@moxt-ai/mobius 0.0.28 → 0.0.30

package/dist/runtime.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/runtime.ts
 import { mkdir as mkdir5, realpath as realpath9, stat as stat9 } from "node:fs/promises";
-import { dirname as dirname8, join as join17, resolve as resolve5 } from "node:path";
+import { dirname as dirname8, join as join18, resolve as resolve5 } from "node:path";
 
 // src/agent-catalog/local-agent.ts
 import { realpathSync, statSync } from "node:fs";
@@ -1029,6 +1029,13 @@ var ManagedNpmPackageInstaller = class {
 
 // src/agent-catalog/agent-specification.ts
 import { join as join3 } from "node:path";
+
+// src/agent-catalog/version-output.ts
+function normalizeVersionOutput(output2) {
+  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
+}
+
+// src/agent-catalog/agent-specification.ts
 var VERSION_PROBE_TIMEOUT_MILLISECONDS = 3e3;
 var ACP_PROBE_TIMEOUT_MILLISECONDS = 5e3;
 var DEFAULT_PROMPT_TIMEOUT_MILLISECONDS = 30 * 60 * 1e3;
@@ -1037,6 +1044,8 @@ var LocalAgentSpecification = class {
   authenticationCommand = () => "";
   adapterVersionArguments = ["--version"];
   agentVersionArguments = ["--version"];
+  normalizeAdapterVersion = normalizeVersionOutput;
+  normalizeAgentVersion = normalizeVersionOutput;
   promptTimeoutMilliseconds = DEFAULT_PROMPT_TIMEOUT_MILLISECONDS;
   versionProbeTimeoutMilliseconds = VERSION_PROBE_TIMEOUT_MILLISECONDS;
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
@@ -1148,6 +1157,20 @@ var AgentProbeError = class extends Error {
   }
 };
 
+// src/agent-catalog/agents/resolve-user-local-executable.ts
+import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+async function resolveUserLocalExecutable(executableName, context) {
+  context.signal.throwIfAborted();
+  const platform = context.platform ?? process.platform;
+  const homeDirectory = context.environment["HOME"];
+  if (platform === "win32" || homeDirectory === void 0 || !isAbsolute2(homeDirectory)) {
+    return [];
+  }
+  const executable = await resolveExecutablePath(join4(homeDirectory, ".local", "bin", executableName), platform);
+  context.signal.throwIfAborted();
+  return executable === null ? [] : [executable];
+}
+
 // src/agent-catalog/agents/verify-session-creation.ts
 import { methods } from "@agentclientprotocol/sdk";
 async function verifySessionCreation(connection, capabilities, defaultWorkspace, signal, label) {
@@ -1172,6 +1195,37 @@ async function verifySessionCreation(connection, capabilities, defaultWorkspace,
   }
 }
 
+// src/agent-catalog/agents/copilot-cli-agent.ts
+var COPILOT_CLI_TESTED_VERSION = "1.0.83";
+var CopilotCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = COPILOT_CLI_TESTED_VERSION;
+  authenticationCommand = () => "copilot login";
+  agentExecutable = "copilot";
+  id = "github-copilot-cli";
+  label = "GitHub Copilot CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_COPILOT_PATH",
+      ["--no-auto-update", "--acp", "--stdio"],
+      ["agents", "github-copilot-cli", COPILOT_CLI_TESTED_VERSION, "bin", "copilot"]
+    );
+  }
+  createLaunchEnvironment = async (_agent, _context) => Object.freeze({ COPILOT_AUTO_UPDATE: "false" });
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || capabilities.sessionCapabilities?.list == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError(
+        "acp_incompatible",
+        "GitHub Copilot CLI reported an unsupported ACP capability set"
+      );
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/cursor-cli-agent.ts
 var CURSOR_CLI_TESTED_VERSION = "2026.09.02-c22c1a3";
 var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
@@ -1198,7 +1252,7 @@ var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 import { realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join5, normalize } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6, normalize } from "node:path";
 
 // src/agent-installation/deepseek-managed-package.ts
 var DeepSeekHarnessManagedPackage = class extends SriManagedNpmPackageDefinition {
@@ -1216,18 +1270,18 @@ var DEEPSEEK_HARNESS_PACKAGE = new DeepSeekHarnessManagedPackage(
 
 // src/storage/state-directory.ts
 import { homedir } from "node:os";
-import { join as join4, resolve as resolve2 } from "node:path";
+import { join as join5, resolve as resolve2 } from "node:path";
 function readStateDirectory(environment = process.env) {
   const configured = environment["MOBIUS_STATE_DIRECTORY"]?.trim();
   if (configured !== void 0 && configured.length > 0) {
     return resolve2(configured);
   }
-  return join4(homedir(), ".mobius");
+  return join5(homedir(), ".mobius");
 }
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 async function validateAgentHome(path2) {
-  if (!isAbsolute2(path2) || normalize(path2) !== path2) {
+  if (!isAbsolute3(path2) || normalize(path2) !== path2) {
     throw new AgentProbeError("agent_environment_invalid", "The configured Agent home is invalid");
   }
   try {
@@ -1277,7 +1331,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
         context.signal
       );
       if (managed.path === agent.path) {
-        selectedHome = join5(readStateDirectory(context.environment), "agents", this.id, "home");
+        selectedHome = join6(readStateDirectory(context.environment), "agents", this.id, "home");
       }
     } catch {
       context.signal.throwIfAborted();
@@ -1293,7 +1347,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join5(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
+      join6(stateDirectory, "agents", this.id, DEEPSEEK_HARNESS_PACKAGE.version),
       DEEPSEEK_HARNESS_PACKAGE
     );
     signal.throwIfAborted();
@@ -1313,9 +1367,41 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/gemini-cli-agent.ts
+var GEMINI_CLI_TESTED_VERSION = "0.59.0";
+var GeminiCliAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = GEMINI_CLI_TESTED_VERSION;
+  authenticationCommand = () => "gemini";
+  agentExecutable = "gemini";
+  id = "gemini-cli";
+  label = "Gemini CLI";
+  versionProbeTimeoutMilliseconds = 1e4;
+  constructor() {
+    super(
+      "MOBIUS_GEMINI_PATH",
+      ["--acp"],
+      [
+        "agents",
+        "gemini-cli",
+        GEMINI_CLI_TESTED_VERSION,
+        "bin",
+        process.platform === "win32" ? "gemini.cmd" : "gemini"
+      ]
+    );
+  }
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    if (capabilities.loadSession !== true || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Gemini CLI reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/grok-build-agent.ts
 import { realpath as realpath4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join7, relative as relative2, sep as sep2 } from "node:path";
 
 // src/agent-installation/grok-managed-package.ts
 var GROK_BUILD_MANAGED_VERSION = "1.0.21";
@@ -1378,7 +1464,7 @@ function grokBuildManagedPackage(platform, architecture) {
 // src/agent-catalog/agents/grok-build-agent.ts
 function isContainedPath2(root, candidate) {
   const difference = relative2(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute3(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute4(difference);
 }
 var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   adapterVersion = GROK_BUILD_MANAGED_VERSION;
@@ -1406,7 +1492,7 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
       if (managed.path === agent.path) {
         return Object.freeze({
           GROK_HOME: await realpath4(
-            join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
+            join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION, "home")
           )
         });
       }
@@ -1417,9 +1503,9 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
   resolveManagedAgent = async (stateDirectory, platform, signal) => {
     signal.throwIfAborted();
-    const versionRoot = await realpath4(join6(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
-    await validateManagedNpmPackage(join6(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
-    const executable = await resolveExecutablePath(join6(versionRoot, "home", "bin", "grok"), platform);
+    const versionRoot = await realpath4(join7(stateDirectory, "agents", this.id, GROK_BUILD_MANAGED_VERSION));
+    await validateManagedNpmPackage(join7(versionRoot, "package"), grokBuildManagedPackage(platform, process.arch));
+    const executable = await resolveExecutablePath(join7(versionRoot, "home", "bin", "grok"), platform);
     signal.throwIfAborted();
     if (executable === null || !isContainedPath2(versionRoot, executable.path)) {
       throw new AgentProbeError("managed_agent_invalid", "The managed Grok Build executable is invalid");
@@ -1436,14 +1522,39 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   };
 };
 
+// src/agent-catalog/agents/hermes-agent.ts
+var HERMES_TESTED_VERSION = "0.21.1";
+var HermesAgentSpecification = class extends DirectAcpAgentDefinition {
+  acpProbeTimeoutMilliseconds = 2e4;
+  adapterVersion = HERMES_TESTED_VERSION;
+  adapterVersionArguments = ["acp", "--version"];
+  authenticationCommand = () => "hermes acp --setup";
+  agentExecutable = "hermes";
+  agentVersionArguments = ["acp", "--version"];
+  id = "hermes";
+  label = "Hermes Agent";
+  constructor() {
+    super("MOBIUS_HERMES_PATH", ["acp"], ["agents", "hermes", HERMES_TESTED_VERSION, "bin", "hermes"]);
+  }
+  resolveInstalledAgentExecutables = async (context) => await resolveUserLocalExecutable(this.agentExecutable, context);
+  verifyAcp = async (connection, initialized, defaultWorkspace, signal) => {
+    const capabilities = initialized.agentCapabilities ?? {};
+    const session = capabilities.sessionCapabilities;
+    if (capabilities.loadSession !== true || session?.fork == null || session.list == null || session.resume == null || (initialized.authMethods ?? []).length === 0) {
+      throw new AgentProbeError("acp_incompatible", "Hermes Agent reported an unsupported ACP capability set");
+    }
+    await verifySessionCreation(connection, capabilities, defaultWorkspace, signal, this.label);
+  };
+};
+
 // src/agent-catalog/agents/opencode-agent.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/agent-installation/managed-agent-archive.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { chmod, copyFile, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open2, realpath as realpath5, rename as rename2, rm as rm2, stat as stat4, writeFile } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute4, join as join7, relative as relative3, sep as sep3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute5, join as join8, relative as relative3, sep as sep3 } from "node:path";
 
 // src/agent-installation/verified-download.ts
 import { fetch } from "undici";
@@ -1549,7 +1660,7 @@ function isRecord3(value) {
 }
 function isContainedPath3(root, candidate) {
   const difference = relative3(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute4(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute5(difference);
 }
 async function hashFile(path2, signal) {
   signal.throwIfAborted();
@@ -1628,11 +1739,11 @@ async function validateManagedAgentArchive(root, definition, signal) {
     if (!rootMetadata.isDirectory() || typeof process.getuid === "function" && rootMetadata.uid !== process.getuid()) {
       throw new Error("Managed Agent root is not user-owned");
     }
-    const manifest = await readManifest(join7(rootPath, "archive.json"));
+    const manifest = await readManifest(join8(rootPath, "archive.json"));
     if (manifest["archiveSha256"] !== definition.archiveSha256 || manifest["archiveUrl"] !== definition.archiveUrl.toString() || manifest["version"] !== definition.version || typeof manifest["executableSha256"] !== "string") {
       throw new Error("Managed Agent archive identity is invalid");
     }
-    const executable = await resolveExecutablePath(join7(rootPath, "bin", definition.executableName));
+    const executable = await resolveExecutablePath(join8(rootPath, "bin", definition.executableName));
     if (executable === null || !isContainedPath3(rootPath, executable.path) || await hashFile(executable.path, signal) !== manifest["executableSha256"]) {
       throw new Error("Managed Agent executable is invalid");
     }
@@ -1724,7 +1835,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
   }
   createLaunchEnvironment = async (_agent, _context) => Object.freeze({ OPENCODE_DISABLE_AUTOUPDATE: "1" });
   resolveManagedAgent = async (stateDirectory, platform, signal) => await validateManagedAgentArchive(
-    join8(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
+    join9(stateDirectory, "agents", this.id, OPENCODE_MANAGED_VERSION),
     openCodeManagedArchive(platform, process.arch),
     signal
   );
@@ -1742,7 +1853,7 @@ var OpenCodeAgentSpecification = class extends DirectAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/pi-agent.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import {
   methods as methods2
 } from "@agentclientprotocol/sdk";
@@ -1801,7 +1912,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join9(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
+      join10(stateDirectory, "agents", this.id, PI_AGENT_PACKAGE.version),
       PI_AGENT_PACKAGE
     );
     signal.throwIfAborted();
@@ -1839,7 +1950,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/workbuddy-agent.ts
-import { isAbsolute as isAbsolute5, join as join10 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 
 // src/agent-installation/workbuddy-managed-package.ts
 var WORKBUDDY_MANAGED_VERSION = "2.146.0";
@@ -1892,7 +2003,7 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
   resolveManagedAgent = async (stateDirectory, _platform, signal) => {
     signal.throwIfAborted();
     const executable = await validateManagedNpmPackage(
-      join10(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
+      join11(stateDirectory, "agents", this.id, WORKBUDDY_MANAGED_VERSION),
       WORKBUDDY_MANAGED_PACKAGE
     );
     signal.throwIfAborted();
@@ -1903,10 +2014,10 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
     if ((context.platform ?? process.platform) !== "darwin") {
       return [];
     }
-    const requestedPaths = [join10("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
+    const requestedPaths = [join11("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
     const homeDirectory = context.environment["HOME"];
-    if (homeDirectory !== void 0 && isAbsolute5(homeDirectory)) {
-      requestedPaths.unshift(join10(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
+    if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
+      requestedPaths.unshift(join11(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
     }
     const executables = [];
     for (const requestedPath of requestedPaths) {
@@ -1932,12 +2043,15 @@ function supportedLocalAgentSpecifications() {
   return Object.freeze([
     new CodexAgentSpecification(),
     new ClaudeCodeAgentSpecification(),
+    new CopilotCliAgentSpecification(),
     new PiAgentSpecification(),
     new DeepSeekHarnessAgentSpecification(),
+    new HermesAgentSpecification(),
     new OpenCodeAgentSpecification(),
     new CursorCliAgentSpecification(),
     new GrokBuildAgentSpecification(),
-    new WorkBuddyAgentSpecification()
+    new WorkBuddyAgentSpecification(),
+    new GeminiCliAgentSpecification()
   ]);
 }
 
@@ -1977,11 +2091,173 @@ var createAcpClient = (handler) => client({ name: "mobius" }).onRequest(
   outcome: { outcome: "cancelled" }
 })).onNotification("cursor/update_todos", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/task", discardExtensionParams, async () => Promise.resolve()).onNotification("cursor/generate_image", discardExtensionParams, async () => Promise.resolve());
 
+// src/agent-catalog/acp-readiness-probe.ts
+var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+var VerifiedAcpReadiness = class {
+  adapterVersion;
+  capabilities;
+  constructor(adapterVersion, capabilities) {
+    this.adapterVersion = adapterVersion;
+    this.capabilities = capabilities;
+  }
+};
+var DiscoveryAcpHandler = class {
+  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
+  onElicitationComplete = (_notification) => Promise.resolve();
+  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
+  onUpdate = (_notification) => Promise.resolve();
+};
+function readableAcpStream(input2) {
+  let byteLength = 0;
+  let open5 = true;
+  return new ReadableStream({
+    start(controller) {
+      input2.on("data", (chunk) => {
+        if (!open5) {
+          return;
+        }
+        if (!(chunk instanceof Uint8Array)) {
+          open5 = false;
+          controller.error(new Error("ACP adapter produced invalid output"));
+          return;
+        }
+        byteLength += chunk.byteLength;
+        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
+          open5 = false;
+          controller.error(new Error("ACP adapter output limit exceeded"));
+          return;
+        }
+        controller.enqueue(new Uint8Array(chunk));
+      });
+      input2.once("end", () => {
+        if (open5) {
+          open5 = false;
+          controller.close();
+        }
+      });
+      input2.once("error", (error61) => {
+        if (open5) {
+          open5 = false;
+          controller.error(error61);
+        }
+      });
+    },
+    cancel() {
+      open5 = false;
+    }
+  });
+}
+function writableAcpStream(output2) {
+  return new WritableStream({
+    write(chunk) {
+      return new Promise((resolveWrite, rejectWrite) => {
+        output2.write(chunk, (error61) => {
+          if (error61) {
+            rejectWrite(error61);
+            return;
+          }
+          resolveWrite();
+        });
+      });
+    }
+  });
+}
+async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
+  signal.throwIfAborted();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort(new Error("ACP probe timed out"));
+  }, specification.acpProbeTimeoutMilliseconds);
+  const abort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", abort, { once: true });
+  if (signal.aborted) {
+    abort();
+  }
+  const child = spawn2(agent.adapterPath, [...agent.arguments], {
+    cwd: defaultWorkspace,
+    detached: process.platform !== "win32",
+    env: { ...environment, ...agent.environment },
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const processExit = new Promise((_resolve, reject) => {
+    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
+    child.once("error", reject);
+    child.once("exit", rejectExit);
+    if (child.exitCode !== null || child.signalCode !== null) {
+      rejectExit();
+    }
+  });
+  const stdin = child.stdin;
+  const stdout = child.stdout;
+  const stderr = child.stderr;
+  if (stdin === null || stdout === null || stderr === null) {
+    await stopProcessTree(child);
+    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
+  }
+  let stderrBytes = 0;
+  const consumeStderr = (chunk) => {
+    stderrBytes += chunk.byteLength;
+    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
+      controller.abort(new Error("ACP adapter output limit exceeded"));
+    }
+  };
+  stderr.on("data", consumeStderr);
+  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
+    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
+  );
+  try {
+    const initialized = await Promise.race([
+      connection.agent.request(
+        methods4.agent.initialize,
+        {
+          clientCapabilities: {},
+          clientInfo: { name: "mobius", version: "0.0.3" },
+          protocolVersion: PROTOCOL_VERSION
+        },
+        { cancellationSignal: controller.signal }
+      ),
+      processExit
+    ]);
+    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
+      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
+    }
+    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
+    return new VerifiedAcpReadiness(
+      normalizeVersionOutput(initialized.agentInfo?.version ?? ""),
+      normalizeAcpCapabilities(initialized)
+    );
+  } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
+    if (timedOut) {
+      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
+    }
+    if (error61 instanceof AgentProbeError) {
+      throw error61;
+    }
+    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
+      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
+    }
+    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", abort);
+    connection.close();
+    stdin.end();
+    stderr.removeListener("data", consumeStderr);
+    await stopProcessTree(child);
+  }
+}
+
 // src/agent-catalog/executable-discovery.ts
-import { isAbsolute as isAbsolute6, join as join12 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // src/agent-installation/managed-adapter-installer.ts
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var ManagedAdapterInstallError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -2038,7 +2314,7 @@ var ManagedAdapterInstaller = class {
     this.#stateDirectory = options.stateDirectory;
   }
   install = async (specification, signal) => {
-    const root = join11(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
+    const root = join12(this.#stateDirectory, "adapters", specification.id, specification.adapterVersion);
     try {
       return await this.#npmInstaller.install(
         root,
@@ -2072,7 +2348,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
   let managed;
   try {
     managed = await validateManagedAdapter(
-      join12(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
+      join13(readStateDirectory(context.environment), "adapters", specification.id, specification.adapterVersion),
       specification
     );
   } catch {
@@ -2083,7 +2359,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
 async function resolveSpecificationExecutables(executableName, overrideVariable, resolveInstalled, resolveManaged, context) {
   const override = context.environment[overrideVariable];
   if (override !== void 0) {
-    if (override.length === 0 || !isAbsolute6(override)) {
+    if (override.length === 0 || !isAbsolute7(override)) {
       return [];
     }
     const executable = await resolveExecutablePath(override, context.platform);
@@ -2137,10 +2413,7 @@ async function resolveAdapterExecutable(specification, context) {
   const executables = await resolveAdapterExecutables(specification, context);
   return executables[0] ?? null;
 }
-function normalizedVersion(output2) {
-  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
-}
-async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds) {
+async function probeVersion(executable, arguments_, environment, defaultWorkspace, signal, timeoutMilliseconds, normalize4 = normalizeVersionOutput) {
   const result = await runBoundedProcess({
     arguments: arguments_,
     command: executable.path,
@@ -2149,7 +2422,7 @@ async function probeVersion(executable, arguments_, environment, defaultWorkspac
     signal,
     timeoutMilliseconds
   });
-  const version2 = normalizedVersion(result.stdout || result.stderr);
+  const version2 = normalize4(result.stdout || result.stderr);
   if (version2.length === 0) {
     throw new ProcessExecutionError("process_exit_failed", "The executable did not report a version");
   }
@@ -2173,7 +2446,8 @@ async function findVerifiedAgentExecutable(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
       return new VerifiedAgentExecutable(executable, version2);
     } catch {
@@ -2185,168 +2459,6 @@ async function findVerifiedAgentExecutable(specification, context) {
   return null;
 }
 
-// src/agent-catalog/acp-readiness-probe.ts
-var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
-var VerifiedAcpReadiness = class {
-  adapterVersion;
-  capabilities;
-  constructor(adapterVersion, capabilities) {
-    this.adapterVersion = adapterVersion;
-    this.capabilities = capabilities;
-  }
-};
-var DiscoveryAcpHandler = class {
-  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
-  onElicitationComplete = (_notification) => Promise.resolve();
-  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
-  onUpdate = (_notification) => Promise.resolve();
-};
-function readableAcpStream(input2) {
-  let byteLength = 0;
-  let open5 = true;
-  return new ReadableStream({
-    start(controller) {
-      input2.on("data", (chunk) => {
-        if (!open5) {
-          return;
-        }
-        if (!(chunk instanceof Uint8Array)) {
-          open5 = false;
-          controller.error(new Error("ACP adapter produced invalid output"));
-          return;
-        }
-        byteLength += chunk.byteLength;
-        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
-          open5 = false;
-          controller.error(new Error("ACP adapter output limit exceeded"));
-          return;
-        }
-        controller.enqueue(new Uint8Array(chunk));
-      });
-      input2.once("end", () => {
-        if (open5) {
-          open5 = false;
-          controller.close();
-        }
-      });
-      input2.once("error", (error61) => {
-        if (open5) {
-          open5 = false;
-          controller.error(error61);
-        }
-      });
-    },
-    cancel() {
-      open5 = false;
-    }
-  });
-}
-function writableAcpStream(output2) {
-  return new WritableStream({
-    write(chunk) {
-      return new Promise((resolveWrite, rejectWrite) => {
-        output2.write(chunk, (error61) => {
-          if (error61) {
-            rejectWrite(error61);
-            return;
-          }
-          resolveWrite();
-        });
-      });
-    }
-  });
-}
-async function probeAcpReadiness(specification, agent, environment, defaultWorkspace, signal) {
-  signal.throwIfAborted();
-  const controller = new AbortController();
-  let timedOut = false;
-  const timeout = setTimeout(() => {
-    timedOut = true;
-    controller.abort(new Error("ACP probe timed out"));
-  }, specification.acpProbeTimeoutMilliseconds);
-  const abort = () => controller.abort(signal.reason);
-  signal.addEventListener("abort", abort, { once: true });
-  if (signal.aborted) {
-    abort();
-  }
-  const child = spawn2(agent.adapterPath, [...agent.arguments], {
-    cwd: defaultWorkspace,
-    detached: process.platform !== "win32",
-    env: { ...environment, ...agent.environment },
-    shell: false,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  const processExit = new Promise((_resolve, reject) => {
-    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
-    child.once("error", reject);
-    child.once("exit", rejectExit);
-    if (child.exitCode !== null || child.signalCode !== null) {
-      rejectExit();
-    }
-  });
-  const stdin = child.stdin;
-  const stdout = child.stdout;
-  const stderr = child.stderr;
-  if (stdin === null || stdout === null || stderr === null) {
-    await stopProcessTree(child);
-    throw new AgentProbeError("acp_incompatible", "ACP adapter streams are unavailable");
-  }
-  let stderrBytes = 0;
-  const consumeStderr = (chunk) => {
-    stderrBytes += chunk.byteLength;
-    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
-      controller.abort(new Error("ACP adapter output limit exceeded"));
-    }
-  };
-  stderr.on("data", consumeStderr);
-  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
-    ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
-  );
-  try {
-    const initialized = await Promise.race([
-      connection.agent.request(
-        methods4.agent.initialize,
-        {
-          clientCapabilities: {},
-          clientInfo: { name: "mobius", version: "0.0.3" },
-          protocolVersion: PROTOCOL_VERSION
-        },
-        { cancellationSignal: controller.signal }
-      ),
-      processExit
-    ]);
-    if (initialized.protocolVersion !== PROTOCOL_VERSION) {
-      throw new AgentProbeError("acp_incompatible", "ACP adapter selected an unsupported protocol version");
-    }
-    await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
-    return new VerifiedAcpReadiness(
-      normalizedVersion(initialized.agentInfo?.version ?? ""),
-      normalizeAcpCapabilities(initialized)
-    );
-  } catch (error61) {
-    if (signal.aborted) {
-      signal.throwIfAborted();
-    }
-    if (timedOut) {
-      throw new AgentProbeError("adapter_probe_timeout", "ACP adapter probe timed out", { cause: error61 });
-    }
-    if (error61 instanceof AgentProbeError) {
-      throw error61;
-    }
-    if (error61 instanceof RequestError && error61.code === -32e3 && specification.authenticationCommand().length > 0) {
-      throw new AgentProbeError("authentication_required", "Agent authentication is required", { cause: error61 });
-    }
-    throw new AgentProbeError("acp_incompatible", "ACP adapter initialization failed", { cause: error61 });
-  } finally {
-    clearTimeout(timeout);
-    signal.removeEventListener("abort", abort);
-    connection.close();
-    stdin.end();
-    stderr.removeListener("data", consumeStderr);
-    await stopProcessTree(child);
-  }
-}
-
 // src/agent-catalog/discover-agent.ts
 function agentProbeFailure(specification, error61) {
   if (error61 instanceof AgentProbeError) {
@@ -2390,7 +2502,8 @@ async function discoverAgent(specification, context) {
         context.environment,
         context.defaultWorkspace,
         context.signal,
-        specification.versionProbeTimeoutMilliseconds
+        specification.versionProbeTimeoutMilliseconds,
+        specification.normalizeAgentVersion
       );
     } catch (error61) {
       if (context.signal.aborted) {
@@ -2426,7 +2539,8 @@ async function discoverAgent(specification, context) {
             },
             context.defaultWorkspace,
             context.signal,
-            specification.versionProbeTimeoutMilliseconds
+            specification.versionProbeTimeoutMilliseconds,
+            specification.normalizeAdapterVersion
           );
         }
       } catch (error61) {
@@ -2549,7 +2663,7 @@ var AuditStore = class {
 };
 
 // src/config.ts
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21419,6 +21533,28 @@ function date4(params) {
 
 // ../protocol/src/prompt-usage.ts
 var TOKEN_COUNT = external_exports.number().int().nonnegative();
+function normalizeQuotaTokenCount(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return value;
+  }
+  if (Reflect.has(value, "inputTokens") || Reflect.has(value, "outputTokens") || Reflect.has(value, "totalTokens")) {
+    return value;
+  }
+  if (!Reflect.has(value, "input_tokens") && !Reflect.has(value, "output_tokens")) {
+    return value;
+  }
+  const inputTokens = Reflect.get(value, "input_tokens");
+  const outputTokens = Reflect.get(value, "output_tokens");
+  const reportedTotal = Reflect.get(value, "total_tokens");
+  return {
+    cachedInputTokens: Reflect.get(value, "cached_input_tokens"),
+    cachedWriteTokens: Reflect.get(value, "cached_write_tokens"),
+    inputTokens,
+    outputTokens,
+    reasoningOutputTokens: Reflect.get(value, "reasoning_output_tokens"),
+    totalTokens: reportedTotal === void 0 && typeof inputTokens === "number" && typeof outputTokens === "number" ? inputTokens + outputTokens : reportedTotal
+  };
+}
 var promptUsageSchema = external_exports.object({
   cachedReadTokens: TOKEN_COUNT.nullish(),
   cachedWriteTokens: TOKEN_COUNT.nullish(),
@@ -21427,14 +21563,17 @@ var promptUsageSchema = external_exports.object({
   thoughtTokens: TOKEN_COUNT.nullish(),
   totalTokens: TOKEN_COUNT
 }).readonly();
-var quotaTokenCountSchema = external_exports.object({
-  cachedInputTokens: TOKEN_COUNT,
-  cachedWriteTokens: TOKEN_COUNT.optional(),
-  inputTokens: TOKEN_COUNT,
-  outputTokens: TOKEN_COUNT,
-  reasoningOutputTokens: TOKEN_COUNT,
-  totalTokens: TOKEN_COUNT
-}).readonly();
+var quotaTokenCountSchema = external_exports.preprocess(
+  normalizeQuotaTokenCount,
+  external_exports.object({
+    cachedInputTokens: TOKEN_COUNT.optional(),
+    cachedWriteTokens: TOKEN_COUNT.optional(),
+    inputTokens: TOKEN_COUNT,
+    outputTokens: TOKEN_COUNT,
+    reasoningOutputTokens: TOKEN_COUNT.optional(),
+    totalTokens: TOKEN_COUNT
+  }).readonly()
+);
 var promptMetadataSchema = external_exports.object({
   quota: external_exports.object({
     model_usage: external_exports.array(
@@ -23062,7 +23201,7 @@ var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSc
 // src/config.ts
 function loadDefaultWorkspace(environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join13(readStateDirectory(environment), "workspace");
+  return configuredWorkspace ?? join14(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23079,7 +23218,7 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { basename as basename4, join as join15 } from "node:path";
+import { basename as basename4, join as join16 } from "node:path";
 import { styleText } from "node:util";
 import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
 
@@ -23094,7 +23233,7 @@ import {
 
 // src/authorization/local-raster.ts
 import { readFile, realpath as realpath6, stat as stat5 } from "node:fs/promises";
-import { basename, isAbsolute as isAbsolute7, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
+import { basename, isAbsolute as isAbsolute8, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var MAX_LOCAL_RASTER_BYTES = 3e6;
 var PNG_SIGNATURE = Uint8Array.of(137, 80, 78, 71);
@@ -23137,17 +23276,17 @@ function sniffRasterMime(bytes) {
 }
 function isInsideRoot(root, target) {
   const relation = relative4(root, target);
-  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute7(relation);
+  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute8(relation);
 }
 async function resolveCanonicalPath(requested, signal) {
   signal.throwIfAborted();
-  if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+  if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
     return null;
   }
   try {
     const target = await realpath6(requested);
     signal.throwIfAborted();
-    if (!isAbsolute7(target) || normalize2(target) !== target) {
+    if (!isAbsolute8(target) || normalize2(target) !== target) {
       return null;
     }
     return target;
@@ -27677,7 +27816,7 @@ var LocalAuthorizationError = class extends Error {
 // src/authorization/workspace-directory.ts
 import { readdir, realpath as realpath7, stat as stat6 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute8, join as join14, normalize as normalize3, relative as relative5 } from "node:path";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, normalize as normalize3, relative as relative5 } from "node:path";
 var WorkspaceDirectoryListing = class {
   directoryId;
   directoryLabel;
@@ -27729,7 +27868,7 @@ var WorkspaceDirectoryService = class {
     }
     if (id.startsWith("path-")) {
       const path2 = decodePath(id, "path-");
-      if (isAbsolute8(path2)) {
+      if (isAbsolute9(path2)) {
         return path2;
       }
     }
@@ -27737,7 +27876,7 @@ var WorkspaceDirectoryService = class {
   };
   resolvePath = async (requested, signal) => {
     signal.throwIfAborted();
-    if (!isAbsolute8(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
+    if (!isAbsolute9(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
       throw new LocalAuthorizationError("The local directory path is invalid");
     }
     try {
@@ -27745,7 +27884,7 @@ var WorkspaceDirectoryService = class {
       signal.throwIfAborted();
       const metadata = await stat6(target);
       signal.throwIfAborted();
-      if (!isAbsolute8(target) || normalize3(target) !== target || !metadata.isDirectory()) {
+      if (!isAbsolute9(target) || normalize3(target) !== target || !metadata.isDirectory()) {
         throw new LocalAuthorizationError("The selected location is not a directory");
       }
       return target;
@@ -27761,7 +27900,7 @@ var WorkspaceDirectoryService = class {
   };
   label = (path2) => {
     const suffix = relative5(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+    return suffix === "" ? "~" : !isAbsolute9(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
   };
   identify = async (bindingId, requestedPath, signal) => {
     this.authorizeMachine(bindingId);
@@ -27791,7 +27930,7 @@ var WorkspaceDirectoryService = class {
           continue;
         }
         try {
-          const path2 = await this.resolvePath(join14(target, child.name), signal);
+          const path2 = await this.resolvePath(join15(target, child.name), signal);
           entries.push({ directoryId: encodePath(path2), name: child.name });
         } catch (cause) {
           signal.throwIfAborted();
@@ -27830,6 +27969,18 @@ import { createHash as createHash3, randomUUID } from "node:crypto";
 import { stat as stat7 } from "node:fs/promises";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
+var identifier2 = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var savedApprovalSchema = external_exports.object({
+  local_grant_id: identifier2,
+  bot_id: identifier2,
+  binding_id: identifier2,
+  binding_revision: external_exports.number().int().positive(),
+  agent_ref: identifier2,
+  workspace_ref: external_exports.string().min(1).max(2048),
+  revocation_epoch: external_exports.number().int().nonnegative(),
+  agent_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  workspace_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/)
+}).readonly();
 var LocalBotAuthorizationError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -27934,6 +28085,17 @@ function parseTargets(encoded) {
 }
 var LocalBotGrantStore = class {
   #database;
+  static containsBot = (path2, botId) => {
+    const database = new DatabaseSync3(path2, { readOnly: true });
+    try {
+      if (database.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'local_bot_grants'").get() === void 0) {
+        return false;
+      }
+      return database.prepare("SELECT local_grant_id FROM local_bot_grants WHERE bot_id = ? LIMIT 1").get(botId) !== void 0;
+    } finally {
+      database.close();
+    }
+  };
   constructor(path2) {
     this.#database = new DatabaseSync3(path2);
     this.#database.exec(`
@@ -27967,6 +28129,78 @@ var LocalBotGrantStore = class {
           ) STRICT;
         `);
   }
+  /** Only the local CLI may invoke this explicit approval transition. */
+  reapprove = async (botId, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    if (!identifier2.safeParse(botId).success) {
+      throw new LocalBotAuthorizationError("invalid_request", "The Bot ID is invalid");
+    }
+    const row = this.#database.prepare("SELECT * FROM local_bot_grants WHERE bot_id = ? ORDER BY binding_revision DESC LIMIT 1").get(botId);
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError("bot_not_found", "This machine has no saved approval for that Bot");
+    }
+    const parsed = savedApprovalSchema.safeParse(row);
+    if (!parsed.success) {
+      throw new LocalBotAuthorizationError("local_grant_invalid", "The saved Bot approval is invalid", {
+        cause: parsed.error
+      });
+    }
+    const saved = parsed.data;
+    const agent = catalog.find(saved.agent_ref);
+    if (!agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError("binding_incompatible", "The local Agent cannot apply Bot context");
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, saved.workspace_ref, signal);
+    const workspaceIdentityDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = this.#database.prepare(`UPDATE local_bot_grants
+                SET agent_identity_digest = ?, workspace_identity_digest = ?, workspace_path = ?,
+                    revoked_at = NULL, expires_at = ?, revocation_epoch = revocation_epoch + 1
+                WHERE local_grant_id = ? AND revocation_epoch = ?
+                    AND agent_identity_digest = ? AND workspace_identity_digest = ?
+                    AND binding_revision = (SELECT MAX(binding_revision) FROM local_bot_grants WHERE bot_id = ?)`).run(
+        agentDigest(agent),
+        workspaceIdentityDigest,
+        workspacePath,
+        now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS,
+        saved.local_grant_id,
+        saved.revocation_epoch,
+        saved.agent_identity_digest,
+        saved.workspace_identity_digest,
+        botId
+      );
+      if (result.changes !== 1) {
+        throw new LocalBotAuthorizationError(
+          "binding_not_approved",
+          "The Bot binding changed during approval; run the command again"
+        );
+      }
+      this.#database.prepare(`INSERT INTO audit_events (recorded_at, event, command_id, session_id, details_json)
+                VALUES (?, 'bot_binding_locally_reapproved', ?, '', ?)`).run(
+        new Date(now).toISOString(),
+        saved.binding_id,
+        JSON.stringify({ botId, bindingId: saved.binding_id, agentRef: saved.agent_ref })
+      );
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    return { bindingId: saved.binding_id, workspacePath, agentRef: saved.agent_ref };
+  };
   approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
     signal.throwIfAborted();
     const existing = this.#database.prepare(
@@ -28302,7 +28536,7 @@ var BotExecutionContextRegistry = class {
 // src/bots/bot-outbound-ipc.ts
 import { chmod as chmod2, mkdir as mkdir3, unlink } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname6, isAbsolute as isAbsolute9 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute10 } from "node:path";
 import { fetch as fetch4 } from "undici";
 var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
 var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
@@ -28400,7 +28634,7 @@ var BotOutboundIpcServer = class {
   #usesFilesystemSocket;
   constructor(socketPath, relayUrl, registry2) {
     const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
-    if (usesFilesystemSocket && !isAbsolute9(socketPath)) {
+    if (usesFilesystemSocket && !isAbsolute10(socketPath)) {
       throw new Error("The Bot IPC path must be absolute");
     }
     this.#registry = registry2;
@@ -30340,7 +30574,7 @@ function botIpcSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\mobius-bot-${randomUUID4()}`;
   }
-  return join15("/tmp", `mobius-bot-${randomUUID4()}.sock`);
+  return join16("/tmp", `mobius-bot-${randomUUID4()}.sock`);
 }
 var DaemonAcpObserver = class {
   #config;
@@ -31010,7 +31244,7 @@ async function executeSessionConfigure(publisher, socket, command, config2, dire
     reportOperationFailure(socket, command.requestId, command.sessionId, error61);
   }
 }
-async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, timer, signal) {
+async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -31039,6 +31273,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       }),
       attemptId
     );
+    activateAttempt();
     const attachments = await resolvePromptArtifacts(config2, command, signal);
     let stopReason;
     if (command.disposition === SessionPromptDisposition.Steer) {
@@ -31150,7 +31385,7 @@ function botExecutionAgent(agent, contextHandle, socketPath) {
     agent.capabilities
   );
 }
-async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, timer, signal) {
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -31231,6 +31466,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         }),
         attemptId
       );
+      activateAttempt();
       const result = await sessions.runPrompt({
         additionalDirectories: resolved.additionalDirectories,
         agent,
@@ -31424,11 +31660,13 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         }
         const turn = new ActiveDaemonTurn(command, receipt.attemptId);
         activeTurns.set(command.commandId, turn);
-        if (trackActiveAttempt) {
-          activeAttemptIds.set(command.sessionId, receipt.attemptId);
-        }
+        const activateAttempt = () => {
+          if (trackActiveAttempt) {
+            activeAttemptIds.set(command.sessionId, receipt.attemptId);
+          }
+        };
         try {
-          await execute(receipt.attemptId, turn.signal);
+          await execute(receipt.attemptId, activateAttempt, turn.signal);
         } finally {
           activeTurns.delete(command.commandId);
           if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
@@ -31513,7 +31751,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             true,
-            (attemptId, executionSignal) => executeBotPrompt(
+            (attemptId, activateAttempt, executionSignal) => executeBotPrompt(
               outbox,
               publisher,
               command,
@@ -31526,6 +31764,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -31538,7 +31777,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             command.disposition !== SessionPromptDisposition.Steer,
-            (attemptId, executionSignal) => executePrompt(
+            (attemptId, activateAttempt, executionSignal) => executePrompt(
               outbox,
               publisher,
               command,
@@ -31547,6 +31786,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               audit,
               sessions,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -32048,7 +32288,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             }
             const turn2 = new ActiveDaemonTurn(command2, receipt2.attemptId);
             activeTurns.set(command2.commandId, turn2);
-            activeAttemptIds.set(command2.sessionId, receipt2.attemptId);
             void executeBotPrompt(
               outbox,
               publisher,
@@ -32062,6 +32301,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               receipt2.attemptId,
+              () => activeAttemptIds.set(command2.sessionId, receipt2.attemptId),
               timer,
               turn2.signal
             ).catch((error61) => {
@@ -32088,9 +32328,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           }
           const turn = new ActiveDaemonTurn(command, receipt.attemptId);
           activeTurns.set(command.commandId, turn);
-          if (command.disposition !== SessionPromptDisposition.Steer) {
-            activeAttemptIds.set(command.sessionId, receipt.attemptId);
-          }
           void executePrompt(
             outbox,
             publisher,
@@ -32100,6 +32337,11 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             audit,
             sessions,
             receipt.attemptId,
+            () => {
+              if (command.disposition !== SessionPromptDisposition.Steer) {
+                activeAttemptIds.set(command.sessionId, receipt.attemptId);
+              }
+            },
             timer,
             turn.signal
           ).catch((error61) => {
@@ -32288,7 +32530,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { mkdir as mkdir4, open as open4, realpath as realpath8, rename as rename3, stat as stat8, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename5, join as join16, resolve as resolve4 } from "node:path";
+import { basename as basename5, join as join17, resolve as resolve4 } from "node:path";
 import { fetch as fetch7 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
@@ -32443,10 +32685,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
 async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
-  const connectionsDirectory = join16(readStateDirectory(environment), "connections");
+  const connectionsDirectory = join17(readStateDirectory(environment), "connections");
   await mkdir4(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join16(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join16(connectionsDirectory, `.${channelId}.${randomUUID5()}.tmp`);
+  const connectionPath = join17(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join17(connectionsDirectory, `.${channelId}.${randomUUID5()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
@@ -32484,7 +32726,7 @@ function decodeSavedConnection(value, expectedChannelId) {
   };
 }
 async function readSavedConnection(channelId, environment) {
-  const connectionPath = join16(readStateDirectory(environment), "connections", `${channelId}.json`);
+  const connectionPath = join17(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -32520,7 +32762,7 @@ function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
   relayUrl.searchParams.set("token", connection.runtimeCredential);
-  const auditDatabasePath = join16(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
+  const auditDatabasePath = join17(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -32579,7 +32821,7 @@ async function pairMobiusRuntime(options, signal, environment = process.env) {
 }
 async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
   const normalizedChannelId = validatePairingId(channelId);
-  const connectionPath = join16(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connectionPath = join17(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
   const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
@@ -32654,7 +32896,7 @@ function loadMobiusRuntimeConnection(environment = process.env) {
     throw new MobiusRuntimeConfigurationError("MOBIUS_CHANNEL_ID is invalid");
   }
   return Object.freeze({
-    auditDatabasePath: environment["MOBIUS_AUDIT_DATABASE"]?.trim() || join17(readStateDirectory(environment), "audit", `${channelId}.sqlite`),
+    auditDatabasePath: environment["MOBIUS_AUDIT_DATABASE"]?.trim() || join18(readStateDirectory(environment), "audit", `${channelId}.sqlite`),
     channelId,
     defaultWorkspace: loadDefaultWorkspace(environment),
     relayUrl: requiredEnvironmentValue(environment, "MOBIUS_RELAY_URL"),