@moxt-ai/mobius 0.0.5 → 0.0.6

package/dist/cli.js

@@ -5,10 +5,12 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/cli.ts
+import { mkdir as mkdir4 } from "node:fs/promises";
+
 // src/agent-catalog/discover-local-agents.ts
 import { spawn as spawn2 } from "node:child_process";
-import { realpath as realpath3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join5, relative as relative3, resolve as resolve3 } from "node:path";
+import { isAbsolute, join as join5 } from "node:path";
 import {
   methods as methods2,
   ndJsonStream,
@@ -41,10 +43,10 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function readGrantedAgents(stateDirectory) {
-  const path = join(stateDirectory, "installation-grants.json");
+  const path2 = join(stateDirectory, "installation-grants.json");
   let handle;
   try {
-    handle = await open(path, "r");
+    handle = await open(path2, "r");
   } catch (error61) {
     if (error61 instanceof Error && "code" in error61 && error61.code === "ENOENT") {
       return /* @__PURE__ */ new Set();
@@ -84,13 +86,13 @@ import {
   rm,
   stat as stat2
 } from "node:fs/promises";
-import { delimiter, dirname, join as join3, relative as relative2 } from "node:path";
+import { delimiter, dirname, join as join3, relative } from "node:path";
 
 // src/process/executable.ts
 import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { access, realpath, stat } from "node:fs/promises";
-import { isAbsolute, join as join2, relative, resolve } from "node:path";
+import { join as join2, resolve } from "node:path";
 var DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
 var PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1e3;
 var PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5e3;
@@ -114,9 +116,9 @@ var ExecutableIdentity = class {
 var ResolvedExecutable = class {
   identity;
   path;
-  constructor(identity) {
-    this.identity = identity;
-    this.path = identity.realPath;
+  constructor(identity2) {
+    this.identity = identity2;
+    this.path = identity2.realPath;
   }
 };
 var ProcessExecutionError = class extends Error {
@@ -135,10 +137,6 @@ var ProcessResult = class {
     this.stdout = stdout;
   }
 };
-function isInside(root, candidate) {
-  const difference = relative(root, candidate);
-  return difference.length === 0 || !difference.startsWith("..") && !isAbsolute(difference);
-}
 function executableExtensions(executableName, environment, platform) {
   if (platform !== "win32") {
     return [""];
@@ -177,10 +175,9 @@ async function resolveExecutablePath(requestedPath, platform = process.platform)
     return null;
   }
 }
-async function findExecutableOnPath(executableName, environment, approvedRoot, platform = process.platform) {
+async function findExecutableOnPath(executableName, environment, platform = process.platform) {
   const encodedPath = environment["PATH"] ?? "";
   const separator = platform === "win32" ? ";" : ":";
-  const approvedRealPath = await realpath(resolve(approvedRoot));
   const extensions = executableExtensions(
     executableName,
     environment,
@@ -195,16 +192,16 @@ async function findExecutableOnPath(executableName, environment, approvedRoot, p
         join2(entry, `${executableName}${extension}`)
       );
       const executable = await resolveExecutablePath(requestedPath, platform);
-      if (executable !== null && !isInside(approvedRealPath, requestedPath) && !isInside(approvedRealPath, executable.path)) {
+      if (executable !== null) {
         return executable;
       }
     }
   }
   return null;
 }
-async function revalidateExecutable(identity, platform = process.platform) {
-  const current = await resolveExecutablePath(identity.requestedPath, platform);
-  return current !== null && identity.matches(current.identity);
+async function revalidateExecutable(identity2, platform = process.platform) {
+  const current = await resolveExecutablePath(identity2.requestedPath, platform);
+  return current !== null && identity2.matches(current.identity);
 }
 function appendBounded(chunks, chunk, currentBytes, limitBytes) {
   const nextBytes = currentBytes + chunk.byteLength;
@@ -444,8 +441,8 @@ function isRecord2(value) {
 function packagePath(root, packageName) {
   return join3(root, "node_modules", ...packageName.split("/"));
 }
-async function readPackageJson(path) {
-  const handle = await open2(path, "r");
+async function readPackageJson(path2) {
+  const handle = await open2(path2, "r");
   try {
     const metadata = await handle.stat();
     if (!metadata.isFile() || metadata.size > PACKAGE_METADATA_LIMIT_BYTES) {
@@ -486,7 +483,7 @@ async function validateManagedAdapter(root, specification) {
   const packageRoot = await realpath2(
     packagePath(rootPath, specification.adapterPackage)
   );
-  const packageDifference = relative2(rootPath, packageRoot);
+  const packageDifference = relative(rootPath, packageRoot);
   if (packageDifference.startsWith("..") || packageDifference.length === 0) {
     throw new ManagedAdapterInstallError(
       "adapter_verification_failed",
@@ -510,7 +507,7 @@ async function validateManagedAdapter(root, specification) {
       "The managed adapter executable is invalid"
     );
   }
-  const executableDifference = relative2(rootPath, executable.path);
+  const executableDifference = relative(rootPath, executable.path);
   if (executableDifference.startsWith("..") || executableDifference.length === 0) {
     throw new ManagedAdapterInstallError(
       "adapter_verification_failed",
@@ -520,11 +517,9 @@ async function validateManagedAdapter(root, specification) {
   return executable;
 }
 var ManagedAdapterInstaller = class {
-  #approvedRoot;
   #environment;
   #stateDirectory;
   constructor(options) {
-    this.#approvedRoot = options.approvedRoot;
     this.#environment = options.environment;
     this.#stateDirectory = options.stateDirectory;
   }
@@ -549,8 +544,7 @@ var ManagedAdapterInstaller = class {
     try {
       const npm = await findExecutableOnPath(
         process.platform === "win32" ? "npm.cmd" : "npm",
-        this.#environment,
-        this.#approvedRoot
+        this.#environment
       );
       if (npm === null) {
         throw new ManagedAdapterInstallError(
@@ -633,8 +627,8 @@ function readStateDirectory(environment = process.env) {
 
 // src/agent-catalog/local-agent.ts
 import { realpathSync, statSync } from "node:fs";
-function readTrustedIdentity(path) {
-  const resolvedPath = realpathSync(path);
+function readTrustedIdentity(path2) {
+  const resolvedPath = realpathSync(path2);
   const metadata = statSync(resolvedPath);
   return new ExecutableIdentity(
     resolvedPath,
@@ -894,23 +888,11 @@ var DiscoveryAcpHandler = class {
   onPermission = (_request, _signal) => Promise.reject(new Error("ACP probe does not grant permissions"));
   onUpdate = (_notification) => Promise.resolve();
 };
-async function authorizeManagedExecutable(managed, options) {
-  const approvedRoot = await realpath3(resolve3(options.approvedRoot));
-  const requestedDifference = relative3(
-    approvedRoot,
-    managed.identity.requestedPath
-  );
-  const resolvedDifference = relative3(approvedRoot, managed.path);
-  const requestedInside = requestedDifference.length === 0 || !requestedDifference.startsWith("..") && !isAbsolute2(requestedDifference);
-  const resolvedInside = resolvedDifference.length === 0 || !resolvedDifference.startsWith("..") && !isAbsolute2(resolvedDifference);
-  return requestedInside || resolvedInside ? null : managed;
-}
 async function resolveManagedExecutable(managedExecutablePath, options) {
-  const managed = await resolveExecutablePath(
+  return await resolveExecutablePath(
     join5(readStateDirectory(options.environment), ...managedExecutablePath),
     options.platform
   );
-  return managed === null ? null : await authorizeManagedExecutable(managed, options);
 }
 async function resolveManagedAdapterExecutable(specification, options) {
   let managed;
@@ -927,12 +909,12 @@ async function resolveManagedAdapterExecutable(specification, options) {
   } catch {
     return null;
   }
-  return await authorizeManagedExecutable(managed, options);
+  return managed;
 }
 async function resolveSpecificationExecutables(executableName, overrideVariable, resolveManaged, options) {
   const override = options.environment[overrideVariable];
   if (override !== void 0) {
-    if (override.length === 0 || !isAbsolute2(override)) {
+    if (override.length === 0 || !isAbsolute(override)) {
       return [];
     }
     const executable = await resolveExecutablePath(override, options.platform);
@@ -941,7 +923,6 @@ async function resolveSpecificationExecutables(executableName, overrideVariable,
   const external = await findExecutableOnPath(
     executableName,
     options.environment,
-    options.approvedRoot,
     options.platform
   );
   const managed = await resolveManaged();
@@ -983,11 +964,11 @@ async function resolveAdapterExecutable(specification, options) {
 function normalizedVersion(output2) {
   return output2.trim().split(/\r?\n/, 1)[0]?.trim().slice(0, 128) ?? "";
 }
-async function probeVersion(executable, environment, approvedRoot, signal) {
+async function probeVersion(executable, environment, defaultWorkspace, signal) {
   const result = await runBoundedProcess({
     arguments: ["--version"],
     command: executable.path,
-    cwd: approvedRoot,
+    cwd: defaultWorkspace,
     environment,
     signal,
     timeoutMilliseconds: VERSION_PROBE_TIMEOUT_MILLISECONDS
@@ -1016,7 +997,7 @@ async function findVerifiedAgentExecutable(specification, options) {
       const version2 = await probeVersion(
         executable,
         options.environment,
-        options.approvedRoot,
+        options.defaultWorkspace,
         options.signal
       );
       return new VerifiedAgentExecutable(executable, version2);
@@ -1083,7 +1064,7 @@ function writableAcpStream(output2) {
     }
   });
 }
-async function probeAcp(agent, environment, approvedRoot, signal) {
+async function probeAcp(agent, environment, defaultWorkspace, signal) {
   signal.throwIfAborted();
   const controller = new AbortController();
   let timedOut = false;
@@ -1097,12 +1078,18 @@ async function probeAcp(agent, environment, approvedRoot, signal) {
     abort();
   }
   const child = spawn2(agent.adapterPath, [...agent.arguments], {
-    cwd: approvedRoot,
+    cwd: defaultWorkspace,
     detached: process.platform !== "win32",
     env: { ...environment, ...agent.environment },
     shell: false,
     stdio: ["pipe", "pipe", "pipe"]
   });
+  const processExit = new Promise((_resolve, reject) => {
+    const rejectExit = () => reject(new Error("ACP adapter exited during initialization"));
+    child.once("error", reject);
+    child.once("exit", rejectExit);
+    if (child.exitCode !== null || child.signalCode !== null) rejectExit();
+  });
   const stdin = child.stdin;
   const stdout = child.stdout;
   const stderr = child.stderr;
@@ -1124,13 +1111,6 @@ async function probeAcp(agent, environment, approvedRoot, signal) {
   const connection = createAcpClient(new DiscoveryAcpHandler()).connect(
     ndJsonStream(writableAcpStream(stdin), readableAcpStream(stdout))
   );
-  const processExit = new Promise((_resolve, reject) => {
-    child.once("error", (error61) => reject(error61));
-    child.once(
-      "exit",
-      () => reject(new Error("ACP adapter exited during initialization"))
-    );
-  });
   try {
     const initialized = await Promise.race([
       connection.agent.request(
@@ -1215,7 +1195,7 @@ async function discoverSpecification(specification, options) {
       agentVersion = await probeVersion(
         agent,
         options.environment,
-        options.approvedRoot,
+        options.defaultWorkspace,
         options.signal
       );
     } catch (error61) {
@@ -1234,7 +1214,7 @@ async function discoverSpecification(specification, options) {
             ...options.environment,
             [specification.adapterEnvironmentVariable]: agent.path
           },
-          options.approvedRoot,
+          options.defaultWorkspace,
           options.signal
         );
       } catch (error61) {
@@ -1259,7 +1239,7 @@ async function discoverSpecification(specification, options) {
         await probeAcp(
           definition,
           options.environment,
-          options.approvedRoot,
+          options.defaultWorkspace,
           options.signal
         );
         return new AvailableAgent(specification, definition);
@@ -1374,9 +1354,9 @@ import { dirname as dirname2 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 var AuditStore = class {
   database;
-  constructor(path) {
-    mkdirSync(dirname2(path), { recursive: true });
-    this.database = new DatabaseSync(path);
+  constructor(path2) {
+    mkdirSync(dirname2(path2), { recursive: true });
+    this.database = new DatabaseSync(path2);
     this.database.exec(`
       CREATE TABLE IF NOT EXISTS audit_events (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1419,13 +1399,15 @@ var AuditStore = class {
 };
 
 // src/config.ts
-function loadApprovedRoot() {
-  return process.env["MOBIUS_APPROVED_ROOT"] ?? process.cwd();
+import { join as join6 } from "node:path";
+function loadDefaultWorkspace() {
+  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = process.env;
+  return configuredWorkspace ?? join6(readStateDirectory(), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
     agents,
-    approvedRoot: connection.approvedRoot,
+    defaultWorkspace: connection.defaultWorkspace,
     auditDatabasePath: connection.auditDatabasePath,
     bindingId: "workspace",
     catalog: new LocalAgentCatalog(agents, installableAgents),
@@ -1440,13 +1422,13 @@ import { randomUUID } from "node:crypto";
 import {
   mkdir as mkdir2,
   open as open3,
-  realpath as realpath4,
+  realpath as realpath3,
   rename as rename2,
   stat as stat3,
   writeFile
 } from "node:fs/promises";
 import { hostname } from "node:os";
-import { basename, join as join6, resolve as resolve4 } from "node:path";
+import { basename, join as join7, resolve as resolve3 } from "node:path";
 import { fetch } from "undici";
 
 // src/network/environment-proxy.ts
@@ -1461,7 +1443,7 @@ var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken"];
 var SAVED_CONNECTION_KEYS = [
-  "approvedRoot",
+  "defaultWorkspace",
   "channelId",
   "daemonToken",
   "relayOrigin"
@@ -1508,7 +1490,7 @@ function readSingleOption(arguments_, option) {
 function assertKnownArguments(arguments_) {
   for (let index = 0; index < arguments_.length; index += 2) {
     const option = arguments_[index];
-    if (option !== "--url" && option !== "--code" && option !== "--root") {
+    if (option !== "--url" && option !== "--code" && option !== "--workspace") {
       throw new PairingClientError(
         "invalid_arguments",
         `Unknown pairing option: ${option ?? "missing option"}`
@@ -1565,7 +1547,7 @@ function parsePairCommand(arguments_) {
   return {
     code: parsePairingCode(readSingleOption(arguments_, "--code")),
     relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
-    root: readSingleOption(arguments_, "--root")
+    workspace: arguments_.includes("--workspace") ? readSingleOption(arguments_, "--workspace") : loadDefaultWorkspace()
   };
 }
 function parseChannelArgument(arguments_) {
@@ -1584,25 +1566,26 @@ function parseChannelArgument(arguments_) {
   }
   return channelId;
 }
-async function resolveApprovedRoot(path) {
-  const requestedRoot = resolve4(path);
+async function resolveDefaultWorkspace(path2) {
+  const requestedWorkspace = resolve3(path2);
   try {
-    const approvedRoot = await realpath4(requestedRoot);
-    const metadata = await stat3(approvedRoot);
+    await mkdir2(requestedWorkspace, { recursive: true, mode: 448 });
+    const defaultWorkspace = await realpath3(requestedWorkspace);
+    const metadata = await stat3(defaultWorkspace);
     if (!metadata.isDirectory()) {
       throw new PairingClientError(
         "invalid_workspace",
-        "The approved workspace root is not a directory"
+        "The default workspace is not a directory"
       );
     }
-    return approvedRoot;
+    return defaultWorkspace;
   } catch (error61) {
     if (error61 instanceof PairingClientError) {
       throw error61;
     }
     throw new PairingClientError(
       "invalid_workspace",
-      "The approved workspace root cannot be resolved",
+      "The default workspace cannot be resolved",
       { cause: error61 }
     );
   }
@@ -1658,7 +1641,7 @@ function decodeClaimResponse(value) {
   }
   return { channelId, daemonToken };
 }
-async function claimPairing(options, approvedRoot, localAgents, installableAgents, signal) {
+async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
     id: agent.id,
     label: agent.label
@@ -1676,7 +1659,7 @@ async function claimPairing(options, approvedRoot, localAgents, installableAgent
         })),
         machineName: hostname(),
         pairingCode: options.code,
-        workspaceName: basename(approvedRoot) || "Local workspace"
+        workspaceName: basename(defaultWorkspace) || "Local workspace"
       }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -1699,11 +1682,11 @@ async function claimPairing(options, approvedRoot, localAgents, installableAgent
   }
   return decodeClaimResponse(value);
 }
-async function persistConnection(channelId, relayOrigin, daemonToken, approvedRoot) {
-  const connectionsDirectory = join6(readStateDirectory(), "connections");
+async function persistConnection(channelId, relayOrigin, daemonToken, defaultWorkspace) {
+  const connectionsDirectory = join7(readStateDirectory(), "connections");
   await mkdir2(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join6(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join6(
+  const connectionPath = join7(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join7(
     connectionsDirectory,
     `.${channelId}.${randomUUID()}.tmp`
   );
@@ -1711,7 +1694,7 @@ async function persistConnection(channelId, relayOrigin, daemonToken, approvedRo
     temporaryPath,
     `${JSON.stringify(
       {
-        approvedRoot,
+        defaultWorkspace,
         channelId,
         daemonToken,
         relayOrigin: relayOrigin.toString()
@@ -1732,25 +1715,25 @@ function decodeSavedConnection(value, expectedChannelId) {
       "The saved connection is invalid"
     );
   }
-  const approvedRoot = value["approvedRoot"];
+  const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
   const daemonToken = value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof approvedRoot !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
     throw new PairingClientError(
       "invalid_connection",
       "The saved connection is invalid"
     );
   }
   return {
-    approvedRoot,
+    defaultWorkspace,
     channelId,
     daemonToken,
     relayOrigin: parseRelayOrigin(relayOrigin)
   };
 }
 async function readSavedConnection(channelId) {
-  const connectionPath = join6(
+  const connectionPath = join7(
     readStateDirectory(),
     "connections",
     `${channelId}.json`
@@ -1781,7 +1764,9 @@ async function readSavedConnection(channelId) {
   }
   const connection = decodeSavedConnection(value, channelId);
   return {
-    approvedRoot: await resolveApprovedRoot(connection.approvedRoot),
+    defaultWorkspace: await resolveDefaultWorkspace(
+      connection.defaultWorkspace
+    ),
     channelId: connection.channelId,
     daemonToken: connection.daemonToken,
     relayOrigin: connection.relayOrigin
@@ -1803,7 +1788,7 @@ function buildPairedDaemon(connection, connectionPath, inventory) {
   );
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
   relayUrl.searchParams.set("token", connection.daemonToken);
-  const auditDatabasePath = join6(
+  const auditDatabasePath = join7(
     readStateDirectory(),
     "audit",
     `${connection.channelId}.sqlite`
@@ -1815,7 +1800,7 @@ function buildPairedDaemon(connection, connectionPath, inventory) {
     ).toString(),
     config: createDaemonConfig(
       {
-        approvedRoot: connection.approvedRoot,
+        defaultWorkspace: connection.defaultWorkspace,
         auditDatabasePath,
         channelId: connection.channelId,
         relayUrl
@@ -1828,9 +1813,9 @@ function buildPairedDaemon(connection, connectionPath, inventory) {
 }
 async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
   const options = parsePairCommand(arguments_);
-  const approvedRoot = await resolveApprovedRoot(options.root);
+  const defaultWorkspace = await resolveDefaultWorkspace(options.workspace);
   const inventory = await discoverLocalAgentInventory({
-    approvedRoot,
+    defaultWorkspace,
     environment: process.env,
     signal
   });
@@ -1838,7 +1823,7 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
   const agents = inventory.readyAgents();
   const claim2 = await claimPairing(
     options,
-    approvedRoot,
+    defaultWorkspace,
     agents,
     inventory.installable,
     signal
@@ -1847,11 +1832,11 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
     claim2.channelId,
     options.relayOrigin,
     claim2.daemonToken,
-    approvedRoot
+    defaultWorkspace
   );
   return buildPairedDaemon(
     {
-      approvedRoot,
+      defaultWorkspace,
       channelId: claim2.channelId,
       daemonToken: claim2.daemonToken,
       relayOrigin: options.relayOrigin
@@ -1862,14 +1847,14 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
 }
 async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
   const channelId = parseChannelArgument(arguments_);
-  const connectionPath = join6(
+  const connectionPath = join7(
     readStateDirectory(),
     "connections",
     `${channelId}.json`
   );
   const connection = await readSavedConnection(channelId);
   const inventory = await discoverLocalAgentInventory({
-    approvedRoot: connection.approvedRoot,
+    defaultWorkspace: connection.defaultWorkspace,
     environment: process.env,
     signal
   });
@@ -1877,7 +1862,7 @@ async function resumeLocalMachine(arguments_, signal = new AbortController().sig
 }
 
 // src/run-daemon.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { basename as basename3 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
@@ -2624,10 +2609,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path) {
-  if (!path)
+function getElementAtPath(obj, path2) {
+  if (!path2)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -3039,11 +3024,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path, issues) {
+function prefixIssues(path2, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path);
+    iss.path.unshift(path2);
     return iss;
   });
 }
@@ -3476,16 +3461,16 @@ function flattenError(error61, mapper = (issue2) => issue2.message) {
 }
 function formatError(error61, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error62, path = []) => {
+  const processError = (error62, path2 = []) => {
     for (const issue2 of error62.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -3524,17 +3509,17 @@ function formatError(error61, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error61, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error62, path = []) => {
+  const processError = (error62, path2 = []) => {
     var _a3;
     for (const issue2 of error62.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -3573,8 +3558,8 @@ function treeifyError(error61, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path) {
+  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path2) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -20084,13 +20069,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path = ref.slice(1).split("/").filter(Boolean);
-  if (path.length === 0) {
+  const path2 = ref.slice(1).split("/").filter(Boolean);
+  if (path2.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path[0] === defsKey) {
-    const key = path[1] === void 0 ? void 0 : decodeJSONPointerSegment(path[1]);
+  if (path2[0] === defsKey) {
+    const key = path2[1] === void 0 ? void 0 : decodeJSONPointerSegment(path2[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -20746,6 +20731,56 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../protocol/src/prompt-usage.ts
+var TOKEN_COUNT = external_exports.number().int().nonnegative();
+var promptUsageSchema = external_exports.object({
+  cachedReadTokens: TOKEN_COUNT.nullish(),
+  cachedWriteTokens: TOKEN_COUNT.nullish(),
+  inputTokens: TOKEN_COUNT,
+  outputTokens: TOKEN_COUNT,
+  thoughtTokens: TOKEN_COUNT.nullish(),
+  totalTokens: TOKEN_COUNT
+}).readonly();
+var quotaTokenCountSchema = external_exports.object({
+  cachedInputTokens: TOKEN_COUNT,
+  cachedWriteTokens: TOKEN_COUNT.optional(),
+  inputTokens: TOKEN_COUNT,
+  outputTokens: TOKEN_COUNT,
+  reasoningOutputTokens: TOKEN_COUNT,
+  totalTokens: TOKEN_COUNT
+}).readonly();
+var promptMetadataSchema = external_exports.object({
+  quota: external_exports.object({
+    model_usage: external_exports.array(
+      external_exports.object({
+        model: external_exports.string().min(1).max(255),
+        token_count: quotaTokenCountSchema
+      }).readonly()
+    ).max(100).readonly(),
+    token_count: quotaTokenCountSchema.nullable()
+  }).readonly().optional()
+}).readonly();
+var agentPromptResponseSchema = external_exports.object({
+  _meta: promptMetadataSchema.nullish(),
+  stopReason: external_exports.enum([
+    "end_turn",
+    "max_tokens",
+    "max_turn_requests",
+    "refusal",
+    "cancelled"
+  ]),
+  usage: promptUsageSchema.nullish()
+}).readonly();
+function decodeAgentPromptResponse(value) {
+  const result = agentPromptResponseSchema.safeParse(value);
+  if (!result.success) {
+    throw new ProtocolMessageError("Invalid agent prompt response", {
+      cause: result.error
+    });
+  }
+  return result.data;
+}
+
 // ../protocol/src/version.ts
 var MOBIUS_PROTOCOL_VERSION = 1;
 
@@ -20812,7 +20847,8 @@ var sessionCapabilitiesSchema = external_exports.strictObject({
   imagePrompt: external_exports.boolean(),
   listSessions: external_exports.boolean(),
   loadSession: external_exports.boolean(),
-  resumeSession: external_exports.boolean()
+  resumeSession: external_exports.boolean(),
+  unstableForkSession: external_exports.boolean().default(false)
 }).readonly();
 var sessionCommandSchema = external_exports.strictObject({
   description: SHORT_TEXT,
@@ -20953,7 +20989,7 @@ var sessionConfigUpdatedEventSchema = external_exports.strictObject({
   requestId: IDENTIFIER,
   sessionId: IDENTIFIER
 }).readonly();
-var sessionUsageUpdatedEventSchema = external_exports.strictObject({
+var sessionContextUsageUpdatedEventSchema = external_exports.strictObject({
   costAmount: external_exports.number().finite().nonnegative(),
   costCurrency: external_exports.string().max(16),
   hasCost: external_exports.boolean(),
@@ -20961,8 +20997,22 @@ var sessionUsageUpdatedEventSchema = external_exports.strictObject({
   protocolVersion: PROTOCOL_VERSION2,
   sessionId: IDENTIFIER,
   size: external_exports.number().int().nonnegative(),
+  source: external_exports.literal("context").default("context"),
   used: external_exports.number().int().nonnegative()
 }).readonly();
+var sessionPromptUsageUpdatedEventSchema = external_exports.strictObject({
+  _meta: promptMetadataSchema.nullable(),
+  commandId: IDENTIFIER,
+  kind: external_exports.literal(SESSION_USAGE_UPDATED_KIND),
+  protocolVersion: PROTOCOL_VERSION2,
+  sessionId: IDENTIFIER,
+  source: external_exports.literal("prompt"),
+  usage: promptUsageSchema.nullable()
+}).refine((event) => event.usage !== null || event._meta?.quota !== void 0).readonly();
+var sessionUsageUpdatedEventSchema = external_exports.union([
+  sessionContextUsageUpdatedEventSchema,
+  sessionPromptUsageUpdatedEventSchema
+]);
 var sessionCommandsUpdatedEventSchema = external_exports.strictObject({
   commands: external_exports.array(sessionCommandSchema).max(500).readonly(),
   kind: external_exports.literal(SESSION_COMMANDS_UPDATED_KIND),
@@ -20973,7 +21023,7 @@ var sessionInfoUpdatedEventSchema = external_exports.strictObject({
   kind: external_exports.literal(SESSION_INFO_UPDATED_KIND),
   protocolVersion: PROTOCOL_VERSION2,
   sessionId: IDENTIFIER,
-  title: external_exports.string().max(500),
+  title: external_exports.string().max(500).nullable(),
   updatedAt: external_exports.string().max(128)
 }).readonly();
 var sessionPermissionRequestedEventSchema = external_exports.strictObject({
@@ -21550,6 +21600,160 @@ function encodeSessionFailedEvent(message) {
   return JSON.stringify(decodeSessionFailedEvent(JSON.stringify(message)));
 }
 
+// ../protocol/src/session-history.ts
+var SESSION_HISTORY_CHARACTER_LIMIT = 256e3;
+var SESSION_HISTORY_MESSAGE_LIMIT = 1e3;
+var SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT = 10;
+var SESSION_HISTORY_IMAGE_CHARACTER_LIMIT = 4e6;
+var historyImage = external_exports.strictObject({
+  data: external_exports.string().min(4).max(SESSION_HISTORY_IMAGE_CHARACTER_LIMIT).refine(
+    (data) => data.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(data)
+  ),
+  mimeType: external_exports.enum(["image/png", "image/jpeg", "image/gif", "image/webp"]),
+  name: external_exports.string().min(1).max(500)
+}).readonly();
+function parseNativeHistoryText(text) {
+  const images = [];
+  let imageCharacters = 0;
+  const plainText = text.replace(
+    /\[@image\]\(([^)\r\n]*)(?:\)|$)/g,
+    (_marker, uri) => {
+      const header = /^data:(image\/[a-z+]+);base64,/.exec(uri);
+      if (header === null) return "[Image unavailable]";
+      const parsed = historyImage.safeParse({
+        data: uri.slice(header[0].length),
+        mimeType: header[1],
+        name: `Image ${(images.length + 1).toString()}`
+      });
+      if (!parsed.success || images.length >= 8 || imageCharacters + parsed.data.data.length > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT)
+        return "[Image unavailable]";
+      images.push(parsed.data);
+      imageCharacters += parsed.data.data.length;
+      return "";
+    }
+  );
+  return { text: plainText, images };
+}
+var historyMessage = external_exports.strictObject({
+  role: external_exports.enum(["user", "assistant"]),
+  text: external_exports.string().max(SESSION_HISTORY_CHARACTER_LIMIT),
+  images: external_exports.array(historyImage).max(8).readonly().optional()
+}).readonly();
+var sessionHistorySchema = external_exports.discriminatedUnion("status", [
+  external_exports.strictObject({
+    status: external_exports.literal("available"),
+    messages: external_exports.array(historyMessage).max(SESSION_HISTORY_MESSAGE_LIMIT).readonly(),
+    truncated: external_exports.boolean(),
+    coveredCommandIds: external_exports.array(external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/)).max(1e4).readonly()
+  }).readonly(),
+  external_exports.strictObject({ status: external_exports.literal("unavailable") }).readonly()
+]).refine(
+  (history) => history.status === "unavailable" || history.messages.reduce(
+    (total, message) => total + message.text.length,
+    0
+  ) <= SESSION_HISTORY_CHARACTER_LIMIT && history.messages.reduce(
+    (total, message) => total + (message.images ?? []).reduce(
+      (size, image) => size + image.data.length,
+      0
+    ),
+    0
+  ) <= SESSION_HISTORY_IMAGE_CHARACTER_LIMIT
+);
+
+// ../protocol/src/native-sessions.ts
+var NATIVE_SESSION_REQUEST_KIND = "native.session.request";
+var NATIVE_SESSION_RESULT_KIND = "native.session.result";
+var NATIVE_SESSION_CANCEL_KIND = "native.session.cancel";
+var identifier = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+var directoryId = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/);
+var envelope = {
+  protocolVersion: external_exports.literal(MOBIUS_PROTOCOL_VERSION),
+  requestId: identifier,
+  sessionId: identifier
+};
+var identity = {
+  ...envelope,
+  kind: external_exports.literal(NATIVE_SESSION_REQUEST_KIND),
+  additionalDirectoryIds: external_exports.array(directoryId).max(16).readonly(),
+  agentId: identifier,
+  bindingId: identifier,
+  directoryId
+};
+var nativeSessionCommandSchema = external_exports.discriminatedUnion("action", [
+  external_exports.strictObject({
+    ...identity,
+    action: external_exports.literal("list"),
+    cursor: identifier.nullable()
+  }).readonly(),
+  external_exports.strictObject({
+    ...identity,
+    action: external_exports.enum(["import", "fork"]),
+    entryId: identifier,
+    targetSessionId: identifier
+  }).readonly(),
+  external_exports.strictObject({
+    ...identity,
+    action: external_exports.literal("delete"),
+    entryId: identifier
+  }).readonly()
+]);
+var nativeSessionEntrySchema = external_exports.strictObject({
+  entryId: identifier,
+  title: external_exports.string().max(500),
+  directoryId,
+  directoryLabel: external_exports.string().min(1).max(2048),
+  updatedAt: external_exports.iso.datetime({ offset: true }).nullable(),
+  additionalDirectories: external_exports.array(
+    external_exports.strictObject({ directoryId, name: external_exports.string().min(1).max(255) }).readonly()
+  ).max(16).readonly()
+}).readonly();
+var resultEnvelope = {
+  ...envelope,
+  kind: external_exports.literal(NATIVE_SESSION_RESULT_KIND)
+};
+var nativeSessionResultSchema = external_exports.discriminatedUnion("action", [
+  external_exports.strictObject({
+    ...resultEnvelope,
+    action: external_exports.literal("list"),
+    capabilities: sessionCapabilitiesSchema,
+    entries: external_exports.array(nativeSessionEntrySchema).max(500).readonly(),
+    nextCursor: identifier.nullable()
+  }).readonly(),
+  external_exports.strictObject({
+    ...resultEnvelope,
+    action: external_exports.enum(["import", "fork"]),
+    ready: sessionReadyEventSchema,
+    history: sessionHistorySchema,
+    title: external_exports.string().max(500)
+  }).readonly(),
+  external_exports.strictObject({
+    ...resultEnvelope,
+    action: external_exports.literal("preview"),
+    entryId: identifier,
+    reason: external_exports.literal("continuation_unavailable"),
+    history: sessionHistorySchema,
+    title: external_exports.string().max(500)
+  }).readonly(),
+  external_exports.strictObject({
+    ...resultEnvelope,
+    action: external_exports.literal("delete"),
+    entryId: identifier,
+    deletedSessionIds: external_exports.array(identifier).max(500).readonly()
+  }).readonly()
+]);
+var nativeSessionCancelSchema = external_exports.strictObject({ ...envelope, kind: external_exports.literal(NATIVE_SESSION_CANCEL_KIND) }).readonly();
+function decode4(schema, encoded) {
+  try {
+    const value = JSON.parse(encoded);
+    return schema.parse(value);
+  } catch (cause) {
+    throw new ProtocolMessageError("Invalid native session message", { cause });
+  }
+}
+var decodeNativeSessionCommand = (encoded) => decode4(nativeSessionCommandSchema, encoded);
+var encodeNativeSessionResult = (value) => JSON.stringify(nativeSessionResultSchema.parse(value));
+var decodeNativeSessionCancel = (encoded) => decode4(nativeSessionCancelSchema, encoded);
+
 // src/run-daemon.ts
 import { WebSocket as WebSocket2 } from "undici";
 
@@ -21799,15 +22003,15 @@ var AcpActivityTracker = class {
       await this.finishNarrative();
     }
     const previous = this.#activities.get(key);
-    const identity = this.#identity(key);
+    const identity2 = this.#identity(key);
     const activity = new AcpActivity(
-      identity.id,
+      identity2.id,
       activityType,
       "",
       [],
       "",
       truncate(`${previous?.output ?? ""}${text}`, AGENT_ACTIVITY_DETAIL_LIMIT),
-      identity.sequence,
+      identity2.sequence,
       "running",
       activityType === "reasoning" ? "Reasoning" : "Progress update",
       activityType === "reasoning" ? "think" : ""
@@ -21827,18 +22031,18 @@ var AcpActivityTracker = class {
       await this.#recordPlanEntries(key, plan.entries);
       return;
     }
-    const identity = this.#identity(key);
+    const identity2 = this.#identity(key);
     const output2 = plan.type === "markdown" ? plan.content : `Plan file: ${plan.uri}`;
     await this.#record(
       key,
       new AcpActivity(
-        identity.id,
+        identity2.id,
         "plan",
         "",
         [],
         "",
         truncate(output2, AGENT_ACTIVITY_DETAIL_LIMIT),
-        identity.sequence,
+        identity2.sequence,
         "running",
         "Plan",
         ""
@@ -21871,18 +22075,18 @@ var AcpActivityTracker = class {
   recordToolCall = async (update) => {
     await this.finishNarrative();
     const key = `tool:${update.toolCallId}`;
-    const identity = this.#identity(key);
+    const identity2 = this.#identity(key);
     const output2 = update.rawOutput === void 0 ? readContentOutput(update.content) : formatUnknown(update.rawOutput);
     await this.#record(
       key,
       new AcpActivity(
-        identity.id,
+        identity2.id,
         "tool",
         update.rawInput === void 0 ? "" : formatUnknown(update.rawInput),
         normalizeLocations(update.locations ?? []),
         truncate(update.name ?? "", 128),
         output2,
-        identity.sequence,
+        identity2.sequence,
         normalizeToolStatus(update.status ?? "pending", "pending"),
         normalizeTitle(update.title, "Tool call"),
         update.kind ?? "other",
@@ -21894,19 +22098,19 @@ var AcpActivityTracker = class {
     await this.finishNarrative();
     const key = `tool:${update.toolCallId}`;
     const previous = this.#activities.get(key);
-    const identity = this.#identity(key);
+    const identity2 = this.#identity(key);
     const output2 = update.rawOutput !== void 0 ? formatUnknown(update.rawOutput) : update.content !== void 0 && update.content !== null ? readContentOutput(update.content) : previous?.output ?? "";
     const content = update.content === void 0 || update.content === null ? previous?.content ?? [] : normalizeToolContent(update.content);
     await this.#record(
       key,
       new AcpActivity(
-        identity.id,
+        identity2.id,
         "tool",
         update.rawInput === void 0 ? previous?.input ?? "" : formatUnknown(update.rawInput),
         update.locations === void 0 || update.locations === null ? previous?.locations ?? [] : normalizeLocations(update.locations),
         update.name === void 0 || update.name === null ? previous?.name ?? "" : truncate(update.name, 128),
         output2,
-        identity.sequence,
+        identity2.sequence,
         update.status === void 0 || update.status === null ? previous?.status ?? "pending" : normalizeToolStatus(update.status, previous?.status ?? "pending"),
         update.title === void 0 || update.title === null ? previous?.title ?? "Tool call" : normalizeTitle(update.title, "Tool call"),
         update.kind === void 0 || update.kind === null ? previous?.toolKind ?? "other" : update.kind,
@@ -21946,30 +22150,30 @@ var AcpActivityTracker = class {
     if (existing !== void 0) {
       return existing;
     }
-    const identity = new ActivityIdentity(
+    const identity2 = new ActivityIdentity(
       `activity-${crypto.randomUUID()}`,
       this.#nextSequence
     );
     this.#nextSequence += 1;
-    this.#identities.set(key, identity);
-    return identity;
+    this.#identities.set(key, identity2);
+    return identity2;
   };
   #record = async (key, activity) => {
     this.#activities.set(key, activity);
     await this.#onActivity(activity);
   };
   #recordPlanEntries = async (key, entries) => {
-    const identity = this.#identity(key);
+    const identity2 = this.#identity(key);
     await this.#record(
       key,
       new AcpActivity(
-        identity.id,
+        identity2.id,
         "plan",
         "",
         [],
         "",
         formatPlanEntries(entries),
-        identity.sequence,
+        identity2.sequence,
         planStatus(entries),
         "Plan",
         ""
@@ -21978,6 +22182,88 @@ var AcpActivityTracker = class {
   };
 };
 
+// src/acp/native-session.ts
+var path = external_exports.string().min(1).max(2048).refine((value) => !value.includes("\0"));
+var nativeSessionIdSchema = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,255}$/);
+var nativeSessionInfoSchema = external_exports.object({
+  sessionId: nativeSessionIdSchema,
+  cwd: path,
+  additionalDirectories: external_exports.array(path).max(16).default([]).readonly(),
+  title: external_exports.string().max(500).nullish(),
+  updatedAt: external_exports.iso.datetime({ offset: true }).nullish()
+}).readonly();
+var nativeSessionPageSchema = external_exports.object({
+  sessions: external_exports.array(nativeSessionInfoSchema).max(500).readonly(),
+  nextCursor: external_exports.string().min(1).max(4096).nullish()
+}).readonly();
+
+// src/acp/session-history.ts
+var AcpHistoryReplay = class {
+  #messages = [];
+  #lastMessageId = null;
+  #characters = 0;
+  #imageCharacters = 0;
+  #truncated = false;
+  record = (update) => {
+    if (update.sessionUpdate !== "user_message_chunk" && update.sessionUpdate !== "agent_message_chunk")
+      return;
+    if (update.sessionUpdate === "agent_message_chunk" && isProgressMessage(update))
+      return;
+    const role = update.sessionUpdate === "user_message_chunk" ? "user" : "assistant";
+    const content = update.content;
+    const parsed = parseNativeHistoryText(
+      content.type === "text" ? content.text : content.type === "image" ? `[@image](data:${content.mimeType};base64,${content.data})` : `[${content.type} attachment]`
+    );
+    const text = parsed.text;
+    if (text.length === 0 && parsed.images.length === 0) return;
+    const previous = this.#messages.at(-1);
+    const id = update.messageId ?? null;
+    const continuation = previous?.role === role && id === this.#lastMessageId;
+    const combined = continuation ? `${previous.text}${text}` : text;
+    const allImages = continuation ? [...previous.images ?? [], ...parsed.images] : parsed.images;
+    const images = allImages.slice(0, 8);
+    this.#truncated ||= images.length < allImages.length;
+    if (continuation) {
+      this.#messages.pop();
+      this.#characters -= previous.text.length;
+      this.#imageCharacters -= (previous.images ?? []).reduce(
+        (size, image) => size + image.data.length,
+        0
+      );
+    }
+    const bounded = combined.slice(-SESSION_HISTORY_CHARACTER_LIMIT);
+    this.#truncated ||= bounded.length < combined.length;
+    this.#messages.push({
+      role,
+      text: bounded,
+      ...images.length > 0 ? { images } : {}
+    });
+    this.#characters += bounded.length;
+    this.#imageCharacters += images.reduce(
+      (size, image) => size + image.data.length,
+      0
+    );
+    this.#lastMessageId = id;
+    while (this.#messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || this.#characters > SESSION_HISTORY_CHARACTER_LIMIT || this.#imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+      const removed = this.#messages.shift();
+      if (removed !== void 0) {
+        this.#characters -= removed.text.length;
+        this.#imageCharacters -= (removed.images ?? []).reduce(
+          (size, image) => size + image.data.length,
+          0
+        );
+      }
+      this.#truncated = true;
+    }
+  };
+  snapshot = () => ({
+    status: "available",
+    messages: [...this.#messages],
+    truncated: this.#truncated,
+    coveredCommandIds: []
+  });
+};
+
 // src/acp/session-store.ts
 import { mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -22011,6 +22297,9 @@ var FoundAcpStoredSession = class extends AcpStoredSessionLookup {
     this.session = session;
   }
 };
+var DeletedAcpStoredSession = class extends AcpStoredSessionLookup {
+  found = false;
+};
 function readString2(value, field) {
   if (typeof value !== "string" || value.length === 0) {
     throw new Error(`Stored ACP session has an invalid ${field}`);
@@ -22051,7 +22340,22 @@ function decodeSessionRow(row) {
 }
 var MemoryAcpSessionStore = class {
   #sessions = /* @__PURE__ */ new Map();
+  #deleted = /* @__PURE__ */ new Set();
+  findNative = (agentId, nativeSessionId) => [...this.#sessions.values()].filter(
+    (session) => session.agentId === agentId && session.nativeSessionId === nativeSessionId
+  );
+  markDeleted = (agentId, nativeSessionId) => {
+    const ids = this.findNative(agentId, nativeSessionId).map(
+      (session) => session.sessionId
+    );
+    for (const id of ids) {
+      this.#sessions.delete(id);
+      this.#deleted.add(id);
+    }
+    return ids;
+  };
   read = (sessionId) => {
+    if (this.#deleted.has(sessionId)) return new DeletedAcpStoredSession();
     const session = this.#sessions.get(sessionId);
     return session === void 0 ? new MissingAcpStoredSession() : new FoundAcpStoredSession(session);
   };
@@ -22064,10 +22368,11 @@ var MemoryAcpSessionStore = class {
 };
 var SqliteAcpSessionStore = class {
   #database;
-  constructor(path) {
-    mkdirSync2(dirname3(path), { recursive: true });
-    this.#database = new DatabaseSync2(path);
+  constructor(path2) {
+    mkdirSync2(dirname3(path2), { recursive: true });
+    this.#database = new DatabaseSync2(path2);
     this.#database.exec(`
+      CREATE TABLE IF NOT EXISTS acp_deleted_sessions (session_id TEXT PRIMARY KEY) STRICT;
       CREATE TABLE IF NOT EXISTS acp_sessions (
         session_id TEXT PRIMARY KEY,
         agent_id TEXT NOT NULL,
@@ -22090,6 +22395,10 @@ var SqliteAcpSessionStore = class {
     }
   }
   read = (sessionId) => {
+    if (this.#database.prepare(
+      "SELECT session_id FROM acp_deleted_sessions WHERE session_id = ?"
+    ).get(sessionId) !== void 0)
+      return new DeletedAcpStoredSession();
     const row = this.#database.prepare(
       `
           SELECT
@@ -22108,6 +22417,28 @@ var SqliteAcpSessionStore = class {
   remove = (sessionId) => {
     this.#database.prepare("DELETE FROM acp_sessions WHERE session_id = ?").run(sessionId);
   };
+  findNative = (agentId, nativeSessionId) => this.#database.prepare(
+    "SELECT * FROM acp_sessions WHERE agent_id = ? AND native_session_id = ?"
+  ).all(agentId, nativeSessionId).map(decodeSessionRow);
+  markDeleted = (agentId, nativeSessionId) => {
+    const ids = this.findNative(agentId, nativeSessionId).map(
+      (session) => session.sessionId
+    );
+    this.#database.exec("BEGIN");
+    try {
+      for (const id of ids) {
+        this.#database.prepare(
+          "INSERT OR IGNORE INTO acp_deleted_sessions (session_id) VALUES (?)"
+        ).run(id);
+        this.remove(id);
+      }
+      this.#database.exec("COMMIT");
+      return ids;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
   write = (session) => {
     this.#database.prepare(
       `
@@ -22237,7 +22568,7 @@ function createWritableAcpStream(output2) {
       if (outputFailure !== void 0) {
         return Promise.reject(outputFailure);
       }
-      return new Promise((resolve6, reject) => {
+      return new Promise((resolve5, reject) => {
         pendingWriteFailures.add(reject);
         output2.write(chunk, (error61) => {
           pendingWriteFailures.delete(reject);
@@ -22250,7 +22581,7 @@ function createWritableAcpStream(output2) {
             reject(outputFailure);
             return;
           }
-          resolve6();
+          resolve5();
         });
       });
     }
@@ -22411,7 +22742,8 @@ function normalizeCapabilities(capabilities) {
     imagePrompt: prompt?.image === true,
     listSessions: session?.list != null,
     loadSession: capabilities.loadSession === true,
-    resumeSession: session?.resume != null
+    resumeSession: session?.resume != null,
+    unstableForkSession: session?.fork != null
   };
 }
 function elicitationFieldType(value) {
@@ -22759,15 +23091,18 @@ var AcpProcessSession = class _AcpProcessSession {
     imagePrompt: false,
     listSessions: false,
     loadSession: false,
-    resumeSession: false
+    resumeSession: false,
+    unstableForkSession: false
   };
   #commands = [];
   #configOptions = [];
   #nativeSessionId = "";
   #prompted = false;
-  #replaying = false;
+  #replay = {
+    kind: "idle"
+  };
   #restored = false;
-  #sessionTitle = "";
+  #sessionTitle = null;
   #sessionUpdatedAt = "";
   #turn = new IdleAcpTurn();
   #updateTail = Promise.resolve();
@@ -22796,9 +23131,9 @@ var AcpProcessSession = class _AcpProcessSession {
     stderr.on("data", (chunk) => {
       process.stderr.write(`[${agent.id}-acp] ${chunk}`);
     });
-    this.#processExit = new Promise((resolve6) => {
-      this.#child.once("error", resolve6);
-      this.#child.once("exit", resolve6);
+    this.#processExit = new Promise((resolve5) => {
+      this.#child.once("error", resolve5);
+      this.#child.once("exit", resolve5);
     });
     const stream = ndJsonStream2(
       createWritableAcpStream(stdin),
@@ -22829,10 +23164,11 @@ var AcpProcessSession = class _AcpProcessSession {
       store
     );
     try {
-      await runtime.initialize(options.signal);
+      await runtime.initialize(options.signal, options.origin);
       return runtime;
     } catch (error61) {
       await runtime.closeProcess();
+      options.signal.throwIfAborted();
       if (error61 instanceof AcpExecutionError) {
         throw error61;
       }
@@ -22851,7 +23187,33 @@ var AcpProcessSession = class _AcpProcessSession {
     this.#configOptions,
     this.#restored
   );
-  initialize = async (signal) => {
+  loadHistory = async (signal) => {
+    if (!this.#capabilities.loadSession) return { status: "unavailable" };
+    const history = new AcpHistoryReplay();
+    this.#replay = { kind: "capture", history };
+    try {
+      await this.race(
+        this.#connection.agent.request(
+          methods3.agent.session.load,
+          {
+            additionalDirectories: [...this.#additionalDirectories],
+            cwd: this.#cwd,
+            mcpServers: [],
+            sessionId: this.#nativeSessionId
+          },
+          { cancellationSignal: signal }
+        ),
+        "ACP agent exited while loading history",
+        signal
+      );
+      await this.#updateTail;
+      signal.throwIfAborted();
+      return history.snapshot();
+    } finally {
+      this.#replay = { kind: "idle" };
+    }
+  };
+  initialize = async (signal, origin) => {
     const initialized = await this.race(
       this.#connection.agent.request(
         methods3.agent.initialize,
@@ -22883,9 +23245,56 @@ var AcpProcessSession = class _AcpProcessSession {
       255
     );
     this.#agentVersion = truncate2(initialized.agentInfo?.version ?? "", 128);
-    const stored = this.#store.read(this.#mobiusSessionId);
+    const stored = origin?.kind === "import" ? new FoundAcpStoredSession(
+      new AcpStoredSession(
+        this.#mobiusSessionId,
+        this.#agentId,
+        nativeSessionIdSchema.parse(origin.nativeSessionId),
+        this.#cwd,
+        this.#additionalDirectories,
+        true
+      )
+    ) : this.#store.read(this.#mobiusSessionId);
+    if (stored instanceof DeletedAcpStoredSession)
+      throw new AcpExecutionError(
+        "The native Agent session was deleted. Start a new chat.",
+        {},
+        "native_session_deleted"
+      );
     let lifecycleResponse;
-    if (stored instanceof FoundAcpStoredSession && stored.session.agentId === this.#agentId && stored.session.cwd === this.#cwd && arraysEqual(
+    if (origin?.kind === "fork") {
+      if (!this.#capabilities.unstableForkSession)
+        throw new AcpExecutionError(
+          "This Agent does not support session forking",
+          {},
+          "native_session_unsupported"
+        );
+      const forked = await this.race(
+        this.#connection.agent.request(
+          methods3.agent.session.fork,
+          {
+            sessionId: nativeSessionIdSchema.parse(origin.nativeSessionId),
+            cwd: this.#cwd,
+            additionalDirectories: [...this.#additionalDirectories],
+            mcpServers: []
+          },
+          { cancellationSignal: signal }
+        ),
+        "ACP agent exited while forking a session",
+        signal
+      );
+      this.#nativeSessionId = nativeSessionIdSchema.parse(forked.sessionId);
+      if (this.#nativeSessionId === origin.nativeSessionId || this.#store.findNative(this.#agentId, this.#nativeSessionId).length > 0) {
+        throw new AcpExecutionError(
+          "The Agent did not create an independent fork",
+          {},
+          "invalid_native_session_response"
+        );
+      }
+      this.#prompted = true;
+      this.#restored = true;
+      lifecycleResponse = forked;
+    } else if (stored instanceof FoundAcpStoredSession && stored.session.agentId === this.#agentId && stored.session.cwd === this.#cwd && arraysEqual(
       stored.session.additionalDirectories,
       this.#additionalDirectories
     )) {
@@ -22908,7 +23317,7 @@ var AcpProcessSession = class _AcpProcessSession {
           signal
         );
       } else if (this.#capabilities.loadSession) {
-        this.#replaying = true;
+        this.#replay = { kind: "discard" };
         try {
           lifecycleResponse = await this.race(
             this.#connection.agent.request(
@@ -22925,7 +23334,8 @@ var AcpProcessSession = class _AcpProcessSession {
             signal
           );
         } finally {
-          this.#replaying = false;
+          await this.#updateTail;
+          this.#replay = { kind: "idle" };
         }
       } else {
         throw new AcpExecutionError(
@@ -22978,7 +23388,60 @@ var AcpProcessSession = class _AcpProcessSession {
     );
     await this.#updateTail;
     signal.throwIfAborted();
+    this.#store.write(
+      new AcpStoredSession(
+        this.#mobiusSessionId,
+        this.#agentId,
+        this.#nativeSessionId,
+        this.#cwd,
+        this.#additionalDirectories,
+        this.#prompted
+      )
+    );
+  };
+  listNativeSessions = async (cursor, signal) => {
+    if (!this.#capabilities.listSessions)
+      throw new AcpExecutionError(
+        "This Agent does not support native session listing",
+        {},
+        "native_session_unsupported"
+      );
+    const response = await this.race(
+      this.#connection.agent.request(
+        methods3.agent.session.list,
+        cursor === null ? {} : { cursor },
+        { cancellationSignal: signal }
+      ),
+      "ACP agent exited while listing sessions",
+      signal
+    );
+    const decoded = nativeSessionPageSchema.safeParse(response);
+    if (!decoded.success)
+      throw new AcpExecutionError(
+        "The Agent returned an invalid native session list",
+        { cause: decoded.error },
+        "invalid_native_session_response"
+      );
+    return decoded.data;
+  };
+  deleteNativeSession = async (nativeSessionId, signal) => {
+    if (!this.#capabilities.deleteSession || !this.#capabilities.listSessions)
+      throw new AcpExecutionError(
+        "This Agent does not support native session deletion",
+        {},
+        "native_session_unsupported"
+      );
+    await this.race(
+      this.#connection.agent.request(
+        methods3.agent.session.delete,
+        { sessionId: nativeSessionIdSchema.parse(nativeSessionId) },
+        { cancellationSignal: signal }
+      ),
+      "ACP agent exited while deleting a session",
+      signal
+    );
   };
+  nativeSessionId = () => this.#nativeSessionId;
   configure = async (options) => {
     const existing = this.#configOptions.find(
       (option) => option.id === options.configId
@@ -23141,7 +23604,28 @@ var AcpProcessSession = class _AcpProcessSession {
       );
       await this.#updateTail;
       await running.activities.finish();
-      return { stopReason: response.stopReason };
+      let result;
+      try {
+        result = decodeAgentPromptResponse(response);
+      } catch (cause) {
+        throw new AcpExecutionError(
+          "ACP agent returned an invalid prompt response",
+          { cause },
+          "acp_invalid_prompt_response"
+        );
+      }
+      if (result.usage != null || result._meta?.quota !== void 0) {
+        await this.#getObserver().onUsage({
+          _meta: result._meta ?? null,
+          commandId: options.commandId,
+          kind: SESSION_USAGE_UPDATED_KIND,
+          protocolVersion: MOBIUS_PROTOCOL_VERSION,
+          sessionId: this.#mobiusSessionId,
+          source: "prompt",
+          usage: result.usage ?? null
+        });
+      }
+      return result;
     } catch (error61) {
       await running.activities.finish();
       if (error61 instanceof AcpExecutionError) {
@@ -23361,7 +23845,8 @@ var AcpProcessSession = class _AcpProcessSession {
   processUpdate = async (notification) => {
     this.assertNativeSession(notification.sessionId);
     const update = notification.update;
-    if (this.#replaying && (update.sessionUpdate === "user_message_chunk" || update.sessionUpdate === "agent_message_chunk" || update.sessionUpdate === "agent_thought_chunk" || update.sessionUpdate === "tool_call" || update.sessionUpdate === "tool_call_update" || update.sessionUpdate === "plan" || update.sessionUpdate === "plan_update" || update.sessionUpdate === "plan_removed")) {
+    if (this.#replay.kind === "capture") this.#replay.history.record(update);
+    if (this.#replay.kind !== "idle" && (update.sessionUpdate === "user_message_chunk" || update.sessionUpdate === "agent_message_chunk" || update.sessionUpdate === "agent_thought_chunk" || update.sessionUpdate === "tool_call" || update.sessionUpdate === "tool_call_update" || update.sessionUpdate === "plan" || update.sessionUpdate === "plan_update" || update.sessionUpdate === "plan_removed")) {
       return;
     }
     if (update.sessionUpdate === "agent_message_chunk") {
@@ -23475,6 +23960,7 @@ var AcpProcessSession = class _AcpProcessSession {
         protocolVersion: MOBIUS_PROTOCOL_VERSION,
         sessionId: this.#mobiusSessionId,
         size: Math.max(0, Math.trunc(update.size)),
+        source: "context",
         used: Math.max(0, Math.trunc(update.used))
       });
     }
@@ -23596,6 +24082,7 @@ var AcpProcessSession = class _AcpProcessSession {
   };
 };
 var AcpSessionManager = class {
+  #nativeOperations = /* @__PURE__ */ new Set();
   #activeSessionIds = /* @__PURE__ */ new Set();
   #cancellationRequests = /* @__PURE__ */ new Set();
   #preparing = /* @__PURE__ */ new Map();
@@ -23647,6 +24134,21 @@ var AcpSessionManager = class {
     return await operation;
   }
   prepareSession = async (options) => {
+    const stored = this.#store.read(options.sessionId);
+    if (stored instanceof DeletedAcpStoredSession)
+      throw new AcpExecutionError(
+        "The native Agent session was deleted. Start a new chat.",
+        {},
+        "native_session_deleted"
+      );
+    if (stored instanceof FoundAcpStoredSession && this.#nativeOperations.has(
+      `${stored.session.agentId}:${stored.session.nativeSessionId}`
+    ))
+      throw new AcpExecutionError(
+        "The native session is being managed",
+        {},
+        "session_busy"
+      );
     const pending = this.#preparing.get(options.sessionId);
     if (pending !== void 0) {
       const runtime2 = await pending;
@@ -23693,6 +24195,16 @@ var AcpSessionManager = class {
     }
   };
   runPrompt = async (options) => {
+    const stored = this.#store.read(options.sessionId);
+    if (stored instanceof FoundAcpStoredSession && this.#nativeOperations.has(
+      `${stored.session.agentId}:${stored.session.nativeSessionId}`
+    )) {
+      throw new AcpExecutionError(
+        "The native session is being managed",
+        {},
+        "session_busy"
+      );
+    }
     if (this.#activeSessionIds.has(options.sessionId)) {
       throw new AcpExecutionError(
         "Another prompt is already running in this conversation",
@@ -23706,6 +24218,14 @@ var AcpSessionManager = class {
         return { stopReason: "cancelled" };
       }
       const runtime = await this.ensureSession(options);
+      if (this.#nativeOperations.has(
+        `${options.agent.id}:${runtime.nativeSessionId()}`
+      ))
+        throw new AcpExecutionError(
+          "The native session is being managed",
+          {},
+          "session_busy"
+        );
       if (this.#cancellationRequests.has(options.sessionId)) {
         return { stopReason: "cancelled" };
       }
@@ -23777,6 +24297,124 @@ var AcpSessionManager = class {
     }
     return started;
   };
+  listNativeSessions = async (options, cursor) => await (await this.ensureSession(options)).listNativeSessions(
+    cursor,
+    options.signal
+  );
+  openNativeSession = async (options, origin) => {
+    const key = `${options.agent.id}:${origin.nativeSessionId}`;
+    if (this.#nativeOperations.has(key))
+      throw new AcpExecutionError(
+        "The native session is being managed",
+        {},
+        "session_busy"
+      );
+    const linked = this.#store.findNative(
+      options.agent.id,
+      origin.nativeSessionId
+    );
+    if (linked.some(
+      (entry) => this.#activeSessionIds.has(entry.sessionId) || this.#preparing.has(entry.sessionId)
+    ))
+      throw new AcpExecutionError(
+        "Wait for the native session's running operation to finish",
+        {},
+        "session_busy"
+      );
+    const existing = linked[0];
+    if (origin.kind === "import" && existing !== void 0) {
+      const runtime = await this.ensureSession({
+        ...options,
+        sessionId: existing.sessionId
+      });
+      if (this.#activeSessionIds.has(existing.sessionId) || this.#nativeOperations.has(key))
+        throw new AcpExecutionError(
+          "Wait for the native session's running operation to finish",
+          {},
+          "session_busy"
+        );
+      this.#nativeOperations.add(key);
+      try {
+        const history = await runtime.loadHistory(options.signal);
+        return {
+          prepared: runtime.prepared(),
+          sessionId: existing.sessionId,
+          history
+        };
+      } catch (error61) {
+        this.#sessions.delete(existing.sessionId);
+        await runtime.closeProcess();
+        throw error61;
+      } finally {
+        this.#nativeOperations.delete(key);
+      }
+    }
+    if (this.#sessions.has(options.sessionId) || this.#preparing.has(options.sessionId) || this.#store.read(options.sessionId) instanceof FoundAcpStoredSession || this.#store.read(options.sessionId) instanceof DeletedAcpStoredSession)
+      throw new AcpExecutionError(
+        "The destination conversation already exists",
+        {},
+        "session_identity_mismatch"
+      );
+    this.#nativeOperations.add(key);
+    try {
+      const runtime = await this.#startPreparation({ ...options, origin });
+      const openedKey = `${options.agent.id}:${runtime.nativeSessionId()}`;
+      this.#nativeOperations.add(openedKey);
+      try {
+        const history = await runtime.loadHistory(options.signal);
+        return {
+          sessionId: options.sessionId,
+          prepared: runtime.prepared(),
+          history
+        };
+      } catch (error61) {
+        this.#sessions.delete(options.sessionId);
+        this.#store.remove(options.sessionId);
+        await runtime.closeProcess();
+        throw error61;
+      } finally {
+        this.#nativeOperations.delete(openedKey);
+      }
+    } finally {
+      this.#nativeOperations.delete(key);
+    }
+  };
+  deleteNativeSession = async (options, nativeSessionId) => {
+    const runtime = await this.ensureSession(options);
+    const key = `${options.agent.id}:${nativeSessionId}`;
+    const linked = this.#store.findNative(options.agent.id, nativeSessionId);
+    if (this.#nativeOperations.has(key) || linked.some(
+      (entry) => this.#activeSessionIds.has(entry.sessionId) || this.#preparing.has(entry.sessionId)
+    ))
+      throw new AcpExecutionError(
+        "Wait for the native session's running operation to finish",
+        {},
+        "session_busy"
+      );
+    this.#nativeOperations.add(key);
+    try {
+      for (const entry of linked) {
+        const active = this.#sessions.get(entry.sessionId);
+        if (active !== void 0 && active !== runtime) {
+          this.#sessions.delete(entry.sessionId);
+          await active.close();
+        }
+      }
+      options.signal.throwIfAborted();
+      await runtime.deleteNativeSession(nativeSessionId, options.signal);
+      const deleted = this.#store.markDeleted(
+        options.agent.id,
+        nativeSessionId
+      );
+      if (runtime.nativeSessionId() === nativeSessionId) {
+        this.#sessions.delete(options.sessionId);
+        await runtime.close();
+      }
+      return deleted;
+    } finally {
+      this.#nativeOperations.delete(key);
+    }
+  };
 };
 
 // src/agent-catalog/publish-agent-catalog.ts
@@ -24224,7 +24862,7 @@ function stableFailureCode(error61) {
 function discoveryOptions(options, environment, signal, specifications) {
   return {
     ...options.architecture === void 0 ? {} : { architecture: options.architecture },
-    approvedRoot: options.approvedRoot,
+    defaultWorkspace: options.defaultWorkspace,
     environment,
     ...options.platform === void 0 ? {} : { platform: options.platform },
     signal,
@@ -24380,11 +25018,11 @@ var AutomaticAdapterProvisioner = class {
 
 // src/agent-installation/fixed-installation-executor.ts
 import { realpathSync as realpathSync2, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 
 // src/agent-installation/fixed-agent-install-recipes.ts
 import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 
 // src/agent-installation/verified-download.ts
 import { createHash } from "node:crypto";
@@ -24591,8 +25229,8 @@ var FixedAgentInstallRecipe = class {
       );
     }
   };
-  requireInstalledExecutable = async (path) => {
-    const executable = await resolveExecutablePath(path);
+  requireInstalledExecutable = async (path2) => {
+    const executable = await resolveExecutablePath(path2);
     if (executable === null) {
       throw new InstallationManagerError(
         "agent_verification_failed",
@@ -24608,18 +25246,18 @@ var CodexInstallRecipe = class extends FixedAgentInstallRecipe {
   releaseChannel = "latest";
   install = async (options) => {
     this.assertSupportedPlatform();
-    const root = join7(options.stateDirectory, "agents", this.id);
-    const temporaryRoot = join7(options.stateDirectory, "temporary");
+    const root = join8(options.stateDirectory, "agents", this.id);
+    const temporaryRoot = join8(options.stateDirectory, "temporary");
     await Promise.all([
       mkdir3(root, { mode: 448, recursive: true }),
       mkdir3(temporaryRoot, { mode: 448, recursive: true })
     ]);
     const temporaryDirectory = await mkdtemp2(
-      join7(temporaryRoot, ".codex-install-")
+      join8(temporaryRoot, ".codex-install-")
     );
-    const installerPath = join7(temporaryDirectory, "install.sh");
-    const installDirectory = join7(root, "bin");
-    const codexHome = join7(root, "home");
+    const installerPath = join8(temporaryDirectory, "install.sh");
+    const installDirectory = join8(root, "bin");
+    const codexHome = join8(root, "home");
     try {
       await Promise.all([
         mkdir3(installDirectory, { mode: 448, recursive: true }),
@@ -24663,7 +25301,7 @@ var CodexInstallRecipe = class extends FixedAgentInstallRecipe {
         timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS
       });
       return await this.requireInstalledExecutable(
-        join7(installDirectory, "codex")
+        join8(installDirectory, "codex")
       );
     } catch (error61) {
       if (options.signal.aborted) {
@@ -24687,17 +25325,17 @@ var ClaudeCodeInstallRecipe = class extends FixedAgentInstallRecipe {
   releaseChannel = "stable";
   install = async (options) => {
     this.assertSupportedPlatform();
-    const root = join7(options.stateDirectory, "agents", this.id);
-    const managedHome = join7(root, "home");
-    const temporaryRoot = join7(options.stateDirectory, "temporary");
+    const root = join8(options.stateDirectory, "agents", this.id);
+    const managedHome = join8(root, "home");
+    const temporaryRoot = join8(options.stateDirectory, "temporary");
     await Promise.all([
       mkdir3(managedHome, { mode: 448, recursive: true }),
       mkdir3(temporaryRoot, { mode: 448, recursive: true })
     ]);
     const temporaryDirectory = await mkdtemp2(
-      join7(temporaryRoot, ".claude-install-")
+      join8(temporaryRoot, ".claude-install-")
     );
-    const installerPath = join7(temporaryDirectory, "install.sh");
+    const installerPath = join8(temporaryDirectory, "install.sh");
     try {
       await options.report("downloading");
       const download = await downloadVerifiedFile({
@@ -24734,7 +25372,7 @@ var ClaudeCodeInstallRecipe = class extends FixedAgentInstallRecipe {
         timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS
       });
       return await this.requireInstalledExecutable(
-        join7(managedHome, ".local", "bin", "claude")
+        join8(managedHome, ".local", "bin", "claude")
       );
     } catch (error61) {
       if (options.signal.aborted) {
@@ -24782,28 +25420,24 @@ function findRecipe(recipes, agentId) {
     "The requested Agent does not have an approved installation recipe"
   );
 }
-function isInside2(root, candidate) {
-  const difference = relative4(resolve5(root), resolve5(candidate));
-  return difference.length === 0 || !difference.startsWith("..") && !isAbsolute3(difference);
-}
-function resolveApprovedRoot2(path) {
+function resolveDefaultWorkspace2(path2) {
   try {
-    const directory = realpathSync2(resolve5(path));
+    const directory = realpathSync2(resolve4(path2));
     if (!statSync2(directory).isDirectory()) {
-      throw new Error("Approved root is not a directory");
+      throw new Error("Default workspace is not a directory");
     }
     return directory;
   } catch (error61) {
     throw new InstallationManagerError(
       "unsafe_installation_root",
-      "The approved workspace is unavailable or unsafe",
+      "The default workspace is unavailable or unsafe",
       { cause: error61 }
     );
   }
 }
-function resolveUserInstallationDirectory(path) {
+function resolveUserInstallationDirectory(path2) {
   try {
-    const directory = realpathSync2(resolve5(path));
+    const directory = realpathSync2(resolve4(path2));
     const metadata = statSync2(directory);
     if (!metadata.isDirectory() || typeof process.getuid === "function" && metadata.uid !== process.getuid()) {
       throw new Error("Installation directory is not user-owned");
@@ -24840,7 +25474,7 @@ function requiresAdapterReplacement(code) {
 }
 var FixedInstallationExecutor = class {
   #adapterInstaller;
-  #approvedRoot;
+  #defaultWorkspace;
   #audit;
   #catalog;
   #environment;
@@ -24849,17 +25483,11 @@ var FixedInstallationExecutor = class {
   #specifications;
   #stateDirectory;
   constructor(options, specifications = supportedLocalAgentSpecifications(), recipes = fixedAgentInstallRecipes(), adapterInstaller) {
-    const approvedRoot = resolveApprovedRoot2(options.approvedRoot);
+    const defaultWorkspace = resolveDefaultWorkspace2(options.defaultWorkspace);
     const stateDirectory = resolveUserInstallationDirectory(
       options.stateDirectory
     );
-    if (isInside2(approvedRoot, stateDirectory)) {
-      throw new InstallationManagerError(
-        "unsafe_installation_root",
-        "The Mobius state directory cannot be inside the approved workspace"
-      );
-    }
-    this.#approvedRoot = approvedRoot;
+    this.#defaultWorkspace = defaultWorkspace;
     this.#audit = options.audit;
     this.#catalog = options.catalog;
     this.#environment = Object.freeze({ ...options.environment });
@@ -24868,7 +25496,6 @@ var FixedInstallationExecutor = class {
     this.#specifications = Object.freeze([...specifications]);
     this.#stateDirectory = stateDirectory;
     this.#adapterInstaller = adapterInstaller ?? new ManagedAdapterInstaller({
-      approvedRoot,
       environment: this.#environment,
       stateDirectory
     });
@@ -24887,7 +25514,7 @@ var FixedInstallationExecutor = class {
         }
       );
       const discoveryOptions2 = {
-        approvedRoot: this.#approvedRoot,
+        defaultWorkspace: this.#defaultWorkspace,
         environment: this.#environment,
         signal
       };
@@ -24922,7 +25549,7 @@ var FixedInstallationExecutor = class {
         environment[specification.agentOverrideVariable] = agent.path;
         environment[specification.adapterOverrideVariable] = adapter.path;
         const inventory = await discoverLocalAgentInventory({
-          approvedRoot: this.#approvedRoot,
+          defaultWorkspace: this.#defaultWorkspace,
           environment,
           signal,
           specifications: this.#specifications
@@ -25034,7 +25661,7 @@ Mobius Web requested installation of ${label} (${requestId}). Allow this fixed u
   };
 };
 
-// src/authorization/authorize-binding.ts
+// src/authorization/local-authorization-error.ts
 var LocalAuthorizationError = class extends Error {
   code = "local_authorization_failed";
   constructor(message, options = {}) {
@@ -25044,18 +25671,16 @@ var LocalAuthorizationError = class extends Error {
 };
 
 // src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath5, stat as stat4 } from "node:fs/promises";
+import { readdir, realpath as realpath4, stat as stat4 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
 import {
   basename as basename2,
   dirname as dirname4,
-  isAbsolute as isAbsolute4,
-  join as join8,
+  isAbsolute as isAbsolute2,
+  join as join9,
   normalize,
-  relative as relative5
+  relative as relative2
 } from "node:path";
-var ROOT_DIRECTORY_ID = "root";
-var DIRECTORY_ID_PREFIX = "dir-";
-var DIRECTORY_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
 var WorkspaceDirectoryListing = class {
   directoryId;
   directoryLabel;
@@ -25068,150 +25693,690 @@ var WorkspaceDirectoryListing = class {
     this.parentDirectoryId = parentDirectoryId;
   }
 };
-function directoryId(relativePath) {
-  if (relativePath.length === 0) {
-    return ROOT_DIRECTORY_ID;
+function encodePath(path2) {
+  const encoded = Buffer.from(path2, "utf8").toString("base64url");
+  if (encoded.length === 0 || encoded.length > 2e3) {
+    throw new LocalAuthorizationError(
+      "The local directory path is too long to select"
+    );
   }
-  return `${DIRECTORY_ID_PREFIX}${Buffer.from(relativePath, "utf8").toString("base64url")}`;
+  return `path-${encoded}`;
 }
-function decodeDirectoryId(value) {
-  if (value === ROOT_DIRECTORY_ID) {
-    return "";
-  }
-  if (!value.startsWith(DIRECTORY_ID_PREFIX)) {
-    throw new LocalAuthorizationError("The workspace directory is invalid");
-  }
-  const encoded = value.slice(DIRECTORY_ID_PREFIX.length);
-  if (encoded.length === 0 || encoded.length > 2e3 || !DIRECTORY_ID_PATTERN.test(encoded)) {
-    throw new LocalAuthorizationError("The workspace directory is invalid");
-  }
+function decodePath(value, prefix) {
+  const encoded = value.slice(prefix.length);
+  if (encoded.length === 0 || encoded.length > 2e3 || !/^[a-zA-Z0-9_-]+$/.test(encoded))
+    throw new LocalAuthorizationError("The directory identifier is invalid");
   const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded) {
-    throw new LocalAuthorizationError("The workspace directory is invalid");
-  }
-  const normalized = normalize(decoded);
-  if (decoded.includes("\0") || isAbsolute4(decoded) || normalized === ".." || normalized.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || normalized !== decoded) {
-    throw new LocalAuthorizationError("The workspace directory is invalid");
-  }
-  return normalized;
-}
-function isContained(root, target) {
-  const remainder = relative5(root, target);
-  return remainder.length === 0 || !isAbsolute4(remainder) && remainder !== ".." && !remainder.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded || decoded.includes("\0") || normalize(decoded) !== decoded)
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  return decoded;
 }
 var WorkspaceDirectoryService = class {
-  #approvedBindingId;
-  #approvedRoot;
-  constructor(approvedBindingId, approvedRoot) {
-    this.#approvedBindingId = approvedBindingId;
-    this.#approvedRoot = approvedRoot;
-  }
-  resolve = async (requestedBindingId, requestedDirectoryId) => {
-    if (requestedBindingId !== this.#approvedBindingId) {
+  #bindingId;
+  #defaultWorkspace;
+  constructor(bindingId, defaultWorkspace) {
+    this.#bindingId = bindingId;
+    this.#defaultWorkspace = defaultWorkspace;
+  }
+  authorizeMachine = (bindingId) => {
+    if (bindingId !== this.#bindingId)
       throw new LocalAuthorizationError(
         "The runtime binding is not authorized"
       );
+  };
+  requestedPath = (id) => {
+    if (id === "default") return this.#defaultWorkspace;
+    if (id === "home") return homedir2();
+    if (id.startsWith("path-")) {
+      const path2 = decodePath(id, "path-");
+      if (isAbsolute2(path2)) return path2;
     }
-    const root = await this.resolveRoot();
-    const relativePath = decodeDirectoryId(requestedDirectoryId);
+    throw new LocalAuthorizationError("The directory identifier is invalid");
+  };
+  resolvePath = async (requested, signal) => {
+    signal.throwIfAborted();
+    if (!isAbsolute2(requested) || requested.includes("\0") || normalize(requested) !== requested)
+      throw new LocalAuthorizationError("The local directory path is invalid");
     try {
-      const target = await realpath5(join8(root, relativePath));
+      const target = await realpath4(requested);
+      signal.throwIfAborted();
       const metadata = await stat4(target);
-      if (!metadata.isDirectory() || !isContained(root, target)) {
+      signal.throwIfAborted();
+      if (!isAbsolute2(target) || normalize(target) !== target || !metadata.isDirectory())
         throw new LocalAuthorizationError(
-          "The workspace directory is not authorized"
+          "The selected location is not a directory"
         );
-      }
       return target;
-    } catch (error61) {
-      if (error61 instanceof LocalAuthorizationError) {
-        throw error61;
-      }
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) throw cause;
       throw new LocalAuthorizationError(
-        "The workspace directory cannot be resolved",
-        { cause: error61 }
+        "This directory is missing or unavailable to your user account",
+        { cause }
       );
     }
   };
-  list = async (requestedBindingId, requestedDirectoryId) => {
-    const root = await this.resolveRoot();
-    const logicalRelativePath = decodeDirectoryId(requestedDirectoryId);
-    const target = await this.resolve(requestedBindingId, requestedDirectoryId);
+  label = (path2) => {
+    const suffix = relative2(homedir2(), path2);
+    return suffix === "" ? "~" : !isAbsolute2(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+  };
+  identify = async (bindingId, requestedPath, signal) => {
+    this.authorizeMachine(bindingId);
+    const path2 = await this.resolvePath(requestedPath, signal);
+    return {
+      path: path2,
+      directoryId: encodePath(path2),
+      name: basename2(path2) || path2,
+      label: this.label(path2)
+    };
+  };
+  resolve = async (bindingId, id, signal) => {
+    this.authorizeMachine(bindingId);
+    return await this.resolvePath(this.requestedPath(id), signal);
+  };
+  list = async (bindingId, id, signal) => {
+    const target = await this.resolve(bindingId, id, signal);
     try {
-      const entries = [];
       const children = await readdir(target, { withFileTypes: true });
+      signal.throwIfAborted();
+      const entries = [];
       for (const child of children) {
-        if (entries.length === 500) {
-          break;
+        if (entries.length === 500) break;
+        if (child.isFile() || child.isBlockDevice() || child.isCharacterDevice() || child.isFIFO() || child.isSocket()) {
+          continue;
         }
-        const logicalChild = logicalRelativePath.length === 0 ? child.name : join8(logicalRelativePath, child.name);
         try {
-          const resolvedChild = await realpath5(join8(target, child.name));
-          const metadata = await stat4(resolvedChild);
-          if (metadata.isDirectory() && isContained(root, resolvedChild)) {
-            entries.push({
-              directoryId: directoryId(logicalChild),
-              name: child.name
-            });
-          }
-        } catch {
+          const path2 = await this.resolvePath(join9(target, child.name), signal);
+          entries.push({ directoryId: encodePath(path2), name: child.name });
+        } catch (cause) {
+          signal.throwIfAborted();
+          if (!(cause instanceof LocalAuthorizationError)) throw cause;
         }
       }
-      entries.sort((left, right) => left.name.localeCompare(right.name));
-      const labelSuffix = logicalRelativePath.replaceAll("\\", "/");
-      const parentRelative = logicalRelativePath.length === 0 || dirname4(logicalRelativePath) === "." ? "" : dirname4(logicalRelativePath);
+      entries.sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname4(target);
       return new WorkspaceDirectoryListing(
-        requestedDirectoryId,
-        labelSuffix.length === 0 ? basename2(root) : `${basename2(root)}/${labelSuffix}`,
+        id,
+        this.label(target),
         entries,
-        requestedDirectoryId === ROOT_DIRECTORY_ID ? "" : directoryId(parentRelative)
+        parent === target ? "" : encodePath(parent)
       );
-    } catch (error61) {
-      if (error61 instanceof LocalAuthorizationError) {
-        throw error61;
-      }
+    } catch (cause) {
+      signal.throwIfAborted();
+      if (cause instanceof LocalAuthorizationError) throw cause;
       throw new LocalAuthorizationError(
-        "The workspace directory cannot be listed",
-        { cause: error61 }
+        "This directory cannot be browsed by your user account",
+        { cause }
       );
     }
   };
-  resolveMany = async (requestedBindingId, directoryIds) => {
-    const resolved = [];
-    const unique = /* @__PURE__ */ new Set();
-    for (const requestedDirectoryId of directoryIds) {
-      const directory = await this.resolve(
-        requestedBindingId,
-        requestedDirectoryId
+  resolveMany = async (bindingId, ids, signal) => {
+    const paths = /* @__PURE__ */ new Set();
+    for (const id of ids) paths.add(await this.resolve(bindingId, id, signal));
+    return [...paths];
+  };
+};
+
+// src/native-sessions/service.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+
+// src/native-sessions/codex-history.ts
+import { spawn as spawn4 } from "node:child_process";
+var responseSchema = external_exports.union([
+  external_exports.object({
+    id: external_exports.number(),
+    error: external_exports.object({ code: external_exports.number(), message: external_exports.string() })
+  }),
+  external_exports.object({ id: external_exports.number(), result: external_exports.unknown() }),
+  external_exports.object({ method: external_exports.string() })
+]);
+var threadSchema = external_exports.object({
+  thread: external_exports.object({
+    id: nativeSessionIdSchema,
+    cwd: external_exports.string().min(1).max(2048).refine((path2) => !path2.includes("\0"))
+  })
+});
+var turnsSchema = external_exports.object({
+  data: external_exports.array(external_exports.object({ items: external_exports.array(external_exports.unknown()).max(1e5) })).max(SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT),
+  nextCursor: external_exports.string().nullish()
+});
+var itemTypeSchema = external_exports.object({ type: external_exports.string().min(1).max(80) });
+var userMessageSchema = external_exports.object({
+  content: external_exports.array(external_exports.unknown()).max(1e4)
+});
+var textSchema = external_exports.object({ text: external_exports.string() });
+var imageSchema = external_exports.object({ url: external_exports.string() });
+var agentMessageSchema = textSchema.extend({ phase: external_exports.string().nullish() });
+function decodeHistory(thread, value) {
+  const page = turnsSchema.parse(value);
+  const messages = [];
+  let characters = 0;
+  let imageCharacters = 0;
+  let truncated = page.nextCursor != null;
+  for (const turn of page.data.toReversed()) {
+    for (const item of turn.items) {
+      const { type } = itemTypeSchema.parse(item);
+      let message;
+      if (type === "userMessage") {
+        const { content } = userMessageSchema.parse(item);
+        const parsed = parseNativeHistoryText(
+          content.map((block) => {
+            const { type: type2 } = itemTypeSchema.parse(block);
+            if (type2 === "text") return textSchema.parse(block).text;
+            if (type2 === "image")
+              return `[@image](${imageSchema.parse(block).url})`;
+            return "[Attachment]";
+          }).join("")
+        );
+        message = {
+          role: "user",
+          text: parsed.text,
+          ...parsed.images.length > 0 ? { images: parsed.images } : {}
+        };
+      } else if (type === "agentMessage") {
+        const agent = agentMessageSchema.parse(item);
+        if (agent.phase === "commentary") continue;
+        message = { role: "assistant", text: agent.text };
+      } else {
+        continue;
+      }
+      const text = message.text.slice(-SESSION_HISTORY_CHARACTER_LIMIT);
+      if (text.length === 0 && (message.images?.length ?? 0) === 0) continue;
+      truncated ||= text.length < message.text.length;
+      messages.push({ ...message, text });
+      characters += text.length;
+      imageCharacters += (message.images ?? []).reduce(
+        (size, image) => size + image.data.length,
+        0
       );
-      if (!unique.has(directory)) {
-        unique.add(directory);
-        resolved.push(directory);
+      while (messages.length > SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT || characters > SESSION_HISTORY_CHARACTER_LIMIT || imageCharacters > SESSION_HISTORY_IMAGE_CHARACTER_LIMIT) {
+        const removed = messages.shift();
+        if (removed !== void 0) {
+          characters -= removed.text.length;
+          imageCharacters -= (removed.images ?? []).reduce(
+            (size, image) => size + image.data.length,
+            0
+          );
+        }
+        truncated = true;
       }
     }
-    return resolved;
+  }
+  return {
+    nativeSessionId: thread.id,
+    cwd: thread.cwd,
+    history: {
+      status: "available",
+      messages,
+      truncated,
+      coveredCommandIds: []
+    }
   };
-  resolveRoot = async () => {
+}
+async function readCodexHistory(agent, cwd, nativeSessionId, signal) {
+  signal.throwIfAborted();
+  nativeSessionIdSchema.parse(nativeSessionId);
+  if (agent.id !== "codex" || !await revalidateExecutable(agent.agentIdentity))
+    throw new AcpExecutionError(
+      "The local Codex executable changed. Restart Mobius to discover it again.",
+      {},
+      "agent_executable_changed"
+    );
+  signal.throwIfAborted();
+  const child = spawn4(agent.agentIdentity.realPath, ["app-server"], {
+    cwd,
+    env: { ...process.env, ...agent.environment },
+    detached: process.platform !== "win32",
+    shell: false,
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  const response = Promise.withResolvers();
+  let state = { kind: "initializing", requestId: 1 };
+  let pending = "";
+  let receivedBytes = 0;
+  const fail = (cause) => response.reject(
+    cause instanceof AcpExecutionError ? cause : new AcpExecutionError(
+      "Saved Codex history could not be read.",
+      { cause },
+      "native_history_unavailable"
+    )
+  );
+  const send2 = (message) => {
+    child.stdin.write(`${JSON.stringify(message)}
+`);
+  };
+  const onData = (chunk) => {
     try {
-      const root = await realpath5(this.#approvedRoot);
-      const metadata = await stat4(root);
-      if (!metadata.isDirectory()) {
-        throw new LocalAuthorizationError(
-          "The approved root is not a directory"
+      receivedBytes += Buffer.byteLength(chunk);
+      if (receivedBytes > 32 * 1024 * 1024)
+        throw new AcpExecutionError(
+          "This saved conversation is too large to preview.",
+          {},
+          "native_history_too_large"
         );
+      pending += chunk;
+      let newline = pending.indexOf("\n");
+      while (newline >= 0) {
+        const line = pending.slice(0, newline);
+        pending = pending.slice(newline + 1);
+        newline = pending.indexOf("\n");
+        if (line.trim().length === 0) continue;
+        const value = JSON.parse(line);
+        const message = responseSchema.parse(value);
+        if (!("id" in message)) continue;
+        if (message.id !== state.requestId)
+          throw new AcpExecutionError(
+            "Codex returned an invalid history response.",
+            {},
+            "invalid_native_session_response"
+          );
+        if ("error" in message) {
+          fail(
+            new AcpExecutionError(
+              "Saved Codex history could not be read.",
+              { cause: message.error },
+              "native_history_unavailable"
+            )
+          );
+          return;
+        }
+        switch (state.kind) {
+          case "initializing":
+            state = { kind: "metadata", requestId: 2 };
+            send2({ method: "initialized", params: {} });
+            send2({
+              id: state.requestId,
+              method: "thread/read",
+              params: { threadId: nativeSessionId, includeTurns: false }
+            });
+            break;
+          case "metadata": {
+            const { thread } = threadSchema.parse(message.result);
+            state = { kind: "turns", requestId: 3, thread };
+            send2({
+              id: state.requestId,
+              method: "thread/turns/list",
+              params: {
+                threadId: nativeSessionId,
+                limit: SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT,
+                sortDirection: "desc",
+                itemsView: "summary"
+              }
+            });
+            break;
+          }
+          case "turns":
+            response.resolve(decodeHistory(state.thread, message.result));
+            return;
+          default: {
+            const unhandled = state;
+            throw new Error(`Unknown history read state: ${String(unhandled)}`);
+          }
+        }
       }
-      return root;
-    } catch (error61) {
-      if (error61 instanceof LocalAuthorizationError) {
-        throw error61;
+    } catch (cause) {
+      fail(cause);
+    }
+  };
+  const abort = () => response.reject(signal.reason);
+  const onExit = () => fail(
+    new AcpExecutionError(
+      "Codex stopped before its saved history was available.",
+      {},
+      "native_history_unavailable"
+    )
+  );
+  const timeout = setTimeout(
+    () => fail(
+      new AcpExecutionError(
+        "Reading saved Codex history timed out.",
+        {},
+        "native_history_timeout"
+      )
+    ),
+    15e3
+  );
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", onData);
+  child.stdin.on("error", fail);
+  child.on("error", fail);
+  child.on("exit", onExit);
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    if (signal.aborted) abort();
+    else
+      send2({
+        id: 1,
+        method: "initialize",
+        params: { clientInfo: { name: "mobius_history", version: "1.0.0" } }
+      });
+    return await response.promise;
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", abort);
+    child.stdout.removeListener("data", onData);
+    if (child.pid !== void 0) await stopProcessTree(child);
+    child.stdin.removeListener("error", fail);
+    child.removeListener("error", fail);
+    child.removeListener("exit", onExit);
+  }
+}
+
+// src/native-sessions/service.ts
+var NativeSessionService = class {
+  #entries = /* @__PURE__ */ new Map();
+  #cursors = /* @__PURE__ */ new Map();
+  #config;
+  #directories;
+  #sessions;
+  #audit;
+  constructor(config2, directories, sessions, audit) {
+    this.#config = config2;
+    this.#directories = directories;
+    this.#sessions = sessions;
+    this.#audit = audit;
+  }
+  execute = async (command, signal) => {
+    signal.throwIfAborted();
+    const cwd = await this.#directories.resolve(
+      command.bindingId,
+      command.directoryId,
+      signal
+    );
+    const additionalDirectories = await this.#directories.resolveMany(
+      command.bindingId,
+      command.additionalDirectoryIds,
+      signal
+    );
+    signal.throwIfAborted();
+    const options = {
+      additionalDirectories,
+      agent: this.#config.catalog.find(command.agentId),
+      cwd,
+      sessionId: command.sessionId,
+      signal
+    };
+    const prepared = await this.#sessions.prepareSession(options);
+    if (!prepared.capabilities.listSessions)
+      throw new AcpExecutionError(
+        "This Agent does not support native session listing",
+        {},
+        "native_session_unsupported"
+      );
+    const scope = JSON.stringify([
+      command.agentId,
+      command.bindingId,
+      command.sessionId,
+      cwd
+    ]);
+    const envelope2 = {
+      kind: "native.session.result",
+      protocolVersion: 1,
+      requestId: command.requestId,
+      sessionId: command.sessionId
+    };
+    if (command.action === "list") {
+      let cursor = null;
+      if (command.cursor !== null) {
+        const known = this.#cursors.get(command.cursor);
+        if (known?.scope !== scope)
+          throw new AcpExecutionError(
+            "Refresh the native session list before continuing",
+            {},
+            "native_session_cursor_expired"
+          );
+        cursor = known.cursor;
       }
-      throw new LocalAuthorizationError(
-        "The approved root cannot be resolved",
-        {
-          cause: error61
-        }
+      const page = await this.#sessions.listNativeSessions(options, cursor);
+      const entries = [];
+      for (const info of page.sessions) {
+        const authorized = await this.authorizeEntry(command, options, info);
+        if (authorized === null) continue;
+        const entryId = randomUUID3();
+        if (this.#entries.size >= 5e3) this.#entries.clear();
+        this.#entries.set(entryId, {
+          scope,
+          nativeSessionId: info.sessionId,
+          cwd: authorized.cwd,
+          additionalDirectories: authorized.additionalDirectories
+        });
+        entries.push({
+          entryId,
+          title: info.title ?? "Untitled session",
+          directoryId: authorized.directoryId,
+          directoryLabel: authorized.directoryLabel,
+          updatedAt: info.updatedAt ?? null,
+          additionalDirectories: authorized.additionalEntries
+        });
+      }
+      let nextCursor = null;
+      if (page.nextCursor != null) {
+        if (page.nextCursor === cursor)
+          throw new AcpExecutionError(
+            "The Agent returned a repeated session cursor",
+            {},
+            "invalid_native_session_response"
+          );
+        nextCursor = randomUUID3();
+        if (this.#cursors.size >= 500) this.#cursors.clear();
+        this.#cursors.set(nextCursor, { scope, cursor: page.nextCursor });
+      }
+      this.record(command, "native_sessions_listed");
+      return {
+        ...envelope2,
+        action: "list",
+        capabilities: prepared.capabilities,
+        entries,
+        nextCursor
+      };
+    }
+    const selected = this.#entries.get(command.entryId);
+    if (selected?.scope !== scope)
+      throw new AcpExecutionError(
+        "Select a session from a fresh native session list",
+        {},
+        "native_session_not_found"
+      );
+    const target = await this.resolveTarget(command, options, selected);
+    if (command.action === "delete") {
+      if (!prepared.capabilities.deleteSession)
+        throw new AcpExecutionError(
+          "This Agent does not support native session deletion",
+          {},
+          "native_session_unsupported"
+        );
+      signal.throwIfAborted();
+      this.record(command, "native_session_delete_authorized");
+      const deletedSessionIds = await this.#sessions.deleteNativeSession(
+        options,
+        target.info.sessionId
+      );
+      this.record(command, "native_session_deleted");
+      return {
+        ...envelope2,
+        action: "delete",
+        entryId: command.entryId,
+        deletedSessionIds
+      };
+    }
+    if (command.action === "import" && !prepared.capabilities.loadSession && !prepared.capabilities.resumeSession)
+      throw new AcpExecutionError(
+        "This Agent cannot import native sessions",
+        {},
+        "native_session_unsupported"
+      );
+    if (command.action === "fork" && !prepared.capabilities.unstableForkSession)
+      throw new AcpExecutionError(
+        "This Agent does not support session forking",
+        {},
+        "native_session_unsupported"
+      );
+    if (target.additionalDirectories.length > 0 && !prepared.capabilities.additionalDirectories)
+      throw new AcpExecutionError(
+        "This Agent cannot restore additional working directories",
+        {},
+        "native_session_unsupported"
+      );
+    const opening = this.#sessions.openNativeSession(
+      {
+        ...options,
+        cwd: target.cwd,
+        sessionId: command.targetSessionId,
+        additionalDirectories: target.additionalDirectories
+      },
+      { kind: command.action, nativeSessionId: target.info.sessionId }
+    );
+    const opened = await opening.catch(async (cause) => {
+      signal.throwIfAborted();
+      if (command.action !== "import" || options.agent.id !== "codex" || !(cause instanceof AcpExecutionError) || cause.code !== "acp_execution_failed")
+        throw cause;
+      const snapshot = await readCodexHistory(
+        options.agent,
+        target.cwd,
+        target.info.sessionId,
+        signal
+      );
+      const resolved = await this.#directories.identify(
+        command.bindingId,
+        snapshot.cwd,
+        signal
+      );
+      if (snapshot.nativeSessionId !== target.info.sessionId || resolved.path !== target.cwd)
+        throw new AcpExecutionError(
+          "Codex returned history for a different session or workspace.",
+          { cause },
+          "invalid_native_session_response"
+        );
+      signal.throwIfAborted();
+      this.record(command, "native_session_previewed");
+      return { kind: "preview", history: snapshot.history };
+    });
+    if ("kind" in opened)
+      return {
+        ...envelope2,
+        action: "preview",
+        entryId: command.entryId,
+        reason: "continuation_unavailable",
+        title: target.info.title ?? "Untitled session",
+        history: opened.history
+      };
+    signal.throwIfAborted();
+    const ready = {
+      additionalDirectories: target.additionalEntries,
+      agentId: command.agentId,
+      agentName: opened.prepared.agentName,
+      agentVersion: opened.prepared.agentVersion,
+      capabilities: opened.prepared.capabilities,
+      commands: opened.prepared.commands,
+      configOptions: opened.prepared.configOptions,
+      directoryId: target.directoryId,
+      directoryLabel: target.directoryLabel,
+      kind: "session.ready",
+      protocolVersion: 1,
+      requestId: command.requestId,
+      restored: true,
+      sessionId: opened.sessionId
+    };
+    this.record(
+      command,
+      command.action === "fork" ? "native_session_forked" : "native_session_imported"
+    );
+    return {
+      ...envelope2,
+      action: command.action,
+      ready,
+      title: target.info.title ?? "Untitled session",
+      history: opened.history
+    };
+  };
+  authorizeEntry = async (command, options, info) => {
+    try {
+      const primary = await this.#directories.identify(
+        command.bindingId,
+        info.cwd,
+        options.signal
+      );
+      const additionalDirectories = [];
+      const additionalEntries = [];
+      const paths = /* @__PURE__ */ new Set([primary.path]);
+      for (const path2 of info.additionalDirectories) {
+        const directory = await this.#directories.identify(
+          command.bindingId,
+          path2,
+          options.signal
+        );
+        if (paths.has(directory.path))
+          throw new LocalAuthorizationError(
+            "Native session roots must be distinct"
+          );
+        paths.add(directory.path);
+        additionalDirectories.push(directory.path);
+        additionalEntries.push({
+          directoryId: directory.directoryId,
+          name: directory.name
+        });
+      }
+      return {
+        info,
+        cwd: primary.path,
+        directoryId: primary.directoryId,
+        directoryLabel: primary.label,
+        additionalDirectories,
+        additionalEntries
+      };
+    } catch (error61) {
+      options.signal.throwIfAborted();
+      if (error61 instanceof LocalAuthorizationError) return null;
+      throw error61;
+    }
+  };
+  resolveTarget = async (command, options, selected) => {
+    let cursor = null;
+    const visited = /* @__PURE__ */ new Set();
+    for (let index = 0; index < 100; index += 1) {
+      const page = await this.#sessions.listNativeSessions(options, cursor);
+      const info = page.sessions.find(
+        (entry) => entry.sessionId === selected.nativeSessionId
       );
+      if (info !== void 0) {
+        const target = await this.authorizeEntry(command, options, info);
+        if (target === null)
+          throw new LocalAuthorizationError(
+            "The selected native session is not authorized"
+          );
+        if (target.cwd !== selected.cwd || target.additionalDirectories.length !== selected.additionalDirectories.length || target.additionalDirectories.some(
+          (path2, index2) => path2 !== selected.additionalDirectories[index2]
+        ))
+          throw new AcpExecutionError(
+            "This session's directory changed. Refresh the list before continuing.",
+            {},
+            "native_session_target_changed"
+          );
+        return target;
+      }
+      cursor = page.nextCursor ?? null;
+      if (cursor === null) break;
+      if (visited.has(cursor))
+        throw new AcpExecutionError(
+          "The Agent returned a repeated session cursor",
+          {},
+          "invalid_native_session_response"
+        );
+      visited.add(cursor);
     }
+    throw new AcpExecutionError(
+      "The selected native session no longer exists. Refresh the list.",
+      {},
+      "native_session_not_found"
+    );
+  };
+  record = (command, event) => {
+    this.#audit.record({
+      commandId: command.requestId,
+      sessionId: command.sessionId,
+      event,
+      details: { agentId: command.agentId }
+    });
   };
 };
 
@@ -25228,7 +26393,7 @@ var RelayConnectionError = class extends Error {
 };
 function connectRelay(url2, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve5, reject) => {
     const socket = new WebSocket(url2, {
       dispatcher: environmentProxyDispatcher
     });
@@ -25281,7 +26446,7 @@ function connectRelay(url2, signal) {
       }
       finished = true;
       cleanup();
-      resolve6(socket);
+      resolve5(socket);
     };
     function onTimeout() {
       fail(
@@ -25302,7 +26467,7 @@ function connectRelay(url2, signal) {
 }
 
 // src/relay-connection/liveness.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var HEARTBEAT_ACK_TIMEOUT_MILLISECONDS = 1e4;
 var HEARTBEAT_INTERVAL_MILLISECONDS = 2e4;
 var RelayLivenessState = class {
@@ -25393,7 +26558,7 @@ var RelayConnectionLiveness = class {
       }
       throw new Error("Heartbeat was scheduled in an invalid state");
     }
-    const heartbeatId = randomUUID3();
+    const heartbeatId = randomUUID4();
     this.#state = new AwaitingHeartbeatAckState(
       heartbeatId,
       this.#timer.schedule(
@@ -25720,15 +26885,16 @@ function reportOperationFailure(socket, requestId, sessionId, error61) {
     })
   );
 }
-async function resolveSessionDirectories(directories, bindingId, directoryId2, additionalDirectoryIds) {
-  const cwd = await directories.resolve(bindingId, directoryId2);
+async function resolveSessionDirectories(directories, bindingId, directoryId2, additionalDirectoryIds, signal) {
+  const cwd = await directories.resolve(bindingId, directoryId2, signal);
   const additionalDirectories = [];
   const additionalDirectoryEntries = [];
   const unique = /* @__PURE__ */ new Set([cwd]);
   for (const additionalDirectoryId of additionalDirectoryIds) {
     const directory = await directories.resolve(
       bindingId,
-      additionalDirectoryId
+      additionalDirectoryId,
+      signal
     );
     if (unique.has(directory)) {
       throw new LocalAuthorizationError(
@@ -25748,11 +26914,12 @@ async function resolveSessionDirectories(directories, bindingId, directoryId2, a
     additionalDirectoryEntries
   );
 }
-async function executeWorkspaceList(socket, command, directories, audit) {
+async function executeWorkspaceList(socket, command, directories, audit, signal) {
   try {
     const listing = await directories.list(
       command.bindingId,
-      command.directoryId
+      command.directoryId,
+      signal
     );
     audit.record({
       commandId: command.requestId,
@@ -25782,7 +26949,8 @@ async function executeSessionPrepare(socket, command, config2, directories, audi
       directories,
       command.bindingId,
       command.directoryId,
-      command.additionalDirectoryIds
+      command.additionalDirectoryIds,
+      signal
     );
     const agent = config2.catalog.find(command.agentId);
     const prepared = await sessions.prepareSession({
@@ -25794,7 +26962,8 @@ async function executeSessionPrepare(socket, command, config2, directories, audi
     });
     const listing = await directories.list(
       command.bindingId,
-      command.directoryId
+      command.directoryId,
+      signal
     );
     audit.record({
       commandId: command.requestId,
@@ -25830,7 +26999,8 @@ async function executeSessionConfigure(socket, command, config2, directories, au
       directories,
       command.bindingId,
       command.directoryId,
-      command.additionalDirectoryIds
+      command.additionalDirectoryIds,
+      signal
     );
     const configOptions = await sessions.configureSession({
       additionalDirectories: resolved.additionalDirectories,
@@ -25869,10 +27039,11 @@ async function executePrompt(socket, command, config2, directories, audit, sessi
       directories,
       command.bindingId,
       command.directoryId,
-      command.additionalDirectoryIds
+      command.additionalDirectoryIds,
+      signal
     );
     const agent = config2.catalog.find(command.agentId);
-    const processAttemptId = randomUUID4();
+    const processAttemptId = randomUUID5();
     audit.record({
       commandId: command.commandId,
       event: "session_authorized",
@@ -25970,262 +27141,383 @@ function waitForRelayRetry(signal, timer) {
   if (signal.aborted) {
     return Promise.resolve();
   }
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     const retry = timer.schedule(finish, RELAY_RECONNECT_DELAY_MILLISECONDS);
     function finish() {
       retry.cancel();
       signal.removeEventListener("abort", finish);
-      resolve6();
+      resolve5();
     }
     signal.addEventListener("abort", finish, { once: true });
   });
 }
-async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, signal, timer) {
+async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
   const activeTurns = /* @__PURE__ */ new Map();
   const connectionController = new AbortController();
+  const nativeRequests = /* @__PURE__ */ new Map();
   sessions.setObserver(new DaemonAcpObserver(socket));
   installationObserver.connect(socket);
-  await new Promise((resolve6, reject) => {
-    let finished = false;
-    const cleanup = () => {
-      connectionRefresh.close();
-      connectionLiveness.close();
-      signal.removeEventListener("abort", stop);
-      socket.removeEventListener("close", handleClose);
-      socket.removeEventListener("error", handleError);
-      socket.removeEventListener("message", handleMessage);
-      installationObserver.disconnect(socket);
-      connectionController.abort();
-      for (const turn of activeTurns.values()) {
-        turn.abortConnection();
-      }
-      activeTurns.clear();
-    };
-    const resolveConnection = () => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      cleanup();
-      resolve6();
-    };
-    const rejectConnection = () => {
-      if (finished) {
-        return;
-      }
-      finished = true;
-      cleanup();
-      reject(new Error("Relay WebSocket failed"));
-    };
-    const stop = () => {
-      socket.close(1e3, "Daemon stopped");
-      resolveConnection();
-    };
-    const refreshConnection = () => {
-      socket.close(1e3, "Refreshing idle relay connection");
-      resolveConnection();
-    };
-    const connectionLiveness = new RelayConnectionLiveness(timer, {
-      send: (message) => send(socket, message),
-      unresponsive: () => {
-        socket.close(4001, "Relay liveness check timed out");
+  try {
+    await new Promise((resolve5, reject) => {
+      let finished = false;
+      const cleanup = () => {
+        connectionRefresh.close();
+        connectionLiveness.close();
+        signal.removeEventListener("abort", stop);
+        socket.removeEventListener("close", handleClose);
+        socket.removeEventListener("error", handleError);
+        socket.removeEventListener("message", handleMessage);
+        installationObserver.disconnect(socket);
+        connectionController.abort();
+        for (const turn of activeTurns.values()) {
+          turn.abortConnection();
+        }
+        activeTurns.clear();
+      };
+      const resolveConnection = () => {
+        if (finished) {
+          return;
+        }
+        finished = true;
+        cleanup();
+        resolve5();
+      };
+      const rejectConnection = () => {
+        if (finished) {
+          return;
+        }
+        finished = true;
+        cleanup();
+        reject(new Error("Relay WebSocket failed"));
+      };
+      const stop = () => {
+        socket.close(1e3, "Daemon stopped");
         resolveConnection();
-      }
-    });
-    const connectionRefresh = new RelayConnectionRefresh(
-      timer,
-      () => activeTurns.size === 0,
-      refreshConnection
-    );
-    signal.addEventListener("abort", stop, { once: true });
-    const handleClose = () => {
-      resolveConnection();
-    };
-    const handleError = () => {
-      if (signal.aborted) {
+      };
+      const refreshConnection = () => {
+        socket.close(1e3, "Refreshing idle relay connection");
         resolveConnection();
-        return;
-      }
-      rejectConnection();
-    };
-    const handleMessage = (event) => {
-      const encoded = event.data;
-      if (typeof encoded !== "string") {
-        socket.close(4003, "Text message required");
-        rejectConnection();
-        return;
-      }
-      try {
-        const kind = decodeMessageKind(encoded);
-        if (kind === RUNTIME_LIVENESS_READY_KIND) {
-          decodeRuntimeLivenessReadyEvent(encoded);
-          connectionLiveness.start();
+      };
+      const connectionLiveness = new RelayConnectionLiveness(timer, {
+        send: (message) => send(socket, message),
+        unresponsive: () => {
+          socket.close(4001, "Relay liveness check timed out");
+          resolveConnection();
+        }
+      });
+      const connectionRefresh = new RelayConnectionRefresh(
+        timer,
+        () => activeTurns.size === 0,
+        refreshConnection
+      );
+      signal.addEventListener("abort", stop, { once: true });
+      const handleClose = () => {
+        resolveConnection();
+      };
+      const handleError = () => {
+        if (signal.aborted) {
+          resolveConnection();
           return;
         }
-        if (kind === RUNTIME_HEARTBEAT_ACK_KIND) {
-          connectionLiveness.acknowledge(
-            decodeRuntimeHeartbeatAckEvent(encoded)
-          );
+        rejectConnection();
+      };
+      const handleMessage = (event) => {
+        const encoded = event.data;
+        if (typeof encoded !== "string") {
+          socket.close(4003, "Text message required");
+          rejectConnection();
           return;
         }
-        if (kind === SESSION_CANCEL_KIND) {
-          const cancellation = decodeSessionCancelCommand(encoded);
-          const turn2 = activeTurns.get(cancellation.commandId);
-          if (turn2 === void 0 || !turn2.matches(cancellation)) {
-            console.warn(
-              "Mobius daemon ignored cancellation for an inactive turn"
+        try {
+          const kind = decodeMessageKind(encoded);
+          if (kind === NATIVE_SESSION_CANCEL_KIND) {
+            const command2 = decodeNativeSessionCancel(encoded);
+            const pending = nativeRequests.get(command2.requestId);
+            if (pending?.sessionId === command2.sessionId)
+              pending.controller.abort(
+                new AcpExecutionError(
+                  "Native session operation cancelled",
+                  {},
+                  "native_session_cancelled"
+                )
+              );
+            return;
+          }
+          if (kind === NATIVE_SESSION_REQUEST_KIND) {
+            const command2 = decodeNativeSessionCommand(encoded);
+            const previous = [...nativeRequests.values()].filter(
+              (request) => request.agentId === command2.agentId
             );
+            if (nativeRequests.has(command2.requestId) || nativeRequests.size >= 4 || previous.some((request) => !request.controller.signal.aborted)) {
+              reportOperationFailure(
+                socket,
+                command2.requestId,
+                command2.sessionId,
+                new AcpExecutionError(
+                  "Another native session operation is running",
+                  {},
+                  "native_session_busy"
+                )
+              );
+              return;
+            }
+            const controller = new AbortController();
+            const operationSignal = AbortSignal.any([
+              connectionController.signal,
+              controller.signal
+            ]);
+            const timeout = timer.schedule(
+              () => controller.abort(
+                new AcpExecutionError(
+                  "Native session operation timed out",
+                  {},
+                  "native_session_timeout"
+                )
+              ),
+              9e4
+            );
+            const completion = (async () => {
+              try {
+                operationSignal.throwIfAborted();
+                if (previous.length > 0) {
+                  await new Promise((resolve6, reject2) => {
+                    const cancel = () => reject2(operationSignal.reason);
+                    operationSignal.addEventListener("abort", cancel, {
+                      once: true
+                    });
+                    void Promise.all(
+                      previous.map((request) => request.completion)
+                    ).then(
+                      () => {
+                        operationSignal.removeEventListener("abort", cancel);
+                        resolve6();
+                      },
+                      (error61) => {
+                        operationSignal.removeEventListener("abort", cancel);
+                        reject2(error61);
+                      }
+                    );
+                  });
+                }
+                operationSignal.throwIfAborted();
+                const result = await nativeSessions.execute(
+                  command2,
+                  operationSignal
+                );
+                if (socket.readyState === WebSocket2.OPEN)
+                  send(socket, encodeNativeSessionResult(result));
+              } catch (error61) {
+                const failure = operationSignal.aborted ? controller.signal.reason ?? new AcpExecutionError(
+                  "Native session operation cancelled",
+                  {},
+                  "native_session_cancelled"
+                ) : error61;
+                audit.record({
+                  commandId: command2.requestId,
+                  sessionId: command2.sessionId,
+                  event: "native_session_operation_failed",
+                  details: { code: operationErrorCode(failure) }
+                });
+                reportOperationFailure(
+                  socket,
+                  command2.requestId,
+                  command2.sessionId,
+                  failure
+                );
+              } finally {
+                timeout.cancel();
+                nativeRequests.delete(command2.requestId);
+              }
+            })();
+            nativeRequests.set(command2.requestId, {
+              agentId: command2.agentId,
+              sessionId: command2.sessionId,
+              controller,
+              completion
+            });
             return;
           }
-          if (!turn2.requestCancellation()) {
+          if (kind === RUNTIME_LIVENESS_READY_KIND) {
+            decodeRuntimeLivenessReadyEvent(encoded);
+            connectionLiveness.start();
             return;
           }
-          audit.record({
-            commandId: cancellation.commandId,
-            event: "session_cancellation_requested",
-            sessionId: cancellation.sessionId
-          });
-          void sessions.cancelPrompt(cancellation.sessionId).catch((error61) => {
-            console.error(
-              "Mobius daemon could not cancel the agent turn",
-              error61
+          if (kind === RUNTIME_HEARTBEAT_ACK_KIND) {
+            connectionLiveness.acknowledge(
+              decodeRuntimeHeartbeatAckEvent(encoded)
             );
-          });
-          return;
-        }
-        if (kind === WORKSPACE_LIST_KIND) {
-          const command2 = decodeWorkspaceListCommand(encoded);
-          void executeWorkspaceList(socket, command2, directories, audit);
-          return;
-        }
-        if (kind === SESSION_PREPARE_KIND) {
-          const command2 = decodeSessionPrepareCommand(encoded);
-          void executeSessionPrepare(
-            socket,
-            command2,
-            config2,
-            directories,
-            audit,
-            sessions,
-            connectionController.signal
-          );
-          return;
-        }
-        if (kind === SESSION_CONFIGURE_KIND) {
-          const command2 = decodeSessionConfigureCommand(encoded);
-          void executeSessionConfigure(
-            socket,
-            command2,
-            config2,
-            directories,
-            audit,
-            sessions,
-            connectionController.signal
-          );
-          return;
-        }
-        if (kind === SESSION_PERMISSION_RESPOND_KIND) {
-          const command2 = decodeSessionPermissionRespondCommand(encoded);
-          void sessions.respondPermission(command2).then(() => {
+            return;
+          }
+          if (kind === SESSION_CANCEL_KIND) {
+            const cancellation = decodeSessionCancelCommand(encoded);
+            const turn2 = activeTurns.get(cancellation.commandId);
+            if (turn2 === void 0 || !turn2.matches(cancellation)) {
+              console.warn(
+                "Mobius daemon ignored cancellation for an inactive turn"
+              );
+              return;
+            }
+            if (!turn2.requestCancellation()) {
+              return;
+            }
             audit.record({
-              commandId: command2.interactionId,
-              event: "session_permission_resolved",
-              sessionId: command2.sessionId
+              commandId: cancellation.commandId,
+              event: "session_cancellation_requested",
+              sessionId: cancellation.sessionId
+            });
+            void sessions.cancelPrompt(cancellation.sessionId).catch((error61) => {
+              console.error(
+                "Mobius daemon could not cancel the agent turn",
+                error61
+              );
             });
-          }).catch((error61) => {
-            reportOperationFailure(
+            return;
+          }
+          if (kind === WORKSPACE_LIST_KIND) {
+            const command2 = decodeWorkspaceListCommand(encoded);
+            void executeWorkspaceList(
               socket,
-              command2.interactionId,
-              command2.sessionId,
-              error61
+              command2,
+              directories,
+              audit,
+              connectionController.signal
             );
-          });
-          return;
-        }
-        if (kind === SESSION_ELICITATION_RESPOND_KIND) {
-          const command2 = decodeSessionElicitationRespondCommand(encoded);
-          void sessions.respondElicitation(command2).then(() => {
-            audit.record({
-              commandId: command2.interactionId,
-              event: "session_elicitation_resolved",
-              sessionId: command2.sessionId
+            return;
+          }
+          if (kind === SESSION_PREPARE_KIND) {
+            const command2 = decodeSessionPrepareCommand(encoded);
+            void executeSessionPrepare(
+              socket,
+              command2,
+              config2,
+              directories,
+              audit,
+              sessions,
+              connectionController.signal
+            );
+            return;
+          }
+          if (kind === SESSION_CONFIGURE_KIND) {
+            const command2 = decodeSessionConfigureCommand(encoded);
+            void executeSessionConfigure(
+              socket,
+              command2,
+              config2,
+              directories,
+              audit,
+              sessions,
+              connectionController.signal
+            );
+            return;
+          }
+          if (kind === SESSION_PERMISSION_RESPOND_KIND) {
+            const command2 = decodeSessionPermissionRespondCommand(encoded);
+            void sessions.respondPermission(command2).then(() => {
+              audit.record({
+                commandId: command2.interactionId,
+                event: "session_permission_resolved",
+                sessionId: command2.sessionId
+              });
+            }).catch((error61) => {
+              reportOperationFailure(
+                socket,
+                command2.interactionId,
+                command2.sessionId,
+                error61
+              );
+            });
+            return;
+          }
+          if (kind === SESSION_ELICITATION_RESPOND_KIND) {
+            const command2 = decodeSessionElicitationRespondCommand(encoded);
+            void sessions.respondElicitation(command2).then(() => {
+              audit.record({
+                commandId: command2.interactionId,
+                event: "session_elicitation_resolved",
+                sessionId: command2.sessionId
+              });
+            }).catch((error61) => {
+              reportOperationFailure(
+                socket,
+                command2.interactionId,
+                command2.sessionId,
+                error61
+              );
+            });
+            return;
+          }
+          if (kind === AGENT_INSTALL_REQUEST_KIND) {
+            const command2 = decodeAgentInstallRequestCommand(encoded);
+            void installations.request(command2, signal).catch((error61) => {
+              console.error("Mobius Agent installation failed", error61);
+            });
+            return;
+          }
+          if (kind === AGENT_INSTALL_CANCEL_KIND) {
+            const command2 = decodeAgentInstallCancelCommand(encoded);
+            void installations.cancel(command2.requestId).catch((error61) => {
+              reportOperationFailure(socket, command2.requestId, "", error61);
             });
-          }).catch((error61) => {
-            reportOperationFailure(
+            return;
+          }
+          if (kind !== SESSION_PROMPT_KIND) {
+            throw new Error("Unsupported protocol message");
+          }
+          const command = decodeSessionPromptCommand(encoded);
+          if (activeTurns.has(command.commandId)) {
+            reportFailure(
               socket,
-              command2.interactionId,
-              command2.sessionId,
-              error61
+              command,
+              "duplicate_command",
+              "The command is already running"
             );
-          });
-          return;
-        }
-        if (kind === AGENT_INSTALL_REQUEST_KIND) {
-          const command2 = decodeAgentInstallRequestCommand(encoded);
-          void installations.request(command2, signal).catch((error61) => {
-            console.error("Mobius Agent installation failed", error61);
-          });
-          return;
-        }
-        if (kind === AGENT_INSTALL_CANCEL_KIND) {
-          const command2 = decodeAgentInstallCancelCommand(encoded);
-          void installations.cancel(command2.requestId).catch((error61) => {
-            reportOperationFailure(socket, command2.requestId, "", error61);
-          });
-          return;
-        }
-        if (kind !== SESSION_PROMPT_KIND) {
-          throw new Error("Unsupported protocol message");
-        }
-        const command = decodeSessionPromptCommand(encoded);
-        if (activeTurns.has(command.commandId)) {
-          reportFailure(
+            return;
+          }
+          const turn = new ActiveDaemonTurn(command, new AbortController());
+          activeTurns.set(command.commandId, turn);
+          void executePrompt(
             socket,
             command,
-            "duplicate_command",
-            "The command is already running"
-          );
-          return;
+            config2,
+            directories,
+            audit,
+            sessions,
+            turn.signal
+          ).catch((error61) => {
+            console.error("Mobius daemon turn failed", error61);
+          }).finally(() => {
+            activeTurns.delete(command.commandId);
+            connectionRefresh.afterTurnFinished();
+          });
+        } catch (error61) {
+          console.error("Mobius daemon rejected a message", error61);
+          socket.close(4008, "Invalid protocol message");
+          rejectConnection();
         }
-        const turn = new ActiveDaemonTurn(command, new AbortController());
-        activeTurns.set(command.commandId, turn);
-        void executePrompt(
-          socket,
-          command,
-          config2,
-          directories,
-          audit,
-          sessions,
-          turn.signal
-        ).catch((error61) => {
-          console.error("Mobius daemon turn failed", error61);
-        }).finally(() => {
-          activeTurns.delete(command.commandId);
-          connectionRefresh.afterTurnFinished();
-        });
-      } catch (error61) {
-        console.error("Mobius daemon rejected a message", error61);
-        socket.close(4008, "Invalid protocol message");
-        rejectConnection();
+      };
+      socket.addEventListener("close", handleClose);
+      socket.addEventListener("error", handleError);
+      socket.addEventListener("message", handleMessage);
+      if (signal.aborted) {
+        stop();
       }
-    };
-    socket.addEventListener("close", handleClose);
-    socket.addEventListener("error", handleError);
-    socket.addEventListener("message", handleMessage);
-    if (signal.aborted) {
-      stop();
-    }
-  });
+    });
+  } finally {
+    connectionController.abort();
+    await Promise.all(
+      [...nativeRequests.values()].map((request) => request.completion)
+    );
+  }
 }
 async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   const installationAudit = new AuditInstallationEvents(audit);
   const stateDirectory = readStateDirectory();
   const specifications = supportedLocalAgentSpecifications();
   const installationExecutor = new FixedInstallationExecutor({
-    approvedRoot: config2.approvedRoot,
+    defaultWorkspace: config2.defaultWorkspace,
     audit: installationAudit,
     catalog: config2.catalog,
     environment: process.env,
@@ -26234,13 +27526,12 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   });
   await new AutomaticAdapterProvisioner(
     {
-      approvedRoot: config2.approvedRoot,
+      defaultWorkspace: config2.defaultWorkspace,
       audit: installationAudit,
       catalog: config2.catalog,
       environment: process.env
     },
     new ManagedAdapterInstaller({
-      approvedRoot: config2.approvedRoot,
       environment: process.env,
       stateDirectory
     }),
@@ -26253,9 +27544,15 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   );
   const directories = new WorkspaceDirectoryService(
     config2.bindingId,
-    config2.approvedRoot
+    config2.defaultWorkspace
   );
   const installationObserver = new DaemonInstallationObserver();
+  const nativeSessions = new NativeSessionService(
+    config2,
+    directories,
+    sessions,
+    audit
+  );
   const installations = new AgentInstallationManager(
     specifications,
     new ConsoleInstallationAuthorizer(stateDirectory),
@@ -26275,6 +27572,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
           sessions,
           installations,
           installationObserver,
+          nativeSessions,
           signal,
           timer
         );
@@ -26310,7 +27608,7 @@ process.once("SIGTERM", () => shutdown.abort());
 var USAGE = `Mobius CLI
 
 Usage:
-  mobius pair --url <relay-url> --code <pairing-code> --root <workspace>
+  mobius pair --url <relay-url> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
 
@@ -26318,6 +27616,9 @@ Commands:
   pair   Pair this machine and start its local daemon
   start  Start the local daemon for a saved channel
   agents Show locally available and installable Agents
+
+Pairing grants this browser access to the machine with your user account's permissions.
+New conversations default to ~/.mobius/workspace; choose other directories in the browser.
 `;
 async function main() {
   const command = process.argv[2];
@@ -26330,8 +27631,9 @@ async function main() {
     if (arguments_.length > 1 || arguments_.length === 1 && arguments_[0] !== "--json") {
       throw new Error("Usage: mobius agents [--json]");
     }
+    await mkdir4(loadDefaultWorkspace(), { recursive: true, mode: 448 });
     const inventory = await discoverLocalAgentInventory({
-      approvedRoot: loadApprovedRoot(),
+      defaultWorkspace: loadDefaultWorkspace(),
       environment: process.env,
       signal: shutdown.signal
     });
@@ -26373,6 +27675,12 @@ async function main() {
   process.stdout.write(
     "Starting the local daemon. Keep this terminal open.\n\n"
   );
+  process.stdout.write(
+    "This paired browser can use the machine with your user account's permissions.\n"
+  );
+  process.stdout.write(`Default workspace: ${config2.defaultWorkspace}
+
+`);
   const audit = new AuditStore(config2.auditDatabasePath);
   try {
     await runDaemon(config2, audit, shutdown.signal);