@moxt-ai/mobius 0.0.5 → 0.0.7

package/dist/run-daemon.js

@@ -1,6 +1,5 @@
-import { randomUUID } from "node:crypto";
 import { basename } from "node:path";
-import { AGENT_ACTIVITY_KIND, AGENT_INSTALL_AWAITING_APPROVAL_KIND, AGENT_INSTALL_CANCEL_KIND, AGENT_INSTALL_CANCELLED_KIND, AGENT_INSTALL_COMPLETED_KIND, AGENT_INSTALL_FAILED_KIND, AGENT_INSTALL_PROGRESS_KIND, AGENT_INSTALL_REQUEST_KIND, AGENT_INSTALL_STARTED_KIND, AGENT_MESSAGE_DELTA_KIND, decodeAgentInstallCancelCommand, decodeAgentInstallRequestCommand, decodeMessageKind, decodeRuntimeHeartbeatAckEvent, decodeRuntimeLivenessReadyEvent, decodeSessionCancelCommand, decodeSessionConfigureCommand, decodeSessionElicitationRespondCommand, decodeSessionPermissionRespondCommand, decodeSessionPrepareCommand, decodeSessionPromptCommand, decodeWorkspaceListCommand, encodeAgentActivityEvent, encodeAgentContentEvent, encodeAgentInstallAwaitingApprovalEvent, encodeAgentInstallCancelledEvent, encodeAgentInstallCompletedEvent, encodeAgentInstallFailedEvent, encodeAgentInstallProgressEvent, encodeAgentInstallStartedEvent, encodeAgentMessageDeltaEvent, encodeSessionCommandsUpdatedEvent, encodeSessionCompletedEvent, encodeSessionConfigUpdatedEvent, encodeSessionElicitationRequestedEvent, encodeSessionElicitationResolvedEvent, encodeSessionFailedEvent, encodeSessionInfoUpdatedEvent, encodeSessionOperationFailedEvent, encodeSessionPermissionRequestedEvent, encodeSessionPermissionResolvedEvent, encodeSessionReadyEvent, encodeSessionStartedEvent, encodeSessionUsageUpdatedEvent, encodeWorkspaceEntriesEvent, MOBIUS_PROTOCOL_VERSION, RUNTIME_HEARTBEAT_ACK_KIND, RUNTIME_LIVENESS_READY_KIND, SESSION_CANCEL_KIND, SESSION_COMPLETED_KIND, SESSION_CONFIGURE_KIND, SESSION_ELICITATION_RESPOND_KIND, SESSION_FAILED_KIND, SESSION_PERMISSION_RESPOND_KIND, SESSION_PREPARE_KIND, SESSION_PROMPT_KIND, SESSION_STARTED_KIND, WORKSPACE_LIST_KIND, } from "@moxt-ai/mobius-protocol";
+import { AGENT_ACTIVITY_KIND, AGENT_INSTALL_AWAITING_APPROVAL_KIND, AGENT_INSTALL_CANCEL_KIND, AGENT_INSTALL_CANCELLED_KIND, AGENT_INSTALL_COMPLETED_KIND, AGENT_INSTALL_FAILED_KIND, AGENT_INSTALL_PROGRESS_KIND, AGENT_INSTALL_REQUEST_KIND, AGENT_INSTALL_STARTED_KIND, AGENT_MESSAGE_DELTA_KIND, decodeAgentInstallCancelCommand, decodeAgentInstallRequestCommand, decodeMessageKind, decodeNativeSessionCancel, decodeNativeSessionCommand, decodeRuntimeHeartbeatAckEvent, decodeRuntimeLivenessReadyEvent, decodeSessionCancelCommand, decodeSessionConfigureCommand, decodeSessionElicitationRespondCommand, decodeSessionEventAcknowledgement, decodeSessionPermissionRespondCommand, decodeSessionPrepareCommand, decodeSessionPromptCommand, decodeWorkspaceListCommand, encodeAgentActivityEvent, encodeAgentContentEvent, encodeAgentInstallAwaitingApprovalEvent, encodeAgentInstallCancelledEvent, encodeAgentInstallCompletedEvent, encodeAgentInstallFailedEvent, encodeAgentInstallProgressEvent, encodeAgentInstallStartedEvent, encodeAgentMessageDeltaEvent, encodeNativeSessionResult, encodeSessionCommandsUpdatedEvent, encodeSessionCompletedEvent, encodeSessionConfigUpdatedEvent, encodeSessionElicitationRequestedEvent, encodeSessionElicitationResolvedEvent, encodeSessionFailedEvent, encodeSessionInfoUpdatedEvent, encodeSessionOperationFailedEvent, encodeSessionPermissionRequestedEvent, encodeSessionPermissionResolvedEvent, encodeSessionReadyEvent, encodeSessionStartedEvent, encodeSessionUsageUpdatedEvent, encodeWorkspaceEntriesEvent, NATIVE_SESSION_CANCEL_KIND, NATIVE_SESSION_REQUEST_KIND, RUNTIME_HEARTBEAT_ACK_KIND, RUNTIME_LIVENESS_READY_KIND, SESSION_CANCEL_KIND, SESSION_COMPLETED_KIND, SESSION_CONFIGURE_KIND, SESSION_ELICITATION_RESPOND_KIND, SESSION_EVENT_ACK_KIND, SESSION_FAILED_KIND, SESSION_PERMISSION_RESPOND_KIND, SESSION_PREPARE_KIND, SESSION_PROMPT_KIND, SESSION_STARTED_KIND, WORKSPACE_LIST_KIND, } from "@moxt-ai/mobius-protocol";
 import { WebSocket } from "undici";
 import { AcpExecutionError, AcpSessionManager, NullAcpSessionObserver, } from "./acp/session-manager.js";
 import { SqliteAcpSessionStore } from "./acp/session-store.js";
@@ -12,10 +11,12 @@ import { AutomaticAdapterProvisioner } from "./agent-installation/automatic-adap
 import { FixedInstallationExecutor } from "./agent-installation/fixed-installation-executor.js";
 import { ConsoleInstallationAuthorizer } from "./agent-installation/local-installation-authorizer.js";
 import { ManagedAdapterInstaller } from "./agent-installation/managed-adapter-installer.js";
-import { LocalAuthorizationError } from "./authorization/authorize-binding.js";
+import { LocalAuthorizationError } from "./authorization/local-authorization-error.js";
 import { WorkspaceDirectoryService } from "./authorization/workspace-directory.js";
+import { NativeSessionService } from "./native-sessions/service.js";
 import { connectRelay } from "./relay-connection/connect.js";
 import { RelayConnectionLiveness } from "./relay-connection/liveness.js";
+import { SessionEventOutbox } from "./relay-connection/session-event-outbox.js";
 import { systemDaemonTimer, } from "./relay-connection/timer.js";
 import { readStateDirectory } from "./storage/state-directory.js";
 const RELAY_RECONNECT_DELAY_MILLISECONDS = 500;
@@ -71,44 +72,44 @@ class RelayConnectionRefresh {
     };
 }
 class DaemonAcpObserver {
-    #socket;
-    constructor(socket) {
-        this.#socket = socket;
+    #record;
+    constructor(record) {
+        this.#record = record;
     }
     onCommands = (event) => {
-        send(this.#socket, encodeSessionCommandsUpdatedEvent(event));
+        this.#record(event.sessionId, encodeSessionCommandsUpdatedEvent(event));
         return Promise.resolve();
     };
     onConfig = (event) => {
-        send(this.#socket, encodeSessionConfigUpdatedEvent(event));
+        this.#record(event.sessionId, encodeSessionConfigUpdatedEvent(event));
         return Promise.resolve();
     };
     onContent = (event) => {
-        send(this.#socket, encodeAgentContentEvent(event));
+        this.#record(event.sessionId, encodeAgentContentEvent(event));
         return Promise.resolve();
     };
     onElicitation = (event) => {
-        send(this.#socket, encodeSessionElicitationRequestedEvent(event));
+        this.#record(event.sessionId, encodeSessionElicitationRequestedEvent(event));
         return Promise.resolve();
     };
     onElicitationResolved = (event) => {
-        send(this.#socket, encodeSessionElicitationResolvedEvent(event));
+        this.#record(event.sessionId, encodeSessionElicitationResolvedEvent(event));
         return Promise.resolve();
     };
     onInfo = (event) => {
-        send(this.#socket, encodeSessionInfoUpdatedEvent(event));
+        this.#record(event.sessionId, encodeSessionInfoUpdatedEvent(event));
         return Promise.resolve();
     };
     onPermission = (event) => {
-        send(this.#socket, encodeSessionPermissionRequestedEvent(event));
+        this.#record(event.sessionId, encodeSessionPermissionRequestedEvent(event));
         return Promise.resolve();
     };
     onPermissionResolved = (event) => {
-        send(this.#socket, encodeSessionPermissionResolvedEvent(event));
+        this.#record(event.sessionId, encodeSessionPermissionResolvedEvent(event));
         return Promise.resolve();
     };
     onUsage = (event) => {
-        send(this.#socket, encodeSessionUsageUpdatedEvent(event));
+        this.#record(event.sessionId, encodeSessionUsageUpdatedEvent(event));
         return Promise.resolve();
     };
 }
@@ -159,7 +160,6 @@ class DaemonInstallationObserver {
             this.#send(socket, encodeAgentInstallAwaitingApprovalEvent({
                 agentId: state.agentId,
                 kind: AGENT_INSTALL_AWAITING_APPROVAL_KIND,
-                protocolVersion: MOBIUS_PROTOCOL_VERSION,
                 requestId: state.requestId,
             }));
             return Promise.resolve();
@@ -170,14 +170,12 @@ class DaemonInstallationObserver {
                 this.#send(socket, encodeAgentInstallStartedEvent({
                     agentId: state.agentId,
                     kind: AGENT_INSTALL_STARTED_KIND,
-                    protocolVersion: MOBIUS_PROTOCOL_VERSION,
                     requestId: state.requestId,
                 }));
             }
             this.#send(socket, encodeAgentInstallProgressEvent({
                 agentId: state.agentId,
                 kind: AGENT_INSTALL_PROGRESS_KIND,
-                protocolVersion: MOBIUS_PROTOCOL_VERSION,
                 requestId: state.requestId,
                 stage: state.stage,
             }));
@@ -188,7 +186,6 @@ class DaemonInstallationObserver {
                 agentId: state.agentId,
                 authenticationMayBeRequired: state.authenticationMayBeRequired,
                 kind: AGENT_INSTALL_COMPLETED_KIND,
-                protocolVersion: MOBIUS_PROTOCOL_VERSION,
                 requestId: state.requestId,
             }));
             return Promise.resolve();
@@ -199,7 +196,6 @@ class DaemonInstallationObserver {
                 code: state.code,
                 kind: AGENT_INSTALL_FAILED_KIND,
                 message: state.message,
-                protocolVersion: MOBIUS_PROTOCOL_VERSION,
                 requestId: state.requestId,
             }));
             return Promise.resolve();
@@ -208,7 +204,6 @@ class DaemonInstallationObserver {
             this.#send(socket, encodeAgentInstallCancelledEvent({
                 agentId: state.agentId,
                 kind: AGENT_INSTALL_CANCELLED_KIND,
-                protocolVersion: MOBIUS_PROTOCOL_VERSION,
                 requestId: state.requestId,
             }));
             return Promise.resolve();
@@ -256,18 +251,20 @@ function send(socket, message) {
     }
     socket.send(message);
 }
-function reportFailure(socket, command, code, message) {
-    if (socket.readyState !== WebSocket.OPEN) {
-        return;
+function recordSessionEvent(outbox, socket, sessionId, payload, attemptId = null) {
+    const envelope = outbox.enqueue(sessionId, payload, attemptId);
+    if (socket.readyState === WebSocket.OPEN) {
+        socket.send(envelope);
     }
-    send(socket, encodeSessionFailedEvent({
+}
+function reportFailure(outbox, socket, command, code, message, attemptId = null) {
+    recordSessionEvent(outbox, socket, command.sessionId, encodeSessionFailedEvent({
         code,
         commandId: command.commandId,
         kind: SESSION_FAILED_KIND,
         message,
-        protocolVersion: MOBIUS_PROTOCOL_VERSION,
         sessionId: command.sessionId,
-    }));
+    }), attemptId);
 }
 function operationErrorCode(error) {
     if (error instanceof AcpExecutionError ||
@@ -293,18 +290,17 @@ function reportOperationFailure(socket, requestId, sessionId, error) {
         code: operationErrorCode(error),
         kind: "session.operation.failed",
         message: operationErrorMessage(error),
-        protocolVersion: MOBIUS_PROTOCOL_VERSION,
         requestId,
         sessionId,
     }));
 }
-async function resolveSessionDirectories(directories, bindingId, directoryId, additionalDirectoryIds) {
-    const cwd = await directories.resolve(bindingId, directoryId);
+async function resolveSessionDirectories(directories, bindingId, directoryId, additionalDirectoryIds, signal) {
+    const cwd = await directories.resolve(bindingId, directoryId, signal);
     const additionalDirectories = [];
     const additionalDirectoryEntries = [];
     const unique = new Set([cwd]);
     for (const additionalDirectoryId of additionalDirectoryIds) {
-        const directory = await directories.resolve(bindingId, additionalDirectoryId);
+        const directory = await directories.resolve(bindingId, additionalDirectoryId, signal);
         if (unique.has(directory)) {
             throw new LocalAuthorizationError("Workspace directories must resolve to distinct locations");
         }
@@ -317,9 +313,9 @@ async function resolveSessionDirectories(directories, bindingId, directoryId, ad
     }
     return new ResolvedSessionDirectories(cwd, additionalDirectories, additionalDirectoryEntries);
 }
-async function executeWorkspaceList(socket, command, directories, audit) {
+async function executeWorkspaceList(socket, command, directories, audit, signal) {
     try {
-        const listing = await directories.list(command.bindingId, command.directoryId);
+        const listing = await directories.list(command.bindingId, command.directoryId, signal);
         audit.record({
             commandId: command.requestId,
             event: "workspace_list_authorized",
@@ -332,7 +328,6 @@ async function executeWorkspaceList(socket, command, directories, audit) {
             entries: listing.entries,
             kind: "workspace.entries",
             parentDirectoryId: listing.parentDirectoryId,
-            protocolVersion: MOBIUS_PROTOCOL_VERSION,
             requestId: command.requestId,
         }));
     }
@@ -340,9 +335,9 @@ async function executeWorkspaceList(socket, command, directories, audit) {
         reportOperationFailure(socket, command.requestId, "", error);
     }
 }
-async function executeSessionPrepare(socket, command, config, directories, audit, sessions, signal) {
+async function executeSessionPrepare(outbox, socket, command, config, directories, audit, sessions, signal) {
     try {
-        const resolved = await resolveSessionDirectories(directories, command.bindingId, command.directoryId, command.additionalDirectoryIds);
+        const resolved = await resolveSessionDirectories(directories, config.bindingId, command.directoryId, command.additionalDirectoryIds, signal);
         const agent = config.catalog.find(command.agentId);
         const prepared = await sessions.prepareSession({
             additionalDirectories: resolved.additionalDirectories,
@@ -351,13 +346,13 @@ async function executeSessionPrepare(socket, command, config, directories, audit
             sessionId: command.sessionId,
             signal,
         });
-        const listing = await directories.list(command.bindingId, command.directoryId);
+        const listing = await directories.list(config.bindingId, command.directoryId, signal);
         audit.record({
             commandId: command.requestId,
             event: "session_prepared",
             sessionId: command.sessionId,
         });
-        send(socket, encodeSessionReadyEvent({
+        recordSessionEvent(outbox, socket, command.sessionId, encodeSessionReadyEvent({
             additionalDirectories: resolved.additionalDirectoryEntries,
             agentId: command.agentId,
             agentName: prepared.agentName,
@@ -368,7 +363,6 @@ async function executeSessionPrepare(socket, command, config, directories, audit
             directoryId: command.directoryId,
             directoryLabel: listing.directoryLabel,
             kind: "session.ready",
-            protocolVersion: MOBIUS_PROTOCOL_VERSION,
             requestId: command.requestId,
             restored: prepared.restored,
             sessionId: command.sessionId,
@@ -378,9 +372,9 @@ async function executeSessionPrepare(socket, command, config, directories, audit
         reportOperationFailure(socket, command.requestId, command.sessionId, error);
     }
 }
-async function executeSessionConfigure(socket, command, config, directories, audit, sessions, signal) {
+async function executeSessionConfigure(outbox, socket, command, config, directories, audit, sessions, signal) {
     try {
-        const resolved = await resolveSessionDirectories(directories, command.bindingId, command.directoryId, command.additionalDirectoryIds);
+        const resolved = await resolveSessionDirectories(directories, config.bindingId, command.directoryId, command.additionalDirectoryIds, signal);
         const configOptions = await sessions.configureSession({
             additionalDirectories: resolved.additionalDirectories,
             agent: config.catalog.find(command.agentId),
@@ -398,10 +392,9 @@ async function executeSessionConfigure(socket, command, config, directories, aud
             event: "session_configured",
             sessionId: command.sessionId,
         });
-        send(socket, encodeSessionConfigUpdatedEvent({
+        recordSessionEvent(outbox, socket, command.sessionId, encodeSessionConfigUpdatedEvent({
             configOptions,
             kind: "session.config.updated",
-            protocolVersion: MOBIUS_PROTOCOL_VERSION,
             requestId: command.requestId,
             sessionId: command.sessionId,
         }));
@@ -410,23 +403,22 @@ async function executeSessionConfigure(socket, command, config, directories, aud
         reportOperationFailure(socket, command.requestId, command.sessionId, error);
     }
 }
-async function executePrompt(socket, command, config, directories, audit, sessions, signal) {
+async function executePrompt(outbox, socket, command, config, directories, audit, sessions, attemptId, signal) {
     try {
-        const resolved = await resolveSessionDirectories(directories, command.bindingId, command.directoryId, command.additionalDirectoryIds);
+        const resolved = await resolveSessionDirectories(directories, config.bindingId, command.directoryId, command.additionalDirectoryIds, signal);
         const agent = config.catalog.find(command.agentId);
-        const processAttemptId = randomUUID();
         audit.record({
             commandId: command.commandId,
             event: "session_authorized",
             sessionId: command.sessionId,
         });
-        send(socket, encodeSessionStartedEvent({
+        outbox.transitionExecution(command.commandId, "running");
+        recordSessionEvent(outbox, socket, command.sessionId, encodeSessionStartedEvent({
             commandId: command.commandId,
             kind: SESSION_STARTED_KIND,
-            processAttemptId,
-            protocolVersion: MOBIUS_PROTOCOL_VERSION,
+            attemptId,
             sessionId: command.sessionId,
-        }));
+        }), attemptId);
         const result = await sessions.runPrompt({
             additionalDirectories: resolved.additionalDirectories,
             agent,
@@ -434,33 +426,32 @@ async function executePrompt(socket, command, config, directories, audit, sessio
             cwd: resolved.cwd,
             images: command.images,
             onActivity: (activity) => {
-                send(socket, encodeAgentActivityEvent({
+                recordSessionEvent(outbox, socket, command.sessionId, encodeAgentActivityEvent({
                     activityId: activity.activityId,
                     activityType: activity.activityType,
                     commandId: command.commandId,
                     content: activity.content,
+                    detail: activity.detail,
                     input: activity.input,
                     kind: AGENT_ACTIVITY_KIND,
                     locations: activity.locations,
                     name: activity.name,
                     output: activity.output,
-                    protocolVersion: MOBIUS_PROTOCOL_VERSION,
                     sequence: activity.sequence,
                     sessionId: command.sessionId,
                     status: activity.status,
                     title: activity.title,
                     toolKind: activity.toolKind,
-                }));
+                }), attemptId);
                 return Promise.resolve();
             },
             onText: (text) => {
-                send(socket, encodeAgentMessageDeltaEvent({
+                recordSessionEvent(outbox, socket, command.sessionId, encodeAgentMessageDeltaEvent({
                     commandId: command.commandId,
                     kind: AGENT_MESSAGE_DELTA_KIND,
-                    protocolVersion: MOBIUS_PROTOCOL_VERSION,
                     sessionId: command.sessionId,
                     text,
-                }));
+                }), attemptId);
                 return Promise.resolve();
             },
             prompt: command.prompt,
@@ -468,13 +459,13 @@ async function executePrompt(socket, command, config, directories, audit, sessio
             sessionId: command.sessionId,
             signal,
         });
-        send(socket, encodeSessionCompletedEvent({
+        recordSessionEvent(outbox, socket, command.sessionId, encodeSessionCompletedEvent({
             commandId: command.commandId,
             kind: SESSION_COMPLETED_KIND,
-            protocolVersion: MOBIUS_PROTOCOL_VERSION,
             sessionId: command.sessionId,
             stopReason: result.stopReason,
-        }));
+        }), attemptId);
+        outbox.transitionExecution(command.commandId, result.stopReason === "cancelled" ? "cancelled" : "succeeded");
         audit.record({
             commandId: command.commandId,
             event: result.stopReason === "cancelled"
@@ -490,9 +481,10 @@ async function executePrompt(socket, command, config, directories, audit, sessio
             sessionId: command.sessionId,
         });
         const code = operationErrorCode(error);
-        reportFailure(socket, command, code === "session_operation_failed" ? "agent_execution_failed" : code, code === "session_operation_failed"
+        reportFailure(outbox, socket, command, code === "session_operation_failed" ? "agent_execution_failed" : code, code === "session_operation_failed"
             ? "The local agent could not complete the request"
-            : operationErrorMessage(error));
+            : operationErrorMessage(error), attemptId);
+        outbox.transitionExecution(command.commandId, "failed");
         console.error("Mobius daemon command failed", error);
     }
 }
@@ -510,215 +502,313 @@ function waitForRelayRetry(signal, timer) {
         signal.addEventListener("abort", finish, { once: true });
     });
 }
-async function runRelayConnection(config, directories, audit, sessions, installations, installationObserver, signal, timer) {
+async function runRelayConnection(config, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, signal, timer) {
     const relayUrl = new URL(config.relayUrl);
     relayUrl.searchParams.set("liveness", "1");
     const socket = await connectRelay(relayUrl, signal);
     const activeTurns = new Map();
+    const activeAttemptIds = new Map();
     const connectionController = new AbortController();
-    sessions.setObserver(new DaemonAcpObserver(socket));
+    const nativeRequests = new Map();
+    const record = (sessionId, payload) => {
+        recordSessionEvent(outbox, socket, sessionId, payload, activeAttemptIds.get(sessionId) ?? null);
+    };
+    sessions.setObserver(new DaemonAcpObserver(record));
     installationObserver.connect(socket);
-    await new Promise((resolve, reject) => {
-        let finished = false;
-        const cleanup = () => {
-            connectionRefresh.close();
-            connectionLiveness.close();
-            signal.removeEventListener("abort", stop);
-            socket.removeEventListener("close", handleClose);
-            socket.removeEventListener("error", handleError);
-            socket.removeEventListener("message", handleMessage);
-            installationObserver.disconnect(socket);
-            connectionController.abort();
-            for (const turn of activeTurns.values()) {
-                turn.abortConnection();
-            }
-            activeTurns.clear();
-        };
-        const resolveConnection = () => {
-            if (finished) {
-                return;
-            }
-            finished = true;
-            cleanup();
-            resolve();
-        };
-        const rejectConnection = () => {
-            if (finished) {
-                return;
-            }
-            finished = true;
-            cleanup();
-            reject(new Error("Relay WebSocket failed"));
-        };
-        const stop = () => {
-            socket.close(1000, "Daemon stopped");
-            resolveConnection();
-        };
-        const refreshConnection = () => {
-            socket.close(1000, "Refreshing idle relay connection");
-            resolveConnection();
-        };
-        const connectionLiveness = new RelayConnectionLiveness(timer, {
-            send: (message) => send(socket, message),
-            unresponsive: () => {
-                socket.close(4001, "Relay liveness check timed out");
+    for (const pending of outbox.pending()) {
+        send(socket, pending);
+    }
+    try {
+        await new Promise((resolve, reject) => {
+            let finished = false;
+            const cleanup = () => {
+                connectionRefresh.close();
+                connectionLiveness.close();
+                signal.removeEventListener("abort", stop);
+                socket.removeEventListener("close", handleClose);
+                socket.removeEventListener("error", handleError);
+                socket.removeEventListener("message", handleMessage);
+                installationObserver.disconnect(socket);
+                connectionController.abort();
+                for (const turn of activeTurns.values()) {
+                    turn.abortConnection();
+                }
+                activeTurns.clear();
+            };
+            const resolveConnection = () => {
+                if (finished) {
+                    return;
+                }
+                finished = true;
+                cleanup();
+                resolve();
+            };
+            const rejectConnection = () => {
+                if (finished) {
+                    return;
+                }
+                finished = true;
+                cleanup();
+                reject(new Error("Relay WebSocket failed"));
+            };
+            const stop = () => {
+                socket.close(1000, "Daemon stopped");
                 resolveConnection();
-            },
-        });
-        const connectionRefresh = new RelayConnectionRefresh(timer, () => activeTurns.size === 0, refreshConnection);
-        signal.addEventListener("abort", stop, { once: true });
-        const handleClose = () => {
-            resolveConnection();
-        };
-        const handleError = () => {
-            if (signal.aborted) {
+            };
+            const refreshConnection = () => {
+                socket.close(1000, "Refreshing idle relay connection");
                 resolveConnection();
-                return;
-            }
-            rejectConnection();
-        };
-        const handleMessage = (event) => {
-            const encoded = event.data;
-            if (typeof encoded !== "string") {
-                socket.close(4003, "Text message required");
-                rejectConnection();
-                return;
-            }
-            try {
-                const kind = decodeMessageKind(encoded);
-                if (kind === RUNTIME_LIVENESS_READY_KIND) {
-                    decodeRuntimeLivenessReadyEvent(encoded);
-                    connectionLiveness.start();
+            };
+            const connectionLiveness = new RelayConnectionLiveness(timer, {
+                send: (message) => send(socket, message),
+                unresponsive: () => {
+                    socket.close(4001, "Relay liveness check timed out");
+                    resolveConnection();
+                },
+            });
+            const connectionRefresh = new RelayConnectionRefresh(timer, () => activeTurns.size === 0, refreshConnection);
+            signal.addEventListener("abort", stop, { once: true });
+            const handleClose = () => {
+                resolveConnection();
+            };
+            const handleError = () => {
+                if (signal.aborted) {
+                    resolveConnection();
                     return;
                 }
-                if (kind === RUNTIME_HEARTBEAT_ACK_KIND) {
-                    connectionLiveness.acknowledge(decodeRuntimeHeartbeatAckEvent(encoded));
+                rejectConnection();
+            };
+            const handleMessage = (event) => {
+                const encoded = event.data;
+                if (typeof encoded !== "string") {
+                    socket.close(4003, "Text message required");
+                    rejectConnection();
                     return;
                 }
-                if (kind === SESSION_CANCEL_KIND) {
-                    const cancellation = decodeSessionCancelCommand(encoded);
-                    const turn = activeTurns.get(cancellation.commandId);
-                    if (turn === undefined || !turn.matches(cancellation)) {
-                        console.warn("Mobius daemon ignored cancellation for an inactive turn");
+                try {
+                    const kind = decodeMessageKind(encoded);
+                    if (kind === SESSION_EVENT_ACK_KIND) {
+                        outbox.acknowledge(decodeSessionEventAcknowledgement(encoded));
                         return;
                     }
-                    if (!turn.requestCancellation()) {
+                    if (kind === NATIVE_SESSION_CANCEL_KIND) {
+                        const command = decodeNativeSessionCancel(encoded);
+                        const pending = nativeRequests.get(command.requestId);
+                        if (pending?.sessionId === command.sessionId)
+                            pending.controller.abort(new AcpExecutionError("Native session operation cancelled", {}, "native_session_cancelled"));
                         return;
                     }
-                    audit.record({
-                        commandId: cancellation.commandId,
-                        event: "session_cancellation_requested",
-                        sessionId: cancellation.sessionId,
-                    });
-                    void sessions.cancelPrompt(cancellation.sessionId).catch((error) => {
-                        console.error("Mobius daemon could not cancel the agent turn", error);
-                    });
-                    return;
-                }
-                if (kind === WORKSPACE_LIST_KIND) {
-                    const command = decodeWorkspaceListCommand(encoded);
-                    void executeWorkspaceList(socket, command, directories, audit);
-                    return;
-                }
-                if (kind === SESSION_PREPARE_KIND) {
-                    const command = decodeSessionPrepareCommand(encoded);
-                    void executeSessionPrepare(socket, command, config, directories, audit, sessions, connectionController.signal);
-                    return;
-                }
-                if (kind === SESSION_CONFIGURE_KIND) {
-                    const command = decodeSessionConfigureCommand(encoded);
-                    void executeSessionConfigure(socket, command, config, directories, audit, sessions, connectionController.signal);
-                    return;
-                }
-                if (kind === SESSION_PERMISSION_RESPOND_KIND) {
-                    const command = decodeSessionPermissionRespondCommand(encoded);
-                    void sessions
-                        .respondPermission(command)
-                        .then(() => {
-                        audit.record({
-                            commandId: command.interactionId,
-                            event: "session_permission_resolved",
+                    if (kind === NATIVE_SESSION_REQUEST_KIND) {
+                        const command = decodeNativeSessionCommand(encoded);
+                        const previous = [...nativeRequests.values()].filter((request) => request.agentId === command.agentId);
+                        if (nativeRequests.has(command.requestId) ||
+                            nativeRequests.size >= 4 ||
+                            previous.some((request) => !request.controller.signal.aborted)) {
+                            reportOperationFailure(socket, command.requestId, command.sessionId, new AcpExecutionError("Another native session operation is running", {}, "native_session_busy"));
+                            return;
+                        }
+                        const controller = new AbortController();
+                        const operationSignal = AbortSignal.any([
+                            connectionController.signal,
+                            controller.signal,
+                        ]);
+                        const timeout = timer.schedule(() => controller.abort(new AcpExecutionError("Native session operation timed out", {}, "native_session_timeout")), 90_000);
+                        const completion = (async () => {
+                            try {
+                                operationSignal.throwIfAborted();
+                                if (previous.length > 0) {
+                                    await new Promise((resolve, reject) => {
+                                        const cancel = () => reject(operationSignal.reason);
+                                        operationSignal.addEventListener("abort", cancel, {
+                                            once: true,
+                                        });
+                                        void Promise.all(previous.map((request) => request.completion)).then(() => {
+                                            operationSignal.removeEventListener("abort", cancel);
+                                            resolve();
+                                        }, (error) => {
+                                            operationSignal.removeEventListener("abort", cancel);
+                                            reject(error);
+                                        });
+                                    });
+                                }
+                                operationSignal.throwIfAborted();
+                                const result = await nativeSessions.execute(command, operationSignal);
+                                if (socket.readyState === WebSocket.OPEN)
+                                    send(socket, encodeNativeSessionResult(result));
+                            }
+                            catch (error) {
+                                const failure = operationSignal.aborted
+                                    ? (controller.signal.reason ??
+                                        new AcpExecutionError("Native session operation cancelled", {}, "native_session_cancelled"))
+                                    : error;
+                                audit.record({
+                                    commandId: command.requestId,
+                                    sessionId: command.sessionId,
+                                    event: "native_session_operation_failed",
+                                    details: { code: operationErrorCode(failure) },
+                                });
+                                reportOperationFailure(socket, command.requestId, command.sessionId, failure);
+                            }
+                            finally {
+                                timeout.cancel();
+                                nativeRequests.delete(command.requestId);
+                            }
+                        })();
+                        nativeRequests.set(command.requestId, {
+                            agentId: command.agentId,
                             sessionId: command.sessionId,
+                            controller,
+                            completion,
                         });
-                    })
-                        .catch((error) => {
-                        reportOperationFailure(socket, command.interactionId, command.sessionId, error);
-                    });
-                    return;
-                }
-                if (kind === SESSION_ELICITATION_RESPOND_KIND) {
-                    const command = decodeSessionElicitationRespondCommand(encoded);
-                    void sessions
-                        .respondElicitation(command)
-                        .then(() => {
+                        return;
+                    }
+                    if (kind === RUNTIME_LIVENESS_READY_KIND) {
+                        decodeRuntimeLivenessReadyEvent(encoded);
+                        connectionLiveness.start();
+                        return;
+                    }
+                    if (kind === RUNTIME_HEARTBEAT_ACK_KIND) {
+                        connectionLiveness.acknowledge(decodeRuntimeHeartbeatAckEvent(encoded));
+                        return;
+                    }
+                    if (kind === SESSION_CANCEL_KIND) {
+                        const cancellation = decodeSessionCancelCommand(encoded);
+                        const turn = activeTurns.get(cancellation.commandId);
+                        if (turn === undefined || !turn.matches(cancellation)) {
+                            console.warn("Mobius daemon ignored cancellation for an inactive turn");
+                            return;
+                        }
+                        if (!turn.requestCancellation()) {
+                            return;
+                        }
                         audit.record({
-                            commandId: command.interactionId,
-                            event: "session_elicitation_resolved",
-                            sessionId: command.sessionId,
+                            commandId: cancellation.commandId,
+                            event: "session_cancellation_requested",
+                            sessionId: cancellation.sessionId,
                         });
-                    })
-                        .catch((error) => {
-                        reportOperationFailure(socket, command.interactionId, command.sessionId, error);
-                    });
-                    return;
-                }
-                if (kind === AGENT_INSTALL_REQUEST_KIND) {
-                    const command = decodeAgentInstallRequestCommand(encoded);
-                    void installations
-                        .request(command, signal)
-                        .catch((error) => {
-                        console.error("Mobius Agent installation failed", error);
-                    });
-                    return;
-                }
-                if (kind === AGENT_INSTALL_CANCEL_KIND) {
-                    const command = decodeAgentInstallCancelCommand(encoded);
-                    void installations
-                        .cancel(command.requestId)
+                        void sessions
+                            .cancelPrompt(cancellation.sessionId)
+                            .catch((error) => {
+                            console.error("Mobius daemon could not cancel the agent turn", error);
+                        });
+                        return;
+                    }
+                    if (kind === WORKSPACE_LIST_KIND) {
+                        const command = decodeWorkspaceListCommand(encoded);
+                        void executeWorkspaceList(socket, command, directories, audit, connectionController.signal);
+                        return;
+                    }
+                    if (kind === SESSION_PREPARE_KIND) {
+                        const command = decodeSessionPrepareCommand(encoded);
+                        void executeSessionPrepare(outbox, socket, command, config, directories, audit, sessions, connectionController.signal);
+                        return;
+                    }
+                    if (kind === SESSION_CONFIGURE_KIND) {
+                        const command = decodeSessionConfigureCommand(encoded);
+                        void executeSessionConfigure(outbox, socket, command, config, directories, audit, sessions, connectionController.signal);
+                        return;
+                    }
+                    if (kind === SESSION_PERMISSION_RESPOND_KIND) {
+                        const command = decodeSessionPermissionRespondCommand(encoded);
+                        void sessions
+                            .respondPermission(command)
+                            .then(() => {
+                            audit.record({
+                                commandId: command.interactionId,
+                                event: "session_permission_resolved",
+                                sessionId: command.sessionId,
+                            });
+                        })
+                            .catch((error) => {
+                            reportOperationFailure(socket, command.interactionId, command.sessionId, error);
+                        });
+                        return;
+                    }
+                    if (kind === SESSION_ELICITATION_RESPOND_KIND) {
+                        const command = decodeSessionElicitationRespondCommand(encoded);
+                        void sessions
+                            .respondElicitation(command)
+                            .then(() => {
+                            audit.record({
+                                commandId: command.interactionId,
+                                event: "session_elicitation_resolved",
+                                sessionId: command.sessionId,
+                            });
+                        })
+                            .catch((error) => {
+                            reportOperationFailure(socket, command.interactionId, command.sessionId, error);
+                        });
+                        return;
+                    }
+                    if (kind === AGENT_INSTALL_REQUEST_KIND) {
+                        const command = decodeAgentInstallRequestCommand(encoded);
+                        void installations
+                            .request(command, signal)
+                            .catch((error) => {
+                            console.error("Mobius Agent installation failed", error);
+                        });
+                        return;
+                    }
+                    if (kind === AGENT_INSTALL_CANCEL_KIND) {
+                        const command = decodeAgentInstallCancelCommand(encoded);
+                        void installations
+                            .cancel(command.requestId)
+                            .catch((error) => {
+                            reportOperationFailure(socket, command.requestId, "", error);
+                        });
+                        return;
+                    }
+                    if (kind !== SESSION_PROMPT_KIND) {
+                        throw new Error("Unsupported protocol message");
+                    }
+                    const command = decodeSessionPromptCommand(encoded);
+                    if (activeTurns.has(command.commandId)) {
+                        return;
+                    }
+                    const receipt = outbox.claimExecution(command.commandId, command.sessionId, encoded);
+                    if (receipt.kind === "duplicate") {
+                        return;
+                    }
+                    const turn = new ActiveDaemonTurn(command, new AbortController());
+                    activeTurns.set(command.commandId, turn);
+                    activeAttemptIds.set(command.sessionId, receipt.attemptId);
+                    void executePrompt(outbox, socket, command, config, directories, audit, sessions, receipt.attemptId, turn.signal)
                         .catch((error) => {
-                        reportOperationFailure(socket, command.requestId, "", error);
+                        console.error("Mobius daemon turn failed", error);
+                    })
+                        .finally(() => {
+                        activeTurns.delete(command.commandId);
+                        if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
+                            activeAttemptIds.delete(command.sessionId);
+                        }
+                        connectionRefresh.afterTurnFinished();
                     });
-                    return;
                 }
-                if (kind !== SESSION_PROMPT_KIND) {
-                    throw new Error("Unsupported protocol message");
+                catch (error) {
+                    console.error("Mobius daemon rejected a message", error);
+                    socket.close(4008, "Invalid protocol message");
+                    rejectConnection();
                 }
-                const command = decodeSessionPromptCommand(encoded);
-                if (activeTurns.has(command.commandId)) {
-                    reportFailure(socket, command, "duplicate_command", "The command is already running");
-                    return;
-                }
-                const turn = new ActiveDaemonTurn(command, new AbortController());
-                activeTurns.set(command.commandId, turn);
-                void executePrompt(socket, command, config, directories, audit, sessions, turn.signal)
-                    .catch((error) => {
-                    console.error("Mobius daemon turn failed", error);
-                })
-                    .finally(() => {
-                    activeTurns.delete(command.commandId);
-                    connectionRefresh.afterTurnFinished();
-                });
-            }
-            catch (error) {
-                console.error("Mobius daemon rejected a message", error);
-                socket.close(4008, "Invalid protocol message");
-                rejectConnection();
+            };
+            socket.addEventListener("close", handleClose);
+            socket.addEventListener("error", handleError);
+            socket.addEventListener("message", handleMessage);
+            if (signal.aborted) {
+                stop();
             }
-        };
-        socket.addEventListener("close", handleClose);
-        socket.addEventListener("error", handleError);
-        socket.addEventListener("message", handleMessage);
-        if (signal.aborted) {
-            stop();
-        }
-    });
+        });
+    }
+    finally {
+        connectionController.abort();
+        await Promise.all([...nativeRequests.values()].map((request) => request.completion));
+    }
 }
 export async function runDaemon(config, audit, signal, timer = systemDaemonTimer) {
     const installationAudit = new AuditInstallationEvents(audit);
     const stateDirectory = readStateDirectory();
     const specifications = supportedLocalAgentSpecifications();
     const installationExecutor = new FixedInstallationExecutor({
-        approvedRoot: config.approvedRoot,
+        defaultWorkspace: config.defaultWorkspace,
         audit: installationAudit,
         catalog: config.catalog,
         environment: process.env,
@@ -726,26 +816,27 @@ export async function runDaemon(config, audit, signal, timer = systemDaemonTimer
         stateDirectory,
     });
     await new AutomaticAdapterProvisioner({
-        approvedRoot: config.approvedRoot,
+        defaultWorkspace: config.defaultWorkspace,
         audit: installationAudit,
         catalog: config.catalog,
         environment: process.env,
     }, new ManagedAdapterInstaller({
-        approvedRoot: config.approvedRoot,
         environment: process.env,
         stateDirectory,
     }), specifications).prepare(signal);
     const sessionStore = new SqliteAcpSessionStore(config.auditDatabasePath);
+    const outbox = new SessionEventOutbox(config.auditDatabasePath);
     const sessions = new AcpSessionManager(new NullAcpSessionObserver(), sessionStore);
-    const directories = new WorkspaceDirectoryService(config.bindingId, config.approvedRoot);
+    const directories = new WorkspaceDirectoryService(config.bindingId, config.defaultWorkspace);
     const installationObserver = new DaemonInstallationObserver();
+    const nativeSessions = new NativeSessionService(config, directories, sessions, audit);
     const installations = new AgentInstallationManager(specifications, new ConsoleInstallationAuthorizer(stateDirectory), installationExecutor, installationObserver, installationAudit);
     let retryAnnounced = false;
     try {
         while (!signal.aborted) {
             try {
                 await publishAgentCatalog(config, signal);
-                await runRelayConnection(config, directories, audit, sessions, installations, installationObserver, signal, timer);
+                await runRelayConnection(config, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, signal, timer);
                 retryAnnounced = false;
             }
             catch {
@@ -769,7 +860,12 @@ export async function runDaemon(config, audit, signal, timer = systemDaemonTimer
                 await sessions.close();
             }
             finally {
-                sessionStore.close();
+                try {
+                    sessionStore.close();
+                }
+                finally {
+                    outbox.close();
+                }
             }
         }
     }