@prismer/runtime 2.0.6 → 2.0.8

package/dist/index.d.ts

@@ -4,6 +4,136 @@ import { EventEmitter } from 'node:events';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { Command } from 'commander';
 
+/**
+ * Sender / participant role within a conversation. Mirrors
+ * `TaskDispatchContextEntry['senderRole']` on the cloud side.
+ */
+type EnvelopeRole = 'human' | 'agent' | 'admin' | 'system';
+/** Active participant of the conversation. */
+interface ParticipantRef {
+    imUserId: string;
+    username: string;
+    displayName: string;
+    role: string;
+    agentType?: string | null;
+}
+/**
+ * One raw L1 message in the `recent` tail. Visibility-filtered per
+ * docs/release201/26 §5.1 (lifecycle / system events are stripped cloud-side).
+ */
+interface EnvelopeRecentEntry {
+    messageId: string;
+    role: EnvelopeRole;
+    sender: string;
+    content: string;
+    createdAt: string;
+    /** Asset IDs attached to this message; bytes are never inlined here. */
+    assetRefs?: AssetRef[];
+}
+/** Structured salient facts extracted by the L2 producer (all optional). */
+interface EnvelopeSalientFacts {
+    topicHeadlines?: string[];
+    decisions?: string[];
+    openQuestions?: string[];
+    entitiesMentioned?: string[];
+    userPreferences?: string[];
+    agentCommitments?: string[];
+    discardedDirections?: string[];
+    /** metric-only: count of `task.*` lifecycle events covered by this segment. */
+    taskEventCount?: number;
+    /** metric-only: count of `awaiting_human_approval` events covered. */
+    approvalCount?: number;
+}
+/** A compressed L2 Range segment (Phase 1's only `segmentKind`). */
+interface EnvelopeSegment {
+    segmentSeq: number;
+    coversFromAt: string;
+    coversToAt: string;
+    summary: string;
+    salientFacts: EnvelopeSalientFacts;
+    sourceCount: number;
+    tokenCountCl100k: number;
+}
+/**
+ * Quote snapshot. Decision C: the ref always points at the raw `messageId`;
+ * the snapshot survives source deletion via `sourceDeletedAt`.
+ */
+interface EnvelopeQuote {
+    quotedMessageId: string;
+    snippet: string;
+    quotedSender: string;
+    quotedAt: string;
+    /** Set when the quoted raw message has since been deleted. */
+    sourceDeletedAt?: string;
+    /**
+     * release201/26 §13.4a P2 — image assets on the quoted (older) message,
+     * re-attached by the cloud (with `cdnUrl`) so the adapter can re-inject them
+     * as image parts in the current turn. Cross-turn vision is blind on stateful
+     * upstreams (Hermes stores prior images as `[screenshot]` placeholders), so
+     * a text snippet / url-in-text is not enough — the agent must receive the
+     * image input again. Reuses the wire `AssetRef` shape.
+     */
+    imageAssetRefs?: AssetRef[];
+}
+/** Resolved identifier (entity name → canonical id). Phase 3 only. */
+interface EnvelopeIdentifier {
+    kind: string;
+    canonicalId: string;
+    displayLabel: string;
+    lastSeenAt: string;
+}
+/** Recent task execution trace. Phase 3 only. */
+interface EnvelopeRecentTaskTrace {
+    taskId: string;
+    toolsUsed: string[];
+    outputs: string[];
+    decisions: string[];
+}
+/** Per-category token floors (cl100k). */
+interface EnvelopeBudgetFloors {
+    recent: number;
+    compressedSegments: number;
+    quotes: number;
+    identifierIndex: number;
+    recentTaskTrace: number;
+}
+interface EnvelopeBudget {
+    /** Total budget in cl100k tokens (Phase 1 default 8000, §6). */
+    totalTokens: number;
+    floors: EnvelopeBudgetFloors;
+}
+/**
+ * Asset partition (decision D). `inputs` participate in the agent's context
+ * (image-as-input / file-as-input); `archives` are described only and do not
+ * consume vision tokens.
+ */
+interface EnvelopeAssets {
+    inputs: AssetRef[];
+    archives: AssetRef[];
+}
+/**
+ * Conversation context envelope — the L3 input contract (cloud → daemon).
+ * See docs/release201/26 §5.
+ */
+interface ConversationContextEnvelope {
+    envelopeVersion: 1;
+    conversationId: string;
+    conversationType: 'direct' | 'group';
+    participants: ParticipantRef[];
+    /** L1 raw tail, oldest first. Visibility-filtered per §5.1. */
+    recent: EnvelopeRecentEntry[];
+    /** L2 Range segments (Phase 1's only kind). */
+    compressedSegments: EnvelopeSegment[];
+    /** Quote snapshots; ref always points at the raw messageId (decision C). */
+    quotes: EnvelopeQuote[];
+    /** Phase 3 only — undefined in Phase 1. */
+    identifierIndex?: EnvelopeIdentifier[];
+    /** Phase 3 only — undefined in Phase 1. */
+    recentTaskTrace?: EnvelopeRecentTaskTrace;
+    assets: EnvelopeAssets;
+    budget: EnvelopeBudget;
+}
+
 type IMAgentStatus = 'online' | 'busy' | 'idle' | 'offline';
 interface HostedAgentDeclaration {
     imUserId: string;
@@ -53,6 +183,21 @@ interface TaskDispatchContextEntry {
     createdAt: string;
     /** Wave-8 W1: assets the human attached to THIS chat message. */
     attachedAssetIds?: string[];
+    /**
+     * 2026-05-31 release201/30 §XML-context P0 — enriched metadata for the
+     * assets attached to this message. Daemon renders each entry as
+     * `<asset id mime filename size_bytes/>` inside a `<attached_assets>`
+     * child of `<prior_message>` / `<current_message>` so the agent sees
+     * prior-turn file attachments (PDF / image / etc.) instead of a blank
+     * text body. Optional + forward-compat with older cloud builds (falls
+     * back to id-only rendering from `attachedAssetIds`).
+     */
+    attachedAssets?: Array<{
+        id: string;
+        mime?: string;
+        filename?: string;
+        sizeBytes?: number;
+    }>;
 }
 /** Wave-8 W1: hydrated asset reference attached to a dispatch. */
 interface AssetRef {
@@ -92,6 +237,18 @@ interface ResolvedAssetRef extends AssetRef {
 }
 interface TaskDispatchRequestPayload {
     taskId: string;
+    /**
+     * release202/09 §3.2 — structural run-vs-task signal.
+     *   - `'run'`  → chat-dispatch run (`taskId` mirrors the run id). Daemon
+     *     injects `PRISMER_RUN_ID` (not `PRISMER_TASK_ID`); the turn closes from
+     *     the agent's reply — no `cloud task` op needed.
+     *   - `'task'` → kanban task. Daemon injects `PRISMER_TASK_ID`.
+     * Optional + forward-compatible: missing → daemon falls back to id-shape
+     * (`run_` prefix) and then legacy probe-both.
+     */
+    kind?: 'run' | 'task';
+    /** The run id when `kind === 'run'`. */
+    runId?: string;
     /** Agent target for runtimeRoute='agent'. Shell dispatches do not use this. */
     agentImUserId?: string;
     /** Runtime/device target for runtimeRoute='shell'. */
@@ -105,6 +262,15 @@ interface TaskDispatchRequestPayload {
     timeoutMs?: number;
     context?: TaskDispatchContextEntry[];
     conversationId?: string;
+    /**
+     * release201/30 §7 — end-to-end trace id, originated by the frontend
+     * (`X-Prismer-Trace-Id`) or generated by the cloud middleware when absent.
+     * Daemon prefixes its stderr lines with `[trace=${traceId}]` so an
+     * operator can grep one id across frontend → cloud → daemon. Optional and
+     * forward-compatible: missing means the wire frame predates the field;
+     * dispatch.ts falls back to `daemon-fallback-<rand>`.
+     */
+    traceId?: string;
     /**
      * Channel mode for the originating conversation. Optional and
      * forward-compatible: when missing, daemon renders 'unknown' in the
@@ -130,6 +296,45 @@ interface TaskDispatchRequestPayload {
     }>;
     /** Wave-8 W1: assets cloud wants daemon to fold into agent context. */
     assetRefs?: AssetRef[];
+    /**
+     * release201/09 Phase 2 — task project scope. NULL = workspace-level
+     * (`_unscoped` sentinel on disk). Daemon uses this together with
+     * `agentImUserId` / `profile.workspaceId` to compose the per-task
+     * scratch path: `workspaces/<wid>/projects/<pid|_unscoped>/tasks/<tid>/`.
+     * Also forwarded into the spawned agent process as `PRISMER_ACTIVE_PROJECT_ID`
+     * (when non-null) so built-in skill --project flag defaults work.
+     */
+    projectId?: string | null;
+    /**
+     * release201/30 — username of the chat sender that triggered this dispatch.
+     * Daemon uses this to label the <current_message author="..."> tag inside
+     * the XML-wrapped conversation context the sessions-style adapters send.
+     *
+     * Optional: when missing, daemon falls back to the trigger row's own
+     * username (typically the human owner), which is still correct for
+     * single-author dispatch flows.
+     */
+    triggerSenderUsername?: string;
+    /**
+     * release201/30 — role of the trigger message sender. Mirrors
+     * `TaskDispatchContextEntry.senderRole` vocabulary.
+     */
+    triggerSenderRole?: 'human' | 'agent' | 'admin' | 'system';
+    /**
+     * release201/25 §7 / release201/26 envelope refactor — typed L3 input
+     * contract built cloud-side by `ConversationMemoryService.buildEnvelope`.
+     *
+     * Envelope-aware adapters call `renderContextEnvelope` (per-adapter
+     * module under `sdk/.../adapters/<name>/context-render.ts`) to turn this
+     * into their native wire shape. Legacy fields above (`context`,
+     * `participants`, `triggerSenderUsername`, `triggerSenderRole`) are still
+     * populated for one release window so older adapters keep working.
+     *
+     * Optional + forward-compatible: missing means the cloud build predates
+     * the wiring (or the flag is off); adapter falls back to the legacy XML
+     * composer / N-message path.
+     */
+    contextEnvelope?: ConversationContextEnvelope;
 }
 interface TaskDispatchProgressPayload {
     taskId: string;
@@ -155,6 +360,21 @@ interface AssetDispatchObservation {
     /** L5: end-to-end fetch duration in ms (DNS + connect + body read). */
     durationMs?: number;
 }
+/**
+ * P1-2 (2026-05-25): per-file artifact rejection record. Surfaced when daemon's
+ * `artifacts-watcher` rejects an artifact because its magic bytes don't match
+ * the file extension (e.g. agent wrote `report.pdf` with markdown content).
+ * Cloud persists these on `IMTask.metadata.outboxRejections` (wire field name
+ * kept for the cross-process contract) and prepends a
+ * warning section to the next dispatch prompt so the agent can self-correct.
+ */
+interface OutboxRejectionRecord {
+    filename: string;
+    reason: string;
+    inferredMime: string;
+    detectedMime: string;
+    rejectedAt: string;
+}
 interface TaskDispatchReplyPayload {
     taskId: string;
     ok: boolean;
@@ -170,6 +390,13 @@ interface TaskDispatchReplyPayload {
     };
     /** Wave-8 W1: per-asset handling report. */
     assetObservability?: AssetDispatchObservation[];
+    /**
+     * P1-2 (2026-05-25): files quarantined locally by artifacts-watcher's
+     * magic-bytes check during this turn. Cloud writes them onto
+     * `IMTask.metadata.outboxRejections` so the next dispatch prompt can warn
+     * the agent.
+     */
+    outboxRejections?: OutboxRejectionRecord[];
 }
 interface TaskCancelPayload {
     taskId: string;
@@ -338,7 +565,7 @@ declare class MemoryStore {
     private rowToPage;
 }
 
-type MemoryScope = 'workspace-shared' | 'agent-private';
+type MemoryScope = 'workspace-shared' | 'agent-private' | 'session-scratch' | 'role-shared' | 'project-shared' | 'global';
 interface ScopedMemoryStoreOptions {
     /** Filesystem root, e.g. `~/.prismer/memory` (will create per-workspace dir under). */
     rootDir: string;
@@ -353,12 +580,37 @@ interface ScopedWriteInput extends Omit<MemoryWriteInput, 'workspaceId'> {
     scope: MemoryScope;
     /** Required when scope='agent-private'; rejected when scope='workspace-shared'. */
     agentImUserId?: string;
+    /**
+     * Required when scope='session-scratch' (release201/26 §14.9 #A5) — opaque
+     * throwaway key, e.g. `eval-<runId>`. Rejected for the other scopes.
+     */
+    sessionKey?: string;
+    /**
+     * Required when scope='role-shared' (release201/26 §14.6 #A5b) — role
+     * template slug; the bucket is shared across all agents of that role.
+     * Rejected for the other scopes.
+     */
+    roleSlug?: string;
+    /**
+     * Required when scope='project-shared' (release201/26 §14.6 #A5b) — project
+     * identifier; the bucket is scoped to a project. Rejected for other scopes.
+     */
+    projectId?: string;
 }
 interface ScopedSearchInput {
     query: string;
     scope: MemoryScope;
     /** Required when scope='agent-private' — search only this agent's bucket. */
     agentImUserId?: string;
+    /**
+     * Required when scope='session-scratch' — search only this throwaway bucket;
+     * never falls through to shared/agent buckets (full isolation, §14.9 #A5).
+     */
+    sessionKey?: string;
+    /** Required when scope='role-shared' (release201/26 §14.6 #A5b). */
+    roleSlug?: string;
+    /** Required when scope='project-shared' (release201/26 §14.6 #A5b). */
+    projectId?: string;
     options?: MemorySearchOptions;
 }
 /**
@@ -369,19 +621,67 @@ declare class ScopedMemoryStore {
     private readonly opts;
     private sharedStore;
     private agentStores;
+    private scratchStores;
+    private roleStores;
+    private projectStores;
+    private globalStore;
     private readonly workspaceDir;
     constructor(opts: ScopedMemoryStoreOptions);
     /** Resolve the shared store (lazy open). */
     shared(): MemoryStore;
     /** Resolve the per-agent store (lazy open). */
     forAgent(agentImUserId: string): MemoryStore;
-    /** Resolve the right store for (scope, agentImUserId). */
-    resolve(scope: MemoryScope, agentImUserId?: string): MemoryStore;
+    /**
+     * Resolve the per-session scratch store (lazy open). release201/26 §14.9 #A5.
+     *
+     * The bucket lives under `<workspaceDir>/scratch/<sanitizedSessionKey>.db`.
+     * It is fully isolated: nothing in here is ever merged into shared/agent
+     * searches, and it is meant to be torn down via `dropScratch` after the run.
+     */
+    forScratch(sessionKey: string): MemoryStore;
+    /**
+     * Resolve the per-role shared store (lazy open). release201/26 §14.6 #A5b.
+     * Bucket: `<workspaceDir>/roles/<sanitizedRoleSlug>.db` — shared across all
+     * agents instantiated from the same role template.
+     */
+    forRole(roleSlug: string): MemoryStore;
+    /**
+     * Resolve the per-project shared store (lazy open). release201/26 §14.6 #A5b.
+     * Bucket: `<workspaceDir>/projects/<sanitizedProjectId>.db`.
+     */
+    forProject(projectId: string): MemoryStore;
+    /**
+     * Resolve the CROSS-workspace global store (lazy open). release201/26 §14.6
+     * #A5b. The bucket lives at `<rootDir>/global.db` (one level ABOVE the
+     * per-workspace dir) so every ScopedMemoryStore sharing the same rootDir reads
+     * and writes the same global.db, regardless of workspaceId. The store is
+     * opened with the constant GLOBAL_WORKSPACE_ID so MemoryStore's single-
+     * workspace filter does not re-partition global rows per workspace.
+     */
+    global(): MemoryStore;
+    /** Resolve the right store for (scope, agentImUserId, sessionKey, roleSlug, projectId). */
+    resolve(scope: MemoryScope, agentImUserId?: string, sessionKey?: string, roleSlug?: string, projectId?: string): MemoryStore;
+    /**
+     * Sanitize an opaque key (sessionKey / roleSlug / projectId) for filesystem
+     * safety. Rejects empty/blank keys; maps any char outside [A-Za-z0-9_-] to
+     * '_' so a key like `eval-../../etc` cannot escape its bucket dir.
+     * release201/26 §14.9 #A5 + §14.6 #A5b.
+     */
+    private static sanitizeKey;
+    /**
+     * Sanitize an opaque sessionKey for filesystem safety. Rejects empty/blank
+     * keys; maps any char outside [A-Za-z0-9_-] to '_' so a key like
+     * `eval-../../etc` cannot escape the scratch dir. release201/26 §14.9 #A5.
+     */
+    private static sanitizeSessionKey;
     /** Write a memory page into the correct bucket. */
     write(input: ScopedWriteInput): {
         pageId: string;
         scope: MemoryScope;
         agentImUserId?: string;
+        sessionKey?: string;
+        roleSlug?: string;
+        projectId?: string;
     };
     /**
      * Search only the requested bucket. This is the daemon-first FTS5 path
@@ -396,6 +696,18 @@ declare class ScopedMemoryStore {
     searchForAgent(query: string, agentImUserId: string, options?: MemorySearchOptions): MemorySearchResult[];
     /** List which agent ids currently have a private DB on disk (for diagnostics). */
     listAgentBuckets(): string[];
+    /**
+     * List which scratch sessionKeys currently have a DB on disk. For
+     * housekeeping — e.g. dropping orphaned scratch buckets from crashed eval
+     * runs. release201/26 §14.9 #A5.
+     */
+    listScratchKeys(): string[];
+    /**
+     * Close + delete a scratch bucket's db file(s) (incl. -wal / -shm sidecars).
+     * Called after an eval/throwaway run to clean up. Idempotent: a missing
+     * bucket is a no-op. release201/26 §14.9 #A5.
+     */
+    dropScratch(sessionKey: string): void;
     /** Total disk footprint (best-effort; sums each bucket's main DB file). */
     diskBytes(): {
         shared: number;
@@ -485,7 +797,23 @@ interface StepRecorderHandle {
 }
 interface TaskInput {
     taskId: string;
+    /**
+     * release202/09 §3.2 — whether this dispatch is a chat-dispatch RUN or a
+     * kanban TASK. Threaded from `TaskDispatchRequestPayload.kind`. When 'run',
+     * `runId` carries the run id and `taskId` mirrors it (back-compat); adapters
+     * surface `<run_id>` (not `<task_id>`) in execution_context. Optional —
+     * adapters that don't read it fall back to the id shape (`run_` prefix).
+     */
+    kind?: 'run' | 'task';
+    /** The run id when `kind === 'run'` (release202/09 §3.2). */
+    runId?: string;
     prompt: string;
+    /**
+     * Adapter-private input metadata. release202/05 C2 — `metadata.conversationId`
+     * + `metadata.agentImUserId` are already populated on dispatch and are the
+     * keys ProviderSessionMapper.get()/put() use to scope a provider session to
+     * one (conversation × agent × adapter) triple.
+     */
     metadata?: Record<string, unknown>;
     timeoutMs?: number;
     onProgress?: (p: {
@@ -547,6 +875,110 @@ interface TaskInput {
      * → passes here). Adapters never instantiate the store themselves.
      */
     memoryStore?: ScopedMemoryStore;
+    /**
+     * Raw structured conversation history. Adapters that natively understand
+     * role-tagged messages (Hermes /v1/runs, OpenAI Responses) should consume
+     * this instead of parsing `prompt`. Adapters that don't (claude-code,
+     * codex CLI) can ignore it — dispatch.ts still concats into `prompt` as
+     * a fallback. 2026-05-29 — added to fix Hermes context-dropout where
+     * dispatch concatenated history into a single user-input string and
+     * Hermes treated it as one new turn (api_server.py:3537-3590).
+     */
+    contextEntries?: Array<{
+        role: 'user' | 'assistant' | 'system';
+        content: string;
+        sender?: string;
+        senderRole?: string;
+        /**
+         * release201/30 — original IM message createdAt (ISO 8601). Consumed by
+         * sessions-dispatcher to stamp the `at="..."` attribute on each
+         * <prior_message> tag inside the conversation context XML so the model
+         * can reason about chronology. Optional for back-compat; missing
+         * timestamps degrade to "now" at compose time.
+         */
+        createdAt?: string;
+        /**
+         * release201/30 §XML-context P0 (2026-05-31) — asset attachments
+         * carried alongside this prior chat message. Forwarded verbatim from
+         * cloud's `TaskDispatchContextEntry.attachedAssetIds /
+         * attachedAssets` so sessions-dispatcher can stamp
+         * `<attached_assets>` children inside `<prior_message>` and the agent
+         * sees prior PDF/image references even though the chat surface only
+         * carried the user's text body. Optional; absence is treated as "no
+         * attachments on this turn".
+         */
+        attachedAssetIds?: string[];
+        attachedAssets?: Array<{
+            id: string;
+            mime?: string;
+            filename?: string;
+            sizeBytes?: number;
+        }>;
+    }>;
+    /**
+     * Unconcatenated original user prompt for adapters that take history
+     * separately via `contextEntries`. When set, Hermes /v1/runs sends this
+     * as `input` and the history as `conversation_history`. When unset,
+     * adapters fall back to `prompt` (already concatenated by dispatch.ts).
+     */
+    currentPrompt?: string;
+    /**
+     * 2026-05-29 — asset reminder/inline blocks produced by
+     * `dispatch.ts:resolveAssetRefs` for non-image / text-like assets
+     * aggregated from the chat context window (W1).
+     *
+     * These blocks are also baked into `prompt` (so legacy text-only
+     * adapters keep working), but adapters that send only `currentPrompt`
+     * to a stateful upstream (Hermes sessions API, OpenAI Responses with
+     * server-side history) would otherwise drop them and the agent would
+     * be told "no file was attached" even though the cloud W1 collector
+     * picked the asset up. Sessions-dispatcher must prepend these to the
+     * current-turn message text.
+     *
+     * Empty / undefined → no assets resolved into prompt blocks; the
+     * adapter sends the bare currentPrompt.
+     */
+    assetPromptBlocks?: string[];
+    /**
+     * release201/30 — fields required by sessions-style adapters (Hermes
+     * /api/sessions/{id}/chat/stream) to build a <conversation_context> XML
+     * block that disambiguates first-person voice across participants in
+     * group chats. Legacy /v1/runs path and non-Hermes adapters ignore these.
+     *
+     * See `daemon/conversation-context.ts` for the composer that consumes
+     * these fields.
+     */
+    conversationType?: 'direct' | 'group' | 'unknown';
+    conversationId?: string;
+    /** profile.agentUsername — agent's human handle (ceo / engineer / etc). */
+    profileAgentUsername?: string;
+    /** profile.agentImUserId — agent's IM user id. */
+    profileAgentImUserId?: string;
+    /** Authoritative recipient list of the originating conversation. */
+    participants?: Array<{
+        imUserId: string;
+        username: string;
+        displayName: string;
+        role: string;
+        agentType?: string | null;
+    }>;
+    /** Username of the human/agent who sent the dispatch trigger message. */
+    currentMessageSender?: string;
+    /** Role of the dispatch trigger sender (human / agent / admin / system). */
+    currentMessageSenderRole?: 'human' | 'agent' | 'admin' | 'system';
+    /**
+     * release201/25 §7 / release201/26 — typed L3 input contract (cloud built
+     * via `ConversationMemoryService.buildEnvelope`). Envelope-aware adapter
+     * paths import their adapter's `context-render.ts` module
+     * (`adapters/<name>/context-render.ts`) and call `renderContextEnvelope`
+     * to translate this into their native history shape (Hermes XML body,
+     * OpenClaw `/v1/responses` input array, CLI markdown, ...).
+     *
+     * Optional + forward-compat: when undefined, adapters fall back to the
+     * legacy fields above (`contextEntries` + `participants` +
+     * `currentMessageSender*`) and compose the body themselves.
+     */
+    contextEnvelope?: ConversationContextEnvelope;
 }
 interface TaskResult {
     ok: boolean;
@@ -565,7 +997,16 @@ interface TaskResult {
         tokensUsed?: number;
         durationMs?: number;
     };
-    /** Adapter-private metadata used by daemon-side bridges/observability. */
+    /**
+     * Adapter-private metadata used by daemon-side bridges/observability.
+     *
+     * release202/05 C2 — interactive adapters (codex / claude-code) MAY set
+     * `metadata.providerSessionId?: string` here: the provider/CLI session
+     * (thread) id to persist via ProviderSessionMapper so the next turn on the
+     * same (conversation, agent, adapter) can `resume` it. No type change needed
+     * (metadata is `Record<string, unknown>`); the daemon dispatch bridge reads
+     * the key and persists when present.
+     */
     metadata?: Record<string, unknown>;
 }
 /**
@@ -660,7 +1101,29 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     model: z.ZodDefault<z.ZodString>;
     /** Named custom provider written into Hermes config.yaml. */
     prismerProviderName: z.ZodDefault<z.ZodString>;
-    /** Override cloud provider base. Defaults to PRISMER_BASE_URL + /api/v1. */
+    /**
+     * 2026-05-30 — per-agent LLM proxy selector.
+     *
+     * Picks which Prismer Cloud upstream pool this hermes profile points its
+     * `chat/completions` calls at. Default `newapi` is the platform aggregator
+     * (gemini / kimi / etc.). `deepseek` swaps the cloud-side `base_url` to the
+     * `/api/v1/proxy/deepseek/chat/completions` alias so the cloud forwards the
+     * request directly to DeepSeek regardless of the global
+     * `DEEPSEEK_BYPASS_ENABLED` env. Lets two agents share a workspace + daemon
+     * but route to different LLM backends for an apples-to-apples comparison.
+     *
+     * Resolution priority for `custom_providers[0].base_url`:
+     *   1. `prismerProviderBaseUrl` (explicit operator override) — wins always.
+     *   2. `proxyProvider === 'deepseek'` → PRISMER_BASE_URL + `/api/v1/proxy/deepseek`
+     *   3. `proxyProvider === 'newapi'` (default) → PRISMER_BASE_URL + `/api/v1`
+     */
+    proxyProvider: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * Override cloud provider base. Defaults to PRISMER_BASE_URL + /api/v1
+     * (or `/api/v1/proxy/<proxyProvider>` when `proxyProvider !== 'newapi'`).
+     * An explicit value here WINS over `proxyProvider` — operators who pin
+     * the base_url get exactly what they pinned.
+     */
     prismerProviderBaseUrl: z.ZodOptional<z.ZodString>;
     /** Env key Hermes reads from profile .env for the Prismer API key. */
     prismerApiKeyEnv: z.ZodDefault<z.ZodString>;
@@ -677,12 +1140,6 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
      * native state key directly and records the exact bridge result on the task.
      */
     mirrorNativeGoals: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Optional checkout path for Hermes Agent source. Used only as a fallback
-     * when the installed `hermes` binary is older than the native Kanban CLI
-     * surface but the local source tree contains hermes_cli/kanban_db.py.
-     */
-    hermesSourceDir: z.ZodOptional<z.ZodString>;
     nativeMirrorTimeoutMs: z.ZodDefault<z.ZodNumber>;
     /** Task authority level: executor (default) or orchestrator. */
     taskAuthority: z.ZodDefault<z.ZodOptional<z.ZodEnum<["executor", "orchestrator"]>>>;
@@ -703,6 +1160,74 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>, "many">]>>;
     /** Override the skills root read for dispatch-time SKILL.md injection. */
     skillsDir: z.ZodOptional<z.ZodString>;
+    /**
+     * release201/24 §Phase2 — extra skill dirs registered into the gateway's
+     * config.yaml `skills.external_dirs` so the skill-under-test enters Hermes'
+     * NATIVE skill discovery (skills_list / skill tools). The daemon's
+     * system-prompt injection alone is not seen by the agent's skill tools, and
+     * HERMES_HOME does NOT scope skill loading (the ~90 bundled skills ship with
+     * the hermes package). The eval session spawner sets this to its isolated
+     * temp-home skills dir.
+     */
+    skillsExternalDirs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * release201/24 §Phase2 — install the prismer daemon memory hooks
+     * (pre_llm_call recall / post_llm_call extract / on_session_end). Default
+     * true. The eval session spawner sets this FALSE so a throwaway eval run
+     * neither READS contaminated workspace memory (a prior failed run's
+     * "skill X is stale" note biases the agent) nor WRITES memories that poison
+     * later runs — the eval judges the skill on its own merits.
+     */
+    installMemoryHooks: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /**
+     * release201/26 §14 Phase A (#A1) — enable hermes' BUILTIN knowledge memory
+     * (`MEMORY.md` / `USER.md` injected into the system prompt). Default false.
+     *
+     * release201/09 §9.4b (2026-05-30 hotfix, Option B2) — important correction
+     * to the previous comment claim "hermes' code default = False, we don't
+     * write a memory: block so it stays off". That was WRONG: hermes
+     * deep-merges user config OVER `DEFAULT_CONFIG` (hermes_cli/config.py:4701
+     * `_deep_merge`), and `DEFAULT_CONFIG.memory.memory_enabled = True`
+     * (config.py:1373). `agent_init.py:1076` reads from the MERGED config, so
+     * not writing a `memory:` block leaves hermes builtin memory ON. Real
+     * contamination symptom (2026-05-30 user report): after workspace clear +
+     * new workspace spawn, CEO recited 5 prior-workspace agent IDs + 7 named
+     * humans verbatim from `~/.hermes/profiles/ceo/memories/MEMORY.md`. Fix
+     * here = ALWAYS write the `memory:` block with explicit values; default
+     * (false) writes `memory_enabled: false` + `user_profile_enabled: false`
+     * so hermes' builtin MEMORY.md/USER.md injection is genuinely off. When
+     * true (release201/26 §14 Phase A cutover), writes `memory_enabled: true`
+     * + `user_profile_enabled: true`. Operator-set sibling keys in an existing
+     * memory: block (e.g. `memory_char_limit`, `provider`) are preserved.
+     */
+    enableBuiltinMemory: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /**
+     * release201/26 §13.4a (P2 spike, 2026-05-30) — pin hermes vision config so
+     * an agent on a `custom:` provider can actually RECEIVE images.
+     *
+     * Production坑: hermes v0.15.0 does NOT route images through the main chat's
+     * inline image part; it spins up a separate `vision_analyze_tool` aux LLM.
+     * That aux path's provider auto-detect does NOT recognize `custom:` providers
+     * → 502. Every daemon agent runs a custom provider (`custom:prismer` →
+     * Prismer Cloud `/api/v1`), so DEFAULT behaviour is: agent receives an image
+     * → guaranteed 502. The spike-verified fix is pure config (no hermes patch):
+     *   model.supports_vision: true  +  agent.image_input_mode: native
+     * which takes the native fast-path and feeds the image straight to the main
+     * model. The default model `us-kimi-k2.6` is vision-capable and correctly
+     * described images under this config in the spike.
+     *
+     * Default取舍 (2026-05-30, evidence-based): when the caller does NOT set this
+     * explicitly, the effective value is `VISION_CAPABLE_MODELS.has(config.model)`
+     * — a per-model allowlist measured by real cloud-proxy vision probes (see the
+     * `VISION_CAPABLE_MODELS` docblock). This REPLACES the prior
+     * `proxyProvider === 'deepseek' ? false : true` heuristic. Verified vision
+     * models (gemini-3.1-pro-preview, gemini-3.1-flash-lite-preview, us-kimi-k2.6
+     * — the daemon default) default ON; verified text-only models
+     * (deepseek-v4-flash / deepseek-v4-pro, which 400 on image parts) default OFF.
+     * An explicit value here always wins; set `true` to force vision on an
+     * unmeasured model, `false` for any text-only / reasoning model.
+     */
+    supportsVision: z.ZodOptional<z.ZodBoolean>;
     /**
      * Role-template snapshot carried in AgentProfile.config by cloud ACP.
      * Expected fields used here:
@@ -773,22 +1298,26 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     installPrismerMcpServer: boolean;
     model: string;
     prismerProviderName: string;
+    proxyProvider: string;
     prismerApiKeyEnv: string;
     mirrorNativeKanban: boolean;
     mirrorNativeGoals: boolean;
     nativeMirrorTimeoutMs: number;
     taskAuthority: "executor" | "orchestrator";
     approvalPolicy: "strict" | "auto-low-risk" | "autonomous";
+    installMemoryHooks: boolean;
+    enableBuiltinMemory: boolean;
     hermesProfileName?: string | undefined;
     prismerMcpServerPath?: string | undefined;
     prismerProviderBaseUrl?: string | undefined;
-    hermesSourceDir?: string | undefined;
     mcpAllowlist?: string[] | null | undefined;
     operatingPrinciples?: string | Record<string, string> | z.objectOutputType<{
         source: z.ZodString;
         text: z.ZodString;
     }, z.ZodTypeAny, "passthrough">[] | undefined;
     skillsDir?: string | undefined;
+    skillsExternalDirs?: string[] | undefined;
+    supportsVision?: boolean | undefined;
     roleTemplate?: z.objectOutputType<{
         mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
             toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -819,11 +1348,11 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
     prismerMcpServerPath?: string | undefined;
     model?: string | undefined;
     prismerProviderName?: string | undefined;
+    proxyProvider?: string | undefined;
     prismerProviderBaseUrl?: string | undefined;
     prismerApiKeyEnv?: string | undefined;
     mirrorNativeKanban?: boolean | undefined;
     mirrorNativeGoals?: boolean | undefined;
-    hermesSourceDir?: string | undefined;
     nativeMirrorTimeoutMs?: number | undefined;
     taskAuthority?: "executor" | "orchestrator" | undefined;
     approvalPolicy?: "strict" | "auto-low-risk" | "autonomous" | undefined;
@@ -833,6 +1362,10 @@ declare const HermesProfileConfigSchema: z.ZodObject<{
         text: z.ZodString;
     }, z.ZodTypeAny, "passthrough">[] | undefined;
     skillsDir?: string | undefined;
+    skillsExternalDirs?: string[] | undefined;
+    installMemoryHooks?: boolean | undefined;
+    enableBuiltinMemory?: boolean | undefined;
+    supportsVision?: boolean | undefined;
     roleTemplate?: z.objectInputType<{
         mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
             toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -898,11 +1431,27 @@ declare const OpenClawProfileConfigSchema: z.ZodObject<{
         }, z.ZodTypeAny, "passthrough">>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     skillsDir: z.ZodOptional<z.ZodString>;
+    /**
+     * release202/03 §3.2 — when set, ensure the OpenClaw gateway's openclaw.json
+     * carries a `prismer` model provider pointing at our cloud gateway, and that
+     * `agents.defaults.model.primary` is the curated model below. Lets each
+     * OpenClaw agent run a different curated chat model through one sk-prismer key
+     * (tiered model). Undefined = leave openclaw.json untouched (legacy).
+     */
+    proxyProvider: z.ZodOptional<z.ZodEnum<["newapi", "deepseek"]>>;
+    /** Curated LLM model id the gateway should use (e.g. 'us-kimi-k2.6'). */
+    prismerModel: z.ZodOptional<z.ZodString>;
+    /** Env var (in the gateway process) holding the sk-prismer-* key. */
+    prismerApiKeyEnv: z.ZodDefault<z.ZodString>;
+    /** openclaw.json path (default ~/.openclaw/openclaw.json or $OPENCLAW_HOME). */
+    openclawConfigPath: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     port: number;
     apiKey: string;
     model: string;
+    prismerApiKeyEnv: string;
     approvalPolicy: "strict" | "auto-low-risk" | "autonomous";
+    proxyProvider?: "newapi" | "deepseek" | undefined;
     mcpAllowlist?: string[] | null | undefined;
     skillsDir?: string | undefined;
     roleTemplate?: z.objectOutputType<{
@@ -914,10 +1463,14 @@ declare const OpenClawProfileConfigSchema: z.ZodObject<{
             toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, z.ZodTypeAny, "passthrough">>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
+    prismerModel?: string | undefined;
+    openclawConfigPath?: string | undefined;
 }, {
     apiKey: string;
     port?: number | undefined;
     model?: string | undefined;
+    proxyProvider?: "newapi" | "deepseek" | undefined;
+    prismerApiKeyEnv?: string | undefined;
     approvalPolicy?: "strict" | "auto-low-risk" | "autonomous" | undefined;
     mcpAllowlist?: string[] | null | undefined;
     skillsDir?: string | undefined;
@@ -930,6 +1483,8 @@ declare const OpenClawProfileConfigSchema: z.ZodObject<{
             toolsAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, z.ZodTypeAny, "passthrough">>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
+    prismerModel?: string | undefined;
+    openclawConfigPath?: string | undefined;
 }>;
 type OpenClawProfileConfig = z.infer<typeof OpenClawProfileConfigSchema>;
 declare const openclawAdapter: AdapterDef;
@@ -994,7 +1549,7 @@ type LocalDb = Database.Database;
 declare function openLocalDb(path: string): LocalDb;
 declare function runMigrations(db: LocalDb): void;
 declare function currentSchemaVersion(db: LocalDb): number;
-declare const TARGET_SCHEMA_VERSION = 4;
+declare const TARGET_SCHEMA_VERSION = 8;
 
 type SyncResourceType = 'workspace' | 'agent' | 'agent_profile';
 type SyncOperation = 'create' | 'update' | 'delete';
@@ -1191,11 +1746,28 @@ interface ConfigPaths {
     cacheDir: string;
     logsDir: string;
     /**
-     * Per-task run scratch dirs. Each chat-mention dispatch creates
-     * `${runsDir}/${taskId}/_outbox/` for adapter-produced files; the
-     * OutboxWatcher uploads from there into IMAssets.
+     * Legacy per-task run scratch dirs (pre-release201/09).
+     *
+     * Pre-09: `${runsDir}/${taskId}/_outbox|scratch/`.
+     * 09 Phase 2 / release202/04: dispatch.ts now writes to
+     *   `${root}/workspaces/<wid>/projects/<pid|_unscoped>/tasks/<tid>/{artifacts,scratch}`
+     * via `resolveTaskWorkdir()`. `runsDir` is kept as a fallback for tests + a
+     * once-off startup migration helper (`runs/<tid>/` → new path; symlink 兜底
+     * 90 天兼容期, §9.3.1).
      */
     runsDir: string;
+    /**
+     * release201/09 Phase 2 root for workspace × project × task scoped scratch:
+     * `${root}/workspaces/`. resolveTaskWorkdir() composes the per-task path
+     * underneath. Cache GC + project archive scan this root.
+     */
+    workspacesDir: string;
+    /**
+     * release201/09 Phase 2 root for device × agent role layer:
+     * `${root}/devices/`. v2.0.7 Phase 2 不主动创建,Phase 3 (agent transfer)
+     * 才落盘 `profile.json` / `skills/<slug>/` 等内容,本 helper 只解析路径。
+     */
+    devicesDir: string;
 }
 /**
  * Resolve paths for the prismer home directory. Honors `PRISMER_HOME` env var;
@@ -1628,13 +2200,14 @@ interface UrlResolution {
  */
 declare function extractHttpUrls(text: string): string[];
 
-interface OutboxWatcherOptions {
+interface ArtifactsWatcherOptions {
     /**
      * Default directory to watch when no setActiveTask has narrowed it.
-     * Container mode: `/workspace/_outbox`. Host mode: omit (no default
-     * scan — only watch when an active task points at a specific dir).
+     * Container mode: `/workspace/_outbox` (legacy path name kept for the
+     * container controller contract). Host mode: omit (no default scan — only
+     * watch when an active task points at a specific dir).
      */
-    outboxDir?: string;
+    artifactsDir?: string;
     /** Cloud client (already configured with apiKey + baseUrl). */
     cloud: CloudClient;
     /**
@@ -1658,19 +2231,39 @@ interface OutboxWatcherOptions {
         info: (msg: string) => void;
         warn: (msg: string) => void;
     };
+    /**
+     * release202/09 P2 — directory auto-scan gate. **Default FALSE.**
+     *
+     * When false, the polling scan loop does NOT run: the watcher never reads
+     * `artifactsDir` and never auto-uploads files. File delivery is instead
+     * driven EXPLICITLY by the agent via `cloud deliver` → daemon local-server
+     * `POST /local/deliver` → `recordDeliveredAsset(taskId, assetId)`. The
+     * `pendingByTask` / `flushPending` / `recordDeliveredAsset` plumbing and the
+     * `upload()` path all still work — only the implicit directory-magic is off.
+     *
+     * The original directory-scan code (currentScanDirs / tick / scanDir /
+     * quarantine) is retained intact behind this flag so it can be re-enabled
+     * (autoScan:true) as a fallback if the explicit path needs to fall back to
+     * the legacy auto-archive behaviour.
+     */
+    autoScan?: boolean;
 }
 interface ActiveTask {
     taskId: string;
     /** Adapter name; surfaces in upload metadata for observability. */
     adapter?: string;
     /**
-     * Per-task outbox directory. When set, scans this directory in
-     * addition to `opts.outboxDir`. Files uploaded from here are tagged
+     * Per-task artifacts directory. When set, scans this directory in
+     * addition to `opts.artifactsDir`. Files uploaded from here are tagged
      * with `kind=agent-output` (host-mode contract).
+     *
+     * Backward-compat (release202/04 P0): the watcher also scans the sibling
+     * legacy `result/` and `_outbox/` dirs (resolved from this dir's parent)
+     * for in-flight tasks created before the artifacts rename.
      */
-    outboxDir?: string;
+    artifactsDir?: string;
 }
-declare class OutboxWatcher {
+declare class ArtifactsWatcher {
     private opts;
     private timer?;
     private uploaded;
@@ -1690,7 +2283,7 @@ declare class OutboxWatcher {
     /**
      * Legacy container/sandbox task. Used only when an `ActiveTask` is set
      * **without** an `outboxDir` (i.e. the legacy `setActiveTask` shape
-     * where the watcher's default `opts.outboxDir` is the scan target).
+     * where the watcher's default `opts.artifactsDir` is the scan target).
      * Single slot because the legacy container deployment only ever runs
      * one task at a time per container.
      */
@@ -1703,13 +2296,13 @@ declare class OutboxWatcher {
      * can stamp it onto task.dispatch.reply.assetIds.
      */
     private pendingByTask;
-    constructor(opts: OutboxWatcherOptions);
+    constructor(opts: ArtifactsWatcherOptions);
     /**
      * Register a host-mode task envelope. Each call adds (or replaces) an
      * entry keyed by `task.taskId` so concurrent dispatches do not clobber
      * each other.
      *
-     * Requires `task.outboxDir` to be set — the per-task workdir is the
+     * Requires `task.artifactsDir` to be set — the per-task workdir is the
      * isolation boundary. For the legacy container/sandbox single-slot
      * shape (no per-task dir), use `setActiveTask` instead.
      */
@@ -1727,7 +2320,7 @@ declare class OutboxWatcher {
      *     mode). The caller is still responsible for `removeActiveTask`
      *     (or another `setActiveTask(null)`) at teardown.
      *   - Non-null **without** `outboxDir` → store in the legacy container
-     *     slot. Uploads from `opts.outboxDir` are tagged with this task.
+     *     slot. Uploads from `opts.artifactsDir` are tagged with this task.
      *   - `null` → clear the legacy container slot only. Does NOT touch
      *     the host-mode `activeTasks` map; concurrent host-mode dispatches
      *     keep their own slots until they call `removeActiveTask`
@@ -1745,6 +2338,46 @@ declare class OutboxWatcher {
      * second time. dispatch.ts calls this once at reply-build time.
      */
     flushPending(taskId: string): string[];
+    /**
+     * release202/09 P2 — explicit-delivery hook (动作 A).
+     *
+     * Append an already-uploaded assetId to `pendingByTask[taskId]` so the
+     * dispatch-end `flushPending(taskId)` surfaces it on
+     * `task.dispatch.reply.assetIds` — exactly the same channel the (now
+     * gated-off) auto-scan used at lines ~578-580. This is the bridge that
+     * lets the daemon local-server's `POST /local/deliver` handler reuse the
+     * existing reply-attachment plumbing instead of inventing a parallel one.
+     *
+     * Idempotency: callers should pass each assetId once. We de-dup defensively
+     * so a double-delivered file does not appear twice in reply.assetIds.
+     */
+    recordDeliveredAsset(taskId: string, assetId: string): void;
+    /**
+     * release202/09 P2 — explicit upload entrypoint shared by the daemon
+     * local-server `POST /local/deliver` handler. Reads the file off the
+     * container FS, runs the SAME agent-output-policy + magic-bytes guards the
+     * auto-scan `upload()` path uses, and POSTs via `DaemonAssetUploadClient`
+     * with the daemon's credential. Returns the freshly-minted assetId.
+     *
+     * Unlike the private `upload()` (which is keyed on an ActiveTask + Stats
+     * from the scan loop), this is a one-shot for a caller-supplied absolute
+     * path; it does NOT touch `pendingByTask` — the caller decides whether the
+     * file rides the reply (`recordDeliveredAsset`, 动作 A) or goes out as a
+     * standalone message (动作 B).
+     *
+     * Throws a clear Error on policy / magic-bytes rejection so the agent can
+     * read why its file was refused.
+     */
+    deliverFile(input: {
+        taskId: string;
+        filePath: string;
+        adapter?: string;
+    }): Promise<{
+        assetId: string;
+        mime: string;
+        filename: string;
+        sizeBytes: number;
+    }>;
     start(): void;
     stop(): void;
     /**
@@ -1762,8 +2395,13 @@ declare class OutboxWatcher {
      * and accumulated per-task without sharing global mutable state.
      *
      * Dedup so a directory configured in both spots only scans once
-     * (legacy single-task case where opts.outboxDir == legacyTask.outboxDir
+     * (legacy single-task case where opts.artifactsDir == legacyTask.artifactsDir
      * is unlikely but cheap to handle).
+     *
+     * Backward-compat (release202/04 P0): for each host-mode task pointing at
+     * the new `artifacts/` dir, also enqueue its sibling legacy `result/` and
+     * `_outbox/` dirs (same parent). readdir on a missing legacy dir is a cheap
+     * ENOENT no-op in scanDir, so this is safe even when no legacy files exist.
      */
     private currentScanDirs;
     private tick;
@@ -1875,14 +2513,20 @@ interface DispatchDeps {
     /** Hook for tests / observability. */
     onProgress?: (taskId: string, p: TaskDispatchProgressPayload) => void;
     /**
-     * Outbox uploader. When provided, dispatch creates a per-task outbox
-     * directory under `paths.runsDir`, points the watcher at it via
-     * setActiveTask, and drains its assetIds into reply.assetIds at flush
-     * time. Optional so tests can omit it.
+     * Artifacts uploader. When provided, dispatch creates a per-task artifacts
+     * directory, points the watcher at it via setActiveTask, and drains its
+     * assetIds into reply.assetIds at flush time. Optional so tests can omit it.
      */
-    outboxWatcher?: OutboxWatcher;
-    /** Daemon paths — used to derive the per-task outbox dir. */
+    artifactsWatcher?: ArtifactsWatcher;
+    /** Daemon paths — used to derive the per-task artifacts dir. */
     paths?: ConfigPaths;
+    /**
+     * release201/09 §9.9 — Stable device identifier from `config.toml`. Surfaced
+     * to the spawned agent process as `PRISMER_DAEMON_ID` env for metric-outbox
+     * emission + transfer manifest authoring. Optional so existing tests can
+     * omit it; production runner always provides.
+     */
+    daemonId?: string;
     /**
      * Multi-workspace asset metadata indexes for #filename resolution.
      * Keyed by workspaceId. If absent, #ref resolution is skipped entirely.
@@ -2012,6 +2656,17 @@ declare class ServicePool {
      * on first use or after a crash. Re-checks `healthy()` before returning a cached entry.
      */
     ensureService(profile: AgentProfile, adapter: AdapterDef): Promise<AdapterService>;
+    /**
+     * Best-effort read of a cached service by profileId. Does NOT trigger
+     * ensureService / health probe (use ensureService for that). Returns
+     * `undefined` when the pool has never seen the profile or it crashed.
+     *
+     * Added for release201/25 §16.4 A6 — runner needs to reach a live
+     * HermesService instance to call native `resolveApproval` without
+     * paying ensureService's spawn cost (the service is already alive for
+     * the in-flight task).
+     */
+    peek(profileId: string): AdapterService | undefined;
     /** Drop a service handle (e.g. on profile delete or daemon shutdown). */
     drop(profileId: string): Promise<void>;
     /** Drop all handles, e.g. on graceful shutdown. */
@@ -2085,11 +2740,72 @@ interface LocalServerOptions {
      * When set, /healthz reports `assetReady: true`.
      */
     attachAsset?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * release202/09 P2 — explicit file-delivery handler for
+     * `POST /local/deliver`. The in-container agent's `cloud deliver` /
+     * `cloud file send` proxy to this endpoint so the daemon (which holds the
+     * usable IM credential the agent lacks) performs the upload + delivery.
+     *
+     * Body: `{ taskId, path, mode: 'attach' | 'send' | 'task-attach' | 'message-attach', conversationId?, messageId? }`.
+     *   - `mode:'attach'` (动作 A): upload + record the assetId onto the active
+     *     task's pending list so dispatch-end `flushPending` rides it on the
+     *     agent's reply (`reply.assetIds`).
+     *   - `mode:'send'` (动作 B): upload + post a standalone message carrying the
+     *     attachment to `conversationId`.
+     *   - `mode:'task-attach'` (动作 ③, P5#2): upload as a TASK-bound asset
+     *     (`sourceTaskId`) for a real kanban task; cloud auto-rolls it onto the
+     *     task card + re-emits the terminal digest. No chat reply, no message.
+     *   - `mode:'message-attach'` (动作 A2, P5#3): upload + append the asset to an
+     *     ALREADY-SENT message (`conversationId` + `messageId`) via the cloud
+     *     attach route, which re-emits `message.updated` so the UI picks it up.
+     *
+     * Returns a structured `{ status, body }`. The runner wires this from
+     * `attachDeliver()` in `daemon/asset/deliver.ts`.
+     */
+    onDeliver?: (body: unknown) => Promise<DeliverHandlerResult>;
+    /**
+     * Optional first-pass handler for `/v1/hooks/*` routes (v2.1 §9.5
+     * daemon-as-hook-intake). Returns true if the request was handled
+     * (response written); false to let the normal route table fall through.
+     * Wired by the daemon runner from `attachHookServer()` in
+     * `daemon/memory/hook-server.ts` whenever both memory + run-session
+     * registry are available. When set, /healthz reports `hooksReady: true`.
+     */
+    attachHooks?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * Optional first-pass handler for `/v1/checkpoints/*` routes
+     * (release201/09 §9.4a.7 task product self-check). Independent of
+     * `attachHooks` — checkpoints fire on SDK status-transition only, while
+     * hooks fire per LLM call. Wired by the runner from
+     * `attachCheckpointServer()` in `daemon/checkpoint-server.ts`. When set,
+     * /healthz reports `checkpointsReady: true`.
+     */
+    attachCheckpoints?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * Optional snapshot getter for the eval-session capability
+     * (release201/08 §7.2). When provided, /healthz reports `evalSessions`
+     * with the current active count + per-run summaries. The runner wires
+     * this from `EvalSessionRunner.getState()`.
+     */
+    getEvalSessions?: () => {
+        active: number;
+        queued: number;
+        maxConcurrent: number;
+        runs: Array<{
+            runId: string;
+            skillId: string;
+            startedAt: string;
+        }>;
+    };
 }
 interface AssetWriteHandlerResult {
     status: 200 | 400 | 502;
     body: unknown;
 }
+interface DeliverHandlerResult {
+    status: 200 | 400 | 404 | 422 | 502;
+    body: unknown;
+}
 /**
  * Dispatch envelope received from the sandbox controller proxy. The schema
  * mirrors `DaemonDispatchSchema` in `infra/sandbox-controller/src/api/v1/
@@ -2177,6 +2893,16 @@ interface LocalServerState {
         name: string;
         ready: boolean;
         version?: string;
+        /**
+         * Release 201 v2.0.7 P1 — pinned binary version range from
+         * `adapters/known-versions.ts`. `minVersion` is the lowest upstream
+         * the wrapper has actively run against; `knownGood` is the rev
+         * exercised by the current cookbook + CI smoke. Both are surfaced
+         * verbatim so cloud-side debug-pipeline can flag drift between the
+         * detected `version` and what we've tested.
+         */
+        minVersion?: string;
+        knownGood?: string;
     }>;
     /**
      * Resource snapshot (Release 200 §5.4 + 08 §175). v200 baseline returns
@@ -2223,7 +2949,7 @@ declare class LocalServer {
      *
      * Walks `snapshotRoot` (default `/workspace`), computes per-file
      * sha256 + sizeBytes + mtime, returns `{ files: [...], rootPath }`.
-     * Skips dotfiles + the `_outbox/_uploaded` reserved subdir. Phase 1
+     * Skips dotfiles + the `<artifacts|_outbox|result>/_uploaded` reserved subdir. Phase 1
      * caller (cloud or controller) is responsible for POSTing the result
      * to `/api/sandboxes/:id/snapshot/manifest`.
      */
@@ -2245,6 +2971,19 @@ declare class LocalServer {
      * 502 on cloud upstream failure; 501 if no sink wired.
      */
     private handleAssetWrite;
+    /**
+     * POST /local/deliver — release202/09 P2 explicit file delivery.
+     *
+     * Body: { taskId, path, mode: 'attach' | 'send' | 'task-attach' | 'message-attach', conversationId?, messageId? }
+     * 200: { ok: true, assetId }
+     * 400 invalid body; 404 file not found; 422 policy/magic-bytes rejection;
+     * 502 cloud upstream failure; 501 if no sink wired.
+     *
+     * The daemon-side `onDeliver` sink (daemon/asset/deliver.ts) owns the
+     * upload (via ArtifactsWatcher.deliverFile, daemon credential) and the
+     * attach-vs-send branch.
+     */
+    private handleDeliver;
     /**
      * POST /dispatch — external channel message → hosted agent dispatch.
      *
@@ -2297,8 +3036,12 @@ declare class Runner extends EventEmitter {
     private servicePool;
     private shellConfig;
     private localServer?;
-    private outboxWatcher?;
+    private evalRunner?;
+    private artifactsWatcher?;
     private memoryWiring?;
+    private runSessionRegistry?;
+    private runCheckpointStore?;
+    private hermesSessionMapper?;
     private assetMetadataIndexes;
     private workspaceMirrors;
     private assetOriginOutbox?;
@@ -2321,10 +3064,21 @@ declare class Runner extends EventEmitter {
     private taskReaperTimer?;
     private skillResyncTimer?;
     private skillSyncInFlight;
+    private resumeInFlightTimer?;
+    private resumeInFlightDone;
     private pendingReplyCache;
     private pendingReplyRecoveryDone;
     constructor(opts?: RunnerOptions);
     start(): Promise<void>;
+    /**
+     * v2.1 §9.5 — build a ProfileResolver backed by the daemon's local
+     * `agent_profiles` mirror. Used by the hook server to translate
+     * `?profile=<name>` query into agentImUserId + workspaceId + role slug
+     * when the run-session registry doesn't yet have the run mapping
+     * (e.g. for the very first pre_llm_call of a session, before the
+     * adapter has had a chance to call register()).
+     */
+    private buildProfileResolver;
     /**
      * F16 (2026-05-20) — enumerate every non-deleted local agent_profile and
      * fan-out `syncInstalledSkillsForDispatch` via `syncAllAgentSkills`.
@@ -2334,6 +3088,62 @@ declare class Runner extends EventEmitter {
     private syncAllSkillsBackground;
     /** F16 — read all live agent_profiles from local DB → AgentProfile[]. */
     private loadAllProfiles;
+    /**
+     * P0-2 (2026-05-25) — daemon cold-start sweep.
+     *
+     * Pulls `IMTaskRun.status='running'` rows where the bound daemon (via
+     * `IMAgentBinding.boundDaemonId`) is this daemon, then re-enqueues each
+     * via the same `onTaskDispatch` handler the ws path uses. Replaces the
+     * slow (~5min) cloud-side `sweepTimedOut()` fallback for pod restarts.
+     *
+     * Idempotent on the daemon side: `onTaskDispatch` dedupes by taskId
+     * against `runningTasks`, so any task that happened to be redispatched
+     * from cloud immediately after our reconnect (via redispatchPending on
+     * the agent.host.declare path) won't double-trigger here.
+     *
+     * Caveat: if the agent was mid-LLM-call when the daemon crashed, the
+     * resumed dispatch starts the call from scratch — token cost duplicated.
+     * We accept that vs the alternative (5min of silence + cloud marks the
+     * run `failed` without any retry).
+     */
+    private resumeInFlightTasks;
+    /**
+     * release201/26 Phase 4 — daemon-local checkpoint resume scan.
+     *
+     * Looks at `local_run_checkpoints` (phase-level). A run that still has
+     * checkpoints at boot means the daemon died before dispatch.ts reached its
+     * terminal `finally` (which deletes them). For each:
+     *
+     *   - adapter registered + healthy → RESUMABLE. The cloud-side sweep
+     *     (resumeInFlightTasks, which ran just before this) already re-dispatches
+     *     in-flight runs from cloud truth — that fresh dispatch writes new
+     *     checkpoints — so here we only confirm resumability, count it, and clear
+     *     the stale checkpoint. onResume is a confirm/log step, not a second
+     *     dispatch (onTaskDispatch would dedupe anyway).
+     *   - adapter missing / unhealthy → emit `task.dispatch.resume_failed` so
+     *     cloud marks IMTaskRun.status='resume_failed' and the chat strip renders
+     *     "task interrupted, retry".
+     *
+     * Best-effort + one-shot in spirit (the scan clears each run's checkpoints, so
+     * a re-invocation is a no-op). Requires ws so resume_failed can be sent.
+     */
+    private resumeFromCheckpoints;
+    /**
+     * release201/26 §9 — emit daemon_run_resume_total{result} (and, on failure,
+     * task_dispatch_resume_failed_total). Fire-and-forget; the cloud /batch
+     * endpoint requires workspaceId, so we attach this daemon's bound workspace
+     * (best-effort — when unknown the event is dropped by cloud, which is fine:
+     * an unscoped daemon has no run to attribute).
+     */
+    private emitResumeMetric;
+    /**
+     * Rebuild a `task.dispatch.request` payload from an in-flight IMTaskRun
+     * row + its parent IMTask. Mirrors what cloud-side
+     * v19x-helpers.buildTaskDispatchRequest does, with one extra field:
+     * `metadata.resumed = true` so downstream prompt injection can note
+     * this is a recovery dispatch.
+     */
+    private reconstructDispatchPayload;
     stop(): Promise<void>;
     isRunning(): boolean;
     /**
@@ -2424,10 +3234,30 @@ declare class Runner extends EventEmitter {
      * validation logic doesn't trip on an unknown field.
      */
     private onWebhookDispatch;
+    /**
+     * release201/24 §3 — handle a cloud-pushed eval run. Ack immediately over
+     * the reverse channel (so cloud's WsRpcService settles), then run the eval
+     * asynchronously. Per-case results are POSTed by EvalSessionRunner.onFinish.
+     */
+    private onEvalRequest;
     private onHostAcked;
     private applyHostAckOwnershipLock;
     private onTaskDispatch;
     private onTaskCancel;
+    /**
+     * release201/25 §16.4 A6 — additionally call hermes-native
+     * `POST /v1/runs/{runId}/approval` so hermes-internal HITL state
+     * (session-level "always" cache, pending approval timer) aligns with
+     * the cloud-side decision. The cloud-side redispatch (approval.decided)
+     * is still the authoritative continuation; this is the SECOND write
+     * to keep hermes in sync.
+     *
+     * Best-effort and tolerant: any failure (no runId / no hermes service /
+     * capability missing / hermes 4xx) is logged but never propagated. The
+     * agent will still receive its `approval.decided` task dispatch.
+     */
+    private onTaskApprovalResolve;
+    private onTaskClarifyResolve;
     private findMessageDispatchAgent;
     private postMessageDispatchReply;
     /**
@@ -2447,6 +3277,26 @@ declare class Runner extends EventEmitter {
     private syncProfileFromCloud;
     private resolveOwnedAgent;
     private onWorkspaceChanged;
+    /**
+     * release201/09 §9.4b — wipe local hermes profile memories + per-agent
+     * memory dir for every agent the cloud says belonged to the cleared
+     * workspace. Cloud has already deleted the cloud-side rows (cascade
+     * ordering: cloud-first, daemon-second), so this fan-out is purely
+     * local-FS cleanup. Best-effort: every failure stderr-logs and continues.
+     *
+     * Resolution: iterate local agent_profiles rows whose agent_im_user_id
+     * appears in payload.agentImUserIds; for each, derive the hermes profile
+     * name via getHermesProfileName (same call site spawn / configure uses)
+     * and call wipeHermesProfileMemory. Then for every agent_im_user_id,
+     * wipe ~/.prismer/devices/<did>/agents/<aid>/memory/* (skills/ stays).
+     *
+     * We do NOT delete agent_profiles rows from local SQLite here — that
+     * happens via the existing agent_profile.changed (delete) flow which the
+     * cloud also emits as part of workspace clear (im_agent_profiles rows
+     * are deleted by clearWorkspaceCascade). This handler is purely the
+     * filesystem-layer counterpart of those Prisma deletes.
+     */
+    private onWorkspaceClearDaemonCleanup;
     private onAssetChanged;
     private onWorkspaceFileChanged;
     private snapshotAdapterObservability;
@@ -2554,13 +3404,13 @@ declare const CCConfigSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         name: string;
         command: string;
-        env?: Record<string, string> | undefined;
         args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
     }, {
         name: string;
         command: string;
-        env?: Record<string, string> | undefined;
         args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
     }>, "many">>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     maxTurns: z.ZodDefault<z.ZodNumber>;
@@ -2575,8 +3425,8 @@ declare const CCConfigSchema: z.ZodObject<{
     mcpServers?: {
         name: string;
         command: string;
-        env?: Record<string, string> | undefined;
         args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
     }[] | undefined;
     systemPrompt?: string | undefined;
     allowedTools?: string[] | undefined;
@@ -2589,8 +3439,8 @@ declare const CCConfigSchema: z.ZodObject<{
     mcpServers?: {
         name: string;
         command: string;
-        env?: Record<string, string> | undefined;
         args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
     }[] | undefined;
     systemPrompt?: string | undefined;
     allowedTools?: string[] | undefined;
@@ -2628,20 +3478,59 @@ declare const CodexConfigSchema: z.ZodObject<{
      * scoped key under a different name.
      */
     apiKeyEnv: z.ZodDefault<z.ZodString>;
+    /**
+     * release202/03 §3.2 + 07 — route Codex through our cloud gateway instead of
+     * the official OpenAI endpoint. When set, the adapter writes a per-dispatch
+     * `CODEX_HOME/config.toml` pointing `model_provider=prismer` with
+     * `wire_api="responses"` and a `sk-prismer-*` bearer at:
+     *   - `newapi` (or default) → `<PRISMER_BASE_URL>/api/v1`        (→ /api/v1/responses)
+     *   - any other chain id     → `<PRISMER_BASE_URL>/api/v1/proxy/<chain>`  (→ /api/v1/proxy/<chain>/responses)
+     * The cloud bridge translates Responses↔Chat and walks the selected provider
+     * chain (07). release202/07 widened this from the old `'newapi'|'deepseek'`
+     * enum to ANY configured chain id. Undefined = official OpenAI endpoint.
+     */
+    proxyProvider: z.ZodOptional<z.ZodString>;
+    /** Env var holding the sk-prismer-* key (default PRISMER_API_KEY). */
+    prismerApiKeyEnv: z.ZodDefault<z.ZodString>;
+    /**
+     * release202/05 C2 — per-(conversation × agent) session continuity. When true
+     * (default), the adapter persists codex session files (drops `--ephemeral`)
+     * and, on subsequent turns of the same conversation, resumes the prior
+     * codex thread via `codex exec resume <thread_id>` so context carries across
+     * turns instead of re-bootstrapping every dispatch.
+     *
+     * Empirically verified (codex-cli 0.133.0, 2026-06-02): a fresh `codex exec`
+     * emits `{"type":"thread.started","thread_id":"<uuid>"}`; `codex exec resume
+     * --json --skip-git-repo-check <thread_id> "<prompt>"` reloads that thread and
+     * recalls prior context. NOTE: `--sandbox`/`--cd` are NOT accepted on the
+     * `resume` subcommand (the help lists them but the parser rejects them when a
+     * positional SESSION_ID is present); sandbox is inherited from the persisted
+     * session, so resume turns reuse turn-1's sandbox/cwd.
+     *
+     * Set false to keep the legacy `--ephemeral` one-shot behavior (no session
+     * files, no resume).
+     */
+    sessionContinuity: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     sandbox: "read-only" | "workspace-write" | "danger-full-access";
     model: string;
+    prismerApiKeyEnv: string;
     cwd: string;
     apiKeyEnv: string;
+    sessionContinuity: boolean;
+    proxyProvider?: string | undefined;
     systemPrompt?: string | undefined;
     envVars?: Record<string, string> | undefined;
 }, {
     cwd: string;
     sandbox?: "read-only" | "workspace-write" | "danger-full-access" | undefined;
     model?: string | undefined;
+    proxyProvider?: string | undefined;
+    prismerApiKeyEnv?: string | undefined;
     systemPrompt?: string | undefined;
-    envVars?: Record<string, string> | undefined;
     apiKeyEnv?: string | undefined;
+    envVars?: Record<string, string> | undefined;
+    sessionContinuity?: boolean | undefined;
 }>;
 type CodexConfig = z.infer<typeof CodexConfigSchema>;
 /**