@moxt-ai/mobius 0.0.28 → 0.0.30

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.28",
+  version: "0.0.30",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -1158,6 +1158,13 @@ var ManagedNpmPackageInstaller = class {
 
 // src/agent-catalog/agent-specification.ts
 import { join as join3 } from "node:path";
+
+// src/agent-catalog/version-output.ts
+function normalizeVersionOutput(output2) {
+  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
+}
+
+// src/agent-catalog/agent-specification.ts
 var VERSION_PROBE_TIMEOUT_MILLISECONDS = 3e3;
 var ACP_PROBE_TIMEOUT_MILLISECONDS = 5e3;
 var DEFAULT_PROMPT_TIMEOUT_MILLISECONDS = 30 * 60 * 1e3;
@@ -1166,6 +1173,8 @@ var LocalAgentSpecification = class {
   authenticationCommand = () => "";
   adapterVersionArguments = ["--version"];
   agentVersionArguments = ["--version"];
+  normalizeAdapterVersion = normalizeVersionOutput;
+  normalizeAgentVersion = normalizeVersionOutput;
   promptTimeoutMilliseconds = DEFAULT_PROMPT_TIMEOUT_MILLISECONDS;
   versionProbeTimeoutMilliseconds = VERSION_PROBE_TIMEOUT_MILLISECONDS;
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
@@ -1277,6 +1286,20 @@ var AgentProbeError = class extends Error {
   }
 };
 
+// src/agent-catalog/agents/resolve-user-local-executable.ts
+import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+async function resolveUserLocalExecutable(executableName, context) {
+  context.signal.throwIfAborted();
+  const platform = context.platform ?? process.platform;
+  const homeDirectory = context.environment["HOME"];
+  if (platform === "win32" || homeDirectory === void 0 || !isAbsolute2(homeDirectory)) {
+    return [];
+  }
+  const executable = await resolveExecutablePath(join4(homeDirectory, ".local", "bin", executableName), platform);
+  context.signal.throwIfAborted();
+  return executable === null ? [] : [executable];
+}
+
 // src/agent-catalog/agents/verify-session-creation.ts
 import { methods } from "@agentclientprotocol/sdk";
 async function verifySessionCreation(connection, capabilities, defaultWorkspace, signal, label) {
@@ -1301,6 +1324,37 @@ async function verifySessionCreation(connection, capabilities, defaultWorkspace,
   }
 }
 
+// src/agent-catalog/agents/copilot-cli-agent.ts
+var COPILOT_CLI_TESTED_VERSION = "1.0.83";
+var CopilotCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = COPILOT_CLI_TESTED_VERSION;
+  authenticationCommand = () => "copilot login";
+  agentExecutable = "copilot";
+  id = "github-copilot-cli";
+  label = "GitHub Copilot CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_COPILOT_PATH",
+      ["--no-auto-update", "--acp", "--stdio"],
+      ["agents", "github-copilot-cli", COPILOT_CLI_TESTED_VERSION, "bin", "copilot"]
+    );
+  }
+  createLaunchEnvironment = async (_agent, _context) => Object.freeze({ COPILOT_AUTO_UPDATE: "false" });
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || capabilities.sessionCapabilities?.list == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError(
+        "acp_incompatible",
+        "GitHub Copilot CLI reported an unsupported ACP capability set"
+      );
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/cursor-cli-agent.ts
 var CURSOR_CLI_TESTED_VERSION = "2026.09.02-c22c1a3";
 var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
@@ -1327,7 +1381,7 @@ var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 import { realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join5, normalize } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6, normalize } from "node:path";
 
 // src/agent-installation/deepseek-managed-package.ts
 var DeepSeekHarnessManagedPackage = class extends SriManagedNpmPackageDefinition {
@@ -1345,18 +1399,18 @@ var DEEPSEEK_HARNESS_PACKAGE = new DeepSeekHarnessManagedPackage(
 
 // src/storage/state-directory.ts
 import { homedir } from "node:os";
-import { join as join4, resolve as resolve2 } from "node:path";
+import { join as join5, resolve as resolve2 } from "node:path";
 function readStateDirectory(environment = process.env) {
   const configured = environment["MOBIUS_STATE_DIRECTORY"]?.trim();
   if (configured !== void 0 && configured.length > 0) {
     return resolve2(configured);
   }
-  return join4(homedir(), ".mobius");
+  return join5(homedir(), ".mobius");
 }
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 async function validateAgentHome(path2) {
-  if (!isAbsolute2(path2) || normalize(path2) !== path2) {
+  if (!isAbsolute3(path2) || normalize(path2) !== path2) {
     throw new AgentProbeError("agent_environment_invalid", "The configured Agent home is invalid");
   }
   try {
@@ -1406,7 +1460,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
         context.signal
       );
       if (managed.path === agent.path) {
-        selectedHome = join5(readStateDirectory(context.environment), "agents", this.id, "home");
+        selectedHome = join6(readStateDirectory(context.environment), "agents", this.id, "home");
       }
     } catch {
       context.signal.throwIfAborted();
@@ -1422,7 +1476,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join5(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
+      join6(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
       DEEPSEEK_HARNESS_PACKAGE
     );
     signal.throwIfAborted();
@@ -1442,9 +1496,41 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/gemini-cli-agent.ts
+var GEMINI_CLI_TESTED_VERSION = "0.59.0";
+var GeminiCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = GEMINI_CLI_TESTED_VERSION;
+  authenticationCommand = () => "gemini";
+  agentExecutable = "gemini";
+  id = "gemini-cli";
+  label = "Gemini CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_GEMINI_PATH",
+      ["--acp"],
+      [
+        "agents",
+        "gemini-cli",
+        GEMINI_CLI_TESTED_VERSION,
+        "bin",
+        process.platform === "win32" ? "gemini.cmd" : "gemini"
+      ]
+    );
+  }
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Gemini CLI reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/grok-build-agent.ts
 import { realpath as realpath4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join7, relative as relative2, sep as sep2 } from "node:path";
 
 // src/agent-installation/grok-managed-package.ts
 var GROK_BUILD_MANAGED_VERSION = "1.0.21";
@@ -1507,7 +1593,7 @@ function grokBuildManagedPackage(platform, architecture) {
 // src/agent-catalog/agents/grok-build-agent.ts
 function isContainedPath2(root, candidate) {
   const difference = relative2(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute3(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute4(difference);
 }
 var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   adapterVersion = GROK_BUILD_MANAGED_VERSION;
@@ -1535,7 +1621,7 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
       if (managed.path === agent.path) {
         return Object.freeze({
           GROK_HOME: await realpath4(
-            join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
+            join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
           )
         });
       }
@@ -1546,9 +1632,9 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
     signal.throwIfAborted();
-    const versionRoot = await realpath4(join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
-    await validateManagedNpmPackage(join6(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
-    const executable = await resolveExecutablePath(join6(versionRoot, "home", "bin", "grok"), platform);
+    const versionRoot = await realpath4(join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
+    await validateManagedNpmPackage(join7(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
+    const executable = await resolveExecutablePath(join7(versionRoot, "home", "bin", "grok"), platform);
     signal.throwIfAborted();
     if (executable === null || !isContainedPath2(versionRoot, executable.path)) {
       throw new AgentProbeError("managed_agent_invalid", "The managed Grok Build executable is invalid");
@@ -1565,14 +1651,39 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/hermes-agent.ts
+var HERMES_TESTED_VERSION = "0.21.1";
+var HermesAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = HERMES_TESTED_VERSION;
+  adapterVersionArguments = ["acp", "--version"];
+  authenticationCommand = () => "hermes acp --setup";
+  agentExecutable = "hermes";
+  agentVersionArguments = ["acp", "--version"];
+  id = "hermes";
+  label = "Hermes Agent";
+  constructor() {
+    super("MOBIUS_HERMES_PATH", ["acp"], ["agents", "hermes", HERMES_TESTED_VERSION, "bin", "hermes"]);
+  }
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    const session = capabilities.sessionCapabilities;
+    if (capabilities.loadSession !== true || session?.fork == null || session.list == null || session.resume == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Hermes Agent reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/opencode-agent.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/agent-installation/managed-agent-archive.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { chmod, copyFile, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open2, realpath as realpath5, rename as rename2, rm as rm2, stat as stat4, writeFile } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute4, join as join7, relative as relative3, sep as sep3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute5, join as join8, relative as relative3, sep as sep3 } from "node:path";
 
 // src/agent-installation/verified-download.ts
 import { fetch } from "undici";
@@ -1678,7 +1789,7 @@ function isRecord3(value) {
 }
 function isContainedPath3(root, candidate) {
   const difference = relative3(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute4(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute5(difference);
 }
 async function hashFile(path2, signal) {
   signal.throwIfAborted();
@@ -1757,11 +1868,11 @@ async function validateManagedAgentArchive(root, definition, signal) {
     if (!rootMetadata.isDirectory() || typeof process.getuid === "function" && rootMetadata.uid !== process.getuid()) {
       throw new Error("Managed Agent root is not user-owned");
     }
-    const manifest = await readManifest(join7(rootPath, "archive.json"));
+    const manifest = await readManifest(join8(rootPath, "archive.json"));
     if (manifest["archiveSha256"] !== definition.archiveSha256 || manifest["archiveUrl"] !== definition.archiveUrl.toString() || manifest["version"] !== definition.version || typeof manifest["executableSha256"] !== "string") {
       throw new Error("Managed Agent archive identity is invalid");
     }
-    const executable = await resolveExecutablePath(join7(rootPath, "bin", definition.executableName));
+    const executable = await resolveExecutablePath(join8(rootPath, "bin", definition.executableName));
     if (executable === null || !isContainedPath3(rootPath, executable.path) || await hashFile(executable.path, signal) !== manifest["executableSha256"]) {
       throw new Error("Managed Agent executable is invalid");
     }
@@ -1853,7 +1964,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
   }
   createLaunchEnvironment = async (_agent, _context) => Object.freeze({ OPENCODE_DISABLE_AUTOUPDATE: "1" });
   resolveManagedAgent = async (stateDirectory, platform, signal) => await validateManagedAgentArchive(
-    join8(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
+    join9(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
     openCodeManagedArchive(platform, process.arch),
     signal
   );
@@ -1871,7 +1982,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/pi-agent.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import {
   methods as methods2
 } from "@agentclientprotocol/sdk";
@@ -1930,7 +2041,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join9(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
+      join10(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
       PI_AGENT_PACKAGE
     );
     signal.throwIfAborted();
@@ -1968,7 +2079,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/workbuddy-agent.ts
-import { isAbsolute as isAbsolute5, join as join10 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 
 // src/agent-installation/workbuddy-managed-package.ts
 var WORKBUDDY_MANAGED_VERSION = "2.146.0";
@@ -2021,7 +2132,7 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join10(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
+      join11(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
       WORKBUDDY_MANAGED_PACKAGE
     );
     signal.throwIfAborted();
@@ -2032,10 +2143,10 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
     if ((context.platform ?? process.platform) !== "darwin") {
       return [];
     }
-    const requestedPaths = [join10("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
+    const requestedPaths = [join11("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
     const homeDirectory = context.environment["HOME"];
-    if (homeDirectory !== void 0 && isAbsolute5(homeDirectory)) {
-      requestedPaths.unshift(join10(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
+    if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
+      requestedPaths.unshift(join11(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
     }
     const executables = [];
     for (const requestedPath of requestedPaths) {
@@ -2061,12 +2172,15 @@ function supportedLocalAgentSpecifications() {
   return Object.freeze([
     new CodexAgentSpecification(),
     new ClaudeCodeAgentSpecification(),
+    new CopilotCliAgentSpecification(),
     new PiAgentSpecification(),
     new DeepSeekHarnessAgentSpecification(),
+    new HermesAgentSpecification(),
     new OpenCodeAgentSpecification(),
     new CursorCliAgentSpecification(),
     new GrokBuildAgentSpecification(),
-    new WorkBuddyAgentSpecification()
+    new WorkBuddyAgentSpecification(),
+    new GeminiCliAgentSpecification()
   ]);
 }
 
@@ -2106,11 +2220,173 @@ var createAcpClient = (handler) => client({ name: "mobius" }).onRequest(
   outcome: { outcome: "cancelled" }
 })).onNotification("cursor/update_todos", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/task", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/generate_image", discardExtensionParams, async () => Promise.resolve());
 
+// src/agent-catalog/acp-readiness-probe.ts
+var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+var VerifiedAcpReadiness = class {
+  adapterVersion;
+  capabilities;
+  constructor(adapterVersion, capabilities) {
+    this.adapterVersion = adapterVersion;
+    this.capabilities = capabilities;
+  }
+};
+var DiscoveryAcpHandler = class {
+  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
+  onElicitationComplete = (_notification) => Promise.resolve();
+  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
+  onUpdate = (_notification) => Promise.resolve();
+};
+function readableAcpStream(input2) {
+  let byteLength = 0;
+  let open5 = true;
+  return new ReadableStream({
+    start(controller) {
+      input2.on("data", (chunk) => {
+        if (!open5) {
+          return;
+        }
+        if (!(chunk instanceof Uint8Array)) {
+          open5 = false;
+          controller.error(new Error("ACP adapter produced invalid output"));
+          return;
+        }
+        byteLength += chunk.byteLength;
+        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
+          open5 = false;
+          controller.error(new Error("ACP adapter output limit exceeded"));
+          return;
+        }
+        controller.enqueue(new Uint8Array(chunk));
+      });
+      input2.once("end", () => {
+        if (open5) {
+          open5 = false;
+          controller.close();
+        }
+      });
+      input2.once("error", (error61) => {
+        if (open5) {
+          open5 = false;
+          controller.error(error61);
+        }
+      });
+    },
+    cancel() {
+      open5 = false;
+    }
+  });
+}
+function writableAcpStream(output2) {
+  return new WritableStream({
+    write(chunk) {
+      return new Promise((resolveWrite, rejectWrite) => {
+        output2.write(chunk, (error61) => {
+          if (error61) {
+            rejectWrite(error61);
+            return;
+          }
+          resolveWrite();
+        });
+      });
+    }
+  });
+}
+async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
+  signal.throwIfAborted();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort(new Error("ACP probe timed out"));
+  }, specification.acpProbeTimeoutMilliseconds);
+  const abort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", abort, { once: true });
+  if (signal.aborted) {
+    abort();
+  }
+  const child = spawn2(agent.adapterPath, [...agent.arguments], {
+    cwd: defaultWorkspace,
+    detached: process.platform !== "win32",
+    env: { ...environment, ...agent.environment },
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const processExit = new Promise((_resolve, reject) => {
+    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
+    child.once("error", reject);
+    child.once("exit", rejectExit);
+    if (child.exitCode !== null || child.signalCode !== null) {
+      rejectExit();
+    }
+  });
+  const stdin = child.stdin;
+  const stdout = child.stdout;
+  const stderr = child.stderr;
+  if (stdin === null || stdout === null || stderr === null) {
+    await stopProcessTree(child);
+    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
+  }
+  let stderrBytes = 0;
+  const consumeStderr = (chunk) => {
+    stderrBytes += chunk.byteLength;
+    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
+      controller.abort(new Error("ACP adapter output limit exceeded"));
+    }
+  };
+  stderr.on("data", consumeStderr);
+  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
+    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
+  );
+  try {
+    const initialized = await Promise.race([
+      connection.agent.request(
+        methods4.agent.initialize,
+        {
+          clientCapabilities: {},
+          clientInfo: { name: "mobius", version: "0.0.3" },
+          protocolVersion: PROTOCOL_VERSION
+        },
+        { cancellationSignal: controller.signal }
+      ),
+      processExit
+    ]);
+    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
+      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
+    }
+    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
+    return new VerifiedAcpReadiness(
+      normalizeVersionOutput(initialized.agentInfo?.version ?? ""),
+      normalizeAcpCapabilities(initialized)
+    );
+  } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
+    if (timedOut) {
+      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
+    }
+    if (error61 instanceof AgentProbeError) {
+      throw error61;
+    }
+    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
+      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
+    }
+    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", abort);
+    connection.close();
+    stdin.end();
+    stderr.removeListener("data", consumeStderr);
+    await stopProcessTree(child);
+  }
+}
+
 // src/agent-catalog/executable-discovery.ts
-import { isAbsolute as isAbsolute6, join as join12 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // src/agent-installation/managed-adapter-installer.ts
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var ManagedAdapterInstallError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -2167,7 +2443,7 @@ var ManagedAdapterInstaller = class {
     this.#stateDirectory = options.stateDirectory;
   }
   install = async (specification, signal) => {
-    const root = join11(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
+    const root = join12(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
     try {
       return await this.#npmInstaller.install(
         root,
@@ -2201,7 +2477,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
   let managed;
   try {
     managed = await validateManagedAdapter(
-      join12(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
+      join13(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
       specification
     );
   } catch {
@@ -2212,7 +2488,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
 async function resolveSpecificationExecutables(executableName, overrideVariable, resolveInstalled, resolveManaged, context) {
   const override = context.environment[overrideVariable];
   if (override !== void 0) {
-    if (override.length === 0 || !isAbsolute6(override)) {
+    if (override.length === 0 || !isAbsolute7(override)) {
       return [];
     }
     const executable = await resolveExecutablePath(override, context.platform);
@@ -2266,10 +2542,7 @@ async function resolveAdapterExecutable(specification, context) {
   const executables = await resolveAdapterExecutables(specification, context);
   return executables[0] ?? null;
 }
-function normalizedVersion(output2) {
-  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
-}
-async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds) {
+async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds, normalize4 = normalizeVersionOutput) {
   const result = await runBoundedProcess({
     arguments: arguments_,
     command: executable.path,
@@ -2278,7 +2551,7 @@ async function probeVersion(executable, arguments_, environment, defaultWorkspac
     signal,
     timeoutMilliseconds
   });
-  const version2 = normalizedVersion(result.stdout || result.stderr);
+  const version2 = normalize4(result.stdout || result.stderr);
   if (version2.length === 0) {
     throw new ProcessExecutionError("process_exit_failed", "The executable did not report a version");
   }
@@ -2302,7 +2575,8 @@ async function findVerifiedAgentExecutable(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
       return new VerifiedAgentExecutable(executable, version2);
     } catch {
@@ -2314,168 +2588,6 @@ async function findVerifiedAgentExecutable(specification, context) {
   return null;
 }
 
-// src/agent-catalog/acp-readiness-probe.ts
-var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
-var VerifiedAcpReadiness = class {
-  adapterVersion;
-  capabilities;
-  constructor(adapterVersion, capabilities) {
-    this.adapterVersion = adapterVersion;
-    this.capabilities = capabilities;
-  }
-};
-var DiscoveryAcpHandler = class {
-  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
-  onElicitationComplete = (_notification) => Promise.resolve();
-  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
-  onUpdate = (_notification) => Promise.resolve();
-};
-function readableAcpStream(input2) {
-  let byteLength = 0;
-  let open5 = true;
-  return new ReadableStream({
-    start(controller) {
-      input2.on("data", (chunk) => {
-        if (!open5) {
-          return;
-        }
-        if (!(chunk instanceof Uint8Array)) {
-          open5 = false;
-          controller.error(new Error("ACP adapter produced invalid output"));
-          return;
-        }
-        byteLength += chunk.byteLength;
-        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
-          open5 = false;
-          controller.error(new Error("ACP adapter output limit exceeded"));
-          return;
-        }
-        controller.enqueue(new Uint8Array(chunk));
-      });
-      input2.once("end", () => {
-        if (open5) {
-          open5 = false;
-          controller.close();
-        }
-      });
-      input2.once("error", (error61) => {
-        if (open5) {
-          open5 = false;
-          controller.error(error61);
-        }
-      });
-    },
-    cancel() {
-      open5 = false;
-    }
-  });
-}
-function writableAcpStream(output2) {
-  return new WritableStream({
-    write(chunk) {
-      return new Promise((resolveWrite, rejectWrite) => {
-        output2.write(chunk, (error61) => {
-          if (error61) {
-            rejectWrite(error61);
-            return;
-          }
-          resolveWrite();
-        });
-      });
-    }
-  });
-}
-async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
-  signal.throwIfAborted();
-  const controller = new AbortController();
-  let timedOut = false;
-  const timeout = setTimeout(() => {
-    timedOut = true;
-    controller.abort(new Error("ACP probe timed out"));
-  }, specification.acpProbeTimeoutMilliseconds);
-  const abort = () => controller.abort(signal.reason);
-  signal.addEventListener("abort", abort, { once: true });
-  if (signal.aborted) {
-    abort();
-  }
-  const child = spawn2(agent.adapterPath, [...agent.arguments], {
-    cwd: defaultWorkspace,
-    detached: process.platform !== "win32",
-    env: { ...environment, ...agent.environment },
-    shell: false,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  const processExit = new Promise((_resolve, reject) => {
-    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
-    child.once("error", reject);
-    child.once("exit", rejectExit);
-    if (child.exitCode !== null || child.signalCode !== null) {
-      rejectExit();
-    }
-  });
-  const stdin = child.stdin;
-  const stdout = child.stdout;
-  const stderr = child.stderr;
-  if (stdin === null || stdout === null || stderr === null) {
-    await stopProcessTree(child);
-    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
-  }
-  let stderrBytes = 0;
-  const consumeStderr = (chunk) => {
-    stderrBytes += chunk.byteLength;
-    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
-      controller.abort(new Error("ACP adapter output limit exceeded"));
-    }
-  };
-  stderr.on("data", consumeStderr);
-  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
-    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
-  );
-  try {
-    const initialized = await Promise.race([
-      connection.agent.request(
-        methods4.agent.initialize,
-        {
-          clientCapabilities: {},
-          clientInfo: { name: "mobius", version: "0.0.3" },
-          protocolVersion: PROTOCOL_VERSION
-        },
-        { cancellationSignal: controller.signal }
-      ),
-      processExit
-    ]);
-    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
-      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
-    }
-    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
-    return new VerifiedAcpReadiness(
-      normalizedVersion(initialized.agentInfo?.version ?? ""),
-      normalizeAcpCapabilities(initialized)
-    );
-  } catch (error61) {
-    if (signal.aborted) {
-      signal.throwIfAborted();
-    }
-    if (timedOut) {
-      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
-    }
-    if (error61 instanceof AgentProbeError) {
-      throw error61;
-    }
-    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
-      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
-    }
-    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
-  } finally {
-    clearTimeout(timeout);
-    signal.removeEventListener("abort", abort);
-    connection.close();
-    stdin.end();
-    stderr.removeListener("data", consumeStderr);
-    await stopProcessTree(child);
-  }
-}
-
 // src/agent-catalog/discover-agent.ts
 function agentProbeFailure(specification, error61) {
   if (error61 instanceof AgentProbeError) {
@@ -2519,7 +2631,8 @@ async function discoverAgent(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
     } catch (error61) {
       if (context.signal.aborted) {
@@ -2555,7 +2668,8 @@ async function discoverAgent(specification, context) {
             },
             context.defaultWorkspace,
             context.signal,
-            specification.versionProbeTimeoutMilliseconds
+            specification.versionProbeTimeoutMilliseconds,
+            specification.normalizeAdapterVersion
           );
         }
       } catch (error61) {
@@ -2629,166 +2743,9 @@ async function discoverLocalAgentInventory(options) {
   return new LocalAgentInventory(discoveries);
 }
 
-// src/bots/bot-message-command.ts
-import { randomUUID } from "node:crypto";
-import { createConnection } from "node:net";
-var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
-var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
-var BotMessageCommandError = class extends Error {
-  code;
-  constructor(code, message, options = {}) {
-    super(message, options);
-    this.code = code;
-    this.name = "BotMessageCommandError";
-  }
-};
-function isRecord4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function requiredEnvironment(environment, name) {
-  const value = environment[name]?.trim();
-  if (value === void 0 || value.length === 0) {
-    throw new BotMessageCommandError(
-      "execution_context_required",
-      "This command is available only inside an active Mobius Bot execution"
-    );
-  }
-  return value;
-}
-function option(arguments_, name) {
-  const index = arguments_.indexOf(name);
-  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-  const value = arguments_[index + 1];
-  if (value === void 0) {
-    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
-  }
-  return value;
-}
-function validateArguments(arguments_) {
-  if (arguments_.length !== 4) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-  const names = [arguments_[0], arguments_[2]];
-  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-}
-function decodeResponse(encoded) {
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch (cause) {
-    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
-      cause
-    });
-  }
-  if (!isRecord4(value) || typeof value["ok"] !== "boolean") {
-    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
-  }
-  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
-    return value["outboundMessageId"];
-  }
-  const error61 = value["error"];
-  if (value["ok"] === false && isRecord4(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
-    throw new BotMessageCommandError(error61["code"], error61["message"]);
-  }
-  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
-}
-async function requestLocalBotService(socketPath, payload, signal) {
-  signal.throwIfAborted();
-  return await new Promise((resolve5, reject) => {
-    const socket = createConnection(socketPath);
-    const chunks = [];
-    let length = 0;
-    let finished = false;
-    const finish = () => {
-      socket.removeAllListeners();
-      socket.destroy();
-    };
-    const fail = (error61) => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      finish();
-      if (error61 instanceof BotMessageCommandError) {
-        reject(error61);
-        return;
-      }
-      reject(
-        new BotMessageCommandError(
-          "execution_context_required",
-          "The active Mobius Bot execution is unavailable",
-          { cause: error61 }
-        )
-      );
-    };
-    const abort = () => fail(signal.reason);
-    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
-      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
-    });
-    socket.once("error", fail);
-    socket.once("connect", () => socket.end(`${payload}
-`));
-    socket.on("data", (chunk) => {
-      length += chunk.byteLength;
-      if (length > BOT_IPC_RESPONSE_LIMIT) {
-        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    socket.once("end", () => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      signal.removeEventListener("abort", abort);
-      try {
-        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
-      } catch (error61) {
-        reject(error61);
-      } finally {
-        finish();
-      }
-    });
-    signal.addEventListener("abort", abort, { once: true });
-  });
-}
-async function executeBotMessageCommand(arguments_, environment, signal) {
-  validateArguments(arguments_);
-  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
-  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
-  const target = option(arguments_, "--target");
-  const text = option(arguments_, "--text");
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
-    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
-  }
-  return await requestLocalBotService(
-    socketPath,
-    JSON.stringify({
-      contextHandle,
-      idempotencyKey: `cli_${randomUUID()}`,
-      target,
-      text
-    }),
-    signal
-  );
-}
-
-// src/config.ts
-import { join as join13 } from "node:path";
+// src/bots/bot-approve-command.ts
+import { readdir as readdir2, realpath as realpath8 } from "node:fs/promises";
+import { dirname as dirname4, join as join17 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21656,8 +21613,198 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// src/authorization/workspace-directory.ts
+import { readdir, realpath as realpath6, stat as stat5 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute8, join as join14, normalize as normalize2, relative as relative4 } from "node:path";
+
+// src/authorization/local-authorization-error.ts
+var LocalAuthorizationError = class extends Error {
+  code = "local_authorization_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalAuthorizationError";
+  }
+};
+
+// src/authorization/workspace-directory.ts
+var WorkspaceDirectoryListing = class {
+  directoryId;
+  directoryLabel;
+  entries;
+  parentDirectoryId;
+  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
+    this.directoryId = directoryId2;
+    this.directoryLabel = directoryLabel;
+    this.entries = entries;
+    this.parentDirectoryId = parentDirectoryId;
+  }
+};
+function encodePath(path2) {
+  const encoded = Buffer.from(path2, "utf8").toString("base64url");
+  if (encoded.length === 0 || encoded.length > 2e3) {
+    throw new LocalAuthorizationError("The local directory path is too long to select");
+  }
+  return `path-${encoded}`;
+}
+function decodePath(value, prefix) {
+  const encoded = value.slice(prefix.length);
+  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
+  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize2(decoded) !== decoded) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  return decoded;
+}
+var WorkspaceDirectoryService = class {
+  #bindingId;
+  #defaultWorkspace;
+  constructor(bindingId, defaultWorkspace) {
+    this.#bindingId = bindingId;
+    this.#defaultWorkspace = defaultWorkspace;
+  }
+  authorizeMachine = (bindingId) => {
+    if (bindingId !== this.#bindingId) {
+      throw new LocalAuthorizationError("The runtime binding is not authorized");
+    }
+  };
+  requestedPath = (id) => {
+    if (id === "default") {
+      return this.#defaultWorkspace;
+    }
+    if (id === "home") {
+      return homedir2();
+    }
+    if (id.startsWith("path-")) {
+      const path2 = decodePath(id, "path-");
+      if (isAbsolute8(path2)) {
+        return path2;
+      }
+    }
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  };
+  resolvePath = async (requested, signal) => {
+    signal.throwIfAborted();
+    if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+      throw new LocalAuthorizationError("The local directory path is invalid");
+    }
+    try {
+      const target = await realpath6(requested);
+      signal.throwIfAborted();
+      const metadata = await stat5(target);
+      signal.throwIfAborted();
+      if (!isAbsolute8(target) || normalize2(target) !== target || !metadata.isDirectory()) {
+        throw new LocalAuthorizationError("The selected location is not a directory");
+      }
+      return target;
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) {
+        throw cause;
+      }
+      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
+        cause
+      });
+    }
+  };
+  label = (path2) => {
+    const suffix = relative4(homedir2(), path2);
+    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+  };
+  identify = async (bindingId, requestedPath, signal) => {
+    this.authorizeMachine(bindingId);
+    const path2 = await this.resolvePath(requestedPath, signal);
+    return {
+      path: path2,
+      directoryId: encodePath(path2),
+      name: basename(path2) || path2,
+      label: this.label(path2)
+    };
+  };
+  resolve = async (bindingId, id, signal) => {
+    this.authorizeMachine(bindingId);
+    return await this.resolvePath(this.requestedPath(id), signal);
+  };
+  list = async (bindingId, id, signal) => {
+    const target = await this.resolve(bindingId, id, signal);
+    try {
+      const children = await readdir(target, { withFileTypes: true });
+      signal.throwIfAborted();
+      const entries = [];
+      for (const child of children) {
+        if (entries.length === 500) {
+          break;
+        }
+        if (child.isFile() || child.isBlockDevice() || child.isCharacterDevice() || child.isFIFO() || child.isSocket()) {
+          continue;
+        }
+        try {
+          const path2 = await this.resolvePath(join14(target, child.name), signal);
+          entries.push({ directoryId: encodePath(path2), name: child.name });
+        } catch (cause) {
+          signal.throwIfAborted();
+          if (!(cause instanceof LocalAuthorizationError)) {
+            throw cause;
+          }
+        }
+      }
+      entries.sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname3(target);
+      return new WorkspaceDirectoryListing(
+        id,
+        this.label(target),
+        entries,
+        parent === target ? "" : encodePath(parent)
+      );
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) {
+        throw cause;
+      }
+      throw new LocalAuthorizationError("This directory cannot be browsed by your user account", { cause });
+    }
+  };
+  resolveMany = async (bindingId, ids, signal) => {
+    const paths = /* @__PURE__ */ new Set();
+    for (const id of ids) {
+      paths.add(await this.resolve(bindingId, id, signal));
+    }
+    return [...paths];
+  };
+};
+
+// src/pairing/pair-local-machine.ts
+import { randomUUID } from "node:crypto";
+import { mkdir as mkdir3, open as open4, realpath as realpath7, rename as rename3, stat as stat6, writeFile as writeFile2 } from "node:fs/promises";
+import { hostname as hostname3 } from "node:os";
+import { basename as basename2, join as join16, resolve as resolve3 } from "node:path";
+
 // ../protocol/src/prompt-usage.ts
 var TOKEN_COUNT = external_exports.number().int().nonnegative();
+function normalizeQuotaTokenCount(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return value;
+  }
+  if (Reflect.has(value, "inputTokens") || Reflect.has(value, "outputTokens") || Reflect.has(value, "totalTokens")) {
+    return value;
+  }
+  if (!Reflect.has(value, "input_tokens") && !Reflect.has(value, "output_tokens")) {
+    return value;
+  }
+  const inputTokens = Reflect.get(value, "input_tokens");
+  const outputTokens = Reflect.get(value, "output_tokens");
+  const reportedTotal = Reflect.get(value, "total_tokens");
+  return {
+    cachedInputTokens: Reflect.get(value, "cached_input_tokens"),
+    cachedWriteTokens: Reflect.get(value, "cached_write_tokens"),
+    inputTokens,
+    outputTokens,
+    reasoningOutputTokens: Reflect.get(value, "reasoning_output_tokens"),
+    totalTokens: reportedTotal === void 0 && typeof inputTokens === "number" && typeof outputTokens === "number" ? inputTokens + outputTokens : reportedTotal
+  };
+}
 var promptUsageSchema = external_exports.object({
   cachedReadTokens: TOKEN_COUNT.nullish(),
   cachedWriteTokens: TOKEN_COUNT.nullish(),
@@ -21666,14 +21813,17 @@ var promptUsageSchema = external_exports.object({
   thoughtTokens: TOKEN_COUNT.nullish(),
   totalTokens: TOKEN_COUNT
 }).readonly();
-var quotaTokenCountSchema = external_exports.object({
-  cachedInputTokens: TOKEN_COUNT,
-  cachedWriteTokens: TOKEN_COUNT.optional(),
-  inputTokens: TOKEN_COUNT,
-  outputTokens: TOKEN_COUNT,
-  reasoningOutputTokens: TOKEN_COUNT,
-  totalTokens: TOKEN_COUNT
-}).readonly();
+var quotaTokenCountSchema = external_exports.preprocess(
+  normalizeQuotaTokenCount,
+  external_exports.object({
+    cachedInputTokens: TOKEN_COUNT.optional(),
+    cachedWriteTokens: TOKEN_COUNT.optional(),
+    inputTokens: TOKEN_COUNT,
+    outputTokens: TOKEN_COUNT,
+    reasoningOutputTokens: TOKEN_COUNT.optional(),
+    totalTokens: TOKEN_COUNT
+  }).readonly()
+);
 var promptMetadataSchema = external_exports.object({
   quota: external_exports.object({
     model_usage: external_exports.array(
@@ -22145,7 +22295,7 @@ var ProtocolMessageError = class extends Error {
     this.name = "ProtocolMessageError";
   }
 };
-function isRecord5(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson2(encoded) {
@@ -22157,7 +22307,7 @@ function parseJson2(encoded) {
       cause: error61
     });
   }
-  if (!isRecord5(value)) {
+  if (!isRecord4(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22254,7 +22404,7 @@ function readActivityContent(value) {
 }
 function readActivityDetail(value) {
   const field = value["detail"];
-  if (!isRecord5(field)) {
+  if (!isRecord4(field)) {
     throw new ProtocolMessageError("Invalid activity detail field");
   }
   const kind = readString(field, "kind", 32);
@@ -22718,7 +22868,7 @@ var BotSessionPromptCommand = class {
     this.replyRoute = replyRoute;
   }
 };
-function isRecord6(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson3(encoded) {
@@ -22728,7 +22878,7 @@ function parseJson3(encoded) {
   } catch (cause) {
     throw new ProtocolMessageError("Message is not valid JSON", { cause });
   }
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22813,7 +22963,7 @@ function readTargets(value, key) {
   const identifiers = /* @__PURE__ */ new Set();
   const aliases = /* @__PURE__ */ new Set();
   for (const candidate of field) {
-    if (!isRecord6(candidate)) {
+    if (!isRecord5(candidate)) {
       throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
     }
     assertExactKeys2(candidate, ["alias", "deliveryTargetId"]);
@@ -22829,7 +22979,7 @@ function readTargets(value, key) {
   return Object.freeze(targets);
 }
 function readCompletionPolicy(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Invalid Bot completion policy");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -22847,7 +22997,7 @@ function readCompletionPolicy(value) {
   throw new ProtocolMessageError("Invalid Bot completion policy");
 }
 function readReplyRoute(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Invalid Bot reply route");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -23298,10 +23448,14 @@ var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSche
 var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
 var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
 
+// src/pairing/pair-local-machine.ts
+import { fetch as fetch2 } from "undici";
+
 // src/config.ts
+import { join as join15 } from "node:path";
 function loadDefaultWorkspace(environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join13(readStateDirectory(environment), "workspace");
+  return configuredWorkspace ?? join15(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23317,11 +23471,6 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 }
 
 // src/pairing/pair-local-machine.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir3, open as open4, realpath as realpath6, rename as rename3, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
-import { hostname as hostname3 } from "node:os";
-import { basename, join as join14, resolve as resolve3 } from "node:path";
-import { fetch as fetch2 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
 var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
@@ -23339,7 +23488,7 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord7(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -23432,8 +23581,8 @@ async function resolveDefaultWorkspace(path2) {
   const requestedWorkspace = resolve3(path2);
   try {
     await mkdir3(requestedWorkspace, { recursive: true, mode: 448 });
-    const defaultWorkspace = await realpath6(requestedWorkspace);
-    const metadata = await stat5(defaultWorkspace);
+    const defaultWorkspace = await realpath7(requestedWorkspace);
+    const metadata = await stat6(defaultWorkspace);
     if (!metadata.isDirectory()) {
       throw new PairingClientError("invalid_workspace", "The default workspace is not a directory");
     }
@@ -23462,9 +23611,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord7(value)) {
+  if (isRecord6(value)) {
     const error61 = value["error"];
-    if (isRecord7(error61)) {
+    if (isRecord6(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -23475,7 +23624,7 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodePairingResponse(value, credentialField, expectedKeys) {
-  if (!isRecord7(value) || !hasExactKeys(value, expectedKeys)) {
+  if (!isRecord6(value) || !hasExactKeys(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
@@ -23503,7 +23652,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
         installableAgents,
         machineName: hostname3(),
         pairingCode: options.code,
-        workspaceName: basename(defaultWorkspace) || "Local workspace"
+        workspaceName: basename2(defaultWorkspace) || "Local workspace"
       }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -23520,10 +23669,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
 async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
-  const connectionsDirectory = join14(readStateDirectory(environment), "connections");
+  const connectionsDirectory = join16(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
+  const connectionPath = join16(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join16(connectionsDirectory, `.${channelId}.${randomUUID()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
@@ -23543,7 +23692,7 @@ async function persistConnection(channelId, relayOrigin, runtimeCredential2, def
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
+  if (!isRecord6(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
@@ -23561,7 +23710,7 @@ function decodeSavedConnection(value, expectedChannelId) {
   };
 }
 async function readSavedConnection(channelId, environment) {
-  const connectionPath = join14(readStateDirectory(environment), "connections", `${channelId}.json`);
+  const connectionPath = join16(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -23597,7 +23746,7 @@ function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
   relayUrl.searchParams.set("token", connection.runtimeCredential);
-  const auditDatabasePath = join14(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
+  const auditDatabasePath = join16(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -23647,7 +23796,7 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
 }
 async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
   const normalizedChannelId = validatePairingId(channelId);
-  const connectionPath = join14(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connectionPath = join16(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
   const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
@@ -23660,15 +23809,714 @@ async function resumeLocalMachine(arguments_, signal = new AbortController().sig
   return await resumeMobiusRuntime(parseChannelArgument(arguments_), signal, process.env);
 }
 
+// src/bots/local-bot-grant-store.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { stat as stat7 } from "node:fs/promises";
+import { DatabaseSync } from "node:sqlite";
+var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
+var identifier2 = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var savedApprovalSchema = external_exports.object({
+  local_grant_id: identifier2,
+  bot_id: identifier2,
+  binding_id: identifier2,
+  binding_revision: external_exports.number().int().positive(),
+  agent_ref: identifier2,
+  workspace_ref: external_exports.string().min(1).max(2048),
+  revocation_epoch: external_exports.number().int().nonnegative(),
+  agent_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  workspace_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/)
+}).readonly();
+var LocalBotAuthorizationError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "LocalBotAuthorizationError";
+  }
+};
+var LocalBotGrant = class {
+  agent;
+  agentIdentityDigest;
+  allowedDeliveryTargetIds;
+  behaviorDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  expiresAt;
+  localGrantId;
+  revocationEpoch;
+  workspaceIdentityDigest;
+  workspacePath;
+  workspaceRef;
+  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspaceRef, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
+    this.localGrantId = localGrantId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.behaviorDigest = behaviorDigest;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.agent = agent;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspaceRef = workspaceRef;
+    this.workspacePath = workspacePath;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
+    this.expiresAt = expiresAt;
+    this.revocationEpoch = revocationEpoch;
+  }
+};
+function digest(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+function agentDigest(agent) {
+  return digest(
+    JSON.stringify({
+      adapter: agent.adapterIdentity,
+      agent: agent.agentIdentity,
+      agentVersion: agent.agentVersion,
+      arguments: agent.arguments,
+      id: agent.id
+    })
+  );
+}
+async function workspaceDigest(path2) {
+  const metadata = await stat7(path2);
+  if (!metadata.isDirectory()) {
+    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
+  }
+  return digest(
+    JSON.stringify({
+      changedAtMilliseconds: metadata.ctimeMs,
+      device: metadata.dev,
+      inode: metadata.ino,
+      path: path2
+    })
+  );
+}
+function exactTargets(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  const expected = [...left].sort();
+  const actual = [...right].sort();
+  return expected.every((target, index) => target === actual[index]);
+}
+function rowString(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "string") {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function rowInteger(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function parseTargets(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
+  }
+  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value.filter((target) => typeof target === "string");
+}
+var LocalBotGrantStore = class {
+  #database;
+  static containsBot = (path2, botId) => {
+    const database = new DatabaseSync(path2, { readOnly: true });
+    try {
+      if (database.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'local_bot_grants'").get() === void 0) {
+        return false;
+      }
+      return database.prepare("SELECT local_grant_id FROM local_bot_grants WHERE bot_id = ? LIMIT 1").get(botId) !== void 0;
+    } finally {
+      database.close();
+    }
+  };
+  constructor(path2) {
+    this.#database = new DatabaseSync(path2);
+    this.#database.exec(`
+          CREATE TABLE IF NOT EXISTS local_bot_grants (
+            local_grant_id TEXT PRIMARY KEY,
+            bot_id TEXT NOT NULL,
+            behavior_revision_id TEXT NOT NULL,
+            behavior_digest TEXT NOT NULL,
+            binding_id TEXT NOT NULL UNIQUE,
+            binding_revision INTEGER NOT NULL,
+            agent_ref TEXT NOT NULL,
+            agent_identity_digest TEXT NOT NULL,
+            workspace_ref TEXT NOT NULL,
+            workspace_path TEXT NOT NULL,
+            workspace_identity_digest TEXT NOT NULL,
+            allowed_delivery_target_ids_json TEXT NOT NULL,
+            unattended_policy_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            revocation_epoch INTEGER NOT NULL DEFAULT 0,
+            revoked_at INTEGER
+          ) STRICT;
+          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
+            request_id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            local_grant_id TEXT NOT NULL,
+            resolved_at INTEGER NOT NULL,
+            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
+            error_code TEXT,
+            error_message TEXT
+          ) STRICT;
+        `);
+  }
+  /** Only the local CLI may invoke this explicit approval transition. */
+  reapprove = async (botId, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    if (!identifier2.safeParse(botId).success) {
+      throw new LocalBotAuthorizationError("invalid_request", "The Bot ID is invalid");
+    }
+    const row = this.#database.prepare("SELECT * FROM local_bot_grants WHERE bot_id = ? ORDER BY binding_revision DESC LIMIT 1").get(botId);
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError("bot_not_found", "This machine has no saved approval for that Bot");
+    }
+    const parsed = savedApprovalSchema.safeParse(row);
+    if (!parsed.success) {
+      throw new LocalBotAuthorizationError("local_grant_invalid", "The saved Bot approval is invalid", {
+        cause: parsed.error
+      });
+    }
+    const saved = parsed.data;
+    const agent = catalog.find(saved.agent_ref);
+    if (!agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError("binding_incompatible", "The local Agent cannot apply Bot context");
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, saved.workspace_ref, signal);
+    const workspaceIdentityDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = this.#database.prepare(`UPDATE local_bot_grants
+                SET agent_identity_digest = ?, workspace_identity_digest = ?, workspace_path = ?,
+                    revoked_at = NULL, expires_at = ?, revocation_epoch = revocation_epoch + 1
+                WHERE local_grant_id = ? AND revocation_epoch = ?
+                    AND agent_identity_digest = ? AND workspace_identity_digest = ?
+                    AND binding_revision = (SELECT MAX(binding_revision) FROM local_bot_grants WHERE bot_id = ?)`).run(
+        agentDigest(agent),
+        workspaceIdentityDigest,
+        workspacePath,
+        now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS,
+        saved.local_grant_id,
+        saved.revocation_epoch,
+        saved.agent_identity_digest,
+        saved.workspace_identity_digest,
+        botId
+      );
+      if (result.changes !== 1) {
+        throw new LocalBotAuthorizationError(
+          "binding_not_approved",
+          "The Bot binding changed during approval; run the command again"
+        );
+      }
+      this.#database.prepare(`INSERT INTO audit_events (recorded_at, event, command_id, session_id, details_json)
+                VALUES (?, 'bot_binding_locally_reapproved', ?, '', ?)`).run(
+        new Date(now).toISOString(),
+        saved.binding_id,
+        JSON.stringify({ botId, bindingId: saved.binding_id, agentRef: saved.agent_ref })
+      );
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    return { bindingId: saved.binding_id, workspacePath, agentRef: saved.agent_ref };
+  };
+  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const existing = this.#database.prepare(
+      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
+                   INNER JOIN local_bot_grants AS grants
+                     ON grants.local_grant_id = resolutions.local_grant_id
+                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
+                    AND resolutions.result = 'approved'`
+    ).get(request.requestId, request.bindingId);
+    if (existing !== void 0) {
+      return new BotExecutionBindingApprovedEvent(
+        request.requestId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.bindingId,
+        request.bindingRevision,
+        rowString(existing, "local_grant_id"),
+        rowString(existing, "agent_identity_digest"),
+        rowString(existing, "workspace_identity_digest")
+      );
+    }
+    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
+    const localGrantId = `lbg_${randomUUID2()}`;
+    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#database.prepare(
+        `INSERT INTO local_bot_grants (
+                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
+                       binding_id, binding_revision, agent_ref,
+                       agent_identity_digest, workspace_ref, workspace_path,
+                       workspace_identity_digest, allowed_delivery_target_ids_json,
+                       unattended_policy_json, created_at, expires_at
+                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        localGrantId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.behaviorDigest,
+        request.bindingId,
+        request.bindingRevision,
+        request.agentRef,
+        resolved.agentIdentityDigest,
+        request.workspaceRef,
+        resolved.workspacePath,
+        resolved.workspaceIdentityDigest,
+        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
+        JSON.stringify({ localSideEffects: "owner-approval-required" }),
+        now,
+        expiresAt
+      );
+      this.#database.prepare(
+        `INSERT INTO local_bot_binding_resolutions (
+                       request_id, binding_id, local_grant_id, resolved_at, result
+                     ) VALUES (?, ?, ?, ?, 'approved')`
+      ).run(request.requestId, request.bindingId, localGrantId, now);
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    signal.throwIfAborted();
+    return new BotExecutionBindingApprovedEvent(
+      request.requestId,
+      request.botId,
+      request.behaviorRevisionId,
+      request.bindingId,
+      request.bindingRevision,
+      localGrantId,
+      resolved.agentIdentityDigest,
+      resolved.workspaceIdentityDigest
+    );
+  };
+  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const row = this.#database.prepare(
+      `SELECT * FROM local_bot_grants
+                  WHERE local_grant_id = ? AND bot_id = ?
+                    AND behavior_revision_id = ? AND behavior_digest = ?
+                    AND binding_id = ? AND binding_revision = ?
+                    AND agent_ref = ?
+                    AND revoked_at IS NULL AND expires_at > ?`
+    ).get(
+      command.localGrantId,
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      command.agentId,
+      now
+    );
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution binding is not locally approved"
+      );
+    }
+    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
+    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
+    if (!exactTargets(approvedTargets, requestedTargets)) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target policy changed after local approval"
+      );
+    }
+    const agent = catalog.find(command.agentId);
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    const workspaceRef = rowString(row, "workspace_ref");
+    const workspacePath = await directories.resolve(bindingAuthorityId, workspaceRef, signal);
+    const currentAgentDigest = agentDigest(agent);
+    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
+      this.revoke(rowString(row, "local_grant_id"), now);
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target changed and requires local approval"
+      );
+    }
+    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply the approved Bot behavior"
+      );
+    }
+    return new LocalBotGrant(
+      rowString(row, "local_grant_id"),
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      agent,
+      currentAgentDigest,
+      workspaceRef,
+      workspacePath,
+      currentWorkspaceDigest,
+      approvedTargets,
+      rowInteger(row, "expires_at"),
+      rowInteger(row, "revocation_epoch")
+    );
+  };
+  recordUnavailable = (request, code, message, now) => {
+    this.#database.prepare(
+      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
+                   request_id, binding_id, local_grant_id, resolved_at,
+                   result, error_code, error_message
+                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
+    ).run(request.requestId, request.bindingId, now, code, message);
+  };
+  close = () => {
+    this.#database.close();
+  };
+  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
+    const agent = catalog.find(request.agentRef);
+    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply embedded Bot context"
+      );
+    }
+    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The Bot requires an unsupported local Agent capability"
+      );
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
+    return {
+      agent,
+      agentIdentityDigest: agentDigest(agent),
+      workspaceIdentityDigest: await workspaceDigest(workspacePath),
+      workspacePath
+    };
+  };
+  revoke = (localGrantId, now) => {
+    this.#database.prepare(
+      `UPDATE local_bot_grants
+                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
+                  WHERE local_grant_id = ? AND revoked_at IS NULL`
+    ).run(now, localGrantId);
+  };
+};
+
+// src/bots/bot-approve-command.ts
+var identifier3 = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var argumentsSchema = external_exports.union([
+  external_exports.tuple([external_exports.literal("--bot"), identifier3]),
+  external_exports.tuple([external_exports.literal("--bot"), identifier3, external_exports.literal("--channel"), identifier3])
+]);
+async function executeBotApproveCommand(arguments_, environment, parent) {
+  const parsed = argumentsSchema.safeParse(arguments_);
+  if (!parsed.success) {
+    throw new LocalBotAuthorizationError(
+      "invalid_arguments",
+      "Usage: mobius bot approve --bot <bot-id> [--channel <channel-id>]"
+    );
+  }
+  const [, botId, , requestedChannel] = parsed.data;
+  const signal = AbortSignal.any([parent, AbortSignal.timeout(3e4)]);
+  signal.throwIfAborted();
+  try {
+    const stateDirectory = await realpath8(readStateDirectory(environment));
+    const auditDirectory = await realpath8(join17(stateDirectory, "audit"));
+    if (dirname4(auditDirectory) !== stateDirectory) {
+      throw new LocalBotAuthorizationError(
+        "local_grant_invalid",
+        "The local approval directory is outside the Mobius state directory"
+      );
+    }
+    const channels = [];
+    for (const entry of await readdir2(auditDirectory, { withFileTypes: true })) {
+      signal.throwIfAborted();
+      if (!entry.isFile() || !entry.name.endsWith(".sqlite")) {
+        continue;
+      }
+      const channelId2 = entry.name.slice(0, -7);
+      if (!identifier3.safeParse(channelId2).success || requestedChannel !== void 0 && requestedChannel !== channelId2) {
+        continue;
+      }
+      const databasePath = await realpath8(join17(auditDirectory, entry.name));
+      if (dirname4(databasePath) !== auditDirectory) {
+        throw new LocalBotAuthorizationError(
+          "local_grant_invalid",
+          "The local approval database is outside the Mobius audit directory"
+        );
+      }
+      if (LocalBotGrantStore.containsBot(databasePath, botId)) {
+        channels.push(channelId2);
+      }
+    }
+    const channelId = channels[0];
+    if (channelId === void 0) {
+      throw new LocalBotAuthorizationError(
+        "bot_not_found",
+        "No saved approval for this Bot was found. Run this command on the machine hosting the Bot."
+      );
+    }
+    if (channels.length !== 1) {
+      throw new LocalBotAuthorizationError(
+        "binding_ambiguous",
+        `This Bot has approvals in multiple local channels. Add --channel with the intended channel: ${channels.join(", ")}`
+      );
+    }
+    const { config: config2 } = await resumeMobiusRuntime(channelId, signal, environment);
+    signal.throwIfAborted();
+    const grants = new LocalBotGrantStore(config2.auditDatabasePath);
+    try {
+      const approval = await grants.reapprove(
+        botId,
+        config2.catalog,
+        new WorkspaceDirectoryService(config2.bindingId, config2.defaultWorkspace),
+        config2.bindingId,
+        Date.now(),
+        signal
+      );
+      return `Approved Bot ${botId}
+Binding: ${approval.bindingId}
+Agent: ${approval.agentRef}
+Workspace: ${approval.workspacePath}
+Keep your daemon running and resend your message in the same Chat conversation.
+`;
+    } finally {
+      grants.close();
+    }
+  } catch (cause) {
+    parent.throwIfAborted();
+    if (signal.aborted) {
+      throw new LocalBotAuthorizationError("approval_timeout", "Local Bot approval timed out", { cause });
+    }
+    if (cause instanceof LocalBotAuthorizationError) {
+      throw cause;
+    }
+    if (cause instanceof Error && "code" in cause && cause.code === "ENOENT") {
+      throw new LocalBotAuthorizationError(
+        "bot_not_found",
+        "No saved local approval or Runtime connection was found for this Bot",
+        { cause }
+      );
+    }
+    throw new LocalBotAuthorizationError(
+      "local_approval_failed",
+      "Local Bot approval failed. Check the saved Runtime connection and local Agent installation.",
+      { cause }
+    );
+  }
+}
+
+// src/bots/bot-message-command.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { createConnection } from "node:net";
+var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
+var BotMessageCommandError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "BotMessageCommandError";
+  }
+};
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredEnvironment(environment, name) {
+  const value = environment[name]?.trim();
+  if (value === void 0 || value.length === 0) {
+    throw new BotMessageCommandError(
+      "execution_context_required",
+      "This command is available only inside an active Mobius Bot execution"
+    );
+  }
+  return value;
+}
+function option(arguments_, name) {
+  const index = arguments_.indexOf(name);
+  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const value = arguments_[index + 1];
+  if (value === void 0) {
+    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
+  }
+  return value;
+}
+function validateArguments(arguments_) {
+  if (arguments_.length !== 4) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const names = [arguments_[0], arguments_[2]];
+  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+}
+function decodeResponse(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
+      cause
+    });
+  }
+  if (!isRecord7(value) || typeof value["ok"] !== "boolean") {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+  }
+  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
+  }
+  const error61 = value["error"];
+  if (value["ok"] === false && isRecord7(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+    throw new BotMessageCommandError(error61["code"], error61["message"]);
+  }
+  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+}
+async function requestLocalBotService(socketPath, payload, signal) {
+  signal.throwIfAborted();
+  return await new Promise((resolve5, reject) => {
+    const socket = createConnection(socketPath);
+    const chunks = [];
+    let length = 0;
+    let finished = false;
+    const finish = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    const fail = (error61) => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      finish();
+      if (error61 instanceof BotMessageCommandError) {
+        reject(error61);
+        return;
+      }
+      reject(
+        new BotMessageCommandError(
+          "execution_context_required",
+          "The active Mobius Bot execution is unavailable",
+          { cause: error61 }
+        )
+      );
+    };
+    const abort = () => fail(signal.reason);
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
+      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
+    });
+    socket.once("error", fail);
+    socket.once("connect", () => socket.end(`${payload}
+`));
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_RESPONSE_LIMIT) {
+        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("end", () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      signal.removeEventListener("abort", abort);
+      try {
+        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
+      } catch (error61) {
+        reject(error61);
+      } finally {
+        finish();
+      }
+    });
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function executeBotMessageCommand(arguments_, environment, signal) {
+  validateArguments(arguments_);
+  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
+  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
+  const target = option(arguments_, "--target");
+  const text = option(arguments_, "--text");
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
+    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
+  }
+  return await requestLocalBotService(
+    socketPath,
+    JSON.stringify({
+      contextHandle,
+      idempotencyKey: `cli_${randomUUID3()}`,
+      target,
+      text
+    }),
+    signal
+  );
+}
+
 // src/audit/audit-store.ts
 import { mkdirSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { dirname as dirname5 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var AuditStore = class {
   database;
   constructor(path2) {
-    mkdirSync(dirname3(path2), { recursive: true });
-    this.database = new DatabaseSync(path2);
+    mkdirSync(dirname5(path2), { recursive: true });
+    this.database = new DatabaseSync2(path2);
     this.database.exec(`
       CREATE TABLE IF NOT EXISTS audit_events (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -23710,7 +24558,7 @@ var AuditStore = class {
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { basename as basename5, join as join16 } from "node:path";
+import { basename as basename5, join as join18 } from "node:path";
 import { styleText } from "node:util";
 import { fetch as fetch7, WebSocket as WebSocket2 } from "undici";
 
@@ -23724,8 +24572,8 @@ import {
 } from "@agentclientprotocol/sdk";
 
 // src/authorization/local-raster.ts
-import { readFile, realpath as realpath7, stat as stat6 } from "node:fs/promises";
-import { basename as basename2, isAbsolute as isAbsolute7, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
+import { readFile, realpath as realpath9, stat as stat8 } from "node:fs/promises";
+import { basename as basename3, isAbsolute as isAbsolute9, normalize as normalize3, relative as relative5, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var MAX_LOCAL_RASTER_BYTES = 3e6;
 var PNG_SIGNATURE = Uint8Array.of(137, 80, 78, 71);
@@ -23767,18 +24615,18 @@ function sniffRasterMime(bytes) {
   return null;
 }
 function isInsideRoot(root, target) {
-  const relation = relative4(root, target);
-  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute7(relation);
+  const relation = relative5(root, target);
+  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute9(relation);
 }
 async function resolveCanonicalPath(requested, signal) {
   signal.throwIfAborted();
-  if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+  if (!isAbsolute9(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
     return null;
   }
   try {
-    const target = await realpath7(requested);
+    const target = await realpath9(requested);
     signal.throwIfAborted();
-    if (!isAbsolute7(target) || normalize2(target) !== target) {
+    if (!isAbsolute9(target) || normalize3(target) !== target) {
       return null;
     }
     return target;
@@ -23824,7 +24672,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
   if (target === null) {
     return null;
   }
-  const targetMetadata = await stat6(target);
+  const targetMetadata = await stat8(target);
   signal.throwIfAborted();
   if (!targetMetadata.isFile() || targetMetadata.size < 1 || targetMetadata.size > MAX_LOCAL_RASTER_BYTES) {
     return null;
@@ -23835,7 +24683,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
     if (directory === null) {
       continue;
     }
-    const metadata = await stat6(directory);
+    const metadata = await stat8(directory);
     signal.throwIfAborted();
     if (metadata.isDirectory()) {
       authorizedRoots.push(directory);
@@ -23853,7 +24701,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
   if (mimeType === null) {
     return null;
   }
-  return new LocalRasterImage(basename2(target) || "Image", mimeType, bytes);
+  return new LocalRasterImage(basename3(target) || "Image", mimeType, bytes);
 }
 
 // src/native-sessions/history-images.ts
@@ -24928,8 +25776,8 @@ var AcpHistoryReplay = class {
 
 // src/acp/session-store.ts
 import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { dirname as dirname6 } from "node:path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var AcpStoredSession = class {
   additionalDirectories;
   agentId;
@@ -25031,8 +25879,8 @@ var MemoryAcpSessionStore = class {
 var SqliteAcpSessionStore = class {
   #database;
   constructor(path2) {
-    mkdirSync2(dirname4(path2), { recursive: true });
-    this.#database = new DatabaseSync2(path2);
+    mkdirSync2(dirname6(path2), { recursive: true });
+    this.#database = new DatabaseSync3(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS acp_deleted_sessions (session_id TEXT PRIMARY KEY) STRICT;
       CREATE TABLE IF NOT EXISTS acp_sessions (
@@ -27901,7 +28749,7 @@ var FixedInstallationExecutor = class {
 };
 
 // src/artifacts/runtime-artifact-uploader.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // ../mobius-sdk/src/errors.ts
 var MobiusError = class extends Error {
@@ -28228,7 +29076,7 @@ async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
       image.name,
       image.mimeType,
       image.bytes.byteLength,
-      createHash2("sha256").update(image.bytes).digest("hex")
+      createHash3("sha256").update(image.bytes).digest("hex")
     );
   } catch (cause) {
     translateSdkError(cause);
@@ -28296,508 +29144,6 @@ async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
   }
 }
 
-// src/authorization/local-authorization-error.ts
-var LocalAuthorizationError = class extends Error {
-  code = "local_authorization_failed";
-  constructor(message, options = {}) {
-    super(message, options);
-    this.name = "LocalAuthorizationError";
-  }
-};
-
-// src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath8, stat as stat7 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute8, join as join15, normalize as normalize3, relative as relative5 } from "node:path";
-var WorkspaceDirectoryListing = class {
-  directoryId;
-  directoryLabel;
-  entries;
-  parentDirectoryId;
-  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
-    this.directoryId = directoryId2;
-    this.directoryLabel = directoryLabel;
-    this.entries = entries;
-    this.parentDirectoryId = parentDirectoryId;
-  }
-};
-function encodePath(path2) {
-  const encoded = Buffer.from(path2, "utf8").toString("base64url");
-  if (encoded.length === 0 || encoded.length > 2e3) {
-    throw new LocalAuthorizationError("The local directory path is too long to select");
-  }
-  return `path-${encoded}`;
-}
-function decodePath(value, prefix) {
-  const encoded = value.slice(prefix.length);
-  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  }
-  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize3(decoded) !== decoded) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  }
-  return decoded;
-}
-var WorkspaceDirectoryService = class {
-  #bindingId;
-  #defaultWorkspace;
-  constructor(bindingId, defaultWorkspace) {
-    this.#bindingId = bindingId;
-    this.#defaultWorkspace = defaultWorkspace;
-  }
-  authorizeMachine = (bindingId) => {
-    if (bindingId !== this.#bindingId) {
-      throw new LocalAuthorizationError("The runtime binding is not authorized");
-    }
-  };
-  requestedPath = (id) => {
-    if (id === "default") {
-      return this.#defaultWorkspace;
-    }
-    if (id === "home") {
-      return homedir2();
-    }
-    if (id.startsWith("path-")) {
-      const path2 = decodePath(id, "path-");
-      if (isAbsolute8(path2)) {
-        return path2;
-      }
-    }
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  };
-  resolvePath = async (requested, signal) => {
-    signal.throwIfAborted();
-    if (!isAbsolute8(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
-      throw new LocalAuthorizationError("The local directory path is invalid");
-    }
-    try {
-      const target = await realpath8(requested);
-      signal.throwIfAborted();
-      const metadata = await stat7(target);
-      signal.throwIfAborted();
-      if (!isAbsolute8(target) || normalize3(target) !== target || !metadata.isDirectory()) {
-        throw new LocalAuthorizationError("The selected location is not a directory");
-      }
-      return target;
-    } catch (cause) {
-      signal.throwIfAborted();
-      if (cause instanceof LocalAuthorizationError) {
-        throw cause;
-      }
-      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
-        cause
-      });
-    }
-  };
-  label = (path2) => {
-    const suffix = relative5(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
-  };
-  identify = async (bindingId, requestedPath, signal) => {
-    this.authorizeMachine(bindingId);
-    const path2 = await this.resolvePath(requestedPath, signal);
-    return {
-      path: path2,
-      directoryId: encodePath(path2),
-      name: basename3(path2) || path2,
-      label: this.label(path2)
-    };
-  };
-  resolve = async (bindingId, id, signal) => {
-    this.authorizeMachine(bindingId);
-    return await this.resolvePath(this.requestedPath(id), signal);
-  };
-  list = async (bindingId, id, signal) => {
-    const target = await this.resolve(bindingId, id, signal);
-    try {
-      const children = await readdir(target, { withFileTypes: true });
-      signal.throwIfAborted();
-      const entries = [];
-      for (const child of children) {
-        if (entries.length === 500) {
-          break;
-        }
-        if (child.isFile() || child.isBlockDevice() || child.isCharacterDevice() || child.isFIFO() || child.isSocket()) {
-          continue;
-        }
-        try {
-          const path2 = await this.resolvePath(join15(target, child.name), signal);
-          entries.push({ directoryId: encodePath(path2), name: child.name });
-        } catch (cause) {
-          signal.throwIfAborted();
-          if (!(cause instanceof LocalAuthorizationError)) {
-            throw cause;
-          }
-        }
-      }
-      entries.sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname5(target);
-      return new WorkspaceDirectoryListing(
-        id,
-        this.label(target),
-        entries,
-        parent === target ? "" : encodePath(parent)
-      );
-    } catch (cause) {
-      signal.throwIfAborted();
-      if (cause instanceof LocalAuthorizationError) {
-        throw cause;
-      }
-      throw new LocalAuthorizationError("This directory cannot be browsed by your user account", { cause });
-    }
-  };
-  resolveMany = async (bindingId, ids, signal) => {
-    const paths = /* @__PURE__ */ new Set();
-    for (const id of ids) {
-      paths.add(await this.resolve(bindingId, id, signal));
-    }
-    return [...paths];
-  };
-};
-
-// src/bots/local-bot-grant-store.ts
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
-import { stat as stat8 } from "node:fs/promises";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
-var LocalBotAuthorizationError = class extends Error {
-  code;
-  constructor(code, message, options = {}) {
-    super(message, options);
-    this.code = code;
-    this.name = "LocalBotAuthorizationError";
-  }
-};
-var LocalBotGrant = class {
-  agent;
-  agentIdentityDigest;
-  allowedDeliveryTargetIds;
-  behaviorDigest;
-  behaviorRevisionId;
-  bindingId;
-  bindingRevision;
-  botId;
-  expiresAt;
-  localGrantId;
-  revocationEpoch;
-  workspaceIdentityDigest;
-  workspacePath;
-  workspaceRef;
-  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspaceRef, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
-    this.localGrantId = localGrantId;
-    this.botId = botId;
-    this.behaviorRevisionId = behaviorRevisionId;
-    this.behaviorDigest = behaviorDigest;
-    this.bindingId = bindingId;
-    this.bindingRevision = bindingRevision;
-    this.agent = agent;
-    this.agentIdentityDigest = agentIdentityDigest;
-    this.workspaceRef = workspaceRef;
-    this.workspacePath = workspacePath;
-    this.workspaceIdentityDigest = workspaceIdentityDigest;
-    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
-    this.expiresAt = expiresAt;
-    this.revocationEpoch = revocationEpoch;
-  }
-};
-function digest(value) {
-  return createHash3("sha256").update(value, "utf8").digest("hex");
-}
-function agentDigest(agent) {
-  return digest(
-    JSON.stringify({
-      adapter: agent.adapterIdentity,
-      agent: agent.agentIdentity,
-      agentVersion: agent.agentVersion,
-      arguments: agent.arguments,
-      id: agent.id
-    })
-  );
-}
-async function workspaceDigest(path2) {
-  const metadata = await stat8(path2);
-  if (!metadata.isDirectory()) {
-    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
-  }
-  return digest(
-    JSON.stringify({
-      changedAtMilliseconds: metadata.ctimeMs,
-      device: metadata.dev,
-      inode: metadata.ino,
-      path: path2
-    })
-  );
-}
-function exactTargets(left, right) {
-  if (left.length !== right.length) {
-    return false;
-  }
-  const expected = [...left].sort();
-  const actual = [...right].sort();
-  return expected.every((target, index) => target === actual[index]);
-}
-function rowString(row, key) {
-  const value = Reflect.get(row, key);
-  if (typeof value !== "string") {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value;
-}
-function rowInteger(row, key) {
-  const value = Reflect.get(row, key);
-  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value;
-}
-function parseTargets(encoded) {
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch (cause) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
-  }
-  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value.filter((target) => typeof target === "string");
-}
-var LocalBotGrantStore = class {
-  #database;
-  constructor(path2) {
-    this.#database = new DatabaseSync3(path2);
-    this.#database.exec(`
-          CREATE TABLE IF NOT EXISTS local_bot_grants (
-            local_grant_id TEXT PRIMARY KEY,
-            bot_id TEXT NOT NULL,
-            behavior_revision_id TEXT NOT NULL,
-            behavior_digest TEXT NOT NULL,
-            binding_id TEXT NOT NULL UNIQUE,
-            binding_revision INTEGER NOT NULL,
-            agent_ref TEXT NOT NULL,
-            agent_identity_digest TEXT NOT NULL,
-            workspace_ref TEXT NOT NULL,
-            workspace_path TEXT NOT NULL,
-            workspace_identity_digest TEXT NOT NULL,
-            allowed_delivery_target_ids_json TEXT NOT NULL,
-            unattended_policy_json TEXT NOT NULL,
-            created_at INTEGER NOT NULL,
-            expires_at INTEGER NOT NULL,
-            revocation_epoch INTEGER NOT NULL DEFAULT 0,
-            revoked_at INTEGER
-          ) STRICT;
-          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
-            request_id TEXT PRIMARY KEY,
-            binding_id TEXT NOT NULL,
-            local_grant_id TEXT NOT NULL,
-            resolved_at INTEGER NOT NULL,
-            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
-            error_code TEXT,
-            error_message TEXT
-          ) STRICT;
-        `);
-  }
-  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
-    signal.throwIfAborted();
-    const existing = this.#database.prepare(
-      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
-                   INNER JOIN local_bot_grants AS grants
-                     ON grants.local_grant_id = resolutions.local_grant_id
-                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
-                    AND resolutions.result = 'approved'`
-    ).get(request.requestId, request.bindingId);
-    if (existing !== void 0) {
-      return new BotExecutionBindingApprovedEvent(
-        request.requestId,
-        request.botId,
-        request.behaviorRevisionId,
-        request.bindingId,
-        request.bindingRevision,
-        rowString(existing, "local_grant_id"),
-        rowString(existing, "agent_identity_digest"),
-        rowString(existing, "workspace_identity_digest")
-      );
-    }
-    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
-    const localGrantId = `lbg_${randomUUID3()}`;
-    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
-    this.#database.exec("BEGIN IMMEDIATE");
-    try {
-      this.#database.prepare(
-        `INSERT INTO local_bot_grants (
-                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
-                       binding_id, binding_revision, agent_ref,
-                       agent_identity_digest, workspace_ref, workspace_path,
-                       workspace_identity_digest, allowed_delivery_target_ids_json,
-                       unattended_policy_json, created_at, expires_at
-                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-      ).run(
-        localGrantId,
-        request.botId,
-        request.behaviorRevisionId,
-        request.behaviorDigest,
-        request.bindingId,
-        request.bindingRevision,
-        request.agentRef,
-        resolved.agentIdentityDigest,
-        request.workspaceRef,
-        resolved.workspacePath,
-        resolved.workspaceIdentityDigest,
-        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
-        JSON.stringify({ localSideEffects: "owner-approval-required" }),
-        now,
-        expiresAt
-      );
-      this.#database.prepare(
-        `INSERT INTO local_bot_binding_resolutions (
-                       request_id, binding_id, local_grant_id, resolved_at, result
-                     ) VALUES (?, ?, ?, ?, 'approved')`
-      ).run(request.requestId, request.bindingId, localGrantId, now);
-      this.#database.exec("COMMIT");
-    } catch (cause) {
-      this.#database.exec("ROLLBACK");
-      throw cause;
-    }
-    signal.throwIfAborted();
-    return new BotExecutionBindingApprovedEvent(
-      request.requestId,
-      request.botId,
-      request.behaviorRevisionId,
-      request.bindingId,
-      request.bindingRevision,
-      localGrantId,
-      resolved.agentIdentityDigest,
-      resolved.workspaceIdentityDigest
-    );
-  };
-  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
-    signal.throwIfAborted();
-    const row = this.#database.prepare(
-      `SELECT * FROM local_bot_grants
-                  WHERE local_grant_id = ? AND bot_id = ?
-                    AND behavior_revision_id = ? AND behavior_digest = ?
-                    AND binding_id = ? AND binding_revision = ?
-                    AND agent_ref = ?
-                    AND revoked_at IS NULL AND expires_at > ?`
-    ).get(
-      command.localGrantId,
-      command.botId,
-      command.behaviorRevisionId,
-      command.behaviorDigest,
-      command.bindingId,
-      command.bindingRevision,
-      command.agentId,
-      now
-    );
-    if (row === void 0) {
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution binding is not locally approved"
-      );
-    }
-    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
-    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
-    if (!exactTargets(approvedTargets, requestedTargets)) {
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution target policy changed after local approval"
-      );
-    }
-    const agent = catalog.find(command.agentId);
-    const [adapterUnchanged, agentUnchanged] = await Promise.all([
-      revalidateExecutable(agent.adapterIdentity),
-      revalidateExecutable(agent.agentIdentity)
-    ]);
-    signal.throwIfAborted();
-    const workspaceRef = rowString(row, "workspace_ref");
-    const workspacePath = await directories.resolve(bindingAuthorityId, workspaceRef, signal);
-    const currentAgentDigest = agentDigest(agent);
-    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
-    signal.throwIfAborted();
-    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
-      this.revoke(rowString(row, "local_grant_id"), now);
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution target changed and requires local approval"
-      );
-    }
-    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent cannot apply the approved Bot behavior"
-      );
-    }
-    return new LocalBotGrant(
-      rowString(row, "local_grant_id"),
-      command.botId,
-      command.behaviorRevisionId,
-      command.behaviorDigest,
-      command.bindingId,
-      command.bindingRevision,
-      agent,
-      currentAgentDigest,
-      workspaceRef,
-      workspacePath,
-      currentWorkspaceDigest,
-      approvedTargets,
-      rowInteger(row, "expires_at"),
-      rowInteger(row, "revocation_epoch")
-    );
-  };
-  recordUnavailable = (request, code, message, now) => {
-    this.#database.prepare(
-      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
-                   request_id, binding_id, local_grant_id, resolved_at,
-                   result, error_code, error_message
-                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
-    ).run(request.requestId, request.bindingId, now, code, message);
-  };
-  close = () => {
-    this.#database.close();
-  };
-  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
-    const agent = catalog.find(request.agentRef);
-    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent cannot apply embedded Bot context"
-      );
-    }
-    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The Bot requires an unsupported local Agent capability"
-      );
-    }
-    const [adapterUnchanged, agentUnchanged] = await Promise.all([
-      revalidateExecutable(agent.adapterIdentity),
-      revalidateExecutable(agent.agentIdentity)
-    ]);
-    signal.throwIfAborted();
-    if (!adapterUnchanged || !agentUnchanged) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent executable changed before approval"
-      );
-    }
-    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
-    return {
-      agent,
-      agentIdentityDigest: agentDigest(agent),
-      workspaceIdentityDigest: await workspaceDigest(workspacePath),
-      workspacePath
-    };
-  };
-  revoke = (localGrantId, now) => {
-    this.#database.prepare(
-      `UPDATE local_bot_grants
-                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
-                  WHERE local_grant_id = ? AND revoked_at IS NULL`
-    ).run(now, localGrantId);
-  };
-};
-
 // src/bots/bot-context-applicator.ts
 var AppliedBotContext = class {
   resources;
@@ -28933,7 +29279,7 @@ var BotExecutionContextRegistry = class {
 // src/bots/bot-outbound-ipc.ts
 import { chmod as chmod2, mkdir as mkdir4, unlink } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname6, isAbsolute as isAbsolute9 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute10 } from "node:path";
 import { fetch as fetch5 } from "undici";
 var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
 var BOT_IPC_TIMEOUT_MILLISECONDS2 = 2e4;
@@ -29031,7 +29377,7 @@ var BotOutboundIpcServer = class {
   #usesFilesystemSocket;
   constructor(socketPath, relayUrl, registry2) {
     const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
-    if (usesFilesystemSocket && !isAbsolute9(socketPath)) {
+    if (usesFilesystemSocket && !isAbsolute10(socketPath)) {
       throw new Error("The Bot IPC path must be absolute");
     }
     this.#registry = registry2;
@@ -29046,7 +29392,7 @@ var BotOutboundIpcServer = class {
   listen = async (signal) => {
     signal.throwIfAborted();
     if (this.#usesFilesystemSocket) {
-      await mkdir4(dirname6(this.#socketPath), { mode: 448, recursive: true });
+      await mkdir4(dirname7(this.#socketPath), { mode: 448, recursive: true });
       await unlink(this.#socketPath).catch((error61) => {
         if (!isRecord12(error61) || error61["code"] !== "ENOENT") {
           throw error61;
@@ -30352,7 +30698,7 @@ var RelayConnectionLiveness = class {
 
 // src/relay-connection/session-event-outbox.ts
 import { mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 var DEFAULT_OUTBOX_LIMITS = {
   criticalEventBytes: 136 * 1024 * 1024,
@@ -30420,7 +30766,7 @@ var SessionEventOutbox = class {
   constructor(path2, limits = DEFAULT_OUTBOX_LIMITS) {
     validateLimits(limits);
     this.#limits = limits;
-    mkdirSync3(dirname7(path2), { recursive: true });
+    mkdirSync3(dirname8(path2), { recursive: true });
     this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS relay_session_event_outbox (
@@ -30971,7 +31317,7 @@ function botIpcSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\mobius-bot-${randomUUID6()}`;
   }
-  return join16("/tmp", `mobius-bot-${randomUUID6()}.sock`);
+  return join18("/tmp", `mobius-bot-${randomUUID6()}.sock`);
 }
 var DaemonAcpObserver = class {
   #config;
@@ -31641,7 +31987,7 @@ async function executeSessionConfigure(publisher, socket, command, config2, dire
     reportOperationFailure(socket, command.requestId, command.sessionId, error61);
   }
 }
-async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, timer, signal) {
+async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -31670,6 +32016,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       }),
       attemptId
     );
+    activateAttempt();
     const attachments = await resolvePromptArtifacts(config2, command, signal);
     let stopReason;
     if (command.disposition === SessionPromptDisposition.Steer) {
@@ -31781,7 +32128,7 @@ function botExecutionAgent(agent, contextHandle, socketPath) {
     agent.capabilities
   );
 }
-async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, timer, signal) {
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -31862,6 +32209,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         }),
         attemptId
       );
+      activateAttempt();
       const result = await sessions.runPrompt({
         additionalDirectories: resolved.additionalDirectories,
         agent,
@@ -32055,11 +32403,13 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         }
         const turn = new ActiveDaemonTurn(command, receipt.attemptId);
         activeTurns.set(command.commandId, turn);
-        if (trackActiveAttempt) {
-          activeAttemptIds.set(command.sessionId, receipt.attemptId);
-        }
+        const activateAttempt = () => {
+          if (trackActiveAttempt) {
+            activeAttemptIds.set(command.sessionId, receipt.attemptId);
+          }
+        };
         try {
-          await execute(receipt.attemptId, turn.signal);
+          await execute(receipt.attemptId, activateAttempt, turn.signal);
         } finally {
           activeTurns.delete(command.commandId);
           if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
@@ -32144,7 +32494,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             true,
-            (attemptId, executionSignal) => executeBotPrompt(
+            (attemptId, activateAttempt, executionSignal) => executeBotPrompt(
               outbox,
               publisher,
               command,
@@ -32157,6 +32507,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -32169,7 +32520,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             command.disposition !== SessionPromptDisposition.Steer,
-            (attemptId, executionSignal) => executePrompt(
+            (attemptId, activateAttempt, executionSignal) => executePrompt(
               outbox,
               publisher,
               command,
@@ -32178,6 +32529,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               audit,
               sessions,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -32679,7 +33031,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             }
             const turn2 = new ActiveDaemonTurn(command2, receipt2.attemptId);
             activeTurns.set(command2.commandId, turn2);
-            activeAttemptIds.set(command2.sessionId, receipt2.attemptId);
             void executeBotPrompt(
               outbox,
               publisher,
@@ -32693,6 +33044,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               receipt2.attemptId,
+              () => activeAttemptIds.set(command2.sessionId, receipt2.attemptId),
               timer,
               turn2.signal
             ).catch((error61) => {
@@ -32719,9 +33071,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           }
           const turn = new ActiveDaemonTurn(command, receipt.attemptId);
           activeTurns.set(command.commandId, turn);
-          if (command.disposition !== SessionPromptDisposition.Steer) {
-            activeAttemptIds.set(command.sessionId, receipt.attemptId);
-          }
           void executePrompt(
             outbox,
             publisher,
@@ -32731,6 +33080,11 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             audit,
             sessions,
             receipt.attemptId,
+            () => {
+              if (command.disposition !== SessionPromptDisposition.Steer) {
+                activeAttemptIds.set(command.sessionId, receipt.attemptId);
+              }
+            },
             timer,
             turn.signal
           ).catch((error61) => {
@@ -32989,6 +33343,7 @@ Usage:
   mobius pair --url <relay-url> --pairing <runtime-pairing-id> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
+  mobius bot approve --bot <bot-id> [--channel <channel-id>]
   mobius bot message send --target <current|alias> --text <message>
 
 Commands:
@@ -32996,7 +33351,7 @@ Commands:
   pair   Pair this machine and start its local daemon
   start  Start the local daemon for a saved channel
   agents Show detected, missing, and integration-ready Agents
-  bot    Invoke Bot-scoped actions from an active local execution
+  bot    Approve a saved Bot locally or send a message from an active execution
 
 Pairing grants this browser access to the machine with your user account's permissions.
 New conversations default to ~/.mobius/workspace; choose other directories in the browser.
@@ -33027,6 +33382,10 @@ async function main() {
     return;
   }
   if (command === "bot") {
+    if (process.argv[3] === "approve") {
+      process.stdout.write(await executeBotApproveCommand(process.argv.slice(4), process.env, shutdown.signal));
+      return;
+    }
     if (process.argv[3] !== "message" || process.argv[4] !== "send") {
       throw new BotMessageCommandError(
         "invalid_request",
@@ -33072,7 +33431,7 @@ try {
 } catch (error61) {
   if (!shutdown.signal.aborted) {
     const message = error61 instanceof Error ? error61.message : "Unknown failure";
-    const code = error61 instanceof BotMessageCommandError ? `${error61.code}: ` : "";
+    const code = error61 instanceof BotMessageCommandError || error61 instanceof LocalBotAuthorizationError ? `${error61.code}: ` : "";
     process.stderr.write(`Mobius daemon failed: ${code}${message}
 `);
     process.exitCode = 1;