@slock-ai/daemon 0.47.0 → 0.48.0-play.20260515194406

package/dist/{chunk-77TJIZSE.js → chunk-54NE5A4K.js}

@@ -11,11 +11,11 @@ import {
 } from "./chunk-B7XIMLOT.js";
 
 // src/core.ts
-import path15 from "path";
+import path16 from "path";
 import os7 from "os";
 import { createRequire } from "module";
 import { accessSync } from "fs";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../shared/src/tracing/index.ts
 var DEFAULT_TRACE_FLAGS = "00";
@@ -640,6 +640,22 @@ var actionCardActionSchema = z.discriminatedUnion("type", [
   channelAddMemberOperationSchema
 ]);
 
+// ../shared/src/translationLanguages.ts
+var SUPPORTED_TRANSLATION_LANGUAGE_CODES = [
+  "en",
+  "zh-cn",
+  "zh-tw",
+  "ja",
+  "ko",
+  "es",
+  "fr",
+  "de",
+  "pt-br"
+];
+var SUPPORTED_TRANSLATION_LANGUAGE_SET = new Set(
+  SUPPORTED_TRANSLATION_LANGUAGE_CODES
+);
+
 // ../shared/src/testing/failpoints.ts
 var NoopFailpointRegistry = class {
   get enabled() {
@@ -709,6 +725,7 @@ var SERVER_CAPABILITY_MATRIX = {
 var RUNTIMES = [
   { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
   { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
+  { id: "pi", displayName: "Pi", binary: "pi", supported: true },
   { id: "kimi", displayName: "Kimi CLI", binary: "kimi", supported: true },
   { id: "copilot", displayName: "Copilot CLI", binary: "copilot", supported: true },
   { id: "cursor", displayName: "Cursor CLI", binary: "cursor-agent", supported: true },
@@ -750,10 +767,10 @@ var DISPLAY_PLAN_CONFIG = {
 };
 
 // src/agentProcessManager.ts
-import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync5, readdirSync as readdirSync3, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2 } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import path11 from "path";
+import path12 from "path";
 import os5 from "os";
 
 // src/drivers/claude.ts
@@ -846,22 +863,25 @@ Use the \`slock\` CLI for chat / task / attachment operations. The daemon inject
 6. **\`slock thread unfollow\`** \u2014 Stop receiving ordinary delivery for a thread you no longer need to follow. This only affects your own agent attention state.
 7. **\`slock message read\`** \u2014 Read past messages from a channel, DM, or thread. Supports \`before\` / \`after\` pagination and \`around\` for centered context.
 8. **\`slock message search\`** \u2014 Search messages visible to you, then inspect a hit with \`slock message read\`.
-9. **\`slock task list\`** \u2014 View a channel's task board.
-10. **\`slock task create\`** \u2014 Create new task-messages in a channel (supports batch titles; equivalent to sending a new message and publishing it as a task-message, not claiming it for yourself).
-11. **\`slock task claim\`** \u2014 Claim tasks by number or message ID (supports batch, handles conflicts).
-12. **\`slock task unclaim\`** \u2014 Release your claim on a task.
-13. **\`slock task update\`** \u2014 Change a task's status (e.g. to in_review or done).
-14. **\`slock attachment upload\`** \u2014 Upload a file to attach to a message. Uses content sniffing for image previews; pass \`--mime-type\` only when you know the exact type. Returns an attachment ID to pass to \`slock message send\`.
-15. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
-16. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
-17. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--display-name <name>\`, and \`--description <text>\`. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
-18. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
-19. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
-20. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
-21. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
-22. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
-23. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
-24. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
+9. **\`slock message react\`** \u2014 Add or remove your reaction on a message. Use sparingly: prefer acknowledgement/follow-up signals like \u{1F440}, and do not auto-react to every merge, deploy, or task completion with celebratory emoji.
+10. **\`slock task list\`** \u2014 View a channel's task board.
+11. **\`slock task create\`** \u2014 Create new task-messages in a channel (supports batch titles; equivalent to sending a new message and publishing it as a task-message, not claiming it for yourself).
+12. **\`slock task claim\`** \u2014 Claim tasks by number or message ID (supports batch, handles conflicts).
+13. **\`slock task unclaim\`** \u2014 Release your claim on a task.
+14. **\`slock task update\`** \u2014 Change a task's status (e.g. to in_review or done).
+15. **\`slock attachment upload\`** \u2014 Upload a file to attach to a message. Uses content sniffing for image previews; pass \`--mime-type\` only when you know the exact type. Returns an attachment ID to pass to \`slock message send\`.
+16. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
+17. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
+18. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--display-name <name>\`, and \`--description <text>\`. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
+19. **\`slock integration list\`** \u2014 List registered third-party services and this agent's active Slock Agent Logins.
+20. **\`slock integration login\`** \u2014 Provision or reuse this agent's login for a registered third-party service.
+21. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
+22. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
+23. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
+24. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
+25. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
+26. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
+27. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
 
 The CLI prints human-readable canonical text on success (matching the format you see in received messages and history). On failure it prints JSON to stderr:
 - failure \u2192 stderr \`{"ok":false,"code":"...","message":"..."}\` with non-zero exit
@@ -957,6 +977,11 @@ Each channel has a **name** and optionally a **description** that define its pur
 - **Reply in context** \u2014 always respond in the channel/thread the message came from.
 - **Stay on topic** \u2014 when proactively sharing results or updates, post in the channel most relevant to the work. Don't scatter messages across unrelated channels.
 - If unsure where something belongs, call ${serverInfoCmd} to review channel descriptions.`;
+  const thirdPartyIntegrationsSection = isCli ? `### Third-party integrations
+
+If a registered third-party service requires login, use Slock Agent Login through the CLI instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app, first run \`slock integration list\` and match the app to a registered service before browsing the app. Use \`slock integration login --service <service>\` to provision or reuse your agent login for that service. When the command returns \`Agent login ready\` or \`Already logged in\`, the agent-side login is ready. If the output includes an app URL, open that URL as the service-provided third-party app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow, use internal request IDs as OAuth callback codes, or call third-party exchange endpoints unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use \`slock profile show\`. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the registered service / Slock Agent Login path.` : `### Third-party integrations
+
+If a registered third-party service requires login, use Slock Agent Login through the available registered-service interface instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app, first inspect the registered-service interface and match the app to a registered service before browsing the app. Once the registered-service interface reports the agent login is ready, the agent-side login is ready. If that interface provides an app URL, use it as the service-provided third-party app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow or treat internal request IDs as OAuth callback codes unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use your Slock profile view. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the registered service / Slock Agent Login path.`;
   const readingHistorySection = isCli ? `### Reading history
 
 \`slock message read --channel "#channel-name"\` or \`slock message read --channel dm:@peer-name\` or \`slock message read --channel "#channel:shortid"\`
@@ -1128,6 +1153,8 @@ ${discoverySection}
 
 ${channelAwarenessSection}
 
+${thirdPartyIntegrationsSection}
+
 ${readingHistorySection}
 
 ${historicalReferenceSection}
@@ -1159,6 +1186,17 @@ Keep the user informed. They cannot see your internal reasoning, so:
 - For multi-step work, send short progress updates (e.g. "Working on step 2/3\u2026").
 - When done, summarize the result.
 - Keep updates concise \u2014 one or two sentences. Don't flood the chat.
+- For long answers where users need the conclusion first but details still matter, put the conclusion and next action outside any collapse, then use sanitized HTML details blocks for optional depth:
+
+\`\`\`html
+<details>
+<summary>Evidence, logs, or edge cases</summary>
+
+Detailed notes go here.
+</details>
+\`\`\`
+
+  Do not hide the main recommendation, blocker, or required action inside \`<details>\`; only fold supporting evidence, logs, alternatives, or extended rationale.
 
 ### Conversation etiquette
 
@@ -1292,6 +1330,19 @@ function buildMcpSystemPrompt(config, opts) {
   return buildPrompt(config, "mcp", opts);
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/drivers/cliTransport.ts
 var shellSingleQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 function runtimeContextEnv(config) {
@@ -1345,7 +1396,7 @@ exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(ctx.slockCliPath)}
     SLOCK_AGENT_TOKEN_FILE: tokenFile,
     PATH: `${slockDir}${path.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   return {
     slockDir,
     tokenFile,
@@ -1382,7 +1433,7 @@ function resolveCommandOnWindows(command, env, execFileSyncFn) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   if (platform === "win32") {
     return resolveCommandOnWindows(command, env, execFileSyncFn);
@@ -1407,7 +1458,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -1772,7 +1823,7 @@ var ClaudeDriver = class {
 
 // src/drivers/codex.ts
 import { spawn as spawn2, execSync } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
 import os2 from "os";
 import path4 from "path";
 function getCodexNotificationErrorMessage(params) {
@@ -1801,11 +1852,29 @@ function ensureGitRepoForCodex(workingDirectory, deps = {}) {
   );
 }
 var CODEX_DESKTOP_BUNDLE_PATH = "/Applications/Codex.app/Contents/Resources/codex";
+function resolveWindowsSandboxRunner(deps = {}) {
+  const homeDir = deps.homeDir ?? os2.homedir();
+  const sandboxBinDir = path4.join(homeDir, ".codex", ".sandbox-bin");
+  if (!(deps.existsSyncFn ?? existsSync3)(sandboxBinDir)) return null;
+  try {
+    const files = readdirSync2(sandboxBinDir);
+    const runners = files.filter((f) => f.startsWith("codex-command-runner") && f.endsWith(".exe")).sort((a, b) => b.localeCompare(a));
+    if (runners.length > 0) return path4.join(sandboxBinDir, runners[0]);
+  } catch {
+  }
+  return null;
+}
 function resolveCodexCommand(deps = {}) {
   const pathCommand = resolveCommandOnPath("codex", deps);
   if (pathCommand) return pathCommand;
-  if ((deps.platform ?? process.platform) !== "darwin") return null;
-  return firstExistingPath([CODEX_DESKTOP_BUNDLE_PATH], deps);
+  const platform = deps.platform ?? process.platform;
+  if (platform === "darwin") {
+    return firstExistingPath([CODEX_DESKTOP_BUNDLE_PATH], deps);
+  }
+  if (platform === "win32") {
+    return resolveWindowsSandboxRunner(deps);
+  }
+  return null;
 }
 function probeCodex(deps = {}) {
   if ((deps.platform ?? process.platform) === "win32") {
@@ -1830,22 +1899,32 @@ function resolveCodexSpawn(commandArgs, deps = {}) {
   if ((deps.platform ?? process.platform) !== "win32") {
     return { command: resolveCodexCommand(deps) ?? "codex", args: commandArgs };
   }
+  const execSyncFn = deps.execSyncFn ?? execSync;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync3;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   let codexEntry = null;
   try {
-    const globalRoot = execSync("npm root -g", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const globalRoot = execSyncFn("npm root -g", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], env }).trim();
     const candidate = path4.join(globalRoot, "@openai", "codex", "bin", "codex.js");
-    if (existsSync3(candidate)) codexEntry = candidate;
+    if (existsSyncFn(candidate)) codexEntry = candidate;
   } catch {
   }
   if (!codexEntry) {
     try {
-      const cmdPath = execSync("where codex", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim().split(/\r?\n/)[0];
+      const cmdPath = execSyncFn("where codex", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], env }).trim().split(/\r?\n/)[0];
       const candidate = path4.join(path4.dirname(cmdPath), "node_modules", "@openai", "codex", "bin", "codex.js");
-      if (existsSync3(candidate)) codexEntry = candidate;
+      if (existsSyncFn(candidate)) codexEntry = candidate;
     } catch {
     }
   }
   if (!codexEntry) {
+    const sandboxRunner = resolveWindowsSandboxRunner(deps);
+    if (sandboxRunner) {
+      return {
+        command: sandboxRunner,
+        args: commandArgs
+      };
+    }
     throw new Error(
       "Cannot resolve Codex CLI entry point on Windows. Ensure @openai/codex is installed globally via npm (npm i -g @openai/codex)."
     );
@@ -2296,13 +2375,13 @@ import { spawn as spawn3 } from "child_process";
 import path5 from "path";
 import { writeFileSync as writeFileSync3 } from "fs";
 function buildCopilotSpawnEnv(ctx) {
-  return {
+  return scrubDaemonChildEnv({
     ...process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1",
     ...ctx.config.envVars || {},
     [SLOCK_HOME_ENV]: resolveSlockHome()
-  };
+  });
 }
 var CopilotDriver = class {
   id = "copilot";
@@ -2460,13 +2539,13 @@ import { spawn as spawn4, spawnSync } from "child_process";
 import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
 import path6 from "path";
 function buildCursorSpawnEnv(ctx) {
-  return {
+  return scrubDaemonChildEnv({
     ...process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1",
     ...ctx.config.envVars || {},
     [SLOCK_HOME_ENV]: resolveSlockHome()
-  };
+  });
 }
 var CursorDriver = class {
   id = "cursor";
@@ -2636,7 +2715,7 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
-    env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3
   });
@@ -2683,7 +2762,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path7.win32;
   let geminiEntry = null;
   try {
@@ -2857,13 +2936,16 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID } from "crypto";
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
 import os3 from "os";
 import path8 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
 var KIMI_MCP_FILE = ".slock-kimi-mcp.json";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -2872,6 +2954,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os3.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path8.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os3.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path8.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync6(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 var KimiDriver = class {
   id = "kimi";
   lifecycle = {
@@ -2888,7 +3037,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   mcpToolPrefix = "";
@@ -2940,6 +3107,7 @@ var KimiDriver = class {
         }
       }
     }), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
@@ -2948,16 +3116,13 @@ var KimiDriver = class {
       "--mcp-config-file",
       mcpConfigPath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
-    if (ctx.config.model && ctx.config.model !== "default") {
-      args.push("--model", ctx.config.model);
-    }
-    const spawnEnv = { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" };
     const proc = spawn6("kimi", args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
-      env: spawnEnv,
+      env: launch.env,
       shell: process.platform === "win32"
     });
     proc.stdin?.write(JSON.stringify({
@@ -3074,14 +3239,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os3.homedir()) {
-  const configPath = path8.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os3.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -3328,7 +3488,7 @@ function detectOpenCodeModels(home = os4.homedir(), runCommand = runOpenCodeMode
 }
 function runOpenCodeModelsCommand(home) {
   const result = spawnSync2("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3
   });
@@ -3484,6 +3644,297 @@ var OpenCodeDriver = class {
   }
 };
 
+// src/drivers/pi.ts
+import { spawn as spawn8 } from "child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
+import path10 from "path";
+import { fileURLToPath } from "url";
+import { getAgentDir, VERSION as PI_SDK_VERSION } from "@earendil-works/pi-coding-agent";
+var CHAT_MCP_TOOL_PREFIX2 = "chat_";
+var NO_MESSAGE_PROMPT2 = "No new messages are pending. Stop now.";
+var FIRST_MESSAGE_TASK_PREFIX2 = "First message task (system-triggered):";
+var MIN_SUPPORTED_PI_VERSION = "0.74.0";
+function parseSemver2(version) {
+  const match = version.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isSupportedPiVersion(version) {
+  if (!version) return true;
+  const actual = parseSemver2(version);
+  const minimum = parseSemver2(MIN_SUPPORTED_PI_VERSION);
+  if (!actual || !minimum) return true;
+  for (let i = 0; i < 3; i += 1) {
+    if (actual[i] > minimum[i]) return true;
+    if (actual[i] < minimum[i]) return false;
+  }
+  return true;
+}
+function unsupportedPiVersionMessage(version) {
+  if (!version || isSupportedPiVersion(version)) return null;
+  return `Pi SDK ${version} is unsupported; requires @earendil-works/pi-coding-agent >= ${MIN_SUPPORTED_PI_VERSION}. Upgrade the daemon Pi dependency before starting this runtime.`;
+}
+function probePi(version = PI_SDK_VERSION) {
+  const unsupportedMessage = unsupportedPiVersionMessage(version);
+  if (unsupportedMessage) {
+    return {
+      available: false,
+      version: `${version} (requires @earendil-works/pi-coding-agent >= ${MIN_SUPPORTED_PI_VERSION})`
+    };
+  }
+  return { available: true, version };
+}
+function resolvePiSdkRunnerPath(moduleUrl = import.meta.url) {
+  const moduleDir = path10.dirname(fileURLToPath(moduleUrl));
+  const sourceSibling = path10.join(moduleDir, "piSdkRunner.ts");
+  if (existsSync7(sourceSibling)) return sourceSibling;
+  const bundledEntry = path10.join(moduleDir, "drivers", "piSdkRunner.js");
+  if (existsSync7(bundledEntry)) return bundledEntry;
+  return path10.join(moduleDir, "piSdkRunner.js");
+}
+function buildPiSdkNodeArgs(runnerPath = resolvePiSdkRunnerPath()) {
+  if (runnerPath.endsWith(".ts")) {
+    return [...process.execArgv, runnerPath];
+  }
+  return [runnerPath];
+}
+function buildPiLaunchOptions(ctx, opts = {}) {
+  const command = opts.command ?? process.execPath;
+  const piDir = path10.join(ctx.workingDirectory, ".slock", "pi");
+  const sessionDir = path10.join(piDir, "sessions");
+  mkdirSync4(sessionDir, { recursive: true });
+  const slock = prepareCliTransport(ctx, { NO_COLOR: "1" });
+  const runnerPath = opts.runnerPath ?? resolvePiSdkRunnerPath();
+  const agentDir = opts.agentDir ?? getAgentDir();
+  const runnerConfigPath = path10.join(
+    piDir,
+    `sdk-run-${(ctx.launchId || "launch").replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`
+  );
+  const turnPrompt = ctx.prompt === ctx.standingPrompt ? NO_MESSAGE_PROMPT2 : ctx.prompt;
+  const runnerConfig = {
+    cwd: ctx.workingDirectory,
+    agentDir,
+    sessionDir,
+    sessionId: ctx.config.sessionId || null,
+    standingPrompt: ctx.standingPrompt,
+    prompt: turnPrompt,
+    model: ctx.config.model && ctx.config.model !== "default" ? ctx.config.model : null
+  };
+  writeFileSync7(runnerConfigPath, `${JSON.stringify(runnerConfig)}
+`, { encoding: "utf8", mode: 384 });
+  const args = [
+    ...buildPiSdkNodeArgs(runnerPath),
+    "--config",
+    runnerConfigPath
+  ];
+  return {
+    command,
+    args,
+    env: slock.spawnEnv,
+    sessionDir,
+    agentDir,
+    runnerConfigPath,
+    sdkVersion: PI_SDK_VERSION
+  };
+}
+function isSystemFirstMessageTask2(message) {
+  return message.sender_id === "system" && message.channel_type === "channel" && message.channel_name === "all" && message.content.trimStart().startsWith(FIRST_MESSAGE_TASK_PREFIX2);
+}
+function buildPiSystemPrompt(config) {
+  return buildCliTransportSystemPrompt(config, {
+    toolPrefix: CHAT_MCP_TOOL_PREFIX2,
+    extraCriticalRules: [
+      "- Runtime Profile migration controls are not available in the Pi runtime yet. If asked to acknowledge a runtime migration, explain the blocker instead of inventing a command."
+    ],
+    postStartupNotes: [
+      "**Pi runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
+    ],
+    includeStdinNotificationSection: false,
+    messageNotificationStyle: "poll"
+  });
+}
+function contentText(content) {
+  if (!content) return "";
+  const chunks = [];
+  for (const item of content) {
+    if (item.type === "text" && typeof item.text === "string") {
+      chunks.push(item.text);
+    }
+  }
+  return chunks.join("");
+}
+function apiKeyErrorMessage(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  if (/no api key found/i.test(trimmed)) return trimmed;
+  if (/api key.+required/i.test(trimmed)) return trimmed;
+  if (/no models available/i.test(trimmed)) return trimmed;
+  return null;
+}
+var PiDriver = class {
+  id = "pi";
+  lifecycle = {
+    kind: "per_turn",
+    start: "defer_until_concrete_message",
+    exit: "terminate_on_turn_end",
+    inFlightWake: "coalesce_into_pending"
+  };
+  communication = {
+    chat: "slock_cli",
+    runtimeControl: "none"
+  };
+  session = {
+    recovery: "resume_or_fresh"
+  };
+  model = {
+    detectedModelsVerifiedAs: "launchable",
+    toLaunchSpec: (modelId, ctx) => {
+      if (!ctx) return modelId && modelId !== "default" ? { args: ["--model", modelId] } : { args: [] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildPiLaunchOptions(launchCtx);
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: [launch.runnerConfigPath],
+        params: {
+          agentDir: launch.agentDir,
+          sessionDir: launch.sessionDir,
+          sdkVersion: launch.sdkVersion,
+          resources: "extensions/skills/prompt-templates/themes/context-files disabled by Slock policy"
+        }
+      };
+    }
+  };
+  supportsStdinNotification = false;
+  mcpToolPrefix = CHAT_MCP_TOOL_PREFIX2;
+  busyDeliveryMode = "none";
+  terminateProcessOnTurnEnd = true;
+  deferSpawnUntilMessage = true;
+  usesSlockCliForCommunication = true;
+  sessionId = null;
+  sessionAnnounced = false;
+  apiKeyErrorAnnounced = false;
+  turnEnded = false;
+  assistantTextByMessageId = /* @__PURE__ */ new Map();
+  shouldDeferWakeMessage(message) {
+    return isSystemFirstMessageTask2(message);
+  }
+  probe() {
+    return probePi();
+  }
+  async detectModels() {
+    return null;
+  }
+  spawn(ctx) {
+    this.sessionId = ctx.config.sessionId || null;
+    this.sessionAnnounced = false;
+    this.apiKeyErrorAnnounced = false;
+    this.turnEnded = false;
+    this.assistantTextByMessageId.clear();
+    const unsupportedMessage = unsupportedPiVersionMessage(PI_SDK_VERSION);
+    if (unsupportedMessage) throw new Error(unsupportedMessage);
+    const launch = buildPiLaunchOptions(ctx);
+    const proc = spawn8(launch.command, launch.args, {
+      cwd: ctx.workingDirectory,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: launch.env,
+      shell: false
+    });
+    proc.stdin?.end();
+    return { process: proc };
+  }
+  parseLine(line) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      if (this.apiKeyErrorAnnounced) return [];
+      const message = apiKeyErrorMessage(line);
+      if (!message) return [];
+      this.apiKeyErrorAnnounced = true;
+      this.turnEnded = true;
+      return [
+        { kind: "error", message },
+        { kind: "turn_end", sessionId: this.sessionId || void 0 }
+      ];
+    }
+    const events = [];
+    if (event.type === "session" && event.id) {
+      this.sessionId = event.id;
+    }
+    if (!this.sessionAnnounced && this.sessionId) {
+      events.push({ kind: "session_init", sessionId: this.sessionId });
+      this.sessionAnnounced = true;
+    }
+    switch (event.type) {
+      case "agent_start":
+      case "turn_start":
+        events.push({ kind: "thinking", text: "" });
+        break;
+      case "message_update":
+      case "message_end":
+        if (event.message?.role === "assistant") {
+          const key = event.message.id || "current";
+          const currentText = contentText(event.message.content);
+          const previousText = this.assistantTextByMessageId.get(key) ?? "";
+          if (currentText.length > previousText.length && currentText.startsWith(previousText)) {
+            events.push({ kind: "text", text: currentText.slice(previousText.length) });
+          } else if (currentText && currentText !== previousText) {
+            events.push({ kind: "text", text: currentText });
+          }
+          this.assistantTextByMessageId.set(key, currentText);
+          if (event.message.stopReason === "error" || event.message.stopReason === "aborted") {
+            events.push({ kind: "error", message: event.message.errorMessage || `Request ${event.message.stopReason}` });
+          }
+        }
+        break;
+      case "tool_execution_start":
+        events.push({
+          kind: "tool_call",
+          name: event.toolName || "unknown_tool",
+          input: event.args
+        });
+        break;
+      case "tool_execution_end":
+        events.push({
+          kind: "tool_output",
+          name: event.toolName || "unknown_tool"
+        });
+        if (event.isError) {
+          events.push({ kind: "error", message: `Pi tool ${event.toolName || "unknown_tool"} failed` });
+        }
+        break;
+      case "compaction_start":
+        events.push({ kind: "compaction_started" });
+        break;
+      case "compaction_end":
+        events.push({ kind: "compaction_finished" });
+        if (event.errorMessage) events.push({ kind: "error", message: event.errorMessage });
+        break;
+      case "turn_end":
+      case "agent_end":
+        if (!this.turnEnded) {
+          events.push({ kind: "turn_end", sessionId: this.sessionId || void 0 });
+          this.turnEnded = true;
+        }
+        break;
+    }
+    return events;
+  }
+  encodeStdinMessage(_text, _sessionId, _opts) {
+    return null;
+  }
+  buildSystemPrompt(config, _agentId) {
+    return buildPiSystemPrompt(config);
+  }
+};
+
 // src/drivers/index.ts
 var driverFactories = {
   claude: () => new ClaudeDriver(),
@@ -3492,7 +3943,8 @@ var driverFactories = {
   cursor: () => new CursorDriver(),
   gemini: () => new GeminiDriver(),
   kimi: () => new KimiDriver(),
-  opencode: () => new OpenCodeDriver()
+  opencode: () => new OpenCodeDriver(),
+  pi: () => new PiDriver()
 };
 function getDriver(runtimeId) {
   const createDriver = driverFactories[runtimeId];
@@ -3505,7 +3957,7 @@ function getDriver(runtimeId) {
 
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
-import path10 from "path";
+import path11 from "path";
 function isValidWorkspaceDirectoryName(directoryName) {
   return !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..");
 }
@@ -3513,7 +3965,7 @@ function resolveWorkspaceDirectoryPath(dataDir, directoryName) {
   if (!isValidWorkspaceDirectoryName(directoryName)) {
     return null;
   }
-  return path10.join(dataDir, directoryName);
+  return path11.join(dataDir, directoryName);
 }
 function emptyWorkspaceDirectorySummary(latestMtime = /* @__PURE__ */ new Date(0)) {
   return {
@@ -3562,7 +4014,7 @@ async function summarizeWorkspaceDirectory(dirPath) {
     return summary;
   }
   const childSummaries = await Promise.all(
-    entries.map((entry) => summarizeWorkspaceEntry(path10.join(dirPath, entry.name), entry))
+    entries.map((entry) => summarizeWorkspaceEntry(path11.join(dirPath, entry.name), entry))
   );
   for (const childSummary of childSummaries) {
     summary = mergeWorkspaceDirectorySummaries(summary, childSummary);
@@ -3581,7 +4033,7 @@ async function scanWorkspaceDirectories(dataDir) {
       if (!entry.isDirectory()) {
         return null;
       }
-      const dirPath = path10.join(dataDir, entry.name);
+      const dirPath = path11.join(dataDir, entry.name);
       try {
         const summary = await summarizeWorkspaceDirectory(dirPath);
         return {
@@ -3772,19 +4224,19 @@ function findSessionJsonl(root, predicate) {
     if (depth < 0 || visited >= maxEntries) return null;
     let entries;
     try {
-      entries = readdirSync2(dir, { withFileTypes: true }).sort((a, b) => b.name.localeCompare(a.name));
+      entries = readdirSync3(dir, { withFileTypes: true }).sort((a, b) => b.name.localeCompare(a.name));
     } catch {
       return null;
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isFile() || !predicate(entry.name)) continue;
-      return path11.join(dir, entry.name);
+      return path12.join(dir, entry.name);
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isDirectory()) continue;
-      const found = visit(path11.join(dir, entry.name), depth - 1);
+      const found = visit(path12.join(dir, entry.name), depth - 1);
       if (found) return found;
     }
     return null;
@@ -3797,10 +4249,10 @@ function safeSessionFilename(value) {
 }
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
-    const dir = path11.join(fallbackDir, ".slock", "runtime-sessions");
-    mkdirSync4(dir, { recursive: true });
-    const filePath = path11.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
-    writeFileSync7(filePath, JSON.stringify({
+    const dir = path12.join(fallbackDir, ".slock", "runtime-sessions");
+    mkdirSync5(dir, { recursive: true });
+    const filePath = path12.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
+    writeFileSync8(filePath, JSON.stringify({
       type: "runtime_session_handoff",
       runtime,
       sessionId,
@@ -3819,7 +4271,7 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   }
 }
 function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os5.homedir(), fallbackDir) {
-  const directPath = path11.isAbsolute(sessionId) ? sessionId : null;
+  const directPath = path12.isAbsolute(sessionId) ? sessionId : null;
   if (directPath) {
     try {
       if (statSync2(directPath).isFile()) {
@@ -3828,7 +4280,7 @@ function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os5.homedir(), f
     } catch {
     }
   }
-  const resolvedPath = runtime === "claude" ? findSessionJsonl(path11.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path11.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
+  const resolvedPath = runtime === "claude" ? findSessionJsonl(path12.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path12.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
   if (!resolvedPath && fallbackDir) {
     const fallback = writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir);
     if (fallback) return fallback;
@@ -4368,6 +4820,17 @@ Success = user starts useful collaboration and setup progresses,
 not finishing a long onboarding conversation in one channel.
 `;
 }
+function createRuntimeTraceCounters() {
+  return {
+    events: 0,
+    toolCalls: 0,
+    toolOutputs: 0,
+    compactionStarts: 0,
+    compactionFinishes: 0,
+    textEvents: 0,
+    thinkingEvents: 0
+  };
+}
 function createGatedSteeringState() {
   return {
     phase: "idle",
@@ -4546,10 +5009,113 @@ function buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes) {
       outstandingToolUses: ap.gatedSteering.outstandingToolUses,
       compacting: ap.gatedSteering.compacting,
       recentStderrCount: ap.recentStderr.length,
-      recentStdoutCount: ap.recentStdout.length
+      recentStdoutCount: ap.recentStdout.length,
+      ...runtimeTraceCounterAttrs(ap)
     }
   };
 }
+function bucketBytes(value) {
+  const bytes = typeof value === "string" ? Buffer.byteLength(value, "utf8") : Math.max(0, Math.floor(value ?? 0));
+  if (bytes === 0) return "0";
+  if (bytes < 1024) return "<1KB";
+  if (bytes < 10 * 1024) return "1KB-10KB";
+  if (bytes < 100 * 1024) return "10KB-100KB";
+  if (bytes < 1024 * 1024) return "100KB-1MB";
+  return "1MB+";
+}
+function attachmentBytesBucket(bytes, knownCount) {
+  return knownCount > 0 ? bucketBytes(bytes) : "unknown";
+}
+function summarizeMessageInputBytes(messages) {
+  if (!messages || messages.length === 0) {
+    return {
+      runtime_input_messages_count: 0,
+      runtime_input_messages_content_bytes_bucket: "0",
+      runtime_input_attachments_count: 0,
+      runtime_input_image_attachments_count: 0,
+      runtime_input_attachments_size_known_count: 0,
+      runtime_input_attachments_bytes_bucket: "0",
+      runtime_input_image_attachments_size_known_count: 0,
+      runtime_input_image_attachments_bytes_bucket: "0",
+      runtime_input_largest_attachment_bytes_bucket: "0",
+      runtime_input_thread_context_messages_count: 0,
+      runtime_input_thread_context_content_bytes_bucket: "0"
+    };
+  }
+  let contentBytes = 0;
+  let attachmentCount = 0;
+  let imageAttachmentCount = 0;
+  let attachmentSizeKnownCount = 0;
+  let attachmentBytes = 0;
+  let imageAttachmentSizeKnownCount = 0;
+  let imageAttachmentBytes = 0;
+  let largestAttachmentBytes = 0;
+  let threadContextMessages = 0;
+  let threadContextContentBytes = 0;
+  for (const message of messages) {
+    contentBytes += Buffer.byteLength(message.content || "", "utf8");
+    for (const attachment of message.attachments || []) {
+      attachmentCount++;
+      if (typeof attachment.sizeBytes === "number" && Number.isFinite(attachment.sizeBytes) && attachment.sizeBytes >= 0) {
+        attachmentSizeKnownCount++;
+        attachmentBytes += attachment.sizeBytes;
+        largestAttachmentBytes = Math.max(largestAttachmentBytes, attachment.sizeBytes);
+      }
+      if (attachment.mimeType?.startsWith("image/")) {
+        imageAttachmentCount++;
+        if (typeof attachment.sizeBytes === "number" && Number.isFinite(attachment.sizeBytes) && attachment.sizeBytes >= 0) {
+          imageAttachmentSizeKnownCount++;
+          imageAttachmentBytes += attachment.sizeBytes;
+        }
+      }
+    }
+    const joinContext = message.thread_join_context;
+    if (joinContext) {
+      const contextMessages = [joinContext.parent_message, ...joinContext.recent_messages];
+      threadContextMessages += contextMessages.length;
+      for (const contextMessage of contextMessages) {
+        threadContextContentBytes += Buffer.byteLength(contextMessage.content || "", "utf8");
+      }
+    }
+  }
+  return {
+    runtime_input_messages_count: messages.length,
+    runtime_input_messages_content_bytes_bucket: bucketBytes(contentBytes),
+    runtime_input_attachments_count: attachmentCount,
+    runtime_input_image_attachments_count: imageAttachmentCount,
+    runtime_input_attachments_size_known_count: attachmentSizeKnownCount,
+    runtime_input_attachments_bytes_bucket: attachmentCount > 0 ? attachmentBytesBucket(attachmentBytes, attachmentSizeKnownCount) : "0",
+    runtime_input_image_attachments_size_known_count: imageAttachmentSizeKnownCount,
+    runtime_input_image_attachments_bytes_bucket: imageAttachmentCount > 0 ? attachmentBytesBucket(imageAttachmentBytes, imageAttachmentSizeKnownCount) : "0",
+    runtime_input_largest_attachment_bytes_bucket: attachmentCount > 0 ? attachmentBytesBucket(largestAttachmentBytes, attachmentSizeKnownCount) : "0",
+    runtime_input_thread_context_messages_count: threadContextMessages,
+    runtime_input_thread_context_content_bytes_bucket: bucketBytes(threadContextContentBytes)
+  };
+}
+function buildRuntimeInputTraceAttrs(opts) {
+  return {
+    runtime_input_source: opts.source,
+    runtime_input_prompt_bytes_bucket: bucketBytes(opts.prompt),
+    runtime_input_standing_prompt_bytes_bucket: bucketBytes(opts.standingPrompt),
+    runtime_input_resume_prompt_present: Boolean(opts.resumePrompt),
+    runtime_input_resume_prompt_bytes_bucket: bucketBytes(opts.resumePrompt),
+    runtime_input_session_present: opts.sessionIdPresent,
+    runtime_input_native_standing_prompt_present: opts.nativeStandingPrompt,
+    runtime_input_unread_channels_count: opts.unreadSummary ? Object.keys(opts.unreadSummary).length : 0,
+    ...summarizeMessageInputBytes(opts.messages)
+  };
+}
+function runtimeTraceCounterAttrs(ap) {
+  return {
+    runtime_events_count: ap.runtimeTraceCounters.events,
+    runtime_tool_calls_count: ap.runtimeTraceCounters.toolCalls,
+    runtime_tool_outputs_count: ap.runtimeTraceCounters.toolOutputs,
+    runtime_compaction_starts_count: ap.runtimeTraceCounters.compactionStarts,
+    runtime_compaction_finishes_count: ap.runtimeTraceCounters.compactionFinishes,
+    runtime_text_events_count: ap.runtimeTraceCounters.textEvents,
+    runtime_thinking_events_count: ap.runtimeTraceCounters.thinkingEvents
+  };
+}
 function getMessageDeliveryText(driver) {
   return driver.supportsStdinNotification ? "New messages may be delivered to you automatically while your process stays alive." : "The daemon will automatically restart you when new messages arrive.";
 }
@@ -4847,26 +5413,26 @@ var AgentProcessManager = class _AgentProcessManager {
     this.recordDaemonTrace("daemon.agent.spawn.started", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
     try {
       const driver = this.driverResolver(config.runtime || "claude");
-      const agentDataDir = path11.join(this.dataDir, agentId);
+      const agentDataDir = path12.join(this.dataDir, agentId);
       await mkdir(agentDataDir, { recursive: true });
       const runtimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
-      const memoryMdPath = path11.join(agentDataDir, "MEMORY.md");
+      const memoryMdPath = path12.join(agentDataDir, "MEMORY.md");
       try {
         await access(memoryMdPath);
       } catch {
         const initialMemoryMd = buildInitialMemoryMd(runtimeConfig);
         await writeFile(memoryMdPath, initialMemoryMd);
       }
-      const notesDir = path11.join(agentDataDir, "notes");
+      const notesDir = path12.join(agentDataDir, "notes");
       await mkdir(notesDir, { recursive: true });
       if (getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE) {
         const seedFiles = buildOnboardingSeedFiles();
         for (const { relativePath, content } of seedFiles) {
-          const fullPath = path11.join(agentDataDir, relativePath);
+          const fullPath = path12.join(agentDataDir, relativePath);
           try {
             await access(fullPath);
           } catch {
-            await mkdir(path11.dirname(fullPath), { recursive: true });
+            await mkdir(path12.dirname(fullPath), { recursive: true });
             await writeFile(fullPath, content);
           }
         }
@@ -4874,17 +5440,21 @@ var AgentProcessManager = class _AgentProcessManager {
       const isResume = !!runtimeConfig.sessionId;
       const standingPrompt = driver.buildSystemPrompt(runtimeConfig, agentId);
       let prompt;
+      let promptSource;
       if (runtimeConfig.runtimeProfileControl && !wakeMessage) {
         prompt = driver.supportsNativeStandingPrompt ? NATIVE_STANDING_PROMPT_STARTUP_INPUT : formatRuntimeProfileControlStartupInput(runtimeConfig.runtimeProfileControl, driver);
+        promptSource = "runtime_profile_control";
       } else if (isResume && resumePrompt) {
         prompt = resumePrompt;
         prompt += getBusyDeliveryNote(driver);
+        promptSource = "resume_prompt";
       } else if (wakeMessage) {
         const runtimeProfileControlPrompt = formatRuntimeProfileControlPrompt([wakeMessage]);
         const channelLabel = formatChannelLabel(wakeMessage);
         prompt = runtimeProfileControlPrompt ?? `New message received:
 
 ${formatIncomingMessage(wakeMessage, driver)}`;
+        promptSource = runtimeProfileControlPrompt ? "runtime_profile_control_message" : "wake_message";
         if (!runtimeProfileControlPrompt && unreadSummary && Object.keys(unreadSummary).length > 0) {
           const otherUnread = Object.entries(unreadSummary).filter(([key]) => key !== channelLabel);
           if (otherUnread.length > 0) {
@@ -4918,12 +5488,25 @@ IMPORTANT: If the message requires multi-step work (e.g. research, code changes,
         prompt += `
 
 Use ${communicationCommand(driver, "read_history")} to catch up on the channels listed above, then stop. Read each listed channel at most once unless a read fails. Do NOT call ${communicationCommand(driver, "check_messages")} in this mode. If the history reveals a direct request, assignment, @mention, review request, or task clearly addressed to you, switch into active handling instead of stopping: ${dynamicReplyInstruction(driver)} and ${dynamicClaimInstruction(driver)} before starting work. Otherwise, do NOT send any message in this mode. ${getMessageDeliveryText(driver)}`;
+        promptSource = "resume_unread_summary";
       } else if (isResume) {
         prompt = `No new messages while you were away. Nothing to do \u2014 just stop. ${getMessageDeliveryText(driver)}`;
         prompt += getBusyDeliveryNote(driver);
+        promptSource = "resume_empty";
       } else {
         prompt = driver.supportsNativeStandingPrompt ? NATIVE_STANDING_PROMPT_STARTUP_INPUT : standingPrompt;
+        promptSource = "cold_start";
       }
+      const runtimeInputTraceAttrs = buildRuntimeInputTraceAttrs({
+        source: promptSource,
+        prompt,
+        standingPrompt,
+        resumePrompt,
+        messages: wakeMessage ? [wakeMessage] : void 0,
+        unreadSummary,
+        sessionIdPresent: isResume,
+        nativeStandingPrompt: Boolean(driver.supportsNativeStandingPrompt)
+      });
       const effectiveConfig = await this.buildSpawnConfig(agentId, runtimeConfig);
       const canDeferEmptyStart = driver.deferSpawnUntilMessage === true && !wakeMessage && !runtimeConfig.runtimeProfileControl && (!unreadSummary || Object.keys(unreadSummary).length === 0);
       if (canDeferEmptyStart) {
@@ -4984,6 +5567,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         lastRuntimeEventAt: Date.now(),
         runtimeProgressStaleSince: null,
         runtimeTraceSpan: null,
+        runtimeTraceCounters: createRuntimeTraceCounters(),
         lastActivity: "",
         lastActivityDetail: "",
         activityClientSeq: 0,
@@ -5005,7 +5589,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         sessionId: effectiveConfig.sessionId || null,
         launchId: launchId || null
       });
-      this.startRuntimeTrace(agentId, agentProcess, "spawn", wakeMessage ? [wakeMessage] : void 0);
+      this.startRuntimeTrace(agentId, agentProcess, "spawn", wakeMessage ? [wakeMessage] : void 0, runtimeInputTraceAttrs);
       this.agentsStarting.delete(agentId);
       if (config.runtimeProfileControl) {
         this.ackInjectedRuntimeProfileControl(agentId, config.runtimeProfileControl, agentProcess.launchId);
@@ -5099,6 +5683,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             expectedTerminationReason: ap.expectedTerminationReason || void 0,
             exitCode: finalCode,
             exitSignal: finalSignal,
+            ...runtimeTraceCounterAttrs(ap),
             ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "process_exit")
           });
           if (processEndedCleanly) {
@@ -5526,7 +6111,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return true;
   }
   async resetWorkspace(agentId) {
-    const agentDataDir = path11.join(this.dataDir, agentId);
+    const agentDataDir = path12.join(this.dataDir, agentId);
     try {
       await rm2(agentDataDir, { recursive: true, force: true });
       logger.info(`[Agent ${agentId}] Workspace reset complete (${agentDataDir})`);
@@ -5563,7 +6148,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return result;
   }
   buildRuntimeProfileReport(agentId, config, sessionId, launchId) {
-    const workspacePath = path11.join(this.dataDir, agentId);
+    const workspacePath = path12.join(this.dataDir, agentId);
     return {
       agentId,
       launchId,
@@ -5811,7 +6396,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   // Workspace file browsing
   async getFileTree(agentId, dirPath) {
-    const agentDir = path11.join(this.dataDir, agentId);
+    const agentDir = path12.join(this.dataDir, agentId);
     try {
       await stat2(agentDir);
     } catch {
@@ -5819,8 +6404,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     let targetDir = agentDir;
     if (dirPath) {
-      const resolved = path11.resolve(agentDir, dirPath);
-      if (!resolved.startsWith(agentDir + path11.sep) && resolved !== agentDir) {
+      const resolved = path12.resolve(agentDir, dirPath);
+      if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
         return [];
       }
       targetDir = resolved;
@@ -5828,14 +6413,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return this.listDirectoryChildren(targetDir, agentDir);
   }
   async readFile(agentId, filePath) {
-    const agentDir = path11.join(this.dataDir, agentId);
-    const resolved = path11.resolve(agentDir, filePath);
-    if (!resolved.startsWith(agentDir + path11.sep) && resolved !== agentDir) {
+    const agentDir = path12.join(this.dataDir, agentId);
+    const resolved = path12.resolve(agentDir, filePath);
+    if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
       throw new Error("Access denied");
     }
     const info = await stat2(resolved);
     if (info.isDirectory()) throw new Error("Cannot read a directory");
-    const ext = path11.extname(resolved).toLowerCase();
+    const ext = path12.extname(resolved).toLowerCase();
     if (WORKSPACE_TEXT_EXTENSIONS.has(ext) || ext === "") {
       if (info.size > WORKSPACE_TEXT_FILE_MAX_BYTES) throw new Error("File too large");
       const content = await readFile(resolved, "utf-8");
@@ -5870,13 +6455,13 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const agent = this.agents.get(agentId);
     const runtime = runtimeHint || agent?.config.runtime || "claude";
     const home = os5.homedir();
-    const workspaceDir = path11.join(this.dataDir, agentId);
+    const workspaceDir = path12.join(this.dataDir, agentId);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalResults = await Promise.all(
-      paths.global.map((p) => this.scanSkillsDir(path11.join(home, p)))
+      paths.global.map((p) => this.scanSkillsDir(path12.join(home, p)))
     );
     const workspaceResults = await Promise.all(
-      paths.workspace.map((p) => this.scanSkillsDir(path11.join(workspaceDir, p)))
+      paths.workspace.map((p) => this.scanSkillsDir(path12.join(workspaceDir, p)))
     );
     const dedup = (skills) => {
       const seen = /* @__PURE__ */ new Set();
@@ -5905,7 +6490,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const skills = [];
     for (const entry of entries) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        const skillMd = path11.join(dir, entry.name, "SKILL.md");
+        const skillMd = path12.join(dir, entry.name, "SKILL.md");
         try {
           const content = await readFile(skillMd, "utf-8");
           const skill = this.parseSkillMd(entry.name, content);
@@ -5916,7 +6501,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       } else if (entry.name.endsWith(".md")) {
         const cmdName = entry.name.replace(/\.md$/, "");
         try {
-          const content = await readFile(path11.join(dir, entry.name), "utf-8");
+          const content = await readFile(path12.join(dir, entry.name), "utf-8");
           const skill = this.parseSkillMd(cmdName, content);
           skill.sourcePath = dir;
           skills.push(skill);
@@ -5951,6 +6536,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   /**
    * Broadcast an activity change — emits a single agent:activity event that carries
    * both the status (for the dot indicator) and trajectory entries (for the activity log).
+   *
+   * TODO(lifecycle-v2/daemon-protocol): split this legacy frame into
+   * structured lifecycle producers. Runtime progress, transient heartbeat,
+   * provider/runtime error, process exit, and user-visible activity entries
+   * should carry explicit reason/correlation/window attrs so the server no
+   * longer infers lifecycle semantics from generic activity strings.
    */
   broadcastActivity(agentId, activity, detail, extraTrajectory = [], launchIdOverride) {
     const ap = this.agents.get(agentId);
@@ -6176,8 +6767,9 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       runtime_profile_turn_outcome: control.kind === "migration" ? control.migrationDoneToolObserved ? "migration_done_observed" : "missing_migration_done" : "notice_only"
     };
   }
-  startRuntimeTrace(agentId, ap, reason, messages) {
+  startRuntimeTrace(agentId, ap, reason, messages, inputTraceAttrs = {}) {
     if (ap.runtimeTraceSpan) return ap.runtimeTraceSpan;
+    ap.runtimeTraceCounters = createRuntimeTraceCounters();
     const messageControl = this.runtimeProfileTurnControlFromMessages(messages);
     if (messageControl) {
       this.activateRuntimeProfileTurnControl(ap, messageControl);
@@ -6192,12 +6784,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         reason,
         hasSession: Boolean(ap.sessionId),
         ...this.messagesTraceAttrs(messages),
+        ...inputTraceAttrs,
         ...this.runtimeProfileTurnControlTraceAttrs(ap.runtimeProfileTurnControl)
       }
     });
     span.addEvent("daemon.turn.started", {
       reason,
       ...this.messagesTraceAttrs(messages),
+      ...inputTraceAttrs,
       ...this.runtimeProfileTurnControlTraceAttrs(ap.runtimeProfileTurnControl)
     });
     ap.runtimeTraceSpan = span;
@@ -6306,6 +6900,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       lastActivity: ap.lastActivity,
       lastActivityDetailPresent: Boolean(ap.lastActivityDetail),
       lastActivityDetailKind: classifyActivityDetailForTrace(ap.lastActivityDetail),
+      ...runtimeTraceCounterAttrs(ap),
       ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_stalled")
     });
     this.broadcastActivity(agentId, "error", diagnostic.detail);
@@ -6338,6 +6933,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       lastActivityDetailKind: classifyActivityDetailForTrace(ap.lastActivityDetail),
       pendingMessages: ap.inbox.length,
       recovery: "terminate_for_queued_message",
+      ...runtimeTraceCounterAttrs(ap),
       ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_stalled")
     });
     ap.expectedTerminationReason = "stalled_recovery";
@@ -6365,6 +6961,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const ap = this.agents.get(agentId);
     if (ap) {
       const wasStalled = Boolean(ap.runtimeProgressStaleSince);
+      this.noteRuntimeTraceCounter(ap, event);
       this.recordRuntimeTraceEvent(agentId, ap, "runtime.event.received", { kind: event.kind });
       if (wasStalled) {
         this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.observed", { afterStall: true });
@@ -6492,6 +7089,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           }
           this.endRuntimeTrace(ap, "ok", {
             outcome: "turn-completed",
+            ...runtimeTraceCounterAttrs(ap),
             ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "turn_end")
           });
           if (ap.driver.terminateProcessOnTurnEnd) {
@@ -6533,10 +7131,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
               `[Agent ${agentId}] Disabled Claude tool-boundary gated steering after thinking-block mutation error; lastFlushReason=${ap.gatedSteering.lastFlushReason || "none"}`
             );
           }
-          this.recordRuntimeTraceEvent(agentId, ap, "runtime.error", runtimeErrorDiagnostics.eventAttrs);
+          this.recordRuntimeTraceEvent(agentId, ap, "runtime.error", {
+            ...runtimeErrorDiagnostics.eventAttrs,
+            ...runtimeTraceCounterAttrs(ap)
+          });
           this.endRuntimeTrace(ap, "error", {
             outcome: "runtime-error",
             ...runtimeErrorDiagnostics.spanAttrs,
+            ...runtimeTraceCounterAttrs(ap),
             ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_error")
           });
           if (ap.driver.supportsStdinNotification && classifyTerminalFailure(ap)) {
@@ -6559,6 +7161,29 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   sendAgentStatus(agentId, status, launchId) {
     this.sendToServer({ type: "agent:status", agentId, status, launchId: launchId || void 0 });
   }
+  noteRuntimeTraceCounter(ap, event) {
+    ap.runtimeTraceCounters.events++;
+    switch (event.kind) {
+      case "tool_call":
+        ap.runtimeTraceCounters.toolCalls++;
+        break;
+      case "tool_output":
+        ap.runtimeTraceCounters.toolOutputs++;
+        break;
+      case "compaction_started":
+        ap.runtimeTraceCounters.compactionStarts++;
+        break;
+      case "compaction_finished":
+        ap.runtimeTraceCounters.compactionFinishes++;
+        break;
+      case "text":
+        ap.runtimeTraceCounters.textEvents++;
+        break;
+      case "thinking":
+        ap.runtimeTraceCounters.thinkingEvents++;
+        break;
+    }
+  }
   /** Send a batched notification to the agent via stdin about pending messages */
   sendStdinNotification(agentId) {
     const ap = this.agents.get(agentId);
@@ -6661,6 +7286,14 @@ ${messages.map((message) => formatIncomingMessage(message, ap.driver)).join("\n"
 
 Respond as appropriate. Complete all your work before stopping.
 ${RESPONSE_TARGET_HINT}`);
+    const inputTraceAttrs = buildRuntimeInputTraceAttrs({
+      source: `stdin_${mode}_delivery`,
+      prompt,
+      messages,
+      sessionIdPresent: Boolean(ap.sessionId),
+      nativeStandingPrompt: Boolean(ap.driver.supportsNativeStandingPrompt)
+    });
+    this.recordRuntimeTraceEvent(agentId, ap, "runtime.input.prepared", inputTraceAttrs);
     const encoded = ap.driver.encodeStdinMessage(prompt, ap.sessionId, { mode });
     if (!encoded) {
       ap.inbox.unshift(...messages);
@@ -6672,6 +7305,7 @@ ${RESPONSE_TARGET_HINT}`);
       );
       this.recordDaemonTrace("daemon.agent.stdin_delivery", {
         ...traceAttrs,
+        ...inputTraceAttrs,
         outcome: "encode_failed",
         requeued_messages_count: messages.length
       }, "error");
@@ -6688,6 +7322,7 @@ ${RESPONSE_TARGET_HINT}`);
     this.ackInjectedRuntimeProfileMessages(agentId, messages, ap.launchId);
     this.recordDaemonTrace("daemon.agent.stdin_delivery", {
       ...traceAttrs,
+      ...inputTraceAttrs,
       outcome: "written",
       stdin_write_attempted: true
     });
@@ -6709,8 +7344,8 @@ ${RESPONSE_TARGET_HINT}`);
     const nodes = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const fullPath = path11.join(dir, entry.name);
-      const relativePath = path11.relative(rootDir, fullPath);
+      const fullPath = path12.join(dir, entry.name);
+      const relativePath = path12.relative(rootDir, fullPath);
       let info;
       try {
         info = await stat2(fullPath);
@@ -7013,9 +7648,9 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
 import os6 from "os";
-import path12 from "path";
+import path13 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
   code = "DAEMON_MACHINE_LOCK_HELD";
@@ -7037,7 +7672,7 @@ function resolveDefaultMachineStateRoot() {
   return resolveSlockHomePath("machines");
 }
 function ownerPath(lockDir) {
-  return path12.join(lockDir, "owner.json");
+  return path13.join(lockDir, "owner.json");
 }
 function readOwner(lockDir) {
   try {
@@ -7067,13 +7702,13 @@ function acquireDaemonMachineLock(options) {
   const rootDir = options.rootDir ?? resolveDefaultMachineStateRoot();
   const fingerprint = apiKeyFingerprint(options.apiKey);
   const lockId = getDaemonMachineLockId(options.apiKey);
-  const machineDir = path12.join(rootDir, lockId);
-  const lockDir = path12.join(machineDir, "daemon.lock");
+  const machineDir = path13.join(rootDir, lockId);
+  const lockDir = path13.join(machineDir, "daemon.lock");
   const token = randomUUID2();
-  mkdirSync5(machineDir, { recursive: true });
+  mkdirSync6(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync5(lockDir);
+      mkdirSync6(lockDir);
       const owner = {
         pid: process.pid,
         token,
@@ -7083,7 +7718,7 @@ function acquireDaemonMachineLock(options) {
         apiKeyFingerprint: fingerprint.slice(0, 16)
       };
       try {
-        writeFileSync8(ownerPath(lockDir), `${JSON.stringify(owner, null, 2)}
+        writeFileSync9(ownerPath(lockDir), `${JSON.stringify(owner, null, 2)}
 `, { mode: 384 });
       } catch (err) {
         rmSync2(lockDir, { recursive: true, force: true });
@@ -7120,8 +7755,8 @@ function acquireDaemonMachineLock(options) {
 }
 
 // src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
-import path13 from "path";
+import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync4, rmSync as rmSync3, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
+import path14 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_FILES = 8;
@@ -7157,7 +7792,7 @@ var LocalRotatingTraceSink = class {
   currentSize = 0;
   sequence = 0;
   constructor(options) {
-    this.traceDir = path13.join(options.machineDir, "traces");
+    this.traceDir = path14.join(options.machineDir, "traces");
     this.maxFileBytes = Math.max(1024, Math.floor(options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES));
     const baseAgeMs = Math.max(1e3, Math.floor(options.maxFileAgeMs ?? DEFAULT_MAX_FILE_AGE_MS));
     const ageJitterMs = Math.max(0, Math.floor(options.maxFileAgeJitterMs ?? 0));
@@ -7183,26 +7818,26 @@ var LocalRotatingTraceSink = class {
     return this.currentFile;
   }
   ensureFile(nextBytes) {
-    mkdirSync6(this.traceDir, { recursive: true, mode: 448 });
+    mkdirSync7(this.traceDir, { recursive: true, mode: 448 });
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
-      this.currentFile = path13.join(
+      this.currentFile = path14.join(
         this.traceDir,
         `daemon-trace-${safeTimestamp(nowMs)}-${process.pid}-${String(this.sequence++).padStart(4, "0")}.jsonl`
       );
-      writeFileSync9(this.currentFile, "", { flag: "a", mode: 384 });
+      writeFileSync10(this.currentFile, "", { flag: "a", mode: 384 });
       this.currentSize = statSync4(this.currentFile).size;
       this.currentFileOpenedAtMs = nowMs;
       this.pruneOldFiles();
     }
   }
   pruneOldFiles() {
-    const files = readdirSync3(this.traceDir).filter((name) => name.startsWith("daemon-trace-") && name.endsWith(".jsonl")).sort();
+    const files = readdirSync4(this.traceDir).filter((name) => name.startsWith("daemon-trace-") && name.endsWith(".jsonl")).sort();
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync3(path13.join(this.traceDir, file), { force: true });
+      rmSync3(path14.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -7289,11 +7924,11 @@ function isDiagnosticErrorAttr(key) {
 import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 import { gzipSync } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 
 // src/directUploadCapability.ts
-function joinUrl(base, path16) {
-  return `${base.replace(/\/+$/, "")}${path16}`;
+function joinUrl(base, path17) {
+  return `${base.replace(/\/+$/, "")}${path17}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -7512,7 +8147,7 @@ var DaemonTraceBundleUploader = class {
     }, nextMs);
   }
   async findUploadCandidates() {
-    const traceDir = path14.join(this.options.machineDir, "traces");
+    const traceDir = path15.join(this.options.machineDir, "traces");
     let names;
     try {
       names = await readdir3(traceDir);
@@ -7524,8 +8159,8 @@ var DaemonTraceBundleUploader = class {
     const currentFile = this.options.currentFileProvider?.();
     const candidates = [];
     for (const name of names.filter((entry) => entry.startsWith("daemon-trace-") && entry.endsWith(".jsonl")).sort()) {
-      const file = path14.join(traceDir, name);
-      if (currentFile && path14.resolve(file) === path14.resolve(currentFile)) continue;
+      const file = path15.join(traceDir, name);
+      if (currentFile && path15.resolve(file) === path15.resolve(currentFile)) continue;
       if (await this.isUploaded(file)) continue;
       try {
         const info = await stat3(file);
@@ -7599,8 +8234,8 @@ var DaemonTraceBundleUploader = class {
     }
   }
   uploadStatePath(file) {
-    const stateDir = path14.join(this.options.machineDir, "trace-uploads");
-    return path14.join(stateDir, `${path14.basename(file)}.uploaded.json`);
+    const stateDir = path15.join(this.options.machineDir, "trace-uploads");
+    return path15.join(stateDir, `${path15.basename(file)}.uploaded.json`);
   }
   async isUploaded(file) {
     try {
@@ -7612,9 +8247,9 @@ var DaemonTraceBundleUploader = class {
   }
   async markUploaded(file, metadata) {
     const stateFile = this.uploadStatePath(file);
-    await mkdir2(path14.dirname(stateFile), { recursive: true, mode: 448 });
+    await mkdir2(path15.dirname(stateFile), { recursive: true, mode: 448 });
     await writeFile2(stateFile, `${JSON.stringify({
-      file: path14.basename(file),
+      file: path15.basename(file),
       uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...metadata
     }, null, 2)}
@@ -7633,10 +8268,10 @@ function readPositiveIntegerEnv2(name, fallback) {
 
 // src/core.ts
 var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
-function parseDaemonCliArgs(args) {
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -7653,23 +8288,23 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveChatBridgePath(moduleUrl = import.meta.url) {
-  const dirname = path15.dirname(fileURLToPath(moduleUrl));
-  const jsPath = path15.resolve(dirname, "chat-bridge.js");
+  const dirname = path16.dirname(fileURLToPath2(moduleUrl));
+  const jsPath = path16.resolve(dirname, "chat-bridge.js");
   try {
     accessSync(jsPath);
     return jsPath;
   } catch {
-    return path15.resolve(dirname, "chat-bridge.ts");
+    return path16.resolve(dirname, "chat-bridge.ts");
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path15.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path15.resolve(thisDir, "cli", "index.js");
+  const thisDir = path16.dirname(fileURLToPath2(moduleUrl));
+  const bundledDistPath = path16.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path15.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path16.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -7848,7 +8483,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path15.join(path15.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path16.join(path16.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -8231,6 +8866,8 @@ var DaemonCore = class {
 };
 
 export {
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,