@prismer/runtime 1.9.24 → 2.0.1

package/dist/index.d.cts

@@ -28,6 +28,11 @@ interface AdapterDef {
     workspaceSchema: z.ZodSchema;
     /** Long-running: ensure the underlying service is reachable. May spawn or just connect. */
     ensureService?(profile: AgentProfile): Promise<AdapterService>;
+    /**
+     * Optional preflight called when the daemon syncs a profile. This should
+     * prepare local profile files/config without starting a long-running service.
+     */
+    prepareProfile?(profile: AgentProfile): Promise<void>;
     /** Interactive: one-shot dispatch (spawn-per-task). */
     dispatch?(profile: AgentProfile, task: TaskInput): Promise<TaskResult>;
     /** Validate config before persisting `AgentProfile.config`. */
@@ -148,6 +153,11 @@ declare class AdapterRegistry {
      * Match rules (deterministic, sorted by name):
      * - exact: adapter declared the tag verbatim
      * - wildcard: adapter declared `code.*` → matches `code.write`
+     *
+     * @internal — v2.0: no caller in tree uses capability-based selection;
+     * dispatch routes by `profile.adapterName` directly. Kept for tests +
+     * future use (e.g. mobile capability negotiation), but not part of the
+     * stable adapter contract surface.
      */
     findByCapability(capability: string): AdapterDef[];
 }
@@ -210,6 +220,84 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     nativeMirrorTimeoutMs: z.ZodDefault<z.ZodNumber>;
     /** Task authority level: executor (default) or orchestrator. */
     taskAuthority: z.ZodDefault<z.ZodOptional<z.ZodEnum<["executor", "orchestrator"]>>>;
+    /** Human approval escalation policy. Enforcement is currently prompt/cloud-side. */
+    approvalPolicy: z.ZodDefault<z.ZodOptional<z.ZodEnum<["strict", "auto-low-risk", "autonomous"]>>>;
+    /** Agent-level MCP tool allowlist. Empty/null means all tools. Supports exact names and trailing * wildcards. */
+    mcpAllowlist: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString, "many">>>;
+    /** Agent-level operating principles injected through /v1/runs instructions. */
+    operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        text: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        source: z.ZodString;
+        text: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        source: z.ZodString;
+        text: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    /** Override the skills root read for dispatch-time SKILL.md injection. */
+    skillsDir: z.ZodOptional<z.ZodString>;
+    /**
+     * Role-template snapshot carried in AgentProfile.config by cloud ACP.
+     * Expected fields used here:
+     *   - roleTemplate.mcpServers[].toolsAllowlist
+     *   - roleTemplate.operatingPrinciples
+     */
+    roleTemplate: z.ZodOptional<z.ZodObject<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+        operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+        operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+        operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, "strip", z.ZodTypeAny, {
     port: number;
     apiKey: string;
@@ -224,10 +312,36 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     mirrorNativeGoals: boolean;
     nativeMirrorTimeoutMs: number;
     taskAuthority: "executor" | "orchestrator";
+    approvalPolicy: "strict" | "auto-low-risk" | "autonomous";
     hermesProfileName?: string | undefined;
     prismerMcpServerPath?: string | undefined;
     prismerProviderBaseUrl?: string | undefined;
     hermesSourceDir?: string | undefined;
+    mcpAllowlist?: string[] | null | undefined;
+    operatingPrinciples?: string | Record<string, string> | z.objectOutputType<{
+        source: z.ZodString;
+        text: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">[] | undefined;
+    skillsDir?: string | undefined;
+    roleTemplate?: z.objectOutputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+        operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
     apiKey: string;
     hermesProfileName?: string | undefined;
@@ -246,10 +360,114 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     hermesSourceDir?: string | undefined;
     nativeMirrorTimeoutMs?: number | undefined;
     taskAuthority?: "executor" | "orchestrator" | undefined;
+    approvalPolicy?: "strict" | "auto-low-risk" | "autonomous" | undefined;
+    mcpAllowlist?: string[] | null | undefined;
+    operatingPrinciples?: string | Record<string, string> | z.objectInputType<{
+        source: z.ZodString;
+        text: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">[] | undefined;
+    skillsDir?: string | undefined;
+    roleTemplate?: z.objectInputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+        operatingPrinciples: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            source: z.ZodString;
+            text: z.ZodString;
+        }, z.ZodTypeAny, "passthrough">>, "many">]>>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
 }>;
 type HermesProfileConfig = z.infer<typeof HermesProfileConfigSchema>;
 declare const hermesAdapter: AdapterDef;
 
+declare const OpenClawProfileConfigSchema: z.ZodObject<{
+    /** OpenClaw chat-completions HTTP port. */
+    port: z.ZodDefault<z.ZodNumber>;
+    /** Bearer token expected by the gateway (from gateway.auth.bearerTokens). */
+    apiKey: z.ZodString;
+    /**
+     * Model field passed to OpenClaw's /v1/chat/completions. OpenClaw
+     * intercepts this differently from a vanilla OpenAI server: the value
+     * MUST be `openclaw` (or `openclaw/<agentId>`) — it picks which
+     * OpenClaw agent answers, NOT the underlying LLM. The LLM is selected
+     * by `agents.defaults.model.primary` in openclaw.json (e.g.
+     * `prismer/us-kimi-k2.5`, set by the bootstrap).
+     */
+    model: z.ZodDefault<z.ZodString>;
+    mcpAllowlist: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString, "many">>>;
+    approvalPolicy: z.ZodDefault<z.ZodOptional<z.ZodEnum<["strict", "auto-low-risk", "autonomous"]>>>;
+    roleTemplate: z.ZodOptional<z.ZodObject<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    skillsDir: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    port: number;
+    apiKey: string;
+    model: string;
+    approvalPolicy: "strict" | "auto-low-risk" | "autonomous";
+    mcpAllowlist?: string[] | null | undefined;
+    skillsDir?: string | undefined;
+    roleTemplate?: z.objectOutputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+}, {
+    apiKey: string;
+    port?: number | undefined;
+    model?: string | undefined;
+    approvalPolicy?: "strict" | "auto-low-risk" | "autonomous" | undefined;
+    mcpAllowlist?: string[] | null | undefined;
+    skillsDir?: string | undefined;
+    roleTemplate?: z.objectInputType<{
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>, "many">>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+}>;
+type OpenClawProfileConfig = z.infer<typeof OpenClawProfileConfigSchema>;
+declare const openclawAdapter: AdapterDef;
+
 interface WsClientOptions {
     /** Cloud WS URL, e.g. `wss://cloud.prismer.dev/ws` or `ws://127.0.0.1:3000/ws`. */
     url: string;
@@ -552,6 +770,10 @@ declare class CloudClient {
     private readonly opts;
     private readonly fetchImpl;
     constructor(opts: CloudClientOptions);
+    /** Configured cloud base URL (no trailing slash). */
+    get baseUrl(): string;
+    /** Bearer API key used to authorize requests. Treat as a secret. */
+    get apiKey(): string;
     /** Low-level request. Caller decides on retry; sync-worker handles backoff. */
     request<T = unknown>(method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE', path: string, init?: {
         body?: unknown;
@@ -643,6 +865,38 @@ declare class AssetCache {
         signal?: AbortSignal;
         assetId?: string;
     }): Promise<CachedAsset>;
+    /**
+     * Fetch a public http(s) URL, content-hash dedup, cache locally.
+     *
+     * Mirrors `getOrFetch` (cache key = sha256 of body bytes), but the input
+     * is a URL whose hash we don't know up front. The fetcher applies:
+     *
+     *   - SSRF guard (resolve hostname, reject loopback / RFC1918 / link-local
+     *     / cloud-metadata / IPv6 ULA + link-local). Cross-host redirects
+     *     re-validate the new host before each hop.
+     *   - manual redirect handling (max 3 hops).
+     *   - hard timeout (default 15 s, override via env
+     *     `PRISMER_URL_FETCH_TIMEOUT_MS`).
+     *   - streaming body read with abort-at-limit (default 5 MiB, override
+     *     via env `PRISMER_URL_FETCH_MAX_BYTES`). Truncated bodies are NOT
+     *     cached.
+     *   - non-2xx → throws (caller should leave the URL in place and emit
+     *     an `error` observation).
+     *
+     * On success returns { cached, finalUrl, durationMs }; the caller can
+     * pin / unpin the hash like any other asset.
+     */
+    getOrFetchUrl(url: string, opts?: {
+        signal?: AbortSignal;
+        userAgent?: string;
+        maxBytes?: number;
+        timeoutMs?: number;
+        maxRedirects?: number;
+    }): Promise<{
+        cached: CachedAsset;
+        finalUrl: string;
+        durationMs: number;
+    }>;
     /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
     registerLocal(hash: string, localPath: string, mime?: string): CachedAsset;
     /** Total bytes across all rows (incl. pinned). */
@@ -800,68 +1054,6 @@ declare class ParseClaimController {
     }): HeartbeatHandle;
 }
 
-type PrismerUriType = 'asset' | 'file';
-interface ParsedPrismerUri {
-    /** Original full URI string. */
-    raw: string;
-    /**
-     * Owner segment for legacy `prismer://<owner>/...` form (informational,
-     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
-     * literal string 'workspace' — prefer `workspaceId` instead.
-     */
-    owner: string;
-    type: PrismerUriType;
-    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
-    rest: string;
-    /** Convenience parses for type='file' and for workspace-form 'asset'. */
-    workspaceId?: string;
-    filePath?: string;
-}
-/**
- * Find every recognized `prismer://...` reference in a string.
- * Only `asset` and `file` types are recognized — other types (memory,
- * context, conversation, evolution, task, pair) pass through untouched.
- */
-declare function parseUris(text: string): ParsedPrismerUri[];
-interface UriResolverOptions {
-    db: LocalDb;
-    cloud: CloudClient;
-    assetCache: AssetCache;
-}
-declare class UriResolver {
-    private readonly db;
-    private readonly cloud;
-    private readonly assetCache;
-    constructor(opts: UriResolverOptions);
-    /**
-     * Resolve a single URI to a local file path. Throws on auth/4xx;
-     * caller decides whether to leave the URI in place (best-effort) or fail.
-     */
-    resolveOne(uri: ParsedPrismerUri, opts?: {
-        signal?: AbortSignal;
-    }): Promise<string>;
-    /**
-     * Walk a string, replace every `prismer://(asset|file)/...` with `file://<localPath>`.
-     * Unrecognized URIs pass through. Returns rewritten text + the list of pinned hashes.
-     */
-    rewrite(text: string, opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        text: string;
-        resolvedHashes: string[];
-    }>;
-    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
-    rewriteAll(texts: string[], opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        texts: string[];
-        resolvedHashes: string[];
-    }>;
-    private lookupFile;
-}
-
 type IMAgentStatus = 'online' | 'busy' | 'idle' | 'offline';
 interface HostedAgentDeclaration {
     imUserId: string;
@@ -887,6 +1079,9 @@ interface HostAckedPayload {
         [key: string]: number;
     };
     profilesToSync: string[];
+    /** Profile IDs the daemon declared but that no longer exist on the cloud
+     *  (soft-deleted). The daemon should remove these from its local store. */
+    profilesToDelete: string[];
 }
 interface AgentStatusChangedPayload {
     agentImUserId: string;
@@ -960,15 +1155,22 @@ interface TaskDispatchProgressPayload {
     detail?: Record<string, unknown>;
 }
 /** Wave-8 W1: how the daemon handled a single AssetRef. */
-type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'error';
+type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'fetched-https' | 'error';
 interface AssetDispatchObservation {
-    assetId: string;
+    /** AssetRef.assetId for cloud-attached refs; undefined for L5 https fetches. */
+    assetId?: string;
     contentHash: string;
     mime: string | null;
     sizeBytes: number | null;
     strategy: AssetDispatchStrategy;
     inlinedBytes?: number;
     error?: string;
+    /** L5: original URL the user wrote in the prompt. */
+    originalUrl?: string;
+    /** L5: post-redirect URL the body was actually downloaded from. */
+    finalUrl?: string;
+    /** L5: end-to-end fetch duration in ms (DNS + connect + body read). */
+    durationMs?: number;
 }
 interface TaskDispatchReplyPayload {
     taskId: string;
@@ -1020,6 +1222,114 @@ interface WorkspaceFileChangedPayload {
     contentHash?: string;
     version: number;
 }
+interface AssetChangedPayload {
+    workspaceId: string;
+    assetId: string;
+    operation: 'create' | 'update' | 'delete';
+    contentHash?: string;
+    assetIndexSeq?: number;
+    revision?: number;
+}
+
+type PrismerUriType = 'asset' | 'file';
+interface ParsedPrismerUri {
+    /** Original full URI string. */
+    raw: string;
+    /**
+     * Owner segment for legacy `prismer://<owner>/...` form (informational,
+     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
+     * literal string 'workspace' — prefer `workspaceId` instead.
+     */
+    owner: string;
+    type: PrismerUriType;
+    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
+    rest: string;
+    /** Convenience parses for type='file' and for workspace-form 'asset'. */
+    workspaceId?: string;
+    filePath?: string;
+}
+/**
+ * Find every recognized `prismer://...` reference in a string.
+ * Only `asset` and `file` types are recognized — other types (memory,
+ * context, conversation, evolution, task, pair) pass through untouched.
+ */
+declare function parseUris(text: string): ParsedPrismerUri[];
+interface UriResolverOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    assetCache: AssetCache;
+}
+declare class UriResolver {
+    private readonly db;
+    private readonly cloud;
+    private readonly assetCache;
+    constructor(opts: UriResolverOptions);
+    /**
+     * Resolve a single URI to a local file path. Throws on auth/4xx;
+     * caller decides whether to leave the URI in place (best-effort) or fail.
+     */
+    resolveOne(uri: ParsedPrismerUri, opts?: {
+        signal?: AbortSignal;
+    }): Promise<string>;
+    /**
+     * Walk a string, replace every `prismer://(asset|file)/...` and
+     * `https://…` / `http://…` URL with `file://<localPath>`.
+     *
+     * Unrecognized URIs pass through unchanged. Returns rewritten text, the
+     * list of pinned hashes, and one observation per http(s) URL the resolver
+     * attempted (success + error both surface) so the dispatch can include
+     * them in `reply.assetObservability`.
+     *
+     * `urlCache` lets the caller dedupe URL fetches across multiple rewrite
+     * calls within a single dispatch (e.g. prompt + each context entry).
+     * Pass the same Map instance to every rewrite() / rewriteAll() call.
+     */
+    rewrite(text: string, opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        /** L5: opt out of http(s) URL fetching for this string (e.g. memory/goal text). */
+        fetchUrls?: boolean;
+        /** L5: shared per-dispatch dedup map (originalUrl → cached resolution). */
+        urlCache?: Map<string, UrlResolution>;
+        /** L5: append url observations here (caller-owned array). */
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        text: string;
+        resolvedHashes: string[];
+    }>;
+    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
+    rewriteAll(texts: string[], opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        fetchUrls?: boolean;
+        urlCache?: Map<string, UrlResolution>;
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        texts: string[];
+        resolvedHashes: string[];
+    }>;
+    private lookupFile;
+}
+/**
+ * L5: per-dispatch resolution record for a fetched http(s) URL. The same
+ * record is reused across every reference to the URL in this dispatch
+ * (prompt + N context entries) so we resolve once even if the URL appears
+ * many times.
+ */
+interface UrlResolution {
+    hash: string;
+    localPath: string;
+    sizeBytes: number;
+    mime: string | null;
+    finalUrl: string;
+    durationMs: number;
+}
+/**
+ * Extract http(s) URLs from a string. Each match has trailing punctuation
+ * stripped so callers can replace the exact match in the source text.
+ * Duplicates are de-duped: the first occurrence wins.
+ */
+declare function extractHttpUrls(text: string): string[];
 
 interface OutboxWatcherOptions {
     /**
@@ -1212,6 +1522,7 @@ declare class AssetMetadataIndex {
      */
     pullDelta(opts?: {
         signal?: AbortSignal;
+        force?: boolean;
     }): Promise<{
         applied: number;
         cursor: number;
@@ -1223,6 +1534,8 @@ declare class AssetMetadataIndex {
     search(query: string, limit?: number): AssetMetadataRow[];
     /** Exact match on filename column. Returns undefined if not indexed. */
     resolveByFilename(filename: string): AssetMetadataRow | undefined;
+    resolveByAssetId(assetId: string): AssetMetadataRow | undefined;
+    resolveByContentHash(contentHash: string): AssetMetadataRow | undefined;
     /** Batch exact match — returns Map for O(1) access. */
     resolveByFilenames(filenames: string[]): Map<string, AssetMetadataRow>;
 }
@@ -1268,6 +1581,101 @@ declare function handleDispatch(payload: TaskDispatchRequestPayload, requestId:
  */
 declare function composePrompt(currentPrompt: string, context: TaskDispatchContextEntry[], maxChars: number, assetBlocks?: string[]): string;
 
+type NormalizedContent = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'image';
+    url: string;
+    caption?: string;
+} | {
+    type: 'file';
+    url: string;
+    fileName: string;
+    mime: string;
+} | {
+    type: 'voice';
+    url: string;
+    durationMs: number;
+} | {
+    type: 'video';
+    url: string;
+    caption?: string;
+};
+interface AgentDispatchRequest {
+    channelAccountId: string;
+    externalUserId: string;
+    conversationId: string;
+    mentionedAgentImUserId: string;
+    messageText: string;
+    messageId: string;
+    attachments?: NormalizedContent[];
+    replyToken: string;
+    replyDeadlineMs: number;
+}
+interface AgentDispatchResponse {
+    ok: boolean;
+    /** ISO8601 timestamp. Required when ok=true. */
+    acceptedAt?: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+type AgentDispatchReplyStatus = 'ok' | 'agent_offline' | 'timeout' | 'agent_error';
+interface AgentDispatchReplyAttachment {
+    kind: 'file' | 'image';
+    assetId: string;
+}
+interface AgentDispatchReplyPayload {
+    replyToken: string;
+    conversationId: string;
+    replyToMessageId: string;
+    agentImUserId: string;
+    status: AgentDispatchReplyStatus;
+    /** Required when status='ok'. */
+    replyText?: string;
+    attachments?: AgentDispatchReplyAttachment[];
+    completedAt: string;
+    /** Required when status!='ok'. */
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+
+interface MessageDispatchAgent {
+    agentImUserId: string;
+    dispatch(input: MessageDispatchTaskInput): Promise<TaskResult>;
+}
+interface MessageDispatchTaskInput {
+    taskId: string;
+    prompt: string;
+    metadata: {
+        source: 'external-channel';
+        channelAccountId: string;
+        externalUserId: string;
+        conversationId: string;
+        messageId: string;
+        attachments?: AgentDispatchRequest['attachments'];
+    };
+    timeoutMs: number;
+    signal: AbortSignal;
+}
+interface MessageDispatchDeps {
+    findAgent(agentImUserId: string): Promise<MessageDispatchAgent | null> | MessageDispatchAgent | null;
+    postReply(payload: AgentDispatchReplyPayload): Promise<void> | void;
+    now?: () => Date;
+    setTimeout?: typeof setTimeout;
+    clearTimeout?: typeof clearTimeout;
+    onError?: (err: unknown, request: AgentDispatchRequest) => void;
+}
+interface MessageDispatchHandle {
+    response: AgentDispatchResponse;
+    done: Promise<AgentDispatchReplyPayload>;
+}
+declare function handleAgentMessageDispatch(request: AgentDispatchRequest, deps: MessageDispatchDeps): MessageDispatchHandle;
+
 declare class ServicePool {
     private readonly services;
     /**
@@ -1295,6 +1703,24 @@ interface LocalServerOptions {
      * sink; tests may pass a stub.
      */
     onDispatch?: (payload: DispatchPayload, runId: string) => void;
+    /**
+     * Optional dependencies for POST /dispatch (Release 200 §2.6 external
+     * message → agent dispatch). When provided, LocalServer invokes
+     * `handleAgentMessageDispatch()` internally and returns its synchronous
+     * AgentDispatchResponse before async reply posting completes.
+     */
+    messageDispatchDeps?: MessageDispatchDeps;
+    /**
+     * Shared HMAC secret for Cloud → daemon POST /dispatch. Production daemons
+     * must receive this via DISPATCH_DAEMON_SECRET or this option.
+     */
+    messageDispatchSecret?: string;
+    /**
+     * Optional direct handler for POST /dispatch. Prefer messageDispatchDeps
+     * for the standard daemon path; this hook exists for tests and alternate
+     * embedders that already wrap `handleAgentMessageDispatch()`.
+     */
+    messageDispatchHandler?: (payload: AgentDispatchRequest) => MessageDispatchHandle;
     /**
      * Install or update one hosted agent/profile in the daemon's local mirror.
      * The runner persists it, reloads hostedAgents, and redeclares to cloud.
@@ -1387,6 +1813,12 @@ interface InstallAgentResult {
 }
 interface LocalServerState {
     daemonId: string;
+    /**
+     * Daemon binary version (Release 200 §5.4). Reported in /healthz so cloud
+     * can validate image pin and graceful-degrade against pre-2.0.0 daemons.
+     * Sourced from the runtime package.json (see runner.ts).
+     */
+    daemonVersion: string;
     cloudBaseUrl?: string;
     workspaceId?: string | null;
     pid: number;
@@ -1400,12 +1832,46 @@ interface LocalServerState {
     runningTaskIds: string[];
     observability?: {
         adapters?: Record<string, unknown>;
+        assetSync?: Record<string, unknown>;
         lastTaskError?: {
             taskId: string;
             message: string;
             at: string;
         };
     };
+    /**
+     * Adapter-level readiness snapshot (Release 200 §5.4). One entry per
+     * registered adapter. Cloud uses this to compute Ready-AND with the
+     * cluster-level signals (pod Running, /healthz reachable).
+     */
+    adapters?: Array<{
+        name: string;
+        ready: boolean;
+        version?: string;
+    }>;
+    /**
+     * Resource snapshot (Release 200 §5.4 + 08 §175). v200 baseline returns
+     * placeholder zeros — true CPU/Mem sampling lives in S5 reconciler or a
+     * follow-up daemon iteration. Cloud should not depend on these values for
+     * health gating yet; they are informational.
+     * TODO(v210): wire real cgroup / process.resourceUsage() sampling.
+     */
+    resources?: {
+        cpu: {
+            usagePct: number;
+        };
+        mem: {
+            usedBytes: number;
+            limitBytes: number;
+        };
+    };
+    /**
+     * Final per-daemon Ready signal (Release 200 §5.4). True iff every
+     * registered adapter reports ready=true. Cloud uses this with
+     * `status==='ok'` to gate dispatch (graceful degrade: pre-2.0.0 daemons
+     * that omit this field are treated as ready when status==='ok').
+     */
+    readyForDispatch?: boolean;
 }
 declare class LocalServer {
     private opts;
@@ -1438,9 +1904,19 @@ declare class LocalServer {
      *
      * Body: { workspaceId, bytes (base64), filename, mime?, path?, description?, sourceAgentImUserId? }
      * Response 200: { assetId, contentHash, prismerUri }
-     * 400 on validation failure; 502 on cloud upstream failure; 501 if no sink wired.
+     * 400 on body validation failure; 422 on agent-output policy rejection;
+     * 502 on cloud upstream failure; 501 if no sink wired.
      */
     private handleAssetWrite;
+    /**
+     * POST /dispatch — external channel message → hosted agent dispatch.
+     *
+     * Cloud calls this with AgentDispatchRequest (Release 200 §2.6). The daemon
+     * returns AgentDispatchResponse immediately, while the handler's `done`
+     * promise completes later by posting AgentDispatchReplyPayload back to cloud.
+     */
+    private handleMessageDispatch;
+    private resolveMessageDispatchHandler;
     /**
      * POST /v1/runs — dispatch ack-only (Cloud 3 S3 Phase 1).
      *
@@ -1487,6 +1963,15 @@ declare class Runner extends EventEmitter {
     private outboxWatcher?;
     private memoryWiring?;
     private assetMetadataIndexes;
+    private workspaceMirrors;
+    private assetOriginOutbox?;
+    private dropFolderAdapter?;
+    private dropFolderUploadRunner?;
+    private dropFolderTimer?;
+    private dropFolderWorkspaceId;
+    private dropFolderWorkspaceDir;
+    private dropFolderTickInFlight;
+    private readonly dropFolderStable;
     private state;
     private startedAt;
     private workspaceId;
@@ -1507,12 +1992,52 @@ declare class Runner extends EventEmitter {
      */
     private runShellCommand;
     snapshotState(): LocalServerState;
+    /**
+     * Per-adapter readiness snapshot for /healthz (Release 200 §5.4).
+     *
+     * We synthesize this from the AdapterRegistry rather than asking each
+     * adapter to expose a per-call health probe — calling adapter.health()
+     * on every /healthz hit would spawn subprocess probes and slow the
+     * cloud-side handshake. Registered adapters are considered ready;
+     * future iteration can flip individual entries to ready=false based on
+     * cached ensureService / dispatch failures.
+     */
+    private snapshotAdapterReadiness;
+    /**
+     * Release 200 T11 — cgroup v2 resource sampling for /healthz.resources.
+     *
+     * Reads `memory.current` / `memory.max` (best-effort, single-shot) and
+     * derives `cpu.usagePct` by diffing `cpu.stat::usage_usec` against a
+     * baseline cached in module state. The very first call after process
+     * start always reports 0% CPU (no baseline yet); subsequent calls
+     * reflect wall-clock usage between probes.
+     *
+     * Graceful degrade: when `/sys/fs/cgroup/` is absent (mac dev host,
+     * Kubernetes-pre-cgroup-v2 distros), all fields are returned as zero
+     * — callers must treat sampler output as advisory, not authoritative.
+     */
+    private cpuBaseline;
+    private sampleCgroupResources;
+    /**
+     * Resolve daemon binary version from runtime package.json. Cached after
+     * first resolution; falls back to constructor override → '0.0.0'.
+     *
+     * The path probe walks `../package.json` first (which matches the layout
+     * produced by `tsup` — dist/runner.js sits one level inside the package)
+     * and then `../../package.json` (source-tree layout, where this file
+     * lives in src/daemon/runner.ts). Either path resolves to the same
+     * runtime package.json depending on whether the runner is executing
+     * from a build or directly under tsx in tests.
+     */
+    private cachedDaemonVersion;
+    private resolveDaemonVersion;
     /**
      * Re-read the local `agents` table (populated by `prismer agent register`)
      * and re-populate `hostedAgents` map. Profiles per agent come from local
      * `agent_profiles` table (filled by host.acked sync).
      */
     loadAgentsFromDb(): void;
+    private prepareLocalProfiles;
     /**
      * Register an in-process AgentProfile snapshot (called by agent CLI / sync layer).
      * Used to populate the `agents` list in agent.host.declare.
@@ -1535,6 +2060,8 @@ declare class Runner extends EventEmitter {
     private onHostAcked;
     private onTaskDispatch;
     private onTaskCancel;
+    private findMessageDispatchAgent;
+    private postMessageDispatchReply;
     private onAgentChanged;
     private onAgentProfileChanged;
     private syncProfileFromCloud;
@@ -1543,12 +2070,31 @@ declare class Runner extends EventEmitter {
     private onAssetChanged;
     private onWorkspaceFileChanged;
     private snapshotAdapterObservability;
+    private snapshotAssetSyncObservability;
     /**
      * Ensure an AssetMetadataIndex exists for the given workspace and pull
      * delta from cloud. Idempotent — creates the index on first call, reuses
      * it on subsequent calls. Same cursor-catch-up semantics as WorkspaceMirror.
      */
     private syncAssetMetadata;
+    /**
+     * Ensure a WorkspaceMirror exists for the workspace and pull path→asset
+     * bindings from cloud. Cold-start daemons previously only had this table
+     * populated by WS push or per-path URI fallback, so local asset state looked
+     * empty even though cloud files existed.
+     */
+    private syncWorkspaceFiles;
+    private syncAssetState;
+    /**
+     * Desktop asset ingress: watch a user-visible local asset folder
+     * and upload new files as IMAssets, preserving nested relative dirs in
+     * IMAsset.folderPath. The lower-level adapter/outbox/uploader already
+     * existed; this method wires them into the real daemon lifecycle.
+     */
+    private ensureDropFolderRuntime;
+    private stopDropFolderRuntime;
+    private runDropFolderTick;
+    private isDropFolderObservationStable;
     /**
      * SyncWorker FlushFn — pushes local writes to cloud.
      *
@@ -1646,29 +2192,29 @@ declare const CCConfigSchema: z.ZodObject<{
     cwd: string;
     maxTurns: number;
     route: "default" | "prismer" | "omniroute";
-    systemPrompt?: string | undefined;
-    allowedTools?: string[] | undefined;
-    envVars?: Record<string, string> | undefined;
     mcpServers?: {
         name: string;
         command: string;
         env?: Record<string, string> | undefined;
         args?: string[] | undefined;
     }[] | undefined;
+    systemPrompt?: string | undefined;
+    allowedTools?: string[] | undefined;
+    envVars?: Record<string, string> | undefined;
     baseURL?: string | undefined;
     apiKeyRef?: string | undefined;
 }, {
     cwd: string;
     model?: string | undefined;
-    systemPrompt?: string | undefined;
-    allowedTools?: string[] | undefined;
-    envVars?: Record<string, string> | undefined;
     mcpServers?: {
         name: string;
         command: string;
         env?: Record<string, string> | undefined;
         args?: string[] | undefined;
     }[] | undefined;
+    systemPrompt?: string | undefined;
+    allowedTools?: string[] | undefined;
+    envVars?: Record<string, string> | undefined;
     maxTurns?: number | undefined;
     baseURL?: string | undefined;
     apiKeyRef?: string | undefined;
@@ -1729,4 +2275,4 @@ declare const codexAdapter: AdapterDef;
 declare function buildProgram(): Command;
 declare function runCli(argv?: string[]): Promise<void>;
 
-export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, getRoleTemplate, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };
+export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentDispatchReplyAttachment, type AgentDispatchReplyPayload, type AgentDispatchReplyStatus, type AgentDispatchRequest, type AgentDispatchResponse, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetChangedPayload, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type MessageDispatchAgent, type MessageDispatchDeps, type MessageDispatchHandle, type MessageDispatchTaskInput, type NormalizedContent, type OpenClawProfileConfig, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type UrlResolution, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, extractHttpUrls, getRoleTemplate, handleAgentMessageDispatch, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, openclawAdapter, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };