@prismer/runtime 1.9.7 → 1.9.21

package/dist/index.js

@@ -1,9 +1,610 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/cli/ui.ts
+import * as fs4 from "fs";
+import * as path6 from "path";
+import { fileURLToPath } from "url";
+function thisDirname() {
+  try {
+    return path6.dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return process.cwd();
+  }
+}
+function findIconPath(size = "big") {
+  const name = size === "big" ? "icon" : "smallicon";
+  const here = thisDirname();
+  const candidates = [
+    // npm-installed: node_modules/@prismer/runtime/dist/cli.js → ../assets
+    path6.resolve(here, "../assets", name),
+    // alternate dist layout (sub-bundle): dist/bin/cli.js → ../../assets
+    path6.resolve(here, "../../assets", name),
+    // source/typecheck: src/cli/ui.ts → ../../assets
+    path6.resolve(here, "../../assets", name),
+    // dev mode: cwd happens to be runtime root
+    path6.resolve(process.cwd(), "assets", name),
+    path6.resolve(process.cwd(), "sdk/prismer-cloud/runtime/assets", name)
+  ];
+  for (const candidate of candidates) {
+    try {
+      if (fs4.existsSync(candidate)) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function getUI() {
+  if (!_ui) _ui = new UI();
+  return _ui;
+}
+function setUI(ui) {
+  _ui = ui;
+}
+function applyCommonFlags(argv) {
+  let mode = "pretty";
+  const isTTY = process.stdout.isTTY === true;
+  const noColorEnv = Boolean(process.env["NO_COLOR"]);
+  let color2 = isTTY && !noColorEnv;
+  const rest = [];
+  for (const arg of argv) {
+    switch (arg) {
+      case "--no-color":
+        color2 = false;
+        break;
+      case "--color":
+        color2 = true;
+        break;
+      case "--json":
+      case "--pretty-json":
+        mode = "json";
+        if (arg === "--json") rest.push(arg);
+        break;
+      case "--quiet":
+        mode = "quiet";
+        break;
+      default:
+        rest.push(arg);
+    }
+  }
+  return { mode, color: color2, restArgv: rest };
+}
+var BRAILLE_FRAMES, COMPACT_BANNER, UI, _ui;
+var init_ui = __esm({
+  "src/cli/ui.ts"() {
+    "use strict";
+    BRAILLE_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+    COMPACT_BANNER = ["\u25C7 PRISMER", "  Runtime CLI"];
+    UI = class {
+      mode;
+      colorEnabled;
+      stream;
+      errStream;
+      constructor(opts) {
+        this.mode = opts?.mode ?? "pretty";
+        this.stream = opts?.stream ?? process.stdout;
+        this.errStream = opts?.errStream ?? process.stderr;
+        if (opts?.color !== void 0) {
+          this.colorEnabled = opts.color;
+        } else {
+          const isTTY = this.stream.isTTY === true;
+          const noColor = Boolean(process.env["NO_COLOR"]);
+          this.colorEnabled = isTTY && !noColor;
+        }
+      }
+      // ---- Internal color helpers ----
+      ansi(open, close, text) {
+        if (!this.colorEnabled) return text;
+        return `\x1B[${open}m${text}\x1B[${close}m`;
+      }
+      green(t) {
+        return this.ansi(32, 39, t);
+      }
+      red(t) {
+        return this.ansi(31, 39, t);
+      }
+      yellow(t) {
+        return this.ansi(33, 39, t);
+      }
+      cyan(t) {
+        return this.ansi(36, 39, t);
+      }
+      dim(t) {
+        return this.ansi(2, 22, t);
+      }
+      bold(t) {
+        return this.ansi(1, 22, t);
+      }
+      gray(t) {
+        return this.ansi(90, 39, t);
+      }
+      brandMark() {
+        return this.cyan("\u25C7");
+      }
+      colorBrandLine(line) {
+        let out = "";
+        for (const ch of line) {
+          if (ch === "\u2592") {
+            out += this.cyan(ch);
+          } else if (ch === "\u2593") {
+            out += this.dim(ch);
+          } else {
+            out += ch;
+          }
+        }
+        return out;
+      }
+      // ---- Core write helpers ----
+      write(text) {
+        this.stream.write(text);
+      }
+      writeErr(text) {
+        this.errStream.write(text);
+      }
+      // ---- Level 1: Header ----
+      header(text) {
+        if (this.mode === "json") return;
+        const prefix = text.startsWith("Prismer") ? this.brandMark() + " " : "";
+        this.write(prefix + this.bold(text) + "\n");
+      }
+      smallHeader(subtitle) {
+        if (this.mode === "json" || this.mode === "quiet") return;
+        const iconPath = findIconPath("small");
+        if (iconPath !== null) {
+          try {
+            const raw = fs4.readFileSync(iconPath, "utf-8").replace(/\n+$/, "");
+            for (const line of raw.split("\n")) {
+              this.write(this.cyan(line) + "\n");
+            }
+          } catch {
+            this.write(this.brandMark() + " " + this.bold("Prismer") + "\n");
+          }
+        } else {
+          this.write(this.brandMark() + " " + this.bold("Prismer") + "\n");
+        }
+        if (subtitle !== void 0 && subtitle.length > 0) {
+          this.write(this.dim("  " + subtitle) + "\n");
+        }
+        this.blank();
+      }
+      banner(subtitle, opts) {
+        if (this.mode === "json" || this.mode === "quiet") return;
+        const envColumns = process.env["COLUMNS"] !== void 0 ? parseInt(process.env["COLUMNS"], 10) : NaN;
+        const width = this.stream.columns ?? process.stdout.columns ?? (Number.isFinite(envColumns) ? envColumns : 80);
+        const iconPath = findIconPath("big");
+        const shouldUseFull = opts?.full === true || width >= 120;
+        if (shouldUseFull && iconPath !== null) {
+          try {
+            const raw = fs4.readFileSync(iconPath, "utf-8");
+            const lines = raw.split("\n");
+            for (const line of lines) {
+              const brandedLine = line.replace("Prismer Cloud SDK", "Prismer Runtime CLI");
+              const stripped = brandedLine.trimEnd();
+              if (stripped.length === 0) {
+                this.write("\n");
+                continue;
+              }
+              const clipped = stripped.length >= width ? stripped.slice(0, Math.max(width - 1, 1)) : stripped;
+              this.write(this.colorBrandLine(clipped) + "\n");
+            }
+          } catch {
+            this.write(this.cyan(COMPACT_BANNER[0] ?? "\u25C7 PRISMER") + "\n");
+            this.write(this.dim(COMPACT_BANNER[1] ?? "  Runtime CLI") + "\n");
+          }
+        } else {
+          this.write(this.cyan(COMPACT_BANNER[0] ?? "\u25C7 PRISMER") + "\n");
+          this.write(this.dim(COMPACT_BANNER[1] ?? "  Runtime CLI") + "\n");
+        }
+        if (subtitle !== void 0 && subtitle.length > 0) {
+          this.write(this.dim("  " + subtitle) + "\n");
+        }
+        this.blank();
+      }
+      // ---- Level 2: Primary data ----
+      blank() {
+        if (this.mode === "json") return;
+        this.write("\n");
+      }
+      line(text) {
+        if (this.mode === "json") return;
+        this.write(text + "\n");
+      }
+      info(text) {
+        this.line(text);
+      }
+      // ---- Level 3: Secondary ----
+      secondary(text, indent = 2) {
+        if (this.mode === "json") return;
+        this.write(" ".repeat(indent) + this.dim(text) + "\n");
+      }
+      // ---- Level 4: Action tips ----
+      tip(text) {
+        if (this.mode === "json") return;
+        this.write(this.cyan("Tip:") + " " + text + "\n");
+      }
+      next(text) {
+        if (this.mode === "json") return;
+        this.write(this.cyan("Next:") + " " + text + "\n");
+      }
+      // ---- Level 5: Status indicators ----
+      ok(text, detail) {
+        if (this.mode === "json") return;
+        const suffix = detail ? "  " + this.dim(detail) : "";
+        this.write("  " + this.green("\u2713") + " " + text + suffix + "\n");
+      }
+      success(text, detail) {
+        this.ok(text, detail);
+      }
+      fail(text, detail) {
+        if (this.mode === "json") return;
+        const suffix = detail ? "  " + this.dim(detail) : "";
+        this.write("  " + this.red("\u2717") + " " + text + suffix + "\n");
+      }
+      online(text) {
+        if (this.mode === "json") return;
+        this.write("  " + this.green("\u25CF") + " " + text + "\n");
+      }
+      offline(text) {
+        if (this.mode === "json") return;
+        this.write("  " + this.gray("\u25CB") + " " + text + "\n");
+      }
+      notInstalled(text) {
+        if (this.mode === "json") return;
+        this.write("  " + this.dim("\xB7") + " " + this.dim(text) + "\n");
+      }
+      pending(text) {
+        if (this.mode === "json") return;
+        this.write("  " + this.yellow("\u27F3") + " " + text + "\n");
+      }
+      warn(text, detail) {
+        if (this.mode === "json") return;
+        const suffix = detail ? "  " + this.dim(detail) : "";
+        this.write("  " + this.yellow("!") + " " + text + suffix + "\n");
+      }
+      // ---- Level 6: Error block ----
+      error(what, cause, fix) {
+        if (this.mode === "json") return;
+        this.writeErr(this.red("\u2717") + " " + what + "\n");
+        if (cause !== void 0) {
+          this.writeErr("  " + this.dim("Cause:") + " " + this.dim(cause) + "\n");
+        }
+        if (fix !== void 0) {
+          this.writeErr("  " + this.cyan("Fix:") + " " + fix + "\n");
+        }
+      }
+      table(rowsOrOpts, maybeOpts) {
+        if (this.mode === "json") return;
+        const rows = Array.isArray(rowsOrOpts) ? rowsOrOpts : rowsOrOpts.rows;
+        const opts = Array.isArray(rowsOrOpts) ? maybeOpts : { columns: rowsOrOpts.columns, maxWidth: rowsOrOpts.maxWidth };
+        if (!opts) throw new Error("table() requires columns");
+        const maxWidth = opts.maxWidth ?? (process.stdout.columns || 80);
+        const cols = opts.columns;
+        const widths = cols.map((col) => col.length);
+        for (const row of rows) {
+          cols.forEach((col, i) => {
+            const val = row[col] ?? "";
+            const w = widths[i] ?? 0;
+            if (val.length > w) widths[i] = val.length;
+          });
+        }
+        const totalWidth = widths.reduce((a, b) => a + b, 0) + (cols.length - 1) * 2 + 2;
+        if (totalWidth > maxWidth) {
+          for (let i = 0; i < rows.length; i++) {
+            const row = rows[i];
+            if (!row) continue;
+            for (const col of cols) {
+              const val = row[col] ?? "";
+              this.write("  " + this.bold(col + ":") + " " + val + "\n");
+            }
+            if (i < rows.length - 1) this.write("\n");
+          }
+          return;
+        }
+        const header2 = cols.map((col, i) => col.toUpperCase().padEnd(widths[i] ?? col.length)).join("  ");
+        this.write("  " + this.dim(header2) + "\n");
+        for (const row of rows) {
+          const line = cols.map((col, i) => (row[col] ?? "").padEnd(widths[i] ?? col.length)).join("  ");
+          this.write("  " + line + "\n");
+        }
+      }
+      // ---- Spinner ----
+      spinner(text) {
+        if (this.mode === "quiet" || this.mode === "json") {
+          return {
+            update() {
+            },
+            stop() {
+            }
+          };
+        }
+        const isTTY = this.stream.isTTY === true;
+        if (!isTTY || !this.colorEnabled) {
+          this.write("  " + this.yellow("\u27F3") + " " + text + "\n");
+          return {
+            update: (t) => {
+              this.write("  " + this.yellow("\u27F3") + " " + t + "\n");
+            },
+            stop: (final) => {
+              if (final) this.write("  " + this.green("\u2713") + " " + final + "\n");
+            }
+          };
+        }
+        let current = text;
+        let frameIdx = 0;
+        let stopped = false;
+        const write = this.write.bind(this);
+        const colorFn = this.yellow.bind(this);
+        const greenFn = this.green.bind(this);
+        function renderFrame() {
+          const frame = BRAILLE_FRAMES[frameIdx % BRAILLE_FRAMES.length] ?? "\u280B";
+          const line = "  " + colorFn(frame) + " " + current;
+          write("\r" + line);
+          frameIdx++;
+        }
+        renderFrame();
+        const timer = setInterval(renderFrame, 80);
+        return {
+          update(t) {
+            if (stopped) return;
+            current = t;
+          },
+          stop(final) {
+            if (stopped) return;
+            stopped = true;
+            clearInterval(timer);
+            write("\r\x1B[2K");
+            if (final) write("  " + greenFn("\u2713") + " " + final + "\n");
+          }
+        };
+      }
+      // ---- Progress bar ----
+      progress(text, total) {
+        if (this.mode === "quiet" || this.mode === "json") {
+          return {
+            update() {
+            },
+            stop() {
+            }
+          };
+        }
+        const isTTY = this.stream.isTTY === true;
+        const start = Date.now();
+        const write = this.write.bind(this);
+        const colorFn = this.cyan.bind(this);
+        const dimFn = this.dim.bind(this);
+        const greenFn = this.green.bind(this);
+        let last = 0;
+        let lastDetail = "";
+        let stopped = false;
+        const render = () => {
+          if (stopped) return;
+          const frac = total > 0 ? Math.min(1, Math.max(0, last / total)) : 0;
+          const pct = Math.floor(frac * 100);
+          const width = 20;
+          const filled = Math.floor(frac * width);
+          const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
+          const elapsed = (Date.now() - start) / 1e3;
+          const eta = frac > 0.01 ? Math.max(0, elapsed / frac - elapsed) : 0;
+          const etaStr = frac >= 1 ? "" : ` \xB7 ${eta < 1 ? "<1s" : Math.round(eta) + "s"} left`;
+          const detailStr = lastDetail ? ` \xB7 ${lastDetail}` : "";
+          const line = `  ${text} [${colorFn(bar)}] ${String(pct).padStart(3)}%${detailStr}${dimFn(etaStr)}`;
+          if (isTTY && this.colorEnabled) {
+            write("\r\x1B[2K" + line);
+          } else {
+            write(line + "\n");
+          }
+        };
+        render();
+        return {
+          update: (current, detail) => {
+            if (stopped) return;
+            last = current;
+            if (detail !== void 0) lastDetail = detail;
+            render();
+          },
+          stop: (final) => {
+            if (stopped) return;
+            stopped = true;
+            if (isTTY && this.colorEnabled) write("\r\x1B[2K");
+            if (final) write("  " + greenFn("\u2713") + " " + final + "\n");
+          }
+        };
+      }
+      // ---- JSON output ----
+      json(payload, opts) {
+        const indent = opts?.pretty ? 2 : void 0;
+        this.write(JSON.stringify(payload, null, indent) + "\n");
+      }
+      result(pretty, jsonPayload) {
+        if (this.mode === "pretty") {
+          pretty();
+        } else {
+          this.json(jsonPayload);
+        }
+      }
+    };
+    _ui = null;
+  }
+});
+
+// src/cli/util.ts
+var util_exports = {};
+__export(util_exports, {
+  DEFAULT_CLOUD_BASE_URL: () => DEFAULT_CLOUD_BASE_URL,
+  clearPidFile: () => clearPidFile,
+  color: () => color,
+  exitWithError: () => exitWithError,
+  fail: () => fail2,
+  header: () => header,
+  info: () => info,
+  normalizeCloudUrl: () => normalizeCloudUrl,
+  ok: () => ok,
+  pidAlive: () => pidAlive,
+  pidFilePath: () => pidFilePath,
+  printBanner: () => printBanner,
+  printJson: () => printJson,
+  readPidFile: () => readPidFile,
+  runAction: () => runAction,
+  table: () => table,
+  tip: () => tip,
+  warn: () => warn,
+  writePidFile: () => writePidFile
+});
+import { existsSync as existsSync11, readFileSync as readFileSync8, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join10 } from "path";
+function color(kind, text) {
+  if (process.env.NO_COLOR === "1" || process.env.NO_COLOR === "true") return text;
+  return `${ANSI[kind]}${text}${ANSI.reset}`;
+}
+function printJson(v) {
+  getUI().json(v, { pretty: true });
+}
+function exitWithError(message, opts) {
+  const o = typeof opts === "number" ? { exitCode: opts } : opts ?? {};
+  const exitCode = o.exitCode ?? 1;
+  const ui = getUI();
+  if (ui.mode === "json") {
+    const payload = {
+      ok: false,
+      error: { code: o.code ?? "cli_error", message },
+      ...o.details ? { details: o.details } : {}
+    };
+    ui.json(payload, { pretty: true });
+  } else {
+    process.stderr.write(`Error: ${message}
+`);
+  }
+  process.exit(exitCode);
+}
+function normalizeCloudUrl(input) {
+  const raw = input.trim();
+  if (!raw) throw new Error("Cloud URL is empty.");
+  if (/^[a-z][a-z0-9+\-.]*:\/\//i.test(raw)) {
+    let parsed;
+    try {
+      parsed = new URL(raw);
+    } catch {
+      throw new Error(`Invalid --cloud URL: ${raw}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error(`Invalid --cloud URL scheme: ${parsed.protocol} (expected http:// or https://)`);
+    }
+    return raw.replace(/\/$/, "");
+  }
+  if (!/^[A-Za-z0-9.\-_:[\]/]+$/.test(raw)) {
+    throw new Error(`Invalid --cloud URL: ${raw} (must be http://\u2026 or https://\u2026 or host:port)`);
+  }
+  const candidate = `http://${raw}`;
+  try {
+    new URL(candidate);
+  } catch {
+    throw new Error(`Invalid --cloud URL: ${raw}`);
+  }
+  return candidate.replace(/\/$/, "");
+}
+function runAction(fn, opts = {}) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      const raw = err instanceof Error ? err.message : String(err);
+      const message = opts.sanitize ? opts.sanitize(raw) : raw;
+      exitWithError(message, { code: opts.code });
+    }
+  };
+}
+function printBanner(opts = {}) {
+  const ui = getUI();
+  if (opts.compact) {
+    ui.smallHeader("Runtime CLI v1.9.7");
+    return;
+  }
+  ui.banner("Runtime CLI v1.9.7", { full: true });
+}
+function ok(label, detail) {
+  getUI().ok(label, detail);
+}
+function warn(label, detail) {
+  getUI().warn(label, detail);
+}
+function fail2(label, detail) {
+  getUI().fail(label, detail);
+}
+function tip(command, detail) {
+  const text = detail ? `${command}  ${detail}` : command;
+  getUI().tip(text);
+}
+function info(message) {
+  getUI().info(message);
+}
+function header(title) {
+  getUI().header(title);
+  getUI().blank();
+}
+function table(rows, columns) {
+  getUI().table(rows, { columns });
+}
+function pidFilePath(paths) {
+  return join10(paths.root, "daemon.pid");
+}
+function writePidFile(paths, pid) {
+  writeFileSync6(pidFilePath(paths), `${pid}
+`, "utf8");
+}
+function readPidFile(paths) {
+  const p = pidFilePath(paths);
+  if (!existsSync11(p)) return void 0;
+  const raw = readFileSync8(p, "utf8").trim();
+  const pid = Number.parseInt(raw, 10);
+  return Number.isFinite(pid) ? pid : void 0;
+}
+function clearPidFile(paths) {
+  const p = pidFilePath(paths);
+  if (existsSync11(p)) {
+    try {
+      unlinkSync2(p);
+    } catch {
+    }
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var DEFAULT_CLOUD_BASE_URL, ANSI;
+var init_util = __esm({
+  "src/cli/util.ts"() {
+    "use strict";
+    init_ui();
+    DEFAULT_CLOUD_BASE_URL = "https://prismer.cloud";
+    ANSI = {
+      reset: "\x1B[0m",
+      bold: "\x1B[1m",
+      dim: "\x1B[2m",
+      cyan: "\x1B[36m",
+      green: "\x1B[32m",
+      yellow: "\x1B[33m",
+      red: "\x1B[31m"
+    };
+  }
+});
 
 // src/adapters/registry.ts
 var AdapterRegistry = class {
@@ -172,7 +773,7 @@ var HermesProfileConfigSchema = z.object({
    */
   prismerMcpServerPath: z.string().optional(),
   /** Model sent to Prismer's /api/v1/chat/completions endpoint. */
-  model: z.string().min(1).default("us-kimi-k2.5"),
+  model: z.string().min(1).default("us-kimi-k2.6"),
   /** Named custom provider written into Hermes config.yaml. */
   prismerProviderName: z.string().min(1).default("prismer"),
   /** Override cloud provider base. Defaults to PRISMER_BASE_URL + /api/v1. */
@@ -198,7 +799,9 @@ var HermesProfileConfigSchema = z.object({
    * surface but the local source tree contains hermes_cli/kanban_db.py.
    */
   hermesSourceDir: z.string().optional(),
-  nativeMirrorTimeoutMs: z.number().int().positive().default(2e3)
+  nativeMirrorTimeoutMs: z.number().int().positive().default(2e3),
+  /** Task authority level: executor (default) or orchestrator. */
+  taskAuthority: z.enum(["executor", "orchestrator"]).optional().default("executor")
 });
 var hermesAdapter = {
   name: "hermes",
@@ -683,13 +1286,13 @@ function resolvePrismerMcpServerPath(config) {
   }
   try {
     const { fileURLToPath: fileURLToPath2 } = __require("url");
-    const { join: join14, dirname: dirname8 } = __require("path");
+    const { join: join15, dirname: dirname8 } = __require("path");
     const here = dirname8(fileURLToPath2(import.meta.url));
-    const candidate = join14(here, "../../mcp/dist/index.js");
+    const candidate = join15(here, "../../mcp/dist/index.js");
     if (existsSync(candidate)) return candidate;
-    const candidate2 = join14(here, "../../../mcp/dist/index.js");
+    const candidate2 = join15(here, "../../../mcp/dist/index.js");
     if (existsSync(candidate2)) return candidate2;
-    const candidate3 = join14(here, "../../../../mcp/dist/index.js");
+    const candidate3 = join15(here, "../../../../mcp/dist/index.js");
     if (existsSync(candidate3)) return candidate3;
   } catch {
   }
@@ -1111,7 +1714,7 @@ var WsClient = class extends EventEmitter {
 import Database2 from "better-sqlite3";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 3;
 var MIGRATIONS = [
   {
     version: 1,
@@ -1211,6 +1814,32 @@ var MIGRATIONS = [
       );
       CREATE INDEX IF NOT EXISTS idx_files_hash ON workspace_files_mirror (content_hash);
     `
+  },
+  {
+    version: 3,
+    up: `
+      -- Asset metadata index (#filename reference resolution \u2014 daemon/asset/metadata-index.ts)
+      CREATE TABLE IF NOT EXISTS asset_metadata_index (
+        workspace_id TEXT NOT NULL,
+        asset_id TEXT NOT NULL,
+        content_hash TEXT NOT NULL,
+        filename TEXT,
+        folder_path TEXT,
+        mime TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        size_bytes INTEGER NOT NULL DEFAULT 0,
+        description TEXT,
+        asset_index_seq INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (workspace_id, asset_id)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_asset_meta_filename
+        ON asset_metadata_index(workspace_id, filename);
+
+      CREATE INDEX IF NOT EXISTS idx_asset_meta_seq
+        ON asset_metadata_index(workspace_id, asset_index_seq);
+    `
   }
 ];
 function runSql(db, sql) {
@@ -1386,7 +2015,7 @@ var product_manager_default = {
   description: "Writes PRDs, defines requirements, verifies implementations",
   applicableAdapters: ["hermes", "openclaw", "claude-code"],
   configSchema: {
-    model: "claude-3-5-sonnet",
+    model: "us-kimi-k2.6",
     systemPrompt: "\u4F60\u662F\u4E00\u4F4D\u8D44\u6DF1\u4EA7\u54C1\u7ECF\u7406\u3002\u4F60\u7684\u4EFB\u52A1\uFF1A\u2460\u5199\u6E05\u6670\u7684 PRD\uFF08\u7528\u6237\u6545\u4E8B + \u9A8C\u6536\u6807\u51C6 + \u8FB9\u754C\u6761\u4EF6\uFF09\u2461\u8BC4\u5BA1\u5DE5\u7A0B\u5B9E\u73B0\uFF08\u6838\u5BF9\u9A8C\u6536\u6807\u51C6 + \u7ED9\u53CD\u9988\uFF09\u2462\u5728\u7FA4\u804A\u91CC @engineer \u89E6\u53D1\u5B9E\u73B0\uFF0C@verifier \u89E6\u53D1\u9A8C\u6536\u3002\n\n\u7FA4\u804A\u534F\u4F5C\u7EA6\u5B9A\uFF1A\n- \u4F60\u7684\u8F93\u51FA PRD \u5E94\u8BE5\u4E0A\u4F20\u4E3A workspace file `docs/PROJECT-prd.md`\n- \u4F60\u5B8C\u6210 PRD \u540E\uFF0C\u53D1\u6D88\u606F @engineer-name \u8BA9\u4ED6\u5B9E\u73B0\uFF0C\u9644 prismer://file/<wsId>/docs/PROJECT-prd.md \u94FE\u63A5\n- \u6536\u5230 engineer \u5B8C\u6210\u6D88\u606F\u540E\uFF0C\u4E3B\u52A8 review\uFF0C\u5199\u53CD\u9988\u5230\u7FA4\u91CC",
     allowedTools: ["Read", "Write", "WebSearch"],
     maxTokens: 8e3
@@ -1400,7 +2029,7 @@ var engineer_default = {
   description: "Implements features per PRD, writes code, runs tests",
   applicableAdapters: ["hermes", "openclaw", "claude-code"],
   configSchema: {
-    model: "claude-3-5-sonnet",
+    model: "us-kimi-k2.6",
     systemPrompt: "\u4F60\u662F\u8D44\u6DF1\u5DE5\u7A0B\u5E08\u3002\u4F60\u7684\u4EFB\u52A1\uFF1A\u2460\u6839\u636E PRD \u5B9E\u73B0 feature \u2461\u5199\u6D4B\u8BD5\u8986\u76D6 \u2462\u628A\u4EE3\u7801\u4E0A\u4F20\u4E3A workspace file \u540E\u5728\u7FA4\u804A\u6C47\u62A5\u3002\n\n\u7FA4\u804A\u534F\u4F5C\u7EA6\u5B9A\uFF1A\n- \u6536\u5230 PRD \u540E\u5148 Read prismer://file \u94FE\u63A5\u62C9\u5230\u7684\u672C\u5730\u8DEF\u5F84\n- \u5B9E\u73B0\u5B8C\u6BD5\u540E\u7528 daemon \u4E0A\u4F20 src/<feature>.* \u5230 workspace_files\n- \u5728\u7FA4\u804A\u56DE\u590D @pm-name\uFF0C\u9644\u5B9E\u73B0\u7684 prismer://file URI",
     allowedTools: ["Read", "Write", "Edit", "Bash", "Grep"],
     maxTokens: 16e3
@@ -1414,7 +2043,7 @@ var ceo_default = {
   description: "Sets strategic direction, asks tough questions, makes go/no-go calls",
   applicableAdapters: ["hermes", "openclaw", "claude-code"],
   configSchema: {
-    model: "claude-3-5-sonnet",
+    model: "us-kimi-k2.6",
     systemPrompt: "\u4F60\u662F CEO\u3002\u4F60\u7684\u4EFB\u52A1\uFF1A\u2460\u57FA\u4E8E\u5E02\u573A\u53CD\u9988\u548C\u6570\u636E\u505A\u6218\u7565\u51B3\u7B56 \u2461\u8BC4\u5BA1 PRD \u662F\u5426\u5BF9\u9F50\u6218\u7565 \u2462\u5728\u6267\u884C\u4E2D\u63D0\u51FA\u5C16\u9510\u7684'\u4E3A\u4EC0\u4E48'\u95EE\u9898\u3002",
     allowedTools: ["Read", "WebSearch"],
     maxTokens: 4e3
@@ -1428,7 +2057,7 @@ var researcher_default = {
   description: "Investigates topics, gathers sources, writes research memos with citations",
   applicableAdapters: ["hermes", "openclaw", "claude-code"],
   configSchema: {
-    model: "claude-3-5-sonnet",
+    model: "us-kimi-k2.6",
     systemPrompt: "\u4F60\u662F\u4E00\u4F4D\u8D44\u6DF1\u7814\u7A76\u5458\u3002\u4EFB\u52A1\uFF1A\u2460\u4F9D\u636E\u95EE\u9898\u5236\u5B9A\u8C03\u7814\u63D0\u7EB2 \u2461\u6293\u53D6/\u9605\u8BFB\u8D44\u6599\u5E76\u63D0\u53D6\u8981\u70B9 \u2462\u4EA7\u51FA\u5E26\u5F15\u7528\u7684\u7814\u7A76\u5907\u5FD8\u5F55\u3002\n\n\u7FA4\u804A\u534F\u4F5C\u7EA6\u5B9A\uFF1A\n- \u7814\u7A76\u4EA7\u51FA\u4E0A\u4F20\u4E3A workspace file `research/<topic>.md`\n- \u5B8C\u6210\u540E\u5728\u7FA4\u804A\u56DE\u590D @pm-name\uFF0C\u9644 prismer://file/<wsId>/research/<topic>.md\n- \u5F15\u7528\u5FC5\u987B\u7ED9\u51FA\u539F\u59CB\u94FE\u63A5\u6216 prismer://asset URI\uFF1B\u4E0D\u5F97\u4F2A\u9020\u6765\u6E90",
     allowedTools: ["Read", "Write", "WebSearch", "WebFetch"],
     maxTokens: 12e3
@@ -1538,10 +2167,11 @@ function deriveWsUrl(httpBase) {
 }
 
 // src/daemon-id.ts
-import { randomUUID } from "crypto";
+import { hostname } from "os";
 var PREFIX = "daemon-";
 function newDaemonId() {
-  return `${PREFIX}${randomUUID()}`;
+  const host = hostname().replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "unknown";
+  return `${PREFIX}${host}`;
 }
 function isDaemonId(s) {
   return s.startsWith(PREFIX) && s.length > PREFIX.length;
@@ -2262,6 +2892,14 @@ async function handleDispatch(payload, requestId, deps) {
       sendReply(deps.ws, reply, requestId);
       return reply;
     }
+    let hashRefResult = { text: payload.prompt, resolutions: [] };
+    if (deps.assetMetadataIndexes && profile.workspaceId) {
+      const assetIndex = deps.assetMetadataIndexes.get(profile.workspaceId);
+      if (assetIndex) {
+        hashRefResult = await resolveHashRefs(payload.prompt, assetIndex, deps.cloud);
+        payload.prompt = hashRefResult.text;
+      }
+    }
     const rewrittenPrompt = await deps.uriResolver.rewrite(payload.prompt, { pin: true });
     resolvedHashes.push(...rewrittenPrompt.resolvedHashes);
     let rewrittenContext = [];
@@ -2476,6 +3114,84 @@ function isTextLikeMime(mime) {
   if (m.endsWith("+json") || m.endsWith("+xml") || m.endsWith("+csv")) return true;
   return false;
 }
+var HASH_REF_RE = /(?:^|\s)#([^\s#]+)/g;
+var HEX_COLOR_RE = /^[0-9a-fA-F]{3,8}$/;
+var FILE_EXT_RE = /\.[a-zA-Z0-9]{1,10}$/;
+var TRAILING_PUNCT_RE = /[,.;:!?)\]}'"]+$/;
+async function resolveHashRefs(prompt, assetIndex, cloud) {
+  const resolutions = [];
+  const candidates = [];
+  let match;
+  const re = new RegExp(HASH_REF_RE.source, "g");
+  while ((match = re.exec(prompt)) !== null) {
+    const refName = match[1];
+    const leading = match[0].startsWith("#") ? 0 : 1;
+    const start = match.index + leading;
+    const end = match.index + match[0].length;
+    if (HEX_COLOR_RE.test(refName)) continue;
+    let cleanRef = refName;
+    let stripped = "";
+    const punctMatch = TRAILING_PUNCT_RE.exec(cleanRef);
+    if (punctMatch) {
+      stripped = punctMatch[0];
+      cleanRef = cleanRef.slice(0, -stripped.length);
+    }
+    if (!cleanRef) continue;
+    if (HEX_COLOR_RE.test(cleanRef)) continue;
+    const hasExtension = FILE_EXT_RE.test(cleanRef);
+    candidates.push({ ref: cleanRef, start, end: end - stripped.length, hasExtension });
+  }
+  if (candidates.length === 0) {
+    return { text: prompt, resolutions: [] };
+  }
+  const allFilenames = candidates.map((c) => c.ref);
+  const localResults = assetIndex.resolveByFilenames(allFilenames);
+  const needsCloud = candidates.filter(
+    (c) => c.hasExtension && !localResults.has(c.ref)
+  );
+  const cloudResults = /* @__PURE__ */ new Map();
+  if (needsCloud.length > 0) {
+    await Promise.allSettled(
+      needsCloud.map(async (c) => {
+        try {
+          const items = await cloud.get(
+            `/api/im/assets?workspaceId=${encodeURIComponent(assetIndex.workspaceId)}&q=${encodeURIComponent(c.ref)}&limit=1`
+          );
+          if (Array.isArray(items) && items.length > 0) {
+            const item = items[0];
+            cloudResults.set(c.ref, item.contentHash);
+          }
+        } catch {
+        }
+      })
+    );
+  }
+  for (const c of candidates) {
+    const local = localResults.get(c.ref);
+    if (local) {
+      resolutions.push({
+        ref: c.ref,
+        start: c.start,
+        end: c.end,
+        resolvedUri: `prismer://workspace/${encodeURIComponent(assetIndex.workspaceId)}/asset/${local.contentHash}`
+      });
+    } else if (c.hasExtension) {
+      const cloudHash = cloudResults.get(c.ref);
+      resolutions.push({
+        ref: c.ref,
+        start: c.start,
+        end: c.end,
+        resolvedUri: cloudHash ? `prismer://workspace/${encodeURIComponent(assetIndex.workspaceId)}/asset/${cloudHash}` : void 0
+      });
+    }
+  }
+  let result = prompt;
+  const sorted = [...resolutions].filter((r) => r.resolvedUri).sort((a, b) => b.start - a.start);
+  for (const r of sorted) {
+    result = result.slice(0, r.start) + r.resolvedUri + result.slice(r.end);
+  }
+  return { text: result, resolutions };
+}
 async function resolveAssetRefs(refs, cache) {
   const out = { promptBlocks: [], observability: [], pinnedHashes: [] };
   if (!refs || refs.length === 0) return out;
@@ -2548,8 +3264,8 @@ async function resolveAssetRefs(refs, cache) {
   return out;
 }
 function formatInlineAssetBlock(ref, mime, body, strategy) {
-  const header = `[Attached file] id=${ref.assetId} mime=${mime ?? "unknown"}${strategy === "inline-text-truncated" ? " (truncated)" : ""}`;
-  return `${header}
+  const header2 = `[Attached file] id=${ref.assetId} mime=${mime ?? "unknown"}${strategy === "inline-text-truncated" ? " (truncated)" : ""}`;
+  return `${header2}
 ---
 ${body}
 ---`;
@@ -2864,7 +3580,7 @@ var ServicePool = class {
 
 // src/daemon/local-server.ts
 import { createServer } from "http";
-import { randomUUID as randomUUID2, createHash } from "crypto";
+import { randomUUID, createHash } from "crypto";
 import { promises as fs } from "fs";
 import * as path2 from "path";
 var LocalServer = class {
@@ -2898,20 +3614,35 @@ var LocalServer = class {
       respond(res, 204, null);
       return;
     }
+    const handlers = [];
     if (this.opts.attachMemory) {
-      void this.opts.attachMemory(req, res).then((handled) => {
-        if (handled) return;
-        this.routeStandard(req, res);
-      }).catch((err) => {
-        respond(res, 500, {
-          error: "attach_memory_threw",
-          message: err instanceof Error ? err.message : String(err)
-        });
-      });
+      handlers.push({ name: "memory", fn: this.opts.attachMemory });
+    }
+    if (this.opts.attachAsset) {
+      handlers.push({ name: "asset", fn: this.opts.attachAsset });
+    }
+    if (handlers.length > 0) {
+      void this.runHandlers(req, res, handlers, 0);
       return;
     }
     this.routeStandard(req, res);
   }
+  async runHandlers(req, res, handlers, idx) {
+    if (idx >= handlers.length) {
+      this.routeStandard(req, res);
+      return;
+    }
+    try {
+      const handled = await handlers[idx].fn(req, res);
+      if (handled) return;
+      await this.runHandlers(req, res, handlers, idx + 1);
+    } catch (err) {
+      respond(res, 500, {
+        error: `attach_${handlers[idx].name}_threw`,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
   routeStandard(req, res) {
     const url = req.url ?? "/";
     if (req.method === "GET" && url === "/healthz") {
@@ -2926,7 +3657,8 @@ var LocalServer = class {
         wsConnected: state.wsConnected,
         hostedAgents: state.hostedAgents,
         observability: state.observability,
-        memoryReady: this.opts.attachMemory != null
+        memoryReady: this.opts.attachMemory != null,
+        assetReady: this.opts.attachAsset != null
       });
       return;
     }
@@ -3078,7 +3810,7 @@ var LocalServer = class {
       respond(res, 400, { error: "missing_taskId" });
       return;
     }
-    const runId = randomUUID2();
+    const runId = randomUUID();
     try {
       this.opts.onDispatch?.(payload, runId);
     } catch (err) {
@@ -3169,7 +3901,7 @@ async function walkAndDigest(root, current) {
 
 // src/daemon/runner.ts
 import { EventEmitter as EventEmitter3 } from "events";
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
 import { platform } from "os";
 
 // src/adapters/claude-code/index.ts
@@ -3821,7 +4553,7 @@ import * as path4 from "path";
 import Database3 from "better-sqlite3";
 import * as fs2 from "fs";
 import * as path3 from "path";
-import { randomUUID as randomUUID3, createHash as createHash2 } from "crypto";
+import { randomUUID as randomUUID2, createHash as createHash2 } from "crypto";
 
 // src/daemon/memory/crypto.ts
 function sealPlaintext(content) {
@@ -4023,16 +4755,17 @@ var MemoryStore = class {
     const existing = db.prepare(
       "SELECT id, version, createdAt FROM memory_pages WHERE workspaceId = ? AND path = ?"
     ).get(this.opts.workspaceId, input.path);
-    const pageId = existing?.id ?? `page_${randomUUID3().replace(/-/g, "").slice(0, 22)}`;
+    const pageId = existing?.id ?? `page_${randomUUID2().replace(/-/g, "").slice(0, 22)}`;
     const newVersion = (existing?.version ?? 0) + 1;
     const createdAt = existing?.createdAt ?? now;
+    const staleFlag = input.stale ? 1 : 0;
     const insertPage = db.prepare(`
       INSERT INTO memory_pages (
         id, workspaceId, path, title, description, contentHash, version,
         pageType, visibilityKind, visibilityImUserId, encrypted, stale,
         archivedAt, sourceAssetId, sourceRefsJson, syncStatus,
         createdAt, updatedAt
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, NULL, ?, ?, 'local-only', ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, NULL, ?, ?, 'local-only', ?, ?)
       ON CONFLICT(workspaceId, path) DO UPDATE SET
         title = excluded.title,
         description = excluded.description,
@@ -4043,6 +4776,7 @@ var MemoryStore = class {
         visibilityImUserId = excluded.visibilityImUserId,
         sourceAssetId = excluded.sourceAssetId,
         sourceRefsJson = excluded.sourceRefsJson,
+        stale = excluded.stale,
         updatedAt = excluded.updatedAt
     `);
     const insertVersion = db.prepare(`
@@ -4070,6 +4804,7 @@ var MemoryStore = class {
         input.pageType ?? "leaf",
         visibility.kind,
         visibilityImUserId,
+        staleFlag,
         input.sourceAssetId ?? null,
         sourceRefsJson,
         createdAt,
@@ -4150,6 +4885,16 @@ var MemoryStore = class {
       dbPath: this.opts.dbPath
     };
   }
+  /**
+   * Record sync cursor for incremental sync. Used by cloud-sync.ts to
+   * persist the high-water mark for future cursor-based catch-up.
+   */
+  recordCursor(workspaceId, cursor) {
+    const now = Date.now();
+    this.requireDb().prepare(
+      `INSERT OR REPLACE INTO memory_inbox_cursor (workspaceId, cursor, updatedAt) VALUES (?, ?, ?)`
+    ).run(workspaceId, cursor, now);
+  }
   /**
    * Internal accessor for outbox.ts — outbox writes its own table within the
    * same DB. Returning the live Database handle keeps outbox transactions
@@ -4300,7 +5045,7 @@ function clamp(n, lo, hi) {
 }
 
 // src/daemon/memory/outbox.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/daemon/memory/envelope.ts
 import { z as z6 } from "zod";
@@ -4433,7 +5178,7 @@ var MemoryOutbox = class {
     const now = Date.now();
     const parsed = MemoryOutboxEnvelope.safeParse(event);
     if (!parsed.success) {
-      const dlId = `dl_${randomUUID4()}`;
+      const dlId = `dl_${randomUUID3()}`;
       db.prepare(
         `INSERT INTO memory_outbox_dead_letter (id, eventType, rawJson, errorJson, createdAt)
          VALUES (?, ?, ?, ?, ?)`
@@ -4450,7 +5195,7 @@ var MemoryOutbox = class {
     if (validated.eventType === "memory.feedback") {
       const check = validateFeedbackTarget(validated);
       if (!check.ok) {
-        const dlId = `dl_${randomUUID4()}`;
+        const dlId = `dl_${randomUUID3()}`;
         db.prepare(
           `INSERT INTO memory_outbox_dead_letter (id, eventType, rawJson, errorJson, createdAt)
            VALUES (?, ?, ?, ?, ?)`
@@ -4464,7 +5209,7 @@ var MemoryOutbox = class {
         return { id: dlId, deadLetter: true };
       }
     }
-    const rowId = `out_${randomUUID4()}`;
+    const rowId = `out_${randomUUID3()}`;
     try {
       db.prepare(
         `INSERT INTO memory_outbox (id, eventType, envelopeJson, idempotencyKey, status, createdAt)
@@ -4800,6 +5545,84 @@ function defaultLog() {
   };
 }
 
+// src/daemon/memory/cloud-sync.ts
+var LOG = "[CloudMemorySync]";
+var CLOUD_PAGE_LIMIT = 300;
+async function initialSyncFromCloud(runtime, cloud, workspaceId) {
+  const slot = runtime.peek(workspaceId);
+  if (!slot) {
+    console.log(`${LOG} No store for workspace=${workspaceId} \u2014 skipping`);
+    return { pulled: 0, skipped: 0 };
+  }
+  const cursorRow = slot.store.rawDb().prepare("SELECT cursor FROM memory_inbox_cursor WHERE workspaceId = ?").get(workspaceId);
+  if (cursorRow) {
+    console.log(`${LOG} Workspace=${workspaceId} already synced (cursor: ${cursorRow.cursor.slice(0, 20)}...) \u2014 skip`);
+    return { pulled: 0, skipped: 0 };
+  }
+  console.log(`${LOG} Fetching cloud pages for workspace=${workspaceId}...`);
+  const resp = await cloud.request(
+    "GET",
+    `/api/im/memory/pages?workspaceId=${encodeURIComponent(workspaceId)}&limit=${CLOUD_PAGE_LIMIT}&stale=all`,
+    { timeoutMs: 15e3 }
+  );
+  if (!resp.ok) {
+    console.warn(
+      `${LOG} Cloud GET /memory/pages returned ${resp.status}: ${resp.error?.message ?? "unknown"}`
+    );
+    return { pulled: 0, skipped: 0 };
+  }
+  const envelope2 = resp.data;
+  if (!envelope2 || !envelope2.ok) {
+    console.log(`${LOG} Cloud returned non-ok envelope for workspace=${workspaceId}`);
+    return { pulled: 0, skipped: 0 };
+  }
+  const pages = envelope2.data;
+  if (!pages || !Array.isArray(pages) || pages.length === 0) {
+    console.log(`${LOG} No cloud pages to sync for workspace=${workspaceId}`);
+    return { pulled: 0, skipped: 0 };
+  }
+  let pulled = 0;
+  let skipped = 0;
+  for (const page of pages) {
+    let content = page.content ?? "";
+    if (!content) {
+      try {
+        const detailResp = await cloud.request(
+          "GET",
+          `/api/im/memory/pages/${encodeURIComponent(page.id)}?workspaceId=${encodeURIComponent(workspaceId)}`,
+          { timeoutMs: 5e3 }
+        );
+        if (detailResp.ok && detailResp.data?.data?.content) {
+          content = detailResp.data.data.content;
+        }
+      } catch {
+      }
+    }
+    const visibility = page.visibility === "agent" ? { kind: "agent", imUserId: "" } : { kind: "workspace" };
+    try {
+      slot.store.write({
+        workspaceId,
+        path: page.path,
+        title: page.title ?? void 0,
+        content: content || "",
+        pageType: page.pageType || "leaf",
+        visibility,
+        actorImUserId: "cloud-sync",
+        actorKind: "agent"
+      });
+      pulled++;
+    } catch (err) {
+      console.warn(`${LOG} write failed for ${page.path}:`, err.message);
+      skipped++;
+    }
+  }
+  slot.store.recordCursor(workspaceId, `synced:${Date.now()}`);
+  console.log(
+    `${LOG} Synced ${pulled} pages${skipped ? `, ${skipped} skipped` : ""} for workspace=${workspaceId}`
+  );
+  return { pulled, skipped };
+}
+
 // src/daemon/memory/runner-wiring.ts
 function attachMemoryRunner(opts) {
   const runtime = new MemoryRuntime({ baseDir: opts.baseDir, deviceId: opts.deviceId });
@@ -4830,6 +5653,24 @@ function attachMemoryRunner(opts) {
     }
   };
 }
+async function syncMemoryFromCloud(wiring, cloud, workspaceIds) {
+  const uniqueIds = [...new Set(workspaceIds.filter(Boolean))];
+  if (uniqueIds.length === 0) return;
+  console.log(`[MemorySync] Initial cloud-to-local sync for ${uniqueIds.length} workspace(s)...`);
+  for (const wsId of uniqueIds) {
+    try {
+      wiring.runtime.resolve(wsId);
+      const result = await initialSyncFromCloud(wiring.runtime, cloud, wsId);
+      if (result.pulled > 0 || result.skipped > 0) {
+        console.log(
+          `[MemorySync] workspace=${wsId}: ${result.pulled} pulled, ${result.skipped} skipped`
+        );
+      }
+    } catch (err) {
+      console.error(`[MemorySync] workspace=${wsId} failed:`, err.message);
+    }
+  }
+}
 
 // src/daemon/memory/fork/select-memories.ts
 var SELECT_MEMORIES_SYSTEM_PROMPT = [
@@ -4948,7 +5789,7 @@ function clamp2(n, lo, hi) {
 }
 
 // src/daemon/memory/fork/tracing.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // src/daemon/memory/fork/runner.ts
 var DEFAULT_SNIPPET_MAX_BYTES = 500;
@@ -5204,37 +6045,264 @@ function handleRecallManifest(runtime, query, res) {
   respond2(res, 200, manifest);
   return true;
 }
-function handleRecallFinalize(runtime, body, res) {
+function handleRecallFinalize(runtime, body, res) {
+  if (!body || typeof body !== "object") {
+    return respond400(res, "json body required");
+  }
+  const b = body;
+  if (typeof b.workspaceId !== "string" || !b.workspaceId) {
+    return respond400(res, "workspaceId is required");
+  }
+  if (!Array.isArray(b.paths)) {
+    return respond400(res, "paths[] is required");
+  }
+  const paths = [];
+  for (const p of b.paths) {
+    if (typeof p === "string" && p.length > 0) paths.push(p);
+  }
+  const snippetMaxBytes = typeof b.snippetMaxBytes === "number" && b.snippetMaxBytes > 0 ? b.snippetMaxBytes : void 0;
+  const results = finalizeSelected(runtime, b.workspaceId, paths, snippetMaxBytes);
+  respond2(res, 200, { workspaceId: b.workspaceId, results });
+  return true;
+}
+function parsePrismerUri(uri) {
+  const PREFIX2 = "prismer://workspace/";
+  if (!uri.startsWith(PREFIX2)) return null;
+  const rest = uri.slice(PREFIX2.length);
+  const segMemory = "/memory/";
+  const memoryIdx = rest.indexOf(segMemory);
+  if (memoryIdx <= 0) return null;
+  const workspaceId = rest.slice(0, memoryIdx);
+  const path7 = rest.slice(memoryIdx + segMemory.length);
+  if (!workspaceId || !path7) return null;
+  return { workspaceId, path: path7 };
+}
+
+// src/daemon/asset/metadata-index.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join8 } from "path";
+var DEFAULT_LIMIT = 8;
+var PULL_PAGE_SIZE = 500;
+var THROTTLE_MS = 3e4;
+function rowToMetadata(row) {
+  return {
+    assetId: row.asset_id,
+    contentHash: row.content_hash,
+    filename: row.filename,
+    folderPath: row.folder_path,
+    mime: row.mime,
+    kind: row.kind,
+    sizeBytes: row.size_bytes,
+    description: row.description,
+    assetIndexSeq: row.asset_index_seq
+  };
+}
+var AssetMetadataIndex = class {
+  db;
+  cloud;
+  /** Workspace ID — exposed for prismer:// URI construction. */
+  workspaceId;
+  cursorPath;
+  _lastSyncMs = 0;
+  constructor(opts) {
+    this.db = opts.db;
+    this.cloud = opts.cloud;
+    this.workspaceId = opts.workspaceId;
+    if (!existsSync7(opts.workspaceStateDir)) {
+      mkdirSync7(opts.workspaceStateDir, { recursive: true });
+    }
+    this.cursorPath = join8(opts.workspaceStateDir, "asset-metadata-cursor.json");
+  }
+  /** Persisted cursor for this workspace, or 0 on first run / corrupted file. */
+  readCursor() {
+    if (!existsSync7(this.cursorPath)) return 0;
+    try {
+      const parsed = JSON.parse(readFileSync5(this.cursorPath, "utf8"));
+      if (parsed.workspaceId !== this.workspaceId) return 0;
+      return parsed.cursor;
+    } catch {
+      return 0;
+    }
+  }
+  writeCursor(cursor) {
+    const payload = {
+      workspaceId: this.workspaceId,
+      cursor,
+      writtenAt: Date.now()
+    };
+    writeFileSync5(this.cursorPath, JSON.stringify(payload, null, 2));
+  }
+  /**
+   * Pull incremental asset metadata changes since the persisted cursor and
+   * upsert into the local index. Newer rows overwrite older ones by
+   * (workspace_id, asset_id) primary key.
+   *
+   * Returns the count of items applied + the new cursor. Throttled: if called
+   * within 30s of the last successful pull, returns immediately.
+   */
+  async pullDelta(opts) {
+    const now = Date.now();
+    if (now - this._lastSyncMs < THROTTLE_MS) {
+      return { applied: 0, cursor: this.readCursor() };
+    }
+    const since = this.readCursor();
+    const sinceParam = since > 0 ? `&since=${since}` : "";
+    const envelope2 = await this.cloud.get(
+      `/api/im/assets/index?workspaceId=${encodeURIComponent(this.workspaceId)}&limit=${PULL_PAGE_SIZE}${sinceParam}`,
+      { signal: opts?.signal }
+    );
+    const upsert = this.db.prepare(`
+      INSERT INTO asset_metadata_index
+        (workspace_id, asset_id, content_hash, filename, folder_path, mime, kind, size_bytes, description, asset_index_seq, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(workspace_id, asset_id) DO UPDATE SET
+        content_hash = excluded.content_hash,
+        filename = excluded.filename,
+        folder_path = excluded.folder_path,
+        mime = excluded.mime,
+        kind = excluded.kind,
+        size_bytes = excluded.size_bytes,
+        description = excluded.description,
+        asset_index_seq = excluded.asset_index_seq,
+        updated_at = excluded.updated_at
+    `);
+    const nowTs = Date.now();
+    let applied = 0;
+    const tx = this.db.transaction((items) => {
+      for (const item of items) {
+        upsert.run(
+          this.workspaceId,
+          item.assetId,
+          item.contentHash,
+          item.filename ?? null,
+          item.folderPath ?? null,
+          item.mime,
+          item.kind,
+          item.sizeBytes,
+          item.description ?? null,
+          item.assetIndexSeq,
+          nowTs
+        );
+        applied += 1;
+      }
+    });
+    try {
+      tx(envelope2.items);
+      this.writeCursor(envelope2.cursor);
+    } catch (err) {
+      throw err;
+    }
+    this._lastSyncMs = now;
+    return { applied, cursor: envelope2.cursor };
+  }
+  /**
+   * Search local index by filename or description substring.
+   * Escapes LIKE wildcards (% and _). Default limit 8.
+   */
+  search(query, limit) {
+    const escaped = query.replace(/%/g, "\\%").replace(/_/g, "\\_");
+    const pattern = `%${escaped}%`;
+    const limitVal = Math.min(Math.max(limit ?? DEFAULT_LIMIT, 1), 200);
+    const rows = this.db.prepare(
+      `SELECT * FROM asset_metadata_index
+         WHERE workspace_id = ?
+           AND (filename LIKE ? ESCAPE '\\' OR description LIKE ? ESCAPE '\\')
+         ORDER BY asset_index_seq DESC
+         LIMIT ?`
+    ).all(this.workspaceId, pattern, pattern, limitVal);
+    return rows.map(rowToMetadata);
+  }
+  /** Exact match on filename column. Returns undefined if not indexed. */
+  resolveByFilename(filename) {
+    const row = this.db.prepare("SELECT * FROM asset_metadata_index WHERE workspace_id = ? AND filename = ?").get(this.workspaceId, filename);
+    return row ? rowToMetadata(row) : void 0;
+  }
+  /** Batch exact match — returns Map for O(1) access. */
+  resolveByFilenames(filenames) {
+    if (filenames.length === 0) return /* @__PURE__ */ new Map();
+    const placeholders = filenames.map(() => "?").join(",");
+    const params = [this.workspaceId, ...filenames];
+    const rows = this.db.prepare(
+      `SELECT * FROM asset_metadata_index
+         WHERE workspace_id = ? AND filename IN (${placeholders})`
+    ).all(...params);
+    const map = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      if (row.filename) map.set(row.filename, rowToMetadata(row));
+    }
+    return map;
+  }
+};
+
+// src/daemon/asset/rpc.ts
+var ASSET_PATH_PREFIX = "/local/asset/";
+function attachAssetRpc(opts) {
+  return async (req, res) => {
+    const url = req.url ?? "/";
+    if (!url.startsWith(ASSET_PATH_PREFIX)) return false;
+    const [pathOnly = ""] = url.split("?", 2);
+    const subpath = pathOnly.slice(ASSET_PATH_PREFIX.length);
+    const method = req.method ?? "GET";
+    try {
+      if (method === "POST" && subpath === "search") {
+        const body = await readJson3(req);
+        return handleSearch2(opts.resolveIndex, body, res);
+      }
+      respond3(res, 404, { error: "asset_route_not_found", path: url });
+      return true;
+    } catch (err) {
+      respond3(res, 500, {
+        error: "asset_rpc_failed",
+        message: err instanceof Error ? err.message : String(err)
+      });
+      return true;
+    }
+  };
+}
+function handleSearch2(resolveIndex, body, res) {
   if (!body || typeof body !== "object") {
-    return respond400(res, "json body required");
+    return respond4002(res, "request body must be a JSON object");
   }
   const b = body;
   if (typeof b.workspaceId !== "string" || !b.workspaceId) {
-    return respond400(res, "workspaceId is required");
+    return respond4002(res, "workspaceId is required (string)");
   }
-  if (!Array.isArray(b.paths)) {
-    return respond400(res, "paths[] is required");
+  if (typeof b.query !== "string" || !b.query.trim()) {
+    return respond4002(res, "query is required (non-empty string)");
   }
-  const paths = [];
-  for (const p of b.paths) {
-    if (typeof p === "string" && p.length > 0) paths.push(p);
+  const index = resolveIndex(b.workspaceId);
+  if (!index) {
+    respond3(res, 404, {
+      error: "workspace_index_not_found",
+      workspaceId: b.workspaceId,
+      message: "No asset metadata index for this workspace. Ensure the daemon has synced asset metadata."
+    });
+    return true;
   }
-  const snippetMaxBytes = typeof b.snippetMaxBytes === "number" && b.snippetMaxBytes > 0 ? b.snippetMaxBytes : void 0;
-  const results = finalizeSelected(runtime, b.workspaceId, paths, snippetMaxBytes);
-  respond2(res, 200, { workspaceId: b.workspaceId, results });
+  const limit = typeof b.limit === "number" && b.limit > 0 ? b.limit : void 0;
+  const items = index.search(b.query.trim(), limit);
+  respond3(res, 200, { items });
   return true;
 }
-function parsePrismerUri(uri) {
-  const PREFIX2 = "prismer://workspace/";
-  if (!uri.startsWith(PREFIX2)) return null;
-  const rest = uri.slice(PREFIX2.length);
-  const segMemory = "/memory/";
-  const memoryIdx = rest.indexOf(segMemory);
-  if (memoryIdx <= 0) return null;
-  const workspaceId = rest.slice(0, memoryIdx);
-  const path7 = rest.slice(memoryIdx + segMemory.length);
-  if (!workspaceId || !path7) return null;
-  return { workspaceId, path: path7 };
+function respond3(res, status, body) {
+  res.statusCode = status;
+  res.setHeader("Content-Type", "application/json");
+  res.end(JSON.stringify(body));
+}
+function respond4002(res, message) {
+  respond3(res, 400, { error: "invalid_request", message });
+  return true;
+}
+async function readJson3(req) {
+  let raw = "";
+  req.setEncoding("utf8");
+  for await (const chunk of req) raw += chunk;
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error("invalid_json");
+  }
 }
 
 // src/daemon/outbox-watcher.ts
@@ -5494,7 +6562,7 @@ var OutboxWatcher = class {
 
 // src/daemon/shell-executor.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { resolve } from "path";
 var DEFAULT_OUTPUT_LIMIT = 256 * 1024;
 var DEFAULT_TIMEOUT = 6e4;
@@ -5531,7 +6599,7 @@ async function executeShellDispatch(payload, deps) {
   const command = readCommand(payload, execution);
   if (!command.trim()) return fail(payload.taskId, "shell_command_required", "Shell command is required");
   const cwd = resolveCwd(execution.cwd, deps.config.defaultCwd);
-  if (!existsSync7(cwd)) return fail(payload.taskId, "shell_cwd_missing", `cwd does not exist: ${cwd}`);
+  if (!existsSync8(cwd)) return fail(payload.taskId, "shell_cwd_missing", `cwd does not exist: ${cwd}`);
   const timeoutMs = Math.min(
     typeof payload.timeoutMs === "number" && payload.timeoutMs > 0 ? payload.timeoutMs : deps.config.maxTimeoutMs,
     deps.config.maxTimeoutMs
@@ -5683,6 +6751,7 @@ var Runner = class extends EventEmitter3 {
   localServer;
   outboxWatcher;
   memoryWiring;
+  assetMetadataIndexes = /* @__PURE__ */ new Map();
   state = "idle";
   startedAt = 0;
   workspaceId = "";
@@ -5699,6 +6768,9 @@ var Runner = class extends EventEmitter3 {
     this.paths = this.opts.paths ?? resolvePaths();
     this.config = this.opts.configOverride ?? loadConfig(this.paths);
     this.shellConfig = resolveShellConfig(this.config.shell);
+    if (process.env.PRISMER_WORKSPACE_ID) {
+      this.workspaceId = process.env.PRISMER_WORKSPACE_ID;
+    }
     process.env.PRISMER_BASE_URL = this.config.cloud_api_base;
     process.env.PRISMER_API_KEY = this.config.api_key;
     this.db = openLocalDb(this.paths.localDb);
@@ -5736,6 +6808,16 @@ var Runner = class extends EventEmitter3 {
       baseDir: `${this.paths.root}/memory`,
       deviceId: this.config.daemon_id
     });
+    if (this.memoryWiring && this.workspaceId) {
+      syncMemoryFromCloud(this.memoryWiring, this.cloud, [this.workspaceId]).catch(
+        (err) => console.error("[Daemon] Initial memory sync failed:", err.message)
+      );
+    }
+    if (this.workspaceId) {
+      this.syncAssetMetadata(this.workspaceId).catch(
+        (err) => console.error("[Daemon] Initial asset metadata sync failed:", err.message)
+      );
+    }
     const containerId = process.env.PRISMER_CONTAINER_ID;
     const isContainer = !!containerId || process.env.PRISMER_RUNTIME_MODE === "container";
     this.outboxWatcher = new OutboxWatcher({
@@ -5782,1374 +6864,875 @@ var Runner = class extends EventEmitter3 {
         // shipped the rpc.ts route table but T1 deliberately deferred the
         // wiring step so it could be reviewed alongside the host-adapter
         // consumer (Hermes T2-B), which is what surfaces these routes to
-        // an actual agent process.
-        attachMemory: this.memoryWiring ? attachMemoryRpc({ runtime: this.memoryWiring.runtime }) : void 0
-      });
-      await this.localServer.start();
-    }
-    this.heartbeatTimer = setInterval(() => {
-      if (this.wsConnected) this.sendDeclare();
-    }, 3e4);
-    this.taskReaperTimer = setInterval(() => {
-      const now = Date.now();
-      for (const [taskId, entry] of this.runningTasks) {
-        const limit = Math.max(entry.timeoutMs, 5 * 6e4);
-        if (now - entry.lastProgressAt <= limit) continue;
-        process.stderr.write(
-          `[daemon] task ${taskId} inactive > ${limit}ms \u2014 aborting
-`
-        );
-        try {
-          entry.ctrl.abort();
-        } catch {
-        }
-      }
-    }, 6e4);
-    this.state = "running";
-    this.emit("ready");
-  }
-  async stop() {
-    if (this.state === "idle" || this.state === "stopping") return;
-    this.state = "stopping";
-    for (const entry of this.runningTasks.values()) {
-      try {
-        entry.ctrl.abort();
-      } catch {
-      }
-    }
-    this.runningTasks.clear();
-    if (this.taskReaperTimer) {
-      clearInterval(this.taskReaperTimer);
-      this.taskReaperTimer = void 0;
-    }
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
-      this.heartbeatTimer = void 0;
-    }
-    this.syncWorker?.stop();
-    this.memoryWiring?.stop();
-    this.memoryWiring = void 0;
-    this.ws?.close();
-    this.outboxWatcher?.stop();
-    await this.servicePool?.shutdown();
-    await this.localServer?.stop();
-    try {
-      this.db?.close();
-    } catch {
-    }
-    this.state = "idle";
-    this.emit("stopped");
-  }
-  isRunning() {
-    return this.state === "running";
-  }
-  /**
-   * Phase 1 escape hatch — see `DispatchPayload.shellCommand`. Spawns
-   * `bash -c <cmd>` with cwd=/workspace, mirrors output to pod logs.
-   * Fire-and-forget; nothing here writes back to cloud.
-   */
-  async runShellCommand(taskId, command) {
-    const { spawn: spawn7 } = await import("child_process");
-    process.stdout.write(`[daemon] shellCommand task=${taskId} cmd=${command}
-`);
-    const child = spawn7("bash", ["-c", command], {
-      cwd: "/workspace",
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env }
-    });
-    child.stdout?.on(
-      "data",
-      (d) => process.stdout.write(`[shellCommand:${taskId}] ${d.toString()}`)
-    );
-    child.stderr?.on(
-      "data",
-      (d) => process.stderr.write(`[shellCommand:${taskId}] ${d.toString()}`)
-    );
-    child.on(
-      "exit",
-      (code) => process.stdout.write(`[daemon] shellCommand task=${taskId} exit=${code}
-`)
-    );
-  }
-  snapshotState() {
-    return {
-      daemonId: this.config?.daemon_id ?? "",
-      cloudBaseUrl: this.config?.cloud_api_base,
-      workspaceId: this.workspaceId || null,
-      pid: process.pid,
-      startedAt: this.startedAt,
-      wsConnected: this.wsConnected,
-      hostedAgents: Array.from(this.hostedAgents.values()).map((a) => ({
-        imUserId: a.imUserId,
-        name: a.name,
-        adapterName: a.adapterName
-      })),
-      runningTaskIds: Array.from(this.runningTasks.keys()),
-      observability: {
-        adapters: this.snapshotAdapterObservability(),
-        ...this.lastTaskError ? { lastTaskError: this.lastTaskError } : {}
-      }
-    };
-  }
-  /**
-   * Re-read the local `agents` table (populated by `prismer agent register`)
-   * and re-populate `hostedAgents` map. Profiles per agent come from local
-   * `agent_profiles` table (filled by host.acked sync).
-   */
-  loadAgentsFromDb() {
-    this.hostedAgents.clear();
-    const agents = this.db.prepare("SELECT * FROM agents").all();
-    const profilesByAgent = /* @__PURE__ */ new Map();
-    const allProfiles = this.db.prepare("SELECT id, agent_im_user_id, version FROM agent_profiles WHERE deleted_at IS NULL").all();
-    for (const p of allProfiles) {
-      const list = profilesByAgent.get(p.agent_im_user_id) ?? [];
-      list.push({ id: p.id, version: p.version });
-      profilesByAgent.set(p.agent_im_user_id, list);
-    }
-    for (const a of agents) {
-      let caps = [];
-      try {
-        caps = JSON.parse(a.capabilities);
-      } catch {
-        caps = [];
-      }
-      this.setHostedAgent({
-        imUserId: a.im_user_id,
-        name: a.name,
-        adapterName: a.adapter_name,
-        capabilities: caps,
-        profiles: profilesByAgent.get(a.im_user_id) ?? []
-      });
-    }
-  }
-  /**
-   * Register an in-process AgentProfile snapshot (called by agent CLI / sync layer).
-   * Used to populate the `agents` list in agent.host.declare.
-   */
-  setHostedAgent(agent) {
-    this.hostedAgents.set(agent.imUserId, {
-      imUserId: agent.imUserId,
-      name: agent.name,
-      adapterName: agent.adapterName,
-      capabilities: agent.capabilities,
-      profiles: new Map(agent.profiles.map((p) => [p.id, p.version]))
-    });
-  }
-  async installHostedAgent(payload) {
-    const now = Date.now();
-    const tx = this.db.transaction((p) => {
-      this.db.prepare(
-        `INSERT OR REPLACE INTO agents
-           (im_user_id, workspace_id, name, adapter_name, capabilities, status, version, synced_at, dirty)
-           VALUES (?, ?, ?, ?, ?, 'offline', 1, ?, 0)`
-      ).run(p.imUserId, p.workspaceId, p.name, p.adapterName, JSON.stringify(p.capabilities), now);
-      this.db.prepare(
-        `INSERT OR REPLACE INTO agent_profiles
-           (id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at, dirty, deleted_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, NULL)`
-      ).run(
-        p.profile.id,
-        p.workspaceId,
-        p.imUserId,
-        p.profile.adapterName,
-        p.profile.name,
-        JSON.stringify(p.profile.config ?? {}),
-        p.profile.version,
-        now
-      );
-    });
-    tx(payload);
-    this.loadAgentsFromDb();
-    if (this.wsConnected) this.sendDeclare();
-    return {
-      ok: true,
-      daemonId: this.config.daemon_id,
-      installedAgent: {
-        imUserId: payload.imUserId,
-        name: payload.name,
-        adapterName: payload.adapterName,
-        profileId: payload.profile.id
-      },
-      hostedAgents: this.snapshotState().hostedAgents
-    };
-  }
-  installStaticHostedAgentFromEnv() {
-    const required = truthy(process.env.PRISMER_STATIC_BINDING_REQUIRED);
-    const rawFile = process.env.PRISMER_HOSTED_AGENT_FILE;
-    const rawJson = process.env.PRISMER_HOSTED_AGENT_JSON;
-    let raw;
-    if (rawFile) {
-      if (!existsSync8(rawFile)) {
-        throw new Error(`PRISMER_HOSTED_AGENT_FILE not found: ${rawFile}`);
-      }
-      raw = readFileSync5(rawFile, "utf8");
-    } else if (rawJson) {
-      raw = rawJson;
-    }
-    if (!raw) {
-      if (required) {
-        throw new Error("static binding required, but PRISMER_HOSTED_AGENT_JSON/PRISMER_HOSTED_AGENT_FILE is missing");
-      }
-      return;
-    }
-    let payload;
-    try {
-      payload = validateStaticHostedAgent(JSON.parse(raw));
-    } catch (err) {
-      throw new Error(`invalid static hosted agent binding: ${err.message}`);
+        // an actual agent process.
+        attachMemory: this.memoryWiring ? attachMemoryRpc({ runtime: this.memoryWiring.runtime }) : void 0,
+        attachAsset: attachAssetRpc({
+          resolveIndex: (workspaceId) => this.assetMetadataIndexes.get(workspaceId)
+        })
+      });
+      await this.localServer.start();
     }
-    const now = Date.now();
-    const tx = this.db.transaction((p) => {
-      this.db.prepare(
-        `INSERT OR REPLACE INTO agents
-           (im_user_id, workspace_id, name, adapter_name, capabilities, status, version, synced_at, dirty)
-           VALUES (?, ?, ?, ?, ?, 'offline', 1, ?, 0)`
-      ).run(p.imUserId, p.workspaceId, p.name, p.adapterName, JSON.stringify(p.capabilities), now);
-      this.db.prepare(
-        `INSERT OR REPLACE INTO agent_profiles
-           (id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at, dirty, deleted_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, NULL)`
-      ).run(
-        p.profile.id,
-        p.workspaceId,
-        p.imUserId,
-        p.profile.adapterName,
-        p.profile.name,
-        JSON.stringify(p.profile.config ?? {}),
-        p.profile.version,
-        now
-      );
-    });
-    tx(payload);
-    process.stdout.write(
-      `[daemon] static binding loaded agent=${payload.imUserId} profile=${payload.profile.id} adapter=${payload.adapterName}
+    this.heartbeatTimer = setInterval(() => {
+      if (this.wsConnected) this.sendDeclare();
+    }, 3e4);
+    this.taskReaperTimer = setInterval(() => {
+      const now = Date.now();
+      for (const [taskId, entry] of this.runningTasks) {
+        const limit = Math.max(entry.timeoutMs, 5 * 6e4);
+        if (now - entry.lastProgressAt <= limit) continue;
+        process.stderr.write(
+          `[daemon] task ${taskId} inactive > ${limit}ms \u2014 aborting
 `
-    );
-  }
-  // ───────────────────────────── internals ─────────────────────────────
-  wireWsHandlers() {
-    this.ws.on("open", () => {
-      this.wsConnected = true;
-      process.stdout.write(`[daemon] ws open, awaiting server authenticated ack
-`);
-    });
-    this.ws.on("close", (code, reason) => {
-      this.wsConnected = false;
-      process.stdout.write(`[daemon] ws closed (code=${code ?? "?"}, reason=${reason ?? ""})
-`);
-    });
-    this.ws.on("error", (err) => {
-      process.stderr.write(`[daemon] ws error: ${err.message}
-`);
-    });
-    this.ws.on("auth-failed", () => {
-      process.stderr.write(`[daemon] ws auth-failed (close code 4001) \u2014 check API key
-`);
-      this.emit("auth-failed");
-    });
-    this.ws.on("reconnect-scheduled", (delayMs) => {
-      process.stdout.write(`[daemon] ws reconnect in ${delayMs}ms
-`);
-    });
-    this.ws.on("message", (msg) => {
-      const m = msg;
-      if (m?.type) process.stdout.write(`[daemon] ws msg \u2190 ${m.type}
-`);
-      if (m?.type === "error") {
-        process.stderr.write(`[daemon] ws error payload: ${JSON.stringify(msg)}
-`);
-        const code = m.payload?.code;
-        if (code === "AUTH_FAILED" || code === "AUTH_REQUIRED" || code === "auth_invalid") {
-          process.stderr.write(`[daemon] application auth failure (${code}) \u2014 stopping daemon
-`);
-          this.emit("auth-failed");
+        );
+        try {
+          entry.ctrl.abort();
+        } catch {
         }
       }
-      if (m?.type === "authenticated") {
-        process.stdout.write(`[daemon] ws authenticated, sending agent.host.declare (${this.hostedAgents.size} agents)
-`);
-        this.sendDeclare();
-        return;
-      }
-      this.handleIncoming(msg);
-    });
-  }
-  sendDeclare() {
-    const payload = {
-      daemonId: this.config.daemon_id,
-      daemonVersion: this.opts.daemonVersion ?? "0.0.0",
-      platform: platform() === "win32" ? "win32" : platform() === "linux" ? "linux" : "darwin",
-      agents: Array.from(this.hostedAgents.values()).map((a) => ({
-        imUserId: a.imUserId,
-        name: a.name,
-        adapterName: a.adapterName,
-        capabilities: a.capabilities,
-        profiles: Array.from(a.profiles.entries()).map(([id, version]) => ({ id, version }))
-      }))
-    };
-    this.ws.send(envelope("agent.host.declare", payload, this.config.daemon_id));
-  }
-  handleIncoming(msg) {
-    switch (msg.type) {
-      case "host.acked":
-        void this.onHostAcked(msg.payload);
-        return;
-      case "task.dispatch.request":
-        void this.onTaskDispatch(msg.payload, msg.requestId);
-        return;
-      case "task.cancel":
-        this.onTaskCancel(msg.payload);
-        return;
-      case "agent.changed":
-        this.onAgentChanged(msg.payload);
-        return;
-      case "agent_profile.changed":
-        void this.onAgentProfileChanged(msg.payload);
-        return;
-      case "workspace.changed":
-        void this.onWorkspaceChanged(msg.payload);
-        return;
-      case "workspace_file.changed":
-        this.onWorkspaceFileChanged(msg.payload);
-        return;
-      default:
-        this.emit("unknown-message", msg);
-    }
+    }, 6e4);
+    this.state = "running";
+    this.emit("ready");
   }
-  async onHostAcked(payload) {
-    this.workspaceId = payload.workspaceId;
-    for (const id of payload.profilesToSync) {
+  async stop() {
+    if (this.state === "idle" || this.state === "stopping") return;
+    this.state = "stopping";
+    for (const entry of this.runningTasks.values()) {
       try {
-        await this.syncProfileFromCloud(id);
-      } catch (err) {
-        this.emit("sync-error", err);
+        entry.ctrl.abort();
+      } catch {
       }
     }
-    if (payload.profilesToSync.length > 0 && this.wsConnected) this.sendDeclare();
-    this.emit("host-acked", payload);
-  }
-  async onTaskDispatch(payload, requestId) {
-    const targetDaemonId = readTargetDaemonId(payload);
-    if (targetDaemonId && targetDaemonId !== this.config.daemon_id) {
-      process.stdout.write(
-        `[daemon] dispatch skip task=${payload.taskId} targetDaemonId=${targetDaemonId} local=${this.config.daemon_id}
-`
-      );
-      return;
+    this.runningTasks.clear();
+    if (this.taskReaperTimer) {
+      clearInterval(this.taskReaperTimer);
+      this.taskReaperTimer = void 0;
     }
-    if (this.runningTasks.has(payload.taskId)) {
-      process.stdout.write(`[daemon] dispatch dup task=${payload.taskId} (already in-flight, skipping)
-`);
-      return;
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = void 0;
     }
-    process.stdout.write(
-      `[daemon] dispatch start task=${payload.taskId} route=${payload.runtimeRoute ?? "agent"} agent=${payload.agentImUserId ?? "-"} daemon=${payload.targetDaemonId ?? "-"}
-`
-    );
-    const ctrl = new AbortController();
-    this.runningTasks.set(payload.taskId, {
-      ctrl,
-      startedAt: Date.now(),
-      lastProgressAt: Date.now(),
-      timeoutMs: typeof payload.timeoutMs === "number" ? payload.timeoutMs : 0
-    });
+    this.syncWorker?.stop();
+    this.memoryWiring?.stop();
+    this.memoryWiring = void 0;
+    this.ws?.close();
+    this.outboxWatcher?.stop();
+    await this.servicePool?.shutdown();
+    await this.localServer?.stop();
     try {
-      if (isShellDispatch(payload)) {
-        const reply = await executeShellDispatch(payload, {
-          config: this.shellConfig,
-          workspaceId: this.workspaceId,
-          signal: ctrl.signal,
-          onProgress: (progressPayload) => {
-            const running = this.runningTasks.get(payload.taskId);
-            if (running) running.lastProgressAt = Date.now();
-            this.ws.send(envelope("task.dispatch.progress", progressPayload));
-          }
-        });
-        this.ws.send(envelope("task.dispatch.reply", reply, requestId));
-      } else {
-        await handleDispatch(payload, requestId, {
-          registry: this.registry,
-          cloud: this.cloud,
-          uriResolver: this.uriResolver,
-          assetCache: this.assetCache,
-          ws: this.ws,
-          outboxWatcher: this.outboxWatcher,
-          paths: this.paths,
-          signal: ctrl.signal,
-          ensureService: (profile, adapter) => this.servicePool.ensureService(profile, adapter),
-          onProgress: () => {
-            const running = this.runningTasks.get(payload.taskId);
-            if (running) running.lastProgressAt = Date.now();
-          }
-        });
-      }
-      process.stdout.write(`[daemon] dispatch done task=${payload.taskId}
-`);
-    } catch (err) {
-      this.lastTaskError = {
-        taskId: payload.taskId,
-        message: err.message,
-        at: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      process.stderr.write(`[daemon] dispatch threw task=${payload.taskId}: ${err.stack ?? err.message}
-`);
-    } finally {
-      this.runningTasks.delete(payload.taskId);
+      this.db?.close();
+    } catch {
     }
+    this.state = "idle";
+    this.emit("stopped");
   }
-  onTaskCancel(payload) {
-    const entry = this.runningTasks.get(payload.taskId);
-    if (entry) entry.ctrl.abort();
+  isRunning() {
+    return this.state === "running";
+  }
+  /**
+   * Phase 1 escape hatch — see `DispatchPayload.shellCommand`. Spawns
+   * `bash -c <cmd>` with cwd=/workspace, mirrors output to pod logs.
+   * Fire-and-forget; nothing here writes back to cloud.
+   */
+  async runShellCommand(taskId, command) {
+    const { spawn: spawn7 } = await import("child_process");
+    process.stdout.write(`[daemon] shellCommand task=${taskId} cmd=${command}
+`);
+    const child = spawn7("bash", ["-c", command], {
+      cwd: "/workspace",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env }
+    });
+    child.stdout?.on(
+      "data",
+      (d) => process.stdout.write(`[shellCommand:${taskId}] ${d.toString()}`)
+    );
+    child.stderr?.on(
+      "data",
+      (d) => process.stderr.write(`[shellCommand:${taskId}] ${d.toString()}`)
+    );
+    child.on(
+      "exit",
+      (code) => process.stdout.write(`[daemon] shellCommand task=${taskId} exit=${code}
+`)
+    );
   }
-  onAgentChanged(payload) {
-    const a = this.hostedAgents.get(payload.agentImUserId);
-    if (!a) return;
-    if (typeof payload.fields.displayName === "string") a.name = payload.fields.displayName;
-    if (Array.isArray(payload.fields.capabilities)) a.capabilities = payload.fields.capabilities;
+  snapshotState() {
+    return {
+      daemonId: this.config?.daemon_id ?? "",
+      cloudBaseUrl: this.config?.cloud_api_base,
+      workspaceId: this.workspaceId || null,
+      pid: process.pid,
+      startedAt: this.startedAt,
+      wsConnected: this.wsConnected,
+      hostedAgents: Array.from(this.hostedAgents.values()).map((a) => ({
+        imUserId: a.imUserId,
+        name: a.name,
+        adapterName: a.adapterName
+      })),
+      runningTaskIds: Array.from(this.runningTasks.keys()),
+      observability: {
+        adapters: this.snapshotAdapterObservability(),
+        ...this.lastTaskError ? { lastTaskError: this.lastTaskError } : {}
+      }
+    };
   }
-  async onAgentProfileChanged(payload) {
-    try {
-      await this.syncProfileFromCloud(payload.profileId);
-      if (this.wsConnected) this.sendDeclare();
-    } catch (err) {
-      this.emit("sync-error", err);
+  /**
+   * Re-read the local `agents` table (populated by `prismer agent register`)
+   * and re-populate `hostedAgents` map. Profiles per agent come from local
+   * `agent_profiles` table (filled by host.acked sync).
+   */
+  loadAgentsFromDb() {
+    this.hostedAgents.clear();
+    const agents = this.db.prepare("SELECT * FROM agents").all();
+    const profilesByAgent = /* @__PURE__ */ new Map();
+    const allProfiles = this.db.prepare("SELECT id, agent_im_user_id, version FROM agent_profiles WHERE deleted_at IS NULL").all();
+    for (const p of allProfiles) {
+      const list = profilesByAgent.get(p.agent_im_user_id) ?? [];
+      list.push({ id: p.id, version: p.version });
+      profilesByAgent.set(p.agent_im_user_id, list);
+    }
+    for (const a of agents) {
+      let caps = [];
+      try {
+        caps = JSON.parse(a.capabilities);
+      } catch {
+        caps = [];
+      }
+      this.setHostedAgent({
+        imUserId: a.im_user_id,
+        name: a.name,
+        adapterName: a.adapter_name,
+        capabilities: caps,
+        profiles: profilesByAgent.get(a.im_user_id) ?? []
+      });
     }
   }
-  async syncProfileFromCloud(profileId) {
-    const profile = await this.cloud.get(`/api/im/agent_profiles/${encodeURIComponent(profileId)}`);
-    const agent = await this.resolveOwnedAgent(profile.agentImUserId);
-    const adapter = this.registry.get(profile.adapterName);
-    const capabilities = agent?.card?.capabilities?.length ? agent.card.capabilities : adapter?.capabilities ?? [];
-    const name = agent?.card?.name || agent?.displayName || agent?.username || profile.agentImUserId;
+  /**
+   * Register an in-process AgentProfile snapshot (called by agent CLI / sync layer).
+   * Used to populate the `agents` list in agent.host.declare.
+   */
+  setHostedAgent(agent) {
+    this.hostedAgents.set(agent.imUserId, {
+      imUserId: agent.imUserId,
+      name: agent.name,
+      adapterName: agent.adapterName,
+      capabilities: agent.capabilities,
+      profiles: new Map(agent.profiles.map((p) => [p.id, p.version]))
+    });
+  }
+  async installHostedAgent(payload) {
     const now = Date.now();
-    const tx = this.db.transaction(() => {
+    const tx = this.db.transaction((p) => {
       this.db.prepare(
         `INSERT OR REPLACE INTO agents
            (im_user_id, workspace_id, name, adapter_name, capabilities, status, version, synced_at, dirty)
            VALUES (?, ?, ?, ?, ?, 'offline', 1, ?, 0)`
-      ).run(
-        profile.agentImUserId,
-        profile.workspaceId,
-        name,
-        profile.adapterName,
-        JSON.stringify(capabilities),
-        now
-      );
+      ).run(p.imUserId, p.workspaceId, p.name, p.adapterName, JSON.stringify(p.capabilities), now);
       this.db.prepare(
         `INSERT OR REPLACE INTO agent_profiles
            (id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at, dirty, deleted_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, NULL)`
       ).run(
-        profile.id,
-        profile.workspaceId,
-        profile.agentImUserId,
-        profile.adapterName,
-        profile.name,
-        JSON.stringify(profile.config ?? {}),
-        profile.version,
+        p.profile.id,
+        p.workspaceId,
+        p.imUserId,
+        p.profile.adapterName,
+        p.profile.name,
+        JSON.stringify(p.profile.config ?? {}),
+        p.profile.version,
         now
       );
     });
-    tx();
+    tx(payload);
     this.loadAgentsFromDb();
-    process.stdout.write(
-      `[daemon] profile synced agent=${profile.agentImUserId} profile=${profile.id} adapter=${profile.adapterName}
-`
-    );
-  }
-  async resolveOwnedAgent(agentImUserId) {
-    try {
-      const agents = await this.cloud.get("/api/im/me/agents");
-      return agents.find((agent) => agent.id === agentImUserId) ?? null;
-    } catch (err) {
-      process.stderr.write(
-        `[daemon] owned agent lookup skipped agent=${agentImUserId}: ${err.message}
-`
-      );
-      return null;
-    }
-  }
-  async onWorkspaceChanged(payload) {
-    if (payload.workspaceId !== this.workspaceId) return;
-    try {
-      await this.cloud.get(`/api/im/workspaces/${encodeURIComponent(payload.workspaceId)}`);
-    } catch (err) {
-      this.emit("sync-error", err);
-    }
-  }
-  onWorkspaceFileChanged(payload) {
-    if (payload.operation === "delete") {
-      this.db.prepare("DELETE FROM workspace_files_mirror WHERE workspace_id = ? AND path = ?").run(payload.workspaceId, payload.path);
-      return;
-    }
-    if (payload.assetId && payload.contentHash) {
-      this.db.prepare(
-        `INSERT OR REPLACE INTO workspace_files_mirror
-           (workspace_id, path, asset_id, content_hash, version, synced_at, dirty)
-           VALUES (?, ?, ?, ?, ?, ?, 0)`
-      ).run(
-        payload.workspaceId,
-        payload.path,
-        payload.assetId,
-        payload.contentHash,
-        payload.version,
-        Date.now()
-      );
-    }
-  }
-  snapshotAdapterObservability() {
-    const agents = Array.from(this.hostedAgents.values());
-    const counts = agents.reduce((acc, agent) => {
-      acc[agent.adapterName] = (acc[agent.adapterName] ?? 0) + 1;
-      return acc;
-    }, {});
+    if (this.wsConnected) this.sendDeclare();
     return {
-      hostedCounts: counts,
-      servicePoolSize: this.servicePool?.size() ?? 0,
-      hermes: {
-        hostedAgents: counts.hermes ?? 0,
-        runningTaskIds: Array.from(this.runningTasks.keys())
-      }
-    };
-  }
-  /**
-   * SyncWorker FlushFn — pushes local writes to cloud.
-   *
-   * Maps:
-   *   workspace      → PATCH /api/im/workspaces/:id
-   *   agent_profile  → PATCH /api/im/agent_profiles/:id
-   *   agent          → PATCH /api/im/agents/:imUserId
-   * On 'create' we POST instead. On 'delete' we DELETE.
-   */
-  /**
-   * SyncWorker FlushFn — pushes one local sync row to cloud via CloudClient.
-   *
-   * resource_type × operation → endpoint:
-   *   workspace.create      → POST   /api/im/workspaces
-   *   workspace.update      → PATCH  /api/im/workspaces/:id
-   *   workspace.delete      → DELETE /api/im/workspaces/:id
-   *   agent.create          → POST   /api/im/register   (the only public path
-   *                                                       that creates an
-   *                                                       IMUser of role='agent')
-   *   agent.update          → PATCH  /api/im/agents/:id
-   *   agent.delete          → DELETE /api/im/agents/:id
-   *   agent_profile.create  → POST   /api/im/agent_profiles
-   *   agent_profile.update  → PATCH  /api/im/agent_profiles/:id
-   *   agent_profile.delete  → DELETE /api/im/agent_profiles/:id
-   *
-   * Error classification per docs/refactor/13-error-handling.md §2.1 / §2.7:
-   *   2xx           → ok:true   (SyncWorker drops the row)
-   *   408 / 429     → retryable (SyncWorker re-queues with exponential backoff)
-   *   5xx / net err → retryable
-   *   4xx (other)   → permanent (SyncWorker marks failed; 409 is conflict)
-   */
-  async flushSyncRow(row) {
-    const op = `${row.resource_type}.${row.operation}`;
-    const id = encodeURIComponent(row.resource_id);
-    const body = row.operation === "delete" ? void 0 : safeJsonParse(row.payload);
-    let method;
-    let path7;
-    switch (op) {
-      case "workspace.create":
-        method = "POST";
-        path7 = "/api/im/workspaces";
-        break;
-      case "workspace.update":
-        method = "PATCH";
-        path7 = `/api/im/workspaces/${id}`;
-        break;
-      case "workspace.delete":
-        method = "DELETE";
-        path7 = `/api/im/workspaces/${id}`;
-        break;
-      // agent.create must use /register — POST /api/im/agents is not exposed.
-      case "agent.create":
-        method = "POST";
-        path7 = "/api/im/register";
-        break;
-      case "agent.update":
-        method = "PATCH";
-        path7 = `/api/im/agents/${id}`;
-        break;
-      case "agent.delete":
-        method = "DELETE";
-        path7 = `/api/im/agents/${id}`;
-        break;
-      case "agent_profile.create":
-        method = "POST";
-        path7 = "/api/im/agent_profiles";
-        break;
-      case "agent_profile.update":
-        method = "PATCH";
-        path7 = `/api/im/agent_profiles/${id}`;
-        break;
-      case "agent_profile.delete":
-        method = "DELETE";
-        path7 = `/api/im/agent_profiles/${id}`;
-        break;
-      default:
-        process.stderr.write(`[daemon] sync flush op=${op} id=${row.id} result=drop (unknown op)
-`);
-        return { ok: false, status: 400, message: `Unknown sync op: ${op}` };
+      ok: true,
+      daemonId: this.config.daemon_id,
+      installedAgent: {
+        imUserId: payload.imUserId,
+        name: payload.name,
+        adapterName: payload.adapterName,
+        profileId: payload.profile.id
+      },
+      hostedAgents: this.snapshotState().hostedAgents
+    };
+  }
+  installStaticHostedAgentFromEnv() {
+    const required = truthy(process.env.PRISMER_STATIC_BINDING_REQUIRED);
+    const rawFile = process.env.PRISMER_HOSTED_AGENT_FILE;
+    const rawJson = process.env.PRISMER_HOSTED_AGENT_JSON;
+    let raw;
+    if (rawFile) {
+      if (!existsSync9(rawFile)) {
+        throw new Error(`PRISMER_HOSTED_AGENT_FILE not found: ${rawFile}`);
+      }
+      raw = readFileSync6(rawFile, "utf8");
+    } else if (rawJson) {
+      raw = rawJson;
     }
-    let res;
+    if (!raw) {
+      if (required) {
+        throw new Error("static binding required, but PRISMER_HOSTED_AGENT_JSON/PRISMER_HOSTED_AGENT_FILE is missing");
+      }
+      return;
+    }
+    let payload;
     try {
-      res = await this.cloud.request(method, path7, { body });
+      payload = validateStaticHostedAgent(JSON.parse(raw));
     } catch (err) {
-      process.stderr.write(
-        `[daemon] sync flush op=${op} id=${row.id} result=retry (threw: ${err.message})
-`
-      );
-      return { ok: false, status: 0, message: err.message };
-    }
-    let label;
-    if (res.ok) {
-      label = "ok";
-    } else if (res.status === 0 || res.status === 408 || res.status === 429 || res.status >= 500) {
-      label = "retry";
-    } else {
-      label = "drop";
+      throw new Error(`invalid static hosted agent binding: ${err.message}`);
     }
+    const now = Date.now();
+    const tx = this.db.transaction((p) => {
+      this.db.prepare(
+        `INSERT OR REPLACE INTO agents
+           (im_user_id, workspace_id, name, adapter_name, capabilities, status, version, synced_at, dirty)
+           VALUES (?, ?, ?, ?, ?, 'offline', 1, ?, 0)`
+      ).run(p.imUserId, p.workspaceId, p.name, p.adapterName, JSON.stringify(p.capabilities), now);
+      this.db.prepare(
+        `INSERT OR REPLACE INTO agent_profiles
+           (id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at, dirty, deleted_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, NULL)`
+      ).run(
+        p.profile.id,
+        p.workspaceId,
+        p.imUserId,
+        p.profile.adapterName,
+        p.profile.name,
+        JSON.stringify(p.profile.config ?? {}),
+        p.profile.version,
+        now
+      );
+    });
+    tx(payload);
     process.stdout.write(
-      `[daemon] sync flush op=${op} id=${row.id} result=${label}${res.ok ? "" : ` status=${res.status}`}
+      `[daemon] static binding loaded agent=${payload.imUserId} profile=${payload.profile.id} adapter=${payload.adapterName}
 `
     );
-    return { ok: res.ok, status: res.status, message: res.error?.message };
-  }
-};
-function readTargetDaemonId(payload) {
-  if (typeof payload.targetDaemonId === "string" && payload.targetDaemonId.length > 0) {
-    return payload.targetDaemonId;
-  }
-  const execution = payload.metadata?.execution;
-  if (execution && typeof execution === "object" && !Array.isArray(execution)) {
-    const value = execution.targetDaemonId;
-    return typeof value === "string" && value.length > 0 ? value : null;
-  }
-  return null;
-}
-function truthy(raw) {
-  return raw === "1" || raw === "true" || raw === "yes";
-}
-function validateStaticHostedAgent(raw) {
-  if (!raw || typeof raw !== "object") throw new Error("binding must be a JSON object");
-  const obj = raw;
-  const profile = obj.profile;
-  const capabilities = obj.capabilities;
-  if (typeof obj.workspaceId !== "string" || obj.workspaceId.length === 0) throw new Error("workspaceId is required");
-  if (typeof obj.imUserId !== "string" || obj.imUserId.length === 0) throw new Error("imUserId is required");
-  if (typeof obj.name !== "string" || obj.name.length === 0) throw new Error("name is required");
-  if (typeof obj.adapterName !== "string" || obj.adapterName.length === 0) throw new Error("adapterName is required");
-  if (!Array.isArray(capabilities) || capabilities.some((v) => typeof v !== "string")) {
-    throw new Error("capabilities must be a string array");
-  }
-  if (!profile || typeof profile !== "object") throw new Error("profile is required");
-  if (typeof profile.id !== "string" || profile.id.length === 0) throw new Error("profile.id is required");
-  if (typeof profile.name !== "string" || profile.name.length === 0) throw new Error("profile.name is required");
-  if (typeof profile.adapterName !== "string" || profile.adapterName.length === 0) {
-    throw new Error("profile.adapterName is required");
-  }
-  if (profile.config !== void 0 && (!profile.config || typeof profile.config !== "object" || Array.isArray(profile.config))) {
-    throw new Error("profile.config must be a JSON object");
-  }
-  return {
-    workspaceId: obj.workspaceId,
-    imUserId: obj.imUserId,
-    name: obj.name,
-    adapterName: obj.adapterName,
-    capabilities,
-    profile: {
-      id: profile.id,
-      name: profile.name,
-      adapterName: profile.adapterName,
-      config: profile.config ?? {},
-      version: typeof profile.version === "number" && Number.isFinite(profile.version) ? profile.version : 1
-    }
-  };
-}
-function safeJsonParse(raw) {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return raw;
-  }
-}
-
-// src/pair.ts
-import { generateKeyPairSync } from "crypto";
-import { hostname } from "os";
-import { setTimeout as sleep } from "timers/promises";
-import qrcode from "qrcode";
-async function pair(opts) {
-  const paths = opts.paths ?? resolvePaths();
-  if (configExists(paths) && !opts.force) {
-    throw new Error(
-      `Config already exists at ${paths.configFile}. Pass --force to overwrite, or run \`prismer status\` to inspect.`
-    );
-  }
-  const isLocalOnly = opts.isLocalOnly ?? (() => process.env.LOCAL_ONLY === "1");
-  const localOnlyMode = !!opts.asUserEmail;
-  if (localOnlyMode && !isLocalOnly()) {
-    throw new Error(
-      "pair: --as-user requires LOCAL_ONLY=1. Without that gate, this would skip mobile approval and silently mint a key for the named user."
-    );
   }
-  const { publicKey } = generateKeyPairSync("ed25519");
-  const devicePub = publicKey.export({ format: "der", type: "spki" }).toString("base64");
-  const cloud = new CloudClient({
-    baseUrl: opts.cloudBaseUrl,
-    apiKey: "pending",
-    // not used: we pass auth:false
-    fetchImpl: opts.fetchImpl
-  });
-  const offerRes = await cloud.request(
-    "POST",
-    "/api/im/pair/offer",
-    {
-      auth: false,
-      body: { devicePub, deviceName: opts.deviceName ?? hostname() }
-    }
-  );
-  if (!offerRes.ok) {
-    throw new Error(`pair: offer failed (${offerRes.status}): ${offerRes.error?.message}`);
+  // ───────────────────────────── internals ─────────────────────────────
+  wireWsHandlers() {
+    this.ws.on("open", () => {
+      this.wsConnected = true;
+      process.stdout.write(`[daemon] ws open, awaiting server authenticated ack
+`);
+    });
+    this.ws.on("close", (code, reason) => {
+      this.wsConnected = false;
+      process.stdout.write(`[daemon] ws closed (code=${code ?? "?"}, reason=${reason ?? ""})
+`);
+    });
+    this.ws.on("error", (err) => {
+      process.stderr.write(`[daemon] ws error: ${err.message}
+`);
+    });
+    this.ws.on("auth-failed", () => {
+      process.stderr.write(`[daemon] ws auth-failed (close code 4001) \u2014 check API key
+`);
+      this.emit("auth-failed");
+    });
+    this.ws.on("reconnect-scheduled", (delayMs) => {
+      process.stdout.write(`[daemon] ws reconnect in ${delayMs}ms
+`);
+    });
+    this.ws.on("message", (msg) => {
+      const m = msg;
+      if (m?.type) process.stdout.write(`[daemon] ws msg \u2190 ${m.type}
+`);
+      if (m?.type === "error") {
+        process.stderr.write(`[daemon] ws error payload: ${JSON.stringify(msg)}
+`);
+        const code = m.payload?.code;
+        if (code === "AUTH_FAILED" || code === "AUTH_REQUIRED" || code === "auth_invalid") {
+          process.stderr.write(`[daemon] application auth failure (${code}) \u2014 stopping daemon
+`);
+          this.emit("auth-failed");
+        }
+      }
+      if (m?.type === "authenticated") {
+        process.stdout.write(`[daemon] ws authenticated, sending agent.host.declare (${this.hostedAgents.size} agents)
+`);
+        this.sendDeclare();
+        return;
+      }
+      this.handleIncoming(msg);
+    });
   }
-  const offer = unwrapEnvelope(offerRes.data);
-  if (!offer.nonce || !offer.qrUrl) {
-    throw new Error("pair: cloud returned no nonce/qrUrl");
+  sendDeclare() {
+    const payload = {
+      daemonId: this.config.daemon_id,
+      daemonVersion: this.opts.daemonVersion ?? "0.0.0",
+      platform: platform() === "win32" ? "win32" : platform() === "linux" ? "linux" : "darwin",
+      agents: Array.from(this.hostedAgents.values()).map((a) => ({
+        imUserId: a.imUserId,
+        name: a.name,
+        adapterName: a.adapterName,
+        capabilities: a.capabilities,
+        profiles: Array.from(a.profiles.entries()).map(([id, version]) => ({ id, version }))
+      }))
+    };
+    this.ws.send(envelope("agent.host.declare", payload, this.config.daemon_id));
   }
-  if (localOnlyMode) {
-    const approveRes = await cloud.request(
-      "POST",
-      "/api/im/pair/local-only-approve",
-      {
-        auth: false,
-        body: { nonce: offer.nonce, asUserEmail: opts.asUserEmail }
-      }
-    );
-    if (!approveRes.ok) {
-      throw new Error(
-        `pair: local-only-approve failed (${approveRes.status}): ${approveRes.error?.message ?? "unknown"}`
-      );
+  handleIncoming(msg) {
+    switch (msg.type) {
+      case "host.acked":
+        void this.onHostAcked(msg.payload);
+        return;
+      case "task.dispatch.request":
+        void this.onTaskDispatch(msg.payload, msg.requestId);
+        return;
+      case "task.cancel":
+        this.onTaskCancel(msg.payload);
+        return;
+      case "agent.changed":
+        this.onAgentChanged(msg.payload);
+        return;
+      case "agent_profile.changed":
+        void this.onAgentProfileChanged(msg.payload);
+        return;
+      case "workspace.changed":
+        void this.onWorkspaceChanged(msg.payload);
+        return;
+      case "workspace_file.changed":
+        this.onWorkspaceFileChanged(msg.payload);
+        return;
+      case "asset.changed":
+        void this.onAssetChanged(msg.payload);
+        return;
+      default:
+        this.emit("unknown-message", msg);
     }
-    process.stdout.write(`[pair] LOCAL_ONLY approved as ${opts.asUserEmail} \u2014 no QR shown
-`);
-  } else {
-    const qrAscii = await qrcode.toString(offer.qrUrl, { type: "terminal", small: true });
-    process.stdout.write(qrAscii);
-    process.stdout.write(`
-Scan with Lumin to approve, or open: ${offer.qrUrl}
-
-`);
-    opts.onQrReady?.(offer.qrUrl);
   }
-  const pollPath = `/api/im/pair/poll/${encodeURIComponent(offer.nonce)}?devicePub=${encodeURIComponent(devicePub)}`;
-  const maxAttempts = opts.maxPollAttempts ?? 60;
-  const pollIntervalMs = opts.pollIntervalMs ?? 5e3;
-  for (let i = 0; i < maxAttempts; i += 1) {
-    if (i > 0 || !localOnlyMode) {
-      await sleep(pollIntervalMs);
+  async onHostAcked(payload) {
+    this.workspaceId = payload.workspaceId;
+    if (this.memoryWiring && this.workspaceId) {
+      syncMemoryFromCloud(this.memoryWiring, this.cloud, [this.workspaceId]).catch(
+        (err) => console.error("[Daemon] Initial memory sync failed:", err.message)
+      );
     }
-    const res = await cloud.request(
-      "GET",
-      pollPath,
-      { auth: false }
+    this.syncAssetMetadata(this.workspaceId).catch(
+      (err) => console.error("[Daemon] Asset metadata sync failed:", err.message)
     );
-    if (res.ok) {
-      const body = unwrapEnvelope(res.data);
-      if (body.apiKey) {
-        const config = {
-          api_key: body.apiKey,
-          cloud_api_base: opts.cloudBaseUrl,
-          daemon_id: newDaemonId()
-        };
-        saveConfig(config, paths);
-        return { config, paths };
+    for (const id of payload.profilesToSync) {
+      try {
+        await this.syncProfileFromCloud(id);
+      } catch (err) {
+        this.emit("sync-error", err);
       }
     }
-    if (res.status === 404 || res.status === 202) {
-      continue;
-    }
-    if (res.status >= 400 && res.status !== 404) {
-      throw new Error(`pair: poll failed (${res.status}): ${res.error?.message}`);
-    }
-  }
-  throw new Error("pair: timed out waiting for approval (5 min)");
-}
-function unwrapEnvelope(raw) {
-  if (raw && typeof raw === "object" && "ok" in raw) {
-    const env = raw;
-    if (env.ok && env.data) return env.data;
-  }
-  return raw;
-}
-
-// src/cli/index.ts
-import { Command as Command18 } from "commander";
-
-// src/cli/commands/adapter.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import {
-  copyFileSync,
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
-  statSync as statSync2,
-  writeFileSync as writeFileSync6
-} from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname7, join as join10 } from "path";
-import { Command } from "commander";
-
-// src/cli/util.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
-import { join as join9 } from "path";
-
-// src/cli/ui.ts
-import * as fs4 from "fs";
-import * as path6 from "path";
-import { fileURLToPath } from "url";
-var BRAILLE_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var COMPACT_BANNER = ["\u25C7 PRISMER", "  Runtime CLI"];
-function thisDirname() {
-  try {
-    return path6.dirname(fileURLToPath(import.meta.url));
-  } catch {
-    return process.cwd();
+    if (payload.profilesToSync.length > 0 && this.wsConnected) this.sendDeclare();
+    this.emit("host-acked", payload);
   }
-}
-function findIconPath(size = "big") {
-  const name = size === "big" ? "icon" : "smallicon";
-  const here = thisDirname();
-  const candidates = [
-    // npm-installed: node_modules/@prismer/runtime/dist/cli.js → ../assets
-    path6.resolve(here, "../assets", name),
-    // alternate dist layout (sub-bundle): dist/bin/cli.js → ../../assets
-    path6.resolve(here, "../../assets", name),
-    // source/typecheck: src/cli/ui.ts → ../../assets
-    path6.resolve(here, "../../assets", name),
-    // dev mode: cwd happens to be runtime root
-    path6.resolve(process.cwd(), "assets", name),
-    path6.resolve(process.cwd(), "sdk/prismer-cloud/runtime/assets", name)
-  ];
-  for (const candidate of candidates) {
-    try {
-      if (fs4.existsSync(candidate)) return candidate;
-    } catch {
+  async onTaskDispatch(payload, requestId) {
+    const targetDaemonId = readTargetDaemonId(payload);
+    if (targetDaemonId && targetDaemonId !== this.config.daemon_id) {
+      process.stdout.write(
+        `[daemon] dispatch skip task=${payload.taskId} targetDaemonId=${targetDaemonId} local=${this.config.daemon_id}
+`
+      );
+      return;
     }
-  }
-  return null;
-}
-var UI = class {
-  mode;
-  colorEnabled;
-  stream;
-  errStream;
-  constructor(opts) {
-    this.mode = opts?.mode ?? "pretty";
-    this.stream = opts?.stream ?? process.stdout;
-    this.errStream = opts?.errStream ?? process.stderr;
-    if (opts?.color !== void 0) {
-      this.colorEnabled = opts.color;
-    } else {
-      const isTTY = this.stream.isTTY === true;
-      const noColor = Boolean(process.env["NO_COLOR"]);
-      this.colorEnabled = isTTY && !noColor;
+    if (this.runningTasks.has(payload.taskId)) {
+      process.stdout.write(`[daemon] dispatch dup task=${payload.taskId} (already in-flight, skipping)
+`);
+      return;
     }
-  }
-  // ---- Internal color helpers ----
-  ansi(open, close, text) {
-    if (!this.colorEnabled) return text;
-    return `\x1B[${open}m${text}\x1B[${close}m`;
-  }
-  green(t) {
-    return this.ansi(32, 39, t);
-  }
-  red(t) {
-    return this.ansi(31, 39, t);
-  }
-  yellow(t) {
-    return this.ansi(33, 39, t);
-  }
-  cyan(t) {
-    return this.ansi(36, 39, t);
-  }
-  dim(t) {
-    return this.ansi(2, 22, t);
-  }
-  bold(t) {
-    return this.ansi(1, 22, t);
-  }
-  gray(t) {
-    return this.ansi(90, 39, t);
-  }
-  brandMark() {
-    return this.cyan("\u25C7");
-  }
-  colorBrandLine(line) {
-    let out = "";
-    for (const ch of line) {
-      if (ch === "\u2592") {
-        out += this.cyan(ch);
-      } else if (ch === "\u2593") {
-        out += this.dim(ch);
+    process.stdout.write(
+      `[daemon] dispatch start task=${payload.taskId} route=${payload.runtimeRoute ?? "agent"} agent=${payload.agentImUserId ?? "-"} daemon=${payload.targetDaemonId ?? "-"}
+`
+    );
+    const ctrl = new AbortController();
+    this.runningTasks.set(payload.taskId, {
+      ctrl,
+      startedAt: Date.now(),
+      lastProgressAt: Date.now(),
+      timeoutMs: typeof payload.timeoutMs === "number" ? payload.timeoutMs : 0
+    });
+    try {
+      if (isShellDispatch(payload)) {
+        const reply = await executeShellDispatch(payload, {
+          config: this.shellConfig,
+          workspaceId: this.workspaceId,
+          signal: ctrl.signal,
+          onProgress: (progressPayload) => {
+            const running = this.runningTasks.get(payload.taskId);
+            if (running) running.lastProgressAt = Date.now();
+            this.ws.send(envelope("task.dispatch.progress", progressPayload));
+          }
+        });
+        this.ws.send(envelope("task.dispatch.reply", reply, requestId));
       } else {
-        out += ch;
+        await handleDispatch(payload, requestId, {
+          registry: this.registry,
+          cloud: this.cloud,
+          uriResolver: this.uriResolver,
+          assetCache: this.assetCache,
+          ws: this.ws,
+          outboxWatcher: this.outboxWatcher,
+          paths: this.paths,
+          signal: ctrl.signal,
+          ensureService: (profile, adapter) => this.servicePool.ensureService(profile, adapter),
+          assetMetadataIndexes: this.assetMetadataIndexes,
+          onProgress: () => {
+            const running = this.runningTasks.get(payload.taskId);
+            if (running) running.lastProgressAt = Date.now();
+          }
+        });
       }
+      process.stdout.write(`[daemon] dispatch done task=${payload.taskId}
+`);
+    } catch (err) {
+      this.lastTaskError = {
+        taskId: payload.taskId,
+        message: err.message,
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      process.stderr.write(`[daemon] dispatch threw task=${payload.taskId}: ${err.stack ?? err.message}
+`);
+    } finally {
+      this.runningTasks.delete(payload.taskId);
     }
-    return out;
   }
-  // ---- Core write helpers ----
-  write(text) {
-    this.stream.write(text);
+  onTaskCancel(payload) {
+    const entry = this.runningTasks.get(payload.taskId);
+    if (entry) entry.ctrl.abort();
+  }
+  onAgentChanged(payload) {
+    const a = this.hostedAgents.get(payload.agentImUserId);
+    if (!a) return;
+    if (typeof payload.fields.displayName === "string") a.name = payload.fields.displayName;
+    if (Array.isArray(payload.fields.capabilities)) a.capabilities = payload.fields.capabilities;
   }
-  writeErr(text) {
-    this.errStream.write(text);
+  async onAgentProfileChanged(payload) {
+    try {
+      await this.syncProfileFromCloud(payload.profileId);
+      if (this.wsConnected) this.sendDeclare();
+    } catch (err) {
+      this.emit("sync-error", err);
+    }
   }
-  // ---- Level 1: Header ----
-  header(text) {
-    if (this.mode === "json") return;
-    const prefix = text.startsWith("Prismer") ? this.brandMark() + " " : "";
-    this.write(prefix + this.bold(text) + "\n");
+  async syncProfileFromCloud(profileId) {
+    const profile = await this.cloud.get(`/api/im/agent_profiles/${encodeURIComponent(profileId)}`);
+    const agent = await this.resolveOwnedAgent(profile.agentImUserId);
+    const adapter = this.registry.get(profile.adapterName);
+    const capabilities = agent?.card?.capabilities?.length ? agent.card.capabilities : adapter?.capabilities ?? [];
+    const name = agent?.card?.name || agent?.displayName || agent?.username || profile.agentImUserId;
+    const now = Date.now();
+    const tx = this.db.transaction(() => {
+      this.db.prepare(
+        `INSERT OR REPLACE INTO agents
+           (im_user_id, workspace_id, name, adapter_name, capabilities, status, version, synced_at, dirty)
+           VALUES (?, ?, ?, ?, ?, 'offline', 1, ?, 0)`
+      ).run(
+        profile.agentImUserId,
+        profile.workspaceId,
+        name,
+        profile.adapterName,
+        JSON.stringify(capabilities),
+        now
+      );
+      this.db.prepare(
+        `INSERT OR REPLACE INTO agent_profiles
+           (id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at, dirty, deleted_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, NULL)`
+      ).run(
+        profile.id,
+        profile.workspaceId,
+        profile.agentImUserId,
+        profile.adapterName,
+        profile.name,
+        JSON.stringify(profile.config ?? {}),
+        profile.version,
+        now
+      );
+    });
+    tx();
+    this.loadAgentsFromDb();
+    process.stdout.write(
+      `[daemon] profile synced agent=${profile.agentImUserId} profile=${profile.id} adapter=${profile.adapterName}
+`
+    );
   }
-  smallHeader(subtitle) {
-    if (this.mode === "json" || this.mode === "quiet") return;
-    const iconPath = findIconPath("small");
-    if (iconPath !== null) {
-      try {
-        const raw = fs4.readFileSync(iconPath, "utf-8").replace(/\n+$/, "");
-        for (const line of raw.split("\n")) {
-          this.write(this.cyan(line) + "\n");
-        }
-      } catch {
-        this.write(this.brandMark() + " " + this.bold("Prismer") + "\n");
-      }
-    } else {
-      this.write(this.brandMark() + " " + this.bold("Prismer") + "\n");
+  async resolveOwnedAgent(agentImUserId) {
+    try {
+      const agents = await this.cloud.get("/api/im/me/agents");
+      return agents.find((agent) => agent.id === agentImUserId) ?? null;
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] owned agent lookup skipped agent=${agentImUserId}: ${err.message}
+`
+      );
+      return null;
     }
-    if (subtitle !== void 0 && subtitle.length > 0) {
-      this.write(this.dim("  " + subtitle) + "\n");
+  }
+  async onWorkspaceChanged(payload) {
+    if (payload.workspaceId !== this.workspaceId) return;
+    try {
+      await this.cloud.get(`/api/im/workspaces/${encodeURIComponent(payload.workspaceId)}`);
+    } catch (err) {
+      this.emit("sync-error", err);
     }
-    this.blank();
   }
-  banner(subtitle, opts) {
-    if (this.mode === "json" || this.mode === "quiet") return;
-    const envColumns = process.env["COLUMNS"] !== void 0 ? parseInt(process.env["COLUMNS"], 10) : NaN;
-    const width = this.stream.columns ?? process.stdout.columns ?? (Number.isFinite(envColumns) ? envColumns : 80);
-    const iconPath = findIconPath("big");
-    const shouldUseFull = opts?.full === true || width >= 120;
-    if (shouldUseFull && iconPath !== null) {
-      try {
-        const raw = fs4.readFileSync(iconPath, "utf-8");
-        const lines = raw.split("\n");
-        for (const line of lines) {
-          const brandedLine = line.replace("Prismer Cloud SDK", "Prismer Runtime CLI");
-          const stripped = brandedLine.trimEnd();
-          if (stripped.length === 0) {
-            this.write("\n");
-            continue;
-          }
-          const clipped = stripped.length >= width ? stripped.slice(0, Math.max(width - 1, 1)) : stripped;
-          this.write(this.colorBrandLine(clipped) + "\n");
-        }
-      } catch {
-        this.write(this.cyan(COMPACT_BANNER[0] ?? "\u25C7 PRISMER") + "\n");
-        this.write(this.dim(COMPACT_BANNER[1] ?? "  Runtime CLI") + "\n");
+  async onAssetChanged(payload) {
+    if (!payload.workspaceId) return;
+    const index = this.assetMetadataIndexes.get(payload.workspaceId);
+    if (!index) return;
+    try {
+      const result = await index.pullDelta();
+      if (result.applied > 0) {
+        console.log(`[Daemon] asset.changed workspace=${payload.workspaceId} applied=${result.applied}`);
       }
-    } else {
-      this.write(this.cyan(COMPACT_BANNER[0] ?? "\u25C7 PRISMER") + "\n");
-      this.write(this.dim(COMPACT_BANNER[1] ?? "  Runtime CLI") + "\n");
-    }
-    if (subtitle !== void 0 && subtitle.length > 0) {
-      this.write(this.dim("  " + subtitle) + "\n");
-    }
-    this.blank();
-  }
-  // ---- Level 2: Primary data ----
-  blank() {
-    if (this.mode === "json") return;
-    this.write("\n");
-  }
-  line(text) {
-    if (this.mode === "json") return;
-    this.write(text + "\n");
-  }
-  info(text) {
-    this.line(text);
-  }
-  // ---- Level 3: Secondary ----
-  secondary(text, indent = 2) {
-    if (this.mode === "json") return;
-    this.write(" ".repeat(indent) + this.dim(text) + "\n");
-  }
-  // ---- Level 4: Action tips ----
-  tip(text) {
-    if (this.mode === "json") return;
-    this.write(this.cyan("Tip:") + " " + text + "\n");
-  }
-  next(text) {
-    if (this.mode === "json") return;
-    this.write(this.cyan("Next:") + " " + text + "\n");
-  }
-  // ---- Level 5: Status indicators ----
-  ok(text, detail) {
-    if (this.mode === "json") return;
-    const suffix = detail ? "  " + this.dim(detail) : "";
-    this.write("  " + this.green("\u2713") + " " + text + suffix + "\n");
-  }
-  success(text, detail) {
-    this.ok(text, detail);
-  }
-  fail(text, detail) {
-    if (this.mode === "json") return;
-    const suffix = detail ? "  " + this.dim(detail) : "";
-    this.write("  " + this.red("\u2717") + " " + text + suffix + "\n");
-  }
-  online(text) {
-    if (this.mode === "json") return;
-    this.write("  " + this.green("\u25CF") + " " + text + "\n");
-  }
-  offline(text) {
-    if (this.mode === "json") return;
-    this.write("  " + this.gray("\u25CB") + " " + text + "\n");
-  }
-  notInstalled(text) {
-    if (this.mode === "json") return;
-    this.write("  " + this.dim("\xB7") + " " + this.dim(text) + "\n");
-  }
-  pending(text) {
-    if (this.mode === "json") return;
-    this.write("  " + this.yellow("\u27F3") + " " + text + "\n");
-  }
-  warn(text, detail) {
-    if (this.mode === "json") return;
-    const suffix = detail ? "  " + this.dim(detail) : "";
-    this.write("  " + this.yellow("!") + " " + text + suffix + "\n");
-  }
-  // ---- Level 6: Error block ----
-  error(what, cause, fix) {
-    if (this.mode === "json") return;
-    this.writeErr(this.red("\u2717") + " " + what + "\n");
-    if (cause !== void 0) {
-      this.writeErr("  " + this.dim("Cause:") + " " + this.dim(cause) + "\n");
-    }
-    if (fix !== void 0) {
-      this.writeErr("  " + this.cyan("Fix:") + " " + fix + "\n");
-    }
-  }
-  table(rowsOrOpts, maybeOpts) {
-    if (this.mode === "json") return;
-    const rows = Array.isArray(rowsOrOpts) ? rowsOrOpts : rowsOrOpts.rows;
-    const opts = Array.isArray(rowsOrOpts) ? maybeOpts : { columns: rowsOrOpts.columns, maxWidth: rowsOrOpts.maxWidth };
-    if (!opts) throw new Error("table() requires columns");
-    const maxWidth = opts.maxWidth ?? (process.stdout.columns || 80);
-    const cols = opts.columns;
-    const widths = cols.map((col) => col.length);
-    for (const row of rows) {
-      cols.forEach((col, i) => {
-        const val = row[col] ?? "";
-        const w = widths[i] ?? 0;
-        if (val.length > w) widths[i] = val.length;
-      });
+    } catch (err) {
+      console.error(`[Daemon] asset.changed pullDelta failed workspace=${payload.workspaceId}:`, err.message);
     }
-    const totalWidth = widths.reduce((a, b) => a + b, 0) + (cols.length - 1) * 2 + 2;
-    if (totalWidth > maxWidth) {
-      for (let i = 0; i < rows.length; i++) {
-        const row = rows[i];
-        if (!row) continue;
-        for (const col of cols) {
-          const val = row[col] ?? "";
-          this.write("  " + this.bold(col + ":") + " " + val + "\n");
-        }
-        if (i < rows.length - 1) this.write("\n");
-      }
+  }
+  onWorkspaceFileChanged(payload) {
+    if (payload.operation === "delete") {
+      this.db.prepare("DELETE FROM workspace_files_mirror WHERE workspace_id = ? AND path = ?").run(payload.workspaceId, payload.path);
       return;
     }
-    const header = cols.map((col, i) => col.toUpperCase().padEnd(widths[i] ?? col.length)).join("  ");
-    this.write("  " + this.dim(header) + "\n");
-    for (const row of rows) {
-      const line = cols.map((col, i) => (row[col] ?? "").padEnd(widths[i] ?? col.length)).join("  ");
-      this.write("  " + line + "\n");
+    if (payload.assetId && payload.contentHash) {
+      this.db.prepare(
+        `INSERT OR REPLACE INTO workspace_files_mirror
+           (workspace_id, path, asset_id, content_hash, version, synced_at, dirty)
+           VALUES (?, ?, ?, ?, ?, ?, 0)`
+      ).run(
+        payload.workspaceId,
+        payload.path,
+        payload.assetId,
+        payload.contentHash,
+        payload.version,
+        Date.now()
+      );
     }
   }
-  // ---- Spinner ----
-  spinner(text) {
-    if (this.mode === "quiet" || this.mode === "json") {
-      return {
-        update() {
-        },
-        stop() {
-        }
-      };
-    }
-    const isTTY = this.stream.isTTY === true;
-    if (!isTTY || !this.colorEnabled) {
-      this.write("  " + this.yellow("\u27F3") + " " + text + "\n");
-      return {
-        update: (t) => {
-          this.write("  " + this.yellow("\u27F3") + " " + t + "\n");
-        },
-        stop: (final) => {
-          if (final) this.write("  " + this.green("\u2713") + " " + final + "\n");
-        }
-      };
-    }
-    let current = text;
-    let frameIdx = 0;
-    let stopped = false;
-    const write = this.write.bind(this);
-    const colorFn = this.yellow.bind(this);
-    const greenFn = this.green.bind(this);
-    function renderFrame() {
-      const frame = BRAILLE_FRAMES[frameIdx % BRAILLE_FRAMES.length] ?? "\u280B";
-      const line = "  " + colorFn(frame) + " " + current;
-      write("\r" + line);
-      frameIdx++;
-    }
-    renderFrame();
-    const timer = setInterval(renderFrame, 80);
+  snapshotAdapterObservability() {
+    const agents = Array.from(this.hostedAgents.values());
+    const counts = agents.reduce((acc, agent) => {
+      acc[agent.adapterName] = (acc[agent.adapterName] ?? 0) + 1;
+      return acc;
+    }, {});
     return {
-      update(t) {
-        if (stopped) return;
-        current = t;
-      },
-      stop(final) {
-        if (stopped) return;
-        stopped = true;
-        clearInterval(timer);
-        write("\r\x1B[2K");
-        if (final) write("  " + greenFn("\u2713") + " " + final + "\n");
+      hostedCounts: counts,
+      servicePoolSize: this.servicePool?.size() ?? 0,
+      hermes: {
+        hostedAgents: counts.hermes ?? 0,
+        runningTaskIds: Array.from(this.runningTasks.keys())
       }
     };
   }
-  // ---- Progress bar ----
-  progress(text, total) {
-    if (this.mode === "quiet" || this.mode === "json") {
-      return {
-        update() {
-        },
-        stop() {
-        }
-      };
+  /**
+   * Ensure an AssetMetadataIndex exists for the given workspace and pull
+   * delta from cloud. Idempotent — creates the index on first call, reuses
+   * it on subsequent calls. Same cursor-catch-up semantics as WorkspaceMirror.
+   */
+  async syncAssetMetadata(workspaceId) {
+    let index = this.assetMetadataIndexes.get(workspaceId);
+    if (!index) {
+      const stateDir = `${this.paths.root}/${workspaceId}`;
+      index = new AssetMetadataIndex({
+        db: this.db,
+        cloud: this.cloud,
+        workspaceId,
+        workspaceStateDir: stateDir
+      });
+      this.assetMetadataIndexes.set(workspaceId, index);
     }
-    const isTTY = this.stream.isTTY === true;
-    const start = Date.now();
-    const write = this.write.bind(this);
-    const colorFn = this.cyan.bind(this);
-    const dimFn = this.dim.bind(this);
-    const greenFn = this.green.bind(this);
-    let last = 0;
-    let lastDetail = "";
-    let stopped = false;
-    const render = () => {
-      if (stopped) return;
-      const frac = total > 0 ? Math.min(1, Math.max(0, last / total)) : 0;
-      const pct = Math.floor(frac * 100);
-      const width = 20;
-      const filled = Math.floor(frac * width);
-      const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
-      const elapsed = (Date.now() - start) / 1e3;
-      const eta = frac > 0.01 ? Math.max(0, elapsed / frac - elapsed) : 0;
-      const etaStr = frac >= 1 ? "" : ` \xB7 ${eta < 1 ? "<1s" : Math.round(eta) + "s"} left`;
-      const detailStr = lastDetail ? ` \xB7 ${lastDetail}` : "";
-      const line = `  ${text} [${colorFn(bar)}] ${String(pct).padStart(3)}%${detailStr}${dimFn(etaStr)}`;
-      if (isTTY && this.colorEnabled) {
-        write("\r\x1B[2K" + line);
-      } else {
-        write(line + "\n");
-      }
-    };
-    render();
-    return {
-      update: (current, detail) => {
-        if (stopped) return;
-        last = current;
-        if (detail !== void 0) lastDetail = detail;
-        render();
-      },
-      stop: (final) => {
-        if (stopped) return;
-        stopped = true;
-        if (isTTY && this.colorEnabled) write("\r\x1B[2K");
-        if (final) write("  " + greenFn("\u2713") + " " + final + "\n");
-      }
-    };
-  }
-  // ---- JSON output ----
-  json(payload, opts) {
-    const indent = opts?.pretty ? 2 : void 0;
-    this.write(JSON.stringify(payload, null, indent) + "\n");
-  }
-  result(pretty, jsonPayload) {
-    if (this.mode === "pretty") {
-      pretty();
-    } else {
-      this.json(jsonPayload);
+    const result = await index.pullDelta();
+    if (result.applied > 0) {
+      console.log(`[AssetMeta] workspace=${workspaceId}: ${result.applied} applied, cursor=${result.cursor}`);
     }
   }
-};
-var _ui = null;
-function getUI() {
-  if (!_ui) _ui = new UI();
-  return _ui;
-}
-function setUI(ui) {
-  _ui = ui;
-}
-function applyCommonFlags(argv) {
-  let mode = "pretty";
-  const isTTY = process.stdout.isTTY === true;
-  const noColorEnv = Boolean(process.env["NO_COLOR"]);
-  let color2 = isTTY && !noColorEnv;
-  const rest = [];
-  for (const arg of argv) {
-    switch (arg) {
-      case "--no-color":
-        color2 = false;
+  /**
+   * SyncWorker FlushFn — pushes local writes to cloud.
+   *
+   * Maps:
+   *   workspace      → PATCH /api/im/workspaces/:id
+   *   agent_profile  → PATCH /api/im/agent_profiles/:id
+   *   agent          → PATCH /api/im/agents/:imUserId
+   * On 'create' we POST instead. On 'delete' we DELETE.
+   */
+  /**
+   * SyncWorker FlushFn — pushes one local sync row to cloud via CloudClient.
+   *
+   * resource_type × operation → endpoint:
+   *   workspace.create      → POST   /api/im/workspaces
+   *   workspace.update      → PATCH  /api/im/workspaces/:id
+   *   workspace.delete      → DELETE /api/im/workspaces/:id
+   *   agent.create          → POST   /api/im/register   (the only public path
+   *                                                       that creates an
+   *                                                       IMUser of role='agent')
+   *   agent.update          → PATCH  /api/im/agents/:id
+   *   agent.delete          → DELETE /api/im/agents/:id
+   *   agent_profile.create  → POST   /api/im/agent_profiles
+   *   agent_profile.update  → PATCH  /api/im/agent_profiles/:id
+   *   agent_profile.delete  → DELETE /api/im/agent_profiles/:id
+   *
+   * Error classification per docs/refactor/13-error-handling.md §2.1 / §2.7:
+   *   2xx           → ok:true   (SyncWorker drops the row)
+   *   408 / 429     → retryable (SyncWorker re-queues with exponential backoff)
+   *   5xx / net err → retryable
+   *   4xx (other)   → permanent (SyncWorker marks failed; 409 is conflict)
+   */
+  async flushSyncRow(row) {
+    const op = `${row.resource_type}.${row.operation}`;
+    const id = encodeURIComponent(row.resource_id);
+    const body = row.operation === "delete" ? void 0 : safeJsonParse(row.payload);
+    let method;
+    let path7;
+    switch (op) {
+      case "workspace.create":
+        method = "POST";
+        path7 = "/api/im/workspaces";
         break;
-      case "--color":
-        color2 = true;
+      case "workspace.update":
+        method = "PATCH";
+        path7 = `/api/im/workspaces/${id}`;
         break;
-      case "--json":
-      case "--pretty-json":
-        mode = "json";
-        if (arg === "--json") rest.push(arg);
+      case "workspace.delete":
+        method = "DELETE";
+        path7 = `/api/im/workspaces/${id}`;
         break;
-      case "--quiet":
-        mode = "quiet";
+      // agent.create must use /register — POST /api/im/agents is not exposed.
+      case "agent.create":
+        method = "POST";
+        path7 = "/api/im/register";
+        break;
+      case "agent.update":
+        method = "PATCH";
+        path7 = `/api/im/agents/${id}`;
+        break;
+      case "agent.delete":
+        method = "DELETE";
+        path7 = `/api/im/agents/${id}`;
+        break;
+      case "agent_profile.create":
+        method = "POST";
+        path7 = "/api/im/agent_profiles";
+        break;
+      case "agent_profile.update":
+        method = "PATCH";
+        path7 = `/api/im/agent_profiles/${id}`;
+        break;
+      case "agent_profile.delete":
+        method = "DELETE";
+        path7 = `/api/im/agent_profiles/${id}`;
         break;
       default:
-        rest.push(arg);
+        process.stderr.write(`[daemon] sync flush op=${op} id=${row.id} result=drop (unknown op)
+`);
+        return { ok: false, status: 400, message: `Unknown sync op: ${op}` };
+    }
+    let res;
+    try {
+      res = await this.cloud.request(method, path7, { body });
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] sync flush op=${op} id=${row.id} result=retry (threw: ${err.message})
+`
+      );
+      return { ok: false, status: 0, message: err.message };
+    }
+    let label;
+    if (res.ok) {
+      label = "ok";
+    } else if (res.status === 0 || res.status === 408 || res.status === 429 || res.status >= 500) {
+      label = "retry";
+    } else {
+      label = "drop";
+    }
+    process.stdout.write(
+      `[daemon] sync flush op=${op} id=${row.id} result=${label}${res.ok ? "" : ` status=${res.status}`}
+`
+    );
+    return { ok: res.ok, status: res.status, message: res.error?.message };
+  }
+};
+function readTargetDaemonId(payload) {
+  if (typeof payload.targetDaemonId === "string" && payload.targetDaemonId.length > 0) {
+    return payload.targetDaemonId;
+  }
+  const execution = payload.metadata?.execution;
+  if (execution && typeof execution === "object" && !Array.isArray(execution)) {
+    const value = execution.targetDaemonId;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  }
+  return null;
+}
+function truthy(raw) {
+  return raw === "1" || raw === "true" || raw === "yes";
+}
+function validateStaticHostedAgent(raw) {
+  if (!raw || typeof raw !== "object") throw new Error("binding must be a JSON object");
+  const obj = raw;
+  const profile = obj.profile;
+  const capabilities = obj.capabilities;
+  if (typeof obj.workspaceId !== "string" || obj.workspaceId.length === 0) throw new Error("workspaceId is required");
+  if (typeof obj.imUserId !== "string" || obj.imUserId.length === 0) throw new Error("imUserId is required");
+  if (typeof obj.name !== "string" || obj.name.length === 0) throw new Error("name is required");
+  if (typeof obj.adapterName !== "string" || obj.adapterName.length === 0) throw new Error("adapterName is required");
+  if (!Array.isArray(capabilities) || capabilities.some((v) => typeof v !== "string")) {
+    throw new Error("capabilities must be a string array");
+  }
+  if (!profile || typeof profile !== "object") throw new Error("profile is required");
+  if (typeof profile.id !== "string" || profile.id.length === 0) throw new Error("profile.id is required");
+  if (typeof profile.name !== "string" || profile.name.length === 0) throw new Error("profile.name is required");
+  if (typeof profile.adapterName !== "string" || profile.adapterName.length === 0) {
+    throw new Error("profile.adapterName is required");
+  }
+  if (profile.config !== void 0 && (!profile.config || typeof profile.config !== "object" || Array.isArray(profile.config))) {
+    throw new Error("profile.config must be a JSON object");
+  }
+  return {
+    workspaceId: obj.workspaceId,
+    imUserId: obj.imUserId,
+    name: obj.name,
+    adapterName: obj.adapterName,
+    capabilities,
+    profile: {
+      id: profile.id,
+      name: profile.name,
+      adapterName: profile.adapterName,
+      config: profile.config ?? {},
+      version: typeof profile.version === "number" && Number.isFinite(profile.version) ? profile.version : 1
     }
+  };
+}
+function safeJsonParse(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
   }
-  return { mode, color: color2, restArgv: rest };
 }
 
-// src/cli/util.ts
-var DEFAULT_CLOUD_BASE_URL = "https://prismer.cloud";
-var ANSI = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  cyan: "\x1B[36m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  red: "\x1B[31m"
-};
-function color(kind, text) {
-  if (process.env.NO_COLOR === "1" || process.env.NO_COLOR === "true") return text;
-  return `${ANSI[kind]}${text}${ANSI.reset}`;
-}
-function printJson(v) {
-  getUI().json(v, { pretty: true });
-}
-function exitWithError(message, opts) {
-  const o = typeof opts === "number" ? { exitCode: opts } : opts ?? {};
-  const exitCode = o.exitCode ?? 1;
-  const ui = getUI();
-  if (ui.mode === "json") {
-    const payload = {
-      ok: false,
-      error: { code: o.code ?? "cli_error", message },
-      ...o.details ? { details: o.details } : {}
-    };
-    ui.json(payload, { pretty: true });
-  } else {
-    process.stderr.write(`Error: ${message}
-`);
+// src/pair.ts
+import { generateKeyPairSync } from "crypto";
+import { hostname as hostname2 } from "os";
+import { setTimeout as sleep } from "timers/promises";
+import qrcode from "qrcode";
+async function pair(opts) {
+  const paths = opts.paths ?? resolvePaths();
+  if (configExists(paths) && !opts.force) {
+    throw new Error(
+      `Config already exists at ${paths.configFile}. Pass --force to overwrite, or run \`prismer status\` to inspect.`
+    );
   }
-  process.exit(exitCode);
-}
-function normalizeCloudUrl(input) {
-  const raw = input.trim();
-  if (!raw) throw new Error("Cloud URL is empty.");
-  if (/^[a-z][a-z0-9+\-.]*:\/\//i.test(raw)) {
-    let parsed;
-    try {
-      parsed = new URL(raw);
-    } catch {
-      throw new Error(`Invalid --cloud URL: ${raw}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error(`Invalid --cloud URL scheme: ${parsed.protocol} (expected http:// or https://)`);
-    }
-    return raw.replace(/\/$/, "");
+  const isLocalOnly = opts.isLocalOnly ?? (() => process.env.LOCAL_ONLY === "1");
+  const localOnlyMode = !!opts.asUserEmail;
+  if (localOnlyMode && !isLocalOnly()) {
+    throw new Error(
+      "pair: --as-user requires LOCAL_ONLY=1. Without that gate, this would skip mobile approval and silently mint a key for the named user."
+    );
   }
-  if (!/^[A-Za-z0-9.\-_:[\]/]+$/.test(raw)) {
-    throw new Error(`Invalid --cloud URL: ${raw} (must be http://\u2026 or https://\u2026 or host:port)`);
+  const { publicKey } = generateKeyPairSync("ed25519");
+  const devicePub = publicKey.export({ format: "der", type: "spki" }).toString("base64");
+  const cloud = new CloudClient({
+    baseUrl: opts.cloudBaseUrl,
+    apiKey: "pending",
+    // not used: we pass auth:false
+    fetchImpl: opts.fetchImpl
+  });
+  const offerRes = await cloud.request(
+    "POST",
+    "/api/im/pair/offer",
+    {
+      auth: false,
+      body: { devicePub, deviceName: opts.deviceName ?? hostname2() }
+    }
+  );
+  if (!offerRes.ok) {
+    throw new Error(`pair: offer failed (${offerRes.status}): ${offerRes.error?.message}`);
   }
-  const candidate = `http://${raw}`;
-  try {
-    new URL(candidate);
-  } catch {
-    throw new Error(`Invalid --cloud URL: ${raw}`);
+  const offer = unwrapEnvelope(offerRes.data);
+  if (!offer.nonce || !offer.qrUrl) {
+    throw new Error("pair: cloud returned no nonce/qrUrl");
   }
-  return candidate.replace(/\/$/, "");
-}
-function runAction(fn, opts = {}) {
-  return async (...args) => {
-    try {
-      await fn(...args);
-    } catch (err) {
-      const raw = err instanceof Error ? err.message : String(err);
-      const message = opts.sanitize ? opts.sanitize(raw) : raw;
-      exitWithError(message, { code: opts.code });
+  if (localOnlyMode) {
+    const approveRes = await cloud.request(
+      "POST",
+      "/api/im/pair/local-only-approve",
+      {
+        auth: false,
+        body: { nonce: offer.nonce, asUserEmail: opts.asUserEmail }
+      }
+    );
+    if (!approveRes.ok) {
+      throw new Error(
+        `pair: local-only-approve failed (${approveRes.status}): ${approveRes.error?.message ?? "unknown"}`
+      );
     }
-  };
-}
-function printBanner(opts = {}) {
-  const ui = getUI();
-  if (opts.compact) {
-    ui.smallHeader("Runtime CLI v1.9.7");
-    return;
+    process.stdout.write(`[pair] LOCAL_ONLY approved as ${opts.asUserEmail} \u2014 no QR shown
+`);
+  } else {
+    const qrAscii = await qrcode.toString(offer.qrUrl, { type: "terminal", small: true });
+    process.stdout.write(qrAscii);
+    process.stdout.write(`
+Scan with Lumin to approve, or open: ${offer.qrUrl}
+
+`);
+    opts.onQrReady?.(offer.qrUrl);
   }
-  ui.banner("Runtime CLI v1.9.7", { full: true });
-}
-function ok(label, detail) {
-  getUI().ok(label, detail);
-}
-function warn(label, detail) {
-  getUI().warn(label, detail);
-}
-function fail2(label, detail) {
-  getUI().fail(label, detail);
-}
-function tip(command, detail) {
-  const text = detail ? `${command}  ${detail}` : command;
-  getUI().tip(text);
-}
-function pidFilePath(paths) {
-  return join9(paths.root, "daemon.pid");
-}
-function writePidFile(paths, pid) {
-  writeFileSync5(pidFilePath(paths), `${pid}
-`, "utf8");
-}
-function readPidFile(paths) {
-  const p = pidFilePath(paths);
-  if (!existsSync10(p)) return void 0;
-  const raw = readFileSync7(p, "utf8").trim();
-  const pid = Number.parseInt(raw, 10);
-  return Number.isFinite(pid) ? pid : void 0;
-}
-function clearPidFile(paths) {
-  const p = pidFilePath(paths);
-  if (existsSync10(p)) {
-    try {
-      unlinkSync2(p);
-    } catch {
+  const pollPath = `/api/im/pair/poll/${encodeURIComponent(offer.nonce)}?devicePub=${encodeURIComponent(devicePub)}`;
+  const maxAttempts = opts.maxPollAttempts ?? 60;
+  const pollIntervalMs = opts.pollIntervalMs ?? 5e3;
+  for (let i = 0; i < maxAttempts; i += 1) {
+    if (i > 0 || !localOnlyMode) {
+      await sleep(pollIntervalMs);
+    }
+    const res = await cloud.request(
+      "GET",
+      pollPath,
+      { auth: false }
+    );
+    if (res.ok) {
+      const body = unwrapEnvelope(res.data);
+      if (body.apiKey) {
+        const config = {
+          api_key: body.apiKey,
+          cloud_api_base: opts.cloudBaseUrl,
+          daemon_id: newDaemonId()
+        };
+        saveConfig(config, paths);
+        return { config, paths };
+      }
+    }
+    if (res.status === 404 || res.status === 202) {
+      continue;
+    }
+    if (res.status >= 400 && res.status !== 404) {
+      throw new Error(`pair: poll failed (${res.status}): ${res.error?.message}`);
     }
   }
+  throw new Error("pair: timed out waiting for approval (5 min)");
 }
-function pidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+function unwrapEnvelope(raw) {
+  if (raw && typeof raw === "object" && "ok" in raw) {
+    const env = raw;
+    if (env.ok && env.data) return env.data;
   }
+  return raw;
 }
 
+// src/cli/index.ts
+import { Command as Command18 } from "commander";
+
 // src/cli/commands/adapter.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import {
+  copyFileSync,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync9,
+  statSync as statSync2,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname7, join as join11 } from "path";
+import { Command } from "commander";
+init_util();
+init_ui();
 var BUILTIN_ADAPTERS = [hermesAdapter, claudeCodeAdapter, openclawAdapter, codexAdapter];
 var INSTALL_SPECS = {
   "claude-code": {
@@ -7159,7 +7742,7 @@ var INSTALL_SPECS = {
     binary: "claude",
     hint: "Set ANTHROPIC_API_KEY in your shell profile, or rely on Claude Code OAuth login. Run `claude login` to sign in.",
     authHints: ["ANTHROPIC_API_KEY or Claude Code OAuth login (`claude login`)"],
-    hookTarget: { path: join10(homedir4(), ".claude", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join11(homedir4(), ".claude", "hooks.json"), kind: "json-file" }
   },
   openclaw: {
     name: "openclaw",
@@ -7168,7 +7751,7 @@ var INSTALL_SPECS = {
     binary: "openclaw",
     hint: "OpenClaw runs as a gateway. Configure ~/.openclaw/openclaw.json and start it with `openclaw gateway` before tasks dispatch.",
     authHints: ["~/.openclaw/openclaw.json gateway.auth.bearerTokens", "Prismer daemon api_key"],
-    hookTarget: { path: join10(homedir4(), ".openclaw", "hooks"), kind: "directory" }
+    hookTarget: { path: join11(homedir4(), ".openclaw", "hooks"), kind: "directory" }
   },
   codex: {
     name: "codex",
@@ -7177,7 +7760,7 @@ var INSTALL_SPECS = {
     binary: "codex",
     hint: "Set OPENAI_API_KEY in your shell profile. Verify with `codex --help`.",
     authHints: ["OPENAI_API_KEY or Codex CLI account login"],
-    hookTarget: { path: join10(homedir4(), ".codex", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join11(homedir4(), ".codex", "hooks.json"), kind: "json-file" }
   },
   hermes: {
     name: "hermes",
@@ -7186,7 +7769,7 @@ var INSTALL_SPECS = {
     binary: "hermes",
     hint: "Hermes runs as a long-lived HTTP gateway in your own Python venv. Start with `hermes -p <profile> gateway` after configuring ~/.hermes/.env.",
     authHints: ["~/.hermes/.env API_SERVER_KEY", "Hermes profile provider credentials"],
-    hookTarget: { path: join10(homedir4(), ".hermes", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join11(homedir4(), ".hermes", "hooks.json"), kind: "json-file" }
   }
 };
 function buildAdapterCommand() {
@@ -7401,15 +7984,15 @@ function runHooks(spec, opts) {
   }
   let backup;
   if (planned.kind === "directory") {
-    mkdirSync7(planned.path, { recursive: true });
-    const markerPath = join10(planned.path, "prismer.json");
+    mkdirSync8(planned.path, { recursive: true });
+    const markerPath = join11(planned.path, "prismer.json");
     backup = backupIfExists(markerPath);
-    writeFileSync6(markerPath, JSON.stringify(prismerHookMarker(spec), null, 2) + "\n", "utf8");
+    writeFileSync7(markerPath, JSON.stringify(prismerHookMarker(spec), null, 2) + "\n", "utf8");
   } else {
-    mkdirSync7(dirname7(planned.path), { recursive: true });
+    mkdirSync8(dirname7(planned.path), { recursive: true });
     backup = backupIfExists(planned.path);
     const merged = mergeHookJson(planned.path, spec);
-    writeFileSync6(planned.path, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    writeFileSync7(planned.path, JSON.stringify(merged, null, 2) + "\n", "utf8");
   }
   return {
     ok: true,
@@ -7476,23 +8059,23 @@ function inspectAuthEnv(spec) {
         hints: spec.authHints ?? []
       };
     case "hermes": {
-      const envFile = join10(homedir4(), ".hermes", ".env");
+      const envFile = join11(homedir4(), ".hermes", ".env");
       return {
-        ok: existsSync11(envFile) || Boolean(process.env.HERMES_API_KEY || process.env.API_SERVER_KEY),
+        ok: existsSync12(envFile) || Boolean(process.env.HERMES_API_KEY || process.env.API_SERVER_KEY),
         present: [
           ...["HERMES_API_KEY", "API_SERVER_KEY"].filter((k) => Boolean(process.env[k])),
-          ...existsSync11(envFile) ? [envFile] : []
+          ...existsSync12(envFile) ? [envFile] : []
         ],
         hints: spec.authHints ?? []
       };
     }
     case "openclaw": {
-      const cfgFile = join10(homedir4(), ".openclaw", "openclaw.json");
+      const cfgFile = join11(homedir4(), ".openclaw", "openclaw.json");
       return {
-        ok: existsSync11(cfgFile) || Boolean(process.env.OPENCLAW_API_KEY),
+        ok: existsSync12(cfgFile) || Boolean(process.env.OPENCLAW_API_KEY),
         present: [
           ...["OPENCLAW_API_KEY"].filter((k) => Boolean(process.env[k])),
-          ...existsSync11(cfgFile) ? [cfgFile] : []
+          ...existsSync12(cfgFile) ? [cfgFile] : []
         ],
         hints: spec.authHints ?? []
       };
@@ -7507,32 +8090,32 @@ function inspectHook(spec) {
     return { supported: false, markerPresent: false };
   }
   if (spec.name === "openclaw") {
-    const jsonPath = join10(homedir4(), ".openclaw", "hooks.json");
-    const markerPath = join10(target.path, "prismer.json");
-    const jsonMarkerPresent = existsSync11(jsonPath) && fileContainsPrismerMarker(jsonPath);
-    const dirMarkerPresent = existsSync11(markerPath) && fileContainsPrismerMarker(markerPath);
+    const jsonPath = join11(homedir4(), ".openclaw", "hooks.json");
+    const markerPath = join11(target.path, "prismer.json");
+    const jsonMarkerPresent = existsSync12(jsonPath) && fileContainsPrismerMarker(jsonPath);
+    const dirMarkerPresent = existsSync12(markerPath) && fileContainsPrismerMarker(markerPath);
     return {
       supported: true,
       kind: "json-file-or-directory",
       path: target.path,
       jsonPath,
-      exists: existsSync11(target.path) || existsSync11(jsonPath),
+      exists: existsSync12(target.path) || existsSync12(jsonPath),
       markerPath,
       markerPresent: jsonMarkerPresent || dirMarkerPresent
     };
   }
   if (target.kind === "directory") {
-    const markerPath = join10(target.path, "prismer.json");
+    const markerPath = join11(target.path, "prismer.json");
     return {
       supported: true,
       kind: target.kind,
       path: target.path,
-      exists: existsSync11(target.path),
+      exists: existsSync12(target.path),
       markerPath,
-      markerPresent: existsSync11(markerPath) && fileContainsPrismerMarker(markerPath)
+      markerPresent: existsSync12(markerPath) && fileContainsPrismerMarker(markerPath)
     };
   }
-  const exists = existsSync11(target.path);
+  const exists = existsSync12(target.path);
   if (!exists) {
     return {
       supported: true,
@@ -7568,14 +8151,14 @@ function prismerHookMarker(spec) {
 }
 function mergeHookJson(path7, spec) {
   const marker = prismerHookMarker(spec);
-  if (!existsSync11(path7)) {
+  if (!existsSync12(path7)) {
     return {
       prismer: marker
     };
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path7, "utf8"));
+    parsed = JSON.parse(readFileSync9(path7, "utf8"));
   } catch (err) {
     throw new Error(`Cannot parse ${path7} as JSON: ${err.message}`);
   }
@@ -7599,7 +8182,7 @@ function mergeHookJson(path7, spec) {
   return next;
 }
 function backupIfExists(path7) {
-  if (!existsSync11(path7)) return null;
+  if (!existsSync12(path7)) return null;
   const suffix = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backup = `${path7}.bak.${suffix}`;
   const stat = statSync2(path7);
@@ -7609,7 +8192,7 @@ function backupIfExists(path7) {
 }
 function fileContainsPrismerMarker(path7) {
   try {
-    return readFileSync8(path7, "utf8").includes("prismer-daemon-runtime");
+    return readFileSync9(path7, "utf8").includes("prismer-daemon-runtime");
   } catch {
     return false;
   }
@@ -7672,6 +8255,8 @@ function clearInstallInConfig(name) {
 // src/cli/commands/agent.ts
 import { Command as Command2 } from "commander";
 import { spawnSync as spawnSync3 } from "child_process";
+init_util();
+init_ui();
 var ADAPTER_BINARY = {
   "claude-code": "claude",
   codex: "codex",
@@ -8051,8 +8636,10 @@ function whichBinary2(bin) {
 
 // src/cli/commands/asset.ts
 import { Command as Command3 } from "commander";
-import { existsSync as existsSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
 import { basename as basename2 } from "path";
+init_util();
+init_ui();
 function buildAssetCommand() {
   const cmd = new Command3("asset").description("Inspect IM assets");
   cmd.command("list").description("List assets for a workspace, optionally filtered by task").option("--workspace-id <id>", "Workspace id").option("--task-id <id>", "Task id filter").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
@@ -8123,9 +8710,9 @@ function mkCloud() {
   return new CloudClient({ baseUrl: cfg.cloud_api_base, apiKey: cfg.api_key });
 }
 async function uploadAsset(file, opts) {
-  if (!existsSync12(file)) exitWithError(`file not found: ${file}`);
+  if (!existsSync13(file)) exitWithError(`file not found: ${file}`);
   const cfg = loadConfig(resolvePaths());
-  const bytes = readFileSync9(file);
+  const bytes = readFileSync10(file);
   const metadata = parseMetadata(opts.metadata);
   if (opts.taskId && metadata.taskId === void 0) metadata.taskId = opts.taskId;
   if (opts.containerId && metadata.containerId === void 0) metadata.containerId = opts.containerId;
@@ -8161,7 +8748,7 @@ async function downloadAsset(assetId, outPath) {
     exitWithError(`asset download failed (${res.status}): ${errorMessage(body)}`);
   }
   const bytes = Buffer.from(await res.arrayBuffer());
-  writeFileSync7(outPath, bytes);
+  writeFileSync8(outPath, bytes);
 }
 function parseMetadata(raw) {
   if (!raw) return {};
@@ -8248,6 +8835,7 @@ function stringField(obj, key) {
 }
 
 // src/cli/commands/banner.ts
+init_util();
 import { Command as Command4 } from "commander";
 function buildBannerCommand() {
   return new Command4("banner").description("Show the Prismer runtime CLI banner").option("--compact", "Show a single-line banner").option("--json", "Accept --json for global flag compatibility (banner is suppressed in JSON mode)").action((opts) => {
@@ -8257,6 +8845,8 @@ function buildBannerCommand() {
 
 // src/cli/commands/chat.ts
 import { Command as Command5 } from "commander";
+init_util();
+init_ui();
 function buildChatCommand() {
   const cmd = new Command5("chat").description("Use IM chat and group APIs");
   cmd.command("me").description("Show the current IM identity").option("--json", "Print raw JSON response").action(async (opts) => {
@@ -8431,6 +9021,8 @@ function sanitizeError(message) {
 
 // src/cli/commands/config.ts
 import { Command as Command6 } from "commander";
+init_util();
+init_ui();
 var SETTABLE_KEYS = ["cloud_api_base", "api_key", "daemon_id"];
 function redactApiKey(key) {
   if (!key.startsWith("sk-prismer-")) return "***";
@@ -8526,6 +9118,8 @@ function buildConfigCommand() {
 
 // src/cli/commands/cookbook.ts
 import { Command as Command7 } from "commander";
+init_util();
+init_ui();
 function buildCookbookCommand() {
   const cmd = new Command7("cookbook").description("Run CLI-only 54release MVP regression suites");
   cmd.command("run").description("Run one or more cookbook smoke suites using the configured API key").option("--suite <name>", "status|im|task|group|asset|sandbox|all, comma-separated", "all").option("--workspace-id <id>", "Workspace id for workspace-scoped suites").option("--agent-id <id>", "Agent IM user id for task create smoke").option("--group-id <id>", "Group/conversation id for group message history smoke").option("--sandbox-id <id>", "Sandbox id for sandbox status smoke").option("--prompt <text>", "Prompt for optional task create smoke").option("--timeout-ms <ms>", "Request/task timeout", parsePositiveInt2, 6e4).option("--strict", "Treat skipped optional checks as failure").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
@@ -8783,9 +9377,11 @@ function parsePositiveInt2(value) {
 // src/cli/commands/daemon.ts
 import { Command as Command8 } from "commander";
 import { spawn as spawn5 } from "child_process";
-import { createReadStream, existsSync as existsSync13, mkdirSync as mkdirSync8, openSync, statSync as statSync3 } from "fs";
+import { createReadStream, existsSync as existsSync14, mkdirSync as mkdirSync9, openSync, statSync as statSync3 } from "fs";
 import { setTimeout as sleep2 } from "timers/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
+init_util();
+init_ui();
 function buildDaemonCommand() {
   const cmd = new Command8("daemon").description("Manage the prismer daemon process");
   cmd.command("start").description("Start the daemon in the background (use --foreground for Docker/systemd)").option("--port <port>", "Local server port (default 3210)", (v) => Number.parseInt(v, 10)).option("--no-local-server", "Skip starting the local 127.0.0.1 server").option("--foreground", "Run in the foreground instead of daemonizing").option("--json", "Output machine-readable JSON").action(async (opts) => {
@@ -8857,8 +9453,8 @@ function buildDaemonCommand() {
     if (existingPid && pidAlive(existingPid)) {
       exitWithError(`Daemon already running (pid ${existingPid}). Use \`prismer daemon stop\` first.`);
     }
-    if (!existsSync13(paths.logsDir)) mkdirSync8(paths.logsDir, { recursive: true });
-    const logFile = join11(paths.logsDir, "daemon.log");
+    if (!existsSync14(paths.logsDir)) mkdirSync9(paths.logsDir, { recursive: true });
+    const logFile = join12(paths.logsDir, "daemon.log");
     const fd = openSync(logFile, "a");
     const args = [process.argv[1], "daemon", "run"];
     if (opts.port) args.push("--port", String(opts.port));
@@ -8942,8 +9538,8 @@ function buildDaemonCommand() {
   });
   cmd.command("logs").description("Show daemon logs").option("--tail <n>", "Number of lines to show", (v) => Number.parseInt(v, 10), 80).option("--follow", "Follow log output").option("--json", "Accept --json for global flag compatibility (raw log bytes are streamed)").action(async (opts) => {
     const paths = resolvePaths();
-    const logFile = join11(paths.logsDir, "daemon.log");
-    if (!existsSync13(logFile)) {
+    const logFile = join12(paths.logsDir, "daemon.log");
+    if (!existsSync14(logFile)) {
       exitWithError(`No daemon log found at ${logFile}. Start the daemon with \`prismer daemon start\`.`);
     }
     const lines = Math.max(1, opts.tail);
@@ -8997,16 +9593,17 @@ async function followFile(path7) {
 }
 
 // src/cli/commands/events.ts
+init_util();
 import { Command as Command9 } from "commander";
-import { createReadStream as createReadStream2, existsSync as existsSync14 } from "fs";
+import { createReadStream as createReadStream2, existsSync as existsSync15 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { createInterface } from "readline";
-var DEFAULT_LIMIT = 50;
+var DEFAULT_LIMIT2 = 50;
 function buildEventsCommand() {
   return addEventOptions(new Command9("events").description("Read local PARA events from ~/.prismer/para/events.jsonl")).action(async (opts) => {
     const file = eventsPath();
-    if (!existsSync14(file)) {
+    if (!existsSync15(file)) {
       printJson(unavailable(file));
       process.exitCode = 1;
       return;
@@ -9023,7 +9620,7 @@ function buildEventsCommand() {
 function buildEventsStatsCommand() {
   return addEventOptions(new Command9("events:stats").description("Summarize local PARA events from ~/.prismer/para/events.jsonl")).action(async (opts) => {
     const file = eventsPath();
-    if (!existsSync14(file)) {
+    if (!existsSync15(file)) {
       printJson(unavailable(file));
       process.exitCode = 1;
       return;
@@ -9038,10 +9635,10 @@ function buildEventsStatsCommand() {
   });
 }
 function addEventOptions(cmd) {
-  return cmd.option("--limit <n>", "Max events to return/read", parsePositiveInt3, DEFAULT_LIMIT).option("--agent-id <id>", "Filter by agent id").option("--session-id <id>", "Filter by session id").option("--family <name>", "Filter by event family").option("--type <name>", "Filter by event type").option("--json", "Output JSON (default)");
+  return cmd.option("--limit <n>", "Max events to return/read", parsePositiveInt3, DEFAULT_LIMIT2).option("--agent-id <id>", "Filter by agent id").option("--session-id <id>", "Filter by session id").option("--family <name>", "Filter by event family").option("--type <name>", "Filter by event type").option("--json", "Output JSON (default)");
 }
 function eventsPath() {
-  return join12(process.env.PRISMER_HOME ?? join12(homedir5(), ".prismer"), "para", "events.jsonl");
+  return join13(process.env.PRISMER_HOME ?? join13(homedir5(), ".prismer"), "para", "events.jsonl");
 }
 function unavailable(file) {
   return {
@@ -9109,7 +9706,7 @@ function bump(map, key) {
 }
 function normalizeFilters(opts) {
   return {
-    limit: Math.max(1, Math.min(1e4, Number.isFinite(opts.limit) ? opts.limit : DEFAULT_LIMIT)),
+    limit: Math.max(1, Math.min(1e4, Number.isFinite(opts.limit) ? opts.limit : DEFAULT_LIMIT2)),
     agentId: opts.agentId,
     sessionId: opts.sessionId,
     family: opts.family,
@@ -9121,13 +9718,14 @@ function cleanFilters(filters) {
 }
 function parsePositiveInt3(v) {
   const n = Number.parseInt(v, 10);
-  return Number.isFinite(n) && n > 0 ? n : DEFAULT_LIMIT;
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_LIMIT2;
 }
 
 // src/cli/commands/memory.ts
 import Database4 from "better-sqlite3";
 import { Command as Command10 } from "commander";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
+init_util();
 var LOCAL_BASE = process.env.PRISMER_DAEMON_URL ?? "http://127.0.0.1:3210";
 function buildMemoryCommand() {
   const cmd = new Command10("memory").description("Inspect local daemon memory/cache state");
@@ -9219,7 +9817,7 @@ async function tryDaemon(methods, paths) {
       try {
         const res = await fetch(`${LOCAL_BASE}${path7}`, { method, signal: AbortSignal.timeout(1500) });
         if (res.status === 404) continue;
-        const body = await readJson3(res);
+        const body = await readJson4(res);
         if (!res.ok) {
           return {
             ok: false,
@@ -9238,7 +9836,7 @@ async function tryDaemon(methods, paths) {
   }
   return void 0;
 }
-async function readJson3(res) {
+async function readJson4(res) {
   const text = await res.text();
   if (!text) return null;
   try {
@@ -9278,7 +9876,7 @@ function readCacheSnapshot(limit) {
   const paths = resolvePaths();
   const empty = {
     dbPath: paths.localDb,
-    dbExists: existsSync15(paths.localDb),
+    dbExists: existsSync16(paths.localDb),
     tables: {
       cached_assets: { exists: false, count: 0, sizeBytes: 0 },
       workspace_files_mirror: { exists: false, count: 0 }
@@ -9332,9 +9930,9 @@ function readCacheSnapshot(limit) {
     db?.close();
   }
 }
-function tableExists(db, table) {
-  const row = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
-  return row?.name === table;
+function tableExists(db, table2) {
+  const row = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table2);
+  return row?.name === table2;
 }
 function assetRow(row) {
   const hash = String(row.content_hash ?? "");
@@ -9398,6 +9996,8 @@ function messageFromBody(body) {
 
 // src/cli/commands/pair.ts
 import { Command as Command11 } from "commander";
+init_util();
+init_ui();
 function buildPairCommand() {
   return new Command11("pair").description("Legacy QR approval path; use `prismer setup` to bind this runtime").option(
     "--cloud <url>",
@@ -9440,10 +10040,11 @@ function buildPairCommand() {
 
 // src/cli/commands/profile.ts
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync16, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
 import { tmpdir } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { spawnSync as spawnSync4 } from "child_process";
+init_util();
 function buildProfileCommand() {
   const cmd = new Command12("profile").description("Manage AgentProfile (per-agent adapter config)");
   cmd.command("templates").description("List built-in role templates (PM / Engineer / CEO \u2026)").option("--json", "Output JSON (default)").action(() => {
@@ -9454,7 +10055,7 @@ function buildProfileCommand() {
     const data = await cloud.get(`/api/im/agent_profiles?agentId=${encodeURIComponent(opts.agent)}`);
     printJson(data);
   }, { code: "profile_list_failed" }));
-  cmd.command("create").description("Create an AgentProfile").requiredOption("--agent <imUserId>", "Agent IMUser.id this profile belongs to").requiredOption("--name <name>", "Profile display name (unique within workspace+agent)").option("--adapter <name>", "Adapter name (defaults to template.applicableAdapters[0] or hermes)").option("--config <jsonOrPath>", "Inline JSON or @path/to/file containing adapter config").option("--from-template <name>", "Use a built-in role template (run `prismer profile templates` to list)").option("--workspace-id <id>", "Workspace id (cloud derives Personal default if omitted)").option("--json", "Output JSON (default)").action(runAction(async (opts) => {
+  cmd.command("create").description("Create an AgentProfile").requiredOption("--agent <imUserId>", "Agent IMUser.id this profile belongs to").requiredOption("--name <name>", "Profile display name (unique within workspace+agent)").option("--adapter <name>", "Adapter name (defaults to template.applicableAdapters[0] or hermes)").option("--config <jsonOrPath>", "Inline JSON or @path/to/file containing adapter config").option("--from-template <name>", "Use a built-in role template (run `prismer profile templates` to list)").option("--model <name>", "Model id (overrides template default; fetched from cloud if omitted)").option("--workspace-id <id>", "Workspace id (cloud derives Personal default if omitted)").option("--json", "Output JSON (default)").action(runAction(async (opts) => {
     let configObj = {};
     let adapterName = opts.adapter ?? "hermes";
     if (opts.fromTemplate) {
@@ -9467,6 +10068,9 @@ function buildProfileCommand() {
       const inline = readJsonArg(opts.config);
       configObj = { ...configObj, ...inline };
     }
+    if (opts.model) {
+      configObj.model = opts.model;
+    }
     const cloud = mkCloud4();
     const wsId = opts.workspaceId ?? await resolveDefaultWorkspaceId(cloud);
     const res = await cloud.request("POST", "/api/im/agent_profiles", {
@@ -9486,12 +10090,12 @@ function buildProfileCommand() {
     const profile = await cloud.get(
       `/api/im/agent_profiles/${encodeURIComponent(profileId)}`
     );
-    const tmpFile = join13(tmpdir(), `prismer-profile-${profileId}.json`);
-    writeFileSync8(tmpFile, JSON.stringify(profile.config, null, 2), "utf8");
+    const tmpFile = join14(tmpdir(), `prismer-profile-${profileId}.json`);
+    writeFileSync9(tmpFile, JSON.stringify(profile.config, null, 2), "utf8");
     const editor = process.env.EDITOR || "vi";
     const ed = spawnSync4(editor, [tmpFile], { stdio: "inherit" });
     if (ed.status !== 0) exitWithError(`editor exited ${ed.status}`, { code: "editor_failed" });
-    const newConfig = JSON.parse(readFileSync10(tmpFile, "utf8"));
+    const newConfig = JSON.parse(readFileSync11(tmpFile, "utf8"));
     const res = await cloud.request("PATCH", `/api/im/agent_profiles/${encodeURIComponent(profileId)}`, {
       body: { config: newConfig, version: profile.version }
     });
@@ -9513,8 +10117,8 @@ function mkCloud4() {
 function readJsonArg(arg) {
   if (arg.startsWith("@")) {
     const path7 = arg.slice(1);
-    if (!existsSync16(path7)) throw new Error(`File not found: ${path7}`);
-    return JSON.parse(readFileSync10(path7, "utf8"));
+    if (!existsSync17(path7)) throw new Error(`File not found: ${path7}`);
+    return JSON.parse(readFileSync11(path7, "utf8"));
   }
   return JSON.parse(arg);
 }
@@ -9527,6 +10131,8 @@ async function resolveDefaultWorkspaceId(cloud) {
 
 // src/cli/commands/sandbox.ts
 import { Command as Command13 } from "commander";
+init_util();
+init_ui();
 function buildSandboxCommand() {
   const cmd = new Command13("sandbox").description("Inspect and smoke-test sandbox lifecycle");
   cmd.command("list").description("List sandbox containers in a workspace").requiredOption("--workspace-id <id>", "Workspace id").option("--status <status>", "Status filter").option("--limit <n>", "Max rows", parsePositiveInt5, 50).option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
@@ -9728,11 +10334,13 @@ async function safeParseResponse(res) {
 
 // src/cli/commands/setup.ts
 import { Command as Command14 } from "commander";
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync17, renameSync } from "fs";
+import { existsSync as existsSync18, renameSync } from "fs";
 import { createServer as createServer2 } from "http";
+init_util();
+init_ui();
 function buildSetupCommand() {
   return new Command14("setup").description("Set up this local runtime and bind it to Prismer Cloud").argument("[api-key]", "Prismer daemon API key; primarily for manual recovery and automation").option(
     "--cloud <url>",
@@ -9755,6 +10363,7 @@ function buildSetupCommand() {
       getUI().blank();
     }
     const shouldStart = opts.start !== false;
+    stopRunningDaemon(paths);
     if (opts.pair || opts.asUser) {
       if (!opts.json) warn("Legacy pair setup path", "plain `prismer setup --start` is the canonical runtime binding flow");
       if (opts.asUser && process.env.LOCAL_ONLY !== "1") {
@@ -9771,7 +10380,7 @@ function buildSetupCommand() {
       }
       const result = await pair({
         cloudBaseUrl,
-        deviceName: opts.deviceName ?? hostname2(),
+        deviceName: opts.deviceName ?? hostname3(),
         force: opts.force,
         paths,
         asUserEmail: opts.asUser
@@ -9788,13 +10397,13 @@ function buildSetupCommand() {
         apiKey = await mintDaemonApiKey({
           cloudBaseUrl,
           token: authToken,
-          deviceName: opts.deviceName ?? hostname2()
+          deviceName: opts.deviceName ?? hostname3()
         });
       }
       if (!apiKey && !authToken && !opts.check && opts.browser !== false) {
         apiKey = await runBrowserSetup({
           cloudBaseUrl,
-          deviceName: opts.deviceName ?? hostname2(),
+          deviceName: opts.deviceName ?? hostname3(),
           json: Boolean(opts.json)
         });
       }
@@ -9975,11 +10584,33 @@ function startDaemonDetached(home) {
   });
   child.unref();
 }
+function stopRunningDaemon(paths) {
+  const pid = readPidFile(paths);
+  if (!pid || !pidAlive(pid)) {
+    if (pid) clearPidFile(paths);
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const deadline = Date.now() + 5e3;
+  while (Date.now() < deadline) {
+    if (!pidAlive(pid)) {
+      clearPidFile(paths);
+      return;
+    }
+    const start = Date.now();
+    while (Date.now() - start < 200) {
+    }
+  }
+}
 function shouldArchiveLocalDb(previous, next) {
   return previous.api_key !== next.api_key || previous.cloud_api_base !== next.cloud_api_base || previous.daemon_id !== next.daemon_id;
 }
 function archiveLocalDb(localDbPath) {
-  if (!existsSync17(localDbPath)) return;
+  if (!existsSync18(localDbPath)) return;
   const archived = `${localDbPath}.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.bak`;
   renameSync(localDbPath, archived);
 }
@@ -10002,6 +10633,8 @@ async function mintDaemonApiKey(input) {
 
 // src/cli/commands/status.ts
 import { Command as Command15 } from "commander";
+init_util();
+init_ui();
 function buildStatusCommand() {
   return new Command15("status").description("Show daemon + config + cloud status").option("--json", "Output machine-readable JSON").action(async (opts) => {
     const paths = resolvePaths();
@@ -10028,10 +10661,34 @@ function buildStatusCommand() {
     const cloud = new CloudClient({ baseUrl: cfg.cloud_api_base, apiKey: cfg.api_key });
     let cloudOk = false;
     let me = null;
+    let devices = null;
+    let agents = null;
     try {
-      const res = await cloud.request("GET", "/api/im/me", { timeoutMs: 3e3 });
-      cloudOk = res.ok;
-      me = res.data ?? null;
+      const meRes = await cloud.request("GET", "/api/im/me", { timeoutMs: 3e3 });
+      cloudOk = meRes.ok;
+      me = meRes.data ?? null;
+      if (cloudOk) {
+        const wsRes = await cloud.request("GET", "/api/im/workspaces", { timeoutMs: 3e3 });
+        if (wsRes.ok) {
+          const wsBody = wsRes.data;
+          const wsList = wsBody?.data;
+          if (Array.isArray(wsList) && wsList.length > 0) {
+            const wsId = wsList[0]?.id;
+            if (wsId) {
+              const devRes = await cloud.request("GET", `/api/workspace/runtime-installations?workspaceId=${encodeURIComponent(wsId)}&includeStopped=false`, { timeoutMs: 3e3 });
+              if (devRes.ok) {
+                const devBody = devRes.data;
+                devices = devBody?.data;
+              }
+              const agRes = await cloud.request("GET", `/api/im/workspaces/${encodeURIComponent(wsId)}/agents`, { timeoutMs: 3e3 });
+              if (agRes.ok) {
+                const agBody = agRes.data;
+                agents = agBody?.data;
+              }
+            }
+          }
+        }
+      }
     } catch {
       cloudOk = false;
     }
@@ -10043,10 +10700,15 @@ function buildStatusCommand() {
       daemon: {
         running: daemonRunning,
         pid: daemonStatus.pid ?? pid ?? null,
-        wsConnected: daemonStatus.wsConnected ?? null
+        wsConnected: daemonStatus.wsConnected ?? null,
+        info: daemonStatus.info ?? {}
       },
-      cloud: { base: cfg.cloud_api_base, reachable: cloudOk, me },
-      local
+      cloud: { base: cfg.cloud_api_base, reachable: cloudOk, me, devices, agents },
+      local,
+      binding: {
+        daemonId: cfg.daemon_id,
+        apiKey: cfg.api_key
+      }
     };
     if (opts.json) {
       printJson(report);
@@ -10060,12 +10722,19 @@ async function readDaemonStatus() {
     const res = await fetch("http://127.0.0.1:3210/healthz", {
       signal: AbortSignal.timeout(1e3)
     });
-    if (!res.ok) return { running: false };
-    const data = await res.json();
-    return { running: true, pid: data.pid, wsConnected: data.wsConnected };
+    if (res.ok) {
+      const data = await res.json();
+      return { running: true, pid: data.pid, wsConnected: data.wsConnected, info: data };
+    }
   } catch {
-    return { running: false };
   }
+  const paths = resolvePaths();
+  const pid = readPidFile(paths);
+  if (pid) {
+    const { pidAlive: pidAlive2 } = await Promise.resolve().then(() => (init_util(), util_exports));
+    if (pidAlive2(pid)) return { running: true, pid };
+  }
+  return { running: false };
 }
 function readLocalCounts(localDbPath) {
   try {
@@ -10091,21 +10760,59 @@ function printPretty(report) {
   ui.blank();
   ok("Config", report.paths.config);
   if (report.daemon.running) {
-    ok("Daemon", `pid=${report.daemon.pid ?? "?"} ws=${report.daemon.wsConnected ? "connected" : "pending"}`);
+    const ws = report.daemon.wsConnected ? "connected" : "pending";
+    ok("Daemon", `pid=${report.daemon.pid}  ws=${ws}`);
+    if (report.daemon.info) {
+      const info2 = report.daemon.info;
+      if (info2.version) ui.line(`  Version:  ${info2.version}`);
+      if (info2.uptime) ui.line(`  Uptime:   ${Math.round(info2.uptime / 60)}m`);
+      if (info2.memoryMb) ui.line(`  Memory:   ${info2.memoryMb} MB`);
+    }
   } else {
     warn("Daemon", "not running");
     tip("prismer daemon start");
   }
-  if (report.cloud.reachable) ok("Cloud", report.cloud.base);
-  else {
+  if (report.cloud.reachable) {
+    ok("Cloud", report.cloud.base);
+    const me = report.cloud.me;
+    if (me?.user) {
+      const roleTag = me.user.role ? `  role=${me.user.role}` : "";
+      ui.line(`  Account:  ${me.user.displayName ?? me.user.username ?? "?"}${roleTag}`);
+    }
+    if (me?.credits) {
+      ui.line(`  Credits:  ${typeof me.credits.balance === "number" ? me.credits.balance.toLocaleString() : "?"}`);
+    }
+  } else {
     fail2("Cloud", `${report.cloud.base} unreachable or unauthorized`);
     tip("prismer setup --force");
   }
+  if (report.binding) {
+    ui.blank();
+    ui.line(`  Daemon ID:  ${report.binding.daemonId}`);
+    const masked = report.binding.apiKey.slice(0, 14) + "\u2022\u2022\u2022\u2022" + report.binding.apiKey.slice(-4);
+    ui.line(`  API Key:    ${masked}`);
+  }
+  if (Array.isArray(report.cloud.devices) && report.cloud.devices.length > 0) {
+    const devs = report.cloud.devices;
+    ui.blank();
+    ui.line(`  Workspace Devices (${devs.length}):`);
+    for (const d of devs) {
+      const statusIcon = d.daemonStatus === "connected" ? "\u25CF" : "\u25CB";
+      const kind = d.runtimeKind === "docker" ? "Local" : "K8s";
+      const declared = d.hostedAgentSummary?.declared ?? 0;
+      ui.line(`    ${statusIcon} ${d.podName?.replace(/^daemon:/, "")?.slice(0, 28) ?? "?"}  kind=${kind}  agents=${declared}`);
+    }
+  } else {
+    ui.line(`  Workspace Devices: none`);
+  }
+  if (Array.isArray(report.cloud.agents) && report.cloud.agents.length > 0) {
+    ui.line(`  Hosted agents: ${report.cloud.agents.length}`);
+  }
   if (report.local) {
     ui.blank();
-    ui.line(`  Agents:    ${report.local.agents}`);
-    ui.line(`  Profiles:  ${report.local.profiles}`);
-    ui.line(`  Tasks:     ${report.local.runningTasks} running locally`);
+    ui.line(`  Local agents:  ${report.local.agents}`);
+    ui.line(`  Profiles:      ${report.local.profiles}`);
+    ui.line(`  Running tasks: ${report.local.runningTasks}`);
   } else {
     warn("Local DB", "unavailable");
   }
@@ -10114,6 +10821,7 @@ function printPretty(report) {
 // src/cli/commands/task.ts
 import { Command as Command16 } from "commander";
 import { setTimeout as sleep3 } from "timers/promises";
+init_util();
 function describeStatus(status) {
   return status === 0 ? "network error" : `HTTP ${status}`;
 }
@@ -10233,6 +10941,8 @@ function taskFrom2(raw) {
 
 // src/cli/commands/workspace.ts
 import { Command as Command17 } from "commander";
+init_util();
+init_ui();
 function buildWorkspaceCommand() {
   const cmd = new Command17("workspace").description("Manage workspaces, runtime snapshots, and workspace files");
   cmd.command("list").description("List workspaces").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
@@ -10467,6 +11177,7 @@ async function readResponseError(res) {
 }
 
 // src/cli/index.ts
+init_ui();
 var VERSION = "1.9.7";
 function buildProgram() {
   const program = new Command18("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);