@openagentpack/sdk 0.2.0-beta.0 → 0.3.0-beta-e537ab3-20260722

package/dist/index.js

@@ -35,9 +35,22 @@ var REQUIRED_METHODS_BY_KIND = {
   skill: ["createSkill", "updateSkill", "deleteSkill"],
   agent: ["createAgent", "updateAgent", "deleteAgent"],
   template: ["createTemplate", "updateTemplate", "archiveTemplate"],
-  memory_store: ["createMemoryStore", "deleteMemoryStore"],
+  memory_store: [
+    "createMemoryStore",
+    "deleteMemoryStore",
+    "listMemoryStores",
+    "getMemoryStore",
+    "updateMemoryStore",
+    "createMemory",
+    "listMemories",
+    "getMemory",
+    "updateMemory",
+    "deleteMemory"
+  ],
   deployment: ["createDeployment", "updateDeployment", "deleteDeployment", "runDeployment", "getDeployment"],
-  session: ["createSession", "listSessions", "getSession", "deleteSession", "sendSessionMessage"]
+  session: ["createSession", "listSessions", "getSession", "deleteSession", "sendSessionMessage"],
+  identity: ["createIdentity", "updateIdentity", "deleteIdentity"],
+  channel: ["createChannel", "updateChannel", "deleteChannel"]
 };
 
 // src/internal/providers/registry.ts
@@ -45,13 +58,13 @@ var registry = /* @__PURE__ */ new Map();
 function registerProvider(def) {
   registry.set(def.name, def);
 }
-function validateProviderFacets(def, adapter) {
+function validateProviderFacets(def, adapter2) {
   const missing = [];
   for (const [kind, methods] of Object.entries(REQUIRED_METHODS_BY_KIND)) {
     if (!isSupported(def.capabilities, kind)) continue;
-    for (const method of methods) {
-      if (typeof adapter[method] !== "function") {
-        missing.push(`${kind}.${method}`);
+    for (const method2 of methods) {
+      if (typeof adapter2[method2] !== "function") {
+        missing.push(`${kind}.${method2}`);
       }
     }
   }
@@ -75,9 +88,9 @@ function buildProviders(providersConfig, projectName) {
       throw new UserError(`Unknown provider '${name}'. Registered: ${Array.from(registry.keys()).join(", ")}`);
     }
     const parsed = def.configSchema.parse(rawConfig);
-    const adapter = def.createAdapter(parsed, projectName);
-    validateProviderFacets(def, adapter);
-    adapters.set(name, adapter);
+    const adapter2 = def.createAdapter(parsed, projectName);
+    validateProviderFacets(def, adapter2);
+    adapters.set(name, adapter2);
   }
   return adapters;
 }
@@ -144,9 +157,9 @@ function buildProviderFromEnv(providerName, projectName) {
   }
   const config = resolveProviderConfigFromEnv(providerName);
   const parsed = def.configSchema.parse(config);
-  const adapter = def.createAdapter(parsed, projectName);
-  validateProviderFacets(def, adapter);
-  return adapter;
+  const adapter2 = def.createAdapter(parsed, projectName);
+  validateProviderFacets(def, adapter2);
+  return adapter2;
 }
 
 // src/internal/providers/claude/adapter.ts
@@ -285,6 +298,7 @@ var BaseApiClient = class {
           buffer = buffer.slice(boundary + 2);
           boundary = buffer.indexOf("\n\n");
           const dataLines = [];
+          let sseId;
           for (const line of frame.split("\n")) {
             if (line.startsWith(":")) continue;
             if (line.startsWith("event:") && line.slice(6).trim() === "heartbeat") {
@@ -294,11 +308,18 @@ var BaseApiClient = class {
             if (line.startsWith("data:")) {
               dataLines.push(line.slice(5).trimStart());
             }
+            if (line.startsWith("id:")) {
+              sseId = line.slice(3).trimStart();
+            }
           }
           if (dataLines.length === 0) continue;
           const json = dataLines.join("\n");
           try {
-            yield JSON.parse(json);
+            const parsed = JSON.parse(json);
+            if (sseId !== void 0 && parsed.id === void 0) {
+              parsed.id = sseId;
+            }
+            yield parsed;
           } catch {
           }
         }
@@ -352,6 +373,216 @@ function toRemoteResource(res) {
   };
 }
 
+// src/internal/providers/memory-api.ts
+function query(path, values) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(values)) {
+    if (value !== void 0 && value !== null) params.set(key, String(value));
+  }
+  const encoded = params.toString();
+  return encoded ? `${path}?${encoded}` : path;
+}
+function canonicalPath(path) {
+  return path.replace(/^\/+/, "");
+}
+function providerPath(path, style) {
+  const relative = canonicalPath(path);
+  return style === "absolute" ? `/${relative}` : relative;
+}
+function page(raw, map) {
+  const body = raw;
+  const data = (body.data ?? body.items ?? body.memories ?? body.memory_stores ?? body.memory_versions ?? []).map(map);
+  const next = body.next_cursor ?? body.next_page ?? body.last_id;
+  return { data, has_more: Boolean(body.has_more ?? next), ...next ? { next_cursor: next } : {} };
+}
+function mapMemoryStore(raw) {
+  return {
+    id: String(raw.id),
+    type: "memory_store",
+    name: String(raw.name ?? ""),
+    description: String(raw.description ?? ""),
+    metadata: raw.metadata ?? {},
+    ...raw.status ? { status: String(raw.status) } : {},
+    ...typeof (raw.entry_count ?? raw.memory_count) === "number" ? { entry_count: Number(raw.entry_count ?? raw.memory_count) } : {},
+    ...typeof (raw.total_size ?? raw.storage_bytes) === "number" ? { total_size: Number(raw.total_size ?? raw.storage_bytes) } : {},
+    ...typeof raw.session_count === "number" ? { session_count: raw.session_count } : {},
+    created_by: raw.created_by,
+    created_at: String(raw.created_at ?? ""),
+    updated_at: String(raw.updated_at ?? raw.created_at ?? ""),
+    archived_at: raw.archived_at ?? null
+  };
+}
+function mapMemory(raw) {
+  return {
+    id: String(raw.id),
+    type: "memory",
+    memory_store_id: String(raw.memory_store_id ?? raw.store_id ?? ""),
+    path: canonicalPath(String(raw.path ?? "")),
+    content: raw.content,
+    content_size_bytes: Number(raw.content_size_bytes ?? raw.size ?? 0),
+    content_sha256: String(raw.content_sha256 ?? ""),
+    ...typeof raw.version === "number" ? { version: raw.version } : {},
+    ...raw.memory_version_id ? { memory_version_id: String(raw.memory_version_id) } : {},
+    metadata: raw.metadata ?? {},
+    created_by: raw.created_by,
+    created_at: String(raw.created_at ?? ""),
+    updated_at: String(raw.updated_at ?? raw.created_at ?? "")
+  };
+}
+function mapMemoryListItem(raw) {
+  if (raw.type === "memory_prefix") return { type: "memory_prefix", path: canonicalPath(String(raw.path ?? "")) };
+  return mapMemory(raw);
+}
+function mapMemoryVersion(raw) {
+  const operation = String(raw.operation ?? raw.action ?? "updated");
+  return {
+    id: String(raw.id),
+    type: "memory_version",
+    memory_store_id: String(raw.memory_store_id ?? raw.store_id ?? ""),
+    memory_id: String(raw.memory_id ?? raw.entry_id ?? ""),
+    path: (raw.path ?? raw.entry_path) == null ? raw.path ?? raw.entry_path : canonicalPath(String(raw.path ?? raw.entry_path)),
+    content: raw.content,
+    content_size_bytes: raw.content_size_bytes ?? raw.size,
+    content_sha256: raw.content_sha256,
+    operation: operation === "modified" ? "updated" : operation,
+    ...typeof raw.version === "number" ? { version: raw.version } : {},
+    ...typeof raw.redacted === "boolean" ? { redacted: raw.redacted } : {},
+    redacted_at: raw.redacted_at,
+    created_by: raw.created_by,
+    created_at: String(raw.created_at ?? "")
+  };
+}
+var ProviderMemoryApi = class {
+  constructor(client, dialect) {
+    this.client = client;
+    this.dialect = dialect;
+  }
+  client;
+  dialect;
+  async listStores(options = {}) {
+    const raw = await this.client.get(
+      query("/memory_stores", {
+        limit: options.limit,
+        [this.dialect.cursorParam]: options.cursor,
+        include_archived: this.dialect.supportsIncludeArchived ? options.include_archived : void 0
+      })
+    );
+    return page(raw, mapMemoryStore);
+  }
+  async getStore(id) {
+    return mapMemoryStore(await this.client.get(`/memory_stores/${id}`));
+  }
+  async updateStore(id, input) {
+    let body = { ...input };
+    if (this.dialect.storeMetadataMode === "merge_patch" && input.metadata !== void 0) {
+      const current = await this.getStore(id);
+      body = {
+        ...input,
+        metadata: {
+          ...Object.fromEntries(Object.keys(current.metadata).map((key) => [key, null])),
+          ...input.metadata
+        }
+      };
+    }
+    return mapMemoryStore(await this.client.post(`/memory_stores/${id}`, body));
+  }
+  async archiveStore(id) {
+    return mapMemoryStore(await this.client.post(`/memory_stores/${id}/archive`, {}));
+  }
+  async createMemory(storeId, input) {
+    const body = {
+      path: providerPath(input.path, this.dialect.pathStyle),
+      content: input.content,
+      ...this.dialect.supportsMemoryMetadata && input.metadata ? { metadata: input.metadata } : {}
+    };
+    return mapMemory(await this.client.post(`/memory_stores/${storeId}/memories`, body));
+  }
+  async listMemories(storeId, options = {}) {
+    const raw = await this.client.get(
+      query(`/memory_stores/${storeId}/memories`, {
+        limit: options.limit,
+        [this.dialect.cursorParam]: options.cursor,
+        [this.dialect.prefixParam]: options.prefix ? providerPath(options.prefix, this.dialect.pathStyle) : void 0,
+        depth: options.depth,
+        view: this.dialect.supportsView ? options.view : void 0
+      })
+    );
+    return page(raw, mapMemoryListItem);
+  }
+  async getMemory(storeId, memoryId) {
+    const path = `/memory_stores/${storeId}/memories/${memoryId}${this.dialect.supportsView ? "?view=full" : ""}`;
+    return mapMemory(await this.client.get(path));
+  }
+  async updateMemory(storeId, memoryId, input) {
+    const { expected_content_sha256, ...values } = input;
+    const body = {
+      ...values.content !== void 0 ? { content: values.content } : {},
+      ...this.dialect.supportsMemoryMetadata && values.metadata ? { metadata: values.metadata } : {},
+      ...this.dialect.supportsPathUpdate !== false && values.path ? { path: providerPath(values.path, this.dialect.pathStyle) } : {}
+    };
+    if (expected_content_sha256 && this.dialect.updatePrecondition !== "none") {
+      if (this.dialect.updatePrecondition === "precondition") {
+        body.precondition = { type: "content_sha256", content_sha256: expected_content_sha256 };
+      } else {
+        body[this.dialect.updatePrecondition] = expected_content_sha256;
+      }
+    }
+    const path = `/memory_stores/${storeId}/memories/${memoryId}${this.dialect.supportsView ? "?view=full" : ""}`;
+    const raw = await this.client.post(path, body);
+    return mapMemory(raw);
+  }
+  async deleteMemory(storeId, memoryId, expected) {
+    await this.client.delete(
+      query(`/memory_stores/${storeId}/memories/${memoryId}`, {
+        expected_content_sha256: this.dialect.supportsDeletePrecondition ? expected : void 0
+      })
+    );
+  }
+  async listVersions(storeId, options = {}) {
+    const segment = this.dialect.versionsSegment ?? "memory_versions";
+    const raw = await this.client.get(
+      query(`/memory_stores/${storeId}/${segment}`, {
+        limit: options.limit,
+        [this.dialect.cursorParam]: options.cursor,
+        memory_id: options.memory_id,
+        view: this.dialect.supportsView ? options.view : void 0
+      })
+    );
+    return page(raw, mapMemoryVersion);
+  }
+  async getVersion(storeId, versionId) {
+    const segment = this.dialect.versionsSegment ?? "memory_versions";
+    return mapMemoryVersion(
+      await this.client.get(
+        `/memory_stores/${storeId}/${segment}/${versionId}${this.dialect.supportsView ? "?view=full" : ""}`
+      )
+    );
+  }
+  async redactVersion(storeId, versionId) {
+    const segment = this.dialect.versionsSegment ?? "memory_versions";
+    return mapMemoryVersion(
+      await this.client.post(`/memory_stores/${storeId}/${segment}/${versionId}/redact`, {})
+    );
+  }
+  async batchCreateMemories(storeId, input) {
+    const body = {
+      items: input.items.map((item) => ({
+        path: providerPath(item.path, this.dialect.pathStyle),
+        content: item.content
+      })),
+      on_conflict: input.on_conflict
+    };
+    const raw = await this.client.post(`/memory_stores/${storeId}/memories/batch_create`, body);
+    return {
+      results: (raw.results ?? []).map((item) => ({
+        path: canonicalPath(item.path),
+        ...item.memory ? { memory: mapMemory(item.memory) } : {},
+        ...item.error ? { error: item.error } : {}
+      }))
+    };
+  }
+};
+
 // src/internal/providers/session-event-response.ts
 async function listSessionEventsPaged(client, sessionId, options, toEvent, config) {
   const params = new URLSearchParams();
@@ -626,8 +857,193 @@ function stripAgentsMetadata(value) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 
+// src/internal/utils/sandbox-mount.ts
+var PROVIDER_MOUNT_PREFIXES = {
+  qoder: "/data",
+  claude: "/workspace",
+  bailian: "/mnt",
+  ark: "/mnt"
+};
+function joinAbsolute(prefix, sub) {
+  const left = prefix.replace(/\/+$/, "");
+  const right = sub.replace(/^\/+/, "");
+  return `${left}/${right}`;
+}
+function quoteShellWord(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function stripUrlQueryAndFragment(value) {
+  const queryIndex = value.indexOf("?");
+  const fragmentIndex = value.indexOf("#");
+  if (queryIndex === -1) {
+    return fragmentIndex === -1 ? value : value.slice(0, fragmentIndex);
+  }
+  if (fragmentIndex === -1) return value.slice(0, queryIndex);
+  return value.slice(0, Math.min(queryIndex, fragmentIndex));
+}
+function stripGitSuffix(value) {
+  return value.toLowerCase().endsWith(".git") ? value.slice(0, -4) : value;
+}
+function lastRemotePathSegment(value) {
+  const lastSlash = value.lastIndexOf("/");
+  const lastColon = value.lastIndexOf(":");
+  return value.slice(Math.max(lastSlash, lastColon) + 1).trim();
+}
+function providerMountPrefix(provider) {
+  return PROVIDER_MOUNT_PREFIXES[provider];
+}
+function resolveSandboxMountPath(provider, mountPath) {
+  const prefix = providerMountPrefix(provider);
+  if (!prefix) return mountPath;
+  if (mountPath === prefix || mountPath.startsWith(`${prefix}/`)) return mountPath;
+  if (mountPath.startsWith("/")) {
+    throw new UserError(`${provider} mount_path must start with '${prefix}/'; received '${mountPath}'.`);
+  }
+  return joinAbsolute(prefix, mountPath);
+}
+function resolveRepositoryMountPath(provider, resource) {
+  const prefix = providerMountPrefix(provider);
+  if (!prefix) throw new UserError(`Provider '${provider}' has no declared mount path prefix.`);
+  if (resource.mount_path) {
+    if (resource.mount_path !== prefix && !resource.mount_path.startsWith(`${prefix}/`)) {
+      throw new UserError(`${provider} Git repository Session resource mount_path must start with '${prefix}/'.`);
+    }
+    return resource.mount_path;
+  }
+  const repositoryName = stripGitSuffix(lastRemotePathSegment(stripUrlQueryAndFragment(resource.url)));
+  if (!repositoryName) {
+    throw new UserError(`Cannot derive a ${provider} Git repository mount path from URL '${resource.url}'.`);
+  }
+  return provider === "qoder" ? `${prefix}/workspace/${repositoryName}` : `${prefix}/${repositoryName}`;
+}
+function composeFileMountHint(files, provider) {
+  if (!files || files.length === 0) return "";
+  const lines = files.map((f) => `- ${resolveSandboxMountPath(provider, f.mount_path)}`);
+  return [
+    "The user uploaded files. They are available at the following sandbox paths:",
+    ...lines,
+    "Read them from these paths when relevant."
+  ].join("\n");
+}
+function prependFileHint(prompt, files, provider) {
+  const hint = composeFileMountHint(files, provider);
+  if (!hint) return prompt;
+  return `${hint}
+
+${prompt}`;
+}
+var FILE_MENTION_START = "\u27E6file:";
+var FILE_MENTION_END = "\u27E7";
+function rewriteFileMentions(prompt, provider) {
+  let cursor = 0;
+  let rewritten = "";
+  while (cursor < prompt.length) {
+    const start = prompt.indexOf(FILE_MENTION_START, cursor);
+    if (start === -1) {
+      rewritten += prompt.slice(cursor);
+      break;
+    }
+    const mountPathStart = start + FILE_MENTION_START.length;
+    const end = prompt.indexOf(FILE_MENTION_END, mountPathStart);
+    if (end === -1) {
+      rewritten += prompt.slice(cursor);
+      break;
+    }
+    rewritten += prompt.slice(cursor, start);
+    rewritten += resolveSandboxMountPath(provider, prompt.slice(mountPathStart, end));
+    cursor = end + FILE_MENTION_END.length;
+  }
+  return rewritten;
+}
+function preparePromptForProvider(prompt, files, provider) {
+  return prependFileHint(rewriteFileMentions(prompt, provider), files, provider);
+}
+function prepareInitialSessionPrompt(prompt, bindings, provider) {
+  const prepared = preparePromptForProvider(prompt, bindings.files, provider);
+  const repositories = (bindings.resources ?? []).filter(
+    (resource) => resource.type === "github_repository"
+  );
+  if (repositories.length === 0) return prepared;
+  const paths = repositories.map((resource) => resolveRepositoryMountPath(provider, resource));
+  if (paths.length === 1) {
+    const path = paths[0];
+    return [
+      `The Git working tree for this task is mounted at \`${path}\`.`,
+      "Work only inside this directory unless the user explicitly requests otherwise.",
+      "Prefix every shell command with:",
+      `cd -- ${quoteShellWord(path)} &&`,
+      `Use absolute paths under \`${path}\` for non-shell file tools.`,
+      "",
+      prepared
+    ].join("\n");
+  }
+  const lines = ["Git working trees for this task are mounted at:", ...paths.map((path) => `- ${path}`)];
+  lines.push("Choose the appropriate working tree for the task before inspecting or modifying files.");
+  return `${lines.join("\n")}
+
+${prepared}`;
+}
+
+// src/internal/utils/tool-permissions.ts
+function canonicalToolName(name) {
+  return name.trim().replace(/[^a-zA-Z0-9]+/g, "").toLowerCase();
+}
+function resolveBuiltinTools(tools, options = {}) {
+  const permissionByName = /* @__PURE__ */ new Map();
+  for (const [name, permission] of Object.entries(tools.permissions ?? {})) {
+    permissionByName.set(canonicalToolName(name), permission);
+  }
+  const supportedByName = options.supportedWireNames ? new Map([...options.supportedWireNames].map((name) => [canonicalToolName(name), name])) : void 0;
+  return tools.builtin.flatMap((configuredName) => {
+    const candidate = options.toWireName?.(configuredName) ?? configuredName;
+    const wireName = supportedByName?.get(canonicalToolName(candidate)) ?? (supportedByName ? void 0 : candidate);
+    if (!wireName) return [];
+    return [
+      {
+        configuredName,
+        wireName,
+        permission: permissionByName.get(canonicalToolName(configuredName)) ?? tools.default_permission ?? "allow"
+      }
+    ];
+  });
+}
+function toPermissionPolicy(permission) {
+  return { type: permission === "ask" ? "always_ask" : "always_allow" };
+}
+function permissionOverridesFromWire(configs, toConfigName = (name) => name) {
+  const permissions = {};
+  for (const config of configs) {
+    if (config.enabled === false) continue;
+    const rawPolicy = config.permission_policy;
+    const type = typeof rawPolicy === "string" ? rawPolicy : rawPolicy && typeof rawPolicy === "object" ? rawPolicy.type : void 0;
+    if (type === "always_ask") permissions[toConfigName(config.name)] = "ask";
+    else if (type === "always_allow") permissions[toConfigName(config.name)] = "allow";
+  }
+  return Object.keys(permissions).length ? permissions : void 0;
+}
+
+// src/internal/providers/session-resource-mapper.ts
+function resolveGithubRepositoryMountPath(provider, resource) {
+  return resolveRepositoryMountPath(provider, resource);
+}
+function mapGithubRepositorySessionResource(resource, options = {}) {
+  const entry = {
+    type: "github_repository",
+    url: options.mapUrl?.(resource.url) ?? resource.url,
+    authorization_token: resource.authorization_token
+  };
+  if (resource.checkout?.branch) entry.checkout = { type: "branch", name: resource.checkout.branch };
+  else if (resource.checkout?.commit) entry.checkout = { type: "commit", sha: resource.checkout.commit };
+  const mountPath = options.mapMountPath?.(resource) ?? resource.mount_path;
+  if (mountPath) entry.mount_path = mountPath;
+  return entry;
+}
+
 // src/internal/providers/claude/mapper.ts
 var CLAUDE_BUILTINS = /* @__PURE__ */ new Set(["read", "write", "edit", "bash", "glob", "grep", "web_search", "web_fetch"]);
+function normalizeGithubRepositoryUrlForClaude(url) {
+  return url.replace(/\.git\/?$/, "");
+}
 function credToDecl(raw, vaultName) {
   const auth = raw.auth ?? {};
   const name = raw.display_name || raw.id || "credential";
@@ -698,6 +1114,7 @@ function agentToDecl(raw) {
   const skills = raw.skills;
   const multiagent = raw.multiagent;
   let builtinTools;
+  let builtinPermissions;
   let allToolsEnabled = false;
   if (tools?.length) {
     const toolset = tools.find((t) => t.type === "agent_toolset_20260401");
@@ -706,6 +1123,7 @@ function agentToDecl(raw) {
       const configs = toolset.configs ?? [];
       if (configs.length > 0) {
         builtinTools = configs.filter((c) => c.enabled !== false).map((c) => c.name);
+        builtinPermissions = permissionOverridesFromWire(configs);
       } else if (defaultConfig?.enabled) {
         allToolsEnabled = true;
       }
@@ -732,7 +1150,7 @@ function agentToDecl(raw) {
   }
   let toolsDecl;
   if (builtinTools?.length) {
-    toolsDecl = { builtin: builtinTools };
+    toolsDecl = { builtin: builtinTools, permissions: builtinPermissions };
   } else if (allToolsEnabled) {
     toolsDecl = {
       builtin: ["read", "write", "edit", "bash", "glob", "grep", "web_search", "web_fetch"]
@@ -792,16 +1210,11 @@ function mapAgent(name, decl, refs, version, projectName) {
     body.metadata = decl.metadata;
   }
   if (decl.tools) {
-    const toolConfigs = decl.tools.builtin.filter((toolName) => CLAUDE_BUILTINS.has(toolName)).map((toolName) => {
-      const permission = decl.tools?.permissions?.[toolName] ?? "allow";
-      return {
-        name: toolName,
-        enabled: true,
-        permission_policy: {
-          type: permission === "ask" ? "always_ask" : "always_allow"
-        }
-      };
-    });
+    const toolConfigs = resolveBuiltinTools(decl.tools, { supportedWireNames: CLAUDE_BUILTINS }).map((tool) => ({
+      name: tool.wireName,
+      enabled: true,
+      permission_policy: toPermissionPolicy(tool.permission)
+    }));
     body.tools = [
       {
         type: "agent_toolset_20260401",
@@ -867,6 +1280,23 @@ function mapDeployment(name, decl, refs, projectName, uploadedFiles) {
   }
   return body;
 }
+function mapDeploymentUpdate(name, decl, refs, projectName, uploadedFiles, existingMetadata) {
+  const body = mapDeployment(name, decl, refs, projectName, uploadedFiles);
+  body.vault_ids = refs.vault_ids;
+  body.resources = mapDeploymentResources(decl, refs, uploadedFiles);
+  if (decl.schedule) {
+    body.schedule = { type: "cron", expression: decl.schedule.expression, timezone: decl.schedule.timezone };
+  }
+  body.description = decl.description ?? "";
+  const desiredMetadata = projectName ? injectMetadata(decl.metadata, projectName, name) : decl.metadata ?? {};
+  body.metadata = {
+    ...Object.fromEntries(
+      Object.keys(existingMetadata ?? {}).filter((key) => !(key in desiredMetadata)).map((key) => [key, null])
+    ),
+    ...desiredMetadata
+  };
+  return body;
+}
 function mapInitialEvents(events) {
   return events.map((ev) => {
     if (ev.type === "user.message" || ev.type === "system.message") {
@@ -900,7 +1330,7 @@ function mapDeploymentResources(decl, refs, uploadedFiles) {
     } else if (r.type === "github_repository") {
       const entry = {
         type: "github_repository",
-        url: r.url
+        url: normalizeGithubRepositoryUrlForClaude(r.url)
       };
       if (r.authorization_token) entry.authorization_token = r.authorization_token;
       if (r.checkout?.branch) {
@@ -1029,8 +1459,16 @@ function mapSession(bindings) {
     resources.push({
       type: "file",
       file_id: f.file_id,
-      mount_path: f.mount_path
+      mount_path: resolveSandboxMountPath("claude", f.mount_path)
     });
+  for (const resource of bindings.resources ?? []) {
+    resources.push(
+      mapGithubRepositorySessionResource(resource, {
+        mapUrl: normalizeGithubRepositoryUrlForClaude,
+        mapMountPath: (item) => resolveGithubRepositoryMountPath("claude", item)
+      })
+    );
+  }
   if (resources.length) body.resources = resources;
   return body;
 }
@@ -1039,10 +1477,30 @@ function mapSession(bindings) {
 var ClaudeAdapter = class _ClaudeAdapter {
   name = "claude";
   eventResume = false;
+  memoryCapabilities = {
+    archive_store: true,
+    batch_create: false,
+    versions: true,
+    optimistic_concurrency: true,
+    memory_metadata: false
+  };
   client;
+  memoryClient;
+  memoryApi;
   projectName;
   constructor(apiKey, beta, projectName) {
     this.client = new ClaudeClient({ apiKey, beta });
+    this.memoryClient = new ClaudeClient({ apiKey, beta: "agent-memory-2026-07-22" });
+    this.memoryApi = new ProviderMemoryApi(this.memoryClient, {
+      pathStyle: "absolute",
+      cursorParam: "page",
+      updatePrecondition: "precondition",
+      prefixParam: "path_prefix",
+      supportsView: true,
+      supportsMemoryMetadata: false,
+      supportsDeletePrecondition: true,
+      supportsIncludeArchived: true
+    });
     this.projectName = projectName ?? "";
   }
   async validate() {
@@ -1058,7 +1516,13 @@ var ClaudeAdapter = class _ClaudeAdapter {
     file: "/files"
   };
   async findResource(type, name, id) {
-    const raw = await locateRemote(this.client, _ClaudeAdapter.ENDPOINT_MAP[type], name, id, notArchived);
+    const raw = await locateRemote(
+      type === "memory_store" ? this.memoryClient : this.client,
+      _ClaudeAdapter.ENDPOINT_MAP[type],
+      name,
+      id,
+      notArchived
+    );
     return raw ? toRemoteResource(raw) : null;
   }
   async listAgents(filter) {
@@ -1191,6 +1655,62 @@ var ClaudeAdapter = class _ClaudeAdapter {
   async deleteAgent(id) {
     await this.client.post(`/agents/${id}/archive`, {});
   }
+  async createMemoryStore(name, decl) {
+    const res = await this.memoryClient.post("/memory_stores", {
+      name,
+      description: decl.description,
+      metadata: decl.metadata
+    });
+    const storeId = String(res.id);
+    try {
+      for (const entry of decl.entries ?? []) {
+        await this.memoryApi.createMemory(storeId, { path: entry.key, content: entry.content });
+      }
+    } catch (error) {
+      await this.memoryClient.delete(`/memory_stores/${storeId}`).catch(() => void 0);
+      throw error;
+    }
+    return toRemoteResource(res);
+  }
+  async deleteMemoryStore(id) {
+    await this.memoryClient.delete(`/memory_stores/${id}`);
+  }
+  listMemoryStores(options) {
+    return this.memoryApi.listStores(options);
+  }
+  getMemoryStore(id) {
+    return this.memoryApi.getStore(id);
+  }
+  updateMemoryStore(id, input) {
+    return this.memoryApi.updateStore(id, input);
+  }
+  archiveMemoryStore(id) {
+    return this.memoryApi.archiveStore(id);
+  }
+  createMemory(storeId, input) {
+    return this.memoryApi.createMemory(storeId, input);
+  }
+  listMemories(storeId, options) {
+    return this.memoryApi.listMemories(storeId, options);
+  }
+  getMemory(storeId, memoryId) {
+    return this.memoryApi.getMemory(storeId, memoryId);
+  }
+  updateMemory(storeId, memoryId, input) {
+    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  }
+  deleteMemory(storeId, memoryId, expected) {
+    return this.memoryApi.deleteMemory(storeId, memoryId, expected);
+  }
+  listMemoryVersions(storeId, options) {
+    return this.memoryApi.listVersions(storeId, options);
+  }
+  getMemoryVersion(storeId, versionId) {
+    return this.memoryApi.getVersion(storeId, versionId);
+  }
+  redactMemoryVersion(storeId, versionId) {
+    return this.memoryApi.redactVersion(storeId, versionId);
+  }
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment(name, decl, refs, this.projectName, uploaded);
@@ -1199,7 +1719,20 @@ var ClaudeAdapter = class _ClaudeAdapter {
   }
   async updateDeployment(id, name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
-    const body = mapDeployment(name, decl, refs, this.projectName, uploaded);
+    const current = await this.client.get(`/deployments/${id}`);
+    if (current.schedule && !decl.schedule) {
+      throw new UserError(
+        `Deployment '${name}' cannot remove its schedule through the documented Claude update API; archive and recreate it as a manual deployment.`
+      );
+    }
+    const body = mapDeploymentUpdate(
+      name,
+      decl,
+      refs,
+      this.projectName,
+      uploaded,
+      current.metadata
+    );
     const res = await this.client.post(`/deployments/${id}`, body);
     return toRemoteResource(res);
   }
@@ -1251,6 +1784,36 @@ var ClaudeAdapter = class _ClaudeAdapter {
       attributes: res
     };
   }
+  async listDeployments(filter) {
+    const params = new URLSearchParams();
+    if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.status) params.set("status", filter.status);
+    if (filter?.include_archived) params.set("include_archived", "true");
+    if (filter?.limit) params.set("limit", String(filter.limit));
+    if (filter?.page) params.set("page", filter.page);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
+    const query2 = params.toString();
+    const res = await this.client.get(`/deployments${query2 ? `?${query2}` : ""}`);
+    const nextPage = res.next_page ?? void 0;
+    return {
+      deployments: (res.data ?? []).map(toDeploymentInfo),
+      has_more: nextPage !== void 0,
+      next_page: nextPage
+    };
+  }
+  async pauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, true);
+  }
+  async unpauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, false);
+  }
+  async setDeploymentPaused(ctx, paused) {
+    if (!ctx.id) throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    const action = paused ? "pause" : "unpause";
+    const res = await this.client.post(`/deployments/${ctx.id}/${action}`, {});
+    return toDeploymentInfo(res);
+  }
   async createSession(bindings) {
     if (bindings.delivery === "forward") throw new UserError("Claude does not support Forward sessions.");
     const body = mapSession(bindings);
@@ -1322,6 +1885,16 @@ var ClaudeAdapter = class _ClaudeAdapter {
     await this.client.delete(`/files/${id}`);
   }
 };
+function toDeploymentInfo(res) {
+  const sched = res.schedule;
+  return {
+    id: res.id ?? null,
+    status: res.status ?? "unknown",
+    paused_reason: res.paused_reason ?? void 0,
+    schedule: sched ? { expression: sched.expression, timezone: sched.timezone } : void 0,
+    attributes: res
+  };
+}
 function toSessionInfo(res) {
   return buildSessionInfo(
     res,
@@ -1353,15 +1926,13 @@ var CLAUDE_CAPABILITIES = {
   skill: { tier: "native", reason: "skills API with files[] upload" },
   agent: { tier: "native", reason: "managed agents API" },
   template: { tier: "unsupported", reason: "no Forward Template equivalent on Claude" },
-  memory_store: {
-    tier: "unsupported",
-    reason: "Claude exposes Memory Stores, but the OpenAgentPack adapter has not implemented them yet",
-    remediation: "use skill knowledge or MCP until Claude Memory Store support is added to the adapter"
-  },
+  memory_store: { tier: "native", reason: "beta memory_stores API" },
   mcp_server: { tier: "native", reason: "mcp_servers field on agent" },
   multiagent: { tier: "native", reason: "coordinator + roster topology" },
   deployment: { tier: "native", reason: "deployments API" },
-  session: { tier: "native", reason: "sessions API" }
+  session: { tier: "native", reason: "sessions API" },
+  identity: { tier: "unsupported", reason: "no mapped Identity primitive on Claude" },
+  channel: { tier: "unsupported", reason: "no mapped messaging Channel primitive on Claude" }
 };
 
 // src/internal/providers/claude/config.ts
@@ -1376,6 +1947,7 @@ registerProvider({
   name: "claude",
   configSchema: claudeConfigSchema,
   capabilities: CLAUDE_CAPABILITIES,
+  features: { tool_permissions: true, session_resources: ["github_repository"] },
   createAdapter: (config, projectName) => {
     const c = config;
     return new ClaudeAdapter(c.api_key, c.beta, projectName);
@@ -1384,7 +1956,7 @@ registerProvider({
 
 // src/internal/providers/qoder/adapter.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { basename as basename3, dirname as dirname2, resolve as resolve2 } from "path";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
 import JSZip2 from "jszip";
 
 // src/internal/providers/qoder/client.ts
@@ -1409,57 +1981,6 @@ var QoderClient = class extends BaseApiClient {
   }
 };
 
-// src/internal/utils/sandbox-mount.ts
-var AGENTS_SESSION_PREFIX = "/mnt/session";
-function joinAbsolute(prefix, sub) {
-  const left = prefix.replace(/\/+$/, "");
-  const right = sub.replace(/^\/+/, "");
-  return `${left}/${right}`;
-}
-function basename2(p) {
-  const trimmed = p.replace(/\/+$/, "");
-  const idx = trimmed.lastIndexOf("/");
-  return idx === -1 ? trimmed : trimmed.slice(idx + 1);
-}
-function resolveSandboxMountPath(provider, mountPath) {
-  switch (provider) {
-    case "ark":
-    case "bailian":
-    case "claude":
-      return joinAbsolute(AGENTS_SESSION_PREFIX, mountPath);
-    case "qoder":
-      return joinAbsolute("/data", basename2(mountPath));
-    default:
-      return mountPath;
-  }
-}
-function composeFileMountHint(files, provider) {
-  if (!files || files.length === 0) return "";
-  const lines = files.map((f) => `- ${resolveSandboxMountPath(provider, f.mount_path)}`);
-  return [
-    "The user uploaded files. They are available at the following sandbox paths:",
-    ...lines,
-    "Read them from these paths when relevant."
-  ].join("\n");
-}
-function prependFileHint(prompt, files, provider) {
-  const hint = composeFileMountHint(files, provider);
-  if (!hint) return prompt;
-  return `${hint}
-
-${prompt}`;
-}
-var FILE_MENTION_SENTINEL_RE = /\u27E6file:(.+?)\u27E7/g;
-function rewriteFileMentions(prompt, provider) {
-  return prompt.replace(
-    FILE_MENTION_SENTINEL_RE,
-    (_match, mountPath) => resolveSandboxMountPath(provider, mountPath)
-  );
-}
-function preparePromptForProvider(prompt, files, provider) {
-  return prependFileHint(rewriteFileMentions(prompt, provider), files, provider);
-}
-
 // src/internal/providers/qoder/mapper.ts
 function toPascalCase(name) {
   return name.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[^a-zA-Z0-9]+/g, " ").trim().split(/\s+/).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("");
@@ -1572,6 +2093,7 @@ function agentToDecl2(raw) {
   const mcpServers = raw.mcp_servers;
   const skills = raw.skills;
   let builtinTools;
+  let builtinPermissions;
   if (tools?.length) {
     const toolset = tools.find((t) => t.type === "agent_toolset_20260401");
     if (toolset && Array.isArray(toolset.enabled_tools)) {
@@ -1579,6 +2101,7 @@ function agentToDecl2(raw) {
     } else if (toolset) {
       const configs = toolset.configs ?? [];
       builtinTools = configs.filter((c) => c.enabled !== false).map((c) => normalizeToolNameFromQoder(c.name));
+      builtinPermissions = permissionOverridesFromWire(configs, normalizeToolNameFromQoder);
     }
   }
   let mcpServerDecls;
@@ -1600,16 +2123,17 @@ function agentToDecl2(raw) {
     description: raw.description,
     model: raw.model,
     instructions: raw.system,
-    tools: builtinTools?.length ? { builtin: builtinTools } : void 0,
+    tools: builtinTools?.length ? { builtin: builtinTools, permissions: builtinPermissions } : void 0,
     mcp_servers: mcpServerDecls,
     skills: skillDecls,
     metadata: stripAgentsMetadata(raw.metadata)
   });
 }
-function mapMemoryStore(name, decl) {
+function mapMemoryStore2(name, decl) {
   return {
     name,
-    description: decl.description
+    description: decl.description,
+    metadata: decl.metadata
   };
 }
 function mapDeployment2(name, decl, refs, projectName, uploadedFiles) {
@@ -1630,6 +2154,7 @@ function mapDeployment2(name, decl, refs, projectName, uploadedFiles) {
     };
   }
   if (decl.description) body.description = decl.description;
+  if (decl.environment_variables !== void 0) body.environment_variables = decl.environment_variables;
   if (projectName) {
     body.metadata = injectMetadata(decl.metadata, projectName, name);
   } else if (decl.metadata) {
@@ -1637,6 +2162,24 @@ function mapDeployment2(name, decl, refs, projectName, uploadedFiles) {
   }
   return body;
 }
+function mapDeploymentUpdate2(name, decl, refs, projectName, uploadedFiles, existingMetadata) {
+  const body = mapDeployment2(name, decl, refs, projectName, uploadedFiles);
+  body.vault_ids = refs.vault_ids;
+  body.resources = mapDeploymentResources2(decl, refs, uploadedFiles);
+  if (decl.schedule) {
+    body.schedule = { type: "cron", expression: decl.schedule.expression, timezone: decl.schedule.timezone };
+  }
+  body.description = decl.description ?? "";
+  body.environment_variables = decl.environment_variables ?? null;
+  const desiredMetadata = projectName ? injectMetadata(decl.metadata, projectName, name) : decl.metadata ?? {};
+  body.metadata = {
+    ...Object.fromEntries(
+      Object.keys(existingMetadata ?? {}).filter((key) => !(key in desiredMetadata)).map((key) => [key, null])
+    ),
+    ...desiredMetadata
+  };
+  return body;
+}
 function mapDeploymentInitialEvents(events) {
   return events.map((ev) => {
     if (ev.type === "user.message" || ev.type === "system.message") {
@@ -1713,11 +2256,14 @@ function mapAgent2(name, decl, refs, version, projectName) {
     body.metadata = decl.metadata;
   }
   if (decl.tools) {
-    const enabledTools = decl.tools.builtin.map((t) => normalizeToolNameForQoder(t));
     body.tools = [
       {
         type: "agent_toolset_20260401",
-        enabled_tools: enabledTools
+        configs: resolveBuiltinTools(decl.tools, { toWireName: normalizeToolNameForQoder }).map((tool) => ({
+          name: tool.wireName,
+          enabled: true,
+          permission_policy: toPermissionPolicy(tool.permission)
+        }))
       }
     ];
   } else {
@@ -1775,19 +2321,14 @@ function mapForwardTemplate(name, decl, refs, projectName) {
   if (projectName) body.metadata = injectMetadata(decl.metadata, projectName, name);
   else body.metadata = decl.metadata ?? {};
   if (decl.tools) {
-    const permissions = decl.tools.permissions ?? {};
     body.tools = [
       {
         type: "agent_toolset_20260401",
-        configs: decl.tools.builtin.map((tool) => {
-          const normalized = normalizeToolNameForQoder(tool);
-          const policy = permissions[tool] ?? permissions[tool.toLowerCase()] ?? permissions[normalized];
-          return {
-            name: normalized,
-            enabled: true,
-            ...policy ? { permission_policy: { type: policy === "ask" ? "always_ask" : "always_allow" } } : {}
-          };
-        })
+        configs: resolveBuiltinTools(decl.tools, { toWireName: normalizeToolNameForQoder }).map((tool) => ({
+          name: tool.wireName,
+          enabled: true,
+          permission_policy: toPermissionPolicy(tool.permission)
+        }))
       }
     ];
   } else {
@@ -1843,6 +2384,7 @@ function toSessionEvent3(raw) {
   const rawType = raw.type ?? "";
   const type = QODER_EVENT_MAP[rawType] ?? "unknown";
   const event = { type, raw_type: rawType, raw };
+  if (typeof raw.id === "string") event.id = raw.id;
   if (typeof raw.role === "string") event.role = raw.role;
   if (type === "message") {
     event.role = roleFromType2(rawType, raw.role);
@@ -1853,12 +2395,15 @@ function toSessionEvent3(raw) {
   } else if (type === "tool_result") {
     event.content = extractContentText2(raw);
   } else if (type === "status") {
+    const stopReason = extractStopReason2(raw.stop_reason);
     if (rawType === "session.thread_status_idle") {
       event.status = "running";
+    } else if (rawType === "session.status_idle" && stopReason === "requires_action") {
+      event.status = "running";
     } else {
       event.status = rawType.includes("idle") ? "idle" : rawType.includes("terminated") ? "terminated" : "running";
     }
-    event.stop_reason = extractStopReason2(raw.stop_reason);
+    event.stop_reason = stopReason;
   } else if (type === "error") {
     event.content = extractErrorMessage2(raw);
   }
@@ -1920,6 +2465,13 @@ function mapSession2(bindings) {
   for (const id of bindings.memory_store_ids) resources.push({ type: "memory_store", memory_store_id: id });
   for (const f of bindings.files ?? [])
     resources.push({ type: "file", file_id: f.file_id, mount_path: resolveSandboxMountPath("qoder", f.mount_path) });
+  for (const resource of bindings.resources ?? []) {
+    resources.push(
+      mapGithubRepositorySessionResource(resource, {
+        mapMountPath: (item) => resolveGithubRepositoryMountPath("qoder", item)
+      })
+    );
+  }
   if (resources.length) body.resources = resources;
   return body;
 }
@@ -1930,17 +2482,46 @@ function deriveForwardGateway(cloudGateway) {
   const trimmed = cloudGateway.replace(/\/$/, "");
   return trimmed.endsWith("/cloud") ? `${trimmed.slice(0, -"/cloud".length)}/forward` : `${trimmed}/forward`;
 }
-var QODER_DEFAULT_IDENTITY_EXTERNAL_ID = "__qca_admin_identity__";
+function toDeploymentInfo2(res) {
+  const sched = res.schedule;
+  return {
+    id: res.id ?? null,
+    status: res.status ?? "unknown",
+    paused_reason: res.paused_reason ?? void 0,
+    schedule: sched ? { expression: sched.expression, timezone: sched.timezone } : void 0,
+    attributes: res
+  };
+}
 var QoderAdapter = class _QoderAdapter {
   name = "qoder";
   eventResume = true;
+  memoryCapabilities = {
+    archive_store: true,
+    batch_create: false,
+    versions: true,
+    optimistic_concurrency: true,
+    memory_metadata: true
+  };
   client;
+  memoryApi;
   forwardClient;
   projectName;
   forwardSessionIds = /* @__PURE__ */ new Set();
-  defaultForwardIdentityId;
   constructor(apiKey, gateway, projectName, forwardGateway) {
     this.client = new QoderClient({ apiKey, gateway });
+    this.memoryApi = new ProviderMemoryApi(this.client, {
+      pathStyle: "relative",
+      cursorParam: "after_id",
+      updatePrecondition: "content_sha256",
+      prefixParam: "prefix",
+      versionsSegment: "versions",
+      storeMetadataMode: "merge_patch",
+      supportsView: false,
+      supportsMemoryMetadata: true,
+      supportsPathUpdate: false,
+      supportsDeletePrecondition: false,
+      supportsIncludeArchived: true
+    });
     this.forwardClient = new QoderClient({
       apiKey,
       gateway: forwardGateway ?? deriveForwardGateway(gateway)
@@ -1956,14 +2537,29 @@ var QoderAdapter = class _QoderAdapter {
     vault: "/vaults",
     skill: "/skills",
     memory_store: "/memory_stores",
-    file: "/files"
-    // deployment omitted: emulated on Qoder, no remote listing endpoint
+    file: "/files",
+    deployment: "/deployments"
   };
   async findResource(type, name, id) {
     if (type === "template") {
       const raw2 = await locateRemote(this.forwardClient, "/templates", name, id, (item) => item.status !== "archived");
       return raw2 ? toRemoteResource(raw2) : null;
     }
+    if (type === "identity") {
+      try {
+        if (id) return toRemoteResource(await this.forwardClient.get(`/identities/${id}`));
+        const res = await this.forwardClient.get(`/identities?external_id=${encodeURIComponent(name)}&limit=100`);
+        const raw2 = (res.data ?? []).find((item) => item.external_id === name);
+        return raw2 ? toRemoteResource(raw2) : null;
+      } catch (err) {
+        if (ApiError.isNotFound(err)) return null;
+        throw err;
+      }
+    }
+    if (type === "channel") {
+      const raw2 = await locateRemote(this.forwardClient, "/channels", name, id, () => true);
+      return raw2 ? toRemoteResource(raw2) : null;
+    }
     const raw = await locateRemote(this.client, _QoderAdapter.ENDPOINT_MAP[type], name, id, notArchived);
     return raw ? toRemoteResource(raw) : null;
   }
@@ -2009,12 +2605,23 @@ var QoderAdapter = class _QoderAdapter {
     return toRestSkillInfo(res);
   }
   getDriftSupport(type) {
-    if (type === "agent" || type === "environment" || type === "template") return "full";
+    if (type === "agent" || type === "environment" || type === "template" || type === "identity" || type === "channel")
+      return "full";
     if (type === "deployment") return "unsupported";
     return _QoderAdapter.ENDPOINT_MAP[type] ? "existence" : "unsupported";
   }
   async readComparableResource(type, id, name) {
-    if (type !== "agent" && type !== "environment" && type !== "template") return null;
+    if (type !== "agent" && type !== "environment" && type !== "template" && type !== "identity" && type !== "channel")
+      return null;
+    if (type === "identity" || type === "channel") {
+      const remote = await this.findResource(type, name, id);
+      if (!remote?.id) return null;
+      const raw2 = await this.forwardClient.get(
+        `/${type === "identity" ? "identities" : "channels"}/${remote.id}`
+      );
+      const comparable2 = this.normalizeRemote(type, raw2);
+      return { id: remote.id, type, comparable: comparable2, snapshot: comparable2 };
+    }
     const isTemplate = type === "template";
     const endpoint = type === "agent" ? "/agents" : type === "environment" ? "/environments" : "/templates";
     const raw = await locateRemote(
@@ -2048,6 +2655,16 @@ var QoderAdapter = class _QoderAdapter {
       );
     }
     if (type === "template") return null;
+    if (type === "identity") {
+      const identity = decl;
+      if (identity.identity_id) return null;
+      return this.normalizeRemote(type, {
+        external_id: identity.external_id,
+        name: identity.name ?? name,
+        enabled: identity.enabled ?? true,
+        metadata: identity.metadata ?? {}
+      });
+    }
     return null;
   }
   normalizeRemote(type, raw) {
@@ -2081,6 +2698,27 @@ var QoderAdapter = class _QoderAdapter {
         metadata: stripAgentsMetadata(raw.metadata)
       });
     }
+    if (type === "identity") {
+      return compactDeep({
+        external_id: raw.external_id,
+        name: raw.name,
+        enabled: raw.enabled,
+        metadata: raw.metadata ?? {}
+      });
+    }
+    if (type === "channel") {
+      const channelConfig = raw.channel_config ?? {};
+      return compactDeep({
+        identity_id: raw.identity_id,
+        template_id: raw.template_id,
+        channel_type: raw.channel_type,
+        name: raw.name,
+        enabled: raw.enabled,
+        channel_config: {
+          response_options: channelConfig.response_options ?? {}
+        }
+      });
+    }
     return compactDeep({
       description: raw.description,
       model: normalizeModel(raw.model),
@@ -2190,6 +2828,71 @@ var QoderAdapter = class _QoderAdapter {
   async archiveTemplate(id) {
     await this.forwardClient.post(`/templates/${id}/archive`, {});
   }
+  async createIdentity(name, decl) {
+    if (decl.identity_id) return { id: decl.identity_id, type: "identity" };
+    const res = await this.forwardClient.post("/identities", {
+      external_id: decl.external_id,
+      name: decl.name ?? name,
+      enabled: decl.enabled ?? true,
+      metadata: decl.metadata ?? {}
+    });
+    return toRemoteResource(res);
+  }
+  async updateIdentity(id, name, decl) {
+    if (decl.identity_id) return { id: decl.identity_id, type: "identity" };
+    const current = await this.forwardClient.get(`/identities/${id}`);
+    const currentMetadata = current.metadata ?? {};
+    const desiredMetadata = decl.metadata ?? {};
+    const metadata = { ...desiredMetadata };
+    for (const key of Object.keys(currentMetadata)) {
+      if (!(key in desiredMetadata)) metadata[key] = "";
+    }
+    const res = await this.forwardClient.post(`/identities/${id}`, {
+      external_id: decl.external_id,
+      name: decl.name ?? name,
+      enabled: decl.enabled ?? true,
+      metadata
+    });
+    return toRemoteResource(res);
+  }
+  async deleteIdentity(id) {
+    await this.forwardClient.delete(`/identities/${id}`);
+  }
+  async createChannel(name, decl, refs) {
+    const res = await this.forwardClient.post("/channels", this.mapChannel(name, decl, refs));
+    return toRemoteResource(res);
+  }
+  async updateChannel(id, name, decl, refs) {
+    const current = await this.forwardClient.get(`/channels/${id}`);
+    if (current.channel_type !== decl.type) {
+      await this.deleteChannel(id);
+      return this.createChannel(name, decl, refs);
+    }
+    const body = this.mapChannel(name, decl, refs);
+    delete body.channel_type;
+    const res = await this.forwardClient.post(`/channels/${id}`, body);
+    return toRemoteResource(res);
+  }
+  async deleteChannel(id) {
+    await this.forwardClient.delete(`/channels/${id}`);
+  }
+  mapChannel(name, decl, refs) {
+    return {
+      identity_id: refs.identity_id,
+      template_id: refs.agent_id,
+      channel_type: decl.type,
+      name: decl.name ?? name,
+      enabled: decl.enabled ?? true,
+      channel_config: {
+        credentials: decl.credentials,
+        response_options: {
+          include_tool_calls: false,
+          include_thinking: false,
+          ...decl.options ?? {}
+        }
+      }
+    };
+  }
   async registerForwardVaults(vaultIds) {
     for (const id of vaultIds) {
       await this.forwardClient.post("/resources/registry", {
@@ -2199,22 +2902,58 @@ var QoderAdapter = class _QoderAdapter {
     }
   }
   async createMemoryStore(name, decl) {
-    const body = mapMemoryStore(name, decl);
+    const body = mapMemoryStore2(name, decl);
     const res = await this.client.post("/memory_stores", body);
     const storeId = res.id;
-    if (decl.entries?.length) {
-      for (const entry of decl.entries) {
-        await this.client.post(`/memory_stores/${storeId}/memories`, {
-          content: entry.content,
-          path: entry.key
-        });
+    try {
+      for (const entry of decl.entries ?? []) {
+        await this.memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
       }
+    } catch (error) {
+      await this.client.delete(`/memory_stores/${storeId}`).catch(() => void 0);
+      throw error;
     }
     return toRemoteResource(res);
   }
   async deleteMemoryStore(id) {
     await this.client.delete(`/memory_stores/${id}`);
   }
+  listMemoryStores(options) {
+    return this.memoryApi.listStores(options);
+  }
+  getMemoryStore(id) {
+    return this.memoryApi.getStore(id);
+  }
+  updateMemoryStore(id, input) {
+    return this.memoryApi.updateStore(id, input);
+  }
+  archiveMemoryStore(id) {
+    return this.memoryApi.archiveStore(id);
+  }
+  createMemory(storeId, input) {
+    return this.memoryApi.createMemory(storeId, input);
+  }
+  listMemories(storeId, options) {
+    return this.memoryApi.listMemories(storeId, options);
+  }
+  getMemory(storeId, memoryId) {
+    return this.memoryApi.getMemory(storeId, memoryId);
+  }
+  updateMemory(storeId, memoryId, input) {
+    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  }
+  deleteMemory(storeId, memoryId, expected) {
+    return this.memoryApi.deleteMemory(storeId, memoryId, expected);
+  }
+  listMemoryVersions(storeId, options) {
+    return this.memoryApi.listVersions(storeId, options);
+  }
+  getMemoryVersion(storeId, versionId) {
+    return this.memoryApi.getVersion(storeId, versionId);
+  }
+  redactMemoryVersion(storeId, versionId) {
+    return this.memoryApi.redactVersion(storeId, versionId);
+  }
   async createDeployment(name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
     const body = mapDeployment2(name, decl, refs, this.projectName, uploaded);
@@ -2223,7 +2962,20 @@ var QoderAdapter = class _QoderAdapter {
   }
   async updateDeployment(id, name, decl, refs, basePath) {
     const uploaded = await this.uploadDeploymentFiles(decl, basePath);
-    const body = mapDeployment2(name, decl, refs, this.projectName, uploaded);
+    const current = await this.client.get(`/deployments/${id}`);
+    if (current.schedule && !decl.schedule) {
+      throw new UserError(
+        `Deployment '${name}' cannot remove its schedule through the documented Qoder update API; archive and recreate it as a manual deployment.`
+      );
+    }
+    const body = mapDeploymentUpdate2(
+      name,
+      decl,
+      refs,
+      this.projectName,
+      uploaded,
+      current.metadata
+    );
     const res = await this.client.post(`/deployments/${id}`, body);
     return toRemoteResource(res);
   }
@@ -2258,6 +3010,35 @@ var QoderAdapter = class _QoderAdapter {
       attributes: res
     };
   }
+  async listDeployments(filter) {
+    const params = new URLSearchParams();
+    if (filter?.agent_id) params.set("agent_id", filter.agent_id);
+    if (filter?.status) params.set("status", filter.status);
+    if (filter?.include_archived) params.set("include_archived", "true");
+    if (filter?.limit) params.set("limit", String(filter.limit));
+    if (filter?.page) params.set("page", filter.page);
+    if (filter?.created_at_gte) params.set("created_at[gte]", filter.created_at_gte);
+    if (filter?.created_at_lte) params.set("created_at[lte]", filter.created_at_lte);
+    const query2 = params.toString();
+    const res = await this.client.get(`/deployments${query2 ? `?${query2}` : ""}`);
+    return {
+      deployments: (res.data ?? []).map(toDeploymentInfo2),
+      has_more: Boolean(res.has_more),
+      next_page: res.next_page ?? void 0
+    };
+  }
+  async pauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, true);
+  }
+  async unpauseDeployment(ctx) {
+    return this.setDeploymentPaused(ctx, false);
+  }
+  async setDeploymentPaused(ctx, paused) {
+    if (!ctx.id) throw new UserError(`Deployment '${ctx.name}' has no remote id; run \`agents apply\` first.`);
+    const action = paused ? "pause" : "unpause";
+    const res = await this.client.post(`/deployments/${ctx.id}/${action}`, {});
+    return toDeploymentInfo2(res);
+  }
   async uploadDeploymentFiles(decl, basePath) {
     const map = /* @__PURE__ */ new Map();
     for (const r of decl.resources ?? []) {
@@ -2271,16 +3052,18 @@ var QoderAdapter = class _QoderAdapter {
     const fullPath = resolve2(dirname2(basePath), source);
     const content = readFileSync2(fullPath);
     const formData = new FormData();
-    formData.append("file", new File([new Uint8Array(content)], basename3(fullPath)));
+    formData.append("file", new File([new Uint8Array(content)], basename2(fullPath)));
     formData.append("purpose", "session_resource");
     const res = await this.client.postFormData("/files", formData);
     return res.file_id ?? res.id;
   }
   async createSession(bindings) {
     if (bindings.delivery === "forward") {
-      const identityId = bindings.identity_id ?? await this.resolveDefaultForwardIdentityId();
+      if (!bindings.identity_id) {
+        throw new UserError("Qoder Forward sessions require an explicit resolved identity_id.");
+      }
       const body2 = {
-        identity_id: identityId,
+        identity_id: bindings.identity_id,
         template_id: bindings.template_id,
         incremental_streaming_enabled: false
       };
@@ -2302,30 +3085,6 @@ var QoderAdapter = class _QoderAdapter {
     const res = await this.client.post("/sessions", body);
     return toSessionInfo2(res);
   }
-  async resolveDefaultForwardIdentityId() {
-    if (this.defaultForwardIdentityId) return this.defaultForwardIdentityId;
-    let afterId;
-    do {
-      const params = new URLSearchParams({ limit: "100" });
-      if (afterId) params.set("after_id", afterId);
-      const res = await this.forwardClient.get(`/identities?${params}`);
-      const identities = res.data ?? [];
-      const match = identities.find(
-        (identity) => identity.external_id === QODER_DEFAULT_IDENTITY_EXTERNAL_ID && identity.enabled !== false && identity.archived !== true
-      );
-      if (typeof match?.id === "string") {
-        this.defaultForwardIdentityId = match.id;
-        return match.id;
-      }
-      const hasMore = res.has_more ?? false;
-      const nextId = hasMore ? res.last_id ?? void 0 : void 0;
-      if (!nextId || nextId === afterId) break;
-      afterId = nextId;
-    } while (afterId);
-    throw new UserError(
-      `Qoder default Forward Identity '${QODER_DEFAULT_IDENTITY_EXTERNAL_ID}' was not found. Ask Qoder to provision it, set defaults.session.qoder.identity_id, or pass --identity-id.`
-    );
-  }
   async listSessions(filter) {
     if (filter?.agent_id?.startsWith("tmpl_")) {
       const params2 = new URLSearchParams({ template_id: filter.agent_id });
@@ -2448,8 +3207,8 @@ var QoderAdapter = class _QoderAdapter {
     if (options?.order) params.set("order", options.order);
     const afterId = options?.after_id ?? options?.page_token ?? options?.page;
     if (afterId) params.set("after_id", afterId);
-    const query = params.toString();
-    const res = await this.forwardClient.get(`/sessions/${sessionId}/events${query ? `?${query}` : ""}`);
+    const query2 = params.toString();
+    const res = await this.forwardClient.get(`/sessions/${sessionId}/events${query2 ? `?${query2}` : ""}`);
     const data = res.data ?? [];
     const hasMore = res.has_more ?? false;
     return {
@@ -2466,7 +3225,7 @@ var QoderAdapter = class _QoderAdapter {
   async uploadFile(filePath, options) {
     const resolved = resolve2(filePath);
     const content = readFileSync2(resolved);
-    const fileName = options?.name ?? basename3(resolved);
+    const fileName = options?.name ?? basename2(resolved);
     return this.uploadFileContent(new Uint8Array(content), fileName, {
       purpose: options?.purpose
     });
@@ -2573,7 +3332,9 @@ var QODER_CAPABILITIES = {
     tier: "native",
     reason: "deployments API with scheduled and manual runs"
   },
-  session: { tier: "native", reason: "sessions API" }
+  session: { tier: "native", reason: "sessions API" },
+  identity: { tier: "native", reason: "Forward Identities API" },
+  channel: { tier: "native", reason: "Forward Channels API" }
 };
 
 // src/internal/providers/qoder/config.ts
@@ -2589,6 +3350,7 @@ registerProvider({
   name: "qoder",
   configSchema: qoderConfigSchema,
   capabilities: QODER_CAPABILITIES,
+  features: { tool_permissions: true, session_resources: ["github_repository"] },
   createAdapter: (config, projectName) => {
     const c = config;
     return new QoderAdapter(c.api_key, c.gateway, projectName, c.forward_gateway);
@@ -2597,7 +3359,7 @@ registerProvider({
 
 // src/internal/providers/bailian/adapter.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { basename as basename4, dirname as dirname3, extname, resolve as resolve3 } from "path";
+import { basename as basename3, dirname as dirname3, extname, resolve as resolve3 } from "path";
 import JSZip3 from "jszip";
 
 // src/internal/providers/bailian/client.ts
@@ -2791,8 +3553,8 @@ function mapAgent3(name, decl, refs, version, projectName, skillVersions) {
   }
   const BAILIAN_BUILTINS = /* @__PURE__ */ new Set(["bash", "read", "write", "edit", "glob", "grep", "download_file"]);
   if (decl.tools) {
-    const toolConfigs = decl.tools.builtin.filter((t) => BAILIAN_BUILTINS.has(t)).map((toolName) => ({
-      name: toolName,
+    const toolConfigs = resolveBuiltinTools(decl.tools, { supportedWireNames: BAILIAN_BUILTINS }).map((tool) => ({
+      name: tool.wireName,
       enabled: true
     }));
     body.tools = [
@@ -2854,7 +3616,13 @@ function mapSession3(bindings) {
   if (bindings.metadata) body.metadata = bindings.metadata;
   if (bindings.vault_ids.length) body.vault_ids = bindings.vault_ids;
   const resources = [];
-  for (const f of bindings.files ?? []) resources.push({ type: "file", file_id: f.file_id, mount_path: f.mount_path });
+  for (const f of bindings.files ?? []) {
+    resources.push({
+      type: "file",
+      file_id: f.file_id,
+      mount_path: resolveSandboxMountPath("bailian", f.mount_path)
+    });
+  }
   if (resources.length) body.resources = resources;
   if (bindings.memory_store_ids.length) body.memory_store_ids = bindings.memory_store_ids;
   return body;
@@ -3302,7 +4070,7 @@ var BailianAdapter = class _BailianAdapter {
     const fullPath = resolve3(dirname3(basePath), source);
     const content = readFileSync3(fullPath);
     const formData = new FormData();
-    formData.append("file", new File([new Uint8Array(content)], basename4(fullPath)));
+    formData.append("file", new File([new Uint8Array(content)], basename3(fullPath)));
     const res = await this.client.postFormData("/files", formData);
     const fileId = res.id;
     await this.waitForFileAvailable(fileId);
@@ -3367,7 +4135,7 @@ var BailianAdapter = class _BailianAdapter {
   async uploadFile(filePath, options) {
     const resolved = resolve3(filePath);
     const content = readFileSync3(resolved);
-    const fileName = options?.name ?? basename4(resolved);
+    const fileName = options?.name ?? basename3(resolved);
     return this.uploadFileContent(new Uint8Array(content), fileName, {
       purpose: options?.purpose
     });
@@ -3494,7 +4262,9 @@ var BAILIAN_CAPABILITIES = {
     reason: "no deployment primitive on Bailian; expanded into a session at run time",
     remediation: "scheduling and outcome rubrics are not enforced server-side \u2014 use external cron/CI for always-on or scheduled runs"
   },
-  session: { tier: "native", reason: "sessions API" }
+  session: { tier: "native", reason: "sessions API" },
+  identity: { tier: "unsupported", reason: "no mapped Identity primitive on Bailian" },
+  channel: { tier: "unsupported", reason: "no mapped messaging Channel primitive on Bailian" }
 };
 
 // src/internal/providers/bailian/config.ts
@@ -3510,6 +4280,7 @@ registerProvider({
   name: "bailian",
   configSchema: bailianConfigSchema,
   capabilities: BAILIAN_CAPABILITIES,
+  features: { tool_permissions: false, session_resources: [] },
   createAdapter: (config, projectName) => {
     const c = config;
     return new BailianAdapter(c.api_key, c.workspace_id, c.base_url, projectName);
@@ -3518,7 +4289,7 @@ registerProvider({
 
 // src/internal/providers/ark/adapter.ts
 import { readFileSync as readFileSync4 } from "fs";
-import { basename as basename5, dirname as dirname4, resolve as resolve4 } from "path";
+import { basename as basename4, dirname as dirname4, resolve as resolve4 } from "path";
 import JSZip4 from "jszip";
 
 // src/internal/providers/resource-naming.ts
@@ -3643,6 +4414,7 @@ function agentToDecl4(raw) {
   const skills = raw.skills;
   const multiagent = raw.multiagent;
   let builtinTools;
+  let builtinPermissions;
   let allToolsEnabled = false;
   if (tools?.length) {
     const toolset = tools.find((t) => t.type === "agent_toolset_20260701");
@@ -3651,6 +4423,7 @@ function agentToDecl4(raw) {
       const configs = toolset.configs ?? [];
       if (configs.length > 0) {
         builtinTools = configs.filter((c) => c.enabled !== false).map((c) => c.name);
+        builtinPermissions = permissionOverridesFromWire(configs);
       } else if (defaultConfig?.enabled) {
         allToolsEnabled = true;
       }
@@ -3681,7 +4454,7 @@ function agentToDecl4(raw) {
   }
   let toolsDecl;
   if (builtinTools?.length) {
-    toolsDecl = { builtin: builtinTools };
+    toolsDecl = { builtin: builtinTools, permissions: builtinPermissions };
   } else if (allToolsEnabled) {
     toolsDecl = {
       builtin: ["read", "write", "edit", "bash", "glob", "grep", "web_search", "web_fetch"]
@@ -3713,10 +4486,11 @@ function mapEnvironment4(name, decl, projectName, wireName) {
   if (decl.description) body.description = decl.description;
   return body;
 }
-function mapMemoryStore2(name, decl) {
+function mapMemoryStore3(name, decl) {
   return {
     name,
-    description: decl.description
+    description: decl.description,
+    metadata: decl.metadata
   };
 }
 function mapAgent4(name, decl, refs, version, projectName) {
@@ -3741,16 +4515,11 @@ function mapAgent4(name, decl, refs, version, projectName) {
     body.metadata = decl.metadata;
   }
   if (decl.tools) {
-    const toolConfigs = decl.tools.builtin.filter((toolName) => ARK_BUILTINS.has(toolName)).map((toolName) => {
-      const permission = decl.tools?.permissions?.[toolName] ?? "allow";
-      return {
-        name: toolName,
-        enabled: true,
-        permission_policy: {
-          type: permission === "ask" ? "always_ask" : "always_allow"
-        }
-      };
-    });
+    const toolConfigs = resolveBuiltinTools(decl.tools, { supportedWireNames: ARK_BUILTINS }).map((tool) => ({
+      name: tool.wireName,
+      enabled: true,
+      permission_policy: toPermissionPolicy(tool.permission)
+    }));
     body.tools = [
       {
         type: "agent_toolset_20260701",
@@ -3905,7 +4674,7 @@ function mapSession4(bindings) {
     resources.push({
       type: "file",
       file_id: f.file_id,
-      mount_path: f.mount_path
+      mount_path: resolveSandboxMountPath("ark", f.mount_path)
     });
   if (resources.length) body.resources = resources;
   return body;
@@ -3915,10 +4684,28 @@ function mapSession4(bindings) {
 var ArkAdapter = class _ArkAdapter {
   name = "ark";
   eventResume = false;
+  memoryCapabilities = {
+    archive_store: false,
+    batch_create: true,
+    versions: false,
+    optimistic_concurrency: false,
+    memory_metadata: false
+  };
   client;
+  memoryApi;
   projectName;
   constructor(apiKey, projectName) {
     this.client = new ArkClient({ apiKey });
+    this.memoryApi = new ProviderMemoryApi(this.client, {
+      pathStyle: "absolute",
+      cursorParam: "page",
+      updatePrecondition: "none",
+      prefixParam: "path_prefix",
+      supportsView: false,
+      supportsMemoryMetadata: false,
+      supportsDeletePrecondition: false,
+      supportsIncludeArchived: false
+    });
     this.projectName = projectName ?? "";
   }
   async validate() {
@@ -4071,22 +4858,49 @@ var ArkAdapter = class _ArkAdapter {
     await this.client.delete(`/agents/${id}`);
   }
   async createMemoryStore(name, decl) {
-    const body = mapMemoryStore2(name, decl);
+    const body = mapMemoryStore3(name, decl);
     const res = await this.client.post("/memory_stores", body);
     const storeId = res.id;
-    if (decl.entries?.length) {
-      for (const entry of decl.entries) {
-        await this.client.post(`/memory_stores/${storeId}/memories`, {
-          content: entry.content,
-          path: entry.key
-        });
+    try {
+      for (const entry of decl.entries ?? []) {
+        await this.memoryApi.createMemory(storeId, { content: entry.content, path: entry.key });
       }
+    } catch (error) {
+      await this.client.delete(`/memory_stores/${storeId}`).catch(() => void 0);
+      throw error;
     }
     return toRemoteResource(res);
   }
   async deleteMemoryStore(id) {
     await this.client.delete(`/memory_stores/${id}`);
   }
+  listMemoryStores(options) {
+    return this.memoryApi.listStores(options);
+  }
+  getMemoryStore(id) {
+    return this.memoryApi.getStore(id);
+  }
+  updateMemoryStore(id, input) {
+    return this.memoryApi.updateStore(id, input);
+  }
+  createMemory(storeId, input) {
+    return this.memoryApi.createMemory(storeId, input);
+  }
+  batchCreateMemories(storeId, input) {
+    return this.memoryApi.batchCreateMemories(storeId, input);
+  }
+  listMemories(storeId, options) {
+    return this.memoryApi.listMemories(storeId, options);
+  }
+  getMemory(storeId, memoryId) {
+    return this.memoryApi.getMemory(storeId, memoryId);
+  }
+  updateMemory(storeId, memoryId, input) {
+    return this.memoryApi.updateMemory(storeId, memoryId, input);
+  }
+  deleteMemory(storeId, memoryId, expected) {
+    return this.memoryApi.deleteMemory(storeId, memoryId, expected);
+  }
   // --- Deployment (emulated) ---
   // Ark has no /deployments endpoint. A deployment is recorded in state with
   // remote_id = null and materialized into a session at run time (mirrors qoder).
@@ -4134,7 +4948,7 @@ var ArkAdapter = class _ArkAdapter {
     const fullPath = resolve4(dirname4(basePath), source);
     const content = readFileSync4(fullPath);
     const formData = new FormData();
-    formData.append("file", new File([new Uint8Array(content)], basename5(fullPath)));
+    formData.append("file", new File([new Uint8Array(content)], basename4(fullPath)));
     formData.append("purpose", "agent");
     const res = await this.client.postFormData("/files", formData);
     return res.file_id ?? res.id;
@@ -4183,7 +4997,7 @@ var ArkAdapter = class _ArkAdapter {
   async uploadFile(filePath, options) {
     const resolved = resolve4(filePath);
     const content = readFileSync4(resolved);
-    const fileName = options?.name ?? basename5(resolved);
+    const fileName = options?.name ?? basename4(resolved);
     return this.uploadFileContent(new Uint8Array(content), fileName, {
       purpose: options?.purpose
     });
@@ -4248,7 +5062,9 @@ var ARK_CAPABILITIES = {
     tier: "emulated",
     reason: "no deployment primitive on Ark; expanded into a session at run time"
   },
-  session: { tier: "native", reason: "sessions API" }
+  session: { tier: "native", reason: "sessions API" },
+  identity: { tier: "unsupported", reason: "no mapped Identity primitive on Ark" },
+  channel: { tier: "unsupported", reason: "no mapped messaging Channel primitive on Ark" }
 };
 
 // src/internal/providers/ark/config.ts
@@ -4262,6 +5078,7 @@ registerProvider({
   name: "ark",
   configSchema: arkConfigSchema,
   capabilities: ARK_CAPABILITIES,
+  features: { tool_permissions: true, session_resources: [] },
   createAdapter: (config, projectName) => {
     const c = config;
     return new ArkAdapter(c.api_key, projectName);
@@ -4308,11 +5125,11 @@ async function writeProjectRuntime(input, fn) {
   );
 }
 function getRuntimeProvider(ctx, providerName) {
-  const adapter = ctx.providers.get(providerName);
-  if (!adapter) {
+  const adapter2 = ctx.providers.get(providerName);
+  if (!adapter2) {
     throw new UserError(`Provider '${providerName}' not configured.`);
   }
-  return adapter;
+  return adapter2;
 }
 
 // src/internal/parser/file-resolver.ts
@@ -4374,7 +5191,7 @@ async function resolveFileReferences(config, configPath) {
 }
 
 // src/internal/parser/resolve-project-config.ts
-import { basename as basename6, dirname as dirname7, resolve as resolve7 } from "path";
+import { basename as basename5, dirname as dirname7, resolve as resolve7 } from "path";
 
 // src/internal/parser/schema.ts
 import { z as z5 } from "zod";
@@ -4444,6 +5261,7 @@ var memoryEntrySchema = z5.object({
 var memoryStoreSchema = z5.object({
   description: z5.string(),
   provider: z5.string().optional(),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
   entries: z5.array(memoryEntrySchema).optional()
 });
 var skillSchema = z5.object({
@@ -4460,6 +5278,23 @@ var fileSchema = z5.object({
   purpose: z5.string().optional(),
   provider: z5.string().optional()
 });
+var managedIdentitySchema = z5.object({
+  provider: z5.string().optional(),
+  external_id: z5.string().trim().min(1),
+  name: z5.string().trim().min(1).optional(),
+  enabled: z5.boolean().optional(),
+  metadata: z5.record(z5.string(), z5.string()).optional(),
+  identity_id: z5.never().optional()
+});
+var externalIdentitySchema = z5.object({
+  provider: z5.string().optional(),
+  identity_id: z5.string().trim().min(1),
+  external_id: z5.never().optional(),
+  name: z5.never().optional(),
+  enabled: z5.never().optional(),
+  metadata: z5.never().optional()
+});
+var identitySchema = z5.union([managedIdentitySchema, externalIdentitySchema]);
 var urlMcpServerSchema = z5.object({
   name: z5.string(),
   type: z5.enum(["url", "http"]).optional(),
@@ -4501,8 +5336,32 @@ var mcpToolkitSchema = z5.object({
 }));
 var toolsSchema = z5.object({
   builtin: z5.array(z5.string()),
+  default_permission: z5.enum(["allow", "ask"]).optional(),
   mcp: z5.array(mcpToolkitSchema).optional(),
   permissions: z5.record(z5.string(), z5.enum(["allow", "ask"])).optional()
+}).superRefine((tools, ctx) => {
+  const enabled = new Set(tools.builtin.map(canonicalToolName));
+  const seen = /* @__PURE__ */ new Map();
+  for (const key of Object.keys(tools.permissions ?? {})) {
+    const canonical = canonicalToolName(key);
+    const previous = seen.get(canonical);
+    if (previous) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["permissions", key],
+        message: `duplicates permission key '${previous}' after tool-name normalization`
+      });
+    } else {
+      seen.set(canonical, key);
+    }
+    if (!enabled.has(canonical)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["permissions", key],
+        message: `references tool '${key}' which is not enabled in tools.builtin`
+      });
+    }
+  }
 });
 var multiagentSchema = z5.object({
   type: z5.literal("coordinator"),
@@ -4523,6 +5382,15 @@ var agentSkillRefSchema = z5.object({
 var agentDeliverySchema = z5.object({
   type: z5.enum(["managed", "forward"])
 });
+var sessionGithubRepoResourceSchema = z5.object({
+  type: z5.literal("github_repository"),
+  url: z5.string().url(),
+  checkout: z5.object({ branch: z5.string().min(1).optional(), commit: z5.string().min(1).optional() }).refine((value) => !(value.branch && value.commit), {
+    message: "checkout accepts either branch or commit, not both"
+  }).optional(),
+  mount_path: z5.string().optional(),
+  authorization_token: z5.string().min(1)
+});
 var agentSchema = z5.object({
   name: z5.string().optional(),
   description: z5.string().optional(),
@@ -4536,10 +5404,21 @@ var agentSchema = z5.object({
   skills: z5.array(z5.union([z5.string(), agentSkillRefSchema])).optional(),
   vault: z5.string().optional(),
   memory_stores: z5.array(z5.string()).optional(),
+  resources: z5.array(sessionGithubRepoResourceSchema).optional(),
   multiagent: multiagentSchema.optional(),
   metadata: z5.record(z5.string(), z5.string()).optional(),
   delivery: z5.record(z5.string(), agentDeliverySchema).optional()
 });
+var channelSchema = z5.object({
+  provider: z5.string().optional(),
+  agent: z5.string().min(1),
+  identity: z5.string().min(1).optional(),
+  type: z5.string().min(1),
+  name: z5.string().trim().min(1).optional(),
+  enabled: z5.boolean().optional(),
+  credentials: z5.record(z5.string(), coerceString).optional(),
+  options: z5.record(z5.string(), z5.unknown()).optional()
+});
 var deploymentFileResourceSchema = z5.object({
   type: z5.literal("file"),
   file_id: z5.string().optional(),
@@ -4593,18 +5472,15 @@ var deploymentSchema = z5.object({
   schedule: scheduleSchema.optional(),
   description: z5.string().optional(),
   provider: z5.string().optional(),
-  metadata: z5.record(z5.string(), z5.string()).optional()
+  metadata: z5.record(z5.string(), z5.string()).optional(),
+  environment_variables: z5.string().optional()
 });
 var projectConfigSchema = z5.object({
   version: z5.string(),
   providers: z5.record(z5.string(), z5.unknown()),
   defaults: z5.object({
     provider: z5.string().optional(),
-    session: z5.object({
-      qoder: z5.object({
-        identity_id: z5.string().min(1).optional()
-      }).optional()
-    }).optional()
+    identity: z5.string().min(1).optional()
   }).optional(),
   environments: z5.record(z5.string(), environmentSchema).optional(),
   tunnels: z5.record(z5.string(), tunnelSchema).optional(),
@@ -4612,7 +5488,9 @@ var projectConfigSchema = z5.object({
   memory_stores: z5.record(z5.string(), memoryStoreSchema).optional(),
   skills: z5.record(z5.string(), skillSchema).optional(),
   files: z5.record(z5.string(), fileSchema).optional(),
+  identities: z5.record(z5.string(), identitySchema).optional(),
   agents: z5.record(z5.string(), agentSchema).optional(),
+  channels: z5.record(z5.string(), channelSchema).optional(),
   deployments: z5.record(z5.string(), deploymentSchema).optional()
 });
 
@@ -4666,7 +5544,7 @@ async function loadConfig(filePath, resolveEnv = false) {
 // src/internal/parser/resolve-project-config.ts
 async function resolveProjectConfig(filePath, options = {}) {
   const configPath = resolve7(filePath);
-  const projectName = options.projectName ?? basename6(dirname7(configPath));
+  const projectName = options.projectName ?? basename5(dirname7(configPath));
   const { config: parsed, errors } = await loadConfig(configPath, options.resolveEnv ?? true);
   if (errors.length > 0) {
     throw new UserError(errors.join("\n"));
@@ -4728,6 +5606,10 @@ function getResourceDeclaration(address, config) {
       return config.agents?.[name] ?? null;
     case "file":
       return config.files?.[name] ?? null;
+    case "identity":
+      return config.identities?.[name] ?? null;
+    case "channel":
+      return config.channels?.[name] ?? null;
     case "deployment":
       return config.deployments?.[name] ?? null;
     default:
@@ -4784,8 +5666,26 @@ async function computeResourceHash(address, config, basePath, state) {
     const refs = resolveTemplateReferenceIds(decl, config, address.provider, state);
     return contentHash({ decl, refs });
   }
+  if (address.type === "channel") {
+    const refs = resolveChannelReferenceIds(
+      decl,
+      config,
+      address.provider,
+      state
+    );
+    return contentHash({ decl, refs });
+  }
   return contentHash(decl);
 }
+function resolveChannelReferenceIds(decl, config, provider, state) {
+  const agent = config.agents?.[decl.agent];
+  const agentType = agent?.delivery?.[provider]?.type === "forward" ? "template" : "agent";
+  const identity = decl.identity ?? config.defaults?.identity;
+  return {
+    agent_id: state?.getResource({ type: agentType, name: decl.agent, provider })?.remote_id,
+    identity_id: identity ? state?.getResource({ type: "identity", name: identity, provider })?.remote_id : void 0
+  };
+}
 function resolveTemplateReferenceIds(decl, config, provider, state) {
   const environment = decl.environment ? config.environments?.[decl.environment] : void 0;
   const tunnel = decl.tunnel ? config.tunnels?.[decl.tunnel] : void 0;
@@ -4884,14 +5784,14 @@ function structurallyEqual(left, right) {
 }
 
 // src/internal/providers/drift-support.ts
-function supportsFullDrift(adapter, type) {
-  return adapter.getDriftSupport?.(type) === "full" && typeof adapter.readComparableResource === "function";
+function supportsFullDrift(adapter2, type) {
+  return adapter2.getDriftSupport?.(type) === "full" && typeof adapter2.readComparableResource === "function";
 }
-async function readComparableIfSupported(adapter, type, id, name) {
-  if (!supportsFullDrift(adapter, type)) return null;
-  if (typeof adapter.readComparableResource !== "function") return null;
+async function readComparableIfSupported(adapter2, type, id, name) {
+  if (!supportsFullDrift(adapter2, type)) return null;
+  if (typeof adapter2.readComparableResource !== "function") return null;
   try {
-    return await adapter.readComparableResource(type, id, name);
+    return await adapter2.readComparableResource(type, id, name);
   } catch {
     return null;
   }
@@ -5026,6 +5926,20 @@ function resolveDeploymentRefs(deploymentName, config, provider, state) {
     memory_store_ids
   };
 }
+function resolveChannelRefs(channelName, config, provider, state) {
+  const channel = config.channels?.[channelName];
+  if (!channel) throw new UserError(`Channel '${channelName}' not found in config`);
+  const agent = config.agents?.[channel.agent];
+  if (!agent) throw new UserError(`Channel '${channelName}' references unknown agent '${channel.agent}'`);
+  const agentType = agent.delivery?.[provider]?.type === "forward" ? "template" : "agent";
+  const agent_id = requireRef(state, { type: agentType, name: channel.agent, provider });
+  const identityName = channel.identity ?? config.defaults?.identity;
+  if (!identityName) {
+    throw new UserError(`Channel '${channelName}' must declare identity or use defaults.identity.`);
+  }
+  const identity_id = requireRef(state, { type: "identity", name: identityName, provider });
+  return { identity_id, agent_id };
+}
 function resolveTunnelIdFromConfig(config, tunnelName, provider) {
   if (provider !== "qoder") {
     throw new UserError("Tunnels are supported only by Qoder BYOC sessions.");
@@ -5078,10 +5992,10 @@ async function executePlan(plan, ctx, options = {}) {
   const failed = /* @__PURE__ */ new Set();
   let stateUpdated = false;
   for (const action of plan.actions) {
-    if (action.address.type !== "environment") continue;
-    const decl = ctx.config.environments?.[action.address.name];
+    if (action.address.type !== "environment" && action.address.type !== "identity") continue;
     const existing = ctx.state.getResource(action.address);
-    if (decl?.environment_id && existing && !existing.externally_managed) {
+    const externalId = action.address.type === "environment" ? ctx.config.environments?.[action.address.name]?.environment_id : ctx.config.identities?.[action.address.name]?.identity_id;
+    if (externalId && existing && !existing.externally_managed) {
       ctx.state.setResource({ ...existing, externally_managed: true });
       stateUpdated = true;
     }
@@ -5225,9 +6139,9 @@ async function executeActionInner(action, provider, ctx) {
     const existing = ctx.state.getResource(address);
     if (!existing) return false;
     const id = existing.remote_id;
-    if (type === "environment") {
-      const decl = ctx.config.environments?.[name];
-      if (existing.externally_managed || decl?.environment_id) {
+    if (type === "environment" || type === "identity") {
+      const externalReference = type === "environment" ? ctx.config.environments?.[name]?.environment_id : ctx.config.identities?.[name]?.identity_id;
+      if (existing.externally_managed || externalReference) {
         ctx.state.removeResource(address);
         return false;
       }
@@ -5262,6 +6176,16 @@ async function executeActionInner(action, provider, ctx) {
           case "file":
             await provider.deleteFile(id);
             break;
+          case "identity":
+            if (!provider.deleteIdentity)
+              throw new UserError(`Provider '${address.provider}' does not support identities`);
+            await provider.deleteIdentity(id);
+            break;
+          case "channel":
+            if (!provider.deleteChannel)
+              throw new UserError(`Provider '${address.provider}' does not support channels`);
+            await provider.deleteChannel(id);
+            break;
         }
       } catch (err) {
         if (!ApiError.isNotFound(err)) throw err;
@@ -5383,27 +6307,51 @@ async function executeActionInner(action, provider, ctx) {
       break;
     }
     case "memory_store": {
-      const createMemoryStore = provider.createMemoryStore?.bind(provider);
-      const deleteMemoryStore = provider.deleteMemoryStore?.bind(provider);
-      if (!createMemoryStore || !deleteMemoryStore) throw memoryStoreUnsupported(address.provider);
+      const createMemoryStore2 = provider.createMemoryStore?.bind(provider);
+      const deleteMemoryStore2 = provider.deleteMemoryStore?.bind(provider);
+      if (!createMemoryStore2 || !deleteMemoryStore2) throw memoryStoreUnsupported(address.provider);
       const decl = ctx.config.memory_stores[name];
-      if (isUpdate) {
-        try {
-          result = await createMemoryStore(name, decl);
-          await deleteMemoryStore(existingId);
-        } catch {
-          await deleteMemoryStore(existingId);
-          result = await createMemoryStore(name, decl);
+      if (!provider.updateMemoryStore || !provider.listMemories || !provider.createMemory || !provider.updateMemory) {
+        throw memoryStoreUnsupported(address.provider);
+      }
+      const reconcile = async (storeId) => {
+        const store = await provider.updateMemoryStore(storeId, {
+          name,
+          description: decl.description,
+          metadata: decl.metadata ?? {}
+        });
+        const current = /* @__PURE__ */ new Map();
+        let cursor;
+        do {
+          const page2 = await provider.listMemories(storeId, { limit: 100, cursor, view: "basic" });
+          for (const memory of page2.data) {
+            if (memory.type === "memory") current.set(memory.path, memory);
+          }
+          cursor = page2.has_more ? page2.next_cursor : void 0;
+        } while (cursor);
+        for (const entry of decl.entries ?? []) {
+          const existing = current.get(entry.key.replace(/^\/+/, ""));
+          if (existing) {
+            if (existing.content_sha256 !== sha256(entry.content)) {
+              await provider.updateMemory(storeId, existing.id, {
+                content: entry.content,
+                expected_content_sha256: existing.content_sha256
+              });
+            }
+          } else {
+            await provider.createMemory(storeId, { path: entry.key, content: entry.content });
+          }
         }
+        return store;
+      };
+      if (isUpdate) {
+        result = await reconcile(existingId);
       } else {
         try {
-          result = await createMemoryStore(name, decl);
+          result = await createMemoryStore2(name, decl);
         } catch (err) {
           result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
-            onExisting: async (existing) => {
-              await deleteMemoryStore(existing.id);
-              return createMemoryStore(name, decl);
-            }
+            onExisting: async (existing) => reconcile(existing.id)
           });
           adopted = true;
         }
@@ -5451,6 +6399,63 @@ async function executeActionInner(action, provider, ctx) {
       }
       break;
     }
+    case "identity": {
+      const createIdentity = provider.createIdentity?.bind(provider);
+      const updateIdentity = provider.updateIdentity?.bind(provider);
+      if (!createIdentity || !updateIdentity) {
+        throw new UserError(`Provider '${address.provider}' does not support identities`);
+      }
+      const decl = ctx.config.identities[name];
+      if (decl.identity_id) {
+        const remote2 = await provider.findResource("identity", name, decl.identity_id);
+        if (!remote2?.id) {
+          throw new UserError(
+            `External identity.${name} '${decl.identity_id}' was not found on provider '${address.provider}'.`
+          );
+        }
+        result = remote2;
+        break;
+      }
+      if (isUpdate) {
+        if (ctx.state.getResource(address)?.externally_managed) {
+          throw new UserError(`identity.${name} is recorded as an external reference; refusing to modify it remotely.`);
+        }
+        result = await updateIdentity(existingId, name, decl);
+      } else {
+        try {
+          result = await createIdentity(name, decl);
+        } catch (err) {
+          if (!(err instanceof ConflictError)) throw err;
+          const existing = await provider.findResource("identity", decl.external_id);
+          if (!existing?.id) throw err;
+          result = await updateIdentity(existing.id, name, decl);
+          adopted = true;
+        }
+      }
+      break;
+    }
+    case "channel": {
+      const createChannel = provider.createChannel?.bind(provider);
+      const updateChannel = provider.updateChannel?.bind(provider);
+      if (!createChannel || !updateChannel) {
+        throw new UserError(`Provider '${address.provider}' does not support channels`);
+      }
+      const decl = ctx.config.channels[name];
+      const refs = resolveChannelRefs(name, ctx.config, address.provider, ctx.state);
+      if (isUpdate) {
+        result = await updateChannel(existingId, name, decl, refs);
+      } else {
+        try {
+          result = await createChannel(name, decl, refs);
+        } catch (err) {
+          result = await adoptOnConflict(err, address, provider, ctx.onFeedback, {
+            onExisting: (existing) => updateChannel(existing.id, name, decl, refs)
+          });
+          adopted = true;
+        }
+      }
+      break;
+    }
     case "deployment": {
       const decl = ctx.config.deployments[name];
       const refs = resolveDeploymentRefs(name, ctx.config, address.provider, ctx.state);
@@ -5503,7 +6508,7 @@ async function executeActionInner(action, provider, ctx) {
   ctx.state.setResource({
     address,
     remote_id: result.id,
-    externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id ? true : void 0,
+    externally_managed: priorResource?.externally_managed || type === "environment" && ctx.config.environments?.[name]?.environment_id || type === "identity" && ctx.config.identities?.[name]?.identity_id ? true : void 0,
     version: result.version,
     content_hash: hash,
     desired_hash: hash,
@@ -5637,6 +6642,13 @@ function collectReferenceDiagnostics(config, diagnostics) {
   const vaultNames = new Set(Object.keys(config.vaults ?? {}));
   const memoryNames = new Set(Object.keys(config.memory_stores ?? {}));
   const agentNames = new Set(Object.keys(config.agents ?? {}));
+  const identityNames = new Set(Object.keys(config.identities ?? {}));
+  if (config.defaults?.identity && !identityNames.has(config.defaults.identity)) {
+    diagnostics.error(
+      "config.defaults.identity.unknown",
+      `defaults.identity references unknown identity '${config.defaults.identity}'`
+    );
+  }
   for (const [name, agent] of Object.entries(config.agents ?? {})) {
     if (agent.environment && !envNames.has(agent.environment)) {
       diagnostics.error(
@@ -5686,6 +6698,23 @@ function collectReferenceDiagnostics(config, diagnostics) {
       );
     }
   }
+  for (const [name, channel] of Object.entries(config.channels ?? {})) {
+    if (!agentNames.has(channel.agent)) {
+      diagnostics.error("config.channel.agent.unknown", `channel.${name}: references unknown agent '${channel.agent}'`);
+    }
+    const identity = channel.identity ?? config.defaults?.identity;
+    if (!identity) {
+      diagnostics.error(
+        "config.channel.identity.required",
+        `channel.${name}: declare identity or configure defaults.identity`
+      );
+    } else if (!identityNames.has(identity)) {
+      diagnostics.error(
+        "config.channel.identity.unknown",
+        `channel.${name}: references unknown identity '${identity}'`
+      );
+    }
+  }
 }
 function collectProviderCapabilities(config, providers, diagnostics) {
   for (const providerName of providers) {
@@ -5698,9 +6727,120 @@ function collectProviderCapabilities(config, providers, diagnostics) {
       continue;
     }
     const caps = def.capabilities;
+    for (const [name, identity] of Object.entries(config.identities ?? {})) {
+      if (identity.provider && identity.provider !== providerName) continue;
+      if (!isSupported(caps, "identity")) {
+        diagnostics.error(
+          `${providerName}.identity.unsupported`,
+          `${caps.identity.reason}. ${caps.identity.remediation ?? ""}`.trim(),
+          { type: "identity", name, provider: providerName }
+        );
+      }
+    }
+    for (const [name, channel] of Object.entries(config.channels ?? {})) {
+      if (channel.provider && channel.provider !== providerName) continue;
+      if (!isSupported(caps, "channel")) {
+        diagnostics.error(
+          `${providerName}.channel.unsupported`,
+          `${caps.channel.reason}. ${caps.channel.remediation ?? ""}`.trim(),
+          { type: "channel", name, provider: providerName }
+        );
+        continue;
+      }
+      if (providerName === "qoder") {
+        const agent = config.agents?.[channel.agent];
+        if (agent?.provider && agent.provider !== providerName) {
+          diagnostics.error(
+            "config.channel.agent.provider_mismatch",
+            `channel.${name}: agent '${channel.agent}' is pinned to provider '${agent.provider}'.`,
+            { type: "channel", name, provider: providerName }
+          );
+        }
+        const identityName = channel.identity ?? config.defaults?.identity;
+        const identity = identityName ? config.identities?.[identityName] : void 0;
+        if (identity?.provider && identity.provider !== providerName) {
+          diagnostics.error(
+            "config.channel.identity.provider_mismatch",
+            `channel.${name}: identity '${identityName}' is pinned to provider '${identity.provider}'.`,
+            { type: "channel", name, provider: providerName }
+          );
+        }
+        if (agent && agent.delivery?.qoder?.type !== "forward") {
+          diagnostics.error(
+            "qoder.channel.forward_template.required",
+            `channel.${name}: Qoder Channels require agent '${channel.agent}' to use delivery.qoder.type: forward.`,
+            { type: "channel", name, provider: providerName }
+          );
+        }
+        const requiredCredentials = {
+          dingtalk: ["client_id", "client_secret"],
+          feishu: ["app_id", "app_secret"],
+          wecom: ["bot_id", "secret"]
+        };
+        if (channel.type === "wechat") {
+          diagnostics.error(
+            "qoder.channel.wechat.credentials.unsupported",
+            `channel.${name}: personal WeChat supports QR binding only; credential-based apply is unavailable.`,
+            { type: "channel", name, provider: providerName }
+          );
+        } else if (!requiredCredentials[channel.type]) {
+          diagnostics.error(
+            "qoder.channel.type.unsupported",
+            `channel.${name}: unsupported Qoder channel type '${channel.type}'.`,
+            { type: "channel", name, provider: providerName }
+          );
+        } else {
+          const missing = requiredCredentials[channel.type].filter((key) => !channel.credentials?.[key]);
+          if (missing.length) {
+            diagnostics.error(
+              "qoder.channel.credentials.required",
+              `channel.${name}: '${channel.type}' requires credentials: ${missing.join(", ")}.`,
+              { type: "channel", name, provider: providerName }
+            );
+          }
+        }
+      }
+    }
     for (const [name, agent] of Object.entries(config.agents ?? {})) {
       if (agent.provider && agent.provider !== providerName) continue;
       const delivery = agent.delivery?.[providerName]?.type ?? "managed";
+      const address = {
+        type: delivery === "forward" ? "template" : "agent",
+        name,
+        provider: providerName
+      };
+      const asksForApproval = agent.tools?.default_permission === "ask" || Object.values(agent.tools?.permissions ?? {}).some((permission) => permission === "ask");
+      if (asksForApproval && !def.features.tool_permissions) {
+        diagnostics.error(
+          `${providerName}.agent.tool_permissions.unsupported`,
+          `agent.${name}: provider '${providerName}' cannot enforce interactive tool permission 'ask'.`,
+          address
+        );
+      }
+      for (const resource of agent.resources ?? []) {
+        if (!def.features.session_resources.includes(resource.type)) {
+          diagnostics.error(
+            `${providerName}.agent.session_resource.${resource.type}.unsupported`,
+            `agent.${name}: provider '${providerName}' does not support Session resource type '${resource.type}'.`,
+            address
+          );
+        }
+        const mountPrefix = providerMountPrefix(providerName);
+        if (mountPrefix && resource.mount_path && resource.mount_path !== mountPrefix && !resource.mount_path.startsWith(`${mountPrefix}/`)) {
+          diagnostics.error(
+            `${providerName}.agent.session_resource.mount_path.invalid`,
+            `agent.${name}: ${providerName} Session resource mount_path must start with '${mountPrefix}/'.`,
+            address
+          );
+        }
+      }
+      if (delivery === "forward" && agent.resources?.length) {
+        diagnostics.error(
+          `${providerName}.template.session_resources.unsupported`,
+          `agent.${name}: Forward delivery cannot attach Agent Session resources; use managed delivery.`,
+          address
+        );
+      }
       if (delivery === "forward" && !isSupported(caps, "template")) {
         diagnostics.error(
           `${providerName}.agent.delivery.forward.unsupported`,
@@ -5774,6 +6914,14 @@ function collectProviderCapabilities(config, providers, diagnostics) {
         }
       }
       for (const [name, deployment] of Object.entries(config.deployments ?? {})) {
+        if (deployment.provider && deployment.provider !== providerName) continue;
+        if (deployment.environment_variables !== void 0) {
+          diagnostics.error(
+            `${providerName}.deployment.environment_variables.unsupported`,
+            `deployment.${name}: environment_variables is supported only by Qoder deployments; remove it or pin this deployment to the qoder provider.`,
+            { type: "deployment", name, provider: providerName }
+          );
+        }
         if (deployment.tunnel && (!deployment.provider || deployment.provider === providerName)) {
           diagnostics.error(
             `${providerName}.deployment.tunnel.unsupported`,
@@ -5911,6 +7059,13 @@ function buildDependencyGraph(config, targetProviders) {
         addNode({ type: "file", name, provider });
       }
     }
+    if (config.identities && isSupported(caps, "identity")) {
+      for (const name of Object.keys(config.identities)) {
+        const decl = config.identities[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        addNode({ type: "identity", name, provider });
+      }
+    }
     if (config.agents) {
       for (const name of Object.keys(config.agents)) {
         const decl = config.agents[name];
@@ -6002,6 +7157,23 @@ function buildDependencyGraph(config, targetProviders) {
         }
       }
     }
+    if (config.channels && isSupported(caps, "channel")) {
+      for (const name of Object.keys(config.channels)) {
+        const decl = config.channels[name];
+        if (decl.provider && decl.provider !== provider) continue;
+        const channelAddr = { type: "channel", name, provider };
+        addNode(channelAddr);
+        const agentDecl = config.agents?.[decl.agent];
+        const agentType = agentDecl ? resolveAgentMaterialization(provider, agentDecl).resourceType : "agent";
+        const agentAddr = { type: agentType, name: decl.agent, provider };
+        if (nodes.has(addressKey(agentAddr))) addEdge(channelAddr, agentAddr);
+        const identityName = decl.identity ?? config.defaults?.identity;
+        if (identityName) {
+          const identityAddr = { type: "identity", name: identityName, provider };
+          if (nodes.has(addressKey(identityAddr))) addEdge(channelAddr, identityAddr);
+        }
+      }
+    }
   }
   return { nodes, edges };
 }
@@ -6071,9 +7243,28 @@ async function buildPlan(config, state, options = {}) {
         );
       }
     }
-    const isExternalEnv = address.type === "environment" && Boolean(config.environments?.[address.name]?.environment_id);
-    const createReason = isExternalEnv ? "Record external environment reference (no remote mutation)" : "Resource does not exist in state";
-    const updateSuffix = isExternalEnv ? " \u2014 external reference, no remote mutation" : "";
+    if (address.type === "identity" && existing) {
+      const identityDecl = config.identities?.[address.name];
+      if (existing.externally_managed && identityDecl && !identityDecl.identity_id) {
+        diagnostics.error(
+          "plan.identity.ownership_transition",
+          `identity.${address.name} is recorded as an external reference (${existing.remote_id ?? "unknown id"}); replacing identity_id with a managed declaration would modify and eventually delete an Identity this project does not own. Restore identity_id or release the state reference first.`,
+          address
+        );
+        stateIndex.delete(key);
+        continue;
+      }
+      if (!existing.externally_managed && existing.remote_id && identityDecl?.identity_id && identityDecl.identity_id !== existing.remote_id) {
+        diagnostics.warning(
+          "plan.identity.ownership_orphan",
+          `identity.${address.name}: switching to external reference '${identityDecl.identity_id}' orphans the previously managed Identity '${existing.remote_id}'.`,
+          address
+        );
+      }
+    }
+    const isExternalReference2 = address.type === "environment" && Boolean(config.environments?.[address.name]?.environment_id) || address.type === "identity" && Boolean(config.identities?.[address.name]?.identity_id);
+    const createReason = isExternalReference2 ? `Record external ${address.type} reference (no remote mutation)` : "Resource does not exist in state";
+    const updateSuffix = isExternalReference2 ? " \u2014 external reference, no remote mutation" : "";
     if (!existing) {
       actions.push({
         action: "create",
@@ -6319,7 +7510,9 @@ var IMPORTABLE_RESOURCE_TYPES = /* @__PURE__ */ new Set([
   "memory_store",
   "skill",
   "agent",
-  "template"
+  "template",
+  "identity",
+  "channel"
 ]);
 async function importResource(ctx, address, remoteId, options = {}) {
   if (!IMPORTABLE_RESOURCE_TYPES.has(address.type)) {
@@ -6482,25 +7675,25 @@ function resolveSyncProvider(config, explicitProvider) {
   );
 }
 async function syncProviderResourcesFromEnv(opts) {
-  const adapter = buildProviderFromEnv(opts.provider);
+  const adapter2 = buildProviderFromEnv(opts.provider);
   const providers = await providersBlockFromFile(opts.configPath, opts.provider);
-  return assembleSyncedConfig(adapter, opts.provider, {
+  return assembleSyncedConfig(adapter2, opts.provider, {
     types: opts.types,
     version: "1",
     providers
   });
 }
 async function syncProviderResourcesFromContext(ctx, opts) {
-  const adapter = getRuntimeProvider(ctx, opts.provider);
+  const adapter2 = getRuntimeProvider(ctx, opts.provider);
   const providers = await providersBlockFromFile(ctx.configPath ?? opts.configPath, opts.provider);
-  return assembleSyncedConfig(adapter, opts.provider, {
+  return assembleSyncedConfig(adapter2, opts.provider, {
     types: opts.types,
     version: ctx.config.version ?? "1",
     providers
   });
 }
-async function assembleSyncedConfig(adapter, provider, opts) {
-  if (!adapter.exportResources) {
+async function assembleSyncedConfig(adapter2, provider, opts) {
+  if (!adapter2.exportResources) {
     throw new UserError(`Provider '${provider}' does not support sync (no exportResources).`);
   }
   const types = opts.types ?? ["environment", "vault", "file", "skill", "agent"];
@@ -6511,7 +7704,7 @@ async function assembleSyncedConfig(adapter, provider, opts) {
     if (!groupKey) {
       throw new UserError(`Resource type '${type}' is not syncable yet.`);
     }
-    const exported = await adapter.exportResources(type);
+    const exported = await adapter2.exportResources(type);
     let group = groups[groupKey];
     if (!group) {
       group = {};
@@ -6523,8 +7716,8 @@ async function assembleSyncedConfig(adapter, provider, opts) {
     }
   }
   let skillFiles;
-  if (types.includes("skill") && adapter.downloadAllSkillFiles) {
-    skillFiles = await adapter.downloadAllSkillFiles();
+  if (types.includes("skill") && adapter2.downloadAllSkillFiles) {
+    skillFiles = await adapter2.downloadAllSkillFiles();
   }
   const config = {
     version: opts.version ?? "1",
@@ -6691,6 +7884,12 @@ async function readYaml(path) {
 }
 
 // src/internal/core/deployment-runtime.ts
+async function listRemoteDeploymentsForContext(ctx, provider, filter) {
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.listDeployments)
+    throw new UserError(`Provider '${provider}' does not support remote deployment listing.`);
+  return adapter2.listDeployments(filter);
+}
 function listDeploymentsForContext(ctx, providerFilter) {
   let rows = ctx.state.listResources().filter((resource) => resource.address.type === "deployment");
   if (providerFilter) {
@@ -6709,9 +7908,9 @@ function listDeploymentsForContext(ctx, providerFilter) {
     };
   });
 }
-async function getDeploymentDetailsForContext(ctx, name, adapter, resolvedProvider) {
+async function getDeploymentDetailsForContext(ctx, name, adapter2, resolvedProvider) {
   const provider = resolvedProvider ?? resolveDeploymentProvider(name, ctx.config);
-  const effectiveAdapter = adapter ?? getRuntimeProvider(ctx, provider);
+  const effectiveAdapter = adapter2 ?? getRuntimeProvider(ctx, provider);
   const depCtx = buildDeploymentContext(ctx, name, provider);
   return {
     name,
@@ -6725,9 +7924,9 @@ async function getDeploymentDetailsForContext(ctx, name, adapter, resolvedProvid
     info: await effectiveAdapter.getDeployment(depCtx)
   };
 }
-async function runDeploymentForContext(ctx, name, adapter, resolvedProvider) {
+async function runDeploymentForContext(ctx, name, adapter2, resolvedProvider) {
   const provider = resolvedProvider ?? resolveDeploymentProvider(name, ctx.config);
-  const effectiveAdapter = adapter ?? getRuntimeProvider(ctx, provider);
+  const effectiveAdapter = adapter2 ?? getRuntimeProvider(ctx, provider);
   const depCtx = buildDeploymentContext(ctx, name, provider);
   return {
     name,
@@ -6735,6 +7934,14 @@ async function runDeploymentForContext(ctx, name, adapter, resolvedProvider) {
     result: await effectiveAdapter.runDeployment(depCtx)
   };
 }
+async function pauseDeploymentForContext(ctx, name, paused, resolvedProvider) {
+  const provider = resolvedProvider ?? resolveDeploymentProvider(name, ctx.config);
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  const operation = paused ? adapter2.pauseDeployment : adapter2.unpauseDeployment;
+  if (!operation)
+    throw new UserError(`Provider '${provider}' does not support ${paused ? "pausing" : "unpausing"} deployments.`);
+  return operation.call(adapter2, buildDeploymentContext(ctx, name, provider));
+}
 function getDeploymentRuntimeProviderForContext(ctx, name, overrideProvider) {
   return resolveDeploymentProvider(name, ctx.config, overrideProvider);
 }
@@ -6774,13 +7981,15 @@ function buildDeploymentContext(ctx, name, provider) {
 // src/internal/core/destroy-runtime.ts
 var destroyOrder = {
   deployment: 0,
+  channel: 0,
   agent: 1,
   template: 1,
-  skill: 2,
-  memory_store: 3,
-  vault: 4,
-  file: 5,
-  environment: 6
+  identity: 2,
+  skill: 3,
+  memory_store: 4,
+  vault: 5,
+  file: 6,
+  environment: 7
 };
 function planDestroyProjectContext(ctx) {
   const resources = [...ctx.state.listResources()].sort(
@@ -6811,7 +8020,7 @@ async function destroyPlannedProjectResources(planned, options = {}) {
   };
 }
 async function destroyOneResource(ctx, resource, options) {
-  if (isExternalEnvironment(ctx, resource)) {
+  if (isExternalReference(ctx, resource)) {
     ctx.state.removeResource(resource.address);
     return successResult(resource, "reference_removed");
   }
@@ -6875,8 +8084,15 @@ async function destroyOneResource(ctx, resource, options) {
     return failureResult(resource, error);
   }
 }
-function isExternalEnvironment(ctx, resource) {
-  return resource.address.type === "environment" && (resource.externally_managed || Boolean(ctx.config.environments?.[resource.address.name]?.environment_id));
+function isExternalReference(ctx, resource) {
+  if (resource.externally_managed) return true;
+  if (resource.address.type === "environment") {
+    return Boolean(ctx.config.environments?.[resource.address.name]?.environment_id);
+  }
+  if (resource.address.type === "identity") {
+    return Boolean(ctx.config.identities?.[resource.address.name]?.identity_id);
+  }
+  return false;
 }
 function successResult(resource, reason) {
   return { resource, status: "success", reason };
@@ -6916,6 +8132,17 @@ async function deleteRemoteResource(provider, type, id, cascade) {
     case "deployment":
       await provider.deleteDeployment(id);
       return;
+    case "identity":
+      if (!provider.deleteIdentity) throw new UserError(`Provider does not support identities`);
+      await provider.deleteIdentity(id);
+      return;
+    case "channel":
+      if (!provider.deleteChannel) throw new UserError(`Provider does not support channels`);
+      await provider.deleteChannel(id);
+      return;
+    case "file":
+      await provider.deleteFile(id);
+      return;
   }
 }
 function isReferencedError(error) {
@@ -6930,11 +8157,11 @@ async function listProviderModelsForContext(providers, providerFilter) {
   const targetProviders = providerFilter ? [providerFilter] : Array.from(providers.keys());
   const result = [];
   for (const name of targetProviders) {
-    const adapter = providers.get(name);
-    if (!adapter) {
+    const adapter2 = providers.get(name);
+    if (!adapter2) {
       throw new UserError(`Provider '${name}' is not configured.`);
     }
-    if (!adapter.listModels) {
+    if (!adapter2.listModels) {
       result.push({
         provider: name,
         supportsDynamicListing: false,
@@ -6945,7 +8172,7 @@ async function listProviderModelsForContext(providers, providerFilter) {
     result.push({
       provider: name,
       supportsDynamicListing: true,
-      models: await adapter.listModels()
+      models: await adapter2.listModels()
     });
   }
   return result;
@@ -6960,6 +8187,89 @@ function listProviderDiscovery() {
   })).sort((a, b) => a.name.localeCompare(b.name));
 }
 
+// src/internal/core/memory-runtime.ts
+function adapter(providers, provider) {
+  const value = providers.get(provider);
+  if (!value) throw new UserError(`Provider '${provider}' is not configured.`);
+  return value;
+}
+function method(value, name) {
+  const fn = value[name];
+  if (typeof fn !== "function")
+    throw new UserError(`Provider '${value.name}' does not support memory operation '${String(name)}'.`);
+  return fn.bind(value);
+}
+function listMemoryStores(providers, provider, options) {
+  const value = adapter(providers, provider);
+  return method(value, "listMemoryStores")(options);
+}
+function getMemoryProviderCapabilities(providers, provider) {
+  const value = adapter(providers, provider);
+  if (!value.memoryCapabilities) throw new UserError(`Provider '${provider}' does not support memory stores.`);
+  return value.memoryCapabilities;
+}
+async function createMemoryStore(providers, provider, input) {
+  const value = adapter(providers, provider);
+  const created = await method(value, "createMemoryStore")(input.name, {
+    description: input.description ?? "",
+    metadata: input.metadata
+  });
+  if (!created.id) throw new UserError(`Provider '${provider}' returned no memory store id.`);
+  return method(value, "getMemoryStore")(created.id);
+}
+function deleteMemoryStore(providers, provider, id) {
+  const value = adapter(providers, provider);
+  return method(value, "deleteMemoryStore")(id);
+}
+function getMemoryStore(providers, provider, id) {
+  const value = adapter(providers, provider);
+  return method(value, "getMemoryStore")(id);
+}
+function updateMemoryStore(providers, provider, id, input) {
+  const value = adapter(providers, provider);
+  return method(value, "updateMemoryStore")(id, input);
+}
+function archiveMemoryStore(providers, provider, id) {
+  const value = adapter(providers, provider);
+  return method(value, "archiveMemoryStore")(id);
+}
+function createMemory(providers, provider, storeId, input) {
+  const value = adapter(providers, provider);
+  return method(value, "createMemory")(storeId, input);
+}
+function batchCreateMemories(providers, provider, storeId, input) {
+  const value = adapter(providers, provider);
+  return method(value, "batchCreateMemories")(storeId, input);
+}
+function listMemories(providers, provider, storeId, options) {
+  const value = adapter(providers, provider);
+  return method(value, "listMemories")(storeId, options);
+}
+function getMemory(providers, provider, storeId, memoryId) {
+  const value = adapter(providers, provider);
+  return method(value, "getMemory")(storeId, memoryId);
+}
+function updateMemory(providers, provider, storeId, memoryId, input) {
+  const value = adapter(providers, provider);
+  return method(value, "updateMemory")(storeId, memoryId, input);
+}
+function deleteMemory(providers, provider, storeId, memoryId, expected) {
+  const value = adapter(providers, provider);
+  return method(value, "deleteMemory")(storeId, memoryId, expected);
+}
+function listMemoryVersions(providers, provider, storeId, options) {
+  const value = adapter(providers, provider);
+  return method(value, "listMemoryVersions")(storeId, options);
+}
+function getMemoryVersion(providers, provider, storeId, versionId) {
+  const value = adapter(providers, provider);
+  return method(value, "getMemoryVersion")(storeId, versionId);
+}
+function redactMemoryVersion(providers, provider, storeId, versionId) {
+  const value = adapter(providers, provider);
+  return method(value, "redactMemoryVersion")(storeId, versionId);
+}
+
 // src/internal/core/agent-builder.ts
 function buildAgentDecl(base, input) {
   const model = input.model ?? base?.model;
@@ -7033,13 +8343,33 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     const available = Object.keys(config.agents ?? {}).join(", ");
     throw new UserError(`Agent '${agentName}' not found in config. Available agents: ${available || "(none)"}`);
   }
+  const sessionResources = options.resources ?? agent.resources;
+  const providerFeatures = getProvider(provider)?.features;
+  for (const resource of sessionResources ?? []) {
+    if (!providerFeatures?.session_resources.includes(resource.type)) {
+      throw new UserError(
+        `Provider '${provider}' does not support Session resource type '${resource.type}' for agent '${agentName}'.`
+      );
+    }
+  }
   if (resolveAgentMaterialization(provider, agent).resourceType === "template") {
+    if (sessionResources?.length) {
+      throw new UserError(
+        `Forward session for '${agentName}' cannot attach Agent resources. Use managed delivery for GitHub repositories.`
+      );
+    }
     const templateId = requireRef(state, { type: "template", name: agentName, provider });
-    const identityId = options.identityId ?? config.defaults?.session?.qoder?.identity_id;
+    const defaultIdentity = config.defaults?.identity;
+    const identityId = options.identityId ?? (defaultIdentity ? requireRef(state, { type: "identity", name: defaultIdentity, provider }) : void 0);
+    if (!identityId) {
+      throw new UserError(
+        `Forward session for '${agentName}' requires an Identity. Configure defaults.identity or pass --identity-id.`
+      );
+    }
     return {
       delivery: "forward",
       template_id: templateId,
-      ...identityId ? { identity_id: identityId } : {},
+      identity_id: identityId,
       files: (options.files ?? []).map((file) => ({ file_id: file.fileId, mount_path: file.mountPath })),
       title: options.title,
       metadata: options.metadata
@@ -7085,6 +8415,7 @@ function buildSessionBindings(agentName, config, provider, state, options = {})
     vault_ids: vaultIds,
     memory_store_ids: memoryStoreIds,
     files: (options.files ?? []).map((f) => ({ file_id: f.fileId, mount_path: f.mountPath })),
+    resources: sessionResources,
     title: options.title,
     metadata: options.metadata
   };
@@ -7123,9 +8454,9 @@ async function listCloudAgents(ctx, options = {}) {
       throw new UserError("Multiple providers configured. Pass `provider` to list cloud agents.");
     }
   }
-  const adapter = getRuntimeProvider(ctx, provider);
-  if (!adapter.listAgents) return [];
-  return adapter.listAgents({ prefix: options.prefix, limit: options.limit });
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  if (!adapter2.listAgents) return [];
+  return adapter2.listAgents({ prefix: options.prefix, limit: options.limit });
 }
 function resolveSingleProvider(ctx, provider) {
   if (provider) return provider;
@@ -7134,55 +8465,55 @@ function resolveSingleProvider(ctx, provider) {
   throw new UserError("Multiple providers configured. Pass `provider` to target one.");
 }
 async function listCloudEnvironments(ctx, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  if (!adapter.listEnvironments) return [];
-  return adapter.listEnvironments({ limit: options.limit });
+  if (!adapter2.listEnvironments) return [];
+  return adapter2.listEnvironments({ limit: options.limit });
 }
 async function createCloudEnvironment(ctx, name, decl, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  return adapter.createEnvironment(name, decl);
+  return adapter2.createEnvironment(name, decl);
 }
 async function deleteCloudEnvironment(ctx, id, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  await adapter.deleteEnvironment(id);
+  await adapter2.deleteEnvironment(id);
 }
 async function listCloudVaults(ctx, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  if (!adapter.listVaults) return [];
-  return adapter.listVaults({ limit: options.limit });
+  if (!adapter2.listVaults) return [];
+  return adapter2.listVaults({ limit: options.limit });
 }
 async function createCloudVault(ctx, name, decl, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  return adapter.createVault(name, decl);
+  return adapter2.createVault(name, decl);
 }
 async function deleteCloudVault(ctx, id, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  await adapter.deleteVault(id);
+  await adapter2.deleteVault(id);
 }
 async function archiveCloudAgent(ctx, id, options = {}) {
-  const adapter = getRuntimeProvider(
+  const adapter2 = getRuntimeProvider(
     ctx,
     resolveSingleProvider(ctx, options.provider)
   );
-  await adapter.deleteAgent(id);
+  await adapter2.deleteAgent(id);
 }
 function getAgent(ctx, agentId) {
   const agent = ctx.config.agents?.[agentId];
@@ -7454,6 +8785,7 @@ function toAgentSkillRef(skill) {
 var TERMINAL_SESSION_STATUSES = /* @__PURE__ */ new Set(["idle", "completed", "failed", "terminated", "deleted"]);
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_POLL_TIMEOUT_MS = 10 * 60 * 1e3;
+var POLL_INITIAL_INTERVAL_MS = 300;
 function resolveAgentName(agents, agentName) {
   if (agentName) return agentName;
   const names = Object.keys(agents ?? {});
@@ -7469,11 +8801,11 @@ function isTerminalSessionStatus(status) {
 function resolveSessionRuntime(ctx, target = {}) {
   const agentName = resolveAgentName(ctx.config.agents, target.agent);
   const provider = resolveSessionProvider(agentName, ctx.config, target.provider);
-  const adapter = getRuntimeProvider(ctx, provider);
-  return { agentName, provider, adapter };
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  return { agentName, provider, adapter: adapter2 };
 }
 async function createSessionForAgent(ctx, options = {}) {
-  const { agentName, provider, adapter } = resolveSessionRuntime(ctx, options);
+  const { agentName, provider, adapter: adapter2 } = resolveSessionRuntime(ctx, options);
   const bindings = buildSessionBindings(agentName, ctx.config, provider, ctx.state, {
     identityId: options.identityId,
     environment: options.environment,
@@ -7484,14 +8816,15 @@ async function createSessionForAgent(ctx, options = {}) {
     vaultIds: options.vaultIds,
     memoryStores: options.memoryStores,
     files: options.files,
+    resources: options.resources,
     title: options.title,
     metadata: options.metadata
   });
-  const session = await adapter.createSession(bindings);
+  const session = await adapter2.createSession(bindings);
   return { agentName, provider, session };
 }
 async function startSessionRun(ctx, prompt, options = {}) {
-  const { agentName, provider, adapter } = resolveSessionRuntime(ctx, options);
+  const { agentName, provider, adapter: adapter2 } = resolveSessionRuntime(ctx, options);
   const bindings = buildSessionBindings(agentName, ctx.config, provider, ctx.state, {
     identityId: options.identityId,
     environment: options.environment,
@@ -7502,60 +8835,59 @@ async function startSessionRun(ctx, prompt, options = {}) {
     vaultIds: options.vaultIds,
     memoryStores: options.memoryStores,
     files: options.files,
+    resources: options.resources,
     title: options.title,
     metadata: options.metadata
   });
-  const session = await adapter.createSession(bindings);
+  const session = await adapter2.createSession(bindings);
   return {
     agentName,
     provider,
     session,
-    events: streamMessageEvents(adapter, session.id, preparePromptForProvider(prompt, bindings.files, provider))
+    events: streamMessageEvents(adapter2, session.id, prepareInitialSessionPrompt(prompt, bindings, provider))
   };
 }
-function streamMessageEvents(adapter, sessionId, message) {
-  if (adapter.eventResume) {
-    return streamWithResume(adapter, sessionId, message);
+function streamMessageEvents(adapter2, sessionId, message) {
+  if (adapter2.eventResume) {
+    return streamWithResume(adapter2, sessionId, message);
   }
-  return streamConnectBeforeSend(adapter, sessionId, message);
+  return streamConnectBeforeSend(adapter2, sessionId, message);
 }
 async function sendSessionMessageStreaming(ctx, sessionId, message, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  return streamMessageEvents(adapter, sessionId, message);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  return streamMessageEvents(adapter2, sessionId, message);
 }
 async function startSessionRunPolling(ctx, prompt, options = {}) {
-  const run = await createSessionForAgent(ctx, options);
-  const adapter = getRuntimeProvider(ctx, run.provider);
-  const hintedPrompt = preparePromptForProvider(
-    prompt,
-    options.files?.map((f) => ({ mount_path: f.mountPath })),
-    run.provider
-  );
-  const collected = await sendSessionMessageAndCollectEvents(adapter, run.session.id, hintedPrompt, options);
-  return { ...run, ...collected };
-}
-async function sendSessionMessageAndCollectEvents(adapter, sessionId, message, options = {}) {
-  const eventId = await adapter.sendSessionMessage(sessionId, message);
-  return collectEventsUntilTerminal(adapter, sessionId, {
-    afterId: adapter.eventResume ? eventId : void 0,
+  const { agentName, provider, adapter: adapter2 } = resolveSessionRuntime(ctx, options);
+  const bindings = buildSessionBindings(agentName, ctx.config, provider, ctx.state, options);
+  const session = await adapter2.createSession(bindings);
+  const initialPrompt = prepareInitialSessionPrompt(prompt, bindings, provider);
+  const collected = await sendSessionMessageAndCollectEvents(adapter2, session.id, initialPrompt, options);
+  return { agentName, provider, session, ...collected };
+}
+async function sendSessionMessageAndCollectEvents(adapter2, sessionId, message, options = {}) {
+  const eventId = await adapter2.sendSessionMessage(sessionId, message);
+  return collectEventsUntilTerminal(adapter2, sessionId, {
+    afterId: adapter2.eventResume ? eventId : void 0,
     pollIntervalMs: options.pollIntervalMs,
     pollTimeoutMs: options.pollTimeoutMs
   }).then((result) => ({ eventId, ...result }));
 }
 async function sendSessionMessagePolling(ctx, sessionId, message, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  return sendSessionMessageAndCollectEvents(adapter, sessionId, message, options);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  return sendSessionMessageAndCollectEvents(adapter2, sessionId, message, options);
 }
-async function collectEventsUntilTerminal(adapter, sessionId, options = {}) {
+async function collectEventsUntilTerminal(adapter2, sessionId, options = {}) {
   const start = Date.now();
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const maxPollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   const pollTimeoutMs = options.pollTimeoutMs ?? DEFAULT_POLL_TIMEOUT_MS;
+  let currentIntervalMs = Math.min(POLL_INITIAL_INTERVAL_MS, maxPollIntervalMs);
   let terminalStatus = "idle";
   let result;
   if (options.afterId) {
     while (true) {
       assertNotTimedOut(start, pollTimeoutMs);
-      result = await adapter.listSessionEvents(sessionId, {
+      result = await adapter2.listSessionEvents(sessionId, {
         limit: 100,
         after_id: options.afterId
       });
@@ -7566,19 +8898,21 @@ async function collectEventsUntilTerminal(adapter, sessionId, options = {}) {
         terminalStatus = terminalEvent.status;
         break;
       }
-      await delay(pollIntervalMs);
+      await delay(currentIntervalMs);
+      currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
   } else {
     while (true) {
       assertNotTimedOut(start, pollTimeoutMs);
-      const session = await adapter.getSession(sessionId);
+      const session = await adapter2.getSession(sessionId);
       if (isTerminalSessionStatus(session.status)) {
         terminalStatus = session.status;
         break;
       }
-      await delay(pollIntervalMs);
+      await delay(currentIntervalMs);
+      currentIntervalMs = Math.min(currentIntervalMs * 2, maxPollIntervalMs);
     }
-    result = await adapter.listSessionEvents(sessionId, { limit: 100 });
+    result = await adapter2.listSessionEvents(sessionId, { limit: 100 });
   }
   return { terminalStatus, result };
 }
@@ -7613,9 +8947,9 @@ async function listSessionsForProject(ctx, options = {}) {
       throw new UserError("Multiple providers configured. Use --provider to specify one.");
     }
   }
-  const adapter = getRuntimeProvider(ctx, provider);
-  const result = await adapter.listSessions(agentId ? { ...options.filter, agent_id: agentId } : options.filter);
-  return { provider, adapter, agentId, agentName, result };
+  const adapter2 = getRuntimeProvider(ctx, provider);
+  const result = await adapter2.listSessions(agentId ? { ...options.filter, agent_id: agentId } : options.filter);
+  return { provider, adapter: adapter2, agentId, agentName, result };
 }
 async function listSessionSummaries(ctx, options = {}) {
   const listed = await listSessionsForProject(ctx, options);
@@ -7653,48 +8987,48 @@ async function listSessionEvents(ctx, sessionId, options = {}) {
   );
 }
 async function uploadFile(ctx, content, filename, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  const purpose = options.purpose ?? defaultFileUploadPurpose(adapter.name);
-  const info = await adapter.uploadFileContent(content, filename, {
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  const purpose = options.purpose ?? defaultFileUploadPurpose(adapter2.name);
+  const info = await adapter2.uploadFileContent(content, filename, {
     mimeType: options.mimeType,
     purpose
   });
-  return enrichProviderFileInfo(adapter.name, info);
+  return enrichProviderFileInfo(adapter2.name, info);
 }
 async function deleteFile(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteFile(id);
 }
 async function getFileInfo(ctx, id, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.getFileInfo) throw new UserError("Provider does not support file metadata lookup");
-  const info = await adapter.getFileInfo(id);
-  return enrichProviderFileInfo(adapter.name, info);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.getFileInfo) throw new UserError("Provider does not support file metadata lookup");
+  const info = await adapter2.getFileInfo(id);
+  return enrichProviderFileInfo(adapter2.name, info);
 }
 async function getFileDownloadUrl(ctx, id, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.getFileDownloadUrl) throw new UserError("Provider does not support file downloads");
-  return adapter.getFileDownloadUrl(id);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.getFileDownloadUrl) throw new UserError("Provider does not support file downloads");
+  return adapter2.getFileDownloadUrl(id);
 }
 async function listFiles(ctx, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.listFiles) return [];
-  const all = await adapter.listFiles();
-  return all.map((info) => enrichProviderFileInfo(adapter.name, info));
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.listFiles) return [];
+  const all = await adapter2.listFiles();
+  return all.map((info) => enrichProviderFileInfo(adapter2.name, info));
 }
 async function listSkills(ctx, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.listSkills) return [];
-  return adapter.listSkills(options.source);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.listSkills) return [];
+  return adapter2.listSkills(options.source);
 }
 async function getSkillInfo(ctx, id, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.getSkillInfo) throw new UserError("Provider does not support skill metadata lookup");
-  return adapter.getSkillInfo(id);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.getSkillInfo) throw new UserError("Provider does not support skill metadata lookup");
+  return adapter2.getSkillInfo(id);
 }
 async function createSkillFromFileId(ctx, fileId, options = {}) {
-  const adapter = resolveDirectAdapter(ctx, options.provider);
-  if (!adapter.createSkillFromFileId) throw new UserError("Provider does not support skill creation");
-  return adapter.createSkillFromFileId(fileId);
+  const adapter2 = resolveDirectAdapter(ctx, options.provider);
+  if (!adapter2.createSkillFromFileId) throw new UserError("Provider does not support skill creation");
+  return adapter2.createSkillFromFileId(fileId);
 }
 async function deleteSkill(ctx, id, options = {}) {
   await resolveDirectAdapter(ctx, options.provider).deleteSkill(id);
@@ -7722,19 +9056,40 @@ function buildAgentNameByRemoteId(ctx, provider) {
   }
   return names;
 }
-async function* streamWithResume(adapter, sessionId, message) {
-  const eventId = await adapter.sendSessionMessage(sessionId, message);
-  yield* adapter.streamSessionEvents(sessionId, eventId ? { after_id: eventId } : void 0);
+async function* streamWithResume(adapter2, sessionId, message) {
+  const eventId = await adapter2.sendSessionMessage(sessionId, message);
+  let lastEventId = eventId;
+  let reachedTerminal = false;
+  let reconnectIntervalMs = POLL_INITIAL_INTERVAL_MS;
+  const start = Date.now();
+  while (!reachedTerminal) {
+    assertNotTimedOut(start, DEFAULT_POLL_TIMEOUT_MS);
+    for await (const event of adapter2.streamSessionEvents(
+      sessionId,
+      lastEventId ? { after_id: lastEventId } : void 0
+    )) {
+      if (event.id) lastEventId = event.id;
+      yield event;
+      if (event.type === "status" && isTerminalSessionStatus(event.status)) {
+        reachedTerminal = true;
+        break;
+      }
+    }
+    if (!reachedTerminal) {
+      await delay(reconnectIntervalMs);
+      reconnectIntervalMs = Math.min(reconnectIntervalMs * 2, DEFAULT_POLL_INTERVAL_MS);
+    }
+  }
 }
-async function* streamConnectBeforeSend(adapter, sessionId, message) {
-  const iterator = adapter.streamSessionEvents(sessionId)[Symbol.asyncIterator]();
+async function* streamConnectBeforeSend(adapter2, sessionId, message) {
+  const iterator = adapter2.streamSessionEvents(sessionId)[Symbol.asyncIterator]();
   let sent = false;
   try {
     while (true) {
       const next = iterator.next();
       if (!sent) {
         sent = true;
-        await adapter.sendSessionMessage(sessionId, message);
+        await adapter2.sendSessionMessage(sessionId, message);
       }
       const item = await next;
       if (item.done) return;
@@ -7979,11 +9334,11 @@ var StateManager = class _StateManager {
   listResources() {
     return [...this.state.resources];
   }
-  findResource(query) {
+  findResource(query2) {
     return this.state.resources.find((resource) => {
-      const matchType = resource.address.type === query.type;
-      const matchName = resource.address.name === query.name;
-      const matchProvider = !query.provider || resource.address.provider === query.provider;
+      const matchType = resource.address.type === query2.type;
+      const matchName = resource.address.name === query2.name;
+      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
       return matchType && matchName && matchProvider;
     });
   }
@@ -8066,11 +9421,11 @@ var InMemoryStateManager = class _InMemoryStateManager {
   listResources() {
     return [...this.state.resources];
   }
-  findResource(query) {
+  findResource(query2) {
     return this.state.resources.find((resource) => {
-      const matchType = resource.address.type === query.type;
-      const matchName = resource.address.name === query.name;
-      const matchProvider = !query.provider || resource.address.provider === query.provider;
+      const matchType = resource.address.type === query2.type;
+      const matchName = resource.address.name === query2.name;
+      const matchProvider = !query2.provider || resource.address.provider === query2.provider;
       return matchType && matchName && matchProvider;
     });
   }
@@ -8117,7 +9472,9 @@ var ResourceTypeSchema = z6.enum([
   "agent",
   "template",
   "deployment",
-  "file"
+  "file",
+  "identity",
+  "channel"
 ]);
 var ResourceAddressSchema = z6.object({
   type: ResourceTypeSchema,
@@ -8408,13 +9765,17 @@ export {
   UserError,
   applyProviderConfigToEnv,
   archiveCloudAgent,
+  archiveMemoryStore,
   areRuntimeCredentialsReady,
+  batchCreateMemories,
   bootstrapRuntimeCredentials,
   bootstrapRuntimeCredentialsSync,
   buildAgentDecl,
   collectConfigReferences,
   createCloudEnvironment,
   createCloudVault,
+  createMemory,
+  createMemoryStore,
   createProjectRuntime,
   createSessionForAgent,
   createSkillFromFileId,
@@ -8422,6 +9783,8 @@ export {
   deleteCloudEnvironment,
   deleteCloudVault,
   deleteFile,
+  deleteMemory,
+  deleteMemoryStore,
   deleteSession,
   deleteSkill,
   destroyPlannedProjectResources,
@@ -8432,6 +9795,10 @@ export {
   getDeploymentRuntimeProviderForContext,
   getFileDownloadUrl,
   getFileInfo,
+  getMemory,
+  getMemoryProviderCapabilities,
+  getMemoryStore,
+  getMemoryVersion,
   getSession,
   getSkillInfo,
   importResource,
@@ -8442,8 +9809,12 @@ export {
   listCloudVaults,
   listDeploymentsForContext,
   listFiles,
+  listMemories,
+  listMemoryStores,
+  listMemoryVersions,
   listProviderModelsForContext,
   listProviderNames,
+  listRemoteDeploymentsForContext,
   listSessionEvents,
   listSessionSummaries,
   listSkills,
@@ -8452,16 +9823,20 @@ export {
   loadProviderConfigIntoEnvSync,
   migrateConfig,
   parseStateAddress,
+  pauseDeploymentForContext,
   planDestroyProjectContext,
   planProjectContext,
+  prepareInitialSessionPrompt,
   preparePromptForProvider,
   prependFileHint,
   providerConfigPath,
   readProjectRuntime,
+  redactMemoryVersion,
   resolveActiveProvider,
   resolveProjectConfig,
   resolveProjectConfigFromObject,
   resolveProviderConfigFromEnv,
+  resolveRepositoryMountPath,
   resolveSessionProvider,
   resolveSyncProvider,
   rewriteFileMentions,
@@ -8475,6 +9850,8 @@ export {
   syncProjectResourcesWithStateBackend,
   syncProviderResourcesFromContext,
   syncProviderResourcesFromEnv,
+  updateMemory,
+  updateMemoryStore,
   uploadFile,
   validateProjectConfig,
   writeProjectRuntime