@moxt-ai/mobius 0.0.335 → 0.0.337

package/dist/cli.js

@@ -2086,7 +2086,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@moxt-ai/mobius",
-      version: "0.0.335",
+      version: "0.0.337",
       description: "Mobius CLI for pairing and running local AI agent services.",
       type: "module",
       bin: {
@@ -70440,11 +70440,270 @@ var init_path_error = __esm({
 });
 
 // src/util/platform/posix.ts
-import { execFile as execFile2 } from "node:child_process";
-import { constants as constants3 } from "node:fs";
-import { access as access2, chmod, lstat as lstat2, realpath as realpath3, unlink as unlink3 } from "node:fs/promises";
+import { chmod, lstat as lstat2, unlink as unlink3 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join as join10 } from "node:path";
+async function removeControlSocket(path8) {
+  try {
+    await unlink3(path8);
+  } catch (cause) {
+    if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
+      throw cause;
+    }
+  }
+}
+var posixOperations;
+var init_posix = __esm({
+  "src/util/platform/posix.ts"() {
+    "use strict";
+    init_path_error();
+    posixOperations = {
+      controlSocketPath: (installationHash) => join10(tmpdir(), `mobius-${installationHash}.sock`),
+      prepareControlSocket: removeControlSocket,
+      secureControlSocket: async (path8) => {
+        await chmod(path8, 384);
+      },
+      removeControlSocket,
+      validatePathPermissions: async (path8, directory, privateAccess, signal) => {
+        signal.throwIfAborted();
+        const metadata = await lstat2(path8);
+        if (process.getuid === void 0 || metadata.uid !== process.getuid()) {
+          throw new LocalPathError("Path is not user-owned");
+        }
+        if (privateAccess) {
+          await chmod(path8, directory ? 448 : 384);
+        }
+        signal.throwIfAborted();
+      }
+    };
+  }
+});
+
+// src/util/platform/linux.ts
+import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+var linuxPlatform;
+var init_linux = __esm({
+  "src/util/platform/linux.ts"() {
+    "use strict";
+    init_posix();
+    linuxPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: (environment) => {
+        const homeDirectory = environment["HOME"];
+        return homeDirectory !== void 0 && isAbsolute5(homeDirectory) ? [join11(homeDirectory, ".local", "bin", "claude")] : [];
+      }
+    };
+  }
+});
+
+// src/util/platform/claude-desktop.ts
+import { readdirSync as readdirSync2 } from "node:fs";
+import { join as join12 } from "node:path";
+function installedDirectories(directory) {
+  try {
+    return readdirSync2(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (cause) {
+    if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR" || cause.code === "EACCES")) {
+      return [];
+    }
+    throw cause;
+  }
+}
+function claudeDesktopExecutablePaths(roots, executablePaths) {
+  const paths = [];
+  for (const root of roots) {
+    const versions = installedDirectories(root).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2)).toSorted((left, right) => right.localeCompare(left, "en", { numeric: true }));
+    for (const version2 of versions) {
+      const directory = join12(root, version2);
+      const installations = [
+        directory,
+        ...installedDirectories(directory).map((build) => join12(directory, build))
+      ];
+      for (const installation of installations) {
+        for (const executablePath of executablePaths) {
+          paths.push(join12(installation, ...executablePath));
+        }
+      }
+    }
+  }
+  return paths;
+}
+var init_claude_desktop = __esm({
+  "src/util/platform/claude-desktop.ts"() {
+    "use strict";
+  }
+});
+
+// src/util/platform/macos.ts
+import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
+var macosPlatform;
+var init_macos = __esm({
+  "src/util/platform/macos.ts"() {
+    "use strict";
+    init_claude_desktop();
+    init_posix();
+    macosPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: (environment) => {
+        const paths = ["/opt/homebrew/bin/claude", "/usr/local/bin/claude"];
+        const homeDirectory = environment["HOME"];
+        if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
+          paths.unshift(join13(homeDirectory, ".local", "bin", "claude"));
+          paths.push(
+            ...claudeDesktopExecutablePaths(
+              [join13(homeDirectory, "Library", "Application Support", "Claude", "claude-code")],
+              [["claude.app", "Contents", "MacOS", "claude"], ["claude"]]
+            )
+          );
+        }
+        return paths;
+      }
+    };
+  }
+});
+
+// src/util/platform/windows.ts
+import { execFile as execFile2 } from "node:child_process";
+import { isAbsolute as isAbsolute7, join as join14 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+function environmentValue(environment, name2) {
+  return Object.entries(environment).find(([key]) => key.toUpperCase() === name2.toUpperCase())?.[1];
+}
+function desktopClaudeExecutablePaths(environment) {
+  const roots = [];
+  const localAppData = environmentValue(environment, "LOCALAPPDATA");
+  if (localAppData !== void 0 && isAbsolute7(localAppData)) {
+    const dataDirectory = join14(localAppData, "Claude-Data");
+    for (const installation of installedDirectories(dataDirectory)) {
+      if (installation.startsWith("claude_")) {
+        roots.push(join14(dataDirectory, installation, "claude-code"));
+      }
+    }
+  }
+  const appData = environmentValue(environment, "APPDATA");
+  if (appData !== void 0 && isAbsolute7(appData)) {
+    roots.push(join14(appData, "Claude", "claude-code"));
+  }
+  return claudeDesktopExecutablePaths(roots, [["claude.exe"]]);
+}
+async function validatePathPermissions(path8, _directory, privateAccess, signal) {
+  signal.throwIfAborted();
+  const systemRoot = environmentValue(process.env, "SystemRoot");
+  if (systemRoot === void 0) {
+    throw new LocalPathError("Windows system directory is unavailable");
+  }
+  try {
+    await execute(
+      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(windowsPermissions, "utf16le").toString("base64")
+      ],
+      {
+        env: {
+          ...process.env,
+          MOBIUS_PERMISSION_PATH: path8,
+          MOBIUS_PERMISSION_PRIVATE: privateAccess ? "1" : "0"
+        },
+        windowsHide: true,
+        signal: AbortSignal.any([signal, AbortSignal.timeout(windowsPermissionsTimeoutMs)]),
+        timeout: windowsPermissionsTimeoutMs,
+        maxBuffer: 16384
+      }
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw new LocalPathError("The local path permissions could not be secured", { cause });
+  }
+}
+var execute, windowsPermissions, windowsPermissionsTimeoutMs, windowsPlatform;
+var init_windows = __esm({
+  "src/util/platform/windows.ts"() {
+    "use strict";
+    init_path_error();
+    init_claude_desktop();
+    execute = promisify2(execFile2);
+    windowsPermissions = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$item = Get-Item -LiteralPath $env:MOBIUS_PERMISSION_PATH -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Unsafe path' }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = $item.GetAccessControl()
+$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
+if ($owner -ne $sid -and -not ($owner.Value -eq 'S-1-5-32-544' -and ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) { throw 'Path is not user-owned' }
+if ($env:MOBIUS_PERMISSION_PRIVATE -eq '1') {
+    if ($item.PSIsContainer) {
+        $private = New-Object Security.AccessControl.DirectorySecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+    } else {
+        $private = New-Object Security.AccessControl.FileSecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow')
+    }
+    $private.SetOwner($sid)
+    $private.SetAccessRuleProtection($true, $false)
+    $private.AddAccessRule($rule)
+    $item.SetAccessControl($private)
+}
+`;
+    windowsPermissionsTimeoutMs = 3e4;
+    windowsPlatform = {
+      controlSocketPath: (installationHash) => `\\\\.\\pipe\\mobius-${installationHash}`,
+      prepareControlSocket: async () => {
+      },
+      secureControlSocket: async () => {
+      },
+      removeControlSocket: async () => {
+      },
+      validatePathPermissions,
+      claudeCodeExecutablePaths: (environment) => {
+        const paths = [];
+        const userProfile = environmentValue(environment, "USERPROFILE");
+        if (userProfile !== void 0 && isAbsolute7(userProfile)) {
+          paths.push(join14(userProfile, ".local", "bin", "claude.exe"));
+        }
+        const localAppData = environmentValue(environment, "LOCALAPPDATA");
+        if (localAppData !== void 0 && isAbsolute7(localAppData)) {
+          paths.push(join14(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"));
+        }
+        paths.push(...desktopClaudeExecutablePaths(environment));
+        return paths;
+      }
+    };
+  }
+});
+
+// src/util/platform/index.ts
+function platformSupportFor(platform2) {
+  return platforms.get(platform2) ?? fallbackPlatform;
+}
+var fallbackPlatform, platforms;
+var init_platform = __esm({
+  "src/util/platform/index.ts"() {
+    "use strict";
+    init_linux();
+    init_macos();
+    init_posix();
+    init_windows();
+    fallbackPlatform = {
+      ...posixOperations,
+      claudeCodeExecutablePaths: () => []
+    };
+    platforms = /* @__PURE__ */ new Map([
+      ["linux", linuxPlatform],
+      ["darwin", macosPlatform],
+      ["win32", windowsPlatform]
+    ]);
+  }
+});
+
+// src/util/process/platform/posix.ts
+import { execFile as execFile3 } from "node:child_process";
+import { constants as constants3 } from "node:fs";
+import { access as access2, realpath as realpath3 } from "node:fs/promises";
 function parseProcessTable(output2) {
   const entries = [];
   for (const line of output2.split("\n")) {
@@ -70464,7 +70723,7 @@ function parseProcessTable(output2) {
 }
 function readProcessTableWithPs(executable) {
   return new Promise((resolveTable) => {
-    execFile2(
+    execFile3(
       executable,
       ["-axo", "pid=,ppid=,pgid="],
       {
@@ -70522,29 +70781,13 @@ function terminateProcess(child, signal) {
   }
   child.kill(signal);
 }
-async function removeControlSocket(path8) {
-  try {
-    await unlink3(path8);
-  } catch (cause) {
-    if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
-      throw cause;
-    }
-  }
-}
-var PROCESS_TABLE_TIMEOUT_MILLISECONDS, PROCESS_TABLE_OUTPUT_LIMIT_BYTES, posixOperations;
-var init_posix = __esm({
-  "src/util/platform/posix.ts"() {
+var PROCESS_TABLE_TIMEOUT_MILLISECONDS, PROCESS_TABLE_OUTPUT_LIMIT_BYTES, posixOperations2;
+var init_posix2 = __esm({
+  "src/util/process/platform/posix.ts"() {
     "use strict";
-    init_path_error();
     PROCESS_TABLE_TIMEOUT_MILLISECONDS = 1e3;
     PROCESS_TABLE_OUTPUT_LIMIT_BYTES = 1024 * 1024;
-    posixOperations = {
-      controlSocketPath: (installationHash) => join10(tmpdir(), `mobius-${installationHash}.sock`),
-      prepareControlSocket: removeControlSocket,
-      secureControlSocket: async (path8) => {
-        await chmod(path8, 384);
-      },
-      removeControlSocket,
+    posixOperations2 = {
       pathDelimiter: ":",
       environmentValue: (environment, name2) => environment[name2],
       executableExtensions: () => [""],
@@ -70556,26 +70799,15 @@ var init_posix = __esm({
       executableLaunch: (command, args) => ({ command, arguments: args }),
       spawnOptions: { detached: true, windowsHide: true },
       signalCapturedProcesses,
-      terminateProcess,
-      validatePathPermissions: async (path8, directory, privateAccess, signal) => {
-        signal.throwIfAborted();
-        const metadata = await lstat2(path8);
-        if (process.getuid === void 0 || metadata.uid !== process.getuid()) {
-          throw new LocalPathError("Path is not user-owned");
-        }
-        if (privateAccess) {
-          await chmod(path8, directory ? 448 : 384);
-        }
-        signal.throwIfAborted();
-      }
+      terminateProcess
     };
   }
 });
 
-// src/util/platform/linux.ts
-import { constants as constants4, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+// src/util/process/platform/linux.ts
+import { constants as constants4, readdirSync as readdirSync3, readFileSync as readFileSync2 } from "node:fs";
 import { access as access3, readdir as readdir4, readFile as readFile4, realpath as realpath4, stat as stat4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { join as join15 } from "node:path";
 function appendLinuxProcessTableEntry(entries, processId, encoded) {
   const closingParenthesis = encoded.lastIndexOf(")");
   if (!encoded.startsWith(`${processId.toString()} (`) || closingParenthesis < 0) {
@@ -70605,7 +70837,7 @@ async function readLinuxProcessTable() {
         appendLinuxProcessTableEntry(
           entries,
           processId,
-          await readFile4(join11("/proc", directory.name, "stat"), "utf8")
+          await readFile4(join15("/proc", directory.name, "stat"), "utf8")
         );
       } catch {
       }
@@ -70617,7 +70849,7 @@ async function readLinuxProcessTable() {
 function readLinuxProcessTableSynchronously() {
   const entries = [];
   try {
-    const directories = readdirSync2("/proc", { withFileTypes: true });
+    const directories = readdirSync3("/proc", { withFileTypes: true });
     for (const directory of directories) {
       if (!directory.isDirectory() || !/^\d+$/.test(directory.name)) {
         continue;
@@ -70630,7 +70862,7 @@ function readLinuxProcessTableSynchronously() {
         appendLinuxProcessTableEntry(
           entries,
           processId,
-          readFileSync2(join11("/proc", directory.name, "stat"), "utf8")
+          readFileSync2(join15("/proc", directory.name, "stat"), "utf8")
         );
       } catch {
       }
@@ -70663,7 +70895,7 @@ async function readLinuxProcessTableWithFallback() {
 }
 function processExists2(processId) {
   try {
-    const encoded = readFileSync2(join11("/proc", processId.toString(), "stat"), "utf8");
+    const encoded = readFileSync2(join15("/proc", processId.toString(), "stat"), "utf8");
     const closingParenthesis = encoded.lastIndexOf(")");
     if (closingParenthesis >= 0) {
       const processState = encoded.slice(closingParenthesis + 1).trimStart().charAt(0);
@@ -70675,89 +70907,31 @@ function processExists2(processId) {
   }
   return processExists(processId);
 }
-var linuxPlatform;
-var init_linux = __esm({
-  "src/util/platform/linux.ts"() {
+var linuxProcessPlatform;
+var init_linux2 = __esm({
+  "src/util/process/platform/linux.ts"() {
     "use strict";
-    init_posix();
-    linuxPlatform = {
-      ...posixOperations,
+    init_posix2();
+    linuxProcessPlatform = {
+      ...posixOperations2,
       readProcessTable: readLinuxProcessTableWithFallback,
       readProcessTableSynchronously: readLinuxProcessTableSynchronously,
-      processExists: processExists2,
-      claudeCodeExecutablePaths: (environment) => {
-        const homeDirectory = environment["HOME"];
-        return homeDirectory !== void 0 && isAbsolute5(homeDirectory) ? [join11(homeDirectory, ".local", "bin", "claude")] : [];
-      }
+      processExists: processExists2
     };
   }
 });
 
-// src/util/platform/claude-desktop.ts
-import { readdirSync as readdirSync3 } from "node:fs";
-import { join as join12 } from "node:path";
-function installedDirectories(directory) {
-  try {
-    return readdirSync3(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch (cause) {
-    if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR" || cause.code === "EACCES")) {
-      return [];
-    }
-    throw cause;
-  }
-}
-function claudeDesktopExecutablePaths(roots, executablePaths) {
-  const paths = [];
-  for (const root of roots) {
-    const versions = installedDirectories(root).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2)).toSorted((left, right) => right.localeCompare(left, "en", { numeric: true }));
-    for (const version2 of versions) {
-      const directory = join12(root, version2);
-      const installations = [
-        directory,
-        ...installedDirectories(directory).map((build) => join12(directory, build))
-      ];
-      for (const installation of installations) {
-        for (const executablePath of executablePaths) {
-          paths.push(join12(installation, ...executablePath));
-        }
-      }
-    }
-  }
-  return paths;
-}
-var init_claude_desktop = __esm({
-  "src/util/platform/claude-desktop.ts"() {
-    "use strict";
-  }
-});
-
-// src/util/platform/macos.ts
-import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
-var macosPlatform;
-var init_macos = __esm({
-  "src/util/platform/macos.ts"() {
+// src/util/process/platform/macos.ts
+var macosProcessPlatform;
+var init_macos2 = __esm({
+  "src/util/process/platform/macos.ts"() {
     "use strict";
-    init_claude_desktop();
-    init_posix();
-    macosPlatform = {
-      ...posixOperations,
+    init_posix2();
+    macosProcessPlatform = {
+      ...posixOperations2,
       readProcessTable: () => readProcessTableWithPs("/bin/ps"),
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: (environment) => {
-        const paths = ["/opt/homebrew/bin/claude", "/usr/local/bin/claude"];
-        const homeDirectory = environment["HOME"];
-        if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
-          paths.unshift(join13(homeDirectory, ".local", "bin", "claude"));
-          paths.push(
-            ...claudeDesktopExecutablePaths(
-              [join13(homeDirectory, "Library", "Application Support", "Claude", "claude-code")],
-              [["claude.app", "Contents", "MacOS", "claude"], ["claude"]]
-            )
-          );
-        }
-        return paths;
-      }
+      processExists
     };
   }
 });
@@ -70778,36 +70952,18 @@ var init_process_error = __esm({
   }
 });
 
-// src/util/platform/windows.ts
-import { execFile as execFile3 } from "node:child_process";
+// src/util/process/platform/windows.ts
+import { execFile as execFile4 } from "node:child_process";
 import { readFile as readFile5, realpath as realpath5 } from "node:fs/promises";
-import { dirname as dirname7, extname, isAbsolute as isAbsolute7, join as join14, resolve as resolve8 } from "node:path";
-import { promisify as promisify2 } from "node:util";
-function environmentValue(environment, name2) {
+import { dirname as dirname7, extname, join as join16, resolve as resolve8 } from "node:path";
+function environmentValue2(environment, name2) {
   return Object.entries(environment).find(([key]) => key.toUpperCase() === name2.toUpperCase())?.[1];
 }
-function desktopClaudeExecutablePaths(environment) {
-  const roots = [];
-  const localAppData = environmentValue(environment, "LOCALAPPDATA");
-  if (localAppData !== void 0 && isAbsolute7(localAppData)) {
-    const dataDirectory = join14(localAppData, "Claude-Data");
-    for (const installation of installedDirectories(dataDirectory)) {
-      if (installation.startsWith("claude_")) {
-        roots.push(join14(dataDirectory, installation, "claude-code"));
-      }
-    }
-  }
-  const appData = environmentValue(environment, "APPDATA");
-  if (appData !== void 0 && isAbsolute7(appData)) {
-    roots.push(join14(appData, "Claude", "claude-code"));
-  }
-  return claudeDesktopExecutablePaths(roots, [["claude.exe"]]);
-}
 function executableExtensions(executableName, environment) {
   if (/\.[a-zA-Z0-9]+$/.test(executableName)) {
     return [""];
   }
-  const configured = environmentValue(environment, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD";
+  const configured = environmentValue2(environment, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD";
   const extensions = configured.split(";").map((extension) => extension.trim()).filter((extension) => extension.length > 0).map((extension) => extension.startsWith(".") ? extension : `.${extension}`);
   return extensions.length > 0 ? extensions : [".EXE"];
 }
@@ -70855,13 +71011,13 @@ function executableLaunch(command, args) {
   return { command, arguments: args };
 }
 function readProcessTable() {
-  const systemRoot = environmentValue(process.env, "SystemRoot");
+  const systemRoot = environmentValue2(process.env, "SystemRoot");
   if (systemRoot === void 0) {
     return Promise.resolve([]);
   }
   return new Promise((resolveTable) => {
-    execFile3(
-      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    execFile4(
+      join16(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
       [
         "-NoLogo",
         "-NoProfile",
@@ -70894,132 +71050,50 @@ function terminateProcess2(child, signal) {
   }
   child.kill(signal);
 }
-async function validatePathPermissions(path8, _directory, privateAccess, signal) {
-  signal.throwIfAborted();
-  const systemRoot = environmentValue(process.env, "SystemRoot");
-  if (systemRoot === void 0) {
-    throw new LocalPathError("Windows system directory is unavailable");
-  }
-  try {
-    await execute(
-      join14(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-      [
-        "-NoLogo",
-        "-NoProfile",
-        "-NonInteractive",
-        "-EncodedCommand",
-        Buffer.from(windowsPermissions, "utf16le").toString("base64")
-      ],
-      {
-        env: {
-          ...process.env,
-          MOBIUS_PERMISSION_PATH: path8,
-          MOBIUS_PERMISSION_PRIVATE: privateAccess ? "1" : "0"
-        },
-        windowsHide: true,
-        signal: AbortSignal.any([signal, AbortSignal.timeout(windowsPermissionsTimeoutMs)]),
-        timeout: windowsPermissionsTimeoutMs,
-        maxBuffer: 16384
-      }
-    );
-  } catch (cause) {
-    signal.throwIfAborted();
-    throw new LocalPathError("The local path permissions could not be secured", { cause });
-  }
-}
-var execute, windowsPermissions, windowsPermissionsTimeoutMs, windowsPlatform;
-var init_windows = __esm({
-  "src/util/platform/windows.ts"() {
+var windowsProcessPlatform;
+var init_windows2 = __esm({
+  "src/util/process/platform/windows.ts"() {
     "use strict";
-    init_path_error();
     init_process_error();
-    init_claude_desktop();
-    init_posix();
-    execute = promisify2(execFile3);
-    windowsPermissions = `
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-$item = Get-Item -LiteralPath $env:MOBIUS_PERMISSION_PATH -Force
-if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Unsafe path' }
-$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
-$acl = $item.GetAccessControl()
-$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
-if ($owner -ne $sid -and -not ($owner.Value -eq 'S-1-5-32-544' -and ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) { throw 'Path is not user-owned' }
-if ($env:MOBIUS_PERMISSION_PRIVATE -eq '1') {
-    if ($item.PSIsContainer) {
-        $private = New-Object Security.AccessControl.DirectorySecurity
-        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
-    } else {
-        $private = New-Object Security.AccessControl.FileSecurity
-        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow')
-    }
-    $private.SetOwner($sid)
-    $private.SetAccessRuleProtection($true, $false)
-    $private.AddAccessRule($rule)
-    $item.SetAccessControl($private)
-}
-`;
-    windowsPermissionsTimeoutMs = 3e4;
-    windowsPlatform = {
-      controlSocketPath: (installationHash) => `\\\\.\\pipe\\mobius-${installationHash}`,
-      prepareControlSocket: async () => {
-      },
-      secureControlSocket: async () => {
-      },
-      removeControlSocket: async () => {
-      },
+    init_posix2();
+    windowsProcessPlatform = {
       pathDelimiter: ";",
-      environmentValue,
+      environmentValue: environmentValue2,
       executableExtensions,
       resolveExecutableTarget,
       executableLaunch,
       spawnOptions: { detached: false, windowsHide: true },
       signalCapturedProcesses: signalCapturedProcesses2,
       terminateProcess: terminateProcess2,
-      validatePathPermissions,
       readProcessTable,
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: (environment) => {
-        const paths = [];
-        const userProfile = environmentValue(environment, "USERPROFILE");
-        if (userProfile !== void 0 && isAbsolute7(userProfile)) {
-          paths.push(join14(userProfile, ".local", "bin", "claude.exe"));
-        }
-        const localAppData = environmentValue(environment, "LOCALAPPDATA");
-        if (localAppData !== void 0 && isAbsolute7(localAppData)) {
-          paths.push(join14(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"));
-        }
-        paths.push(...desktopClaudeExecutablePaths(environment));
-        return paths;
-      }
+      processExists
     };
   }
 });
 
-// src/util/platform/index.ts
-function platformSupportFor(platform2) {
-  return platforms.get(platform2) ?? fallbackPlatform;
+// src/util/process/platform/index.ts
+function processPlatformSupportFor(platform2) {
+  return platforms2.get(platform2) ?? fallbackPlatform2;
 }
-var fallbackPlatform, platforms;
-var init_platform = __esm({
-  "src/util/platform/index.ts"() {
+var fallbackPlatform2, platforms2;
+var init_platform2 = __esm({
+  "src/util/process/platform/index.ts"() {
     "use strict";
-    init_linux();
-    init_macos();
-    init_posix();
-    init_windows();
-    fallbackPlatform = {
-      ...posixOperations,
+    init_linux2();
+    init_macos2();
+    init_posix2();
+    init_windows2();
+    fallbackPlatform2 = {
+      ...posixOperations2,
       readProcessTable: () => readProcessTableWithPs("/usr/bin/ps"),
       readProcessTableSynchronously: () => [],
-      processExists,
-      claudeCodeExecutablePaths: () => []
+      processExists
     };
-    platforms = /* @__PURE__ */ new Map([
-      ["linux", linuxPlatform],
-      ["darwin", macosPlatform],
-      ["win32", windowsPlatform]
+    platforms2 = /* @__PURE__ */ new Map([
+      ["linux", linuxProcessPlatform],
+      ["darwin", macosProcessPlatform],
+      ["win32", windowsProcessPlatform]
     ]);
   }
 });
@@ -71027,11 +71101,11 @@ var init_platform = __esm({
 // src/util/process/executable.ts
 import { spawn as spawn3 } from "node:child_process";
 import { stat as stat5 } from "node:fs/promises";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { join as join17, resolve as resolve9 } from "node:path";
 async function resolveExecutablePath(requestedPath2, platform2 = process.platform) {
   const absoluteRequestedPath = resolve9(requestedPath2);
   try {
-    const resolvedPath = await platformSupportFor(platform2).resolveExecutableTarget(absoluteRequestedPath);
+    const resolvedPath = await processPlatformSupportFor(platform2).resolveExecutableTarget(absoluteRequestedPath);
     const metadata = await stat5(resolvedPath);
     if (!metadata.isFile()) {
       return null;
@@ -71051,7 +71125,7 @@ async function resolveExecutablePath(requestedPath2, platform2 = process.platfor
   }
 }
 async function findExecutableOnPath(executableName, environment, platform2 = process.platform) {
-  const support = platformSupportFor(platform2);
+  const support = processPlatformSupportFor(platform2);
   const encodedPath = support.environmentValue(environment, "PATH") ?? "";
   const separator = support.pathDelimiter;
   const extensions = support.executableExtensions(executableName, environment);
@@ -71060,7 +71134,7 @@ async function findExecutableOnPath(executableName, environment, platform2 = pro
       continue;
     }
     for (const extension of extensions) {
-      const requestedPath2 = resolve9(join15(entry, `${executableName}${extension}`));
+      const requestedPath2 = resolve9(join17(entry, `${executableName}${extension}`));
       const executable = await resolveExecutablePath(requestedPath2, platform2);
       if (executable !== null) {
         return executable;
@@ -71309,10 +71383,10 @@ var hostPlatform, DEFAULT_OUTPUT_LIMIT_BYTES, PROCESS_GRACEFUL_STOP_TIMEOUT_MILL
 var init_executable = __esm({
   "src/util/process/executable.ts"() {
     "use strict";
-    init_platform();
+    init_platform2();
     init_process_error();
     init_process_error();
-    hostPlatform = platformSupportFor(process.platform);
+    hostPlatform = processPlatformSupportFor(process.platform);
     DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
     PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1e3;
     PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5e3;
@@ -73958,7 +74032,7 @@ function decodeZodValue(value, schema) {
 function encodeZodMessage(message, schema) {
   return JSON.stringify(decodeZodValue(message, schema));
 }
-var ProtocolMessageError, UnsupportedProtocolMessageKindError;
+var ProtocolMessageError;
 var init_message_codec = __esm({
   "../mobius-sdk/src/protocol/shared/message-codec.ts"() {
     "use strict";
@@ -73971,17 +74045,6 @@ var init_message_codec = __esm({
         this.name = "ProtocolMessageError";
       }
     };
-    UnsupportedProtocolMessageKindError = class extends Error {
-      code = "unsupported_protocol_message_kind";
-      direction;
-      messageKind;
-      constructor(direction, messageKind) {
-        super(`Unsupported ${direction} message kind: ${messageKind}`);
-        this.name = "UnsupportedProtocolMessageKindError";
-        this.direction = direction;
-        this.messageKind = messageKind;
-      }
-    };
   }
 });
 
@@ -75278,6 +75341,86 @@ var init_native = __esm({
 });
 
 // ../mobius-sdk/src/protocol/session/observability/event-log.ts
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasUnknownDiscriminator(value, key, known) {
+  if (!isRecord4(value)) {
+    return false;
+  }
+  const variant = value[key];
+  return typeof variant === "string" && !known.has(variant);
+}
+function containsUnknownContentBlock(value) {
+  return hasUnknownDiscriminator(value, "type", knownContentBlockTypes);
+}
+function containsUnknownToolCallContent(value) {
+  if (hasUnknownDiscriminator(value, "type", knownToolCallContentTypes)) {
+    return true;
+  }
+  return isRecord4(value) && value["type"] === "content" && containsUnknownContentBlock(value["content"]);
+}
+function arrayContainsUnknown(value, predicate) {
+  return Array.isArray(value) && value.some(predicate);
+}
+function containsUnknownAcpVariant(payload) {
+  const update = payload["sessionUpdate"];
+  if (typeof update !== "string") {
+    return false;
+  }
+  if (!knownSessionUpdates.has(update)) {
+    return true;
+  }
+  if (["user_message_chunk", "agent_message_chunk", "agent_thought_chunk", "compaction_summary_chunk"].includes(
+    update
+  )) {
+    return containsUnknownContentBlock(payload["content"]);
+  }
+  if (update === "tool_call" || update === "tool_call_update") {
+    return arrayContainsUnknown(payload["content"], containsUnknownToolCallContent);
+  }
+  if (update === "plan_update") {
+    return hasUnknownDiscriminator(payload["plan"], "type", knownPlanTypes);
+  }
+  if (update === "config_option_update") {
+    return arrayContainsUnknown(
+      payload["configOptions"],
+      (option) => hasUnknownDiscriminator(option, "type", knownConfigOptionTypes)
+    );
+  }
+  if (update === "compaction_update") {
+    return arrayContainsUnknown(payload["summary"], containsUnknownContentBlock);
+  }
+  return false;
+}
+function isKnownSessionEventVariant(value) {
+  if (!isRecord4(value)) {
+    return true;
+  }
+  const type = value["type"];
+  if (typeof type !== "string") {
+    return true;
+  }
+  if (type === "acp") {
+    const payload = value["payload"];
+    return !isRecord4(payload) || !containsUnknownAcpVariant(payload);
+  }
+  if (type === "lifecycle-metadata") {
+    const payload = value["payload"];
+    if (!isRecord4(payload)) {
+      return true;
+    }
+    const kind = payload["kind"];
+    if (typeof kind === "string" && !knownLifecycleKinds.has(kind)) {
+      return false;
+    }
+    return kind !== "prompt.requested" || !arrayContainsUnknown(payload["content"], containsUnknownContentBlock);
+  }
+  return false;
+}
+function filterKnownSessionEventVariants(events) {
+  return Array.isArray(events) ? events.filter(isKnownSessionEventVariant) : events;
+}
 function inputValue(value) {
   if (typeof value !== "string") {
     return value;
@@ -75300,7 +75443,22 @@ function decode4(value, schema) {
 function encode3(value, schema) {
   return JSON.stringify(decode4(value, schema));
 }
-var MAX_EVENT_COUNT, MAX_COLLECTION_SIZE2, MAX_CONTENT_LENGTH2, SESSION_EVENT_KIND, SESSION_EVENT_BATCH_MAX_SIZE, boundedString2, shortString, externalContentKeySchema, annotationsSchema, contentFields, textContentSchema, imageContentSchema, audioContentSchema, externalImageContentSchema, externalAudioContentSchema, externalResourceContentSchema, resourceLinkSchema, textResourceSchema, blobResourceSchema, embeddedResourceSchema, contentBlockSchema, toolCallContentSchema, toolKindSchema, toolStatusSchema, backgroundTaskSchema, toolPatchFields, planEntrySchema, planContentSchema, commandSchema, configSelectOptionSchema, configSelectGroupSchema, configBaseFields, sessionConfigOptionSchema2, contentChunkFields, acpSessionUpdateSchema, lifecycleBase, promptExecutionContextSchema, lifecycleMetadataSchema, sessionEventPayloadSchema, positionSchema, sharedSessionEventFields, sessionLiveEventFields, sessionEventSchema, sessionLiveEventSchema, wireLifecyclePayloadSchema, wireEventFields, sessionWireEventSchema, sessionWireEnvelopeSchema, sessionEventBatchSchema, sessionLiveEventBatchSchema, sessionExportSchema, mobiusSessionExportSchema, sessionEventEnvelopeSchema, sessionEventLogPageSchema, sessionEventOmissionSchema, nativeEventPageRequestSchema, queuedPromptRequestEventLogSchema, nativeSessionEventsSchema, decodeSessionEvent, decodeSessionEventEnvelope, encodeSessionEventEnvelope, decodeAcpSessionUpdate;
+function sanitizeKnownNativeSessionEvents(value) {
+  const input2 = inputValue(value);
+  if (!isRecord4(input2)) {
+    return input2;
+  }
+  const page = input2["events"];
+  const queuedPromptRequests = input2["queuedPromptRequests"];
+  return {
+    ...input2,
+    events: isRecord4(page) ? { ...page, events: filterKnownSessionEventVariants(page["events"]) } : page,
+    queuedPromptRequests: Array.isArray(queuedPromptRequests) ? queuedPromptRequests.filter(
+      (prompt) => !isRecord4(prompt) || !arrayContainsUnknown(prompt["content"], containsUnknownContentBlock)
+    ) : queuedPromptRequests
+  };
+}
+var MAX_EVENT_COUNT, MAX_COLLECTION_SIZE2, MAX_CONTENT_LENGTH2, SESSION_EVENT_KIND, SESSION_EVENT_BATCH_MAX_SIZE, boundedString2, shortString, externalContentKeySchema, annotationsSchema, contentFields, textContentSchema, imageContentSchema, audioContentSchema, externalImageContentSchema, externalAudioContentSchema, externalResourceContentSchema, resourceLinkSchema, textResourceSchema, blobResourceSchema, embeddedResourceSchema, contentBlockSchema, toolCallContentSchema, toolKindSchema, toolStatusSchema, backgroundTaskSchema, toolPatchFields, planEntrySchema, planContentSchema, commandSchema, configSelectOptionSchema, configSelectGroupSchema, configBaseFields, sessionConfigOptionSchema2, contentChunkFields, acpSessionUpdateSchema, lifecycleBase, promptExecutionContextSchema, lifecycleMetadataSchema, sessionEventPayloadSchema, positionSchema, sharedSessionEventFields, sessionLiveEventFields, sessionEventSchema, sessionLiveEventSchema, wireLifecyclePayloadSchema, wireEventFields, sessionWireEventSchema, sessionWireEnvelopeSchema, knownContentBlockTypes, knownToolCallContentTypes, knownPlanTypes, knownConfigOptionTypes, knownSessionUpdates, knownLifecycleKinds, sessionEventBatchSchema, sessionLiveEventBatchSchema, sessionExportSchema, mobiusSessionExportSchema, sessionEventEnvelopeSchema, sessionEventLogPageSchema, sessionEventOmissionSchema, nativeEventPageRequestSchema, queuedPromptRequestEventLogSchema, nativeSessionEventsSchema, knownSessionLiveEventBatchSchema, decodeSessionEvent, decodeKnownSessionEventPayload, decodeSessionEventEnvelope, encodeSessionEventEnvelope, decodeAcpSessionUpdate, decodeKnownNativeSessionEvents;
 var init_event_log = __esm({
   "../mobius-sdk/src/protocol/session/observability/event-log.ts"() {
     "use strict";
@@ -75642,7 +75800,49 @@ var init_event_log = __esm({
     sessionWireEnvelopeSchema = external_exports.object({
       kind: external_exports.literal(SESSION_EVENT_KIND),
       events: external_exports.array(sessionWireEventSchema).min(1).max(SESSION_EVENT_BATCH_MAX_SIZE).readonly()
-    }).readonly();
+    }).passthrough().readonly();
+    knownContentBlockTypes = /* @__PURE__ */ new Set([
+      "text",
+      "image",
+      "audio",
+      "resource_link",
+      "resource",
+      "external_image",
+      "external_audio",
+      "external_resource"
+    ]);
+    knownToolCallContentTypes = /* @__PURE__ */ new Set(["content", "diff", "terminal"]);
+    knownPlanTypes = /* @__PURE__ */ new Set(["items", "file", "markdown"]);
+    knownConfigOptionTypes = /* @__PURE__ */ new Set(["select", "boolean"]);
+    knownSessionUpdates = /* @__PURE__ */ new Set([
+      "user_message_chunk",
+      "agent_message_chunk",
+      "agent_thought_chunk",
+      "tool_call",
+      "tool_call_update",
+      "plan",
+      "plan_update",
+      "plan_removed",
+      "available_commands_update",
+      "current_mode_update",
+      "config_option_update",
+      "session_info_update",
+      "usage_update",
+      "compaction_update",
+      "compaction_summary_chunk"
+    ]);
+    knownLifecycleKinds = /* @__PURE__ */ new Set([
+      "session.queue.changed",
+      "session.permission.requested",
+      "session.permission.resolved",
+      "session.elicitation.requested",
+      "session.elicitation.resolved",
+      "prompt.requested",
+      "prompt.started",
+      "prompt.completed",
+      "prompt.failed-before-start",
+      "prompt.failed"
+    ]);
     sessionEventBatchSchema = external_exports.array(sessionEventSchema).min(1).max(SESSION_EVENT_BATCH_MAX_SIZE).readonly();
     sessionLiveEventBatchSchema = external_exports.array(sessionLiveEventSchema).min(1).max(SESSION_EVENT_BATCH_MAX_SIZE).readonly();
     sessionExportSchema = external_exports.object({
@@ -75706,10 +75906,13 @@ var init_event_log = __esm({
       events: sessionEventLogPageSchema,
       queuedPromptRequests: external_exports.array(queuedPromptRequestEventLogSchema).max(MAX_COLLECTION_SIZE2).readonly()
     }).readonly();
+    knownSessionLiveEventBatchSchema = external_exports.array(sessionLiveEventSchema).max(SESSION_EVENT_BATCH_MAX_SIZE).readonly();
     decodeSessionEvent = (value) => decode4(value, sessionEventSchema);
+    decodeKnownSessionEventPayload = (value) => isKnownSessionEventVariant(value) ? decode4(value, sessionEventPayloadSchema) : null;
     decodeSessionEventEnvelope = (value) => decode4(value, sessionEventEnvelopeSchema);
     encodeSessionEventEnvelope = (value) => encode3(value, sessionEventEnvelopeSchema);
     decodeAcpSessionUpdate = (value) => decode4(value, acpSessionUpdateSchema);
+    decodeKnownNativeSessionEvents = (value) => decode4(sanitizeKnownNativeSessionEvents(value), nativeSessionEventsSchema);
   }
 });
 
@@ -75722,7 +75925,18 @@ function decode5(schema, encoded) {
     throw new ProtocolMessageError("Invalid live Session history message", { cause });
   }
 }
-var SESSION_HISTORY_PAGE_LOAD_KIND, SESSION_HISTORY_PAGE_LOADED_KIND, SESSION_PREVIEW_HISTORY_PAGE_LOAD_KIND, SESSION_PREVIEW_HISTORY_PAGE_LOADED_KIND, pageRequestFields, sessionHistoryPageLoadSchema, sessionPreviewHistoryPageLoadSchema, pageLoadedFields, sessionHistoryPageLoadedSchema, sessionPreviewHistoryPageLoadedSchema, decodeSessionHistoryPageLoad, decodeSessionHistoryPageLoaded, decodeSessionPreviewHistoryPageLoad, decodeSessionPreviewHistoryPageLoaded, encodeSessionHistoryPageLoad, encodeSessionHistoryPageLoaded, encodeSessionPreviewHistoryPageLoad, encodeSessionPreviewHistoryPageLoaded;
+function decodeLoaded(schema, encoded) {
+  try {
+    const value = JSON.parse(encoded);
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return schema.parse(value);
+    }
+    return schema.parse({ ...value, events: decodeKnownNativeSessionEvents(Reflect.get(value, "events")) });
+  } catch (cause) {
+    throw new ProtocolMessageError("Invalid live Session history message", { cause });
+  }
+}
+var SESSION_HISTORY_PAGE_LOAD_KIND, SESSION_HISTORY_PAGE_LOADED_KIND, SESSION_PREVIEW_HISTORY_PAGE_LOAD_KIND, SESSION_PREVIEW_HISTORY_PAGE_LOADED_KIND, pageRequestFields, sessionHistoryPageLoadSchema, sessionPreviewHistoryPageLoadSchema, pageLoadedFields, sessionHistoryPageLoadedSchema, sessionPreviewHistoryPageLoadedSchema, wireNativeSessionEventsSchema, sessionHistoryWirePageLoadedSchema, sessionPreviewHistoryWirePageLoadedSchema, decodeSessionHistoryPageLoad, decodeSessionHistoryPageLoaded, decodeSessionPreviewHistoryPageLoad, decodeSessionPreviewHistoryPageLoaded, encodeSessionHistoryPageLoad, encodeSessionHistoryPageLoaded, encodeSessionPreviewHistoryPageLoad, encodeSessionPreviewHistoryPageLoaded;
 var init_history2 = __esm({
   "../mobius-sdk/src/protocol/session/observability/history.ts"() {
     "use strict";
@@ -75759,10 +75973,34 @@ var init_history2 = __esm({
     };
     sessionHistoryPageLoadedSchema = external_exports.object({ ...pageLoadedFields, kind: external_exports.literal(SESSION_HISTORY_PAGE_LOADED_KIND) }).readonly();
     sessionPreviewHistoryPageLoadedSchema = external_exports.object({ ...pageLoadedFields, kind: external_exports.literal(SESSION_PREVIEW_HISTORY_PAGE_LOADED_KIND) }).readonly();
+    wireNativeSessionEventsSchema = external_exports.object({
+      events: external_exports.object({
+        events: external_exports.array(external_exports.unknown()).max(1e4).readonly(),
+        nextCursor: external_exports.string().min(1).max(512).nullable(),
+        sessionGenerationId: identifierStringSchema,
+        tailCursor: external_exports.string().max(512),
+        throughPosition: external_exports.string().regex(/^(0|[1-9][0-9]*)$/u).optional(),
+        truncated: external_exports.boolean(),
+        version: external_exports.literal(2)
+      }).passthrough().readonly(),
+      queuedPromptRequests: external_exports.array(external_exports.unknown()).max(1e3).readonly()
+    }).passthrough().readonly();
+    sessionHistoryWirePageLoadedSchema = external_exports.object({
+      events: wireNativeSessionEventsSchema,
+      kind: external_exports.literal(SESSION_HISTORY_PAGE_LOADED_KIND),
+      requestId: identifierStringSchema,
+      sessionId: identifierStringSchema
+    }).passthrough().readonly();
+    sessionPreviewHistoryWirePageLoadedSchema = external_exports.object({
+      events: wireNativeSessionEventsSchema,
+      kind: external_exports.literal(SESSION_PREVIEW_HISTORY_PAGE_LOADED_KIND),
+      requestId: identifierStringSchema,
+      sessionId: identifierStringSchema
+    }).passthrough().readonly();
     decodeSessionHistoryPageLoad = (encoded) => decode5(sessionHistoryPageLoadSchema, encoded);
-    decodeSessionHistoryPageLoaded = (encoded) => decode5(sessionHistoryPageLoadedSchema, encoded);
+    decodeSessionHistoryPageLoaded = (encoded) => decodeLoaded(sessionHistoryPageLoadedSchema, encoded);
     decodeSessionPreviewHistoryPageLoad = (encoded) => decode5(sessionPreviewHistoryPageLoadSchema, encoded);
-    decodeSessionPreviewHistoryPageLoaded = (encoded) => decode5(sessionPreviewHistoryPageLoadedSchema, encoded);
+    decodeSessionPreviewHistoryPageLoaded = (encoded) => decodeLoaded(sessionPreviewHistoryPageLoadedSchema, encoded);
     encodeSessionHistoryPageLoad = (value) => JSON.stringify(sessionHistoryPageLoadSchema.parse(value));
     encodeSessionHistoryPageLoaded = (value) => JSON.stringify(sessionHistoryPageLoadedSchema.parse(value));
     encodeSessionPreviewHistoryPageLoad = (value) => JSON.stringify(sessionPreviewHistoryPageLoadSchema.parse(value));
@@ -76094,7 +76332,7 @@ var init_turn_history = __esm({
 });
 
 // ../mobius-sdk/src/protocol/session/recording/webhooks.ts
-var isoTimestamp2, shortText2, promptSucceededOutcome2, promptCancelledOutcome2, promptFailedOutcome2, sessionStatusWebhookCommandSchema, sessionStatusWebhookBodySchema;
+var isoTimestamp2, shortText2, promptSucceededOutcome2, promptCancelledOutcome2, promptFailedOutcome2, sessionStatusWebhookCommandSchema, sessionStatusWebhookBodyFields, sessionStatusWebhookBodySchema, consumedSessionStatusWebhookBodySchema;
 var init_webhooks = __esm({
   "../mobius-sdk/src/protocol/session/recording/webhooks.ts"() {
     "use strict";
@@ -76127,13 +76365,20 @@ var init_webhooks = __esm({
         outcome: external_exports.literal("failed")
       }).readonly()
     ]);
-    sessionStatusWebhookBodySchema = external_exports.object({
+    sessionStatusWebhookBodyFields = {
       appId: identifierStringSchema,
-      commands: external_exports.array(sessionStatusWebhookCommandSchema).min(1).readonly(),
       projectId: identifierStringSchema,
       runtimeId: identifierStringSchema,
       sessionId: identifierStringSchema,
       status: sessionRecordingStatusSchema
+    };
+    sessionStatusWebhookBodySchema = external_exports.object({
+      ...sessionStatusWebhookBodyFields,
+      commands: external_exports.array(sessionStatusWebhookCommandSchema).min(1).readonly()
+    }).readonly();
+    consumedSessionStatusWebhookBodySchema = external_exports.object({
+      ...sessionStatusWebhookBodyFields,
+      commands: external_exports.array(sessionStatusWebhookCommandSchema).readonly()
     }).readonly();
   }
 });
@@ -76251,18 +76496,32 @@ function defineMessageSignature(kind, encoder, decoder) {
     schema
   };
 }
-function decodeServiceToDaemonMessage(encoded) {
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasUnknownDiscriminator2(value, key, known) {
+  if (!isRecord5(value)) {
+    return false;
+  }
+  const variant = value[key];
+  return typeof variant === "string" && !known.has(variant);
+}
+function hasUnknownServiceVariant(kind, value) {
+  return kind === NATIVE_SESSION_REQUEST_KIND && hasUnknownDiscriminator2(value, "action", knownNativeActions);
+}
+function decodeKnownServiceToDaemonMessage(encoded) {
   const kind = decodeMessageKind(encoded);
   const signature = serviceToDaemonRegistry[kind];
   if (signature === void 0) {
-    throw new UnsupportedProtocolMessageKindError("service-to-daemon", kind);
+    return null;
   }
-  return signature.decoder(encoded);
+  const value = parseJson(encoded);
+  return hasUnknownServiceVariant(kind, value) ? null : signature.decoder(encoded);
 }
 function encodeDaemonToServiceMessage(message) {
   return daemonToServiceSignatures[message.kind].encoder(message);
 }
-var serviceToDaemonSignatures, serviceToDaemonRegistry, daemonToServiceSignatures;
+var serviceToDaemonSignatures, serviceToDaemonRegistry, knownNativeActions, daemonToServiceSignatures;
 var init_daemon_transport = __esm({
   "../mobius-sdk/src/protocol/transport/daemon-transport.ts"() {
     "use strict";
@@ -76413,6 +76672,7 @@ var init_daemon_transport = __esm({
       )
     };
     serviceToDaemonRegistry = serviceToDaemonSignatures;
+    knownNativeActions = /* @__PURE__ */ new Set(["active-turn", "find", "list", "import", "fork"]);
     daemonToServiceSignatures = {
       [SESSION_CLOSED_KIND]: defineMessageSignature(
         SESSION_CLOSED_KIND,
@@ -76574,7 +76834,6 @@ var init_protocol = __esm({
     init_workspace();
     init_directory();
     init_identifier();
-    init_message_codec();
     init_daemon_transport();
   }
 });
@@ -77856,12 +78115,12 @@ var init_environment = __esm({
 });
 
 // src/acp/harness/pi/upstream/dist/acp/paths.js
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 function getPiAcpDir(environment = process.env) {
-  return join16(environmentHome(environment), ".pi", "pi-acp");
+  return join18(environmentHome(environment), ".pi", "pi-acp");
 }
 function getPiAcpSessionMapPath(environment = process.env) {
-  return join16(getPiAcpDir(environment), "session-map.json");
+  return join18(getPiAcpDir(environment), "session-map.json");
 }
 var init_paths = __esm({
   "src/acp/harness/pi/upstream/dist/acp/paths.js"() {
@@ -77917,13 +78176,13 @@ var init_pi_commands = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/pi-sessions.js
 import { closeSync as closeSync2, existsSync as existsSync4, openSync as openSync2, readdirSync as readdirSync4, readFileSync as readFileSync3, readSync as readSync2, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute10, join as join17, resolve as resolve10 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join19, resolve as resolve10 } from "node:path";
 function getPiAgentDir(environment) {
   const configured = environment["PI_CODING_AGENT_DIR"];
-  return configured ? resolve10(configured) : join17(environmentHome(environment), ".pi", "agent");
+  return configured ? resolve10(configured) : join19(environmentHome(environment), ".pi", "agent");
 }
 function readSessionDirFromSettings(agentDir) {
-  const settingsPath = join17(agentDir, "settings.json");
+  const settingsPath = join19(agentDir, "settings.json");
   try {
     if (!existsSync4(settingsPath)) {
       return null;
@@ -77944,7 +78203,7 @@ function readSessionDirFromSettings(agentDir) {
 }
 function getPiSessionsDir(environment = process.env) {
   const agentDir = getPiAgentDir(environment);
-  return readSessionDirFromSettings(agentDir) ?? join17(agentDir, "sessions");
+  return readSessionDirFromSettings(agentDir) ?? join19(agentDir, "sessions");
 }
 function getPiSessionDiscoveryDirs(environment) {
   const discoveryDirectories = [getPiSessionsDir(environment)];
@@ -77955,7 +78214,7 @@ function getPiSessionDiscoveryDirs(environment) {
       if (!entry.isDirectory()) {
         continue;
       }
-      const directory = join17(mobiusSessionsRoot, entry.name);
+      const directory = join19(mobiusSessionsRoot, entry.name);
       if (!discoveryDirectories.includes(directory)) {
         discoveryDirectories.push(directory);
       }
@@ -77972,7 +78231,7 @@ function walkJsonlFiles(dir, out2) {
   }
   for (const e of entries) {
     const name2 = typeof e.name === "string" ? e.name : String(e.name);
-    const p = join17(dir, name2);
+    const p = join19(dir, name2);
     if (e.isDirectory()) {
       walkJsonlFiles(p, out2);
     } else if (e.isFile() && name2.endsWith(".jsonl")) {
@@ -78250,7 +78509,7 @@ var init_pi_sessions = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/pi-settings.js
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join as join18, resolve as resolve11 } from "node:path";
+import { join as join20, resolve as resolve11 } from "node:path";
 function isObject2(x) {
   return Boolean(x) && typeof x === "object" && !Array.isArray(x);
 }
@@ -78279,7 +78538,7 @@ function readJsonFile(path8) {
   }
 }
 function getMergedSettings(cwd, environment) {
-  const globalSettingsPath = join18(getAgentDir(environment), "settings.json");
+  const globalSettingsPath = join20(getAgentDir(environment), "settings.json");
   const projectSettingsPath = resolve11(cwd, ".pi", "settings.json");
   const global2 = readJsonFile(globalSettingsPath);
   const project = readJsonFile(projectSettingsPath);
@@ -78287,7 +78546,7 @@ function getMergedSettings(cwd, environment) {
 }
 function getAgentDir(environment = process.env) {
   const configured = environment["PI_CODING_AGENT_DIR"];
-  return configured ? resolve11(configured) : join18(environmentHome(environment), ".pi", "agent");
+  return configured ? resolve11(configured) : join20(environmentHome(environment), ".pi", "agent");
 }
 function getEnableSkillCommands(cwd, environment = process.env) {
   const merged = getMergedSettings(cwd, environment);
@@ -78557,7 +78816,7 @@ var init_session_store = __esm({
 
 // src/acp/harness/pi/upstream/dist/acp/slash-commands.js
 import { existsSync as existsSync6, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "node:fs";
-import { join as join19, resolve as resolve12 } from "node:path";
+import { join as join21, resolve as resolve12 } from "node:path";
 function parseFrontmatter(content) {
   const frontmatter = {};
   if (!content.startsWith("---")) {
@@ -78585,7 +78844,7 @@ function loadCommandsFromDir(dir, source, subdir = "") {
   try {
     const entries = readdirSync5(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join19(dir, entry.name);
+      const fullPath = join21(dir, entry.name);
       if (entry.isDirectory()) {
         const newSubdir = subdir ? `${subdir}:${entry.name}` : entry.name;
         commands.push(...loadCommandsFromDir(fullPath, source, newSubdir));
@@ -78625,7 +78884,7 @@ function loadCommandsFromDir(dir, source, subdir = "") {
 }
 function loadSlashCommands(cwd, environment = process.env) {
   const commands = [];
-  const userDir = join19(environmentHome(environment), ".pi", "agent", "prompts");
+  const userDir = join21(environmentHome(environment), ".pi", "agent", "prompts");
   const projectDir = resolve12(cwd, ".pi", "prompts");
   commands.push(...loadCommandsFromDir(userDir, "user"));
   commands.push(...loadCommandsFromDir(projectDir, "project"));
@@ -79717,7 +79976,7 @@ var init_prompt = __esm({
 import { spawnSync } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
-import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute12, join as join20 } from "node:path";
+import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute12, join as join22 } from "node:path";
 import { RequestError as RequestError10 } from "@agentclientprotocol/sdk";
 function thinkingLevelName(id) {
   return id.split(/[_-]/u).map((part) => part.length === 0 ? part : `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}`).join(" ");
@@ -79992,7 +80251,7 @@ function buildStartupInfo(opts) {
     md.push("");
   };
   const contextItems = [];
-  const contextPath = join20(opts.cwd, "AGENTS.md");
+  const contextPath = join22(opts.cwd, "AGENTS.md");
   if (existsSync7(contextPath)) {
     contextItems.push(contextPath);
   }
@@ -80001,7 +80260,7 @@ function buildStartupInfo(opts) {
   const pushSkillFromRoot = (root) => {
     try {
       for (const e of readdirSync6(root)) {
-        const p = join20(root, e);
+        const p = join22(root, e);
         try {
           const st2 = statSync3(p);
           if (st2.isFile() && e.toLowerCase().endsWith(".md")) {
@@ -80026,7 +80285,7 @@ function buildStartupInfo(opts) {
           if (name2 === "node_modules" || name2 === ".git") {
             continue;
           }
-          const p = join20(dir, name2);
+          const p = join22(dir, name2);
           let st2;
           try {
             st2 = statSync3(p);
@@ -80043,16 +80302,16 @@ function buildStartupInfo(opts) {
     } catch {
     }
   };
-  const globalSkillsDir = join20(getAgentDir(opts.environment), "skills");
+  const globalSkillsDir = join22(getAgentDir(opts.environment), "skills");
   pushSkillFromRoot(globalSkillsDir);
   const home = opts.environment["HOME"] ?? opts.environment["USERPROFILE"] ?? "";
-  const legacyAgentsSkillsDir = join20(home, ".agents", "skills");
+  const legacyAgentsSkillsDir = join22(home, ".agents", "skills");
   pushSkillFromRoot(legacyAgentsSkillsDir);
-  const projectSkillsDir = join20(opts.cwd, ".pi", "skills");
+  const projectSkillsDir = join22(opts.cwd, ".pi", "skills");
   pushSkillFromRoot(projectSkillsDir);
   addSection("Skills", skillsItems);
   const promptsItems = [];
-  const promptsDir = join20(home, ".pi", "agent", "prompts");
+  const promptsDir = join22(home, ".pi", "agent", "prompts");
   try {
     const prompts = readdirSync6(promptsDir).filter((f) => f.endsWith(".md"));
     for (const f of prompts) {
@@ -80062,17 +80321,17 @@ function buildStartupInfo(opts) {
   }
   addSection("Prompts", promptsItems);
   const extItems = [];
-  const extDir = join20(home, ".pi", "agent", "extensions");
+  const extDir = join22(home, ".pi", "agent", "extensions");
   try {
     const exts = readdirSync6(extDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
     for (const f of exts) {
-      extItems.push(join20(extDir, f));
+      extItems.push(join22(extDir, f));
     }
   } catch {
   }
   const settingsPaths = [
-    join20(getAgentDir(opts.environment), "settings.json"),
-    join20(opts.cwd, ".pi", "settings.json")
+    join22(getAgentDir(opts.environment), "settings.json"),
+    join22(opts.cwd, ".pi", "settings.json")
   ];
   for (const settingsPath of settingsPaths) {
     try {
@@ -80663,7 +80922,7 @@ ${JSON.stringify(stats, null, 2)}`;
                 if (piPath) {
                   const resolved = realpathSync3(piPath);
                   const pkgRoot = dirname9(dirname9(resolved));
-                  const p = join20(pkgRoot, "CHANGELOG.md");
+                  const p = join22(pkgRoot, "CHANGELOG.md");
                   if (existsSync7(p)) {
                     return p;
                   }
@@ -80674,7 +80933,7 @@ ${JSON.stringify(stats, null, 2)}`;
                 const npmRoot = spawnSync("npm", ["root", "-g"], { encoding: "utf-8" });
                 const root = String(npmRoot.stdout ?? "").trim();
                 if (root) {
-                  const p = join20(root, "@earendil-works", "pi-coding-agent", "CHANGELOG.md");
+                  const p = join22(root, "@earendil-works", "pi-coding-agent", "CHANGELOG.md");
                   if (existsSync7(p)) {
                     return p;
                   }
@@ -80768,7 +81027,7 @@ ${JSON.stringify(stats, null, 2)}`;
               return { stopReason: "end_turn" };
             }
             const safeSessionId = session.sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
-            const outputPath = join20(session.cwd, `pi-session-${safeSessionId}.html`);
+            const outputPath = join22(session.cwd, `pi-session-${safeSessionId}.html`);
             let resultPath = "";
             try {
               const result2 = await session.proc.exportHtml(outputPath);
@@ -81461,7 +81720,7 @@ var init_agent_probe_error = __esm({
 
 // src/agent/specification/vendors/pi-agent.ts
 import { createHash as createHash3 } from "node:crypto";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 import {
   methods as methods7
 } from "@agentclientprotocol/sdk";
@@ -81481,7 +81740,7 @@ var init_pi_agent = __esm({
       // keeps the adapter's opt-in capability flag enabled for every launch it owns.
       createLaunchEnvironment = async (_agent, context) => {
         const workspaceHash = createHash3("sha256").update(context.defaultWorkspace).digest("hex").slice(0, 24);
-        const sessionDirectory = join21(context.dataDirectory, "agents", "pi", "sessions", workspaceHash);
+        const sessionDirectory = join23(context.dataDirectory, "agents", "pi", "sessions", workspaceHash);
         return Object.freeze({
           PI_ACP_ENABLE_EMBEDDED_CONTEXT: "true",
           MOBIUS_PI_SESSION_DIR: sessionDirectory
@@ -82393,7 +82652,7 @@ var init_native_session = __esm({
 
 // src/acp/protocol/session-config-protocol.ts
 import { methods as methods9 } from "@agentclientprotocol/sdk";
-function isRecord4(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString3(value, fallback = "") {
@@ -82424,7 +82683,7 @@ function normalizeConfigValues(value) {
   }
   const normalized = [];
   for (const entry of value) {
-    if (!isRecord4(entry)) {
+    if (!isRecord6(entry)) {
       continue;
     }
     const groupedOptions = entry["options"];
@@ -82432,7 +82691,7 @@ function normalizeConfigValues(value) {
       const groupId = readString3(entry["group"]);
       const groupName = readString3(entry["name"]);
       for (const groupedOption of groupedOptions) {
-        if (isRecord4(groupedOption)) {
+        if (isRecord6(groupedOption)) {
           const normalizedValue = normalizeConfigValue(groupedOption, groupId, groupName);
           if (normalizedValue !== void 0) {
             normalized.push(normalizedValue);
@@ -82457,7 +82716,7 @@ function normalizeConfigOptions(value, modes) {
   const normalized = [];
   if (Array.isArray(value)) {
     for (const option of value) {
-      if (!isRecord4(option)) {
+      if (!isRecord6(option)) {
         continue;
       }
       const id = truncate3(readString3(option["id"]), 128);
@@ -82497,12 +82756,12 @@ function normalizeConfigOptions(value, modes) {
       }
     }
   }
-  if (isRecord4(modes)) {
+  if (isRecord6(modes)) {
     const values = [];
     const availableModes = modes["availableModes"];
     if (Array.isArray(availableModes)) {
       for (const mode of availableModes) {
-        if (!isRecord4(mode)) {
+        if (!isRecord6(mode)) {
           continue;
         }
         const id = truncate3(readString3(mode["id"]), 500);
@@ -82535,7 +82794,7 @@ function normalizeConfigOptions(value, modes) {
   return normalized.slice(0, MAXIMUM_CONFIG_OPTIONS);
 }
 function normalizeStandardLifecycle(response) {
-  const lifecycle = isRecord4(response) ? response : {};
+  const lifecycle = isRecord6(response) ? response : {};
   return normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]);
 }
 function replaceStandardConfigOptions(current, value) {
@@ -82592,7 +82851,7 @@ var init_session_config_protocol = __esm({
           "ACP agent exited while changing session configuration",
           change.signal
         );
-        if (!isRecord4(response) || !Array.isArray(response["configOptions"])) {
+        if (!isRecord6(response) || !Array.isArray(response["configOptions"])) {
           throw new SessionConfigProtocolError("The Agent returned an invalid session configuration response");
         }
         return replaceStandardConfigOptions(current, response["configOptions"]);
@@ -84960,7 +85219,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join39(chunks, separator) {
+      function join41(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -84968,7 +85227,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join39;
+      _sql.join = join41;
       function identifier2(value) {
         return new Name(value);
       }
@@ -86926,7 +87185,7 @@ var init_select = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join39) => join39.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join41) => join41.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -88523,7 +88782,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k2, join39]) => {
+          return sql.join(withEntries.map(([k2, join41]) => {
             const relation = tableConfig.relations[k2];
             const isSingle2 = is(relation, One2);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -88534,7 +88793,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join39,
+              queryConfig: join41,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -88548,7 +88807,7 @@ var init_dialect = __esm({
               key: k2,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join39 !== true && !!join39.where
+              isOptional: (relation.optional ?? false) || join41 !== true && !!join41.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -88970,7 +89229,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on2) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join39) => join39.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join41) => join41.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on2 === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on2 = on2(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -89856,12 +90115,12 @@ var init_local_sqlite_database = __esm({
 
 // src/storage/sqlite/local-databases.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 function channelSessionDatabasePaths(stateDirectory, channelId) {
   const channelHash = createHash4("sha256").update(channelId).digest("hex");
   return {
-    events: join22(stateDirectory, "sessions", `${channelHash}.events.sqlite`),
-    sessions: join22(stateDirectory, "sessions", `${channelHash}.sqlite`)
+    events: join24(stateDirectory, "sessions", `${channelHash}.events.sqlite`),
+    sessions: join24(stateDirectory, "sessions", `${channelHash}.sqlite`)
   };
 }
 var openAcpSessionDatabase, openSessionEventCacheDatabase;
@@ -90094,13 +90353,13 @@ var init_session_event_cache_table = __esm({
 // src/storage/session/temporary-session-event-cache.ts
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 function openTemporarySessionEventCache() {
-  const directory = mkdtempSync(join23(tmpdir2(), "mobius-preview-events-"));
+  const directory = mkdtempSync(join25(tmpdir2(), "mobius-preview-events-"));
   const removeFiles = () => rmSync2(directory, { recursive: true, force: true });
   try {
     return {
-      table: new SessionEventCacheTable(openSessionEventCacheDatabase(join23(directory, "events.sqlite"))),
+      table: new SessionEventCacheTable(openSessionEventCacheDatabase(join25(directory, "events.sqlite"))),
       removeFiles
     };
   } catch (error62) {
@@ -90431,7 +90690,7 @@ function decodeBase64(data) {
   }
   return bytes;
 }
-function isRecord5(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var MAXIMUM_ENCODED_CONTENT_CHARACTERS, embeddedImageSchema, inlineImageUrlSchema, toolImageSchema, AcpContentExternalizer;
@@ -90568,13 +90827,13 @@ var init_content_externalizer = __esm({
           }
           return result2;
         }
-        if (!isRecord5(value)) {
+        if (!isRecord7(value)) {
           return value;
         }
         const image = toolImageSchema.safeParse(value);
         if (image.success && image.data.data.length > 0) {
           const prepared = await this.#content(sessionId, image.data, signal);
-          if (isRecord5(prepared.event) && typeof prepared.event["imageKey"] === "string") {
+          if (isRecord7(prepared.event) && typeof prepared.event["imageKey"] === "string") {
             images.set(prepared.event["imageKey"], prepared);
           } else {
             images.set(`unavailable:${images.size}`, prepared);
@@ -90605,7 +90864,7 @@ var init_content_externalizer = __esm({
           const prepared = await this.#content(sessionId, content, signal);
           agentContent.push({ ...item, content: prepared.agent });
           eventContent.push({ ...item, content: prepared.event });
-          if (isRecord5(prepared.event) && typeof prepared.event["imageKey"] === "string") {
+          if (isRecord7(prepared.event) && typeof prepared.event["imageKey"] === "string") {
             images.delete(prepared.event["imageKey"]);
           }
         }
@@ -90766,7 +91025,7 @@ var init_relay_authentication = __esm({
 
 // src/runtime/catalog/publish-agent-catalog.ts
 import { fetch as fetch2 } from "undici";
-function isRecord6(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isSafeRelayErrorMessage(value) {
@@ -90779,7 +91038,7 @@ async function rejectedCatalogError(response) {
   } catch {
     return new AgentCatalogPublishError("The Relay rejected the Agent catalog update");
   }
-  if (!isRecord6(value) || !isRecord6(value["error"])) {
+  if (!isRecord8(value) || !isRecord8(value["error"])) {
     return new AgentCatalogPublishError("The Relay rejected the Agent catalog update");
   }
   const code = value["error"]["code"];
@@ -90949,10 +91208,10 @@ var init_catalog2 = __esm({
 });
 
 // src/runtime/config.ts
-import { join as join24, resolve as resolve14 } from "node:path";
+import { join as join26, resolve as resolve14 } from "node:path";
 function loadDefaultWorkspace(dataDirectory, environment = process.env) {
   const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
-  return configuredWorkspace ?? join24(dataDirectory, "workspace");
+  return configuredWorkspace ?? join26(dataDirectory, "workspace");
 }
 function withRuntimeEnvironment(agent, environment) {
   const launchEnvironment = {};
@@ -91128,7 +91387,7 @@ var init_runtime_connection = __esm({
 // src/runtime/connection/runtime-installation-store.ts
 import { randomUUID as randomUUID13 } from "node:crypto";
 import { resolve as resolve15 } from "node:path";
-function isRecord7(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -91195,7 +91454,7 @@ function installationId() {
   return `min_${randomUUID13().replaceAll("-", "")}`;
 }
 function decodeInstallationPointer(value) {
-  if (!isRecord7(value) || !hasExactKeys(value, INSTALLATION_POINTER_KEYS) || value["version"] !== 1) {
+  if (!isRecord9(value) || !hasExactKeys(value, INSTALLATION_POINTER_KEYS) || value["version"] !== 1) {
     throw new RuntimeInstallationStoreError("invalid_installation", "The local installation record is invalid");
   }
   const storedInstallationId = value["installationId"];
@@ -91205,7 +91464,7 @@ function decodeInstallationPointer(value) {
   return { installationId: validateInstallationId(storedInstallationId) };
 }
 function decodeChannelIndex(value) {
-  if (!isRecord7(value) || !hasExactKeys(value, CHANNEL_INDEX_KEYS) || value["version"] !== 1) {
+  if (!isRecord9(value) || !hasExactKeys(value, CHANNEL_INDEX_KEYS) || value["version"] !== 1) {
     throw new RuntimeInstallationStoreError("invalid_connection", "The saved Runtime connection is invalid");
   }
   const applicationId = value["applicationId"];
@@ -91255,7 +91514,7 @@ function decodeVerifiedConnection(value) {
   );
 }
 function decodeConnection(value) {
-  if (!isRecord7(value)) {
+  if (!isRecord9(value)) {
     throw new RuntimeInstallationStoreError("invalid_connection", "The saved Runtime connection is invalid");
   }
   return decodeVerifiedConnection(value);
@@ -91589,9 +91848,9 @@ var init_runtime_installation_store = __esm({
 // src/storage/daemon/version-data.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { cp as cp2, lstat as lstat4, mkdtemp, readFile as readFile7, rename as rename4, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join25, relative as relative2, sep as sep5 } from "node:path";
+import { join as join27, relative as relative2, sep as sep5 } from "node:path";
 async function readCurrentDataVersion(root, signal) {
-  const pointer = join25(root, STATE_ROOT_LAYOUT.currentData);
+  const pointer = join27(root, STATE_ROOT_LAYOUT.currentData);
   try {
     await validateLocalPath(pointer, false, true, signal);
     const value = (await readFile7(pointer, { encoding: "utf8", signal })).trim();
@@ -91608,7 +91867,7 @@ async function readCurrentDataVersion(root, signal) {
 }
 async function versionDataExists(root, version2, signal) {
   try {
-    await validateLocalPath(join25(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
+    await validateLocalPath(join27(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
     return true;
   } catch (cause) {
     if (!isNodeError(cause, "ENOENT")) {
@@ -91622,13 +91881,13 @@ function nestedRootEntry(segments) {
 }
 async function copyVersionData(root, sourceVersion, targetVersion, signal) {
   const leftBehind = [];
-  const versions = join25(root, STATE_ROOT_LAYOUT.versions);
-  const source = join25(versions, sourceVersion);
-  const target = join25(versions, targetVersion);
+  const versions = join27(root, STATE_ROOT_LAYOUT.versions);
+  const source = join27(versions, sourceVersion);
+  const target = join27(versions, targetVersion);
   await validateLocalPath(root, true, true, signal);
   await validateLocalPath(versions, true, true, signal);
   await validateLocalPath(source, true, true, signal);
-  const staging = await mkdtemp(join25(versions, `.${targetVersion}-`));
+  const staging = await mkdtemp(join27(versions, `.${targetVersion}-`));
   try {
     await cp2(source, staging, {
       recursive: true,
@@ -91665,10 +91924,10 @@ async function discardVersionData(root, version2, signal) {
   if (await readCurrentDataVersion(root, signal) === version2 || !await versionDataExists(root, version2, signal)) {
     return;
   }
-  const versions = join25(root, STATE_ROOT_LAYOUT.versions);
-  const discarded = join25(versions, `.${version2}-discarded-${randomUUID14()}`);
+  const versions = join27(root, STATE_ROOT_LAYOUT.versions);
+  const discarded = join27(versions, `.${version2}-discarded-${randomUUID14()}`);
   try {
-    await rename4(join25(versions, version2), discarded);
+    await rename4(join27(versions, version2), discarded);
   } catch (cause) {
     if (isNodeError(cause, "ENOENT")) {
       return;
@@ -91679,13 +91938,13 @@ async function discardVersionData(root, version2, signal) {
 }
 async function writeCurrentDataVersion(root, version2, signal) {
   await validateLocalPath(root, true, true, signal);
-  await validateLocalPath(join25(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
-  const temporary = join25(root, `.current-data-${randomUUID14()}.txt`);
+  await validateLocalPath(join27(root, STATE_ROOT_LAYOUT.versions, version2), true, true, signal);
+  const temporary = join27(root, `.current-data-${randomUUID14()}.txt`);
   try {
     await writeFile2(temporary, `versions/${version2}
 `, { mode: 384, flag: "wx", signal });
     signal.throwIfAborted();
-    await rename4(temporary, join25(root, STATE_ROOT_LAYOUT.currentData));
+    await rename4(temporary, join27(root, STATE_ROOT_LAYOUT.currentData));
   } finally {
     await rm3(temporary, { force: true });
   }
@@ -91706,7 +91965,7 @@ var init_version_data = __esm({
 
 // src/daemon/pairing/pair-local-machine.ts
 import { hostname as hostname3 } from "node:os";
-import { basename as basename7, join as join26, resolve as resolve16 } from "node:path";
+import { basename as basename7, join as join28, resolve as resolve16 } from "node:path";
 import { fetch as fetch3 } from "undici";
 function hasExactKeys2(value, expectedKeys) {
   const keys = Object.keys(value);
@@ -91967,7 +92226,7 @@ async function openMobiusVersionInstallation(version2, signal, environment) {
   return await openRuntimeInstallationStore(
     {
       applicationId: MOBIUS_CLI_APPLICATION_ID,
-      stateDirectory: join26(readStateDirectory(environment), "versions", version2)
+      stateDirectory: join28(readStateDirectory(environment), "versions", version2)
     },
     signal
   );
@@ -92240,9 +92499,9 @@ var init_agents = __esm({
 
 // src/storage/daemon/manager-lock.ts
 import { readFile as readFile8, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join29 } from "node:path";
 async function acquireManagerLock(stateDirectory, name2 = "manager.lock") {
-  const path8 = join27(stateDirectory, name2);
+  const path8 = join29(stateDirectory, name2);
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       await writeFile3(path8, `${process.pid.toString()}
@@ -92271,7 +92530,7 @@ async function acquireManagerLock(stateDirectory, name2 = "manager.lock") {
 }
 async function managerLockExists(stateDirectory) {
   try {
-    await readFile8(join27(stateDirectory, "manager.lock"), "utf8");
+    await readFile8(join29(stateDirectory, "manager.lock"), "utf8");
     return true;
   } catch (cause) {
     if (isNodeError(cause, "ENOENT")) {
@@ -92290,9 +92549,9 @@ var init_manager_lock = __esm({
 // src/storage/daemon/control-token.ts
 import { randomBytes } from "node:crypto";
 import { readFile as readFile9, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join30 } from "node:path";
 function controlTokenPath(stateDirectory) {
-  return join28(stateDirectory, "manager.token");
+  return join30(stateDirectory, "manager.token");
 }
 async function readOrCreateControlToken(stateDirectory) {
   const path8 = controlTokenPath(stateDirectory);
@@ -92477,7 +92736,10 @@ var init_local_server = __esm({
 });
 
 // src/daemon/control/protocol.ts
-var workerLaunch, transition, daemonSwitchState, lifecycleCommand, lifecycleResponse;
+function hasUnknownKind(value, known) {
+  return typeof value === "object" && value !== null && "kind" in value && typeof value.kind === "string" && !known.has(value.kind);
+}
+var workerLaunch, transition, daemonSwitchState, lifecycleCommand, lifecycleResponse, lifecycleCommandKinds, lifecycleResponseKinds, daemonSwitchStateKinds, decodeKnownLifecycleCommand, decodeKnownLifecycleResponse;
 var init_protocol2 = __esm({
   "src/daemon/control/protocol.ts"() {
     "use strict";
@@ -92529,15 +92791,28 @@ var init_protocol2 = __esm({
       external_exports.object({ kind: external_exports.literal("switching") }),
       external_exports.object({ kind: external_exports.literal("error"), code: external_exports.string(), message: external_exports.string() })
     ]).readonly();
+    lifecycleCommandKinds = /* @__PURE__ */ new Set(["ensure", "status", "stop", "switch", "switch-status"]);
+    lifecycleResponseKinds = /* @__PURE__ */ new Set(["error", "status", "stopped", "switching", "switch-status"]);
+    daemonSwitchStateKinds = /* @__PURE__ */ new Set(["rolled-back", "switched", "switching"]);
+    decodeKnownLifecycleCommand = (value) => hasUnknownKind(value, lifecycleCommandKinds) ? null : lifecycleCommand.parse(value);
+    decodeKnownLifecycleResponse = (value) => {
+      if (hasUnknownKind(value, lifecycleResponseKinds)) {
+        return null;
+      }
+      if (typeof value === "object" && value !== null && "kind" in value && value.kind === "switch-status" && "state" in value && hasUnknownKind(value.state, daemonSwitchStateKinds)) {
+        return lifecycleResponse.parse({ ...value, state: null });
+      }
+      return lifecycleResponse.parse(value);
+    };
   }
 });
 
 // src/daemon/control/switch-status.ts
 async function readSwitchStatus(directory, signal, wait = false) {
-  const response = lifecycleResponse.parse(
+  const response = decodeKnownLifecycleResponse(
     await sendLocalRequest(directory, "manager", { kind: "switch-status", wait }, signal)
   );
-  if (response.kind !== "switch-status") {
+  if (response?.kind !== "switch-status") {
     throw new Error("The manager could not return the switch status");
   }
   return response.state;
@@ -92600,7 +92875,7 @@ var init_data = __esm({
 
 // src/storage/logs/bounded-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync9, renameSync as renameSync2, statSync as statSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join31 } from "node:path";
 var BoundedLineLog;
 var init_bounded_log = __esm({
   "src/storage/logs/bounded-log.ts"() {
@@ -92613,7 +92888,7 @@ var init_bounded_log = __esm({
       #onWriteFailure;
       constructor(directory, filename, maximumBytes, onWriteFailure = () => void 0) {
         this.#directory = directory;
-        this.#path = join29(directory, filename);
+        this.#path = join31(directory, filename);
         this.#maximumBytes = maximumBytes;
         this.#onWriteFailure = onWriteFailure;
       }
@@ -92667,19 +92942,19 @@ var init_bounded_log = __esm({
 // src/storage/logs/log-files.ts
 import { readFileSync as readFileSync10 } from "node:fs";
 import { lstat as lstat5, readdir as readdir6, readFile as readFile10 } from "node:fs/promises";
-import { join as join30, relative as relative3 } from "node:path";
+import { join as join32, relative as relative3 } from "node:path";
 function unhandledRejectionLogFilename(role) {
   return `unhandled-rejections-${role}.log`;
 }
 function logDirectory(stateDirectory) {
-  return join30(stateDirectory, "logs");
+  return join32(stateDirectory, "logs");
 }
 function processLogPaths(stateDirectory) {
   return [
     WORKER_LIFECYCLE_LOG_FILENAME,
     unhandledRejectionLogFilename("manager"),
     unhandledRejectionLogFilename("worker")
-  ].map((filename) => join30(logDirectory(stateDirectory), filename));
+  ].map((filename) => join32(logDirectory(stateDirectory), filename));
 }
 function readLogText(path8) {
   try {
@@ -92692,17 +92967,17 @@ function isAbsent(cause) {
   return typeof cause === "object" && cause !== null && Reflect.get(cause, "code") === "ENOENT";
 }
 async function findLogDirectories(root, unreadable, signal) {
-  const versions = join30(root, VERSIONS_DIRECTORY);
-  const installationsRoots = [join30(root, INSTALLATIONS_DIRECTORY)];
+  const versions = join32(root, VERSIONS_DIRECTORY);
+  const installationsRoots = [join32(root, INSTALLATIONS_DIRECTORY)];
   for (const version2 of await listDirectories(versions, root, unreadable, signal)) {
-    installationsRoots.push(join30(versions, version2, INSTALLATIONS_DIRECTORY));
+    installationsRoots.push(join32(versions, version2, INSTALLATIONS_DIRECTORY));
   }
   const found = [];
   for (const installations of installationsRoots) {
     for (const applicationId of await listDirectories(installations, root, unreadable, signal)) {
-      const application = join30(installations, applicationId);
+      const application = join32(installations, applicationId);
       for (const installationId2 of await listDirectories(application, root, unreadable, signal)) {
-        const logs = join30(application, installationId2, "logs");
+        const logs = join32(application, installationId2, "logs");
         const status = await directoryStatus(logs);
         if (status === "listed") {
           found.push(logs);
@@ -93190,15 +93465,10 @@ async function runManager(stateDirectory, signal) {
     }
   };
   const handle = async (value, requestSignal) => {
-    const parsed = lifecycleCommand.safeParse(value);
-    if (!parsed.success) {
-      return {
-        kind: "error",
-        code: "unsupported_lifecycle_command",
-        message: "The manager only accepts lifecycle commands"
-      };
+    const command = decodeKnownLifecycleCommand(value);
+    if (command === null) {
+      return null;
     }
-    const command = parsed.data;
     if (command.kind === "switch-status" && !command.wait) {
       return { kind: "switch-status", state: switchState };
     }
@@ -93315,13 +93585,13 @@ var init_manager2 = __esm({
 
 // src/storage/daemon/release-files.ts
 import { readFile as readFile11, realpath as realpath8 } from "node:fs/promises";
-import { join as join31 } from "node:path";
+import { join as join33 } from "node:path";
 function releasePrefix(version2) {
-  return join31(readStateDirectory(), STATE_ROOT_LAYOUT.releases, version2);
+  return join33(readStateDirectory(), STATE_ROOT_LAYOUT.releases, version2);
 }
 async function readInstalledRelease(prefix) {
-  const packageRoot = await realpath8(join31(prefix, "node_modules", "@moxt-ai", "mobius"));
-  return { manifest: await readFile11(join31(packageRoot, "package.json"), "utf8"), packageRoot };
+  const packageRoot = await realpath8(join33(prefix, "node_modules", "@moxt-ai", "mobius"));
+  return { manifest: await readFile11(join33(packageRoot, "package.json"), "utf8"), packageRoot };
 }
 var init_release_files = __esm({
   "src/storage/daemon/release-files.ts"() {
@@ -93332,7 +93602,7 @@ var init_release_files = __esm({
 });
 
 // src/daemon/upgrades/package.ts
-import { isAbsolute as isAbsolute16, join as join32, relative as relative4 } from "node:path";
+import { isAbsolute as isAbsolute16, join as join34, relative as relative4 } from "node:path";
 async function prepareDaemonReleaseVersion(version2, signal) {
   runtimeUpgradeVersionSchema.parse(version2);
   signal.throwIfAborted();
@@ -93413,7 +93683,7 @@ async function verifyInstalledDaemonRelease(installed, prefix, version2, signal)
     bin: external_exports.object({ mobius: external_exports.literal("dist/cli.js") }),
     engines: external_exports.object({ node: external_exports.string().refine((value) => (0, import_semver.validRange)(value) !== null) })
   }).parse(JSON.parse(installed.manifest));
-  const entry = await canonicalPath(join32(installed.packageRoot, metadata.bin.mobius));
+  const entry = await canonicalPath(join34(installed.packageRoot, metadata.bin.mobius));
   const resolved = relative4(await canonicalPath(prefix), entry);
   if (resolved.startsWith("..") || isAbsolute16(resolved)) {
     throw new Error("Installed entry escaped npm prefix");
@@ -93537,24 +93807,24 @@ async function ensureWorkingProcess(stateDirectory, cliVersion, signal) {
   const launch = await prepareDaemonReleaseVersion(version2, signal);
   const deadline = AbortSignal.any([signal, AbortSignal.timeout(CONTROL_TIMEOUT_MILLISECONDS)]);
   await ensureManager(stateDirectory, launch, deadline);
-  const response = lifecycleResponse.parse(
+  const response = decodeKnownLifecycleResponse(
     await sendLocalRequest(stateDirectory, "manager", { kind: "ensure", launch }, deadline)
   );
-  if (response.kind === "error") {
+  if (response?.kind === "error") {
     throw new Error(response.message);
   }
-  if (response.kind !== "status" || response.worker?.version !== version2) {
+  if (response?.kind !== "status" || response.worker?.version !== version2) {
     throw new Error("The working daemon did not start");
   }
   return version2;
 }
 async function readWorkingProcessVersion(stateDirectory, signal) {
   try {
-    const response = lifecycleResponse.safeParse(
+    const response = decodeKnownLifecycleResponse(
       await sendLocalRequest(stateDirectory, "manager", { kind: "status" }, signal)
     );
-    if (response.success && response.data.kind === "status") {
-      return response.data.worker?.version ?? null;
+    if (response?.kind === "status") {
+      return response.worker?.version ?? null;
     }
   } catch (cause) {
     if (!isNodeError(cause, "ENOENT") && !isNodeError(cause, "ECONNREFUSED")) {
@@ -93567,10 +93837,10 @@ async function ensureManager(stateDirectory, launch, signal) {
   let managerStarted = false;
   while (!signal.aborted) {
     try {
-      const response = lifecycleResponse.safeParse(
+      const response = decodeKnownLifecycleResponse(
         await sendLocalRequest(stateDirectory, "manager", { kind: "status" }, signal)
       );
-      if (response.success && response.data.kind === "status") {
+      if (response?.kind === "status") {
         if (managerStarted) {
           process.stdout.write(`Mobius daemon ${launch.version} started
 `);
@@ -93604,13 +93874,13 @@ async function ensureManager(stateDirectory, launch, signal) {
 }
 async function stopManager(stateDirectory, signal) {
   try {
-    const response = lifecycleResponse.parse(
+    const response = decodeKnownLifecycleResponse(
       await sendLocalRequest(stateDirectory, "manager", { kind: "stop" }, signal)
     );
-    if (response.kind === "error") {
+    if (response?.kind === "error") {
       throw new Error(response.message);
     }
-    if (response.kind !== "stopped") {
+    if (response?.kind !== "stopped") {
       throw new Error("The Mobius manager returned an unexpected response");
     }
     await waitForManagerExit(stateDirectory, signal);
@@ -93798,7 +94068,10 @@ function legacyState(receipt) {
   if (receipt.outcome === null) {
     return receipt.started ? "running" : "dispatching";
   }
-  const event = sessionEventPayloadSchema.parse(JSON.parse(receipt.outcome));
+  const event = decodeKnownSessionEventPayload(JSON.parse(receipt.outcome));
+  if (event === null) {
+    return "failed";
+  }
   return event.type === "lifecycle-metadata" && event.payload.kind === "prompt.completed" ? event.payload.stopReason === "cancelled" ? "cancelled" : "succeeded" : "failed";
 }
 var receiptSchema, identitySchema, ExecutionReceiptTable;
@@ -94782,7 +95055,11 @@ var init_session_configurations = __esm({
         external_exports.object({ configId: external_exports.string().max(128), type: external_exports.literal("select"), value: external_exports.string().max(500) })
       ])
     ).max(100);
-    decodeStoredSessionConfigurations = (value) => storedSessionConfigurationsSchema.parse(value);
+    decodeStoredSessionConfigurations = (value) => storedSessionConfigurationsSchema.parse(
+      Array.isArray(value) ? value.filter(
+        (configuration) => typeof configuration !== "object" || configuration === null || !("type" in configuration) || typeof configuration.type !== "string" || configuration.type === "boolean" || configuration.type === "select"
+      ) : value
+    );
     SessionConfigurations = class {
       #selected = [];
       stored = () => this.#selected;
@@ -97405,7 +97682,7 @@ var init_execution_receipts = __esm({
       };
       outcome = (commandId) => {
         const receipt = this.#executions.get(commandId);
-        return receipt?.outcome === null || receipt === void 0 ? void 0 : sessionEventPayloadSchema.parse(JSON.parse(receipt.outcome));
+        return receipt?.outcome === null || receipt === void 0 ? void 0 : decodeKnownSessionEventPayload(JSON.parse(receipt.outcome)) ?? void 0;
       };
       /** Reserves an unseen command for cancellation before a delayed prompt can claim its identity. */
       recordCancellationBeforeAdmission = (commandId, sessionId) => {
@@ -97468,7 +97745,10 @@ var init_execution_receipts = __esm({
               code: "runtime_restarted",
               message: "The local runtime restarted before this request started"
             }
-          } : sessionEventPayloadSchema.parse(JSON.parse(receipt.outcome));
+          } : decodeKnownSessionEventPayload(JSON.parse(receipt.outcome));
+          if (event === null) {
+            continue;
+          }
           const recordedAt = receipt.outcome === null ? (/* @__PURE__ */ new Date()).toISOString() : external_exports.object({ recordedAt: external_exports.string() }).parse(JSON.parse(receipt.outcome)).recordedAt;
           recovered.push({ sessionId: receipt.sessionId, event, recordedAt });
           if (receipt.outcome === null) {
@@ -97921,7 +98201,7 @@ var init_session_turns = __esm({
 
 // src/session/workspace/workspace-directory.ts
 import { homedir as homedir4 } from "node:os";
-import { basename as basename8, dirname as dirname11, isAbsolute as isAbsolute17, join as join33, normalize as normalize2, relative as relative5 } from "node:path";
+import { basename as basename8, dirname as dirname11, isAbsolute as isAbsolute17, join as join35, normalize as normalize2, relative as relative5 } from "node:path";
 function encodePath(path8) {
   const encoded = Buffer.from(path8, "utf8").toString("base64url");
   if (path8.length === 0 || path8.length > MAX_WORKSPACE_PATH_LENGTH || encoded.length + "path-".length > MAX_DIRECTORY_IDENTIFIER_LENGTH) {
@@ -98050,7 +98330,7 @@ var init_workspace_directory = __esm({
               continue;
             }
             try {
-              const path8 = await this.resolvePath(join33(target, child.name), signal);
+              const path8 = await this.resolvePath(join35(target, child.name), signal);
               entries.push({ directoryId: encodePath(path8), name: child.name });
             } catch (cause) {
               signal.throwIfAborted();
@@ -98222,7 +98502,7 @@ var init_session_layer = __esm({
 // src/storage/files/scratch-directory.ts
 import { randomUUID as randomUUID18 } from "node:crypto";
 import { lstat as lstat6, mkdir as mkdir5, readdir as readdir7, readFile as readFile12, realpath as realpath9, rename as rename5, rm as rm4, stat as stat8, utimes, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { dirname as dirname12, join as join36 } from "node:path";
 async function atomicWrite(path8, bytes, signal) {
   const temporary = `${path8}.${randomUUID18()}.tmp`;
   try {
@@ -98240,7 +98520,7 @@ var init_scratch_directory = __esm({
     ScratchDirectory = class {
       #root;
       constructor(parent) {
-        this.#root = join34(parent, randomUUID18());
+        this.#root = join36(parent, randomUUID18());
       }
       /** Refreshes this directory's lease and removes sibling directories whose lease is older than `leaseMilliseconds`. */
       refreshLease = async (leaseMilliseconds) => {
@@ -98251,7 +98531,7 @@ var init_scratch_directory = __esm({
           if (!directory.isDirectory() || !/^[a-f0-9-]{36}$/u.test(directory.name)) {
             continue;
           }
-          const path8 = join34(dirname12(this.#root), directory.name);
+          const path8 = join36(dirname12(this.#root), directory.name);
           if (path8 === this.#root) {
             continue;
           }
@@ -98266,10 +98546,10 @@ var init_scratch_directory = __esm({
       };
       /** Writes `bytes` atomically to `<group>/<name>` with owner-only permissions and returns the path. */
       write = async (group, name2, bytes, signal) => {
-        const directory = join34(this.#root, group);
+        const directory = join36(this.#root, group);
         await mkdir5(directory, { mode: 448, recursive: true });
         signal.throwIfAborted();
-        const path8 = join34(directory, name2);
+        const path8 = join36(directory, name2);
         await atomicWrite(path8, bytes, signal);
         return path8;
       };
@@ -98304,7 +98584,7 @@ var init_scratch_directory = __esm({
 
 // src/session/content/external-content-store.ts
 import { createHash as createHash8 } from "node:crypto";
-import { join as join35 } from "node:path";
+import { join as join37 } from "node:path";
 var contentRequest, CONTENT_LIFETIME_MILLISECONDS, metadataSchema, LocalExternalContentStore;
 var init_external_content_store = __esm({
   "src/session/content/external-content-store.ts"() {
@@ -98326,7 +98606,7 @@ var init_external_content_store = __esm({
       #expirationTimer;
       #cleanup = Promise.resolve();
       constructor(stateDirectory) {
-        this.#scratch = new ScratchDirectory(join35(stateDirectory, "tmp", "session-content"));
+        this.#scratch = new ScratchDirectory(join37(stateDirectory, "tmp", "session-content"));
         this.#expirationTimer = setInterval(() => {
           void this.#expire().catch(() => void 0);
         }, 6e4);
@@ -98731,7 +99011,7 @@ var init_agent_process_pool = __esm({
 });
 
 // src/runtime/observability/diagnostic-log.ts
-import { join as join36 } from "node:path";
+import { join as join38 } from "node:path";
 function exportedFields(value) {
   const entry = {};
   for (const field of REMOTE_DIAGNOSTIC_FIELDS) {
@@ -98800,7 +99080,7 @@ var init_diagnostic_log = __esm({
         this.#maximumBytes = maximumBytes;
         const processLogsDirectory = options.processLogsDirectory;
         this.#sources = [
-          { maximumBytes, path: join36(directory, DAEMON_LOG_FILENAME) },
+          { maximumBytes, path: join38(directory, DAEMON_LOG_FILENAME) },
           // The process logs a Runtime does not own, but must read to explain its own deaths.
           ...processLogsDirectory === void 0 ? [] : processLogPaths(processLogsDirectory).map((path8) => ({ maximumBytes: null, path: path8 }))
         ];
@@ -99840,7 +100120,7 @@ var init_content_write = __esm({
 });
 
 // src/session/content/session-files.ts
-import { basename as basename9, extname as extname2, isAbsolute as isAbsolute18, join as join37, normalize as normalize3, resolve as resolve18 } from "node:path";
+import { basename as basename9, extname as extname2, isAbsolute as isAbsolute18, join as join39, normalize as normalize3, resolve as resolve18 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function requestedPath(value) {
   if (value.includes("\0")) {
@@ -99864,7 +100144,7 @@ async function resolveFile(value, workingDirectory, signal) {
   if (isAbsolute18(requested.path) && normalize3(requested.path) !== requested.path) {
     return null;
   }
-  const candidates = requested.explicitUrl || workingDirectory === null ? [requested.path] : isAbsolute18(requested.path) ? [join37(workingDirectory, requested.path), requested.path] : [resolve18(workingDirectory, requested.path)];
+  const candidates = requested.explicitUrl || workingDirectory === null ? [requested.path] : isAbsolute18(requested.path) ? [join39(workingDirectory, requested.path), requested.path] : [resolve18(workingDirectory, requested.path)];
   for (const candidate of candidates) {
     if (!isAbsolute18(candidate) || normalize3(candidate) !== candidate) {
       continue;
@@ -101793,35 +102073,6 @@ function closeRelaySocket(socket, code, reason) {
     }
   }
 }
-function readCommandCorrelation(encoded) {
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch {
-    return { requestId: "unsupported", sessionId: "" };
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return { requestId: "unsupported", sessionId: "" };
-  }
-  const requestId = Reflect.get(value, "requestId");
-  const sessionId = Reflect.get(value, "sessionId");
-  return {
-    requestId: typeof requestId === "string" && isIdentifier(requestId) ? requestId : "unsupported",
-    sessionId: typeof sessionId === "string" && isIdentifier(sessionId) ? sessionId : ""
-  };
-}
-function rejectUnsupportedCommand(socket, correlation, rejection) {
-  if (socket.readyState !== WebSocket8.OPEN) {
-    return;
-  }
-  send(socket, {
-    code: rejection.code,
-    kind: SESSION_OPERATION_FAILED_KIND,
-    message: "The Relay sent a command this daemon does not support",
-    requestId: correlation.requestId,
-    sessionId: correlation.sessionId
-  });
-}
 async function runRelayConnection({
   resolveAgent,
   config: config2,
@@ -101974,7 +102225,10 @@ async function runRelayConnection({
           return;
         }
         try {
-          const message = decodeServiceToDaemonMessage(encoded);
+          const message = decodeKnownServiceToDaemonMessage(encoded);
+          if (message === null) {
+            return;
+          }
           const kind = message.kind;
           if (kind === RUNTIME_LIVENESS_READY_KIND) {
             if (ready) {
@@ -101992,26 +102246,6 @@ async function runRelayConnection({
           }
           commands.dispatch(message);
         } catch (error62) {
-          if (error62 instanceof UnsupportedProtocolMessageKindError) {
-            const correlation = readCommandCorrelation(encoded);
-            console.warn("Mobius daemon rejected an unsupported Relay command", {
-              code: error62.code,
-              direction: error62.direction,
-              messageKind: error62.messageKind
-            });
-            diagnostics.daemonDiagnostic(
-              "relay_command_unsupported",
-              correlation.requestId,
-              {
-                code: error62.code,
-                direction: error62.direction,
-                messageKind: error62.messageKind
-              },
-              error62
-            );
-            rejectUnsupportedCommand(socket, correlation, error62);
-            return;
-          }
           console.error("Mobius daemon rejected a message", error62);
           failAndClose(
             new Error("Relay sent an invalid protocol message", { cause: error62 }),
@@ -102583,13 +102817,13 @@ async function requestDaemonReleaseUpgrade(stateDirectory, currentVersion, signa
 }
 async function requestInstalledDaemonReleaseSwitch(stateDirectory, launch, signal) {
   const id = randomUUID20();
-  const response = lifecycleResponse.parse(
+  const response = decodeKnownLifecycleResponse(
     await sendLocalRequest(stateDirectory, "manager", { kind: "switch", id, context: "npm", launch }, signal)
   );
-  if (response.kind === "error") {
+  if (response?.kind === "error") {
     throw new DaemonReleaseUpgradeError(response.code, response.message);
   }
-  if (response.kind !== "switching") {
+  if (response?.kind !== "switching") {
     throw new DaemonReleaseUpgradeError("manager_incompatible", "The manager does not support daemon switching");
   }
   return { kind: "requested", id, version: launch.version };
@@ -102957,7 +103191,7 @@ var init_daemon = __esm({
 });
 
 // src/cli/handler/logs/logic/collect-local-logs.ts
-import { join as join38, relative as relative6, resolve as resolve19 } from "node:path";
+import { join as join40, relative as relative6, resolve as resolve19 } from "node:path";
 async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   signal.throwIfAborted();
   const root = resolve19(stateDirectory);
@@ -102967,7 +103201,7 @@ async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   for (const directory of directories) {
     const names = await listLogFiles(directory, root, unreadable);
     for (const name2 of names) {
-      const path8 = join38(directory, name2);
+      const path8 = join40(directory, name2);
       const reported = relative6(root, path8);
       const read = await readOwnedLogFile(path8, signal);
       if (read.kind === "unreadable") {