@moxt-ai/mobius 0.0.4 → 0.0.5

package/dist/index.js

@@ -23,65 +23,466 @@ var createAcpClient = (handler) => client({ name: "mobius" }).onRequest(
 
 // src/config.ts
 import { fileURLToPath } from "node:url";
-var repositoryRoot = fileURLToPath(new URL("../../../", import.meta.url));
-function adapterEntrypoint(packageName) {
-  return fileURLToPath(new URL("./index.js", import.meta.resolve(packageName)));
+
+// src/agent-catalog/local-agent.ts
+import { realpathSync, statSync } from "node:fs";
+
+// src/process/executable.ts
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { access, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+var DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
+var PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1e3;
+var PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5e3;
+var ExecutableIdentity = class {
+  changedAtMilliseconds;
+  device;
+  inode;
+  realPath;
+  requestedPath;
+  size;
+  constructor(requestedPath, realPath_, device, inode, size, changedAtMilliseconds) {
+    this.changedAtMilliseconds = changedAtMilliseconds;
+    this.device = device;
+    this.inode = inode;
+    this.realPath = realPath_;
+    this.requestedPath = requestedPath;
+    this.size = size;
+  }
+  matches = (candidate) => this.requestedPath === candidate.requestedPath && this.realPath === candidate.realPath && this.device === candidate.device && this.inode === candidate.inode && this.size === candidate.size && this.changedAtMilliseconds === candidate.changedAtMilliseconds;
+};
+var ResolvedExecutable = class {
+  identity;
+  path;
+  constructor(identity) {
+    this.identity = identity;
+    this.path = identity.realPath;
+  }
+};
+var ProcessExecutionError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "ProcessExecutionError";
+  }
+};
+var ProcessResult = class {
+  stderr;
+  stdout;
+  constructor(stdout, stderr) {
+    this.stderr = stderr;
+    this.stdout = stdout;
+  }
+};
+function isInside(root, candidate) {
+  const difference = relative(root, candidate);
+  return difference.length === 0 || !difference.startsWith("..") && !isAbsolute(difference);
+}
+function executableExtensions(executableName, environment, platform) {
+  if (platform !== "win32") {
+    return [""];
+  }
+  if (/\.[a-zA-Z0-9]+$/.test(executableName)) {
+    return [""];
+  }
+  const configured = environment["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD";
+  const extensions = configured.split(";").map((extension) => extension.trim()).filter((extension) => extension.length > 0).map(
+    (extension) => extension.startsWith(".") ? extension : `.${extension}`
+  );
+  return extensions.length > 0 ? extensions : [".EXE"];
+}
+async function resolveExecutablePath(requestedPath, platform = process.platform) {
+  const absoluteRequestedPath = resolve(requestedPath);
+  try {
+    const resolvedPath = await realpath(absoluteRequestedPath);
+    const metadata = await stat(resolvedPath);
+    if (!metadata.isFile()) {
+      return null;
+    }
+    if (platform !== "win32") {
+      await access(resolvedPath, constants.X_OK);
+    }
+    return new ResolvedExecutable(
+      new ExecutableIdentity(
+        absoluteRequestedPath,
+        resolvedPath,
+        metadata.dev,
+        metadata.ino,
+        metadata.size,
+        metadata.ctimeMs
+      )
+    );
+  } catch {
+    return null;
+  }
+}
+async function findExecutableOnPath(executableName, environment, approvedRoot, platform = process.platform) {
+  const encodedPath = environment["PATH"] ?? "";
+  const separator = platform === "win32" ? ";" : ":";
+  const approvedRealPath = await realpath(resolve(approvedRoot));
+  const extensions = executableExtensions(
+    executableName,
+    environment,
+    platform
+  );
+  for (const entry of encodedPath.split(separator)) {
+    if (entry.length === 0) {
+      continue;
+    }
+    for (const extension of extensions) {
+      const requestedPath = resolve(
+        join(entry, `${executableName}${extension}`)
+      );
+      const executable = await resolveExecutablePath(requestedPath, platform);
+      if (executable !== null && !isInside(approvedRealPath, requestedPath) && !isInside(approvedRealPath, executable.path)) {
+        return executable;
+      }
+    }
+  }
+  return null;
+}
+async function revalidateExecutable(identity, platform = process.platform) {
+  const current = await resolveExecutablePath(identity.requestedPath, platform);
+  return current !== null && identity.matches(current.identity);
+}
+function appendBounded(chunks, chunk, currentBytes, limitBytes) {
+  const nextBytes = currentBytes + chunk.byteLength;
+  if (nextBytes > limitBytes) {
+    throw new ProcessExecutionError(
+      "process_output_limit",
+      "The executable produced too much output"
+    );
+  }
+  chunks.push(chunk);
+  return nextBytes;
+}
+function terminateProcess(child) {
+  if (child.exitCode !== null || child.signalCode !== null || child.pid === void 0) {
+    return;
+  }
+  if (process.platform !== "win32") {
+    try {
+      process.kill(-child.pid, "SIGTERM");
+      return;
+    } catch {
+    }
+  }
+  child.kill("SIGTERM");
+}
+function forceTerminateProcess(child) {
+  if (child.exitCode !== null || child.signalCode !== null || child.pid === void 0) {
+    return;
+  }
+  if (process.platform !== "win32") {
+    try {
+      process.kill(-child.pid, "SIGKILL");
+      return;
+    } catch {
+    }
+  }
+  child.kill("SIGKILL");
+}
+async function stopProcessTree(child) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return;
+  }
+  terminateProcess(child);
+  const exitedAfterTermination = await waitForProcessExit(
+    child,
+    PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS
+  );
+  if (exitedAfterTermination) {
+    return;
+  }
+  forceTerminateProcess(child);
+  const exitedAfterForce = await waitForProcessExit(
+    child,
+    PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS
+  );
+  if (!exitedAfterForce) {
+    throw new ProcessExecutionError(
+      "process_termination_timeout",
+      "The executable process could not be stopped"
+    );
+  }
+}
+function waitForProcessExit(child, timeoutMilliseconds) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return Promise.resolve(true);
+  }
+  return new Promise((resolveExit) => {
+    let settled = false;
+    const finish = (exited) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timeout);
+      child.removeListener("exit", handleExit);
+      resolveExit(exited);
+    };
+    const handleExit = () => finish(true);
+    const timeout = setTimeout(() => finish(false), timeoutMilliseconds);
+    child.once("exit", handleExit);
+    if (child.exitCode !== null || child.signalCode !== null) {
+      finish(true);
+    }
+  });
+}
+async function runBoundedProcess(options) {
+  options.signal.throwIfAborted();
+  const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
+  const child = spawn(options.command, [...options.arguments], {
+    cwd: options.cwd,
+    detached: process.platform !== "win32",
+    env: { ...options.environment },
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const stdout = [];
+  const stderr = [];
+  let stdoutBytes = 0;
+  let stderrBytes = 0;
+  let interruptionFailure = null;
+  let interruptionCleanupFailure = null;
+  let stopping = false;
+  const interrupted = Promise.withResolvers();
+  const interrupt = (failure) => {
+    if (stopping) {
+      return;
+    }
+    stopping = true;
+    interruptionFailure = failure;
+    const stop = async () => {
+      try {
+        await stopProcessTree(child);
+      } catch (error61) {
+        interruptionCleanupFailure = error61 instanceof ProcessExecutionError ? error61 : new ProcessExecutionError(
+          "process_termination_failed",
+          "The executable process could not be stopped",
+          { cause: error61 }
+        );
+      } finally {
+        interrupted.resolve();
+      }
+    };
+    void stop();
+  };
+  const collectStdout = (chunk) => {
+    if (interruptionFailure !== null) {
+      return;
+    }
+    try {
+      stdoutBytes = appendBounded(stdout, chunk, stdoutBytes, outputLimitBytes);
+    } catch (error61) {
+      const failure = error61 instanceof ProcessExecutionError ? error61 : new ProcessExecutionError(
+        "process_output_limit",
+        "The executable produced too much output",
+        { cause: error61 }
+      );
+      interrupt(failure);
+    }
+  };
+  const collectStderr = (chunk) => {
+    if (interruptionFailure !== null) {
+      return;
+    }
+    try {
+      stderrBytes = appendBounded(stderr, chunk, stderrBytes, outputLimitBytes);
+    } catch (error61) {
+      const failure = error61 instanceof ProcessExecutionError ? error61 : new ProcessExecutionError(
+        "process_output_limit",
+        "The executable produced too much output",
+        { cause: error61 }
+      );
+      interrupt(failure);
+    }
+  };
+  child.stdout?.on("data", collectStdout);
+  child.stderr?.on("data", collectStderr);
+  const timeout = setTimeout(() => {
+    interrupt(
+      new ProcessExecutionError(
+        "process_timeout",
+        "The executable probe timed out"
+      )
+    );
+  }, options.timeoutMilliseconds);
+  const abort = () => interrupt(
+    new ProcessExecutionError(
+      "process_cancelled",
+      "The executable probe was cancelled",
+      { cause: options.signal.reason }
+    )
+  );
+  options.signal.addEventListener("abort", abort, { once: true });
+  if (options.signal.aborted) {
+    abort();
+  }
+  try {
+    const exit = new Promise((resolveExit, rejectExit) => {
+      child.once("error", rejectExit);
+      child.once("exit", (code) => resolveExit(code ?? 1));
+    });
+    const exitCode = await Promise.race([
+      exit,
+      interrupted.promise.then(() => -1)
+    ]);
+    if (interruptionCleanupFailure !== null) {
+      throw interruptionCleanupFailure;
+    }
+    if (interruptionFailure !== null) {
+      throw interruptionFailure;
+    }
+    if (exitCode !== 0) {
+      throw new ProcessExecutionError(
+        "process_exit_failed",
+        "The executable probe failed"
+      );
+    }
+    return new ProcessResult(
+      Buffer.concat(stdout).toString("utf8"),
+      Buffer.concat(stderr).toString("utf8")
+    );
+  } catch (error61) {
+    if (error61 instanceof ProcessExecutionError) {
+      throw error61;
+    }
+    throw new ProcessExecutionError(
+      "process_spawn_failed",
+      "The executable could not be started",
+      { cause: error61 }
+    );
+  } finally {
+    clearTimeout(timeout);
+    options.signal.removeEventListener("abort", abort);
+    child.stdout?.removeListener("data", collectStdout);
+    child.stderr?.removeListener("data", collectStderr);
+    if (stopping) {
+      await interrupted.promise;
+    } else {
+      await stopProcessTree(child);
+    }
+  }
+}
+
+// src/agent-catalog/local-agent.ts
+function readTrustedIdentity(path) {
+  const resolvedPath = realpathSync(path);
+  const metadata = statSync(resolvedPath);
+  return new ExecutableIdentity(
+    resolvedPath,
+    resolvedPath,
+    metadata.dev,
+    metadata.ino,
+    metadata.size,
+    metadata.ctimeMs
+  );
 }
 var LocalAgentDefinition = class {
+  adapterIdentity;
+  adapterPath;
+  adapterVersion;
+  agentIdentity;
+  agentVersion;
   arguments;
   command;
+  environment;
   id;
   label;
-  constructor(id, label, command, arguments_) {
+  constructor(id, label, command, arguments_, environment = {}, adapterVersion = "", agentVersion = "", adapterIdentity = readTrustedIdentity(command), agentIdentity = adapterIdentity) {
+    this.adapterIdentity = adapterIdentity;
+    this.adapterPath = adapterIdentity.realPath;
+    this.adapterVersion = adapterVersion;
+    this.agentIdentity = agentIdentity;
+    this.agentVersion = agentVersion;
     this.id = id;
     this.label = label;
-    this.command = command;
-    this.arguments = arguments_;
+    this.command = adapterIdentity.realPath;
+    this.arguments = Object.freeze([...arguments_]);
+    this.environment = Object.freeze({ ...environment });
   }
 };
-function loadLocalAgents() {
-  const overridePath = process.env["MOBIUS_ACP_AGENT_PATH"]?.trim();
-  if (overridePath !== void 0 && overridePath.length > 0) {
-    return [
-      new LocalAgentDefinition("codex", "Codex", process.execPath, [
-        overridePath,
-        "--agent-name",
-        "Codex"
-      ]),
-      new LocalAgentDefinition("claude", "Claude Code", process.execPath, [
-        overridePath,
-        "--agent-name",
-        "Claude Code"
-      ])
-    ];
+var InstallableAgentDefinition = class {
+  id;
+  label;
+  requiresLocalApproval;
+  constructor(id, label, requiresLocalApproval = true) {
+    this.id = id;
+    this.label = label;
+    this.requiresLocalApproval = requiresLocalApproval;
   }
-  return [
-    new LocalAgentDefinition("codex", "Codex", process.execPath, [
-      adapterEntrypoint("@agentclientprotocol/codex-acp")
-    ]),
-    new LocalAgentDefinition("claude", "Claude Code", process.execPath, [
-      adapterEntrypoint("@agentclientprotocol/claude-agent-acp")
-    ])
-  ];
+};
+var LocalAgentCatalogSnapshot = class {
+  agents;
+  installableAgents;
+  constructor(agents, installableAgents) {
+    this.agents = Object.freeze([...agents]);
+    this.installableAgents = Object.freeze([...installableAgents]);
+  }
+};
+var LocalAgentCatalogError = class extends Error {
+  code = "agent_not_ready";
+  constructor() {
+    super("The requested local Agent is not ready");
+    this.name = "LocalAgentCatalogError";
+  }
+};
+var LocalAgentCatalog = class {
+  #snapshot;
+  constructor(agents, installableAgents) {
+    this.#snapshot = this.validate(agents, installableAgents);
+  }
+  find = (agentId) => {
+    for (const agent of this.#snapshot.agents) {
+      if (agent.id === agentId) {
+        return agent;
+      }
+    }
+    throw new LocalAgentCatalogError();
+  };
+  read = () => this.#snapshot;
+  transition = (agents, installableAgents) => {
+    const next = this.validate(agents, installableAgents);
+    this.#snapshot = next;
+    return next;
+  };
+  validate = (agents, installableAgents) => {
+    const identifiers = /* @__PURE__ */ new Set();
+    for (const agent of agents) {
+      if (identifiers.has(agent.id)) {
+        throw new Error("The local Agent catalog contains duplicate entries");
+      }
+      identifiers.add(agent.id);
+    }
+    for (const agent of installableAgents) {
+      if (identifiers.has(agent.id)) {
+        throw new Error("A local Agent cannot be ready and installable");
+      }
+      identifiers.add(agent.id);
+    }
+    return new LocalAgentCatalogSnapshot(agents, installableAgents);
+  };
+};
+
+// src/config.ts
+function loadApprovedRoot() {
+  return process.env["MOBIUS_APPROVED_ROOT"] ?? process.cwd();
 }
-function createDaemonConfig(connection) {
+function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
-    agents: loadLocalAgents(),
+    agents,
     approvedRoot: connection.approvedRoot,
     auditDatabasePath: connection.auditDatabasePath,
     bindingId: "workspace",
+    catalog: new LocalAgentCatalog(agents, installableAgents),
     channelId: connection.channelId,
+    installableAgents,
     relayUrl: connection.relayUrl
   };
 }
-function findLocalAgent(agents, agentId) {
-  for (const agent of agents) {
-    if (agent.id === agentId) {
-      return agent;
-    }
-  }
-  throw new Error("The requested local agent is not approved");
-}
 function loadDaemonConfig() {
   const relayUrl = new URL(
     // biome-ignore lint/complexity/useLiteralKeys: Environment variables use an index signature.
@@ -95,22 +496,26 @@ function loadDaemonConfig() {
   if (relayUrl.protocol !== "ws:" && relayUrl.protocol !== "wss:") {
     throw new Error("MOBIUS_RELAY_URL must use ws or wss");
   }
-  return createDaemonConfig({
-    // biome-ignore lint/complexity/useLiteralKeys: Environment variables use an index signature.
-    approvedRoot: process.env["MOBIUS_APPROVED_ROOT"] ?? repositoryRoot,
-    auditDatabasePath: (
+  return createDaemonConfig(
+    {
+      approvedRoot: loadApprovedRoot(),
+      auditDatabasePath: (
+        // biome-ignore lint/complexity/useLiteralKeys: Environment variables use an index signature.
+        process.env["MOBIUS_AUDIT_DATABASE"] ?? fileURLToPath(
+          new URL("../../../.mobius/daemon.sqlite", import.meta.url)
+        )
+      ),
       // biome-ignore lint/complexity/useLiteralKeys: Environment variables use an index signature.
-      process.env["MOBIUS_AUDIT_DATABASE"] ?? fileURLToPath(new URL("../../../.mobius/daemon.sqlite", import.meta.url))
-    ),
-    // biome-ignore lint/complexity/useLiteralKeys: Environment variables use an index signature.
-    channelId: process.env["MOBIUS_CHANNEL_ID"] ?? "local",
-    relayUrl
-  });
+      channelId: process.env["MOBIUS_CHANNEL_ID"] ?? "local",
+      relayUrl
+    },
+    [],
+    []
+  );
 }
 
 // src/acp/session-manager.ts
-import { spawn } from "node:child_process";
-import { once } from "node:events";
+import { spawn as spawn2 } from "node:child_process";
 import {
   methods as methods2,
   ndJsonStream,
@@ -2077,8 +2482,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+var mac = (delimiter2) => {
+  const escapedDelim = escapeRegex(delimiter2 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -19004,6 +19409,14 @@ var SESSION_ELICITATION_RESPOND_KIND = "session.elicitation.respond";
 var SESSION_ELICITATION_RESOLVED_KIND = "session.elicitation.resolved";
 var SESSION_OPERATION_FAILED_KIND = "session.operation.failed";
 var AGENT_CONTENT_KIND = "agent.content";
+var AGENT_INSTALL_REQUEST_KIND = "agent.install.request";
+var AGENT_INSTALL_CANCEL_KIND = "agent.install.cancel";
+var AGENT_INSTALL_AWAITING_APPROVAL_KIND = "agent.install.awaiting_approval";
+var AGENT_INSTALL_STARTED_KIND = "agent.install.started";
+var AGENT_INSTALL_PROGRESS_KIND = "agent.install.progress";
+var AGENT_INSTALL_COMPLETED_KIND = "agent.install.completed";
+var AGENT_INSTALL_FAILED_KIND = "agent.install.failed";
+var AGENT_INSTALL_CANCELLED_KIND = "agent.install.cancelled";
 var IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var DIRECTORY_IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
 var IDENTIFIER = external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN);
@@ -19277,6 +19690,55 @@ var agentContentEventSchema = external_exports.strictObject({
   protocolVersion: PROTOCOL_VERSION,
   sessionId: IDENTIFIER
 }).readonly();
+var agentInstallIdentityFields = {
+  agentId: IDENTIFIER,
+  protocolVersion: PROTOCOL_VERSION,
+  requestId: IDENTIFIER
+};
+var agentInstallRequestCommandSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  kind: external_exports.literal(AGENT_INSTALL_REQUEST_KIND)
+}).readonly();
+var agentInstallCancelCommandSchema = external_exports.strictObject({
+  kind: external_exports.literal(AGENT_INSTALL_CANCEL_KIND),
+  protocolVersion: PROTOCOL_VERSION,
+  requestId: IDENTIFIER
+}).readonly();
+var agentInstallAwaitingApprovalEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  kind: external_exports.literal(AGENT_INSTALL_AWAITING_APPROVAL_KIND)
+}).readonly();
+var agentInstallStartedEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  kind: external_exports.literal(AGENT_INSTALL_STARTED_KIND)
+}).readonly();
+var installationStageSchema = external_exports.enum([
+  "downloading",
+  "verifying",
+  "installing_agent",
+  "installing_adapter",
+  "checking_acp"
+]);
+var agentInstallProgressEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  kind: external_exports.literal(AGENT_INSTALL_PROGRESS_KIND),
+  stage: installationStageSchema
+}).readonly();
+var agentInstallCompletedEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  authenticationMayBeRequired: external_exports.boolean(),
+  kind: external_exports.literal(AGENT_INSTALL_COMPLETED_KIND)
+}).readonly();
+var agentInstallFailedEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  code: IDENTIFIER,
+  kind: external_exports.literal(AGENT_INSTALL_FAILED_KIND),
+  message: external_exports.string().min(1).max(500)
+}).readonly();
+var agentInstallCancelledEventSchema = external_exports.strictObject({
+  ...agentInstallIdentityFields,
+  kind: external_exports.literal(AGENT_INSTALL_CANCELLED_KIND)
+}).readonly();
 function parseJson(encoded) {
   try {
     return JSON.parse(encoded);
@@ -19325,6 +19787,14 @@ var decodeSessionElicitationRespondCommand = (encoded) => decode3(encoded, sessi
 var encodeSessionElicitationResolvedEvent = (message) => encode3(message, sessionElicitationResolvedEventSchema);
 var encodeSessionOperationFailedEvent = (message) => encode3(message, sessionOperationFailedEventSchema);
 var encodeAgentContentEvent = (message) => encode3(message, agentContentEventSchema);
+var decodeAgentInstallRequestCommand = (encoded) => decode3(encoded, agentInstallRequestCommandSchema);
+var decodeAgentInstallCancelCommand = (encoded) => decode3(encoded, agentInstallCancelCommandSchema);
+var encodeAgentInstallAwaitingApprovalEvent = (message) => encode3(message, agentInstallAwaitingApprovalEventSchema);
+var encodeAgentInstallStartedEvent = (message) => encode3(message, agentInstallStartedEventSchema);
+var encodeAgentInstallProgressEvent = (message) => encode3(message, agentInstallProgressEventSchema);
+var encodeAgentInstallCompletedEvent = (message) => encode3(message, agentInstallCompletedEventSchema);
+var encodeAgentInstallFailedEvent = (message) => encode3(message, agentInstallFailedEventSchema);
+var encodeAgentInstallCancelledEvent = (message) => encode3(message, agentInstallCancelledEventSchema);
 
 // ../protocol/src/messages.ts
 var SESSION_PROMPT_KIND = "session.prompt";
@@ -20398,7 +20868,7 @@ function createWritableAcpStream(output2) {
       if (outputFailure !== void 0) {
         return Promise.reject(outputFailure);
       }
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve6, reject) => {
         pendingWriteFailures.add(reject);
         output2.write(chunk, (error61) => {
           pendingWriteFailures.delete(reject);
@@ -20411,34 +20881,12 @@ function createWritableAcpStream(output2) {
             reject(outputFailure);
             return;
           }
-          resolve2();
+          resolve6();
         });
       });
     }
   });
 }
-async function stopAgentProcess(child) {
-  child.stdin?.end();
-  if (child.exitCode !== null) {
-    return;
-  }
-  child.kill("SIGTERM");
-  try {
-    await once(child, "exit", {
-      signal: AbortSignal.timeout(PROCESS_STOP_TIMEOUT_MILLISECONDS)
-    });
-  } catch {
-    if (child.exitCode === null) {
-      child.kill("SIGKILL");
-      try {
-        await once(child, "exit", {
-          signal: AbortSignal.timeout(PROCESS_STOP_TIMEOUT_MILLISECONDS)
-        });
-      } catch {
-      }
-    }
-  }
-}
 function truncate2(value, maximumLength) {
   return value.length <= maximumLength ? value : `${value.slice(0, Math.max(0, maximumLength - 1))}\u2026`;
 }
@@ -20961,8 +21409,11 @@ var AcpProcessSession = class _AcpProcessSession {
     this.#getObserver = getObserver;
     this.#mobiusSessionId = mobiusSessionId;
     this.#store = store;
-    this.#child = spawn(agent.command, [...agent.arguments], {
+    this.#child = spawn2(agent.adapterPath, [...agent.arguments], {
       cwd,
+      detached: process.platform !== "win32",
+      env: { ...process.env, ...agent.environment },
+      shell: false,
       stdio: ["pipe", "pipe", "pipe"]
     });
     const stdin = this.#child.stdin;
@@ -20976,9 +21427,9 @@ var AcpProcessSession = class _AcpProcessSession {
     stderr.on("data", (chunk) => {
       process.stderr.write(`[${agent.id}-acp] ${chunk}`);
     });
-    this.#processExit = new Promise((resolve2) => {
-      this.#child.once("error", resolve2);
-      this.#child.once("exit", resolve2);
+    this.#processExit = new Promise((resolve6) => {
+      this.#child.once("error", resolve6);
+      this.#child.once("exit", resolve6);
     });
     const stream = ndJsonStream(
       createWritableAcpStream(stdin),
@@ -20988,6 +21439,18 @@ var AcpProcessSession = class _AcpProcessSession {
   }
   static start = async (options, getObserver, store) => {
     options.signal.throwIfAborted();
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(options.agent.adapterIdentity),
+      revalidateExecutable(options.agent.agentIdentity)
+    ]);
+    options.signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new AcpExecutionError(
+        "The local Agent runtime changed; restart Mobius before starting a new conversation",
+        {},
+        "agent_runtime_changed"
+      );
+    }
     const runtime = new _AcpProcessSession(
       options.agent,
       options.cwd,
@@ -21029,7 +21492,7 @@ var AcpProcessSession = class _AcpProcessSession {
             plan: {},
             session: { configOptions: { boolean: {} } }
           },
-          clientInfo: { name: "mobius", version: "0.0.2" },
+          clientInfo: { name: "mobius", version: "0.0.3" },
           protocolVersion: PROTOCOL_VERSION2
         },
         { cancellationSignal: signal }
@@ -21667,7 +22130,7 @@ var AcpProcessSession = class _AcpProcessSession {
   };
   closeProcess = async () => {
     this.#connection.close();
-    await stopAgentProcess(this.#child);
+    await stopProcessTree(this.#child);
   };
   race = async (operation, exitMessage, signal) => {
     signal.throwIfAborted();
@@ -21989,9 +22452,16 @@ var AuditStore = class {
         recorded_at TEXT NOT NULL,
         event TEXT NOT NULL,
         command_id TEXT NOT NULL,
-        session_id TEXT NOT NULL
+        session_id TEXT NOT NULL,
+        details_json TEXT NOT NULL DEFAULT '{}'
       ) STRICT
     `);
+    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
+    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
+      this.database.exec(
+        "ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'"
+      );
+    }
   }
   record(record2) {
     this.database.prepare(
@@ -22000,14 +22470,16 @@ var AuditStore = class {
             recorded_at,
             event,
             command_id,
-            session_id
-          ) VALUES (?, ?, ?, ?)
+            session_id,
+            details_json
+          ) VALUES (?, ?, ?, ?, ?)
         `
     ).run(
       (/* @__PURE__ */ new Date()).toISOString(),
       record2.event,
       record2.commandId,
-      record2.sessionId
+      record2.sessionId,
+      JSON.stringify(record2.details ?? {})
     );
   }
   close() {
@@ -22016,7 +22488,7 @@ var AuditStore = class {
 };
 
 // src/authorization/authorize-binding.ts
-import { realpath, stat } from "node:fs/promises";
+import { realpath as realpath2, stat as stat2 } from "node:fs/promises";
 var LocalAuthorizationError = class extends Error {
   code = "local_authorization_failed";
   constructor(message, options = {}) {
@@ -22029,8 +22501,8 @@ async function authorizeBinding(requestedBindingId, approvedBindingId, approvedR
     throw new LocalAuthorizationError("The runtime binding is not authorized");
   }
   try {
-    const resolvedRoot = await realpath(approvedRoot);
-    const metadata = await stat(resolvedRoot);
+    const resolvedRoot = await realpath2(approvedRoot);
+    const metadata = await stat2(resolvedRoot);
     if (!metadata.isDirectory()) {
       throw new LocalAuthorizationError("The approved root is not a directory");
     }
@@ -22048,427 +22520,2543 @@ async function authorizeBinding(requestedBindingId, approvedBindingId, approvedR
 // src/pairing/pair-local-machine.ts
 import { randomUUID } from "node:crypto";
 import {
-  mkdir,
-  open as open2,
-  realpath as realpath2,
-  rename,
-  stat as stat2,
+  mkdir as mkdir2,
+  open as open4,
+  realpath as realpath5,
+  rename as rename2,
+  stat as stat4,
   writeFile
 } from "node:fs/promises";
-import { homedir, hostname as hostname3 } from "node:os";
-import { basename, join, resolve } from "node:path";
+import { hostname as hostname3 } from "node:os";
+import { basename, join as join6, resolve as resolve4 } from "node:path";
 import { fetch } from "undici";
 
-// src/network/environment-proxy.ts
-import { EnvHttpProxyAgent } from "undici";
-var environmentProxyDispatcher = new EnvHttpProxyAgent();
+// src/agent-catalog/discover-local-agents.ts
+import { spawn as spawn3 } from "node:child_process";
+import { realpath as realpath4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join5, relative as relative3, resolve as resolve3 } from "node:path";
+import {
+  methods as methods3,
+  ndJsonStream as ndJsonStream2,
+  PROTOCOL_VERSION as PROTOCOL_VERSION3
+} from "@agentclientprotocol/sdk";
 
-// src/pairing/pair-local-machine.ts
-var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
-var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
-var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
-var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
-var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken"];
-var SAVED_CONNECTION_KEYS = [
-  "approvedRoot",
-  "channelId",
-  "daemonToken",
-  "relayOrigin"
-];
-var PairingClientError = class extends Error {
+// src/agent-installation/installation-grants.ts
+import { open as open2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var MAX_GRANT_FILE_LENGTH = 16 * 1024;
+var AGENT_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readGrantedAgents(stateDirectory) {
+  const path = join2(stateDirectory, "installation-grants.json");
+  let handle;
+  try {
+    handle = await open2(path, "r");
+  } catch (error61) {
+    if (error61 instanceof Error && "code" in error61 && error61.code === "ENOENT") {
+      return /* @__PURE__ */ new Set();
+    }
+    throw error61;
+  }
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > MAX_GRANT_FILE_LENGTH || typeof process.getuid === "function" && metadata.uid !== process.getuid() || process.platform !== "win32" && (metadata.mode & 63) !== 0) {
+      throw new Error("The local installation grant file is not private");
+    }
+    const encoded = await handle.readFile({ encoding: "utf8" });
+    const value = JSON.parse(encoded);
+    if (!isRecord4(value) || Object.keys(value).length !== 2 || value["version"] !== 1 || !Array.isArray(value["agents"])) {
+      throw new Error("The local installation grant file is invalid");
+    }
+    const agents = /* @__PURE__ */ new Set();
+    for (const candidate of value["agents"]) {
+      if (typeof candidate !== "string" || !AGENT_ID_PATTERN.test(candidate) || agents.has(candidate)) {
+        throw new Error("The local installation grant file is invalid");
+      }
+      agents.add(candidate);
+    }
+    return agents;
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/agent-installation/managed-adapter-installer.ts
+import {
+  mkdir,
+  mkdtemp,
+  open as open3,
+  realpath as realpath3,
+  rename,
+  rm,
+  stat as stat3
+} from "node:fs/promises";
+import { delimiter, dirname as dirname3, join as join3, relative as relative2 } from "node:path";
+var ADAPTER_INSTALL_TIMEOUT_MILLISECONDS = 2 * 60 * 1e3;
+var PACKAGE_METADATA_LIMIT_BYTES = 64 * 1024;
+var ManagedAdapterInstallError = class extends Error {
   code;
   constructor(code, message, options = {}) {
     super(message, options);
     this.code = code;
-    this.name = "PairingClientError";
+    this.name = "ManagedAdapterInstallError";
   }
 };
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function hasExactKeys(value, expectedKeys) {
-  const keys = Object.keys(value);
-  return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
+function packagePath(root, packageName) {
+  return join3(root, "node_modules", ...packageName.split("/"));
 }
-function readSingleOption(arguments_, option) {
-  const values = [];
-  for (let index = 0; index < arguments_.length; index += 1) {
-    if (arguments_[index] !== option) {
-      continue;
-    }
-    const value = arguments_[index + 1];
-    if (value === void 0 || value.startsWith("--")) {
-      throw new PairingClientError(
-        "invalid_arguments",
-        `${option} requires a value`
+async function readPackageJson(path) {
+  const handle = await open3(path, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > PACKAGE_METADATA_LIMIT_BYTES) {
+      throw new ManagedAdapterInstallError(
+        "adapter_verification_failed",
+        "The managed adapter package metadata is invalid"
       );
     }
-    values.push(value);
-    index += 1;
-  }
-  if (values.length !== 1) {
-    throw new PairingClientError(
-      "invalid_arguments",
-      `${option} must be provided exactly once`
+    const value = JSON.parse(
+      await handle.readFile({ encoding: "utf8" })
     );
-  }
-  return values[0] ?? "";
-}
-function assertKnownArguments(arguments_) {
-  for (let index = 0; index < arguments_.length; index += 2) {
-    const option = arguments_[index];
-    if (option !== "--url" && option !== "--code" && option !== "--root") {
-      throw new PairingClientError(
-        "invalid_arguments",
-        `Unknown pairing option: ${option ?? "missing option"}`
+    if (!isRecord5(value)) {
+      throw new ManagedAdapterInstallError(
+        "adapter_verification_failed",
+        "The managed adapter package metadata is invalid"
       );
     }
+    return value;
+  } finally {
+    await handle.close();
   }
 }
-function parseRelayOrigin(value) {
-  let url2;
-  try {
-    url2 = new URL(value);
-  } catch (error61) {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL is invalid",
-      { cause: error61 }
+function readBinPath(packageMetadata, executableName) {
+  const bin = packageMetadata["bin"];
+  if (typeof bin === "string") {
+    return bin;
+  }
+  if (isRecord5(bin) && typeof bin[executableName] === "string") {
+    return bin[executableName];
+  }
+  throw new ManagedAdapterInstallError(
+    "adapter_verification_failed",
+    "The managed adapter executable declaration is invalid"
+  );
+}
+async function validateManagedAdapter(root, specification) {
+  const rootPath = await realpath3(root);
+  const packageRoot = await realpath3(
+    packagePath(rootPath, specification.adapterPackage)
+  );
+  const packageDifference = relative2(rootPath, packageRoot);
+  if (packageDifference.startsWith("..") || packageDifference.length === 0) {
+    throw new ManagedAdapterInstallError(
+      "adapter_verification_failed",
+      "The managed adapter package escaped its private cache"
     );
   }
-  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL must use http or https"
+  const metadata = await readPackageJson(join3(packageRoot, "package.json"));
+  if (metadata["name"] !== specification.adapterPackage || metadata["version"] !== specification.adapterVersion) {
+    throw new ManagedAdapterInstallError(
+      "adapter_verification_failed",
+      "The managed adapter package identity is invalid"
     );
   }
-  if (url2.username.length > 0 || url2.password.length > 0) {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL cannot contain credentials"
+  const declaredBin = readBinPath(metadata, specification.adapterExecutable);
+  const executable = await resolveExecutablePath(
+    join3(packageRoot, declaredBin)
+  );
+  if (executable === null) {
+    throw new ManagedAdapterInstallError(
+      "adapter_verification_failed",
+      "The managed adapter executable is invalid"
     );
   }
-  if (url2.protocol === "http:" && url2.hostname !== "127.0.0.1" && url2.hostname !== "localhost") {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "A remote relay must use https"
+  const executableDifference = relative2(rootPath, executable.path);
+  if (executableDifference.startsWith("..") || executableDifference.length === 0) {
+    throw new ManagedAdapterInstallError(
+      "adapter_verification_failed",
+      "The managed adapter executable escaped its private cache"
     );
   }
-  url2.hash = "";
-  url2.pathname = "/";
-  url2.search = "";
-  return url2;
+  return executable;
 }
-function parsePairingCode(value) {
-  const code = value.trim().toUpperCase();
-  if (!PAIRING_CODE_PATTERN.test(code)) {
-    throw new PairingClientError(
-      "invalid_pairing_code",
-      "The pairing code must match the code shown in the browser"
+var ManagedAdapterInstaller = class {
+  #approvedRoot;
+  #environment;
+  #stateDirectory;
+  constructor(options) {
+    this.#approvedRoot = options.approvedRoot;
+    this.#environment = options.environment;
+    this.#stateDirectory = options.stateDirectory;
+  }
+  install = async (specification, signal) => {
+    signal.throwIfAborted();
+    const agentCache = join3(this.#stateDirectory, "adapters", specification.id);
+    const published = join3(agentCache, specification.adapterVersion);
+    try {
+      const metadata = await stat3(published);
+      if (metadata.isDirectory()) {
+        return await validateManagedAdapter(published, specification);
+      }
+    } catch (error61) {
+      if (!(error61 instanceof Error) || !("code" in error61) || error61.code !== "ENOENT") {
+        throw error61;
+      }
+    }
+    await mkdir(agentCache, { mode: 448, recursive: true });
+    const staging = await mkdtemp(
+      join3(agentCache, `.${specification.adapterVersion}.staging-`)
     );
+    try {
+      const npm = await findExecutableOnPath(
+        process.platform === "win32" ? "npm.cmd" : "npm",
+        this.#environment,
+        this.#approvedRoot
+      );
+      if (npm === null) {
+        throw new ManagedAdapterInstallError(
+          "package_manager_not_found",
+          "A supported npm executable is required to install the ACP adapter"
+        );
+      }
+      await runBoundedProcess({
+        arguments: [
+          "install",
+          "--prefix",
+          staging,
+          "--omit=optional",
+          "--ignore-scripts",
+          "--no-audit",
+          "--no-fund",
+          "--package-lock=false",
+          "--save=false",
+          "--registry=https://registry.npmjs.org/",
+          `${specification.adapterPackage}@${specification.adapterVersion}`
+        ],
+        command: npm.path,
+        cwd: staging,
+        environment: {
+          HOME: join3(staging, "home"),
+          NPM_CONFIG_AUDIT: "false",
+          NPM_CONFIG_FUND: "false",
+          NPM_CONFIG_IGNORE_SCRIPTS: "true",
+          NPM_CONFIG_OMIT: "optional",
+          NPM_CONFIG_REGISTRY: "https://registry.npmjs.org/",
+          PATH: `${dirname3(process.execPath)}${delimiter}/usr/bin${delimiter}/bin`
+        },
+        outputLimitBytes: 64 * 1024,
+        signal,
+        timeoutMilliseconds: ADAPTER_INSTALL_TIMEOUT_MILLISECONDS
+      });
+      await validateManagedAdapter(staging, specification);
+      try {
+        await rename(staging, published);
+      } catch (error61) {
+        try {
+          return await validateManagedAdapter(published, specification);
+        } catch {
+          throw new ManagedAdapterInstallError(
+            "adapter_publish_failed",
+            "The managed adapter could not be published",
+            { cause: error61 }
+          );
+        }
+      }
+      return await validateManagedAdapter(published, specification);
+    } catch (error61) {
+      if (signal.aborted) {
+        signal.throwIfAborted();
+      }
+      if (error61 instanceof ManagedAdapterInstallError) {
+        throw error61;
+      }
+      throw new ManagedAdapterInstallError(
+        "adapter_install_failed",
+        "The pinned ACP adapter could not be installed",
+        { cause: error61 }
+      );
+    } finally {
+      await rm(staging, { force: true, recursive: true });
+    }
+  };
+};
+
+// src/storage/state-directory.ts
+import { homedir } from "node:os";
+import { join as join4, resolve as resolve2 } from "node:path";
+function readStateDirectory(environment = process.env) {
+  const configured = environment["MOBIUS_STATE_DIRECTORY"]?.trim();
+  if (configured !== void 0 && configured.length > 0) {
+    return resolve2(configured);
   }
-  return code;
+  return join4(homedir(), ".mobius");
 }
-function parsePairCommand(arguments_) {
-  assertKnownArguments(arguments_);
-  return {
-    code: parsePairingCode(readSingleOption(arguments_, "--code")),
-    relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
-    root: readSingleOption(arguments_, "--root")
-  };
+
+// src/agent-catalog/discover-local-agents.ts
+var VERSION_PROBE_TIMEOUT_MILLISECONDS = 3e3;
+var ACP_PROBE_TIMEOUT_MILLISECONDS = 5e3;
+var ACP_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+var LocalAgentSpecification = class {
+  recoveryCommand = () => `npm install -g --omit=optional ${this.adapterPackage}@${this.adapterVersion}`;
+  supportsInstallation = (platform, architecture) => (platform === "darwin" || platform === "linux") && (architecture === "arm64" || architecture === "x64");
+};
+var CodexAgentSpecification = class extends LocalAgentSpecification {
+  adapterEnvironmentVariable = "CODEX_PATH";
+  adapterExecutable = "codex-acp";
+  adapterOverrideVariable = "MOBIUS_CODEX_ACP_PATH";
+  adapterPackage = "@agentclientprotocol/codex-acp";
+  adapterVersion = "1.8.0";
+  agentExecutable = "codex";
+  agentOverrideVariable = "MOBIUS_CODEX_PATH";
+  id = "codex";
+  label = "Codex";
+  managedAdapterExecutablePath = [
+    "adapters",
+    "codex",
+    "1.8.0",
+    "node_modules",
+    "@agentclientprotocol",
+    "codex-acp",
+    "dist",
+    "index.js"
+  ];
+  managedAgentExecutablePath = ["agents", "codex", "bin", "codex"];
+};
+var ClaudeCodeAgentSpecification = class extends LocalAgentSpecification {
+  adapterEnvironmentVariable = "CLAUDE_CODE_EXECUTABLE";
+  adapterExecutable = "claude-agent-acp";
+  adapterOverrideVariable = "MOBIUS_CLAUDE_ACP_PATH";
+  adapterPackage = "@agentclientprotocol/claude-agent-acp";
+  adapterVersion = "0.73.0";
+  agentExecutable = "claude";
+  agentOverrideVariable = "MOBIUS_CLAUDE_PATH";
+  id = "claude";
+  label = "Claude Code";
+  managedAdapterExecutablePath = [
+    "adapters",
+    "claude",
+    "0.73.0",
+    "node_modules",
+    "@agentclientprotocol",
+    "claude-agent-acp",
+    "dist",
+    "index.js"
+  ];
+  managedAgentExecutablePath = [
+    "agents",
+    "claude",
+    "home",
+    ".local",
+    "bin",
+    "claude"
+  ];
+};
+function supportedLocalAgentSpecifications() {
+  return Object.freeze([
+    new CodexAgentSpecification(),
+    new ClaudeCodeAgentSpecification()
+  ]);
 }
-function parseChannelArgument(arguments_) {
-  if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
-    throw new PairingClientError(
-      "invalid_arguments",
-      "Usage: mobius start --channel <channel-id>"
-    );
+var AgentDiscovery = class {
+  specification;
+  constructor(specification) {
+    this.specification = specification;
   }
-  const channelId = arguments_[1] ?? "";
-  if (!IDENTIFIER_PATTERN3.test(channelId)) {
-    throw new PairingClientError(
-      "invalid_channel_id",
-      "The saved channel ID is invalid"
-    );
+};
+var AvailableAgent = class extends AgentDiscovery {
+  agent;
+  status = "ready";
+  constructor(specification, agent) {
+    super(specification);
+    this.agent = agent;
   }
-  return channelId;
-}
-async function resolveApprovedRoot(path) {
-  const requestedRoot = resolve(path);
-  try {
-    const approvedRoot = await realpath2(requestedRoot);
-    const metadata = await stat2(approvedRoot);
-    if (!metadata.isDirectory()) {
-      throw new PairingClientError(
-        "invalid_workspace",
-        "The approved workspace root is not a directory"
-      );
-    }
-    return approvedRoot;
-  } catch (error61) {
-    if (error61 instanceof PairingClientError) {
-      throw error61;
-    }
-    throw new PairingClientError(
-      "invalid_workspace",
-      "The approved workspace root cannot be resolved",
-      { cause: error61 }
-    );
+};
+var UnavailableAgent = class extends AgentDiscovery {
+};
+var MissingAdapter = class extends UnavailableAgent {
+  code = "adapter_not_found";
+  message = "ACP adapter not found";
+  status = "missing_adapter";
+  constructor(specification) {
+    super(specification);
   }
-}
-async function readJsonResponse(response) {
-  if (response.headers.get("cf-mitigated") === "challenge") {
-    throw new PairingClientError(
-      "relay_challenge",
-      "Cloudflare is protecting this temporary preview. Claim the deployment or use an authenticated deployment, then pair again"
+};
+var MissingAgent = class extends UnavailableAgent {
+  code = "agent_not_found";
+  message = "Agent executable not found";
+  status = "missing_agent";
+  constructor(specification) {
+    super(specification);
+  }
+};
+var ProbeFailed = class extends UnavailableAgent {
+  code;
+  message;
+  status = "probe_failed";
+  constructor(specification, code, message) {
+    super(specification);
+    this.code = code;
+    this.message = message;
+  }
+};
+var IncompatibleAdapter = class extends UnavailableAgent {
+  code = "acp_incompatible";
+  message = "ACP adapter is incompatible";
+  status = "incompatible_adapter";
+  constructor(specification) {
+    super(specification);
+  }
+};
+var LocalAgentInventory = class {
+  available;
+  discoveries;
+  installable;
+  unavailable;
+  constructor(discoveries, grantedAgents = /* @__PURE__ */ new Set(), platform = process.platform, architecture = process.arch) {
+    const available = [];
+    const unavailable = [];
+    for (const discovery of discoveries) {
+      if (discovery instanceof AvailableAgent) {
+        available.push(discovery);
+      } else if (discovery instanceof UnavailableAgent) {
+        unavailable.push(discovery);
+      } else {
+        throw new Error("Unsupported Agent discovery outcome");
+      }
+    }
+    this.available = Object.freeze(available);
+    this.discoveries = Object.freeze([...discoveries]);
+    this.installable = Object.freeze(
+      unavailable.filter(
+        (discovery) => discovery.specification.supportsInstallation(platform, architecture)
+      ).map(
+        (discovery) => new InstallableAgentDefinition(
+          discovery.specification.id,
+          discovery.specification.label,
+          !grantedAgents.has(discovery.specification.id)
+        )
+      )
     );
+    this.unavailable = Object.freeze(unavailable);
   }
-  const encoded = await response.text();
+  readyAgents = () => this.available.map((discovery) => discovery.agent);
+};
+var AgentProbeError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "AgentProbeError";
+  }
+};
+var DiscoveryAcpHandler = class {
+  onElicitation = (_request, _signal) => Promise.reject(new Error("ACP probe does not accept elicitations"));
+  onElicitationComplete = (_notification) => Promise.resolve();
+  onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
+  onUpdate = (_notification) => Promise.resolve();
+};
+async function authorizeManagedExecutable(managed, options) {
+  const approvedRoot = await realpath4(resolve3(options.approvedRoot));
+  const requestedDifference = relative3(
+    approvedRoot,
+    managed.identity.requestedPath
+  );
+  const resolvedDifference = relative3(approvedRoot, managed.path);
+  const requestedInside = requestedDifference.length === 0 || !requestedDifference.startsWith("..") && !isAbsolute2(requestedDifference);
+  const resolvedInside = resolvedDifference.length === 0 || !resolvedDifference.startsWith("..") && !isAbsolute2(resolvedDifference);
+  return requestedInside || resolvedInside ? null : managed;
+}
+async function resolveManagedExecutable(managedExecutablePath, options) {
+  const managed = await resolveExecutablePath(
+    join5(readStateDirectory(options.environment), ...managedExecutablePath),
+    options.platform
+  );
+  return managed === null ? null : await authorizeManagedExecutable(managed, options);
+}
+async function resolveManagedAdapterExecutable(specification, options) {
+  let managed;
   try {
-    return JSON.parse(encoded);
-  } catch (error61) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid response",
-      { cause: error61 }
+    managed = await validateManagedAdapter(
+      join5(
+        readStateDirectory(options.environment),
+        "adapters",
+        specification.id,
+        specification.adapterVersion
+      ),
+      specification
     );
+  } catch {
+    return null;
   }
+  return await authorizeManagedExecutable(managed, options);
 }
-function readRelayError(value) {
-  if (isRecord4(value)) {
-    const error61 = value["error"];
-    if (isRecord4(error61)) {
-      const code = error61["code"];
-      const message = error61["message"];
-      if (typeof code === "string" && typeof message === "string") {
-        return new PairingClientError(code, message);
-      }
+async function resolveSpecificationExecutables(executableName, overrideVariable, resolveManaged, options) {
+  const override = options.environment[overrideVariable];
+  if (override !== void 0) {
+    if (override.length === 0 || !isAbsolute2(override)) {
+      return [];
     }
+    const executable = await resolveExecutablePath(override, options.platform);
+    return executable === null ? [] : [executable];
   }
-  return new PairingClientError(
-    "pairing_failed",
-    "The relay could not pair this machine"
+  const external = await findExecutableOnPath(
+    executableName,
+    options.environment,
+    options.approvedRoot,
+    options.platform
+  );
+  const managed = await resolveManaged();
+  if (external === null) {
+    return managed === null ? [] : [managed];
+  }
+  if (managed === null || managed.path === external.path) {
+    return [external];
+  }
+  return [external, managed];
+}
+async function resolveAgentExecutables(specification, options) {
+  return await resolveSpecificationExecutables(
+    specification.agentExecutable,
+    specification.agentOverrideVariable,
+    async () => await resolveManagedExecutable(
+      specification.managedAgentExecutablePath,
+      options
+    ),
+    options
   );
 }
-function decodeClaimResponse(value) {
-  if (!isRecord4(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid pairing response"
-    );
-  }
-  const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN3.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken)) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid pairing response"
+async function resolveAdapterExecutables(specification, options) {
+  return await resolveSpecificationExecutables(
+    specification.adapterExecutable,
+    specification.adapterOverrideVariable,
+    async () => await resolveManagedAdapterExecutable(specification, options),
+    options
+  );
+}
+async function resolveAgentExecutable(specification, options) {
+  const executables = await resolveAgentExecutables(specification, options);
+  return executables[0] ?? null;
+}
+async function resolveAdapterExecutable(specification, options) {
+  const executables = await resolveAdapterExecutables(specification, options);
+  return executables[0] ?? null;
+}
+function normalizedVersion(output2) {
+  return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
+}
+async function probeVersion(executable, environment, approvedRoot, signal) {
+  const result = await runBoundedProcess({
+    arguments: ["--version"],
+    command: executable.path,
+    cwd: approvedRoot,
+    environment,
+    signal,
+    timeoutMilliseconds: VERSION_PROBE_TIMEOUT_MILLISECONDS
+  });
+  const version2 = normalizedVersion(result.stdout || result.stderr);
+  if (version2.length === 0) {
+    throw new ProcessExecutionError(
+      "process_exit_failed",
+      "The executable did not report a version"
     );
   }
-  return { channelId, daemonToken };
+  return version2;
 }
-async function claimPairing(options, approvedRoot) {
-  const agents = loadLocalAgents().map((agent) => ({
-    id: agent.id,
-    label: agent.label
-  }));
-  const endpoint = new URL("/v1/pairings/claim", options.relayOrigin);
-  let response;
-  try {
-    response = await fetch(endpoint, {
-      body: JSON.stringify({
-        agents,
-        machineName: hostname3(),
-        pairingCode: options.code,
-        workspaceName: basename(approvedRoot) || "Local workspace"
-      }),
-      dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
-      method: "POST",
-      signal: AbortSignal.timeout(PAIRING_TIMEOUT_MILLISECONDS)
-    });
-  } catch (error61) {
-    throw new PairingClientError(
-      "relay_unavailable",
-      "The pairing relay could not be reached",
-      { cause: error61 }
-    );
+var VerifiedAgentExecutable = class {
+  executable;
+  version;
+  constructor(executable, version2) {
+    this.executable = executable;
+    this.version = version2;
   }
-  const value = await readJsonResponse(response);
-  if (!response.ok) {
-    throw readRelayError(value);
+};
+async function findVerifiedAgentExecutable(specification, options) {
+  const executables = await resolveAgentExecutables(specification, options);
+  for (const executable of executables) {
+    try {
+      const version2 = await probeVersion(
+        executable,
+        options.environment,
+        options.approvedRoot,
+        options.signal
+      );
+      return new VerifiedAgentExecutable(executable, version2);
+    } catch {
+      if (options.signal.aborted) {
+        options.signal.throwIfAborted();
+      }
+    }
   }
-  return decodeClaimResponse(value);
+  return null;
+}
+function readableAcpStream(input2) {
+  let byteLength = 0;
+  let open6 = true;
+  return new ReadableStream({
+    start(controller) {
+      input2.on("data", (chunk) => {
+        if (!open6) {
+          return;
+        }
+        if (!(chunk instanceof Uint8Array)) {
+          open6 = false;
+          controller.error(new Error("ACP adapter produced invalid output"));
+          return;
+        }
+        byteLength += chunk.byteLength;
+        if (byteLength > ACP_OUTPUT_LIMIT_BYTES) {
+          open6 = false;
+          controller.error(new Error("ACP adapter output limit exceeded"));
+          return;
+        }
+        controller.enqueue(new Uint8Array(chunk));
+      });
+      input2.once("end", () => {
+        if (open6) {
+          open6 = false;
+          controller.close();
+        }
+      });
+      input2.once("error", (error61) => {
+        if (open6) {
+          open6 = false;
+          controller.error(error61);
+        }
+      });
+    },
+    cancel() {
+      open6 = false;
+    }
+  });
+}
+function writableAcpStream(output2) {
+  return new WritableStream({
+    write(chunk) {
+      return new Promise((resolveWrite, rejectWrite) => {
+        output2.write(chunk, (error61) => {
+          if (error61) {
+            rejectWrite(error61);
+            return;
+          }
+          resolveWrite();
+        });
+      });
+    }
+  });
+}
+async function probeAcp(agent, environment, approvedRoot, signal) {
+  signal.throwIfAborted();
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort(new Error("ACP probe timed out"));
+  }, ACP_PROBE_TIMEOUT_MILLISECONDS);
+  const abort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", abort, { once: true });
+  if (signal.aborted) {
+    abort();
+  }
+  const child = spawn3(agent.adapterPath, [...agent.arguments], {
+    cwd: approvedRoot,
+    detached: process.platform !== "win32",
+    env: { ...environment, ...agent.environment },
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const stdin = child.stdin;
+  const stdout = child.stdout;
+  const stderr = child.stderr;
+  if (stdin === null || stdout === null || stderr === null) {
+    await stopProcessTree(child);
+    throw new AgentProbeError(
+      "acp_incompatible",
+      "ACP adapter streams are unavailable"
+    );
+  }
+  let stderrBytes = 0;
+  const consumeStderr = (chunk) => {
+    stderrBytes += chunk.byteLength;
+    if (stderrBytes > ACP_OUTPUT_LIMIT_BYTES) {
+      controller.abort(new Error("ACP adapter output limit exceeded"));
+    }
+  };
+  stderr.on("data", consumeStderr);
+  const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
+    ndJsonStream2(writableAcpStream(stdin), readableAcpStream(stdout))
+  );
+  const processExit = new Promise((_resolve, reject) => {
+    child.once("error", (error61) => reject(error61));
+    child.once(
+      "exit",
+      () => reject(new Error("ACP adapter exited during initialization"))
+    );
+  });
+  try {
+    const initialized = await Promise.race([
+      connection.agent.request(
+        methods3.agent.initialize,
+        {
+          clientCapabilities: {},
+          clientInfo: { name: "mobius", version: "0.0.3" },
+          protocolVersion: PROTOCOL_VERSION3
+        },
+        { cancellationSignal: controller.signal }
+      ),
+      processExit
+    ]);
+    if (initialized.protocolVersion !== PROTOCOL_VERSION3) {
+      throw new AgentProbeError(
+        "acp_incompatible",
+        "ACP adapter selected an unsupported protocol version"
+      );
+    }
+  } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
+    if (timedOut) {
+      throw new AgentProbeError(
+        "adapter_probe_timeout",
+        "ACP adapter probe timed out",
+        { cause: error61 }
+      );
+    }
+    if (error61 instanceof AgentProbeError) {
+      throw error61;
+    }
+    throw new AgentProbeError(
+      "acp_incompatible",
+      "ACP adapter initialization failed",
+      { cause: error61 }
+    );
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", abort);
+    connection.close();
+    stdin.end();
+    stderr.removeListener("data", consumeStderr);
+    await stopProcessTree(child);
+  }
+}
+function probeFailure(specification, executableKind, error61) {
+  if (error61 instanceof AgentProbeError) {
+    return error61.code === "acp_incompatible" ? new IncompatibleAdapter(specification) : new ProbeFailed(specification, error61.code, error61.message);
+  }
+  if (error61 instanceof ProcessExecutionError) {
+    const code = error61.code === "process_timeout" ? `${executableKind}_probe_timeout` : `${executableKind}_probe_failed`;
+    return new ProbeFailed(
+      specification,
+      code,
+      `${executableKind === "agent" ? "Agent" : "Adapter"} version probe failed`
+    );
+  }
+  return new ProbeFailed(
+    specification,
+    `${executableKind}_probe_failed`,
+    `${executableKind === "agent" ? "Agent" : "Adapter"} probe failed`
+  );
+}
+async function discoverSpecification(specification, options) {
+  options.signal.throwIfAborted();
+  const [adapters, agents] = await Promise.all([
+    resolveAdapterExecutables(specification, options),
+    resolveAgentExecutables(specification, options)
+  ]);
+  if (adapters.length === 0) {
+    return new MissingAdapter(specification);
+  }
+  if (agents.length === 0) {
+    return new MissingAgent(specification);
+  }
+  let lastFailure = null;
+  for (const agent of agents) {
+    let agentVersion = "";
+    try {
+      agentVersion = await probeVersion(
+        agent,
+        options.environment,
+        options.approvedRoot,
+        options.signal
+      );
+    } catch (error61) {
+      if (options.signal.aborted) {
+        options.signal.throwIfAborted();
+      }
+      lastFailure = probeFailure(specification, "agent", error61);
+      continue;
+    }
+    for (const adapter of adapters) {
+      let adapterVersion = "";
+      try {
+        adapterVersion = await probeVersion(
+          adapter,
+          {
+            ...options.environment,
+            [specification.adapterEnvironmentVariable]: agent.path
+          },
+          options.approvedRoot,
+          options.signal
+        );
+      } catch (error61) {
+        if (options.signal.aborted) {
+          options.signal.throwIfAborted();
+        }
+        lastFailure = probeFailure(specification, "adapter", error61);
+        continue;
+      }
+      const definition = new LocalAgentDefinition(
+        specification.id,
+        specification.label,
+        adapter.path,
+        [],
+        { [specification.adapterEnvironmentVariable]: agent.path },
+        adapterVersion,
+        agentVersion,
+        adapter.identity,
+        agent.identity
+      );
+      try {
+        await probeAcp(
+          definition,
+          options.environment,
+          options.approvedRoot,
+          options.signal
+        );
+        return new AvailableAgent(specification, definition);
+      } catch (error61) {
+        if (options.signal.aborted) {
+          options.signal.throwIfAborted();
+        }
+        lastFailure = probeFailure(specification, "adapter", error61);
+      }
+    }
+  }
+  return lastFailure ?? new IncompatibleAdapter(specification);
+}
+async function discoverLocalAgentInventory(options) {
+  const specifications = options.specifications ?? supportedLocalAgentSpecifications();
+  const discoveries = await Promise.all(
+    specifications.map(
+      async (specification) => await discoverSpecification(specification, options)
+    )
+  );
+  let grantedAgents = /* @__PURE__ */ new Set();
+  try {
+    grantedAgents = await readGrantedAgents(
+      readStateDirectory(options.environment)
+    );
+  } catch {
+  }
+  return new LocalAgentInventory(
+    discoveries,
+    grantedAgents,
+    options.platform,
+    options.architecture
+  );
+}
+
+// src/network/environment-proxy.ts
+import { EnvHttpProxyAgent } from "undici";
+var environmentProxyDispatcher = new EnvHttpProxyAgent();
+
+// src/pairing/pair-local-machine.ts
+var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
+var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
+var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
+var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken"];
+var SAVED_CONNECTION_KEYS = [
+  "approvedRoot",
+  "channelId",
+  "daemonToken",
+  "relayOrigin"
+];
+var PairingClientError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "PairingClientError";
+  }
+};
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expectedKeys) {
+  const keys = Object.keys(value);
+  return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
+}
+function readSingleOption(arguments_, option) {
+  const values = [];
+  for (let index = 0; index < arguments_.length; index += 1) {
+    if (arguments_[index] !== option) {
+      continue;
+    }
+    const value = arguments_[index + 1];
+    if (value === void 0 || value.startsWith("--")) {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `${option} requires a value`
+      );
+    }
+    values.push(value);
+    index += 1;
+  }
+  if (values.length !== 1) {
+    throw new PairingClientError(
+      "invalid_arguments",
+      `${option} must be provided exactly once`
+    );
+  }
+  return values[0] ?? "";
+}
+function assertKnownArguments(arguments_) {
+  for (let index = 0; index < arguments_.length; index += 2) {
+    const option = arguments_[index];
+    if (option !== "--url" && option !== "--code" && option !== "--root") {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `Unknown pairing option: ${option ?? "missing option"}`
+      );
+    }
+  }
+}
+function parseRelayOrigin(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL is invalid",
+      { cause: error61 }
+    );
+  }
+  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL must use http or https"
+    );
+  }
+  if (url2.username.length > 0 || url2.password.length > 0) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL cannot contain credentials"
+    );
+  }
+  if (url2.protocol === "http:" && url2.hostname !== "127.0.0.1" && url2.hostname !== "localhost") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "A remote relay must use https"
+    );
+  }
+  url2.hash = "";
+  url2.pathname = "/";
+  url2.search = "";
+  return url2;
+}
+function parsePairingCode(value) {
+  const code = value.trim().toUpperCase();
+  if (!PAIRING_CODE_PATTERN.test(code)) {
+    throw new PairingClientError(
+      "invalid_pairing_code",
+      "The pairing code must match the code shown in the browser"
+    );
+  }
+  return code;
+}
+function parsePairCommand(arguments_) {
+  assertKnownArguments(arguments_);
+  return {
+    code: parsePairingCode(readSingleOption(arguments_, "--code")),
+    relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
+    root: readSingleOption(arguments_, "--root")
+  };
+}
+function parseChannelArgument(arguments_) {
+  if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
+    throw new PairingClientError(
+      "invalid_arguments",
+      "Usage: mobius start --channel <channel-id>"
+    );
+  }
+  const channelId = arguments_[1] ?? "";
+  if (!IDENTIFIER_PATTERN3.test(channelId)) {
+    throw new PairingClientError(
+      "invalid_channel_id",
+      "The saved channel ID is invalid"
+    );
+  }
+  return channelId;
+}
+async function resolveApprovedRoot(path) {
+  const requestedRoot = resolve4(path);
+  try {
+    const approvedRoot = await realpath5(requestedRoot);
+    const metadata = await stat4(approvedRoot);
+    if (!metadata.isDirectory()) {
+      throw new PairingClientError(
+        "invalid_workspace",
+        "The approved workspace root is not a directory"
+      );
+    }
+    return approvedRoot;
+  } catch (error61) {
+    if (error61 instanceof PairingClientError) {
+      throw error61;
+    }
+    throw new PairingClientError(
+      "invalid_workspace",
+      "The approved workspace root cannot be resolved",
+      { cause: error61 }
+    );
+  }
+}
+async function readJsonResponse(response) {
+  if (response.headers.get("cf-mitigated") === "challenge") {
+    throw new PairingClientError(
+      "relay_challenge",
+      "Cloudflare is protecting this temporary preview. Claim the deployment or use an authenticated deployment, then pair again"
+    );
+  }
+  const encoded = await response.text();
+  try {
+    return JSON.parse(encoded);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid response",
+      { cause: error61 }
+    );
+  }
+}
+function readRelayError(value) {
+  if (isRecord6(value)) {
+    const error61 = value["error"];
+    if (isRecord6(error61)) {
+      const code = error61["code"];
+      const message = error61["message"];
+      if (typeof code === "string" && typeof message === "string") {
+        return new PairingClientError(code, message);
+      }
+    }
+  }
+  return new PairingClientError(
+    "pairing_failed",
+    "The relay could not pair this machine"
+  );
+}
+function decodeClaimResponse(value) {
+  if (!isRecord6(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN3.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  return { channelId, daemonToken };
+}
+async function claimPairing(options, approvedRoot, localAgents, installableAgents, signal) {
+  const agents = localAgents.map((agent) => ({
+    id: agent.id,
+    label: agent.label
+  }));
+  const endpoint = new URL("/v1/pairings/claim", options.relayOrigin);
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      body: JSON.stringify({
+        agents,
+        installableAgents: installableAgents.map((agent) => ({
+          id: agent.id,
+          label: agent.label,
+          requiresLocalApproval: agent.requiresLocalApproval
+        })),
+        machineName: hostname3(),
+        pairingCode: options.code,
+        workspaceName: basename(approvedRoot) || "Local workspace"
+      }),
+      dispatcher: environmentProxyDispatcher,
+      headers: { "content-type": "application/json" },
+      method: "POST",
+      signal: AbortSignal.any([
+        signal,
+        AbortSignal.timeout(PAIRING_TIMEOUT_MILLISECONDS)
+      ])
+    });
+  } catch (error61) {
+    throw new PairingClientError(
+      "relay_unavailable",
+      "The pairing relay could not be reached",
+      { cause: error61 }
+    );
+  }
+  const value = await readJsonResponse(response);
+  if (!response.ok) {
+    throw readRelayError(value);
+  }
+  return decodeClaimResponse(value);
+}
+async function persistConnection(channelId, relayOrigin, daemonToken, approvedRoot) {
+  const connectionsDirectory = join6(readStateDirectory(), "connections");
+  await mkdir2(connectionsDirectory, { mode: 448, recursive: true });
+  const connectionPath = join6(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join6(
+    connectionsDirectory,
+    `.${channelId}.${randomUUID()}.tmp`
+  );
+  await writeFile(
+    temporaryPath,
+    `${JSON.stringify(
+      {
+        approvedRoot,
+        channelId,
+        daemonToken,
+        relayOrigin: relayOrigin.toString()
+      },
+      null,
+      2
+    )}
+`,
+    { flag: "wx", mode: 384 }
+  );
+  await rename2(temporaryPath, connectionPath);
+  return connectionPath;
+}
+function decodeSavedConnection(value, expectedChannelId) {
+  if (!isRecord6(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  const approvedRoot = value["approvedRoot"];
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  const relayOrigin = value["relayOrigin"];
+  if (typeof approvedRoot !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN3.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  return {
+    approvedRoot,
+    channelId,
+    daemonToken,
+    relayOrigin: parseRelayOrigin(relayOrigin)
+  };
+}
+async function readSavedConnection(channelId) {
+  const connectionPath = join6(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  let encoded = "";
+  const handle = await open4(connectionPath, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > MAX_CONNECTION_FILE_LENGTH) {
+      throw new PairingClientError(
+        "invalid_connection",
+        "The saved connection is invalid"
+      );
+    }
+    encoded = await handle.readFile({ encoding: "utf8" });
+  } finally {
+    await handle.close();
+  }
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid",
+      { cause: error61 }
+    );
+  }
+  const connection = decodeSavedConnection(value, channelId);
+  return {
+    approvedRoot: await resolveApprovedRoot(connection.approvedRoot),
+    channelId: connection.channelId,
+    daemonToken: connection.daemonToken,
+    relayOrigin: connection.relayOrigin
+  };
+}
+function assertInventoryUsable(inventory) {
+  if (inventory.available.length + inventory.installable.length === 0) {
+    throw new PairingClientError(
+      "no_supported_agent",
+      "No supported Agent is ready or safely installable on this machine"
+    );
+  }
+}
+function buildPairedDaemon(connection, connectionPath, inventory) {
+  assertInventoryUsable(inventory);
+  const relayUrl = new URL(
+    `/v1/channels/${encodeURIComponent(connection.channelId)}/daemon`,
+    connection.relayOrigin
+  );
+  relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
+  relayUrl.searchParams.set("token", connection.daemonToken);
+  const auditDatabasePath = join6(
+    readStateDirectory(),
+    "audit",
+    `${connection.channelId}.sqlite`
+  );
+  return {
+    channelUrl: new URL(
+      `/channels/${encodeURIComponent(connection.channelId)}`,
+      connection.relayOrigin
+    ).toString(),
+    config: createDaemonConfig(
+      {
+        approvedRoot: connection.approvedRoot,
+        auditDatabasePath,
+        channelId: connection.channelId,
+        relayUrl
+      },
+      inventory.readyAgents(),
+      inventory.installable
+    ),
+    connectionPath
+  };
+}
+async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
+  const options = parsePairCommand(arguments_);
+  const approvedRoot = await resolveApprovedRoot(options.root);
+  const inventory = await discoverLocalAgentInventory({
+    approvedRoot,
+    environment: process.env,
+    signal
+  });
+  assertInventoryUsable(inventory);
+  const agents = inventory.readyAgents();
+  const claim2 = await claimPairing(
+    options,
+    approvedRoot,
+    agents,
+    inventory.installable,
+    signal
+  );
+  const connectionPath = await persistConnection(
+    claim2.channelId,
+    options.relayOrigin,
+    claim2.daemonToken,
+    approvedRoot
+  );
+  return buildPairedDaemon(
+    {
+      approvedRoot,
+      channelId: claim2.channelId,
+      daemonToken: claim2.daemonToken,
+      relayOrigin: options.relayOrigin
+    },
+    connectionPath,
+    inventory
+  );
+}
+async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
+  const channelId = parseChannelArgument(arguments_);
+  const connectionPath = join6(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  const connection = await readSavedConnection(channelId);
+  const inventory = await discoverLocalAgentInventory({
+    approvedRoot: connection.approvedRoot,
+    environment: process.env,
+    signal
+  });
+  return buildPairedDaemon(connection, connectionPath, inventory);
+}
+
+// src/run-daemon.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { basename as basename3 } from "node:path";
+import { WebSocket as WebSocket2 } from "undici";
+
+// src/agent-catalog/publish-agent-catalog.ts
+import { fetch as fetch2 } from "undici";
+var CATALOG_UPDATE_TIMEOUT_MILLISECONDS = 2e4;
+var AgentCatalogPublishError = class extends Error {
+  code = "agent_catalog_update_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "AgentCatalogPublishError";
+  }
+};
+function catalogEndpoint(relayUrl) {
+  const endpoint = new URL(relayUrl);
+  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  if (!endpoint.pathname.endsWith("/daemon")) {
+    throw new AgentCatalogPublishError("The Relay URL is invalid");
+  }
+  endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
+  return endpoint;
+}
+async function publishAgentCatalog(config2, signal) {
+  signal.throwIfAborted();
+  const timeoutSignal = AbortSignal.timeout(
+    CATALOG_UPDATE_TIMEOUT_MILLISECONDS
+  );
+  const requestSignal = AbortSignal.any([signal, timeoutSignal]);
+  let response;
+  const catalog = config2.catalog.read();
+  try {
+    response = await fetch2(catalogEndpoint(config2.relayUrl), {
+      body: JSON.stringify({
+        agents: catalog.agents.map((agent) => ({
+          id: agent.id,
+          label: agent.label
+        })),
+        installableAgents: catalog.installableAgents.map((agent) => ({
+          id: agent.id,
+          label: agent.label,
+          requiresLocalApproval: agent.requiresLocalApproval
+        }))
+      }),
+      dispatcher: environmentProxyDispatcher,
+      headers: { "content-type": "application/json" },
+      method: "PUT",
+      signal: requestSignal
+    });
+  } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
+    throw new AgentCatalogPublishError(
+      timeoutSignal.aborted ? "The Agent catalog update timed out" : "The Agent catalog could not be updated",
+      { cause: error61 }
+    );
+  }
+  await response.body?.cancel();
+  if (!response.ok) {
+    throw new AgentCatalogPublishError(
+      "The Relay rejected the Agent catalog update"
+    );
+  }
+}
+
+// src/agent-installation/agent-installation-manager.ts
+var INSTALLATION_DEADLINE_MILLISECONDS = 10 * 60 * 1e3;
+var AgentInstallation = class {
+  agentId;
+  requestId;
+  constructor(requestId, agentId) {
+    this.agentId = agentId;
+    this.requestId = requestId;
+  }
+};
+var RequestedInstallation = class extends AgentInstallation {
+  status = "requested";
+  constructor(requestId, agentId) {
+    super(requestId, agentId);
+  }
+};
+var AwaitingLocalApproval = class extends AgentInstallation {
+  status = "awaiting_local_approval";
+  constructor(requestId, agentId) {
+    super(requestId, agentId);
+  }
+};
+var RunningInstallation = class extends AgentInstallation {
+  stage;
+  status = "running";
+  constructor(requestId, agentId, stage) {
+    super(requestId, agentId);
+    this.stage = stage;
+  }
+};
+var SucceededInstallation = class extends AgentInstallation {
+  authenticationMayBeRequired = true;
+  status = "succeeded";
+  constructor(requestId, agentId) {
+    super(requestId, agentId);
+  }
+};
+var FailedInstallation = class extends AgentInstallation {
+  code;
+  message;
+  status = "failed";
+  constructor(requestId, agentId, code, message) {
+    super(requestId, agentId);
+    this.code = code;
+    this.message = message;
+  }
+};
+var CancelledInstallation = class extends AgentInstallation {
+  status = "cancelled";
+  constructor(requestId, agentId) {
+    super(requestId, agentId);
+  }
+};
+var InstallationManagerError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "InstallationManagerError";
+  }
+};
+var NullInstallationAudit = class {
+  record = () => void 0;
+};
+var InstallationJob = class {
+  agentId;
+  completion = Promise.withResolvers();
+  controller = new AbortController();
+  requestId;
+  state;
+  constructor(requestId, agentId) {
+    this.agentId = agentId;
+    this.requestId = requestId;
+    this.state = new RequestedInstallation(requestId, agentId);
+  }
+};
+function specificationFor(specifications, agentId) {
+  for (const specification of specifications) {
+    if (specification.id === agentId) {
+      return specification;
+    }
+  }
+  return null;
+}
+function executionFailure(error61) {
+  if (error61 instanceof InstallationManagerError) {
+    return error61;
+  }
+  return new InstallationManagerError(
+    "installation_failed",
+    "The local Agent installation failed",
+    { cause: error61 }
+  );
+}
+var AgentInstallationManager = class {
+  #activeAgents = /* @__PURE__ */ new Map();
+  #audit;
+  #authorizer;
+  #executor;
+  #jobs = /* @__PURE__ */ new Map();
+  #observer;
+  #specifications;
+  constructor(specifications, authorizer, executor, observer, audit = new NullInstallationAudit()) {
+    this.#audit = audit;
+    this.#authorizer = authorizer;
+    this.#executor = executor;
+    this.#observer = observer;
+    this.#specifications = Object.freeze([...specifications]);
+  }
+  request = async (command, signal) => {
+    const existing = this.#jobs.get(command.requestId);
+    if (existing !== void 0) {
+      if (existing.agentId !== command.agentId) {
+        const conflict = new FailedInstallation(
+          command.requestId,
+          command.agentId,
+          "installation_request_conflict",
+          "The installation request identifier is already in use"
+        );
+        this.#audit.record(
+          "agent_installation_failed_installation_request_conflict",
+          command.requestId,
+          command.agentId
+        );
+        await this.#observer.onState(conflict);
+        return conflict;
+      }
+      await this.#observer.onState(existing.state);
+      return await existing.completion.promise;
+    }
+    this.#audit.record(
+      "agent_installation_requested",
+      command.requestId,
+      command.agentId
+    );
+    const specification = specificationFor(
+      this.#specifications,
+      command.agentId
+    );
+    if (specification === null) {
+      const unknown2 = new FailedInstallation(
+        command.requestId,
+        command.agentId,
+        "unknown_agent",
+        "The requested Agent is not supported"
+      );
+      const job2 = new InstallationJob(command.requestId, command.agentId);
+      job2.state = unknown2;
+      job2.completion.resolve(unknown2);
+      this.#jobs.set(command.requestId, job2);
+      this.#audit.record(
+        "agent_installation_failed_unknown_agent",
+        command.requestId,
+        command.agentId
+      );
+      await this.#observer.onState(unknown2);
+      return unknown2;
+    }
+    if (this.#activeAgents.has(command.agentId)) {
+      const busy = new FailedInstallation(
+        command.requestId,
+        command.agentId,
+        "installation_in_progress",
+        "An installation for this Agent is already running"
+      );
+      const job2 = new InstallationJob(command.requestId, command.agentId);
+      job2.state = busy;
+      job2.completion.resolve(busy);
+      this.#jobs.set(command.requestId, job2);
+      this.#audit.record(
+        "agent_installation_failed_installation_in_progress",
+        command.requestId,
+        command.agentId
+      );
+      await this.#observer.onState(busy);
+      return busy;
+    }
+    const job = new InstallationJob(command.requestId, command.agentId);
+    this.#jobs.set(command.requestId, job);
+    this.#activeAgents.set(command.agentId, command.requestId);
+    void this.#run(job, specification, signal);
+    return await job.completion.promise;
+  };
+  cancel = async (requestId) => {
+    const job = this.#jobs.get(requestId);
+    if (job === void 0) {
+      throw new InstallationManagerError(
+        "installation_not_found",
+        "The installation request was not found"
+      );
+    }
+    if (job.state instanceof SucceededInstallation || job.state instanceof FailedInstallation || job.state instanceof CancelledInstallation) {
+      await this.#observer.onState(job.state);
+      return job.state;
+    }
+    this.#audit.record(
+      "agent_installation_cancellation_requested",
+      job.requestId,
+      job.agentId
+    );
+    job.controller.abort(new Error("Agent installation cancelled"));
+    return await job.completion.promise;
+  };
+  close = async () => {
+    const completions = [];
+    for (const requestId of this.#activeAgents.values()) {
+      const job = this.#jobs.get(requestId);
+      if (job === void 0) {
+        throw new InstallationManagerError(
+          "installation_state_invalid",
+          "An active Agent installation is unavailable"
+        );
+      }
+      job.controller.abort(new Error("Mobius daemon stopped"));
+      completions.push(job.completion.promise);
+    }
+    await Promise.all(completions);
+  };
+  #transition = async (job, state) => {
+    job.state = state;
+    await this.#observer.onState(state);
+  };
+  #run = async (job, specification, externalSignal) => {
+    const abort = () => job.controller.abort(externalSignal.reason);
+    externalSignal.addEventListener("abort", abort, { once: true });
+    if (externalSignal.aborted) {
+      abort();
+    }
+    const deadline = setTimeout(() => {
+      job.controller.abort(
+        new InstallationManagerError(
+          "installation_timeout",
+          "The local Agent installation exceeded its deadline"
+        )
+      );
+    }, INSTALLATION_DEADLINE_MILLISECONDS);
+    const signal = job.controller.signal;
+    try {
+      await this.#transition(
+        job,
+        new AwaitingLocalApproval(job.requestId, job.agentId)
+      );
+      this.#audit.record(
+        "agent_installation_awaiting_approval",
+        job.requestId,
+        job.agentId
+      );
+      const approved = await this.#authorizer.authorize(
+        specification.id,
+        specification.label,
+        job.requestId,
+        signal
+      );
+      signal.throwIfAborted();
+      if (!approved) {
+        const denied = new FailedInstallation(
+          job.requestId,
+          job.agentId,
+          "installation_not_authorized",
+          "Installation was not approved on the local machine"
+        );
+        await this.#transition(job, denied);
+        this.#audit.record(
+          "agent_installation_denied",
+          job.requestId,
+          job.agentId
+        );
+        job.completion.resolve(denied);
+        return;
+      }
+      this.#audit.record(
+        "agent_installation_authorized",
+        job.requestId,
+        job.agentId
+      );
+      await this.#executor.execute(
+        job.agentId,
+        job.requestId,
+        async (stage) => {
+          signal.throwIfAborted();
+          await this.#transition(
+            job,
+            new RunningInstallation(job.requestId, job.agentId, stage)
+          );
+          this.#audit.record(
+            `agent_installation_${stage}`,
+            job.requestId,
+            job.agentId
+          );
+        },
+        signal
+      );
+      signal.throwIfAborted();
+      const succeeded = new SucceededInstallation(job.requestId, job.agentId);
+      await this.#transition(job, succeeded);
+      this.#audit.record(
+        "agent_installation_completed",
+        job.requestId,
+        job.agentId
+      );
+      job.completion.resolve(succeeded);
+    } catch (error61) {
+      if (signal.aborted) {
+        if (signal.reason instanceof InstallationManagerError && signal.reason.code === "installation_timeout") {
+          const timedOut = new FailedInstallation(
+            job.requestId,
+            job.agentId,
+            signal.reason.code,
+            signal.reason.message
+          );
+          await this.#transition(job, timedOut);
+          this.#audit.record(
+            "agent_installation_failed_installation_timeout",
+            job.requestId,
+            job.agentId
+          );
+          job.completion.resolve(timedOut);
+          return;
+        }
+        const cancelled = new CancelledInstallation(job.requestId, job.agentId);
+        await this.#transition(job, cancelled);
+        this.#audit.record(
+          "agent_installation_cancelled",
+          job.requestId,
+          job.agentId
+        );
+        job.completion.resolve(cancelled);
+      } else {
+        const failure = executionFailure(error61);
+        const failed = new FailedInstallation(
+          job.requestId,
+          job.agentId,
+          failure.code,
+          failure.message
+        );
+        await this.#transition(job, failed);
+        this.#audit.record(
+          `agent_installation_failed_${failure.code}`,
+          job.requestId,
+          job.agentId
+        );
+        job.completion.resolve(failed);
+      }
+    } finally {
+      clearTimeout(deadline);
+      externalSignal.removeEventListener("abort", abort);
+      if (this.#activeAgents.get(job.agentId) === job.requestId) {
+        this.#activeAgents.delete(job.agentId);
+      }
+    }
+  };
+};
+
+// src/agent-installation/automatic-adapter-provisioner.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+var AUTOMATIC_ADAPTER_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "adapter_not_found",
+  "adapter_probe_failed",
+  "adapter_probe_timeout",
+  "acp_incompatible"
+]);
+var InstalledAutomaticAdapter = class {
+  executable;
+  requestId;
+  specification;
+  constructor(specification, requestId, executable) {
+    this.executable = executable;
+    this.requestId = requestId;
+    this.specification = specification;
+  }
+};
+function shouldProvisionAdapter(unavailable, options) {
+  return AUTOMATIC_ADAPTER_FAILURE_CODES.has(unavailable.code) && options.environment[unavailable.specification.adapterOverrideVariable] === void 0 && unavailable.specification.supportsInstallation(
+    options.platform ?? process.platform,
+    options.architecture ?? process.arch
+  );
+}
+function stableFailureCode(error61) {
+  return error61 instanceof ManagedAdapterInstallError ? error61.code : "adapter_install_failed";
+}
+function discoveryOptions(options, environment, signal, specifications) {
+  return {
+    ...options.architecture === void 0 ? {} : { architecture: options.architecture },
+    approvedRoot: options.approvedRoot,
+    environment,
+    ...options.platform === void 0 ? {} : { platform: options.platform },
+    signal,
+    specifications
+  };
+}
+var AutomaticAdapterProvisioner = class {
+  #adapterInstaller;
+  #options;
+  #specifications;
+  constructor(options, adapterInstaller, specifications = supportedLocalAgentSpecifications()) {
+    this.#adapterInstaller = adapterInstaller;
+    this.#options = options;
+    this.#specifications = Object.freeze([...specifications]);
+  }
+  prepare = async (signal) => {
+    signal.throwIfAborted();
+    let inventory = await discoverLocalAgentInventory(
+      discoveryOptions(
+        this.#options,
+        this.#options.environment,
+        signal,
+        this.#specifications
+      )
+    );
+    const candidates = inventory.unavailable.filter(
+      (unavailable) => shouldProvisionAdapter(unavailable, this.#options)
+    );
+    const attempts = [];
+    for (const unavailable of candidates) {
+      signal.throwIfAborted();
+      const specification = unavailable.specification;
+      const verifiedAgent = await findVerifiedAgentExecutable(
+        specification,
+        discoveryOptions(
+          this.#options,
+          this.#options.environment,
+          signal,
+          this.#specifications
+        )
+      );
+      if (verifiedAgent === null) {
+        attempts.push(null);
+        continue;
+      }
+      const requestId = `automatic-adapter-${randomUUID2()}`;
+      this.#options.audit.record(
+        "agent_adapter_auto_install_started",
+        requestId,
+        specification.id,
+        {
+          agentVersion: verifiedAgent.version,
+          adapterVersion: specification.adapterVersion
+        }
+      );
+      process.stdout.write(
+        `Installing the pinned ACP adapter for ${specification.label}.
+`
+      );
+      try {
+        const executable = await this.#adapterInstaller.install(
+          specification,
+          signal
+        );
+        this.#options.audit.record(
+          "agent_adapter_auto_install_completed",
+          requestId,
+          specification.id,
+          { adapterVersion: specification.adapterVersion }
+        );
+        attempts.push(
+          new InstalledAutomaticAdapter(specification, requestId, executable)
+        );
+      } catch (error61) {
+        if (signal.aborted) {
+          this.#options.audit.record(
+            "agent_adapter_auto_install_cancelled",
+            requestId,
+            specification.id
+          );
+          signal.throwIfAborted();
+        }
+        this.#options.audit.record(
+          "agent_adapter_auto_install_failed",
+          requestId,
+          specification.id,
+          { code: stableFailureCode(error61) }
+        );
+        process.stderr.write(
+          `The pinned ACP adapter for ${specification.label} could not be installed automatically; the daemon will continue.
+`
+        );
+        attempts.push(null);
+      }
+    }
+    signal.throwIfAborted();
+    const installed = attempts.filter(
+      (attempt) => attempt !== null
+    );
+    if (installed.length > 0) {
+      const verificationEnvironment = {
+        ...this.#options.environment
+      };
+      for (const attempt of installed) {
+        verificationEnvironment[attempt.specification.adapterOverrideVariable] = attempt.executable.path;
+      }
+      inventory = await discoverLocalAgentInventory(
+        discoveryOptions(
+          this.#options,
+          verificationEnvironment,
+          signal,
+          this.#specifications
+        )
+      );
+    }
+    this.#options.catalog.transition(
+      inventory.readyAgents(),
+      inventory.installable
+    );
+    for (const attempt of installed) {
+      const available = inventory.available.find(
+        (candidate) => candidate instanceof AvailableAgent && candidate.specification.id === attempt.specification.id
+      );
+      if (available === void 0) {
+        const unavailable = inventory.unavailable.find(
+          (candidate) => candidate.specification.id === attempt.specification.id
+        );
+        this.#options.audit.record(
+          "agent_adapter_auto_install_verification_failed",
+          attempt.requestId,
+          attempt.specification.id,
+          { code: unavailable?.code ?? "agent_verification_failed" }
+        );
+        continue;
+      }
+      this.#options.audit.record(
+        "agent_adapter_auto_install_verified",
+        attempt.requestId,
+        attempt.specification.id,
+        {
+          adapterVersion: available.agent.adapterVersion,
+          agentVersion: available.agent.agentVersion
+        }
+      );
+      process.stdout.write(
+        `${attempt.specification.label} ACP integration is ready.
+`
+      );
+    }
+    return inventory;
+  };
+};
+
+// src/agent-installation/fixed-installation-executor.ts
+import { realpathSync as realpathSync2, statSync as statSync2 } from "node:fs";
+import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
+
+// src/agent-installation/fixed-agent-install-recipes.ts
+import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
+import { join as join7 } from "node:path";
+
+// src/agent-installation/verified-download.ts
+import { createHash } from "node:crypto";
+import { open as open5, unlink } from "node:fs/promises";
+import { fetch as fetch3 } from "undici";
+var MAX_REDIRECTS = 4;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var InstallerDownloadError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "InstallerDownloadError";
+  }
+};
+var VerifiedDownload = class {
+  bytes;
+  sha256;
+  url;
+  constructor(url2, bytes, sha256) {
+    this.bytes = bytes;
+    this.sha256 = sha256;
+    this.url = url2;
+  }
+};
+var UndiciInstallerDownloadTransport = class {
+  get = async (url2, signal) => await fetch3(url2, {
+    dispatcher: environmentProxyDispatcher,
+    headers: {
+      accept: "text/plain, application/octet-stream;q=0.9",
+      "user-agent": "Mobius-Agent-Installer/0.0.3"
+    },
+    method: "GET",
+    redirect: "manual",
+    signal
+  });
+};
+function validateUrl(url2, allowedHosts) {
+  if (url2.protocol !== "https:" || url2.username.length > 0 || url2.password.length > 0 || url2.port.length > 0 || !allowedHosts.has(url2.hostname)) {
+    throw new InstallerDownloadError(
+      "installer_host_not_allowed",
+      "The installer download target is not allowed"
+    );
+  }
+}
+async function fetchInstaller(options, signal, transport) {
+  let url2 = new URL(options.url);
+  for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
+    validateUrl(url2, options.allowedHosts);
+    const response = await transport.get(url2, signal);
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return { response, url: url2 };
+    }
+    await response.body?.cancel();
+    const location = response.headers.get("location");
+    if (location === null || redirectCount === MAX_REDIRECTS) {
+      throw new InstallerDownloadError(
+        "installer_redirect_invalid",
+        "The installer returned an invalid redirect"
+      );
+    }
+    let redirected;
+    try {
+      redirected = new URL(location, url2);
+    } catch (error61) {
+      throw new InstallerDownloadError(
+        "installer_redirect_invalid",
+        "The installer returned an invalid redirect",
+        { cause: error61 }
+      );
+    }
+    try {
+      validateUrl(redirected, options.allowedHosts);
+    } catch (error61) {
+      throw new InstallerDownloadError(
+        "installer_redirect_not_allowed",
+        "The installer redirect left the approved host allowlist",
+        { cause: error61 }
+      );
+    }
+    url2 = redirected;
+  }
+  throw new InstallerDownloadError(
+    "installer_redirect_invalid",
+    "The installer returned too many redirects"
+  );
+}
+async function writeCompleteChunk(handle, chunk) {
+  let offset = 0;
+  while (offset < chunk.byteLength) {
+    const written = await handle.write(
+      chunk,
+      offset,
+      chunk.byteLength - offset
+    );
+    if (written.bytesWritten < 1) {
+      throw new InstallerDownloadError(
+        "installer_write_failed",
+        "The verified installer could not be stored"
+      );
+    }
+    offset += written.bytesWritten;
+  }
+}
+async function downloadVerifiedFile(options, transport = new UndiciInstallerDownloadTransport()) {
+  options.signal.throwIfAborted();
+  const timeoutSignal = AbortSignal.timeout(options.timeoutMilliseconds);
+  const signal = AbortSignal.any([options.signal, timeoutSignal]);
+  let handle = null;
+  let responseBody = null;
+  try {
+    const fetched = await fetchInstaller(options, signal, transport);
+    responseBody = fetched.response.body;
+    if (!fetched.response.ok || fetched.response.body === null) {
+      throw new InstallerDownloadError(
+        "installer_download_failed",
+        "The approved installer could not be downloaded"
+      );
+    }
+    const contentLength = fetched.response.headers.get("content-length");
+    if (contentLength !== null) {
+      const declaredLength = Number(contentLength);
+      if (!Number.isSafeInteger(declaredLength) || declaredLength < 1 || declaredLength > options.maximumBytes) {
+        throw new InstallerDownloadError(
+          "installer_size_invalid",
+          "The installer size is outside the approved limit"
+        );
+      }
+    }
+    handle = await open5(options.destination, "wx", 384);
+    const digest = createHash("sha256");
+    const reader = fetched.response.body.getReader();
+    let bytes = 0;
+    try {
+      while (true) {
+        signal.throwIfAborted();
+        const chunk = await reader.read();
+        if (chunk.done) {
+          break;
+        }
+        bytes += chunk.value.byteLength;
+        if (bytes > options.maximumBytes) {
+          throw new InstallerDownloadError(
+            "installer_size_invalid",
+            "The installer exceeded the approved size limit"
+          );
+        }
+        digest.update(chunk.value);
+        await writeCompleteChunk(handle, chunk.value);
+      }
+    } finally {
+      await reader.cancel().catch(() => void 0);
+      reader.releaseLock();
+    }
+    if (bytes === 0) {
+      throw new InstallerDownloadError(
+        "installer_verification_failed",
+        "The downloaded installer is empty"
+      );
+    }
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    return new VerifiedDownload(fetched.url, bytes, digest.digest("hex"));
+  } catch (error61) {
+    if (handle !== null) {
+      await handle.close().catch(() => void 0);
+    }
+    await unlink(options.destination).catch(() => void 0);
+    if (options.signal.aborted) {
+      options.signal.throwIfAborted();
+    }
+    if (timeoutSignal.aborted) {
+      throw new InstallerDownloadError(
+        "installer_download_timeout",
+        "The installer download timed out",
+        { cause: error61 }
+      );
+    }
+    if (error61 instanceof InstallerDownloadError) {
+      throw error61;
+    }
+    throw new InstallerDownloadError(
+      "installer_download_failed",
+      "The approved installer could not be downloaded",
+      { cause: error61 }
+    );
+  } finally {
+    await responseBody?.cancel().catch(() => void 0);
+  }
+}
+
+// src/agent-installation/fixed-agent-install-recipes.ts
+var INSTALLER_DOWNLOAD_LIMIT_BYTES = 1024 * 1024;
+var INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS = 6e4;
+var AGENT_INSTALL_TIMEOUT_MILLISECONDS = 5 * 60 * 1e3;
+var MINIMAL_PATH = "/usr/bin:/bin";
+var FixedAgentInstallRecipe = class {
+  assertSupportedPlatform = () => {
+    if (process.platform !== "darwin" && process.platform !== "linux" || process.arch !== "arm64" && process.arch !== "x64") {
+      throw new InstallationManagerError(
+        "unsupported_install_platform",
+        "This Agent installation recipe does not support the local platform"
+      );
+    }
+  };
+  requireInstalledExecutable = async (path) => {
+    const executable = await resolveExecutablePath(path);
+    if (executable === null) {
+      throw new InstallationManagerError(
+        "agent_verification_failed",
+        "The Agent installer did not produce a valid executable"
+      );
+    }
+    return executable;
+  };
+};
+var CodexInstallRecipe = class extends FixedAgentInstallRecipe {
+  id = "codex";
+  label = "Codex";
+  releaseChannel = "latest";
+  install = async (options) => {
+    this.assertSupportedPlatform();
+    const root = join7(options.stateDirectory, "agents", this.id);
+    const temporaryRoot = join7(options.stateDirectory, "temporary");
+    await Promise.all([
+      mkdir3(root, { mode: 448, recursive: true }),
+      mkdir3(temporaryRoot, { mode: 448, recursive: true })
+    ]);
+    const temporaryDirectory = await mkdtemp2(
+      join7(temporaryRoot, ".codex-install-")
+    );
+    const installerPath = join7(temporaryDirectory, "install.sh");
+    const installDirectory = join7(root, "bin");
+    const codexHome = join7(root, "home");
+    try {
+      await Promise.all([
+        mkdir3(installDirectory, { mode: 448, recursive: true }),
+        mkdir3(codexHome, { mode: 448, recursive: true })
+      ]);
+      await options.report("downloading");
+      const download = await downloadVerifiedFile({
+        allowedHosts: /* @__PURE__ */ new Set(["chatgpt.com", "releases.openai.com"]),
+        destination: installerPath,
+        maximumBytes: INSTALLER_DOWNLOAD_LIMIT_BYTES,
+        signal: options.signal,
+        timeoutMilliseconds: INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS,
+        url: new URL("https://chatgpt.com/codex/install.sh")
+      });
+      options.audit.record(
+        "agent_installer_download_verified",
+        options.requestId,
+        this.id,
+        {
+          bytes: download.bytes.toString(),
+          releaseChannel: this.releaseChannel,
+          sha256: download.sha256
+        }
+      );
+      await options.report("verifying");
+      await options.report("installing_agent");
+      await runBoundedProcess({
+        arguments: [installerPath],
+        command: "/bin/sh",
+        cwd: temporaryDirectory,
+        environment: {
+          CODEX_HOME: codexHome,
+          CODEX_INSTALL_DIR: installDirectory,
+          CODEX_NON_INTERACTIVE: "1",
+          CODEX_RELEASE: this.releaseChannel,
+          HOME: codexHome,
+          PATH: MINIMAL_PATH
+        },
+        outputLimitBytes: 64 * 1024,
+        signal: options.signal,
+        timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS
+      });
+      return await this.requireInstalledExecutable(
+        join7(installDirectory, "codex")
+      );
+    } catch (error61) {
+      if (options.signal.aborted) {
+        options.signal.throwIfAborted();
+      }
+      if (error61 instanceof InstallationManagerError || error61 instanceof Error && "code" in error61) {
+        throw error61;
+      }
+      throw new InstallationManagerError(
+        "agent_install_failed",
+        "The fixed Codex installation recipe failed"
+      );
+    } finally {
+      await rm2(temporaryDirectory, { force: true, recursive: true });
+    }
+  };
+};
+var ClaudeCodeInstallRecipe = class extends FixedAgentInstallRecipe {
+  id = "claude";
+  label = "Claude Code";
+  releaseChannel = "stable";
+  install = async (options) => {
+    this.assertSupportedPlatform();
+    const root = join7(options.stateDirectory, "agents", this.id);
+    const managedHome = join7(root, "home");
+    const temporaryRoot = join7(options.stateDirectory, "temporary");
+    await Promise.all([
+      mkdir3(managedHome, { mode: 448, recursive: true }),
+      mkdir3(temporaryRoot, { mode: 448, recursive: true })
+    ]);
+    const temporaryDirectory = await mkdtemp2(
+      join7(temporaryRoot, ".claude-install-")
+    );
+    const installerPath = join7(temporaryDirectory, "install.sh");
+    try {
+      await options.report("downloading");
+      const download = await downloadVerifiedFile({
+        allowedHosts: /* @__PURE__ */ new Set(["claude.ai"]),
+        destination: installerPath,
+        maximumBytes: INSTALLER_DOWNLOAD_LIMIT_BYTES,
+        signal: options.signal,
+        timeoutMilliseconds: INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS,
+        url: new URL("https://claude.ai/install.sh")
+      });
+      options.audit.record(
+        "agent_installer_download_verified",
+        options.requestId,
+        this.id,
+        {
+          bytes: download.bytes.toString(),
+          releaseChannel: this.releaseChannel,
+          sha256: download.sha256
+        }
+      );
+      await options.report("verifying");
+      await options.report("installing_agent");
+      await runBoundedProcess({
+        arguments: [installerPath, "stable"],
+        command: "/bin/bash",
+        cwd: temporaryDirectory,
+        environment: {
+          HOME: managedHome,
+          PATH: MINIMAL_PATH,
+          SHELL: "/bin/bash"
+        },
+        outputLimitBytes: 64 * 1024,
+        signal: options.signal,
+        timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS
+      });
+      return await this.requireInstalledExecutable(
+        join7(managedHome, ".local", "bin", "claude")
+      );
+    } catch (error61) {
+      if (options.signal.aborted) {
+        options.signal.throwIfAborted();
+      }
+      if (error61 instanceof InstallationManagerError || error61 instanceof Error && "code" in error61) {
+        throw error61;
+      }
+      throw new InstallationManagerError(
+        "agent_install_failed",
+        "The fixed Claude Code installation recipe failed"
+      );
+    } finally {
+      await rm2(temporaryDirectory, { force: true, recursive: true });
+    }
+  };
+};
+function fixedAgentInstallRecipes() {
+  return Object.freeze([
+    new CodexInstallRecipe(),
+    new ClaudeCodeInstallRecipe()
+  ]);
 }
-function readStateDirectory() {
-  const configured = process.env["MOBIUS_STATE_DIRECTORY"]?.trim();
-  if (configured !== void 0 && configured.length > 0) {
-    return resolve(configured);
+
+// src/agent-installation/fixed-installation-executor.ts
+function findSpecification(specifications, agentId) {
+  for (const specification of specifications) {
+    if (specification.id === agentId) {
+      return specification;
+    }
   }
-  return join(homedir(), ".mobius");
-}
-async function persistConnection(channelId, relayOrigin, daemonToken, approvedRoot) {
-  const connectionsDirectory = join(readStateDirectory(), "connections");
-  await mkdir(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join(
-    connectionsDirectory,
-    `.${channelId}.${randomUUID()}.tmp`
-  );
-  await writeFile(
-    temporaryPath,
-    `${JSON.stringify(
-      {
-        approvedRoot,
-        channelId,
-        daemonToken,
-        relayOrigin: relayOrigin.toString()
-      },
-      null,
-      2
-    )}
-`,
-    { flag: "wx", mode: 384 }
+  throw new InstallationManagerError(
+    "unknown_agent",
+    "The requested Agent is not supported"
   );
-  await rename(temporaryPath, connectionPath);
-  return connectionPath;
 }
-function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord4(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid"
-    );
-  }
-  const approvedRoot = value["approvedRoot"];
-  const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
-  const relayOrigin = value["relayOrigin"];
-  if (typeof approvedRoot !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN3.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid"
-    );
+function findRecipe(recipes, agentId) {
+  for (const recipe of recipes) {
+    if (recipe.id === agentId) {
+      return recipe;
+    }
   }
-  return {
-    approvedRoot,
-    channelId,
-    daemonToken,
-    relayOrigin: parseRelayOrigin(relayOrigin)
-  };
-}
-async function readSavedConnection(channelId) {
-  const connectionPath = join(
-    readStateDirectory(),
-    "connections",
-    `${channelId}.json`
+  throw new InstallationManagerError(
+    "agent_not_installable",
+    "The requested Agent does not have an approved installation recipe"
   );
-  let encoded = "";
-  const handle = await open2(connectionPath, "r");
+}
+function isInside2(root, candidate) {
+  const difference = relative4(resolve5(root), resolve5(candidate));
+  return difference.length === 0 || !difference.startsWith("..") && !isAbsolute3(difference);
+}
+function resolveApprovedRoot2(path) {
   try {
-    const metadata = await handle.stat();
-    if (!metadata.isFile() || metadata.size > MAX_CONNECTION_FILE_LENGTH) {
-      throw new PairingClientError(
-        "invalid_connection",
-        "The saved connection is invalid"
-      );
+    const directory = realpathSync2(resolve5(path));
+    if (!statSync2(directory).isDirectory()) {
+      throw new Error("Approved root is not a directory");
     }
-    encoded = await handle.readFile({ encoding: "utf8" });
-  } finally {
-    await handle.close();
+    return directory;
+  } catch (error61) {
+    throw new InstallationManagerError(
+      "unsafe_installation_root",
+      "The approved workspace is unavailable or unsafe",
+      { cause: error61 }
+    );
   }
-  let value;
+}
+function resolveUserInstallationDirectory(path) {
   try {
-    value = JSON.parse(encoded);
+    const directory = realpathSync2(resolve5(path));
+    const metadata = statSync2(directory);
+    if (!metadata.isDirectory() || typeof process.getuid === "function" && metadata.uid !== process.getuid()) {
+      throw new Error("Installation directory is not user-owned");
+    }
+    return directory;
   } catch (error61) {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid",
+    throw new InstallationManagerError(
+      "unsafe_installation_root",
+      "The local Agent installation root is unavailable or unsafe",
       { cause: error61 }
     );
   }
-  const connection = decodeSavedConnection(value, channelId);
-  return {
-    approvedRoot: await resolveApprovedRoot(connection.approvedRoot),
-    channelId: connection.channelId,
-    daemonToken: connection.daemonToken,
-    relayOrigin: connection.relayOrigin
-  };
 }
-function buildPairedDaemon(connection, connectionPath) {
-  const relayUrl = new URL(
-    `/v1/channels/${encodeURIComponent(connection.channelId)}/daemon`,
-    connection.relayOrigin
-  );
-  relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
-  relayUrl.searchParams.set("token", connection.daemonToken);
-  const auditDatabasePath = join(
-    readStateDirectory(),
-    "audit",
-    `${connection.channelId}.sqlite`
+function translateExecutionError(error61) {
+  if (error61 instanceof InstallationManagerError) {
+    return error61;
+  }
+  if (error61 instanceof ManagedAdapterInstallError || error61 instanceof InstallerDownloadError || error61 instanceof ProcessExecutionError) {
+    return new InstallationManagerError(error61.code, error61.message, {
+      cause: error61
+    });
+  }
+  return new InstallationManagerError(
+    "installation_failed",
+    "The fixed local Agent installation failed",
+    { cause: error61 }
   );
-  return {
-    channelUrl: new URL(
-      `/channels/${encodeURIComponent(connection.channelId)}`,
-      connection.relayOrigin
-    ).toString(),
-    config: createDaemonConfig({
-      approvedRoot: connection.approvedRoot,
-      auditDatabasePath,
-      channelId: connection.channelId,
-      relayUrl
-    }),
-    connectionPath
-  };
 }
-async function pairLocalMachine(arguments_) {
-  const options = parsePairCommand(arguments_);
-  const approvedRoot = await resolveApprovedRoot(options.root);
-  const claim2 = await claimPairing(options, approvedRoot);
-  const connectionPath = await persistConnection(
-    claim2.channelId,
-    options.relayOrigin,
-    claim2.daemonToken,
-    approvedRoot
-  );
-  return buildPairedDaemon(
-    {
-      approvedRoot,
-      channelId: claim2.channelId,
-      daemonToken: claim2.daemonToken,
-      relayOrigin: options.relayOrigin
-    },
-    connectionPath
-  );
+function requiresAgentReplacement(code) {
+  return code === "agent_not_found" || code === "agent_probe_failed" || code === "agent_probe_timeout";
 }
-async function resumeLocalMachine(arguments_) {
-  const channelId = parseChannelArgument(arguments_);
-  const connectionPath = join(
-    readStateDirectory(),
-    "connections",
-    `${channelId}.json`
-  );
-  return buildPairedDaemon(
-    await readSavedConnection(channelId),
-    connectionPath
-  );
+function requiresAdapterReplacement(code) {
+  return code === "adapter_not_found" || code === "adapter_probe_failed" || code === "adapter_probe_timeout" || code === "acp_incompatible";
 }
+var FixedInstallationExecutor = class {
+  #adapterInstaller;
+  #approvedRoot;
+  #audit;
+  #catalog;
+  #environment;
+  #publishCatalog;
+  #recipes;
+  #specifications;
+  #stateDirectory;
+  constructor(options, specifications = supportedLocalAgentSpecifications(), recipes = fixedAgentInstallRecipes(), adapterInstaller) {
+    const approvedRoot = resolveApprovedRoot2(options.approvedRoot);
+    const stateDirectory = resolveUserInstallationDirectory(
+      options.stateDirectory
+    );
+    if (isInside2(approvedRoot, stateDirectory)) {
+      throw new InstallationManagerError(
+        "unsafe_installation_root",
+        "The Mobius state directory cannot be inside the approved workspace"
+      );
+    }
+    this.#approvedRoot = approvedRoot;
+    this.#audit = options.audit;
+    this.#catalog = options.catalog;
+    this.#environment = Object.freeze({ ...options.environment });
+    this.#publishCatalog = options.publishCatalog;
+    this.#recipes = Object.freeze([...recipes]);
+    this.#specifications = Object.freeze([...specifications]);
+    this.#stateDirectory = stateDirectory;
+    this.#adapterInstaller = adapterInstaller ?? new ManagedAdapterInstaller({
+      approvedRoot,
+      environment: this.#environment,
+      stateDirectory
+    });
+  }
+  execute = async (agentId, requestId, report, signal) => {
+    try {
+      const specification = findSpecification(this.#specifications, agentId);
+      const recipe = findRecipe(this.#recipes, agentId);
+      this.#audit.record(
+        "agent_installation_recipe_resolved",
+        requestId,
+        agentId,
+        {
+          adapterVersion: specification.adapterVersion,
+          releaseChannel: recipe.releaseChannel
+        }
+      );
+      const discoveryOptions2 = {
+        approvedRoot: this.#approvedRoot,
+        environment: this.#environment,
+        signal
+      };
+      let agent = await resolveAgentExecutable(specification, discoveryOptions2);
+      let installedAgent = false;
+      if (agent === null) {
+        agent = await recipe.install({
+          audit: this.#audit,
+          report,
+          requestId,
+          signal,
+          stateDirectory: this.#stateDirectory
+        });
+        installedAgent = true;
+      }
+      let adapter = await resolveAdapterExecutable(
+        specification,
+        discoveryOptions2
+      );
+      let installedAdapter = false;
+      if (adapter === null) {
+        await report("installing_adapter");
+        adapter = await this.#adapterInstaller.install(specification, signal);
+        installedAdapter = true;
+        this.#audit.record("agent_adapter_verified", requestId, agentId, {
+          version: specification.adapterVersion
+        });
+      }
+      while (true) {
+        await report("checking_acp");
+        const environment = { ...this.#environment };
+        environment[specification.agentOverrideVariable] = agent.path;
+        environment[specification.adapterOverrideVariable] = adapter.path;
+        const inventory = await discoverLocalAgentInventory({
+          approvedRoot: this.#approvedRoot,
+          environment,
+          signal,
+          specifications: this.#specifications
+        });
+        const verified = inventory.available.find(
+          (candidate) => candidate.specification.id === agentId
+        );
+        if (verified instanceof AvailableAgent) {
+          this.#audit.record(
+            "agent_installation_acp_verified",
+            requestId,
+            agentId,
+            {
+              adapterVersion: verified.agent.adapterVersion,
+              agentVersion: verified.agent.agentVersion
+            }
+          );
+          const previous = this.#catalog.read();
+          this.#catalog.transition(
+            inventory.readyAgents(),
+            inventory.installable
+          );
+          try {
+            await this.#publishCatalog(signal);
+          } catch (error61) {
+            this.#catalog.transition(
+              previous.agents,
+              previous.installableAgents
+            );
+            throw error61;
+          }
+          return;
+        }
+        const unavailable = inventory.unavailable.find(
+          (candidate) => candidate.specification.id === agentId
+        );
+        if (unavailable === void 0) {
+          throw new InstallationManagerError(
+            "agent_verification_failed",
+            "The complete Agent ACP path did not pass verification"
+          );
+        }
+        if (!installedAdapter && requiresAdapterReplacement(unavailable.code)) {
+          await report("installing_adapter");
+          adapter = await this.#adapterInstaller.install(specification, signal);
+          installedAdapter = true;
+          this.#audit.record("agent_adapter_verified", requestId, agentId, {
+            version: specification.adapterVersion
+          });
+          continue;
+        }
+        if (!installedAgent && (requiresAgentReplacement(unavailable.code) || unavailable.code === "acp_incompatible")) {
+          agent = await recipe.install({
+            audit: this.#audit,
+            report,
+            requestId,
+            signal,
+            stateDirectory: this.#stateDirectory
+          });
+          installedAgent = true;
+          continue;
+        }
+        throw new InstallationManagerError(
+          unavailable.code,
+          unavailable.message
+        );
+      }
+    } catch (error61) {
+      if (signal.aborted) {
+        signal.throwIfAborted();
+      }
+      throw translateExecutionError(error61);
+    }
+  };
+};
 
-// src/run-daemon.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { basename as basename3 } from "node:path";
-import { WebSocket as WebSocket2 } from "undici";
+// src/agent-installation/local-installation-authorizer.ts
+import { createInterface } from "node:readline/promises";
+var ConsoleInstallationAuthorizer = class {
+  #stateDirectory;
+  constructor(stateDirectory) {
+    this.#stateDirectory = stateDirectory;
+  }
+  authorize = async (agentId, label, requestId, signal) => {
+    signal.throwIfAborted();
+    const grants = await readGrantedAgents(this.#stateDirectory);
+    signal.throwIfAborted();
+    if (grants.has(agentId)) {
+      return true;
+    }
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      return false;
+    }
+    const prompt = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    try {
+      const answer = await prompt.question(
+        `
+Mobius Web requested installation of ${label} (${requestId}). Allow this fixed user-level recipe? [y/N] `,
+        { signal }
+      );
+      const normalized = answer.trim().toLowerCase();
+      return normalized === "y" || normalized === "yes";
+    } finally {
+      prompt.close();
+    }
+  };
+};
 
 // src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath3, stat as stat3 } from "node:fs/promises";
+import { readdir, realpath as realpath6, stat as stat5 } from "node:fs/promises";
 import {
   basename as basename2,
-  dirname as dirname3,
-  isAbsolute,
-  join as join2,
+  dirname as dirname4,
+  isAbsolute as isAbsolute4,
+  join as join8,
   normalize,
-  relative
+  relative as relative5
 } from "node:path";
 var ROOT_DIRECTORY_ID = "root";
 var DIRECTORY_ID_PREFIX = "dir-";
@@ -22507,14 +25095,14 @@ function decodeDirectoryId(value) {
     throw new LocalAuthorizationError("The workspace directory is invalid");
   }
   const normalized = normalize(decoded);
-  if (decoded.includes("\0") || isAbsolute(decoded) || normalized === ".." || normalized.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || normalized !== decoded) {
+  if (decoded.includes("\0") || isAbsolute4(decoded) || normalized === ".." || normalized.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || normalized !== decoded) {
     throw new LocalAuthorizationError("The workspace directory is invalid");
   }
   return normalized;
 }
 function isContained(root, target) {
-  const remainder = relative(root, target);
-  return remainder.length === 0 || !isAbsolute(remainder) && remainder !== ".." && !remainder.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  const remainder = relative5(root, target);
+  return remainder.length === 0 || !isAbsolute4(remainder) && remainder !== ".." && !remainder.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 var WorkspaceDirectoryService = class {
   #approvedBindingId;
@@ -22532,8 +25120,8 @@ var WorkspaceDirectoryService = class {
     const root = await this.resolveRoot();
     const relativePath = decodeDirectoryId(requestedDirectoryId);
     try {
-      const target = await realpath3(join2(root, relativePath));
-      const metadata = await stat3(target);
+      const target = await realpath6(join8(root, relativePath));
+      const metadata = await stat5(target);
       if (!metadata.isDirectory() || !isContained(root, target)) {
         throw new LocalAuthorizationError(
           "The workspace directory is not authorized"
@@ -22561,10 +25149,10 @@ var WorkspaceDirectoryService = class {
         if (entries.length === 500) {
           break;
         }
-        const logicalChild = logicalRelativePath.length === 0 ? child.name : join2(logicalRelativePath, child.name);
+        const logicalChild = logicalRelativePath.length === 0 ? child.name : join8(logicalRelativePath, child.name);
         try {
-          const resolvedChild = await realpath3(join2(target, child.name));
-          const metadata = await stat3(resolvedChild);
+          const resolvedChild = await realpath6(join8(target, child.name));
+          const metadata = await stat5(resolvedChild);
           if (metadata.isDirectory() && isContained(root, resolvedChild)) {
             entries.push({
               directoryId: directoryId(logicalChild),
@@ -22576,7 +25164,7 @@ var WorkspaceDirectoryService = class {
       }
       entries.sort((left, right) => left.name.localeCompare(right.name));
       const labelSuffix = logicalRelativePath.replaceAll("\\", "/");
-      const parentRelative = logicalRelativePath.length === 0 || dirname3(logicalRelativePath) === "." ? "" : dirname3(logicalRelativePath);
+      const parentRelative = logicalRelativePath.length === 0 || dirname4(logicalRelativePath) === "." ? "" : dirname4(logicalRelativePath);
       return new WorkspaceDirectoryListing(
         requestedDirectoryId,
         labelSuffix.length === 0 ? basename2(root) : `${basename2(root)}/${labelSuffix}`,
@@ -22610,8 +25198,8 @@ var WorkspaceDirectoryService = class {
   };
   resolveRoot = async () => {
     try {
-      const root = await realpath3(this.#approvedRoot);
-      const metadata = await stat3(root);
+      const root = await realpath6(this.#approvedRoot);
+      const metadata = await stat5(root);
       if (!metadata.isDirectory()) {
         throw new LocalAuthorizationError(
           "The approved root is not a directory"
@@ -22645,7 +25233,7 @@ var RelayConnectionError = class extends Error {
 };
 function connectRelay(url2, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve6, reject) => {
     const socket = new WebSocket(url2, {
       dispatcher: environmentProxyDispatcher
     });
@@ -22698,7 +25286,7 @@ function connectRelay(url2, signal) {
       }
       finished = true;
       cleanup();
-      resolve2(socket);
+      resolve6(socket);
     };
     function onTimeout() {
       fail(
@@ -22719,7 +25307,7 @@ function connectRelay(url2, signal) {
 }
 
 // src/relay-connection/liveness.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var HEARTBEAT_ACK_TIMEOUT_MILLISECONDS = 1e4;
 var HEARTBEAT_INTERVAL_MILLISECONDS = 2e4;
 var RelayLivenessState = class {
@@ -22810,7 +25398,7 @@ var RelayConnectionLiveness = class {
       }
       throw new Error("Heartbeat was scheduled in an invalid state");
     }
-    const heartbeatId = randomUUID2();
+    const heartbeatId = randomUUID3();
     this.#state = new AwaitingHeartbeatAckState(
       heartbeatId,
       this.#timer.schedule(
@@ -22933,6 +25521,127 @@ var DaemonAcpObserver = class {
     return Promise.resolve();
   };
 };
+var AuditInstallationEvents = class {
+  #audit;
+  constructor(audit) {
+    this.#audit = audit;
+  }
+  record = (event, requestId, agentId, details = {}) => {
+    this.#audit.record({
+      commandId: requestId,
+      details,
+      event,
+      sessionId: `agent-installation:${agentId}`
+    });
+  };
+};
+var DaemonInstallationObserver = class {
+  #started = /* @__PURE__ */ new Set();
+  #socket = null;
+  connect = (socket) => {
+    this.#socket = socket;
+  };
+  disconnect = (socket) => {
+    if (this.#socket === socket) {
+      this.#socket = null;
+    }
+  };
+  #send = (socket, message) => {
+    try {
+      send(socket, message);
+    } catch {
+      if (this.#socket === socket) {
+        this.#socket = null;
+      }
+    }
+  };
+  onState = (state) => {
+    const socket = this.#socket;
+    if (socket === null || socket.readyState !== WebSocket2.OPEN) {
+      return Promise.resolve();
+    }
+    if (state instanceof RequestedInstallation) {
+      return Promise.resolve();
+    }
+    if (state instanceof AwaitingLocalApproval) {
+      this.#send(
+        socket,
+        encodeAgentInstallAwaitingApprovalEvent({
+          agentId: state.agentId,
+          kind: AGENT_INSTALL_AWAITING_APPROVAL_KIND,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          requestId: state.requestId
+        })
+      );
+      return Promise.resolve();
+    }
+    if (state instanceof RunningInstallation) {
+      if (!this.#started.has(state.requestId)) {
+        this.#started.add(state.requestId);
+        this.#send(
+          socket,
+          encodeAgentInstallStartedEvent({
+            agentId: state.agentId,
+            kind: AGENT_INSTALL_STARTED_KIND,
+            protocolVersion: MOBIUS_PROTOCOL_VERSION,
+            requestId: state.requestId
+          })
+        );
+      }
+      this.#send(
+        socket,
+        encodeAgentInstallProgressEvent({
+          agentId: state.agentId,
+          kind: AGENT_INSTALL_PROGRESS_KIND,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          requestId: state.requestId,
+          stage: state.stage
+        })
+      );
+      return Promise.resolve();
+    }
+    if (state instanceof SucceededInstallation) {
+      this.#send(
+        socket,
+        encodeAgentInstallCompletedEvent({
+          agentId: state.agentId,
+          authenticationMayBeRequired: state.authenticationMayBeRequired,
+          kind: AGENT_INSTALL_COMPLETED_KIND,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          requestId: state.requestId
+        })
+      );
+      return Promise.resolve();
+    }
+    if (state instanceof FailedInstallation) {
+      this.#send(
+        socket,
+        encodeAgentInstallFailedEvent({
+          agentId: state.agentId,
+          code: state.code,
+          kind: AGENT_INSTALL_FAILED_KIND,
+          message: state.message,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          requestId: state.requestId
+        })
+      );
+      return Promise.resolve();
+    }
+    if (state instanceof CancelledInstallation) {
+      this.#send(
+        socket,
+        encodeAgentInstallCancelledEvent({
+          agentId: state.agentId,
+          kind: AGENT_INSTALL_CANCELLED_KIND,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          requestId: state.requestId
+        })
+      );
+      return Promise.resolve();
+    }
+    throw new Error("Unsupported Agent installation state");
+  };
+};
 var ResolvedSessionDirectories = class {
   additionalDirectories;
   additionalDirectoryEntries;
@@ -22989,13 +25698,13 @@ function reportFailure(socket, command, code, message) {
   );
 }
 function operationErrorCode(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError) {
     return error61.code;
   }
   return "session_operation_failed";
 }
 function operationErrorMessage(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError) {
     return error61.message;
   }
   return "The local agent operation could not be completed";
@@ -23080,7 +25789,7 @@ async function executeSessionPrepare(socket, command, config2, directories, audi
       command.directoryId,
       command.additionalDirectoryIds
     );
-    const agent = findLocalAgent(config2.agents, command.agentId);
+    const agent = config2.catalog.find(command.agentId);
     const prepared = await sessions.prepareSession({
       additionalDirectories: resolved.additionalDirectories,
       agent,
@@ -23130,7 +25839,7 @@ async function executeSessionConfigure(socket, command, config2, directories, au
     );
     const configOptions = await sessions.configureSession({
       additionalDirectories: resolved.additionalDirectories,
-      agent: findLocalAgent(config2.agents, command.agentId),
+      agent: config2.catalog.find(command.agentId),
       booleanValue: command.booleanValue,
       configId: command.configId,
       cwd: resolved.cwd,
@@ -23167,8 +25876,8 @@ async function executePrompt(socket, command, config2, directories, audit, sessi
       command.directoryId,
       command.additionalDirectoryIds
     );
-    const agent = findLocalAgent(config2.agents, command.agentId);
-    const processAttemptId = randomUUID3();
+    const agent = config2.catalog.find(command.agentId);
+    const processAttemptId = randomUUID4();
     audit.record({
       commandId: command.commandId,
       event: "session_authorized",
@@ -23252,11 +25961,12 @@ async function executePrompt(socket, command, config2, directories, audit, sessi
       event: "session_failed",
       sessionId: command.sessionId
     });
+    const code = operationErrorCode(error61);
     reportFailure(
       socket,
       command,
-      "agent_execution_failed",
-      "The local agent could not complete the request"
+      code === "session_operation_failed" ? "agent_execution_failed" : code,
+      code === "session_operation_failed" ? "The local agent could not complete the request" : operationErrorMessage(error61)
     );
     console.error("Mobius daemon command failed", error61);
   }
@@ -23265,24 +25975,25 @@ function waitForRelayRetry(signal, timer) {
   if (signal.aborted) {
     return Promise.resolve();
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve6) => {
     const retry = timer.schedule(finish, RELAY_RECONNECT_DELAY_MILLISECONDS);
     function finish() {
       retry.cancel();
       signal.removeEventListener("abort", finish);
-      resolve2();
+      resolve6();
     }
     signal.addEventListener("abort", finish, { once: true });
   });
 }
-async function runRelayConnection(config2, directories, audit, sessions, signal, timer) {
+async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
   const activeTurns = /* @__PURE__ */ new Map();
   const connectionController = new AbortController();
   sessions.setObserver(new DaemonAcpObserver(socket));
-  await new Promise((resolve2, reject) => {
+  installationObserver.connect(socket);
+  await new Promise((resolve6, reject) => {
     let finished = false;
     const cleanup = () => {
       connectionRefresh.close();
@@ -23291,6 +26002,7 @@ async function runRelayConnection(config2, directories, audit, sessions, signal,
       socket.removeEventListener("close", handleClose);
       socket.removeEventListener("error", handleError);
       socket.removeEventListener("message", handleMessage);
+      installationObserver.disconnect(socket);
       connectionController.abort();
       for (const turn of activeTurns.values()) {
         turn.abortConnection();
@@ -23303,7 +26015,7 @@ async function runRelayConnection(config2, directories, audit, sessions, signal,
       }
       finished = true;
       cleanup();
-      resolve2();
+      resolve6();
     };
     const rejectConnection = () => {
       if (finished) {
@@ -23456,6 +26168,20 @@ async function runRelayConnection(config2, directories, audit, sessions, signal,
           });
           return;
         }
+        if (kind === AGENT_INSTALL_REQUEST_KIND) {
+          const command2 = decodeAgentInstallRequestCommand(encoded);
+          void installations.request(command2, signal).catch((error61) => {
+            console.error("Mobius Agent installation failed", error61);
+          });
+          return;
+        }
+        if (kind === AGENT_INSTALL_CANCEL_KIND) {
+          const command2 = decodeAgentInstallCancelCommand(encoded);
+          void installations.cancel(command2.requestId).catch((error61) => {
+            reportOperationFailure(socket, command2.requestId, "", error61);
+          });
+          return;
+        }
         if (kind !== SESSION_PROMPT_KIND) {
           throw new Error("Unsupported protocol message");
         }
@@ -23500,6 +26226,31 @@ async function runRelayConnection(config2, directories, audit, sessions, signal,
   });
 }
 async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
+  const installationAudit = new AuditInstallationEvents(audit);
+  const stateDirectory = readStateDirectory();
+  const specifications = supportedLocalAgentSpecifications();
+  const installationExecutor = new FixedInstallationExecutor({
+    approvedRoot: config2.approvedRoot,
+    audit: installationAudit,
+    catalog: config2.catalog,
+    environment: process.env,
+    publishCatalog: async (installationSignal) => await publishAgentCatalog(config2, installationSignal),
+    stateDirectory
+  });
+  await new AutomaticAdapterProvisioner(
+    {
+      approvedRoot: config2.approvedRoot,
+      audit: installationAudit,
+      catalog: config2.catalog,
+      environment: process.env
+    },
+    new ManagedAdapterInstaller({
+      approvedRoot: config2.approvedRoot,
+      environment: process.env,
+      stateDirectory
+    }),
+    specifications
+  ).prepare(signal);
   const sessionStore = new SqliteAcpSessionStore(config2.auditDatabasePath);
   const sessions = new AcpSessionManager(
     new NullAcpSessionObserver(),
@@ -23509,15 +26260,26 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
     config2.bindingId,
     config2.approvedRoot
   );
+  const installationObserver = new DaemonInstallationObserver();
+  const installations = new AgentInstallationManager(
+    specifications,
+    new ConsoleInstallationAuthorizer(stateDirectory),
+    installationExecutor,
+    installationObserver,
+    installationAudit
+  );
   let retryAnnounced = false;
   try {
     while (!signal.aborted) {
       try {
+        await publishAgentCatalog(config2, signal);
         await runRelayConnection(
           config2,
           directories,
           audit,
           sessions,
+          installations,
+          installationObserver,
           signal,
           timer
         );
@@ -23534,8 +26296,15 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
       await waitForRelayRetry(signal, timer);
     }
   } finally {
-    await sessions.close();
-    sessionStore.close();
+    try {
+      await installations.close();
+    } finally {
+      try {
+        await sessions.close();
+      } finally {
+        sessionStore.close();
+      }
+    }
   }
 }
 export {