@nextclaw/kernel 0.14.0 → 0.15.0-beta.1

package/dist/index.js

@@ -1,7 +1,7 @@
 import { AUTOMATIC_UPDATE_CHECK_INTERVAL_MS, getAutomaticUpdateCheckDelay, resolveAutomaticUpdateCheckIntervalMs } from "./utils/automatic-update-check.utils.js";
 import { n as getUnsignedUpdateManifest, r as serializeUnsignedUpdateManifest, t as UpdateManifestReader } from "./update-manifest.types-C0qPrjGQ.js";
 import { createRequire } from "node:module";
-import { APP_NAME, AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ConfigSchema, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_WORKSPACE_REPOSITORY_IDENTITY_RESOLVER, DIAGNOSTIC_CORRELATION_METADATA_KEY, DiagnosticRuntime, EditFileTool, ExecTool, ExtensionChannelAdapter, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, LocalExecutionClaimService, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MemoryStore, MessageBus, MessageTool, ProviderModelDiscoveryService, ProviderRegistry, ReadFileTool, RequestedSkillsMetadataReader, SILENT_REPLY_TOKEN, SessionProjectContextResolver, SessionSearchService, SkillsLoader, THINKING_LEVELS, ViewImageTool, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAgentProfile, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createRuntimeChildEnv, createTypingStopControlMessage, diffConfigPaths, ensureDir, estimateInputTokens, evaluateSilentReply, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, isNextclawControlMessage, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeAgentProfileId, normalizeInlineSecretRefs, normalizeModelThinkingCapability, normalizeProviderModelConfig, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, removeAgentProfile, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveEffectiveAgentProfiles, resolveNextclawSelfManageGuidePaths, resolveProviderRuntime, resolveRuntimeCommandLaunch, resolveSecretRef, resolveSessionProjectContext, resolveSessionWorkspacePath, resolveThinkingLevel, safeFilename, sanitizeOutboundAssistantContent, saveConfig, summarizeSessionRequestTask, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
+import { APP_NAME, AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ConfigSchema, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_WORKSPACE_REPOSITORY_IDENTITY_RESOLVER, DIAGNOSTIC_CORRELATION_METADATA_KEY, DiagnosticRuntime, EditFileTool, ExecTool, ExtensionChannelAdapter, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, LocalExecutionClaimService, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MemoryStore, MessageBus, MessageTool, ProviderModelDiscoveryService, ProviderRegistry, ReadFileTool, SILENT_REPLY_TOKEN, SessionProjectContextResolver, SessionSearchService, SkillsLoader, THINKING_LEVELS, ViewImageTool, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAgentProfile, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createRuntimeChildEnv, createTypingStopControlMessage, diffConfigPaths, ensureDir, estimateInputTokens, evaluateSilentReply, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, isNextclawControlMessage, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeAgentProfileId, normalizeInlineSecretRefs, normalizeModelThinkingCapability, normalizeProviderModelConfig, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, removeAgentProfile, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveEffectiveAgentProfiles, resolveNextclawSelfManageGuidePaths, resolveProviderRuntime, resolveRuntimeCommandLaunch, resolveSecretRef, resolveSessionProjectContext, resolveSessionWorkspacePath, resolveThinkingLevel, safeFilename, sanitizeOutboundAssistantContent, saveConfig, summarizeSessionRequestTask, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
 import { NCP_AI_EXECUTION_METADATA_KEY, NCP_INTERNAL_VISIBILITY_METADATA_KEY, NCP_RUN_TRIGGER_METADATA_KEY, NcpEventType, OBSERVATION_EVENT_EXTENSION_TYPE, createUnavailableNcpAiExecutionMetadata, isHiddenNcpMessage, normalizeAssistantText, parseNcpRunTriggerInput, readNcpAiExecutionMetadata, sanitizeAssistantReplyTags } from "@nextclaw/ncp";
 import { LocalAssetStore, buildAssetContentPath, buildOpenAiFunctionTool, isTextLikeAsset, ncpMessageToOpenAiMessages, validateToolArgs } from "@nextclaw/ncp-agent-runtime";
 import { CHAT_CONTINUATION_TARGET_MESSAGE_METADATA_KEY, CHAT_CONVERSATION_EXCERPT_TOKEN_KIND, CHAT_INLINE_TOKENS_METADATA_KEY, CHAT_INLINE_TOKENS_SCHEMA_VERSION, CHAT_PROJECT_TOKEN_KIND, CHAT_SESSION_MATERIALIZATION_METADATA_KEY, CHAT_SYSTEM_OBJECT_TOKEN_KIND, CHAT_UI_RESOURCE_TOKEN_KIND, CHAT_WORKSPACE_DIRECTORY_TOKEN_KIND, CHAT_WORKSPACE_EXCERPT_TOKEN_KIND, CHAT_WORKSPACE_FILE_TOKEN_KIND, Contribution as Contribution$1, EventBus, EventBus as EventBus$1, Ingress, Ingress as Ingress$1, PANEL_APP_INLINE_HOST_CONTRACT, PANEL_APP_SCROLL_RESTORATION_CONTRACT, SYSTEM_OBJECT_REFERENCE_DEFAULT_LIMIT, SYSTEM_OBJECT_REFERENCE_MAX_LIMIT, SYSTEM_OBJECT_TYPE_CRON_JOB, SYSTEM_OBJECT_TYPE_INBOX_DELIVERY, UI_CONTENT_PARAMS_HOST_CONTRACT, classifyDiagnosticError, createSystemObjectReferenceUri, createTypedKey, eventKeys, eventKeys as eventKeys$1, ingressKeys, ingressKeys as ingressKeys$1, isRuntimeDefaultModelValue, isSilentReplyNcpMessage, normalizeRuntimeModelSelectionMode, parseSystemObjectReferenceUri, readChatUiResourceReference, readInlineContentHeight, readSystemObjectResolvedReference, readUiContentParams } from "@nextclaw/shared";
@@ -10,8 +10,8 @@ import { catchError, filter, from, lastValueFrom, tap } from "rxjs";
 import { DefaultNcpAgentConversationStateManager, insertMessageByTimeline, mergeToolExecutionTiming } from "@nextclaw/ncp-toolkit";
 import { accessSync, appendFileSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import { access, appendFile, chmod, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { AppHomeService, AppInstallationService, AppInstanceInventoryService, AppInstanceStorageService, AppManifestService, AppPlatformTargetService, AppRegistryService, AppServiceLaunchService, FileLockService, isAppComponentManifestBundle } from "@nextclaw/app-runtime";
+import { access, appendFile, chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { AppGrantService, AppHomeService, AppInstallationService, AppInstanceInventoryService, AppInstanceStorageService, AppManifestService, AppPlatformTargetService, AppRegistryService, AppServiceLaunchService, FileLockService, isAppComponentManifestBundle } from "@nextclaw/app-runtime";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_PROVIDER_PLUGINS } from "@nextclaw/runtime";
@@ -1393,26 +1393,26 @@ const SESSION_ACTIVITY_PREVIEW_STATUS_KINDS = new Set([
 	"run-failed",
 	"run-interrupted"
 ]);
-function isRecord$20(value) {
+function isRecord$22(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function readOptionalString$14(value) {
+function readOptionalString$16(value) {
 	if (typeof value !== "string") return;
 	const trimmed = value.trim();
 	return trimmed.length > 0 ? trimmed : void 0;
 }
 function readSessionActivityPreviewMetadata(value) {
-	if (!isRecord$20(value)) return null;
+	if (!isRecord$22(value)) return null;
 	const state = value.state;
-	const timestamp = readOptionalString$14(value.timestamp);
+	const timestamp = readOptionalString$16(value.timestamp);
 	if (!SESSION_ACTIVITY_PREVIEW_STATES.has(state) || !timestamp) return null;
-	const statusKind = readOptionalString$14(value.statusKind);
+	const statusKind = readOptionalString$16(value.statusKind);
 	return {
 		state,
 		timestamp,
 		statusKind: SESSION_ACTIVITY_PREVIEW_STATUS_KINDS.has(statusKind) ? statusKind : void 0,
-		statusText: readOptionalString$14(value.statusText),
-		replyText: readOptionalString$14(value.replyText)
+		statusText: readOptionalString$16(value.statusText),
+		replyText: readOptionalString$16(value.replyText)
 	};
 }
 function compareIsoTimestamp(left, right) {
@@ -1496,7 +1496,7 @@ var SessionActivityPreviewEventService = class {
 //#endregion
 //#region src/managers/agent-run-session-command.manager.ts
 const CONTINUATION_PROMPT = "Continue from where you stopped. Preserve completed work and avoid repeating it.";
-function isRecord$19(value) {
+function isRecord$21(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function hasSendableMessageContent(message) {
@@ -1504,7 +1504,7 @@ function hasSendableMessageContent(message) {
 }
 function readSessionActivityState(metadata) {
 	const preview = metadata?.[SESSION_ACTIVITY_PREVIEW_METADATA_KEY];
-	return isRecord$19(preview) && typeof preview.state === "string" ? preview.state : null;
+	return isRecord$21(preview) && typeof preview.state === "string" ? preview.state : null;
 }
 var AgentRunSessionCommandManager = class {
 	pendingCommands = /* @__PURE__ */ new Map();
@@ -1879,13 +1879,13 @@ function buildRunMetadata(params) {
 }
 //#endregion
 //#region src/utils/agent-run-request.utils.ts
-function readOptionalString$13(value) {
+function readOptionalString$15(value) {
 	if (typeof value !== "string") return;
 	return value.trim() || void 0;
 }
 function toAgentRunRequest(envelope) {
 	const metadata = envelope.metadata ?? {};
-	const peerId = readOptionalString$13(envelope.peerId);
+	const peerId = readOptionalString$15(envelope.peerId);
 	const requestMetadata = {
 		agentRuntimeId: metadata.agentRuntimeId,
 		agentId: metadata.agentId,
@@ -1897,10 +1897,10 @@ function toAgentRunRequest(envelope) {
 		maxTokens: metadata.maxTokens,
 		thinkingEffort: metadata.thinkingEffort,
 		delivery: envelope.delivery,
-		idempotencyKey: readOptionalString$13(envelope.idempotencyKey)
+		idempotencyKey: readOptionalString$15(envelope.idempotencyKey)
 	};
 	if (Array.isArray(envelope.content)) {
-		const sessionId = readOptionalString$13(envelope.sessionId);
+		const sessionId = readOptionalString$15(envelope.sessionId);
 		if (sessionId && peerId) throw new Error("agent-run.send cannot accept both sessionId and peerId.");
 		return {
 			...requestMetadata,
@@ -1918,8 +1918,8 @@ function toAgentRunRequest(envelope) {
 	}
 	const sourceMessage = envelope.message;
 	if (!sourceMessage) throw new Error("Invalid agent run send request.");
-	const envelopeSessionId = readOptionalString$13(envelope.sessionId);
-	const messageSessionId = readOptionalString$13(sourceMessage.sessionId);
+	const envelopeSessionId = readOptionalString$15(envelope.sessionId);
+	const messageSessionId = readOptionalString$15(sourceMessage.sessionId);
 	const sessionId = envelopeSessionId ?? messageSessionId;
 	if (sessionId && peerId) throw new Error("agent-run.send cannot accept both sessionId and peerId.");
 	return {
@@ -1980,7 +1980,7 @@ function readSessionMaterialization(metadata) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const materialization = value;
 	if (materialization.kind !== "child") throw new Error("session_materialization.kind must be \"child\".");
-	const parentSessionId = readOptionalString$13(materialization.parentSessionId);
+	const parentSessionId = readOptionalString$15(materialization.parentSessionId);
 	if (!parentSessionId) throw new Error("session_materialization.parentSessionId is required.");
 	if (materialization.inheritContext !== true) throw new Error("session_materialization.inheritContext must be true.");
 	return {
@@ -2185,15 +2185,15 @@ var AgentRuntimeRunObserverService = class {
 };
 //#endregion
 //#region src/utils/agent-run-trigger.utils.ts
-function isRecord$18(value) {
+function isRecord$20(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function readOptionalString$12(value) {
+function readOptionalString$14(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function readSourceRunSpec(message) {
 	const value = message.metadata?.[AGENT_RUN_MESSAGE_RUN_SPEC_METADATA_KEY];
-	return isRecord$18(value) ? value : {};
+	return isRecord$20(value) ? value : {};
 }
 const SOURCE_CONTEXT_KEYS = [
 	"channel",
@@ -2222,9 +2222,9 @@ function readSourceContext(request) {
 function createAgentToolRunTriggerInput(params) {
 	const { request, source } = params;
 	const runSpec = readSourceRunSpec(request.message);
-	const sourceSessionId = readOptionalString$12(request.sessionId);
-	const sourceRunId = readOptionalString$12(runSpec.runId);
-	const sourceModel = readOptionalString$12(runSpec.model);
+	const sourceSessionId = readOptionalString$14(request.sessionId);
+	const sourceRunId = readOptionalString$14(runSpec.runId);
+	const sourceModel = readOptionalString$14(runSpec.model);
 	const sourceContext = readSourceContext(request);
 	return {
 		actor: "agent",
@@ -2240,9 +2240,9 @@ function createAgentToolRunTriggerInput(params) {
 function createIngressRunTriggerInput(params) {
 	const { request } = params;
 	const source = request.channel ? `channel:${request.channel}` : params.source.trim() || "internal";
-	const sourceSessionId = readOptionalString$12(request.sessionId);
+	const sourceSessionId = readOptionalString$14(request.sessionId);
 	const sourceContext = readSourceContext(request);
-	const cronJobId = readOptionalString$12(request.metadata?.cron_job_id);
+	const cronJobId = readOptionalString$14(request.metadata?.cron_job_id);
 	const isCron = request.metadata?.session_origin === "cron" || Boolean(cronJobId);
 	return {
 		actor: isCron ? "automation" : request.message.role === "user" ? "human" : request.message.role === "service" ? "automation" : "system",
@@ -2296,7 +2296,7 @@ function createRunTriggerMetadataEvent(params) {
 	};
 }
 function attachSourceToolCall(trigger, sourceToolCallId) {
-	const normalizedToolCallId = readOptionalString$12(sourceToolCallId);
+	const normalizedToolCallId = readOptionalString$14(sourceToolCallId);
 	return {
 		...structuredClone(trigger),
 		...normalizedToolCallId ? { sourceToolCallId: normalizedToolCallId } : {}
@@ -2698,7 +2698,7 @@ const BUILTIN_RUNTIME_PRESENTATION = {
 		}
 	}
 };
-function readString$11(value) {
+function readString$12(value) {
 	if (typeof value !== "string") return;
 	return value.trim() || void 0;
 }
@@ -2707,7 +2707,7 @@ function readRecord$3(value) {
 	return value;
 }
 function resolveBuiltinRuntimePresentation(value) {
-	const normalized = readString$11(value)?.toLowerCase();
+	const normalized = readString$12(value)?.toLowerCase();
 	if (!normalized) return null;
 	if (!(normalized in BUILTIN_RUNTIME_PRESENTATION)) return null;
 	return BUILTIN_RUNTIME_PRESENTATION[normalized] ?? null;
@@ -2728,13 +2728,13 @@ function resolveAgentRuntimeEntries(params) {
 	entries.set(DEFAULT_AGENT_RUNTIME_ENTRY_ID, buildNativeRuntimeEntry(params.config));
 	for (const [rawId, rawEntry] of Object.entries(params.config.agents.runtimes.entries ?? {})) {
 		const id = rawId.trim().toLowerCase();
-		const type = readString$11(rawEntry.type)?.toLowerCase();
+		const type = readString$12(rawEntry.type)?.toLowerCase();
 		if (!id || !type) continue;
 		const explicitIcon = normalizeAgentRuntimeSessionTypeIcon(rawEntry.icon);
 		const builtinPresentation = resolveBuiltinRuntimePresentation(id) ?? resolveBuiltinRuntimePresentation(type);
 		entries.set(id, {
 			id,
-			label: readString$11(rawEntry.label) ?? builtinPresentation?.label ?? id,
+			label: readString$12(rawEntry.label) ?? builtinPresentation?.label ?? id,
 			...explicitIcon ?? builtinPresentation?.icon ? { icon: explicitIcon ?? builtinPresentation?.icon } : {},
 			type,
 			enabled: rawEntry.enabled !== false,
@@ -3664,7 +3664,11 @@ var AppPackageReadinessManager = class {
 			isolation: manifestBundle.manifest.main.kind === "wasi-http-component" ? "host-mediated" : "sandboxed",
 			permissions: manifestBundle.manifest.permissions ?? {}
 		};
-		const [dependencies, secrets] = await Promise.all([this.params.dependencyCoordinator.inspectTarget(this.params.dependencyCoordinator.targetForInfo(info, selectedVersion), providers), this.inspectSecretsForInfo(info, true, selectedVersion)]);
+		const [dependencies, secrets, documentAccess] = await Promise.all([
+			this.params.dependencyCoordinator.inspectTarget(this.params.dependencyCoordinator.targetForInfo(info, selectedVersion), providers),
+			this.inspectSecretsForInfo(info, true, selectedVersion),
+			this.params.grantService.summarize(info.appId).then((state) => state.documentAccess)
+		]);
 		return {
 			id: info.appId,
 			name: info.name,
@@ -3701,7 +3705,8 @@ var AppPackageReadinessManager = class {
 			isolation: security.isolation,
 			readiness: this.combineReadiness(dependencies.readiness, secrets.readiness),
 			secrets,
-			dependencies
+			dependencies,
+			documentAccess
 		};
 	};
 	inspectSecrets = async (info, verify, selectedVersion = info.activeVersion) => {
@@ -3807,10 +3812,10 @@ function parseServiceAppManifest(raw, options = {}) {
 	} catch (error) {
 		throw new Error(`service-app.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	if (!isRecord$17(parsed)) throw new Error("service-app.json must contain an object.");
+	if (!isRecord$19(parsed)) throw new Error("service-app.json must contain an object.");
 	const id = readRequiredString$8(parsed, "id");
 	if (!SERVICE_APP_ID_PATTERN$1.test(id)) throw new Error("service app id must be kebab-case.");
-	const protocol = readOptionalString$11(parsed, "protocol") ?? "mcp";
+	const protocol = readOptionalString$13(parsed, "protocol") ?? "mcp";
 	if (protocol !== "mcp" && protocol !== "wasi-component") throw new Error("service app protocol must be mcp or wasi-component.");
 	const launch = protocol === "mcp" ? new AppServiceLaunchService(options.platformTargetService).resolve(parsed, options.target) : void 0;
 	const componentEntry = protocol === "wasi-component" ? readPortableComponentEntry(parsed) : void 0;
@@ -3821,7 +3826,7 @@ function parseServiceAppManifest(raw, options = {}) {
 	return {
 		id,
 		title: readRequiredString$8(parsed, "title"),
-		description: readOptionalString$11(parsed, "description"),
+		description: readOptionalString$13(parsed, "description"),
 		enabled: readOptionalBoolean$2(parsed, "enabled") ?? true,
 		protocol,
 		command: launch?.command,
@@ -3836,14 +3841,14 @@ function parseServiceAppManifest(raw, options = {}) {
 }
 function readServiceAppProvides(value) {
 	if (value === void 0) return void 0;
-	if (!isRecord$17(value)) throw new Error("service app provides must be an object.");
+	if (!isRecord$19(value)) throw new Error("service app provides must be an object.");
 	if (value.capabilities === void 0) return void 0;
 	if (!Array.isArray(value.capabilities)) throw new Error("service app provides.capabilities must be an array.");
 	const seen = /* @__PURE__ */ new Set();
 	const capabilities = value.capabilities.map((entry, index) => {
-		if (!isRecord$17(entry)) throw new Error(`service app provides.capabilities[${index}] must be an object.`);
+		if (!isRecord$19(entry)) throw new Error(`service app provides.capabilities[${index}] must be an object.`);
 		const id = readRequirementIdentifier(entry, "id", `provides.capabilities[${index}].id`);
-		const version = readOptionalString$11(entry, "version");
+		const version = readOptionalString$13(entry, "version");
 		if (!version) throw new Error(`service app provides.capabilities[${index}].version is required.`);
 		const key = `${id}@${version}`;
 		if (seen.has(key)) throw new Error(`service app provides.capabilities contains duplicate ${key}.`);
@@ -3869,7 +3874,7 @@ function readCapabilityResourceTypes(value, index) {
 }
 function readServiceAppRequirements(value, protocol) {
 	if (value === void 0) return void 0;
-	if (!isRecord$17(value)) throw new Error("service app requires must be an object.");
+	if (!isRecord$19(value)) throw new Error("service app requires must be an object.");
 	const capabilities = readCapabilityRequirements(value.capabilities, protocol);
 	const resources = readResourceRequirements(value.resources);
 	const modelSlots = readModelCapabilitySlots(value.modelSlots);
@@ -3893,7 +3898,7 @@ function readCapabilitySlots(value, name, hasModelLimits) {
 	const seen = /* @__PURE__ */ new Set();
 	return value.map((entry, index) => {
 		const field = `requires.${name}[${index}]`;
-		if (!isRecord$17(entry)) throw new Error(`service app ${field} must be an object.`);
+		if (!isRecord$19(entry)) throw new Error(`service app ${field} must be an object.`);
 		const allowed = hasModelLimits ? [
 			"id",
 			"title",
@@ -3935,9 +3940,9 @@ function readCapabilityRequirements(value, protocol) {
 	if (!Array.isArray(value)) throw new Error("service app requires.capabilities must be an array.");
 	const seen = /* @__PURE__ */ new Set();
 	return value.map((entry, index) => {
-		if (!isRecord$17(entry)) throw new Error(`service app requires.capabilities[${index}] must be an object.`);
+		if (!isRecord$19(entry)) throw new Error(`service app requires.capabilities[${index}] must be an object.`);
 		const id = readRequirementIdentifier(entry, "id", `requires.capabilities[${index}].id`);
-		const version = readOptionalString$11(entry, "version");
+		const version = readOptionalString$13(entry, "version");
 		const key = `${id}@${version ?? "*"}`;
 		if (seen.has(key)) throw new Error(`service app requires.capabilities contains duplicate ${key}.`);
 		seen.add(key);
@@ -3950,19 +3955,19 @@ function readCapabilityRequirements(value, protocol) {
 			version,
 			provider,
 			wit,
-			title: readOptionalString$11(entry, "title"),
-			description: readOptionalString$11(entry, "description"),
+			title: readOptionalString$13(entry, "title"),
+			description: readOptionalString$13(entry, "description"),
 			remediation: readExternalRemediation(entry.remediation, `requires.capabilities[${index}]`)
 		};
 	});
 }
 function readWitContract(value, fieldName, role) {
 	if (value === void 0) return void 0;
-	if (!isRecord$17(value)) throw new Error(`service app ${fieldName} must be an object.`);
-	const packageName = readOptionalString$11(value, "package");
+	if (!isRecord$19(value)) throw new Error(`service app ${fieldName} must be an object.`);
+	const packageName = readOptionalString$13(value, "package");
 	if (!packageName || !WIT_PACKAGE_PATTERN.test(packageName)) throw new Error(`service app ${fieldName}.package must be a WIT package identifier.`);
 	const interfaceName = readRequirementIdentifier(value, "interface", `${fieldName}.interface`);
-	const version = readOptionalString$11(value, "version");
+	const version = readOptionalString$13(value, "version");
 	if (!version) throw new Error(`service app ${fieldName}.version is required.`);
 	if (role === "provider" && !SEMVER_VERSION_PATTERN.test(version)) throw new Error(`service app ${fieldName}.version must be an exact semver version for a Provider.`);
 	if (role === "consumer" && !isSemverRange(version)) throw new Error(`service app ${fieldName}.version must be a semver range for a Consumer.`);
@@ -3985,7 +3990,7 @@ function readResourceRequirements(value) {
 	if (!Array.isArray(value)) throw new Error("service app requires.resources must be an array.");
 	const seen = /* @__PURE__ */ new Set();
 	return value.map((entry, index) => {
-		if (!isRecord$17(entry)) throw new Error(`service app requires.resources[${index}] must be an object.`);
+		if (!isRecord$19(entry)) throw new Error(`service app requires.resources[${index}] must be an object.`);
 		const binding = readRequirementIdentifier(entry, "binding", `requires.resources[${index}].binding`);
 		if (seen.has(binding)) throw new Error(`service app requires.resources contains duplicate binding ${binding}.`);
 		seen.add(binding);
@@ -3993,21 +3998,21 @@ function readResourceRequirements(value) {
 			binding,
 			type: readRequirementIdentifier(entry, "type", `requires.resources[${index}].type`),
 			required: readOptionalBoolean$2(entry, "required") ?? true,
-			title: readOptionalString$11(entry, "title"),
-			description: readOptionalString$11(entry, "description"),
+			title: readOptionalString$13(entry, "title"),
+			description: readOptionalString$13(entry, "description"),
 			remediation: readExternalRemediation(entry.remediation, `requires.resources[${index}]`)
 		};
 	});
 }
 function readRequirementIdentifier(record, key, fieldName) {
-	const value = readOptionalString$11(record, key);
+	const value = readOptionalString$13(record, key);
 	if (!value || !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(value)) throw new Error(`service app ${fieldName} must be a lowercase identifier.`);
 	return value;
 }
 function readExternalRemediation(value, fieldPrefix) {
 	if (value === void 0) return void 0;
-	if (!isRecord$17(value) || value.kind !== "agent-setup") throw new Error(`service app ${fieldPrefix}.remediation.kind must be agent-setup.`);
-	const summary = readOptionalString$11(value, "summary");
+	if (!isRecord$19(value) || value.kind !== "agent-setup") throw new Error(`service app ${fieldPrefix}.remediation.kind must be agent-setup.`);
+	const summary = readOptionalString$13(value, "summary");
 	if (!summary) throw new Error(`service app ${fieldPrefix}.remediation.summary is required.`);
 	return {
 		kind: "agent-setup",
@@ -4017,8 +4022,8 @@ function readExternalRemediation(value, fieldPrefix) {
 }
 function readServiceAppLifecycle(value) {
 	if (value === void 0) return { mode: "action" };
-	if (!isRecord$17(value)) throw new Error("service app lifecycle must be an object.");
-	const mode = readOptionalString$11(value, "mode") ?? "action";
+	if (!isRecord$19(value)) throw new Error("service app lifecycle must be an object.");
+	const mode = readOptionalString$13(value, "mode") ?? "action";
 	if (mode === "action") return { mode };
 	if (mode === "provider") return { mode };
 	if (mode !== "resident") throw new Error("service app lifecycle.mode must be action, resident or provider.");
@@ -4039,13 +4044,13 @@ function readProviderIds(value) {
 	return Array.from(new Set(providerIds));
 }
 function readServiceAppId(record, key, fieldName) {
-	const value = readOptionalString$11(record, key);
+	const value = readOptionalString$13(record, key);
 	if (!value || !SERVICE_APP_ID_PATTERN$1.test(value)) throw new Error(`service app ${fieldName} must be a kebab-case service app id.`);
 	return value;
 }
 function readPortableComponentEntry(record) {
 	const component = record.component;
-	if (!isRecord$17(component)) throw new Error("service app component is required for wasi-component.");
+	if (!isRecord$19(component)) throw new Error("service app component is required for wasi-component.");
 	const entry = readRequiredString$8(component, "entry").replace(/\\/g, "/");
 	if (path.isAbsolute(entry) || entry.includes("\0") || entry.split("/").includes("..")) throw new Error("service app component.entry must be a package-relative path.");
 	if (!entry.endsWith(".wasm")) throw new Error("service app component.entry must reference a .wasm file.");
@@ -4053,22 +4058,22 @@ function readPortableComponentEntry(record) {
 }
 function readManifestActions(value) {
 	if (value === void 0) throw new Error("service app actions are required.");
-	if (!isRecord$17(value)) throw new Error("service app actions must be an object.");
+	if (!isRecord$19(value)) throw new Error("service app actions must be an object.");
 	if (Object.keys(value).length === 0) throw new Error("service app actions cannot be empty.");
 	const actions = {};
 	for (const [name, action] of Object.entries(value)) {
 		if (!name.trim()) throw new Error("service app action name cannot be empty.");
-		if (!isRecord$17(action)) throw new Error(`service app action ${name} must be an object.`);
-		const risk = readOptionalString$11(action, "risk");
+		if (!isRecord$19(action)) throw new Error(`service app action ${name} must be an object.`);
+		const risk = readOptionalString$13(action, "risk");
 		if (risk !== void 0 && !SERVICE_ACTION_RISKS.has(risk)) throw new Error(`service app action ${name} has invalid risk.`);
 		const inputSchema = action.inputSchema;
-		if (inputSchema !== void 0 && !isRecord$17(inputSchema)) throw new Error(`service app action ${name} inputSchema must be an object.`);
+		if (inputSchema !== void 0 && !isRecord$19(inputSchema)) throw new Error(`service app action ${name} inputSchema must be an object.`);
 		const timeoutMs = readOptionalNumber$1(action, "timeoutMs");
 		if (timeoutMs !== void 0 && (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 3e5)) throw new Error(`service app action ${name} timeoutMs must be an integer between 100 and 300000.`);
 		actions[name] = {
 			risk,
-			title: readOptionalString$11(action, "title"),
-			description: readOptionalString$11(action, "description"),
+			title: readOptionalString$13(action, "title"),
+			description: readOptionalString$13(action, "description"),
 			inputSchema,
 			timeoutMs
 		};
@@ -4076,7 +4081,7 @@ function readManifestActions(value) {
 	return actions;
 }
 function readRequiredString$8(record, key) {
-	const value = readOptionalString$11(record, key);
+	const value = readOptionalString$13(record, key);
 	if (!value) throw new Error(`service app ${key} is required.`);
 	return value;
 }
@@ -4084,7 +4089,7 @@ function readRequiredBoolean(record, key) {
 	if (typeof record[key] !== "boolean") throw new Error(`service app ${key} is required and must be a boolean.`);
 	return record[key];
 }
-function readOptionalString$11(record, key) {
+function readOptionalString$13(record, key) {
 	return typeof record[key] === "string" && record[key].trim() ? record[key].trim() : void 0;
 }
 function readOptionalBoolean$2(record, key) {
@@ -4097,7 +4102,7 @@ function readOptionalNumber$1(record, key) {
 	if (typeof record[key] !== "number") throw new Error(`service app ${key} must be number.`);
 	return record[key];
 }
-function isRecord$17(value) {
+function isRecord$19(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
@@ -4537,6 +4542,73 @@ var AppPackageDependencyCoordinator = class {
 	};
 };
 //#endregion
+//#region src/services/app-package-document-access.service.ts
+var AppPackageDocumentAccessService = class {
+	constructor(params) {
+		this.params = params;
+	}
+	inspect = async (appId) => await this.params.installationService.withAppOperation(appId, async () => {
+		try {
+			return await this.params.grantService.summarize(appId);
+		} catch (error) {
+			throw this.toError(error);
+		}
+	});
+	assert = async (appId, scopeId, requestedMode) => {
+		const scope = (await this.inspect(appId)).documentAccess.find((entry) => entry.id === scopeId);
+		if (!scope) throw new AppPackageError("DOCUMENT_SCOPE_NOT_DECLARED", `App ${appId} does not declare document scope ${scopeId}.`);
+		if (!scope.granted) throw new AppPackageError("DOCUMENT_SCOPE_NOT_GRANTED", `App ${appId} requires document scope ${scopeId}. Grant it and retry the action.`);
+		if (scope.status === "unavailable") throw new AppPackageError("DOCUMENT_SCOPE_UNAVAILABLE", `App ${appId} document scope ${scopeId} is unavailable. Replace or revoke it.`);
+		if (requestedMode === "read-write" && scope.effectiveMode !== "read-write") throw new AppPackageError("DOCUMENT_SCOPE_MODE_INSUFFICIENT", `App ${appId} document scope ${scopeId} needs read-write access.`);
+	};
+	grant = async (appId, input) => await this.mutate(appId, input.scopeId, async () => await this.params.grantService.grantDocumentScope({
+		appId,
+		...input
+	}));
+	revoke = async (appId, scopeId) => await this.mutate(appId, scopeId, async () => {
+		if (!(await this.params.grantService.summarize(appId)).documentAccess.some((scope) => scope.id === scopeId)) throw new AppPackageError("DOCUMENT_SCOPE_NOT_DECLARED", `App ${appId} does not declare document scope ${scopeId}.`);
+		return await this.params.grantService.revokeDocumentScope({
+			appId,
+			scopeId
+		});
+	});
+	mutate = async (appId, scopeId, mutation) => await this.params.installationService.withAppOperation(appId, async () => {
+		const app = await this.params.getPackage(appId);
+		const previousGrant = (await this.params.registryService.getApp(appId))?.grants[scopeId];
+		const sources = this.toComponentSources(app);
+		const runtimeHooks = this.params.getRuntimeHooks();
+		const rollbackRuntime = app.enabled ? await runtimeHooks.prepareCapabilityChange(sources) : async () => void 0;
+		try {
+			const result = await mutation();
+			if (app.enabled) await runtimeHooks.afterCapabilityChange(sources);
+			return result;
+		} catch (error) {
+			const recoveryErrors = [];
+			try {
+				await this.params.registryService.restoreDocumentGrant(appId, scopeId, previousGrant);
+			} catch (recoveryError) {
+				recoveryErrors.push(recoveryError);
+			}
+			try {
+				await rollbackRuntime();
+			} catch (recoveryError) {
+				recoveryErrors.push(recoveryError);
+			}
+			if (recoveryErrors.length > 0) throw new AggregateError([error, ...recoveryErrors], `App ${appId} document scope ${scopeId} mutation failed and recovery was incomplete.`);
+			throw this.toError(error);
+		}
+	});
+	toComponentSources = (app) => app.components.map((component) => ({ ...component }));
+	toError = (error) => {
+		if (error instanceof AppPackageError) return error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (message.includes("未声明 documentAccess scope")) return new AppPackageError("DOCUMENT_SCOPE_NOT_DECLARED", message);
+		if (message.includes("只声明了 read")) return new AppPackageError("DOCUMENT_SCOPE_MODE_INSUFFICIENT", message);
+		if (message.includes("不是可用目录")) return new AppPackageError("DOCUMENT_SCOPE_UNAVAILABLE", message);
+		return new AppPackageError("DOCUMENT_SCOPE_MUTATION_FAILED", message);
+	};
+};
+//#endregion
 //#region src/services/app-package-host-target.service.ts
 var AppPackageHostTargetService = class {
 	platformTargetService = new AppPlatformTargetService();
@@ -4607,6 +4679,8 @@ const EMPTY_APP_PACKAGE_RUNTIME_HOOKS = {
 	assertCanActivate: async () => void 0,
 	afterActivate: async () => void 0,
 	beforeDeactivate: async () => void 0,
+	prepareCapabilityChange: async () => async () => void 0,
+	afterCapabilityChange: async () => void 0,
 	beforeUninstall: async () => void 0
 };
 var AppPackageRuntimeActivationService = class {
@@ -4637,6 +4711,8 @@ var AppPackageManager = class {
 	dependencyCoordinator;
 	runtimeActivationService = new AppPackageRuntimeActivationService();
 	registryService;
+	grantService;
+	documentAccessService;
 	readinessManager;
 	runtimeHooks = EMPTY_APP_PACKAGE_RUNTIME_HOOKS;
 	builtInBootstrapPromise;
@@ -4646,6 +4722,14 @@ var AppPackageManager = class {
 		this.appHomeService = new AppHomeService(params.appHomeDirectory);
 		this.installationService = new AppInstallationService(this.appHomeService);
 		this.registryService = new AppRegistryService(this.appHomeService);
+		this.grantService = new AppGrantService(this.registryService, this.manifestService);
+		this.documentAccessService = new AppPackageDocumentAccessService({
+			grantService: this.grantService,
+			installationService: this.installationService,
+			registryService: this.registryService,
+			getPackage: this.getPackage,
+			getRuntimeHooks: () => this.runtimeHooks
+		});
 		this.dependencyCoordinator = new AppPackageDependencyCoordinator({
 			installationService: this.installationService,
 			registryService: this.registryService,
@@ -4658,6 +4742,7 @@ var AppPackageManager = class {
 			presentationService: this.presentationService,
 			dependencyCoordinator: this.dependencyCoordinator,
 			registryService: this.registryService,
+			grantService: this.grantService,
 			productVersion: params.productVersion,
 			getSecretConfig: params.getSecretConfig,
 			secretConfigPath: params.secretConfigPath,
@@ -4718,6 +4803,12 @@ var AppPackageManager = class {
 		await this.registryService.unbindSecret(appId, slotId);
 		return await this.inspectSecrets(appId);
 	});
+	inspectDocumentAccess = async (appId) => await this.documentAccessService.inspect(appId);
+	assertDocumentAccess = async (appId, scopeId, requestedMode) => {
+		await this.documentAccessService.assert(appId, scopeId, requestedMode);
+	};
+	grantDocumentAccess = async (appId, input) => await this.documentAccessService.grant(appId, input);
+	revokeDocumentAccess = async (appId, scopeId) => await this.documentAccessService.revoke(appId, scopeId);
 	listActiveComponentSources = async () => (await this.listActiveComponentSourcesWithDiagnostics()).sources;
 	listActiveComponentSourcesWithDiagnostics = async () => await this.dependencyCoordinator.listActiveComponentSourcesWithDiagnostics();
 	listOperations = async () => await this.operationManager.list();
@@ -5856,14 +5947,14 @@ var ExtensionLifecycleService = class {
 };
 //#endregion
 //#region src/features/extension-runtime/utils/extension-runtime-payload.utils.ts
-function readString$10(value) {
+function readString$11(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function readRecord$2(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function readRequiredString$7(value, name) {
-	const trimmed = readString$10(value);
+	const trimmed = readString$11(value);
 	if (!trimmed) throw new Error(`${name} is required`);
 	return trimmed;
 }
@@ -5878,16 +5969,16 @@ function readTextContent(value) {
 function readInboundAttachments(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))).map((entry) => ({
-		...readString$10(entry.id) ? { id: readString$10(entry.id) } : {},
-		...readString$10(entry.name) ? { name: readString$10(entry.name) } : {},
-		...readString$10(entry.path) ? { path: readString$10(entry.path) } : {},
-		...readString$10(entry.url) ? { url: readString$10(entry.url) } : {},
-		...readString$10(entry.assetUri) ? { assetUri: readString$10(entry.assetUri) } : {},
-		...readString$10(entry.mimeType) ? { mimeType: readString$10(entry.mimeType) } : {},
+		...readString$11(entry.id) ? { id: readString$11(entry.id) } : {},
+		...readString$11(entry.name) ? { name: readString$11(entry.name) } : {},
+		...readString$11(entry.path) ? { path: readString$11(entry.path) } : {},
+		...readString$11(entry.url) ? { url: readString$11(entry.url) } : {},
+		...readString$11(entry.assetUri) ? { assetUri: readString$11(entry.assetUri) } : {},
+		...readString$11(entry.mimeType) ? { mimeType: readString$11(entry.mimeType) } : {},
 		...readOptionalNumber(entry.size) !== void 0 ? { size: readOptionalNumber(entry.size) } : {},
-		...readString$10(entry.source) ? { source: readString$10(entry.source) } : {},
+		...readString$11(entry.source) ? { source: readString$11(entry.source) } : {},
 		...entry.status === "ready" || entry.status === "remote-only" ? { status: entry.status } : {},
-		...readString$10(entry.errorCode) ? { errorCode: readString$10(entry.errorCode) } : {}
+		...readString$11(entry.errorCode) ? { errorCode: readString$11(entry.errorCode) } : {}
 	}));
 }
 function toInboundMessage(value) {
@@ -5919,7 +6010,7 @@ function normalizeAuthPollResult(value) {
 	return {
 		channel: readRequiredString$7(record.channel, "channel"),
 		status: record.status,
-		message: readString$10(record.message),
+		message: readString$11(record.message),
 		nextPollMs: readOptionalNumber(record.nextPollMs),
 		accountId: typeof record.accountId === "string" ? record.accountId : null,
 		notes: Array.isArray(record.notes) ? record.notes.filter((note) => typeof note === "string") : [],
@@ -5953,10 +6044,10 @@ var ExtensionIngressDiagnosticsService = class {
 			event: readRequiredString$7(payload.event, "event"),
 			component: readRequiredString$7(payload.component, "component"),
 			outcome: readRequiredString$7(payload.outcome, "outcome"),
-			correlationId: readString$10(payload.correlationId),
-			parentCorrelationId: readString$10(payload.parentCorrelationId),
-			reasonCode: readString$10(payload.reasonCode),
-			providerCode: readString$10(payload.providerCode),
+			correlationId: readString$11(payload.correlationId),
+			parentCorrelationId: readString$11(payload.parentCorrelationId),
+			reasonCode: readString$11(payload.reasonCode),
+			providerCode: readString$11(payload.providerCode),
 			durationMs: readOptionalNumber(payload.durationMs),
 			attempt: readOptionalNumber(payload.attempt),
 			facts: {
@@ -6100,12 +6191,12 @@ var ExtensionAuthLeaseService = class {
 		if (kind === "channel.auth.poll") {
 			const sessionId = readRequiredString$7(payload.sessionId, "sessionId");
 			const result = value ? readRecord$2(value) : null;
-			const status = result ? readString$10(result.status) : null;
+			const status = result ? readString$11(result.status) : null;
 			if (status === "authorized") await this.retainHandoff(extensionId, channelId, generation);
 			if (!result || status === "authorized" || status === "expired" || status === "error") this.releaseSession(extensionId, sessionId);
 			return;
 		}
-		if (kind === "channel.auth.connect" && readString$10(readRecord$2(value).status) === "authorized") {
+		if (kind === "channel.auth.connect" && readString$11(readRecord$2(value).status) === "authorized") {
 			await this.retainHandoff(extensionId, channelId, generation);
 			return;
 		}
@@ -6224,7 +6315,7 @@ const BUILTIN_EXTENSION_PACKAGES = [
 	"@nextclaw/channel-extension-weixin"
 ];
 const runtimeRequire = createRequire(import.meta.url);
-function readString$9(value) {
+function readString$10(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function readStringArray$1(value) {
@@ -6273,16 +6364,16 @@ function toManifest(value, rootDir) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("extension manifest must be an object");
 	const record = value;
 	const server = readRecord$1(record.server);
-	const id = readString$9(record.id);
-	const command = readString$9(server.command);
+	const id = readString$10(record.id);
+	const command = readString$10(server.command);
 	if (!id) throw new Error("extension manifest id is required");
 	if (server.type !== "stdio") throw new Error("extension server.type must be stdio");
 	if (!command) throw new Error("extension server.command is required");
 	return {
 		id,
 		rootDir,
-		...readString$9(record.name) ? { name: readString$9(record.name) } : {},
-		...readString$9(record.version) ? { version: readString$9(record.version) } : {},
+		...readString$10(record.name) ? { name: readString$10(record.name) } : {},
+		...readString$10(record.version) ? { version: readString$10(record.version) } : {},
 		server: {
 			type: "stdio",
 			command,
@@ -6478,13 +6569,13 @@ var ExtensionObservationRuntimeService = class {
 				eventId,
 				eventType,
 				occurredAt,
-				observedAt: readString$10(event.observedAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
-				...readString$10(event.cursor) ? { cursor: readString$10(event.cursor) } : {},
-				...readString$10(event.dedupeKey) ? { dedupeKey: readString$10(event.dedupeKey) } : {},
+				observedAt: readString$11(event.observedAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
+				...readString$11(event.cursor) ? { cursor: readString$11(event.cursor) } : {},
+				...readString$11(event.dedupeKey) ? { dedupeKey: readString$11(event.dedupeKey) } : {},
 				payload: event.payload,
 				...Array.isArray(event.sourceRefs) && event.sourceRefs.every((value) => typeof value === "string") ? { sourceRefs: event.sourceRefs } : {},
-				...readString$10(event.causationId) ? { causationId: readString$10(event.causationId) } : {},
-				...readString$10(event.correlationId) ? { correlationId: readString$10(event.correlationId) } : {}
+				...readString$11(event.causationId) ? { causationId: readString$11(event.causationId) } : {},
+				...readString$11(event.correlationId) ? { correlationId: readString$11(event.correlationId) } : {}
 			}
 		}) ?? { accepted: false };
 	};
@@ -6569,13 +6660,13 @@ function stableStringify(value) {
 }
 function sortValue(value) {
 	if (Array.isArray(value)) return value.map(sortValue);
-	if (!isRecord$16(value)) return value;
+	if (!isRecord$18(value)) return value;
 	return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sortValue(value[key])]));
 }
 function normalizeJsonValue(value) {
 	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return value;
 	if (Array.isArray(value)) return value.map(normalizeJsonValue);
-	if (isRecord$16(value)) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizeJsonValue(item)]));
+	if (isRecord$18(value)) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizeJsonValue(item)]));
 	throw new Error("Capability grant target must be JSON-compatible.");
 }
 function requireString$1(value, field) {
@@ -6583,13 +6674,16 @@ function requireString$1(value, field) {
 	if (!normalized) throw new Error(`Capability grant ${field} is required.`);
 	return normalized;
 }
-function isRecord$16(value) {
+function isRecord$18(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
 //#region src/utils/service-app-error.utils.ts
 const SERVICE_APP_ERROR_CODES = new Set([
 	"AUTHORIZATION_REQUIRED",
+	"DOCUMENT_SCOPE_NOT_GRANTED",
+	"DOCUMENT_SCOPE_MODE_INSUFFICIENT",
+	"DOCUMENT_SCOPE_UNAVAILABLE",
 	"SERVICE_APP_ACTION_NOT_DECLARED",
 	"SERVICE_APP_ACTION_NOT_FOUND",
 	"SERVICE_APP_INVALID_ACTION",
@@ -7063,10 +7157,10 @@ function toGrantRecord(grants) {
 	}));
 }
 function normalizeStoreData(value) {
-	if (!isRecord$15(value) || value.version !== 1 || !isRecord$15(value.grants)) throw new Error("Capability grant store is invalid.");
+	if (!isRecord$17(value) || value.version !== 1 || !isRecord$17(value.grants)) throw new Error("Capability grant store is invalid.");
 	const grants = [];
 	for (const grant of Object.values(value.grants)) {
-		if (!isRecord$15(grant) || !isRecord$15(grant.subject) || !isRecord$15(grant.resource) || !Array.isArray(grant.access) || !grant.access.every((item) => typeof item === "string") || typeof grant.declarationFingerprint !== "string" || typeof grant.grantedAt !== "string") throw new Error("Capability grant store contains an invalid grant.");
+		if (!isRecord$17(grant) || !isRecord$17(grant.subject) || !isRecord$17(grant.resource) || !Array.isArray(grant.access) || !grant.access.every((item) => typeof item === "string") || typeof grant.declarationFingerprint !== "string" || typeof grant.grantedAt !== "string") throw new Error("Capability grant store contains an invalid grant.");
 		const request = normalizeCapabilityGrantRequest({
 			subject: {
 				type: String(grant.subject.type ?? ""),
@@ -7090,11 +7184,11 @@ function normalizeStoreData(value) {
 		grants: toGrantRecord(grants)
 	};
 }
-function isRecord$15(value) {
+function isRecord$17(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isMissingFileError$1(error) {
-	return isRecord$15(error) && error.code === "ENOENT";
+	return isRecord$17(error) && error.code === "ENOENT";
 }
 //#endregion
 //#region src/features/capability-grants/managers/capability-grant.manager.ts
@@ -7598,10 +7692,10 @@ var DesktopNodeReplService = class {
 	}
 	async handleWorkerMessage(key, worker, value) {
 		const message = asRecord$1(value);
-		const executionId = readString$8(message.executionId);
+		const executionId = readString$9(message.executionId);
 		if (!executionId || !worker.pending.has(executionId)) return;
 		if (message.type === "desktop.request") {
-			const requestId = readString$8(message.requestId);
+			const requestId = readString$9(message.requestId);
 			if (!requestId) return;
 			try {
 				const result = await this.invokeDesktop(worker.pending.get(executionId).caller, message.operation, message.args);
@@ -7632,7 +7726,7 @@ var DesktopNodeReplService = class {
 		}
 		if (message.type === "error") {
 			const error = asRecord$1(message.error);
-			this.reject(worker, executionId, replError(readString$8(error.code) ?? "repl_execution_failed", readString$8(error.message) ?? "node_repl execution failed."));
+			this.reject(worker, executionId, replError(readString$9(error.code) ?? "repl_execution_failed", readString$9(error.message) ?? "node_repl execution failed."));
 			return;
 		}
 		this.stopWorker(key, worker);
@@ -7650,23 +7744,23 @@ var DesktopNodeReplService = class {
 			});
 			case "setValue": return await this.sessionState.setValue(caller, {
 				target,
-				stateId: requiredString$1(args.stateId, "stateId"),
+				stateId: requiredString$2(args.stateId, "stateId"),
 				elementIndex: readElementIndex(args.element),
 				value: requiredValue$1(args.value ?? args.text, "value")
 			});
 			case "click": return await this.sessionState.click(caller, {
 				target,
-				stateId: requiredString$1(args.stateId, "stateId"),
+				stateId: requiredString$2(args.stateId, "stateId"),
 				...args.coordinate === void 0 ? { elementIndex: readElementIndex(args.element) } : { coordinate: readCoordinate(args.coordinate) }
 			});
 			case "typeText": return await this.sessionState.typeText(caller, {
 				target,
-				stateId: requiredString$1(args.stateId, "stateId"),
+				stateId: requiredString$2(args.stateId, "stateId"),
 				text: requiredText(args.text, "text")
 			});
 			case "pressKey": return await this.sessionState.pressKey(caller, {
 				target,
-				stateId: requiredString$1(args.stateId, "stateId"),
+				stateId: requiredString$2(args.stateId, "stateId"),
 				key: readKeyboardKey(args.key),
 				...args.modifiers === void 0 ? {} : { modifiers: readKeyboardModifiers(args.modifiers) }
 			});
@@ -7713,7 +7807,7 @@ function pickCaller(input) {
 	};
 }
 function readTarget(value) {
-	return { applicationId: requiredString$1(asRecord$1(value).applicationId, "target.applicationId") };
+	return { applicationId: requiredString$2(asRecord$1(value).applicationId, "target.applicationId") };
 }
 function readElementIndex(value) {
 	const index = asRecord$1(value).index;
@@ -7737,7 +7831,7 @@ function isFiniteNumber$1(value) {
 function asRecord$1(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function requiredString$1(value, field) {
+function requiredString$2(value, field) {
 	if (typeof value !== "string" || !value.trim()) throw replError("invalid_tool_arguments", `${field} must be a non-empty string.`);
 	return value.trim();
 }
@@ -7769,7 +7863,7 @@ const SUPPORTED_KEY_MODIFIERS = new Set([
 	"shift"
 ]);
 function readKeyboardKey(value) {
-	const key = requiredString$1(value, "key");
+	const key = requiredString$2(value, "key");
 	if (!SUPPORTED_KEYS.has(key)) throw replError("invalid_tool_arguments", "key must be a supported named key or a lowercase letter/digit.");
 	return key;
 }
@@ -7778,7 +7872,7 @@ function readKeyboardModifiers(value) {
 	if (new Set(value).size !== value.length) throw replError("invalid_tool_arguments", "modifiers cannot contain duplicates.");
 	return value;
 }
-function readString$8(value) {
+function readString$9(value) {
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
 function trimOutput(value) {
@@ -8249,9 +8343,9 @@ var ExtensionDesktopRuntimeService = class {
 			method: readRequiredString$7(payload.method, "method"),
 			payload: readRecord$2(payload.payload),
 			caller: {
-				...readString$10(caller.sessionId) ? { sessionId: readString$10(caller.sessionId) } : {},
-				...readString$10(caller.agentRunId) ? { agentRunId: readString$10(caller.agentRunId) } : {},
-				...readString$10(caller.subscriptionId) ? { subscriptionId: readString$10(caller.subscriptionId) } : {}
+				...readString$11(caller.sessionId) ? { sessionId: readString$11(caller.sessionId) } : {},
+				...readString$11(caller.agentRunId) ? { agentRunId: readString$11(caller.agentRunId) } : {},
+				...readString$11(caller.subscriptionId) ? { subscriptionId: readString$11(caller.subscriptionId) } : {}
 			}
 		});
 	};
@@ -8392,7 +8486,7 @@ var ExtensionRuntimeService = class {
 		const desired = /* @__PURE__ */ new Map();
 		const channelConfig = readRecord$2(config.channels);
 		for (const manifest of this.manifests) for (const channel of manifest.contributes?.channels ?? []) {
-			const channelId = readString$10(channel.id);
+			const channelId = readString$11(channel.id);
 			if (!channelId || readRecord$2(channelConfig[channelId]).enabled !== true) continue;
 			desired.set(this.persistentLeaseKey(manifest.id, channelId), {
 				manifest,
@@ -8469,15 +8563,15 @@ var ExtensionRuntimeService = class {
 				channel,
 				chatId,
 				senderId,
-				content: readString$10(payload.rawText) ?? readString$10(payload.commandName) ?? "",
+				content: readString$11(payload.rawText) ?? readString$11(payload.commandName) ?? "",
 				timestamp: /* @__PURE__ */ new Date(),
 				attachments: [],
 				metadata
 			},
-			forcedAgentId: readString$10(metadata.target_agent_id),
-			sessionKeyOverride: readString$10(metadata.session_key_override)
+			forcedAgentId: readString$11(metadata.target_agent_id),
+			sessionKeyOverride: readString$11(metadata.session_key_override)
 		});
-		const rawText = readString$10(payload.rawText);
+		const rawText = readString$11(payload.rawText);
 		if (rawText) return await registry.executeText(rawText, {
 			channel,
 			chatId,
@@ -8510,7 +8604,7 @@ var ExtensionRuntimeService = class {
 		this.pendingRequests.delete(requestId);
 		pending.cleanup();
 		if (payload.ok === false) {
-			const message = readString$10(readRecord$2(payload.error).message) ?? "Extension request failed";
+			const message = readString$11(readRecord$2(payload.error).message) ?? "Extension request failed";
 			pending.reject(new Error(message));
 			return { accepted: true };
 		}
@@ -8621,9 +8715,9 @@ var ExtensionRuntimeService = class {
 	};
 	assertAuthorized = (envelope, context) => {
 		const credential = this.lifecycle.authenticateCredential({
-			extensionId: readString$10(envelope.extensionId) ?? null,
-			generation: readString$10(envelope.generation) ?? null,
-			token: readString$10(context.token) ?? null
+			extensionId: readString$11(envelope.extensionId) ?? null,
+			generation: readString$11(envelope.generation) ?? null,
+			token: readString$11(context.token) ?? null
 		});
 		if (!credential) throw new Error("Unauthorized ingress token");
 		return credential;
@@ -8765,11 +8859,11 @@ var ExtensionManager = class {
 //#endregion
 //#region src/utils/model-message-vision.utils.ts
 const IMAGE_OMITTED_TEXT = "[Image omitted: the selected model is not configured for vision input.]";
-function isRecord$14(value) {
+function isRecord$16(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isImageContentPart(value) {
-	if (!isRecord$14(value)) return false;
+	if (!isRecord$16(value)) return false;
 	const type = value.type;
 	return type === "image_url" || type === "input_image";
 }
@@ -8785,7 +8879,7 @@ function normalizeContentWithoutVision(content) {
 		};
 	});
 	if (!sawImage) return content;
-	const textParts = parts.filter((part) => isRecord$14(part) && part.type === "text" && typeof part.text === "string").map((part) => part.text.trim()).filter(Boolean);
+	const textParts = parts.filter((part) => isRecord$16(part) && part.type === "text" && typeof part.text === "string").map((part) => part.text.trim()).filter(Boolean);
 	if (textParts.length === parts.length) return textParts.join("\n\n");
 	return parts;
 }
@@ -10344,14 +10438,14 @@ function parsePanelAppFolderManifest(raw) {
 	} catch (error) {
 		throw new Error(`panel-app.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	if (!isRecord$13(parsed)) throw new Error("panel-app.json must contain an object.");
-	const id = readOptionalString$10(parsed, "id");
+	if (!isRecord$15(parsed)) throw new Error("panel-app.json must contain an object.");
+	const id = readOptionalString$12(parsed, "id");
 	if (id && !PANEL_APP_ID_PATTERN.test(id)) throw new Error("panel app id must be kebab-case.");
 	return {
 		id,
 		title: readRequiredString$6(parsed, "title"),
-		description: readOptionalString$10(parsed, "description"),
-		icon: readOptionalString$10(parsed, "icon"),
+		description: readOptionalString$12(parsed, "description"),
+		icon: readOptionalString$12(parsed, "icon"),
 		entry: readRequiredString$6(parsed, "entry"),
 		capabilities: readStringArray(parsed.capabilities, "capabilities"),
 		client: readOptionalBoolean$1(parsed, "client"),
@@ -10413,11 +10507,11 @@ function parseTokenList(content) {
 	return [...new Set(content.split(/[,\s]+/).map((entry) => entry.trim()).filter(Boolean))];
 }
 function readRequiredString$6(record, key) {
-	const value = readOptionalString$10(record, key);
+	const value = readOptionalString$12(record, key);
 	if (!value) throw new Error(`panel app ${key} is required.`);
 	return value;
 }
-function readOptionalString$10(record, key) {
+function readOptionalString$12(record, key) {
 	return typeof record[key] === "string" && record[key].trim() ? record[key].trim() : void 0;
 }
 function readOptionalBoolean$1(record, key) {
@@ -10431,7 +10525,7 @@ function readStringArray(value, key) {
 	if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) throw new Error(`panel app ${key} must be a string array.`);
 	return [...new Set(value.map((entry) => entry.trim()).filter(Boolean))];
 }
-function isRecord$13(value) {
+function isRecord$15(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeTextValue(value) {
@@ -10931,7 +11025,7 @@ const PANEL_APP_AGENT_MAX_CONTEXT_CHARS = 8e4;
 function normalizePanelAppGenerateObjectInput(input) {
 	const peerId = input.peerId.trim();
 	const prompt = input.prompt.trim();
-	if (!peerId || !prompt || !isRecord$12(input.schema)) throw new PanelAppError("PANEL_APP_AGENT_REQUEST_INVALID", "invalid generateObject request");
+	if (!peerId || !prompt || !isRecord$14(input.schema)) throw new PanelAppError("PANEL_APP_AGENT_REQUEST_INVALID", "invalid generateObject request");
 	if (prompt.length > PANEL_APP_AGENT_MAX_PROMPT_CHARS) throw new PanelAppError("PANEL_APP_AGENT_REQUEST_INVALID", "generateObject prompt is too large");
 	if (stringifyJsonValue(input.context ?? null).length > PANEL_APP_AGENT_MAX_CONTEXT_CHARS) throw new PanelAppError("PANEL_APP_AGENT_REQUEST_INVALID", "generateObject context is too large");
 	return {
@@ -11072,7 +11166,7 @@ function readStructuredResultEvent(event, resultToolCallId) {
 	};
 }
 function assertToolResultContent(content) {
-	if (!isRecord$12(content) || content.ok !== false || !isRecord$12(content.error)) return;
+	if (!isRecord$14(content) || content.ok !== false || !isRecord$14(content.error)) return;
 	if (content.error.code === "invalid_tool_arguments") throw new PanelAppError("AGENT_OBJECT_RESULT_SCHEMA_INVALID", "agent object result did not match the schema");
 	throw new PanelAppError("AGENT_OBJECT_REQUEST_FAILED", typeof content.error.message === "string" ? content.error.message : "agent object request failed");
 }
@@ -11088,7 +11182,7 @@ function stringifyJsonValue(value) {
 		throw new PanelAppError("PANEL_APP_AGENT_REQUEST_INVALID", "value is not JSON serializable");
 	}
 }
-function isRecord$12(value) {
+function isRecord$14(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
@@ -12509,12 +12603,12 @@ function parseSkillFrontmatter(raw) {
 	const summaryI18n = readLocalizedTextMap(parsed, "summaryi18n", "summary_i18n");
 	const descriptionI18n = readLocalizedTextMap(parsed, "descriptioni18n", "description_i18n");
 	return {
-		name: readString$7(parsed, "name"),
-		summary: readString$7(parsed, "summary"),
-		summaryI18n: mergeLocalizedTextMap(summaryI18n, { zh: readString$7(parsed, "summaryzh", "summary_zh") }),
-		description: readString$7(parsed, "description"),
-		descriptionI18n: mergeLocalizedTextMap(descriptionI18n, { zh: readString$7(parsed, "descriptionzh", "description_zh") }),
-		author: readString$7(parsed, "author"),
+		name: readString$8(parsed, "name"),
+		summary: readString$8(parsed, "summary"),
+		summaryI18n: mergeLocalizedTextMap(summaryI18n, { zh: readString$8(parsed, "summaryzh", "summary_zh") }),
+		description: readString$8(parsed, "description"),
+		descriptionI18n: mergeLocalizedTextMap(descriptionI18n, { zh: readString$8(parsed, "descriptionzh", "description_zh") }),
+		author: readString$8(parsed, "author"),
 		tags: readTags(parsed)
 	};
 }
@@ -12535,19 +12629,19 @@ function parseFrontmatterBlock(raw) {
 function parseYamlFrontmatter(raw) {
 	try {
 		const parsed = parse(raw);
-		return isRecord$11(parsed) ? parsed : {};
+		return isRecord$13(parsed) ? parsed : {};
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		throw new Error(`Invalid SKILL.md frontmatter: ${message}`);
 	}
 }
-function readString$7(record, ...names) {
+function readString$8(record, ...names) {
 	const value = readValue(record, names);
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function readLocalizedTextMap(record, ...names) {
 	const value = readValue(record, names);
-	if (!isRecord$11(value)) return;
+	if (!isRecord$13(value)) return;
 	const localized = Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string" && entry[1].trim().length > 0).map(([locale, text]) => [normalizeLocaleTag(locale), text.trim()]));
 	return Object.keys(localized).length > 0 ? localized : void 0;
 }
@@ -12571,7 +12665,7 @@ function normalizeFrontmatterKey(raw) {
 function normalizeLocaleTag(raw) {
 	return raw.trim().toLowerCase();
 }
-function isRecord$11(value) {
+function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
@@ -12791,11 +12885,11 @@ function createAgentPeerSessionIdentity(params) {
 }
 function resolveAgentPeerScope(params) {
 	const metadata = params.metadata ?? {};
-	const explicitScope = readOptionalString$9(metadata["agent_peer_scope"]) ?? readOptionalString$9(metadata.agentPeerScope);
+	const explicitScope = readOptionalString$11(metadata["agent_peer_scope"]) ?? readOptionalString$11(metadata.agentPeerScope);
 	if (explicitScope) return explicitScope;
-	return `agent:${readOptionalString$9(params.agentId) ?? BUILTIN_MAIN_AGENT_ID}:${readOptionalString$9(params.channel) ?? readOptionalString$9(metadata.channel) ?? "agent-run"}:${readOptionalString$9(metadata.accountId) ?? readOptionalString$9(metadata.account_id) ?? "default"}`;
+	return `agent:${readOptionalString$11(params.agentId) ?? BUILTIN_MAIN_AGENT_ID}:${readOptionalString$11(params.channel) ?? readOptionalString$11(metadata.channel) ?? "agent-run"}:${readOptionalString$11(metadata.accountId) ?? readOptionalString$11(metadata.account_id) ?? "default"}`;
 }
-function readOptionalString$9(value) {
+function readOptionalString$11(value) {
 	if (typeof value !== "string") return;
 	return value.trim() || void 0;
 }
@@ -12855,20 +12949,20 @@ function readEventMessageId(event) {
 	if (event.type === "session.snapshot.message") return null;
 	const streamingMessageId = readStreamingMessageId(event);
 	if (streamingMessageId) return streamingMessageId;
-	const messageId = ("payload" in event && isRecord$10(event.payload) ? event.payload : null)?.messageId;
+	const messageId = ("payload" in event && isRecord$12(event.payload) ? event.payload : null)?.messageId;
 	if (typeof messageId === "string" && messageId.trim()) return messageId.trim();
 	return null;
 }
 function readEventRunId(event) {
 	if (isJournalOnlyEvent(event)) return null;
 	if (event.type === "session.snapshot.message") return null;
-	const runId = ("payload" in event && isRecord$10(event.payload) ? event.payload : null)?.runId;
+	const runId = ("payload" in event && isRecord$12(event.payload) ? event.payload : null)?.runId;
 	if (typeof runId === "string" && runId.trim()) return runId.trim();
 	return null;
 }
 function readEventToolCallId(event) {
 	if (isJournalOnlyEvent(event)) return null;
-	const toolCallId = ("payload" in event && isRecord$10(event.payload) ? event.payload : null)?.toolCallId;
+	const toolCallId = ("payload" in event && isRecord$12(event.payload) ? event.payload : null)?.toolCallId;
 	return typeof toolCallId === "string" && toolCallId.trim() ? toolCallId.trim() : null;
 }
 function createReplayEvent(event, toolResultsByCallId) {
@@ -12913,7 +13007,7 @@ function mergeReplayCompletedToolResults(message, toolResultsByCallId) {
 	} : message;
 }
 function readLegacyContextCompactionMessageId(message) {
-	const checkpoint = isRecord$10(message?.metadata?.checkpoint) ? message.metadata.checkpoint : null;
+	const checkpoint = isRecord$12(message?.metadata?.checkpoint) ? message.metadata.checkpoint : null;
 	const checkpointId = typeof checkpoint?.id === "string" ? checkpoint.id : "";
 	const coveredCount = checkpoint?.coveredSessionMessageCount;
 	const legacyId = `${message?.sessionId}:service:context-compaction:${checkpointId}`;
@@ -12945,11 +13039,11 @@ function readReplayMessageId(event) {
 	return readMessageFromSummaryEvent$1(event)?.id ?? null;
 }
 function readEventSessionId$1(event) {
-	const sessionId = ("payload" in event && isRecord$10(event.payload) ? event.payload : null)?.sessionId;
+	const sessionId = ("payload" in event && isRecord$12(event.payload) ? event.payload : null)?.sessionId;
 	return typeof sessionId === "string" ? sessionId : "";
 }
 function readReplayPayloadTimestamp(event) {
-	const payload = "payload" in event && isRecord$10(event.payload) ? event.payload : null;
+	const payload = "payload" in event && isRecord$12(event.payload) ? event.payload : null;
 	const timestamp = typeof payload?.timestamp === "string" ? payload.timestamp : "";
 	return Number.isFinite(Date.parse(timestamp)) ? new Date(timestamp).toISOString() : null;
 }
@@ -12970,7 +13064,7 @@ function readStreamingMessageId(event) {
 function isJournalOnlyEvent(event) {
 	return event.type === "session.request.accepted" || event.type === "session.request.completed" || event.type === "session.request.failed";
 }
-function isRecord$10(value) {
+function isRecord$12(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function readMessageFromSummaryEvent$1(event) {
@@ -13077,7 +13171,7 @@ function safeNcpSessionFilename(value) {
 function normalizeNcpAgentId(agentId) {
 	return agentId?.trim().toLowerCase() || void 0;
 }
-function isRecord$9(value) {
+function isRecord$11(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function toIsoString(value, fallback) {
@@ -13644,16 +13738,15 @@ function applySessionRuntimePatch(metadata, patch) {
 function applySessionSettingsMetadataPatch(currentMetadata, patch) {
 	return applySessionRuntimePatch(applySessionPreferencePatch(structuredClone(currentMetadata), patch), patch);
 }
-async function applySessionProjectMetadataPatch(metadata, patch, normalizeProjectRoot) {
+async function applySessionProjectMetadataPatch(metadata, patch, normalizeProjectContext) {
 	if (!Object.prototype.hasOwnProperty.call(patch, "projectRoot")) return metadata;
-	const projectRoot = await normalizeProjectRoot(patch.projectRoot);
-	const { projectRoot: _legacyProjectRoot, ...nextMetadata } = metadata;
-	if (projectRoot) return {
+	const project = await normalizeProjectContext(patch.projectRoot);
+	const { projectRoot: _legacyProjectRoot, projectId: _legacyProjectId, project_root: _projectRoot, project_id: _projectId, ...nextMetadata } = metadata;
+	return project ? {
 		...nextMetadata,
-		project_root: projectRoot
-	};
-	const { project_root: _projectRoot, ...metadataWithoutProjectRoot } = nextMetadata;
-	return metadataWithoutProjectRoot;
+		project_id: project.projectId,
+		project_root: project.rootPath
+	} : nextMetadata;
 }
 function publishSessionMetadataChanged(eventBus, sessionKey, metadata, mode) {
 	eventBus.emit(eventKeys$1.sessionMetadataChanged, {
@@ -13685,7 +13778,7 @@ function applyLimit(items, limit) {
 	if (!Number.isFinite(limit) || typeof limit !== "number" || limit <= 0) return items;
 	return items.slice(0, Math.trunc(limit));
 }
-function readOptionalString$8(value) {
+function readOptionalString$10(value) {
 	if (typeof value !== "string") return null;
 	const trimmed = value.trim();
 	return trimmed.length > 0 ? trimmed : null;
@@ -13715,6 +13808,9 @@ function readThinkingEffort(metadata) {
 function readProjectRoot(metadata) {
 	return readOptionalMetadataString(metadata?.project_root) ?? readOptionalMetadataString(metadata?.projectRoot);
 }
+function readProjectId(metadata) {
+	return readOptionalMetadataString(metadata?.project_id) ?? readOptionalMetadataString(metadata?.projectId);
+}
 function readAgentRuntimeId(metadata) {
 	return readOptionalMetadataString(metadata?.agentRuntimeId) ?? readOptionalMetadataString(metadata?.runtime) ?? readOptionalMetadataString(metadata?.session_type);
 }
@@ -13731,7 +13827,7 @@ function cloneInheritedMetadata(sourceMetadata) {
 		"preferred_model",
 		"preferred_thinking",
 		"project_root",
-		"requested_skill_refs",
+		"project_id",
 		"codex_runtime_backend",
 		"reasoningNormalizationMode",
 		"reasoning_normalization_mode"
@@ -13746,7 +13842,7 @@ function mergeMetadataOverrides(metadata, overrides) {
 }
 function resolveSessionType(params) {
 	const { metadata, runtime, sessionType } = params;
-	return readOptionalString$8(runtime) ?? readOptionalString$8(metadata.runtime) ?? readOptionalString$8(sessionType) ?? readOptionalString$8(metadata.session_type) ?? "native";
+	return readOptionalString$10(runtime) ?? readOptionalString$10(metadata.runtime) ?? readOptionalString$10(sessionType) ?? readOptionalString$10(metadata.session_type) ?? "native";
 }
 function applySessionOverrides(params) {
 	const { lifecycle, metadata, model, parentSessionId, projectRoot, requestId, sessionType, thinkingLevel, title } = params;
@@ -13756,15 +13852,15 @@ function applySessionOverrides(params) {
 	metadata[CHILD_SESSION_LIFECYCLE_METADATA_KEY] = lifecycle;
 	if (parentSessionId) metadata[CHILD_SESSION_PARENT_METADATA_KEY] = parentSessionId;
 	if (requestId) metadata[CHILD_SESSION_REQUEST_METADATA_KEY] = requestId;
-	if (readOptionalString$8(model)) {
+	if (readOptionalString$10(model)) {
 		metadata.model = model?.trim();
 		metadata.preferred_model = model?.trim();
 	}
-	if (readOptionalString$8(thinkingLevel)) {
+	if (readOptionalString$10(thinkingLevel)) {
 		metadata.thinking = thinkingLevel?.trim();
 		metadata.preferred_thinking = thinkingLevel?.trim();
 	}
-	if (readOptionalString$8(projectRoot)) metadata.project_root = projectRoot?.trim();
+	if (readOptionalString$10(projectRoot)) metadata.project_root = projectRoot?.trim();
 }
 //#endregion
 //#region src/app/kernel-storage-paths.ts
@@ -13785,6 +13881,9 @@ function resolveKernelPreferenceStorePath(options) {
 function resolveKernelProjectStorePath(options) {
 	return resolveKernelDataPath(options, "projects", "projects.json");
 }
+function resolveKernelProjectWorkStorePath(options) {
+	return resolveKernelDataPath(options, "projects", "work-items.db");
+}
 function resolveKernelInboxDeliveryStorePath(options) {
 	return resolveKernelDataPath(options, "inbox", "deliveries.json");
 }
@@ -15106,10 +15205,14 @@ var PortableServiceCapabilityResolverService = class {
 		if (!record || app.packageVersion && record.activeVersion !== app.packageVersion) return [];
 		const resolved = [];
 		for (const scope of scopes) {
-			const grantedPath = record.grants[scope.id];
-			if (grantedPath) resolved.push({
-				scope,
-				hostPath: await this.requireCanonicalDirectory(grantedPath, `${app.id}:${scope.id}`)
+			const grant = record.grants[scope.id];
+			if (!grant || grant.mode === "read-write" && scope.mode !== "read-write") continue;
+			resolved.push({
+				scope: {
+					...scope,
+					mode: grant.mode
+				},
+				hostPath: await this.requireCanonicalDirectory(grant.path, `${app.id}:${scope.id}`)
 			});
 		}
 		return resolved;
@@ -16051,7 +16154,7 @@ var ServiceAppAiCapabilityService = class {
 		const payload = requireHostCallObject(call.request.input);
 		if (call.request.capability === "model-complete") {
 			const messages = payload.messages;
-			if (!Array.isArray(messages) || !messages.every(isRecord$8)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "AI model messages must be an array of objects.");
+			if (!Array.isArray(messages) || !messages.every(isRecord$10)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "AI model messages must be an array of objects.");
 			return await this.modelComplete({
 				app: call.app,
 				manifest: call.manifest,
@@ -16063,7 +16166,7 @@ var ServiceAppAiCapabilityService = class {
 		}
 		if (call.request.capability === "agent-start") {
 			const input = payload.input;
-			if (!isRecord$8(input)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "AI Agent input must be an object.");
+			if (!isRecord$10(input)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "AI Agent input must be an object.");
 			const execution = await this.agentStart({
 				app: call.app,
 				manifest: call.manifest,
@@ -16188,11 +16291,11 @@ var ServiceAppAiCapabilityService = class {
 		};
 	};
 };
-function isRecord$8(value) {
+function isRecord$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireHostCallObject(value) {
-	if (!isRecord$8(value)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "Portable host call input must be an object.");
+	if (!isRecord$10(value)) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", "Portable host call input must be an object.");
 	return value;
 }
 function requireHostCallString(value, key) {
@@ -17341,6 +17444,7 @@ function projectCapabilityProviders(entries) {
 //#endregion
 //#region src/managers/service-app.manager.ts
 const SERVICE_APP_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const DOCUMENT_GUEST_PATH_PATTERN = /^\/documents\/([^/]+)(?:\/|$)/;
 var ServiceAppManager = class {
 	removalService = new ServiceAppRemovalService();
 	runtimeService;
@@ -17489,6 +17593,7 @@ var ServiceAppManager = class {
 		const action = listServiceAppManifestActions(record, manifest).find((entry) => entry.id === actionId);
 		if (!action) throw new ServiceAppError("SERVICE_APP_ACTION_NOT_FOUND", "service action not found");
 		if (!await this.actionGrants.isGranted(request.caller, action)) throw new ServiceAppError("AUTHORIZATION_REQUIRED", `This panel app needs permission to call ${actionId}.`);
+		await this.assertDocumentInputAccess(record, action.risk, request.input ?? {});
 		return await this.jobManager.invoke({
 			actionId,
 			actionName,
@@ -17505,6 +17610,8 @@ var ServiceAppManager = class {
 	*/
 	invokeInstalledServiceAction = async (appId, actionName, input = {}) => {
 		const { manifest, record } = await this.requireInstalledServiceApp(appId, actionName);
+		const action = listServiceAppManifestActions(record, manifest).find((entry) => entry.name === actionName);
+		await this.assertDocumentInputAccess(record, action?.risk ?? "dangerous", input);
 		return await this.jobManager.invoke({
 			actionId: buildServiceActionId(record.id, actionName),
 			actionName,
@@ -17515,6 +17622,24 @@ var ServiceAppManager = class {
 			entrySurface: "installed-app-cli"
 		});
 	};
+	assertDocumentInputAccess = async (record, risk, input) => {
+		const match = (typeof input.path === "string" ? input.path : void 0)?.match(DOCUMENT_GUEST_PATH_PATTERN);
+		if (!match || !record.packageId || !this.params.assertDocumentAccess) return;
+		const scopeId = decodeURIComponent(match[1]);
+		const requestedMode = risk === "read" ? "read" : "read-write";
+		try {
+			await this.params.assertDocumentAccess(record.packageId, scopeId, requestedMode);
+		} catch (error) {
+			const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "DOCUMENT_SCOPE_NOT_GRANTED";
+			if (code === "DOCUMENT_SCOPE_NOT_GRANTED" || code === "DOCUMENT_SCOPE_MODE_INSUFFICIENT" || code === "DOCUMENT_SCOPE_UNAVAILABLE") throw new ServiceAppError(code, error instanceof Error ? error.message : code, {
+				appId: record.packageId,
+				scopeId,
+				requestedMode,
+				recoveryActions: code === "DOCUMENT_SCOPE_UNAVAILABLE" ? ["replace", "revoke"] : code === "DOCUMENT_SCOPE_MODE_INSUFFICIENT" ? ["upgrade"] : ["grant"]
+			});
+			throw error;
+		}
+	};
 	listVerificationRecords = async (filters = {}) => await this.jobManager.listVerificationRecords(filters);
 	exportVerificationRecords = async (filters = {}) => await this.jobManager.exportVerificationRecords(filters);
 	listServiceAppJobs = async (appId, params = {}) => await this.jobManager.list(appId, params.caller);
@@ -18609,7 +18734,7 @@ function hasToolCall(message, toolCallId) {
 	return message.parts.some((part) => part.type === "tool-invocation" && part.toolCallId === toolCallId);
 }
 function findContextInheritanceAnchor(params) {
-	const anchorToolCallId = readOptionalString$8(params.anchorToolCallId);
+	const anchorToolCallId = readOptionalString$10(params.anchorToolCallId);
 	if (!anchorToolCallId) return null;
 	const index = params.messages.findIndex((message) => hasToolCall(message, anchorToolCallId));
 	const message = index >= 0 ? params.messages[index] : void 0;
@@ -18649,7 +18774,7 @@ function createInheritedContextSnapshot(params) {
 			enabled: true,
 			sourceSessionId: sourceRecord.sessionId,
 			anchorKind: anchor ? "tool_call" : "latest_persisted",
-			anchorToolCallId: readOptionalString$8(anchorToolCallId),
+			anchorToolCallId: readOptionalString$10(anchorToolCallId),
 			anchorMessageId: anchor?.message.id,
 			inheritedMessageCount: messages.length
 		}
@@ -18871,7 +18996,7 @@ var SessionSettingsService = class {
 			existing = await this.options.getSessionRecord(sessionId);
 		}
 		if (!existing) return null;
-		const metadata = await applySessionProjectMetadataPatch(applySessionSettingsMetadataPatch(existing.metadata ?? {}, patch), patch, this.options.normalizeProjectRoot);
+		const metadata = await applySessionProjectMetadataPatch(applySessionSettingsMetadataPatch(existing.metadata ?? {}, patch), patch, this.options.normalizeProjectContext);
 		return await this.options.setSessionMetadata(sessionId, metadata) ? await this.options.getSession(sessionId) : null;
 	};
 };
@@ -18937,7 +19062,7 @@ var SessionWorkingDirResolver = class {
 		return this.resolveContext(params).effectiveWorkspace;
 	};
 	resolveContext = (params) => {
-		const profile = this.agentManager.resolveAgentProfile(readOptionalString$8(params.agentId));
+		const profile = this.agentManager.resolveAgentProfile(readOptionalString$10(params.agentId));
 		return resolveSessionProjectContext({
 			sessionMetadata: params.metadata,
 			workspace: profile.workspace
@@ -18974,7 +19099,7 @@ var SessionManager = class {
 			createSession: this.createSession,
 			getSession: this.getSession,
 			getSessionRecord: this.getSessionRecord,
-			normalizeProjectRoot: options.projectManager.normalizeSessionProjectRoot,
+			normalizeProjectContext: options.projectManager.normalizeSessionProjectContext,
 			setSessionMetadata: this.setSessionMetadata
 		});
 	}
@@ -18985,10 +19110,10 @@ var SessionManager = class {
 		const { agentId: requestedAgentId, contextInheritance, metadataOverrides, model, parentSessionId: rawParentSessionId, projectRoot, requestId: rawRequestId, runtime, sessionId: requestedSessionId, sessionType: requestedSessionType, sourceSessionId, sourceSessionMetadata, task, thinkingLevel, title: requestedTitle } = params;
 		const sourceRecord = sourceSessionId ? await this.getSessionRecord(sourceSessionId) : null;
 		const metadata = cloneInheritedMetadata(sourceSessionMetadata);
-		const title = readOptionalString$8(requestedTitle) ?? summarizeTask(task);
-		const parentSessionId = readOptionalString$8(rawParentSessionId);
+		const title = readOptionalString$10(requestedTitle) ?? summarizeTask(task);
+		const parentSessionId = readOptionalString$10(rawParentSessionId);
 		await assertCanCreateSessionFromLineage(parentSessionId, sourceRecord, metadataOverrides, this.getSessionRecord);
-		const requestId = readOptionalString$8(rawRequestId);
+		const requestId = readOptionalString$10(rawRequestId);
 		const sessionType = resolveSessionType({
 			runtime,
 			sessionType: requestedSessionType,
@@ -19006,16 +19131,11 @@ var SessionManager = class {
 			title
 		});
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const nextMetadata = mergeMetadataOverrides(metadata, metadataOverrides);
+		let nextMetadata = mergeMetadataOverrides(metadata, metadataOverrides);
 		const requestedProjectRoot = projectRoot !== void 0 ? projectRoot : readProjectRoot(nextMetadata);
-		if (requestedProjectRoot !== void 0) {
-			const normalizedProjectRoot = await this.options.projectManager.normalizeSessionProjectRoot(requestedProjectRoot);
-			delete nextMetadata.projectRoot;
-			if (normalizedProjectRoot) nextMetadata.project_root = normalizedProjectRoot;
-			else delete nextMetadata.project_root;
-		}
-		const agentId = readOptionalString$8(requestedAgentId) ?? readOptionalString$8(sourceRecord?.agentId) ?? BUILTIN_MAIN_AGENT_ID;
-		const sessionId = readOptionalString$8(requestedSessionId) ?? buildSessionId();
+		if (requestedProjectRoot !== void 0) nextMetadata = await applySessionProjectMetadataPatch(nextMetadata, { projectRoot: requestedProjectRoot }, this.options.projectManager.normalizeSessionProjectContext);
+		const agentId = readOptionalString$10(requestedAgentId) ?? readOptionalString$10(sourceRecord?.agentId) ?? BUILTIN_MAIN_AGENT_ID;
+		const sessionId = readOptionalString$10(requestedSessionId) ?? buildSessionId();
 		const inheritedContext = createSessionContextInheritance({
 			childSessionId: sessionId,
 			contextInheritance,
@@ -19101,7 +19221,7 @@ var SessionManager = class {
 	listSessions = async (options) => {
 		const { limit, peerId: rawPeerId } = options ?? {};
 		const { journalStore } = this.options;
-		const peerId = readOptionalString$8(rawPeerId);
+		const peerId = readOptionalString$10(rawPeerId);
 		const summaryReadOptions = !peerId && limit !== void 0 ? { limit } : void 0;
 		return applyLimit((await journalStore.listSessionSummaries(summaryReadOptions)).filter((summary) => !peerId || summary.peerId === peerId).map(this.workingDirResolver.withWorkingDir), limit);
 	};
@@ -19160,9 +19280,9 @@ var SessionManager = class {
 	};
 	createAgentRunSession = async (params) => {
 		const { agentId, agentRuntimeId: requestedAgentRuntimeId, channel, contextInheritance, metadata, model, parentSessionId: rawParentSessionId, peerId: rawPeerId, projectRoot, sessionId, sourceSessionId: rawSourceSessionId, sourceSessionMetadata: requestedSourceSessionMetadata, task, thinkingEffort } = params;
-		const peerId = readOptionalString$8(rawPeerId);
-		const parentSessionId = readOptionalString$8(rawParentSessionId);
-		const sourceSessionId = readOptionalString$8(rawSourceSessionId);
+		const peerId = readOptionalString$10(rawPeerId);
+		const parentSessionId = readOptionalString$10(rawParentSessionId);
+		const sourceSessionId = readOptionalString$10(rawSourceSessionId);
 		const sourceRecord = sourceSessionId ? await this.getSessionRecord(sourceSessionId) : null;
 		const sourceSessionMetadata = requestedSourceSessionMetadata ?? sourceRecord?.metadata ?? {};
 		const agentRuntimeId = requestedAgentRuntimeId ?? readAgentRuntimeId(sourceSessionMetadata) ?? "native";
@@ -19172,7 +19292,7 @@ var SessionManager = class {
 			metadata,
 			peerId
 		}) : void 0;
-		const requestedSessionId = readOptionalString$8(sessionId);
+		const requestedSessionId = readOptionalString$10(sessionId);
 		const created = await this.createSession({
 			contextInheritance,
 			parentSessionId: parentSessionId ?? void 0,
@@ -19198,6 +19318,7 @@ var SessionManager = class {
 			metadata: structuredClone(created.metadata ?? {}),
 			model: model ?? readOptionalMetadataString(created.metadata?.model) ?? readOptionalMetadataString(created.metadata?.preferred_model),
 			projectRoot: readProjectRoot(created.metadata),
+			projectId: readProjectId(created.metadata),
 			workingDir: this.workingDirResolver.resolve({
 				agentId: created.agentId,
 				metadata: created.metadata
@@ -19219,6 +19340,7 @@ var SessionManager = class {
 			metadata: structuredClone(metadata),
 			model: readOptionalMetadataString(metadata.model) ?? readOptionalMetadataString(metadata.preferred_model),
 			projectRoot: readProjectRoot(metadata),
+			projectId: readProjectId(metadata),
 			workingDir: this.workingDirResolver.resolve({
 				agentId: summary.agentId,
 				metadata
@@ -20206,8 +20328,11 @@ var ObservationManager = class {
 	};
 };
 //#endregion
-//#region src/stores/project.store.ts
-const PROJECT_STORE_VERSION = 1;
+//#region src/features/projects/stores/project.store.ts
+const PROJECT_STORE_VERSION = 2;
+function createProjectId() {
+	return randomBytes(9).toString("base64url");
+}
 var ProjectStoreError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -20227,6 +20352,28 @@ var ProjectStore = class {
 			throw error;
 		}
 	};
+	migrateLegacyRecords = async () => {
+		let source;
+		try {
+			source = await readFile(this.storePath, "utf8");
+		} catch (error) {
+			if (this.isMissingFileError(error)) return false;
+			throw error;
+		}
+		let storeFile;
+		try {
+			storeFile = this.parseStoredFile(source);
+		} catch (error) {
+			if (error instanceof SyntaxError) throw new ProjectStoreError("project registry contains invalid JSON");
+			throw error;
+		}
+		if (storeFile.version === PROJECT_STORE_VERSION) return false;
+		await this.save(storeFile.projects.map((project) => ({
+			id: createProjectId(),
+			...project
+		})));
+		return true;
+	};
 	save = async (projects) => {
 		const tempPath = `${this.storePath}.${randomUUID()}.tmp`;
 		const storeFile = {
@@ -20243,25 +20390,46 @@ var ProjectStore = class {
 		}
 	};
 	parseStoreFile = (source) => {
-		const value = JSON.parse(source);
-		if (!this.isRecord(value) || value.version !== PROJECT_STORE_VERSION || !Array.isArray(value.projects) || !value.projects.every(this.isProjectRecord)) throw new ProjectStoreError("project registry has an unsupported structure");
+		const value = this.parseStoredFile(source);
+		if (value.version !== PROJECT_STORE_VERSION || !value.projects.every(this.isProjectRecord)) throw new ProjectStoreError("project registry has an unsupported structure");
 		return {
 			version: PROJECT_STORE_VERSION,
 			projects: value.projects.map((project) => structuredClone(project))
 		};
 	};
+	parseStoredFile = (source) => {
+		const value = JSON.parse(source);
+		if (!this.isRecord(value) || !Array.isArray(value.projects)) throw new ProjectStoreError("project registry has an unsupported structure");
+		if (value.version === PROJECT_STORE_VERSION && value.projects.every(this.isProjectRecord)) return {
+			version: PROJECT_STORE_VERSION,
+			projects: value.projects.map((project) => structuredClone(project))
+		};
+		if (value.version === 1 && value.projects.every(this.isLegacyProjectRecord)) return {
+			version: 1,
+			projects: value.projects.map((project) => structuredClone(project))
+		};
+		throw new ProjectStoreError("project registry has an unsupported structure");
+	};
 	isProjectRecord = (value) => {
 		if (!this.isRecord(value)) return false;
-		return typeof value.name === "string" && typeof value.rootPath === "string" && (value.template === void 0 || value.template === "empty" || value.template === "knowledge-base") && typeof value.createdAt === "string" && typeof value.updatedAt === "string";
+		return typeof value.id === "string" && value.id.length > 0 && typeof value.name === "string" && typeof value.rootPath === "string" && (value.template === void 0 || value.template === "empty" || value.template === "knowledge-base") && typeof value.createdAt === "string" && typeof value.updatedAt === "string";
+	};
+	isLegacyProjectRecord = (value) => {
+		if (!this.isRecord(value)) return false;
+		const { id: _id, ...legacy } = value;
+		return this.isProjectRecord({
+			id: "legacy",
+			...legacy
+		});
 	};
 	isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 };
 //#endregion
-//#region src/types/project.types.ts
+//#region src/features/projects/types/project.types.ts
 const PROJECT_TEMPLATE_IDS = ["empty", "knowledge-base"];
 //#endregion
-//#region src/managers/project.manager.ts
+//#region src/features/projects/managers/project.manager.ts
 const PROJECT_TEMPLATES = [{
 	id: "empty",
 	name: "Empty project",
@@ -20288,6 +20456,17 @@ var ProjectManager = class {
 		this.store = new ProjectStore(options.storePath);
 	}
 	listProjects = async () => (await this.store.list()).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || left.name.localeCompare(right.name));
+	migrateLegacyProjects = async () => await this.store.migrateLegacyRecords();
+	getProjectById = async (projectId) => {
+		const project = (await this.store.list()).find((entry) => entry.id === projectId);
+		return project ? structuredClone(project) : null;
+	};
+	getRegisteredProject = async (rootPath) => {
+		const canonicalPath = await this.resolveExistingProjectRoot(rootPath);
+		if (!canonicalPath) return null;
+		const project = (await this.store.list()).find((entry) => entry.rootPath === canonicalPath);
+		return project ? structuredClone(project) : null;
+	};
 	listTemplates = () => structuredClone(PROJECT_TEMPLATES);
 	createProject = async (input) => {
 		const name = this.normalizeName(input.name);
@@ -20319,14 +20498,20 @@ var ProjectManager = class {
 		});
 	};
 	normalizeSessionProjectRoot = async (value) => {
+		return (await this.normalizeSessionProjectContext(value))?.rootPath ?? null;
+	};
+	normalizeSessionProjectContext = async (value) => {
 		if (value == null || typeof value === "string" && !value.trim()) return null;
 		const rootPath = await this.resolveExistingProjectRoot(value);
 		if (!rootPath) return null;
-		await this.upsertProject({
+		const project = await this.upsertProject({
 			name: basename(rootPath),
 			rootPath
 		});
-		return rootPath;
+		return {
+			projectId: project.id,
+			rootPath: project.rootPath
+		};
 	};
 	resolveExistingProjectRoot = async (value) => {
 		if (typeof value !== "string") throw new ProjectError("PROJECT_PATH_INVALID_TYPE", "project path must be a string or null");
@@ -20357,6 +20542,7 @@ var ProjectManager = class {
 		if (existing) return existing;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const project = {
+			id: createProjectId(),
 			name: input.name,
 			rootPath: input.rootPath,
 			...input.template ? { template: input.template } : {},
@@ -20364,6 +20550,7 @@ var ProjectManager = class {
 			updatedAt: now
 		};
 		await this.store.save([...projects, project]);
+		await this.options.onProjectRegistered?.(structuredClone(project));
 		return structuredClone(project);
 	};
 	assertNotDefaultWorkspace = async (rootPath) => {
@@ -20421,138 +20608,2254 @@ var ProjectManager = class {
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 };
 //#endregion
-//#region src/stores/ncp-agent-session-journal-summary-recovery.store.ts
-async function loadNcpAgentSessionSummary(params) {
-	const journalStat = await stat(params.journalPath);
-	const projectionMeta = await params.projectionStore.readMeta(params.sessionId);
-	if (projectionMeta && projectionMeta.projectedJournalOffset <= journalStat.size) {
-		const metadata = await params.metadataStore.read(params.sessionId, {
-			createdAt: params.updatedAt,
-			updatedAt: params.updatedAt,
-			metadata: {}
-		});
-		const page = await params.projectionStore.listPage({
-			sessionId: params.sessionId,
-			limit: 1
-		});
-		return {
-			...createNcpAgentSessionSummary({
-				sessionId: params.sessionId,
-				...metadata.agentId ? { agentId: metadata.agentId } : {},
-				createdAt: metadata.createdAt,
-				updatedAt: metadata.updatedAt,
-				metadata: metadata.metadata,
-				messages: page?.messages ?? []
-			}),
-			messageCount: page?.total ?? projectionMeta.total
-		};
-	}
-	return await loadNcpAgentSessionSummaryWithoutReplay({
-		sessionId: params.sessionId,
-		journalPath: params.journalPath,
-		updatedAt: params.updatedAt,
-		metadataStore: params.metadataStore
-	});
-}
-async function loadNcpAgentSessionSummaryWithoutReplay(params) {
-	const stream = createReadStream(params.journalPath, { encoding: "utf-8" });
-	const lines = createInterface({
-		input: stream,
-		crlfDelay: Infinity
-	});
-	const state = {
-		createdAt: params.updatedAt,
-		metadata: {},
-		messageCount: 0,
-		messageIds: /* @__PURE__ */ new Set(),
-		requiresReplay: false
-	};
+//#region src/stores/sqlite-database.store.ts
+const require = createRequire(import.meta.url);
+const portableDatabases = /* @__PURE__ */ new Map();
+async function openSqliteDatabase(databasePath) {
 	try {
-		for await (const line of lines) applyJournalSummaryLine(state, line);
-	} catch {
-		return null;
-	} finally {
-		lines.close();
-		stream.destroy();
-	}
-	if (state.requiresReplay) return null;
-	const snapshot = await params.metadataStore.read(params.sessionId, {
-		...state.agentId ? { agentId: state.agentId } : {},
-		createdAt: state.createdAt,
-		updatedAt: params.updatedAt,
-		metadata: state.metadata
-	});
-	return {
-		...createNcpAgentSessionSummary({
-			sessionId: params.sessionId,
-			...snapshot.agentId ? { agentId: snapshot.agentId } : {},
-			createdAt: snapshot.createdAt,
-			updatedAt: snapshot.updatedAt,
-			metadata: snapshot.metadata,
-			messages: []
-		}),
-		messageCount: state.messageCount,
-		...state.lastMessageAt ? { lastMessageAt: state.lastMessageAt } : {}
-	};
-}
-function applyJournalSummaryLine(state, line) {
-	const parsed = parseJournalLine(line);
-	if (!parsed) return;
-	if (parsed._type === "metadata") {
-		state.createdAt = toIsoString(parsed.created_at, state.createdAt);
-		state.agentId = typeof parsed.agent_id === "string" ? parsed.agent_id : state.agentId;
-		if (isRecord$9(parsed.metadata)) state.metadata = structuredClone(parsed.metadata);
-		return;
+		return new (require("node:sqlite")).DatabaseSync(databasePath);
+	} catch (error) {
+		if (!isMissingNodeSqlite(error)) throw error;
+		return await openPortableDatabase(databasePath);
 	}
-	if (parsed._type !== "event" || !isRecord$9(parsed.event)) return;
-	const event = parsed.event;
-	const payload = isRecord$9(event.payload) ? event.payload : null;
-	const message = payload && isRecord$9(payload.message) ? payload.message : null;
-	const messageId = typeof message?.id === "string" ? message.id : typeof payload?.messageId === "string" ? payload.messageId : null;
-	if (!isMessageStartEvent(event.type) || !messageId || state.messageIds.has(messageId)) return;
-	state.messageIds.add(messageId);
-	state.messageCount += 1;
-	if (isRecord$9(message?.metadata) && message.metadata.nextclaw_timeline_kind === "context_compaction") state.requiresReplay = true;
-	if (!isFinalMessageEvent(event.type)) return;
-	const timestamp = toIsoString(message?.timestamp, "");
-	if (timestamp && (!state.lastMessageAt || timestamp > state.lastMessageAt)) state.lastMessageAt = timestamp;
 }
-function parseJournalLine(line) {
-	if (!line.trim()) return null;
+function runSqliteTransaction(database, operation, mode = "DEFERRED") {
+	database.exec(`BEGIN ${mode}`);
 	try {
-		const parsed = JSON.parse(line);
-		return isRecord$9(parsed) ? parsed : null;
-	} catch {
-		return null;
+		const result = operation();
+		database.exec("COMMIT");
+		return result;
+	} catch (error) {
+		database.exec("ROLLBACK");
+		throw error;
 	}
 }
-function isMessageStartEvent(type) {
-	return type === NcpEventType.MessageSent || type === NcpEventType.MessageCompleted || type === "session.snapshot.message" || type === NcpEventType.MessageTextStart || type === NcpEventType.MessageReasoningStart;
+function isMissingNodeSqlite(error) {
+	const code = typeof error === "object" && error !== null ? error.code : void 0;
+	return code === "ERR_UNKNOWN_BUILTIN_MODULE" || code === "MODULE_NOT_FOUND";
 }
-function isFinalMessageEvent(type) {
-	return type === NcpEventType.MessageSent || type === NcpEventType.MessageCompleted || type === "session.snapshot.message";
+async function openPortableDatabase(databasePath) {
+	const existing = portableDatabases.get(databasePath);
+	if (existing) return (await existing).acquire();
+	const opening = createPortableDatabase(databasePath).catch((error) => {
+		portableDatabases.delete(databasePath);
+		throw error;
+	});
+	portableDatabases.set(databasePath, opening);
+	return (await opening).acquire();
 }
-//#endregion
-//#region src/utils/ncp-agent-unfinished-run.utils.ts
-function applyNcpAgentRunLifecycleEvent(sessionId, activeRun, event) {
-	if (event.type === NcpEventType.RunStarted) return {
-		sessionId,
-		...event.payload.messageId ? { messageId: event.payload.messageId } : {},
-		...event.payload.runId ? { runId: event.payload.runId } : {},
-		...event.payload.startedAt ? { startedAt: event.payload.startedAt } : {}
-	};
-	if (activeRun && (event.type === NcpEventType.RunFinished || event.type === NcpEventType.RunError || event.type === NcpEventType.MessageAbort) && (!event.payload.runId || !activeRun.runId || event.payload.runId === activeRun.runId)) return null;
-	return activeRun;
+async function createPortableDatabase(databasePath) {
+	const initialize = (await import("sql.js")).default;
+	const sqlite = await initialize({ locateFile: (file) => require.resolve(`sql.js/dist/${file}`) });
+	return new PortableSqliteDatabase(databasePath, existsSync(databasePath) ? new sqlite.Database(readFileSync(databasePath)) : new sqlite.Database());
 }
-//#endregion
-//#region src/stores/ncp-agent-unfinished-run.store.ts
-var NcpAgentUnfinishedRunStore = class {
-	constructor(journalDir, listSessionIds) {
-		this.journalDir = journalDir;
-		this.listSessionIds = listSessionIds;
+var PortableSqliteDatabase = class {
+	inTransaction = false;
+	dirty = false;
+	leaseCount = 0;
+	constructor(databasePath, database) {
+		this.databasePath = databasePath;
+		this.database = database;
 	}
-	list = async () => {
-		const runs = [];
+	acquire = () => {
+		this.leaseCount += 1;
+		return new PortableSqliteLease(this);
+	};
+	exec = (sql) => {
+		const command = sql.trim().toUpperCase();
+		this.database.run(sql);
+		if (command.startsWith("BEGIN")) {
+			this.inTransaction = true;
+			return;
+		}
+		if (command.startsWith("ROLLBACK")) {
+			this.inTransaction = false;
+			this.dirty = false;
+			return;
+		}
+		if (command.startsWith("COMMIT")) {
+			this.inTransaction = false;
+			this.persistIfDirty();
+			return;
+		}
+		if (!command.startsWith("PRAGMA")) this.markDirty();
+	};
+	prepare = (sql) => new PortableSqliteStatement(this, sql);
+	release = () => {
+		this.leaseCount -= 1;
+		if (this.leaseCount > 0) return;
+		this.persistIfDirty();
+		this.database.close();
+		portableDatabases.delete(this.databasePath);
+	};
+	run = (sql, params) => {
+		this.database.run(sql, normalizeParams(params));
+		this.markDirty();
+	};
+	readRows = (sql, params) => {
+		const statement = this.database.prepare(sql);
+		try {
+			bindStatement(statement, params);
+			const rows = [];
+			while (statement.step()) rows.push(statement.getAsObject());
+			return rows;
+		} finally {
+			statement.free();
+		}
+	};
+	markDirty = () => {
+		this.dirty = true;
+		if (!this.inTransaction) this.persistIfDirty();
+	};
+	persistIfDirty = () => {
+		if (!this.dirty) return;
+		const temporaryPath = `${this.databasePath}.tmp`;
+		writeFileSync(temporaryPath, this.database.export());
+		renameSync(temporaryPath, this.databasePath);
+		this.dirty = false;
+	};
+};
+var PortableSqliteLease = class {
+	closed = false;
+	constructor(owner) {
+		this.owner = owner;
+	}
+	close = () => {
+		if (this.closed) return;
+		this.closed = true;
+		this.owner.release();
+	};
+	exec = (sql) => this.owner.exec(sql);
+	prepare = (sql) => this.owner.prepare(sql);
+};
+var PortableSqliteStatement = class {
+	constructor(database, sql) {
+		this.database = database;
+		this.sql = sql;
+	}
+	all = (...params) => this.database.readRows(this.sql, params);
+	get = (...params) => this.all(...params)[0];
+	run = (...params) => {
+		this.database.run(this.sql, params);
+		return {};
+	};
+};
+function bindStatement(statement, params) {
+	const normalized = normalizeParams(params);
+	if (Array.isArray(normalized) && normalized.length === 0) return;
+	statement.bind(normalized);
+}
+function normalizeParams(params) {
+	if (params.length !== 1 || !isRecord$9(params[0])) return params;
+	return Object.fromEntries(Object.entries(params[0]).map(([key, value]) => [`@${key}`, value]));
+}
+function isRecord$9(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/features/projects/stores/project-work-activity.store.ts
+var ProjectWorkActivityStore = class {
+	constructor(db) {
+		this.db = db;
+	}
+	listActivities = async (projectId, workItemId, options) => {
+		const { cursor, limit } = options;
+		const cursorSequence = cursor ? Number(cursor) : null;
+		if (cursorSequence !== null && !Number.isInteger(cursorSequence)) throw new Error("PROJECT_WORK_ACTIVITY_CURSOR_INVALID");
+		const rows = this.db().prepare(`SELECT rowid AS sequence, * FROM project_work_activities
+         WHERE project_id = ? AND work_item_id = ? ${cursorSequence !== null ? "AND rowid < ?" : ""}
+         ORDER BY rowid DESC LIMIT ?`).all(projectId, workItemId, ...cursorSequence !== null ? [cursorSequence] : [], limit + 1);
+		const hasMore = rows.length > limit;
+		const pageRows = rows.slice(0, limit);
+		return {
+			activities: pageRows.map(toActivity),
+			nextCursor: hasMore ? String(pageRows.at(-1)?.sequence) : null
+		};
+	};
+	listArtifacts = async (projectId, workItemId) => this.db().prepare(`SELECT * FROM project_work_artifact_links
+           WHERE project_id = ? AND work_item_id = ? ORDER BY created_at DESC`).all(projectId, workItemId).map(toArtifactLink);
+	linkArtifact = async (params) => {
+		const { actor, label, path, projectId, workItemId } = params;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const id = randomUUID();
+		runSqliteTransaction(this.db(), () => {
+			this.db().prepare(`INSERT INTO project_work_artifact_links
+             (id, project_id, work_item_id, path, label, created_at) VALUES (?, ?, ?, ?, ?, ?)`).run(id, projectId, workItemId, path, label ?? null, now);
+			this.insertActivity({
+				projectId,
+				workItemId,
+				type: "artifact-linked",
+				actor,
+				details: {
+					artifactLinkId: id,
+					path
+				},
+				createdAt: now
+			});
+		}, "IMMEDIATE");
+		return (await this.listArtifacts(projectId, workItemId)).find((link) => link.id === id);
+	};
+	unlinkArtifact = async (params) => {
+		const { actor, artifactLinkId, projectId, workItemId } = params;
+		const link = this.db().prepare(`SELECT * FROM project_work_artifact_links
+         WHERE project_id = ? AND work_item_id = ? AND id = ? LIMIT 1`).get(projectId, workItemId, artifactLinkId);
+		if (!link) return false;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		runSqliteTransaction(this.db(), () => {
+			this.db().prepare("DELETE FROM project_work_artifact_links WHERE project_id = ? AND work_item_id = ? AND id = ?").run(projectId, workItemId, artifactLinkId);
+			this.insertActivity({
+				projectId,
+				workItemId,
+				type: "artifact-unlinked",
+				actor,
+				details: {
+					artifactLinkId: link.id,
+					path: link.path
+				},
+				createdAt: now
+			});
+		}, "IMMEDIATE");
+		return true;
+	};
+	insertActivity = (activity) => {
+		this.db().prepare(`INSERT INTO project_work_activities
+         (id, project_id, work_item_id, type, actor_json, details_json, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`).run(randomUUID(), activity.projectId, activity.workItemId, activity.type, JSON.stringify(activity.actor), JSON.stringify(activity.details), activity.createdAt);
+	};
+};
+function toActivity(row) {
+	return {
+		id: row.id,
+		projectId: row.project_id,
+		workItemId: row.work_item_id,
+		type: row.type,
+		actor: JSON.parse(row.actor_json),
+		details: JSON.parse(row.details_json),
+		createdAt: row.created_at
+	};
+}
+function toArtifactLink(row) {
+	return {
+		id: row.id,
+		projectId: row.project_id,
+		workItemId: row.work_item_id,
+		path: row.path,
+		label: row.label,
+		createdAt: row.created_at
+	};
+}
+//#endregion
+//#region src/features/projects/stores/project-work-state.store.ts
+const DEFAULT_PROJECT_WORK_STATES = [
+	{
+		name: "Backlog",
+		category: "backlog",
+		position: 0,
+		isDefault: false
+	},
+	{
+		name: "Planned",
+		category: "unstarted",
+		position: 1,
+		isDefault: true
+	},
+	{
+		name: "In Progress",
+		category: "started",
+		position: 2,
+		isDefault: false
+	},
+	{
+		name: "In Review",
+		category: "started",
+		position: 3,
+		isDefault: false
+	},
+	{
+		name: "Awaiting Acceptance",
+		category: "started",
+		position: 4,
+		isDefault: false
+	},
+	{
+		name: "Completed",
+		category: "completed",
+		position: 5,
+		isDefault: false
+	},
+	{
+		name: "Canceled",
+		category: "canceled",
+		position: 6,
+		isDefault: false
+	}
+];
+var ProjectWorkStateStore = class {
+	constructor(db, insertActivity) {
+		this.db = db;
+		this.insertActivity = insertActivity;
+	}
+	ensureProject = async (projectId) => {
+		if (this.db().prepare("SELECT COUNT(*) AS total FROM project_work_states WHERE project_id = ?").get(projectId).total > 0) return;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		runSqliteTransaction(this.db(), () => {
+			if (this.db().prepare("SELECT COUNT(*) AS total FROM project_work_states WHERE project_id = ?").get(projectId).total > 0) return;
+			const insert = this.db().prepare(`INSERT INTO project_work_states
+           (id, project_id, name, category, position, is_default, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+			for (const state of DEFAULT_PROJECT_WORK_STATES) insert.run(randomUUID(), projectId, state.name, state.category, state.position, state.isDefault ? 1 : 0, now, now);
+		}, "IMMEDIATE");
+	};
+	listStates = async (projectId) => this.db().prepare("SELECT * FROM project_work_states WHERE project_id = ? ORDER BY position, created_at").all(projectId).map(toState);
+	getState = async (projectId, stateId) => {
+		const row = this.db().prepare("SELECT * FROM project_work_states WHERE project_id = ? AND id = ? LIMIT 1").get(projectId, stateId);
+		return row ? toState(row) : null;
+	};
+	createState = async (projectId, input) => {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const id = randomUUID();
+		const position = input.position ?? this.nextStatePosition(projectId);
+		runSqliteTransaction(this.db(), () => {
+			if (input.isDefault) this.clearDefaultState(projectId);
+			this.db().prepare(`INSERT INTO project_work_states
+             (id, project_id, name, category, position, is_default, created_at, updated_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(id, projectId, input.name, input.category, position, input.isDefault ? 1 : 0, now, now);
+		}, "IMMEDIATE");
+		return await this.getState(projectId, id);
+	};
+	updateState = async (projectId, stateId, input) => {
+		const current = await this.getState(projectId, stateId);
+		if (!current) return null;
+		const next = {
+			...current,
+			...input,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		runSqliteTransaction(this.db(), () => {
+			if (next.isDefault) this.clearDefaultState(projectId);
+			this.db().prepare(`UPDATE project_work_states
+             SET name = ?, category = ?, position = ?, is_default = ?, updated_at = ?
+             WHERE project_id = ? AND id = ?`).run(next.name, next.category, next.position, next.isDefault ? 1 : 0, next.updatedAt, projectId, stateId);
+		}, "IMMEDIATE");
+		return await this.getState(projectId, stateId);
+	};
+	deleteState = async (projectId, stateId, migrateToStateId, actor) => {
+		const current = await this.getState(projectId, stateId);
+		if (!current) return false;
+		runSqliteTransaction(this.db(), () => {
+			if (this.db().prepare("SELECT COUNT(*) AS total FROM project_work_items WHERE project_id = ? AND state_id = ?").get(projectId, stateId).total > 0 && !migrateToStateId) throw new Error("PROJECT_WORK_STATE_IN_USE");
+			if (migrateToStateId) this.migrateItems(projectId, stateId, migrateToStateId, actor);
+			this.db().prepare("DELETE FROM project_work_states WHERE project_id = ? AND id = ?").run(projectId, stateId);
+			if (current.isDefault) this.assignReplacementDefault(projectId, migrateToStateId);
+		}, "IMMEDIATE");
+		return true;
+	};
+	migrateItems = (projectId, stateId, migrateToStateId, actor) => {
+		const affected = this.db().prepare("SELECT id FROM project_work_items WHERE project_id = ? AND state_id = ?").all(projectId, stateId);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		this.db().prepare(`UPDATE project_work_items
+         SET state_id = ?, version = version + 1, updated_at = ?
+         WHERE project_id = ? AND state_id = ?`).run(migrateToStateId, now, projectId, stateId);
+		for (const item of affected) this.insertActivity({
+			projectId,
+			workItemId: item.id,
+			type: "state-changed",
+			actor,
+			details: {
+				fromStateId: stateId,
+				toStateId: migrateToStateId,
+				reason: "state-deleted"
+			},
+			createdAt: now
+		});
+	};
+	assignReplacementDefault = (projectId, migrateToStateId) => {
+		const replacement = migrateToStateId ?? this.db().prepare("SELECT id FROM project_work_states WHERE project_id = ? ORDER BY position LIMIT 1").get(projectId)?.id;
+		if (replacement) this.db().prepare("UPDATE project_work_states SET is_default = 1 WHERE project_id = ? AND id = ?").run(projectId, replacement);
+	};
+	nextStatePosition = (projectId) => {
+		return this.db().prepare("SELECT COALESCE(MAX(position), -1) + 1 AS position FROM project_work_states WHERE project_id = ?").get(projectId).position;
+	};
+	clearDefaultState = (projectId) => {
+		this.db().prepare("UPDATE project_work_states SET is_default = 0 WHERE project_id = ?").run(projectId);
+	};
+};
+function toState(row) {
+	return {
+		id: row.id,
+		projectId: row.project_id,
+		name: row.name,
+		category: row.category,
+		position: row.position,
+		isDefault: Boolean(row.is_default),
+		createdAt: row.created_at,
+		updatedAt: row.updated_at
+	};
+}
+//#endregion
+//#region src/features/projects/stores/project-work.store.ts
+var ProjectWorkStore = class {
+	database = null;
+	readyPromise = null;
+	activities = new ProjectWorkActivityStore(() => this.db());
+	states = new ProjectWorkStateStore(() => this.db(), this.activities.insertActivity);
+	constructor(databasePath) {
+		this.databasePath = databasePath;
+	}
+	initialize = async () => await this.ensureReady();
+	close = () => {
+		this.database?.close();
+		this.database = null;
+		this.readyPromise = null;
+	};
+	ensureProject = async (projectId) => {
+		await this.ensureReady();
+		await this.states.ensureProject(projectId);
+	};
+	listStates = async (projectId) => {
+		await this.ensureReady();
+		return await this.states.listStates(projectId);
+	};
+	getState = async (projectId, stateId) => {
+		await this.ensureReady();
+		return await this.states.getState(projectId, stateId);
+	};
+	createState = async (projectId, input) => {
+		await this.ensureReady();
+		return await this.states.createState(projectId, input);
+	};
+	updateState = async (projectId, stateId, input) => {
+		await this.ensureReady();
+		return await this.states.updateState(projectId, stateId, input);
+	};
+	deleteState = async (projectId, stateId, migrateToStateId, actor) => {
+		await this.ensureReady();
+		return await this.states.deleteState(projectId, stateId, migrateToStateId, actor);
+	};
+	listItems = async (projectId, includeDeleted = false) => {
+		await this.ensureReady();
+		return this.db().prepare(`SELECT * FROM project_work_items
+       WHERE project_id = ? ${includeDeleted ? "" : "AND deleted_at IS NULL"}
+       ORDER BY updated_at DESC, created_at DESC`).all(projectId).map(toItem);
+	};
+	getItem = async (projectId, workItemId) => {
+		await this.ensureReady();
+		const row = this.db().prepare("SELECT * FROM project_work_items WHERE project_id = ? AND id = ? LIMIT 1").get(projectId, workItemId);
+		return row ? toItem(row) : null;
+	};
+	createItem = async (params) => {
+		await this.ensureReady();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const id = randomUUID();
+		runSqliteTransaction(this.db(), () => {
+			this.db().prepare(`INSERT INTO project_work_items
+         (id, project_id, title, description, state_id, attention, version, created_at, updated_at, deleted_at)
+         VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`).run(id, params.projectId, params.input.title, params.input.description ?? "", params.stateId, params.input.attention ?? "none", now, now);
+			this.activities.insertActivity({
+				projectId: params.projectId,
+				workItemId: id,
+				type: "created",
+				actor: params.actor,
+				details: { stateId: params.stateId },
+				createdAt: now
+			});
+		}, "IMMEDIATE");
+		return await this.getItem(params.projectId, id);
+	};
+	updateItem = async (params) => {
+		await this.ensureReady();
+		const { actor, input, projectId, workItemId } = params;
+		const current = await this.getItem(projectId, workItemId);
+		if (!current) return null;
+		if (input.expectedVersion !== void 0 && input.expectedVersion !== current.version) throw new Error("PROJECT_WORK_VERSION_CONFLICT");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const next = {
+			...current,
+			...input
+		};
+		runSqliteTransaction(this.db(), () => {
+			this.db().prepare(`UPDATE project_work_items SET title = ?, description = ?, state_id = ?, attention = ?,
+         version = version + 1, updated_at = ? WHERE project_id = ? AND id = ?`).run(next.title, next.description, next.stateId, next.attention, now, projectId, workItemId);
+			const stateChanged = next.stateId !== current.stateId;
+			this.activities.insertActivity({
+				projectId,
+				workItemId,
+				type: stateChanged ? "state-changed" : "updated",
+				actor,
+				details: stateChanged ? {
+					fromStateId: current.stateId,
+					toStateId: next.stateId
+				} : changedItemFields(current, next),
+				createdAt: now
+			});
+		}, "IMMEDIATE");
+		return await this.getItem(projectId, workItemId);
+	};
+	setDeleted = async (params) => {
+		await this.ensureReady();
+		const { actor, deleted, projectId, workItemId } = params;
+		if (!await this.getItem(projectId, workItemId)) return null;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		runSqliteTransaction(this.db(), () => {
+			this.db().prepare(`UPDATE project_work_items SET deleted_at = ?, version = version + 1, updated_at = ?
+         WHERE project_id = ? AND id = ?`).run(deleted ? now : null, now, projectId, workItemId);
+			this.activities.insertActivity({
+				projectId,
+				workItemId,
+				type: deleted ? "deleted" : "restored",
+				actor,
+				details: {},
+				createdAt: now
+			});
+		}, "IMMEDIATE");
+		return await this.getItem(projectId, workItemId);
+	};
+	listActivities = async (projectId, workItemId, options) => {
+		await this.ensureReady();
+		return await this.activities.listActivities(projectId, workItemId, options);
+	};
+	listArtifacts = async (projectId, workItemId) => {
+		await this.ensureReady();
+		return await this.activities.listArtifacts(projectId, workItemId);
+	};
+	linkArtifact = async (params) => {
+		await this.ensureReady();
+		return await this.activities.linkArtifact(params);
+	};
+	unlinkArtifact = async (params) => {
+		await this.ensureReady();
+		return await this.activities.unlinkArtifact(params);
+	};
+	ensureReady = async () => {
+		this.readyPromise ??= this.open();
+		await this.readyPromise;
+	};
+	open = async () => {
+		await mkdir(dirname(this.databasePath), { recursive: true });
+		this.database = await openSqliteDatabase(this.databasePath);
+		this.database.exec(`
+      PRAGMA busy_timeout = 10000;
+      PRAGMA journal_mode = WAL;
+      PRAGMA synchronous = NORMAL;
+      PRAGMA foreign_keys = ON;
+      CREATE TABLE IF NOT EXISTS project_work_states (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        category TEXT NOT NULL,
+        position INTEGER NOT NULL,
+        is_default INTEGER NOT NULL DEFAULT 0,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, name)
+      );
+      CREATE TABLE IF NOT EXISTS project_work_items (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        title TEXT NOT NULL,
+        description TEXT NOT NULL DEFAULT '',
+        state_id TEXT NOT NULL,
+        attention TEXT NOT NULL DEFAULT 'none',
+        version INTEGER NOT NULL DEFAULT 1,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        deleted_at TEXT,
+        FOREIGN KEY(state_id) REFERENCES project_work_states(id)
+      );
+      CREATE TABLE IF NOT EXISTS project_work_activities (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        work_item_id TEXT NOT NULL,
+        type TEXT NOT NULL,
+        actor_json TEXT NOT NULL,
+        details_json TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        FOREIGN KEY(work_item_id) REFERENCES project_work_items(id)
+      );
+      CREATE TABLE IF NOT EXISTS project_work_artifact_links (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        work_item_id TEXT NOT NULL,
+        path TEXT NOT NULL,
+        label TEXT,
+        created_at TEXT NOT NULL,
+        UNIQUE(project_id, work_item_id, path),
+        FOREIGN KEY(work_item_id) REFERENCES project_work_items(id)
+      );
+      CREATE INDEX IF NOT EXISTS project_work_items_list_idx
+      ON project_work_items(project_id, deleted_at, updated_at);
+      CREATE INDEX IF NOT EXISTS project_work_activity_timeline_idx
+      ON project_work_activities(project_id, work_item_id, created_at);
+    `);
+	};
+	db = () => {
+		if (!this.database) throw new Error("Project work database is not initialized.");
+		return this.database;
+	};
+};
+function toItem(row) {
+	return {
+		id: row.id,
+		projectId: row.project_id,
+		title: row.title,
+		description: row.description,
+		stateId: row.state_id,
+		attention: row.attention,
+		version: row.version,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at,
+		deletedAt: row.deleted_at
+	};
+}
+function changedItemFields(current, next) {
+	const fields = {};
+	if (current.title !== next.title) fields.title = {
+		from: current.title,
+		to: next.title
+	};
+	if (current.description !== next.description) fields.descriptionChanged = true;
+	if (current.attention !== next.attention) fields.attention = {
+		from: current.attention,
+		to: next.attention
+	};
+	return fields;
+}
+//#endregion
+//#region src/features/projects/types/project-work-error.types.ts
+var ProjectWorkError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ProjectWorkError";
+	}
+};
+function isProjectWorkError(error) {
+	return error instanceof ProjectWorkError;
+}
+//#endregion
+//#region src/features/projects/types/project-work.types.ts
+const PROJECT_WORK_STATE_CATEGORIES = [
+	"backlog",
+	"unstarted",
+	"started",
+	"completed",
+	"canceled"
+];
+const PROJECT_WORK_ATTENTION_VALUES = [
+	"none",
+	"blocked",
+	"awaiting-user"
+];
+//#endregion
+//#region src/features/projects/managers/project-work.manager.ts
+var ProjectWorkManager = class {
+	store;
+	constructor(options) {
+		this.options = options;
+		this.store = new ProjectWorkStore(options.databasePath);
+	}
+	initialize = async () => {
+		await this.store.initialize();
+		for (const project of await this.options.projectManager.listProjects()) await this.store.ensureProject(project.id);
+	};
+	dispose = () => this.store.close();
+	ensureProject = async (projectId) => {
+		await this.requireProject(projectId);
+		await this.store.ensureProject(projectId);
+	};
+	list = async (projectId, includeDeleted = false) => {
+		await this.ensureProject(projectId);
+		const [states, items] = await Promise.all([this.store.listStates(projectId), this.store.listItems(projectId, includeDeleted)]);
+		const stateById = new Map(states.map((state) => [state.id, state]));
+		const detailed = await Promise.all(items.map(async (item) => ({
+			...item,
+			state: this.requireMappedState(stateById, item.stateId),
+			artifacts: await this.store.listArtifacts(projectId, item.id)
+		})));
+		return {
+			items: detailed,
+			states,
+			total: detailed.length
+		};
+	};
+	summary = async (projectId) => {
+		const { items } = await this.list(projectId);
+		return {
+			total: items.length,
+			active: items.filter((item) => item.state.category !== "completed" && item.state.category !== "canceled").length,
+			completed: items.filter((item) => item.state.category === "completed").length,
+			attention: items.filter((item) => item.attention !== "none").length,
+			updatedAt: items[0]?.updatedAt ?? null
+		};
+	};
+	get = async (projectId, workItemId) => {
+		await this.ensureProject(projectId);
+		const item = await this.store.getItem(projectId, workItemId);
+		if (!item) throw new ProjectWorkError("PROJECT_WORK_ITEM_NOT_FOUND", "work item was not found");
+		const state = await this.store.getState(projectId, item.stateId);
+		if (!state) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		return {
+			...item,
+			state,
+			artifacts: await this.store.listArtifacts(projectId, workItemId)
+		};
+	};
+	create = async (projectId, input, actor) => {
+		await this.ensureProject(projectId);
+		const title = this.requireName(input.title, "work item title");
+		const attention = input.attention ?? "none";
+		this.assertAttention(attention);
+		const states = await this.store.listStates(projectId);
+		const state = input.stateId ? states.find((entry) => entry.id === input.stateId) : states.find((entry) => entry.isDefault);
+		if (!state) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		const item = await this.store.createItem({
+			projectId,
+			actor: this.normalizeActor(actor),
+			stateId: state.id,
+			input: {
+				title,
+				description: input.description?.trim() ?? "",
+				attention
+			}
+		});
+		await this.emit(projectId, "created", item.id);
+		return await this.get(projectId, item.id);
+	};
+	update = async (projectId, workItemId, input, actor) => {
+		await this.ensureProject(projectId);
+		const current = await this.get(projectId, workItemId);
+		if (input.expectedVersion !== void 0 && input.expectedVersion !== current.version) throw new ProjectWorkError("PROJECT_WORK_VERSION_CONFLICT", "work item changed since it was loaded");
+		const normalizedInput = {
+			...input,
+			...input.title !== void 0 ? { title: this.requireName(input.title, "work item title") } : {},
+			...input.description !== void 0 ? { description: input.description.trim() } : {}
+		};
+		if (normalizedInput.attention !== void 0) this.assertAttention(normalizedInput.attention);
+		if (normalizedInput.stateId !== void 0 && !await this.store.getState(projectId, normalizedInput.stateId)) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		if ((normalizedInput.title === void 0 || normalizedInput.title === current.title) && (normalizedInput.description === void 0 || normalizedInput.description === current.description) && (normalizedInput.stateId === void 0 || normalizedInput.stateId === current.stateId) && (normalizedInput.attention === void 0 || normalizedInput.attention === current.attention)) return current;
+		let item;
+		try {
+			item = await this.store.updateItem({
+				projectId,
+				workItemId,
+				input: normalizedInput,
+				actor: this.normalizeActor(actor)
+			});
+		} catch (error) {
+			if (error instanceof Error && error.message === "PROJECT_WORK_VERSION_CONFLICT") throw new ProjectWorkError("PROJECT_WORK_VERSION_CONFLICT", "work item changed since it was loaded");
+			throw error;
+		}
+		if (!item) throw new ProjectWorkError("PROJECT_WORK_ITEM_NOT_FOUND", "work item was not found");
+		await this.emit(projectId, "updated", workItemId);
+		return await this.get(projectId, workItemId);
+	};
+	delete = async (projectId, workItemId, actor) => {
+		return await this.setDeleted(projectId, workItemId, true, actor);
+	};
+	restore = async (projectId, workItemId, actor) => {
+		return await this.setDeleted(projectId, workItemId, false, actor);
+	};
+	listActivities = async (projectId, workItemId, options = {}) => {
+		await this.get(projectId, workItemId);
+		if (options.cursor && !/^\d+$/.test(options.cursor)) throw new ProjectWorkError("PROJECT_WORK_VALIDATION_FAILED", "work item activity cursor is invalid");
+		return await this.store.listActivities(projectId, workItemId, {
+			...options.cursor ? { cursor: options.cursor } : {},
+			limit: Math.min(100, Math.max(1, options.limit ?? 50))
+		});
+	};
+	listStates = async (projectId) => {
+		await this.ensureProject(projectId);
+		return await this.store.listStates(projectId);
+	};
+	createState = async (projectId, input) => {
+		await this.ensureProject(projectId);
+		const normalized = {
+			...input,
+			name: this.requireName(input.name, "state name")
+		};
+		this.assertCategory(normalized.category);
+		if ((await this.store.listStates(projectId)).some((state) => state.name.toLocaleLowerCase() === normalized.name.toLocaleLowerCase())) throw new ProjectWorkError("PROJECT_WORK_STATE_INVALID", "state name is already in use");
+		const state = await this.store.createState(projectId, normalized);
+		await this.emit(projectId, "state-config");
+		return state;
+	};
+	updateState = async (projectId, stateId, input) => {
+		await this.ensureProject(projectId);
+		const normalizedInput = {
+			...input,
+			...input.name !== void 0 ? { name: this.requireName(input.name, "state name") } : {}
+		};
+		if (normalizedInput.category !== void 0) this.assertCategory(normalizedInput.category);
+		const current = await this.store.getState(projectId, stateId);
+		if (!current) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		if (current.isDefault && normalizedInput.isDefault === false) throw new ProjectWorkError("PROJECT_WORK_STATE_INVALID", "choose another default state before clearing this one");
+		if (normalizedInput.name && (await this.store.listStates(projectId)).some((state) => state.id !== stateId && state.name.toLocaleLowerCase() === normalizedInput.name.toLocaleLowerCase())) throw new ProjectWorkError("PROJECT_WORK_STATE_INVALID", "state name is already in use");
+		const state = await this.store.updateState(projectId, stateId, normalizedInput);
+		if (!state) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		await this.emit(projectId, "state-config");
+		return state;
+	};
+	deleteState = async (projectId, stateId, migrateToStateId, actor) => {
+		await this.ensureProject(projectId);
+		const states = await this.store.listStates(projectId);
+		if (states.length <= 1) throw new ProjectWorkError("PROJECT_WORK_STATE_INVALID", "a project must keep at least one state");
+		if (migrateToStateId === stateId) throw new ProjectWorkError("PROJECT_WORK_STATE_INVALID", "migration target must be a different state");
+		if (migrateToStateId && !states.some((state) => state.id === migrateToStateId)) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "migration target state was not found");
+		try {
+			if (!await this.store.deleteState(projectId, stateId, migrateToStateId, this.normalizeActor(actor))) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		} catch (error) {
+			if (error instanceof Error && error.message === "PROJECT_WORK_STATE_IN_USE") throw new ProjectWorkError("PROJECT_WORK_STATE_IN_USE", "state is used by work items; choose a migration target");
+			throw error;
+		}
+		await this.emit(projectId, "state-config");
+	};
+	linkArtifact = async (params) => {
+		const { actor, label, path, projectId, workItemId } = params;
+		const project = await this.requireProject(projectId);
+		await this.get(projectId, workItemId);
+		const artifactPath = await this.normalizeArtifactPath(project.rootPath, path);
+		const existing = (await this.store.listArtifacts(projectId, workItemId)).find((link) => link.path === artifactPath);
+		if (existing) return existing;
+		const link = await this.store.linkArtifact({
+			projectId,
+			workItemId,
+			path: artifactPath,
+			label: label?.trim() || void 0,
+			actor: this.normalizeActor(actor)
+		});
+		await this.emit(projectId, "artifact", workItemId);
+		return link;
+	};
+	unlinkArtifact = async (params) => {
+		const { actor, artifactLinkId, projectId, workItemId } = params;
+		await this.get(projectId, workItemId);
+		if (!await this.store.unlinkArtifact({
+			projectId,
+			workItemId,
+			artifactLinkId,
+			actor: this.normalizeActor(actor)
+		})) throw new ProjectWorkError("PROJECT_WORK_ARTIFACT_NOT_FOUND", "artifact link was not found");
+		await this.emit(projectId, "artifact", workItemId);
+	};
+	setDeleted = async (projectId, workItemId, deleted, actor) => {
+		await this.ensureProject(projectId);
+		const current = await this.get(projectId, workItemId);
+		if (current.deletedAt !== null === deleted) return current;
+		if (!await this.store.setDeleted({
+			projectId,
+			workItemId,
+			deleted,
+			actor: this.normalizeActor(actor)
+		})) throw new ProjectWorkError("PROJECT_WORK_ITEM_NOT_FOUND", "work item was not found");
+		await this.emit(projectId, deleted ? "deleted" : "restored", workItemId);
+		return await this.get(projectId, workItemId);
+	};
+	requireProject = async (projectId) => {
+		const normalized = projectId.trim();
+		const project = normalized ? await this.options.projectManager.getProjectById(normalized) : null;
+		if (!project) throw new ProjectWorkError("PROJECT_NOT_FOUND", "project was not found");
+		return project;
+	};
+	requireMappedState = (states, stateId) => {
+		const state = states.get(stateId);
+		if (!state) throw new ProjectWorkError("PROJECT_WORK_STATE_NOT_FOUND", "work item state was not found");
+		return state;
+	};
+	requireName = (value, label) => {
+		const normalized = typeof value === "string" ? value.trim() : "";
+		if (!normalized) throw new ProjectWorkError("PROJECT_WORK_VALIDATION_FAILED", `${label} is required`);
+		if (normalized.length > 200) throw new ProjectWorkError("PROJECT_WORK_VALIDATION_FAILED", `${label} is too long`);
+		return normalized;
+	};
+	assertAttention = (value) => {
+		if (!PROJECT_WORK_ATTENTION_VALUES.some((entry) => entry === value)) throw new ProjectWorkError("PROJECT_WORK_VALIDATION_FAILED", "work item attention is invalid");
+	};
+	assertCategory = (value) => {
+		if (!PROJECT_WORK_STATE_CATEGORIES.some((entry) => entry === value)) throw new ProjectWorkError("PROJECT_WORK_VALIDATION_FAILED", "work item state category is invalid");
+	};
+	normalizeActor = (actor) => ({
+		kind: actor.kind,
+		...actor.id?.trim() ? { id: actor.id.trim() } : {},
+		...actor.sessionId?.trim() ? { sessionId: actor.sessionId.trim() } : {}
+	});
+	normalizeArtifactPath = async (rootPath, inputPath) => {
+		const requested = inputPath.trim();
+		if (!requested) throw new ProjectWorkError("PROJECT_WORK_ARTIFACT_INVALID", "artifact path is required");
+		const canonicalRoot = await realpath(rootPath);
+		const candidate = await realpath(isAbsolute(requested) ? requested : resolve(canonicalRoot, requested)).catch(() => null);
+		if (!candidate) throw new ProjectWorkError("PROJECT_WORK_ARTIFACT_NOT_FOUND", "artifact file does not exist");
+		const relativePath = relative(canonicalRoot, candidate);
+		if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) throw new ProjectWorkError("PROJECT_WORK_ARTIFACT_INVALID", "artifact must be a file inside the project root");
+		if (!(await stat(candidate)).isFile()) throw new ProjectWorkError("PROJECT_WORK_ARTIFACT_INVALID", "artifact must be a file");
+		return relativePath.split(sep).join("/");
+	};
+	emit = async (projectId, change, workItemId) => {
+		await this.options.eventBus.emit(eventKeys$1.projectWorkChanged, {
+			projectId,
+			change,
+			...workItemId ? { workItemId } : {}
+		});
+	};
+};
+//#endregion
+//#region src/features/projects/types/project-observation.types.ts
+const PROJECT_OBSERVATION_PROTOCOL = "nextclaw.project/v1";
+var ProjectObservationError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ProjectObservationError";
+	}
+};
+function isProjectObservationError(error) {
+	return error instanceof ProjectObservationError;
+}
+//#endregion
+//#region src/features/projects/utils/project-observation-config.utils.ts
+const isRecord$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readString$7 = (value) => {
+	if (typeof value !== "string") return null;
+	return value.trim() || null;
+};
+const collectUnknownKeyIssues = (value, allowed, owner) => Object.keys(value).flatMap((key) => allowed.includes(key) ? [] : [{
+	code: "PROJECT_CONFIG_UNKNOWN_FIELD",
+	message: `${owner} contains unknown field '${key}'.`
+}]);
+function parseContext(value) {
+	if (value === void 0) return {
+		value: [],
+		issues: []
+	};
+	if (!Array.isArray(value)) return {
+		value: [],
+		issues: [{
+			code: "PROJECT_CONFIG_CONTEXT_INVALID",
+			message: "project.context must be an array."
+		}]
+	};
+	const issues = [];
+	return {
+		value: value.flatMap((entry, index) => {
+			if (!isRecord$8(entry)) {
+				issues.push({
+					code: "PROJECT_CONFIG_CONTEXT_INVALID",
+					message: `project.context[${index}] must be an object.`
+				});
+				return [];
+			}
+			issues.push(...collectUnknownKeyIssues(entry, [
+				"id",
+				"role",
+				"source"
+			], `project.context[${index}]`));
+			const id = readString$7(entry.id);
+			const role = readString$7(entry.role);
+			const source = readString$7(entry.source);
+			if (!id || !role || !source) {
+				issues.push({
+					code: "PROJECT_CONFIG_CONTEXT_INVALID",
+					message: `project.context[${index}] requires id, role and source.`
+				});
+				return [];
+			}
+			return [{
+				id,
+				role,
+				source
+			}];
+		}),
+		issues
+	};
+}
+function parseWorkflows(value) {
+	if (value === void 0) return {
+		value: [],
+		issues: []
+	};
+	if (!Array.isArray(value)) return {
+		value: [],
+		issues: [{
+			code: "PROJECT_CONFIG_WORKFLOWS_INVALID",
+			message: "workflows must be an array."
+		}]
+	};
+	const issues = [];
+	return {
+		value: value.flatMap((entry, workflowIndex) => {
+			if (!isRecord$8(entry) || !Array.isArray(entry.stages)) {
+				issues.push({
+					code: "PROJECT_CONFIG_WORKFLOW_INVALID",
+					message: `workflows[${workflowIndex}] requires a stages array.`
+				});
+				return [];
+			}
+			issues.push(...collectUnknownKeyIssues(entry, [
+				"id",
+				"label",
+				"stages"
+			], `workflows[${workflowIndex}]`));
+			const id = readString$7(entry.id);
+			const label = readString$7(entry.label);
+			const stages = entry.stages.flatMap((stage, stageIndex) => {
+				if (!isRecord$8(stage)) {
+					issues.push({
+						code: "PROJECT_CONFIG_STAGE_INVALID",
+						message: `workflows[${workflowIndex}].stages[${stageIndex}] must be an object.`
+					});
+					return [];
+				}
+				issues.push(...collectUnknownKeyIssues(stage, ["id", "label"], `workflows[${workflowIndex}].stages[${stageIndex}]`));
+				const stageId = readString$7(stage.id);
+				const stageLabel = readString$7(stage.label);
+				if (!stageId || !stageLabel) {
+					issues.push({
+						code: "PROJECT_CONFIG_STAGE_INVALID",
+						message: `workflows[${workflowIndex}].stages[${stageIndex}] requires id and label.`
+					});
+					return [];
+				}
+				return [{
+					id: stageId,
+					label: stageLabel
+				}];
+			});
+			if (!id || !label) {
+				issues.push({
+					code: "PROJECT_CONFIG_WORKFLOW_INVALID",
+					message: `workflows[${workflowIndex}] requires id and label.`
+				});
+				return [];
+			}
+			return [{
+				id,
+				label,
+				stages
+			}];
+		}),
+		issues
+	};
+}
+function parseArtifactCategories(value) {
+	if (value === void 0) return {
+		value: [],
+		issues: []
+	};
+	if (!Array.isArray(value)) return {
+		value: [],
+		issues: [{
+			code: "PROJECT_CONFIG_ARTIFACTS_INVALID",
+			message: "observation.artifacts must be an array."
+		}]
+	};
+	const issues = [];
+	return {
+		value: value.flatMap((entry, index) => {
+			if (!isRecord$8(entry) || !Array.isArray(entry.include)) {
+				issues.push({
+					code: "PROJECT_CONFIG_ARTIFACT_INVALID",
+					message: `observation.artifacts[${index}] requires an include array.`
+				});
+				return [];
+			}
+			issues.push(...collectUnknownKeyIssues(entry, [
+				"id",
+				"label",
+				"include"
+			], `observation.artifacts[${index}]`));
+			const id = readString$7(entry.id);
+			const label = readString$7(entry.label);
+			const include = entry.include.map(readString$7).filter((pattern) => pattern !== null);
+			if (!id || !label || include.length !== entry.include.length || include.length === 0) {
+				issues.push({
+					code: "PROJECT_CONFIG_ARTIFACT_INVALID",
+					message: `observation.artifacts[${index}] requires id, label and non-empty string patterns.`
+				});
+				return [];
+			}
+			return [{
+				id,
+				label,
+				include
+			}];
+		}),
+		issues
+	};
+}
+function parseSkillRoots(value) {
+	if (value === void 0) return {
+		value: [".agents/skills"],
+		issues: []
+	};
+	if (!Array.isArray(value)) return {
+		value: [],
+		issues: [{
+			code: "PROJECT_CONFIG_SKILLS_INVALID",
+			message: "observation.skills must be an array."
+		}]
+	};
+	const issues = [];
+	return {
+		value: value.flatMap((entry, index) => {
+			if (!isRecord$8(entry)) {
+				issues.push({
+					code: "PROJECT_CONFIG_SKILL_INVALID",
+					message: `observation.skills[${index}] must be an object.`
+				});
+				return [];
+			}
+			issues.push(...collectUnknownKeyIssues(entry, ["root"], `observation.skills[${index}]`));
+			const root = readString$7(entry.root);
+			if (!root) {
+				issues.push({
+					code: "PROJECT_CONFIG_SKILL_INVALID",
+					message: `observation.skills[${index}] requires root.`
+				});
+				return [];
+			}
+			return [root];
+		}),
+		issues
+	};
+}
+function parseProjectObservationConfig(source) {
+	const issues = [];
+	let parsed;
+	try {
+		parsed = parse(source);
+	} catch (error) {
+		return {
+			config: null,
+			issues: [{
+				code: "PROJECT_CONFIG_YAML_INVALID",
+				message: error instanceof Error ? error.message : "project.yaml is invalid YAML."
+			}]
+		};
+	}
+	if (!isRecord$8(parsed)) return {
+		config: null,
+		issues: [{
+			code: "PROJECT_CONFIG_INVALID",
+			message: "project.yaml must contain an object."
+		}]
+	};
+	issues.push(...collectUnknownKeyIssues(parsed, [
+		"schema_version",
+		"project",
+		"workflows",
+		"observation"
+	], "project.yaml"));
+	if (parsed.schema_version !== 1) return {
+		config: null,
+		issues: [{
+			code: "PROJECT_CONFIG_VERSION_UNSUPPORTED",
+			message: "Only schema_version 1 is supported."
+		}, ...issues]
+	};
+	const project = isRecord$8(parsed.project) ? parsed.project : {};
+	const observation = isRecord$8(parsed.observation) ? parsed.observation : {};
+	if (parsed.project !== void 0 && !isRecord$8(parsed.project)) issues.push({
+		code: "PROJECT_CONFIG_PROJECT_INVALID",
+		message: "project must be an object."
+	});
+	if (parsed.observation !== void 0 && !isRecord$8(parsed.observation)) issues.push({
+		code: "PROJECT_CONFIG_OBSERVATION_INVALID",
+		message: "observation must be an object."
+	});
+	issues.push(...collectUnknownKeyIssues(project, ["summary", "context"], "project"));
+	issues.push(...collectUnknownKeyIssues(observation, [
+		"markers",
+		"work_items",
+		"artifacts",
+		"skills"
+	], "observation"));
+	if (observation.markers !== void 0) {
+		if (!(Array.isArray(observation.markers) ? observation.markers : []).some((marker) => isRecord$8(marker) && marker.protocol === "nextclaw.project/v1")) issues.push({
+			code: "PROJECT_CONFIG_MARKERS_INVALID",
+			message: `observation.markers must enable protocol '${PROJECT_OBSERVATION_PROTOCOL}'.`
+		});
+	}
+	const context = parseContext(project.context);
+	const workflows = parseWorkflows(parsed.workflows);
+	const artifactCategories = parseArtifactCategories(observation.artifacts);
+	const skillRoots = parseSkillRoots(observation.skills);
+	issues.push(...context.issues, ...workflows.issues, ...artifactCategories.issues, ...skillRoots.issues);
+	return {
+		config: {
+			...readString$7(project.summary) ? { summary: readString$7(project.summary) } : {},
+			context: context.value,
+			workflows: workflows.value,
+			artifactCategories: artifactCategories.value,
+			skillRoots: skillRoots.value
+		},
+		issues
+	};
+}
+//#endregion
+//#region src/features/projects/utils/project-observation-files.utils.ts
+const IGNORED_DIRECTORIES = new Set([
+	".git",
+	".hg",
+	".svn",
+	"node_modules"
+]);
+const MAX_ARTIFACT_FILES = 1e4;
+const MAX_DEPTH = 12;
+const toPortablePath = (value) => value.split(sep).join("/");
+function globSearchBase(pattern) {
+	const segments = pattern.split("/");
+	const firstDynamicSegment = segments.findIndex((segment) => segment.includes("*") || segment.includes("?"));
+	if (firstDynamicSegment >= 0) return segments.slice(0, firstDynamicSegment).join("/");
+	return segments.slice(0, -1).join("/");
+}
+function shouldVisitDirectory(relativeDirectory, searchBases) {
+	if (!relativeDirectory) return true;
+	return searchBases.some((base) => !base || base === relativeDirectory || base.startsWith(`${relativeDirectory}/`) || relativeDirectory.startsWith(`${base}/`));
+}
+function compareFileRecency(left, right) {
+	return left.updatedAt.localeCompare(right.updatedAt) || left.relativePath.localeCompare(right.relativePath);
+}
+function siftOldestFileDown(files, index) {
+	let parent = index;
+	while (true) {
+		const left = parent * 2 + 1;
+		const right = left + 1;
+		let oldest = parent;
+		if (left < files.length && compareFileRecency(files[left], files[oldest]) < 0) oldest = left;
+		if (right < files.length && compareFileRecency(files[right], files[oldest]) < 0) oldest = right;
+		if (oldest === parent) return;
+		[files[parent], files[oldest]] = [files[oldest], files[parent]];
+		parent = oldest;
+	}
+}
+function keepMostRecentArtifactFile(files, file, maxArtifactFiles) {
+	if (files.length < maxArtifactFiles) {
+		files.push(file);
+		let child = files.length - 1;
+		while (child > 0) {
+			const parent = Math.floor((child - 1) / 2);
+			if (compareFileRecency(files[child], files[parent]) >= 0) break;
+			[files[child], files[parent]] = [files[parent], files[child]];
+			child = parent;
+		}
+		return;
+	}
+	if (compareFileRecency(file, files[0]) <= 0) return;
+	files[0] = file;
+	siftOldestFileDown(files, 0);
+}
+function normalizeProjectRelativePath(value) {
+	const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\//, "");
+	if (!normalized || normalized.startsWith("/") || isAbsolute(normalized)) return null;
+	const segments = normalized.split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) return null;
+	return segments.join("/");
+}
+function resolveInsideProject(rootPath, projectRelativePath) {
+	const normalized = normalizeProjectRelativePath(projectRelativePath);
+	if (!normalized) return null;
+	const target = resolve(rootPath, normalized);
+	const targetRelative = relative(rootPath, target);
+	return targetRelative && !targetRelative.startsWith(`..${sep}`) && targetRelative !== ".." ? target : null;
+}
+async function observeProjectFile(rootPath, projectRelativePath) {
+	const target = resolveInsideProject(rootPath, projectRelativePath);
+	if (!target) return null;
+	try {
+		const targetLstat = await lstat(target);
+		if (targetLstat.isSymbolicLink() || !targetLstat.isFile()) return null;
+		const canonicalRoot = await realpath(rootPath);
+		const canonicalTarget = await realpath(target);
+		const canonicalRelative = relative(canonicalRoot, canonicalTarget);
+		if (canonicalRelative.startsWith(`..${sep}`) || canonicalRelative === "..") return null;
+		const targetStat = await stat(canonicalTarget);
+		return {
+			createdAt: targetStat.birthtime.toISOString(),
+			relativePath: normalizeProjectRelativePath(projectRelativePath),
+			size: targetStat.size,
+			updatedAt: targetStat.mtime.toISOString()
+		};
+	} catch {
+		return null;
+	}
+}
+function globToRegExp(pattern) {
+	const normalized = normalizeProjectRelativePath(pattern);
+	if (!normalized) return null;
+	let source = "^";
+	for (let index = 0; index < normalized.length; index += 1) {
+		const character = normalized[index];
+		const next = normalized[index + 1];
+		if (character === "*" && next === "*") {
+			const after = normalized[index + 2];
+			source += after === "/" ? "(?:.*/)?" : ".*";
+			index += after === "/" ? 2 : 1;
+			continue;
+		}
+		if (character === "*") {
+			source += "[^/]*";
+			continue;
+		}
+		if (character === "?") {
+			source += "[^/]";
+			continue;
+		}
+		source += /[|\\{}()[\]^$+?.]/.test(character) ? `\\${character}` : character;
+	}
+	return new RegExp(`${source}$`);
+}
+async function scanProjectArtifactFiles(rootPath, categories, options = {}) {
+	const issues = [];
+	const compiled = categories.flatMap((category) => category.include.flatMap((pattern) => {
+		const matcher = globToRegExp(pattern);
+		if (!matcher) {
+			issues.push({
+				code: "PROJECT_ARTIFACT_PATTERN_INVALID",
+				message: `Artifact pattern '${pattern}' is not a safe project-relative glob.`,
+				projectRelativePath: pattern
+			});
+			return [];
+		}
+		return [{
+			...category,
+			pattern,
+			matcher
+		}];
+	}));
+	if (compiled.length === 0) return {
+		matches: [],
+		issues
+	};
+	const files = [];
+	let matchedFileCount = 0;
+	const maxArtifactFiles = options.maxArtifactFiles ?? MAX_ARTIFACT_FILES;
+	const searchBases = [...new Set(compiled.map((rule) => globSearchBase(rule.pattern)))];
+	const visit = async (directory, depth) => {
+		if (depth > MAX_DEPTH) return;
+		const entries = await readdir(directory, { withFileTypes: true });
+		for (const entry of entries) {
+			if (entry.isSymbolicLink()) continue;
+			const absolutePath = resolve(directory, entry.name);
+			if (entry.isDirectory()) {
+				const relativeDirectory = toPortablePath(relative(rootPath, absolutePath));
+				if (!IGNORED_DIRECTORIES.has(entry.name) && shouldVisitDirectory(relativeDirectory, searchBases)) await visit(absolutePath, depth + 1);
+				continue;
+			}
+			if (!entry.isFile()) continue;
+			const relativePath = toPortablePath(relative(rootPath, absolutePath));
+			if (!compiled.some((rule) => rule.matcher.test(relativePath))) continue;
+			const fileStat = await stat(absolutePath);
+			matchedFileCount += 1;
+			keepMostRecentArtifactFile(files, {
+				createdAt: fileStat.birthtime.toISOString(),
+				relativePath,
+				size: fileStat.size,
+				updatedAt: fileStat.mtime.toISOString()
+			}, maxArtifactFiles);
+		}
+	};
+	try {
+		await visit(rootPath, 0);
+	} catch (error) {
+		issues.push({
+			code: "PROJECT_ARTIFACT_SCAN_FAILED",
+			message: error instanceof Error ? error.message : "Project artifact scan failed."
+		});
+	}
+	if (matchedFileCount > maxArtifactFiles) issues.push({
+		code: "PROJECT_ARTIFACT_SCAN_LIMIT",
+		message: `Showing the ${maxArtifactFiles} most recently updated files out of ${matchedFileCount} matched artifacts.`
+	});
+	const matchesByPath = /* @__PURE__ */ new Map();
+	for (const rule of compiled) for (const file of files) {
+		if (!rule.matcher.test(file.relativePath) || matchesByPath.has(file.relativePath)) continue;
+		matchesByPath.set(file.relativePath, {
+			...file,
+			categoryId: rule.id,
+			categoryLabel: rule.label
+		});
+	}
+	return {
+		matches: [...matchesByPath.values()],
+		issues
+	};
+}
+//#endregion
+//#region src/features/projects/utils/project-observation-projection.utils.ts
+const projectObservationConfigReference = (asOf) => ({
+	kind: "project-config",
+	label: "项目配置",
+	observedAt: asOf,
+	projectRelativePath: ".nextclaw/project.yaml"
+});
+const projectObservationFileReference = (path, observedAt) => ({
+	kind: "file-observation",
+	label: "文件观测",
+	observedAt,
+	projectRelativePath: path
+});
+const markerReference = (marker) => ({
+	kind: "ai-report",
+	label: "AI 报告",
+	observedAt: marker.timestamp,
+	sessionId: marker.sessionId,
+	messageId: marker.messageId
+});
+const markerActivityMessage = (marker) => {
+	switch (marker.kind) {
+		case "work-item": return `AI 报告工作项“${marker.name}”为 ${marker.status}`;
+		case "artifact": return `AI 报告产物 ${marker.path}`;
+		case "schedule": return `AI 报告 ${marker.itemId} 的计划信息`;
+		case "signal": return marker.message;
+		case "request": return marker.prompt;
+	}
+};
+const readOptionalString$9 = (value) => {
+	if (typeof value !== "string") return void 0;
+	return value.trim() || void 0;
+};
+const readProjectRunState = (session) => {
+	const state = (session.metadata?.last_activity_preview)?.state;
+	if (state === "running" || state === "completed" || state === "failed" || state === "cancelled" || state === "idle") return state;
+	return session.status === "running" ? "running" : "idle";
+};
+function projectObservedRuns(sessions, markers) {
+	const latestWorkItemIdBySession = /* @__PURE__ */ new Map();
+	for (const marker of markers) if (marker.kind === "work-item") latestWorkItemIdBySession.set(marker.sessionId, marker.id);
+	return sessions.map((session) => {
+		const preview = session.metadata?.last_activity_preview;
+		const updatedAt = readOptionalString$9(preview?.timestamp) ?? session.lastMessageAt ?? session.updatedAt;
+		const model = readOptionalString$9(session.metadata?.preferred_model) ?? readOptionalString$9(session.metadata?.preferredModel) ?? readOptionalString$9(session.metadata?.model);
+		const label = readOptionalString$9(session.metadata?.label);
+		const statusText = readOptionalString$9(preview?.statusText);
+		const workItemId = latestWorkItemIdBySession.get(session.sessionId);
+		return {
+			sessionId: session.sessionId,
+			state: readProjectRunState(session),
+			updatedAt,
+			...session.agentId ? { agentId: session.agentId } : {},
+			...model ? { model } : {},
+			...label ? { label } : {},
+			...statusText ? { statusText } : {},
+			...workItemId ? { workItemId } : {},
+			reference: {
+				kind: "system-record",
+				label: "会话运行",
+				observedAt: updatedAt,
+				sessionId: session.sessionId
+			}
+		};
+	}).sort((left, right) => {
+		return Number(right.state === "running") - Number(left.state === "running") || right.updatedAt.localeCompare(left.updatedAt);
+	});
+}
+function projectObservedWorkItems(markers, workflows, addDiagnostic) {
+	const workItems = /* @__PURE__ */ new Map();
+	const schedules = /* @__PURE__ */ new Map();
+	for (const marker of markers) {
+		if (marker.kind === "work-item") workItems.set(marker.id, marker);
+		if (marker.kind === "schedule") schedules.set(marker.itemId, marker);
+	}
+	return [...workItems.values()].map((marker) => {
+		const inferredWorkflows = marker.stageId ? workflows.filter((entry) => entry.stages.some((stage) => stage.id === marker.stageId)) : [];
+		const workflow = marker.workflowId ? workflows.find((entry) => entry.id === marker.workflowId) : inferredWorkflows.length === 1 ? inferredWorkflows[0] : void 0;
+		if (marker.workflowId && !workflow) addDiagnostic("sessions", "warning", "PROJECT_MARKER_WORKFLOW_UNKNOWN", `Work item '${marker.id}' references unknown workflow '${marker.workflowId}'.`, {
+			sessionId: marker.sessionId,
+			messageId: marker.messageId
+		});
+		if (marker.stageId && (!workflow || !workflow.stages.some((stage) => stage.id === marker.stageId))) addDiagnostic("sessions", "warning", "PROJECT_MARKER_STAGE_UNKNOWN", `Work item '${marker.id}' references unknown stage '${marker.stageId}'.`, {
+			sessionId: marker.sessionId,
+			messageId: marker.messageId
+		});
+		const schedule = schedules.get(marker.id);
+		return {
+			id: marker.id,
+			name: marker.name,
+			status: marker.status,
+			...workflow ? { workflowId: workflow.id } : {},
+			...workflow && marker.stageId && workflow.stages.some((stage) => stage.id === marker.stageId) ? { stageId: marker.stageId } : {},
+			...schedule ? { schedule: {
+				...schedule.start ? { start: schedule.start } : {},
+				...schedule.end ? { end: schedule.end } : {},
+				milestone: schedule.milestone,
+				dependsOn: schedule.dependsOn
+			} } : {},
+			updatedAt: marker.timestamp,
+			reference: markerReference(marker)
+		};
+	}).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+}
+async function mergeProjectObservedArtifacts(rootPath, observed, config, markers, addDiagnostic) {
+	const artifacts = new Map(observed.map((artifact) => [`${artifact.categoryId}:${artifact.path}`, artifact]));
+	for (const marker of markers) {
+		if (marker.kind !== "artifact") continue;
+		const category = config?.artifactCategories.find((entry) => entry.id === marker.categoryId);
+		const path = normalizeProjectRelativePath(marker.path);
+		const file = path ? await observeProjectFile(rootPath, path) : null;
+		if (!category) addDiagnostic("sessions", "warning", "PROJECT_MARKER_CATEGORY_UNKNOWN", `Artifact marker references unknown category '${marker.categoryId}'.`, {
+			sessionId: marker.sessionId,
+			messageId: marker.messageId
+		});
+		if (!file) addDiagnostic("files", "warning", "PROJECT_MARKER_ARTIFACT_UNAVAILABLE", `Artifact '${marker.path}' is missing or outside the project.`, {
+			projectRelativePath: marker.path,
+			sessionId: marker.sessionId,
+			messageId: marker.messageId
+		});
+		const normalizedPath = path ?? marker.path;
+		const key = `${marker.categoryId}:${normalizedPath}`;
+		const existing = artifacts.get(key);
+		if (existing) {
+			artifacts.set(key, {
+				...existing,
+				itemId: marker.itemId,
+				references: [...existing.references, markerReference(marker)]
+			});
+			continue;
+		}
+		artifacts.set(key, {
+			id: key,
+			path: normalizedPath,
+			categoryId: marker.categoryId,
+			categoryLabel: category?.label ?? marker.categoryId,
+			exists: file !== null,
+			itemId: marker.itemId,
+			...file ? {
+				size: file.size,
+				fileCreatedAt: file.createdAt,
+				fileUpdatedAt: file.updatedAt
+			} : {},
+			references: [markerReference(marker), ...file ? [projectObservationFileReference(file.relativePath, file.updatedAt)] : []]
+		});
+	}
+	return [...artifacts.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+function projectObservedSignals(markers) {
+	const signals = /* @__PURE__ */ new Map();
+	for (const marker of markers) if (marker.kind === "signal") signals.set(marker.id, marker);
+	return [...signals.values()].map((marker) => ({
+		id: marker.id,
+		...marker.itemId ? { itemId: marker.itemId } : {},
+		status: marker.status,
+		level: marker.level,
+		message: marker.message,
+		updatedAt: marker.timestamp,
+		reference: markerReference(marker)
+	})).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+}
+function projectObservedRequests(markers, responses) {
+	const requests = /* @__PURE__ */ new Map();
+	for (const marker of markers) if (marker.kind === "request") requests.set(marker.id, marker);
+	return [...requests.values()].map((marker) => ({
+		id: marker.id,
+		...marker.itemId ? { itemId: marker.itemId } : {},
+		status: marker.status,
+		response: marker.response,
+		prompt: marker.prompt,
+		updatedAt: marker.timestamp,
+		...responses.get(marker.id) ? { reply: responses.get(marker.id) } : {},
+		reference: markerReference(marker)
+	})).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+}
+const projectObservedActivity = (markers) => markers.map((marker) => ({
+	id: `${marker.messageId}:${marker.line}:${marker.kind}`,
+	kind: marker.kind,
+	message: markerActivityMessage(marker),
+	at: marker.timestamp,
+	...marker.kind === "work-item" ? { itemId: marker.id } : marker.kind === "artifact" || marker.kind === "schedule" ? { itemId: marker.itemId } : marker.itemId ? { itemId: marker.itemId } : {},
+	reference: markerReference(marker)
+})).sort((left, right) => right.at.localeCompare(left.at));
+//#endregion
+//#region src/features/projects/utils/project-observation-marker.utils.ts
+function createProjectObservationMarkerParseState() {
+	return {
+		currentWorkItemIdBySession: /* @__PURE__ */ new Map(),
+		requestsById: /* @__PURE__ */ new Map(),
+		workItemsById: /* @__PURE__ */ new Map()
+	};
+}
+const ID_VALUE = "[a-z0-9][a-z0-9._-]*";
+const ID = `(${ID_VALUE})`;
+const OPTIONAL_ID = `(${ID_VALUE}|none)`;
+const TEXT = "([^\"\\]\\r\\n]{1,240})";
+const DATE = "(\\d{4}-\\d{2}-\\d{2}|none)";
+const PREFIX = "\\[nextclaw\\.project/v1 ";
+const LEGACY_WORK_ITEM_PATTERN = new RegExp(`^${PREFIX}kind=work-item id=${ID} title="${TEXT}" workflow=${OPTIONAL_ID} stage=${OPTIONAL_ID} status=(active|blocked|completed|cancelled)\\]$`);
+const LEGACY_ARTIFACT_PATTERN = new RegExp(`^${PREFIX}kind=artifact item=${ID} path="${TEXT}" category=${ID}\\]$`);
+const LEGACY_SCHEDULE_PATTERN = new RegExp(`^${PREFIX}kind=schedule item=${ID} start=${DATE} end=${DATE} milestone=(true|false) depends-on=([a-z0-9._,-]+|none)\\]$`);
+const LEGACY_SIGNAL_PATTERN = new RegExp(`^${PREFIX}kind=signal id=${ID} item=${OPTIONAL_ID} status=(open|resolved) level=(info|attention|warning) message="${TEXT}"\\]$`);
+const LEGACY_REQUEST_PATTERN = new RegExp(`^${PREFIX}kind=request id=${ID} item=${OPTIONAL_ID} status=(open|resolved|expired) response=(confirm-reject|open-session) prompt="${TEXT}"\\]$`);
+const ID_PATTERN = new RegExp(`^${ID_VALUE}$`);
+const FIELD_PATTERN = /([a-z][a-z-]*)=(?:"([^"\\\]\r\n]{1,240})"|([^\s\]]+))/y;
+const WORK_ITEM_STATUSES = new Set([
+	"active",
+	"blocked",
+	"completed",
+	"cancelled"
+]);
+const REQUEST_STATUSES = new Set([
+	"open",
+	"resolved",
+	"expired"
+]);
+const REQUEST_RESPONSES = new Set(["confirm-reject", "open-session"]);
+const optional = (value) => value === "none" ? void 0 : value;
+function parseFields(value) {
+	const fields = /* @__PURE__ */ new Map();
+	let cursor = 0;
+	while (cursor < value.length) {
+		FIELD_PATTERN.lastIndex = cursor;
+		const match = FIELD_PATTERN.exec(value);
+		if (!match || fields.has(match[1])) return null;
+		fields.set(match[1], match[2] ?? match[3]);
+		cursor = FIELD_PATTERN.lastIndex;
+		if (cursor === value.length) break;
+		if (value[cursor] !== " ") return null;
+		cursor += 1;
+	}
+	return fields;
+}
+function hasOnlyFields(fields, allowed) {
+	const allowedSet = new Set(allowed);
+	return [...fields.keys()].every((key) => allowedSet.has(key));
+}
+function rememberWorkItem(marker, state) {
+	state.currentWorkItemIdBySession.set(marker.sessionId, marker.id);
+	state.workItemsById.set(marker.id, {
+		id: marker.id,
+		name: marker.name,
+		...marker.workflowId ? { workflowId: marker.workflowId } : {},
+		...marker.stageId ? { stageId: marker.stageId } : {},
+		status: marker.status
+	});
+}
+function rememberRequest(marker, state) {
+	state.requestsById.set(marker.id, {
+		id: marker.id,
+		...marker.itemId ? { itemId: marker.itemId } : {},
+		status: marker.status,
+		response: marker.response,
+		prompt: marker.prompt
+	});
+}
+function parseLegacyMarkerLine(line, source, state) {
+	let match = LEGACY_WORK_ITEM_PATTERN.exec(line);
+	if (match) {
+		const marker = {
+			...source,
+			kind: "work-item",
+			id: match[1],
+			name: match[2],
+			...optional(match[3]) ? { workflowId: optional(match[3]) } : {},
+			...optional(match[4]) ? { stageId: optional(match[4]) } : {},
+			status: match[5]
+		};
+		rememberWorkItem(marker, state);
+		return marker;
+	}
+	match = LEGACY_ARTIFACT_PATTERN.exec(line);
+	if (match) return {
+		...source,
+		kind: "artifact",
+		itemId: match[1],
+		path: match[2],
+		categoryId: match[3]
+	};
+	match = LEGACY_SCHEDULE_PATTERN.exec(line);
+	if (match) return {
+		...source,
+		kind: "schedule",
+		itemId: match[1],
+		...optional(match[2]) ? { start: optional(match[2]) } : {},
+		...optional(match[3]) ? { end: optional(match[3]) } : {},
+		milestone: match[4] === "true",
+		dependsOn: match[5] === "none" ? [] : match[5].split(",")
+	};
+	match = LEGACY_SIGNAL_PATTERN.exec(line);
+	if (match) return {
+		...source,
+		kind: "signal",
+		id: match[1],
+		...optional(match[2]) ? { itemId: optional(match[2]) } : {},
+		status: match[3],
+		level: match[4],
+		message: match[5]
+	};
+	match = LEGACY_REQUEST_PATTERN.exec(line);
+	if (match) {
+		const marker = {
+			...source,
+			kind: "request",
+			id: match[1],
+			...optional(match[2]) ? { itemId: optional(match[2]) } : {},
+			status: match[3],
+			response: match[4],
+			prompt: match[5]
+		};
+		rememberRequest(marker, state);
+		return marker;
+	}
+	return null;
+}
+function parseCompactWorkItem(body, source, state) {
+	const fields = parseFields(body);
+	if (!fields || fields.size === 0 || !hasOnlyFields(fields, [
+		"id",
+		"name",
+		"workflow",
+		"stage",
+		"status"
+	])) return null;
+	const explicitId = fields.get("id");
+	if (explicitId && !ID_PATTERN.test(explicitId)) return null;
+	const id = explicitId ?? state.currentWorkItemIdBySession.get(source.sessionId);
+	if (!id) return null;
+	const previous = state.workItemsById.get(id);
+	const explicitName = fields.get("name");
+	if (!previous && (!explicitName || !fields.has("stage"))) return null;
+	if (previous && explicitName && explicitName !== previous.name) return null;
+	const statusValue = fields.get("status");
+	if (statusValue && !WORK_ITEM_STATUSES.has(statusValue)) return null;
+	const workflowValue = fields.get("workflow");
+	const stageValue = fields.get("stage");
+	if (workflowValue && workflowValue !== "none" && !ID_PATTERN.test(workflowValue) || stageValue && stageValue !== "none" && !ID_PATTERN.test(stageValue)) return null;
+	const workflowId = workflowValue === void 0 ? previous?.workflowId : optional(workflowValue);
+	const stageId = stageValue === void 0 ? previous?.stageId : optional(stageValue);
+	const marker = {
+		...source,
+		kind: "work-item",
+		id,
+		name: explicitName ?? previous.name,
+		...workflowId ? { workflowId } : {},
+		...stageId ? { stageId } : {},
+		status: statusValue ?? (fields.has("stage") ? "active" : previous?.status ?? "active")
+	};
+	rememberWorkItem(marker, state);
+	return marker;
+}
+function parseCompactArtifact(body, source, state) {
+	const fields = parseFields(body);
+	if (!fields || !hasOnlyFields(fields, [
+		"path",
+		"category",
+		"work-id"
+	])) return null;
+	const path = fields.get("path");
+	const categoryId = fields.get("category");
+	const itemId = fields.get("work-id") ?? state.currentWorkItemIdBySession.get(source.sessionId);
+	if (!path || !categoryId || !itemId || !ID_PATTERN.test(categoryId) || !ID_PATTERN.test(itemId)) return null;
+	return {
+		...source,
+		kind: "artifact",
+		itemId,
+		path,
+		categoryId
+	};
+}
+function parseCompactRequest(body, source, state) {
+	const fields = parseFields(body);
+	if (!fields || !hasOnlyFields(fields, [
+		"request",
+		"work-id",
+		"status",
+		"response",
+		"prompt"
+	])) return null;
+	const id = fields.get("request");
+	if (!id || !ID_PATTERN.test(id)) return null;
+	const previous = state.requestsById.get(id);
+	const itemId = fields.get("work-id") ?? previous?.itemId ?? state.currentWorkItemIdBySession.get(source.sessionId);
+	const statusValue = fields.get("status") ?? previous?.status ?? "open";
+	const responseValue = fields.get("response") ?? previous?.response;
+	const prompt = fields.get("prompt") ?? previous?.prompt;
+	if (!responseValue || !prompt || !REQUEST_STATUSES.has(statusValue) || !REQUEST_RESPONSES.has(responseValue) || itemId && !ID_PATTERN.test(itemId)) return null;
+	const marker = {
+		...source,
+		kind: "request",
+		id,
+		...itemId ? { itemId } : {},
+		status: statusValue,
+		response: responseValue,
+		prompt
+	};
+	rememberRequest(marker, state);
+	return marker;
+}
+function parseCompactMarkerLine(line, source, state) {
+	const prefix = `[${PROJECT_OBSERVATION_PROTOCOL} `;
+	if (!line.startsWith(prefix) || !line.endsWith("]")) return null;
+	const body = line.slice(prefix.length, -1);
+	if (body.startsWith("artifact ")) return parseCompactArtifact(body.slice(9), source, state);
+	if (body.startsWith("request=")) return parseCompactRequest(body, source, state);
+	return parseCompactWorkItem(body, source, state);
+}
+function parseProjectObservationMarkers(params) {
+	const markers = [];
+	const issues = [];
+	const state = params.state ?? createProjectObservationMarkerParseState();
+	let insideFencedCodeBlock = false;
+	params.text.split(/\r?\n/).forEach((rawLine, index) => {
+		const line = rawLine.trim();
+		if (line.startsWith("```")) {
+			insideFencedCodeBlock = !insideFencedCodeBlock;
+			return;
+		}
+		if (insideFencedCodeBlock) return;
+		if (!line.startsWith(`[nextclaw.project/v1`)) return;
+		const source = {
+			sessionId: params.sessionId,
+			messageId: params.messageId,
+			timestamp: params.timestamp,
+			line: index + 1
+		};
+		const marker = line.includes(" kind=") ? parseLegacyMarkerLine(line, source, state) : parseCompactMarkerLine(line, source, state);
+		if (marker) {
+			markers.push(marker);
+			return;
+		}
+		if (params.reportInvalid !== false) issues.push({
+			code: "PROJECT_MARKER_INVALID",
+			message: `Invalid ${PROJECT_OBSERVATION_PROTOCOL} marker at line ${index + 1}.`,
+			line: index + 1
+		});
+	});
+	return {
+		markers,
+		issues
+	};
+}
+const isRecord$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function readProjectObservationResponseMetadata(metadata) {
+	const response = metadata?.project_observation_response;
+	if (!isRecord$7(response) || response.protocol !== "nextclaw.project/v1" || typeof response.requestId !== "string" || response.decision !== "confirmed" && response.decision !== "rejected") return null;
+	return {
+		protocol: PROJECT_OBSERVATION_PROTOCOL,
+		requestId: response.requestId,
+		decision: response.decision
+	};
+}
+//#endregion
+//#region src/features/projects/services/project-observation.service.ts
+const SOURCE_LABELS = {
+	config: "项目配置",
+	files: "项目文件",
+	sessions: "项目会话",
+	skills: "项目 Skills"
+};
+const readOptionalString$8 = (value) => {
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
+};
+const readSessionProjectRoot$1 = (session) => readOptionalString$8(session.metadata?.project_root) ?? readOptionalString$8(session.metadata?.projectRoot);
+const readMessageText = (message) => message.parts.flatMap((part) => part.type === "text" || part.type === "rich-text" ? [part.text] : []).join("\n");
+const compareMarkerSource = (left, right) => left.timestamp.localeCompare(right.timestamp) || left.sessionId.localeCompare(right.sessionId) || left.messageId.localeCompare(right.messageId) || left.line - right.line;
+const markerConflictKey = (marker) => {
+	switch (marker.kind) {
+		case "work-item":
+		case "signal":
+		case "request": return `${marker.kind}:${marker.id}`;
+		case "schedule": return `${marker.kind}:${marker.itemId}`;
+		case "artifact": return null;
+	}
+};
+const markerSemanticValue = (marker) => {
+	const { line: _line, messageId: _messageId, sessionId: _sessionId, timestamp: _timestamp, ...semantic } = marker;
+	return JSON.stringify(semantic);
+};
+const parseProjectSessionMessage = (sessionId, message, state) => {
+	if (message.role === "assistant") {
+		const parsed = parseProjectObservationMarkers({
+			text: readMessageText(message),
+			sessionId,
+			messageId: message.id,
+			timestamp: message.timestamp,
+			reportInvalid: message.status === "final" || message.status === "error",
+			state
+		});
+		return {
+			markers: parsed.markers,
+			markerIssues: parsed.issues
+		};
+	}
+	if (message.role !== "user") return {
+		markers: [],
+		markerIssues: []
+	};
+	const response = readProjectObservationResponseMetadata(message.metadata);
+	return {
+		markers: [],
+		markerIssues: [],
+		...response ? { response: {
+			requestId: response.requestId,
+			decision: response.decision,
+			sentAt: message.timestamp,
+			messageId: message.id
+		} } : {}
+	};
+};
+const mergeLatestResponse = (responses, response) => {
+	const next = new Map(responses);
+	const current = next.get(response.requestId);
+	if (!current || current.sentAt.localeCompare(response.sentAt) <= 0) {
+		const { requestId, ...value } = response;
+		next.set(requestId, value);
+	}
+	return next;
+};
+var ProjectObservationService = class {
+	now;
+	constructor(options) {
+		this.options = options;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+	}
+	observe = async (rootPath) => {
+		let project;
+		try {
+			project = await this.options.projectManager.getRegisteredProject(rootPath);
+		} catch (error) {
+			throw new ProjectObservationError("PROJECT_OBSERVATION_INVALID_ROOT", error instanceof Error ? error.message : "Project root is invalid.");
+		}
+		if (!project) throw new ProjectObservationError("PROJECT_NOT_REGISTERED", "Project is not registered.");
+		const asOf = this.now().toISOString();
+		const diagnostics = [];
+		const sourceCounts = /* @__PURE__ */ new Map();
+		const sourceErrors = /* @__PURE__ */ new Set();
+		const addDiagnostic = (source, level, code, message, details = {}) => {
+			if (level === "error") sourceErrors.add(source);
+			diagnostics.push({
+				id: `${source}:${code}:${diagnostics.filter((entry) => entry.source === source && entry.code === code).length + 1}`,
+				source,
+				level,
+				code,
+				message,
+				...details
+			});
+		};
+		const addSourceCount = (source, count) => {
+			sourceCounts.set(source, (sourceCounts.get(source) ?? 0) + count);
+		};
+		const config = await this.readConfig(project.rootPath, addDiagnostic);
+		const context = await this.observeContext(project.rootPath, config, asOf, addDiagnostic);
+		addSourceCount("config", (config ? 1 : 0) + context.length + (config?.workflows.length ?? 0));
+		const artifacts = await this.observeArtifacts(project.rootPath, config, asOf, addDiagnostic);
+		addSourceCount("files", artifacts.length);
+		const sessionObservation = await this.observeSessions(project.rootPath, addDiagnostic);
+		addSourceCount("sessions", sessionObservation.sessions.length);
+		const skills = this.observeSkills(project.rootPath, config, asOf, addDiagnostic);
+		addSourceCount("skills", skills.length);
+		const workflows = (config?.workflows ?? []).map((workflow) => ({
+			...workflow,
+			reference: projectObservationConfigReference(asOf)
+		}));
+		const workItems = projectObservedWorkItems(sessionObservation.markers, workflows, addDiagnostic);
+		const runs = projectObservedRuns(sessionObservation.sessions, sessionObservation.markers);
+		const mergedArtifacts = await mergeProjectObservedArtifacts(project.rootPath, artifacts, config, sessionObservation.markers, addDiagnostic);
+		const signals = projectObservedSignals(sessionObservation.markers);
+		const requests = projectObservedRequests(sessionObservation.markers, sessionObservation.responses);
+		const activity = projectObservedActivity(sessionObservation.markers);
+		const sources = Object.keys(SOURCE_LABELS).map((source) => this.createSourceStatus(source, asOf, sourceCounts.get(source) ?? 0, sourceErrors.has(source), diagnostics));
+		const errorSourceCount = sources.filter((source) => source.status === "error").length;
+		return {
+			asOf,
+			project: {
+				name: project.name,
+				rootPath: project.rootPath,
+				...config?.summary ? { summary: config.summary } : {},
+				context
+			},
+			sources,
+			workflows,
+			runs,
+			workItems,
+			artifactCategories: (config?.artifactCategories ?? []).map(({ id, label }) => ({
+				id,
+				label
+			})),
+			artifacts: mergedArtifacts,
+			signals,
+			requests,
+			activity,
+			skills,
+			diagnostics,
+			dataQuality: errorSourceCount === sources.length ? "unavailable" : diagnostics.some((entry) => entry.level === "error" || entry.level === "warning") ? "partial" : "complete"
+		};
+	};
+	readConfig = async (rootPath, addDiagnostic) => {
+		const path = ".nextclaw/project.yaml";
+		if (!await observeProjectFile(rootPath, path)) {
+			addDiagnostic("config", "info", "PROJECT_CONFIG_NOT_FOUND", "No .nextclaw/project.yaml was found.", { projectRelativePath: path });
+			return null;
+		}
+		try {
+			const result = parseProjectObservationConfig(await readFile(join(rootPath, path), "utf8"));
+			for (const issue of result.issues) addDiagnostic("config", result.config ? "warning" : "error", issue.code, issue.message, { projectRelativePath: path });
+			return result.config;
+		} catch (error) {
+			addDiagnostic("config", "error", "PROJECT_CONFIG_READ_FAILED", error instanceof Error ? error.message : "Project config could not be read.", { projectRelativePath: path });
+			return null;
+		}
+	};
+	observeContext = async (rootPath, config, asOf, addDiagnostic) => await Promise.all((config?.context ?? []).map(async (entry) => {
+		const path = normalizeProjectRelativePath(entry.source);
+		const observed = path ? await observeProjectFile(rootPath, path) : null;
+		if (!observed) addDiagnostic("files", "warning", "PROJECT_CONTEXT_SOURCE_UNAVAILABLE", `Context source '${entry.source}' is unavailable or outside the project.`, { projectRelativePath: entry.source });
+		return {
+			...entry,
+			accessible: observed !== null,
+			reference: observed ? projectObservationFileReference(observed.relativePath, asOf) : projectObservationConfigReference(asOf)
+		};
+	}));
+	observeArtifacts = async (rootPath, config, asOf, addDiagnostic) => {
+		const result = await scanProjectArtifactFiles(rootPath, config?.artifactCategories ?? []);
+		for (const issue of result.issues) addDiagnostic("files", "warning", issue.code, issue.message, { ...issue.projectRelativePath ? { projectRelativePath: issue.projectRelativePath } : {} });
+		return result.matches.map((match) => ({
+			id: `${match.categoryId}:${match.relativePath}`,
+			path: match.relativePath,
+			categoryId: match.categoryId,
+			categoryLabel: match.categoryLabel,
+			exists: true,
+			size: match.size,
+			fileCreatedAt: match.createdAt,
+			fileUpdatedAt: match.updatedAt,
+			references: [projectObservationFileReference(match.relativePath, asOf)]
+		}));
+	};
+	observeSessions = async (rootPath, addDiagnostic) => {
+		const markers = [];
+		let responses = /* @__PURE__ */ new Map();
+		let sessions;
+		try {
+			sessions = (await this.options.sessionManager.listSessions()).filter((session) => readSessionProjectRoot$1(session) === rootPath);
+		} catch (error) {
+			addDiagnostic("sessions", "error", "PROJECT_SESSIONS_READ_FAILED", error instanceof Error ? error.message : "Project sessions could not be listed.");
+			return {
+				markers,
+				responses,
+				sessions: []
+			};
+		}
+		const messages = [];
+		for (const session of sessions) try {
+			messages.push(...(await this.options.sessionManager.listSessionMessages(session.sessionId)).map((message) => ({
+				message,
+				sessionId: session.sessionId
+			})));
+		} catch (error) {
+			addDiagnostic("sessions", "error", "PROJECT_SESSION_MESSAGES_READ_FAILED", error instanceof Error ? error.message : "Project session messages could not be read.", { sessionId: session.sessionId });
+		}
+		messages.sort((left, right) => left.message.timestamp.localeCompare(right.message.timestamp) || left.sessionId.localeCompare(right.sessionId) || left.message.id.localeCompare(right.message.id));
+		const parseState = createProjectObservationMarkerParseState();
+		for (const { message, sessionId } of messages) {
+			const parsed = parseProjectSessionMessage(sessionId, message, parseState);
+			markers.push(...parsed.markers);
+			for (const issue of parsed.markerIssues) addDiagnostic("sessions", "warning", issue.code, issue.message, {
+				sessionId,
+				messageId: message.id
+			});
+			if (parsed.response) responses = mergeLatestResponse(responses, parsed.response);
+		}
+		markers.sort(compareMarkerSource);
+		this.addMarkerConflictDiagnostics(markers, addDiagnostic);
+		return {
+			markers,
+			responses,
+			sessions
+		};
+	};
+	addMarkerConflictDiagnostics = (markers, addDiagnostic) => {
+		const latestAtByKey = /* @__PURE__ */ new Map();
+		for (const marker of markers) {
+			const key = markerConflictKey(marker);
+			if (!key) continue;
+			const current = latestAtByKey.get(key);
+			const value = markerSemanticValue(marker);
+			if (current?.timestamp === marker.timestamp && (current.sessionId !== marker.sessionId || current.messageId !== marker.messageId) && current.value !== value) addDiagnostic("sessions", "warning", "PROJECT_MARKER_CONFLICT", `Conflicting '${key}' markers share the same observation time; a deterministic source order was used.`, {
+				sessionId: marker.sessionId,
+				messageId: marker.messageId
+			});
+			latestAtByKey.set(key, {
+				messageId: marker.messageId,
+				sessionId: marker.sessionId,
+				timestamp: marker.timestamp,
+				value
+			});
+		}
+	};
+	observeSkills = (rootPath, config, asOf, addDiagnostic) => {
+		const output = /* @__PURE__ */ new Map();
+		for (const skillRoot of config?.skillRoots ?? [".agents/skills"]) {
+			const normalizedRoot = normalizeProjectRelativePath(skillRoot);
+			if (!normalizedRoot) {
+				addDiagnostic("skills", "warning", "PROJECT_SKILL_ROOT_INVALID", `Skill root '${skillRoot}' is outside the project.`, { projectRelativePath: skillRoot });
+				continue;
+			}
+			try {
+				const loader = new SkillsLoader({
+					workspace: this.options.workspacePath,
+					projectRoot: rootPath,
+					projectSkillsDirName: normalizedRoot,
+					includeBuiltin: false,
+					includeGlobal: false
+				});
+				for (const skill of loader.listSkills(false).filter((entry) => entry.scope === "project")) {
+					const metadata = loader.getSkillMetadata(skill) ?? {};
+					const relativePath = normalizeProjectRelativePath(skill.path.slice(rootPath.length + 1)) ?? `${normalizedRoot}/${skill.name}/SKILL.md`;
+					output.set(skill.ref, {
+						ref: skill.ref,
+						name: skill.name,
+						...metadata.description ? { description: metadata.description } : {},
+						source: "project",
+						path: relativePath,
+						readable: true,
+						reference: projectObservationFileReference(relativePath, asOf)
+					});
+				}
+			} catch (error) {
+				addDiagnostic("skills", "error", "PROJECT_SKILLS_READ_FAILED", error instanceof Error ? error.message : "Project skills could not be read.", { projectRelativePath: normalizedRoot });
+			}
+		}
+		return [...output.values()].sort((left, right) => left.name.localeCompare(right.name));
+	};
+	createSourceStatus = (source, asOf, itemCount, hasError, diagnostics) => ({
+		id: source,
+		label: SOURCE_LABELS[source],
+		status: hasError ? "error" : itemCount > 0 ? "available" : "empty",
+		itemCount,
+		observedAt: asOf,
+		diagnosticIds: diagnostics.filter((entry) => entry.source === source).map((entry) => entry.id)
+	});
+};
+//#endregion
+//#region src/stores/ncp-agent-session-journal-summary-recovery.store.ts
+async function loadNcpAgentSessionSummary(params) {
+	const journalStat = await stat(params.journalPath);
+	const projectionMeta = await params.projectionStore.readMeta(params.sessionId);
+	if (projectionMeta && projectionMeta.projectedJournalOffset <= journalStat.size) {
+		const metadata = await params.metadataStore.read(params.sessionId, {
+			createdAt: params.updatedAt,
+			updatedAt: params.updatedAt,
+			metadata: {}
+		});
+		const page = await params.projectionStore.listPage({
+			sessionId: params.sessionId,
+			limit: 1
+		});
+		return {
+			...createNcpAgentSessionSummary({
+				sessionId: params.sessionId,
+				...metadata.agentId ? { agentId: metadata.agentId } : {},
+				createdAt: metadata.createdAt,
+				updatedAt: metadata.updatedAt,
+				metadata: metadata.metadata,
+				messages: page?.messages ?? []
+			}),
+			messageCount: page?.total ?? projectionMeta.total
+		};
+	}
+	return await loadNcpAgentSessionSummaryWithoutReplay({
+		sessionId: params.sessionId,
+		journalPath: params.journalPath,
+		updatedAt: params.updatedAt,
+		metadataStore: params.metadataStore
+	});
+}
+async function loadNcpAgentSessionSummaryWithoutReplay(params) {
+	const stream = createReadStream(params.journalPath, { encoding: "utf-8" });
+	const lines = createInterface({
+		input: stream,
+		crlfDelay: Infinity
+	});
+	const state = {
+		createdAt: params.updatedAt,
+		metadata: {},
+		messageCount: 0,
+		messageIds: /* @__PURE__ */ new Set(),
+		requiresReplay: false
+	};
+	try {
+		for await (const line of lines) applyJournalSummaryLine(state, line);
+	} catch {
+		return null;
+	} finally {
+		lines.close();
+		stream.destroy();
+	}
+	if (state.requiresReplay) return null;
+	const snapshot = await params.metadataStore.read(params.sessionId, {
+		...state.agentId ? { agentId: state.agentId } : {},
+		createdAt: state.createdAt,
+		updatedAt: params.updatedAt,
+		metadata: state.metadata
+	});
+	return {
+		...createNcpAgentSessionSummary({
+			sessionId: params.sessionId,
+			...snapshot.agentId ? { agentId: snapshot.agentId } : {},
+			createdAt: snapshot.createdAt,
+			updatedAt: snapshot.updatedAt,
+			metadata: snapshot.metadata,
+			messages: []
+		}),
+		messageCount: state.messageCount,
+		...state.lastMessageAt ? { lastMessageAt: state.lastMessageAt } : {}
+	};
+}
+function applyJournalSummaryLine(state, line) {
+	const parsed = parseJournalLine(line);
+	if (!parsed) return;
+	if (parsed._type === "metadata") {
+		state.createdAt = toIsoString(parsed.created_at, state.createdAt);
+		state.agentId = typeof parsed.agent_id === "string" ? parsed.agent_id : state.agentId;
+		if (isRecord$11(parsed.metadata)) state.metadata = structuredClone(parsed.metadata);
+		return;
+	}
+	if (parsed._type !== "event" || !isRecord$11(parsed.event)) return;
+	const event = parsed.event;
+	const payload = isRecord$11(event.payload) ? event.payload : null;
+	const message = payload && isRecord$11(payload.message) ? payload.message : null;
+	const messageId = typeof message?.id === "string" ? message.id : typeof payload?.messageId === "string" ? payload.messageId : null;
+	if (!isMessageStartEvent(event.type) || !messageId || state.messageIds.has(messageId)) return;
+	state.messageIds.add(messageId);
+	state.messageCount += 1;
+	if (isRecord$11(message?.metadata) && message.metadata.nextclaw_timeline_kind === "context_compaction") state.requiresReplay = true;
+	if (!isFinalMessageEvent(event.type)) return;
+	const timestamp = toIsoString(message?.timestamp, "");
+	if (timestamp && (!state.lastMessageAt || timestamp > state.lastMessageAt)) state.lastMessageAt = timestamp;
+}
+function parseJournalLine(line) {
+	if (!line.trim()) return null;
+	try {
+		const parsed = JSON.parse(line);
+		return isRecord$11(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function isMessageStartEvent(type) {
+	return type === NcpEventType.MessageSent || type === NcpEventType.MessageCompleted || type === "session.snapshot.message" || type === NcpEventType.MessageTextStart || type === NcpEventType.MessageReasoningStart;
+}
+function isFinalMessageEvent(type) {
+	return type === NcpEventType.MessageSent || type === NcpEventType.MessageCompleted || type === "session.snapshot.message";
+}
+//#endregion
+//#region src/utils/ncp-agent-unfinished-run.utils.ts
+function applyNcpAgentRunLifecycleEvent(sessionId, activeRun, event) {
+	if (event.type === NcpEventType.RunStarted) return {
+		sessionId,
+		...event.payload.messageId ? { messageId: event.payload.messageId } : {},
+		...event.payload.runId ? { runId: event.payload.runId } : {},
+		...event.payload.startedAt ? { startedAt: event.payload.startedAt } : {}
+	};
+	if (activeRun && (event.type === NcpEventType.RunFinished || event.type === NcpEventType.RunError || event.type === NcpEventType.MessageAbort) && (!event.payload.runId || !activeRun.runId || event.payload.runId === activeRun.runId)) return null;
+	return activeRun;
+}
+//#endregion
+//#region src/stores/ncp-agent-unfinished-run.store.ts
+var NcpAgentUnfinishedRunStore = class {
+	constructor(journalDir, listSessionIds) {
+		this.journalDir = journalDir;
+		this.listSessionIds = listSessionIds;
+	}
+	list = async () => {
+		const runs = [];
 		for (const sessionId of await this.listSessionIds()) {
 			const run = await this.read(sessionId);
 			if (run) runs.push(run);
@@ -20575,7 +22878,7 @@ var NcpAgentUnfinishedRunStore = class {
 				} catch {
 					continue;
 				}
-				if (!isRecord$9(parsed) || parsed._type !== "event" || !isRecord$9(parsed.event)) continue;
+				if (!isRecord$11(parsed) || parsed._type !== "event" || !isRecord$11(parsed.event)) continue;
 				activeRun = applyNcpAgentRunLifecycleEvent(sessionId, activeRun, parsed.event);
 			}
 			return activeRun;
@@ -20596,11 +22899,11 @@ function isNcpAgentSessionMessageProjectionBoundaryEvent(event) {
 function serializeNcpAgentSessionJournalEntry(entry) {
 	const serialized = JSON.stringify(entry);
 	if (!serialized) throw new Error("ncp agent session journal entry serialization produced empty output");
-	if (!isRecord$9(JSON.parse(serialized))) throw new Error("ncp agent session journal entry serialization produced a non-object entry");
+	if (!isRecord$11(JSON.parse(serialized))) throw new Error("ncp agent session journal entry serialization produced a non-object entry");
 	return serialized;
 }
 function attachNcpAgentSessionJournalTimestamp(event, timestamp) {
-	if (!("payload" in event) || !isRecord$9(event.payload)) return event;
+	if (!("payload" in event) || !isRecord$11(event.payload)) return event;
 	return {
 		...event,
 		payload: {
@@ -20625,7 +22928,7 @@ var NcpAgentSessionJournalParser = class {
 			this.applyMetadata(parsed);
 			return;
 		}
-		if (parsed._type === "event" && isRecord$9(parsed.event)) this.applyEvent(parsed, lineEndOffset);
+		if (parsed._type === "event" && isRecord$11(parsed.event)) this.applyEvent(parsed, lineEndOffset);
 	};
 	finish = () => ({
 		metadata: this.metadata,
@@ -20639,14 +22942,14 @@ var NcpAgentSessionJournalParser = class {
 	parseLine = (line, index) => {
 		try {
 			const parsed = JSON.parse(line);
-			return isRecord$9(parsed) ? parsed : null;
+			return isRecord$11(parsed) ? parsed : null;
 		} catch (error) {
 			console.warn(`[ncp-agent-session-journal] skipped corrupted journal line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`);
 			return null;
 		}
 	};
 	applyMetadata = (entry) => {
-		this.metadata = isRecord$9(entry.metadata) ? structuredClone(entry.metadata) : {};
+		this.metadata = isRecord$11(entry.metadata) ? structuredClone(entry.metadata) : {};
 		this.agentId = normalizeNcpAgentId(typeof entry.agent_id === "string" ? entry.agent_id : void 0);
 		this.createdAt = toIsoString(entry.created_at, this.createdAt);
 		this.updatedAt = toIsoString(entry.updated_at, this.updatedAt);
@@ -20693,7 +22996,7 @@ var NcpAgentSessionMetadataStore = class {
 	read = async (sessionId, activitySnapshot) => {
 		try {
 			const parsed = JSON.parse(await readFile(this.metadataPath(sessionId), "utf-8"));
-			if (!isRecord$9(parsed) || parsed._type !== "metadata" || !isRecord$9(parsed.metadata)) throw new Error(`invalid ncp agent session metadata sidecar: ${sessionId}`);
+			if (!isRecord$11(parsed) || parsed._type !== "metadata" || !isRecord$11(parsed.metadata)) throw new Error(`invalid ncp agent session metadata sidecar: ${sessionId}`);
 			const createdAt = toIsoString(parsed.created_at, activitySnapshot.createdAt);
 			const agentId = normalizeNcpAgentId(typeof parsed.agent_id === "string" ? parsed.agent_id : void 0);
 			return {
@@ -20763,7 +23066,7 @@ function deduplicateNcpAgentSessionTailMessages(messages) {
 function isNcpAgentSessionMessageProjectionMeta(value, sessionId) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
 	const meta = value;
-	return meta.version === 7 && meta.sessionId === sessionId && Number.isSafeInteger(meta.total) && Number.isSafeInteger(meta.projectedJournalOffset) && Number.isSafeInteger(meta.dataBytes) && (meta.activeMessageId === null || typeof meta.activeMessageId === "string") && Array.isArray(meta.pendingCompactionMessageIds) && meta.pendingCompactionMessageIds.every((id) => typeof id === "string") && (meta.contextWindow === null || isRecord$7(meta.contextWindow));
+	return meta.version === 7 && meta.sessionId === sessionId && Number.isSafeInteger(meta.total) && Number.isSafeInteger(meta.projectedJournalOffset) && Number.isSafeInteger(meta.dataBytes) && (meta.activeMessageId === null || typeof meta.activeMessageId === "string") && Array.isArray(meta.pendingCompactionMessageIds) && meta.pendingCompactionMessageIds.every((id) => typeof id === "string") && (meta.contextWindow === null || isRecord$6(meta.contextWindow));
 }
 function readActiveAssistantMessageId(messages) {
 	for (let index = messages.length - 1; index >= 0; index -= 1) {
@@ -20786,12 +23089,12 @@ function mergePendingCompactionMessageIds(current, messages) {
 	}
 	return pending;
 }
-function isRecord$7(value) {
+function isRecord$6(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function readCompactionStatus(message) {
 	const checkpoint = message.metadata?.checkpoint;
-	if (message.metadata?.nextclaw_timeline_kind !== "context_compaction" || !isRecord$7(checkpoint)) return null;
+	if (message.metadata?.nextclaw_timeline_kind !== "context_compaction" || !isRecord$6(checkpoint)) return null;
 	return typeof checkpoint.status === "string" ? checkpoint.status : null;
 }
 //#endregion
@@ -21299,151 +23602,6 @@ async function readLegacyRecords(journalDir, diagnostics) {
 	return /* @__PURE__ */ new Map();
 }
 //#endregion
-//#region src/stores/ncp-session-catalog-sqlite-driver.store.ts
-const require = createRequire(import.meta.url);
-const portableDatabases = /* @__PURE__ */ new Map();
-async function openSessionCatalogSqliteDatabase(databasePath) {
-	try {
-		return new (require("node:sqlite")).DatabaseSync(databasePath);
-	} catch (error) {
-		if (!isMissingNodeSqlite(error)) throw error;
-		return await openPortableDatabase(databasePath);
-	}
-}
-function runSessionCatalogSqliteTransaction(database, operation, mode = "DEFERRED") {
-	database.exec(`BEGIN ${mode}`);
-	try {
-		const result = operation();
-		database.exec("COMMIT");
-		return result;
-	} catch (error) {
-		database.exec("ROLLBACK");
-		throw error;
-	}
-}
-function isMissingNodeSqlite(error) {
-	const code = typeof error === "object" && error !== null ? error.code : void 0;
-	return code === "ERR_UNKNOWN_BUILTIN_MODULE" || code === "MODULE_NOT_FOUND";
-}
-async function openPortableDatabase(databasePath) {
-	const existing = portableDatabases.get(databasePath);
-	if (existing) return (await existing).acquire();
-	const opening = createPortableDatabase(databasePath).catch((error) => {
-		portableDatabases.delete(databasePath);
-		throw error;
-	});
-	portableDatabases.set(databasePath, opening);
-	return (await opening).acquire();
-}
-async function createPortableDatabase(databasePath) {
-	const initialize = (await import("sql.js")).default;
-	const sqlite = await initialize({ locateFile: (file) => require.resolve(`sql.js/dist/${file}`) });
-	return new PortableSessionCatalogSqliteDatabase(databasePath, existsSync(databasePath) ? new sqlite.Database(readFileSync(databasePath)) : new sqlite.Database());
-}
-var PortableSessionCatalogSqliteDatabase = class {
-	inTransaction = false;
-	dirty = false;
-	leaseCount = 0;
-	constructor(databasePath, database) {
-		this.databasePath = databasePath;
-		this.database = database;
-	}
-	acquire = () => {
-		this.leaseCount += 1;
-		return new PortableSessionCatalogSqliteLease(this);
-	};
-	exec = (sql) => {
-		const command = sql.trim().toUpperCase();
-		this.database.run(sql);
-		if (command.startsWith("BEGIN")) {
-			this.inTransaction = true;
-			return;
-		}
-		if (command.startsWith("ROLLBACK")) {
-			this.inTransaction = false;
-			this.dirty = false;
-			return;
-		}
-		if (command.startsWith("COMMIT")) {
-			this.inTransaction = false;
-			this.persistIfDirty();
-			return;
-		}
-		if (!command.startsWith("PRAGMA")) this.markDirty();
-	};
-	prepare = (sql) => new PortableSessionCatalogSqliteStatement(this, sql);
-	release = () => {
-		this.leaseCount -= 1;
-		if (this.leaseCount > 0) return;
-		this.persistIfDirty();
-		this.database.close();
-		portableDatabases.delete(this.databasePath);
-	};
-	run = (sql, params) => {
-		this.database.run(sql, normalizeParams(params));
-		this.markDirty();
-	};
-	readRows = (sql, params) => {
-		const statement = this.database.prepare(sql);
-		try {
-			bindStatement(statement, params);
-			const rows = [];
-			while (statement.step()) rows.push(statement.getAsObject());
-			return rows;
-		} finally {
-			statement.free();
-		}
-	};
-	markDirty = () => {
-		this.dirty = true;
-		if (!this.inTransaction) this.persistIfDirty();
-	};
-	persistIfDirty = () => {
-		if (!this.dirty) return;
-		const temporaryPath = `${this.databasePath}.tmp`;
-		writeFileSync(temporaryPath, this.database.export());
-		renameSync(temporaryPath, this.databasePath);
-		this.dirty = false;
-	};
-};
-var PortableSessionCatalogSqliteLease = class {
-	closed = false;
-	constructor(owner) {
-		this.owner = owner;
-	}
-	close = () => {
-		if (this.closed) return;
-		this.closed = true;
-		this.owner.release();
-	};
-	exec = (sql) => this.owner.exec(sql);
-	prepare = (sql) => this.owner.prepare(sql);
-};
-var PortableSessionCatalogSqliteStatement = class {
-	constructor(database, sql) {
-		this.database = database;
-		this.sql = sql;
-	}
-	all = (...params) => this.database.readRows(this.sql, params);
-	get = (...params) => this.all(...params)[0];
-	run = (...params) => {
-		this.database.run(this.sql, params);
-		return {};
-	};
-};
-function bindStatement(statement, params) {
-	const normalized = normalizeParams(params);
-	if (Array.isArray(normalized) && normalized.length === 0) return;
-	statement.bind(normalized);
-}
-function normalizeParams(params) {
-	if (params.length !== 1 || !isRecord$6(params[0])) return params;
-	return Object.fromEntries(Object.entries(params[0]).map(([key, value]) => [`@${key}`, value]));
-}
-function isRecord$6(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
 //#region src/stores/ncp-agent-session-summary-index.store.ts
 const SQLITE_DATABASE_FILE = ".ncp-agent-session-catalog.sqlite";
 const CATALOG_SCHEMA_VERSION = 1;
@@ -21548,7 +23706,7 @@ var NcpAgentSessionSummaryIndexStore = class {
 		const { sessionId: rawSessionId, event, updatedAt } = params;
 		const sessionId = normalizeNcpSessionId(rawSessionId);
 		const currentRow = this.db().prepare("SELECT * FROM sessions WHERE session_id = ? LIMIT 1").get(sessionId);
-		const row = summaryToRow({
+		const { deleted_at: _deletedAt, ...upsertParams } = summaryToRow({
 			...upsertNcpAgentSessionSummaryEvent({
 				current: currentRow && currentRow.deleted_at === null ? rowToSummary(currentRow) : void 0,
 				sessionId,
@@ -21577,13 +23735,13 @@ var NcpAgentSessionSummaryIndexStore = class {
          END,
          message_count = sessions.message_count + excluded.message_count,
          status = excluded.status
-       WHERE sessions.deleted_at IS NULL`).run(row);
+       WHERE sessions.deleted_at IS NULL`).run(upsertParams);
 	};
 	remove = async (sessionId) => {
 		await this.ensureReady();
 		const normalizedSessionId = normalizeNcpSessionId(sessionId);
 		const deletedAt = (/* @__PURE__ */ new Date()).toISOString();
-		runSessionCatalogSqliteTransaction(this.db(), () => {
+		runSqliteTransaction(this.db(), () => {
 			if (this.db().prepare("SELECT session_id FROM sessions WHERE session_id = ? LIMIT 1").get(normalizedSessionId)) {
 				this.db().prepare("UPDATE sessions SET deleted_at = ? WHERE session_id = ?").run(deletedAt, normalizedSessionId);
 				return;
@@ -21608,7 +23766,7 @@ var NcpAgentSessionSummaryIndexStore = class {
 	};
 	initializeCatalog = async () => {
 		await mkdir(this.journalDir, { recursive: true });
-		this.database = await openSessionCatalogSqliteDatabase(resolve(this.journalDir, SQLITE_DATABASE_FILE));
+		this.database = await openSqliteDatabase(resolve(this.journalDir, SQLITE_DATABASE_FILE));
 		this.database.exec(`
       PRAGMA busy_timeout = 10000;
       PRAGMA journal_mode = WAL;
@@ -21648,7 +23806,7 @@ var NcpAgentSessionSummaryIndexStore = class {
 			loadSession: (sessionId) => this.loadSession(sessionId),
 			loadSessionSummary: this.loadSessionSummary
 		});
-		runSessionCatalogSqliteTransaction(this.db(), () => {
+		runSqliteTransaction(this.db(), () => {
 			if (this.db().prepare("SELECT value FROM storage_meta WHERE key = ? LIMIT 1").get(MIGRATION_STATUS_KEY)?.value === MIGRATION_COMPLETE) {
 				this.reconcileRecords(scan.records);
 				return;
@@ -22663,7 +24821,6 @@ function resolveSessionChannelContext(params) {
 }
 //#endregion
 //#region src/features/native-runtime/utils/nextclaw-ncp-run-context.utils.ts
-const REQUESTED_SKILLS_METADATA_READER = new RequestedSkillsMetadataReader();
 function resolveRequestedToolNames(metadata) {
 	const rawValue = metadata.requested_tools ?? metadata.requestedTools;
 	if (!Array.isArray(rawValue)) return [];
@@ -22700,7 +24857,6 @@ function buildNextclawNcpRunContext(params) {
 		requestMetadata
 	});
 	const sessionMetadata = channelContext.metadata;
-	const requestedSkills = REQUESTED_SKILLS_METADATA_READER.readSelection(requestMetadata);
 	const runtimeThinking = resolveThinkingLevel({
 		config,
 		agentId: profile.agentId,
@@ -22715,7 +24871,6 @@ function buildNextclawNcpRunContext(params) {
 		effectiveWorkspace,
 		profile,
 		requestMetadata,
-		requestedSkills,
 		requestedToolNames: resolveRequestedToolNames(requestMetadata),
 		runtimeThinking,
 		sessionKey: sessionId,
@@ -23513,13 +25668,12 @@ var ReplyFormatContextProvider = class {
 };
 //#endregion
 //#region src/contributions/context-provider/providers/skills-context.provider.ts
-function renderActiveSkillsSection(skills, skillSelectors) {
+function renderAlwaysOnSkillsSection(skills, skillSelectors) {
 	const manifest = skills.buildSkillsManifest(skillSelectors);
 	if (!manifest) return "";
 	return [
-		"# Active Skills",
-		"These user-selected or always-on skills take precedence when relevant. Read the chosen `Root/<name>/SKILL.md` before following it.",
-		"For NextClaw self-management, use the active built-in self-management skill before unrelated generic skills.",
+		"# Always-on Skills",
+		"These skills are always active. Read each `Root/<name>/SKILL.md` before following it.",
 		manifest
 	].join("\n");
 }
@@ -23554,7 +25708,7 @@ var SkillsContextProvider = class {
 		this.context = context;
 	}
 	provide = async (request) => {
-		const { projectContext, runContext } = await this.context.resolve(request);
+		const { projectContext } = await this.context.resolve(request);
 		const skills = new SkillsLoader({
 			workspace: projectContext.hostWorkspace,
 			projectRoot: projectContext.projectRoot,
@@ -23564,10 +25718,10 @@ var SkillsContextProvider = class {
 			hostWorkspace: projectContext.hostWorkspace,
 			projectSkillsRoot: projectContext.projectSkillsRoot
 		})];
-		const activeSkills = [...runContext.requestedSkills.selectors, ...skills.getAlwaysSkills()];
-		if (activeSkills.length) {
-			const activeSection = renderActiveSkillsSection(skills, activeSkills);
-			if (activeSection) blocks.push(activeSection);
+		const alwaysOnSkills = skills.getAlwaysSkills();
+		if (alwaysOnSkills.length) {
+			const alwaysOnSection = renderAlwaysOnSkillsSection(skills, alwaysOnSkills);
+			if (alwaysOnSection) blocks.push(alwaysOnSection);
 		}
 		const availableSkillsSection = renderAvailableSkillsSection(skills);
 		if (availableSkillsSection) blocks.push(availableSkillsSection);
@@ -24198,7 +26352,6 @@ const LEARNING_LOOP_LAST_TOOL_CALL_COUNT_METADATA_KEY = "learning_loop_last_tool
 const LEARNING_LOOP_LAST_REQUESTED_AT_METADATA_KEY = "learning_loop_last_requested_at";
 const LEARNING_LOOP_LAST_REVIEW_SESSION_ID_METADATA_KEY = "learning_loop_last_review_session_id";
 const LEARNING_LOOP_SOURCE_SESSION_ID_METADATA_KEY = "learning_loop_source_session_id";
-const LEARNING_LOOP_REQUESTED_SKILLS = ["skill-creator"];
 function readLearningLoopRuntimeConfig(config) {
 	return {
 		enabled: config.agents.learningLoop.enabled,
@@ -24311,7 +26464,6 @@ var LearningLoopContribution = class extends Contribution$1 {
 				sourceSessionId: sessionId,
 				sourceSessionMetadata: metadata,
 				metadataOverrides: {
-					requested_skills: LEARNING_LOOP_REQUESTED_SKILLS,
 					[LEARNING_LOOP_DISABLED_METADATA_KEY]: true,
 					[LEARNING_LOOP_SOURCE_SESSION_ID_METADATA_KEY]: sessionId
 				},
@@ -24509,12 +26661,234 @@ var ProjectsCreateTool = class {
 	};
 };
 //#endregion
+//#region src/tools/project-work.tools.ts
+function requiredString$1(value, key) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`${key} must be a non-empty string.`);
+	return value.trim();
+}
+function optionalString$1(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function optionalBoolean(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+function optionalNumber(value) {
+	return typeof value === "number" && Number.isInteger(value) ? value : void 0;
+}
+function agentActor(context) {
+	return {
+		kind: "agent",
+		...context.agentId ? { id: context.agentId } : {},
+		sessionId: context.sessionId
+	};
+}
+var ProjectWorkListTool = class {
+	name = "project_work_list";
+	description = "List persistent work items and custom states for the current project.";
+	parameters = {
+		type: "object",
+		properties: { include_deleted: {
+			type: "boolean",
+			description: "Include deleted work items."
+		} },
+		additionalProperties: false
+	};
+	constructor(work, context) {
+		this.work = work;
+		this.context = context;
+	}
+	execute = async (args) => {
+		const params = normalizeToolParams(args);
+		return JSON.stringify(await this.work.list(this.context.projectId, optionalBoolean(params.include_deleted) ?? false), null, 2);
+	};
+};
+var ProjectWorkGetTool = class {
+	name = "project_work_get";
+	description = "Get one current-project work item with artifact links and recent immutable activity.";
+	parameters = {
+		type: "object",
+		properties: {
+			id: {
+				type: "string",
+				description: "Work item id."
+			},
+			activity_limit: {
+				type: "integer",
+				minimum: 1,
+				maximum: 100,
+				description: "Recent activity entries. Defaults to 20."
+			}
+		},
+		required: ["id"],
+		additionalProperties: false
+	};
+	constructor(work, context) {
+		this.work = work;
+		this.context = context;
+	}
+	execute = async (args) => {
+		const params = normalizeToolParams(args);
+		const id = requiredString$1(params.id, "id");
+		const [item, activity] = await Promise.all([this.work.get(this.context.projectId, id), this.work.listActivities(this.context.projectId, id, { limit: optionalNumber(params.activity_limit) ?? 20 })]);
+		return JSON.stringify({
+			item,
+			activity
+		}, null, 2);
+	};
+};
+var ProjectWorkCreateTool = class {
+	name = "project_work_create";
+	description = "Create a persistent work item in the current project.";
+	parameters = {
+		type: "object",
+		properties: {
+			title: {
+				type: "string",
+				description: "Concise work item title."
+			},
+			description: {
+				type: "string",
+				description: "Optional durable context and acceptance notes."
+			},
+			state_id: {
+				type: "string",
+				description: "Optional custom state id. The project default is used when omitted."
+			},
+			attention: {
+				type: "string",
+				enum: [
+					"none",
+					"blocked",
+					"awaiting-user"
+				]
+			}
+		},
+		required: ["title"],
+		additionalProperties: false
+	};
+	constructor(work, context) {
+		this.work = work;
+		this.context = context;
+	}
+	execute = async (args) => {
+		const params = normalizeToolParams(args);
+		return JSON.stringify(await this.work.create(this.context.projectId, {
+			title: requiredString$1(params.title, "title"),
+			...optionalString$1(params.description) ? { description: optionalString$1(params.description) } : {},
+			...optionalString$1(params.state_id) ? { stateId: optionalString$1(params.state_id) } : {},
+			...optionalString$1(params.attention) ? { attention: optionalString$1(params.attention) } : {}
+		}, agentActor(this.context)), null, 2);
+	};
+};
+var ProjectWorkUpdateTool = class {
+	name = "project_work_update";
+	description = "Update, soft-delete, or restore a current-project work item, or add/remove its artifact links. Status changes use state_id; there is no separate start tool.";
+	parameters = {
+		type: "object",
+		properties: {
+			id: {
+				type: "string",
+				description: "Work item id."
+			},
+			title: { type: "string" },
+			description: { type: "string" },
+			state_id: { type: "string" },
+			attention: {
+				type: "string",
+				enum: [
+					"none",
+					"blocked",
+					"awaiting-user"
+				]
+			},
+			expected_version: {
+				type: "integer",
+				minimum: 1
+			},
+			deleted: {
+				type: "boolean",
+				description: "True to soft-delete the item; false to restore it."
+			},
+			add_artifact: {
+				type: "object",
+				properties: {
+					path: { type: "string" },
+					label: { type: "string" }
+				},
+				required: ["path"],
+				additionalProperties: false
+			},
+			remove_artifact_id: { type: "string" }
+		},
+		required: ["id"],
+		additionalProperties: false
+	};
+	constructor(work, context) {
+		this.work = work;
+		this.context = context;
+	}
+	execute = async (args) => {
+		const params = normalizeToolParams(args);
+		const id = requiredString$1(params.id, "id");
+		const actor = agentActor(this.context);
+		const patch = {
+			...params.title !== void 0 ? { title: requiredString$1(params.title, "title") } : {},
+			...typeof params.description === "string" ? { description: params.description } : {},
+			...optionalString$1(params.state_id) ? { stateId: optionalString$1(params.state_id) } : {},
+			...optionalString$1(params.attention) ? { attention: optionalString$1(params.attention) } : {},
+			...optionalNumber(params.expected_version) ? { expectedVersion: optionalNumber(params.expected_version) } : {}
+		};
+		if (Object.keys(patch).length > 0) await this.work.update(this.context.projectId, id, patch, actor);
+		const deleted = optionalBoolean(params.deleted);
+		if (deleted !== void 0) await (deleted ? this.work.delete(this.context.projectId, id, actor) : this.work.restore(this.context.projectId, id, actor));
+		if (params.add_artifact && typeof params.add_artifact === "object" && !Array.isArray(params.add_artifact)) {
+			const artifact = params.add_artifact;
+			await this.work.linkArtifact({
+				projectId: this.context.projectId,
+				workItemId: id,
+				path: requiredString$1(artifact.path, "add_artifact.path"),
+				...optionalString$1(artifact.label) ? { label: optionalString$1(artifact.label) } : {},
+				actor
+			});
+		}
+		const removeArtifactId = optionalString$1(params.remove_artifact_id);
+		if (removeArtifactId) await this.work.unlinkArtifact({
+			projectId: this.context.projectId,
+			workItemId: id,
+			artifactLinkId: removeArtifactId,
+			actor
+		});
+		return JSON.stringify(await this.work.get(this.context.projectId, id), null, 2);
+	};
+};
+//#endregion
 //#region src/contributions/tool-provider/providers/project-tool.provider.ts
 var ProjectToolProvider = class {
-	constructor(projectManager) {
+	constructor(runContext, projectManager, projectWork) {
+		this.runContext = runContext;
 		this.projectManager = projectManager;
+		this.projectWork = projectWork;
 	}
-	provide = (_request) => [new ProjectsListTool(this.projectManager), new ProjectsCreateTool(this.projectManager)];
+	provide = async (request) => {
+		const globalTools = [new ProjectsListTool(this.projectManager), new ProjectsCreateTool(this.projectManager)];
+		const resolved = await this.runContext.resolve(request);
+		const projectId = readProjectId(resolved.session?.metadata);
+		const projectRoot = readProjectRoot(resolved.session?.metadata);
+		const project = projectId ? await this.projectManager.getProjectById(projectId) : projectRoot ? await this.projectManager.getRegisteredProject(projectRoot) : null;
+		if (!project || !resolved.sessionId) return globalTools;
+		const context = {
+			projectId: project.id,
+			sessionId: resolved.sessionId,
+			...resolved.session?.agentId ? { agentId: resolved.session.agentId } : {}
+		};
+		return [
+			...globalTools,
+			new ProjectWorkListTool(this.projectWork, context),
+			new ProjectWorkGetTool(this.projectWork, context),
+			new ProjectWorkCreateTool(this.projectWork, context),
+			new ProjectWorkUpdateTool(this.projectWork, context)
+		];
+	};
 };
 //#endregion
 //#region src/tools/session-history.tools.ts
@@ -26351,7 +28725,7 @@ var ToolProviderContribution = class extends Contribution$1 {
 			new DesktopToolProvider(runContextService, this.kernel.extensions.getDesktopHost()),
 			new CoreToolProvider(runContextService, this.kernel.getGatewayController),
 			new MessagingToolProvider(runContextService, this.kernel.channels, this.kernel.automation, this.kernel.extensions),
-			new ProjectToolProvider(this.kernel.projectManager),
+			new ProjectToolProvider(runContextService, this.kernel.projectManager, this.kernel.projectWorkManager),
 			new SessionToolProvider(runContextService, this.kernel.sessionManager, this.kernel.sessionRequests, this.kernel.sessionSearch),
 			new AssetToolProvider(this.kernel.assetStore),
 			new ServiceActionToolProvider(runContextService, this.kernel.serviceAppManager),
@@ -26391,6 +28765,7 @@ function createKernelServiceAppManagers(params) {
 		appHomeDirectory,
 		configManager,
 		listPackageComponentSources: appPackageManager.listActiveComponentSources,
+		assertDocumentAccess: appPackageManager.assertDocumentAccess,
 		capabilityGrantManager,
 		hasAgent,
 		providerManager,
@@ -26447,16 +28822,26 @@ function createPortableRuntimeAcceptanceServices(params) {
 	};
 }
 function createKernelSessionManagers(params) {
-	const { agentContextWindowManager, agentManager, configManager, eventBus, ingress, observationStorePath, projectStorePath, sessionsDir } = params;
+	const { agentContextWindowManager, agentManager, configManager, eventBus, ingress, observationStorePath, projectStorePath, projectWorkStorePath, sessionsDir } = params;
 	const sessionSearch = new SessionSearchService({
 		databasePath: resolve(getDataDir(), "session-search.db"),
 		sessionsDir
 	});
 	const journalStore = new NcpAgentSessionJournalStore(resolve(sessionsDir, ".ncp-agent-journal"));
+	const projectWorkOwner = { current: null };
 	const projectManager = new ProjectManager({
 		storePath: projectStorePath,
-		getDefaultWorkspacePath: () => getWorkspacePathFromConfig(configManager.config)
+		getDefaultWorkspacePath: () => getWorkspacePathFromConfig(configManager.config),
+		onProjectRegistered: async (project) => {
+			await projectWorkOwner.current?.ensureProject(project.id);
+		}
+	});
+	const projectWorkManager = new ProjectWorkManager({
+		databasePath: projectWorkStorePath,
+		eventBus,
+		projectManager
 	});
+	projectWorkOwner.current = projectWorkManager;
 	const observationOwner = { current: null };
 	const sessionManager = new SessionManager({
 		agentContextWindowManager,
@@ -26478,11 +28863,18 @@ function createKernelSessionManagers(params) {
 		ingress,
 		eventBus
 	});
+	const projectObservation = new ProjectObservationService({
+		projectManager,
+		sessionManager,
+		workspacePath: getWorkspacePathFromConfig(configManager.config)
+	});
 	observationOwner.current = observations;
 	return {
 		journalStore,
 		observations,
 		projectManager,
+		projectObservation,
+		projectWorkManager,
 		sessionManager,
 		sessionSearch
 	};
@@ -26511,6 +28903,10 @@ function installKernelAppPackageRuntimeHooks(params) {
 			panelAppManager.deactivatePackageComponents(sources);
 			await serviceAppManager.deactivatePackageComponents(sources);
 		},
+		prepareCapabilityChange: async (sources) => await serviceAppManager.preparePackageComponentDeactivation(sources),
+		afterCapabilityChange: async (sources) => {
+			await serviceAppManager.activatePackageComponents(sources);
+		},
 		beforeUninstall: async (sources) => {
 			const rollbacks = [];
 			try {
@@ -26578,6 +28974,8 @@ var NextclawKernel = class {
 	panelAppManager;
 	preferenceManager;
 	projectManager;
+	projectObservation;
+	projectWorkManager;
 	serviceAppManager;
 	extensions;
 	agentRuntimeManager = new AgentRuntimeManager();
@@ -26623,7 +29021,7 @@ var NextclawKernel = class {
 			homeDir: options.homeDir
 		});
 		this.capabilityGrantLegacyMigration = this.createCapabilityGrantLegacyMigration(options);
-		({journalStore: this.ncpAgentSessionJournalStore, observations: this.observations, projectManager: this.projectManager, sessionManager: this.sessionManager, sessionSearch: this.sessionSearch} = createKernelSessionManagers({
+		({journalStore: this.ncpAgentSessionJournalStore, observations: this.observations, projectManager: this.projectManager, projectObservation: this.projectObservation, projectWorkManager: this.projectWorkManager, sessionManager: this.sessionManager, sessionSearch: this.sessionSearch} = createKernelSessionManagers({
 			agentContextWindowManager: this.agentContextWindowManager,
 			agentManager: this.agents,
 			configManager: this.configManager,
@@ -26631,6 +29029,7 @@ var NextclawKernel = class {
 			ingress: this.ingress,
 			observationStorePath: resolveKernelObservationStorePath(options),
 			projectStorePath: resolveKernelProjectStorePath(options),
+			projectWorkStorePath: resolveKernelProjectWorkStorePath(options),
 			sessionsDir
 		}));
 		this.inboxDeliveryManager = new InboxDeliveryManager({
@@ -26730,7 +29129,9 @@ var NextclawKernel = class {
 		this.sessionSearch.start();
 		this.mcpManager.start();
 		this.providerModelCatalog.start();
+		await this.projectManager.migrateLegacyProjects();
 		await this.projectManager.importSessionProjects((await this.sessionManager.listSessions()).map((session) => readProjectRoot(session.metadata)));
+		await this.projectWorkManager.initialize();
 		await this.sessionManager.start();
 		for (const contribution of this.contributions) await contribution.start();
 		this.agentRunRequestManager.start();
@@ -26750,6 +29151,7 @@ var NextclawKernel = class {
 		await this.mcpManager.dispose();
 		await this.serviceAppManager.dispose();
 		await this.sessionSearch.dispose();
+		this.projectWorkManager.dispose();
 	};
 };
 //#endregion
@@ -27892,6 +30294,6 @@ function resolveLegacyEventType(message) {
 	return `message.${role || "other"}`;
 }
 //#endregion
-export { AUTOMATIC_UPDATE_CHECK_INTERVAL_MS, AccessManager, AgentManager, AgentRunClient, AppDataError, AppDataManager, AppPackageError, AppPackageManager, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_CONTINUATION_TEXT, CONTEXT_COMPACTION_PROJECTION_KIND, CONTEXT_COMPACTION_PROJECTION_METADATA_KEY, CONTEXT_COMPACTION_SYSTEM_PREAMBLE, CONTEXT_COMPACTION_TIMELINE_KIND, CapabilityGrantLegacyMigrationService, CapabilityGrantManager, CapabilityGrantStore, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionJournalRecoveryService, ContextCompactionPreflightService, Contribution, DEFAULT_AGENT_RUNTIME_ENTRY_ID, DEFAULT_SERVICE_ACTION_RISK, DESKTOP_HOST_ACCESS, DESKTOP_HOST_PROTOCOL_VERSION, DesktopHostCapabilityManager, DesktopNodeReplService, DesktopSessionStateService, EventBus, ExtensionManager, FeatureControlsService, GatewayInboundProcessor, InboxDeliveryError, InboxDeliveryManager, Ingress, LlmProviderManager, LlmUsageManager, LlmUsageStore, MAX_INBOX_DELIVERY_CONTENT_LENGTH, McpManager, McpServiceAppRuntimeService, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawHarness, NextclawHarnessError, NextclawKernel, ObservationManager, PANEL_APP_AGENT_CAPABILITIES, PORTABLE_RUNTIME_ACCEPTANCE_CONTRACT, PORTABLE_RUNTIME_ACCEPTANCE_CONTRACT_FINGERPRINT, PORTABLE_RUNTIME_ACCEPTANCE_LOCALES, PORTABLE_RUNTIME_ACCEPTANCE_PLATFORMS, PORTABLE_RUNTIME_ACCEPTANCE_PRESENTATION, PORTABLE_RUNTIME_ACCEPTANCE_REFERENCE_APP_ID, PROJECT_TEMPLATE_IDS, PROVIDER_MODEL_CATALOG_REFRESH_INTERVAL_MS, PanelAppAssetTokenService, PanelAppError, PanelAppManager, PortableRuntimeAcceptanceIdentityService, PortableRuntimeAcceptanceManager, PreferenceError, PreferenceManager, ProjectError, ProjectManager, ProviderManagerNcpLLMApi, ProviderModelCatalogManager, SERVICE_APP_MANIFEST_FILE_NAME, ServiceAppAiCapabilityService, ServiceAppError, ServiceAppJobJournalService, ServiceAppManager, ServiceAppResidentEventInboxService, ServiceAppRuntimeService, SessionContextCompactionError, SessionContextCompactionManager, SessionManager, SessionMessageCursorError, SessionRequestManager, SessionSettingsError, SkillManager, SystemObjectReferenceError, SystemObjectReferenceManager, UnavailableDesktopHost, UpdateManifestReader, VerificationRecordService, assertObservationJsonValue, assertObservationPredicate, buildAgentRunSendPayload, buildContextCompactionModelProjection, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildNextclawNcpRunContext, buildObservationEventModelMessage, buildServiceActionId, buildSessionRequestCompletionMessage, capabilityGrantCovers, createAgentRuntimeSessionRequestDispatcher, createAgentRuntimeSessionRequestSourceNotifier, createAssetTools, createCapabilityDeclarationFingerprint, createContextCompactionMessageId, createContextWindowSignature, createCronJobSystemObjectProvider, createDesktopHostError, createInboxDeliverySystemObjectProvider, createLlmUsageRecord, createPanelAppAgentGrantRequest, createPanelAppClientGrantRequest, createServiceActionGrantRequest, createServiceAppAgentSlotGrantRequest, createServiceAppModelSlotGrantRequest, createTypedKey, describeAgentRuntimeSessionTypes, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, dispatchPromptOverNcpResult, evaluateObservationEventAdmission, evaluatePortableRuntimeAcceptance, evaluatePortableRuntimeAcceptanceArtifact, eventKeys, getAutomaticUpdateCheckDelay, getCapabilityGrantKey, getServiceActionName, getServiceAppManifestPath, getUiContentParamsBootstrapScript, getUnsignedUpdateManifest, hasLlmUsageTelemetry, ingressKeys, injectUiContentParamsBootstrap, isAppDataError, isAppPackageError, isContextCompactionProjectionMessage, isContextCompactionTimelineMessage, isContextWindowSnapshot, isInboxDeliveryError, isPanelAppAgentCapability, isPanelAppError, isPreferenceError, isProjectError, isReplyCapableChannel, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError, isSystemObjectReferenceError, listExtensionChannelIds, listServiceAppManifestActions, matchesCapabilityGrantFilter, matchesObservationPredicate, mergeServiceAppRuntimeActions, normalizeAgentRuntimeSessionTypeIcon, normalizeCapabilityGrantRequest, normalizeLlmUsageModel, normalizeOptionalString, normalizePortableRuntimeEnvironment, parseObservationDuration, parsePortableRuntimeAcceptanceEvidenceArtifact, parseServiceAppManifest, parseSkillFrontmatter, presentPortableRuntimeAcceptanceDefinition, readContextCompactionCheckpoint, readContextWindowEventSessionId, readJsonPointer, readLatestContextCompactionCheckpoint, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, readServiceActionTargetId, readServiceAppManifest, readServiceAppSlotTarget, resolveAgentRuntimeEntries, resolveAutomaticUpdateCheckIntervalMs, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolvePortableRuntimeAcceptanceLocale, resolveSessionChannelContext, runGatewayInboundLoop, runNextclawTask, sanitizeLlmUsage, serializeContextTail, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, startPromptOverNcpExecution, stripSkillFrontmatter, syncSessionThinkingPreference, toBoundedJson, toNcpMessages, waitForAgentRuntimeSessionReply };
+export { AUTOMATIC_UPDATE_CHECK_INTERVAL_MS, AccessManager, AgentManager, AgentRunClient, AppDataError, AppDataManager, AppPackageError, AppPackageManager, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_CONTINUATION_TEXT, CONTEXT_COMPACTION_PROJECTION_KIND, CONTEXT_COMPACTION_PROJECTION_METADATA_KEY, CONTEXT_COMPACTION_SYSTEM_PREAMBLE, CONTEXT_COMPACTION_TIMELINE_KIND, CapabilityGrantLegacyMigrationService, CapabilityGrantManager, CapabilityGrantStore, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionJournalRecoveryService, ContextCompactionPreflightService, Contribution, DEFAULT_AGENT_RUNTIME_ENTRY_ID, DEFAULT_SERVICE_ACTION_RISK, DESKTOP_HOST_ACCESS, DESKTOP_HOST_PROTOCOL_VERSION, DesktopHostCapabilityManager, DesktopNodeReplService, DesktopSessionStateService, EventBus, ExtensionManager, FeatureControlsService, GatewayInboundProcessor, InboxDeliveryError, InboxDeliveryManager, Ingress, LlmProviderManager, LlmUsageManager, LlmUsageStore, MAX_INBOX_DELIVERY_CONTENT_LENGTH, McpManager, McpServiceAppRuntimeService, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawHarness, NextclawHarnessError, NextclawKernel, ObservationManager, PANEL_APP_AGENT_CAPABILITIES, PORTABLE_RUNTIME_ACCEPTANCE_CONTRACT, PORTABLE_RUNTIME_ACCEPTANCE_CONTRACT_FINGERPRINT, PORTABLE_RUNTIME_ACCEPTANCE_LOCALES, PORTABLE_RUNTIME_ACCEPTANCE_PLATFORMS, PORTABLE_RUNTIME_ACCEPTANCE_PRESENTATION, PORTABLE_RUNTIME_ACCEPTANCE_REFERENCE_APP_ID, PROJECT_OBSERVATION_PROTOCOL, PROJECT_TEMPLATE_IDS, PROJECT_WORK_ATTENTION_VALUES, PROJECT_WORK_STATE_CATEGORIES, PROVIDER_MODEL_CATALOG_REFRESH_INTERVAL_MS, PanelAppAssetTokenService, PanelAppError, PanelAppManager, PortableRuntimeAcceptanceIdentityService, PortableRuntimeAcceptanceManager, PreferenceError, PreferenceManager, ProjectError, ProjectManager, ProjectObservationError, ProjectObservationService, ProjectWorkError, ProjectWorkManager, ProviderManagerNcpLLMApi, ProviderModelCatalogManager, SERVICE_APP_MANIFEST_FILE_NAME, ServiceAppAiCapabilityService, ServiceAppError, ServiceAppJobJournalService, ServiceAppManager, ServiceAppResidentEventInboxService, ServiceAppRuntimeService, SessionContextCompactionError, SessionContextCompactionManager, SessionManager, SessionMessageCursorError, SessionRequestManager, SessionSettingsError, SkillManager, SystemObjectReferenceError, SystemObjectReferenceManager, UnavailableDesktopHost, UpdateManifestReader, VerificationRecordService, assertObservationJsonValue, assertObservationPredicate, buildAgentRunSendPayload, buildContextCompactionModelProjection, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildNextclawNcpRunContext, buildObservationEventModelMessage, buildServiceActionId, buildSessionRequestCompletionMessage, capabilityGrantCovers, createAgentRuntimeSessionRequestDispatcher, createAgentRuntimeSessionRequestSourceNotifier, createAssetTools, createCapabilityDeclarationFingerprint, createContextCompactionMessageId, createContextWindowSignature, createCronJobSystemObjectProvider, createDesktopHostError, createInboxDeliverySystemObjectProvider, createLlmUsageRecord, createPanelAppAgentGrantRequest, createPanelAppClientGrantRequest, createServiceActionGrantRequest, createServiceAppAgentSlotGrantRequest, createServiceAppModelSlotGrantRequest, createTypedKey, describeAgentRuntimeSessionTypes, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, dispatchPromptOverNcpResult, evaluateObservationEventAdmission, evaluatePortableRuntimeAcceptance, evaluatePortableRuntimeAcceptanceArtifact, eventKeys, getAutomaticUpdateCheckDelay, getCapabilityGrantKey, getServiceActionName, getServiceAppManifestPath, getUiContentParamsBootstrapScript, getUnsignedUpdateManifest, hasLlmUsageTelemetry, ingressKeys, injectUiContentParamsBootstrap, isAppDataError, isAppPackageError, isContextCompactionProjectionMessage, isContextCompactionTimelineMessage, isContextWindowSnapshot, isInboxDeliveryError, isPanelAppAgentCapability, isPanelAppError, isPreferenceError, isProjectError, isProjectObservationError, isProjectWorkError, isReplyCapableChannel, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError, isSystemObjectReferenceError, listExtensionChannelIds, listServiceAppManifestActions, matchesCapabilityGrantFilter, matchesObservationPredicate, mergeServiceAppRuntimeActions, normalizeAgentRuntimeSessionTypeIcon, normalizeCapabilityGrantRequest, normalizeLlmUsageModel, normalizeOptionalString, normalizePortableRuntimeEnvironment, parseObservationDuration, parsePortableRuntimeAcceptanceEvidenceArtifact, parseServiceAppManifest, parseSkillFrontmatter, presentPortableRuntimeAcceptanceDefinition, readContextCompactionCheckpoint, readContextWindowEventSessionId, readJsonPointer, readLatestContextCompactionCheckpoint, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, readServiceActionTargetId, readServiceAppManifest, readServiceAppSlotTarget, resolveAgentRuntimeEntries, resolveAutomaticUpdateCheckIntervalMs, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolvePortableRuntimeAcceptanceLocale, resolveSessionChannelContext, runGatewayInboundLoop, runNextclawTask, sanitizeLlmUsage, serializeContextTail, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, startPromptOverNcpExecution, stripSkillFrontmatter, syncSessionThinkingPreference, toBoundedJson, toNcpMessages, waitForAgentRuntimeSessionReply };
 
 //# sourceMappingURL=index.js.map