@prismer/runtime 2.0.0 → 2.0.2

package/dist/index.d.cts

@@ -746,7 +746,15 @@ declare function saveConfig(config: Config, paths?: ConfigPaths): void;
 /** Derive a `wss?://` URL from a `https?://` base. Trailing `/ws` appended. */
 declare function deriveWsUrl(httpBase: string): string;
 
-declare function newDaemonId(): string;
+interface NewDaemonIdOptions {
+    /** API key — when provided, the suffix becomes a deterministic sha256(hostname|apiKey)
+     * slice(0,12). Pass this so re-running `prismer setup` yields the same daemonId
+     * and cloud-side upsert dedupes the IMContainer row instead of accumulating. */
+    apiKey?: string;
+    /** Optional explicit hostname (test only). */
+    hostnameOverride?: string;
+}
+declare function newDaemonId(opts?: NewDaemonIdOptions): string;
 declare function isDaemonId(s: string): boolean;
 
 interface CloudClientOptions {
@@ -865,6 +873,38 @@ declare class AssetCache {
         signal?: AbortSignal;
         assetId?: string;
     }): Promise<CachedAsset>;
+    /**
+     * Fetch a public http(s) URL, content-hash dedup, cache locally.
+     *
+     * Mirrors `getOrFetch` (cache key = sha256 of body bytes), but the input
+     * is a URL whose hash we don't know up front. The fetcher applies:
+     *
+     *   - SSRF guard (resolve hostname, reject loopback / RFC1918 / link-local
+     *     / cloud-metadata / IPv6 ULA + link-local). Cross-host redirects
+     *     re-validate the new host before each hop.
+     *   - manual redirect handling (max 3 hops).
+     *   - hard timeout (default 15 s, override via env
+     *     `PRISMER_URL_FETCH_TIMEOUT_MS`).
+     *   - streaming body read with abort-at-limit (default 5 MiB, override
+     *     via env `PRISMER_URL_FETCH_MAX_BYTES`). Truncated bodies are NOT
+     *     cached.
+     *   - non-2xx → throws (caller should leave the URL in place and emit
+     *     an `error` observation).
+     *
+     * On success returns { cached, finalUrl, durationMs }; the caller can
+     * pin / unpin the hash like any other asset.
+     */
+    getOrFetchUrl(url: string, opts?: {
+        signal?: AbortSignal;
+        userAgent?: string;
+        maxBytes?: number;
+        timeoutMs?: number;
+        maxRedirects?: number;
+    }): Promise<{
+        cached: CachedAsset;
+        finalUrl: string;
+        durationMs: number;
+    }>;
     /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
     registerLocal(hash: string, localPath: string, mime?: string): CachedAsset;
     /** Total bytes across all rows (incl. pinned). */
@@ -1022,68 +1062,6 @@ declare class ParseClaimController {
     }): HeartbeatHandle;
 }
 
-type PrismerUriType = 'asset' | 'file';
-interface ParsedPrismerUri {
-    /** Original full URI string. */
-    raw: string;
-    /**
-     * Owner segment for legacy `prismer://<owner>/...` form (informational,
-     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
-     * literal string 'workspace' — prefer `workspaceId` instead.
-     */
-    owner: string;
-    type: PrismerUriType;
-    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
-    rest: string;
-    /** Convenience parses for type='file' and for workspace-form 'asset'. */
-    workspaceId?: string;
-    filePath?: string;
-}
-/**
- * Find every recognized `prismer://...` reference in a string.
- * Only `asset` and `file` types are recognized — other types (memory,
- * context, conversation, evolution, task, pair) pass through untouched.
- */
-declare function parseUris(text: string): ParsedPrismerUri[];
-interface UriResolverOptions {
-    db: LocalDb;
-    cloud: CloudClient;
-    assetCache: AssetCache;
-}
-declare class UriResolver {
-    private readonly db;
-    private readonly cloud;
-    private readonly assetCache;
-    constructor(opts: UriResolverOptions);
-    /**
-     * Resolve a single URI to a local file path. Throws on auth/4xx;
-     * caller decides whether to leave the URI in place (best-effort) or fail.
-     */
-    resolveOne(uri: ParsedPrismerUri, opts?: {
-        signal?: AbortSignal;
-    }): Promise<string>;
-    /**
-     * Walk a string, replace every `prismer://(asset|file)/...` with `file://<localPath>`.
-     * Unrecognized URIs pass through. Returns rewritten text + the list of pinned hashes.
-     */
-    rewrite(text: string, opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        text: string;
-        resolvedHashes: string[];
-    }>;
-    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
-    rewriteAll(texts: string[], opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        texts: string[];
-        resolvedHashes: string[];
-    }>;
-    private lookupFile;
-}
-
 type IMAgentStatus = 'online' | 'busy' | 'idle' | 'offline';
 interface HostedAgentDeclaration {
     imUserId: string;
@@ -1185,15 +1163,22 @@ interface TaskDispatchProgressPayload {
     detail?: Record<string, unknown>;
 }
 /** Wave-8 W1: how the daemon handled a single AssetRef. */
-type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'error';
+type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'fetched-https' | 'error';
 interface AssetDispatchObservation {
-    assetId: string;
+    /** AssetRef.assetId for cloud-attached refs; undefined for L5 https fetches. */
+    assetId?: string;
     contentHash: string;
     mime: string | null;
     sizeBytes: number | null;
     strategy: AssetDispatchStrategy;
     inlinedBytes?: number;
     error?: string;
+    /** L5: original URL the user wrote in the prompt. */
+    originalUrl?: string;
+    /** L5: post-redirect URL the body was actually downloaded from. */
+    finalUrl?: string;
+    /** L5: end-to-end fetch duration in ms (DNS + connect + body read). */
+    durationMs?: number;
 }
 interface TaskDispatchReplyPayload {
     taskId: string;
@@ -1254,6 +1239,106 @@ interface AssetChangedPayload {
     revision?: number;
 }
 
+type PrismerUriType = 'asset' | 'file';
+interface ParsedPrismerUri {
+    /** Original full URI string. */
+    raw: string;
+    /**
+     * Owner segment for legacy `prismer://<owner>/...` form (informational,
+     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
+     * literal string 'workspace' — prefer `workspaceId` instead.
+     */
+    owner: string;
+    type: PrismerUriType;
+    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
+    rest: string;
+    /** Convenience parses for type='file' and for workspace-form 'asset'. */
+    workspaceId?: string;
+    filePath?: string;
+}
+/**
+ * Find every recognized `prismer://...` reference in a string.
+ * Only `asset` and `file` types are recognized — other types (memory,
+ * context, conversation, evolution, task, pair) pass through untouched.
+ */
+declare function parseUris(text: string): ParsedPrismerUri[];
+interface UriResolverOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    assetCache: AssetCache;
+}
+declare class UriResolver {
+    private readonly db;
+    private readonly cloud;
+    private readonly assetCache;
+    constructor(opts: UriResolverOptions);
+    /**
+     * Resolve a single URI to a local file path. Throws on auth/4xx;
+     * caller decides whether to leave the URI in place (best-effort) or fail.
+     */
+    resolveOne(uri: ParsedPrismerUri, opts?: {
+        signal?: AbortSignal;
+    }): Promise<string>;
+    /**
+     * Walk a string, replace every `prismer://(asset|file)/...` and
+     * `https://…` / `http://…` URL with `file://<localPath>`.
+     *
+     * Unrecognized URIs pass through unchanged. Returns rewritten text, the
+     * list of pinned hashes, and one observation per http(s) URL the resolver
+     * attempted (success + error both surface) so the dispatch can include
+     * them in `reply.assetObservability`.
+     *
+     * `urlCache` lets the caller dedupe URL fetches across multiple rewrite
+     * calls within a single dispatch (e.g. prompt + each context entry).
+     * Pass the same Map instance to every rewrite() / rewriteAll() call.
+     */
+    rewrite(text: string, opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        /** L5: opt out of http(s) URL fetching for this string (e.g. memory/goal text). */
+        fetchUrls?: boolean;
+        /** L5: shared per-dispatch dedup map (originalUrl → cached resolution). */
+        urlCache?: Map<string, UrlResolution>;
+        /** L5: append url observations here (caller-owned array). */
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        text: string;
+        resolvedHashes: string[];
+    }>;
+    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
+    rewriteAll(texts: string[], opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        fetchUrls?: boolean;
+        urlCache?: Map<string, UrlResolution>;
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        texts: string[];
+        resolvedHashes: string[];
+    }>;
+    private lookupFile;
+}
+/**
+ * L5: per-dispatch resolution record for a fetched http(s) URL. The same
+ * record is reused across every reference to the URL in this dispatch
+ * (prompt + N context entries) so we resolve once even if the URL appears
+ * many times.
+ */
+interface UrlResolution {
+    hash: string;
+    localPath: string;
+    sizeBytes: number;
+    mime: string | null;
+    finalUrl: string;
+    durationMs: number;
+}
+/**
+ * Extract http(s) URLs from a string. Each match has trailing punctuation
+ * stripped so callers can replace the exact match in the source text.
+ * Duplicates are de-duped: the first occurrence wins.
+ */
+declare function extractHttpUrls(text: string): string[];
+
 interface OutboxWatcherOptions {
     /**
      * Default directory to watch when no setActiveTask has narrowed it.
@@ -1904,8 +1989,19 @@ declare class Runner extends EventEmitter {
     private lastTaskError?;
     private heartbeatTimer?;
     private taskReaperTimer?;
+    private skillResyncTimer?;
+    private skillSyncInFlight;
     constructor(opts?: RunnerOptions);
     start(): Promise<void>;
+    /**
+     * F16 (2026-05-20) — enumerate every non-deleted local agent_profile and
+     * fan-out `syncInstalledSkillsForDispatch` via `syncAllAgentSkills`.
+     * Fire-and-forget — failures are logged per profile but never throw.
+     * Re-entrant guard so an overlong sync doesn't stack with the next tick.
+     */
+    private syncAllSkillsBackground;
+    /** F16 — read all live agent_profiles from local DB → AgentProfile[]. */
+    private loadAllProfiles;
     stop(): Promise<void>;
     isRunning(): boolean;
     /**
@@ -2198,4 +2294,4 @@ declare const codexAdapter: AdapterDef;
 declare function buildProgram(): Command;
 declare function runCli(argv?: string[]): Promise<void>;
 
-export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentDispatchReplyAttachment, type AgentDispatchReplyPayload, type AgentDispatchReplyStatus, type AgentDispatchRequest, type AgentDispatchResponse, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetChangedPayload, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type MessageDispatchAgent, type MessageDispatchDeps, type MessageDispatchHandle, type MessageDispatchTaskInput, type NormalizedContent, type OpenClawProfileConfig, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, getRoleTemplate, handleAgentMessageDispatch, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, openclawAdapter, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };
+export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentDispatchReplyAttachment, type AgentDispatchReplyPayload, type AgentDispatchReplyStatus, type AgentDispatchRequest, type AgentDispatchResponse, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetChangedPayload, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type MessageDispatchAgent, type MessageDispatchDeps, type MessageDispatchHandle, type MessageDispatchTaskInput, type NormalizedContent, type OpenClawProfileConfig, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type UrlResolution, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, extractHttpUrls, getRoleTemplate, handleAgentMessageDispatch, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, openclawAdapter, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };

package/dist/index.d.ts

@@ -746,7 +746,15 @@ declare function saveConfig(config: Config, paths?: ConfigPaths): void;
 /** Derive a `wss?://` URL from a `https?://` base. Trailing `/ws` appended. */
 declare function deriveWsUrl(httpBase: string): string;
 
-declare function newDaemonId(): string;
+interface NewDaemonIdOptions {
+    /** API key — when provided, the suffix becomes a deterministic sha256(hostname|apiKey)
+     * slice(0,12). Pass this so re-running `prismer setup` yields the same daemonId
+     * and cloud-side upsert dedupes the IMContainer row instead of accumulating. */
+    apiKey?: string;
+    /** Optional explicit hostname (test only). */
+    hostnameOverride?: string;
+}
+declare function newDaemonId(opts?: NewDaemonIdOptions): string;
 declare function isDaemonId(s: string): boolean;
 
 interface CloudClientOptions {
@@ -865,6 +873,38 @@ declare class AssetCache {
         signal?: AbortSignal;
         assetId?: string;
     }): Promise<CachedAsset>;
+    /**
+     * Fetch a public http(s) URL, content-hash dedup, cache locally.
+     *
+     * Mirrors `getOrFetch` (cache key = sha256 of body bytes), but the input
+     * is a URL whose hash we don't know up front. The fetcher applies:
+     *
+     *   - SSRF guard (resolve hostname, reject loopback / RFC1918 / link-local
+     *     / cloud-metadata / IPv6 ULA + link-local). Cross-host redirects
+     *     re-validate the new host before each hop.
+     *   - manual redirect handling (max 3 hops).
+     *   - hard timeout (default 15 s, override via env
+     *     `PRISMER_URL_FETCH_TIMEOUT_MS`).
+     *   - streaming body read with abort-at-limit (default 5 MiB, override
+     *     via env `PRISMER_URL_FETCH_MAX_BYTES`). Truncated bodies are NOT
+     *     cached.
+     *   - non-2xx → throws (caller should leave the URL in place and emit
+     *     an `error` observation).
+     *
+     * On success returns { cached, finalUrl, durationMs }; the caller can
+     * pin / unpin the hash like any other asset.
+     */
+    getOrFetchUrl(url: string, opts?: {
+        signal?: AbortSignal;
+        userAgent?: string;
+        maxBytes?: number;
+        timeoutMs?: number;
+        maxRedirects?: number;
+    }): Promise<{
+        cached: CachedAsset;
+        finalUrl: string;
+        durationMs: number;
+    }>;
     /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
     registerLocal(hash: string, localPath: string, mime?: string): CachedAsset;
     /** Total bytes across all rows (incl. pinned). */
@@ -1022,68 +1062,6 @@ declare class ParseClaimController {
     }): HeartbeatHandle;
 }
 
-type PrismerUriType = 'asset' | 'file';
-interface ParsedPrismerUri {
-    /** Original full URI string. */
-    raw: string;
-    /**
-     * Owner segment for legacy `prismer://<owner>/...` form (informational,
-     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
-     * literal string 'workspace' — prefer `workspaceId` instead.
-     */
-    owner: string;
-    type: PrismerUriType;
-    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
-    rest: string;
-    /** Convenience parses for type='file' and for workspace-form 'asset'. */
-    workspaceId?: string;
-    filePath?: string;
-}
-/**
- * Find every recognized `prismer://...` reference in a string.
- * Only `asset` and `file` types are recognized — other types (memory,
- * context, conversation, evolution, task, pair) pass through untouched.
- */
-declare function parseUris(text: string): ParsedPrismerUri[];
-interface UriResolverOptions {
-    db: LocalDb;
-    cloud: CloudClient;
-    assetCache: AssetCache;
-}
-declare class UriResolver {
-    private readonly db;
-    private readonly cloud;
-    private readonly assetCache;
-    constructor(opts: UriResolverOptions);
-    /**
-     * Resolve a single URI to a local file path. Throws on auth/4xx;
-     * caller decides whether to leave the URI in place (best-effort) or fail.
-     */
-    resolveOne(uri: ParsedPrismerUri, opts?: {
-        signal?: AbortSignal;
-    }): Promise<string>;
-    /**
-     * Walk a string, replace every `prismer://(asset|file)/...` with `file://<localPath>`.
-     * Unrecognized URIs pass through. Returns rewritten text + the list of pinned hashes.
-     */
-    rewrite(text: string, opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        text: string;
-        resolvedHashes: string[];
-    }>;
-    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
-    rewriteAll(texts: string[], opts?: {
-        pin?: boolean;
-        signal?: AbortSignal;
-    }): Promise<{
-        texts: string[];
-        resolvedHashes: string[];
-    }>;
-    private lookupFile;
-}
-
 type IMAgentStatus = 'online' | 'busy' | 'idle' | 'offline';
 interface HostedAgentDeclaration {
     imUserId: string;
@@ -1185,15 +1163,22 @@ interface TaskDispatchProgressPayload {
     detail?: Record<string, unknown>;
 }
 /** Wave-8 W1: how the daemon handled a single AssetRef. */
-type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'error';
+type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'fetched-https' | 'error';
 interface AssetDispatchObservation {
-    assetId: string;
+    /** AssetRef.assetId for cloud-attached refs; undefined for L5 https fetches. */
+    assetId?: string;
     contentHash: string;
     mime: string | null;
     sizeBytes: number | null;
     strategy: AssetDispatchStrategy;
     inlinedBytes?: number;
     error?: string;
+    /** L5: original URL the user wrote in the prompt. */
+    originalUrl?: string;
+    /** L5: post-redirect URL the body was actually downloaded from. */
+    finalUrl?: string;
+    /** L5: end-to-end fetch duration in ms (DNS + connect + body read). */
+    durationMs?: number;
 }
 interface TaskDispatchReplyPayload {
     taskId: string;
@@ -1254,6 +1239,106 @@ interface AssetChangedPayload {
     revision?: number;
 }
 
+type PrismerUriType = 'asset' | 'file';
+interface ParsedPrismerUri {
+    /** Original full URI string. */
+    raw: string;
+    /**
+     * Owner segment for legacy `prismer://<owner>/...` form (informational,
+     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
+     * literal string 'workspace' — prefer `workspaceId` instead.
+     */
+    owner: string;
+    type: PrismerUriType;
+    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
+    rest: string;
+    /** Convenience parses for type='file' and for workspace-form 'asset'. */
+    workspaceId?: string;
+    filePath?: string;
+}
+/**
+ * Find every recognized `prismer://...` reference in a string.
+ * Only `asset` and `file` types are recognized — other types (memory,
+ * context, conversation, evolution, task, pair) pass through untouched.
+ */
+declare function parseUris(text: string): ParsedPrismerUri[];
+interface UriResolverOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    assetCache: AssetCache;
+}
+declare class UriResolver {
+    private readonly db;
+    private readonly cloud;
+    private readonly assetCache;
+    constructor(opts: UriResolverOptions);
+    /**
+     * Resolve a single URI to a local file path. Throws on auth/4xx;
+     * caller decides whether to leave the URI in place (best-effort) or fail.
+     */
+    resolveOne(uri: ParsedPrismerUri, opts?: {
+        signal?: AbortSignal;
+    }): Promise<string>;
+    /**
+     * Walk a string, replace every `prismer://(asset|file)/...` and
+     * `https://…` / `http://…` URL with `file://<localPath>`.
+     *
+     * Unrecognized URIs pass through unchanged. Returns rewritten text, the
+     * list of pinned hashes, and one observation per http(s) URL the resolver
+     * attempted (success + error both surface) so the dispatch can include
+     * them in `reply.assetObservability`.
+     *
+     * `urlCache` lets the caller dedupe URL fetches across multiple rewrite
+     * calls within a single dispatch (e.g. prompt + each context entry).
+     * Pass the same Map instance to every rewrite() / rewriteAll() call.
+     */
+    rewrite(text: string, opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        /** L5: opt out of http(s) URL fetching for this string (e.g. memory/goal text). */
+        fetchUrls?: boolean;
+        /** L5: shared per-dispatch dedup map (originalUrl → cached resolution). */
+        urlCache?: Map<string, UrlResolution>;
+        /** L5: append url observations here (caller-owned array). */
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        text: string;
+        resolvedHashes: string[];
+    }>;
+    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
+    rewriteAll(texts: string[], opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+        fetchUrls?: boolean;
+        urlCache?: Map<string, UrlResolution>;
+        urlObservations?: AssetDispatchObservation[];
+    }): Promise<{
+        texts: string[];
+        resolvedHashes: string[];
+    }>;
+    private lookupFile;
+}
+/**
+ * L5: per-dispatch resolution record for a fetched http(s) URL. The same
+ * record is reused across every reference to the URL in this dispatch
+ * (prompt + N context entries) so we resolve once even if the URL appears
+ * many times.
+ */
+interface UrlResolution {
+    hash: string;
+    localPath: string;
+    sizeBytes: number;
+    mime: string | null;
+    finalUrl: string;
+    durationMs: number;
+}
+/**
+ * Extract http(s) URLs from a string. Each match has trailing punctuation
+ * stripped so callers can replace the exact match in the source text.
+ * Duplicates are de-duped: the first occurrence wins.
+ */
+declare function extractHttpUrls(text: string): string[];
+
 interface OutboxWatcherOptions {
     /**
      * Default directory to watch when no setActiveTask has narrowed it.
@@ -1904,8 +1989,19 @@ declare class Runner extends EventEmitter {
     private lastTaskError?;
     private heartbeatTimer?;
     private taskReaperTimer?;
+    private skillResyncTimer?;
+    private skillSyncInFlight;
     constructor(opts?: RunnerOptions);
     start(): Promise<void>;
+    /**
+     * F16 (2026-05-20) — enumerate every non-deleted local agent_profile and
+     * fan-out `syncInstalledSkillsForDispatch` via `syncAllAgentSkills`.
+     * Fire-and-forget — failures are logged per profile but never throw.
+     * Re-entrant guard so an overlong sync doesn't stack with the next tick.
+     */
+    private syncAllSkillsBackground;
+    /** F16 — read all live agent_profiles from local DB → AgentProfile[]. */
+    private loadAllProfiles;
     stop(): Promise<void>;
     isRunning(): boolean;
     /**
@@ -2198,4 +2294,4 @@ declare const codexAdapter: AdapterDef;
 declare function buildProgram(): Command;
 declare function runCli(argv?: string[]): Promise<void>;
 
-export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentDispatchReplyAttachment, type AgentDispatchReplyPayload, type AgentDispatchReplyStatus, type AgentDispatchRequest, type AgentDispatchResponse, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetChangedPayload, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type MessageDispatchAgent, type MessageDispatchDeps, type MessageDispatchHandle, type MessageDispatchTaskInput, type NormalizedContent, type OpenClawProfileConfig, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, getRoleTemplate, handleAgentMessageDispatch, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, openclawAdapter, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };
+export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentDispatchReplyAttachment, type AgentDispatchReplyPayload, type AgentDispatchReplyStatus, type AgentDispatchRequest, type AgentDispatchResponse, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetChangedPayload, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type MessageDispatchAgent, type MessageDispatchDeps, type MessageDispatchHandle, type MessageDispatchTaskInput, type NormalizedContent, type OpenClawProfileConfig, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type UrlResolution, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, extractHttpUrls, getRoleTemplate, handleAgentMessageDispatch, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, openclawAdapter, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };