@moxt-ai/mobius 0.0.29 → 0.0.31

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.29",
+  version: "0.0.31",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -2743,166 +2743,9 @@ async function discoverLocalAgentInventory(options) {
   return new LocalAgentInventory(discoveries);
 }
 
-// src/bots/bot-message-command.ts
-import { randomUUID } from "node:crypto";
-import { createConnection } from "node:net";
-var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
-var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
-var BotMessageCommandError = class extends Error {
-  code;
-  constructor(code, message, options = {}) {
-    super(message, options);
-    this.code = code;
-    this.name = "BotMessageCommandError";
-  }
-};
-function isRecord4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function requiredEnvironment(environment, name) {
-  const value = environment[name]?.trim();
-  if (value === void 0 || value.length === 0) {
-    throw new BotMessageCommandError(
-      "execution_context_required",
-      "This command is available only inside an active Mobius Bot execution"
-    );
-  }
-  return value;
-}
-function option(arguments_, name) {
-  const index = arguments_.indexOf(name);
-  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-  const value = arguments_[index + 1];
-  if (value === void 0) {
-    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
-  }
-  return value;
-}
-function validateArguments(arguments_) {
-  if (arguments_.length !== 4) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-  const names = [arguments_[0], arguments_[2]];
-  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
-    throw new BotMessageCommandError(
-      "invalid_request",
-      "Usage: mobius bot message send --target <current|alias> --text <message>"
-    );
-  }
-}
-function decodeResponse(encoded) {
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch (cause) {
-    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
-      cause
-    });
-  }
-  if (!isRecord4(value) || typeof value["ok"] !== "boolean") {
-    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
-  }
-  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
-    return value["outboundMessageId"];
-  }
-  const error61 = value["error"];
-  if (value["ok"] === false && isRecord4(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
-    throw new BotMessageCommandError(error61["code"], error61["message"]);
-  }
-  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
-}
-async function requestLocalBotService(socketPath, payload, signal) {
-  signal.throwIfAborted();
-  return await new Promise((resolve5, reject) => {
-    const socket = createConnection(socketPath);
-    const chunks = [];
-    let length = 0;
-    let finished = false;
-    const finish = () => {
-      socket.removeAllListeners();
-      socket.destroy();
-    };
-    const fail = (error61) => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      finish();
-      if (error61 instanceof BotMessageCommandError) {
-        reject(error61);
-        return;
-      }
-      reject(
-        new BotMessageCommandError(
-          "execution_context_required",
-          "The active Mobius Bot execution is unavailable",
-          { cause: error61 }
-        )
-      );
-    };
-    const abort = () => fail(signal.reason);
-    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
-      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
-    });
-    socket.once("error", fail);
-    socket.once("connect", () => socket.end(`${payload}
-`));
-    socket.on("data", (chunk) => {
-      length += chunk.byteLength;
-      if (length > BOT_IPC_RESPONSE_LIMIT) {
-        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    socket.once("end", () => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      signal.removeEventListener("abort", abort);
-      try {
-        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
-      } catch (error61) {
-        reject(error61);
-      } finally {
-        finish();
-      }
-    });
-    signal.addEventListener("abort", abort, { once: true });
-  });
-}
-async function executeBotMessageCommand(arguments_, environment, signal) {
-  validateArguments(arguments_);
-  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
-  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
-  const target = option(arguments_, "--target");
-  const text = option(arguments_, "--text");
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
-    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
-  }
-  return await requestLocalBotService(
-    socketPath,
-    JSON.stringify({
-      contextHandle,
-      idempotencyKey: `cli_${randomUUID()}`,
-      target,
-      text
-    }),
-    signal
-  );
-}
-
-// src/config.ts
-import { join as join14 } from "node:path";
+// src/bots/bot-approve-command.ts
+import { readdir as readdir2, realpath as realpath8 } from "node:fs/promises";
+import { dirname as dirname4, join as join17 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21770,6 +21613,174 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// src/authorization/workspace-directory.ts
+import { readdir, realpath as realpath6, stat as stat5 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute8, join as join14, normalize as normalize2, relative as relative4 } from "node:path";
+
+// src/authorization/local-authorization-error.ts
+var LocalAuthorizationError = class extends Error {
+  code = "local_authorization_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalAuthorizationError";
+  }
+};
+
+// src/authorization/workspace-directory.ts
+var WorkspaceDirectoryListing = class {
+  directoryId;
+  directoryLabel;
+  entries;
+  parentDirectoryId;
+  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
+    this.directoryId = directoryId2;
+    this.directoryLabel = directoryLabel;
+    this.entries = entries;
+    this.parentDirectoryId = parentDirectoryId;
+  }
+};
+function encodePath(path2) {
+  const encoded = Buffer.from(path2, "utf8").toString("base64url");
+  if (encoded.length === 0 || encoded.length > 2e3) {
+    throw new LocalAuthorizationError("The local directory path is too long to select");
+  }
+  return `path-${encoded}`;
+}
+function decodePath(value, prefix) {
+  const encoded = value.slice(prefix.length);
+  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
+  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize2(decoded) !== decoded) {
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  }
+  return decoded;
+}
+var WorkspaceDirectoryService = class {
+  #bindingId;
+  #defaultWorkspace;
+  constructor(bindingId, defaultWorkspace) {
+    this.#bindingId = bindingId;
+    this.#defaultWorkspace = defaultWorkspace;
+  }
+  authorizeMachine = (bindingId) => {
+    if (bindingId !== this.#bindingId) {
+      throw new LocalAuthorizationError("The runtime binding is not authorized");
+    }
+  };
+  requestedPath = (id) => {
+    if (id === "default") {
+      return this.#defaultWorkspace;
+    }
+    if (id === "home") {
+      return homedir2();
+    }
+    if (id.startsWith("path-")) {
+      const path2 = decodePath(id, "path-");
+      if (isAbsolute8(path2)) {
+        return path2;
+      }
+    }
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  };
+  resolvePath = async (requested, signal) => {
+    signal.throwIfAborted();
+    if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+      throw new LocalAuthorizationError("The local directory path is invalid");
+    }
+    try {
+      const target = await realpath6(requested);
+      signal.throwIfAborted();
+      const metadata = await stat5(target);
+      signal.throwIfAborted();
+      if (!isAbsolute8(target) || normalize2(target) !== target || !metadata.isDirectory()) {
+        throw new LocalAuthorizationError("The selected location is not a directory");
+      }
+      return target;
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) {
+        throw cause;
+      }
+      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
+        cause
+      });
+    }
+  };
+  label = (path2) => {
+    const suffix = relative4(homedir2(), path2);
+    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+  };
+  identify = async (bindingId, requestedPath, signal) => {
+    this.authorizeMachine(bindingId);
+    const path2 = await this.resolvePath(requestedPath, signal);
+    return {
+      path: path2,
+      directoryId: encodePath(path2),
+      name: basename(path2) || path2,
+      label: this.label(path2)
+    };
+  };
+  resolve = async (bindingId, id, signal) => {
+    this.authorizeMachine(bindingId);
+    return await this.resolvePath(this.requestedPath(id), signal);
+  };
+  list = async (bindingId, id, signal) => {
+    const target = await this.resolve(bindingId, id, signal);
+    try {
+      const children = await readdir(target, { withFileTypes: true });
+      signal.throwIfAborted();
+      const entries = [];
+      for (const child of children) {
+        if (entries.length === 500) {
+          break;
+        }
+        if (child.isFile() || child.isBlockDevice() || child.isCharacterDevice() || child.isFIFO() || child.isSocket()) {
+          continue;
+        }
+        try {
+          const path2 = await this.resolvePath(join14(target, child.name), signal);
+          entries.push({ directoryId: encodePath(path2), name: child.name });
+        } catch (cause) {
+          signal.throwIfAborted();
+          if (!(cause instanceof LocalAuthorizationError)) {
+            throw cause;
+          }
+        }
+      }
+      entries.sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname3(target);
+      return new WorkspaceDirectoryListing(
+        id,
+        this.label(target),
+        entries,
+        parent === target ? "" : encodePath(parent)
+      );
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) {
+        throw cause;
+      }
+      throw new LocalAuthorizationError("This directory cannot be browsed by your user account", { cause });
+    }
+  };
+  resolveMany = async (bindingId, ids, signal) => {
+    const paths = /* @__PURE__ */ new Set();
+    for (const id of ids) {
+      paths.add(await this.resolve(bindingId, id, signal));
+    }
+    return [...paths];
+  };
+};
+
+// src/pairing/pair-local-machine.ts
+import { randomUUID } from "node:crypto";
+import { mkdir as mkdir3, open as open4, realpath as realpath7, rename as rename3, stat as stat6, writeFile as writeFile2 } from "node:fs/promises";
+import { hostname as hostname3 } from "node:os";
+import { basename as basename2, join as join16, resolve as resolve3 } from "node:path";
+
 // ../protocol/src/prompt-usage.ts
 var TOKEN_COUNT = external_exports.number().int().nonnegative();
 function normalizeQuotaTokenCount(value) {
@@ -22284,7 +22295,7 @@ var ProtocolMessageError = class extends Error {
     this.name = "ProtocolMessageError";
   }
 };
-function isRecord5(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson2(encoded) {
@@ -22296,7 +22307,7 @@ function parseJson2(encoded) {
       cause: error61
     });
   }
-  if (!isRecord5(value)) {
+  if (!isRecord4(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22393,7 +22404,7 @@ function readActivityContent(value) {
 }
 function readActivityDetail(value) {
   const field = value["detail"];
-  if (!isRecord5(field)) {
+  if (!isRecord4(field)) {
     throw new ProtocolMessageError("Invalid activity detail field");
   }
   const kind = readString(field, "kind", 32);
@@ -22857,7 +22868,7 @@ var BotSessionPromptCommand = class {
     this.replyRoute = replyRoute;
   }
 };
-function isRecord6(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson3(encoded) {
@@ -22867,7 +22878,7 @@ function parseJson3(encoded) {
   } catch (cause) {
     throw new ProtocolMessageError("Message is not valid JSON", { cause });
   }
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22952,7 +22963,7 @@ function readTargets(value, key) {
   const identifiers = /* @__PURE__ */ new Set();
   const aliases = /* @__PURE__ */ new Set();
   for (const candidate of field) {
-    if (!isRecord6(candidate)) {
+    if (!isRecord5(candidate)) {
       throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
     }
     assertExactKeys2(candidate, ["alias", "deliveryTargetId"]);
@@ -22968,7 +22979,7 @@ function readTargets(value, key) {
   return Object.freeze(targets);
 }
 function readCompletionPolicy(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Invalid Bot completion policy");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -22986,7 +22997,7 @@ function readCompletionPolicy(value) {
   throw new ProtocolMessageError("Invalid Bot completion policy");
 }
 function readReplyRoute(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Invalid Bot reply route");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -23437,10 +23448,14 @@ var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSche
 var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
 var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
 
+// src/pairing/pair-local-machine.ts
+import { fetch as fetch2 } from "undici";
+
 // src/config.ts
+import { join as join15 } from "node:path";
 function loadDefaultWorkspace(environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join14(readStateDirectory(environment), "workspace");
+  return configuredWorkspace ?? join15(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23456,11 +23471,6 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 }
 
 // src/pairing/pair-local-machine.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir3, open as open4, realpath as realpath6, rename as rename3, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
-import { hostname as hostname3 } from "node:os";
-import { basename, join as join15, resolve as resolve3 } from "node:path";
-import { fetch as fetch2 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
 var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
@@ -23478,7 +23488,7 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord7(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -23571,8 +23581,8 @@ async function resolveDefaultWorkspace(path2) {
   const requestedWorkspace = resolve3(path2);
   try {
     await mkdir3(requestedWorkspace, { recursive: true, mode: 448 });
-    const defaultWorkspace = await realpath6(requestedWorkspace);
-    const metadata = await stat5(defaultWorkspace);
+    const defaultWorkspace = await realpath7(requestedWorkspace);
+    const metadata = await stat6(defaultWorkspace);
     if (!metadata.isDirectory()) {
       throw new PairingClientError("invalid_workspace", "The default workspace is not a directory");
     }
@@ -23601,9 +23611,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord7(value)) {
+  if (isRecord6(value)) {
     const error61 = value["error"];
-    if (isRecord7(error61)) {
+    if (isRecord6(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -23614,7 +23624,7 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodePairingResponse(value, credentialField, expectedKeys) {
-  if (!isRecord7(value) || !hasExactKeys(value, expectedKeys)) {
+  if (!isRecord6(value) || !hasExactKeys(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
@@ -23642,7 +23652,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
         installableAgents,
         machineName: hostname3(),
         pairingCode: options.code,
-        workspaceName: basename(defaultWorkspace) || "Local workspace"
+        workspaceName: basename2(defaultWorkspace) || "Local workspace"
       }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -23659,10 +23669,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
 async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
-  const connectionsDirectory = join15(readStateDirectory(environment), "connections");
+  const connectionsDirectory = join16(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join15(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join15(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
+  const connectionPath = join16(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join16(connectionsDirectory, `.${channelId}.${randomUUID()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
@@ -23682,7 +23692,7 @@ async function persistConnection(channelId, relayOrigin, runtimeCredential2, def
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
+  if (!isRecord6(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
@@ -23700,7 +23710,7 @@ function decodeSavedConnection(value, expectedChannelId) {
   };
 }
 async function readSavedConnection(channelId, environment) {
-  const connectionPath = join15(readStateDirectory(environment), "connections", `${channelId}.json`);
+  const connectionPath = join16(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -23736,7 +23746,7 @@ function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
   relayUrl.searchParams.set("token", connection.runtimeCredential);
-  const auditDatabasePath = join15(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
+  const auditDatabasePath = join16(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -23786,7 +23796,7 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
 }
 async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
   const normalizedChannelId = validatePairingId(channelId);
-  const connectionPath = join15(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connectionPath = join16(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
   const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
@@ -23799,15 +23809,714 @@ async function resumeLocalMachine(arguments_, signal = new AbortController().sig
   return await resumeMobiusRuntime(parseChannelArgument(arguments_), signal, process.env);
 }
 
+// src/bots/local-bot-grant-store.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { stat as stat7 } from "node:fs/promises";
+import { DatabaseSync } from "node:sqlite";
+var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
+var identifier2 = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var savedApprovalSchema = external_exports.object({
+  local_grant_id: identifier2,
+  bot_id: identifier2,
+  binding_id: identifier2,
+  binding_revision: external_exports.number().int().positive(),
+  agent_ref: identifier2,
+  workspace_ref: external_exports.string().min(1).max(2048),
+  revocation_epoch: external_exports.number().int().nonnegative(),
+  agent_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  workspace_identity_digest: external_exports.string().regex(/^[a-f0-9]{64}$/)
+}).readonly();
+var LocalBotAuthorizationError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "LocalBotAuthorizationError";
+  }
+};
+var LocalBotGrant = class {
+  agent;
+  agentIdentityDigest;
+  allowedDeliveryTargetIds;
+  behaviorDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  expiresAt;
+  localGrantId;
+  revocationEpoch;
+  workspaceIdentityDigest;
+  workspacePath;
+  workspaceRef;
+  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspaceRef, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
+    this.localGrantId = localGrantId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.behaviorDigest = behaviorDigest;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.agent = agent;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspaceRef = workspaceRef;
+    this.workspacePath = workspacePath;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
+    this.expiresAt = expiresAt;
+    this.revocationEpoch = revocationEpoch;
+  }
+};
+function digest(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+function agentDigest(agent) {
+  return digest(
+    JSON.stringify({
+      adapter: agent.adapterIdentity,
+      agent: agent.agentIdentity,
+      agentVersion: agent.agentVersion,
+      arguments: agent.arguments,
+      id: agent.id
+    })
+  );
+}
+async function workspaceDigest(path2) {
+  const metadata = await stat7(path2);
+  if (!metadata.isDirectory()) {
+    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
+  }
+  return digest(
+    JSON.stringify({
+      changedAtMilliseconds: metadata.ctimeMs,
+      device: metadata.dev,
+      inode: metadata.ino,
+      path: path2
+    })
+  );
+}
+function exactTargets(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  const expected = [...left].sort();
+  const actual = [...right].sort();
+  return expected.every((target, index) => target === actual[index]);
+}
+function rowString(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "string") {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function rowInteger(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function parseTargets(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
+  }
+  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value.filter((target) => typeof target === "string");
+}
+var LocalBotGrantStore = class {
+  #database;
+  static containsBot = (path2, botId) => {
+    const database = new DatabaseSync(path2, { readOnly: true });
+    try {
+      if (database.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'local_bot_grants'").get() === void 0) {
+        return false;
+      }
+      return database.prepare("SELECT local_grant_id FROM local_bot_grants WHERE bot_id = ? LIMIT 1").get(botId) !== void 0;
+    } finally {
+      database.close();
+    }
+  };
+  constructor(path2) {
+    this.#database = new DatabaseSync(path2);
+    this.#database.exec(`
+          CREATE TABLE IF NOT EXISTS local_bot_grants (
+            local_grant_id TEXT PRIMARY KEY,
+            bot_id TEXT NOT NULL,
+            behavior_revision_id TEXT NOT NULL,
+            behavior_digest TEXT NOT NULL,
+            binding_id TEXT NOT NULL UNIQUE,
+            binding_revision INTEGER NOT NULL,
+            agent_ref TEXT NOT NULL,
+            agent_identity_digest TEXT NOT NULL,
+            workspace_ref TEXT NOT NULL,
+            workspace_path TEXT NOT NULL,
+            workspace_identity_digest TEXT NOT NULL,
+            allowed_delivery_target_ids_json TEXT NOT NULL,
+            unattended_policy_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            revocation_epoch INTEGER NOT NULL DEFAULT 0,
+            revoked_at INTEGER
+          ) STRICT;
+          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
+            request_id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            local_grant_id TEXT NOT NULL,
+            resolved_at INTEGER NOT NULL,
+            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
+            error_code TEXT,
+            error_message TEXT
+          ) STRICT;
+        `);
+  }
+  /** Only the local CLI may invoke this explicit approval transition. */
+  reapprove = async (botId, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    if (!identifier2.safeParse(botId).success) {
+      throw new LocalBotAuthorizationError("invalid_request", "The Bot ID is invalid");
+    }
+    const row = this.#database.prepare("SELECT * FROM local_bot_grants WHERE bot_id = ? ORDER BY binding_revision DESC LIMIT 1").get(botId);
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError("bot_not_found", "This machine has no saved approval for that Bot");
+    }
+    const parsed = savedApprovalSchema.safeParse(row);
+    if (!parsed.success) {
+      throw new LocalBotAuthorizationError("local_grant_invalid", "The saved Bot approval is invalid", {
+        cause: parsed.error
+      });
+    }
+    const saved = parsed.data;
+    const agent = catalog.find(saved.agent_ref);
+    if (!agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError("binding_incompatible", "The local Agent cannot apply Bot context");
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, saved.workspace_ref, signal);
+    const workspaceIdentityDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = this.#database.prepare(`UPDATE local_bot_grants
+                SET agent_identity_digest = ?, workspace_identity_digest = ?, workspace_path = ?,
+                    revoked_at = NULL, expires_at = ?, revocation_epoch = revocation_epoch + 1
+                WHERE local_grant_id = ? AND revocation_epoch = ?
+                    AND agent_identity_digest = ? AND workspace_identity_digest = ?
+                    AND binding_revision = (SELECT MAX(binding_revision) FROM local_bot_grants WHERE bot_id = ?)`).run(
+        agentDigest(agent),
+        workspaceIdentityDigest,
+        workspacePath,
+        now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS,
+        saved.local_grant_id,
+        saved.revocation_epoch,
+        saved.agent_identity_digest,
+        saved.workspace_identity_digest,
+        botId
+      );
+      if (result.changes !== 1) {
+        throw new LocalBotAuthorizationError(
+          "binding_not_approved",
+          "The Bot binding changed during approval; run the command again"
+        );
+      }
+      this.#database.prepare(`INSERT INTO audit_events (recorded_at, event, command_id, session_id, details_json)
+                VALUES (?, 'bot_binding_locally_reapproved', ?, '', ?)`).run(
+        new Date(now).toISOString(),
+        saved.binding_id,
+        JSON.stringify({ botId, bindingId: saved.binding_id, agentRef: saved.agent_ref })
+      );
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    return { bindingId: saved.binding_id, workspacePath, agentRef: saved.agent_ref };
+  };
+  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const existing = this.#database.prepare(
+      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
+                   INNER JOIN local_bot_grants AS grants
+                     ON grants.local_grant_id = resolutions.local_grant_id
+                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
+                    AND resolutions.result = 'approved'`
+    ).get(request.requestId, request.bindingId);
+    if (existing !== void 0) {
+      return new BotExecutionBindingApprovedEvent(
+        request.requestId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.bindingId,
+        request.bindingRevision,
+        rowString(existing, "local_grant_id"),
+        rowString(existing, "agent_identity_digest"),
+        rowString(existing, "workspace_identity_digest")
+      );
+    }
+    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
+    const localGrantId = `lbg_${randomUUID2()}`;
+    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#database.prepare(
+        `INSERT INTO local_bot_grants (
+                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
+                       binding_id, binding_revision, agent_ref,
+                       agent_identity_digest, workspace_ref, workspace_path,
+                       workspace_identity_digest, allowed_delivery_target_ids_json,
+                       unattended_policy_json, created_at, expires_at
+                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        localGrantId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.behaviorDigest,
+        request.bindingId,
+        request.bindingRevision,
+        request.agentRef,
+        resolved.agentIdentityDigest,
+        request.workspaceRef,
+        resolved.workspacePath,
+        resolved.workspaceIdentityDigest,
+        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
+        JSON.stringify({ localSideEffects: "owner-approval-required" }),
+        now,
+        expiresAt
+      );
+      this.#database.prepare(
+        `INSERT INTO local_bot_binding_resolutions (
+                       request_id, binding_id, local_grant_id, resolved_at, result
+                     ) VALUES (?, ?, ?, ?, 'approved')`
+      ).run(request.requestId, request.bindingId, localGrantId, now);
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    signal.throwIfAborted();
+    return new BotExecutionBindingApprovedEvent(
+      request.requestId,
+      request.botId,
+      request.behaviorRevisionId,
+      request.bindingId,
+      request.bindingRevision,
+      localGrantId,
+      resolved.agentIdentityDigest,
+      resolved.workspaceIdentityDigest
+    );
+  };
+  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const row = this.#database.prepare(
+      `SELECT * FROM local_bot_grants
+                  WHERE local_grant_id = ? AND bot_id = ?
+                    AND behavior_revision_id = ? AND behavior_digest = ?
+                    AND binding_id = ? AND binding_revision = ?
+                    AND agent_ref = ?
+                    AND revoked_at IS NULL AND expires_at > ?`
+    ).get(
+      command.localGrantId,
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      command.agentId,
+      now
+    );
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution binding is not locally approved"
+      );
+    }
+    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
+    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
+    if (!exactTargets(approvedTargets, requestedTargets)) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target policy changed after local approval"
+      );
+    }
+    const agent = catalog.find(command.agentId);
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    const workspaceRef = rowString(row, "workspace_ref");
+    const workspacePath = await directories.resolve(bindingAuthorityId, workspaceRef, signal);
+    const currentAgentDigest = agentDigest(agent);
+    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
+      this.revoke(rowString(row, "local_grant_id"), now);
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target changed and requires local approval"
+      );
+    }
+    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply the approved Bot behavior"
+      );
+    }
+    return new LocalBotGrant(
+      rowString(row, "local_grant_id"),
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      agent,
+      currentAgentDigest,
+      workspaceRef,
+      workspacePath,
+      currentWorkspaceDigest,
+      approvedTargets,
+      rowInteger(row, "expires_at"),
+      rowInteger(row, "revocation_epoch")
+    );
+  };
+  recordUnavailable = (request, code, message, now) => {
+    this.#database.prepare(
+      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
+                   request_id, binding_id, local_grant_id, resolved_at,
+                   result, error_code, error_message
+                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
+    ).run(request.requestId, request.bindingId, now, code, message);
+  };
+  close = () => {
+    this.#database.close();
+  };
+  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
+    const agent = catalog.find(request.agentRef);
+    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply embedded Bot context"
+      );
+    }
+    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The Bot requires an unsupported local Agent capability"
+      );
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
+    return {
+      agent,
+      agentIdentityDigest: agentDigest(agent),
+      workspaceIdentityDigest: await workspaceDigest(workspacePath),
+      workspacePath
+    };
+  };
+  revoke = (localGrantId, now) => {
+    this.#database.prepare(
+      `UPDATE local_bot_grants
+                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
+                  WHERE local_grant_id = ? AND revoked_at IS NULL`
+    ).run(now, localGrantId);
+  };
+};
+
+// src/bots/bot-approve-command.ts
+var identifier3 = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var argumentsSchema = external_exports.union([
+  external_exports.tuple([external_exports.literal("--bot"), identifier3]),
+  external_exports.tuple([external_exports.literal("--bot"), identifier3, external_exports.literal("--channel"), identifier3])
+]);
+async function executeBotApproveCommand(arguments_, environment, parent) {
+  const parsed = argumentsSchema.safeParse(arguments_);
+  if (!parsed.success) {
+    throw new LocalBotAuthorizationError(
+      "invalid_arguments",
+      "Usage: mobius bot approve --bot <bot-id> [--channel <channel-id>]"
+    );
+  }
+  const [, botId, , requestedChannel] = parsed.data;
+  const signal = AbortSignal.any([parent, AbortSignal.timeout(3e4)]);
+  signal.throwIfAborted();
+  try {
+    const stateDirectory = await realpath8(readStateDirectory(environment));
+    const auditDirectory = await realpath8(join17(stateDirectory, "audit"));
+    if (dirname4(auditDirectory) !== stateDirectory) {
+      throw new LocalBotAuthorizationError(
+        "local_grant_invalid",
+        "The local approval directory is outside the Mobius state directory"
+      );
+    }
+    const channels = [];
+    for (const entry of await readdir2(auditDirectory, { withFileTypes: true })) {
+      signal.throwIfAborted();
+      if (!entry.isFile() || !entry.name.endsWith(".sqlite")) {
+        continue;
+      }
+      const channelId2 = entry.name.slice(0, -7);
+      if (!identifier3.safeParse(channelId2).success || requestedChannel !== void 0 && requestedChannel !== channelId2) {
+        continue;
+      }
+      const databasePath = await realpath8(join17(auditDirectory, entry.name));
+      if (dirname4(databasePath) !== auditDirectory) {
+        throw new LocalBotAuthorizationError(
+          "local_grant_invalid",
+          "The local approval database is outside the Mobius audit directory"
+        );
+      }
+      if (LocalBotGrantStore.containsBot(databasePath, botId)) {
+        channels.push(channelId2);
+      }
+    }
+    const channelId = channels[0];
+    if (channelId === void 0) {
+      throw new LocalBotAuthorizationError(
+        "bot_not_found",
+        "No saved approval for this Bot was found. Run this command on the machine hosting the Bot."
+      );
+    }
+    if (channels.length !== 1) {
+      throw new LocalBotAuthorizationError(
+        "binding_ambiguous",
+        `This Bot has approvals in multiple local channels. Add --channel with the intended channel: ${channels.join(", ")}`
+      );
+    }
+    const { config: config2 } = await resumeMobiusRuntime(channelId, signal, environment);
+    signal.throwIfAborted();
+    const grants = new LocalBotGrantStore(config2.auditDatabasePath);
+    try {
+      const approval = await grants.reapprove(
+        botId,
+        config2.catalog,
+        new WorkspaceDirectoryService(config2.bindingId, config2.defaultWorkspace),
+        config2.bindingId,
+        Date.now(),
+        signal
+      );
+      return `Approved Bot ${botId}
+Binding: ${approval.bindingId}
+Agent: ${approval.agentRef}
+Workspace: ${approval.workspacePath}
+Keep your daemon running and resend your message in the same Chat conversation.
+`;
+    } finally {
+      grants.close();
+    }
+  } catch (cause) {
+    parent.throwIfAborted();
+    if (signal.aborted) {
+      throw new LocalBotAuthorizationError("approval_timeout", "Local Bot approval timed out", { cause });
+    }
+    if (cause instanceof LocalBotAuthorizationError) {
+      throw cause;
+    }
+    if (cause instanceof Error && "code" in cause && cause.code === "ENOENT") {
+      throw new LocalBotAuthorizationError(
+        "bot_not_found",
+        "No saved local approval or Runtime connection was found for this Bot",
+        { cause }
+      );
+    }
+    throw new LocalBotAuthorizationError(
+      "local_approval_failed",
+      "Local Bot approval failed. Check the saved Runtime connection and local Agent installation.",
+      { cause }
+    );
+  }
+}
+
+// src/bots/bot-message-command.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { createConnection } from "node:net";
+var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
+var BotMessageCommandError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "BotMessageCommandError";
+  }
+};
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredEnvironment(environment, name) {
+  const value = environment[name]?.trim();
+  if (value === void 0 || value.length === 0) {
+    throw new BotMessageCommandError(
+      "execution_context_required",
+      "This command is available only inside an active Mobius Bot execution"
+    );
+  }
+  return value;
+}
+function option(arguments_, name) {
+  const index = arguments_.indexOf(name);
+  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const value = arguments_[index + 1];
+  if (value === void 0) {
+    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
+  }
+  return value;
+}
+function validateArguments(arguments_) {
+  if (arguments_.length !== 4) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const names = [arguments_[0], arguments_[2]];
+  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+}
+function decodeResponse(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
+      cause
+    });
+  }
+  if (!isRecord7(value) || typeof value["ok"] !== "boolean") {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+  }
+  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
+  }
+  const error61 = value["error"];
+  if (value["ok"] === false && isRecord7(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+    throw new BotMessageCommandError(error61["code"], error61["message"]);
+  }
+  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+}
+async function requestLocalBotService(socketPath, payload, signal) {
+  signal.throwIfAborted();
+  return await new Promise((resolve5, reject) => {
+    const socket = createConnection(socketPath);
+    const chunks = [];
+    let length = 0;
+    let finished = false;
+    const finish = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    const fail = (error61) => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      finish();
+      if (error61 instanceof BotMessageCommandError) {
+        reject(error61);
+        return;
+      }
+      reject(
+        new BotMessageCommandError(
+          "execution_context_required",
+          "The active Mobius Bot execution is unavailable",
+          { cause: error61 }
+        )
+      );
+    };
+    const abort = () => fail(signal.reason);
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
+      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
+    });
+    socket.once("error", fail);
+    socket.once("connect", () => socket.end(`${payload}
+`));
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_RESPONSE_LIMIT) {
+        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("end", () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      signal.removeEventListener("abort", abort);
+      try {
+        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
+      } catch (error61) {
+        reject(error61);
+      } finally {
+        finish();
+      }
+    });
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function executeBotMessageCommand(arguments_, environment, signal) {
+  validateArguments(arguments_);
+  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
+  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
+  const target = option(arguments_, "--target");
+  const text = option(arguments_, "--text");
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
+    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
+  }
+  return await requestLocalBotService(
+    socketPath,
+    JSON.stringify({
+      contextHandle,
+      idempotencyKey: `cli_${randomUUID3()}`,
+      target,
+      text
+    }),
+    signal
+  );
+}
+
 // src/audit/audit-store.ts
 import { mkdirSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { dirname as dirname5 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var AuditStore = class {
   database;
   constructor(path2) {
-    mkdirSync(dirname3(path2), { recursive: true });
-    this.database = new DatabaseSync(path2);
+    mkdirSync(dirname5(path2), { recursive: true });
+    this.database = new DatabaseSync2(path2);
     this.database.exec(`
       CREATE TABLE IF NOT EXISTS audit_events (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -23849,7 +24558,7 @@ var AuditStore = class {
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { basename as basename5, join as join17 } from "node:path";
+import { basename as basename5, join as join18 } from "node:path";
 import { styleText } from "node:util";
 import { fetch as fetch7, WebSocket as WebSocket2 } from "undici";
 
@@ -23863,8 +24572,8 @@ import {
 } from "@agentclientprotocol/sdk";
 
 // src/authorization/local-raster.ts
-import { readFile, realpath as realpath7, stat as stat6 } from "node:fs/promises";
-import { basename as basename2, isAbsolute as isAbsolute8, normalize as normalize2, relative as relative4, sep as sep4 } from "node:path";
+import { readFile, realpath as realpath9, stat as stat8 } from "node:fs/promises";
+import { basename as basename3, isAbsolute as isAbsolute9, normalize as normalize3, relative as relative5, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var MAX_LOCAL_RASTER_BYTES = 3e6;
 var PNG_SIGNATURE = Uint8Array.of(137, 80, 78, 71);
@@ -23906,18 +24615,18 @@ function sniffRasterMime(bytes) {
   return null;
 }
 function isInsideRoot(root, target) {
-  const relation = relative4(root, target);
-  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute8(relation);
+  const relation = relative5(root, target);
+  return relation !== ".." && !relation.startsWith(`..${sep4}`) && !isAbsolute9(relation);
 }
 async function resolveCanonicalPath(requested, signal) {
   signal.throwIfAborted();
-  if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+  if (!isAbsolute9(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
     return null;
   }
   try {
-    const target = await realpath7(requested);
+    const target = await realpath9(requested);
     signal.throwIfAborted();
-    if (!isAbsolute8(target) || normalize2(target) !== target) {
+    if (!isAbsolute9(target) || normalize3(target) !== target) {
       return null;
     }
     return target;
@@ -23963,7 +24672,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
   if (target === null) {
     return null;
   }
-  const targetMetadata = await stat6(target);
+  const targetMetadata = await stat8(target);
   signal.throwIfAborted();
   if (!targetMetadata.isFile() || targetMetadata.size < 1 || targetMetadata.size > MAX_LOCAL_RASTER_BYTES) {
     return null;
@@ -23974,7 +24683,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
     if (directory === null) {
       continue;
     }
-    const metadata = await stat6(directory);
+    const metadata = await stat8(directory);
     signal.throwIfAborted();
     if (metadata.isDirectory()) {
       authorizedRoots.push(directory);
@@ -23992,7 +24701,7 @@ async function readAuthorizedRaster(uri, roots, signal) {
   if (mimeType === null) {
     return null;
   }
-  return new LocalRasterImage(basename2(target) || "Image", mimeType, bytes);
+  return new LocalRasterImage(basename3(target) || "Image", mimeType, bytes);
 }
 
 // src/native-sessions/history-images.ts
@@ -25067,8 +25776,8 @@ var AcpHistoryReplay = class {
 
 // src/acp/session-store.ts
 import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { dirname as dirname6 } from "node:path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var AcpStoredSession = class {
   additionalDirectories;
   agentId;
@@ -25170,8 +25879,8 @@ var MemoryAcpSessionStore = class {
 var SqliteAcpSessionStore = class {
   #database;
   constructor(path2) {
-    mkdirSync2(dirname4(path2), { recursive: true });
-    this.#database = new DatabaseSync2(path2);
+    mkdirSync2(dirname6(path2), { recursive: true });
+    this.#database = new DatabaseSync3(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS acp_deleted_sessions (session_id TEXT PRIMARY KEY) STRICT;
       CREATE TABLE IF NOT EXISTS acp_sessions (
@@ -28040,7 +28749,7 @@ var FixedInstallationExecutor = class {
 };
 
 // src/artifacts/runtime-artifact-uploader.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // ../mobius-sdk/src/errors.ts
 var MobiusError = class extends Error {
@@ -28367,7 +29076,7 @@ async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
       image.name,
       image.mimeType,
       image.bytes.byteLength,
-      createHash2("sha256").update(image.bytes).digest("hex")
+      createHash3("sha256").update(image.bytes).digest("hex")
     );
   } catch (cause) {
     translateSdkError(cause);
@@ -28435,508 +29144,6 @@ async function uploadRuntimeArtifact(config2, sessionId, image, signal) {
   }
 }
 
-// src/authorization/local-authorization-error.ts
-var LocalAuthorizationError = class extends Error {
-  code = "local_authorization_failed";
-  constructor(message, options = {}) {
-    super(message, options);
-    this.name = "LocalAuthorizationError";
-  }
-};
-
-// src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath8, stat as stat7 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join16, normalize as normalize3, relative as relative5 } from "node:path";
-var WorkspaceDirectoryListing = class {
-  directoryId;
-  directoryLabel;
-  entries;
-  parentDirectoryId;
-  constructor(directoryId2, directoryLabel, entries, parentDirectoryId) {
-    this.directoryId = directoryId2;
-    this.directoryLabel = directoryLabel;
-    this.entries = entries;
-    this.parentDirectoryId = parentDirectoryId;
-  }
-};
-function encodePath(path2) {
-  const encoded = Buffer.from(path2, "utf8").toString("base64url");
-  if (encoded.length === 0 || encoded.length > 2e3) {
-    throw new LocalAuthorizationError("The local directory path is too long to select");
-  }
-  return `path-${encoded}`;
-}
-function decodePath(value, prefix) {
-  const encoded = value.slice(prefix.length);
-  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded)) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  }
-  const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize3(decoded) !== decoded) {
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  }
-  return decoded;
-}
-var WorkspaceDirectoryService = class {
-  #bindingId;
-  #defaultWorkspace;
-  constructor(bindingId, defaultWorkspace) {
-    this.#bindingId = bindingId;
-    this.#defaultWorkspace = defaultWorkspace;
-  }
-  authorizeMachine = (bindingId) => {
-    if (bindingId !== this.#bindingId) {
-      throw new LocalAuthorizationError("The runtime binding is not authorized");
-    }
-  };
-  requestedPath = (id) => {
-    if (id === "default") {
-      return this.#defaultWorkspace;
-    }
-    if (id === "home") {
-      return homedir2();
-    }
-    if (id.startsWith("path-")) {
-      const path2 = decodePath(id, "path-");
-      if (isAbsolute9(path2)) {
-        return path2;
-      }
-    }
-    throw new LocalAuthorizationError("The directory identifier is invalid");
-  };
-  resolvePath = async (requested, signal) => {
-    signal.throwIfAborted();
-    if (!isAbsolute9(requested) || requested.includes("\0") || normalize3(requested) !== requested) {
-      throw new LocalAuthorizationError("The local directory path is invalid");
-    }
-    try {
-      const target = await realpath8(requested);
-      signal.throwIfAborted();
-      const metadata = await stat7(target);
-      signal.throwIfAborted();
-      if (!isAbsolute9(target) || normalize3(target) !== target || !metadata.isDirectory()) {
-        throw new LocalAuthorizationError("The selected location is not a directory");
-      }
-      return target;
-    } catch (cause) {
-      signal.throwIfAborted();
-      if (cause instanceof LocalAuthorizationError) {
-        throw cause;
-      }
-      throw new LocalAuthorizationError("This directory is missing or unavailable to your user account", {
-        cause
-      });
-    }
-  };
-  label = (path2) => {
-    const suffix = relative5(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute9(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
-  };
-  identify = async (bindingId, requestedPath, signal) => {
-    this.authorizeMachine(bindingId);
-    const path2 = await this.resolvePath(requestedPath, signal);
-    return {
-      path: path2,
-      directoryId: encodePath(path2),
-      name: basename3(path2) || path2,
-      label: this.label(path2)
-    };
-  };
-  resolve = async (bindingId, id, signal) => {
-    this.authorizeMachine(bindingId);
-    return await this.resolvePath(this.requestedPath(id), signal);
-  };
-  list = async (bindingId, id, signal) => {
-    const target = await this.resolve(bindingId, id, signal);
-    try {
-      const children = await readdir(target, { withFileTypes: true });
-      signal.throwIfAborted();
-      const entries = [];
-      for (const child of children) {
-        if (entries.length === 500) {
-          break;
-        }
-        if (child.isFile() || child.isBlockDevice() || child.isCharacterDevice() || child.isFIFO() || child.isSocket()) {
-          continue;
-        }
-        try {
-          const path2 = await this.resolvePath(join16(target, child.name), signal);
-          entries.push({ directoryId: encodePath(path2), name: child.name });
-        } catch (cause) {
-          signal.throwIfAborted();
-          if (!(cause instanceof LocalAuthorizationError)) {
-            throw cause;
-          }
-        }
-      }
-      entries.sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname5(target);
-      return new WorkspaceDirectoryListing(
-        id,
-        this.label(target),
-        entries,
-        parent === target ? "" : encodePath(parent)
-      );
-    } catch (cause) {
-      signal.throwIfAborted();
-      if (cause instanceof LocalAuthorizationError) {
-        throw cause;
-      }
-      throw new LocalAuthorizationError("This directory cannot be browsed by your user account", { cause });
-    }
-  };
-  resolveMany = async (bindingId, ids, signal) => {
-    const paths = /* @__PURE__ */ new Set();
-    for (const id of ids) {
-      paths.add(await this.resolve(bindingId, id, signal));
-    }
-    return [...paths];
-  };
-};
-
-// src/bots/local-bot-grant-store.ts
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
-import { stat as stat8 } from "node:fs/promises";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
-var LocalBotAuthorizationError = class extends Error {
-  code;
-  constructor(code, message, options = {}) {
-    super(message, options);
-    this.code = code;
-    this.name = "LocalBotAuthorizationError";
-  }
-};
-var LocalBotGrant = class {
-  agent;
-  agentIdentityDigest;
-  allowedDeliveryTargetIds;
-  behaviorDigest;
-  behaviorRevisionId;
-  bindingId;
-  bindingRevision;
-  botId;
-  expiresAt;
-  localGrantId;
-  revocationEpoch;
-  workspaceIdentityDigest;
-  workspacePath;
-  workspaceRef;
-  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspaceRef, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
-    this.localGrantId = localGrantId;
-    this.botId = botId;
-    this.behaviorRevisionId = behaviorRevisionId;
-    this.behaviorDigest = behaviorDigest;
-    this.bindingId = bindingId;
-    this.bindingRevision = bindingRevision;
-    this.agent = agent;
-    this.agentIdentityDigest = agentIdentityDigest;
-    this.workspaceRef = workspaceRef;
-    this.workspacePath = workspacePath;
-    this.workspaceIdentityDigest = workspaceIdentityDigest;
-    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
-    this.expiresAt = expiresAt;
-    this.revocationEpoch = revocationEpoch;
-  }
-};
-function digest(value) {
-  return createHash3("sha256").update(value, "utf8").digest("hex");
-}
-function agentDigest(agent) {
-  return digest(
-    JSON.stringify({
-      adapter: agent.adapterIdentity,
-      agent: agent.agentIdentity,
-      agentVersion: agent.agentVersion,
-      arguments: agent.arguments,
-      id: agent.id
-    })
-  );
-}
-async function workspaceDigest(path2) {
-  const metadata = await stat8(path2);
-  if (!metadata.isDirectory()) {
-    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
-  }
-  return digest(
-    JSON.stringify({
-      changedAtMilliseconds: metadata.ctimeMs,
-      device: metadata.dev,
-      inode: metadata.ino,
-      path: path2
-    })
-  );
-}
-function exactTargets(left, right) {
-  if (left.length !== right.length) {
-    return false;
-  }
-  const expected = [...left].sort();
-  const actual = [...right].sort();
-  return expected.every((target, index) => target === actual[index]);
-}
-function rowString(row, key) {
-  const value = Reflect.get(row, key);
-  if (typeof value !== "string") {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value;
-}
-function rowInteger(row, key) {
-  const value = Reflect.get(row, key);
-  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value;
-}
-function parseTargets(encoded) {
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch (cause) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
-  }
-  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
-    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
-  }
-  return value.filter((target) => typeof target === "string");
-}
-var LocalBotGrantStore = class {
-  #database;
-  constructor(path2) {
-    this.#database = new DatabaseSync3(path2);
-    this.#database.exec(`
-          CREATE TABLE IF NOT EXISTS local_bot_grants (
-            local_grant_id TEXT PRIMARY KEY,
-            bot_id TEXT NOT NULL,
-            behavior_revision_id TEXT NOT NULL,
-            behavior_digest TEXT NOT NULL,
-            binding_id TEXT NOT NULL UNIQUE,
-            binding_revision INTEGER NOT NULL,
-            agent_ref TEXT NOT NULL,
-            agent_identity_digest TEXT NOT NULL,
-            workspace_ref TEXT NOT NULL,
-            workspace_path TEXT NOT NULL,
-            workspace_identity_digest TEXT NOT NULL,
-            allowed_delivery_target_ids_json TEXT NOT NULL,
-            unattended_policy_json TEXT NOT NULL,
-            created_at INTEGER NOT NULL,
-            expires_at INTEGER NOT NULL,
-            revocation_epoch INTEGER NOT NULL DEFAULT 0,
-            revoked_at INTEGER
-          ) STRICT;
-          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
-            request_id TEXT PRIMARY KEY,
-            binding_id TEXT NOT NULL,
-            local_grant_id TEXT NOT NULL,
-            resolved_at INTEGER NOT NULL,
-            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
-            error_code TEXT,
-            error_message TEXT
-          ) STRICT;
-        `);
-  }
-  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
-    signal.throwIfAborted();
-    const existing = this.#database.prepare(
-      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
-                   INNER JOIN local_bot_grants AS grants
-                     ON grants.local_grant_id = resolutions.local_grant_id
-                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
-                    AND resolutions.result = 'approved'`
-    ).get(request.requestId, request.bindingId);
-    if (existing !== void 0) {
-      return new BotExecutionBindingApprovedEvent(
-        request.requestId,
-        request.botId,
-        request.behaviorRevisionId,
-        request.bindingId,
-        request.bindingRevision,
-        rowString(existing, "local_grant_id"),
-        rowString(existing, "agent_identity_digest"),
-        rowString(existing, "workspace_identity_digest")
-      );
-    }
-    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
-    const localGrantId = `lbg_${randomUUID3()}`;
-    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
-    this.#database.exec("BEGIN IMMEDIATE");
-    try {
-      this.#database.prepare(
-        `INSERT INTO local_bot_grants (
-                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
-                       binding_id, binding_revision, agent_ref,
-                       agent_identity_digest, workspace_ref, workspace_path,
-                       workspace_identity_digest, allowed_delivery_target_ids_json,
-                       unattended_policy_json, created_at, expires_at
-                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-      ).run(
-        localGrantId,
-        request.botId,
-        request.behaviorRevisionId,
-        request.behaviorDigest,
-        request.bindingId,
-        request.bindingRevision,
-        request.agentRef,
-        resolved.agentIdentityDigest,
-        request.workspaceRef,
-        resolved.workspacePath,
-        resolved.workspaceIdentityDigest,
-        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
-        JSON.stringify({ localSideEffects: "owner-approval-required" }),
-        now,
-        expiresAt
-      );
-      this.#database.prepare(
-        `INSERT INTO local_bot_binding_resolutions (
-                       request_id, binding_id, local_grant_id, resolved_at, result
-                     ) VALUES (?, ?, ?, ?, 'approved')`
-      ).run(request.requestId, request.bindingId, localGrantId, now);
-      this.#database.exec("COMMIT");
-    } catch (cause) {
-      this.#database.exec("ROLLBACK");
-      throw cause;
-    }
-    signal.throwIfAborted();
-    return new BotExecutionBindingApprovedEvent(
-      request.requestId,
-      request.botId,
-      request.behaviorRevisionId,
-      request.bindingId,
-      request.bindingRevision,
-      localGrantId,
-      resolved.agentIdentityDigest,
-      resolved.workspaceIdentityDigest
-    );
-  };
-  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
-    signal.throwIfAborted();
-    const row = this.#database.prepare(
-      `SELECT * FROM local_bot_grants
-                  WHERE local_grant_id = ? AND bot_id = ?
-                    AND behavior_revision_id = ? AND behavior_digest = ?
-                    AND binding_id = ? AND binding_revision = ?
-                    AND agent_ref = ?
-                    AND revoked_at IS NULL AND expires_at > ?`
-    ).get(
-      command.localGrantId,
-      command.botId,
-      command.behaviorRevisionId,
-      command.behaviorDigest,
-      command.bindingId,
-      command.bindingRevision,
-      command.agentId,
-      now
-    );
-    if (row === void 0) {
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution binding is not locally approved"
-      );
-    }
-    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
-    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
-    if (!exactTargets(approvedTargets, requestedTargets)) {
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution target policy changed after local approval"
-      );
-    }
-    const agent = catalog.find(command.agentId);
-    const [adapterUnchanged, agentUnchanged] = await Promise.all([
-      revalidateExecutable(agent.adapterIdentity),
-      revalidateExecutable(agent.agentIdentity)
-    ]);
-    signal.throwIfAborted();
-    const workspaceRef = rowString(row, "workspace_ref");
-    const workspacePath = await directories.resolve(bindingAuthorityId, workspaceRef, signal);
-    const currentAgentDigest = agentDigest(agent);
-    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
-    signal.throwIfAborted();
-    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
-      this.revoke(rowString(row, "local_grant_id"), now);
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution target changed and requires local approval"
-      );
-    }
-    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent cannot apply the approved Bot behavior"
-      );
-    }
-    return new LocalBotGrant(
-      rowString(row, "local_grant_id"),
-      command.botId,
-      command.behaviorRevisionId,
-      command.behaviorDigest,
-      command.bindingId,
-      command.bindingRevision,
-      agent,
-      currentAgentDigest,
-      workspaceRef,
-      workspacePath,
-      currentWorkspaceDigest,
-      approvedTargets,
-      rowInteger(row, "expires_at"),
-      rowInteger(row, "revocation_epoch")
-    );
-  };
-  recordUnavailable = (request, code, message, now) => {
-    this.#database.prepare(
-      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
-                   request_id, binding_id, local_grant_id, resolved_at,
-                   result, error_code, error_message
-                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
-    ).run(request.requestId, request.bindingId, now, code, message);
-  };
-  close = () => {
-    this.#database.close();
-  };
-  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
-    const agent = catalog.find(request.agentRef);
-    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent cannot apply embedded Bot context"
-      );
-    }
-    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The Bot requires an unsupported local Agent capability"
-      );
-    }
-    const [adapterUnchanged, agentUnchanged] = await Promise.all([
-      revalidateExecutable(agent.adapterIdentity),
-      revalidateExecutable(agent.agentIdentity)
-    ]);
-    signal.throwIfAborted();
-    if (!adapterUnchanged || !agentUnchanged) {
-      throw new LocalBotAuthorizationError(
-        "binding_incompatible",
-        "The local Agent executable changed before approval"
-      );
-    }
-    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
-    return {
-      agent,
-      agentIdentityDigest: agentDigest(agent),
-      workspaceIdentityDigest: await workspaceDigest(workspacePath),
-      workspacePath
-    };
-  };
-  revoke = (localGrantId, now) => {
-    this.#database.prepare(
-      `UPDATE local_bot_grants
-                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
-                  WHERE local_grant_id = ? AND revoked_at IS NULL`
-    ).run(now, localGrantId);
-  };
-};
-
 // src/bots/bot-context-applicator.ts
 var AppliedBotContext = class {
   resources;
@@ -29072,7 +29279,7 @@ var BotExecutionContextRegistry = class {
 // src/bots/bot-outbound-ipc.ts
 import { chmod as chmod2, mkdir as mkdir4, unlink } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname6, isAbsolute as isAbsolute10 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute10 } from "node:path";
 import { fetch as fetch5 } from "undici";
 var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
 var BOT_IPC_TIMEOUT_MILLISECONDS2 = 2e4;
@@ -29185,7 +29392,7 @@ var BotOutboundIpcServer = class {
   listen = async (signal) => {
     signal.throwIfAborted();
     if (this.#usesFilesystemSocket) {
-      await mkdir4(dirname6(this.#socketPath), { mode: 448, recursive: true });
+      await mkdir4(dirname7(this.#socketPath), { mode: 448, recursive: true });
       await unlink(this.#socketPath).catch((error61) => {
         if (!isRecord12(error61) || error61["code"] !== "ENOENT") {
           throw error61;
@@ -30491,7 +30698,7 @@ var RelayConnectionLiveness = class {
 
 // src/relay-connection/session-event-outbox.ts
 import { mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 var DEFAULT_OUTBOX_LIMITS = {
   criticalEventBytes: 136 * 1024 * 1024,
@@ -30559,7 +30766,7 @@ var SessionEventOutbox = class {
   constructor(path2, limits = DEFAULT_OUTBOX_LIMITS) {
     validateLimits(limits);
     this.#limits = limits;
-    mkdirSync3(dirname7(path2), { recursive: true });
+    mkdirSync3(dirname8(path2), { recursive: true });
     this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS relay_session_event_outbox (
@@ -31110,7 +31317,7 @@ function botIpcSocketPath() {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\mobius-bot-${randomUUID6()}`;
   }
-  return join17("/tmp", `mobius-bot-${randomUUID6()}.sock`);
+  return join18("/tmp", `mobius-bot-${randomUUID6()}.sock`);
 }
 var DaemonAcpObserver = class {
   #config;
@@ -31780,7 +31987,7 @@ async function executeSessionConfigure(publisher, socket, command, config2, dire
     reportOperationFailure(socket, command.requestId, command.sessionId, error61);
   }
 }
-async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, timer, signal) {
+async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -31809,6 +32016,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       }),
       attemptId
     );
+    activateAttempt();
     const attachments = await resolvePromptArtifacts(config2, command, signal);
     let stopReason;
     if (command.disposition === SessionPromptDisposition.Steer) {
@@ -31920,7 +32128,7 @@ function botExecutionAgent(agent, contextHandle, socketPath) {
     agent.capabilities
   );
 }
-async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, timer, signal) {
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, activateAttempt, timer, signal) {
   const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
     publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
   });
@@ -32001,6 +32209,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         }),
         attemptId
       );
+      activateAttempt();
       const result = await sessions.runPrompt({
         additionalDirectories: resolved.additionalDirectories,
         agent,
@@ -32194,11 +32403,13 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         }
         const turn = new ActiveDaemonTurn(command, receipt.attemptId);
         activeTurns.set(command.commandId, turn);
-        if (trackActiveAttempt) {
-          activeAttemptIds.set(command.sessionId, receipt.attemptId);
-        }
+        const activateAttempt = () => {
+          if (trackActiveAttempt) {
+            activeAttemptIds.set(command.sessionId, receipt.attemptId);
+          }
+        };
         try {
-          await execute(receipt.attemptId, turn.signal);
+          await execute(receipt.attemptId, activateAttempt, turn.signal);
         } finally {
           activeTurns.delete(command.commandId);
           if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
@@ -32283,7 +32494,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             true,
-            (attemptId, executionSignal) => executeBotPrompt(
+            (attemptId, activateAttempt, executionSignal) => executeBotPrompt(
               outbox,
               publisher,
               command,
@@ -32296,6 +32507,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -32308,7 +32520,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             delivery,
             command,
             command.disposition !== SessionPromptDisposition.Steer,
-            (attemptId, executionSignal) => executePrompt(
+            (attemptId, activateAttempt, executionSignal) => executePrompt(
               outbox,
               publisher,
               command,
@@ -32317,6 +32529,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               audit,
               sessions,
               attemptId,
+              activateAttempt,
               timer,
               executionSignal
             )
@@ -32818,7 +33031,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             }
             const turn2 = new ActiveDaemonTurn(command2, receipt2.attemptId);
             activeTurns.set(command2.commandId, turn2);
-            activeAttemptIds.set(command2.sessionId, receipt2.attemptId);
             void executeBotPrompt(
               outbox,
               publisher,
@@ -32832,6 +33044,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               receipt2.attemptId,
+              () => activeAttemptIds.set(command2.sessionId, receipt2.attemptId),
               timer,
               turn2.signal
             ).catch((error61) => {
@@ -32858,9 +33071,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           }
           const turn = new ActiveDaemonTurn(command, receipt.attemptId);
           activeTurns.set(command.commandId, turn);
-          if (command.disposition !== SessionPromptDisposition.Steer) {
-            activeAttemptIds.set(command.sessionId, receipt.attemptId);
-          }
           void executePrompt(
             outbox,
             publisher,
@@ -32870,6 +33080,11 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             audit,
             sessions,
             receipt.attemptId,
+            () => {
+              if (command.disposition !== SessionPromptDisposition.Steer) {
+                activeAttemptIds.set(command.sessionId, receipt.attemptId);
+              }
+            },
             timer,
             turn.signal
           ).catch((error61) => {
@@ -33128,6 +33343,7 @@ Usage:
   mobius pair --url <relay-url> --pairing <runtime-pairing-id> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
+  mobius bot approve --bot <bot-id> [--channel <channel-id>]
   mobius bot message send --target <current|alias> --text <message>
 
 Commands:
@@ -33135,7 +33351,7 @@ Commands:
   pair   Pair this machine and start its local daemon
   start  Start the local daemon for a saved channel
   agents Show detected, missing, and integration-ready Agents
-  bot    Invoke Bot-scoped actions from an active local execution
+  bot    Approve a saved Bot locally or send a message from an active execution
 
 Pairing grants this browser access to the machine with your user account's permissions.
 New conversations default to ~/.mobius/workspace; choose other directories in the browser.
@@ -33166,6 +33382,10 @@ async function main() {
     return;
   }
   if (command === "bot") {
+    if (process.argv[3] === "approve") {
+      process.stdout.write(await executeBotApproveCommand(process.argv.slice(4), process.env, shutdown.signal));
+      return;
+    }
     if (process.argv[3] !== "message" || process.argv[4] !== "send") {
       throw new BotMessageCommandError(
         "invalid_request",
@@ -33211,7 +33431,7 @@ try {
 } catch (error61) {
   if (!shutdown.signal.aborted) {
     const message = error61 instanceof Error ? error61.message : "Unknown failure";
-    const code = error61 instanceof BotMessageCommandError ? `${error61.code}: ` : "";
+    const code = error61 instanceof BotMessageCommandError || error61 instanceof LocalBotAuthorizationError ? `${error61.code}: ` : "";
     process.stderr.write(`Mobius daemon failed: ${code}${message}
 `);
     process.exitCode = 1;