@prismer/runtime 1.9.9 → 1.9.22

package/dist/cli.js

@@ -1,6 +1,12 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -12,10 +18,10 @@ var __export = (target, all) => {
 // src/cli/ui.ts
 import * as fs from "fs";
 import * as path from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath } from "url";
 function thisDirname() {
   try {
-    return path.dirname(fileURLToPath2(import.meta.url));
+    return path.dirname(fileURLToPath(import.meta.url));
   } catch {
     return process.cwd();
   }
@@ -447,7 +453,7 @@ __export(util_exports, {
   info: () => info,
   normalizeCloudUrl: () => normalizeCloudUrl,
   ok: () => ok,
-  pidAlive: () => pidAlive2,
+  pidAlive: () => pidAlive,
   pidFilePath: () => pidFilePath,
   printBanner: () => printBanner,
   printJson: () => printJson,
@@ -459,7 +465,7 @@ __export(util_exports, {
   writePidFile: () => writePidFile
 });
 import { existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 function color(kind, text) {
   if (process.env.NO_COLOR === "1" || process.env.NO_COLOR === "true") return text;
   return `${ANSI[kind]}${text}${ANSI.reset}`;
@@ -524,10 +530,10 @@ function runAction(fn, opts = {}) {
 function printBanner(opts = {}) {
   const ui = getUI();
   if (opts.compact) {
-    ui.smallHeader("Runtime CLI v1.9.7");
+    ui.smallHeader("Runtime CLI v${VERSION}");
     return;
   }
-  ui.banner("Runtime CLI v1.9.7", { full: true });
+  ui.banner("Runtime CLI v${VERSION}", { full: true });
 }
 function ok(label, detail) {
   getUI().ok(label, detail);
@@ -553,7 +559,7 @@ function table(rows, columns) {
   getUI().table(rows, { columns });
 }
 function pidFilePath(paths) {
-  return join4(paths.root, "daemon.pid");
+  return join3(paths.root, "daemon.pid");
 }
 function writePidFile(paths, pid) {
   writeFileSync3(pidFilePath(paths), `${pid}
@@ -575,7 +581,7 @@ function clearPidFile(paths) {
     }
   }
 }
-function pidAlive2(pid) {
+function pidAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -602,7 +608,7 @@ var init_util = __esm({
 });
 
 // src/cli/index.ts
-import { Command as Command19 } from "commander";
+import { Command as Command18 } from "commander";
 
 // src/cli/commands/adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -614,8 +620,8 @@ import {
   statSync,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join4 } from "path";
 import { Command } from "commander";
 
 // src/adapters/claude-code/index.ts
@@ -1133,36 +1139,15 @@ var codexAdapter = {
 };
 
 // src/adapters/hermes/index.ts
-import { execFileSync, spawn as spawn3 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { createRequire } from "module";
 import { homedir } from "os";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
 import Database from "better-sqlite3";
 import * as YAML from "yaml";
 import { z as z3 } from "zod";
 var PRISMER_IM_SKILL_NAME = "prismer-im-collab";
-var PRISMER_IM_SKILL_CONTENT = `---
-name: prismer-im-collab
-description: Coordinate reliably in Prismer conversations, use workspace assets through bounded MCP tools, and keep task work on the board.
-allowed-tools: prismer.agent.send prismer.conversation.listAgents prismer.task.create prismer.task.update prismer.task.complete prismer.approval.request_human_approval prismer.asset.search prismer.asset.describe prismer.asset.read
-metadata:
-  prismer:
-    version: "1.0.0"
-    mcp_tools:
-      - prismer.agent.send
-      - prismer.conversation.listAgents
-      - prismer.task.create
-      - prismer.task.update
-      - prismer.task.complete
-      - prismer.approval.request_human_approval
-      - prismer.asset.search
-      - prismer.asset.describe
-      - prismer.asset.read
----
-
-# Prismer IM Collaboration
+var PRISMER_IM_SKILL_CONTENT = `# Prismer IM Collaboration
 
 You are an agent in a Prismer multi-agent workspace. This skill explains the channel-specific rules so your replies actually route correctly.
 
@@ -1192,19 +1177,6 @@ You will receive a \`[Channel context]\` block at the top of each prompt indicat
 | Address another agent so the platform dispatches your message to them | Call \`prismer.agent.send\` (from the \`prismer-tasks\` MCP server). |
 | Look up which agents you can talk to | Call \`prismer.conversation.listAgents\` before guessing usernames. |
 | Create / update tasks on the workspace board | \`prismer.task.create\` / \`prismer.task.update\` from \`prismer-tasks\` MCP. |
-| Ask for structured human sign-off | \`prismer.approval.request_human_approval\`. |
-| Find uploaded workspace files | \`prismer.asset.search\`. |
-| Inspect file metadata before reading bytes | \`prismer.asset.describe\`. |
-| Read a bounded byte range from a file | \`prismer.asset.read\`. |
-
-## Workspace asset rules
-
-- Web-uploaded workspace files are available as asset metadata first; bytes are fetched lazily by the local daemon.
-- When a task needs file content, call \`prismer.asset.describe\` first, then read only the needed range with \`prismer.asset.read\`.
-- For many files, call \`prismer.asset.search\` to find candidates. Do not ask the user to paste file contents already present in workspace assets.
-- Do not claim you read a file unless an asset tool call succeeded.
-- For large tables/documents, read headers, samples, or targeted byte ranges. Never try to load the whole file into a reply.
-- Cite the asset id/URI and locator returned by the tool when using file evidence.
 
 ### When to use \`prismer.agent.send\` vs inline \`@\`
 
@@ -1218,7 +1190,6 @@ You will receive a \`[Channel context]\` block at the top of each prompt indicat
 2. **Don't fabricate usernames.** If \`prismer.conversation.listAgents\` doesn't return a name, that agent doesn't exist; use plain text and address them by displayName (no @).
 3. **Don't pretend to call a tool.** If you write "I sent a message via the tool" without actually invoking the tool, the message doesn't exist; the human will see the inconsistency.
 4. **Check tool return values.** \`prismer.agent.send\` may return \`{ ok: false, error: 'agent_not_found' }\`; surface the error rather than pretending it worked.
-5. **Use structured approvals.** For destructive, irreversible, external, spend, access, or publish operations, call \`prismer.approval.request_human_approval\`; do not inline-mention a human asking for approval.
 
 ## Example: group discussion handoff
 
@@ -1306,23 +1277,7 @@ var HermesProfileConfigSchema = z3.object({
   hermesSourceDir: z3.string().optional(),
   nativeMirrorTimeoutMs: z3.number().int().positive().default(2e3),
   /** Task authority level: executor (default) or orchestrator. */
-  taskAuthority: z3.enum(["executor", "orchestrator"]).optional().default("executor"),
-  /** Human approval escalation policy. Enforcement is currently prompt/cloud-side. */
-  approvalPolicy: z3.enum(["strict", "auto-low-risk", "autonomous"]).optional().default("auto-low-risk"),
-  /** Agent-level MCP tool allowlist. Empty/null means all tools. Supports exact names and trailing * wildcards. */
-  mcpAllowlist: z3.array(z3.string()).nullable().optional(),
-  /** Agent-level operating principles injected through /v1/runs instructions. */
-  operatingPrinciples: z3.union([z3.string(), z3.record(z3.string())]).optional(),
-  /**
-   * Role-template snapshot carried in AgentProfile.config by cloud ACP.
-   * Expected fields used here:
-   *   - roleTemplate.mcpServers[].toolsAllowlist
-   *   - roleTemplate.operatingPrinciples
-   */
-  roleTemplate: z3.object({
-    mcpServers: z3.array(z3.object({ toolsAllowlist: z3.array(z3.string()).optional() }).passthrough()).optional(),
-    operatingPrinciples: z3.union([z3.string(), z3.record(z3.string())]).optional()
-  }).passthrough().optional()
+  taskAuthority: z3.enum(["executor", "orchestrator"]).optional().default("executor")
 });
 var hermesAdapter = {
   name: "hermes",
@@ -1337,22 +1292,14 @@ var hermesAdapter = {
       errors: r.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`)
     };
   },
-  async prepareProfile(profile) {
-    const config = HermesProfileConfigSchema.parse(profile.config);
-    if (config.configurePrismerProvider) {
-      const profileName = getHermesProfileName(profile);
-      const agentUsername = profile.agentUsername || profileName;
-      configurePrismerProvider(profileName, config, agentUsername, profile.workspaceId);
-    }
-  },
   async ensureService(profile) {
     const config = HermesProfileConfigSchema.parse(profile.config);
-    const profileName = getHermesProfileName(profile);
-    const portOverride = config.port !== 8642 ? config.port : portForProfile(`${profileName}:${config.apiKey}`, 8642);
+    const profileName = config.hermesProfileName && config.hermesProfileName !== "default" ? config.hermesProfileName : profile.agentUsername || profile.id.slice(0, 8);
+    const portOverride = config.port !== 8642 ? config.port : portForProfile(profileName, 8642);
     const baseUrl = `http://127.0.0.1:${portOverride}`;
     const agentUsername = profile.agentUsername || profileName;
     if (config.configurePrismerProvider) {
-      configurePrismerProvider(profileName, config, agentUsername, profile.workspaceId);
+      configurePrismerProvider(profileName, config, agentUsername);
     }
     if (!await checkHealth(baseUrl, config.apiKey)) {
       if (!config.autoStart) {
@@ -1362,7 +1309,6 @@ var hermesAdapter = {
 (set autoStart: true on the AgentProfile to spawn it automatically)`
         );
       }
-      await stopStaleHermesGateways(profileName, portOverride, config.startupTimeoutMs);
       spawn3("hermes", ["-p", profileName, "gateway", "run"], {
         detached: false,
         stdio: "ignore",
@@ -1422,8 +1368,6 @@ var HermesService = class {
     const startedAt = Date.now();
     let runId;
     const sysPrompt = typeof task.metadata?.systemPrompt === "string" ? task.metadata.systemPrompt : void 0;
-    const operatingPrinciples = typeof task.metadata?.operatingPrinciples === "string" ? task.metadata.operatingPrinciples : void 0;
-    const instructions = [sysPrompt, operatingPrinciples].filter(Boolean).join("\n\n");
     if (sysPrompt) {
       try {
         const profileDir = getHermesProfileDir(this.profileName);
@@ -1460,7 +1404,7 @@ var HermesService = class {
         // sent `messages: [...]` which Hermes 0.12 rejects with 400.
         body: JSON.stringify({
           input: task.prompt,
-          instructions: instructions || void 0,
+          instructions: sysPrompt,
           session_id: typeof task.metadata?.conversationId === "string" ? task.metadata.conversationId : void 0,
           stream: true
         }),
@@ -1745,7 +1689,7 @@ function formatHermesGoalText(goals) {
     return `${index + 1}. ${priority}${goal.title}${description}`;
   }).join("\n");
 }
-function configurePrismerProvider(profileName, config, agentUsername, workspaceId) {
+function configurePrismerProvider(profileName, config, agentUsername) {
   const baseUrl = resolvePrismerProviderBaseUrl(config);
   const apiKey = resolvePrismerApiKey(config);
   if (!baseUrl || !apiKey) {
@@ -1788,16 +1732,9 @@ function configurePrismerProvider(profileName, config, agentUsername, workspaceI
         PRISMER_API_KEY: apiKey,
         PRISMER_BASE_URL: baseUrl.replace(/\/api\/v1\/?$/, "")
       };
-      if (workspaceId) {
-        mcpEnv.PRISMER_WORKSPACE_ID = workspaceId;
-      }
       if (agentUsername) {
         mcpEnv.PRISMER_AGENT_USERNAME = agentUsername;
       }
-      const allowlist = resolveMcpAllowlist(config);
-      if (allowlist) {
-        mcpEnv.PRISMER_MCP_ALLOWLIST = allowlist.join(",");
-      }
       mcpServers["prismer-tasks"] = {
         command: "node",
         args: [serverPath],
@@ -1818,17 +1755,20 @@ function resolvePrismerMcpServerPath(config) {
   if (config.prismerMcpServerPath) return config.prismerMcpServerPath;
   if (process.env.PRISMER_MCP_SERVER) return process.env.PRISMER_MCP_SERVER;
   try {
+    const { createRequire } = __require("module");
     const req = createRequire(import.meta.url);
     return req.resolve("@prismer/mcp-server");
   } catch {
   }
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const candidate = join(here, "../../mcp/dist/index.js");
+    const { fileURLToPath: fileURLToPath2 } = __require("url");
+    const { join: join14, dirname: dirname8 } = __require("path");
+    const here = dirname8(fileURLToPath2(import.meta.url));
+    const candidate = join14(here, "../../mcp/dist/index.js");
     if (existsSync(candidate)) return candidate;
-    const candidate2 = join(here, "../../../mcp/dist/index.js");
+    const candidate2 = join14(here, "../../../mcp/dist/index.js");
     if (existsSync(candidate2)) return candidate2;
-    const candidate3 = join(here, "../../../../mcp/dist/index.js");
+    const candidate3 = join14(here, "../../../../mcp/dist/index.js");
     if (existsSync(candidate3)) return candidate3;
   } catch {
   }
@@ -1997,29 +1937,25 @@ function runPythonJson(args, env, timeoutMs) {
     });
   });
 }
-function readHermesConfig(path9) {
-  if (!existsSync(path9)) return {};
+function readHermesConfig(path7) {
+  if (!existsSync(path7)) return {};
   try {
-    return YAML.parse(readFileSync(path9, "utf8")) ?? {};
+    return YAML.parse(readFileSync(path7, "utf8")) ?? {};
   } catch (err) {
-    throw new Error(`Failed to parse Hermes config at ${path9}: ${err.message}`);
+    throw new Error(`Failed to parse Hermes config at ${path7}: ${err.message}`);
   }
 }
-function writeEnvValue(path9, key, value) {
-  mkdirSync(dirname(path9), { recursive: true });
-  const lines = existsSync(path9) ? readFileSync(path9, "utf8").split(/\r?\n/) : [];
+function writeEnvValue(path7, key, value) {
+  mkdirSync(dirname(path7), { recursive: true });
+  const lines = existsSync(path7) ? readFileSync(path7, "utf8").split(/\r?\n/) : [];
   const next = lines.filter((line) => !line.startsWith(`${key}=`) && line.trim() !== "");
   next.push(`${key}=${quoteEnv(value)}`);
-  writeFileSync(path9, `${next.join("\n")}
+  writeFileSync(path7, `${next.join("\n")}
 `, "utf8");
 }
 function quoteEnv(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
-function getHermesProfileName(profile) {
-  const configured = profile.config && typeof profile.config.hermesProfileName === "string" ? profile.config.hermesProfileName : void 0;
-  return configured && configured !== "default" ? configured : profile.agentUsername || profile.id.slice(0, 8);
-}
 function getHermesProfileDir(profileName) {
   const root = process.env.HERMES_HOME || join(homedir(), ".hermes");
   if (!profileName || profileName === "default") return root;
@@ -2041,18 +1977,6 @@ function resolvePrismerProviderBaseUrl(config) {
 function resolvePrismerApiKey(config) {
   return process.env[config.prismerApiKeyEnv] || process.env.PRISMER_API_KEY || "";
 }
-function resolveMcpAllowlist(config) {
-  if (Array.isArray(config.mcpAllowlist)) return normalizeAllowlist(config.mcpAllowlist);
-  const prismerServer = config.roleTemplate?.mcpServers?.find((server) => {
-    const record = server;
-    return record.package === "@prismer/mcp-server" || record.name === "prismer-tasks";
-  });
-  if (!prismerServer) return null;
-  return Array.isArray(prismerServer.toolsAllowlist) ? normalizeAllowlist(prismerServer.toolsAllowlist) : null;
-}
-function normalizeAllowlist(values) {
-  return values.map((value) => value.trim()).filter(Boolean);
-}
 function normalizeProviderName(value) {
   return value.trim().toLowerCase().replace(/\s+/g, "-");
 }
@@ -2158,71 +2082,9 @@ async function waitForHealthy(baseUrl, apiKey, timeoutMs) {
   }
   throw new Error(`Hermes did not become healthy at ${baseUrl} within ${timeoutMs}ms`);
 }
-async function stopStaleHermesGateways(profileName, port, timeoutMs) {
-  const pids = findHermesGatewayPids(profileName, port);
-  for (const pid of pids) {
-    try {
-      process.kill(pid, "SIGTERM");
-    } catch {
-      continue;
-    }
-  }
-  const deadline = Date.now() + Math.min(timeoutMs, 5e3);
-  while (Date.now() < deadline) {
-    const alive = pids.filter(pidAlive);
-    if (alive.length === 0) return;
-    await new Promise((r) => setTimeout(r, 100));
-  }
-  for (const pid of pids) {
-    if (!pidAlive(pid)) continue;
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-    }
-  }
-}
-function findHermesGatewayPids(profileName, port) {
-  try {
-    const out = execFileSync("ps", ["-axo", "pid=,command="], { encoding: "utf8" });
-    const current = process.pid;
-    const escapedProfile = escapeRegExp(profileName);
-    const profilePattern = new RegExp(`(?:^|\\s)-p\\s+${escapedProfile}(?:\\s|$)`);
-    const portPattern = new RegExp(`(?:^|\\s)API_SERVER_PORT=${port}(?:\\s|$)`);
-    return out.split(/\r?\n/).map((line) => {
-      const trimmed = line.trim();
-      const match = /^(\d+)\s+(.+)$/.exec(trimmed);
-      if (!match) return null;
-      const pid = Number.parseInt(match[1], 10);
-      const command = match[2];
-      if (!Number.isFinite(pid) || pid === current) return null;
-      if (!isHermesGatewayCommand(command)) return null;
-      if (!profilePattern.test(command) && !portPattern.test(command)) return null;
-      return pid;
-    }).filter((pid) => pid !== null);
-  } catch {
-    return [];
-  }
-}
-function isHermesGatewayCommand(command) {
-  if (!/\bgateway\b/.test(command) || !/\brun\b/.test(command)) return false;
-  return /(^|\s)(?:\S*\/)?hermes(?:\s|$)/.test(command);
-}
-function pidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 
 // src/adapters/openclaw/index.ts
 import { z as z4 } from "zod";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
 var OpenClawProfileConfigSchema = z4.object({
   /** OpenClaw chat-completions HTTP port. */
   port: z4.number().int().min(1).max(65535).default(18789),
@@ -2236,13 +2098,7 @@ var OpenClawProfileConfigSchema = z4.object({
    * by `agents.defaults.model.primary` in openclaw.json (e.g.
    * `prismer/us-kimi-k2.5`, set by the bootstrap).
    */
-  model: z4.string().min(1).default("openclaw"),
-  mcpAllowlist: z4.array(z4.string()).nullable().optional(),
-  approvalPolicy: z4.enum(["strict", "auto-low-risk", "autonomous"]).optional().default("auto-low-risk"),
-  roleTemplate: z4.object({
-    mcpServers: z4.array(z4.object({ toolsAllowlist: z4.array(z4.string()).optional() }).passthrough()).optional()
-  }).passthrough().optional(),
-  skillsDir: z4.string().optional()
+  model: z4.string().min(1).default("openclaw")
 });
 var openclawAdapter = {
   name: "openclaw",
@@ -2266,24 +2122,22 @@ var openclawAdapter = {
   openclaw gateway --port ${config.port}`
       );
     }
-    return new OpenClawService(baseUrl, config.apiKey, config.model, resolveOpenClawSkillsDir(profile, config));
+    return new OpenClawService(baseUrl, config.apiKey, config.model);
   },
   async health() {
     return { available: true };
   }
 };
 var OpenClawService = class {
-  constructor(baseUrl, apiKey, model, skillsDir) {
+  constructor(baseUrl, apiKey, model) {
     this.baseUrl = baseUrl;
     this.apiKey = apiKey;
     this.model = model;
-    this.skillsDir = skillsDir;
     this.id = baseUrl;
   }
   baseUrl;
   apiKey;
   model;
-  skillsDir;
   id;
   async healthy() {
     return checkHealth2(this.baseUrl, this.apiKey);
@@ -2344,15 +2198,6 @@ var OpenClawService = class {
     }
   }
 };
-function getOpenClawSkillsDir(profile) {
-  const config = OpenClawProfileConfigSchema.parse(profile.config);
-  return resolveOpenClawSkillsDir(profile, config);
-}
-function resolveOpenClawSkillsDir(profile, config) {
-  if (config.skillsDir) return config.skillsDir;
-  const name = profile.agentUsername || profile.id.slice(0, 8);
-  return join2(process.env.OPENCLAW_HOME || join2(homedir2(), ".openclaw"), "profiles", name, "skills");
-}
 async function checkHealth2(baseUrl, apiKey) {
   try {
     const res = await fetch(`${baseUrl}/health`, {
@@ -2368,8 +2213,8 @@ async function checkHealth2(baseUrl, apiKey) {
 // src/config.ts
 import * as TOML from "@iarna/toml";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
 import { z as z5 } from "zod";
 var ConfigSchema = z5.object({
   /** API key from `prismer setup`, or env override. */
@@ -2399,14 +2244,14 @@ var ConfigSchema = z5.object({
   }).optional()
 });
 function resolvePaths(home) {
-  const root = home ?? process.env.PRISMER_HOME ?? join3(homedir3(), ".prismer");
+  const root = home ?? process.env.PRISMER_HOME ?? join2(homedir2(), ".prismer");
   return {
     root,
-    configFile: join3(root, "config.toml"),
-    localDb: join3(root, "local.db"),
-    cacheDir: join3(root, "cache"),
-    logsDir: join3(root, "logs"),
-    runsDir: join3(root, "runs")
+    configFile: join2(root, "config.toml"),
+    localDb: join2(root, "local.db"),
+    cacheDir: join2(root, "cache"),
+    logsDir: join2(root, "logs"),
+    runsDir: join2(root, "runs")
   };
 }
 function configExists(paths = resolvePaths()) {
@@ -2461,7 +2306,7 @@ var INSTALL_SPECS = {
     binary: "claude",
     hint: "Set ANTHROPIC_API_KEY in your shell profile, or rely on Claude Code OAuth login. Run `claude login` to sign in.",
     authHints: ["ANTHROPIC_API_KEY or Claude Code OAuth login (`claude login`)"],
-    hookTarget: { path: join5(homedir4(), ".claude", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join4(homedir3(), ".claude", "hooks.json"), kind: "json-file" }
   },
   openclaw: {
     name: "openclaw",
@@ -2470,7 +2315,7 @@ var INSTALL_SPECS = {
     binary: "openclaw",
     hint: "OpenClaw runs as a gateway. Configure ~/.openclaw/openclaw.json and start it with `openclaw gateway` before tasks dispatch.",
     authHints: ["~/.openclaw/openclaw.json gateway.auth.bearerTokens", "Prismer daemon api_key"],
-    hookTarget: { path: join5(homedir4(), ".openclaw", "hooks"), kind: "directory" }
+    hookTarget: { path: join4(homedir3(), ".openclaw", "hooks"), kind: "directory" }
   },
   codex: {
     name: "codex",
@@ -2479,7 +2324,7 @@ var INSTALL_SPECS = {
     binary: "codex",
     hint: "Set OPENAI_API_KEY in your shell profile. Verify with `codex --help`.",
     authHints: ["OPENAI_API_KEY or Codex CLI account login"],
-    hookTarget: { path: join5(homedir4(), ".codex", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join4(homedir3(), ".codex", "hooks.json"), kind: "json-file" }
   },
   hermes: {
     name: "hermes",
@@ -2488,7 +2333,7 @@ var INSTALL_SPECS = {
     binary: "hermes",
     hint: "Hermes runs as a long-lived HTTP gateway in your own Python venv. Start with `hermes -p <profile> gateway` after configuring ~/.hermes/.env.",
     authHints: ["~/.hermes/.env API_SERVER_KEY", "Hermes profile provider credentials"],
-    hookTarget: { path: join5(homedir4(), ".hermes", "hooks.json"), kind: "json-file" }
+    hookTarget: { path: join4(homedir3(), ".hermes", "hooks.json"), kind: "json-file" }
   }
 };
 function buildAdapterCommand() {
@@ -2576,8 +2421,8 @@ function buildAdapterCommand() {
   });
   return cmd;
 }
-function runInstall(spec, version, dryRun) {
-  const { argv0, args } = installCommand(spec, version);
+function runInstall(spec, version2, dryRun) {
+  const { argv0, args } = installCommand(spec, version2);
   getUI().line(`> ${argv0} ${args.join(" ")}`);
   if (dryRun) {
     getUI().line("(dry-run \u2014 not executing)");
@@ -2704,7 +2549,7 @@ function runHooks(spec, opts) {
   let backup;
   if (planned.kind === "directory") {
     mkdirSync3(planned.path, { recursive: true });
-    const markerPath = join5(planned.path, "prismer.json");
+    const markerPath = join4(planned.path, "prismer.json");
     backup = backupIfExists(markerPath);
     writeFileSync4(markerPath, JSON.stringify(prismerHookMarker(spec), null, 2) + "\n", "utf8");
   } else {
@@ -2721,16 +2566,16 @@ function runHooks(spec, opts) {
     hook: inspectHook(spec)
   };
 }
-function installCommand(spec, version) {
-  const ref = version === "latest" ? spec.package : `${spec.package}@${version}`;
+function installCommand(spec, version2) {
+  const ref = version2 === "latest" ? spec.package : `${spec.package}@${version2}`;
   switch (spec.manager) {
     case "npm":
       return { argv0: "npm", args: ["install", "-g", ref] };
     case "pipx":
-      const pyRef = version === "latest" ? spec.package : `${spec.package}==${version}`;
+      const pyRef = version2 === "latest" ? spec.package : `${spec.package}==${version2}`;
       return { argv0: "pipx", args: ["install", pyRef] };
     case "pip":
-      const pipRef = version === "latest" ? spec.package : `${spec.package}==${version}`;
+      const pipRef = version2 === "latest" ? spec.package : `${spec.package}==${version2}`;
       return { argv0: "pip", args: ["install", "--user", pipRef] };
   }
 }
@@ -2778,7 +2623,7 @@ function inspectAuthEnv(spec) {
         hints: spec.authHints ?? []
       };
     case "hermes": {
-      const envFile = join5(homedir4(), ".hermes", ".env");
+      const envFile = join4(homedir3(), ".hermes", ".env");
       return {
         ok: existsSync5(envFile) || Boolean(process.env.HERMES_API_KEY || process.env.API_SERVER_KEY),
         present: [
@@ -2789,7 +2634,7 @@ function inspectAuthEnv(spec) {
       };
     }
     case "openclaw": {
-      const cfgFile = join5(homedir4(), ".openclaw", "openclaw.json");
+      const cfgFile = join4(homedir3(), ".openclaw", "openclaw.json");
       return {
         ok: existsSync5(cfgFile) || Boolean(process.env.OPENCLAW_API_KEY),
         present: [
@@ -2809,8 +2654,8 @@ function inspectHook(spec) {
     return { supported: false, markerPresent: false };
   }
   if (spec.name === "openclaw") {
-    const jsonPath = join5(homedir4(), ".openclaw", "hooks.json");
-    const markerPath = join5(target.path, "prismer.json");
+    const jsonPath = join4(homedir3(), ".openclaw", "hooks.json");
+    const markerPath = join4(target.path, "prismer.json");
     const jsonMarkerPresent = existsSync5(jsonPath) && fileContainsPrismerMarker(jsonPath);
     const dirMarkerPresent = existsSync5(markerPath) && fileContainsPrismerMarker(markerPath);
     return {
@@ -2824,7 +2669,7 @@ function inspectHook(spec) {
     };
   }
   if (target.kind === "directory") {
-    const markerPath = join5(target.path, "prismer.json");
+    const markerPath = join4(target.path, "prismer.json");
     return {
       supported: true,
       kind: target.kind,
@@ -2868,21 +2713,21 @@ function prismerHookMarker(spec) {
     installed_at: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-function mergeHookJson(path9, spec) {
+function mergeHookJson(path7, spec) {
   const marker = prismerHookMarker(spec);
-  if (!existsSync5(path9)) {
+  if (!existsSync5(path7)) {
     return {
       prismer: marker
     };
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path9, "utf8"));
+    parsed = JSON.parse(readFileSync5(path7, "utf8"));
   } catch (err) {
-    throw new Error(`Cannot parse ${path9} as JSON: ${err.message}`);
+    throw new Error(`Cannot parse ${path7} as JSON: ${err.message}`);
   }
   if (!isRecord(parsed)) {
-    throw new Error(`Cannot merge ${path9}: expected a JSON object`);
+    throw new Error(`Cannot merge ${path7}: expected a JSON object`);
   }
   const next = { ...parsed };
   next.prismer = marker;
@@ -2900,18 +2745,18 @@ function mergeHookJson(path9, spec) {
   }
   return next;
 }
-function backupIfExists(path9) {
-  if (!existsSync5(path9)) return null;
+function backupIfExists(path7) {
+  if (!existsSync5(path7)) return null;
   const suffix = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backup = `${path9}.bak.${suffix}`;
-  const stat = statSync(path9);
+  const backup = `${path7}.bak.${suffix}`;
+  const stat = statSync(path7);
   if (stat.isDirectory()) return null;
-  copyFileSync(path9, backup);
+  copyFileSync(path7, backup);
   return backup;
 }
-function fileContainsPrismerMarker(path9) {
+function fileContainsPrismerMarker(path7) {
   try {
-    return readFileSync5(path9, "utf8").includes("prismer-daemon-runtime");
+    return readFileSync5(path7, "utf8").includes("prismer-daemon-runtime");
   } catch {
     return false;
   }
@@ -2929,7 +2774,7 @@ function readAdapterConfig() {
     return {};
   }
 }
-function recordInstallInConfig(spec, binPath, version) {
+function recordInstallInConfig(spec, binPath, version2) {
   const paths = resolvePaths();
   if (!configExists(paths)) {
     process.stderr.write(
@@ -2951,7 +2796,7 @@ function recordInstallInConfig(spec, binPath, version) {
     package_manager: spec.manager,
     package_name: spec.package,
     binary: binPath,
-    version,
+    version: version2,
     installed_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveConfig({ ...cfg, adapters }, paths);
@@ -2984,8 +2829,8 @@ var CloudClient = class {
   opts;
   fetchImpl;
   /** Low-level request. Caller decides on retry; sync-worker handles backoff. */
-  async request(method, path9, init) {
-    const url = this.urlFor(path9);
+  async request(method, path7, init) {
+    const url = this.urlFor(path7);
     const headers = {
       "Content-Type": "application/json",
       Accept: "application/json",
@@ -3044,8 +2889,8 @@ var CloudClient = class {
     return { ok: true, status: res.status, data: body ?? void 0 };
   }
   /** Convenience: GET expecting `{ ok, data }` envelope. Returns `data` or throws. */
-  async get(path9, opts) {
-    const res = await this.request("GET", path9, opts);
+  async get(path7, opts) {
+    const res = await this.request("GET", path7, opts);
     if (!res.ok) throw new CloudError(res.status, res.error?.code ?? "unknown", res.error?.message ?? "request failed");
     if (res.data && typeof res.data === "object" && "ok" in res.data) {
       const env = res.data;
@@ -3054,14 +2899,14 @@ var CloudClient = class {
     }
     return res.data;
   }
-  urlFor(path9) {
+  urlFor(path7) {
     const trimmedBase = this.opts.baseUrl.replace(/\/$/, "");
-    const trimmedPath = path9.startsWith("/") ? path9 : `/${path9}`;
+    const trimmedPath = path7.startsWith("/") ? path7 : `/${path7}`;
     return `${trimmedBase}${trimmedPath}`;
   }
   /** Raw byte download (for asset cache). Returns response so caller can stream body. */
-  async fetchRaw(path9, init) {
-    const url = this.urlFor(path9);
+  async fetchRaw(path7, init) {
+    const url = this.urlFor(path7);
     const headers = {
       Authorization: `Bearer ${this.opts.apiKey}`,
       ...init?.headers ?? {}
@@ -3233,11 +3078,11 @@ var MIGRATIONS = [
 function runSql(db, sql) {
   db["exec"](sql);
 }
-function openLocalDb(path9) {
-  if (path9 !== ":memory:" && !existsSync6(dirname5(path9))) {
-    mkdirSync4(dirname5(path9), { recursive: true });
+function openLocalDb(path7) {
+  if (path7 !== ":memory:" && !existsSync6(dirname5(path7))) {
+    mkdirSync4(dirname5(path7), { recursive: true });
   }
-  const db = new Database2(path9);
+  const db = new Database2(path7);
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
   runMigrations(db);
@@ -3617,7 +3462,7 @@ async function fetchCloudProfiles(cloud, imUserId) {
 async function fetchLocalServer() {
   const paths = resolvePaths();
   const pid = readPidFile(paths);
-  if (!pid || !pidAlive2(pid)) return { ok: false, error: "daemon process is not running", agents: [] };
+  if (!pid || !pidAlive(pid)) return { ok: false, error: "daemon process is not running", agents: [] };
   try {
     const [healthRes, agentsRes] = await Promise.all([
       fetch(`${LOCAL_SERVER}/healthz`, { signal: AbortSignal.timeout(1e3) }),
@@ -3641,664 +3486,83 @@ function whichBinary2(bin) {
 
 // src/cli/commands/asset.ts
 import { Command as Command3 } from "commander";
-import { existsSync as existsSync10, lstatSync, readdirSync, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
-import { basename, dirname as dirname7, join as join9, relative } from "path";
-
-// src/asset-cache.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join6 } from "path";
-function rowToCached(row) {
-  return {
-    contentHash: row.content_hash,
-    sizeBytes: row.size_bytes,
-    mime: row.mime,
-    localPath: row.local_path,
-    fetchedAt: row.fetched_at,
-    lastUsedAt: row.last_used_at,
-    pin: row.pin === 1
-  };
-}
-var AssetCache = class {
-  db;
-  cloud;
-  cacheDir;
-  maxBytes;
-  constructor(opts) {
-    this.db = opts.db;
-    this.cloud = opts.cloud;
-    this.cacheDir = opts.cacheDir;
-    this.maxBytes = opts.maxBytes ?? 5 * 1024 * 1024 * 1024;
-    if (!existsSync7(this.cacheDir)) {
-      mkdirSync5(this.cacheDir, { recursive: true });
-    }
-  }
-  /** Local file path for a content hash. Files split by first 2 chars for fs scaling. */
-  pathFor(hash) {
-    return join6(this.cacheDir, hash.slice(0, 2), hash);
-  }
-  get(hash) {
-    const row = this.db.prepare("SELECT * FROM cached_assets WHERE content_hash = ?").get(hash);
-    if (!row) return void 0;
-    if (!existsSync7(row.local_path)) {
-      this.db.prepare("DELETE FROM cached_assets WHERE content_hash = ?").run(hash);
-      return void 0;
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { basename } from "path";
+init_util();
+init_ui();
+function buildAssetCommand() {
+  const cmd = new Command3("asset").description("Inspect IM assets");
+  cmd.command("list").description("List assets for a workspace, optionally filtered by task").option("--workspace-id <id>", "Workspace id").option("--task-id <id>", "Task id filter").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
+    const cloud = mkCloud();
+    const query = new URLSearchParams();
+    if (opts.workspaceId) query.set("workspaceId", opts.workspaceId);
+    if (opts.taskId) query.set("taskId", opts.taskId);
+    const path7 = `/api/im/assets${query.toString() ? `?${query.toString()}` : ""}`;
+    const res = await cloud.request("GET", path7);
+    if (!res.ok) exitWithError(`asset list failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_list_failed" });
+    const body = res.data;
+    if (isErrorEnvelope(body)) {
+      exitWithError(`asset list failed (${res.status}): ${errorMessage(body)}`, { code: "asset_list_failed" });
     }
-    this.touch(hash);
-    return rowToCached({ ...row, last_used_at: Date.now() });
-  }
-  /** Bump `last_used_at` (call when an asset is consulted). */
-  touch(hash) {
-    this.db.prepare("UPDATE cached_assets SET last_used_at = ? WHERE content_hash = ?").run(Date.now(), hash);
-  }
-  pin(hash) {
-    this.db.prepare("UPDATE cached_assets SET pin = 1 WHERE content_hash = ?").run(hash);
-  }
-  unpin(hash) {
-    this.db.prepare("UPDATE cached_assets SET pin = 0 WHERE content_hash = ?").run(hash);
-  }
-  /**
-   * Get or fetch by hash. On miss, downloads the raw bytes and caches them.
-   *
-   * Why two endpoints: `GET /api/im/assets/by-hash/:hash` returns the JSON
-   * `AssetDTO` (id, contentHash, storageUri, …) — *metadata only*. The raw
-   * bytes live at `GET /api/im/assets/:id`. If `opts.assetId` is supplied
-   * the caller already has the id from an `AssetRef`, so we go straight to
-   * the byte endpoint; otherwise we resolve `hash → id` first (one extra
-   * round-trip on the metadata route) before downloading the body.
-   *
-   * Earlier this method called `by-hash` and treated the JSON body as the
-   * asset content — the daemon stored the 500-byte metadata blob on disk
-   * and `resolveAssetRefs` inlined that JSON into the prompt. The agent
-   * saw `{"id":"…","storageUri":"…"}` instead of the user's file and
-   * concluded the upload had failed.
-   */
-  async getOrFetch(hash, opts) {
-    const existing = this.get(hash);
-    if (existing) return existing;
-    const wsParam = opts?.workspaceIdHint ? `?wsId=${encodeURIComponent(opts.workspaceIdHint)}` : "";
-    let assetId = opts?.assetId;
-    if (!assetId) {
-      const metaRes = await this.cloud.fetchRaw(
-        `/api/im/assets/by-hash/${encodeURIComponent(hash)}${wsParam}`,
-        { signal: opts?.signal }
-      );
-      if (!metaRes.ok) {
-        throw new Error(`Asset metadata fetch failed for ${hash}: HTTP ${metaRes.status}`);
-      }
-      const metaJson = await metaRes.json();
-      if (!metaJson?.ok || typeof metaJson.data?.id !== "string") {
-        throw new Error(`Asset metadata payload missing id for ${hash}`);
-      }
-      assetId = metaJson.data.id;
+    if (opts.json) {
+      printJson(body ?? null);
+      return;
     }
-    const res = await this.cloud.fetchRaw(`/api/im/assets/${encodeURIComponent(assetId)}`, {
-      signal: opts?.signal
-    });
-    if (!res.ok) {
-      throw new Error(`Asset bytes fetch failed for ${hash} (id=${assetId}): HTTP ${res.status}`);
+    printAssetList(body);
+  }, { code: "asset_list_failed" }));
+  cmd.command("upload <file>").description("Upload a local file as an IM asset").requiredOption("--workspace-id <id>", "Workspace id").option("--kind <kind>", "Asset kind", "file").option("--task-id <id>", "Source task id").option("--agent-id <id>", "Source agent IM user id").option("--container-id <id>", "Container id; also added to metadata for sandbox-output assets").option("--metadata <json>", "Additional JSON metadata").option("--mime <type>", "Override file MIME type").option("--json", "Output machine-readable JSON").action(runAction(async (file, opts) => {
+    const body = await uploadAsset(file, opts);
+    if (opts.json) {
+      printJson(body ?? null);
+      return;
     }
-    const buf = Buffer.from(await res.arrayBuffer());
-    const actualHash = sha256(buf);
-    if (actualHash !== hash) {
-      throw new Error(`Asset hash mismatch for ${hash}: downloaded ${actualHash}`);
+    printAssetDetail("Uploaded asset", file, body);
+  }, { code: "asset_upload_failed" }));
+  cmd.command("download <assetId>").description("Download asset bytes").requiredOption("--out <path>", "Destination file path").action(runAction(async (assetId, opts) => {
+    await downloadAsset(assetId, opts.out);
+    getUI().line(`Downloaded ${assetId} -> ${opts.out}`);
+  }, { code: "asset_download_failed" }));
+  cmd.command("get <assetId>").description("Fetch asset metadata by id").option("--json", "Output machine-readable JSON").action(runAction(async (assetId, opts) => {
+    const cloud = mkCloud();
+    const res = await cloud.request("GET", `/api/im/assets/${encodeURIComponent(assetId)}/detail`);
+    if (!res.ok) exitWithError(`asset get failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_get_failed" });
+    const body = res.data;
+    if (isErrorEnvelope(body)) {
+      exitWithError(`asset get failed (${res.status}): ${errorMessage(body)}`, { code: "asset_get_failed" });
     }
-    const localPath = this.pathFor(hash);
-    if (!existsSync7(dirname6(localPath))) {
-      mkdirSync5(dirname6(localPath), { recursive: true });
+    if (opts.json) {
+      printJson(body ?? null);
+      return;
     }
-    const tmpPath = `${localPath}.${process.pid}.${Date.now()}.tmp`;
-    writeFileSync5(tmpPath, buf);
-    renameSync(tmpPath, localPath);
-    const mime = res.headers.get("content-type");
-    const now = Date.now();
-    this.db.prepare(
-      `INSERT OR REPLACE INTO cached_assets
-         (content_hash, size_bytes, mime, local_path, fetched_at, last_used_at, pin)
-         VALUES (?, ?, ?, ?, ?, ?, 0)`
-    ).run(hash, buf.length, mime, localPath, now, now);
-    this.evictIfOver();
-    return {
-      contentHash: hash,
-      sizeBytes: buf.length,
-      mime,
-      localPath,
-      fetchedAt: now,
-      lastUsedAt: now,
-      pin: false
-    };
-  }
-  /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
-  registerLocal(hash, localPath, mime) {
-    const actualHash = sha256(readFileBuffer(localPath));
-    if (actualHash !== hash) {
-      throw new Error(`Asset hash mismatch for ${hash}: local file is ${actualHash}`);
+    printAssetDetail("Asset", assetId, body);
+  }, { code: "asset_get_failed" }));
+  cmd.command("by-hash <sha256>").description("Fetch asset metadata by content hash").option("--workspace-id <id>", "Workspace id (required by the cloud API)").option("--json", "Output machine-readable JSON").action(runAction(async (sha2562, opts) => {
+    const cloud = mkCloud();
+    const query = new URLSearchParams();
+    if (opts.workspaceId) query.set("wsId", opts.workspaceId);
+    const path7 = `/api/im/assets/by-hash/${encodeURIComponent(sha2562)}${query.toString() ? `?${query.toString()}` : ""}`;
+    const res = await cloud.request("GET", path7);
+    if (!res.ok) exitWithError(`asset by-hash failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_by_hash_failed" });
+    const body = res.data;
+    if (isErrorEnvelope(body)) {
+      exitWithError(`asset by-hash failed (${res.status}): ${errorMessage(body)}`, { code: "asset_by_hash_failed" });
     }
-    const size = statSync2(localPath).size;
-    const now = Date.now();
-    this.db.prepare(
-      `INSERT OR REPLACE INTO cached_assets
-         (content_hash, size_bytes, mime, local_path, fetched_at, last_used_at, pin)
-         VALUES (?, ?, ?, ?, ?, ?, 1)`
-    ).run(hash, size, mime ?? null, localPath, now, now);
-    return { contentHash: hash, sizeBytes: size, mime: mime ?? null, localPath, fetchedAt: now, lastUsedAt: now, pin: true };
-  }
-  /** Total bytes across all rows (incl. pinned). */
-  totalBytes() {
-    const row = this.db.prepare("SELECT COALESCE(SUM(size_bytes),0) AS total FROM cached_assets").get();
-    return row.total;
-  }
-  /** Run LRU eviction until under cap. Pinned rows are never evicted. */
-  evictIfOver() {
-    let total = this.totalBytes();
-    if (total <= this.maxBytes) return { removed: 0, freed: 0 };
-    const candidates = this.db.prepare(
-      `SELECT content_hash, size_bytes, local_path FROM cached_assets
-         WHERE pin = 0
-         ORDER BY last_used_at ASC`
-    ).all();
-    let freed = 0;
-    let removed = 0;
-    for (const row of candidates) {
-      if (total <= this.maxBytes) break;
-      try {
-        if (existsSync7(row.local_path)) unlinkSync2(row.local_path);
-      } catch {
-      }
-      this.db.prepare("DELETE FROM cached_assets WHERE content_hash = ?").run(row.content_hash);
-      freed += row.size_bytes;
-      total -= row.size_bytes;
-      removed += 1;
+    if (opts.json) {
+      printJson(body ?? null);
+      return;
     }
-    return { removed, freed };
-  }
-};
-function sha256(buf) {
-  return createHash("sha256").update(buf).digest("hex");
+    printAssetDetail("Asset hash", sha2562, body);
+  }, { code: "asset_by_hash_failed" }));
+  return cmd;
 }
-function readFileBuffer(path9) {
-  return readFileSync6(path9);
-}
-
-// src/daemon/asset/metadata-index.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
-var DEFAULT_LIMIT = 8;
-var PULL_PAGE_SIZE = 500;
-var THROTTLE_MS = 3e4;
-function rowToMetadata(row) {
-  return {
-    assetId: row.asset_id,
-    contentHash: row.content_hash,
-    filename: row.filename,
-    folderPath: row.folder_path,
-    mime: row.mime,
-    kind: row.kind,
-    sizeBytes: row.size_bytes,
-    description: row.description,
-    assetIndexSeq: row.asset_index_seq
-  };
-}
-var AssetMetadataIndex = class {
-  db;
-  cloud;
-  /** Workspace ID — exposed for prismer:// URI construction. */
-  workspaceId;
-  cursorPath;
-  _lastSyncMs = 0;
-  constructor(opts) {
-    this.db = opts.db;
-    this.cloud = opts.cloud;
-    this.workspaceId = opts.workspaceId;
-    if (!existsSync8(opts.workspaceStateDir)) {
-      mkdirSync6(opts.workspaceStateDir, { recursive: true });
-    }
-    this.cursorPath = join7(opts.workspaceStateDir, "asset-metadata-cursor.json");
-  }
-  /** Persisted cursor for this workspace, or 0 on first run / corrupted file. */
-  readCursor() {
-    if (!existsSync8(this.cursorPath)) return 0;
-    try {
-      const parsed = JSON.parse(readFileSync7(this.cursorPath, "utf8"));
-      if (parsed.workspaceId !== this.workspaceId) return 0;
-      return parsed.cursor;
-    } catch {
-      return 0;
-    }
-  }
-  writeCursor(cursor) {
-    const payload = {
-      workspaceId: this.workspaceId,
-      cursor,
-      writtenAt: Date.now()
-    };
-    writeFileSync6(this.cursorPath, JSON.stringify(payload, null, 2));
-  }
-  /**
-   * Pull incremental asset metadata changes since the persisted cursor and
-   * upsert into the local index. Newer rows overwrite older ones by
-   * (workspace_id, asset_id) primary key.
-   *
-   * Returns the count of items applied + the new cursor. Throttled: if called
-   * within 30s of the last successful pull, returns immediately.
-   */
-  async pullDelta(opts) {
-    const now = Date.now();
-    if (now - this._lastSyncMs < THROTTLE_MS) {
-      return { applied: 0, cursor: this.readCursor() };
-    }
-    const since = this.readCursor();
-    const sinceParam = since > 0 ? `&since=${since}` : "";
-    const envelope2 = await this.cloud.get(
-      `/api/im/assets/index?workspaceId=${encodeURIComponent(this.workspaceId)}&limit=${PULL_PAGE_SIZE}${sinceParam}`,
-      { signal: opts?.signal }
-    );
-    const upsert = this.db.prepare(`
-      INSERT INTO asset_metadata_index
-        (workspace_id, asset_id, content_hash, filename, folder_path, mime, kind, size_bytes, description, asset_index_seq, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(workspace_id, asset_id) DO UPDATE SET
-        content_hash = excluded.content_hash,
-        filename = excluded.filename,
-        folder_path = excluded.folder_path,
-        mime = excluded.mime,
-        kind = excluded.kind,
-        size_bytes = excluded.size_bytes,
-        description = excluded.description,
-        asset_index_seq = excluded.asset_index_seq,
-        updated_at = excluded.updated_at
-    `);
-    const nowTs = Date.now();
-    let applied = 0;
-    const tx = this.db.transaction((items) => {
-      for (const item of items) {
-        const assetId = item.assetId ?? item.id;
-        if (!assetId) {
-          throw new Error("Asset metadata index item missing assetId/id");
-        }
-        upsert.run(
-          this.workspaceId,
-          assetId,
-          item.contentHash,
-          item.filename ?? null,
-          item.folderPath ?? null,
-          item.mime,
-          item.kind,
-          item.sizeBytes,
-          item.description ?? null,
-          item.assetIndexSeq,
-          nowTs
-        );
-        applied += 1;
-      }
-    });
-    try {
-      tx(envelope2.items);
-      this.writeCursor(envelope2.cursor);
-    } catch (err) {
-      throw err;
-    }
-    this._lastSyncMs = now;
-    return { applied, cursor: envelope2.cursor };
-  }
-  /**
-   * Search local index by filename or description substring.
-   * Escapes LIKE wildcards (% and _). Default limit 8.
-   */
-  search(query, limit) {
-    const escaped = query.replace(/%/g, "\\%").replace(/_/g, "\\_");
-    const pattern = `%${escaped}%`;
-    const limitVal = Math.min(Math.max(limit ?? DEFAULT_LIMIT, 1), 200);
-    const rows = this.db.prepare(
-      `SELECT * FROM asset_metadata_index
-         WHERE workspace_id = ?
-           AND (filename LIKE ? ESCAPE '\\' OR description LIKE ? ESCAPE '\\')
-         ORDER BY asset_index_seq DESC
-         LIMIT ?`
-    ).all(this.workspaceId, pattern, pattern, limitVal);
-    return rows.map(rowToMetadata);
-  }
-  /** Exact match on filename column. Returns undefined if not indexed. */
-  resolveByFilename(filename) {
-    const row = this.db.prepare("SELECT * FROM asset_metadata_index WHERE workspace_id = ? AND filename = ?").get(this.workspaceId, filename);
-    return row ? rowToMetadata(row) : void 0;
-  }
-  resolveByAssetId(assetId) {
-    const row = this.db.prepare("SELECT * FROM asset_metadata_index WHERE workspace_id = ? AND asset_id = ?").get(this.workspaceId, assetId);
-    return row ? rowToMetadata(row) : void 0;
-  }
-  resolveByContentHash(contentHash) {
-    const row = this.db.prepare("SELECT * FROM asset_metadata_index WHERE workspace_id = ? AND content_hash = ?").get(this.workspaceId, contentHash);
-    return row ? rowToMetadata(row) : void 0;
-  }
-  /** Batch exact match — returns Map for O(1) access. */
-  resolveByFilenames(filenames) {
-    if (filenames.length === 0) return /* @__PURE__ */ new Map();
-    const placeholders = filenames.map(() => "?").join(",");
-    const params = [this.workspaceId, ...filenames];
-    const rows = this.db.prepare(
-      `SELECT * FROM asset_metadata_index
-         WHERE workspace_id = ? AND filename IN (${placeholders})`
-    ).all(...params);
-    const map = /* @__PURE__ */ new Map();
-    for (const row of rows) {
-      if (row.filename) map.set(row.filename, rowToMetadata(row));
-    }
-    return map;
-  }
-};
-
-// src/daemon/asset/mirror.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join8 } from "path";
-function rowToBinding(row) {
-  return {
-    workspaceId: row.workspace_id,
-    path: row.path,
-    assetId: row.asset_id,
-    contentHash: row.content_hash,
-    version: row.version,
-    syncedAt: row.synced_at,
-    dirty: row.dirty === 1
-  };
-}
-var WorkspaceMirror = class {
-  db;
-  cloud;
-  workspaceId;
-  cursorPath;
-  constructor(opts) {
-    this.db = opts.db;
-    this.cloud = opts.cloud;
-    this.workspaceId = opts.workspaceId;
-    if (!existsSync9(opts.workspaceStateDir)) {
-      mkdirSync7(opts.workspaceStateDir, { recursive: true });
-    }
-    this.cursorPath = join8(opts.workspaceStateDir, "asset-cursor.json");
-  }
-  /** Persisted cursor for this workspace, or null on first run / corrupted file. */
-  readCursor() {
-    if (!existsSync9(this.cursorPath)) return null;
-    try {
-      const parsed = JSON.parse(readFileSync8(this.cursorPath, "utf8"));
-      if (parsed.workspaceId !== this.workspaceId) return null;
-      return parsed.cursor;
-    } catch {
-      return null;
-    }
-  }
-  writeCursor(cursor) {
-    const payload = {
-      workspaceId: this.workspaceId,
-      cursor,
-      writtenAt: Date.now()
-    };
-    writeFileSync7(this.cursorPath, JSON.stringify(payload, null, 2));
-  }
-  /**
-   * Pull workspace_file changes since the persisted cursor and upsert into
-   * the local mirror. Soft-deleted rows are removed from the mirror; active
-   * rows are upserted with synced_at = now and dirty = 0.
-   *
-   * Returns the count of items applied + the new cursor (may be unchanged
-   * when the cloud has nothing new). Idempotent — safe to retry.
-   */
-  async pullDelta(opts) {
-    const since = this.readCursor();
-    const sinceParam = since ? `?since=${encodeURIComponent(since)}` : "";
-    const envelope2 = await this.cloud.get(
-      `/api/im/workspaces/${encodeURIComponent(this.workspaceId)}/files/sync${sinceParam}`,
-      { signal: opts?.signal }
-    );
-    const upsert = this.db.prepare(`
-      INSERT INTO workspace_files_mirror (workspace_id, path, asset_id, content_hash, version, synced_at, dirty)
-      VALUES (?, ?, ?, ?, ?, ?, 0)
-      ON CONFLICT(workspace_id, path) DO UPDATE SET
-        asset_id = excluded.asset_id,
-        content_hash = excluded.content_hash,
-        version = excluded.version,
-        synced_at = excluded.synced_at,
-        dirty = 0
-    `);
-    const remove = this.db.prepare(
-      "DELETE FROM workspace_files_mirror WHERE workspace_id = ? AND path = ?"
-    );
-    const now = Date.now();
-    let applied = 0;
-    const tx = this.db.transaction((items) => {
-      for (const item of items) {
-        if (item.workspaceId !== this.workspaceId) continue;
-        if (item.deletedAt) {
-          remove.run(this.workspaceId, item.path);
-        } else if (item.contentHash) {
-          upsert.run(this.workspaceId, item.path, item.assetId, item.contentHash, item.version, now);
-        } else {
-          remove.run(this.workspaceId, item.path);
-        }
-        applied += 1;
-      }
-    });
-    tx(envelope2.items);
-    this.writeCursor(envelope2.cursor);
-    return { applied, cursor: envelope2.cursor };
-  }
-  /** Lookup the active binding for a workspace path. Returns undefined if not mirrored. */
-  lookupByPath(path9) {
-    const row = this.db.prepare("SELECT * FROM workspace_files_mirror WHERE workspace_id = ? AND path = ?").get(this.workspaceId, path9);
-    return row ? rowToBinding(row) : void 0;
-  }
-  /** Find an asset's contentHash via any path binding (asset may map to many paths). */
-  hashForAssetId(assetId) {
-    const row = this.db.prepare(
-      "SELECT content_hash FROM workspace_files_mirror WHERE workspace_id = ? AND asset_id = ? LIMIT 1"
-    ).get(this.workspaceId, assetId);
-    return row?.content_hash;
-  }
-  /** All active bindings for this workspace — used by status / debug surfaces. */
-  list() {
-    const rows = this.db.prepare("SELECT * FROM workspace_files_mirror WHERE workspace_id = ? ORDER BY path ASC").all(this.workspaceId);
-    return rows.map(rowToBinding);
-  }
-  /** Wipe the mirror for this workspace (e.g., re-pair). Cursor file is left intact. */
-  clear() {
-    this.db.prepare("DELETE FROM workspace_files_mirror WHERE workspace_id = ?").run(this.workspaceId);
-  }
-};
-
-// src/cli/commands/asset.ts
-init_util();
-init_ui();
-function buildAssetCommand() {
-  const cmd = new Command3("asset").description("Inspect IM assets");
-  cmd.command("sync").description("Sync remote asset indexes into the local daemon DB; optionally prefetch bytes").requiredOption("--workspace-id <id>", "Workspace id").option("--bytes", "Also prefetch asset bytes into ~/.prismer/cache").option("--limit <n>", "Maximum number of assets to prefetch when --bytes is set", parsePositiveInt).option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
-    const result = await syncAssets(opts);
-    if (opts.json) {
-      printJson({ ok: true, data: result });
-      return;
-    }
-    getUI().line(`Synced asset metadata: ${result.metadata.applied} applied (cursor=${result.metadata.cursor})`);
-    getUI().line(`Synced workspace files: ${result.workspaceFiles.applied} applied (cursor=${result.workspaceFiles.cursor ?? "null"})`);
-    if (opts.bytes) {
-      getUI().line(
-        `Prefetched bytes: ${result.prefetch.fetched}/${result.prefetch.considered} assets, ${result.prefetch.bytes} bytes`
-      );
-      if (result.prefetch.failed.length > 0) {
-        getUI().line(`Prefetch failures: ${result.prefetch.failed.length}`);
-      }
-    } else {
-      getUI().line("Asset bytes were not prefetched; they are downloaded lazily on first use. Run with --bytes to fill ~/.prismer/cache.");
-    }
-  }, { code: "asset_sync_failed" }));
-  cmd.command("list").description("List assets for a workspace, optionally filtered by task").option("--workspace-id <id>", "Workspace id").option("--task-id <id>", "Task id filter").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
-    const cloud = mkCloud();
-    const query = new URLSearchParams();
-    if (opts.workspaceId) query.set("workspaceId", opts.workspaceId);
-    if (opts.taskId) query.set("taskId", opts.taskId);
-    const path9 = `/api/im/assets${query.toString() ? `?${query.toString()}` : ""}`;
-    const res = await cloud.request("GET", path9);
-    if (!res.ok) exitWithError(`asset list failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_list_failed" });
-    const body = res.data;
-    if (isErrorEnvelope(body)) {
-      exitWithError(`asset list failed (${res.status}): ${errorMessage(body)}`, { code: "asset_list_failed" });
-    }
-    if (opts.json) {
-      printJson(body ?? null);
-      return;
-    }
-    printAssetList(body);
-  }, { code: "asset_list_failed" }));
-  cmd.command("upload <path>").description("Upload a local file or directory as IM assets").requiredOption("--workspace-id <id>", "Workspace id").option("--kind <kind>", "Asset kind", "file").option("--folder-path <path>", "Cloud folderPath prefix for the uploaded file(s)").option("--task-id <id>", "Source task id").option("--agent-id <id>", "Source agent IM user id").option("--container-id <id>", "Container id; also added to metadata for sandbox-output assets").option("--metadata <json>", "Additional JSON metadata").option("--mime <type>", "Override file MIME type").option("--json", "Output machine-readable JSON").action(runAction(async (inputPath, opts) => {
-    const body = await uploadAssetPath(inputPath, opts);
-    if (opts.json) {
-      printJson(body ?? null);
-      return;
-    }
-    if (isUploadManyResult(body)) {
-      getUI().line(`Uploaded ${body.data.count} assets`);
-      for (const item of body.data.items) {
-        printAssetDetail("Uploaded asset", item.file, item.response);
-      }
-    } else {
-      printAssetDetail("Uploaded asset", inputPath, body);
-    }
-  }, { code: "asset_upload_failed" }));
-  cmd.command("download <assetId>").description("Download asset bytes").requiredOption("--out <path>", "Destination file path").action(runAction(async (assetId, opts) => {
-    await downloadAsset(assetId, opts.out);
-    getUI().line(`Downloaded ${assetId} -> ${opts.out}`);
-  }, { code: "asset_download_failed" }));
-  cmd.command("get <assetId>").description("Fetch asset metadata by id").option("--json", "Output machine-readable JSON").action(runAction(async (assetId, opts) => {
-    const cloud = mkCloud();
-    const res = await cloud.request("GET", `/api/im/assets/${encodeURIComponent(assetId)}/detail`);
-    if (!res.ok) exitWithError(`asset get failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_get_failed" });
-    const body = res.data;
-    if (isErrorEnvelope(body)) {
-      exitWithError(`asset get failed (${res.status}): ${errorMessage(body)}`, { code: "asset_get_failed" });
-    }
-    if (opts.json) {
-      printJson(body ?? null);
-      return;
-    }
-    printAssetDetail("Asset", assetId, body);
-  }, { code: "asset_get_failed" }));
-  cmd.command("by-hash <sha256>").description("Fetch asset metadata by content hash").option("--workspace-id <id>", "Workspace id (required by the cloud API)").option("--json", "Output machine-readable JSON").action(runAction(async (sha2564, opts) => {
-    const cloud = mkCloud();
-    const query = new URLSearchParams();
-    if (opts.workspaceId) query.set("wsId", opts.workspaceId);
-    const path9 = `/api/im/assets/by-hash/${encodeURIComponent(sha2564)}${query.toString() ? `?${query.toString()}` : ""}`;
-    const res = await cloud.request("GET", path9);
-    if (!res.ok) exitWithError(`asset by-hash failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_by_hash_failed" });
-    const body = res.data;
-    if (isErrorEnvelope(body)) {
-      exitWithError(`asset by-hash failed (${res.status}): ${errorMessage(body)}`, { code: "asset_by_hash_failed" });
-    }
-    if (opts.json) {
-      printJson(body ?? null);
-      return;
-    }
-    printAssetDetail("Asset hash", sha2564, body);
-  }, { code: "asset_by_hash_failed" }));
-  return cmd;
-}
-function mkCloud() {
-  const cfg = loadConfig(resolvePaths());
-  return new CloudClient({ baseUrl: cfg.cloud_api_base, apiKey: cfg.api_key });
-}
-async function syncAssets(opts) {
-  const paths = resolvePaths();
-  const cfg = loadConfig(paths);
-  const cloud = new CloudClient({ baseUrl: cfg.cloud_api_base, apiKey: cfg.api_key });
-  const db = openLocalDb(paths.localDb);
-  try {
-    const stateDir = `${paths.root}/${opts.workspaceId}`;
-    const metadataIndex = new AssetMetadataIndex({
-      db,
-      cloud,
-      workspaceId: opts.workspaceId,
-      workspaceStateDir: stateDir
-    });
-    const mirror = new WorkspaceMirror({
-      db,
-      cloud,
-      workspaceId: opts.workspaceId,
-      workspaceStateDir: stateDir
-    });
-    const [metadata, workspaceFiles] = await Promise.all([
-      metadataIndex.pullDelta(),
-      mirror.pullDelta()
-    ]);
-    const prefetch = opts.bytes ? await prefetchAssetBytes({
-      db,
-      cloud,
-      workspaceId: opts.workspaceId,
-      cacheDir: paths.cacheDir,
-      maxBytes: cfg.cache?.max_bytes,
-      limit: opts.limit
-    }) : { considered: 0, fetched: 0, bytes: 0, failed: [] };
-    return { workspaceId: opts.workspaceId, metadata, workspaceFiles, prefetch };
-  } finally {
-    db.close();
-  }
-}
-async function prefetchAssetBytes(opts) {
-  const limitClause = opts.limit ? " LIMIT ?" : "";
-  const params = [opts.workspaceId];
-  if (opts.limit) params.push(opts.limit);
-  const rows = opts.db.prepare(
-    `SELECT asset_id, content_hash, mime, size_bytes
-       FROM asset_metadata_index
-       WHERE workspace_id = ?
-       ORDER BY asset_index_seq DESC${limitClause}`
-  ).all(...params);
-  const cache = new AssetCache({
-    db: opts.db,
-    cloud: opts.cloud,
-    cacheDir: opts.cacheDir,
-    maxBytes: opts.maxBytes
-  });
-  let fetched = 0;
-  let bytes = 0;
-  const failed = [];
-  for (const row of rows) {
-    try {
-      const cached = await cache.getOrFetch(row.content_hash, {
-        workspaceIdHint: opts.workspaceId,
-        assetId: row.asset_id
-      });
-      fetched += 1;
-      bytes += cached.sizeBytes;
-    } catch (err) {
-      failed.push({
-        assetId: row.asset_id,
-        contentHash: row.content_hash,
-        error: err.message
-      });
-    }
-  }
-  return { considered: rows.length, fetched, bytes, failed };
-}
-async function uploadAssetPath(inputPath, opts) {
-  if (!existsSync10(inputPath)) exitWithError(`path not found: ${inputPath}`);
-  const stat = lstatSync(inputPath);
-  if (stat.isSymbolicLink()) exitWithError(`refusing to upload symlink: ${inputPath}`);
-  if (stat.isFile()) {
-    return uploadAsset(inputPath, { ...opts, folderPath: normalizeFolderPath(opts.folderPath) });
-  }
-  if (!stat.isDirectory()) exitWithError(`path is not a file or directory: ${inputPath}`);
-  const files = listFilesRecursive(inputPath);
-  if (files.length === 0) exitWithError(`directory has no uploadable files: ${inputPath}`);
-  const items = [];
-  for (const file of files) {
-    const relDir = dirname7(relative(inputPath, file));
-    const folderPath = combineFolderPath(opts.folderPath, relDir === "." ? "" : relDir);
-    const response = await uploadAsset(file, { ...opts, folderPath });
-    items.push({ file, folderPath: folderPath ?? null, response });
-  }
-  return { ok: true, data: { count: items.length, items } };
+function mkCloud() {
+  const cfg = loadConfig(resolvePaths());
+  return new CloudClient({ baseUrl: cfg.cloud_api_base, apiKey: cfg.api_key });
 }
 async function uploadAsset(file, opts) {
-  if (!existsSync10(file)) exitWithError(`file not found: ${file}`);
+  if (!existsSync7(file)) exitWithError(`file not found: ${file}`);
   const cfg = loadConfig(resolvePaths());
-  const bytes = readFileSync9(file);
+  const bytes = readFileSync6(file);
   const metadata = parseMetadata(opts.metadata);
   if (opts.taskId && metadata.taskId === void 0) metadata.taskId = opts.taskId;
   if (opts.containerId && metadata.containerId === void 0) metadata.containerId = opts.containerId;
@@ -4307,7 +3571,6 @@ async function uploadAsset(file, opts) {
   form.set("kind", opts.kind);
   if (opts.agentId) form.set("sourceAgentImUserId", opts.agentId);
   if (opts.taskId) form.set("sourceTaskId", opts.taskId);
-  if (opts.folderPath !== void 0) form.set("folderPath", opts.folderPath);
   if (Object.keys(metadata).length > 0) form.set("metadata", JSON.stringify(metadata));
   form.set("file", new Blob([bytes], { type: opts.mime ?? "application/octet-stream" }), basename(file));
   const url = `${cfg.cloud_api_base.replace(/\/$/, "")}/api/im/assets`;
@@ -4327,37 +3590,6 @@ async function uploadAsset(file, opts) {
   }
   return body;
 }
-function listFilesRecursive(root) {
-  const out = [];
-  for (const name of readdirSync(root)) {
-    if (name.startsWith(".")) continue;
-    const full = join9(root, name);
-    const stat = lstatSync(full);
-    if (stat.isSymbolicLink()) continue;
-    if (stat.isDirectory()) {
-      out.push(...listFilesRecursive(full));
-    } else if (stat.isFile()) {
-      out.push(full);
-    }
-  }
-  return out.sort();
-}
-function combineFolderPath(prefix, relDir) {
-  const normalizedPrefix = normalizeFolderPath(prefix);
-  const normalizedRel = normalizeFolderPath(relDir);
-  if (normalizedPrefix && normalizedRel) return `${normalizedPrefix}/${normalizedRel}`;
-  return normalizedPrefix ?? normalizedRel;
-}
-function normalizeFolderPath(value) {
-  if (value === void 0) return void 0;
-  const normalized = value.trim().replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
-  return normalized.length > 0 ? normalized : "";
-}
-function isUploadManyResult(raw) {
-  return Boolean(
-    raw && typeof raw === "object" && raw.ok === true && raw.data && Array.isArray(raw.data.items)
-  );
-}
 async function downloadAsset(assetId, outPath) {
   const cloud = mkCloud();
   const res = await cloud.fetchRaw(`/api/im/assets/${encodeURIComponent(assetId)}`);
@@ -4366,7 +3598,7 @@ async function downloadAsset(assetId, outPath) {
     exitWithError(`asset download failed (${res.status}): ${errorMessage(body)}`);
   }
   const bytes = Buffer.from(await res.arrayBuffer());
-  writeFileSync8(outPath, bytes);
+  writeFileSync5(outPath, bytes);
 }
 function parseMetadata(raw) {
   if (!raw) return {};
@@ -4451,13 +3683,6 @@ function stringField(obj, key) {
   const value = obj?.[key];
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function parsePositiveInt(raw) {
-  const n = Number(raw);
-  if (!Number.isInteger(n) || n <= 0) {
-    throw new Error("--limit must be a positive integer");
-  }
-  return n;
-}
 
 // src/cli/commands/banner.ts
 init_util();
@@ -4513,7 +3738,7 @@ ${name} (${role})`);
     getUI().line(`Group created ${data.groupId ?? "(unknown)"}
 ${data.title ?? opts.name} (${memberCount} members)`);
   });
-  group.command("messages <groupId>").description("List group messages").option("--limit <n>", "Max messages", parsePositiveInt2).option("--before <id>", "Return messages before this message id").option("--json", "Print raw JSON response").action(async (groupId, opts) => {
+  group.command("messages <groupId>").description("List group messages").option("--limit <n>", "Max messages", parsePositiveInt).option("--before <id>", "Return messages before this message id").option("--json", "Print raw JSON response").action(async (groupId, opts) => {
     const data = await requestOrExit(
       "GET",
       withQuery(`/api/im/groups/${encodeURIComponent(groupId)}/messages`, {
@@ -4551,7 +3776,7 @@ ${data.title ?? opts.name} (${memberCount} members)`);
     getUI().line(`Removed ${memberId} from group ${groupId}`);
   });
   cmd.addCommand(group);
-  cmd.command("messages <conversationId>").description("List conversation messages").option("--limit <n>", "Max messages", parsePositiveInt2).option("--before <id>", "Return messages before this message id").option("--json", "Print raw JSON response").action(async (conversationId, opts) => {
+  cmd.command("messages <conversationId>").description("List conversation messages").option("--limit <n>", "Max messages", parsePositiveInt).option("--before <id>", "Return messages before this message id").option("--json", "Print raw JSON response").action(async (conversationId, opts) => {
     const data = await requestOrExit(
       "GET",
       withQuery(`/api/im/messages/${encodeURIComponent(conversationId)}`, {
@@ -4567,15 +3792,15 @@ ${data.title ?? opts.name} (${memberCount} members)`);
   });
   return cmd;
 }
-async function requestOrExit(method, path9, body) {
+async function requestOrExit(method, path7, body) {
   let res;
   try {
-    res = await mkCloud2().request(method, path9, body === void 0 ? void 0 : { body });
+    res = await mkCloud2().request(method, path7, body === void 0 ? void 0 : { body });
   } catch (err) {
     exitWithError(sanitizeError(err.message));
   }
   if (!res.ok) {
-    exitWithError(`${method} ${path9} failed (${res.status}): ${sanitizeError(res.error?.message ?? "unknown")}`);
+    exitWithError(`${method} ${path7} failed (${res.status}): ${sanitizeError(res.error?.message ?? "unknown")}`);
   }
   return unwrapEnvelope(res.data);
 }
@@ -4607,20 +3832,20 @@ function unwrapEnvelope(raw) {
 function parseCsv(value) {
   return value.split(",").map((v) => v.trim()).filter(Boolean);
 }
-function parsePositiveInt2(value) {
+function parsePositiveInt(value) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isInteger(parsed) || parsed < 1) {
     throw new Error("expected a positive integer");
   }
   return parsed;
 }
-function withQuery(path9, params) {
+function withQuery(path7, params) {
   const query = new URLSearchParams();
   for (const [key, value] of Object.entries(params)) {
     if (value !== void 0) query.set(key, String(value));
   }
   const suffix = query.toString();
-  return suffix ? `${path9}?${suffix}` : path9;
+  return suffix ? `${path7}?${suffix}` : path7;
 }
 function printMessageSummary(label, data) {
   const msg = data.message ?? {};
@@ -4747,7 +3972,7 @@ init_util();
 init_ui();
 function buildCookbookCommand() {
   const cmd = new Command7("cookbook").description("Run CLI-only 54release MVP regression suites");
-  cmd.command("run").description("Run one or more cookbook smoke suites using the configured API key").option("--suite <name>", "status|im|task|group|asset|sandbox|all, comma-separated", "all").option("--workspace-id <id>", "Workspace id for workspace-scoped suites").option("--agent-id <id>", "Agent IM user id for task create smoke").option("--group-id <id>", "Group/conversation id for group message history smoke").option("--sandbox-id <id>", "Sandbox id for sandbox status smoke").option("--prompt <text>", "Prompt for optional task create smoke").option("--timeout-ms <ms>", "Request/task timeout", parsePositiveInt3, 6e4).option("--strict", "Treat skipped optional checks as failure").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
+  cmd.command("run").description("Run one or more cookbook smoke suites using the configured API key").option("--suite <name>", "status|im|task|group|asset|sandbox|all, comma-separated", "all").option("--workspace-id <id>", "Workspace id for workspace-scoped suites").option("--agent-id <id>", "Agent IM user id for task create smoke").option("--group-id <id>", "Group/conversation id for group message history smoke").option("--sandbox-id <id>", "Sandbox id for sandbox status smoke").option("--prompt <text>", "Prompt for optional task create smoke").option("--timeout-ms <ms>", "Request/task timeout", parsePositiveInt2, 6e4).option("--strict", "Treat skipped optional checks as failure").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
     const suites = parseSuites(opts.suite);
     const cloud = mkCloud3(opts.timeoutMs);
     const checks = [];
@@ -4789,8 +4014,8 @@ async function runStatusSuite(cloud) {
     await check("status", "cloud health", "GET", "/api/health"),
     await check("status", "current IM identity", "GET", "/api/im/me", void 0, cloud)
   ];
-  async function check(suite, name, method, path9, body, client = cloud) {
-    return requestCheck(client, suite, name, method, path9, body);
+  async function check(suite, name, method, path7, body, client = cloud) {
+    return requestCheck(client, suite, name, method, path7, body);
   }
 }
 async function runIMSuite(cloud) {
@@ -4864,27 +4089,27 @@ async function runSandboxSuite(cloud, opts) {
   }
   return checks;
 }
-async function requestCheck(cloud, suite, name, method, path9, body) {
+async function requestCheck(cloud, suite, name, method, path7, body) {
   let res;
   try {
-    res = await cloud.request(method, path9, body === void 0 ? void 0 : { body });
+    res = await cloud.request(method, path7, body === void 0 ? void 0 : { body });
   } catch (err) {
-    return { suite, name, status: "fail", endpoint: path9, detail: sanitize(err.message) };
+    return { suite, name, status: "fail", endpoint: path7, detail: sanitize(err.message) };
   }
   if (!res.ok) {
     return {
       suite,
       name,
       status: "fail",
-      endpoint: path9,
+      endpoint: path7,
       detail: sanitize(`${res.status}: ${res.error?.message ?? "request failed"}`)
     };
   }
   const data = unwrap(res.data);
   if (isApiError(res.data)) {
-    return { suite, name, status: "fail", endpoint: path9, detail: sanitize(apiErrorMessage(res.data)), data: res.data };
+    return { suite, name, status: "fail", endpoint: path7, detail: sanitize(apiErrorMessage(res.data)), data: res.data };
   }
-  return { suite, name, status: "pass", endpoint: path9, detail: summarizeData(data), data };
+  return { suite, name, status: "pass", endpoint: path7, detail: summarizeData(data), data };
 }
 async function pollTask(cloud, taskId, timeoutMs) {
   const started = Date.now();
@@ -4991,7 +4216,7 @@ function taskFrom(data) {
 function sanitize(message) {
   return message.replace(/sk-prismer-[A-Za-z0-9_-]+/g, "sk-prismer-***");
 }
-function parsePositiveInt3(value) {
+function parsePositiveInt2(value) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
     throw new Error("expected a positive integer");
@@ -5002,16 +4227,14 @@ function parsePositiveInt3(value) {
 // src/cli/commands/daemon.ts
 import { Command as Command8 } from "commander";
 import { spawn as spawn5 } from "child_process";
-import { createReadStream, existsSync as existsSync14, mkdirSync as mkdirSync9, openSync as openSync2, statSync as statSync4 } from "fs";
-import { setTimeout as sleep2 } from "timers/promises";
-import { join as join17 } from "path";
+import { createReadStream, existsSync as existsSync13, mkdirSync as mkdirSync8, openSync, statSync as statSync3 } from "fs";
+import { setTimeout as sleep } from "timers/promises";
+import { join as join11 } from "path";
 
 // src/daemon/runner.ts
 import { EventEmitter as EventEmitter3 } from "events";
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
-import { mkdir } from "fs/promises";
-import { homedir as homedir7, platform } from "os";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { platform } from "os";
 
 // src/adapters/registry.ts
 var AdapterRegistry = class {
@@ -5038,34 +4261,193 @@ var AdapterRegistry = class {
   get(name) {
     return this.adapters.get(name);
   }
-  list() {
-    return Array.from(this.adapters.values());
+  list() {
+    return Array.from(this.adapters.values());
+  }
+  size() {
+    return this.adapters.size;
+  }
+  /**
+   * Find adapters that satisfy a capability tag.
+   *
+   * Match rules (deterministic, sorted by name):
+   * - exact: adapter declared the tag verbatim
+   * - wildcard: adapter declared `code.*` → matches `code.write`
+   */
+  findByCapability(capability) {
+    const matches2 = [];
+    for (const adapter of this.adapters.values()) {
+      if (adapter.capabilities.includes(capability)) {
+        matches2.push(adapter);
+        continue;
+      }
+      if (adapter.capabilities.some(
+        (tag) => tag.endsWith(".*") && capability.startsWith(tag.slice(0, -1))
+      )) {
+        matches2.push(adapter);
+      }
+    }
+    matches2.sort((a, b) => a.name.localeCompare(b.name));
+    return matches2;
+  }
+};
+
+// src/asset-cache.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join5 } from "path";
+function rowToCached(row) {
+  return {
+    contentHash: row.content_hash,
+    sizeBytes: row.size_bytes,
+    mime: row.mime,
+    localPath: row.local_path,
+    fetchedAt: row.fetched_at,
+    lastUsedAt: row.last_used_at,
+    pin: row.pin === 1
+  };
+}
+var AssetCache = class {
+  db;
+  cloud;
+  cacheDir;
+  maxBytes;
+  constructor(opts) {
+    this.db = opts.db;
+    this.cloud = opts.cloud;
+    this.cacheDir = opts.cacheDir;
+    this.maxBytes = opts.maxBytes ?? 5 * 1024 * 1024 * 1024;
+    if (!existsSync8(this.cacheDir)) {
+      mkdirSync5(this.cacheDir, { recursive: true });
+    }
+  }
+  /** Local file path for a content hash. Files split by first 2 chars for fs scaling. */
+  pathFor(hash) {
+    return join5(this.cacheDir, hash.slice(0, 2), hash);
+  }
+  get(hash) {
+    const row = this.db.prepare("SELECT * FROM cached_assets WHERE content_hash = ?").get(hash);
+    if (!row) return void 0;
+    if (!existsSync8(row.local_path)) {
+      this.db.prepare("DELETE FROM cached_assets WHERE content_hash = ?").run(hash);
+      return void 0;
+    }
+    this.touch(hash);
+    return rowToCached({ ...row, last_used_at: Date.now() });
+  }
+  /** Bump `last_used_at` (call when an asset is consulted). */
+  touch(hash) {
+    this.db.prepare("UPDATE cached_assets SET last_used_at = ? WHERE content_hash = ?").run(Date.now(), hash);
+  }
+  pin(hash) {
+    this.db.prepare("UPDATE cached_assets SET pin = 1 WHERE content_hash = ?").run(hash);
+  }
+  unpin(hash) {
+    this.db.prepare("UPDATE cached_assets SET pin = 0 WHERE content_hash = ?").run(hash);
+  }
+  /**
+   * Get or fetch by hash. On miss, downloads the raw bytes and caches them.
+   *
+   * Why two endpoints: `GET /api/im/assets/by-hash/:hash` returns the JSON
+   * `AssetDTO` (id, contentHash, storageUri, …) — *metadata only*. The raw
+   * bytes live at `GET /api/im/assets/:id`. If `opts.assetId` is supplied
+   * the caller already has the id from an `AssetRef`, so we go straight to
+   * the byte endpoint; otherwise we resolve `hash → id` first (one extra
+   * round-trip on the metadata route) before downloading the body.
+   *
+   * Earlier this method called `by-hash` and treated the JSON body as the
+   * asset content — the daemon stored the 500-byte metadata blob on disk
+   * and `resolveAssetRefs` inlined that JSON into the prompt. The agent
+   * saw `{"id":"…","storageUri":"…"}` instead of the user's file and
+   * concluded the upload had failed.
+   */
+  async getOrFetch(hash, opts) {
+    const existing = this.get(hash);
+    if (existing) return existing;
+    const wsParam = opts?.workspaceIdHint ? `?wsId=${encodeURIComponent(opts.workspaceIdHint)}` : "";
+    let assetId = opts?.assetId;
+    if (!assetId) {
+      const metaRes = await this.cloud.fetchRaw(
+        `/api/im/assets/by-hash/${encodeURIComponent(hash)}${wsParam}`,
+        { signal: opts?.signal }
+      );
+      if (!metaRes.ok) {
+        throw new Error(`Asset metadata fetch failed for ${hash}: HTTP ${metaRes.status}`);
+      }
+      const metaJson = await metaRes.json();
+      if (!metaJson?.ok || typeof metaJson.data?.id !== "string") {
+        throw new Error(`Asset metadata payload missing id for ${hash}`);
+      }
+      assetId = metaJson.data.id;
+    }
+    const res = await this.cloud.fetchRaw(`/api/im/assets/${encodeURIComponent(assetId)}`, {
+      signal: opts?.signal
+    });
+    if (!res.ok) {
+      throw new Error(`Asset bytes fetch failed for ${hash} (id=${assetId}): HTTP ${res.status}`);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    const localPath = this.pathFor(hash);
+    if (!existsSync8(dirname6(localPath))) {
+      mkdirSync5(dirname6(localPath), { recursive: true });
+    }
+    writeFileSync6(localPath, buf);
+    const mime = res.headers.get("content-type");
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT OR REPLACE INTO cached_assets
+         (content_hash, size_bytes, mime, local_path, fetched_at, last_used_at, pin)
+         VALUES (?, ?, ?, ?, ?, ?, 0)`
+    ).run(hash, buf.length, mime, localPath, now, now);
+    this.evictIfOver();
+    return {
+      contentHash: hash,
+      sizeBytes: buf.length,
+      mime,
+      localPath,
+      fetchedAt: now,
+      lastUsedAt: now,
+      pin: false
+    };
+  }
+  /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
+  registerLocal(hash, localPath, mime) {
+    const size = statSync2(localPath).size;
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT OR REPLACE INTO cached_assets
+         (content_hash, size_bytes, mime, local_path, fetched_at, last_used_at, pin)
+         VALUES (?, ?, ?, ?, ?, ?, 1)`
+    ).run(hash, size, mime ?? null, localPath, now, now);
+    return { contentHash: hash, sizeBytes: size, mime: mime ?? null, localPath, fetchedAt: now, lastUsedAt: now, pin: true };
   }
-  size() {
-    return this.adapters.size;
+  /** Total bytes across all rows (incl. pinned). */
+  totalBytes() {
+    const row = this.db.prepare("SELECT COALESCE(SUM(size_bytes),0) AS total FROM cached_assets").get();
+    return row.total;
   }
-  /**
-   * Find adapters that satisfy a capability tag.
-   *
-   * Match rules (deterministic, sorted by name):
-   * - exact: adapter declared the tag verbatim
-   * - wildcard: adapter declared `code.*` → matches `code.write`
-   */
-  findByCapability(capability) {
-    const matches2 = [];
-    for (const adapter of this.adapters.values()) {
-      if (adapter.capabilities.includes(capability)) {
-        matches2.push(adapter);
-        continue;
-      }
-      if (adapter.capabilities.some(
-        (tag) => tag.endsWith(".*") && capability.startsWith(tag.slice(0, -1))
-      )) {
-        matches2.push(adapter);
+  /** Run LRU eviction until under cap. Pinned rows are never evicted. */
+  evictIfOver() {
+    let total = this.totalBytes();
+    if (total <= this.maxBytes) return { removed: 0, freed: 0 };
+    const candidates = this.db.prepare(
+      `SELECT content_hash, size_bytes, local_path FROM cached_assets
+         WHERE pin = 0
+         ORDER BY last_used_at ASC`
+    ).all();
+    let freed = 0;
+    let removed = 0;
+    for (const row of candidates) {
+      if (total <= this.maxBytes) break;
+      try {
+        if (existsSync8(row.local_path)) unlinkSync2(row.local_path);
+      } catch {
       }
+      this.db.prepare("DELETE FROM cached_assets WHERE content_hash = ?").run(row.content_hash);
+      freed += row.size_bytes;
+      total -= row.size_bytes;
+      removed += 1;
     }
-    matches2.sort((a, b) => a.name.localeCompare(b.name));
-    return matches2;
+    return { removed, freed };
   }
 };
 
@@ -5322,20 +4704,20 @@ var UriResolver = class {
     }
     return { texts: all, resolvedHashes: dedupe(allHashes) };
   }
-  async lookupFile(workspaceId, path9, signal) {
+  async lookupFile(workspaceId, path7, signal) {
     const local = this.db.prepare(
       "SELECT asset_id, content_hash, version FROM workspace_files_mirror WHERE workspace_id = ? AND path = ?"
-    ).get(workspaceId, path9);
+    ).get(workspaceId, path7);
     if (local) return local;
     const remote = await this.cloud.get(
-      `/api/im/workspaces/${encodeURIComponent(workspaceId)}/files?path=${encodeURIComponent(path9)}`,
+      `/api/im/workspaces/${encodeURIComponent(workspaceId)}/files?path=${encodeURIComponent(path7)}`,
       { signal }
     );
     this.db.prepare(
       `INSERT OR REPLACE INTO workspace_files_mirror
          (workspace_id, path, asset_id, content_hash, version, synced_at, dirty)
          VALUES (?, ?, ?, ?, ?, ?, 0)`
-    ).run(workspaceId, path9, remote.assetId, remote.contentHash, remote.version, Date.now());
+    ).run(workspaceId, path7, remote.assetId, remote.contentHash, remote.version, Date.now());
     return { asset_id: remote.assetId, content_hash: remote.contentHash, version: remote.version };
   }
 };
@@ -5344,96 +4726,11 @@ function dedupe(xs) {
 }
 
 // src/daemon/dispatch.ts
-import { readFileSync as readFileSync10, promises as fsp2 } from "fs";
+import { readFileSync as readFileSync7, promises as fsp } from "fs";
 import * as path2 from "path";
-
-// src/daemon/skill-sync.ts
-import { promises as fsp } from "fs";
-import { join as join10 } from "path";
-import { createHash as createHash2 } from "crypto";
-async function syncInstalledSkillsForDispatch(profile, agentImUserId, cloud, signal) {
-  if (!agentImUserId) return { synced: 0, skipped: 0, unchanged: 0 };
-  const data = await cloud.get(
-    `/api/im/skills/installed?agentId=${encodeURIComponent(agentImUserId)}`,
-    { signal }
-  );
-  const entries = normalizeInstalledSkills(data);
-  const skillsRoot = resolveSkillsRoot(profile);
-  if (!skillsRoot) return { synced: 0, skipped: 0, unchanged: 0 };
-  let synced = 0;
-  let skipped = 0;
-  let unchanged = 0;
-  for (const entry of entries) {
-    const slug = sanitizeSlug(trimmedStringFrom(entry.skill?.slug) ?? trimmedStringFrom(entry.slug));
-    const content = contentStringFrom(entry.skill?.content) ?? contentStringFrom(entry.content);
-    if (!slug || !content) {
-      skipped++;
-      if (slug && !content) {
-        process.stderr.write(`[daemon] skill sync skipped ${slug}: missing content
-`);
-      }
-      continue;
-    }
-    const skillDir = join10(skillsRoot, slug);
-    await fsp.mkdir(skillDir, { recursive: true });
-    const target = join10(skillDir, "SKILL.md");
-    const existing = await fsp.readFile(target, "utf8").catch(() => null);
-    if (existing != null && sha2562(existing) === sha2562(content)) {
-      unchanged++;
-      continue;
-    }
-    await fsp.writeFile(target, content, "utf8");
-    synced++;
-  }
-  return { synced, skipped, unchanged };
-}
-function resolveSkillsRoot(profile) {
-  if (profile.adapterName === "hermes") return join10(getHermesProfileDir(getHermesProfileName(profile)), "skills");
-  if (profile.adapterName === "openclaw") return getOpenClawSkillsDir(profile);
-  return null;
-}
-function sha2562(value) {
-  return createHash2("sha256").update(value).digest("hex");
-}
-function normalizeInstalledSkills(data) {
-  if (Array.isArray(data)) return data.filter(isInstalledSkillEntry);
-  if (!data || typeof data !== "object" || Array.isArray(data)) return [];
-  const record = data;
-  const nested = record.data;
-  if (Array.isArray(nested)) return nested.filter(isInstalledSkillEntry);
-  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
-    const skills2 = nested.skills;
-    if (Array.isArray(skills2)) return skills2.filter(isInstalledSkillEntry);
-  }
-  const skills = record.skills;
-  if (Array.isArray(skills)) return skills.filter(isInstalledSkillEntry);
-  return [];
-}
-function isInstalledSkillEntry(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function trimmedStringFrom(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function contentStringFrom(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function sanitizeSlug(value) {
-  if (!value) return void 0;
-  const safe = value.replace(/[^a-zA-Z0-9_-]/g, "");
-  return safe || void 0;
-}
-
-// src/daemon/dispatch.ts
 var DEFAULT_CONTEXT_MAX = 8e3;
 var GOAL_CONTEXT_MAX = 4;
 var MEMORY_DIGEST_MAX_BYTES = 4e3;
-var DEFAULT_OPERATING_PRINCIPLES = [
-  "- Decide and act; only request human approval for destructive operations or irreversible external effects.",
-  "- Assignable work should become explicit tasks; do not leave concrete work as chat discussion only.",
-  "- Use workspace asset tools for uploaded files: search/describe first, then read bounded ranges; do not claim file contents unless a tool call succeeded.",
-  "- Keep users informed with concise status and concrete next steps."
-].join("\n");
 var ASSET_INLINE_FULL_MAX_BYTES = 64 * 1024;
 var ASSET_INLINE_TRUNCATE_BYTES = 16 * 1024;
 async function handleDispatch(payload, requestId, deps) {
@@ -5444,7 +4741,7 @@ async function handleDispatch(payload, requestId, deps) {
   const outboxDir = outboxBase ? path2.join(outboxBase, "_outbox") : null;
   if (outboxDir) {
     try {
-      await fsp2.mkdir(outboxDir, { recursive: true });
+      await fsp.mkdir(outboxDir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `[daemon] outbox provision failed task=${taskId} dir=${outboxDir}: ${err.message}
@@ -5471,18 +4768,6 @@ async function handleDispatch(payload, requestId, deps) {
       sendReply(deps.ws, reply, requestId);
       return reply;
     }
-    try {
-      const skillSync = await syncInstalledSkillsForDispatch(profile, agentImUserId, deps.cloud, deps.signal);
-      if (skillSync.synced > 0 || skillSync.skipped > 0) {
-        process.stderr.write(
-          `[daemon] skill sync profile=${profile.id} adapter=${profile.adapterName} synced=${skillSync.synced} skipped=${skillSync.skipped}
-`
-        );
-      }
-    } catch (err) {
-      process.stderr.write(`[daemon] skill sync skipped profile=${profile.id}: ${err.message}
-`);
-    }
     let hashRefResult = { text: payload.prompt, resolutions: [] };
     if (deps.assetMetadataIndexes && profile.workspaceId) {
       const assetIndex = deps.assetMetadataIndexes.get(profile.workspaceId);
@@ -5532,7 +4817,6 @@ async function handleDispatch(payload, requestId, deps) {
 `
       );
     }
-    const operatingPrinciples = resolveOperatingPrinciples(profile.config);
     const taskInput = {
       taskId,
       prompt: adapterPrompt,
@@ -5541,7 +4825,6 @@ async function handleDispatch(payload, requestId, deps) {
         conversationId: payload.conversationId,
         prismerGoals: goalContext.map(toGoalMirrorPayload),
         ...profileSystemPrompt ? { systemPrompt: profileSystemPrompt } : {},
-        ...operatingPrinciples ? { operatingPrinciples } : {},
         // Wave-9: spawn-style adapters (claude-code, codex, openclaw) read
         // this and inject `PRISMER_OUTBOX_DIR=<abs>` into the child env so
         // the LLM tool can resolve the path even if it doesn't read the
@@ -5812,7 +5095,7 @@ async function resolveAssetRefs(refs, cache) {
     const inlineCandidate = isTextLikeMime(effectiveMime);
     if (inlineCandidate) {
       try {
-        const buf = readFileSync10(cached.localPath);
+        const buf = readFileSync7(cached.localPath);
         let strategy;
         let body;
         if (buf.byteLength <= ASSET_INLINE_FULL_MAX_BYTES) {
@@ -5886,36 +5169,6 @@ ${memory.digest.trim()}
 
 ${prompt}`;
 }
-function resolveOperatingPrinciples(config) {
-  const cfg = readRecord(config);
-  const roleTemplate = readRecord(cfg.roleTemplate);
-  const principles = stringifyPrinciples(cfg.operatingPrinciples) ?? stringifyPrinciples(roleTemplate.operatingPrinciples) ?? DEFAULT_OPERATING_PRINCIPLES;
-  const policy = typeof cfg.approvalPolicy === "string" ? cfg.approvalPolicy : roleTemplate.approvalPolicy;
-  if (policy === "strict") {
-    return `${principles}
-- Approval policy: strict. Request human approval before destructive, external, spend, access, or publish operations.`;
-  }
-  if (policy === "autonomous") {
-    return `${principles}
-- Approval policy: autonomous. Do not request human approval unless a platform policy explicitly requires it.`;
-  }
-  return `${principles}
-- Approval policy: auto-low-risk. Proceed on reversible low-risk work; request human approval for destructive or irreversible operations.`;
-}
-function stringifyPrinciples(value) {
-  if (typeof value === "string" && value.trim()) return value.trim();
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    const record = value;
-    for (const key of ["en", "zh"]) {
-      const text = record[key];
-      if (typeof text === "string" && text.trim()) return text.trim();
-    }
-    for (const text of Object.values(record)) {
-      if (typeof text === "string" && text.trim()) return text.trim();
-    }
-  }
-  return void 0;
-}
 function appendOutboxInstruction(prompt, outboxDir, profileConfig) {
   if (!outboxDir) return prompt;
   if (profileConfig?.disableOutboxHints === true) return prompt;
@@ -5934,9 +5187,6 @@ function appendChannelContext(prompt, payload, profile) {
   const type = payload.conversationType === "direct" || payload.conversationType === "group" ? payload.conversationType : "unknown";
   const youAre = profile.agentUsername || payload.agentImUserId || "this agent";
   const lines = ["[Channel context]", `Conversation type: ${type}`, `You are: ${youAre}`];
-  if (payload.conversationId) {
-    lines.push(`Conversation ID: ${payload.conversationId}`);
-  }
   const participants = Array.isArray(payload.participants) ? payload.participants : [];
   if (participants.length > 0) {
     if (type === "direct") {
@@ -6160,7 +5410,7 @@ function updatedTime(task) {
 
 // src/daemon/local-server.ts
 import { createServer } from "http";
-import { randomUUID, createHash as createHash3 } from "crypto";
+import { randomUUID, createHash } from "crypto";
 import { promises as fs2 } from "fs";
 import * as path3 from "path";
 var LocalServer = class {
@@ -6468,10 +5718,10 @@ async function walkAndDigest(root, current) {
     }
     if (!st.isFile()) continue;
     const buf = await fs2.readFile(full);
-    const sha2564 = createHash3("sha256").update(buf).digest("hex");
+    const sha2562 = createHash("sha256").update(buf).digest("hex");
     out.push({
       path: rel,
-      sha256: sha2564,
+      sha256: sha2562,
       sizeBytes: st.size,
       mtime: Math.floor(st.mtimeMs)
     });
@@ -6487,7 +5737,7 @@ import * as path5 from "path";
 import Database3 from "better-sqlite3";
 import * as fs3 from "fs";
 import * as path4 from "path";
-import { randomUUID as randomUUID2, createHash as createHash4 } from "crypto";
+import { randomUUID as randomUUID2, createHash as createHash2 } from "crypto";
 
 // src/daemon/memory/crypto.ts
 function sealPlaintext(content) {
@@ -6638,9 +5888,9 @@ var MemoryStore = class {
     const row = db.prepare("SELECT * FROM memory_pages WHERE workspaceId = ? AND id = ?").get(this.opts.workspaceId, pageId);
     return row ? this.rowToPage(row) : null;
   }
-  loadContent(pageId, version) {
+  loadContent(pageId, version2) {
     const db = this.requireDb();
-    const targetVersion = version ?? db.prepare("SELECT version FROM memory_pages WHERE workspaceId = ? AND id = ?").get(this.opts.workspaceId, pageId)?.version;
+    const targetVersion = version2 ?? db.prepare("SELECT version FROM memory_pages WHERE workspaceId = ? AND id = ?").get(this.opts.workspaceId, pageId)?.version;
     if (targetVersion === void 0) return null;
     const row = db.prepare(
       `SELECT c.pageId, c.version, c.payloadKind, c.payloadValue
@@ -6678,7 +5928,7 @@ var MemoryStore = class {
     }
     const db = this.requireDb();
     const now = Date.now();
-    const contentHash = sha2563(input.content);
+    const contentHash = sha256(input.content);
     const payload = sealPlaintext(input.content);
     if (payload.kind !== "inline") {
       throw new Error("MemoryStore.write: non-inline payload not yet supported in phase-0");
@@ -6872,8 +6122,8 @@ var MemoryStore = class {
     };
   }
 };
-function sha2563(s) {
-  return createHash4("sha256").update(s, "utf8").digest("hex");
+function sha256(s) {
+  return createHash2("sha256").update(s, "utf8").digest("hex");
 }
 
 // src/daemon/memory/search.ts
@@ -7731,8 +6981,8 @@ function finalizeSelected(runtime, workspaceId, paths, snippetMaxBytes = DEFAULT
   const slot = runtime.peek(workspaceId);
   if (!slot) return [];
   const out = [];
-  for (const path9 of paths) {
-    const page = slot.store.loadByPath(path9);
+  for (const path7 of paths) {
+    const page = slot.store.loadByPath(path7);
     if (!page) continue;
     const content = slot.store.loadContent(page.id)?.content ?? "";
     out.push({
@@ -7990,33 +7240,186 @@ function handleRecallFinalize(runtime, body, res) {
   if (!Array.isArray(b.paths)) {
     return respond400(res, "paths[] is required");
   }
-  const paths = [];
-  for (const p of b.paths) {
-    if (typeof p === "string" && p.length > 0) paths.push(p);
+  const paths = [];
+  for (const p of b.paths) {
+    if (typeof p === "string" && p.length > 0) paths.push(p);
+  }
+  const snippetMaxBytes = typeof b.snippetMaxBytes === "number" && b.snippetMaxBytes > 0 ? b.snippetMaxBytes : void 0;
+  const results = finalizeSelected(runtime, b.workspaceId, paths, snippetMaxBytes);
+  respond2(res, 200, { workspaceId: b.workspaceId, results });
+  return true;
+}
+function parsePrismerUri(uri) {
+  const PREFIX2 = "prismer://workspace/";
+  if (!uri.startsWith(PREFIX2)) return null;
+  const rest = uri.slice(PREFIX2.length);
+  const segMemory = "/memory/";
+  const memoryIdx = rest.indexOf(segMemory);
+  if (memoryIdx <= 0) return null;
+  const workspaceId = rest.slice(0, memoryIdx);
+  const path7 = rest.slice(memoryIdx + segMemory.length);
+  if (!workspaceId || !path7) return null;
+  return { workspaceId, path: path7 };
+}
+
+// src/daemon/asset/metadata-index.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
+var DEFAULT_LIMIT = 8;
+var PULL_PAGE_SIZE = 500;
+var THROTTLE_MS = 3e4;
+function rowToMetadata(row) {
+  return {
+    assetId: row.asset_id,
+    contentHash: row.content_hash,
+    filename: row.filename,
+    folderPath: row.folder_path,
+    mime: row.mime,
+    kind: row.kind,
+    sizeBytes: row.size_bytes,
+    description: row.description,
+    assetIndexSeq: row.asset_index_seq
+  };
+}
+var AssetMetadataIndex = class {
+  db;
+  cloud;
+  /** Workspace ID — exposed for prismer:// URI construction. */
+  workspaceId;
+  cursorPath;
+  _lastSyncMs = 0;
+  constructor(opts) {
+    this.db = opts.db;
+    this.cloud = opts.cloud;
+    this.workspaceId = opts.workspaceId;
+    if (!existsSync10(opts.workspaceStateDir)) {
+      mkdirSync7(opts.workspaceStateDir, { recursive: true });
+    }
+    this.cursorPath = join9(opts.workspaceStateDir, "asset-metadata-cursor.json");
+  }
+  /** Persisted cursor for this workspace, or 0 on first run / corrupted file. */
+  readCursor() {
+    if (!existsSync10(this.cursorPath)) return 0;
+    try {
+      const parsed = JSON.parse(readFileSync8(this.cursorPath, "utf8"));
+      if (parsed.workspaceId !== this.workspaceId) return 0;
+      return parsed.cursor;
+    } catch {
+      return 0;
+    }
+  }
+  writeCursor(cursor) {
+    const payload = {
+      workspaceId: this.workspaceId,
+      cursor,
+      writtenAt: Date.now()
+    };
+    writeFileSync7(this.cursorPath, JSON.stringify(payload, null, 2));
+  }
+  /**
+   * Pull incremental asset metadata changes since the persisted cursor and
+   * upsert into the local index. Newer rows overwrite older ones by
+   * (workspace_id, asset_id) primary key.
+   *
+   * Returns the count of items applied + the new cursor. Throttled: if called
+   * within 30s of the last successful pull, returns immediately.
+   */
+  async pullDelta(opts) {
+    const now = Date.now();
+    if (now - this._lastSyncMs < THROTTLE_MS) {
+      return { applied: 0, cursor: this.readCursor() };
+    }
+    const since = this.readCursor();
+    const sinceParam = since > 0 ? `&since=${since}` : "";
+    const envelope2 = await this.cloud.get(
+      `/api/im/assets/index?workspaceId=${encodeURIComponent(this.workspaceId)}&limit=${PULL_PAGE_SIZE}${sinceParam}`,
+      { signal: opts?.signal }
+    );
+    const upsert = this.db.prepare(`
+      INSERT INTO asset_metadata_index
+        (workspace_id, asset_id, content_hash, filename, folder_path, mime, kind, size_bytes, description, asset_index_seq, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(workspace_id, asset_id) DO UPDATE SET
+        content_hash = excluded.content_hash,
+        filename = excluded.filename,
+        folder_path = excluded.folder_path,
+        mime = excluded.mime,
+        kind = excluded.kind,
+        size_bytes = excluded.size_bytes,
+        description = excluded.description,
+        asset_index_seq = excluded.asset_index_seq,
+        updated_at = excluded.updated_at
+    `);
+    const nowTs = Date.now();
+    let applied = 0;
+    const tx = this.db.transaction((items) => {
+      for (const item of items) {
+        upsert.run(
+          this.workspaceId,
+          item.assetId,
+          item.contentHash,
+          item.filename ?? null,
+          item.folderPath ?? null,
+          item.mime,
+          item.kind,
+          item.sizeBytes,
+          item.description ?? null,
+          item.assetIndexSeq,
+          nowTs
+        );
+        applied += 1;
+      }
+    });
+    try {
+      tx(envelope2.items);
+      this.writeCursor(envelope2.cursor);
+    } catch (err) {
+      throw err;
+    }
+    this._lastSyncMs = now;
+    return { applied, cursor: envelope2.cursor };
+  }
+  /**
+   * Search local index by filename or description substring.
+   * Escapes LIKE wildcards (% and _). Default limit 8.
+   */
+  search(query, limit) {
+    const escaped = query.replace(/%/g, "\\%").replace(/_/g, "\\_");
+    const pattern = `%${escaped}%`;
+    const limitVal = Math.min(Math.max(limit ?? DEFAULT_LIMIT, 1), 200);
+    const rows = this.db.prepare(
+      `SELECT * FROM asset_metadata_index
+         WHERE workspace_id = ?
+           AND (filename LIKE ? ESCAPE '\\' OR description LIKE ? ESCAPE '\\')
+         ORDER BY asset_index_seq DESC
+         LIMIT ?`
+    ).all(this.workspaceId, pattern, pattern, limitVal);
+    return rows.map(rowToMetadata);
+  }
+  /** Exact match on filename column. Returns undefined if not indexed. */
+  resolveByFilename(filename) {
+    const row = this.db.prepare("SELECT * FROM asset_metadata_index WHERE workspace_id = ? AND filename = ?").get(this.workspaceId, filename);
+    return row ? rowToMetadata(row) : void 0;
+  }
+  /** Batch exact match — returns Map for O(1) access. */
+  resolveByFilenames(filenames) {
+    if (filenames.length === 0) return /* @__PURE__ */ new Map();
+    const placeholders = filenames.map(() => "?").join(",");
+    const params = [this.workspaceId, ...filenames];
+    const rows = this.db.prepare(
+      `SELECT * FROM asset_metadata_index
+         WHERE workspace_id = ? AND filename IN (${placeholders})`
+    ).all(...params);
+    const map = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      if (row.filename) map.set(row.filename, rowToMetadata(row));
+    }
+    return map;
   }
-  const snippetMaxBytes = typeof b.snippetMaxBytes === "number" && b.snippetMaxBytes > 0 ? b.snippetMaxBytes : void 0;
-  const results = finalizeSelected(runtime, b.workspaceId, paths, snippetMaxBytes);
-  respond2(res, 200, { workspaceId: b.workspaceId, results });
-  return true;
-}
-function parsePrismerUri(uri) {
-  const PREFIX2 = "prismer://workspace/";
-  if (!uri.startsWith(PREFIX2)) return null;
-  const rest = uri.slice(PREFIX2.length);
-  const segMemory = "/memory/";
-  const memoryIdx = rest.indexOf(segMemory);
-  if (memoryIdx <= 0) return null;
-  const workspaceId = rest.slice(0, memoryIdx);
-  const path9 = rest.slice(memoryIdx + segMemory.length);
-  if (!workspaceId || !path9) return null;
-  return { workspaceId, path: path9 };
-}
+};
 
 // src/daemon/asset/rpc.ts
-import { closeSync, openSync, readSync, statSync as statSync3 } from "fs";
 var ASSET_PATH_PREFIX = "/local/asset/";
-var MAX_READ_BYTES = 256 * 1024;
-var MAX_SEARCH_BYTES = 1024 * 1024;
 function attachAssetRpc(opts) {
   return async (req, res) => {
     const url = req.url ?? "/";
@@ -8027,17 +7430,10 @@ function attachAssetRpc(opts) {
     try {
       if (method === "POST" && subpath === "search") {
         const body = await readJson3(req);
-        return await handleSearch2(opts, body, res);
-      }
-      if (method === "POST" && subpath === "describe") {
-        const body = await readJson3(req);
-        return handleDescribe(opts, body, res);
-      }
-      if (method === "POST" && subpath === "read") {
-        const body = await readJson3(req);
-        return await handleRead(opts, body, res);
+        return handleSearch2(opts.resolveIndex, body, res);
       }
-      return false;
+      respond3(res, 404, { error: "asset_route_not_found", path: url });
+      return true;
     } catch (err) {
       respond3(res, 500, {
         error: "asset_rpc_failed",
@@ -8047,699 +7443,55 @@ function attachAssetRpc(opts) {
     }
   };
 }
-async function handleSearch2(opts, body, res) {
+function handleSearch2(resolveIndex, body, res) {
   if (!body || typeof body !== "object") {
     return respond4002(res, "request body must be a JSON object");
   }
   const b = body;
-  if (typeof b.query !== "string" || !b.query.trim()) {
-    return respond4002(res, "query is required (non-empty string)");
-  }
-  if (typeof b.uri === "string" && b.uri.trim()) {
-    return searchAssetContent(opts, b.uri.trim(), b.query.trim(), res);
-  }
   if (typeof b.workspaceId !== "string" || !b.workspaceId) {
     return respond4002(res, "workspaceId is required (string)");
   }
-  const index = opts.resolveIndex(b.workspaceId);
-  if (!index) {
-    respond3(res, 404, {
-      error: "workspace_index_not_found",
-      workspaceId: b.workspaceId,
-      message: "No asset metadata index for this workspace. Ensure the daemon has synced asset metadata."
-    });
-    return true;
-  }
-  const limit = typeof b.limit === "number" && b.limit > 0 ? b.limit : void 0;
-  const items = index.search(b.query.trim(), limit);
-  respond3(res, 200, { items });
-  return true;
-}
-function handleDescribe(opts, body, res) {
-  const resolved = resolveAssetRef(opts, body);
-  if ("error" in resolved) return respond4002(res, resolved.error);
-  const cached = opts.assetCache?.get(resolved.row.contentHash);
-  respond3(res, 200, {
-    asset: resolved.row,
-    uri: `prismer://workspace/${resolved.workspaceId}/asset/${resolved.row.contentHash}`,
-    cache: cached ? { status: "hit", localPath: cached.localPath, sizeBytes: cached.sizeBytes, lastUsedAt: cached.lastUsedAt } : { status: "miss" },
-    tools: ["asset.describe", "asset.read", "asset.search"]
-  });
-  return true;
-}
-async function handleRead(opts, body, res) {
-  const resolved = resolveAssetRef(opts, body);
-  if ("error" in resolved) return respond4002(res, resolved.error);
-  if (!opts.assetCache) {
-    respond3(res, 503, { error: "asset_cache_unavailable" });
-    return true;
-  }
-  const b = body;
-  const offset = typeof b.offset === "number" && b.offset > 0 ? Math.floor(b.offset) : 0;
-  const requested = typeof b.length === "number" && b.length > 0 ? Math.floor(b.length) : MAX_READ_BYTES;
-  const length = Math.min(requested, MAX_READ_BYTES);
-  const cached = await opts.assetCache.getOrFetch(resolved.row.contentHash, {
-    workspaceIdHint: resolved.workspaceId,
-    assetId: resolved.row.assetId
-  });
-  const chunk = readFileRange(cached.localPath, offset, length);
-  const textLike = isTextLike(resolved.row);
-  respond3(res, 200, {
-    asset: resolved.row,
-    locator: { byteOffset: offset, byteLength: chunk.bytesRead },
-    truncated: requested > MAX_READ_BYTES || offset + chunk.bytesRead < chunk.sizeBytes,
-    encoding: textLike ? "utf8" : "base64",
-    content: textLike ? chunk.buffer.toString("utf8") : chunk.buffer.toString("base64")
-  });
-  return true;
-}
-async function searchAssetContent(opts, uri, query, res) {
-  const resolved = resolveAssetRef(opts, { uri });
-  if ("error" in resolved) return respond4002(res, resolved.error);
-  if (!opts.assetCache) {
-    respond3(res, 503, { error: "asset_cache_unavailable" });
-    return true;
-  }
-  if (!isTextLike(resolved.row)) {
-    respond3(res, 200, {
-      items: [],
-      unsupported: true,
-      reason: "content search currently supports text-like assets only",
-      asset: resolved.row
-    });
-    return true;
-  }
-  const cached = await opts.assetCache.getOrFetch(resolved.row.contentHash, {
-    workspaceIdHint: resolved.workspaceId,
-    assetId: resolved.row.assetId
-  });
-  const chunk = readFileRange(cached.localPath, 0, MAX_SEARCH_BYTES);
-  const text = chunk.buffer.toString("utf8");
-  const needle = query.toLowerCase();
-  const lines = text.split(/\r?\n/);
-  const items = [];
-  let byteOffset = 0;
-  for (let i = 0; i < lines.length && items.length < 20; i += 1) {
-    const line = lines[i] ?? "";
-    if (line.toLowerCase().includes(needle)) {
-      items.push({ line: i + 1, byteOffset, preview: line.slice(0, 500) });
-    }
-    byteOffset += Buffer.byteLength(line) + 1;
-  }
-  respond3(res, 200, {
-    items,
-    asset: resolved.row,
-    searched: { byteOffset: 0, byteLength: chunk.bytesRead, truncated: chunk.bytesRead < chunk.sizeBytes }
-  });
-  return true;
-}
-function resolveAssetRef(opts, body) {
-  if (!body || typeof body !== "object") return { error: "request body must be a JSON object" };
-  const b = body;
-  let workspaceId = typeof b.workspaceId === "string" ? b.workspaceId : "";
-  let assetId = typeof b.assetId === "string" ? b.assetId : "";
-  let contentHash = typeof b.contentHash === "string" ? b.contentHash : "";
-  if (typeof b.uri === "string" && b.uri.trim()) {
-    const [uri] = parseUris(b.uri.trim());
-    if (!uri) return { error: "uri must be prismer://workspace/<workspaceId>/asset/<hash>" };
-    if (uri.type !== "asset") return { error: "file uri lookup is not available in this RPC yet; pass asset uri or assetId" };
-    workspaceId = uri.workspaceId ?? workspaceId;
-    contentHash = uri.rest;
-  }
-  if (!workspaceId) return { error: "workspaceId is required (string)" };
-  const index = opts.resolveIndex(workspaceId);
-  if (!index) return { error: "workspace asset index is not synced yet" };
-  const row = assetId ? index.resolveByAssetId(assetId) : contentHash ? index.resolveByContentHash(contentHash) : void 0;
-  if (!row) return { error: "asset not found in local metadata index" };
-  return { workspaceId, row };
-}
-function isTextLike(row) {
-  const mime = row.mime ?? "";
-  const name = row.filename ?? "";
-  return mime.startsWith("text/") || mime.includes("json") || mime.includes("xml") || mime.includes("markdown") || mime.includes("csv") || /\.(md|markdown|txt|json|csv|tsv|ndjson|js|jsx|ts|tsx|py|go|rs|java|kt|swift|rb|php|css|html|htm|xhtml|sql|yaml|yml|toml|log)$/i.test(
-    name
-  );
-}
-function readFileRange(path9, offset, length) {
-  const sizeBytes = statSync3(path9).size;
-  if (offset >= sizeBytes) return { buffer: Buffer.alloc(0), bytesRead: 0, sizeBytes };
-  const fd = openSync(path9, "r");
-  try {
-    const target = Math.min(length, sizeBytes - offset);
-    const buffer = Buffer.alloc(target);
-    const bytesRead = readSync(fd, buffer, 0, target, offset);
-    return { buffer: buffer.subarray(0, bytesRead), bytesRead, sizeBytes };
-  } finally {
-    closeSync(fd);
-  }
-}
-function respond3(res, status, body) {
-  res.statusCode = status;
-  res.setHeader("Content-Type", "application/json");
-  res.end(JSON.stringify(body));
-}
-function respond4002(res, message) {
-  respond3(res, 400, { error: "invalid_request", message });
-  return true;
-}
-async function readJson3(req) {
-  let raw = "";
-  req.setEncoding("utf8");
-  for await (const chunk of req) raw += chunk;
-  if (!raw) return {};
-  try {
-    return JSON.parse(raw);
-  } catch {
-    throw new Error("invalid_json");
-  }
-}
-
-// src/daemon/asset/origin/drop-folder.ts
-import { promises as fs4 } from "fs";
-import { homedir as homedir6 } from "os";
-import * as path6 from "path";
-var DropFolderAdapter = class {
-  kind = "drop-folder";
-  workspaceDir;
-  rootDir;
-  constructor(opts = {}) {
-    this.workspaceDir = opts.workspaceDir;
-    this.rootDir = opts.rootDir ?? path6.join(opts.homeDir ?? homedir6(), ".prismer");
-  }
-  /**
-   * Long-lived async iterable wrapping `scanOnce` on a 1s polling interval.
-   * Stops when the iterator is broken (e.g. consumer returns / throws).
-   */
-  async *observe(workspaceId) {
-    while (true) {
-      const batch = await this.scanOnce(workspaceId);
-      for (const obs of batch) yield obs;
-      await sleep(1e3);
-    }
-  }
-  /**
-   * Single-tick scan exposed for tests and one-shot CLI usage. Reads every
-   * file currently under the workspace's drop directory, returning one
-   * observation per file. The caller is expected to feed each into the
-   * outbox; idempotency on the outbox side collapses re-observations of
-   * unchanged files.
-   */
-  async scanOnce(workspaceId) {
-    const drop = this.dropDir(workspaceId);
-    let entries = [];
-    try {
-      entries = await fs4.readdir(drop);
-    } catch (err) {
-      if (err.code === "ENOENT") return [];
-      throw err;
-    }
-    const out = [];
-    for (const name of entries) {
-      if (name.startsWith(".")) continue;
-      const fullPath = path6.join(drop, name);
-      const stat = await fs4.lstat(fullPath).catch(() => null);
-      if (!stat) continue;
-      if (stat.isSymbolicLink()) continue;
-      if (stat.isDirectory()) {
-        for (const nested of await walk(fullPath)) {
-          const nstat = await fs4.lstat(nested).catch(() => null);
-          if (!nstat || !nstat.isFile()) continue;
-          out.push(makeObservation(workspaceId, nested, drop, nstat.size, Math.floor(nstat.mtimeMs)));
-        }
-        continue;
-      }
-      if (!stat.isFile()) continue;
-      out.push(makeObservation(workspaceId, fullPath, drop, stat.size, Math.floor(stat.mtimeMs)));
-    }
-    return out;
-  }
-  async identifySource(obs) {
-    const detail = obs.detail;
-    const rel = path6.relative(detail.watchDir, detail.path);
-    const folderDir = path6.dirname(rel);
-    return {
-      sourceRef: `folder://${obs.workspaceId}/${rel.split(path6.sep).join("/")}`,
-      hints: {
-        filename: path6.basename(detail.path),
-        folderPath: folderDir === "." ? "" : folderDir.split(path6.sep).join("/")
-      }
-    };
-  }
-  async fetch(obs) {
-    const detail = obs.detail;
-    const bytes = await fs4.readFile(detail.path);
-    return {
-      bytes,
-      mime: mimeFromExtension(detail.path),
-      size: bytes.length
-    };
-  }
-  /** Hook called by UploadRunner after a successful upload of one observation. */
-  async onUploadSuccess(obs) {
-    await this.moveTo(obs, this.uploadedDir(obs.workspaceId));
-  }
-  /** Hook called by UploadRunner after attempts hit maxAttempts. */
-  async onUploadFailure(obs) {
-    await this.moveTo(obs, this.failedDir(obs.workspaceId));
-  }
-  async moveTo(obs, destDir) {
-    const detail = obs.detail;
-    if (!detail || typeof detail.path !== "string") return;
-    try {
-      const rel = typeof detail.watchDir === "string" ? path6.relative(detail.watchDir, detail.path) : path6.basename(detail.path);
-      const safeRel = rel && !rel.startsWith("..") && !path6.isAbsolute(rel) ? rel : path6.basename(detail.path);
-      const destPath = path6.join(destDir, safeRel);
-      await fs4.mkdir(path6.dirname(destPath), { recursive: true });
-      await fs4.rename(detail.path, destPath);
-    } catch (err) {
-      if (err.code === "ENOENT") return;
-      throw err;
-    }
-  }
-  dropDir(workspaceId) {
-    if (this.workspaceDir) return path6.join(this.workspaceDir, "drop");
-    return path6.join(this.rootDir, "workspaces", workspaceId, "drop");
-  }
-  uploadedDir(workspaceId) {
-    if (this.workspaceDir) return path6.join(this.workspaceDir, "uploaded");
-    return path6.join(this.rootDir, "workspaces", workspaceId, "uploaded");
-  }
-  failedDir(workspaceId) {
-    if (this.workspaceDir) return path6.join(this.workspaceDir, "upload-failed");
-    return path6.join(this.rootDir, "workspaces", workspaceId, "upload-failed");
-  }
-};
-function makeObservation(workspaceId, filePath, watchDir, size, mtime) {
-  return {
-    workspaceId,
-    detail: { path: filePath, watchDir, size, mtime },
-    observedAt: mtime
-  };
-}
-async function walk(root) {
-  const out = [];
-  const entries = await fs4.readdir(root).catch(() => []);
-  for (const name of entries) {
-    if (name.startsWith(".")) continue;
-    const full = path6.join(root, name);
-    const stat = await fs4.lstat(full).catch(() => null);
-    if (!stat) continue;
-    if (stat.isSymbolicLink()) continue;
-    if (stat.isDirectory()) {
-      out.push(...await walk(full));
-    } else if (stat.isFile()) {
-      out.push(full);
-    }
-  }
-  return out;
-}
-var MIME_BY_EXT = {
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".csv": "text/csv",
-  ".json": "application/json",
-  ".yaml": "application/yaml",
-  ".yml": "application/yaml",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".xhtml": "application/xhtml+xml",
-  ".xml": "application/xml",
-  ".zip": "application/zip",
-  ".tar": "application/x-tar",
-  ".gz": "application/gzip",
-  ".mp3": "audio/mpeg",
-  ".mp4": "video/mp4",
-  ".mov": "video/quicktime",
-  ".wav": "audio/wav"
-};
-function mimeFromExtension(p) {
-  const ext = path6.extname(p).toLowerCase();
-  return MIME_BY_EXT[ext] ?? null;
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-
-// src/daemon/asset/origin/outbox.ts
-import Database4 from "better-sqlite3";
-import { createHash as createHash5, randomUUID as randomUUID5 } from "crypto";
-import { z as z7 } from "zod";
-var OriginObservationRecordSchema = z7.object({
-  workspaceId: z7.string().min(1),
-  originKind: z7.enum(["upload", "drop-folder", "agent-gen"]),
-  sourceRef: z7.string().min(1),
-  payloadJson: z7.string().min(2),
-  hintsJson: z7.string().min(2),
-  observedAt: z7.number().int().nonnegative()
-});
-var DDL_STATEMENTS = [
-  `CREATE TABLE IF NOT EXISTS asset_origin_outbox (
-    id TEXT PRIMARY KEY,
-    workspaceId TEXT NOT NULL,
-    originKind TEXT NOT NULL,
-    sourceRef TEXT NOT NULL,
-    payloadJson TEXT NOT NULL,
-    hintsJson TEXT NOT NULL,
-    observedAt INTEGER NOT NULL,
-    idempotencyKey TEXT NOT NULL UNIQUE,
-    status TEXT NOT NULL CHECK (status IN ('pending', 'claimed', 'uploaded')),
-    attempts INTEGER NOT NULL DEFAULT 0,
-    lastError TEXT,
-    assetId TEXT,
-    contentHash TEXT,
-    createdAt INTEGER NOT NULL,
-    updatedAt INTEGER NOT NULL
-  )`,
-  `CREATE INDEX IF NOT EXISTS idx_asset_origin_outbox_status
-    ON asset_origin_outbox(status, createdAt)`,
-  `CREATE TABLE IF NOT EXISTS asset_origin_outbox_dead_letter (
-    id TEXT PRIMARY KEY,
-    workspaceId TEXT NOT NULL,
-    originKind TEXT NOT NULL,
-    sourceRef TEXT NOT NULL,
-    payloadJson TEXT NOT NULL,
-    hintsJson TEXT NOT NULL,
-    observedAt INTEGER NOT NULL,
-    errorJson TEXT NOT NULL,
-    attempts INTEGER NOT NULL,
-    createdAt INTEGER NOT NULL
-  )`
-];
-var OriginOutbox = class {
-  db;
-  constructor(opts) {
-    this.db = new Database4(opts.dbPath);
-    this.db.pragma("journal_mode = WAL");
-    for (const ddl of DDL_STATEMENTS) this.db.prepare(ddl).run();
-  }
-  /**
-   * Validate + persist an observation. Schema-invalid input lands in
-   * `asset_origin_outbox_dead_letter` (never silently dropped). Re-enqueue
-   * with the same {originKind, workspaceId, sourceRef, observedAt} returns
-   * the existing row id without inserting again.
-   */
-  enqueue(record) {
-    const now = Date.now();
-    const parsed = OriginObservationRecordSchema.safeParse(record);
-    if (!parsed.success) {
-      const dlId = `dl_${randomUUID5()}`;
-      const raw = record && typeof record === "object" ? record : {};
-      this.db.prepare(
-        `INSERT INTO asset_origin_outbox_dead_letter
-           (id, workspaceId, originKind, sourceRef, payloadJson, hintsJson, observedAt, errorJson, attempts, createdAt)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-      ).run(
-        dlId,
-        coerceToString(raw.workspaceId, ""),
-        coerceToString(raw.originKind, ""),
-        coerceToString(raw.sourceRef, ""),
-        coerceToJson(raw.payloadJson),
-        coerceToJson(raw.hintsJson),
-        typeof raw.observedAt === "number" ? raw.observedAt : 0,
-        JSON.stringify(parsed.error.errors),
-        0,
-        now
-      );
-      return { id: dlId, deadLetter: true };
-    }
-    const validated = parsed.data;
-    const idempotencyKey = computeIdempotencyKey(validated);
-    const rowId = `out_${randomUUID5()}`;
-    try {
-      this.db.prepare(
-        `INSERT INTO asset_origin_outbox
-           (id, workspaceId, originKind, sourceRef, payloadJson, hintsJson, observedAt,
-            idempotencyKey, status, attempts, createdAt, updatedAt)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?)`
-      ).run(
-        rowId,
-        validated.workspaceId,
-        validated.originKind,
-        validated.sourceRef,
-        validated.payloadJson,
-        validated.hintsJson,
-        validated.observedAt,
-        idempotencyKey,
-        now,
-        now
-      );
-      return { id: rowId, deadLetter: false };
-    } catch (err) {
-      const code = err.code;
-      if (code === "SQLITE_CONSTRAINT_UNIQUE") {
-        const existing = this.db.prepare("SELECT id FROM asset_origin_outbox WHERE idempotencyKey = ?").get(idempotencyKey);
-        if (existing) return { id: existing.id, deadLetter: false };
-      }
-      throw err;
-    }
-  }
-  /**
-   * Atomically claim the oldest pending row, transition status to 'claimed',
-   * and return it. Returns null when the queue is empty. The caller MUST
-   * follow up with `markUploaded` (success) or `recordFailure` (error) so
-   * the row doesn't sit in 'claimed' forever — Phase-0 is a single worker
-   * so we don't need a claim-expiry sweeper yet.
-   */
-  claimNext() {
-    const pickAndClaim = this.db.transaction(() => {
-      const row = this.db.prepare(
-        `SELECT id, workspaceId, originKind, sourceRef, payloadJson, hintsJson,
-                  observedAt, attempts, lastError, createdAt
-             FROM asset_origin_outbox
-            WHERE status = 'pending'
-            ORDER BY createdAt ASC
-            LIMIT 1`
-      ).get();
-      if (!row) return null;
-      this.db.prepare("UPDATE asset_origin_outbox SET status = 'claimed', updatedAt = ? WHERE id = ?").run(Date.now(), row.id);
-      return row;
-    });
-    const claimed = pickAndClaim();
-    if (!claimed) return null;
-    return {
-      id: claimed.id,
-      row: rawToRow(claimed)
-    };
-  }
-  markUploaded(id, meta) {
-    this.db.prepare(
-      `UPDATE asset_origin_outbox
-            SET status = 'uploaded', assetId = ?, contentHash = ?, updatedAt = ?
-          WHERE id = ?`
-    ).run(meta.assetId, meta.contentHash, Date.now(), id);
-  }
-  /**
-   * Record one failed upload attempt. Increments `attempts`, stores the
-   * latest error, and either re-queues for retry (status -> 'pending') or
-   * spills to dead-letter once attempts hit maxAttempts.
-   */
-  recordFailure(id, error, opts) {
-    const now = Date.now();
-    const updated = this.db.transaction(() => {
-      const row = this.db.prepare(
-        `SELECT id, workspaceId, originKind, sourceRef, payloadJson, hintsJson,
-                  observedAt, attempts, createdAt
-             FROM asset_origin_outbox
-            WHERE id = ?`
-      ).get(id);
-      if (!row) return;
-      const nextAttempts = row.attempts + 1;
-      if (nextAttempts >= opts.maxAttempts) {
-        this.db.prepare(
-          `INSERT INTO asset_origin_outbox_dead_letter
-             (id, workspaceId, originKind, sourceRef, payloadJson, hintsJson, observedAt, errorJson, attempts, createdAt)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-        ).run(
-          `dl_${randomUUID5()}`,
-          row.workspaceId,
-          row.originKind,
-          row.sourceRef,
-          row.payloadJson,
-          row.hintsJson,
-          row.observedAt,
-          JSON.stringify({ message: error, attempts: nextAttempts }),
-          nextAttempts,
-          now
-        );
-        this.db.prepare("DELETE FROM asset_origin_outbox WHERE id = ?").run(id);
-      } else {
-        this.db.prepare(
-          `UPDATE asset_origin_outbox
-                SET status = 'pending', attempts = ?, lastError = ?, updatedAt = ?
-              WHERE id = ?`
-        ).run(nextAttempts, error, now, id);
-      }
-    });
-    updated();
-  }
-  /**
-   * Re-promote any rows orphaned in `'claimed'` state back to `'pending'`.
-   *
-   * Why this exists: claimNext() transitions a row to 'claimed' under a
-   * transaction, but the upload that follows runs OUTSIDE the transaction
-   * (network call). If the daemon dies between the claim and the
-   * markUploaded/recordFailure call, the row is stuck — claimNext() only
-   * selects status='pending', so it would never be picked up again.
-   *
-   * Phase-0 single-worker safety: there is at most one in-flight claim at
-   * any time, so on next process startup ANY 'claimed' row is by definition
-   * orphaned. We promote it back to 'pending' (preserving attempts /
-   * lastError) so the next drainOnce can retry it.
-   *
-   * If we ever go multi-worker, this naive sweep becomes unsafe and must be
-   * replaced with a lease/heartbeat scheme.
-   *
-   * Returns the number of rows recovered (for logging / observability).
-   */
-  resetClaimed() {
-    const result = this.db.prepare(
-      "UPDATE asset_origin_outbox SET status = 'pending', updatedAt = ? WHERE status = 'claimed'"
-    ).run(Date.now());
-    return Number(result.changes);
-  }
-  pendingCount() {
-    return this.db.prepare("SELECT COUNT(*) AS n FROM asset_origin_outbox WHERE status = 'pending'").get().n;
-  }
-  uploadedCount() {
-    return this.db.prepare("SELECT COUNT(*) AS n FROM asset_origin_outbox WHERE status = 'uploaded'").get().n;
-  }
-  deadLetterCount() {
-    return this.db.prepare("SELECT COUNT(*) AS n FROM asset_origin_outbox_dead_letter").get().n;
-  }
-  close() {
-    this.db.close();
-  }
-};
-function computeIdempotencyKey(record) {
-  return createHash5("sha256").update(record.originKind).update("|").update(record.workspaceId).update("|").update(record.sourceRef).update("|").update(String(record.observedAt)).digest("hex");
-}
-function coerceToString(value, fallback) {
-  if (typeof value === "string") return value;
-  if (value == null) return fallback;
-  return String(value);
-}
-function coerceToJson(value) {
-  if (typeof value === "string") return value;
-  if (value == null) return "{}";
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return "{}";
-  }
-}
-function rawToRow(raw) {
-  return {
-    id: raw.id,
-    workspaceId: raw.workspaceId,
-    originKind: raw.originKind,
-    sourceRef: raw.sourceRef,
-    payloadJson: raw.payloadJson,
-    hintsJson: raw.hintsJson,
-    observedAt: raw.observedAt,
-    attempts: raw.attempts,
-    lastError: raw.lastError,
-    createdAt: raw.createdAt
-  };
-}
-
-// src/daemon/asset/origin/upload-runner.ts
-var UploadRunner = class {
-  constructor(opts) {
-    this.opts = opts;
-    opts.outbox.resetClaimed();
-  }
-  opts;
-  /**
-   * Process every currently-pending outbox row exactly once. Failed rows
-   * stay 'pending' (with attempts+1) for the next drainOnce call; rows
-   * that hit maxAttempts spill to dead-letter and trigger onUploadFailure.
-   *
-   * Returns the count of rows processed (success + failure).
-   */
-  async drainOnce() {
-    let count = 0;
-    while (true) {
-      const claim = this.opts.outbox.claimNext();
-      if (!claim) break;
-      count += 1;
-      const row = claim.row;
-      const adapter = this.opts.adapters[row.originKind];
-      if (!adapter) {
-        this.opts.outbox.recordFailure(claim.id, `no adapter registered for kind=${row.originKind}`, {
-          maxAttempts: 1
-          // unrecoverable — fast-fail to dead-letter
-        });
-        continue;
-      }
-      try {
-        const obs = rowToObservation(row);
-        const bytes = await adapter.fetch(obs);
-        const id = await adapter.identifySource(obs);
-        const filename = id.hints?.filename ?? path7.basename(row.sourceRef);
-        const metadata = {
-          sourceRef: row.sourceRef,
-          sourceKind: row.originKind
-        };
-        if (id.hints?.description) metadata.description = id.hints.description;
-        if (id.hints?.sourceAgentImUserId) {
-          metadata.sourceAgentImUserId = id.hints.sourceAgentImUserId;
-        }
-        const folderPath = id.hints?.folderPath || void 0;
-        const result = await this.opts.cloud.uploadAsset({
-          workspaceId: row.workspaceId,
-          filename,
-          bytes: bytes.bytes,
-          mime: bytes.mime,
-          size: bytes.size,
-          metadata,
-          folderPath
-        });
-        this.opts.outbox.markUploaded(claim.id, result);
-        await adapter.onUploadSuccess?.(obs);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const before = this.opts.outbox.deadLetterCount();
-        this.opts.outbox.recordFailure(claim.id, message, { maxAttempts: this.opts.maxAttempts });
-        const after = this.opts.outbox.deadLetterCount();
-        if (after > before) {
-          const obs = rowToObservation(row);
-          await adapter.onUploadFailure?.(obs, err);
-        }
-      }
-    }
-    return count;
-  }
-};
-function rowToObservation(row) {
-  let detail = {};
+  if (typeof b.query !== "string" || !b.query.trim()) {
+    return respond4002(res, "query is required (non-empty string)");
+  }
+  const index = resolveIndex(b.workspaceId);
+  if (!index) {
+    respond3(res, 404, {
+      error: "workspace_index_not_found",
+      workspaceId: b.workspaceId,
+      message: "No asset metadata index for this workspace. Ensure the daemon has synced asset metadata."
+    });
+    return true;
+  }
+  const limit = typeof b.limit === "number" && b.limit > 0 ? b.limit : void 0;
+  const items = index.search(b.query.trim(), limit);
+  respond3(res, 200, { items });
+  return true;
+}
+function respond3(res, status, body) {
+  res.statusCode = status;
+  res.setHeader("Content-Type", "application/json");
+  res.end(JSON.stringify(body));
+}
+function respond4002(res, message) {
+  respond3(res, 400, { error: "invalid_request", message });
+  return true;
+}
+async function readJson3(req) {
+  let raw = "";
+  req.setEncoding("utf8");
+  for await (const chunk of req) raw += chunk;
+  if (!raw) return {};
   try {
-    const parsed = JSON.parse(row.payloadJson);
-    if (parsed && typeof parsed === "object") detail = parsed;
+    return JSON.parse(raw);
   } catch {
+    throw new Error("invalid_json");
   }
-  return {
-    workspaceId: row.workspaceId,
-    detail,
-    observedAt: row.observedAt
-  };
 }
-var path7 = {
-  basename(p) {
-    const idx = Math.max(p.lastIndexOf("/"), p.lastIndexOf("\\"));
-    return idx === -1 ? p : p.slice(idx + 1);
-  }
-};
 
 // src/daemon/outbox-watcher.ts
-import { promises as fs5 } from "fs";
-import * as path8 from "path";
+import { promises as fs4 } from "fs";
+import * as path6 from "path";
 var DEFAULT_INTERVAL_MS = 2e3;
 var RESERVED_SUBDIR = "_uploaded";
 var OutboxWatcher = class {
@@ -8906,7 +7658,7 @@ var OutboxWatcher = class {
   async scanDir(dir, kind, task) {
     let entries = [];
     try {
-      entries = await fs5.readdir(dir);
+      entries = await fs4.readdir(dir);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -8916,10 +7668,10 @@ var OutboxWatcher = class {
     for (const name of entries) {
       if (name.startsWith(".")) continue;
       if (name === RESERVED_SUBDIR) continue;
-      const full = path8.join(dir, name);
+      const full = path6.join(dir, name);
       let st;
       try {
-        st = await fs5.stat(full);
+        st = await fs4.stat(full);
       } catch {
         continue;
       }
@@ -8944,8 +7696,8 @@ var OutboxWatcher = class {
       this.log("warn", `skip ${filePath}: no active taskId (no dispatch/handoff received yet)`);
       return;
     }
-    const bytes = await fs5.readFile(filePath);
-    const fileName = path8.basename(filePath);
+    const bytes = await fs4.readFile(filePath);
+    const fileName = path6.basename(filePath);
     const blob = new Blob([new Uint8Array(bytes)]);
     const form = new FormData();
     form.append("workspaceId", wsId);
@@ -9040,7 +7792,7 @@ var ServicePool = class {
 
 // src/daemon/shell-executor.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { resolve as resolve2 } from "path";
 var DEFAULT_OUTPUT_LIMIT = 256 * 1024;
 var DEFAULT_TIMEOUT = 6e4;
@@ -9077,7 +7829,7 @@ async function executeShellDispatch(payload, deps) {
   const command = readCommand(payload, execution);
   if (!command.trim()) return fail2(payload.taskId, "shell_command_required", "Shell command is required");
   const cwd = resolveCwd(execution.cwd, deps.config.defaultCwd);
-  if (!existsSync12(cwd)) return fail2(payload.taskId, "shell_cwd_missing", `cwd does not exist: ${cwd}`);
+  if (!existsSync11(cwd)) return fail2(payload.taskId, "shell_cwd_missing", `cwd does not exist: ${cwd}`);
   const timeoutMs = Math.min(
     typeof payload.timeoutMs === "number" && payload.timeoutMs > 0 ? payload.timeoutMs : deps.config.maxTimeoutMs,
     deps.config.maxTimeoutMs
@@ -9333,15 +8085,6 @@ var Runner = class extends EventEmitter3 {
   outboxWatcher;
   memoryWiring;
   assetMetadataIndexes = /* @__PURE__ */ new Map();
-  workspaceMirrors = /* @__PURE__ */ new Map();
-  assetOriginOutbox;
-  dropFolderAdapter;
-  dropFolderUploadRunner;
-  dropFolderTimer;
-  dropFolderWorkspaceId = "";
-  dropFolderWorkspaceDir = "";
-  dropFolderTickInFlight = false;
-  dropFolderStable = /* @__PURE__ */ new Map();
   state = "idle";
   startedAt = 0;
   workspaceId = "";
@@ -9383,7 +8126,6 @@ var Runner = class extends EventEmitter3 {
     this.servicePool = new ServicePool();
     this.installStaticHostedAgentFromEnv();
     this.loadAgentsFromDb();
-    await this.prepareLocalProfiles();
     this.syncQueue = new SyncQueue(this.db);
     this.syncWorker = new SyncWorker({ queue: this.syncQueue, flush: (row) => this.flushSyncRow(row) });
     this.syncWorker.start();
@@ -9405,10 +8147,9 @@ var Runner = class extends EventEmitter3 {
       );
     }
     if (this.workspaceId) {
-      this.syncAssetState(this.workspaceId).catch(
-        (err) => console.error("[Daemon] Initial asset sync failed:", err.message)
+      this.syncAssetMetadata(this.workspaceId).catch(
+        (err) => console.error("[Daemon] Initial asset metadata sync failed:", err.message)
       );
-      await this.ensureDropFolderRuntime(this.workspaceId);
     }
     const containerId = process.env.PRISMER_CONTAINER_ID;
     const isContainer = !!containerId || process.env.PRISMER_RUNTIME_MODE === "container";
@@ -9459,8 +8200,7 @@ var Runner = class extends EventEmitter3 {
         // an actual agent process.
         attachMemory: this.memoryWiring ? attachMemoryRpc({ runtime: this.memoryWiring.runtime }) : void 0,
         attachAsset: attachAssetRpc({
-          resolveIndex: (workspaceId) => this.assetMetadataIndexes.get(workspaceId),
-          assetCache: this.assetCache
+          resolveIndex: (workspaceId) => this.assetMetadataIndexes.get(workspaceId)
         })
       });
       await this.localServer.start();
@@ -9509,7 +8249,6 @@ var Runner = class extends EventEmitter3 {
     this.memoryWiring = void 0;
     this.ws?.close();
     this.outboxWatcher?.stop();
-    this.stopDropFolderRuntime();
     await this.servicePool?.shutdown();
     await this.localServer?.stop();
     try {
@@ -9566,7 +8305,6 @@ var Runner = class extends EventEmitter3 {
       runningTaskIds: Array.from(this.runningTasks.keys()),
       observability: {
         adapters: this.snapshotAdapterObservability(),
-        assetSync: this.snapshotAssetSyncObservability(),
         ...this.lastTaskError ? { lastTaskError: this.lastTaskError } : {}
       }
     };
@@ -9602,35 +8340,6 @@ var Runner = class extends EventEmitter3 {
       });
     }
   }
-  async prepareLocalProfiles() {
-    const rows = this.db.prepare(
-      `SELECT id, workspace_id, agent_im_user_id, adapter_name, name, config, version, synced_at
-         FROM agent_profiles
-         WHERE deleted_at IS NULL`
-    ).all();
-    for (const row of rows) {
-      const adapter = this.registry.get(row.adapter_name);
-      if (!adapter?.prepareProfile) continue;
-      try {
-        await adapter.prepareProfile({
-          id: row.id,
-          workspaceId: row.workspace_id,
-          agentImUserId: row.agent_im_user_id,
-          adapterName: row.adapter_name,
-          name: row.name,
-          config: parseProfileConfig(row.config),
-          version: row.version,
-          createdAt: new Date(row.synced_at ?? Date.now()),
-          updatedAt: new Date(row.synced_at ?? Date.now())
-        });
-      } catch (err) {
-        process.stderr.write(
-          `[daemon] local profile preflight skipped agent=${row.agent_im_user_id} profile=${row.id}: ${err.message}
-`
-        );
-      }
-    }
-  }
   /**
    * Register an in-process AgentProfile snapshot (called by agent CLI / sync layer).
    * Used to populate the `agents` list in agent.host.declare.
@@ -9688,10 +8397,10 @@ var Runner = class extends EventEmitter3 {
     const rawJson = process.env.PRISMER_HOSTED_AGENT_JSON;
     let raw;
     if (rawFile) {
-      if (!existsSync13(rawFile)) {
+      if (!existsSync12(rawFile)) {
         throw new Error(`PRISMER_HOSTED_AGENT_FILE not found: ${rawFile}`);
       }
-      raw = readFileSync11(rawFile, "utf8");
+      raw = readFileSync9(rawFile, "utf8");
     } else if (rawJson) {
       raw = rawJson;
     }
@@ -9793,7 +8502,7 @@ var Runner = class extends EventEmitter3 {
         name: a.name,
         adapterName: a.adapterName,
         capabilities: a.capabilities,
-        profiles: Array.from(a.profiles.entries()).map(([id, version]) => ({ id, version }))
+        profiles: Array.from(a.profiles.entries()).map(([id, version2]) => ({ id, version: version2 }))
       }))
     };
     this.ws.send(envelope("agent.host.declare", payload, this.config.daemon_id));
@@ -9835,29 +8544,17 @@ var Runner = class extends EventEmitter3 {
         (err) => console.error("[Daemon] Initial memory sync failed:", err.message)
       );
     }
-    this.syncAssetState(this.workspaceId).catch(
-      (err) => console.error("[Daemon] Asset sync failed:", err.message)
+    this.syncAssetMetadata(this.workspaceId).catch(
+      (err) => console.error("[Daemon] Asset metadata sync failed:", err.message)
     );
-    await this.ensureDropFolderRuntime(this.workspaceId);
     for (const id of payload.profilesToSync) {
       try {
-        await this.servicePool.drop(id);
         await this.syncProfileFromCloud(id);
       } catch (err) {
         this.emit("sync-error", err);
       }
     }
-    for (const id of payload.profilesToDelete ?? []) {
-      const row = this.db.prepare("SELECT agent_im_user_id FROM agent_profiles WHERE id = ?").get(id);
-      this.db.prepare("DELETE FROM agent_profiles WHERE id = ?").run(id);
-      if (row) {
-        this.db.prepare("DELETE FROM agents WHERE im_user_id = ?").run(row.agent_im_user_id);
-      }
-      process.stderr.write(`[daemon] tombstone profile=${id}
-`);
-    }
-    if (payload.profilesToDelete?.length) this.loadAgentsFromDb();
-    if ((payload.profilesToSync.length > 0 || (payload.profilesToDelete?.length ?? 0) > 0) && this.wsConnected) this.sendDeclare();
+    if (payload.profilesToSync.length > 0 && this.wsConnected) this.sendDeclare();
     this.emit("host-acked", payload);
   }
   async onTaskDispatch(payload, requestId) {
@@ -9898,14 +8595,8 @@ var Runner = class extends EventEmitter3 {
           }
         });
         this.ws.send(envelope("task.dispatch.reply", reply, requestId));
-        if (!reply.ok) {
-          const code = reply.error?.code ?? "unknown";
-          const message = reply.error?.message ?? "unknown error";
-          process.stderr.write(`[daemon] dispatch failed task=${payload.taskId} code=${code} message=${message}
-`);
-        }
       } else {
-        const reply = await handleDispatch(payload, requestId, {
+        await handleDispatch(payload, requestId, {
           registry: this.registry,
           cloud: this.cloud,
           uriResolver: this.uriResolver,
@@ -9921,12 +8612,6 @@ var Runner = class extends EventEmitter3 {
             if (running) running.lastProgressAt = Date.now();
           }
         });
-        if (!reply.ok) {
-          const code = reply.error?.code ?? "unknown";
-          const message = reply.error?.message ?? "unknown error";
-          process.stderr.write(`[daemon] dispatch failed task=${payload.taskId} code=${code} message=${message}
-`);
-        }
       }
       process.stdout.write(`[daemon] dispatch done task=${payload.taskId}
 `);
@@ -9954,7 +8639,6 @@ var Runner = class extends EventEmitter3 {
   }
   async onAgentProfileChanged(payload) {
     try {
-      await this.servicePool.drop(payload.profileId);
       await this.syncProfileFromCloud(payload.profileId);
       if (this.wsConnected) this.sendDeclare();
     } catch (err) {
@@ -9962,21 +8646,7 @@ var Runner = class extends EventEmitter3 {
     }
   }
   async syncProfileFromCloud(profileId) {
-    let profile;
-    try {
-      profile = await this.cloud.get(`/api/im/agent_profiles/${encodeURIComponent(profileId)}`);
-    } catch (err) {
-      if (err instanceof CloudError && err.status === 404) {
-        const row = this.db.prepare("SELECT agent_im_user_id FROM agent_profiles WHERE id = ?").get(profileId);
-        this.db.prepare("DELETE FROM agent_profiles WHERE id = ?").run(profileId);
-        if (row) {
-          this.db.prepare("DELETE FROM agents WHERE im_user_id = ?").run(row.agent_im_user_id);
-        }
-        this.loadAgentsFromDb();
-        return;
-      }
-      throw err;
-    }
+    const profile = await this.cloud.get(`/api/im/agent_profiles/${encodeURIComponent(profileId)}`);
     const agent = await this.resolveOwnedAgent(profile.agentImUserId);
     const adapter = this.registry.get(profile.adapterName);
     const capabilities = agent?.card?.capabilities?.length ? agent.card.capabilities : adapter?.capabilities ?? [];
@@ -10011,14 +8681,6 @@ var Runner = class extends EventEmitter3 {
       );
     });
     tx();
-    try {
-      await adapter?.prepareProfile?.(profile);
-    } catch (err) {
-      process.stderr.write(
-        `[daemon] profile preflight skipped agent=${profile.agentImUserId} profile=${profile.id}: ${err.message}
-`
-      );
-    }
     this.loadAgentsFromDb();
     process.stdout.write(
       `[daemon] profile synced agent=${profile.agentImUserId} profile=${profile.id} adapter=${profile.adapterName}
@@ -10047,10 +8709,15 @@ var Runner = class extends EventEmitter3 {
   }
   async onAssetChanged(payload) {
     if (!payload.workspaceId) return;
+    const index = this.assetMetadataIndexes.get(payload.workspaceId);
+    if (!index) return;
     try {
-      await this.syncAssetState(payload.workspaceId);
+      const result = await index.pullDelta();
+      if (result.applied > 0) {
+        console.log(`[Daemon] asset.changed workspace=${payload.workspaceId} applied=${result.applied}`);
+      }
     } catch (err) {
-      console.error(`[Daemon] asset.changed sync failed workspace=${payload.workspaceId}:`, err.message);
+      console.error(`[Daemon] asset.changed pullDelta failed workspace=${payload.workspaceId}:`, err.message);
     }
   }
   onWorkspaceFileChanged(payload) {
@@ -10088,15 +8755,6 @@ var Runner = class extends EventEmitter3 {
       }
     };
   }
-  snapshotAssetSyncObservability() {
-    return {
-      workspaceId: this.dropFolderWorkspaceId || null,
-      rootDir: this.dropFolderWorkspaceDir || null,
-      dropDir: this.dropFolderWorkspaceDir ? join16(this.dropFolderWorkspaceDir, "drop") : null,
-      uploadedDir: this.dropFolderWorkspaceDir ? join16(this.dropFolderWorkspaceDir, "uploaded") : null,
-      failedDir: this.dropFolderWorkspaceDir ? join16(this.dropFolderWorkspaceDir, "upload-failed") : null
-    };
-  }
   /**
    * Ensure an AssetMetadataIndex exists for the given workspace and pull
    * delta from cloud. Idempotent — creates the index on first call, reuses
@@ -10119,132 +8777,6 @@ var Runner = class extends EventEmitter3 {
       console.log(`[AssetMeta] workspace=${workspaceId}: ${result.applied} applied, cursor=${result.cursor}`);
     }
   }
-  /**
-   * Ensure a WorkspaceMirror exists for the workspace and pull path→asset
-   * bindings from cloud. Cold-start daemons previously only had this table
-   * populated by WS push or per-path URI fallback, so local asset state looked
-   * empty even though cloud files existed.
-   */
-  async syncWorkspaceFiles(workspaceId) {
-    let mirror = this.workspaceMirrors.get(workspaceId);
-    if (!mirror) {
-      const stateDir = `${this.paths.root}/${workspaceId}`;
-      mirror = new WorkspaceMirror({
-        db: this.db,
-        cloud: this.cloud,
-        workspaceId,
-        workspaceStateDir: stateDir
-      });
-      this.workspaceMirrors.set(workspaceId, mirror);
-    }
-    const result = await mirror.pullDelta();
-    if (result.applied > 0) {
-      console.log(`[WorkspaceFiles] workspace=${workspaceId}: ${result.applied} applied, cursor=${result.cursor ?? "null"}`);
-    }
-  }
-  async syncAssetState(workspaceId) {
-    if (!this.paths?.root) return;
-    await Promise.all([
-      this.syncAssetMetadata(workspaceId),
-      this.syncWorkspaceFiles(workspaceId)
-    ]);
-  }
-  /**
-   * Desktop asset ingress: watch a user-visible local asset folder
-   * and upload new files as IMAssets, preserving nested relative dirs in
-   * IMAsset.folderPath. The lower-level adapter/outbox/uploader already
-   * existed; this method wires them into the real daemon lifecycle.
-   */
-  async ensureDropFolderRuntime(workspaceId) {
-    if (!workspaceId || !this.paths?.root) return;
-    if (this.dropFolderWorkspaceId === workspaceId && this.dropFolderTimer) return;
-    this.stopDropFolderRuntime();
-    this.dropFolderWorkspaceId = workspaceId;
-    const workspaceRoot = resolveUserAssetWorkspaceDir(workspaceId);
-    this.dropFolderWorkspaceDir = workspaceRoot;
-    await mkdir(join16(workspaceRoot, "drop"), { recursive: true });
-    await mkdir(join16(workspaceRoot, "uploaded"), { recursive: true });
-    await mkdir(join16(workspaceRoot, "upload-failed"), { recursive: true });
-    this.assetOriginOutbox = new OriginOutbox({ dbPath: join16(this.paths.root, "asset-origin.db") });
-    this.dropFolderAdapter = new DropFolderAdapter({ workspaceDir: workspaceRoot });
-    this.dropFolderUploadRunner = new UploadRunner({
-      outbox: this.assetOriginOutbox,
-      cloud: new DaemonAssetUploadClient(this.config),
-      adapters: { "drop-folder": this.dropFolderAdapter },
-      maxAttempts: 3
-    });
-    const tick = () => {
-      this.runDropFolderTick().catch((err) => {
-        process.stderr.write(`[daemon] drop-folder sync failed: ${err.message}
-`);
-      });
-    };
-    this.dropFolderTimer = setInterval(tick, 1e3);
-    tick();
-    process.stdout.write(`[daemon] drop-folder asset sync watching ${join16(workspaceRoot, "drop")}
-`);
-  }
-  stopDropFolderRuntime() {
-    if (this.dropFolderTimer) {
-      clearInterval(this.dropFolderTimer);
-      this.dropFolderTimer = void 0;
-    }
-    try {
-      this.assetOriginOutbox?.close();
-    } catch {
-    }
-    this.assetOriginOutbox = void 0;
-    this.dropFolderAdapter = void 0;
-    this.dropFolderUploadRunner = void 0;
-    this.dropFolderWorkspaceId = "";
-    this.dropFolderWorkspaceDir = "";
-    this.dropFolderTickInFlight = false;
-    this.dropFolderStable.clear();
-  }
-  async runDropFolderTick() {
-    if (this.dropFolderTickInFlight) return;
-    const workspaceId = this.dropFolderWorkspaceId;
-    const adapter = this.dropFolderAdapter;
-    const outbox = this.assetOriginOutbox;
-    const runner = this.dropFolderUploadRunner;
-    if (!workspaceId || !adapter || !outbox || !runner) return;
-    this.dropFolderTickInFlight = true;
-    try {
-      const observations = await adapter.scanOnce(workspaceId);
-      for (const obs of observations) {
-        const id = await adapter.identifySource(obs);
-        if (!this.isDropFolderObservationStable(id.sourceRef, obs.detail)) continue;
-        outbox.enqueue({
-          workspaceId: obs.workspaceId,
-          originKind: "drop-folder",
-          sourceRef: id.sourceRef,
-          payloadJson: JSON.stringify(obs.detail),
-          hintsJson: JSON.stringify(id.hints ?? {}),
-          observedAt: obs.observedAt
-        });
-      }
-      const processed = await runner.drainOnce();
-      if (processed > 0) {
-        this.dropFolderStable.clear();
-        process.stdout.write(`[daemon] drop-folder uploaded/processed ${processed} asset(s)
-`);
-        await this.syncAssetState(workspaceId).catch(
-          (err) => process.stderr.write(`[daemon] drop-folder post-sync failed: ${err.message}
-`)
-        );
-      }
-    } finally {
-      this.dropFolderTickInFlight = false;
-    }
-  }
-  isDropFolderObservationStable(sourceRef, detail) {
-    const raw = detail && typeof detail === "object" ? detail : {};
-    const size = typeof raw.size === "number" ? raw.size : -1;
-    const mtime = typeof raw.mtime === "number" ? raw.mtime : -1;
-    const previous = this.dropFolderStable.get(sourceRef);
-    this.dropFolderStable.set(sourceRef, { size, mtime });
-    return Boolean(previous && previous.size === size && previous.mtime === mtime);
-  }
   /**
    * SyncWorker FlushFn — pushes local writes to cloud.
    *
@@ -10281,44 +8813,44 @@ var Runner = class extends EventEmitter3 {
     const id = encodeURIComponent(row.resource_id);
     const body = row.operation === "delete" ? void 0 : safeJsonParse(row.payload);
     let method;
-    let path9;
+    let path7;
     switch (op) {
       case "workspace.create":
         method = "POST";
-        path9 = "/api/im/workspaces";
+        path7 = "/api/im/workspaces";
         break;
       case "workspace.update":
         method = "PATCH";
-        path9 = `/api/im/workspaces/${id}`;
+        path7 = `/api/im/workspaces/${id}`;
         break;
       case "workspace.delete":
         method = "DELETE";
-        path9 = `/api/im/workspaces/${id}`;
+        path7 = `/api/im/workspaces/${id}`;
         break;
       // agent.create must use /register — POST /api/im/agents is not exposed.
       case "agent.create":
         method = "POST";
-        path9 = "/api/im/register";
+        path7 = "/api/im/register";
         break;
       case "agent.update":
         method = "PATCH";
-        path9 = `/api/im/agents/${id}`;
+        path7 = `/api/im/agents/${id}`;
         break;
       case "agent.delete":
         method = "DELETE";
-        path9 = `/api/im/agents/${id}`;
+        path7 = `/api/im/agents/${id}`;
         break;
       case "agent_profile.create":
         method = "POST";
-        path9 = "/api/im/agent_profiles";
+        path7 = "/api/im/agent_profiles";
         break;
       case "agent_profile.update":
         method = "PATCH";
-        path9 = `/api/im/agent_profiles/${id}`;
+        path7 = `/api/im/agent_profiles/${id}`;
         break;
       case "agent_profile.delete":
         method = "DELETE";
-        path9 = `/api/im/agent_profiles/${id}`;
+        path7 = `/api/im/agent_profiles/${id}`;
         break;
       default:
         process.stderr.write(`[daemon] sync flush op=${op} id=${row.id} result=drop (unknown op)
@@ -10327,7 +8859,7 @@ var Runner = class extends EventEmitter3 {
     }
     let res;
     try {
-      res = await this.cloud.request(method, path9, { body });
+      res = await this.cloud.request(method, path7, { body });
     } catch (err) {
       process.stderr.write(
         `[daemon] sync flush op=${op} id=${row.id} result=retry (threw: ${err.message})
@@ -10350,89 +8882,6 @@ var Runner = class extends EventEmitter3 {
     return { ok: res.ok, status: res.status, message: res.error?.message };
   }
 };
-var DaemonAssetUploadClient = class {
-  constructor(config) {
-    this.config = config;
-  }
-  config;
-  async uploadAsset(req) {
-    const form = new FormData();
-    form.set("workspaceId", req.workspaceId);
-    form.set("kind", "file");
-    form.set("metadata", JSON.stringify(req.metadata));
-    if (req.folderPath !== void 0) form.set("folderPath", req.folderPath);
-    form.set("file", new Blob([req.bytes], { type: req.mime ?? "application/octet-stream" }), req.filename);
-    const url = `${this.config.cloud_api_base.replace(/\/$/, "")}/api/im/assets`;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 6e4);
-    let res;
-    try {
-      res = await fetch(url, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${this.config.api_key}` },
-        body: form,
-        signal: controller.signal
-      });
-    } catch (err) {
-      if (err.name === "AbortError") {
-        throw new Error("asset upload timed out after 60000ms");
-      }
-      throw err;
-    } finally {
-      clearTimeout(timer);
-    }
-    const text = await res.text();
-    let body;
-    try {
-      body = text ? JSON.parse(text) : void 0;
-    } catch {
-      body = text;
-    }
-    if (!res.ok || isCloudErrorEnvelope(body)) {
-      throw new Error(`asset upload failed (${res.status}): ${cloudUploadErrorMessage(body)}`);
-    }
-    const data = unwrapCloudData(body);
-    const assetId = stringValue(data, "id");
-    const contentHash = stringValue(data, "contentHash");
-    if (!assetId || !contentHash) {
-      throw new Error("asset upload response missing id/contentHash");
-    }
-    return { assetId, contentHash };
-  }
-};
-function isCloudErrorEnvelope(raw) {
-  return Boolean(raw && typeof raw === "object" && "ok" in raw && raw.ok === false);
-}
-function cloudUploadErrorMessage(raw) {
-  if (raw && typeof raw === "object") {
-    const error = raw.error;
-    if (typeof error === "string") return error;
-    if (error && typeof error === "object") {
-      const message = error.message;
-      if (typeof message === "string") return message;
-    }
-  }
-  return typeof raw === "string" ? raw : "request failed";
-}
-function unwrapCloudData(raw) {
-  if (raw && typeof raw === "object") {
-    const data = raw.data;
-    if (data && typeof data === "object" && !Array.isArray(data)) return data;
-  }
-  return {};
-}
-function stringValue(obj, key) {
-  const value = obj[key];
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function resolveUserAssetWorkspaceDir(workspaceId) {
-  const override = process.env.PRISMER_ASSET_SYNC_ROOT;
-  if (override) return join16(override, workspaceId);
-  const home = homedir7();
-  const desktop = join16(home, "Desktop");
-  const base = existsSync13(desktop) ? desktop : home;
-  return join16(base, "Prismer Assets", workspaceId);
-}
 function readTargetDaemonId(payload) {
   if (typeof payload.targetDaemonId === "string" && payload.targetDaemonId.length > 0) {
     return payload.targetDaemonId;
@@ -10483,14 +8932,6 @@ function validateStaticHostedAgent(raw) {
     }
   };
 }
-function parseProfileConfig(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
 function safeJsonParse(raw) {
   try {
     return JSON.parse(raw);
@@ -10517,7 +8958,7 @@ function buildDaemonCommand() {
   async function runForeground(opts) {
     const paths = resolvePaths();
     const existingPid = readPidFile(paths);
-    if (existingPid && pidAlive2(existingPid)) {
+    if (existingPid && pidAlive(existingPid)) {
       exitWithError(`Daemon already running (pid ${existingPid}). Use \`prismer daemon stop\` first.`);
     }
     writePidFile(paths, process.pid);
@@ -10541,7 +8982,7 @@ function buildDaemonCommand() {
     while (!configExists(paths)) {
       if (stopRequested) return;
       getUI().info(`[daemon] waiting for ${paths.configFile} \u2014 run \`prismer setup\` to create it`);
-      await sleep2(5e3);
+      await sleep(5e3);
     }
     runner = new Runner({
       startLocalServer: opts.localServer !== false,
@@ -10570,12 +9011,12 @@ function buildDaemonCommand() {
   async function startBackground(opts) {
     const paths = resolvePaths();
     const existingPid = readPidFile(paths);
-    if (existingPid && pidAlive2(existingPid)) {
+    if (existingPid && pidAlive(existingPid)) {
       exitWithError(`Daemon already running (pid ${existingPid}). Use \`prismer daemon stop\` first.`);
     }
-    if (!existsSync14(paths.logsDir)) mkdirSync9(paths.logsDir, { recursive: true });
-    const logFile = join17(paths.logsDir, "daemon.log");
-    const fd = openSync2(logFile, "a");
+    if (!existsSync13(paths.logsDir)) mkdirSync8(paths.logsDir, { recursive: true });
+    const logFile = join11(paths.logsDir, "daemon.log");
+    const fd = openSync(logFile, "a");
     const args = [process.argv[1], "daemon", "run"];
     if (opts.port) args.push("--port", String(opts.port));
     if (opts.localServer === false) args.push("--no-local-server");
@@ -10587,9 +9028,9 @@ function buildDaemonCommand() {
     child.unref();
     const deadline = Date.now() + 5e3;
     while (Date.now() < deadline) {
-      await sleep2(200);
+      await sleep(200);
       const pid = readPidFile(paths);
-      if (pid && pidAlive2(pid)) {
+      if (pid && pidAlive(pid)) {
         if (opts.json) printJson({ ok: true, pid, logFile });
         else getUI().ok("Daemon started", `pid ${pid} \xB7 logs ${logFile}`);
         return;
@@ -10604,7 +9045,7 @@ function buildDaemonCommand() {
     const paths = resolvePaths();
     const pid = readPidFile(paths);
     if (!pid) exitWithError("No daemon.pid found \u2014 daemon does not appear to be running.");
-    if (!pidAlive2(pid)) {
+    if (!pidAlive(pid)) {
       clearPidFile(paths);
       getUI().warn("Daemon was not alive", `pid ${pid}; cleared stale pid file`);
       return;
@@ -10616,12 +9057,12 @@ function buildDaemonCommand() {
     }
     const deadline = Date.now() + (opts.timeout ?? 5e3);
     while (Date.now() < deadline) {
-      if (!pidAlive2(pid)) {
+      if (!pidAlive(pid)) {
         clearPidFile(paths);
         getUI().ok("Daemon stopped", `pid ${pid}`);
         return;
       }
-      await sleep2(200);
+      await sleep(200);
     }
     process.stderr.write(`Daemon did not exit within timeout; pid ${pid} may still be alive.
 `);
@@ -10641,7 +9082,7 @@ function buildDaemonCommand() {
   cmd.command("status").description("Show daemon process + WS state").option("--json", "Output JSON (default)").action(async () => {
     const paths = resolvePaths();
     const pid = readPidFile(paths);
-    const alive = pid ? pidAlive2(pid) : false;
+    const alive = pid ? pidAlive(pid) : false;
     if (!pid || !alive) {
       printJson({ running: false, pid: pid ?? null, paths: { config: paths.configFile } });
       return;
@@ -10658,8 +9099,8 @@ function buildDaemonCommand() {
   });
   cmd.command("logs").description("Show daemon logs").option("--tail <n>", "Number of lines to show", (v) => Number.parseInt(v, 10), 80).option("--follow", "Follow log output").option("--json", "Accept --json for global flag compatibility (raw log bytes are streamed)").action(async (opts) => {
     const paths = resolvePaths();
-    const logFile = join17(paths.logsDir, "daemon.log");
-    if (!existsSync14(logFile)) {
+    const logFile = join11(paths.logsDir, "daemon.log");
+    if (!existsSync13(logFile)) {
       exitWithError(`No daemon log found at ${logFile}. Start the daemon with \`prismer daemon start\`.`);
     }
     const lines = Math.max(1, opts.tail);
@@ -10669,9 +9110,9 @@ function buildDaemonCommand() {
   });
   return cmd;
 }
-async function tailFromEnd(path9, lines) {
+async function tailFromEnd(path7, lines) {
   const { open } = await import("fs/promises");
-  const handle = await open(path9, "r");
+  const handle = await open(path7, "r");
   try {
     const stat = await handle.stat();
     let size = stat.size;
@@ -10699,14 +9140,14 @@ async function tailFromEnd(path9, lines) {
     await handle.close();
   }
 }
-async function followFile(path9) {
-  let offset = statSync4(path9).size;
+async function followFile(path7) {
+  let offset = statSync3(path7).size;
   for (; ; ) {
-    await sleep2(1e3);
-    const size = statSync4(path9).size;
+    await sleep(1e3);
+    const size = statSync3(path7).size;
     if (size < offset) offset = 0;
     if (size === offset) continue;
-    const stream = createReadStream(path9, { start: offset, end: size - 1, encoding: "utf8" });
+    const stream = createReadStream(path7, { start: offset, end: size - 1, encoding: "utf8" });
     for await (const chunk of stream) process.stdout.write(chunk);
     offset = size;
   }
@@ -10715,15 +9156,15 @@ async function followFile(path9) {
 // src/cli/commands/events.ts
 init_util();
 import { Command as Command9 } from "commander";
-import { createReadStream as createReadStream2, existsSync as existsSync15 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { createReadStream as createReadStream2, existsSync as existsSync14 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join12 } from "path";
 import { createInterface } from "readline";
 var DEFAULT_LIMIT2 = 50;
 function buildEventsCommand() {
   return addEventOptions(new Command9("events").description("Read local PARA events from ~/.prismer/para/events.jsonl")).action(async (opts) => {
     const file = eventsPath();
-    if (!existsSync15(file)) {
+    if (!existsSync14(file)) {
       printJson(unavailable(file));
       process.exitCode = 1;
       return;
@@ -10740,7 +9181,7 @@ function buildEventsCommand() {
 function buildEventsStatsCommand() {
   return addEventOptions(new Command9("events:stats").description("Summarize local PARA events from ~/.prismer/para/events.jsonl")).action(async (opts) => {
     const file = eventsPath();
-    if (!existsSync15(file)) {
+    if (!existsSync14(file)) {
       printJson(unavailable(file));
       process.exitCode = 1;
       return;
@@ -10755,10 +9196,10 @@ function buildEventsStatsCommand() {
   });
 }
 function addEventOptions(cmd) {
-  return cmd.option("--limit <n>", "Max events to return/read", parsePositiveInt4, DEFAULT_LIMIT2).option("--agent-id <id>", "Filter by agent id").option("--session-id <id>", "Filter by session id").option("--family <name>", "Filter by event family").option("--type <name>", "Filter by event type").option("--json", "Output JSON (default)");
+  return cmd.option("--limit <n>", "Max events to return/read", parsePositiveInt3, DEFAULT_LIMIT2).option("--agent-id <id>", "Filter by agent id").option("--session-id <id>", "Filter by session id").option("--family <name>", "Filter by event family").option("--type <name>", "Filter by event type").option("--json", "Output JSON (default)");
 }
 function eventsPath() {
-  return join18(process.env.PRISMER_HOME ?? join18(homedir8(), ".prismer"), "para", "events.jsonl");
+  return join12(process.env.PRISMER_HOME ?? join12(homedir5(), ".prismer"), "para", "events.jsonl");
 }
 function unavailable(file) {
   return {
@@ -10836,15 +9277,15 @@ function normalizeFilters(opts) {
 function cleanFilters(filters) {
   return Object.fromEntries(Object.entries(filters).filter(([, value]) => value !== void 0));
 }
-function parsePositiveInt4(v) {
+function parsePositiveInt3(v) {
   const n = Number.parseInt(v, 10);
   return Number.isFinite(n) && n > 0 ? n : DEFAULT_LIMIT2;
 }
 
 // src/cli/commands/memory.ts
-import Database5 from "better-sqlite3";
+import Database4 from "better-sqlite3";
 import { Command as Command10 } from "commander";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 init_util();
 var LOCAL_BASE = process.env.PRISMER_DAEMON_URL ?? "http://127.0.0.1:3210";
 function buildMemoryCommand() {
@@ -10870,7 +9311,7 @@ function buildMemoryCommand() {
     }));
     process.exitCode = 1;
   });
-  cmd.command("list").description("List memory records, or local cache records when gateway is unavailable").option("--workspace-id <id>", "Workspace to list (required for daemon RPC)").option("--page-type <type>", "Filter by pageType (hub/leaf/decision/glossary/archive)").option("--limit <n>", "Max items", parsePositiveInt5, 20).option("--json", "Output JSON (default)").action(async (opts) => {
+  cmd.command("list").description("List memory records, or local cache records when gateway is unavailable").option("--workspace-id <id>", "Workspace to list (required for daemon RPC)").option("--page-type <type>", "Filter by pageType (hub/leaf/decision/glossary/archive)").option("--limit <n>", "Max items", parsePositiveInt4, 20).option("--json", "Output JSON (default)").action(async (opts) => {
     const limit = clampLimit(opts.limit);
     const daemonPaths = [];
     if (opts.workspaceId) {
@@ -10889,7 +9330,7 @@ function buildMemoryCommand() {
     printJson(unavailable2("list", snapshot, { items: snapshot.items, limit }));
     process.exitCode = 1;
   });
-  cmd.command("search").description("Search memory records, or local cache metadata when gateway is unavailable").argument("[query]", "Search text").option("--query <text>", "Search text").option("--workspace-id <id>", "Workspace to search (required for daemon RPC)").option("--limit <n>", "Max items", parsePositiveInt5, 20).option("--json", "Output JSON (default)").action(async (argQuery, opts) => {
+  cmd.command("search").description("Search memory records, or local cache metadata when gateway is unavailable").argument("[query]", "Search text").option("--query <text>", "Search text").option("--workspace-id <id>", "Workspace to search (required for daemon RPC)").option("--limit <n>", "Max items", parsePositiveInt4, 20).option("--json", "Output JSON (default)").action(async (argQuery, opts) => {
     const query = opts.query ?? argQuery ?? "";
     const limit = clampLimit(opts.limit);
     const encoded = encodeURIComponent(query);
@@ -10933,9 +9374,9 @@ function buildMemoryCommand() {
 }
 async function tryDaemon(methods, paths) {
   for (const method of methods) {
-    for (const path9 of paths) {
+    for (const path7 of paths) {
       try {
-        const res = await fetch(`${LOCAL_BASE}${path9}`, { method, signal: AbortSignal.timeout(1500) });
+        const res = await fetch(`${LOCAL_BASE}${path7}`, { method, signal: AbortSignal.timeout(1500) });
         if (res.status === 404) continue;
         const body = await readJson4(res);
         if (!res.ok) {
@@ -10943,12 +9384,12 @@ async function tryDaemon(methods, paths) {
             ok: false,
             error: {
               code: `daemon_http_${res.status}`,
-              message: messageFromBody(body) ?? `Daemon endpoint ${method} ${path9} returned HTTP ${res.status}`
+              message: messageFromBody(body) ?? `Daemon endpoint ${method} ${path7} returned HTTP ${res.status}`
             },
-            checks: { daemon: { url: LOCAL_BASE, endpoint: path9, reachable: true } }
+            checks: { daemon: { url: LOCAL_BASE, endpoint: path7, reachable: true } }
           };
         }
-        return normalizeDaemonBody(body, { method, path: path9 });
+        return normalizeDaemonBody(body, { method, path: path7 });
       } catch {
         continue;
       }
@@ -10996,7 +9437,7 @@ function readCacheSnapshot(limit) {
   const paths = resolvePaths();
   const empty = {
     dbPath: paths.localDb,
-    dbExists: existsSync16(paths.localDb),
+    dbExists: existsSync15(paths.localDb),
     tables: {
       cached_assets: { exists: false, count: 0, sizeBytes: 0 },
       workspace_files_mirror: { exists: false, count: 0 }
@@ -11006,7 +9447,7 @@ function readCacheSnapshot(limit) {
   if (!empty.dbExists) return empty;
   let db;
   try {
-    db = new Database5(paths.localDb, { readonly: true, fileMustExist: true });
+    db = new Database4(paths.localDb, { readonly: true, fileMustExist: true });
     const hasAssets = tableExists(db, "cached_assets");
     const hasFiles = tableExists(db, "workspace_files_mirror");
     const assets = hasAssets ? db.prepare("SELECT COUNT(*) AS count, COALESCE(SUM(size_bytes), 0) AS sizeBytes FROM cached_assets").get() : { count: 0, sizeBytes: 0 };
@@ -11095,7 +9536,7 @@ function searchableText(item) {
     item.localPath
   ].filter(Boolean).join(" ");
 }
-function parsePositiveInt5(v) {
+function parsePositiveInt4(v) {
   const n = Number.parseInt(v, 10);
   return Number.isFinite(n) && n > 0 ? n : 20;
 }
@@ -11120,16 +9561,15 @@ import { Command as Command11 } from "commander";
 // src/pair.ts
 import { generateKeyPairSync } from "crypto";
 import { hostname as hostname2 } from "os";
-import { setTimeout as sleep3 } from "timers/promises";
+import { setTimeout as sleep2 } from "timers/promises";
 import qrcode from "qrcode";
 
 // src/daemon-id.ts
-import { randomBytes } from "crypto";
 import { hostname } from "os";
 var PREFIX = "daemon-";
 function newDaemonId() {
   const host = hostname().replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "unknown";
-  return `${PREFIX}${host}-${randomBytes(6).toString("hex")}`;
+  return `${PREFIX}${host}`;
 }
 
 // src/pair.ts
@@ -11200,7 +9640,7 @@ Scan with Lumin to approve, or open: ${offer.qrUrl}
   const pollIntervalMs = opts.pollIntervalMs ?? 5e3;
   for (let i = 0; i < maxAttempts; i += 1) {
     if (i > 0 || !localOnlyMode) {
-      await sleep3(pollIntervalMs);
+      await sleep2(pollIntervalMs);
     }
     const res = await cloud.request(
       "GET",
@@ -11281,9 +9721,9 @@ function buildPairCommand() {
 
 // src/cli/commands/profile.ts
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync17, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir } from "os";
-import { join as join19 } from "path";
+import { join as join13 } from "path";
 import { spawnSync as spawnSync4 } from "child_process";
 
 // src/templates/roles/product-manager.json
@@ -11407,12 +9847,12 @@ function buildProfileCommand() {
     const profile = await cloud.get(
       `/api/im/agent_profiles/${encodeURIComponent(profileId)}`
     );
-    const tmpFile = join19(tmpdir(), `prismer-profile-${profileId}.json`);
-    writeFileSync9(tmpFile, JSON.stringify(profile.config, null, 2), "utf8");
+    const tmpFile = join13(tmpdir(), `prismer-profile-${profileId}.json`);
+    writeFileSync8(tmpFile, JSON.stringify(profile.config, null, 2), "utf8");
     const editor = process.env.EDITOR || "vi";
     const ed = spawnSync4(editor, [tmpFile], { stdio: "inherit" });
     if (ed.status !== 0) exitWithError(`editor exited ${ed.status}`, { code: "editor_failed" });
-    const newConfig = JSON.parse(readFileSync12(tmpFile, "utf8"));
+    const newConfig = JSON.parse(readFileSync10(tmpFile, "utf8"));
     const res = await cloud.request("PATCH", `/api/im/agent_profiles/${encodeURIComponent(profileId)}`, {
       body: { config: newConfig, version: profile.version }
     });
@@ -11433,9 +9873,9 @@ function mkCloud4() {
 }
 function readJsonArg(arg) {
   if (arg.startsWith("@")) {
-    const path9 = arg.slice(1);
-    if (!existsSync17(path9)) throw new Error(`File not found: ${path9}`);
-    return JSON.parse(readFileSync12(path9, "utf8"));
+    const path7 = arg.slice(1);
+    if (!existsSync16(path7)) throw new Error(`File not found: ${path7}`);
+    return JSON.parse(readFileSync10(path7, "utf8"));
   }
   return JSON.parse(arg);
 }
@@ -11446,200 +9886,13 @@ async function resolveDefaultWorkspaceId(cloud) {
   return def.id;
 }
 
-// src/cli/commands/reset.ts
-import { Command as Command13 } from "commander";
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, rmSync, renameSync as renameSync2 } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname10, join as join20 } from "path";
-import { setTimeout as sleep4 } from "timers/promises";
-init_util();
-init_ui();
-function buildResetCommand() {
-  return new Command13("reset").description("Stop daemon and reset local runtime state so setup can bind another account").option("--yes", "Actually perform the reset").option("--check", "Print the reset plan without changing files").option("--wipe", "Delete local state instead of archiving it").option("--timeout <ms>", "Time to wait for daemon shutdown (default 5000)", (v) => Number.parseInt(v, 10), 5e3).option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
-    const paths = resolvePaths();
-    const pid = readPidFile(paths);
-    const runningPid = pid && pidAlive2(pid) ? pid : null;
-    const archivePath = opts.wipe ? null : `${paths.root}.reset.${timestamp()}`;
-    const assetSyncRoot = resolveAssetSyncRoot();
-    const assetSyncArchivePath = opts.wipe ? null : `${assetSyncRoot}.reset.${timestamp()}`;
-    const hermesHome = resolveHermesHome();
-    const hermesArchivePath = opts.wipe ? null : `${hermesHome}.reset.${timestamp()}`;
-    const hermesGatewayPids = findHermesGatewayPids2();
-    const plan = {
-      root: paths.root,
-      exists: existsSync18(paths.root),
-      runningPid,
-      mode: opts.wipe ? "wipe" : "archive",
-      archivePath,
-      assetSyncRoot,
-      assetSyncExists: existsSync18(assetSyncRoot),
-      assetSyncArchivePath,
-      hermesHome,
-      hermesExists: existsSync18(hermesHome),
-      hermesArchivePath,
-      hermesGatewayPids,
-      willStopDaemon: runningPid !== null,
-      nextStep: "prismer setup"
-    };
-    if (opts.check) {
-      printPlan(plan, opts.json);
-      return;
-    }
-    if (!opts.yes) {
-      exitWithError("Refusing to reset without --yes. Run `prismer reset --check` to preview.", {
-        code: "confirmation_required"
-      });
-    }
-    if (runningPid !== null) {
-      await stopDaemon(runningPid, opts.timeout ?? 5e3);
-      clearPidFile(paths);
-    } else if (pid) {
-      clearPidFile(paths);
-    }
-    for (const gatewayPid of hermesGatewayPids) {
-      await stopProcess(gatewayPid, opts.timeout ?? 5e3, "Hermes gateway");
-    }
-    if (existsSync18(paths.root)) {
-      if (opts.wipe) {
-        rmSync(paths.root, { recursive: true, force: true });
-      } else {
-        if (!archivePath) throw new Error("internal: archivePath missing");
-        if (!existsSync18(dirname10(archivePath))) {
-          mkdirSync10(dirname10(archivePath), { recursive: true });
-        }
-        renameSync2(paths.root, archivePath);
-      }
-    }
-    if (existsSync18(assetSyncRoot)) {
-      if (opts.wipe) {
-        rmSync(assetSyncRoot, { recursive: true, force: true });
-      } else {
-        if (!assetSyncArchivePath) throw new Error("internal: assetSyncArchivePath missing");
-        if (!existsSync18(dirname10(assetSyncArchivePath))) {
-          mkdirSync10(dirname10(assetSyncArchivePath), { recursive: true });
-        }
-        renameSync2(assetSyncRoot, assetSyncArchivePath);
-      }
-    }
-    if (existsSync18(hermesHome)) {
-      if (opts.wipe) {
-        rmSync(hermesHome, { recursive: true, force: true });
-      } else {
-        if (!hermesArchivePath) throw new Error("internal: hermesArchivePath missing");
-        if (!existsSync18(dirname10(hermesArchivePath))) {
-          mkdirSync10(dirname10(hermesArchivePath), { recursive: true });
-        }
-        renameSync2(hermesHome, hermesArchivePath);
-      }
-    }
-    mkdirSync10(paths.root, { recursive: true });
-    if (opts.json) {
-      printJson({ ok: true, reset: true, plan });
-      return;
-    }
-    const ui = getUI();
-    ui.ok("Runtime reset complete", paths.root);
-    if (archivePath) ui.line(`  archived: ${archivePath}`);
-    if (assetSyncArchivePath && plan.assetSyncExists) ui.line(`  asset sync archived: ${assetSyncArchivePath}`);
-    if (hermesArchivePath && plan.hermesExists) ui.line(`  Hermes archived: ${hermesArchivePath}`);
-    if (hermesGatewayPids.length > 0) ui.line(`  stopped Hermes gateway pid(s): ${hermesGatewayPids.join(", ")}`);
-    ui.line("  next: prismer setup");
-  }, { code: "reset_failed" }));
-}
-function printPlan(plan, json) {
-  if (json) {
-    printJson({ ok: true, check: true, plan });
-    return;
-  }
-  const ui = getUI();
-  ui.header("Runtime reset plan");
-  ui.blank();
-  ui.line(`  root:        ${plan.root}`);
-  ui.line(`  exists:      ${plan.exists ? "yes" : "no"}`);
-  ui.line(`  daemon:      ${plan.runningPid ? `running pid ${plan.runningPid}` : "not running"}`);
-  ui.line(`  mode:        ${plan.mode}`);
-  if (plan.archivePath) ui.line(`  archive:     ${plan.archivePath}`);
-  ui.line(`  asset sync:  ${plan.assetSyncExists ? plan.assetSyncRoot : `${plan.assetSyncRoot} (not found)`}`);
-  if (plan.assetSyncArchivePath) ui.line(`  asset archive: ${plan.assetSyncArchivePath}`);
-  ui.line(`  Hermes:     ${plan.hermesExists ? plan.hermesHome : `${plan.hermesHome} (not found)`}`);
-  if (plan.hermesArchivePath) ui.line(`  Hermes archive: ${plan.hermesArchivePath}`);
-  ui.line(
-    `  Hermes gateway: ${plan.hermesGatewayPids.length > 0 ? `running pid(s) ${plan.hermesGatewayPids.join(", ")}` : "not running"}`
-  );
-  ui.blank();
-  ui.line("Run `prismer reset --yes` to apply, then `prismer setup` to bind a new account.");
-}
-async function stopDaemon(pid, timeoutMs) {
-  await stopProcess(pid, timeoutMs, "daemon");
-}
-async function stopProcess(pid, timeoutMs, label) {
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch (err) {
-    throw new Error(`SIGTERM failed for ${label} pid ${pid}: ${err.message}`);
-  }
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (!pidAlive2(pid)) return;
-    await sleep4(100);
-  }
-  try {
-    process.kill(pid, "SIGKILL");
-  } catch (err) {
-    throw new Error(`SIGKILL failed for ${label} pid ${pid}: ${err.message}`);
-  }
-  const killDeadline = Date.now() + 1e3;
-  while (Date.now() < killDeadline) {
-    if (!pidAlive2(pid)) return;
-    await sleep4(100);
-  }
-  throw new Error(`${label} pid ${pid} did not exit within ${timeoutMs + 1e3}ms`);
-}
-function timestamp() {
-  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-}
-function resolveAssetSyncRoot() {
-  const override = process.env.PRISMER_ASSET_SYNC_ROOT;
-  if (override) return override;
-  const home = homedir9();
-  const desktop = join20(home, "Desktop");
-  const base = existsSync18(desktop) ? desktop : home;
-  return join20(base, "Prismer Assets");
-}
-function resolveHermesHome() {
-  return process.env.HERMES_HOME || join20(homedir9(), ".hermes");
-}
-function findHermesGatewayPids2() {
-  try {
-    const out = execFileSync2("ps", ["-axo", "pid=,command="], { encoding: "utf8" });
-    const current = process.pid;
-    return out.split(/\r?\n/).map((line) => {
-      const trimmed = line.trim();
-      const match = /^(\d+)\s+(.+)$/.exec(trimmed);
-      if (!match) return null;
-      const pid = Number.parseInt(match[1], 10);
-      const command = match[2];
-      if (!Number.isFinite(pid) || pid === current) return null;
-      if (!isHermesGatewayCommand2(command)) return null;
-      return pid;
-    }).filter((pid) => pid !== null);
-  } catch {
-    return [];
-  }
-}
-function isHermesGatewayCommand2(command) {
-  if (!/\bgateway\b/.test(command) || !/\brun\b/.test(command)) return false;
-  return /(^|\s)(?:\S*\/)?hermes(?:\s|$)/.test(command);
-}
-
 // src/cli/commands/sandbox.ts
-import { Command as Command14 } from "commander";
+import { Command as Command13 } from "commander";
 init_util();
 init_ui();
 function buildSandboxCommand() {
-  const cmd = new Command14("sandbox").description("Inspect and smoke-test sandbox lifecycle");
-  cmd.command("list").description("List sandbox containers in a workspace").requiredOption("--workspace-id <id>", "Workspace id").option("--status <status>", "Status filter").option("--limit <n>", "Max rows", parsePositiveInt6, 50).option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
+  const cmd = new Command13("sandbox").description("Inspect and smoke-test sandbox lifecycle");
+  cmd.command("list").description("List sandbox containers in a workspace").requiredOption("--workspace-id <id>", "Workspace id").option("--status <status>", "Status filter").option("--limit <n>", "Max rows", parsePositiveInt5, 50).option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
     const query = new URLSearchParams({ workspaceId: opts.workspaceId, limit: String(opts.limit) });
     if (opts.status) query.set("status", opts.status);
     const body = await cloudRequest("GET", `/api/sandboxes?${query.toString()}`);
@@ -11698,7 +9951,7 @@ function buildSandboxCommand() {
     }
     printSnapshotResult(id, body);
   }, { code: "sandbox_snapshot_failed" }));
-  cmd.command("runCmd <id> <command...>").description("Run a command in a sandbox container").option("--timeout-ms <ms>", "Command timeout", parsePositiveInt6, 6e4).option("--json", "Output machine-readable JSON").allowUnknownOption(true).action(runAction(async (id, command, opts) => {
+  cmd.command("runCmd <id> <command...>").description("Run a command in a sandbox container").option("--timeout-ms <ms>", "Command timeout", parsePositiveInt5, 6e4).option("--json", "Output machine-readable JSON").allowUnknownOption(true).action(runAction(async (id, command, opts) => {
     if (!Array.isArray(command) || command.length === 0) exitWithError("runCmd requires a command after --", { code: "invalid_argument" });
     const body = await cloudRequest("POST", `/api/sandboxes/${encodeURIComponent(id)}/runCmd`, {
       command,
@@ -11739,12 +9992,12 @@ function errorMessage2(raw) {
   if (typeof raw.error === "string") return raw.error;
   return raw.error?.message ?? "request failed";
 }
-async function cloudRequest(method, path9, body) {
+async function cloudRequest(method, path7, body) {
   const cloud = mkCloud5();
-  const res = await cloud.request(method, path9, body === void 0 ? void 0 : { body });
-  if (!res.ok) exitWithError(`${method} ${path9} failed (${res.status}): ${res.error?.message ?? "request failed"}`);
+  const res = await cloud.request(method, path7, body === void 0 ? void 0 : { body });
+  if (!res.ok) exitWithError(`${method} ${path7} failed (${res.status}): ${res.error?.message ?? "request failed"}`);
   const responseBody = res.data;
-  if (isErrorEnvelope2(responseBody)) exitWithError(`${method} ${path9} failed (${res.status}): ${errorMessage2(responseBody)}`);
+  if (isErrorEnvelope2(responseBody)) exitWithError(`${method} ${path7} failed (${res.status}): ${errorMessage2(responseBody)}`);
   return responseBody;
 }
 function printSandboxList(raw) {
@@ -11819,7 +10072,7 @@ function writeLine2(label, value) {
   if (value === void 0 || value === null || value === "") return;
   getUI().line(`  ${label}: ${String(value)}`);
 }
-function parsePositiveInt6(value) {
+function parsePositiveInt5(value) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
     throw new Error("expected a positive integer");
@@ -11837,16 +10090,16 @@ async function safeParseResponse(res) {
 }
 
 // src/cli/commands/setup.ts
-import { Command as Command15 } from "commander";
+import { Command as Command14 } from "commander";
 import { hostname as hostname3 } from "os";
 import { spawn as spawn6 } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync19, renameSync as renameSync3 } from "fs";
+import { randomBytes } from "crypto";
+import { existsSync as existsSync17, renameSync } from "fs";
 import { createServer as createServer2 } from "http";
 init_util();
 init_ui();
 function buildSetupCommand() {
-  return new Command15("setup").description("Set up this local runtime and bind it to Prismer Cloud").argument("[api-key]", "Prismer daemon API key; primarily for manual recovery and automation").option(
+  return new Command14("setup").description("Set up this local runtime and bind it to Prismer Cloud").argument("[api-key]", "Prismer daemon API key; primarily for manual recovery and automation").option(
     "--cloud <url>",
     `Cloud base URL (default: ${DEFAULT_CLOUD_BASE_URL}; bare host:port is auto-prefixed http://)`,
     (v) => v
@@ -11859,7 +10112,7 @@ function buildSetupCommand() {
     } catch (err) {
       exitWithError(err.message, { code: "invalid_cloud_url" });
     }
-    let apiKey = apiKeyArg ?? (opts.force ? void 0 : process.env.PRISMER_API_KEY);
+    let apiKey = apiKeyArg ?? process.env.PRISMER_API_KEY;
     const authToken = opts.token ?? process.env.PRISMER_AUTH_TOKEN;
     if (!opts.json) {
       printBanner({ compact: true });
@@ -11867,6 +10120,7 @@ function buildSetupCommand() {
       getUI().blank();
     }
     const shouldStart = opts.start !== false;
+    stopRunningDaemon(paths);
     if (opts.pair || opts.asUser) {
       if (!opts.json) warn("Legacy pair setup path", "plain `prismer setup --start` is the canonical runtime binding flow");
       if (opts.asUser && process.env.LOCAL_ONLY !== "1") {
@@ -11957,11 +10211,10 @@ function buildSetupCommand() {
         return;
       }
       const previousConfig = configExists(paths) ? loadConfig(paths) : null;
-      const daemonId = previousConfig && previousConfig.api_key === apiKey && previousConfig.cloud_api_base === cloudBaseUrl ? previousConfig.daemon_id : newDaemonId();
       const config = {
         api_key: apiKey,
         cloud_api_base: cloudBaseUrl,
-        daemon_id: daemonId
+        daemon_id: newDaemonId()
       };
       if (previousConfig && shouldArchiveLocalDb(previousConfig, config)) {
         archiveLocalDb(paths.localDb);
@@ -11991,7 +10244,7 @@ function buildSetupCommand() {
   }, { code: "setup_failed" }));
 }
 async function runBrowserSetup(input) {
-  const state = randomBytes2(18).toString("base64url");
+  const state = randomBytes(18).toString("base64url");
   const server = createServer2();
   const apiKeyPromise = waitForSetupCallback(server, state);
   await new Promise((resolve3, reject) => {
@@ -12088,13 +10341,35 @@ function startDaemonDetached(home) {
   });
   child.unref();
 }
+function stopRunningDaemon(paths) {
+  const pid = readPidFile(paths);
+  if (!pid || !pidAlive(pid)) {
+    if (pid) clearPidFile(paths);
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const deadline = Date.now() + 5e3;
+  while (Date.now() < deadline) {
+    if (!pidAlive(pid)) {
+      clearPidFile(paths);
+      return;
+    }
+    const start = Date.now();
+    while (Date.now() - start < 200) {
+    }
+  }
+}
 function shouldArchiveLocalDb(previous, next) {
   return previous.api_key !== next.api_key || previous.cloud_api_base !== next.cloud_api_base || previous.daemon_id !== next.daemon_id;
 }
 function archiveLocalDb(localDbPath) {
-  if (!existsSync19(localDbPath)) return;
+  if (!existsSync17(localDbPath)) return;
   const archived = `${localDbPath}.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.bak`;
-  renameSync3(localDbPath, archived);
+  renameSync(localDbPath, archived);
 }
 async function mintDaemonApiKey(input) {
   const label = `Daemon: ${input.deviceName} ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
@@ -12114,12 +10389,11 @@ async function mintDaemonApiKey(input) {
 }
 
 // src/cli/commands/status.ts
-import { Command as Command16 } from "commander";
-import { hostname as hostname4 } from "os";
+import { Command as Command15 } from "commander";
 init_util();
 init_ui();
 function buildStatusCommand() {
-  return new Command16("status").description("Show daemon + config + cloud status").option("--json", "Output machine-readable JSON").action(async (opts) => {
+  return new Command15("status").description("Show daemon + config + cloud status").option("--json", "Output machine-readable JSON").action(async (opts) => {
     const paths = resolvePaths();
     if (!configExists(paths)) {
       const report2 = { configured: false, paired: false, paths: { config: paths.configFile } };
@@ -12187,7 +10461,11 @@ function buildStatusCommand() {
         info: daemonStatus.info ?? {}
       },
       cloud: { base: cfg.cloud_api_base, reachable: cloudOk, me, devices, agents },
-      local
+      local,
+      binding: {
+        daemonId: cfg.daemon_id,
+        apiKey: cfg.api_key
+      }
     };
     if (opts.json) {
       printJson(report);
@@ -12210,8 +10488,8 @@ async function readDaemonStatus() {
   const paths = resolvePaths();
   const pid = readPidFile(paths);
   if (pid) {
-    const { pidAlive: pidAlive3 } = await Promise.resolve().then(() => (init_util(), util_exports));
-    if (pidAlive3(pid)) return { running: true, pid };
+    const { pidAlive: pidAlive2 } = await Promise.resolve().then(() => (init_util(), util_exports));
+    if (pidAlive2(pid)) return { running: true, pid };
   }
   return { running: false };
 }
@@ -12239,9 +10517,8 @@ function printPretty(report) {
   ui.blank();
   ok("Config", report.paths.config);
   if (report.daemon.running) {
-    const daemonName = report.cloud.me && typeof report.cloud.me === "object" ? report.cloud.me.user?.username ?? hostname4() : hostname4();
     const ws = report.daemon.wsConnected ? "connected" : "pending";
-    ok("Daemon", `${daemonName}  pid=${report.daemon.pid}  ws=${ws}`);
+    ok("Daemon", `pid=${report.daemon.pid}  ws=${ws}`);
     if (report.daemon.info) {
       const info2 = report.daemon.info;
       if (info2.version) ui.line(`  Version:  ${info2.version}`);
@@ -12256,7 +10533,8 @@ function printPretty(report) {
     ok("Cloud", report.cloud.base);
     const me = report.cloud.me;
     if (me?.user) {
-      ui.line(`  User:     ${me.user.displayName ?? me.user.username ?? "?"}`);
+      const roleTag = me.user.role ? `  role=${me.user.role}` : "";
+      ui.line(`  Account:  ${me.user.displayName ?? me.user.username ?? "?"}${roleTag}`);
     }
     if (me?.credits) {
       ui.line(`  Credits:  ${typeof me.credits.balance === "number" ? me.credits.balance.toLocaleString() : "?"}`);
@@ -12265,6 +10543,12 @@ function printPretty(report) {
     fail("Cloud", `${report.cloud.base} unreachable or unauthorized`);
     tip("prismer setup --force");
   }
+  if (report.binding) {
+    ui.blank();
+    ui.line(`  Daemon ID:  ${report.binding.daemonId}`);
+    const masked = report.binding.apiKey.slice(0, 14) + "\u2022\u2022\u2022\u2022" + report.binding.apiKey.slice(-4);
+    ui.line(`  API Key:    ${masked}`);
+  }
   if (Array.isArray(report.cloud.devices) && report.cloud.devices.length > 0) {
     const devs = report.cloud.devices;
     ui.blank();
@@ -12275,6 +10559,8 @@ function printPretty(report) {
       const declared = d.hostedAgentSummary?.declared ?? 0;
       ui.line(`    ${statusIcon} ${d.podName?.replace(/^daemon:/, "")?.slice(0, 28) ?? "?"}  kind=${kind}  agents=${declared}`);
     }
+  } else {
+    ui.line(`  Workspace Devices: none`);
   }
   if (Array.isArray(report.cloud.agents) && report.cloud.agents.length > 0) {
     ui.line(`  Hosted agents: ${report.cloud.agents.length}`);
@@ -12290,14 +10576,14 @@ function printPretty(report) {
 }
 
 // src/cli/commands/task.ts
-import { Command as Command17 } from "commander";
-import { setTimeout as sleep5 } from "timers/promises";
+import { Command as Command16 } from "commander";
+import { setTimeout as sleep3 } from "timers/promises";
 init_util();
 function describeStatus(status) {
   return status === 0 ? "network error" : `HTTP ${status}`;
 }
 function buildTaskCommand() {
-  const cmd = new Command17("task").description("Manage tasks");
+  const cmd = new Command16("task").description("Manage tasks");
   cmd.command("create").description("Create + dispatch a task to the given agent and wait for completion").requiredOption("--agent <imUserId>", "Assignee agent IMUser.id").requiredOption("--prompt <text>", "Prompt to send to the adapter").option("--profile <profileId>", "AgentProfile id (cloud picks first if omitted)").option("--capability <name>", "Capability tag", "chat").option("--title <text>", "Task title (defaults to prompt prefix)").option("--timeout-ms <ms>", "Per-task timeout", (v) => Number.parseInt(v, 10)).option("--no-wait", "Just create + print task id; don't poll").option("--json", "Output JSON (default)").action(runAction(async (opts) => {
     const cloud = mkCloud6();
     const body = {
@@ -12374,7 +10660,7 @@ function unwrap2(raw) {
 async function pollUntilTerminal(cloud, taskId, timeoutMs) {
   const deadline = Date.now() + (timeoutMs ?? 5 * 6e4);
   while (Date.now() < deadline) {
-    await sleep5(1e3);
+    await sleep3(1e3);
     const res = await cloud.request(
       "GET",
       `/api/im/tasks/${encodeURIComponent(taskId)}`
@@ -12411,11 +10697,11 @@ function taskFrom2(raw) {
 }
 
 // src/cli/commands/workspace.ts
-import { Command as Command18 } from "commander";
+import { Command as Command17 } from "commander";
 init_util();
 init_ui();
 function buildWorkspaceCommand() {
-  const cmd = new Command18("workspace").description("Manage workspaces, runtime snapshots, and workspace files");
+  const cmd = new Command17("workspace").description("Manage workspaces, runtime snapshots, and workspace files");
   cmd.command("list").description("List workspaces").option("--json", "Output machine-readable JSON").action(runAction(async (opts) => {
     const cloud = mkCloud7();
     const data = await cloud.get("/api/im/workspaces");
@@ -12649,15 +10935,18 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "1.9.7";
+
+// package.json
+var version = "1.9.22";
+
+// src/cli/index.ts
 function buildProgram() {
-  const program = new Command19("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
+  const program = new Command18("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(version);
   program.addCommand(buildBannerCommand());
   program.addCommand(buildSetupCommand());
   program.addCommand(buildConfigCommand());
   program.addCommand(buildDaemonCommand());
   program.addCommand(buildPairCommand());
-  program.addCommand(buildResetCommand());
   program.addCommand(buildStatusCommand());
   program.addCommand(buildAdapterCommand());
   program.addCommand(buildAgentCommand());