@pstdio/pocketcoder-cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -366,7 +366,7 @@ var require_main = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 import { existsSync as existsSync2, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
 import { dirname as dirname7, join as join6, resolve as resolve8 } from "path";
 
@@ -453,80 +453,6 @@ function sha256Hex(input) {
 function digestOf(value) {
   return `sha256:${sha256Hex(canonicalJson(value))}`;
 }
-// ../contracts/src/duration.ts
-var DURATION_RE = /^(\d+)(ms|s|m|h)$/;
-var UNIT_MS = {
-  ms: 1,
-  s: 1000,
-  m: 60000,
-  h: 3600000
-};
-function isDuration(value) {
-  return DURATION_RE.test(value);
-}
-function parseDurationMs(value) {
-  const match = DURATION_RE.exec(value);
-  if (!match) {
-    throw new Error(`invalid duration: ${value}`);
-  }
-  const amount = Number(match[1]);
-  const unit = UNIT_MS[match[2]];
-  if (unit === undefined) {
-    throw new Error(`invalid duration unit: ${value}`);
-  }
-  return amount * unit;
-}
-// ../contracts/src/errors.ts
-var ERROR_CODES = {
-  "auth.invalid_key": 401,
-  "auth.missing_scope": 403,
-  "auth.disabled_principal": 403,
-  "validation.invalid": 400,
-  "idempotency.conflict": 409,
-  "capacity.queue_full": 429,
-  "capacity.waiters_full": 429,
-  "template.not_found": 404,
-  "template.version_not_found": 404,
-  "template.not_authorized": 403,
-  "workspace.not_found": 404,
-  "workspace.not_ready": 409,
-  "workspace.terminal": 410,
-  "workspace.disconnected": 503,
-  "workspace.persistence_not_enabled": 409,
-  "workspace.preserving": 409,
-  "checkpoint.not_found": 404,
-  "checkpoint.not_ready": 409,
-  "checkpoint.none_ready": 409,
-  "checkpoint.corrupt": 409,
-  "checkpoint.quota_exceeded": 413,
-  "checkpoint.in_use": 409,
-  "restore.template_not_authorized": 403,
-  "restore.image_unavailable": 409,
-  "restore.incompatible": 409,
-  "operation.conflict": 409,
-  "source.not_allowed": 422,
-  "source.invalid_revision": 422,
-  "secret.unavailable": 503,
-  "storage.capacity_exhausted": 507,
-  "relay.body_too_large": 413,
-  "relay.route_not_allowed": 422,
-  "relay.deadline_exceeded": 504,
-  "relay.upstream_error": 502,
-  "internal.error": 500
-};
-
-class ApiError extends Error {
-  code;
-  status;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.status = ERROR_CODES[code];
-  }
-}
-function errorEnvelope(code, message, requestId) {
-  return { error: { code, message, request_id: requestId } };
-}
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -14803,6 +14729,108 @@ function date4(params) {
 
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// ../contracts/src/conversation.ts
+var CONVERSATION_ROLES = ["user", "assistant", "system", "tool"];
+var ConversationMetadataSchema = exports_external.record(exports_external.string().min(1).max(64), exports_external.string().max(512)).refine((value) => Object.keys(value).length <= 32, "conversation metadata has at most 32 keys");
+var ConversationMessageInputSchema = exports_external.object({
+  message_id: exports_external.string().min(1).max(256),
+  role: exports_external.enum(CONVERSATION_ROLES),
+  content: exports_external.string().max(256 * 1024),
+  occurred_at: exports_external.iso.datetime(),
+  metadata: ConversationMetadataSchema.default({})
+});
+var ConversationMessageResourceSchema = ConversationMessageInputSchema.extend({
+  seq: exports_external.number().int().positive()
+});
+var ConversationListQuerySchema = exports_external.object({
+  after: exports_external.coerce.number().int().nonnegative().default(0),
+  limit: exports_external.coerce.number().int().positive().max(200).default(100)
+});
+var ConversationResumeOutcomeSchema = exports_external.object({
+  status: exports_external.literal("supported"),
+  reason: exports_external.null(),
+  source_workspace_id: exports_external.uuid(),
+  checkpoint_id: exports_external.uuid()
+});
+// ../contracts/src/duration.ts
+var DURATION_RE = /^(\d+)(ms|s|m|h)$/;
+var UNIT_MS = {
+  ms: 1,
+  s: 1000,
+  m: 60000,
+  h: 3600000
+};
+function isDuration(value) {
+  return DURATION_RE.test(value);
+}
+function parseDurationMs(value) {
+  const match = DURATION_RE.exec(value);
+  if (!match) {
+    throw new Error(`invalid duration: ${value}`);
+  }
+  const amount = Number(match[1]);
+  const unit = UNIT_MS[match[2]];
+  if (unit === undefined) {
+    throw new Error(`invalid duration unit: ${value}`);
+  }
+  return amount * unit;
+}
+// ../contracts/src/errors.ts
+var ERROR_CODES = {
+  "auth.invalid_key": 401,
+  "auth.missing_scope": 403,
+  "auth.disabled_principal": 403,
+  "validation.invalid": 400,
+  "idempotency.conflict": 409,
+  "capacity.queue_full": 429,
+  "capacity.waiters_full": 429,
+  "template.not_found": 404,
+  "template.version_not_found": 404,
+  "template.not_authorized": 403,
+  "workspace.not_found": 404,
+  "workspace.not_ready": 409,
+  "workspace.terminal": 410,
+  "workspace.disconnected": 503,
+  "workspace.persistence_not_enabled": 409,
+  "workspace.preserving": 409,
+  "checkpoint.not_found": 404,
+  "checkpoint.not_ready": 409,
+  "checkpoint.none_ready": 409,
+  "checkpoint.corrupt": 409,
+  "checkpoint.quota_exceeded": 413,
+  "checkpoint.in_use": 409,
+  "restore.template_not_authorized": 403,
+  "restore.image_unavailable": 409,
+  "restore.incompatible": 409,
+  "resume.unsupported": 409,
+  "conversation.expired": 410,
+  "conversation.deleted": 410,
+  "operation.conflict": 409,
+  "source.not_allowed": 422,
+  "source.invalid_revision": 422,
+  "secret.unavailable": 503,
+  "storage.capacity_exhausted": 507,
+  "relay.body_too_large": 413,
+  "relay.route_not_allowed": 422,
+  "relay.deadline_exceeded": 504,
+  "relay.upstream_error": 502,
+  "internal.error": 500
+};
+
+class ApiError extends Error {
+  code;
+  status;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.status = ERROR_CODES[code];
+    this.details = details;
+  }
+}
+function errorEnvelope(code, message, requestId, details) {
+  return { error: { code, message, request_id: requestId, ...details ? { details } : {} } };
+}
 // ../contracts/src/persistence.ts
 var DurationValueSchema = exports_external.string().refine(isDuration, { message: "expected a duration like 15s, 20m, or 2h" });
 var LAUNCH_MODES = ["create", "restore"];
@@ -14841,6 +14869,7 @@ var CheckpointPolicySchema = exports_external.object({
 var PersistenceSpecSchema = exports_external.object({
   mounts: exports_external.array(PersistenceMountSchema).max(16).default([]),
   conversationRestore: exports_external.enum(CONVERSATION_RESTORE_CAPABILITIES).default("filesystem_only"),
+  conversationRetention: DurationValueSchema.default("168h"),
   sessionCompatibility: exports_external.string().min(1).max(128).optional(),
   checkpoint: CheckpointPolicySchema.prefault({})
 });
@@ -15016,6 +15045,7 @@ var WorkspaceResourceSchema = exports_external.object({
   agent_state: exports_external.enum(AGENT_STATES),
   change_cursor: exports_external.number().int().nonnegative(),
   provider_kind: exports_external.string().nullable(),
+  provisioning_mode: exports_external.enum(["cold", "warm"]).nullable(),
   health: exports_external.record(exports_external.string(), exports_external.string()),
   created_at: exports_external.iso.datetime(),
   updated_at: exports_external.iso.datetime(),
@@ -15033,6 +15063,10 @@ var WorkspaceResourceSchema = exports_external.object({
   persistence: exports_external.object({
     enabled: exports_external.boolean(),
     conversation_restore: exports_external.enum(CONVERSATION_RESTORE_CAPABILITIES),
+    conversation_resume: exports_external.object({
+      status: exports_external.enum(["supported", "unsupported", "unknown"]),
+      reason: exports_external.enum(["filesystem_only", "capability_unknown"]).nullable()
+    }),
     latest_checkpoint_id: exports_external.uuid().nullable()
   }),
   outputs: exports_external.record(exports_external.string(), exports_external.unknown()),
@@ -15050,6 +15084,9 @@ var WorkspaceListQuerySchema = exports_external.object({
   external_id: exports_external.string().optional(),
   state: exports_external.enum(WORKSPACE_STATES).optional(),
   template: exports_external.string().optional(),
+  metadata: exports_external.string().max(4096).optional(),
+  created_after: exports_external.iso.datetime().optional(),
+  created_before: exports_external.iso.datetime().optional(),
   limit: exports_external.coerce.number().int().positive().max(200).default(50),
   cursor: exports_external.string().optional()
 });
@@ -15073,6 +15110,7 @@ var EventEnvelopeSchema = exports_external.object({
     state: exports_external.enum(WORKSPACE_STATES),
     reason_code: exports_external.string().nullable(),
     agent_state: exports_external.enum(AGENT_STATES),
+    provisioning_mode: exports_external.enum(["cold", "warm"]).nullable().default(null),
     change_cursor: exports_external.number().int().nonnegative(),
     failure: exports_external.object({
       reason_code: exports_external.enum(REASON_CODES),
@@ -15489,12 +15527,15 @@ function findRoute(snapshot, service, method, path) {
 // ../contracts/src/protocol.ts
 var LEGACY_PROTOCOL_VERSION = 1;
 var PROTOCOL_VERSION = 2;
+var POOL_PROTOCOL_VERSION = 3;
 var SUPPORTED_PROTOCOL_VERSIONS = [LEGACY_PROTOCOL_VERSION, PROTOCOL_VERSION];
 var MAX_FRAME_BYTES = 1048576;
 var HEADER_PROTOCOL = "x-pocketcoder-protocol";
 var HEADER_WORKSPACE = "x-pocketcoder-workspace";
 var HEADER_REGISTRATION = "x-pocketcoder-registration";
 var HEADER_RECONNECT = "x-pocketcoder-reconnect";
+var HEADER_POOL_RUNTIME = "x-pocketcoder-pool-runtime";
+var HEADER_POOL_ENROLLMENT = "x-pocketcoder-pool-enrollment";
 var EnvelopeBase = exports_external.object({
   v: exports_external.union([exports_external.literal(LEGACY_PROTOCOL_VERSION), exports_external.literal(PROTOCOL_VERSION)]),
   workspace_id: exports_external.uuid(),
@@ -15565,6 +15606,7 @@ var RestoreStatusPayload = exports_external.object({
   capability: exports_external.enum(CONVERSATION_RESTORE_CAPABILITIES),
   detail: exports_external.string().max(512).optional()
 });
+var ConversationMessagePayload = ConversationMessageInputSchema;
 var AgentFrameSchema = exports_external.discriminatedUnion("type", [
   EnvelopeBase.extend({ type: exports_external.literal("registered"), payload: RegisteredPayload }),
   EnvelopeBase.extend({ type: exports_external.literal("heartbeat"), payload: HeartbeatPayload }),
@@ -15577,7 +15619,11 @@ var AgentFrameSchema = exports_external.discriminatedUnion("type", [
   EnvelopeBase.extend({ type: exports_external.literal("source_resolved"), payload: SourceResolvedPayload }),
   EnvelopeBase.extend({ type: exports_external.literal("checkpoint_status"), payload: CheckpointStatusPayload }),
   EnvelopeBase.extend({ type: exports_external.literal("output_published"), payload: OutputPublishedPayload }),
-  EnvelopeBase.extend({ type: exports_external.literal("restore_status"), payload: RestoreStatusPayload })
+  EnvelopeBase.extend({ type: exports_external.literal("restore_status"), payload: RestoreStatusPayload }),
+  EnvelopeBase.extend({
+    type: exports_external.literal("conversation_message"),
+    payload: ConversationMessagePayload
+  })
 ]);
 var ExecSpecSchema = exports_external.object({
   setup: exports_external.array(SetupStepSchema),
@@ -15670,6 +15716,27 @@ var ProviderInputSchema = exports_external.object({
   }).optional(),
   launch_input: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
 });
+var PoolProviderInputSchema = exports_external.object({
+  pool_runtime_id: exports_external.uuid(),
+  server_url: exports_external.string(),
+  enrollment_secret: exports_external.string().min(1),
+  template_digest: exports_external.string(),
+  template_name: exports_external.string(),
+  template_version: exports_external.string()
+});
+var ProviderBootstrapInputSchema = exports_external.union([ProviderInputSchema, PoolProviderInputSchema]);
+var PoolRegisteredFrameSchema = exports_external.object({
+  v: exports_external.literal(POOL_PROTOCOL_VERSION),
+  type: exports_external.literal("pool_registered"),
+  pool_runtime_id: exports_external.uuid(),
+  template: exports_external.object({ name: exports_external.string(), version: exports_external.string(), digest: exports_external.string() }),
+  agent_version: exports_external.string()
+});
+var LeaseAssignmentFrameSchema = exports_external.object({
+  v: exports_external.literal(POOL_PROTOCOL_VERSION),
+  type: exports_external.literal("lease_assignment"),
+  input: ProviderInputSchema
+});
 // ../contracts/src/scopes.ts
 var SCOPES = [
   "templates:read",
@@ -15681,6 +15748,8 @@ var SCOPES = [
   "checkpoints:read",
   "checkpoints:delete",
   "outputs:read",
+  "conversations:read",
+  "conversations:delete",
   "services:relay",
   "logs:read",
   "admin"
@@ -31118,6 +31187,58 @@ ALTER TABLE "workspaces" ADD COLUMN "failure_log_tail" text;--> statement-breakp
 ALTER TABLE "workspaces" ADD COLUMN "failure_log_tail_truncated" boolean DEFAULT false NOT NULL;--> statement-breakpoint
 ALTER TABLE "workspaces" ADD COLUMN "failure_last_log_seq" bigint;`;
 
+// ../db/drizzle/20260803081501_warm-workspace-pool/migration.sql
+var migration_default4 = `CREATE TABLE "warm_pool_runtimes" (
+	"id" uuid PRIMARY KEY,
+	"template_id" uuid NOT NULL,
+	"template_name" text NOT NULL,
+	"template_version" text NOT NULL,
+	"template_digest" text NOT NULL,
+	"driver_kind" text NOT NULL,
+	"eligibility_fingerprint" text NOT NULL,
+	"state" text NOT NULL,
+	"provider_ref" jsonb,
+	"enrollment_digest" bytea,
+	"enrollment_expires_at" timestamp with time zone,
+	"workspace_id" uuid,
+	"created_at" timestamp with time zone NOT NULL,
+	"updated_at" timestamp with time zone NOT NULL,
+	"ready_at" timestamp with time zone,
+	"leased_at" timestamp with time zone,
+	"failure_code" text
+);
+--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN "provisioning_mode" text;--> statement-breakpoint
+CREATE INDEX "warm_pool_eligible" ON "warm_pool_runtimes" ("template_digest","driver_kind","eligibility_fingerprint","state","ready_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "warm_pool_workspace_once" ON "warm_pool_runtimes" ("workspace_id");--> statement-breakpoint
+ALTER TABLE "warm_pool_runtimes" ADD CONSTRAINT "warm_pool_runtimes_template_id_templates_id_fkey" FOREIGN KEY ("template_id") REFERENCES "templates"("id");--> statement-breakpoint
+ALTER TABLE "warm_pool_runtimes" ADD CONSTRAINT "warm_pool_runtimes_workspace_id_workspaces_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id");`;
+
+// ../db/drizzle/20260803092834_durable-conversations/migration.sql
+var migration_default5 = `CREATE TABLE "workspace_conversation_messages" (
+	"workspace_id" uuid,
+	"seq" bigint,
+	"message_id" text NOT NULL,
+	"role" text NOT NULL,
+	"content" text NOT NULL,
+	"occurred_at" timestamp with time zone NOT NULL,
+	"metadata" jsonb DEFAULT '{}' NOT NULL,
+	"created_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "workspace_conversation_messages_pkey" PRIMARY KEY("workspace_id","seq"),
+	CONSTRAINT "workspace_conversation_messages_workspace_id_message_id_unique" UNIQUE("workspace_id","message_id")
+);
+--> statement-breakpoint
+CREATE TABLE "workspace_conversations" (
+	"workspace_id" uuid PRIMARY KEY,
+	"status" text NOT NULL,
+	"expires_at" timestamp with time zone,
+	"deleted_at" timestamp with time zone,
+	"updated_at" timestamp with time zone NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "workspace_conversation_messages" ADD CONSTRAINT "workspace_conversation_messages_workspace_id_workspaces_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id");--> statement-breakpoint
+ALTER TABLE "workspace_conversations" ADD CONSTRAINT "workspace_conversations_workspace_id_workspaces_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id");`;
+
 // ../db/src/migrations.ts
 function migration(name2, folderMillis, source) {
   return {
@@ -31131,7 +31252,9 @@ function migration(name2, folderMillis, source) {
 var MIGRATIONS = [
   migration("20260730103433_initial", Date.UTC(2026, 6, 30, 10, 34, 33), migration_default),
   migration("20260730113243_regular_pretty_boy", Date.UTC(2026, 6, 30, 11, 32, 43), migration_default2),
-  migration("20260730132750_workspace-change-diagnostics", Date.UTC(2026, 6, 30, 13, 27, 50), migration_default3)
+  migration("20260730132750_workspace-change-diagnostics", Date.UTC(2026, 6, 30, 13, 27, 50), migration_default3),
+  migration("20260803081501_warm-workspace-pool", Date.UTC(2026, 7, 3, 8, 15, 1), migration_default4),
+  migration("20260803092834_durable-conversations", Date.UTC(2026, 7, 3, 9, 28, 34), migration_default5)
 ];
 
 // ../db/src/schema.ts
@@ -31190,6 +31313,7 @@ var workspaces = pgTable("workspaces", {
   launchInput: jsonb("launch_input").$type(),
   providerKind: text2("provider_kind"),
   providerRef: jsonb("provider_ref").$type(),
+  provisioningMode: text2("provisioning_mode"),
   registrationDigest: bytea2("registration_digest"),
   registrationExpiresAt: timestamptz("registration_expires_at"),
   reconnectDigest: bytea2("reconnect_digest"),
@@ -31219,6 +31343,28 @@ var workspaces = pgTable("workspaces", {
   index("workspaces_state_created").on(table.state, table.createdAt),
   index("workspaces_deadline").on(table.deadlineAt).where(sql`${table.state} NOT IN ${terminalStates}`)
 ]);
+var warmPoolRuntimes = pgTable("warm_pool_runtimes", {
+  id: uuid3("id").primaryKey(),
+  templateId: uuid3("template_id").notNull().references(() => templates.id),
+  templateName: text2("template_name").notNull(),
+  templateVersion: text2("template_version").notNull(),
+  templateDigest: text2("template_digest").notNull(),
+  driverKind: text2("driver_kind").notNull(),
+  eligibilityFingerprint: text2("eligibility_fingerprint").notNull(),
+  state: text2("state").notNull(),
+  providerRef: jsonb("provider_ref").$type(),
+  enrollmentDigest: bytea2("enrollment_digest"),
+  enrollmentExpiresAt: timestamptz("enrollment_expires_at"),
+  workspaceId: uuid3("workspace_id").references(() => workspaces.id),
+  createdAt: timestamptz("created_at").notNull(),
+  updatedAt: timestamptz("updated_at").notNull(),
+  readyAt: timestamptz("ready_at"),
+  leasedAt: timestamptz("leased_at"),
+  failureCode: text2("failure_code")
+}, (table) => [
+  index("warm_pool_eligible").on(table.templateDigest, table.driverKind, table.eligibilityFingerprint, table.state, table.readyAt),
+  uniqueIndex("warm_pool_workspace_once").on(table.workspaceId)
+]);
 var workspaceStorage = pgTable("workspace_storage", {
   id: uuid3("id").primaryKey(),
   workspaceId: uuid3("workspace_id").notNull().references(() => workspaces.id),
@@ -31294,6 +31440,26 @@ var workspaceOutputs = pgTable("workspace_outputs", {
   value: jsonb("value").$type().notNull(),
   occurredAt: timestamptz("occurred_at").notNull()
 }, (table) => [primaryKey({ columns: [table.workspaceId, table.seq] })]);
+var workspaceConversations = pgTable("workspace_conversations", {
+  workspaceId: uuid3("workspace_id").primaryKey().references(() => workspaces.id),
+  status: text2("status").notNull(),
+  expiresAt: timestamptz("expires_at"),
+  deletedAt: timestamptz("deleted_at"),
+  updatedAt: timestamptz("updated_at").notNull()
+});
+var workspaceConversationMessages = pgTable("workspace_conversation_messages", {
+  workspaceId: uuid3("workspace_id").notNull().references(() => workspaces.id),
+  seq: bigint5("seq", { mode: "bigint" }).notNull(),
+  messageId: text2("message_id").notNull(),
+  role: text2("role").notNull(),
+  content: text2("content").notNull(),
+  occurredAt: timestamptz("occurred_at").notNull(),
+  metadata: jsonb("metadata").$type().notNull().default({}),
+  createdAt: timestamptz("created_at").notNull()
+}, (table) => [
+  primaryKey({ columns: [table.workspaceId, table.seq] }),
+  unique().on(table.workspaceId, table.messageId)
+]);
 var workspaceStateHistory = pgTable("workspace_state_history", {
   id: uuid3("id").primaryKey(),
   workspaceId: uuid3("workspace_id").notNull().references(() => workspaces.id),
@@ -31406,7 +31572,7 @@ async function migrationStatus(sql2, schema) {
   });
 }
 // ../db/src/store.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 // ../runtime-core/src/events.ts
 import { randomUUID as randomUUID2 } from "crypto";
 function buildEventEnvelope(row, occurredAt) {
@@ -31420,6 +31586,7 @@ function buildEventEnvelope(row, occurredAt) {
       state: row.state,
       reason_code: row.reasonCode,
       agent_state: row.agentState,
+      provisioning_mode: row.provisioningMode,
       change_cursor: row.changeSeq,
       failure: row.state === "failed" && row.reasonCode ? {
         reason_code: row.reasonCode,
@@ -31896,7 +32063,26 @@ class Scheduler {
         return;
       case "provisioning":
         if (row.registrationExpiresAt && now >= row.registrationExpiresAt) {
-          await this.fail(row, "registration_timeout", now);
+          if (row.provisioningMode === "warm" && row.launchAttempts < this.deps.limits.maxLaunchAttempts) {
+            if (row.providerRef) {
+              await this.deps.driver.stop(row.providerRef, 1).catch(() => {});
+              await this.deps.driver.remove(row.providerRef).catch(() => {});
+            }
+            await this.deps.store.transition(row.id, {
+              from: ["provisioning"],
+              to: "queued",
+              at: now,
+              patch: {
+                providerKind: null,
+                providerRef: null,
+                provisioningMode: null,
+                registrationDigest: null,
+                registrationExpiresAt: null
+              }
+            });
+          } else {
+            await this.fail(row, "registration_timeout", now);
+          }
         }
         return;
       case "connected":
@@ -32085,19 +32271,8 @@ class Scheduler {
     const { store, driver, secrets } = this.deps;
     const now = this.now();
     const secret = secrets.generate();
-    const claimed = await store.transition(row.id, {
-      from: ["queued"],
-      to: "provisioning",
-      at: now,
-      patch: {
-        registrationDigest: secrets.digest(secret),
-        registrationExpiresAt: new Date(now.getTime() + this.timeoutMs(row, "start")),
-        launchAttempts: row.launchAttempts + 1
-      }
-    });
-    if (!claimed) {
-      return false;
-    }
+    const registrationDigest = secrets.digest(secret);
+    const registrationExpiresAt = new Date(now.getTime() + this.timeoutMs(row, "start"));
     const input = {
       workspace_id: row.id,
       server_url: this.deps.workspaceServerUrl,
@@ -32115,6 +32290,26 @@ class Scheduler {
       } : {},
       ...row.launchInput ? { launch_input: row.launchInput } : {}
     };
+    if (this.deps.warmPool) {
+      const hit = await this.deps.warmPool.tryLease(row, input, registrationDigest, registrationExpiresAt);
+      if (hit)
+        return true;
+      if (this.deps.warmPool.missDecision(row) === "wait")
+        return false;
+    }
+    const claimed = await store.transition(row.id, {
+      from: ["queued"],
+      to: "provisioning",
+      at: now,
+      patch: {
+        provisioningMode: "cold",
+        registrationDigest,
+        registrationExpiresAt,
+        launchAttempts: row.launchAttempts + 1
+      }
+    });
+    if (!claimed)
+      return false;
     try {
       const mounts = await this.prepareStorage(claimed);
       if (!this.deps.secretResolver && JSON.stringify(claimed.templateSnapshot.spec).includes('"secretRef:')) {
@@ -32242,9 +32437,275 @@ class Scheduler {
     await this.deps.store.updateOperation(operation.id, { state, reasonCode, completedAt: at, attemptCount: operation.attemptCount + 1 }, at);
   }
 }
+// ../runtime-core/src/warm-pool.ts
+import { randomUUID as randomUUID4 } from "crypto";
+function warmPoolFingerprint(template2, driverKind) {
+  return digestOf({ template_digest: template2.digest, driver: driverKind });
+}
+function validateWarmPoolTemplate(template2) {
+  if (template2.spec.persistence.mounts.length > 0) {
+    throw new Error(`warm pool ${template2.name}@${template2.version} is ineligible: persistent mounts are not supported`);
+  }
+  if (JSON.stringify(template2.spec).includes('"secretRef:')) {
+    throw new Error(`warm pool ${template2.name}@${template2.version} is ineligible: resolved secret mounts are not supported`);
+  }
+}
+async function resolveWarmPools(store, entries, driverKind, globalLimit) {
+  if (entries.reduce((sum3, entry) => sum3 + entry.minReady, 0) > globalLimit) {
+    throw new Error("warm pool desired capacity exceeds POCKETCODER_MAX_ACTIVE_WORKSPACES");
+  }
+  const seen = new Set;
+  const resolved = [];
+  for (const entry of entries) {
+    const template2 = await store.getTemplate(entry.template, entry.version);
+    if (!template2 || template2.status === "retired") {
+      throw new Error(`warm pool template not found: ${entry.template}${entry.version ? `@${entry.version}` : ""}`);
+    }
+    validateWarmPoolTemplate(template2);
+    if (seen.has(template2.digest))
+      throw new Error(`duplicate warm pool template digest: ${template2.digest}`);
+    seen.add(template2.digest);
+    resolved.push({
+      ...entry,
+      templateRow: template2,
+      eligibilityFingerprint: warmPoolFingerprint(template2, driverKind)
+    });
+  }
+  return resolved;
+}
+
+class WarmPoolManager {
+  deps;
+  metrics = {
+    warmHits: 0,
+    misses: 0,
+    leaseFailures: 0,
+    replenishFailures: 0,
+    staleCleanups: 0,
+    leaseLatencyMsTotal: 0
+  };
+  constructor(deps) {
+    this.deps = deps;
+  }
+  now() {
+    return this.deps.now?.() ?? new Date;
+  }
+  poolFor(row) {
+    return this.deps.pools.find((pool) => pool.templateRow.digest === row.templateDigest);
+  }
+  missDecision(row) {
+    const pool = this.poolFor(row);
+    if (!pool || pool.missPolicy === "cold")
+      return "cold";
+    return this.now().getTime() - row.createdAt.getTime() < pool.waitTimeoutMs ? "wait" : "cold";
+  }
+  async tryLease(row, input, registrationDigest, registrationExpiresAt) {
+    const pool = this.poolFor(row);
+    if (!pool)
+      return false;
+    const started = this.now();
+    const claimed = await this.deps.store.claimWarmPoolRuntime({
+      workspaceId: row.id,
+      templateDigest: row.templateDigest,
+      driverKind: this.deps.driver.kind,
+      eligibilityFingerprint: pool.eligibilityFingerprint,
+      registrationDigest,
+      registrationExpiresAt,
+      at: started
+    });
+    if (!claimed) {
+      this.metrics.misses += 1;
+      return false;
+    }
+    await this.deps.store.updateWarmPoolRuntime(claimed.runtime.id, { state: "leased" }, this.now());
+    if (!this.deps.connections.assign(claimed.runtime.id, input)) {
+      this.metrics.leaseFailures += 1;
+      await this.destroy(claimed.runtime, "assignment_connection_lost");
+      await this.deps.store.transition(row.id, {
+        from: ["provisioning"],
+        to: "queued",
+        at: this.now(),
+        patch: {
+          providerKind: null,
+          providerRef: null,
+          provisioningMode: null,
+          registrationDigest: null,
+          registrationExpiresAt: null
+        }
+      });
+      return false;
+    }
+    this.metrics.warmHits += 1;
+    this.metrics.leaseLatencyMsTotal += this.now().getTime() - started.getTime();
+    return true;
+  }
+  async markReady(runtimeId) {
+    let row = await this.deps.store.getWarmPoolRuntime(runtimeId);
+    for (let attempt = 0;row?.state === "provisioning" && !row.providerRef && attempt < 50; attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      row = await this.deps.store.getWarmPoolRuntime(runtimeId);
+    }
+    if (row?.state !== "provisioning" || !row.providerRef)
+      return false;
+    const now = this.now();
+    await this.deps.store.updateWarmPoolRuntime(runtimeId, {
+      state: "ready",
+      readyAt: now,
+      enrollmentDigest: null,
+      enrollmentExpiresAt: null
+    }, now);
+    this.deps.driver.cleanupWarmInput?.(runtimeId).catch(() => {});
+    return true;
+  }
+  async disconnected(runtimeId) {
+    const row = await this.deps.store.getWarmPoolRuntime(runtimeId);
+    if (row && ["provisioning", "ready", "leasing"].includes(row.state)) {
+      await this.destroy(row, "pool_agent_disconnected");
+    }
+  }
+  async destroy(row, reason) {
+    await this.deps.store.updateWarmPoolRuntime(row.id, { state: "draining", failureCode: reason }, this.now());
+    this.deps.connections.close(row.id);
+    if (row.providerRef) {
+      await this.deps.driver.stop(row.providerRef, 1).catch(() => {});
+      await this.deps.driver.remove(row.providerRef).catch(() => {});
+    }
+    await this.deps.store.updateWarmPoolRuntime(row.id, { state: "failed", failureCode: reason }, this.now());
+  }
+  async create(pool) {
+    const now = this.now();
+    const id = randomUUID4();
+    const secret = this.deps.secrets.generate();
+    const row = {
+      id,
+      templateId: pool.templateRow.id,
+      templateName: pool.templateRow.name,
+      templateVersion: pool.templateRow.version,
+      templateDigest: pool.templateRow.digest,
+      driverKind: this.deps.driver.kind,
+      eligibilityFingerprint: pool.eligibilityFingerprint,
+      state: "provisioning",
+      providerRef: null,
+      enrollmentDigest: this.deps.secrets.digest(secret),
+      enrollmentExpiresAt: new Date(now.getTime() + parseDurationMs(pool.templateRow.spec.timeouts.start)),
+      workspaceId: null,
+      createdAt: now,
+      updatedAt: now,
+      readyAt: null,
+      leasedAt: null,
+      failureCode: null
+    };
+    await this.deps.store.insertWarmPoolRuntime(row);
+    const input = {
+      pool_runtime_id: id,
+      server_url: this.deps.workspaceServerUrl,
+      enrollment_secret: secret,
+      template_digest: pool.templateRow.digest,
+      template_name: pool.templateRow.name,
+      template_version: pool.templateRow.version
+    };
+    try {
+      const template2 = {
+        name: pool.templateRow.name,
+        version: pool.templateRow.version,
+        digest: pool.templateRow.digest,
+        spec: pool.templateRow.spec
+      };
+      const ref = await this.deps.driver.createWarm({ runtimeId: id, template: template2, input });
+      await this.deps.store.updateWarmPoolRuntime(id, { providerRef: ref }, this.now());
+    } catch (error51) {
+      this.metrics.replenishFailures += 1;
+      await this.deps.store.updateWarmPoolRuntime(id, { state: "failed", failureCode: "provider_create_failed" }, this.now());
+      this.deps.onError?.(`warm-pool.create.${id}`, error51);
+    }
+  }
+  async cleanupReason(row, pool, now) {
+    if (!pool)
+      return "pool_retired";
+    if (["provisioning", "ready"].includes(row.state) && row.createdAt.getTime() + pool.maxWarmAgeMs <= now.getTime())
+      return "max_warm_age";
+    if (row.state === "provisioning" && row.enrollmentExpiresAt !== null && row.enrollmentExpiresAt <= now) {
+      return "enrollment_timeout";
+    }
+    if (!row.workspaceId)
+      return null;
+    return (await this.deps.store.getWorkspace(row.workspaceId))?.terminalAt ? "workspace_ended" : null;
+  }
+  async reconcileRow(row, pool, now) {
+    const reason = await this.cleanupReason(row, pool, now);
+    if (reason) {
+      if (row.state !== "failed") {
+        this.metrics.staleCleanups += 1;
+        await this.destroy(row, reason);
+      }
+      return;
+    }
+    if (!row.providerRef || ["failed", "draining"].includes(row.state))
+      return;
+    const state = await this.deps.driver.inspect(row.providerRef);
+    if (!state.exists || !state.running)
+      await this.destroy(row, "provider_lost");
+  }
+  async reconcile() {
+    const now = this.now();
+    const configured = new Map(this.deps.pools.map((pool) => [pool.templateRow.digest, pool]));
+    const rows = await this.deps.store.listWarmPoolRuntimes();
+    const known = new Map(rows.map((row) => [row.id, row]));
+    for (const provider of await this.deps.driver.listWarm()) {
+      const row = known.get(provider.runtimeId);
+      if (!row || row.templateDigest !== provider.templateDigest || row.driverKind !== this.deps.driver.kind) {
+        this.metrics.staleCleanups += 1;
+        await this.deps.driver.stop(provider.ref, 1).catch(() => {});
+        await this.deps.driver.remove(provider.ref).catch(() => {});
+        continue;
+      }
+      if (!row.providerRef && row.state === "provisioning") {
+        await this.deps.store.updateWarmPoolRuntime(row.id, { providerRef: provider.ref }, now);
+        row.providerRef = provider.ref;
+      }
+    }
+    for (const row of rows) {
+      await this.reconcileRow(row, configured.get(row.templateDigest), now);
+    }
+    const fresh = await this.deps.store.listWarmPoolRuntimes();
+    for (const pool of this.deps.pools) {
+      const available = fresh.filter((row) => row.templateDigest === pool.templateRow.digest && ["provisioning", "ready"].includes(row.state)).length;
+      for (let i = available;i < pool.minReady; i += 1)
+        await this.create(pool);
+    }
+  }
+  async inventory() {
+    const rows = await this.deps.store.listWarmPoolRuntimes();
+    const now = this.now();
+    return {
+      items: this.deps.pools.map((pool) => {
+        const matching = rows.filter((row) => row.templateDigest === pool.templateRow.digest);
+        const counts = {};
+        for (const row of matching)
+          counts[row.state] = (counts[row.state] ?? 0) + 1;
+        const ready = matching.filter((row) => row.state === "ready" && row.readyAt).map((row) => row.readyAt);
+        return {
+          template: pool.templateRow.name,
+          version: pool.templateRow.version,
+          template_digest: pool.templateRow.digest,
+          driver: this.deps.driver.kind,
+          desired: pool.minReady,
+          counts,
+          oldest_ready_age_ms: ready.length ? now.getTime() - Math.min(...ready.map((date9) => date9.getTime())) : null
+        };
+      }),
+      metrics: {
+        ...this.metrics,
+        average_lease_latency_ms: this.metrics.warmHits ? this.metrics.leaseLatencyMsTotal / this.metrics.warmHits : 0
+      }
+    };
+  }
+}
 // ../db/src/store.ts
 var {SQL: SQL6 } = globalThis.Bun;
 var MAX_LOG_BYTES = 10 * 1024 * 1024;
+var MAX_CONVERSATION_BYTES = 50 * 1024 * 1024;
+var MAX_CONVERSATION_MESSAGES = 1e5;
 var CLAIM_LEASE_MS = 60000;
 function pgTextArray(items) {
   return `{${items.map((i) => `"${i.replace(/(["\\])/g, "\\$1")}"`).join(",")}}`;
@@ -32340,7 +32801,7 @@ class PostgresStore {
 					(id, name, version, digest, description, spec, status, created_at)
 				 VALUES ($1, $2, $3, $4, $5, $6::jsonb, 'active', now())
 				 RETURNING *`, [
-        randomUUID4(),
+        randomUUID5(),
         input.name,
         input.version,
         input.digest,
@@ -32364,6 +32825,127 @@ class PostgresStore {
 			 SET status = $3, retired_at = CASE WHEN $3 = 'retired' THEN now() ELSE NULL END
 			 WHERE name = $1 AND version = $2`, [name2, version2, status]);
   }
+  warmPoolRuntimeFromRow(r) {
+    return {
+      id: String(r.id),
+      templateId: String(r.template_id),
+      templateName: String(r.template_name),
+      templateVersion: String(r.template_version),
+      templateDigest: String(r.template_digest),
+      driverKind: String(r.driver_kind),
+      eligibilityFingerprint: String(r.eligibility_fingerprint),
+      state: r.state,
+      providerRef: r.provider_ref == null ? null : asJson(r.provider_ref),
+      enrollmentDigest: asBytes(r.enrollment_digest),
+      enrollmentExpiresAt: asDateOrNull(r.enrollment_expires_at),
+      workspaceId: r.workspace_id ?? null,
+      createdAt: asDate(r.created_at),
+      updatedAt: asDate(r.updated_at),
+      readyAt: asDateOrNull(r.ready_at),
+      leasedAt: asDateOrNull(r.leased_at),
+      failureCode: r.failure_code ?? null
+    };
+  }
+  async insertWarmPoolRuntime(row) {
+    const rows = await this.sql.unsafe(`INSERT INTO ${this.t("warm_pool_runtimes")}
+			 (id, template_id, template_name, template_version, template_digest, driver_kind,
+			  eligibility_fingerprint, state, provider_ref, enrollment_digest,
+			  enrollment_expires_at, workspace_id, created_at, updated_at, ready_at,
+			  leased_at, failure_code)
+			 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17)
+			 ON CONFLICT (id) DO NOTHING RETURNING *`, [
+      row.id,
+      row.templateId,
+      row.templateName,
+      row.templateVersion,
+      row.templateDigest,
+      row.driverKind,
+      row.eligibilityFingerprint,
+      row.state,
+      row.providerRef == null ? null : JSON.stringify(row.providerRef),
+      row.enrollmentDigest,
+      row.enrollmentExpiresAt,
+      row.workspaceId,
+      row.createdAt,
+      row.updatedAt,
+      row.readyAt,
+      row.leasedAt,
+      row.failureCode
+    ]);
+    return rows[0] ? this.warmPoolRuntimeFromRow(rows[0]) : await this.getWarmPoolRuntime(row.id);
+  }
+  async getWarmPoolRuntime(id) {
+    const rows = await this.sql.unsafe(`SELECT * FROM ${this.t("warm_pool_runtimes")} WHERE id = $1`, [id]);
+    return rows[0] ? this.warmPoolRuntimeFromRow(rows[0]) : null;
+  }
+  async listWarmPoolRuntimes() {
+    const rows = await this.sql.unsafe(`SELECT * FROM ${this.t("warm_pool_runtimes")} ORDER BY created_at`);
+    return rows.map((row) => this.warmPoolRuntimeFromRow(row));
+  }
+  async updateWarmPoolRuntime(id, patch, at) {
+    const columns = {
+      state: "state",
+      providerRef: "provider_ref",
+      enrollmentDigest: "enrollment_digest",
+      enrollmentExpiresAt: "enrollment_expires_at",
+      workspaceId: "workspace_id",
+      readyAt: "ready_at",
+      leasedAt: "leased_at",
+      failureCode: "failure_code"
+    };
+    const params = [id, at];
+    const sets = ["updated_at = $2"];
+    for (const [key, column] of Object.entries(columns)) {
+      if (!(key in patch))
+        continue;
+      const value = patch[key] ?? null;
+      params.push(key === "providerRef" && value !== null ? JSON.stringify(value) : value);
+      sets.push(`${column} = $${params.length}${key === "providerRef" ? "::jsonb" : ""}`);
+    }
+    await this.sql.unsafe(`UPDATE ${this.t("warm_pool_runtimes")} SET ${sets.join(", ")} WHERE id = $1`, params);
+  }
+  async claimWarmPoolRuntime(claim) {
+    const result = await this.sql.begin(async (tx) => {
+      const workspaceRows = await tx.unsafe(`SELECT * FROM ${this.t("workspaces")} WHERE id = $1 FOR UPDATE`, [claim.workspaceId]);
+      const current = workspaceRows[0] ? this.workspaceFromRow(workspaceRows[0]) : null;
+      if (current?.state !== "queued")
+        return null;
+      const runtimeRows = await tx.unsafe(`SELECT * FROM ${this.t("warm_pool_runtimes")}
+				 WHERE template_digest = $1 AND driver_kind = $2 AND eligibility_fingerprint = $3
+				   AND state = 'ready' AND provider_ref IS NOT NULL
+				 ORDER BY ready_at FOR UPDATE SKIP LOCKED LIMIT 1`, [claim.templateDigest, claim.driverKind, claim.eligibilityFingerprint]);
+      if (!runtimeRows[0])
+        return null;
+      const runtime = this.warmPoolRuntimeFromRow(runtimeRows[0]);
+      const leasedRows = await tx.unsafe(`UPDATE ${this.t("warm_pool_runtimes")}
+				 SET state='leasing', workspace_id=$2, leased_at=$3, updated_at=$3
+				 WHERE id=$1 AND state='ready' RETURNING *`, [runtime.id, current.id, claim.at]);
+      if (!leasedRows[0])
+        return null;
+      const updatedRows = await tx.unsafe(`UPDATE ${this.t("workspaces")}
+				 SET state='provisioning', provisioning_mode='warm', provider_kind=$2,
+				     provider_ref=$3::jsonb, registration_digest=$4,
+				     registration_expires_at=$5, launch_attempts=launch_attempts+1,
+				     updated_at=$6, change_seq=change_seq+1
+				 WHERE id=$1 AND state='queued' RETURNING *`, [
+        current.id,
+        runtime.driverKind,
+        JSON.stringify(runtime.providerRef),
+        claim.registrationDigest,
+        claim.registrationExpiresAt,
+        claim.at
+      ]);
+      if (!updatedRows[0])
+        throw new Error("warm_pool.claim_workspace_race");
+      const workspace2 = this.workspaceFromRow(updatedRows[0]);
+      await this.appendHistoryTx(tx, workspace2, "queued", "provisioning", null, claim.at);
+      await this.appendEventTx(tx, workspace2, claim.at);
+      return { runtime: this.warmPoolRuntimeFromRow(leasedRows[0]), workspace: workspace2 };
+    });
+    if (result)
+      this.notifyWorkspaceChange(claim.workspaceId);
+    return result;
+  }
   principalFromRow(r) {
     return {
       id: String(r.id),
@@ -32376,7 +32958,7 @@ class PostgresStore {
   }
   async createPrincipal(name2, scopes2, templateNames) {
     const rows = await this.sql.unsafe(`INSERT INTO ${this.t("principals")} (id, name, scopes, template_names, created_at)
-			 VALUES ($1, $2, $3::text[], $4::text[], now()) RETURNING *`, [randomUUID4(), name2, pgTextArray(scopes2), pgTextArray(templateNames)]);
+			 VALUES ($1, $2, $3::text[], $4::text[], now()) RETURNING *`, [randomUUID5(), name2, pgTextArray(scopes2), pgTextArray(templateNames)]);
     return this.principalFromRow(rows[0]);
   }
   async getPrincipalByName(name2) {
@@ -32477,6 +33059,7 @@ class PostgresStore {
       launchInput: r.launch_input == null ? null : asJson(r.launch_input),
       providerKind: r.provider_kind ?? null,
       providerRef: r.provider_ref == null ? null : asJson(r.provider_ref),
+      provisioningMode: r.provisioning_mode ?? null,
       registrationDigest: asBytes(r.registration_digest),
       registrationExpiresAt: asDateOrNull(r.registration_expires_at),
       reconnectDigest: asBytes(r.reconnect_digest),
@@ -32586,13 +33169,26 @@ class PostgresStore {
       params.push(filter.template);
       clauses.push(`template_name = $${params.length}`);
     }
+    if (filter.metadata) {
+      params.push(JSON.stringify(filter.metadata));
+      clauses.push(`metadata @> $${params.length}::jsonb`);
+    }
+    if (filter.createdAfter) {
+      params.push(filter.createdAfter);
+      clauses.push(`created_at >= $${params.length}`);
+    }
+    if (filter.createdBefore) {
+      params.push(filter.createdBefore);
+      clauses.push(`created_at < $${params.length}`);
+    }
     if (filter.cursor) {
       params.push(filter.cursor);
-      clauses.push(`created_at < (SELECT created_at FROM ${this.t("workspaces")} WHERE id = $${params.length})`);
+      clauses.push(`(created_at, id) < (SELECT created_at, id FROM ${this.t("workspaces")}
+				 WHERE id = $${params.length} AND principal_id = $1)`);
     }
     params.push(filter.limit);
     const rows = await this.sql.unsafe(`SELECT * FROM ${this.t("workspaces")} WHERE ${clauses.join(" AND ")}
-			 ORDER BY created_at DESC LIMIT $${params.length}`, params);
+				 ORDER BY created_at DESC, id DESC LIMIT $${params.length}`, params);
     return rows.map((r) => this.workspaceFromRow(r));
   }
   async listQueued(limit) {
@@ -32627,6 +33223,7 @@ class PostgresStore {
     launchInput: "launch_input",
     providerKind: "provider_kind",
     providerRef: "provider_ref",
+    provisioningMode: "provisioning_mode",
     registrationDigest: "registration_digest",
     registrationExpiresAt: "registration_expires_at",
     reconnectDigest: "reconnect_digest",
@@ -32642,6 +33239,7 @@ class PostgresStore {
     failureLogTailTruncated: "failure_log_tail_truncated",
     failureLastLogSeq: "failure_last_log_seq",
     resolvedSource: "resolved_source",
+    persistenceCapability: "persistence_capability",
     latestCheckpointId: "latest_checkpoint_id",
     outputs: "outputs"
   };
@@ -32661,6 +33259,7 @@ class PostgresStore {
     "failureLogTailTruncated",
     "failureLastLogSeq",
     "resolvedSource",
+    "persistenceCapability",
     "latestCheckpointId",
     "outputs"
   ]);
@@ -32757,6 +33356,15 @@ class PostgresStore {
       const workspace3 = this.workspaceFromRow(updated[0]);
       await this.appendHistoryTx(tx, workspace3, current.state, req.to, workspace3.reasonCode, req.at);
       await this.appendEventTx(tx, workspace3, req.at);
+      if (isTerminal(req.to)) {
+        const expiresAt = new Date(req.at.getTime() + parseDurationMs(workspace3.templateSnapshot.spec.persistence.conversationRetention));
+        await tx.unsafe(`INSERT INTO ${this.t("workspace_conversations")}
+					 (workspace_id, status, expires_at, deleted_at, updated_at)
+					 VALUES ($1, 'retained', $2, NULL, $3)
+					 ON CONFLICT (workspace_id) DO UPDATE
+					 SET expires_at = EXCLUDED.expires_at, updated_at = EXCLUDED.updated_at
+					 WHERE ${this.t("workspace_conversations")}.status <> 'deleted'`, [workspace3.id, expiresAt, req.at]);
+      }
       return workspace3;
     });
     if (workspace2)
@@ -33124,7 +33732,7 @@ class PostgresStore {
   async appendHistoryTx(tx, row, from, to, reason, at) {
     await tx.unsafe(`INSERT INTO ${this.t("workspace_state_history")}
 				(id, workspace_id, from_state, to_state, reason_code, occurred_at)
-			 VALUES ($1, $2, $3, $4, $5, $6)`, [randomUUID4(), row.id, from, to, reason, at]);
+			 VALUES ($1, $2, $3, $4, $5, $6)`, [randomUUID5(), row.id, from, to, reason, at]);
   }
   async appendEventTx(tx, row, at) {
     const payload = buildEventEnvelope(row, at);
@@ -33190,6 +33798,104 @@ class PostgresStore {
       lastSeq
     };
   }
+  conversationMessageFromRow(row) {
+    return {
+      workspaceId: String(row.workspace_id),
+      seq: Number(row.seq),
+      messageId: String(row.message_id),
+      role: row.role,
+      content: String(row.content),
+      occurredAt: asDate(row.occurred_at),
+      metadata: asJson(row.metadata),
+      createdAt: asDate(row.created_at)
+    };
+  }
+  async appendConversationMessage(input) {
+    return await this.sql.begin(async (tx) => {
+      await tx.unsafe("SELECT pg_advisory_xact_lock(hashtextextended($1, 7081))", [
+        input.workspaceId
+      ]);
+      const states = await tx.unsafe(`SELECT status FROM ${this.t("workspace_conversations")} WHERE workspace_id = $1 FOR UPDATE`, [input.workspaceId]);
+      if (states[0]?.status === "deleted")
+        throw new Error("conversation.deleted");
+      const existing = await tx.unsafe(`SELECT * FROM ${this.t("workspace_conversation_messages")}
+				 WHERE workspace_id = $1 AND message_id = $2`, [input.workspaceId, input.messageId]);
+      if (existing[0]) {
+        return { message: this.conversationMessageFromRow(existing[0]), created: false };
+      }
+      await tx.unsafe(`INSERT INTO ${this.t("workspace_conversations")}
+				 (workspace_id, status, expires_at, deleted_at, updated_at)
+				 VALUES ($1, 'retained', NULL, NULL, $2)
+				 ON CONFLICT (workspace_id) DO NOTHING`, [input.workspaceId, input.createdAt]);
+      const stats = await tx.unsafe(`SELECT COALESCE(MAX(seq), 0)::bigint AS max_seq,
+				        COUNT(*)::bigint AS message_count,
+				        COALESCE(SUM(octet_length(content) + octet_length(metadata::text)), 0)::bigint AS bytes
+				 FROM ${this.t("workspace_conversation_messages")} WHERE workspace_id = $1`, [input.workspaceId]);
+      const inputBytes = Buffer.byteLength(input.content) + Buffer.byteLength(JSON.stringify(input.metadata));
+      if (Number(stats[0]?.message_count ?? 0) >= MAX_CONVERSATION_MESSAGES || Number(stats[0]?.bytes ?? 0) + inputBytes > MAX_CONVERSATION_BYTES) {
+        throw new Error("conversation.quota_exceeded");
+      }
+      const seq = Number(stats[0]?.max_seq ?? 0) + 1;
+      const inserted = await tx.unsafe(`INSERT INTO ${this.t("workspace_conversation_messages")}
+				 (workspace_id, seq, message_id, role, content, occurred_at, metadata, created_at)
+				 VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8) RETURNING *`, [
+        input.workspaceId,
+        seq,
+        input.messageId,
+        input.role,
+        input.content,
+        input.occurredAt,
+        JSON.stringify(input.metadata),
+        input.createdAt
+      ]);
+      return { message: this.conversationMessageFromRow(inserted[0]), created: true };
+    });
+  }
+  async readConversation(workspaceId, afterSeq, limit) {
+    const rows = await this.sql.unsafe(`SELECT * FROM ${this.t("workspace_conversation_messages")}
+			 WHERE workspace_id = $1 AND seq > $2 ORDER BY seq ASC LIMIT $3`, [workspaceId, afterSeq, limit]);
+    return rows.map((row) => this.conversationMessageFromRow(row));
+  }
+  async getConversationState(workspaceId) {
+    const rows = await this.sql.unsafe(`SELECT * FROM ${this.t("workspace_conversations")} WHERE workspace_id = $1`, [workspaceId]);
+    const row = rows[0];
+    return row ? {
+      workspaceId: String(row.workspace_id),
+      status: row.status,
+      expiresAt: asDateOrNull(row.expires_at),
+      deletedAt: asDateOrNull(row.deleted_at),
+      updatedAt: asDate(row.updated_at)
+    } : null;
+  }
+  async setConversationExpiry(workspaceId, expiresAt, at) {
+    await this.sql.unsafe(`INSERT INTO ${this.t("workspace_conversations")}
+			 (workspace_id, status, expires_at, deleted_at, updated_at)
+			 VALUES ($1, 'retained', $2, NULL, $3)
+			 ON CONFLICT (workspace_id) DO UPDATE
+			 SET expires_at = EXCLUDED.expires_at, updated_at = EXCLUDED.updated_at
+			 WHERE ${this.t("workspace_conversations")}.status <> 'deleted'`, [workspaceId, expiresAt, at]);
+  }
+  async deleteConversation(workspaceId, at) {
+    await this.sql.begin(async (tx) => {
+      await tx.unsafe(`DELETE FROM ${this.t("workspace_conversation_messages")} WHERE workspace_id = $1`, [workspaceId]);
+      await tx.unsafe(`INSERT INTO ${this.t("workspace_conversations")}
+				 (workspace_id, status, expires_at, deleted_at, updated_at)
+				 VALUES ($1, 'deleted', NULL, $2, $2)
+				 ON CONFLICT (workspace_id) DO UPDATE
+				 SET status = 'deleted', expires_at = NULL, deleted_at = EXCLUDED.deleted_at,
+				     updated_at = EXCLUDED.updated_at`, [workspaceId, at]);
+    });
+  }
+  async pruneExpiredConversations(at) {
+    const rows = await this.sql.unsafe(`DELETE FROM ${this.t("workspace_conversation_messages")} AS messages
+			 USING ${this.t("workspace_conversations")} AS conversations
+			 WHERE messages.workspace_id = conversations.workspace_id
+			   AND conversations.status = 'retained'
+			   AND conversations.expires_at IS NOT NULL
+			   AND conversations.expires_at <= $1
+			 RETURNING messages.workspace_id`, [at]);
+    return new Set(rows.map((row) => String(row.workspace_id))).size;
+  }
   outboxFromRow(r) {
     return {
       id: String(r.id),
@@ -33227,7 +33933,7 @@ class PostgresStore {
   async appendEvent(workspaceId, eventType, payload, at) {
     await this.sql.unsafe(`INSERT INTO ${this.t("event_outbox")}
 				(id, workspace_id, event_type, payload, occurred_at, next_attempt_at)
-			 VALUES ($1, $2, $3, $4::jsonb, $5, $5)`, [randomUUID4(), workspaceId, eventType, JSON.stringify(payload), at]);
+			 VALUES ($1, $2, $3, $4::jsonb, $5, $5)`, [randomUUID5(), workspaceId, eventType, JSON.stringify(payload), at]);
   }
 }
 // src/index.ts
@@ -38085,7 +38791,7 @@ var yargs_default = Yargs;
 
 // src/server-process.ts
 import { spawn, spawnSync } from "child_process";
-import { createHash as createHash5, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID12 } from "crypto";
 import {
   closeSync,
   existsSync,
@@ -38103,10 +38809,10 @@ import { dirname as dirname5, join as join4, resolve as resolve7 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 
 // ../../apps/pocketcoder-server/src/persistence.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // ../../apps/pocketcoder-server/src/service.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function templateAuthorized(principal, templateName) {
   return principal.templateNames.includes("*") || principal.templateNames.includes(templateName);
 }
@@ -38124,6 +38830,7 @@ function toResource(row) {
     agent_state: row.agentState,
     change_cursor: row.changeSeq,
     provider_kind: row.providerKind,
+    provisioning_mode: row.provisioningMode,
     health: row.health,
     created_at: row.createdAt.toISOString(),
     updated_at: row.updatedAt.toISOString(),
@@ -38143,6 +38850,7 @@ function toResource(row) {
     persistence: {
       enabled: row.templateSnapshot.spec.persistence.mounts.length > 0,
       conversation_restore: row.persistenceCapability,
+      conversation_resume: row.persistenceCapability === "supported" ? { status: "supported", reason: null } : row.persistenceCapability === "filesystem_only" ? { status: "unsupported", reason: "filesystem_only" } : { status: "unknown", reason: "capability_unknown" },
       latest_checkpoint_id: row.latestCheckpointId
     },
     outputs: row.outputs,
@@ -38204,7 +38912,7 @@ class WorkspaceService {
     }
     const now = this.now();
     const result = await store2.insertWorkspace({
-      id: randomUUID5(),
+      id: randomUUID6(),
       principalId: principal.id,
       externalId: body.external_id,
       idempotencyKey,
@@ -38361,8 +39069,8 @@ class PersistenceService {
     }
     this.storageDriver();
     const requestDigest = digestOf({ workspace_id: workspaceId, ...body });
-    const checkpointId = randomUUID6();
-    const operationId = randomUUID6();
+    const checkpointId = randomUUID7();
+    const operationId = randomUUID7();
     const now = this.now();
     const operationResult = await this.deps.store.insertOperation({
       id: operationId,
@@ -38484,6 +39192,7 @@ class PersistenceService {
   }
   async pruneExpired() {
     const now = this.now();
+    const transcriptsDeleted = await this.deps.store.pruneExpiredConversations(now);
     let deleted = 0;
     let skipped = 0;
     for (const principal of await this.deps.store.listPrincipals()) {
@@ -38505,7 +39214,7 @@ class PersistenceService {
         }
       }
     }
-    return { deleted, skipped };
+    return { deleted, skipped, transcriptsDeleted };
   }
   async stopForSnapshot(workspace2, operationId) {
     const hook = workspace2.templateSnapshot.spec.checkpointHook;
@@ -38530,6 +39239,7 @@ class PersistenceService {
   async completePreserve(workspace2, checkpoint, storage, operationId, result, quiesced) {
     const { store: store2, driver: driver2, hub } = this.deps;
     const readyAt = this.now();
+    const conversationRestore = quiesced ? workspace2.persistenceCapability : "filesystem_only";
     await store2.updateCheckpoint(checkpoint.id, {
       state: "ready",
       providerKind: this.storageDriver().kind,
@@ -38539,7 +39249,7 @@ class PersistenceService {
       logicalBytes: result.manifest.logical_bytes,
       storedBytes: result.storedBytes,
       fileCount: result.manifest.file_count,
-      conversationRestore: quiesced ? workspace2.persistenceCapability : "filesystem_only",
+      conversationRestore,
       readyAt
     }, readyAt);
     const readyCheckpoint = await store2.getCheckpoint(checkpoint.id);
@@ -38551,7 +39261,7 @@ class PersistenceService {
       fileCount: result.manifest.file_count,
       retainedUntil: checkpoint.expiresAt
     }, readyAt);
-    await store2.updateWorkspace(workspace2.id, { latestCheckpointId: checkpoint.id }, readyAt);
+    await store2.updateWorkspace(workspace2.id, { latestCheckpointId: checkpoint.id, persistenceCapability: conversationRestore }, readyAt);
     if (workspace2.providerRef) {
       await driver2.remove({
         kind: workspace2.providerKind ?? "",
@@ -38634,9 +39344,9 @@ class PersistenceService {
     const now = this.now();
     const requestDigest = digestOf({ checkpoint_id: checkpointId, ...body });
     await this.assertOperationCapacity(principal.id, "restore", idempotencyKey);
-    const resultWorkspaceId = randomUUID6();
+    const resultWorkspaceId = randomUUID7();
     const operationResult = await this.deps.store.insertOperation({
-      id: randomUUID6(),
+      id: randomUUID7(),
       principalId: principal.id,
       kind: "restore",
       state: "pending",
@@ -38701,7 +39411,7 @@ class PersistenceService {
       throw new ApiError("idempotency.conflict", "The requested external_id is already active.");
     }
     await this.deps.store.appendEvent(checkpoint.workspaceId, "workspace.restore_queued", {
-      id: randomUUID6(),
+      id: randomUUID7(),
       type: "workspace.restore_queued",
       occurred_at: now.toISOString(),
       origin_workspace_id: checkpoint.workspaceId,
@@ -38722,7 +39432,7 @@ class PersistenceService {
     const now = this.now();
     await this.assertOperationCapacity(principal.id, "verify", idempotencyKey);
     const inserted = await this.deps.store.insertOperation({
-      id: randomUUID6(),
+      id: randomUUID7(),
       principalId: principal.id,
       kind: "verify",
       state: "running",
@@ -38762,7 +39472,7 @@ class PersistenceService {
     const now = this.now();
     await this.assertOperationCapacity(principal.id, "delete", idempotencyKey);
     const inserted = await this.deps.store.insertOperation({
-      id: randomUUID6(),
+      id: randomUUID7(),
       principalId: principal.id,
       kind: "delete",
       state: "running",
@@ -38846,7 +39556,7 @@ class PersistenceService {
     });
     const at = this.now();
     await this.deps.store.appendEvent(workspaceId, "workspace.output_published", {
-      id: randomUUID6(),
+      id: randomUUID7(),
       type: "workspace.output_published",
       occurred_at: at.toISOString(),
       workspace_id: workspaceId,
@@ -38890,7 +39600,7 @@ class PersistenceService {
   async emitCheckpointEvent(type, row) {
     const at = this.now();
     await this.deps.store.appendEvent(row.workspaceId, type, {
-      id: randomUUID6(),
+      id: randomUUID7(),
       type,
       occurred_at: at.toISOString(),
       checkpoint: {
@@ -38907,6 +39617,50 @@ class PersistenceService {
 }
 
 // ../../apps/pocketcoder-server/src/config.ts
+function resolveWarmPools2(env2) {
+  const raw = env2.POCKETCODER_WARM_POOLS;
+  if (!raw)
+    return [];
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("POCKETCODER_WARM_POOLS must be valid JSON");
+  }
+  if (!Array.isArray(value))
+    throw new Error("POCKETCODER_WARM_POOLS must be a JSON array");
+  return value.map((item, index2) => {
+    if (!item || typeof item !== "object")
+      throw new Error(`POCKETCODER_WARM_POOLS[${index2}] must be an object`);
+    const entry = item;
+    if (typeof entry.template !== "string" || !entry.template)
+      throw new Error(`POCKETCODER_WARM_POOLS[${index2}].template is required`);
+    const minReady = entry.min_ready === undefined ? 1 : Number(entry.min_ready);
+    if (!Number.isInteger(minReady) || minReady <= 0)
+      throw new Error(`POCKETCODER_WARM_POOLS[${index2}].min_ready must be a positive integer`);
+    const missPolicy = entry.miss_policy ?? "cold";
+    if (missPolicy !== "cold" && missPolicy !== "wait")
+      throw new Error(`POCKETCODER_WARM_POOLS[${index2}].miss_policy must be cold or wait`);
+    const duration4 = (key, fallback) => {
+      const candidate = entry[key] ?? fallback;
+      if (typeof candidate !== "string")
+        throw new Error(`POCKETCODER_WARM_POOLS[${index2}].${key} must be a duration`);
+      try {
+        return parseDurationMs(candidate);
+      } catch {
+        throw new Error(`POCKETCODER_WARM_POOLS[${index2}].${key} must be a duration`);
+      }
+    };
+    return {
+      template: entry.template,
+      ...typeof entry.version === "string" ? { version: entry.version } : {},
+      minReady,
+      maxWarmAgeMs: duration4("max_warm_age", "15m"),
+      missPolicy,
+      waitTimeoutMs: duration4("wait_timeout", "5s")
+    };
+  });
+}
 function intEnv(env2, key, fallback) {
   const raw = env2[key];
   if (!raw)
@@ -39030,7 +39784,8 @@ function loadConfig(env2 = process.env) {
     limits: resolveAdmissionLimits(env2),
     schedulerIntervalMs: intEnv(env2, "POCKETCODER_SCHEDULER_INTERVAL_MS", 1000),
     outboxIntervalMs: intEnv(env2, "POCKETCODER_OUTBOX_INTERVAL_MS", 1000),
-    persistenceLimits: resolvePersistenceLimits(env2)
+    persistenceLimits: resolvePersistenceLimits(env2),
+    warmPools: resolveWarmPools2(env2)
   };
 }
 
@@ -39040,6 +39795,7 @@ import { tmpdir } from "os";
 import { join as join2 } from "path";
 var WORKSPACE_LABEL = "pocketcoder.workspace";
 var DIGEST_LABEL = "pocketcoder.template-digest";
+var POOL_RUNTIME_LABEL = "pocketcoder.pool-runtime";
 async function run(bin, args) {
   const proc = Bun.spawn([bin, ...args], { stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, code] = await Promise.all([
@@ -39148,6 +39904,56 @@ class DockerDriver {
       throw err;
     }
   }
+  async createWarm(launch) {
+    const spec = launch.template.spec;
+    await mkdir(this.opts.inputDir, { recursive: true, mode: 448 });
+    await chmod(this.opts.inputDir, 448);
+    const inputFile = this.inputPath(`pool-${launch.runtimeId}`);
+    await writeFile2(inputFile, JSON.stringify(launch.input), { mode: 420 });
+    const name2 = `pocketcoder-pool-${launch.runtimeId}`;
+    const args = [
+      "run",
+      "--detach",
+      "--name",
+      name2,
+      "--label",
+      `${POOL_RUNTIME_LABEL}=${launch.runtimeId}`,
+      "--label",
+      `${DIGEST_LABEL}=${launch.template.digest}`,
+      "--restart=no",
+      "--user",
+      `${spec.security.uid}:${spec.security.gid}`,
+      "--security-opt",
+      "no-new-privileges",
+      "--cpus",
+      spec.resources.cpu.endsWith("m") ? String(Number(spec.resources.cpu.slice(0, -1)) / 1000) : spec.resources.cpu,
+      "--memory",
+      spec.resources.memory.replace("Mi", "m").replace("Gi", "g"),
+      "-v",
+      `${inputFile}:/run/pocketcoder/input:ro`
+    ];
+    for (const cap of spec.security.dropCapabilities)
+      args.push("--cap-drop", cap);
+    if (spec.security.readOnlyRoot)
+      args.push("--read-only");
+    for (const path of spec.security.writableMemoryPaths) {
+      args.push("--tmpfs", `${path}:rw,noexec,nosuid,size=256m,uid=${spec.security.uid},gid=${spec.security.gid},mode=0700`);
+    }
+    if (this.opts.network)
+      args.push("--network", this.opts.network);
+    if (this.opts.addHostGateway)
+      args.push("--add-host", "host.docker.internal:host-gateway");
+    for (const [key, value] of Object.entries(spec.env))
+      args.push("-e", `${key}=${value}`);
+    args.push(await resolveDockerImage(this.opts.dockerBin, spec.image), ...spec.command);
+    try {
+      const id = await run(this.opts.dockerBin, args);
+      return { kind: this.kind, id, name: name2, poolRuntimeId: launch.runtimeId };
+    } catch (error51) {
+      await rm(inputFile, { force: true });
+      throw error51;
+    }
+  }
   async inspect(ref) {
     try {
       const out = await run(this.opts.dockerBin, [
@@ -39176,6 +39982,11 @@ class DockerDriver {
       await run(this.opts.dockerBin, ["rm", "-f", ref.id]);
     } catch {}
     const name2 = typeof ref.name === "string" ? ref.name : "";
+    const poolRuntimeId = typeof ref.poolRuntimeId === "string" ? ref.poolRuntimeId : "";
+    if (poolRuntimeId) {
+      await rm(this.inputPath(`pool-${poolRuntimeId}`), { force: true });
+      return;
+    }
     const workspaceId = name2.replace(/^pocketcoder-ws-/, "");
     if (workspaceId) {
       await rm(this.inputPath(workspaceId), { force: true });
@@ -39184,6 +39995,9 @@ class DockerDriver {
   async cleanupInput(workspaceId) {
     await rm(this.inputPath(workspaceId), { force: true });
   }
+  async cleanupWarmInput(runtimeId) {
+    await rm(this.inputPath(`pool-${runtimeId}`), { force: true });
+  }
   async list() {
     const out = await run(this.opts.dockerBin, [
       "ps",
@@ -39205,6 +40019,32 @@ class DockerDriver {
       };
     });
   }
+  async listWarm() {
+    const out = await run(this.opts.dockerBin, [
+      "ps",
+      "--all",
+      "--filter",
+      `label=${POOL_RUNTIME_LABEL}`,
+      "--format",
+      `{{.ID}}	{{.Label "${POOL_RUNTIME_LABEL}"}}	{{.Label "${DIGEST_LABEL}"}}`
+    ]);
+    if (!out)
+      return [];
+    return out.split(`
+`).map((line4) => {
+      const [id = "", runtimeId = "", templateDigest = ""] = line4.split("\t");
+      return {
+        runtimeId,
+        templateDigest,
+        ref: {
+          kind: this.kind,
+          id,
+          name: `pocketcoder-pool-${runtimeId}`,
+          poolRuntimeId: runtimeId
+        }
+      };
+    });
+  }
 }
 // ../drivers/src/file-secrets.ts
 import { lstat, realpath } from "fs/promises";
@@ -39761,6 +40601,7 @@ class FilesystemStorageDriver {
 // ../drivers/src/kubernetes.ts
 var KUBERNETES_WORKSPACE_LABEL = "pocketcoder.workspace";
 var KUBERNETES_DIGEST_ANNOTATION = "pocketcoder.dev/template-digest";
+var KUBERNETES_POOL_LABEL = "pocketcoder.pool-runtime";
 async function kubectl(bin, namespace, args, input) {
   const proc = Bun.spawn([bin, "--namespace", namespace, "--request-timeout=30s", ...args], {
     stdout: "pipe",
@@ -39989,6 +40830,102 @@ class KubernetesDriver {
       throw error51;
     }
   }
+  async createWarm(launch) {
+    const spec = launch.template.spec;
+    const name2 = `pocketcoder-pool-${launch.runtimeId}`;
+    const inputSecret = `${name2}-input`;
+    await kubectl(this.kubectlBin, this.namespace, ["apply", "-f", "-"], JSON.stringify({
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: { name: inputSecret, labels: { [KUBERNETES_POOL_LABEL]: launch.runtimeId } },
+      type: "Opaque",
+      stringData: { "input.json": JSON.stringify(launch.input) }
+    }));
+    const memory = spec.security.writableMemoryPaths.map((path, index2) => ({
+      volume: { name: `memory-${index2}`, emptyDir: { medium: "Memory", sizeLimit: "256Mi" } },
+      mount: { name: `memory-${index2}`, mountPath: path }
+    }));
+    const labels = { [KUBERNETES_POOL_LABEL]: launch.runtimeId };
+    const annotations = { [KUBERNETES_DIGEST_ANNOTATION]: launch.template.digest };
+    const manifest = {
+      apiVersion: "batch/v1",
+      kind: "Job",
+      metadata: { name: name2, labels, annotations },
+      spec: {
+        backoffLimit: 0,
+        ttlSecondsAfterFinished: 3600,
+        template: {
+          metadata: { labels, annotations },
+          spec: {
+            restartPolicy: "Never",
+            automountServiceAccountToken: false,
+            ...this.serviceAccountName ? { serviceAccountName: this.serviceAccountName } : {},
+            securityContext: {
+              runAsUser: spec.security.uid,
+              runAsGroup: spec.security.gid,
+              runAsNonRoot: true,
+              fsGroup: spec.security.gid,
+              fsGroupChangePolicy: "OnRootMismatch",
+              seccompProfile: { type: spec.security.seccomp }
+            },
+            containers: [
+              {
+                name: "workspace",
+                image: spec.image,
+                imagePullPolicy: this.imagePullPolicy,
+                command: spec.command,
+                env: Object.entries(spec.env).map(([name3, value]) => ({ name: name3, value })),
+                resources: { requests: spec.resources, limits: spec.resources },
+                securityContext: {
+                  readOnlyRootFilesystem: spec.security.readOnlyRoot,
+                  allowPrivilegeEscalation: spec.security.allowPrivilegeEscalation,
+                  capabilities: { drop: spec.security.dropCapabilities }
+                },
+                volumeMounts: [
+                  {
+                    name: "provider-input",
+                    mountPath: "/run/pocketcoder/input",
+                    subPath: "input.json",
+                    readOnly: true
+                  },
+                  ...memory.map((item) => item.mount)
+                ]
+              }
+            ],
+            volumes: [
+              {
+                name: "provider-input",
+                secret: {
+                  secretName: inputSecret,
+                  items: [{ key: "input.json", path: "input.json" }]
+                }
+              },
+              ...memory.map((item) => item.volume)
+            ]
+          }
+        }
+      }
+    };
+    try {
+      await kubectl(this.kubectlBin, this.namespace, ["apply", "-f", "-"], JSON.stringify(manifest));
+      return {
+        kind: this.kind,
+        id: name2,
+        name: name2,
+        inputSecret,
+        namespace: this.namespace,
+        poolRuntimeId: launch.runtimeId
+      };
+    } catch (error51) {
+      await kubectl(this.kubectlBin, this.namespace, [
+        "delete",
+        "secret",
+        inputSecret,
+        "--ignore-not-found"
+      ]).catch(() => {});
+      throw error51;
+    }
+  }
   async inspect(ref) {
     try {
       const output = await kubectl(this.kubectlBin, this.namespace, [
@@ -40022,7 +40959,7 @@ class KubernetesDriver {
       "delete",
       "pod",
       "-l",
-      `${KUBERNETES_WORKSPACE_LABEL}=${String(ref.name ?? ref.id).replace(/^pocketcoder-ws-/, "")}`,
+      `job-name=${ref.id}`,
       `--grace-period=${graceSeconds}`,
       "--wait=true",
       "--ignore-not-found"
@@ -40052,6 +40989,14 @@ class KubernetesDriver {
       "--ignore-not-found"
     ]).catch(() => {});
   }
+  async cleanupWarmInput(runtimeId) {
+    await kubectl(this.kubectlBin, this.namespace, [
+      "delete",
+      "secret",
+      `pocketcoder-pool-${runtimeId}-input`,
+      "--ignore-not-found"
+    ]).catch(() => {});
+  }
   async list() {
     const output = await kubectl(this.kubectlBin, this.namespace, [
       "get",
@@ -40083,6 +41028,38 @@ class KubernetesDriver {
       ];
     });
   }
+  async listWarm() {
+    const output = await kubectl(this.kubectlBin, this.namespace, [
+      "get",
+      "jobs",
+      "-l",
+      KUBERNETES_POOL_LABEL,
+      "-o",
+      "json"
+    ]);
+    const list = JSON.parse(output);
+    return (list.items ?? []).flatMap((job) => {
+      const runtimeId = job.metadata?.labels?.[KUBERNETES_POOL_LABEL];
+      const name2 = job.metadata?.name;
+      const templateDigest = job.metadata?.annotations?.[KUBERNETES_DIGEST_ANNOTATION];
+      if (!runtimeId || !name2 || !templateDigest)
+        return [];
+      return [
+        {
+          runtimeId,
+          templateDigest,
+          ref: {
+            kind: this.kind,
+            id: name2,
+            name: name2,
+            inputSecret: `${name2}-input`,
+            namespace: this.namespace,
+            poolRuntimeId: runtimeId
+          }
+        }
+      ];
+    });
+  }
 }
 // ../drivers/src/kubernetes-secrets.ts
 function collect(workspace2) {
@@ -40189,13 +41166,18 @@ class KubernetesPvcStorageDriver {
 class FakeDriver {
   kind = "fake";
   created = [];
+  warmCreated = [];
   terminated = [];
   stopped = [];
   failNextCreate = false;
+  createDelayMs = 0;
   counter = 0;
   live = new Map;
   stoppedIds = new Set;
+  warm = new Map;
   async create(launch) {
+    if (this.createDelayMs > 0)
+      await new Promise((resolve7) => setTimeout(resolve7, this.createDelayMs));
     if (this.failNextCreate) {
       this.failNextCreate = false;
       throw new Error("fake driver create failure");
@@ -40210,8 +41192,23 @@ class FakeDriver {
     });
     return ref;
   }
+  async createWarm(launch) {
+    this.warmCreated.push(launch);
+    this.counter += 1;
+    const ref = {
+      kind: this.kind,
+      id: `fake-warm-${this.counter}`,
+      poolRuntimeId: launch.runtimeId
+    };
+    this.warm.set(launch.runtimeId, {
+      runtimeId: launch.runtimeId,
+      templateDigest: launch.template.digest,
+      ref
+    });
+    return ref;
+  }
   async inspect(ref) {
-    const exists3 = [...this.live.values()].some((p) => p.ref.id === ref.id);
+    const exists3 = [...this.live.values(), ...this.warm.values()].some((p) => p.ref.id === ref.id);
     return {
       exists: exists3,
       running: exists3 && !this.stoppedIds.has(ref.id),
@@ -40229,10 +41226,16 @@ class FakeDriver {
       if (p.ref.id === ref.id)
         this.live.delete(wsId);
     }
+    for (const [id, p] of this.warm)
+      if (p.ref.id === ref.id)
+        this.warm.delete(id);
   }
   async list() {
     return [...this.live.values()];
   }
+  async listWarm() {
+    return [...this.warm.values()];
+  }
   inputFor(workspaceId) {
     return this.created.find((l) => l.workspace.id === workspaceId)?.input;
   }
@@ -40241,7 +41244,7 @@ class FakeDriver {
 var PLACEHOLDER_DIGEST = "a".repeat(64);
 var OTHER_DIGEST = "b".repeat(64);
 // ../testkit/src/memory-store.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var ACTIVE_STATES = [
   "provisioning",
   "connected",
@@ -40250,6 +41253,8 @@ var ACTIVE_STATES = [
   "terminating"
 ];
 var MAX_LOG_BYTES2 = 10 * 1024 * 1024;
+var MAX_CONVERSATION_BYTES2 = 50 * 1024 * 1024;
+var MAX_CONVERSATION_MESSAGES2 = 1e5;
 var CHANGE_PATCH_KEYS = new Set([
   "connectedAt",
   "disconnectedAt",
@@ -40259,6 +41264,7 @@ var CHANGE_PATCH_KEYS = new Set([
   "failureLogTailTruncated",
   "failureLastLogSeq",
   "resolvedSource",
+  "persistenceCapability",
   "latestCheckpointId",
   "outputs"
 ]);
@@ -40268,6 +41274,7 @@ class MemoryStore {
   principals = [];
   keys = [];
   workspaces = new Map;
+  warmPoolRuntimes = new Map;
   history = [];
   outbox = [];
   logs = new Map;
@@ -40277,6 +41284,9 @@ class MemoryStore {
   checkpoints = new Map;
   operations = new Map;
   outputs = new Map;
+  conversations = new Map;
+  conversationBytes = new Map;
+  conversationStates = new Map;
   changeWaiters = new Map;
   async init() {}
   async close() {
@@ -40303,7 +41313,7 @@ class MemoryStore {
       return { row: existing, created: false, conflict: false };
     }
     const row = {
-      id: randomUUID7(),
+      id: randomUUID8(),
       name: input.name,
       version: input.version,
       digest: input.digest,
@@ -40338,12 +41348,58 @@ class MemoryStore {
       row.retiredAt = status === "retired" ? new Date : null;
     }
   }
+  async insertWarmPoolRuntime(row) {
+    const existing = this.warmPoolRuntimes.get(row.id);
+    if (existing)
+      return { ...existing };
+    this.warmPoolRuntimes.set(row.id, { ...row });
+    return { ...row };
+  }
+  async getWarmPoolRuntime(id) {
+    const row = this.warmPoolRuntimes.get(id);
+    return row ? { ...row } : null;
+  }
+  async listWarmPoolRuntimes() {
+    return [...this.warmPoolRuntimes.values()].map((row) => ({ ...row }));
+  }
+  async updateWarmPoolRuntime(id, patch, at) {
+    const row = this.warmPoolRuntimes.get(id);
+    if (!row)
+      return;
+    Object.assign(row, patch);
+    row.updatedAt = at;
+  }
+  async claimWarmPoolRuntime(claim) {
+    const workspace2 = this.workspaces.get(claim.workspaceId);
+    if (workspace2?.state !== "queued")
+      return null;
+    const runtime = [...this.warmPoolRuntimes.values()].filter((row) => row.state === "ready" && row.templateDigest === claim.templateDigest && row.driverKind === claim.driverKind && row.eligibilityFingerprint === claim.eligibilityFingerprint).sort((a, b) => (a.readyAt?.getTime() ?? 0) - (b.readyAt?.getTime() ?? 0))[0];
+    if (!runtime?.providerRef)
+      return null;
+    runtime.state = "leasing";
+    runtime.workspaceId = workspace2.id;
+    runtime.leasedAt = claim.at;
+    runtime.updatedAt = claim.at;
+    workspace2.state = "provisioning";
+    workspace2.provisioningMode = "warm";
+    workspace2.providerKind = runtime.driverKind;
+    workspace2.providerRef = runtime.providerRef;
+    workspace2.registrationDigest = claim.registrationDigest;
+    workspace2.registrationExpiresAt = claim.registrationExpiresAt;
+    workspace2.launchAttempts += 1;
+    workspace2.changeSeq += 1;
+    workspace2.updatedAt = claim.at;
+    this.appendHistory(workspace2, "queued", "provisioning", null, claim.at);
+    this.appendWorkspaceEvent(workspace2, claim.at);
+    this.notifyWorkspaceChange(workspace2.id);
+    return { runtime: { ...runtime }, workspace: { ...workspace2 } };
+  }
   async createPrincipal(name2, scopes2, templateNames) {
     if (this.principals.some((p) => p.name === name2)) {
       throw new Error(`principal exists: ${name2}`);
     }
     const row = {
-      id: randomUUID7(),
+      id: randomUUID8(),
       name: name2,
       scopes: scopes2,
       templateNames,
@@ -40426,6 +41482,7 @@ class MemoryStore {
       launchInput: row.launchInput,
       providerKind: null,
       providerRef: null,
+      provisioningMode: null,
       registrationDigest: null,
       registrationExpiresAt: null,
       reconnectDigest: null,
@@ -40467,7 +41524,15 @@ class MemoryStore {
       rows = rows.filter((w) => w.state === filter.state);
     if (filter.template)
       rows = rows.filter((w) => w.templateName === filter.template);
-    rows.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+    if (filter.metadata) {
+      rows = rows.filter((w) => Object.entries(filter.metadata ?? {}).every(([key, value]) => w.metadata[key] === value));
+    }
+    const { createdAfter, createdBefore } = filter;
+    if (createdAfter)
+      rows = rows.filter((w) => w.createdAt >= createdAfter);
+    if (createdBefore)
+      rows = rows.filter((w) => w.createdAt < createdBefore);
+    rows.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || b.id.localeCompare(a.id));
     if (filter.cursor) {
       const idx = rows.findIndex((w) => w.id === filter.cursor);
       if (idx >= 0)
@@ -40561,6 +41626,16 @@ class MemoryStore {
       row.terminalAt = req.at;
       row.launchInput = null;
       row.registrationDigest = null;
+      const current = this.conversationStates.get(id);
+      if (current?.status !== "deleted") {
+        this.conversationStates.set(id, {
+          workspaceId: id,
+          status: "retained",
+          expiresAt: new Date(req.at.getTime() + parseDurationMs(row.templateSnapshot.spec.persistence.conversationRetention)),
+          deletedAt: null,
+          updatedAt: req.at
+        });
+      }
     }
     this.appendHistory(row, fromState, req.to, row.reasonCode, req.at);
     this.appendWorkspaceEvent(row, req.at);
@@ -40677,7 +41752,7 @@ class MemoryStore {
   }
   appendHistory(row, from, to, reason, at) {
     this.history.push({
-      id: randomUUID7(),
+      id: randomUUID8(),
       workspaceId: row.id,
       fromState: from,
       toState: to,
@@ -40735,6 +41810,76 @@ class MemoryStore {
       lastSeq
     };
   }
+  async appendConversationMessage(input) {
+    const state = this.conversationStates.get(input.workspaceId);
+    if (state?.status === "deleted")
+      throw new Error("conversation.deleted");
+    const rows = this.conversations.get(input.workspaceId) ?? [];
+    const existing = rows.find((row) => row.messageId === input.messageId);
+    if (existing)
+      return { message: { ...existing }, created: false };
+    const storedBytes = this.conversationBytes.get(input.workspaceId) ?? 0;
+    const inputBytes = Buffer.byteLength(input.content) + Buffer.byteLength(JSON.stringify(input.metadata));
+    if (rows.length >= MAX_CONVERSATION_MESSAGES2 || storedBytes + inputBytes > MAX_CONVERSATION_BYTES2) {
+      throw new Error("conversation.quota_exceeded");
+    }
+    const message = { ...input, seq: (rows.at(-1)?.seq ?? 0) + 1 };
+    rows.push(message);
+    this.conversations.set(input.workspaceId, rows);
+    this.conversationBytes.set(input.workspaceId, storedBytes + inputBytes);
+    if (!state) {
+      this.conversationStates.set(input.workspaceId, {
+        workspaceId: input.workspaceId,
+        status: "retained",
+        expiresAt: null,
+        deletedAt: null,
+        updatedAt: input.createdAt
+      });
+    }
+    return { message: { ...message }, created: true };
+  }
+  async readConversation(workspaceId, afterSeq, limit) {
+    return (this.conversations.get(workspaceId) ?? []).filter((row) => row.seq > afterSeq).slice(0, limit).map((row) => ({ ...row, metadata: { ...row.metadata } }));
+  }
+  async getConversationState(workspaceId) {
+    const row = this.conversationStates.get(workspaceId);
+    return row ? { ...row } : null;
+  }
+  async setConversationExpiry(workspaceId, expiresAt, at) {
+    const current = this.conversationStates.get(workspaceId);
+    if (current?.status === "deleted")
+      return;
+    this.conversationStates.set(workspaceId, {
+      workspaceId,
+      status: "retained",
+      expiresAt,
+      deletedAt: null,
+      updatedAt: at
+    });
+  }
+  async deleteConversation(workspaceId, at) {
+    this.conversations.delete(workspaceId);
+    this.conversationBytes.delete(workspaceId);
+    this.conversationStates.set(workspaceId, {
+      workspaceId,
+      status: "deleted",
+      expiresAt: null,
+      deletedAt: at,
+      updatedAt: at
+    });
+  }
+  async pruneExpiredConversations(at) {
+    let deleted = 0;
+    for (const state of this.conversationStates.values()) {
+      if (state.status !== "retained" || !state.expiresAt || state.expiresAt > at)
+        continue;
+      if ((this.conversations.get(state.workspaceId)?.length ?? 0) > 0)
+        deleted += 1;
+      this.conversations.delete(state.workspaceId);
+      this.conversationBytes.delete(state.workspaceId);
+    }
+    return deleted;
+  }
   async claimDueEvents(now, limit) {
     const due = this.outbox.filter((e) => !e.deliveredAt && e.nextAttemptAt <= now && !this.claimedEvents.has(e.id)).sort((a, b) => a.occurredAt.getTime() - b.occurredAt.getTime()).slice(0, limit);
     for (const e of due)
@@ -40760,7 +41905,7 @@ class MemoryStore {
   }
   async appendEvent(workspaceId, eventType, payload, at) {
     this.outbox.push({
-      id: randomUUID7(),
+      id: randomUUID8(),
       workspaceId,
       eventType,
       payload,
@@ -40772,6 +41917,9 @@ class MemoryStore {
     });
   }
 }
+// ../../apps/pocketcoder-server/src/app.ts
+import { randomUUID as randomUUID11 } from "crypto";
+
 // ../../node_modules/.bun/@asteasolutions+zod-to-openapi@8.5.0+68a1e3a0c4588df3/node_modules/@asteasolutions/zod-to-openapi/dist/index.mjs
 function __rest(s, e) {
   var t = {};
@@ -44393,7 +45541,7 @@ var createBunWebSocket = () => ({
 });
 
 // ../../apps/pocketcoder-server/src/hub.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var MAX_INFLIGHT_RELAY = 16;
 
 class Hub {
@@ -44502,12 +45650,12 @@ class Hub {
   relay(workspaceId, request) {
     const conn = this.byWorkspace.get(workspaceId);
     if (!conn?.registered) {
-      return Promise.resolve({ request_id: randomUUID8(), headers: {}, error_code: "unreachable" });
+      return Promise.resolve({ request_id: randomUUID9(), headers: {}, error_code: "unreachable" });
     }
     if (conn.inflight.size >= MAX_INFLIGHT_RELAY) {
-      return Promise.resolve({ request_id: randomUUID8(), headers: {}, error_code: "deadline" });
+      return Promise.resolve({ request_id: randomUUID9(), headers: {}, error_code: "deadline" });
     }
-    const requestId = randomUUID8();
+    const requestId = randomUUID9();
     return new Promise((resolve7) => {
       const timer = setTimeout(() => {
         conn.inflight.delete(requestId);
@@ -44543,9 +45691,9 @@ class Hub {
 }
 
 // ../../apps/pocketcoder-server/src/middleware.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var requestId = async (c, next) => {
-  c.set("requestId", randomUUID9());
+  c.set("requestId", randomUUID10());
   await next();
 };
 function machineAuth(store2, pepper) {
@@ -44583,14 +45731,100 @@ function requireScope(scope) {
   };
 }
 function handleError(err, c) {
-  const id = c.get("requestId") ?? randomUUID9();
+  const id = c.get("requestId") ?? randomUUID10();
   if (err instanceof ApiError) {
-    return c.json(errorEnvelope(err.code, err.message, id), err.status);
+    return c.json(errorEnvelope(err.code, err.message, id, err.details), err.status);
   }
   console.error(`[pocketcoder] request ${id} failed:`, err instanceof Error ? err.message : err);
   return c.json(errorEnvelope("internal.error", "Internal error.", id), 500);
 }
 
+// ../../apps/pocketcoder-server/src/pool-ws.ts
+class PoolConnectionHub {
+  connections = new Map;
+  attach(runtimeId, ws) {
+    this.connections.get(runtimeId)?.close(1008, "superseded pool connection");
+    this.connections.set(runtimeId, ws);
+  }
+  detach(runtimeId, ws) {
+    if (this.connections.get(runtimeId) === ws)
+      this.connections.delete(runtimeId);
+  }
+  assign(runtimeId, input) {
+    const ws = this.connections.get(runtimeId);
+    if (!ws)
+      return false;
+    const frame = LeaseAssignmentFrameSchema.parse({
+      v: POOL_PROTOCOL_VERSION,
+      type: "lease_assignment",
+      input
+    });
+    try {
+      ws.send(JSON.stringify(frame));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  isConnected(runtimeId) {
+    return this.connections.has(runtimeId);
+  }
+  close(runtimeId) {
+    const ws = this.connections.get(runtimeId);
+    this.connections.delete(runtimeId);
+    ws?.close(1000, "pool runtime drained");
+  }
+}
+function poolConnectValidator(deps) {
+  return async (c, next) => {
+    const reject = (message) => c.json(errorEnvelope("auth.invalid_key", message, c.get("requestId") ?? ""), 401);
+    if (Number(c.req.header(HEADER_PROTOCOL)) !== POOL_PROTOCOL_VERSION)
+      return reject("Unsupported pool protocol version.");
+    const runtimeId = c.req.header(HEADER_POOL_RUNTIME) ?? "";
+    const secret = c.req.header(HEADER_POOL_ENROLLMENT) ?? "";
+    const row = runtimeId ? await deps.store.getWarmPoolRuntime(runtimeId) : null;
+    if (row?.state !== "provisioning" || !row.enrollmentDigest || !row.enrollmentExpiresAt || row.enrollmentExpiresAt <= new Date || !verifyOpaque(deps.pepper, secret, row.enrollmentDigest)) {
+      return reject("Invalid or expired pool enrollment credential.");
+    }
+    c.set("poolAuth", { runtimeId });
+    await next();
+  };
+}
+function poolWsEvents(deps) {
+  return (c) => {
+    const auth = c.get("poolAuth");
+    let registered = false;
+    return {
+      onMessage: (event, ws) => {
+        (async () => {
+          if (registered) {
+            ws.close(1008, "pool runtime already registered");
+            return;
+          }
+          const raw2 = typeof event.data === "string" ? event.data : Buffer.from(event.data).toString("utf8");
+          const parsed = PoolRegisteredFrameSchema.safeParse(JSON.parse(raw2));
+          const row = await deps.store.getWarmPoolRuntime(auth.runtimeId);
+          if (!parsed.success || !row || parsed.data.pool_runtime_id !== row.id || parsed.data.template.digest !== row.templateDigest || parsed.data.template.name !== row.templateName || parsed.data.template.version !== row.templateVersion) {
+            ws.close(1008, "invalid pool registration");
+            return;
+          }
+          deps.hub.attach(row.id, ws);
+          registered = await deps.manager.markReady(row.id);
+          if (!registered)
+            ws.close(1008, "pool registration no longer valid");
+        })().catch((error51) => {
+          deps.log?.(`pool ws ${auth.runtimeId}: ${String(error51)}`);
+          ws.close(1011, "pool registration failed");
+        });
+      },
+      onClose: (_event, ws) => {
+        deps.hub.detach(auth.runtimeId, ws);
+        deps.manager.disconnected(auth.runtimeId);
+      }
+    };
+  };
+}
+
 // ../../apps/pocketcoder-server/src/relay.ts
 var SAFE_RESPONSE_HEADERS = ["content-type"];
 function requestPath(c, workspaceId, serviceName) {
@@ -44933,6 +46167,25 @@ async function handleConnectedFrame(deps, connection, ws, frame, closeProtocol)
       return;
     case "restore_status":
       return;
+    case "conversation_message": {
+      const workspace2 = await deps.store.getWorkspace(frame.workspace_id);
+      if (!workspace2 || isTerminal(workspace2.state))
+        return;
+      try {
+        await deps.store.appendConversationMessage({
+          workspaceId: frame.workspace_id,
+          messageId: frame.payload.message_id,
+          role: frame.payload.role,
+          content: frame.payload.content,
+          occurredAt: new Date(frame.payload.occurred_at),
+          metadata: frame.payload.metadata,
+          createdAt: new Date
+        });
+      } catch (error51) {
+        deps.log?.(`conversation ${frame.workspace_id}: ${String(error51)}`);
+      }
+      return;
+    }
   }
 }
 function parseFrame(data, auth, connection, ws, closeProtocol) {
@@ -45026,6 +46279,35 @@ function safeTemplateItem(row) {
     status: row.status
   };
 }
+var WorkspaceMetadataFilterSchema = exports_external.record(exports_external.string().min(1).max(64), exports_external.string().max(512)).refine((value) => Object.keys(value).length <= 16, "metadata filter has at most 16 keys");
+function parseMetadataFilter(value) {
+  if (!value)
+    return;
+  try {
+    const parsed = WorkspaceMetadataFilterSchema.safeParse(JSON.parse(value));
+    if (parsed.success)
+      return parsed.data;
+  } catch {}
+  throw new ApiError("validation.invalid", "metadata must be a JSON object containing bounded string keys and values.");
+}
+function workspaceListFilterOf(query) {
+  const metadata = parseMetadataFilter(query.metadata);
+  const createdAfter = query.created_after ? new Date(query.created_after) : undefined;
+  const createdBefore = query.created_before ? new Date(query.created_before) : undefined;
+  if (createdAfter && createdBefore && createdAfter >= createdBefore) {
+    throw new ApiError("validation.invalid", "created_after must be before created_before.");
+  }
+  return {
+    ...query.external_id ? { externalId: query.external_id } : {},
+    ...query.state ? { state: query.state } : {},
+    ...query.template ? { template: query.template } : {},
+    ...metadata ? { metadata } : {},
+    ...createdAfter ? { createdAfter } : {},
+    ...createdBefore ? { createdBefore } : {},
+    limit: query.limit,
+    ...query.cursor ? { cursor: query.cursor } : {}
+  };
+}
 var WorkspaceCreateHeadersSchema = exports_external.object({
   "Idempotency-Key": exports_external.string().min(1).max(256).openapi({
     description: "Opaque caller key. Reusing it with the same request returns the original workspace; a different request returns idempotency.conflict.",
@@ -45035,6 +46317,20 @@ var WorkspaceCreateHeadersSchema = exports_external.object({
 function buildServer(deps) {
   const { store: store2, driver: driver2, pepper, limits, log } = deps;
   const hub = new Hub;
+  const poolHub = new PoolConnectionHub;
+  const secretFactory = {
+    generate: generateOpaqueSecret,
+    digest: (secret) => digestOpaque(pepper, secret)
+  };
+  const warmPool = deps.warmPools ? new WarmPoolManager({
+    store: store2,
+    driver: driver2,
+    connections: poolHub,
+    secrets: secretFactory,
+    workspaceServerUrl: deps.workspaceServerUrl,
+    pools: deps.warmPools,
+    onError: (context, error51) => log?.(`${context}: ${String(error51)}`)
+  }) : undefined;
   const persistenceHolder = {};
   const scheduler2 = new Scheduler({
     store: store2,
@@ -45042,12 +46338,10 @@ function buildServer(deps) {
     ...deps.storageDriver ? { storageDriver: deps.storageDriver } : {},
     ...deps.secretResolver ? { secretResolver: deps.secretResolver } : {},
     connections: hub,
-    secrets: {
-      generate: generateOpaqueSecret,
-      digest: (secret) => digestOpaque(pepper, secret)
-    },
+    secrets: secretFactory,
     limits,
     workspaceServerUrl: deps.workspaceServerUrl,
+    ...warmPool ? { warmPool } : {},
     preserveByPolicy: async (row, trigger) => persistenceHolder.service?.preserveByPolicy(row, trigger) ?? false,
     onError: (context, err) => log?.(`scheduler ${context}: ${String(err)}`)
   });
@@ -45091,6 +46385,9 @@ function buildServer(deps) {
     persistence: persistence2
   };
   app.get("/v1/agent/connect", agentConnectValidator(wsDeps), upgradeWebSocket2(agentWsEvents(wsDeps)));
+  if (warmPool) {
+    app.get("/v1/agent/pool-connect", poolConnectValidator({ store: store2, pepper }), upgradeWebSocket2(poolWsEvents({ store: store2, hub: poolHub, manager: warmPool, ...log ? { log } : {} })));
+  }
   app.doc("/v1/openapi.json", {
     openapi: "3.0.0",
     info: {
@@ -45120,6 +46417,26 @@ function buildServer(deps) {
     const rows = await store2.listTemplates(names);
     return c.json({ items: rows.map(safeTemplateItem) }, 200);
   });
+  if (warmPool) {
+    app.openapi(createRoute({
+      method: "get",
+      path: "/v1/warm-pools",
+      middleware: [requireScope("admin")],
+      responses: {
+        200: {
+          description: "Warm runtime inventory and cumulative metrics",
+          content: {
+            "application/json": {
+              schema: exports_external.object({
+                items: exports_external.array(exports_external.record(exports_external.string(), exports_external.unknown())),
+                metrics: exports_external.record(exports_external.string(), exports_external.number())
+              })
+            }
+          }
+        }
+      }
+    }), async (c) => c.json(await warmPool.inventory(), 200));
+  }
   app.openapi(createRoute({
     method: "get",
     path: "/v1/storage/inventory",
@@ -45152,13 +46469,21 @@ function buildServer(deps) {
           "application/json": {
             schema: exports_external.object({
               deleted: exports_external.number(),
-              skipped: exports_external.number()
+              skipped: exports_external.number(),
+              transcripts_deleted: exports_external.number()
             })
           }
         }
       }
     }
-  }), async (c) => c.json(await persistence2.pruneExpired(), 200));
+  }), async (c) => {
+    const result = await persistence2.pruneExpired();
+    return c.json({
+      deleted: result.deleted,
+      skipped: result.skipped,
+      transcripts_deleted: result.transcriptsDeleted
+    }, 200);
+  });
   app.openapi(createRoute({
     method: "post",
     path: "/v1/workspaces/{id}/preserve",
@@ -45366,6 +46691,131 @@ function buildServer(deps) {
       operation: toOperationResource(result.operation)
     }, 202);
   });
+  app.openapi(createRoute({
+    method: "post",
+    path: "/v1/workspaces/{id}/resume",
+    middleware: [requireScope("workspaces:restore")],
+    request: {
+      params: exports_external.object({ id: exports_external.uuid() }),
+      headers: exports_external.object({ "idempotency-key": exports_external.string().min(1).max(256) }),
+      body: { content: { "application/json": { schema: RestoreRequestSchema } } }
+    },
+    responses: {
+      202: {
+        description: "New workspace queued with supported conversation context",
+        content: {
+          "application/json": {
+            schema: exports_external.object({
+              workspace: WorkspaceResourceSchema,
+              operation: OperationResourceSchema,
+              resume: ConversationResumeOutcomeSchema
+            })
+          }
+        }
+      }
+    }
+  }), async (c) => {
+    const principal = c.get("principal");
+    const source = await service.getOwned(principal, c.req.valid("param").id);
+    const checkpoints = await store2.listCheckpoints(principal.id, {
+      workspaceId: source.id,
+      state: "ready"
+    });
+    const checkpoint = checkpoints[0];
+    if (!checkpoint) {
+      throw new ApiError("checkpoint.none_ready", "Workspace has no ready checkpoint.");
+    }
+    if (checkpoint.conversationRestore !== "supported") {
+      const reason = checkpoint.conversationRestore === "filesystem_only" ? "filesystem_only" : "capability_unknown";
+      throw new ApiError("resume.unsupported", "This checkpoint cannot restore conversation context.", { reason, checkpoint_id: checkpoint.id });
+    }
+    const result = await persistence2.restore(principal, checkpoint.id, c.req.valid("json"), c.req.valid("header")["idempotency-key"]);
+    const workspace2 = await service.getOwned(principal, result.workspaceId);
+    return c.json({
+      workspace: toResource(workspace2),
+      operation: toOperationResource(result.operation),
+      resume: {
+        status: "supported",
+        reason: null,
+        source_workspace_id: source.id,
+        checkpoint_id: checkpoint.id
+      }
+    }, 202);
+  });
+  app.openapi(createRoute({
+    method: "get",
+    path: "/v1/workspaces/{id}/conversation",
+    middleware: [requireScope("conversations:read")],
+    request: {
+      params: exports_external.object({ id: exports_external.uuid() }),
+      query: ConversationListQuerySchema
+    },
+    responses: {
+      200: {
+        description: "Durable conversation transcript for an active or terminal workspace",
+        content: {
+          "application/json": {
+            schema: exports_external.object({
+              items: exports_external.array(ConversationMessageResourceSchema),
+              next_cursor: exports_external.number().int().positive().nullable(),
+              retention: exports_external.object({
+                status: exports_external.literal("retained"),
+                expires_at: exports_external.iso.datetime().nullable()
+              })
+            })
+          }
+        }
+      }
+    }
+  }), async (c) => {
+    const principal = c.get("principal");
+    const workspace2 = await service.getOwned(principal, c.req.valid("param").id);
+    const state = await store2.getConversationState(workspace2.id);
+    if (state?.status === "deleted") {
+      throw new ApiError("conversation.deleted", "Conversation history was deleted.");
+    }
+    const expiresAt = state?.expiresAt ?? (workspace2.terminalAt ? new Date(workspace2.terminalAt.getTime() + parseDurationMs(workspace2.templateSnapshot.spec.persistence.conversationRetention)) : null);
+    if (expiresAt && expiresAt <= new Date) {
+      throw new ApiError("conversation.expired", "Conversation history has expired.");
+    }
+    const { after, limit } = c.req.valid("query");
+    const rows = await store2.readConversation(workspace2.id, after, limit);
+    const last = rows.at(-1);
+    return c.json({
+      items: rows.map((row) => ({
+        message_id: row.messageId,
+        seq: row.seq,
+        role: row.role,
+        content: row.content,
+        occurred_at: row.occurredAt.toISOString(),
+        metadata: row.metadata
+      })),
+      next_cursor: rows.length === limit && last ? last.seq : null,
+      retention: { status: "retained", expires_at: expiresAt?.toISOString() ?? null }
+    }, 200);
+  });
+  app.openapi(createRoute({
+    method: "delete",
+    path: "/v1/workspaces/{id}/conversation",
+    middleware: [requireScope("conversations:delete")],
+    request: { params: exports_external.object({ id: exports_external.uuid() }) },
+    responses: { 204: { description: "Conversation content deleted idempotently" } }
+  }), async (c) => {
+    const principal = c.get("principal");
+    const workspace2 = await service.getOwned(principal, c.req.valid("param").id);
+    const at = new Date;
+    const previous = await store2.getConversationState(workspace2.id);
+    await store2.deleteConversation(workspace2.id, at);
+    if (previous?.status !== "deleted") {
+      await store2.appendEvent(workspace2.id, "workspace.conversation_deleted", {
+        id: randomUUID11(),
+        type: "workspace.conversation_deleted",
+        occurred_at: at.toISOString(),
+        workspace_id: workspace2.id
+      }, at);
+    }
+    return c.body(null, 204);
+  });
   app.openapi(createRoute({
     method: "get",
     path: "/v1/workspaces/{id}/outputs",
@@ -45480,13 +46930,7 @@ function buildServer(deps) {
   }), async (c) => {
     const principal = c.get("principal");
     const query = c.req.valid("query");
-    const rows = await store2.listWorkspaces(principal.id, {
-      ...query.external_id ? { externalId: query.external_id } : {},
-      ...query.state ? { state: query.state } : {},
-      ...query.template ? { template: query.template } : {},
-      limit: query.limit,
-      ...query.cursor ? { cursor: query.cursor } : {}
-    });
+    const rows = await store2.listWorkspaces(principal.id, workspaceListFilterOf(query));
     const last = rows[rows.length - 1];
     return c.json({
       items: rows.map(toResource),
@@ -45609,7 +47053,15 @@ function buildServer(deps) {
     }, 200);
   });
   app.on(["GET", "POST", "PUT", "PATCH", "DELETE"], "/v1/workspaces/:id/services/:service/*", requireScope("services:relay"), relayHandler({ store: store2, hub, service }));
-  return { app, websocket: websocket2, hub, scheduler: scheduler2, service, persistence: persistence2 };
+  return {
+    app,
+    websocket: websocket2,
+    hub,
+    scheduler: scheduler2,
+    service,
+    persistence: persistence2,
+    ...warmPool ? { warmPool } : {}
+  };
 }
 
 // ../../apps/pocketcoder-server/src/lifecycle.ts
@@ -45698,9 +47150,11 @@ async function startPocketcoderServer(config2 = loadConfig(), options = {}) {
   try {
     await loadConfiguredTemplates(store2, config2.templateDir, log);
     const driver2 = createWorkspaceDriver(config2);
+    const warmPools = await resolveWarmPools(store2, config2.warmPools, driver2.kind, config2.limits.globalActiveWorkspaces);
+    const warmPoolContinuously = warmPools.length > 0 || (await store2.listWarmPoolRuntimes()).some((runtime) => runtime.state !== "failed");
     const storageDriver = createStorageDriver(config2);
     const secretResolver = createSecretResolver(config2);
-    const { app, websocket: websocket2, scheduler: scheduler2, persistence: persistence2 } = buildServer({
+    const { app, websocket: websocket2, scheduler: scheduler2, persistence: persistence2, warmPool } = buildServer({
       store: store2,
       driver: driver2,
       ...storageDriver ? { storageDriver } : {},
@@ -45710,7 +47164,8 @@ async function startPocketcoderServer(config2 = loadConfig(), options = {}) {
       workspaceServerUrl: config2.workspaceServerUrl,
       persistenceLimits: config2.persistenceLimits,
       ...options.instanceId ? { instanceId: options.instanceId } : {},
-      log
+      log,
+      warmPools
     });
     await reconcileStartup(store2, driver2, storageDriver, log);
     const outbox2 = new OutboxDispatcher({
@@ -45721,6 +47176,7 @@ async function startPocketcoderServer(config2 = loadConfig(), options = {}) {
     });
     const schedulerTimer = startExclusiveTimer(config2.schedulerIntervalMs, () => scheduler2.tick(), "scheduler tick failed", log);
     const outboxTimer = startExclusiveTimer(config2.outboxIntervalMs, () => outbox2.tick(), "outbox tick failed", log);
+    const warmPoolTimer = warmPool && warmPoolContinuously ? startExclusiveTimer(config2.schedulerIntervalMs, () => warmPool.reconcile(), "warm pool reconciliation failed", log) : null;
     const retentionTimer = startExclusiveTimer(60000, async () => {
       const { deleted, skipped } = await persistence2.pruneExpired();
       if (deleted > 0 || skipped > 0) {
@@ -45739,12 +47195,16 @@ async function startPocketcoderServer(config2 = loadConfig(), options = {}) {
       clearInterval(schedulerTimer);
       clearInterval(outboxTimer);
       clearInterval(retentionTimer);
+      if (warmPoolTimer)
+        clearInterval(warmPoolTimer);
       throw error51;
     }
     const healthHost = config2.listenHost === "0.0.0.0" || config2.listenHost === "::" ? "127.0.0.1" : config2.listenHost;
     const url2 = `http://${healthHost}:${server.port}`;
     log(`listening on http://${config2.listenHost}:${server.port}`);
     log(`workspaces reach this server at ${config2.workspaceServerUrl}`);
+    if (warmPool)
+      warmPool.reconcile().catch((error51) => log(`warm pool initial reconcile failed: ${String(error51)}`));
     let stopPromise = null;
     return {
       config: config2,
@@ -45757,6 +47217,8 @@ async function startPocketcoderServer(config2 = loadConfig(), options = {}) {
           clearInterval(schedulerTimer);
           clearInterval(outboxTimer);
           clearInterval(retentionTimer);
+          if (warmPoolTimer)
+            clearInterval(warmPoolTimer);
           await server.stop(true);
           await store2.close();
         })();
@@ -45812,7 +47274,7 @@ function readState() {
 function writeState(state) {
   const path = statePath();
   mkdirSync(dirname5(path), { recursive: true, mode: 448 });
-  const temporary = `${path}.${process.pid}.${randomUUID10()}.tmp`;
+  const temporary = `${path}.${process.pid}.${randomUUID12()}.tmp`;
   writeFileSync(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
   renameSync(temporary, path);
@@ -45921,7 +47383,7 @@ async function startManagedServer(options) {
   if (existing)
     removeState();
   const config2 = loadConfig();
-  const instanceToken = randomUUID10();
+  const instanceToken = randomUUID12();
   const state = {
     version: 1,
     pid: 0,
@@ -46311,7 +47773,7 @@ async function chatWorkspace(flags, deps) {
 }
 
 // src/workspace-create.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var TERMINAL_WORKSPACE_STATES = new Set([
   "succeeded",
   "failed",
@@ -46401,7 +47863,7 @@ async function waitForReady(initial, flags, deps) {
 }
 async function createWorkspace(flags, deps) {
   const template2 = need2(flags, "template", deps.fail);
-  const externalId = typeof flags["external-id"] === "string" ? flags["external-id"] : `pcd-${randomUUID11()}`;
+  const externalId = typeof flags["external-id"] === "string" ? flags["external-id"] : `pcd-${randomUUID13()}`;
   const launchInput = parseLaunchInput(flags, deps.fail);
   const response = await deps.api("/v1/workspaces", {
     method: "POST",
@@ -46601,6 +48063,7 @@ function createCli(argv) {
     array: true,
     description: "Template manifest files"
   })).command("list", "List authorized template versions through the REST API", (command2) => command2.option("json", { type: "boolean", description: "Print JSON" })).command("list-database", "List every template version from PostgreSQL"));
+  parser2 = commandGroup(parser2, "pools", "Inspect operator-managed warm capacity", (group) => group.command("list", "List warm pool inventory and metrics", (command2) => command2.option("json", { type: "boolean", description: "Print JSON" })));
   parser2 = commandGroup(parser2, "workspaces", "Manage workspaces", (group) => group.command("list", "List workspaces", (command2) => command2.option("active", {
     type: "boolean",
     description: "Only show nonterminal workspaces"
@@ -46885,6 +48348,25 @@ async function handleTemplates(context) {
       return false;
   }
 }
+async function handlePools(context) {
+  if (context.group !== "pools" || context.action !== "list")
+    return false;
+  const response = await api2("/v1/warm-pools");
+  const body = await response.json();
+  if (!response.ok)
+    fail(`warm pool inventory failed (${response.status}): ${JSON.stringify(body)}`);
+  if (context.flags.json) {
+    console.log(JSON.stringify(body, null, 2));
+    return true;
+  }
+  for (const item of body.items ?? []) {
+    const counts = Object.entries(item.counts).map(([state, count3]) => `${state}=${count3}`).join(" ");
+    console.log(`${item.template}@${item.version}	desired=${item.desired}	${counts || "empty"}	oldest_ready_ms=${item.oldest_ready_age_ms ?? "-"}`);
+  }
+  if (body.metrics)
+    console.log(`metrics	${Object.entries(body.metrics).map(([name2, value]) => `${name2}=${value}`).join(" ")}`);
+  return true;
+}
 async function listWorkspaces(flags) {
   const params = new URLSearchParams;
   for (const [flag, param2] of [
@@ -46968,7 +48450,7 @@ async function handleWorkspacePersistence({
     };
     const res = await api2(`/v1/workspaces/${id}/preserve`, {
       method: "POST",
-      headers: { "idempotency-key": `preserve-${id}-${randomUUID12()}` },
+      headers: { "idempotency-key": `preserve-${id}-${randomUUID14()}` },
       body: JSON.stringify(body)
     });
     console.log(JSON.stringify(await res.json(), null, 2));
@@ -47045,7 +48527,7 @@ async function verifyCheckpoint(flags) {
   const id = need3(flags, "id");
   const response = await api2(`/v1/checkpoints/${id}/verify`, {
     method: "POST",
-    headers: { "idempotency-key": `verify-${id}-${randomUUID12()}` }
+    headers: { "idempotency-key": `verify-${id}-${randomUUID14()}` }
   });
   console.log(JSON.stringify(await response.json(), null, 2));
   if (!response.ok)
@@ -47156,7 +48638,7 @@ function containsDoctorNonce(message, nonce) {
   return !["user", "human"].includes(role) && JSON.stringify(message).includes(nonce);
 }
 async function runDoctorTurn(workspaceId, timeoutSeconds2) {
-  const nonce = `pocketcoder-doctor-${randomUUID12()}`;
+  const nonce = `pocketcoder-doctor-${randomUUID14()}`;
   console.log("doctor: sending a correlated request/response probe");
   const messageResponse = await api2(`/v1/workspaces/${workspaceId}/services/agent/message`, {
     method: "POST",
@@ -47202,7 +48684,7 @@ async function handleDoctor({ group, flags }) {
   if (group !== "doctor")
     return false;
   const template2 = need3(flags, "template");
-  const externalId = `doctor-${randomUUID12()}`;
+  const externalId = `doctor-${randomUUID14()}`;
   const turnTimeoutSeconds = doctorTurnTimeout(flags);
   console.log(`doctor: creating probe workspace from template ${template2}`);
   const createRes = await api2("/v1/workspaces", {
@@ -47244,6 +48726,7 @@ async function dispatchCommand(context) {
     handlePrincipals,
     handleKeys,
     handleTemplates,
+    handlePools,
     handleWorkspaceCore,
     handleWorkspacePersistence,
     handleWorkspaceAttach,