@moxt-ai/mobius 0.0.26 → 0.0.28

package/dist/runtime.js

@@ -5,7 +5,7 @@ var __export = (target, all) => {
 };
 
 // src/runtime.ts
-import { mkdir as mkdir5, realpath as realpath8, stat as stat8 } from "node:fs/promises";
+import { mkdir as mkdir5, realpath as realpath9, stat as stat9 } from "node:fs/promises";
 import { dirname as dirname8, join as join17, resolve as resolve5 } from "node:path";
 
 // src/agent-catalog/local-agent.ts
@@ -2524,7 +2524,7 @@ var AuditStore = class {
       this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
     }
   }
-  record(record2) {
+  record(record3) {
     this.database.prepare(
       `
           INSERT INTO audit_events (
@@ -2537,10 +2537,10 @@ var AuditStore = class {
         `
     ).run(
       (/* @__PURE__ */ new Date()).toISOString(),
-      record2.event,
-      record2.commandId,
-      record2.sessionId,
-      JSON.stringify(record2.details ?? {})
+      record3.event,
+      record3.commandId,
+      record3.sessionId,
+      JSON.stringify(record3.details ?? {})
     );
   }
   close() {
@@ -18603,8 +18603,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = /* @__PURE__ */ new Map();
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -21561,6 +21561,7 @@ var elicitationFieldSchema = external_exports.strictObject({
   type: external_exports.enum(["boolean", "integer", "multiselect", "number", "select", "string"])
 }).readonly();
 var displayContentSchema = external_exports.strictObject({
+  artifactId: external_exports.string().max(128).default(""),
   data: external_exports.string().max(4e6),
   mimeType: external_exports.string().max(255),
   name: external_exports.string().max(500),
@@ -21573,6 +21574,7 @@ var displayContentSchema = external_exports.strictObject({
   uri: external_exports.string().max(4096)
 }).readonly();
 var recordedDisplayContentSchema = external_exports.strictObject({
+  artifactId: external_exports.string().max(128).default(""),
   data: external_exports.string().max(4e6),
   mimeType: external_exports.string().max(255),
   name: external_exports.string().max(500),
@@ -21856,6 +21858,9 @@ var SESSION_CANCEL_KIND = "session.cancel";
 var RUNTIME_LIVENESS_READY_KIND = "runtime.liveness.ready";
 var RUNTIME_HEARTBEAT_KIND = "runtime.heartbeat";
 var RUNTIME_HEARTBEAT_ACK_KIND = "runtime.heartbeat.ack";
+var RUNTIME_DELIVERY_KIND = "runtime.delivery";
+var RUNTIME_DELIVERY_RECEIVED_KIND = "runtime.delivery.received";
+var RUNTIME_DELIVERY_COMMITTED_KIND = "runtime.delivery.committed";
 var SESSION_STARTED_KIND = "session.started";
 var AGENT_MESSAGE_DELTA_KIND = "agent.message.delta";
 var AGENT_ACTIVITY_KIND = "agent.activity";
@@ -21878,6 +21883,7 @@ var DIRECTORY_IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
 var MAX_PROMPT_LENGTH = 1e4;
 var MAX_PROMPT_ATTACHMENT_LENGTH = 6e6;
 var MAX_EVENT_TEXT_LENGTH = 1e5;
+var MAX_RUNTIME_DELIVERY_PAYLOAD_LENGTH = 8 * 1024 * 1024;
 var ACTIVITY_TYPES = /* @__PURE__ */ new Set(["plan", "progress", "reasoning", "tool"]);
 var ACTIVITY_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "completed", "failed"]);
 var TOOL_KINDS = /* @__PURE__ */ new Set([
@@ -22156,6 +22162,37 @@ function decodeRuntimeHeartbeatAckEvent(encoded) {
     kind: RUNTIME_HEARTBEAT_ACK_KIND
   };
 }
+function decodeRuntimeDelivery(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "payload", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_KIND,
+    payload: readString(value, "payload", MAX_RUNTIME_DELIVERY_PAYLOAD_LENGTH),
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function decodeRuntimeDeliveryReceived(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_RECEIVED_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function decodeRuntimeDeliveryCommitted(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_COMMITTED_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_COMMITTED_KIND,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
 function decodeSessionStartedEvent(encoded) {
   const value = parseJson2(encoded);
   assertExactKeys(value, ["commandId", "kind", "attemptId", "sessionId"]);
@@ -22243,6 +22280,9 @@ function decodeSessionFailedEvent(encoded) {
 function encodeRuntimeHeartbeatEvent(message) {
   return JSON.stringify(decodeRuntimeHeartbeatEvent(JSON.stringify(message)));
 }
+function encodeRuntimeDeliveryReceived(message) {
+  return JSON.stringify(decodeRuntimeDeliveryReceived(JSON.stringify(message)));
+}
 function encodeSessionStartedEvent(message) {
   return JSON.stringify(decodeSessionStartedEvent(JSON.stringify(message)));
 }
@@ -22941,7 +22981,8 @@ var SESSION_EVENT_COMMITTED_KIND = "session.event.committed";
 var SESSION_EVENT_REJECTED_KIND = "session.event.rejected";
 var SessionEventRejectionCode = {
   SessionDeleted: "session_deleted",
-  SessionNotFound: "session_not_found"
+  SessionNotFound: "session_not_found",
+  SessionRejected: "session_rejected"
 };
 var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CURSOR_PATTERN = /^[A-Za-z0-9_-]{1,512}$/;
@@ -23038,9 +23079,9 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { basename as basename3, join as join15 } from "node:path";
+import { basename as basename4, join as join15 } from "node:path";
 import { styleText } from "node:util";
-import { fetch as fetch5, WebSocket as WebSocket2 } from "undici";
+import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
 
 // src/acp/session-manager.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -23051,6 +23092,212 @@ import {
   RequestError as RequestError2
 } from "@agentclientprotocol/sdk";
 
+// src/authorization/local-raster.ts
+import { readFile, realpath as realpath6, stat as stat5 } from "node:fs/promises";
+import { basename, isAbsolute as isAbsolute7, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
+import { fileURLToPath } from "node:url";
+var MAX_LOCAL_RASTER_BYTES = 3e6;
+var PNG_SIGNATURE = Uint8Array.of(137, 80, 78, 71);
+var JPEG_SIGNATURE = Uint8Array.of(255, 216, 255);
+var GIF87_SIGNATURE = new TextEncoder().encode("GIF87a");
+var GIF89_SIGNATURE = new TextEncoder().encode("GIF89a");
+var RIFF_SIGNATURE = new TextEncoder().encode("RIFF");
+var WEBP_SIGNATURE = new TextEncoder().encode("WEBP");
+var LocalRasterImage = class {
+  bytes;
+  mimeType;
+  name;
+  constructor(name, mimeType, bytes) {
+    this.bytes = bytes;
+    this.mimeType = mimeType;
+    this.name = name;
+  }
+  base64 = () => Buffer.from(this.bytes).toString("base64");
+};
+function startsWith(bytes, signature, offset = 0) {
+  if (bytes.byteLength < offset + signature.byteLength) {
+    return false;
+  }
+  return signature.every((value, index) => bytes[offset + index] === value);
+}
+function sniffRasterMime(bytes) {
+  if (startsWith(bytes, PNG_SIGNATURE)) {
+    return "image/png";
+  }
+  if (startsWith(bytes, JPEG_SIGNATURE)) {
+    return "image/jpeg";
+  }
+  if (startsWith(bytes, GIF87_SIGNATURE) || startsWith(bytes, GIF89_SIGNATURE)) {
+    return "image/gif";
+  }
+  if (startsWith(bytes, RIFF_SIGNATURE) && startsWith(bytes, WEBP_SIGNATURE, 8)) {
+    return "image/webp";
+  }
+  return null;
+}
+function isInsideRoot(root, target) {
+  const relation = relative4(root, target);
+  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute7(relation);
+}
+async function resolveCanonicalPath(requested, signal) {
+  signal.throwIfAborted();
+  if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+    return null;
+  }
+  try {
+    const target = await realpath6(requested);
+    signal.throwIfAborted();
+    if (!isAbsolute7(target) || normalize2(target) !== target) {
+      return null;
+    }
+    return target;
+  } catch (cause) {
+    signal.throwIfAborted();
+    if (cause instanceof Error && cause.name === "AbortError") {
+      throw cause;
+    }
+    return null;
+  }
+}
+function parseLocalImageUri(uri) {
+  const trimmed = uri.trim();
+  if (trimmed.length === 0 || trimmed.length > 2048 || trimmed.includes("\0")) {
+    return null;
+  }
+  if (trimmed.startsWith("data:")) {
+    return null;
+  }
+  if (trimmed.startsWith("file:")) {
+    try {
+      const url2 = new URL(trimmed);
+      if (url2.protocol !== "file:" || url2.host.length > 0) {
+        return null;
+      }
+      return fileURLToPath(url2);
+    } catch {
+      return null;
+    }
+  }
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+  return trimmed;
+}
+async function readAuthorizedRaster(uri, roots, signal) {
+  signal.throwIfAborted();
+  const requested = parseLocalImageUri(uri);
+  if (requested === null) {
+    return null;
+  }
+  const target = await resolveCanonicalPath(requested, signal);
+  if (target === null) {
+    return null;
+  }
+  const targetMetadata = await stat5(target);
+  signal.throwIfAborted();
+  if (!targetMetadata.isFile() || targetMetadata.size < 1 || targetMetadata.size > MAX_LOCAL_RASTER_BYTES) {
+    return null;
+  }
+  const authorizedRoots = [];
+  for (const root of roots) {
+    const directory = await resolveCanonicalPath(root, signal);
+    if (directory === null) {
+      continue;
+    }
+    const metadata = await stat5(directory);
+    signal.throwIfAborted();
+    if (metadata.isDirectory()) {
+      authorizedRoots.push(directory);
+    }
+  }
+  if (!authorizedRoots.some((root) => isInsideRoot(root, target))) {
+    return null;
+  }
+  const bytes = new Uint8Array(await readFile(target));
+  signal.throwIfAborted();
+  if (bytes.byteLength < 1 || bytes.byteLength > MAX_LOCAL_RASTER_BYTES) {
+    return null;
+  }
+  const mimeType = sniffRasterMime(bytes);
+  if (mimeType === null) {
+    return null;
+  }
+  return new LocalRasterImage(basename(target) || "Image", mimeType, bytes);
+}
+
+// src/native-sessions/history-images.ts
+var IMAGE_MARKER = /\[@image\]\(([^)\r\n]*)(?:\)|$)/g;
+async function embedLocalHistoryImages(history, roots, signal) {
+  if (history.status !== "available") {
+    return history;
+  }
+  const messages = [];
+  let imageCharacters = 0;
+  for (const message of history.messages) {
+    signal.throwIfAborted();
+    const resolved = await resolveMessageImages(message, roots, imageCharacters, signal);
+    imageCharacters += (resolved.images ?? []).reduce((size, image) => size + image.data.length, 0);
+    messages.push(resolved);
+  }
+  return {
+    ...history,
+    messages
+  };
+}
+async function resolveMessageImages(message, roots, usedCharacters, signal) {
+  const images = [...message.images ?? []];
+  let imageCharacters = images.reduce((size, image) => size + image.data.length, 0);
+  const text = await replaceImageMarkers(message.text, async (uri) => {
+    if (images.length >= 8 || usedCharacters + imageCharacters >= SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      return "[Image unavailable]";
+    }
+    const embedded = parseNativeHistoryText(`[@image](${uri})`).images[0];
+    if (embedded !== void 0) {
+      if (usedCharacters + imageCharacters + embedded.data.length > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+        return "[Image unavailable]";
+      }
+      images.push(embedded);
+      imageCharacters += embedded.data.length;
+      return "";
+    }
+    const local = await readAuthorizedRaster(uri, roots, signal);
+    if (local === null) {
+      return "[Image unavailable]";
+    }
+    const data = local.base64();
+    if (usedCharacters + imageCharacters + data.length > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      return "[Image unavailable]";
+    }
+    images.push({
+      data,
+      mimeType: local.mimeType,
+      name: local.name
+    });
+    imageCharacters += data.length;
+    return "";
+  });
+  return {
+    ...message,
+    text,
+    ...images.length > 0 ? { images } : {}
+  };
+}
+async function replaceImageMarkers(text, replace) {
+  const matches = [...text.matchAll(IMAGE_MARKER)];
+  if (matches.length === 0) {
+    return text;
+  }
+  let cursor = 0;
+  let rewritten = "";
+  for (const match of matches) {
+    const index = match.index ?? 0;
+    rewritten += text.slice(cursor, index);
+    rewritten += await replace(match[1] ?? "");
+    cursor = index + match[0].length;
+  }
+  return `${rewritten}${text.slice(cursor)}`;
+}
+
 // src/acp/activity.ts
 var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
 function isRecord6(value) {
@@ -23148,6 +23395,7 @@ function readContentOutputDetail(content) {
 function summarizeDisplayContent(content) {
   return {
     ...content,
+    artifactId: truncate(content.artifactId, 128),
     data: truncate(content.data, AGENT_ACTIVITY_DETAIL_LIMIT),
     mimeType: truncate(content.mimeType, 255),
     name: truncate(content.name, 500),
@@ -23160,7 +23408,7 @@ function summarizeDisplayContent(content) {
   };
 }
 function contentFitsRecordingEnvelope(content) {
-  return content.data.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.mimeType.length <= 255 && content.name.length <= 500 && content.newText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.oldText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.path.length <= 2048 && content.terminalId.length <= 255 && content.text.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.uri.length <= 4096;
+  return content.artifactId.length <= 128 && content.data.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.mimeType.length <= 255 && content.name.length <= 500 && content.newText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.oldText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.path.length <= 2048 && content.terminalId.length <= 255 && content.text.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.uri.length <= 4096;
 }
 function encodedByteLength(value) {
   return new TextEncoder().encode(JSON.stringify(value)).byteLength;
@@ -23186,6 +23434,7 @@ function recordedDetail(activity) {
 }
 function emptyDisplayContent(type) {
   return {
+    artifactId: "",
     data: "",
     mimeType: "",
     name: "",
@@ -23198,6 +23447,16 @@ function emptyDisplayContent(type) {
     uri: ""
   };
 }
+function imageDisplayContent(mimeType, name, data, artifactId = "", uri = "") {
+  return {
+    ...emptyDisplayContent("image"),
+    artifactId,
+    data,
+    mimeType,
+    name,
+    uri
+  };
+}
 function normalizeContentBlock(content) {
   if (content.type === "text") {
     return { ...emptyDisplayContent("text"), text: content.text };
@@ -23989,7 +24248,6 @@ var AcpHistoryReplay = class {
   #messages = [];
   #lastMessageId = null;
   #characters = 0;
-  #imageCharacters = 0;
   #truncated = false;
   record = (update) => {
     if (update.sessionUpdate !== "user_message_chunk" && update.sessionUpdate !== "agent_message_chunk") {
@@ -24000,40 +24258,30 @@ var AcpHistoryReplay = class {
     }
     const role = update.sessionUpdate === "user_message_chunk" ? "user" : "assistant";
     const content = update.content;
-    const parsed = parseNativeHistoryText(
-      content.type === "text" ? content.text : content.type === "image" ? `[@image](data:${content.mimeType};base64,${content.data})` : `[${content.type} attachment]`
-    );
-    const text = parsed.text;
-    if (text.length === 0 && parsed.images.length === 0) {
+    const text = content.type === "text" ? content.text : content.type === "image" ? content.data.length > 0 ? `[@image](data:${content.mimeType};base64,${content.data})` : content.uri != null && content.uri.length > 0 ? `[@image](${content.uri})` : "[image attachment]" : `[${content.type} attachment]`;
+    if (text.length === 0) {
       return;
     }
     const previous = this.#messages.at(-1);
     const id = update.messageId ?? null;
     const continuation = previous?.role === role && id === this.#lastMessageId;
     const combined = continuation ? `${previous.text}${text}` : text;
-    const allImages = continuation ? [...previous.images ?? [], ...parsed.images] : parsed.images;
-    const images = allImages.slice(0, 8);
-    this.#truncated ||= images.length < allImages.length;
     if (continuation) {
       this.#messages.pop();
       this.#characters -= previous.text.length;
-      this.#imageCharacters -= (previous.images ?? []).reduce((size, image) => size + image.data.length, 0);
     }
     const bounded = combined.slice(-SESSION_HISTORY_CHARACTER_LIMIT);
     this.#truncated ||= bounded.length < combined.length;
     this.#messages.push({
       role,
-      text: bounded,
-      ...images.length > 0 ? { images } : {}
+      text: bounded
     });
     this.#characters += bounded.length;
-    this.#imageCharacters += images.reduce((size, image) => size + image.data.length, 0);
     this.#lastMessageId = id;
-    while (this.#messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || this.#characters > SESSION_HISTORY_CHARACTER_LIMIT || this.#imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+    while (this.#messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || this.#characters > SESSION_HISTORY_CHARACTER_LIMIT) {
       const removed = this.#messages.shift();
       if (removed !== void 0) {
         this.#characters -= removed.text.length;
-        this.#imageCharacters -= (removed.images ?? []).reduce((size, image) => size + image.data.length, 0);
       }
       this.#truncated = true;
     }
@@ -24256,6 +24504,10 @@ var MAX_PRE_SESSION_UPDATES = 100;
 var MAX_PRE_SESSION_UPDATE_BYTES = 1024 * 1024;
 var SESSION_CONTROL_COMMAND_ID = "session-control";
 var NullAcpSessionObserver = class {
+  importLocalImage = (_sessionId, _image, signal) => {
+    signal.throwIfAborted();
+    return Promise.resolve("");
+  };
   onCommands = () => Promise.resolve();
   onConfig = () => Promise.resolve();
   onContent = () => Promise.resolve();
@@ -24878,11 +25130,75 @@ var AcpProcessSession = class _AcpProcessSession {
       );
       await this.#updateTail;
       signal.throwIfAborted();
-      return history.snapshot();
+      return await embedLocalHistoryImages(
+        history.snapshot(),
+        [this.#cwd, ...this.#additionalDirectories],
+        signal
+      );
     } finally {
       this.#replay = { kind: "idle" };
     }
   };
+  imageRoots = () => [this.#cwd, ...this.#additionalDirectories];
+  emitAgentText = async (text, messageId) => {
+    const signal = AbortSignal.timeout(2e4);
+    const parts = text.split(/(\[@image\]\([^)\r\n]*(?:\)|$))/);
+    let leftover = "";
+    for (const part of parts) {
+      const marker = /^\[@image\]\(([^)\r\n]*)(?:\)|$)/.exec(part);
+      if (marker === null) {
+        leftover += part;
+        continue;
+      }
+      if (leftover.length > 0) {
+        await this.#turn.onText(leftover, messageId);
+        leftover = "";
+      }
+      const raster = await readAuthorizedRaster(marker[1] ?? "", this.imageRoots(), signal);
+      if (raster === null) {
+        leftover += "[Image unavailable]";
+        continue;
+      }
+      await this.emitRaster(raster, messageId, signal);
+    }
+    if (leftover.length > 0) {
+      await this.#turn.onText(leftover, messageId);
+    }
+  };
+  emitAgentContent = async (content, messageId) => {
+    if (content.type === "image" && content.data.length === 0 && content.uri.length > 0) {
+      const signal = AbortSignal.timeout(2e4);
+      const raster = await readAuthorizedRaster(content.uri, this.imageRoots(), signal);
+      if (raster !== null) {
+        await this.emitRaster(raster, messageId, signal);
+        return;
+      }
+    }
+    await this.#getObserver().onContent({
+      commandId: this.#turn.commandId,
+      content,
+      contentId: `content-${crypto.randomUUID()}`,
+      kind: AGENT_CONTENT_KIND,
+      messageId,
+      sessionId: this.#mobiusSessionId
+    });
+  };
+  emitRaster = async (raster, messageId, signal) => {
+    const artifactId = await this.#getObserver().importLocalImage(this.#mobiusSessionId, raster, signal);
+    await this.#getObserver().onContent({
+      commandId: this.#turn.commandId,
+      content: imageDisplayContent(
+        raster.mimeType,
+        raster.name,
+        artifactId.length > 0 ? "" : raster.base64(),
+        artifactId
+      ),
+      contentId: `content-${crypto.randomUUID()}`,
+      kind: AGENT_CONTENT_KIND,
+      messageId,
+      sessionId: this.#mobiusSessionId
+    });
+  };
   async #initializeAgent(signal) {
     const initialized = await this.race(
       this.#connection.agent.request(
@@ -25585,18 +25901,14 @@ var AcpProcessSession = class _AcpProcessSession {
           );
         } else {
           await this.#turn.activities.finishNarrative();
-          await this.#turn.onText(update.content.text, truncate3(update.messageId ?? "", 255));
+          await this.emitAgentText(update.content.text, truncate3(update.messageId ?? "", 255));
         }
       } else {
         await this.#turn.activities.finishNarrative();
-        await this.#getObserver().onContent({
-          commandId: this.#turn.commandId,
-          content: normalizeContentBlock(update.content),
-          contentId: `content-${crypto.randomUUID()}`,
-          kind: AGENT_CONTENT_KIND,
-          messageId: truncate3(update.messageId ?? "", 255),
-          sessionId: this.#mobiusSessionId
-        });
+        await this.emitAgentContent(
+          normalizeContentBlock(update.content),
+          truncate3(update.messageId ?? "", 255)
+        );
       }
       return;
     }
@@ -26418,6 +26730,23 @@ var AcpSessionManager = class {
 
 // src/agent-catalog/publish-agent-catalog.ts
 import { fetch as fetch2 } from "undici";
+
+// src/relay-connection/runtime-authentication.ts
+function runtimeCredential(relayUrl) {
+  return relayUrl.searchParams.get("token") ?? "";
+}
+function runtimeAuthorization(relayUrl) {
+  const credential = runtimeCredential(relayUrl);
+  return credential.length === 0 ? {} : { authorization: `Bearer ${credential}` };
+}
+function relayHttpEndpoint(relayUrl) {
+  const endpoint = new URL(relayUrl);
+  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  endpoint.search = "";
+  return endpoint;
+}
+
+// src/agent-catalog/publish-agent-catalog.ts
 var CATALOG_UPDATE_TIMEOUT_MILLISECONDS = 2e4;
 var AgentCatalogPublishError = class extends Error {
   code = "agent_catalog_update_failed";
@@ -26427,8 +26756,7 @@ var AgentCatalogPublishError = class extends Error {
   }
 };
 function catalogEndpoint(config2) {
-  const endpoint = new URL(config2.relayUrl);
-  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  const endpoint = relayHttpEndpoint(config2.relayUrl);
   if (endpoint.pathname.endsWith("/daemon")) {
     endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
     return endpoint;
@@ -26459,7 +26787,7 @@ async function publishAgentCatalog(config2, signal) {
         installableAgents: catalog.installableAgents
       }),
       dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
+      headers: { ...runtimeAuthorization(config2.relayUrl), "content-type": "application/json" },
       method: "PUT",
       signal: requestSignal
     });
@@ -26941,114 +27269,510 @@ var FixedInstallationExecutor = class {
   };
 };
 
-// src/authorization/local-authorization-error.ts
-var LocalAuthorizationError = class extends Error {
-  code = "local_authorization_failed";
-  constructor(message, options = {}) {
+// src/artifacts/runtime-artifact-uploader.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../mobius-sdk/src/errors.ts
+var MobiusError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
     super(message, options);
-    this.name = "LocalAuthorizationError";
+    this.code = code;
+    this.name = "MobiusError";
   }
 };
-
-// src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath6, stat as stat5 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename, dirname as dirname5, isAbsolute as isAbsolute7, join as join14, normalize as normalize2, relative as relative4 } from "node:path";
-var WorkspaceDirectoryListing = class {
-  directoryId;
-  directoryLabel;
-  entries;
-  parentDirectoryId;
-  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
-    this.directoryId = directoryId2;
-    this.directoryLabel = directoryLabel;
-    this.entries = entries;
-    this.parentDirectoryId = parentDirectoryId;
+var MobiusProtocolError = class extends MobiusError {
+  constructor(message, options = {}) {
+    super("invalid_service_response", message, options);
+    this.name = "MobiusProtocolError";
   }
 };
-function encodePath(path2) {
-  const encoded = Buffer.from(path2, "utf8").toString("base64url");
-  if (encoded.length === 0 || encoded.length > 2e3) {
-    throw new LocalAuthorizationError("The local directory path is too long to select");
+var MobiusValidationError = class extends MobiusError {
+  constructor(message, options = {}) {
+    super("invalid_request", message, options);
+    this.name = "MobiusValidationError";
   }
-  return `path-${encoded}`;
+};
+
+// ../mobius-sdk/src/resources.ts
+var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function invalidResponse(message) {
+  return new MobiusProtocolError(message);
 }
-function decodePath(value, prefix) {
-  const encoded = value.slice(prefix.length);
-  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function record2(value, name) {
+  if (!isRecord9(value)) {
+    throw invalidResponse(`The service returned an invalid ${name}`);
   }
-  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize2(decoded) !== decoded) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
+  return value;
+}
+function stringField(value, field, maximumLength = 85e5) {
+  const candidate = value[field];
+  if (typeof candidate !== "string" || candidate.length > maximumLength) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
   }
-  return decoded;
+  return candidate;
 }
-var WorkspaceDirectoryService = class {
-  #bindingId;
-  #defaultWorkspace;
-  constructor(bindingId, defaultWorkspace) {
-    this.#bindingId = bindingId;
-    this.#defaultWorkspace = defaultWorkspace;
+function identifierField(value, field) {
+  const candidate = stringField(value, field, 128);
+  if (!IDENTIFIER_PATTERN5.test(candidate)) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
   }
-  authorizeMachine = (bindingId) => {
-    if (bindingId !== this.#bindingId) {
-      throw new LocalAuthorizationError("The runtime binding is not authorized");
-    }
-  };
-  requestedPath = (id) => {
-    if (id === "default") {
-      return this.#defaultWorkspace;
-    }
-    if (id === "home") {
-      return homedir2();
-    }
-    if (id.startsWith("path-")) {
-      const path2 = decodePath(id, "path-");
-      if (isAbsolute7(path2)) {
-        return path2;
-      }
-    }
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  };
-  resolvePath = async (requested, signal) => {
-    signal.throwIfAborted();
-    if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
-      throw new LocalAuthorizationError("The local directory path is invalid");
-    }
-    try {
-      const target = await realpath6(requested);
-      signal.throwIfAborted();
-      const metadata = await stat5(target);
-      signal.throwIfAborted();
-      if (!isAbsolute7(target) || normalize2(target) !== target || !metadata.isDirectory()) {
-        throw new LocalAuthorizationError("The selected location is not a directory");
-      }
-      return target;
-    } catch (cause) {
-      signal.throwIfAborted();
-      if (cause instanceof LocalAuthorizationError) {
-        throw cause;
-      }
-      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
-        cause
-      });
+  return candidate;
+}
+function integerField(value, field) {
+  const candidate = value[field];
+  if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 0) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return candidate;
+}
+function validateTimestamp(value, field) {
+  if (Number.isNaN(Date.parse(value))) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return value;
+}
+var MobiusArtifactUploadRequest = class {
+  byteLength;
+  mediaType;
+  name;
+  sha256;
+  constructor(name, mediaType, byteLength, sha256) {
+    if (name.length < 1 || name.length > 500 || name.includes("\0") || mediaType.length < 1 || mediaType.length > 255 || mediaType.includes("\r") || mediaType.includes("\n") || !Number.isSafeInteger(byteLength) || byteLength < 1 || !/^[a-f0-9]{64}$/.test(sha256)) {
+      throw new MobiusValidationError("The artifact upload request is invalid");
     }
-  };
-  label = (path2) => {
-    const suffix = relative4(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute7(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
-  };
-  identify = async (bindingId, requestedPath, signal) => {
-    this.authorizeMachine(bindingId);
-    const path2 = await this.resolvePath(requestedPath, signal);
-    return {
-      path: path2,
-      directoryId: encodePath(path2),
-      name: basename(path2) || path2,
-      label: this.label(path2)
-    };
-  };
+    this.byteLength = byteLength;
+    this.mediaType = mediaType;
+    this.name = name;
+    this.sha256 = sha256;
+  }
+};
+var MobiusArtifact = class {
+  artifactId;
+  byteLength;
+  createdAt;
+  mediaType;
+  name;
+  sessionId;
+  sha256;
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt) {
+    this.artifactId = artifactId;
+    this.byteLength = byteLength;
+    this.createdAt = createdAt;
+    this.mediaType = mediaType;
+    this.name = name;
+    this.sessionId = sessionId;
+    this.sha256 = sha256;
+  }
+};
+var MobiusUploadingArtifact = class extends MobiusArtifact {
+  expiresAt;
+  state = "uploading";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, expiresAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.expiresAt = expiresAt;
+  }
+};
+var MobiusArtifactUpload = class extends MobiusUploadingArtifact {
+  uploadToken;
+  constructor(artifact, uploadToken) {
+    super(
+      artifact.sessionId,
+      artifact.artifactId,
+      artifact.name,
+      artifact.mediaType,
+      artifact.byteLength,
+      artifact.sha256,
+      artifact.createdAt,
+      artifact.expiresAt
+    );
+    this.uploadToken = uploadToken;
+  }
+};
+var MobiusAvailableArtifact = class extends MobiusArtifact {
+  availableAt;
+  state = "available";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, availableAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.availableAt = availableAt;
+  }
+};
+var MobiusExpiredArtifact = class extends MobiusArtifact {
+  expiredAt;
+  state = "expired";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, expiredAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.expiredAt = expiredAt;
+  }
+};
+function artifactFields(value) {
+  const sha256 = stringField(value, "sha256", 64);
+  if (!/^[a-f0-9]{64}$/.test(sha256)) {
+    throw invalidResponse("The service returned an invalid artifact digest");
+  }
+  return {
+    artifactId: identifierField(value, "artifactId"),
+    byteLength: integerField(value, "byteLength"),
+    createdAt: validateTimestamp(stringField(value, "createdAt", 128), "createdAt"),
+    mediaType: stringField(value, "mediaType", 255),
+    name: stringField(value, "name", 500),
+    sessionId: identifierField(value, "sessionId"),
+    sha256
+  };
+}
+function uploadingArtifact(value) {
+  const fields = artifactFields(value);
+  return new MobiusUploadingArtifact(
+    fields.sessionId,
+    fields.artifactId,
+    fields.name,
+    fields.mediaType,
+    fields.byteLength,
+    fields.sha256,
+    fields.createdAt,
+    validateTimestamp(stringField(value, "expiresAt", 128), "expiresAt")
+  );
+}
+function decodeMobiusArtifactUpload(value) {
+  const artifact = record2(value, "artifact upload authorization");
+  return new MobiusArtifactUpload(uploadingArtifact(artifact), stringField(artifact, "uploadToken", 256));
+}
+function decodeMobiusArtifact(value) {
+  const artifact = record2(value, "artifact");
+  const state = stringField(artifact, "state", 32);
+  if (state === "uploading") {
+    return uploadingArtifact(artifact);
+  }
+  const fields = artifactFields(artifact);
+  if (state === "available") {
+    return new MobiusAvailableArtifact(
+      fields.sessionId,
+      fields.artifactId,
+      fields.name,
+      fields.mediaType,
+      fields.byteLength,
+      fields.sha256,
+      fields.createdAt,
+      validateTimestamp(stringField(artifact, "availableAt", 128), "availableAt")
+    );
+  }
+  if (state === "expired") {
+    return new MobiusExpiredArtifact(
+      fields.sessionId,
+      fields.artifactId,
+      fields.name,
+      fields.mediaType,
+      fields.byteLength,
+      fields.sha256,
+      fields.createdAt,
+      validateTimestamp(stringField(artifact, "expiredAt", 128), "expiredAt")
+    );
+  }
+  throw invalidResponse("The service returned an invalid artifact state");
+}
+function decodeMobiusAvailableArtifact(value) {
+  const artifact = decodeMobiusArtifact(value);
+  if (!(artifact instanceof MobiusAvailableArtifact)) {
+    throw invalidResponse("The service did not make the artifact available");
+  }
+  return artifact;
+}
+var MobiusRuntimePairingLifecycle = Object.freeze({
+  Expired: "expired",
+  Paired: "paired",
+  Pending: "pending",
+  Revoked: "revoked"
+});
+
+// src/artifacts/runtime-artifact-uploader.ts
+import { fetch as fetch3 } from "undici";
+var UPLOAD_TIMEOUT_MILLISECONDS = 2e4;
+var RuntimeArtifactUploadError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "RuntimeArtifactUploadError";
+  }
+};
+var UploadedRuntimeArtifact = class {
+  artifactId;
+  byteLength;
+  mimeType;
+  name;
+  sha256;
+  constructor(artifactId, name, mimeType, byteLength, sha256) {
+    this.artifactId = artifactId;
+    this.byteLength = byteLength;
+    this.mimeType = mimeType;
+    this.name = name;
+    this.sha256 = sha256;
+  }
+};
+function daemonToken(config2) {
+  const token = config2.relayUrl.searchParams.get("token");
+  if (token === null || token.length < 32) {
+    throw new RuntimeArtifactUploadError("artifact_endpoint_invalid", "The Relay daemon token is missing");
+  }
+  return token;
+}
+function channelOrigin(config2) {
+  const url2 = new URL(config2.relayUrl);
+  url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
+  let channelPath = "";
+  if (url2.pathname.endsWith("/daemon")) {
+    channelPath = url2.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = `${MOBIUS_API_PREFIX}/v1/runtimes/connect`;
+    if (!url2.pathname.endsWith("/v1/runtimes/connect") && !url2.pathname.endsWith(runtimePath)) {
+      throw new RuntimeArtifactUploadError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+    }
+    channelPath = `${url2.pathname.replace(/\/v1\/runtimes\/connect$/, "")}/channels/${encodeURIComponent(config2.channelId)}`;
+  }
+  url2.pathname = channelPath;
+  url2.search = "";
+  url2.hash = "";
+  return url2;
+}
+function uploadError(code, message, cause) {
+  return new RuntimeArtifactUploadError(code, message, cause === void 0 ? {} : { cause });
+}
+function translateSdkError(cause) {
+  if (cause instanceof MobiusValidationError) {
+    throw uploadError("artifact_upload_failed", cause.message, cause);
+  }
+  if (cause instanceof MobiusProtocolError) {
+    throw uploadError("artifact_upload_failed", "The Relay returned an invalid upload response", cause);
+  }
+  throw cause;
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch (cause) {
+    throw uploadError("artifact_upload_failed", "The Relay returned an invalid upload response", cause);
+  }
+}
+async function readAuthorization(response) {
+  try {
+    return decodeMobiusArtifactUpload(await readJson(response));
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+}
+function sessionArtifactUrl(origin, sessionId, resourcePath, token) {
+  const url2 = new URL(`${origin.pathname}/sessions/${encodeURIComponent(sessionId)}/${resourcePath}`, origin);
+  url2.searchParams.set("token", token);
+  return url2;
+}
+async function postLease(url2, request, signal) {
+  return await fetch3(url2, {
+    dispatcher: environmentProxyDispatcher,
+    headers: { "content-type": "application/json" },
+    method: "POST",
+    body: JSON.stringify(request),
+    signal
+  });
+}
+async function putContent(url2, authorization, bytes, signal) {
+  return await fetch3(url2, {
+    dispatcher: environmentProxyDispatcher,
+    headers: {
+      "content-type": authorization.mediaType,
+      "x-mobius-upload-token": authorization.uploadToken
+    },
+    method: "PUT",
+    body: bytes,
+    signal
+  });
+}
+async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
+  signal.throwIfAborted();
+  let request;
+  try {
+    request = new MobiusArtifactUploadRequest(
+      image.name,
+      image.mimeType,
+      image.bytes.byteLength,
+      createHash2("sha256").update(image.bytes).digest("hex")
+    );
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+  const timeoutSignal = AbortSignal.timeout(UPLOAD_TIMEOUT_MILLISECONDS);
+  const requestSignal = AbortSignal.any([signal, timeoutSignal]);
+  const origin = channelOrigin(config2);
+  const token = daemonToken(config2);
+  let created;
+  try {
+    created = await postLease(
+      sessionArtifactUrl(origin, sessionId, "artifacts/uploads", token),
+      request,
+      requestSignal
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw uploadError(
+      timeoutSignal.aborted ? "artifact_upload_timeout" : "artifact_upload_failed",
+      timeoutSignal.aborted ? "The artifact upload authorization timed out" : "The artifact upload could not start",
+      cause
+    );
+  }
+  if (!created.ok) {
+    await created.body?.cancel();
+    throw uploadError("artifact_upload_rejected", "The Relay rejected the artifact upload");
+  }
+  const authorization = await readAuthorization(created);
+  let uploaded;
+  try {
+    uploaded = await putContent(
+      sessionArtifactUrl(
+        origin,
+        sessionId,
+        `artifacts/${encodeURIComponent(authorization.artifactId)}/content`,
+        token
+      ),
+      authorization,
+      image.bytes,
+      requestSignal
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw uploadError(
+      timeoutSignal.aborted ? "artifact_upload_timeout" : "artifact_upload_failed",
+      timeoutSignal.aborted ? "The artifact upload timed out" : "The artifact content could not be uploaded",
+      cause
+    );
+  }
+  if (!uploaded.ok) {
+    await uploaded.body?.cancel();
+    throw uploadError("artifact_upload_rejected", "The Relay rejected the artifact content");
+  }
+  try {
+    const available = decodeMobiusAvailableArtifact(await readJson(uploaded));
+    return new UploadedRuntimeArtifact(
+      available.artifactId,
+      available.name,
+      available.mediaType,
+      available.byteLength,
+      available.sha256
+    );
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+}
+
+// src/authorization/local-authorization-error.ts
+var LocalAuthorizationError = class extends Error {
+  code = "local_authorization_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalAuthorizationError";
+  }
+};
+
+// src/authorization/workspace-directory.ts
+import { readdir, realpath as realpath7, stat as stat6 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute8, join as join14, normalize as normalize3, relative as relative5 } from "node:path";
+var WorkspaceDirectoryListing = class {
+  directoryId;
+  directoryLabel;
+  entries;
+  parentDirectoryId;
+  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
+    this.directoryId = directoryId2;
+    this.directoryLabel = directoryLabel;
+    this.entries = entries;
+    this.parentDirectoryId = parentDirectoryId;
+  }
+};
+function encodePath(path2) {
+  const encoded = Buffer.from(path2, "utf8").toString("base64url");
+  if (encoded.length === 0 || encoded.length > 2e3) {
+    throw new LocalAuthorizationError("The local directory path is too long to select");
+  }
+  return `path-${encoded}`;
+}
+function decodePath(value, prefix) {
+  const encoded = value.slice(prefix.length);
+  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
+  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize3(decoded) !== decoded) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  return decoded;
+}
+var WorkspaceDirectoryService = class {
+  #bindingId;
+  #defaultWorkspace;
+  constructor(bindingId, defaultWorkspace) {
+    this.#bindingId = bindingId;
+    this.#defaultWorkspace = defaultWorkspace;
+  }
+  authorizeMachine = (bindingId) => {
+    if (bindingId !== this.#bindingId) {
+      throw new LocalAuthorizationError("The runtime binding is not authorized");
+    }
+  };
+  requestedPath = (id) => {
+    if (id === "default") {
+      return this.#defaultWorkspace;
+    }
+    if (id === "home") {
+      return homedir2();
+    }
+    if (id.startsWith("path-")) {
+      const path2 = decodePath(id, "path-");
+      if (isAbsolute8(path2)) {
+        return path2;
+      }
+    }
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  };
+  resolvePath = async (requested, signal) => {
+    signal.throwIfAborted();
+    if (!isAbsolute8(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
+      throw new LocalAuthorizationError("The local directory path is invalid");
+    }
+    try {
+      const target = await realpath7(requested);
+      signal.throwIfAborted();
+      const metadata = await stat6(target);
+      signal.throwIfAborted();
+      if (!isAbsolute8(target) || normalize3(target) !== target || !metadata.isDirectory()) {
+        throw new LocalAuthorizationError("The selected location is not a directory");
+      }
+      return target;
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) {
+        throw cause;
+      }
+      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
+        cause
+      });
+    }
+  };
+  label = (path2) => {
+    const suffix = relative5(homedir2(), path2);
+    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+  };
+  identify = async (bindingId, requestedPath, signal) => {
+    this.authorizeMachine(bindingId);
+    const path2 = await this.resolvePath(requestedPath, signal);
+    return {
+      path: path2,
+      directoryId: encodePath(path2),
+      name: basename2(path2) || path2,
+      label: this.label(path2)
+    };
+  };
   resolve = async (bindingId, id, signal) => {
     this.authorizeMachine(bindingId);
     return await this.resolvePath(this.requestedPath(id), signal);
@@ -27102,8 +27826,8 @@ var WorkspaceDirectoryService = class {
 };
 
 // src/bots/local-bot-grant-store.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import { stat as stat6 } from "node:fs/promises";
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import { stat as stat7 } from "node:fs/promises";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
 var LocalBotAuthorizationError = class extends Error {
@@ -27147,7 +27871,7 @@ var LocalBotGrant = class {
   }
 };
 function digest(value) {
-  return createHash2("sha256").update(value, "utf8").digest("hex");
+  return createHash3("sha256").update(value, "utf8").digest("hex");
 }
 function agentDigest(agent) {
   return digest(
@@ -27161,7 +27885,7 @@ function agentDigest(agent) {
   );
 }
 async function workspaceDigest(path2) {
-  const metadata = await stat6(path2);
+  const metadata = await stat7(path2);
   if (!metadata.isDirectory()) {
     throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
   }
@@ -27578,12 +28302,12 @@ var BotExecutionContextRegistry = class {
 // src/bots/bot-outbound-ipc.ts
 import { chmod as chmod2, mkdir as mkdir3, unlink } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname6, isAbsolute as isAbsolute8 } from "node:path";
-import { fetch as fetch3 } from "undici";
+import { dirname as dirname6, isAbsolute as isAbsolute9 } from "node:path";
+import { fetch as fetch4 } from "undici";
 var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
 var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
 var BOT_RELAY_TIMEOUT_MILLISECONDS = 2e4;
-var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var WINDOWS_NAMED_PIPE_PREFIX = "\\\\.\\pipe\\";
 var BotOutboundIpcRequest = class {
   contextHandle;
@@ -27597,7 +28321,7 @@ var BotOutboundIpcRequest = class {
     this.text = text;
   }
 };
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeRequest(encoded) {
@@ -27607,7 +28331,7 @@ function decodeRequest(encoded) {
   } catch (cause) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid", { cause });
   }
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
   }
   const keys = Object.keys(value);
@@ -27618,7 +28342,7 @@ function decodeRequest(encoded) {
   const idempotencyKey = value["idempotencyKey"];
   const target = value["target"];
   const text = value["text"];
-  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN5.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN5.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
+  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN6.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN6.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
   }
   return new BotOutboundIpcRequest(contextHandle, idempotencyKey, target, text);
@@ -27640,7 +28364,7 @@ function relayEndpoint(relayUrl, context, target) {
   endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/delivery-targets/${encodeURIComponent(deliveryTargetId)}/messages`;
   return endpoint;
 }
-function daemonToken(relayUrl) {
+function daemonToken2(relayUrl) {
   const token = relayUrl.searchParams.get("token") ?? "";
   if (!/^[a-zA-Z0-9_-]{32,256}$/.test(token)) {
     throw new LocalBotAuthorizationError("bot_service_unavailable", "The Runtime credential is unavailable");
@@ -27657,10 +28381,10 @@ async function decodeRelayResponse(response) {
       cause
     });
   }
-  if (response.status === 202 && isRecord9(value) && typeof value["outboundMessageId"] === "string") {
+  if (response.status === 202 && isRecord10(value) && typeof value["outboundMessageId"] === "string") {
     return value["outboundMessageId"];
   }
-  if (isRecord9(value) && isRecord9(value["error"])) {
+  if (isRecord10(value) && isRecord10(value["error"])) {
     const error61 = value["error"];
     if (typeof error61["code"] === "string" && typeof error61["message"] === "string") {
       throw new LocalBotAuthorizationError(error61["code"], error61["message"]);
@@ -27676,7 +28400,7 @@ var BotOutboundIpcServer = class {
   #usesFilesystemSocket;
   constructor(socketPath, relayUrl, registry2) {
     const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
-    if (usesFilesystemSocket && !isAbsolute8(socketPath)) {
+    if (usesFilesystemSocket && !isAbsolute9(socketPath)) {
       throw new Error("The Bot IPC path must be absolute");
     }
     this.#registry = registry2;
@@ -27693,7 +28417,7 @@ var BotOutboundIpcServer = class {
     if (this.#usesFilesystemSocket) {
       await mkdir3(dirname6(this.#socketPath), { mode: 448, recursive: true });
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord9(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -27728,7 +28452,7 @@ var BotOutboundIpcServer = class {
     }
     if (this.#usesFilesystemSocket) {
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord9(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -27792,10 +28516,10 @@ var BotOutboundIpcServer = class {
     const requestSignal = AbortSignal.any([signal, timeout]);
     let response;
     try {
-      response = await fetch3(relayEndpoint(this.#relayUrl, context, request.target), {
+      response = await fetch4(relayEndpoint(this.#relayUrl, context, request.target), {
         body: JSON.stringify({ idempotencyKey: request.idempotencyKey, text: request.text }),
         headers: {
-          authorization: `Bearer ${daemonToken(this.#relayUrl)}`,
+          authorization: `Bearer ${daemonToken2(this.#relayUrl)}`,
           "content-type": "application/json",
           "x-mobius-bot-execution-capability": context.command.executionCapabilitySecret
         },
@@ -27816,7 +28540,7 @@ var BotOutboundIpcServer = class {
 
 // src/native-sessions/service.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 
 // src/native-sessions/codex-history.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -27849,7 +28573,6 @@ function decodeHistory(thread, value) {
   const page = turnsSchema.parse(value);
   const messages = [];
   let characters = 0;
-  let imageCharacters = 0;
   let truncated = page.nextCursor != null;
   for (const turn of page.data.toReversed()) {
     for (const item of turn.items) {
@@ -27857,22 +28580,19 @@ function decodeHistory(thread, value) {
       let message;
       if (type === "userMessage") {
         const { content } = userMessageSchema.parse(item);
-        const parsed = parseNativeHistoryText(
-          content.map((block) => {
-            const { type: type2 } = itemTypeSchema.parse(block);
-            if (type2 === "text") {
-              return textSchema.parse(block).text;
-            }
-            if (type2 === "image") {
-              return `[@image](${imageSchema.parse(block).url})`;
-            }
-            return "[Attachment]";
-          }).join("")
-        );
+        const text2 = content.map((block) => {
+          const { type: type2 } = itemTypeSchema.parse(block);
+          if (type2 === "text") {
+            return textSchema.parse(block).text;
+          }
+          if (type2 === "image") {
+            return `[@image](${imageSchema.parse(block).url})`;
+          }
+          return "[Attachment]";
+        }).join("");
         message = {
           role: "user",
-          text: parsed.text,
-          ...parsed.images.length > 0 ? { images: parsed.images } : {}
+          text: text2
         };
       } else if (type === "agentMessage") {
         const agent = agentMessageSchema.parse(item);
@@ -27890,12 +28610,10 @@ function decodeHistory(thread, value) {
       truncated ||= text.length < message.text.length;
       messages.push({ ...message, text });
       characters += text.length;
-      imageCharacters += (message.images ?? []).reduce((size, image) => size + image.data.length, 0);
-      while (messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || characters > SESSION_HISTORY_CHARACTER_LIMIT || imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      while (messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || characters > SESSION_HISTORY_CHARACTER_LIMIT) {
         const removed = messages.shift();
         if (removed !== void 0) {
           characters -= removed.text.length;
-          imageCharacters -= (removed.images ?? []).reduce((size, image) => size + image.data.length, 0);
         }
         truncated = true;
       }
@@ -28053,7 +28771,11 @@ async function readCodexHistory(agent, cwd, nativeSessionId, signal) {
         params: { clientInfo: { name: "mobius_history", version: "1.0.0" } }
       });
     }
-    return await response.promise;
+    const snapshot = await response.promise;
+    return {
+      ...snapshot,
+      history: await embedLocalHistoryImages(snapshot.history, [cwd, snapshot.cwd], signal)
+    };
   } finally {
     clearTimeout(timeout);
     signal.removeEventListener("abort", abort);
@@ -28307,7 +29029,7 @@ var NativeSessionService = class {
       }
       resolvedPaths.add(path2);
       additionalDirectories.push(path2);
-      additionalEntries.push({ directoryId: directoryId2, name: basename2(path2) });
+      additionalEntries.push({ directoryId: directoryId2, name: basename3(path2) });
     }
     const listing = await this.#directories.list(this.#config.bindingId, command.directoryId, signal);
     const opened = await this.#sessions.forkSessionAtTurn(
@@ -28446,13 +29168,13 @@ var NativeSessionService = class {
 };
 
 // src/prompt-artifact-resolver.ts
-import { createHash as createHash3 } from "node:crypto";
-import { fetch as fetch4 } from "undici";
+import { createHash as createHash4 } from "node:crypto";
+import { fetch as fetch5 } from "undici";
 var ARTIFACT_SCHEME = "mobius-artifact:";
 var ARTIFACT_DOWNLOAD_TIMEOUT_MILLISECONDS = 2e4;
 var MAX_AGENT_IMAGE_BASE64_LENGTH = 4e6;
 var MAX_AGENT_RESOURCE_BYTE_LENGTH = 1e6;
-var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var PromptArtifactError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -28495,14 +29217,13 @@ function parseReference(resource) {
   const encodedByteLength2 = url2.searchParams.get("byteLength") ?? "";
   const sha256 = url2.searchParams.get("sha256") ?? "";
   const byteLength = Number(encodedByteLength2);
-  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN6.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
+  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN7.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
     throw new PromptArtifactError("artifact_reference_invalid", "The prompt artifact reference is invalid");
   }
   return new PromptArtifactReference(artifactId, byteLength, sha256, resource);
 }
 function downloadUrl(config2, command, reference) {
-  const url2 = new URL(config2.relayUrl);
-  url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
+  const url2 = relayHttpEndpoint(config2.relayUrl);
   let channelPath = "";
   if (url2.pathname.endsWith("/daemon")) {
     channelPath = url2.pathname.slice(0, -"/daemon".length);
@@ -28514,7 +29235,6 @@ function downloadUrl(config2, command, reference) {
     channelPath = `${url2.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
   url2.pathname = `${channelPath}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
-  url2.searchParams.delete("liveness");
   return url2;
 }
 async function responseBytes(response, expectedByteLength, signal) {
@@ -28563,9 +29283,13 @@ async function download(config2, command, reference, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch4(downloadUrl(config2, command, reference), {
+    response = await fetch5(downloadUrl(config2, command, reference), {
       dispatcher: environmentProxyDispatcher,
-      headers: { accept: reference.resource.mimeType },
+      headers: {
+        accept: reference.resource.mimeType,
+        "accept-encoding": "identity",
+        ...runtimeAuthorization(config2.relayUrl)
+      },
       signal: requestSignal
     });
     if (!response.ok) {
@@ -28583,7 +29307,7 @@ async function download(config2, command, reference, signal) {
       );
     }
     const bytes = await responseBytes(response, reference.byteLength, requestSignal);
-    if (createHash3("sha256").update(bytes).digest("hex") !== reference.sha256) {
+    if (createHash4("sha256").update(bytes).digest("hex") !== reference.sha256) {
       throw new PromptArtifactError(
         "artifact_integrity_failed",
         "The prompt artifact failed integrity validation"
@@ -28675,12 +29399,8 @@ function connectRelay(url2, signal) {
   signal.throwIfAborted();
   return new Promise((resolve6, reject) => {
     const endpoint = new URL(url2);
-    const headers = {};
-    if (endpoint.pathname.endsWith("/v1/runtimes/connect")) {
-      const runtimeCredential = endpoint.searchParams.get("token") ?? "";
-      endpoint.searchParams.delete("token");
-      headers["authorization"] = `Bearer ${runtimeCredential}`;
-    }
+    const headers = runtimeAuthorization(endpoint);
+    endpoint.searchParams.delete("token");
     const socket = new WebSocket(endpoint, {
       dispatcher: environmentProxyDispatcher,
       headers
@@ -29003,6 +29723,42 @@ var RelayConnectionLiveness = class {
 import { mkdirSync as mkdirSync3 } from "node:fs";
 import { dirname as dirname7 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
+var DEFAULT_OUTBOX_LIMITS = {
+  criticalEventBytes: 136 * 1024 * 1024,
+  criticalEventCount: 10128,
+  runtimeDeliveryBytes: 64 * 1024 * 1024,
+  runtimeDeliveryCount: 64,
+  standardEventBytes: 128 * 1024 * 1024,
+  standardEventCount: 1e4
+};
+var SessionEventOutboxCapacityError = class extends Error {
+  code = "session_event_outbox_full";
+  constructor() {
+    super("The durable Session event outbox is full");
+    this.name = "SessionEventOutboxCapacityError";
+  }
+};
+var RuntimeDeliveryInboxCapacityError = class extends Error {
+  code = "runtime_delivery_inbox_full";
+  constructor() {
+    super("The durable Runtime delivery inbox is full");
+    this.name = "RuntimeDeliveryInboxCapacityError";
+  }
+};
+var StoredRuntimeDelivery = class {
+  deliveryId;
+  duplicate;
+  payload;
+  sessionId;
+  state;
+  constructor(deliveryId, sessionId, payload, state, duplicate) {
+    this.deliveryId = deliveryId;
+    this.duplicate = duplicate;
+    this.payload = payload;
+    this.sessionId = sessionId;
+    this.state = state;
+  }
+};
 function readPendingEnvelope(row) {
   if (typeof row !== "object" || row === null || Array.isArray(row)) {
     throw new Error("SQLite returned an invalid session event outbox row");
@@ -29013,9 +29769,26 @@ function readPendingEnvelope(row) {
   }
   return envelope2;
 }
+function rowNumber(row, field) {
+  const value = typeof row === "object" && row !== null ? Reflect.get(row, field) : void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`SQLite returned an invalid ${field} value`);
+  }
+  return value;
+}
+function rowString2(row, field) {
+  const value = typeof row === "object" && row !== null ? Reflect.get(row, field) : void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`SQLite returned an invalid ${field} value`);
+  }
+  return value;
+}
 var SessionEventOutbox = class {
   #database;
-  constructor(path2) {
+  #limits;
+  constructor(path2, limits = DEFAULT_OUTBOX_LIMITS) {
+    validateLimits(limits);
+    this.#limits = limits;
     mkdirSync3(dirname7(path2), { recursive: true });
     this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
@@ -29024,6 +29797,7 @@ var SessionEventOutbox = class {
         event_id TEXT NOT NULL UNIQUE,
         session_id TEXT NOT NULL,
         source_key TEXT NOT NULL,
+        byte_length INTEGER NOT NULL,
         envelope_json TEXT NOT NULL
       ) STRICT;
       CREATE INDEX IF NOT EXISTS relay_session_event_outbox_order
@@ -29034,7 +29808,7 @@ var SessionEventOutbox = class {
         session_id TEXT NOT NULL,
         envelope_json TEXT NOT NULL,
         rejection_code TEXT NOT NULL CHECK (
-          rejection_code IN ('session_deleted', 'session_not_found')
+          rejection_code IN ('session_deleted', 'session_not_found', 'session_rejected')
         )
       ) STRICT;
       CREATE TABLE IF NOT EXISTS relay_session_event_sources (
@@ -29050,7 +29824,53 @@ var SessionEventOutbox = class {
           state IN ('dispatching', 'running', 'succeeded', 'failed', 'cancelled')
         )
       ) STRICT;
+      CREATE TABLE IF NOT EXISTS relay_session_event_outbox_state (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        event_count INTEGER NOT NULL,
+        total_bytes INTEGER NOT NULL
+      ) STRICT;
+      INSERT OR IGNORE INTO relay_session_event_outbox_state (
+        singleton, event_count, total_bytes
+      ) VALUES (1, 0, 0);
+      CREATE TABLE IF NOT EXISTS relay_runtime_deliveries (
+        delivery_id TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        payload_json TEXT NOT NULL,
+        payload_bytes INTEGER NOT NULL,
+        state TEXT NOT NULL CHECK (
+          state IN ('received', 'relay_committed', 'processed')
+        ),
+        received_at INTEGER NOT NULL
+      ) STRICT;
     `);
+    const deadLetterTable = this.#database.prepare(
+      `SELECT sql FROM sqlite_master
+                 WHERE type = 'table' AND name = 'relay_session_event_dead_letters'`
+    ).get();
+    const deadLetterSql = typeof deadLetterTable === "object" && deadLetterTable !== null ? Reflect.get(deadLetterTable, "sql") : void 0;
+    if (typeof deadLetterSql !== "string" || !deadLetterSql.includes("'session_rejected'")) {
+      this.#database.exec(`
+        BEGIN IMMEDIATE;
+        ALTER TABLE relay_session_event_dead_letters
+          RENAME TO relay_session_event_dead_letters_legacy;
+        CREATE TABLE relay_session_event_dead_letters (
+          ordinal INTEGER PRIMARY KEY,
+          event_id TEXT NOT NULL UNIQUE,
+          session_id TEXT NOT NULL,
+          envelope_json TEXT NOT NULL,
+          rejection_code TEXT NOT NULL CHECK (
+            rejection_code IN ('session_deleted', 'session_not_found', 'session_rejected')
+          )
+        ) STRICT;
+        INSERT INTO relay_session_event_dead_letters (
+          ordinal, event_id, session_id, envelope_json, rejection_code
+        )
+        SELECT ordinal, event_id, session_id, envelope_json, rejection_code
+        FROM relay_session_event_dead_letters_legacy;
+        DROP TABLE relay_session_event_dead_letters_legacy;
+        COMMIT;
+      `);
+    }
     const outboxColumns = this.#database.prepare("PRAGMA table_info(relay_session_event_outbox)").all();
     const hasSourceKey = outboxColumns.some(
       (column) => typeof column === "object" && column !== null && Reflect.get(column, "name") === "source_key"
@@ -29061,6 +29881,15 @@ var SessionEventOutbox = class {
           ADD COLUMN source_key TEXT NOT NULL DEFAULT '';
       `);
     }
+    const hasByteLength = outboxColumns.some(
+      (column) => typeof column === "object" && column !== null && Reflect.get(column, "name") === "byte_length"
+    );
+    if (!hasByteLength) {
+      this.#database.exec(`
+        ALTER TABLE relay_session_event_outbox
+          ADD COLUMN byte_length INTEGER NOT NULL DEFAULT 0;
+      `);
+    }
     this.#database.exec(`
       UPDATE relay_session_event_outbox
       SET source_key = CASE json_extract(envelope_json, '$.source.kind')
@@ -29069,6 +29898,16 @@ var SessionEventOutbox = class {
         ELSE 'runtime:' || session_id
       END
       WHERE source_key = '';
+      UPDATE relay_session_event_outbox
+      SET byte_length = length(CAST(envelope_json AS BLOB))
+      WHERE byte_length = 0;
+      UPDATE relay_session_event_outbox_state
+      SET event_count = (SELECT COUNT(*) FROM relay_session_event_outbox),
+          total_bytes = (
+            SELECT COALESCE(SUM(byte_length), 0)
+            FROM relay_session_event_outbox
+          )
+      WHERE singleton = 1;
       CREATE INDEX IF NOT EXISTS relay_session_event_outbox_source_order
         ON relay_session_event_outbox(source_key, ordinal);
     `);
@@ -29129,13 +29968,19 @@ var SessionEventOutbox = class {
     const state = typeof row === "object" && row !== null ? Reflect.get(row, "state") : void 0;
     return state === "succeeded" || state === "failed" || state === "cancelled";
   };
-  acknowledge = (acknowledgement) => this.#database.prepare(
-    `DELETE FROM relay_session_event_outbox
-         WHERE event_id = ? AND session_id = ?`
-  ).run(acknowledgement.eventId, acknowledgement.sessionId).changes === 1;
+  acknowledge = (acknowledgement) => this.#removeAcknowledgedEvent(acknowledgement.eventId, acknowledgement.sessionId);
   quarantine = (rejection) => {
     this.#database.exec("BEGIN IMMEDIATE");
     try {
+      const stored = this.#database.prepare(
+        `SELECT byte_length FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).get(rejection.eventId, rejection.sessionId);
+      if (stored === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const byteLength = rowNumber(stored, "byte_length");
       const insertion = this.#database.prepare(
         `INSERT INTO relay_session_event_dead_letters (
              ordinal, event_id, session_id, envelope_json, rejection_code
@@ -29155,6 +30000,7 @@ var SessionEventOutbox = class {
       if (deletion.changes !== 1) {
         throw new Error("The rejected session event could not be removed from the durable outbox");
       }
+      this.#decrementEventState(byteLength);
       this.#database.exec("COMMIT");
       return true;
     } catch (error61) {
@@ -29166,7 +30012,129 @@ var SessionEventOutbox = class {
     this.#database.close();
   };
   enqueue = (sessionId, payload, attemptId = null) => {
-    const sourceKey = attemptId === null ? `runtime:${sessionId}` : `attempt:${sessionId}:${attemptId}`;
+    return this.#enqueueBounded(
+      sessionId,
+      payload,
+      attemptId ?? "",
+      this.#limits.standardEventCount,
+      this.#limits.standardEventBytes
+    );
+  };
+  enqueueCritical = (sessionId, payload, attemptId = "") => this.#enqueueBounded(
+    sessionId,
+    payload,
+    attemptId,
+    this.#limits.criticalEventCount,
+    this.#limits.criticalEventBytes
+  );
+  claimRuntimeDelivery = (delivery) => {
+    const payloadBytes = new TextEncoder().encode(delivery.payload).byteLength;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const existing = this.#database.prepare(
+        `SELECT session_id, payload_json, state
+                     FROM relay_runtime_deliveries
+                     WHERE delivery_id = ?`
+      ).get(delivery.deliveryId);
+      if (existing !== void 0) {
+        const sessionId = rowString2(existing, "session_id");
+        const payload = rowString2(existing, "payload_json");
+        const state = runtimeDeliveryState(existing);
+        if (sessionId !== delivery.sessionId || payload !== delivery.payload) {
+          throw new Error("The Runtime delivery identity conflicts with its durable receipt");
+        }
+        this.#database.exec("COMMIT");
+        return new StoredRuntimeDelivery(delivery.deliveryId, sessionId, payload, state, true);
+      }
+      const usage = this.#database.prepare(
+        `SELECT COUNT(*) AS delivery_count,
+                            COALESCE(SUM(payload_bytes), 0) AS delivery_bytes
+                     FROM relay_runtime_deliveries`
+      ).get();
+      if (rowNumber(usage, "delivery_count") + 1 > this.#limits.runtimeDeliveryCount || rowNumber(usage, "delivery_bytes") + payloadBytes > this.#limits.runtimeDeliveryBytes) {
+        throw new RuntimeDeliveryInboxCapacityError();
+      }
+      this.#database.prepare(
+        `INSERT INTO relay_runtime_deliveries (
+                       delivery_id, session_id, payload_json, payload_bytes, state, received_at
+                     ) VALUES (?, ?, ?, ?, 'received', ?)`
+      ).run(delivery.deliveryId, delivery.sessionId, delivery.payload, payloadBytes, Date.now());
+      this.#database.exec("COMMIT");
+      return new StoredRuntimeDelivery(
+        delivery.deliveryId,
+        delivery.sessionId,
+        delivery.payload,
+        "received",
+        false
+      );
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  markRuntimeDeliveryCommitted = (deliveryId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.#database.prepare(
+        `SELECT state FROM relay_runtime_deliveries
+                     WHERE delivery_id = ? AND session_id = ?`
+      ).get(deliveryId, sessionId);
+      if (row === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const state = runtimeDeliveryState(row);
+      if (state === "processed") {
+        this.#database.prepare(`DELETE FROM relay_runtime_deliveries WHERE delivery_id = ?`).run(deliveryId);
+      } else if (state === "received") {
+        this.#database.prepare(`UPDATE relay_runtime_deliveries SET state = 'relay_committed' WHERE delivery_id = ?`).run(deliveryId);
+      }
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  markRuntimeDeliveryProcessed = (deliveryId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.#database.prepare(
+        `SELECT state FROM relay_runtime_deliveries
+                     WHERE delivery_id = ? AND session_id = ?`
+      ).get(deliveryId, sessionId);
+      if (row === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const state = runtimeDeliveryState(row);
+      if (state === "relay_committed") {
+        this.#database.prepare(`DELETE FROM relay_runtime_deliveries WHERE delivery_id = ?`).run(deliveryId);
+      } else if (state === "received") {
+        this.#database.prepare(`UPDATE relay_runtime_deliveries SET state = 'processed' WHERE delivery_id = ?`).run(deliveryId);
+      }
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  runtimeDeliveries = () => this.#database.prepare(
+    `SELECT delivery_id, session_id, payload_json, state
+                 FROM relay_runtime_deliveries
+                 ORDER BY received_at, delivery_id`
+  ).all().map(
+    (row) => new StoredRuntimeDelivery(
+      rowString2(row, "delivery_id"),
+      rowString2(row, "session_id"),
+      rowString2(row, "payload_json"),
+      runtimeDeliveryState(row),
+      true
+    )
+  );
+  #enqueueBounded = (sessionId, payload, attemptId, maximumEventCount, maximumEventBytes) => {
+    const sourceKey = attemptId.length === 0 ? `runtime:${sessionId}` : `attempt:${sessionId}:${attemptId}`;
     this.#database.exec("BEGIN IMMEDIATE");
     try {
       const row = this.#database.prepare(
@@ -29183,13 +30151,22 @@ var SessionEventOutbox = class {
         kind: SESSION_EVENT_KIND,
         payload,
         sessionId,
-        source: attemptId === null ? { kind: "runtime", sourceSeq: nextSourceSeq.toString() } : {
+        source: attemptId.length === 0 ? { kind: "runtime", sourceSeq: nextSourceSeq.toString() } : {
           attemptId,
           kind: "attempt",
           sourceSeq: nextSourceSeq.toString()
         }
       };
       const encoded = encodeSessionEventEnvelope(envelope2);
+      const byteLength = new TextEncoder().encode(encoded).byteLength;
+      const state = this.#database.prepare(
+        `SELECT event_count, total_bytes
+                     FROM relay_session_event_outbox_state
+                     WHERE singleton = 1`
+      ).get();
+      if (rowNumber(state, "event_count") + 1 > maximumEventCount || rowNumber(state, "total_bytes") + byteLength > maximumEventBytes) {
+        throw new SessionEventOutboxCapacityError();
+      }
       this.#database.prepare(
         `INSERT INTO relay_session_event_sources (
              source_key, next_source_seq
@@ -29199,9 +30176,15 @@ var SessionEventOutbox = class {
       ).run(sourceKey, nextSourceSeq + 1);
       this.#database.prepare(
         `INSERT INTO relay_session_event_outbox (
-             event_id, session_id, source_key, envelope_json
-           ) VALUES (?, ?, ?, ?)`
-      ).run(envelope2.eventId, envelope2.sessionId, sourceKey, encoded);
+             event_id, session_id, source_key, byte_length, envelope_json
+           ) VALUES (?, ?, ?, ?, ?)`
+      ).run(envelope2.eventId, envelope2.sessionId, sourceKey, byteLength, encoded);
+      this.#database.prepare(
+        `UPDATE relay_session_event_outbox_state
+                     SET event_count = event_count + 1,
+                         total_bytes = total_bytes + ?
+                     WHERE singleton = 1`
+      ).run(byteLength);
       this.#database.exec("COMMIT");
       return encoded;
     } catch (error61) {
@@ -29209,6 +30192,44 @@ var SessionEventOutbox = class {
       throw error61;
     }
   };
+  #removeAcknowledgedEvent = (eventId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const stored = this.#database.prepare(
+        `SELECT byte_length FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).get(eventId, sessionId);
+      if (stored === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const byteLength = rowNumber(stored, "byte_length");
+      const deletion = this.#database.prepare(
+        `DELETE FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).run(eventId, sessionId);
+      if (deletion.changes !== 1) {
+        throw new Error("The acknowledged session event could not be removed from the durable outbox");
+      }
+      this.#decrementEventState(byteLength);
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  #decrementEventState = (byteLength) => {
+    const result = this.#database.prepare(
+      `UPDATE relay_session_event_outbox_state
+                 SET event_count = event_count - 1,
+                     total_bytes = total_bytes - ?
+                 WHERE singleton = 1 AND event_count > 0 AND total_bytes >= ?`
+    ).run(byteLength, byteLength);
+    if (result.changes !== 1) {
+      throw new Error("The Session event outbox capacity state is inconsistent");
+    }
+  };
   pending = () => this.#database.prepare(
     `SELECT envelope_json
          FROM relay_session_event_outbox
@@ -29235,7 +30256,68 @@ var SessionEventOutbox = class {
                  LIMIT ?`
     ).all(limit).map(readPendingEnvelope);
   };
+  pendingSourceHeads = (limit, excludedEventIds, excludedSourceKeys) => {
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+      throw new Error("Session event replay batch limit must be a positive integer");
+    }
+    const exclusions = [];
+    const parameters = [];
+    if (excludedEventIds.length > 0) {
+      exclusions.push(`event_id NOT IN (${excludedEventIds.map(() => "?").join(", ")})`);
+      parameters.push(...excludedEventIds);
+    }
+    if (excludedSourceKeys.length > 0) {
+      exclusions.push(`source_key NOT IN (${excludedSourceKeys.map(() => "?").join(", ")})`);
+      parameters.push(...excludedSourceKeys);
+    }
+    parameters.push(limit.toString());
+    const where = exclusions.length === 0 ? "" : `WHERE ${exclusions.join(" AND ")}`;
+    return this.#database.prepare(
+      `WITH available_events AS (
+                   SELECT ordinal, source_key
+                   FROM relay_session_event_outbox
+                   ${where}
+                 ), ranked_events AS (
+                   SELECT ordinal,
+                          ROW_NUMBER() OVER (
+                            PARTITION BY source_key
+                            ORDER BY ordinal
+                          ) AS source_position
+                   FROM available_events
+                 )
+                 SELECT outbox.envelope_json
+                 FROM ranked_events AS ranked
+                 INNER JOIN relay_session_event_outbox AS outbox
+                   ON outbox.ordinal = ranked.ordinal
+                 WHERE ranked.source_position = 1
+                 ORDER BY outbox.ordinal
+                 LIMIT ?`
+    ).all(...parameters).map(readPendingEnvelope);
+  };
 };
+function validateLimits(limits) {
+  const values = [
+    limits.criticalEventBytes,
+    limits.criticalEventCount,
+    limits.runtimeDeliveryBytes,
+    limits.runtimeDeliveryCount,
+    limits.standardEventBytes,
+    limits.standardEventCount
+  ];
+  if (values.some((value) => !Number.isSafeInteger(value) || value < 1)) {
+    throw new Error("Session event outbox limits must be positive integers");
+  }
+  if (limits.criticalEventBytes < limits.standardEventBytes || limits.criticalEventCount < limits.standardEventCount) {
+    throw new Error("Critical Session event capacity must include the standard capacity");
+  }
+}
+function runtimeDeliveryState(row) {
+  const state = rowString2(row, "state");
+  if (state !== "received" && state !== "relay_committed" && state !== "processed") {
+    throw new Error("SQLite returned an invalid Runtime delivery state");
+  }
+  return state;
+}
 function isDaemonExecutionState(value) {
   return value === "cancelled" || value === "dispatching" || value === "failed" || value === "running" || value === "succeeded";
 }
@@ -29261,10 +30343,23 @@ function botIpcSocketPath() {
   return join15("/tmp", `mobius-bot-${randomUUID4()}.sock`);
 }
 var DaemonAcpObserver = class {
+  #config;
   #record;
-  constructor(record2) {
-    this.#record = record2;
+  constructor(config2, record3) {
+    this.#config = config2;
+    this.#record = record3;
   }
+  importLocalImage = async (sessionId, image, signal) => {
+    try {
+      return (await uploadRuntimeArtifact(this.#config, sessionId, image, signal)).artifactId;
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof Error && cause.name === "AbortError") {
+        throw cause;
+      }
+      return "";
+    }
+  };
   onCommands = (event) => {
     this.#record(event.sessionId, encodeSessionCommandsUpdatedEvent(event));
     return Promise.resolve();
@@ -29454,8 +30549,7 @@ var ActiveTurnReconciliationError = class extends Error {
   }
 };
 function activeTurnReconciliationEndpoint(config2, turn) {
-  const endpoint = new URL(config2.relayUrl);
-  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  const endpoint = relayHttpEndpoint(config2.relayUrl);
   let channelPath = "";
   if (endpoint.pathname.endsWith("/daemon")) {
     channelPath = endpoint.pathname.slice(0, -"/daemon".length);
@@ -29467,7 +30561,6 @@ function activeTurnReconciliationEndpoint(config2, turn) {
     channelPath = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
   endpoint.pathname = `${channelPath}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
-  endpoint.searchParams.delete("liveness");
   return endpoint;
 }
 async function reconcileActiveTurn(config2, turn, signal) {
@@ -29476,10 +30569,10 @@ async function reconcileActiveTurn(config2, turn, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch5(activeTurnReconciliationEndpoint(config2, turn), {
+    response = await fetch6(activeTurnReconciliationEndpoint(config2, turn), {
       body: JSON.stringify({ outcome: { kind: "running" } }),
       dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
+      headers: { ...runtimeAuthorization(config2.relayUrl), "content-type": "application/json" },
       method: "POST",
       signal: requestSignal
     });
@@ -29547,17 +30640,31 @@ var ConnectedDaemonSessionEventState = class extends DaemonSessionEventConnectio
     }
   };
 };
-var SESSION_EVENT_REPLAY_WINDOW = 4;
+var SESSION_EVENT_REPLAY_WINDOW = 16;
+var SESSION_EVENT_SOURCE_REPLAY_WINDOW = 4;
+var SESSION_EVENT_REPLAY_BYTE_LIMIT = 32 * 1024 * 1024;
+var InFlightSessionEvent = class {
+  byteLength;
+  sourceKey;
+  constructor(sourceKey, byteLength) {
+    this.byteLength = byteLength;
+    this.sourceKey = sourceKey;
+  }
+};
+function sessionEventSourceKey(envelope2) {
+  return envelope2.source.kind === "attempt" ? `attempt:${envelope2.sessionId}:${envelope2.source.attemptId}` : `runtime:${envelope2.sessionId}`;
+}
 var DaemonSessionEventPublisher = class {
   #outbox;
-  #inFlightEventIds = /* @__PURE__ */ new Set();
+  #inFlightEvents = /* @__PURE__ */ new Map();
+  #inFlightBytes = 0;
   #connection = new DisconnectedDaemonSessionEventState();
   constructor(outbox) {
     this.#outbox = outbox;
   }
   connect = (socket) => {
     this.#connection = new ConnectedDaemonSessionEventState(socket);
-    this.#inFlightEventIds.clear();
+    this.#clearInFlight();
     this.#publishNextBatch();
   };
   disconnect = (socket) => {
@@ -29565,10 +30672,15 @@ var DaemonSessionEventPublisher = class {
       return;
     }
     this.#connection = this.#connection.disconnect(socket);
-    this.#inFlightEventIds.clear();
+    this.#clearInFlight();
   };
   recordAttempt = (sessionId, payload, attemptId) => {
-    this.#outbox.enqueue(sessionId, payload, attemptId);
+    const kind = decodeMessageKind(payload);
+    if (kind === SESSION_COMPLETED_KIND || kind === SESSION_FAILED_KIND) {
+      this.#outbox.enqueueCritical(sessionId, payload, attemptId);
+    } else {
+      this.#outbox.enqueue(sessionId, payload, attemptId);
+    }
     this.#publishNextBatch();
   };
   recordRuntime = (sessionId, payload) => {
@@ -29579,7 +30691,7 @@ var DaemonSessionEventPublisher = class {
     if (!this.#outbox.acknowledge(acknowledgement)) {
       return;
     }
-    this.#inFlightEventIds.delete(acknowledgement.eventId);
+    this.#removeInFlight(acknowledgement.eventId);
     this.#publishNextBatch();
   };
   quarantine = (rejection) => {
@@ -29587,24 +30699,60 @@ var DaemonSessionEventPublisher = class {
     if (!quarantined) {
       return false;
     }
-    this.#inFlightEventIds.delete(rejection.eventId);
+    this.#removeInFlight(rejection.eventId);
     this.#publishNextBatch();
     return true;
   };
   #publishNextBatch = () => {
-    if (this.#inFlightEventIds.size > 0) {
-      return;
-    }
-    const batch = this.#outbox.pendingBatch(SESSION_EVENT_REPLAY_WINDOW);
-    for (const encoded of batch) {
-      const envelope2 = decodeSessionEventEnvelope(encoded);
-      if (!this.#connection.send(encoded)) {
-        this.#inFlightEventIds.clear();
+    while (this.#inFlightEvents.size < SESSION_EVENT_REPLAY_WINDOW) {
+      const sourceCounts = /* @__PURE__ */ new Map();
+      for (const inFlight of this.#inFlightEvents.values()) {
+        sourceCounts.set(inFlight.sourceKey, (sourceCounts.get(inFlight.sourceKey) ?? 0) + 1);
+      }
+      const saturatedSources = [...sourceCounts.entries()].filter(([, count]) => count >= SESSION_EVENT_SOURCE_REPLAY_WINDOW).map(([sourceKey]) => sourceKey);
+      const batch = this.#outbox.pendingSourceHeads(
+        SESSION_EVENT_REPLAY_WINDOW - this.#inFlightEvents.size,
+        [...this.#inFlightEvents.keys()],
+        saturatedSources
+      );
+      let sent = 0;
+      for (const encoded of batch) {
+        const envelope2 = decodeSessionEventEnvelope(encoded);
+        const sourceKey = sessionEventSourceKey(envelope2);
+        const sourceCount = sourceCounts.get(sourceKey) ?? 0;
+        if (sourceCount >= SESSION_EVENT_SOURCE_REPLAY_WINDOW) {
+          continue;
+        }
+        const byteLength = new TextEncoder().encode(encoded).byteLength;
+        if (this.#inFlightBytes + byteLength > SESSION_EVENT_REPLAY_BYTE_LIMIT) {
+          continue;
+        }
+        if (!this.#connection.send(encoded)) {
+          this.#clearInFlight();
+          return;
+        }
+        this.#inFlightEvents.set(envelope2.eventId, new InFlightSessionEvent(sourceKey, byteLength));
+        this.#inFlightBytes += byteLength;
+        sourceCounts.set(sourceKey, sourceCount + 1);
+        sent += 1;
+      }
+      if (sent === 0) {
         return;
       }
-      this.#inFlightEventIds.add(envelope2.eventId);
     }
   };
+  #removeInFlight = (eventId) => {
+    const inFlight = this.#inFlightEvents.get(eventId);
+    if (inFlight === void 0) {
+      return;
+    }
+    this.#inFlightEvents.delete(eventId);
+    this.#inFlightBytes -= inFlight.byteLength;
+  };
+  #clearInFlight = () => {
+    this.#inFlightEvents.clear();
+    this.#inFlightBytes = 0;
+  };
 };
 var CoalescingDaemonActivityPublisher = class {
   #pending = /* @__PURE__ */ new Map();
@@ -29737,7 +30885,7 @@ async function resolveSessionDirectories(directories, bindingId, directoryId2, a
     additionalDirectories.push(directory);
     additionalDirectoryEntries.push({
       directoryId: additionalDirectoryId,
-      name: basename3(directory)
+      name: basename4(directory)
     });
   }
   return new ResolvedSessionDirectories(cwd, additionalDirectories, additionalDirectoryEntries);
@@ -29856,6 +31004,9 @@ async function executeSessionConfigure(publisher, socket, command, config2, dire
       })
     );
   } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
     reportOperationFailure(socket, command.requestId, command.sessionId, error61);
   }
 }
@@ -30195,6 +31346,7 @@ async function publishAgentCatalogUntilAvailable(config2, diagnostics, signal, t
 }
 async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, grants, contexts, applicator, ipc, activeTurns, activeAttemptIds, connectionEpoch, diagnostics, onConnected, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
+  relayUrl.searchParams.set("deliveryReceipts", "1");
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
   const reconnectingTurns = [...activeTurns.values()];
@@ -30243,6 +31395,239 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         closeRelaySocket(socket, code, reason);
         rejectConnection(failure);
       };
+      const processingDeliveryIds = /* @__PURE__ */ new Set();
+      const processDeliveredPrompt = async (delivery, command, trackActiveAttempt, execute) => {
+        if (command.sessionId !== delivery.sessionId) {
+          throw new Error("Runtime delivery Session identity does not match its payload");
+        }
+        const active = activeTurns.get(command.commandId);
+        if (active !== void 0) {
+          await active.completion;
+          return;
+        }
+        const receipt = outbox.claimExecution(command.commandId, command.sessionId, delivery.payload);
+        if (receipt.kind === "duplicate") {
+          if (receipt.state === "running") {
+            reportFailure(
+              publisher,
+              command,
+              "agent_execution_interrupted",
+              "The local Agent execution was interrupted before it completed",
+              receipt.attemptId
+            );
+            outbox.transitionExecution(command.commandId, "failed");
+            return;
+          }
+          if (receipt.state !== "dispatching") {
+            return;
+          }
+        }
+        const turn = new ActiveDaemonTurn(command, receipt.attemptId);
+        activeTurns.set(command.commandId, turn);
+        if (trackActiveAttempt) {
+          activeAttemptIds.set(command.sessionId, receipt.attemptId);
+        }
+        try {
+          await execute(receipt.attemptId, turn.signal);
+        } finally {
+          activeTurns.delete(command.commandId);
+          if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
+            activeAttemptIds.delete(command.sessionId);
+          }
+          turn.finish();
+        }
+      };
+      const processDeliveredPayload = async (delivery) => {
+        const kind = decodeMessageKind(delivery.payload);
+        if (kind === SESSION_CANCEL_KIND) {
+          const cancellation = decodeSessionCancelCommand(delivery.payload);
+          if (cancellation.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          const turn = activeTurns.get(cancellation.commandId);
+          if (turn === void 0 || !turn.matches(cancellation) || !turn.requestCancellation()) {
+            return;
+          }
+          audit.record({
+            commandId: cancellation.commandId,
+            event: "session_cancellation_requested",
+            sessionId: cancellation.sessionId
+          });
+          await sessions.cancelPrompt(cancellation.sessionId);
+          return;
+        }
+        if (kind === SESSION_CONFIGURE_KIND) {
+          const command = decodeSessionConfigureCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          await executeSessionConfigure(
+            publisher,
+            socket,
+            command,
+            config2,
+            directories,
+            audit,
+            sessions,
+            connectionController.signal
+          );
+          return;
+        }
+        if (kind === SESSION_PERMISSION_RESPOND_KIND) {
+          const command = decodeSessionPermissionRespondCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          try {
+            await sessions.respondPermission(command);
+            audit.record({
+              commandId: command.interactionId,
+              event: "session_permission_resolved",
+              sessionId: command.sessionId
+            });
+          } catch (error61) {
+            reportOperationFailure(socket, command.interactionId, command.sessionId, error61);
+          }
+          return;
+        }
+        if (kind === SESSION_ELICITATION_RESPOND_KIND) {
+          const command = decodeSessionElicitationRespondCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          try {
+            await sessions.respondElicitation(command);
+            audit.record({
+              commandId: command.interactionId,
+              event: "session_elicitation_resolved",
+              sessionId: command.sessionId
+            });
+          } catch (error61) {
+            reportOperationFailure(socket, command.interactionId, command.sessionId, error61);
+          }
+          return;
+        }
+        if (kind === BOT_SESSION_PROMPT_KIND) {
+          const command = decodeBotSessionPromptCommand(delivery.payload);
+          await processDeliveredPrompt(
+            delivery,
+            command,
+            true,
+            (attemptId, executionSignal) => executeBotPrompt(
+              outbox,
+              publisher,
+              command,
+              config2,
+              directories,
+              audit,
+              sessions,
+              grants,
+              contexts,
+              applicator,
+              ipc,
+              attemptId,
+              timer,
+              executionSignal
+            )
+          );
+          return;
+        }
+        if (kind === SESSION_PROMPT_KIND) {
+          const command = decodeSessionPromptCommand(delivery.payload);
+          await processDeliveredPrompt(
+            delivery,
+            command,
+            command.disposition !== SessionPromptDisposition.Steer,
+            (attemptId, executionSignal) => executePrompt(
+              outbox,
+              publisher,
+              command,
+              config2,
+              directories,
+              audit,
+              sessions,
+              attemptId,
+              timer,
+              executionSignal
+            )
+          );
+          return;
+        }
+        throw new Error("Runtime delivery contains an unsupported protocol message");
+      };
+      const processRuntimeDelivery = (delivery, state) => {
+        if (state === "processed" || processingDeliveryIds.has(delivery.deliveryId)) {
+          return;
+        }
+        processingDeliveryIds.add(delivery.deliveryId);
+        void processDeliveredPayload(delivery).then(() => {
+          outbox.markRuntimeDeliveryProcessed(delivery.deliveryId, delivery.sessionId);
+        }).catch((error61) => {
+          if (connectionController.signal.aborted) {
+            return;
+          }
+          console.error("Mobius daemon could not process a durable Runtime delivery", error61);
+          failAndClose(
+            new Error("Runtime delivery processing failed", { cause: error61 }),
+            4008,
+            "Invalid Runtime delivery",
+            "delivery"
+          );
+        }).finally(() => processingDeliveryIds.delete(delivery.deliveryId));
+      };
+      const receiveRuntimeDelivery = (delivery) => {
+        const payloadKind = decodeMessageKind(delivery.payload);
+        let payloadSessionId = "";
+        if (payloadKind === SESSION_CANCEL_KIND) {
+          payloadSessionId = decodeSessionCancelCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_CONFIGURE_KIND) {
+          payloadSessionId = decodeSessionConfigureCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_PERMISSION_RESPOND_KIND) {
+          payloadSessionId = decodeSessionPermissionRespondCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_ELICITATION_RESPOND_KIND) {
+          payloadSessionId = decodeSessionElicitationRespondCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_PROMPT_KIND) {
+          payloadSessionId = decodeSessionPromptCommand(delivery.payload).sessionId;
+        } else if (payloadKind === BOT_SESSION_PROMPT_KIND) {
+          payloadSessionId = decodeBotSessionPromptCommand(delivery.payload).sessionId;
+        } else {
+          throw new Error("Runtime delivery contains an unsupported protocol message");
+        }
+        if (payloadSessionId !== delivery.sessionId) {
+          throw new Error("Runtime delivery Session identity does not match its payload");
+        }
+        const stored = outbox.claimRuntimeDelivery(delivery);
+        send(
+          socket,
+          encodeRuntimeDeliveryReceived({
+            deliveryId: delivery.deliveryId,
+            kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+            sessionId: delivery.sessionId
+          })
+        );
+        processRuntimeDelivery(delivery, stored.state);
+      };
+      const resumeRuntimeDeliveries = () => {
+        for (const stored of outbox.runtimeDeliveries()) {
+          const delivery = {
+            deliveryId: stored.deliveryId,
+            kind: RUNTIME_DELIVERY_KIND,
+            payload: stored.payload,
+            sessionId: stored.sessionId
+          };
+          if (stored.state !== "relay_committed") {
+            send(
+              socket,
+              encodeRuntimeDeliveryReceived({
+                deliveryId: stored.deliveryId,
+                kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+                sessionId: stored.sessionId
+              })
+            );
+          }
+          processRuntimeDelivery(delivery, stored.state);
+        }
+      };
       const connectionLiveness = new RelayConnectionLiveness(timer, {
         send: (message) => send(socket, message),
         unresponsive: (heartbeatId, timeoutMilliseconds) => {
@@ -30281,6 +31666,17 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         }
         try {
           const kind = decodeMessageKind(encoded);
+          if (kind === RUNTIME_DELIVERY_COMMITTED_KIND) {
+            const committed = decodeRuntimeDeliveryCommitted(encoded);
+            if (!outbox.markRuntimeDeliveryCommitted(committed.deliveryId, committed.sessionId)) {
+              console.warn("Mobius daemon ignored confirmation for an unknown Runtime delivery");
+            }
+            return;
+          }
+          if (kind === RUNTIME_DELIVERY_KIND) {
+            receiveRuntimeDelivery(decodeRuntimeDelivery(encoded));
+            return;
+          }
           if (kind === SESSION_EVENT_ACK_KIND) {
             publisher.acknowledge(decodeSessionEventAcknowledgement(encoded));
             return;
@@ -30717,6 +32113,10 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           });
         } catch (error61) {
           console.error("Mobius daemon rejected a message", error61);
+          if (error61 instanceof RuntimeDeliveryInboxCapacityError) {
+            failAndClose(error61, 4013, "Runtime delivery queue full", "delivery_backpressure");
+            return;
+          }
           failAndClose(
             new Error("Relay sent an invalid protocol message", { cause: error61 }),
             4008,
@@ -30734,6 +32134,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             return;
           }
           publisher.connect(socket);
+          resumeRuntimeDeliveries();
         },
         (error61) => {
           if (finished) {
@@ -30786,7 +32187,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
     }
     publisher.recordAttempt(sessionId, payload, attemptId);
   };
-  const sessions = new AcpSessionManager(new DaemonAcpObserver(recordSessionEvent), sessionStore);
+  const sessions = new AcpSessionManager(new DaemonAcpObserver(config2, recordSessionEvent), sessionStore);
   const directories = new WorkspaceDirectoryService(config2.bindingId, config2.defaultWorkspace);
   const installationObserver = new DaemonInstallationObserver();
   const diagnostics = new RelayConnectionDiagnostics(audit, config2.channelId, config2.relayUrl);
@@ -30885,13 +32286,13 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
 
 // src/pairing/pair-local-machine.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { mkdir as mkdir4, open as open4, realpath as realpath7, rename as rename3, stat as stat7, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir4, open as open4, realpath as realpath8, rename as rename3, stat as stat8, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename4, join as join16, resolve as resolve4 } from "node:path";
-import { fetch as fetch6 } from "undici";
+import { basename as basename5, join as join16, resolve as resolve4 } from "node:path";
+import { fetch as fetch7 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
-var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN8 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var TOKEN_PATTERN2 = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken", "runtimeId"];
@@ -30906,7 +32307,7 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -30945,7 +32346,7 @@ function parsePairingCode(value) {
   return code;
 }
 function validatePairingId(value) {
-  if (!IDENTIFIER_PATTERN7.test(value)) {
+  if (!IDENTIFIER_PATTERN8.test(value)) {
     throw new PairingClientError("invalid_pairing_id", "The Runtime pairing ID is invalid");
   }
   return value;
@@ -30954,8 +32355,8 @@ async function resolveDefaultWorkspace2(path2) {
   const requestedWorkspace = resolve4(path2);
   try {
     await mkdir4(requestedWorkspace, { recursive: true, mode: 448 });
-    const defaultWorkspace = await realpath7(requestedWorkspace);
-    const metadata = await stat7(defaultWorkspace);
+    const defaultWorkspace = await realpath8(requestedWorkspace);
+    const metadata = await stat8(defaultWorkspace);
     if (!metadata.isDirectory()) {
       throw new PairingClientError("invalid_workspace", "The default workspace is not a directory");
     }
@@ -30984,9 +32385,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord10(value)) {
+  if (isRecord11(value)) {
     const error61 = value["error"];
-    if (isRecord10(error61)) {
+    if (isRecord11(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -30997,16 +32398,16 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodePairingResponse(value, credentialField, expectedKeys) {
-  if (!isRecord10(value) || !hasExactKeys(value, expectedKeys)) {
+  if (!isRecord11(value) || !hasExactKeys(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const runtimeCredential = value[credentialField];
+  const runtimeCredential2 = value[credentialField];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN7.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN7.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN8.test(channelId) || typeof runtimeCredential2 !== "string" || !TOKEN_PATTERN2.test(runtimeCredential2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN8.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, runtimeCredential, runtimeId };
+  return { channelId, runtimeCredential: runtimeCredential2, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -31019,13 +32420,13 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   const endpoint = options.pairingId.length > 0 ? mobiusApiUrl(options.relayOrigin, `/v1/runtime-pairings/${encodeURIComponent(options.pairingId)}/redeem`) : mobiusApiUrl(options.relayOrigin, "/pairings/claim");
   let response;
   try {
-    response = await fetch6(endpoint, {
+    response = await fetch7(endpoint, {
       body: JSON.stringify({
         agents,
         installableAgents,
         machineName: hostname3(),
         pairingCode: options.code,
-        workspaceName: basename4(defaultWorkspace) || "Local workspace"
+        workspaceName: basename5(defaultWorkspace) || "Local workspace"
       }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -31041,7 +32442,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   }
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
-async function persistConnection(channelId, relayOrigin, runtimeCredential, defaultWorkspace, environment) {
+async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
   const connectionsDirectory = join16(readStateDirectory(environment), "connections");
   await mkdir4(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join16(connectionsDirectory, `${channelId}.json`);
@@ -31053,7 +32454,7 @@ async function persistConnection(channelId, relayOrigin, runtimeCredential, defa
         defaultWorkspace,
         channelId,
         relayOrigin: relayOrigin.toString(),
-        runtimeCredential
+        runtimeCredential: runtimeCredential2
       },
       null,
       2
@@ -31065,21 +32466,21 @@ async function persistConnection(channelId, relayOrigin, runtimeCredential, defa
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord10(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
+  if (!isRecord11(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const runtimeCredential = value["runtimeCredential"] ?? value["daemonToken"];
+  const runtimeCredential2 = value["runtimeCredential"] ?? value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN7.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN8.test(channelId) || typeof runtimeCredential2 !== "string" || !TOKEN_PATTERN2.test(runtimeCredential2) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
     relayOrigin: parseRelayOrigin(relayOrigin),
-    runtimeCredential
+    runtimeCredential: runtimeCredential2
   };
 }
 async function readSavedConnection(channelId, environment) {
@@ -31191,7 +32592,7 @@ async function resumeMobiusRuntime(channelId, signal, environment = process.env)
 // src/runtime.ts
 var APP_CREDENTIAL_PATTERN = /^mapp_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
 var CONVERSATION_CREDENTIAL_PATTERN = /^mconv_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
-var IDENTIFIER_PATTERN8 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN9 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var RUNTIME_CREDENTIAL_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
 var MobiusRuntimeConfigurationError = class extends Error {
   code = "runtime_configuration_invalid";
@@ -31249,7 +32650,7 @@ function relayUrlFromConnection(connection) {
 }
 function loadMobiusRuntimeConnection(environment = process.env) {
   const channelId = requiredEnvironmentValue(environment, "MOBIUS_CHANNEL_ID");
-  if (!IDENTIFIER_PATTERN8.test(channelId)) {
+  if (!IDENTIFIER_PATTERN9.test(channelId)) {
     throw new MobiusRuntimeConfigurationError("MOBIUS_CHANNEL_ID is invalid");
   }
   return Object.freeze({
@@ -31264,8 +32665,8 @@ async function resolveWorkspace(path2) {
   const requested = resolve5(path2);
   try {
     await mkdir5(requested, { recursive: true, mode: 448 });
-    const resolved = await realpath8(requested);
-    const metadata = await stat8(resolved);
+    const resolved = await realpath9(requested);
+    const metadata = await stat9(resolved);
     if (!metadata.isDirectory()) {
       throw new MobiusRuntimeConfigurationError("The Runtime workspace is not a directory");
     }