@moxt-ai/mobius 0.0.27 → 0.0.29

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.27",
+  version: "0.0.29",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -55,6 +55,7 @@ var package_default = {
   },
   devDependencies: {
     "@moxt-ai/mobius-protocol": "workspace:*",
+    "@moxt-ai/mobius-sdk": "workspace:*",
     "@types/node": "^24.13.3",
     esbuild: "0.28.2"
   },
@@ -1157,6 +1158,13 @@ var ManagedNpmPackageInstaller = class {
 
 // src/agent-catalog/agent-specification.ts
 import { join as join3 } from "node:path";
+
+// src/agent-catalog/version-output.ts
+function normalizeVersionOutput(output2) {
+  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
+}
+
+// src/agent-catalog/agent-specification.ts
 var VERSION_PROBE_TIMEOUT_MILLISECONDS = 3e3;
 var ACP_PROBE_TIMEOUT_MILLISECONDS = 5e3;
 var DEFAULT_PROMPT_TIMEOUT_MILLISECONDS = 30 * 60 * 1e3;
@@ -1165,6 +1173,8 @@ var LocalAgentSpecification = class {
   authenticationCommand = () => "";
   adapterVersionArguments = ["--version"];
   agentVersionArguments = ["--version"];
+  normalizeAdapterVersion = normalizeVersionOutput;
+  normalizeAgentVersion = normalizeVersionOutput;
   promptTimeoutMilliseconds = DEFAULT_PROMPT_TIMEOUT_MILLISECONDS;
   versionProbeTimeoutMilliseconds = VERSION_PROBE_TIMEOUT_MILLISECONDS;
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
@@ -1276,6 +1286,20 @@ var AgentProbeError = class extends Error {
   }
 };
 
+// src/agent-catalog/agents/resolve-user-local-executable.ts
+import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+async function resolveUserLocalExecutable(executableName, context) {
+  context.signal.throwIfAborted();
+  const platform = context.platform ?? process.platform;
+  const homeDirectory = context.environment["HOME"];
+  if (platform === "win32" || homeDirectory === void 0 || !isAbsolute2(homeDirectory)) {
+    return [];
+  }
+  const executable = await resolveExecutablePath(join4(homeDirectory, ".local", "bin", executableName), platform);
+  context.signal.throwIfAborted();
+  return executable === null ? [] : [executable];
+}
+
 // src/agent-catalog/agents/verify-session-creation.ts
 import { methods } from "@agentclientprotocol/sdk";
 async function verifySessionCreation(connection, capabilities, defaultWorkspace, signal, label) {
@@ -1300,6 +1324,37 @@ async function verifySessionCreation(connection, capabilities, defaultWorkspace,
   }
 }
 
+// src/agent-catalog/agents/copilot-cli-agent.ts
+var COPILOT_CLI_TESTED_VERSION = "1.0.83";
+var CopilotCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = COPILOT_CLI_TESTED_VERSION;
+  authenticationCommand = () => "copilot login";
+  agentExecutable = "copilot";
+  id = "github-copilot-cli";
+  label = "GitHub Copilot CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_COPILOT_PATH",
+      ["--no-auto-update", "--acp", "--stdio"],
+      ["agents", "github-copilot-cli", COPILOT_CLI_TESTED_VERSION, "bin", "copilot"]
+    );
+  }
+  createLaunchEnvironment = async (_agent, _context) => Object.freeze({ COPILOT_AUTO_UPDATE: "false" });
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || capabilities.sessionCapabilities?.list == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError(
+        "acp_incompatible",
+        "GitHub Copilot CLI reported an unsupported ACP capability set"
+      );
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/cursor-cli-agent.ts
 var CURSOR_CLI_TESTED_VERSION = "2026.09.02-c22c1a3";
 var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
@@ -1326,7 +1381,7 @@ var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 import { realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join5, normalize } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6, normalize } from "node:path";
 
 // src/agent-installation/deepseek-managed-package.ts
 var DeepSeekHarnessManagedPackage = class extends SriManagedNpmPackageDefinition {
@@ -1344,18 +1399,18 @@ var DEEPSEEK_HARNESS_PACKAGE = new DeepSeekHarnessManagedPackage(
 
 // src/storage/state-directory.ts
 import { homedir } from "node:os";
-import { join as join4, resolve as resolve2 } from "node:path";
+import { join as join5, resolve as resolve2 } from "node:path";
 function readStateDirectory(environment = process.env) {
   const configured = environment["MOBIUS_STATE_DIRECTORY"]?.trim();
   if (configured !== void 0 && configured.length > 0) {
     return resolve2(configured);
   }
-  return join4(homedir(), ".mobius");
+  return join5(homedir(), ".mobius");
 }
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 async function validateAgentHome(path2) {
-  if (!isAbsolute2(path2) || normalize(path2) !== path2) {
+  if (!isAbsolute3(path2) || normalize(path2) !== path2) {
     throw new AgentProbeError("agent_environment_invalid", "The configured Agent home is invalid");
   }
   try {
@@ -1405,7 +1460,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
         context.signal
       );
       if (managed.path === agent.path) {
-        selectedHome = join5(readStateDirectory(context.environment), "agents", this.id, "home");
+        selectedHome = join6(readStateDirectory(context.environment), "agents", this.id, "home");
       }
     } catch {
       context.signal.throwIfAborted();
@@ -1421,7 +1476,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join5(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
+      join6(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
       DEEPSEEK_HARNESS_PACKAGE
     );
     signal.throwIfAborted();
@@ -1441,9 +1496,41 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/gemini-cli-agent.ts
+var GEMINI_CLI_TESTED_VERSION = "0.59.0";
+var GeminiCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = GEMINI_CLI_TESTED_VERSION;
+  authenticationCommand = () => "gemini";
+  agentExecutable = "gemini";
+  id = "gemini-cli";
+  label = "Gemini CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_GEMINI_PATH",
+      ["--acp"],
+      [
+        "agents",
+        "gemini-cli",
+        GEMINI_CLI_TESTED_VERSION,
+        "bin",
+        process.platform === "win32" ? "gemini.cmd" : "gemini"
+      ]
+    );
+  }
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Gemini CLI reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/grok-build-agent.ts
 import { realpath as realpath4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join7, relative as relative2, sep as sep2 } from "node:path";
 
 // src/agent-installation/grok-managed-package.ts
 var GROK_BUILD_MANAGED_VERSION = "1.0.21";
@@ -1506,7 +1593,7 @@ function grokBuildManagedPackage(platform, architecture) {
 // src/agent-catalog/agents/grok-build-agent.ts
 function isContainedPath2(root, candidate) {
   const difference = relative2(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute3(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute4(difference);
 }
 var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   adapterVersion = GROK_BUILD_MANAGED_VERSION;
@@ -1534,7 +1621,7 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
       if (managed.path === agent.path) {
         return Object.freeze({
           GROK_HOME: await realpath4(
-            join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
+            join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
           )
         });
       }
@@ -1545,9 +1632,9 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
     signal.throwIfAborted();
-    const versionRoot = await realpath4(join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
-    await validateManagedNpmPackage(join6(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
-    const executable = await resolveExecutablePath(join6(versionRoot, "home", "bin", "grok"), platform);
+    const versionRoot = await realpath4(join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
+    await validateManagedNpmPackage(join7(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
+    const executable = await resolveExecutablePath(join7(versionRoot, "home", "bin", "grok"), platform);
     signal.throwIfAborted();
     if (executable === null || !isContainedPath2(versionRoot, executable.path)) {
       throw new AgentProbeError("managed_agent_invalid", "The managed Grok Build executable is invalid");
@@ -1564,14 +1651,39 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/hermes-agent.ts
+var HERMES_TESTED_VERSION = "0.21.1";
+var HermesAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = HERMES_TESTED_VERSION;
+  adapterVersionArguments = ["acp", "--version"];
+  authenticationCommand = () => "hermes acp --setup";
+  agentExecutable = "hermes";
+  agentVersionArguments = ["acp", "--version"];
+  id = "hermes";
+  label = "Hermes Agent";
+  constructor() {
+    super("MOBIUS_HERMES_PATH", ["acp"], ["agents", "hermes", HERMES_TESTED_VERSION, "bin", "hermes"]);
+  }
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    const session = capabilities.sessionCapabilities;
+    if (capabilities.loadSession !== true || session?.fork == null || session.list == null || session.resume == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Hermes Agent reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/opencode-agent.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/agent-installation/managed-agent-archive.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { chmod, copyFile, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open2, realpath as realpath5, rename as rename2, rm as rm2, stat as stat4, writeFile } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute4, join as join7, relative as relative3, sep as sep3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute5, join as join8, relative as relative3, sep as sep3 } from "node:path";
 
 // src/agent-installation/verified-download.ts
 import { fetch } from "undici";
@@ -1677,7 +1789,7 @@ function isRecord3(value) {
 }
 function isContainedPath3(root, candidate) {
   const difference = relative3(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute4(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute5(difference);
 }
 async function hashFile(path2, signal) {
   signal.throwIfAborted();
@@ -1756,11 +1868,11 @@ async function validateManagedAgentArchive(root, definition, signal) {
     if (!rootMetadata.isDirectory() || typeof process.getuid === "function" && rootMetadata.uid !== process.getuid()) {
       throw new Error("Managed Agent root is not user-owned");
     }
-    const manifest = await readManifest(join7(rootPath, "archive.json"));
+    const manifest = await readManifest(join8(rootPath, "archive.json"));
     if (manifest["archiveSha256"] !== definition.archiveSha256 || manifest["archiveUrl"] !== definition.archiveUrl.toString() || manifest["version"] !== definition.version || typeof manifest["executableSha256"] !== "string") {
       throw new Error("Managed Agent archive identity is invalid");
     }
-    const executable = await resolveExecutablePath(join7(rootPath, "bin", definition.executableName));
+    const executable = await resolveExecutablePath(join8(rootPath, "bin", definition.executableName));
     if (executable === null || !isContainedPath3(rootPath, executable.path) || await hashFile(executable.path, signal) !== manifest["executableSha256"]) {
       throw new Error("Managed Agent executable is invalid");
     }
@@ -1852,7 +1964,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
   }
   createLaunchEnvironment = async (_agent, _context) => Object.freeze({ OPENCODE_DISABLE_AUTOUPDATE: "1" });
   resolveManagedAgent = async (stateDirectory, platform, signal) => await validateManagedAgentArchive(
-    join8(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
+    join9(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
     openCodeManagedArchive(platform, process.arch),
     signal
   );
@@ -1870,7 +1982,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/pi-agent.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import {
   methods as methods2
 } from "@agentclientprotocol/sdk";
@@ -1929,7 +2041,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join9(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
+      join10(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
       PI_AGENT_PACKAGE
     );
     signal.throwIfAborted();
@@ -1967,7 +2079,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/workbuddy-agent.ts
-import { isAbsolute as isAbsolute5, join as join10 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 
 // src/agent-installation/workbuddy-managed-package.ts
 var WORKBUDDY_MANAGED_VERSION = "2.146.0";
@@ -2020,7 +2132,7 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join10(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
+      join11(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
       WORKBUDDY_MANAGED_PACKAGE
     );
     signal.throwIfAborted();
@@ -2031,10 +2143,10 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
     if ((context.platform ?? process.platform) !== "darwin") {
       return [];
     }
-    const requestedPaths = [join10("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
+    const requestedPaths = [join11("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
     const homeDirectory = context.environment["HOME"];
-    if (homeDirectory !== void 0 && isAbsolute5(homeDirectory)) {
-      requestedPaths.unshift(join10(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
+    if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
+      requestedPaths.unshift(join11(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
     }
     const executables = [];
     for (const requestedPath of requestedPaths) {
@@ -2060,12 +2172,15 @@ function supportedLocalAgentSpecifications() {
   return Object.freeze([
     new CodexAgentSpecification(),
     new ClaudeCodeAgentSpecification(),
+    new CopilotCliAgentSpecification(),
     new PiAgentSpecification(),
     new DeepSeekHarnessAgentSpecification(),
+    new HermesAgentSpecification(),
     new OpenCodeAgentSpecification(),
     new CursorCliAgentSpecification(),
     new GrokBuildAgentSpecification(),
-    new WorkBuddyAgentSpecification()
+    new WorkBuddyAgentSpecification(),
+    new GeminiCliAgentSpecification()
   ]);
 }
 
@@ -2105,11 +2220,173 @@ var createAcpClient = (handler) => client({ name: "mobius" }).onRequest(
   outcome: { outcome: "cancelled" }
 })).onNotification("cursor/update_todos", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/task", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/generate_image", discardExtensionParams, async () => Promise.resolve());
 
+// src/agent-catalog/acp-readiness-probe.ts
+var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+var VerifiedAcpReadiness = class {
+  adapterVersion;
+  capabilities;
+  constructor(adapterVersion, capabilities) {
+    this.adapterVersion = adapterVersion;
+    this.capabilities = capabilities;
+  }
+};
+var DiscoveryAcpHandler = class {
+  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
+  onElicitationComplete = (_notification) => Promise.resolve();
+  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
+  onUpdate = (_notification) => Promise.resolve();
+};
+function readableAcpStream(input2) {
+  let byteLength = 0;
+  let open5 = true;
+  return new ReadableStream({
+    start(controller) {
+      input2.on("data", (chunk) => {
+        if (!open5) {
+          return;
+        }
+        if (!(chunk instanceof Uint8Array)) {
+          open5 = false;
+          controller.error(new Error("ACP adapter produced invalid output"));
+          return;
+        }
+        byteLength += chunk.byteLength;
+        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
+          open5 = false;
+          controller.error(new Error("ACP adapter output limit exceeded"));
+          return;
+        }
+        controller.enqueue(new Uint8Array(chunk));
+      });
+      input2.once("end", () => {
+        if (open5) {
+          open5 = false;
+          controller.close();
+        }
+      });
+      input2.once("error", (error61) => {
+        if (open5) {
+          open5 = false;
+          controller.error(error61);
+        }
+      });
+    },
+    cancel() {
+      open5 = false;
+    }
+  });
+}
+function writableAcpStream(output2) {
+  return new WritableStream({
+    write(chunk) {
+      return new Promise((resolveWrite, rejectWrite) => {
+        output2.write(chunk, (error61) => {
+          if (error61) {
+            rejectWrite(error61);
+            return;
+          }
+          resolveWrite();
+        });
+      });
+    }
+  });
+}
+async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
+  signal.throwIfAborted();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort(new Error("ACP probe timed out"));
+  }, specification.acpProbeTimeoutMilliseconds);
+  const abort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", abort, { once: true });
+  if (signal.aborted) {
+    abort();
+  }
+  const child = spawn2(agent.adapterPath, [...agent.arguments], {
+    cwd: defaultWorkspace,
+    detached: process.platform !== "win32",
+    env: { ...environment, ...agent.environment },
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const processExit = new Promise((_resolve, reject) => {
+    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
+    child.once("error", reject);
+    child.once("exit", rejectExit);
+    if (child.exitCode !== null || child.signalCode !== null) {
+      rejectExit();
+    }
+  });
+  const stdin = child.stdin;
+  const stdout = child.stdout;
+  const stderr = child.stderr;
+  if (stdin === null || stdout === null || stderr === null) {
+    await stopProcessTree(child);
+    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
+  }
+  let stderrBytes = 0;
+  const consumeStderr = (chunk) => {
+    stderrBytes += chunk.byteLength;
+    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
+      controller.abort(new Error("ACP adapter output limit exceeded"));
+    }
+  };
+  stderr.on("data", consumeStderr);
+  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
+    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
+  );
+  try {
+    const initialized = await Promise.race([
+      connection.agent.request(
+        methods4.agent.initialize,
+        {
+          clientCapabilities: {},
+          clientInfo: { name: "mobius", version: "0.0.3" },
+          protocolVersion: PROTOCOL_VERSION
+        },
+        { cancellationSignal: controller.signal }
+      ),
+      processExit
+    ]);
+    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
+      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
+    }
+    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
+    return new VerifiedAcpReadiness(
+      normalizeVersionOutput(initialized.agentInfo?.version ?? ""),
+      normalizeAcpCapabilities(initialized)
+    );
+  } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
+    if (timedOut) {
+      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
+    }
+    if (error61 instanceof AgentProbeError) {
+      throw error61;
+    }
+    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
+      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
+    }
+    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", abort);
+    connection.close();
+    stdin.end();
+    stderr.removeListener("data", consumeStderr);
+    await stopProcessTree(child);
+  }
+}
+
 // src/agent-catalog/executable-discovery.ts
-import { isAbsolute as isAbsolute6, join as join12 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // src/agent-installation/managed-adapter-installer.ts
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var ManagedAdapterInstallError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -2166,7 +2443,7 @@ var ManagedAdapterInstaller = class {
     this.#stateDirectory = options.stateDirectory;
   }
   install = async (specification, signal) => {
-    const root = join11(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
+    const root = join12(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
     try {
       return await this.#npmInstaller.install(
         root,
@@ -2200,7 +2477,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
   let managed;
   try {
     managed = await validateManagedAdapter(
-      join12(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
+      join13(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
       specification
     );
   } catch {
@@ -2211,7 +2488,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
 async function resolveSpecificationExecutables(executableName, overrideVariable, resolveInstalled, resolveManaged, context) {
   const override = context.environment[overrideVariable];
   if (override !== void 0) {
-    if (override.length === 0 || !isAbsolute6(override)) {
+    if (override.length === 0 || !isAbsolute7(override)) {
       return [];
     }
     const executable = await resolveExecutablePath(override, context.platform);
@@ -2265,10 +2542,7 @@ async function resolveAdapterExecutable(specification, context) {
   const executables = await resolveAdapterExecutables(specification, context);
   return executables[0] ?? null;
 }
-function normalizedVersion(output2) {
-  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
-}
-async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds) {
+async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds, normalize4 = normalizeVersionOutput) {
   const result = await runBoundedProcess({
     arguments: arguments_,
     command: executable.path,
@@ -2277,7 +2551,7 @@ async function probeVersion(executable, arguments_, environment, defaultWorkspac
     signal,
     timeoutMilliseconds
   });
-  const version2 = normalizedVersion(result.stdout || result.stderr);
+  const version2 = normalize4(result.stdout || result.stderr);
   if (version2.length === 0) {
     throw new ProcessExecutionError("process_exit_failed", "The executable did not report a version");
   }
@@ -2301,7 +2575,8 @@ async function findVerifiedAgentExecutable(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
       return new VerifiedAgentExecutable(executable, version2);
     } catch {
@@ -2313,168 +2588,6 @@ async function findVerifiedAgentExecutable(specification, context) {
   return null;
 }
 
-// src/agent-catalog/acp-readiness-probe.ts
-var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
-var VerifiedAcpReadiness = class {
-  adapterVersion;
-  capabilities;
-  constructor(adapterVersion, capabilities) {
-    this.adapterVersion = adapterVersion;
-    this.capabilities = capabilities;
-  }
-};
-var DiscoveryAcpHandler = class {
-  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
-  onElicitationComplete = (_notification) => Promise.resolve();
-  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
-  onUpdate = (_notification) => Promise.resolve();
-};
-function readableAcpStream(input2) {
-  let byteLength = 0;
-  let open5 = true;
-  return new ReadableStream({
-    start(controller) {
-      input2.on("data", (chunk) => {
-        if (!open5) {
-          return;
-        }
-        if (!(chunk instanceof Uint8Array)) {
-          open5 = false;
-          controller.error(new Error("ACP adapter produced invalid output"));
-          return;
-        }
-        byteLength += chunk.byteLength;
-        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
-          open5 = false;
-          controller.error(new Error("ACP adapter output limit exceeded"));
-          return;
-        }
-        controller.enqueue(new Uint8Array(chunk));
-      });
-      input2.once("end", () => {
-        if (open5) {
-          open5 = false;
-          controller.close();
-        }
-      });
-      input2.once("error", (error61) => {
-        if (open5) {
-          open5 = false;
-          controller.error(error61);
-        }
-      });
-    },
-    cancel() {
-      open5 = false;
-    }
-  });
-}
-function writableAcpStream(output2) {
-  return new WritableStream({
-    write(chunk) {
-      return new Promise((resolveWrite, rejectWrite) => {
-        output2.write(chunk, (error61) => {
-          if (error61) {
-            rejectWrite(error61);
-            return;
-          }
-          resolveWrite();
-        });
-      });
-    }
-  });
-}
-async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
-  signal.throwIfAborted();
-  const controller = new AbortController();
-  let timedOut = false;
-  const timeout = setTimeout(() => {
-    timedOut = true;
-    controller.abort(new Error("ACP probe timed out"));
-  }, specification.acpProbeTimeoutMilliseconds);
-  const abort = () => controller.abort(signal.reason);
-  signal.addEventListener("abort", abort, { once: true });
-  if (signal.aborted) {
-    abort();
-  }
-  const child = spawn2(agent.adapterPath, [...agent.arguments], {
-    cwd: defaultWorkspace,
-    detached: process.platform !== "win32",
-    env: { ...environment, ...agent.environment },
-    shell: false,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  const processExit = new Promise((_resolve, reject) => {
-    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
-    child.once("error", reject);
-    child.once("exit", rejectExit);
-    if (child.exitCode !== null || child.signalCode !== null) {
-      rejectExit();
-    }
-  });
-  const stdin = child.stdin;
-  const stdout = child.stdout;
-  const stderr = child.stderr;
-  if (stdin === null || stdout === null || stderr === null) {
-    await stopProcessTree(child);
-    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
-  }
-  let stderrBytes = 0;
-  const consumeStderr = (chunk) => {
-    stderrBytes += chunk.byteLength;
-    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
-      controller.abort(new Error("ACP adapter output limit exceeded"));
-    }
-  };
-  stderr.on("data", consumeStderr);
-  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
-    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
-  );
-  try {
-    const initialized = await Promise.race([
-      connection.agent.request(
-        methods4.agent.initialize,
-        {
-          clientCapabilities: {},
-          clientInfo: { name: "mobius", version: "0.0.3" },
-          protocolVersion: PROTOCOL_VERSION
-        },
-        { cancellationSignal: controller.signal }
-      ),
-      processExit
-    ]);
-    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
-      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
-    }
-    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
-    return new VerifiedAcpReadiness(
-      normalizedVersion(initialized.agentInfo?.version ?? ""),
-      normalizeAcpCapabilities(initialized)
-    );
-  } catch (error61) {
-    if (signal.aborted) {
-      signal.throwIfAborted();
-    }
-    if (timedOut) {
-      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
-    }
-    if (error61 instanceof AgentProbeError) {
-      throw error61;
-    }
-    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
-      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
-    }
-    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
-  } finally {
-    clearTimeout(timeout);
-    signal.removeEventListener("abort", abort);
-    connection.close();
-    stdin.end();
-    stderr.removeListener("data", consumeStderr);
-    await stopProcessTree(child);
-  }
-}
-
 // src/agent-catalog/discover-agent.ts
 function agentProbeFailure(specification, error61) {
   if (error61 instanceof AgentProbeError) {
@@ -2518,7 +2631,8 @@ async function discoverAgent(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
     } catch (error61) {
       if (context.signal.aborted) {
@@ -2554,7 +2668,8 @@ async function discoverAgent(specification, context) {
             },
             context.defaultWorkspace,
             context.signal,
-            specification.versionProbeTimeoutMilliseconds
+            specification.versionProbeTimeoutMilliseconds,
+            specification.normalizeAdapterVersion
           );
         }
       } catch (error61) {
@@ -2787,7 +2902,7 @@ async function executeBotMessageCommand(arguments_, environment, signal) {
 }
 
 // src/config.ts
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -18841,8 +18956,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = /* @__PURE__ */ new Map();
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -21657,6 +21772,28 @@ function date4(params) {
 
 // ../protocol/src/prompt-usage.ts
 var TOKEN_COUNT = external_exports.number().int().nonnegative();
+function normalizeQuotaTokenCount(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return value;
+  }
+  if (Reflect.has(value, "inputTokens") || Reflect.has(value, "outputTokens") || Reflect.has(value, "totalTokens")) {
+    return value;
+  }
+  if (!Reflect.has(value, "input_tokens") && !Reflect.has(value, "output_tokens")) {
+    return value;
+  }
+  const inputTokens = Reflect.get(value, "input_tokens");
+  const outputTokens = Reflect.get(value, "output_tokens");
+  const reportedTotal = Reflect.get(value, "total_tokens");
+  return {
+    cachedInputTokens: Reflect.get(value, "cached_input_tokens"),
+    cachedWriteTokens: Reflect.get(value, "cached_write_tokens"),
+    inputTokens,
+    outputTokens,
+    reasoningOutputTokens: Reflect.get(value, "reasoning_output_tokens"),
+    totalTokens: reportedTotal === void 0 && typeof inputTokens === "number" && typeof outputTokens === "number" ? inputTokens + outputTokens : reportedTotal
+  };
+}
 var promptUsageSchema = external_exports.object({
   cachedReadTokens: TOKEN_COUNT.nullish(),
   cachedWriteTokens: TOKEN_COUNT.nullish(),
@@ -21665,14 +21802,17 @@ var promptUsageSchema = external_exports.object({
   thoughtTokens: TOKEN_COUNT.nullish(),
   totalTokens: TOKEN_COUNT
 }).readonly();
-var quotaTokenCountSchema = external_exports.object({
-  cachedInputTokens: TOKEN_COUNT,
-  cachedWriteTokens: TOKEN_COUNT.optional(),
-  inputTokens: TOKEN_COUNT,
-  outputTokens: TOKEN_COUNT,
-  reasoningOutputTokens: TOKEN_COUNT,
-  totalTokens: TOKEN_COUNT
-}).readonly();
+var quotaTokenCountSchema = external_exports.preprocess(
+  normalizeQuotaTokenCount,
+  external_exports.object({
+    cachedInputTokens: TOKEN_COUNT.optional(),
+    cachedWriteTokens: TOKEN_COUNT.optional(),
+    inputTokens: TOKEN_COUNT,
+    outputTokens: TOKEN_COUNT,
+    reasoningOutputTokens: TOKEN_COUNT.optional(),
+    totalTokens: TOKEN_COUNT
+  }).readonly()
+);
 var promptMetadataSchema = external_exports.object({
   quota: external_exports.object({
     model_usage: external_exports.array(
@@ -21799,6 +21939,7 @@ var elicitationFieldSchema = external_exports.strictObject({
   type: external_exports.enum(["boolean", "integer", "multiselect", "number", "select", "string"])
 }).readonly();
 var displayContentSchema = external_exports.strictObject({
+  artifactId: external_exports.string().max(128).default(""),
   data: external_exports.string().max(4e6),
   mimeType: external_exports.string().max(255),
   name: external_exports.string().max(500),
@@ -21811,6 +21952,7 @@ var displayContentSchema = external_exports.strictObject({
   uri: external_exports.string().max(4096)
 }).readonly();
 var recordedDisplayContentSchema = external_exports.strictObject({
+  artifactId: external_exports.string().max(128).default(""),
   data: external_exports.string().max(4e6),
   mimeType: external_exports.string().max(255),
   name: external_exports.string().max(500),
@@ -23298,7 +23440,7 @@ var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSc
 // src/config.ts
 function loadDefaultWorkspace(environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join13(readStateDirectory(environment), "workspace");
+  return configuredWorkspace ?? join14(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23317,7 +23459,7 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir3, open as open4, realpath as realpath6, rename as rename3, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname as hostname3 } from "node:os";
-import { basename, join as join14, resolve as resolve3 } from "node:path";
+import { basename, join as join15, resolve as resolve3 } from "node:path";
 import { fetch as fetch2 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
@@ -23517,10 +23659,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
 async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
-  const connectionsDirectory = join14(readStateDirectory(environment), "connections");
+  const connectionsDirectory = join15(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
+  const connectionPath = join15(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join15(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
@@ -23558,7 +23700,7 @@ function decodeSavedConnection(value, expectedChannelId) {
   };
 }
 async function readSavedConnection(channelId, environment) {
-  const connectionPath = join14(readStateDirectory(environment), "connections", `${channelId}.json`);
+  const connectionPath = join15(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -23594,7 +23736,7 @@ function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
   relayUrl.searchParams.set("token", connection.runtimeCredential);
-  const auditDatabasePath = join14(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
+  const auditDatabasePath = join15(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -23644,7 +23786,7 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
 }
 async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
   const normalizedChannelId = validatePairingId(channelId);
-  const connectionPath = join14(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connectionPath = join15(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
   const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
@@ -23681,7 +23823,7 @@ var AuditStore = class {
       this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
     }
   }
-  record(record2) {
+  record(record3) {
     this.database.prepare(
       `
           INSERT INTO audit_events (
@@ -23694,10 +23836,10 @@ var AuditStore = class {
         `
     ).run(
       (/* @__PURE__ */ new Date()).toISOString(),
-      record2.event,
-      record2.commandId,
-      record2.sessionId,
-      JSON.stringify(record2.details ?? {})
+      record3.event,
+      record3.commandId,
+      record3.sessionId,
+      JSON.stringify(record3.details ?? {})
     );
   }
   close() {
@@ -23707,9 +23849,9 @@ var AuditStore = class {
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { basename as basename4, join as join16 } from "node:path";
+import { basename as basename5, join as join17 } from "node:path";
 import { styleText } from "node:util";
-import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
+import { fetch as fetch7, WebSocket as WebSocket2 } from "undici";
 
 // src/acp/session-manager.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -23720,6 +23862,212 @@ import {
   RequestError as RequestError2
 } from "@agentclientprotocol/sdk";
 
+// src/authorization/local-raster.ts
+import { readFile, realpath as realpath7, stat as stat6 } from "node:fs/promises";
+import { basename as basename2, isAbsolute as isAbsolute8, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
+import { fileURLToPath } from "node:url";
+var MAX_LOCAL_RASTER_BYTES = 3e6;
+var PNG_SIGNATURE = Uint8Array.of(137, 80, 78, 71);
+var JPEG_SIGNATURE = Uint8Array.of(255, 216, 255);
+var GIF87_SIGNATURE = new TextEncoder().encode("GIF87a");
+var GIF89_SIGNATURE = new TextEncoder().encode("GIF89a");
+var RIFF_SIGNATURE = new TextEncoder().encode("RIFF");
+var WEBP_SIGNATURE = new TextEncoder().encode("WEBP");
+var LocalRasterImage = class {
+  bytes;
+  mimeType;
+  name;
+  constructor(name, mimeType, bytes) {
+    this.bytes = bytes;
+    this.mimeType = mimeType;
+    this.name = name;
+  }
+  base64 = () => Buffer.from(this.bytes).toString("base64");
+};
+function startsWith(bytes, signature, offset = 0) {
+  if (bytes.byteLength < offset + signature.byteLength) {
+    return false;
+  }
+  return signature.every((value, index) => bytes[offset + index] === value);
+}
+function sniffRasterMime(bytes) {
+  if (startsWith(bytes, PNG_SIGNATURE)) {
+    return "image/png";
+  }
+  if (startsWith(bytes, JPEG_SIGNATURE)) {
+    return "image/jpeg";
+  }
+  if (startsWith(bytes, GIF87_SIGNATURE) || startsWith(bytes, GIF89_SIGNATURE)) {
+    return "image/gif";
+  }
+  if (startsWith(bytes, RIFF_SIGNATURE) && startsWith(bytes, WEBP_SIGNATURE, 8)) {
+    return "image/webp";
+  }
+  return null;
+}
+function isInsideRoot(root, target) {
+  const relation = relative4(root, target);
+  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute8(relation);
+}
+async function resolveCanonicalPath(requested, signal) {
+  signal.throwIfAborted();
+  if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+    return null;
+  }
+  try {
+    const target = await realpath7(requested);
+    signal.throwIfAborted();
+    if (!isAbsolute8(target) || normalize2(target) !== target) {
+      return null;
+    }
+    return target;
+  } catch (cause) {
+    signal.throwIfAborted();
+    if (cause instanceof Error && cause.name === "AbortError") {
+      throw cause;
+    }
+    return null;
+  }
+}
+function parseLocalImageUri(uri) {
+  const trimmed = uri.trim();
+  if (trimmed.length === 0 || trimmed.length > 2048 || trimmed.includes("\0")) {
+    return null;
+  }
+  if (trimmed.startsWith("data:")) {
+    return null;
+  }
+  if (trimmed.startsWith("file:")) {
+    try {
+      const url2 = new URL(trimmed);
+      if (url2.protocol !== "file:" || url2.host.length > 0) {
+        return null;
+      }
+      return fileURLToPath(url2);
+    } catch {
+      return null;
+    }
+  }
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+  return trimmed;
+}
+async function readAuthorizedRaster(uri, roots, signal) {
+  signal.throwIfAborted();
+  const requested = parseLocalImageUri(uri);
+  if (requested === null) {
+    return null;
+  }
+  const target = await resolveCanonicalPath(requested, signal);
+  if (target === null) {
+    return null;
+  }
+  const targetMetadata = await stat6(target);
+  signal.throwIfAborted();
+  if (!targetMetadata.isFile() || targetMetadata.size < 1 || targetMetadata.size > MAX_LOCAL_RASTER_BYTES) {
+    return null;
+  }
+  const authorizedRoots = [];
+  for (const root of roots) {
+    const directory = await resolveCanonicalPath(root, signal);
+    if (directory === null) {
+      continue;
+    }
+    const metadata = await stat6(directory);
+    signal.throwIfAborted();
+    if (metadata.isDirectory()) {
+      authorizedRoots.push(directory);
+    }
+  }
+  if (!authorizedRoots.some((root) => isInsideRoot(root, target))) {
+    return null;
+  }
+  const bytes = new Uint8Array(await readFile(target));
+  signal.throwIfAborted();
+  if (bytes.byteLength < 1 || bytes.byteLength > MAX_LOCAL_RASTER_BYTES) {
+    return null;
+  }
+  const mimeType = sniffRasterMime(bytes);
+  if (mimeType === null) {
+    return null;
+  }
+  return new LocalRasterImage(basename2(target) || "Image", mimeType, bytes);
+}
+
+// src/native-sessions/history-images.ts
+var IMAGE_MARKER = /\[@image\]\(([^)\r\n]*)(?:\)|$)/g;
+async function embedLocalHistoryImages(history, roots, signal) {
+  if (history.status !== "available") {
+    return history;
+  }
+  const messages = [];
+  let imageCharacters = 0;
+  for (const message of history.messages) {
+    signal.throwIfAborted();
+    const resolved = await resolveMessageImages(message, roots, imageCharacters, signal);
+    imageCharacters += (resolved.images ?? []).reduce((size, image) => size + image.data.length, 0);
+    messages.push(resolved);
+  }
+  return {
+    ...history,
+    messages
+  };
+}
+async function resolveMessageImages(message, roots, usedCharacters, signal) {
+  const images = [...message.images ?? []];
+  let imageCharacters = images.reduce((size, image) => size + image.data.length, 0);
+  const text = await replaceImageMarkers(message.text, async (uri) => {
+    if (images.length >= 8 || usedCharacters + imageCharacters >= SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      return "[Image unavailable]";
+    }
+    const embedded = parseNativeHistoryText(`[@image](${uri})`).images[0];
+    if (embedded !== void 0) {
+      if (usedCharacters + imageCharacters + embedded.data.length > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+        return "[Image unavailable]";
+      }
+      images.push(embedded);
+      imageCharacters += embedded.data.length;
+      return "";
+    }
+    const local = await readAuthorizedRaster(uri, roots, signal);
+    if (local === null) {
+      return "[Image unavailable]";
+    }
+    const data = local.base64();
+    if (usedCharacters + imageCharacters + data.length > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      return "[Image unavailable]";
+    }
+    images.push({
+      data,
+      mimeType: local.mimeType,
+      name: local.name
+    });
+    imageCharacters += data.length;
+    return "";
+  });
+  return {
+    ...message,
+    text,
+    ...images.length > 0 ? { images } : {}
+  };
+}
+async function replaceImageMarkers(text, replace) {
+  const matches = [...text.matchAll(IMAGE_MARKER)];
+  if (matches.length === 0) {
+    return text;
+  }
+  let cursor = 0;
+  let rewritten = "";
+  for (const match of matches) {
+    const index = match.index ?? 0;
+    rewritten += text.slice(cursor, index);
+    rewritten += await replace(match[1] ?? "");
+    cursor = index + match[0].length;
+  }
+  return `${rewritten}${text.slice(cursor)}`;
+}
+
 // src/acp/activity.ts
 var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
 function isRecord8(value) {
@@ -23817,6 +24165,7 @@ function readContentOutputDetail(content) {
 function summarizeDisplayContent(content) {
   return {
     ...content,
+    artifactId: truncate(content.artifactId, 128),
     data: truncate(content.data, AGENT_ACTIVITY_DETAIL_LIMIT),
     mimeType: truncate(content.mimeType, 255),
     name: truncate(content.name, 500),
@@ -23829,7 +24178,7 @@ function summarizeDisplayContent(content) {
   };
 }
 function contentFitsRecordingEnvelope(content) {
-  return content.data.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.mimeType.length <= 255 && content.name.length <= 500 && content.newText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.oldText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.path.length <= 2048 && content.terminalId.length <= 255 && content.text.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.uri.length <= 4096;
+  return content.artifactId.length <= 128 && content.data.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.mimeType.length <= 255 && content.name.length <= 500 && content.newText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.oldText.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.path.length <= 2048 && content.terminalId.length <= 255 && content.text.length <= AGENT_ACTIVITY_RECORDED_FIELD_LIMIT && content.uri.length <= 4096;
 }
 function encodedByteLength(value) {
   return new TextEncoder().encode(JSON.stringify(value)).byteLength;
@@ -23855,6 +24204,7 @@ function recordedDetail(activity) {
 }
 function emptyDisplayContent(type) {
   return {
+    artifactId: "",
     data: "",
     mimeType: "",
     name: "",
@@ -23867,6 +24217,16 @@ function emptyDisplayContent(type) {
     uri: ""
   };
 }
+function imageDisplayContent(mimeType, name, data, artifactId = "", uri = "") {
+  return {
+    ...emptyDisplayContent("image"),
+    artifactId,
+    data,
+    mimeType,
+    name,
+    uri
+  };
+}
 function normalizeContentBlock(content) {
   if (content.type === "text") {
     return { ...emptyDisplayContent("text"), text: content.text };
@@ -24658,7 +25018,6 @@ var AcpHistoryReplay = class {
   #messages = [];
   #lastMessageId = null;
   #characters = 0;
-  #imageCharacters = 0;
   #truncated = false;
   record = (update) => {
     if (update.sessionUpdate !== "user_message_chunk" && update.sessionUpdate !== "agent_message_chunk") {
@@ -24669,40 +25028,30 @@ var AcpHistoryReplay = class {
     }
     const role = update.sessionUpdate === "user_message_chunk" ? "user" : "assistant";
     const content = update.content;
-    const parsed = parseNativeHistoryText(
-      content.type === "text" ? content.text : content.type === "image" ? `[@image](data:${content.mimeType};base64,${content.data})` : `[${content.type} attachment]`
-    );
-    const text = parsed.text;
-    if (text.length === 0 && parsed.images.length === 0) {
+    const text = content.type === "text" ? content.text : content.type === "image" ? content.data.length > 0 ? `[@image](data:${content.mimeType};base64,${content.data})` : content.uri != null && content.uri.length > 0 ? `[@image](${content.uri})` : "[image attachment]" : `[${content.type} attachment]`;
+    if (text.length === 0) {
       return;
     }
     const previous = this.#messages.at(-1);
     const id = update.messageId ?? null;
     const continuation = previous?.role === role && id === this.#lastMessageId;
     const combined = continuation ? `${previous.text}${text}` : text;
-    const allImages = continuation ? [...previous.images ?? [], ...parsed.images] : parsed.images;
-    const images = allImages.slice(0, 8);
-    this.#truncated ||= images.length < allImages.length;
     if (continuation) {
       this.#messages.pop();
       this.#characters -= previous.text.length;
-      this.#imageCharacters -= (previous.images ?? []).reduce((size, image) => size + image.data.length, 0);
     }
     const bounded = combined.slice(-SESSION_HISTORY_CHARACTER_LIMIT);
     this.#truncated ||= bounded.length < combined.length;
     this.#messages.push({
       role,
-      text: bounded,
-      ...images.length > 0 ? { images } : {}
+      text: bounded
     });
     this.#characters += bounded.length;
-    this.#imageCharacters += images.reduce((size, image) => size + image.data.length, 0);
     this.#lastMessageId = id;
-    while (this.#messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || this.#characters > SESSION_HISTORY_CHARACTER_LIMIT || this.#imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+    while (this.#messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || this.#characters > SESSION_HISTORY_CHARACTER_LIMIT) {
       const removed = this.#messages.shift();
       if (removed !== void 0) {
         this.#characters -= removed.text.length;
-        this.#imageCharacters -= (removed.images ?? []).reduce((size, image) => size + image.data.length, 0);
       }
       this.#truncated = true;
     }
@@ -24925,6 +25274,10 @@ var MAX_PRE_SESSION_UPDATES = 100;
 var MAX_PRE_SESSION_UPDATE_BYTES = 1024 * 1024;
 var SESSION_CONTROL_COMMAND_ID = "session-control";
 var NullAcpSessionObserver = class {
+  importLocalImage = (_sessionId, _image, signal) => {
+    signal.throwIfAborted();
+    return Promise.resolve("");
+  };
   onCommands = () => Promise.resolve();
   onConfig = () => Promise.resolve();
   onContent = () => Promise.resolve();
@@ -25547,11 +25900,75 @@ var AcpProcessSession = class _AcpProcessSession {
       );
       await this.#updateTail;
       signal.throwIfAborted();
-      return history.snapshot();
+      return await embedLocalHistoryImages(
+        history.snapshot(),
+        [this.#cwd, ...this.#additionalDirectories],
+        signal
+      );
     } finally {
       this.#replay = { kind: "idle" };
     }
   };
+  imageRoots = () => [this.#cwd, ...this.#additionalDirectories];
+  emitAgentText = async (text, messageId) => {
+    const signal = AbortSignal.timeout(2e4);
+    const parts = text.split(/(\[@image\]\([^)\r\n]*(?:\)|$))/);
+    let leftover = "";
+    for (const part of parts) {
+      const marker = /^\[@image\]\(([^)\r\n]*)(?:\)|$)/.exec(part);
+      if (marker === null) {
+        leftover += part;
+        continue;
+      }
+      if (leftover.length > 0) {
+        await this.#turn.onText(leftover, messageId);
+        leftover = "";
+      }
+      const raster = await readAuthorizedRaster(marker[1] ?? "", this.imageRoots(), signal);
+      if (raster === null) {
+        leftover += "[Image unavailable]";
+        continue;
+      }
+      await this.emitRaster(raster, messageId, signal);
+    }
+    if (leftover.length > 0) {
+      await this.#turn.onText(leftover, messageId);
+    }
+  };
+  emitAgentContent = async (content, messageId) => {
+    if (content.type === "image" && content.data.length === 0 && content.uri.length > 0) {
+      const signal = AbortSignal.timeout(2e4);
+      const raster = await readAuthorizedRaster(content.uri, this.imageRoots(), signal);
+      if (raster !== null) {
+        await this.emitRaster(raster, messageId, signal);
+        return;
+      }
+    }
+    await this.#getObserver().onContent({
+      commandId: this.#turn.commandId,
+      content,
+      contentId: `content-${crypto.randomUUID()}`,
+      kind: AGENT_CONTENT_KIND,
+      messageId,
+      sessionId: this.#mobiusSessionId
+    });
+  };
+  emitRaster = async (raster, messageId, signal) => {
+    const artifactId = await this.#getObserver().importLocalImage(this.#mobiusSessionId, raster, signal);
+    await this.#getObserver().onContent({
+      commandId: this.#turn.commandId,
+      content: imageDisplayContent(
+        raster.mimeType,
+        raster.name,
+        artifactId.length > 0 ? "" : raster.base64(),
+        artifactId
+      ),
+      contentId: `content-${crypto.randomUUID()}`,
+      kind: AGENT_CONTENT_KIND,
+      messageId,
+      sessionId: this.#mobiusSessionId
+    });
+  };
   async #initializeAgent(signal) {
     const initialized = await this.race(
       this.#connection.agent.request(
@@ -26254,18 +26671,14 @@ var AcpProcessSession = class _AcpProcessSession {
           );
         } else {
           await this.#turn.activities.finishNarrative();
-          await this.#turn.onText(update.content.text, truncate3(update.messageId ?? "", 255));
+          await this.emitAgentText(update.content.text, truncate3(update.messageId ?? "", 255));
         }
       } else {
         await this.#turn.activities.finishNarrative();
-        await this.#getObserver().onContent({
-          commandId: this.#turn.commandId,
-          content: normalizeContentBlock(update.content),
-          contentId: `content-${crypto.randomUUID()}`,
-          kind: AGENT_CONTENT_KIND,
-          messageId: truncate3(update.messageId ?? "", 255),
-          sessionId: this.#mobiusSessionId
-        });
+        await this.emitAgentContent(
+          normalizeContentBlock(update.content),
+          truncate3(update.messageId ?? "", 255)
+        );
       }
       return;
     }
@@ -27626,6 +28039,402 @@ var FixedInstallationExecutor = class {
   };
 };
 
+// src/artifacts/runtime-artifact-uploader.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../mobius-sdk/src/errors.ts
+var MobiusError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "MobiusError";
+  }
+};
+var MobiusProtocolError = class extends MobiusError {
+  constructor(message, options = {}) {
+    super("invalid_service_response", message, options);
+    this.name = "MobiusProtocolError";
+  }
+};
+var MobiusValidationError = class extends MobiusError {
+  constructor(message, options = {}) {
+    super("invalid_request", message, options);
+    this.name = "MobiusValidationError";
+  }
+};
+
+// ../mobius-sdk/src/resources.ts
+var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function invalidResponse(message) {
+  return new MobiusProtocolError(message);
+}
+function isRecord11(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function record2(value, name) {
+  if (!isRecord11(value)) {
+    throw invalidResponse(`The service returned an invalid ${name}`);
+  }
+  return value;
+}
+function stringField(value, field, maximumLength = 85e5) {
+  const candidate = value[field];
+  if (typeof candidate !== "string" || candidate.length > maximumLength) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return candidate;
+}
+function identifierField(value, field) {
+  const candidate = stringField(value, field, 128);
+  if (!IDENTIFIER_PATTERN6.test(candidate)) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return candidate;
+}
+function integerField(value, field) {
+  const candidate = value[field];
+  if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 0) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return candidate;
+}
+function validateTimestamp(value, field) {
+  if (Number.isNaN(Date.parse(value))) {
+    throw invalidResponse(`The service returned an invalid ${field}`);
+  }
+  return value;
+}
+var MobiusArtifactUploadRequest = class {
+  byteLength;
+  mediaType;
+  name;
+  sha256;
+  constructor(name, mediaType, byteLength, sha256) {
+    if (name.length < 1 || name.length > 500 || name.includes("\0") || mediaType.length < 1 || mediaType.length > 255 || mediaType.includes("\r") || mediaType.includes("\n") || !Number.isSafeInteger(byteLength) || byteLength < 1 || !/^[a-f0-9]{64}$/.test(sha256)) {
+      throw new MobiusValidationError("The artifact upload request is invalid");
+    }
+    this.byteLength = byteLength;
+    this.mediaType = mediaType;
+    this.name = name;
+    this.sha256 = sha256;
+  }
+};
+var MobiusArtifact = class {
+  artifactId;
+  byteLength;
+  createdAt;
+  mediaType;
+  name;
+  sessionId;
+  sha256;
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt) {
+    this.artifactId = artifactId;
+    this.byteLength = byteLength;
+    this.createdAt = createdAt;
+    this.mediaType = mediaType;
+    this.name = name;
+    this.sessionId = sessionId;
+    this.sha256 = sha256;
+  }
+};
+var MobiusUploadingArtifact = class extends MobiusArtifact {
+  expiresAt;
+  state = "uploading";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, expiresAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.expiresAt = expiresAt;
+  }
+};
+var MobiusArtifactUpload = class extends MobiusUploadingArtifact {
+  uploadToken;
+  constructor(artifact, uploadToken) {
+    super(
+      artifact.sessionId,
+      artifact.artifactId,
+      artifact.name,
+      artifact.mediaType,
+      artifact.byteLength,
+      artifact.sha256,
+      artifact.createdAt,
+      artifact.expiresAt
+    );
+    this.uploadToken = uploadToken;
+  }
+};
+var MobiusAvailableArtifact = class extends MobiusArtifact {
+  availableAt;
+  state = "available";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, availableAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.availableAt = availableAt;
+  }
+};
+var MobiusExpiredArtifact = class extends MobiusArtifact {
+  expiredAt;
+  state = "expired";
+  constructor(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt, expiredAt) {
+    super(sessionId, artifactId, name, mediaType, byteLength, sha256, createdAt);
+    this.expiredAt = expiredAt;
+  }
+};
+function artifactFields(value) {
+  const sha256 = stringField(value, "sha256", 64);
+  if (!/^[a-f0-9]{64}$/.test(sha256)) {
+    throw invalidResponse("The service returned an invalid artifact digest");
+  }
+  return {
+    artifactId: identifierField(value, "artifactId"),
+    byteLength: integerField(value, "byteLength"),
+    createdAt: validateTimestamp(stringField(value, "createdAt", 128), "createdAt"),
+    mediaType: stringField(value, "mediaType", 255),
+    name: stringField(value, "name", 500),
+    sessionId: identifierField(value, "sessionId"),
+    sha256
+  };
+}
+function uploadingArtifact(value) {
+  const fields = artifactFields(value);
+  return new MobiusUploadingArtifact(
+    fields.sessionId,
+    fields.artifactId,
+    fields.name,
+    fields.mediaType,
+    fields.byteLength,
+    fields.sha256,
+    fields.createdAt,
+    validateTimestamp(stringField(value, "expiresAt", 128), "expiresAt")
+  );
+}
+function decodeMobiusArtifactUpload(value) {
+  const artifact = record2(value, "artifact upload authorization");
+  return new MobiusArtifactUpload(uploadingArtifact(artifact), stringField(artifact, "uploadToken", 256));
+}
+function decodeMobiusArtifact(value) {
+  const artifact = record2(value, "artifact");
+  const state = stringField(artifact, "state", 32);
+  if (state === "uploading") {
+    return uploadingArtifact(artifact);
+  }
+  const fields = artifactFields(artifact);
+  if (state === "available") {
+    return new MobiusAvailableArtifact(
+      fields.sessionId,
+      fields.artifactId,
+      fields.name,
+      fields.mediaType,
+      fields.byteLength,
+      fields.sha256,
+      fields.createdAt,
+      validateTimestamp(stringField(artifact, "availableAt", 128), "availableAt")
+    );
+  }
+  if (state === "expired") {
+    return new MobiusExpiredArtifact(
+      fields.sessionId,
+      fields.artifactId,
+      fields.name,
+      fields.mediaType,
+      fields.byteLength,
+      fields.sha256,
+      fields.createdAt,
+      validateTimestamp(stringField(artifact, "expiredAt", 128), "expiredAt")
+    );
+  }
+  throw invalidResponse("The service returned an invalid artifact state");
+}
+function decodeMobiusAvailableArtifact(value) {
+  const artifact = decodeMobiusArtifact(value);
+  if (!(artifact instanceof MobiusAvailableArtifact)) {
+    throw invalidResponse("The service did not make the artifact available");
+  }
+  return artifact;
+}
+var MobiusRuntimePairingLifecycle = Object.freeze({
+  Expired: "expired",
+  Paired: "paired",
+  Pending: "pending",
+  Revoked: "revoked"
+});
+
+// src/artifacts/runtime-artifact-uploader.ts
+import { fetch as fetch4 } from "undici";
+var UPLOAD_TIMEOUT_MILLISECONDS = 2e4;
+var RuntimeArtifactUploadError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "RuntimeArtifactUploadError";
+  }
+};
+var UploadedRuntimeArtifact = class {
+  artifactId;
+  byteLength;
+  mimeType;
+  name;
+  sha256;
+  constructor(artifactId, name, mimeType, byteLength, sha256) {
+    this.artifactId = artifactId;
+    this.byteLength = byteLength;
+    this.mimeType = mimeType;
+    this.name = name;
+    this.sha256 = sha256;
+  }
+};
+function daemonToken(config2) {
+  const token = config2.relayUrl.searchParams.get("token");
+  if (token === null || token.length < 32) {
+    throw new RuntimeArtifactUploadError("artifact_endpoint_invalid", "The Relay daemon token is missing");
+  }
+  return token;
+}
+function channelOrigin(config2) {
+  const url2 = new URL(config2.relayUrl);
+  url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
+  let channelPath = "";
+  if (url2.pathname.endsWith("/daemon")) {
+    channelPath = url2.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = `${MOBIUS_API_PREFIX}/v1/runtimes/connect`;
+    if (!url2.pathname.endsWith("/v1/runtimes/connect") && !url2.pathname.endsWith(runtimePath)) {
+      throw new RuntimeArtifactUploadError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+    }
+    channelPath = `${url2.pathname.replace(/\/v1\/runtimes\/connect$/, "")}/channels/${encodeURIComponent(config2.channelId)}`;
+  }
+  url2.pathname = channelPath;
+  url2.search = "";
+  url2.hash = "";
+  return url2;
+}
+function uploadError(code, message, cause) {
+  return new RuntimeArtifactUploadError(code, message, cause === void 0 ? {} : { cause });
+}
+function translateSdkError(cause) {
+  if (cause instanceof MobiusValidationError) {
+    throw uploadError("artifact_upload_failed", cause.message, cause);
+  }
+  if (cause instanceof MobiusProtocolError) {
+    throw uploadError("artifact_upload_failed", "The Relay returned an invalid upload response", cause);
+  }
+  throw cause;
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch (cause) {
+    throw uploadError("artifact_upload_failed", "The Relay returned an invalid upload response", cause);
+  }
+}
+async function readAuthorization(response) {
+  try {
+    return decodeMobiusArtifactUpload(await readJson(response));
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+}
+function sessionArtifactUrl(origin, sessionId, resourcePath, token) {
+  const url2 = new URL(`${origin.pathname}/sessions/${encodeURIComponent(sessionId)}/${resourcePath}`, origin);
+  url2.searchParams.set("token", token);
+  return url2;
+}
+async function postLease(url2, request, signal) {
+  return await fetch4(url2, {
+    dispatcher: environmentProxyDispatcher,
+    headers: { "content-type": "application/json" },
+    method: "POST",
+    body: JSON.stringify(request),
+    signal
+  });
+}
+async function putContent(url2, authorization, bytes, signal) {
+  return await fetch4(url2, {
+    dispatcher: environmentProxyDispatcher,
+    headers: {
+      "content-type": authorization.mediaType,
+      "x-mobius-upload-token": authorization.uploadToken
+    },
+    method: "PUT",
+    body: bytes,
+    signal
+  });
+}
+async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
+  signal.throwIfAborted();
+  let request;
+  try {
+    request = new MobiusArtifactUploadRequest(
+      image.name,
+      image.mimeType,
+      image.bytes.byteLength,
+      createHash2("sha256").update(image.bytes).digest("hex")
+    );
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+  const timeoutSignal = AbortSignal.timeout(UPLOAD_TIMEOUT_MILLISECONDS);
+  const requestSignal = AbortSignal.any([signal, timeoutSignal]);
+  const origin = channelOrigin(config2);
+  const token = daemonToken(config2);
+  let created;
+  try {
+    created = await postLease(
+      sessionArtifactUrl(origin, sessionId, "artifacts/uploads", token),
+      request,
+      requestSignal
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw uploadError(
+      timeoutSignal.aborted ? "artifact_upload_timeout" : "artifact_upload_failed",
+      timeoutSignal.aborted ? "The artifact upload authorization timed out" : "The artifact upload could not start",
+      cause
+    );
+  }
+  if (!created.ok) {
+    await created.body?.cancel();
+    throw uploadError("artifact_upload_rejected", "The Relay rejected the artifact upload");
+  }
+  const authorization = await readAuthorization(created);
+  let uploaded;
+  try {
+    uploaded = await putContent(
+      sessionArtifactUrl(
+        origin,
+        sessionId,
+        `artifacts/${encodeURIComponent(authorization.artifactId)}/content`,
+        token
+      ),
+      authorization,
+      image.bytes,
+      requestSignal
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw uploadError(
+      timeoutSignal.aborted ? "artifact_upload_timeout" : "artifact_upload_failed",
+      timeoutSignal.aborted ? "The artifact upload timed out" : "The artifact content could not be uploaded",
+      cause
+    );
+  }
+  if (!uploaded.ok) {
+    await uploaded.body?.cancel();
+    throw uploadError("artifact_upload_rejected", "The Relay rejected the artifact content");
+  }
+  try {
+    const available = decodeMobiusAvailableArtifact(await readJson(uploaded));
+    return new UploadedRuntimeArtifact(
+      available.artifactId,
+      available.name,
+      available.mediaType,
+      available.byteLength,
+      available.sha256
+    );
+  } catch (cause) {
+    translateSdkError(cause);
+  }
+}
+
 // src/authorization/local-authorization-error.ts
 var LocalAuthorizationError = class extends Error {
   code = "local_authorization_failed";
@@ -27636,9 +28445,9 @@ var LocalAuthorizationError = class extends Error {
 };
 
 // src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath7, stat as stat6 } from "node:fs/promises";
+import { readdir, realpath as realpath8, stat as stat7 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute7, join as join15, normalize as normalize2, relative as relative4 } from "node:path";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join16, normalize as normalize3, relative as relative5 } from "node:path";
 var WorkspaceDirectoryListing = class {
   directoryId;
   directoryLabel;
@@ -27664,7 +28473,7 @@ function decodePath(value, prefix) {
     throw new LocalAuthorizationError("The directory identifier is invalid");
   }
   const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize2(decoded) !== decoded) {
+  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize3(decoded) !== decoded) {
     throw new LocalAuthorizationError("The directory identifier is invalid");
   }
   return decoded;
@@ -27690,7 +28499,7 @@ var WorkspaceDirectoryService = class {
     }
     if (id.startsWith("path-")) {
       const path2 = decodePath(id, "path-");
-      if (isAbsolute7(path2)) {
+      if (isAbsolute9(path2)) {
         return path2;
       }
     }
@@ -27698,15 +28507,15 @@ var WorkspaceDirectoryService = class {
   };
   resolvePath = async (requested, signal) => {
     signal.throwIfAborted();
-    if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+    if (!isAbsolute9(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
       throw new LocalAuthorizationError("The local directory path is invalid");
     }
     try {
-      const target = await realpath7(requested);
+      const target = await realpath8(requested);
       signal.throwIfAborted();
-      const metadata = await stat6(target);
+      const metadata = await stat7(target);
       signal.throwIfAborted();
-      if (!isAbsolute7(target) || normalize2(target) !== target || !metadata.isDirectory()) {
+      if (!isAbsolute9(target) || normalize3(target) !== target || !metadata.isDirectory()) {
         throw new LocalAuthorizationError("The selected location is not a directory");
       }
       return target;
@@ -27721,8 +28530,8 @@ var WorkspaceDirectoryService = class {
     }
   };
   label = (path2) => {
-    const suffix = relative4(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute7(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+    const suffix = relative5(homedir2(), path2);
+    return suffix === "" ? "~" : !isAbsolute9(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
   };
   identify = async (bindingId, requestedPath, signal) => {
     this.authorizeMachine(bindingId);
@@ -27730,7 +28539,7 @@ var WorkspaceDirectoryService = class {
     return {
       path: path2,
       directoryId: encodePath(path2),
-      name: basename2(path2) || path2,
+      name: basename3(path2) || path2,
       label: this.label(path2)
     };
   };
@@ -27752,7 +28561,7 @@ var WorkspaceDirectoryService = class {
           continue;
         }
         try {
-          const path2 = await this.resolvePath(join15(target, child.name), signal);
+          const path2 = await this.resolvePath(join16(target, child.name), signal);
           entries.push({ directoryId: encodePath(path2), name: child.name });
         } catch (cause) {
           signal.throwIfAborted();
@@ -27787,8 +28596,8 @@ var WorkspaceDirectoryService = class {
 };
 
 // src/bots/local-bot-grant-store.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
-import { stat as stat7 } from "node:fs/promises";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { stat as stat8 } from "node:fs/promises";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
 var LocalBotAuthorizationError = class extends Error {
@@ -27832,7 +28641,7 @@ var LocalBotGrant = class {
   }
 };
 function digest(value) {
-  return createHash2("sha256").update(value, "utf8").digest("hex");
+  return createHash3("sha256").update(value, "utf8").digest("hex");
 }
 function agentDigest(agent) {
   return digest(
@@ -27846,7 +28655,7 @@ function agentDigest(agent) {
   );
 }
 async function workspaceDigest(path2) {
-  const metadata = await stat7(path2);
+  const metadata = await stat8(path2);
   if (!metadata.isDirectory()) {
     throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
   }
@@ -28263,12 +29072,12 @@ var BotExecutionContextRegistry = class {
 // src/bots/bot-outbound-ipc.ts
 import { chmod as chmod2, mkdir as mkdir4, unlink } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname6, isAbsolute as isAbsolute8 } from "node:path";
-import { fetch as fetch4 } from "undici";
+import { dirname as dirname6, isAbsolute as isAbsolute10 } from "node:path";
+import { fetch as fetch5 } from "undici";
 var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
 var BOT_IPC_TIMEOUT_MILLISECONDS2 = 2e4;
 var BOT_RELAY_TIMEOUT_MILLISECONDS = 2e4;
-var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var WINDOWS_NAMED_PIPE_PREFIX = "\\\\.\\pipe\\";
 var BotOutboundIpcRequest = class {
   contextHandle;
@@ -28282,7 +29091,7 @@ var BotOutboundIpcRequest = class {
     this.text = text;
   }
 };
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeRequest(encoded) {
@@ -28292,7 +29101,7 @@ function decodeRequest(encoded) {
   } catch (cause) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid", { cause });
   }
-  if (!isRecord11(value)) {
+  if (!isRecord12(value)) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
   }
   const keys = Object.keys(value);
@@ -28303,7 +29112,7 @@ function decodeRequest(encoded) {
   const idempotencyKey = value["idempotencyKey"];
   const target = value["target"];
   const text = value["text"];
-  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN6.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN6.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
+  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN7.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN7.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
   }
   return new BotOutboundIpcRequest(contextHandle, idempotencyKey, target, text);
@@ -28325,7 +29134,7 @@ function relayEndpoint(relayUrl, context, target) {
   endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/delivery-targets/${encodeURIComponent(deliveryTargetId)}/messages`;
   return endpoint;
 }
-function daemonToken(relayUrl) {
+function daemonToken2(relayUrl) {
   const token = relayUrl.searchParams.get("token") ?? "";
   if (!/^[a-zA-Z0-9_-]{32,256}$/.test(token)) {
     throw new LocalBotAuthorizationError("bot_service_unavailable", "The Runtime credential is unavailable");
@@ -28342,10 +29151,10 @@ async function decodeRelayResponse(response) {
       cause
     });
   }
-  if (response.status === 202 && isRecord11(value) && typeof value["outboundMessageId"] === "string") {
+  if (response.status === 202 && isRecord12(value) && typeof value["outboundMessageId"] === "string") {
     return value["outboundMessageId"];
   }
-  if (isRecord11(value) && isRecord11(value["error"])) {
+  if (isRecord12(value) && isRecord12(value["error"])) {
     const error61 = value["error"];
     if (typeof error61["code"] === "string" && typeof error61["message"] === "string") {
       throw new LocalBotAuthorizationError(error61["code"], error61["message"]);
@@ -28361,7 +29170,7 @@ var BotOutboundIpcServer = class {
   #usesFilesystemSocket;
   constructor(socketPath, relayUrl, registry2) {
     const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
-    if (usesFilesystemSocket && !isAbsolute8(socketPath)) {
+    if (usesFilesystemSocket && !isAbsolute10(socketPath)) {
       throw new Error("The Bot IPC path must be absolute");
     }
     this.#registry = registry2;
@@ -28378,7 +29187,7 @@ var BotOutboundIpcServer = class {
     if (this.#usesFilesystemSocket) {
       await mkdir4(dirname6(this.#socketPath), { mode: 448, recursive: true });
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord11(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord12(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -28413,7 +29222,7 @@ var BotOutboundIpcServer = class {
     }
     if (this.#usesFilesystemSocket) {
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord11(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord12(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -28477,10 +29286,10 @@ var BotOutboundIpcServer = class {
     const requestSignal = AbortSignal.any([signal, timeout]);
     let response;
     try {
-      response = await fetch4(relayEndpoint(this.#relayUrl, context, request.target), {
+      response = await fetch5(relayEndpoint(this.#relayUrl, context, request.target), {
         body: JSON.stringify({ idempotencyKey: request.idempotencyKey, text: request.text }),
         headers: {
-          authorization: `Bearer ${daemonToken(this.#relayUrl)}`,
+          authorization: `Bearer ${daemonToken2(this.#relayUrl)}`,
           "content-type": "application/json",
           "x-mobius-bot-execution-capability": context.command.executionCapabilitySecret
         },
@@ -28501,7 +29310,7 @@ var BotOutboundIpcServer = class {
 
 // src/native-sessions/service.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 
 // src/native-sessions/codex-history.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -28534,7 +29343,6 @@ function decodeHistory(thread, value) {
   const page = turnsSchema.parse(value);
   const messages = [];
   let characters = 0;
-  let imageCharacters = 0;
   let truncated = page.nextCursor != null;
   for (const turn of page.data.toReversed()) {
     for (const item of turn.items) {
@@ -28542,22 +29350,19 @@ function decodeHistory(thread, value) {
       let message;
       if (type === "userMessage") {
         const { content } = userMessageSchema.parse(item);
-        const parsed = parseNativeHistoryText(
-          content.map((block) => {
-            const { type: type2 } = itemTypeSchema.parse(block);
-            if (type2 === "text") {
-              return textSchema.parse(block).text;
-            }
-            if (type2 === "image") {
-              return `[@image](${imageSchema.parse(block).url})`;
-            }
-            return "[Attachment]";
-          }).join("")
-        );
+        const text2 = content.map((block) => {
+          const { type: type2 } = itemTypeSchema.parse(block);
+          if (type2 === "text") {
+            return textSchema.parse(block).text;
+          }
+          if (type2 === "image") {
+            return `[@image](${imageSchema.parse(block).url})`;
+          }
+          return "[Attachment]";
+        }).join("");
         message = {
           role: "user",
-          text: parsed.text,
-          ...parsed.images.length > 0 ? { images: parsed.images } : {}
+          text: text2
         };
       } else if (type === "agentMessage") {
         const agent = agentMessageSchema.parse(item);
@@ -28575,12 +29380,10 @@ function decodeHistory(thread, value) {
       truncated ||= text.length < message.text.length;
       messages.push({ ...message, text });
       characters += text.length;
-      imageCharacters += (message.images ?? []).reduce((size, image) => size + image.data.length, 0);
-      while (messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || characters > SESSION_HISTORY_CHARACTER_LIMIT || imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      while (messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || characters > SESSION_HISTORY_CHARACTER_LIMIT) {
         const removed = messages.shift();
         if (removed !== void 0) {
           characters -= removed.text.length;
-          imageCharacters -= (removed.images ?? []).reduce((size, image) => size + image.data.length, 0);
         }
         truncated = true;
       }
@@ -28738,7 +29541,11 @@ async function readCodexHistory(agent, cwd, nativeSessionId, signal) {
         params: { clientInfo: { name: "mobius_history", version: "1.0.0" } }
       });
     }
-    return await response.promise;
+    const snapshot = await response.promise;
+    return {
+      ...snapshot,
+      history: await embedLocalHistoryImages(snapshot.history, [cwd, snapshot.cwd], signal)
+    };
   } finally {
     clearTimeout(timeout);
     signal.removeEventListener("abort", abort);
@@ -28992,7 +29799,7 @@ var NativeSessionService = class {
       }
       resolvedPaths.add(path2);
       additionalDirectories.push(path2);
-      additionalEntries.push({ directoryId: directoryId2, name: basename3(path2) });
+      additionalEntries.push({ directoryId: directoryId2, name: basename4(path2) });
     }
     const listing = await this.#directories.list(this.#config.bindingId, command.directoryId, signal);
     const opened = await this.#sessions.forkSessionAtTurn(
@@ -29131,13 +29938,13 @@ var NativeSessionService = class {
 };
 
 // src/prompt-artifact-resolver.ts
-import { createHash as createHash3 } from "node:crypto";
-import { fetch as fetch5 } from "undici";
+import { createHash as createHash4 } from "node:crypto";
+import { fetch as fetch6 } from "undici";
 var ARTIFACT_SCHEME = "mobius-artifact:";
 var ARTIFACT_DOWNLOAD_TIMEOUT_MILLISECONDS = 2e4;
 var MAX_AGENT_IMAGE_BASE64_LENGTH = 4e6;
 var MAX_AGENT_RESOURCE_BYTE_LENGTH = 1e6;
-var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN8 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var PromptArtifactError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -29180,7 +29987,7 @@ function parseReference(resource) {
   const encodedByteLength2 = url2.searchParams.get("byteLength") ?? "";
   const sha256 = url2.searchParams.get("sha256") ?? "";
   const byteLength = Number(encodedByteLength2);
-  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN7.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
+  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN8.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
     throw new PromptArtifactError("artifact_reference_invalid", "The prompt artifact reference is invalid");
   }
   return new PromptArtifactReference(artifactId, byteLength, sha256, resource);
@@ -29246,7 +30053,7 @@ async function download(config2, command, reference, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch5(downloadUrl(config2, command, reference), {
+    response = await fetch6(downloadUrl(config2, command, reference), {
       dispatcher: environmentProxyDispatcher,
       headers: {
         accept: reference.resource.mimeType,
@@ -29270,7 +30077,7 @@ async function download(config2, command, reference, signal) {
       );
     }
     const bytes = await responseBytes(response, reference.byteLength, requestSignal);
-    if (createHash3("sha256").update(bytes).digest("hex") !== reference.sha256) {
+    if (createHash4("sha256").update(bytes).digest("hex") !== reference.sha256) {
       throw new PromptArtifactError(
         "artifact_integrity_failed",
         "The prompt artifact failed integrity validation"
@@ -30303,13 +31110,26 @@ function botIpcSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\mobius-bot-${randomUUID6()}`;
   }
-  return join16("/tmp", `mobius-bot-${randomUUID6()}.sock`);
+  return join17("/tmp", `mobius-bot-${randomUUID6()}.sock`);
 }
 var DaemonAcpObserver = class {
+  #config;
   #record;
-  constructor(record2) {
-    this.#record = record2;
+  constructor(config2, record3) {
+    this.#config = config2;
+    this.#record = record3;
   }
+  importLocalImage = async (sessionId, image, signal) => {
+    try {
+      return (await uploadRuntimeArtifact(this.#config, sessionId, image, signal)).artifactId;
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof Error && cause.name === "AbortError") {
+        throw cause;
+      }
+      return "";
+    }
+  };
   onCommands = (event) => {
     this.#record(event.sessionId, encodeSessionCommandsUpdatedEvent(event));
     return Promise.resolve();
@@ -30519,7 +31339,7 @@ async function reconcileActiveTurn(config2, turn, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch6(activeTurnReconciliationEndpoint(config2, turn), {
+    response = await fetch7(activeTurnReconciliationEndpoint(config2, turn), {
       body: JSON.stringify({ outcome: { kind: "running" } }),
       dispatcher: environmentProxyDispatcher,
       headers: { ...runtimeAuthorization(config2.relayUrl), "content-type": "application/json" },
@@ -30835,7 +31655,7 @@ async function resolveSessionDirectories(directories, bindingId, directoryId2, a
     additionalDirectories.push(directory);
     additionalDirectoryEntries.push({
       directoryId: additionalDirectoryId,
-      name: basename4(directory)
+      name: basename5(directory)
     });
   }
   return new ResolvedSessionDirectories(cwd, additionalDirectories, additionalDirectoryEntries);
@@ -31346,8 +32166,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         rejectConnection(failure);
       };
       const processingDeliveryIds = /* @__PURE__ */ new Set();
-      const processDeliveredPrompt = async (delivery) => {
-        const command = decodeSessionPromptCommand(delivery.payload);
+      const processDeliveredPrompt = async (delivery, command, trackActiveAttempt, execute) => {
         if (command.sessionId !== delivery.sessionId) {
           throw new Error("Runtime delivery Session identity does not match its payload");
         }
@@ -31375,22 +32194,11 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         }
         const turn = new ActiveDaemonTurn(command, receipt.attemptId);
         activeTurns.set(command.commandId, turn);
-        if (command.disposition !== SessionPromptDisposition.Steer) {
+        if (trackActiveAttempt) {
           activeAttemptIds.set(command.sessionId, receipt.attemptId);
         }
         try {
-          await executePrompt(
-            outbox,
-            publisher,
-            command,
-            config2,
-            directories,
-            audit,
-            sessions,
-            receipt.attemptId,
-            timer,
-            turn.signal
-          );
+          await execute(receipt.attemptId, turn.signal);
         } finally {
           activeTurns.delete(command.commandId);
           if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
@@ -31469,8 +32277,50 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           }
           return;
         }
+        if (kind === BOT_SESSION_PROMPT_KIND) {
+          const command = decodeBotSessionPromptCommand(delivery.payload);
+          await processDeliveredPrompt(
+            delivery,
+            command,
+            true,
+            (attemptId, executionSignal) => executeBotPrompt(
+              outbox,
+              publisher,
+              command,
+              config2,
+              directories,
+              audit,
+              sessions,
+              grants,
+              contexts,
+              applicator,
+              ipc,
+              attemptId,
+              timer,
+              executionSignal
+            )
+          );
+          return;
+        }
         if (kind === SESSION_PROMPT_KIND) {
-          await processDeliveredPrompt(delivery);
+          const command = decodeSessionPromptCommand(delivery.payload);
+          await processDeliveredPrompt(
+            delivery,
+            command,
+            command.disposition !== SessionPromptDisposition.Steer,
+            (attemptId, executionSignal) => executePrompt(
+              outbox,
+              publisher,
+              command,
+              config2,
+              directories,
+              audit,
+              sessions,
+              attemptId,
+              timer,
+              executionSignal
+            )
+          );
           return;
         }
         throw new Error("Runtime delivery contains an unsupported protocol message");
@@ -31508,6 +32358,8 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           payloadSessionId = decodeSessionElicitationRespondCommand(delivery.payload).sessionId;
         } else if (payloadKind === SESSION_PROMPT_KIND) {
           payloadSessionId = decodeSessionPromptCommand(delivery.payload).sessionId;
+        } else if (payloadKind === BOT_SESSION_PROMPT_KIND) {
+          payloadSessionId = decodeBotSessionPromptCommand(delivery.payload).sessionId;
         } else {
           throw new Error("Runtime delivery contains an unsupported protocol message");
         }
@@ -32105,7 +32957,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
     }
     publisher.recordAttempt(sessionId, payload, attemptId);
   };
-  const sessions = new AcpSessionManager(new DaemonAcpObserver(recordSessionEvent), sessionStore);
+  const sessions = new AcpSessionManager(new DaemonAcpObserver(config2, recordSessionEvent), sessionStore);
   const directories = new WorkspaceDirectoryService(config2.bindingId, config2.defaultWorkspace);
   const installationObserver = new DaemonInstallationObserver();
   const diagnostics = new RelayConnectionDiagnostics(audit, config2.channelId, config2.relayUrl);