@slock-ai/daemon 0.50.0 → 0.51.0

package/dist/{chunk-EXJF5JKE.js → chunk-NAMH7BB6.js}

@@ -777,7 +777,7 @@ import os2 from "os";
 import path4 from "path";
 
 // src/drivers/cliTransport.ts
-import { mkdirSync, writeFileSync } from "fs";
+import { mkdirSync, rmSync, writeFileSync } from "fs";
 import path2 from "path";
 
 // src/drivers/systemPrompt.ts
@@ -870,7 +870,7 @@ Use the \`slock\` CLI for chat / task / attachment operations. The daemon inject
 16. **\`slock attachment upload\`** \u2014 Upload a file to attach to a message. Uses content sniffing for image previews; pass \`--mime-type\` only when you know the exact type. Returns an attachment ID to pass to \`slock message send\`.
 17. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
 18. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
-19. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--display-name <name>\`, and \`--description <text>\`. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
+19. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--avatar-url pixel:random:<seed>\`, \`--display-name <name>\`, and \`--description <text>\`. Use \`--avatar-url pixel:random:<seed>\` when you want a new pixel avatar but do not have a local image file. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
 20. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
 21. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
 22. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
@@ -1349,8 +1349,304 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/agentCredentialProxy.ts
+import { randomBytes } from "crypto";
+import http from "http";
+import { URL as URL2 } from "url";
+var registrations = /* @__PURE__ */ new Map();
+var servers = /* @__PURE__ */ new Map();
+function allocatePort() {
+  return 43e3 + randomBytes(2).readUInt16BE(0) % 1e4;
+}
+function ensureServer(port) {
+  if (servers.has(port)) return;
+  const server = http.createServer((req, res) => {
+    void handleProxyRequest(req, res);
+  });
+  server.on("error", (err) => {
+    logger.warn(`[Agent Credential Proxy] local proxy on port ${port} failed: ${err.message}`);
+  });
+  server.listen(port, "127.0.0.1");
+  server.unref();
+  servers.set(port, server);
+}
+async function handleProxyRequest(req, res) {
+  const auth = req.headers.authorization;
+  const token = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
+  const registration = registrations.get(token);
+  if (!registration) {
+    res.writeHead(401, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid local agent proxy token", code: "invalid_agent_proxy_token" }));
+    return;
+  }
+  try {
+    const target = new URL2(req.url ?? "/", registration.serverUrl);
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+      if (value === void 0) continue;
+      if (name.toLowerCase() === "host") continue;
+      if (name.toLowerCase() === "authorization") continue;
+      if (Array.isArray(value)) {
+        for (const item of value) headers.append(name, item);
+      } else {
+        headers.set(name, value);
+      }
+    }
+    headers.set("Authorization", `Bearer ${registration.apiKey}`);
+    headers.set("X-Agent-Id", registration.agentId);
+    headers.set("X-Slock-Client", "cli");
+    headers.set("X-Slock-Agent-Active-Capabilities", registration.activeCapabilities);
+    const method = req.method ?? "GET";
+    let body = method === "GET" || method === "HEAD" ? void 0 : req;
+    let sendTarget;
+    if (method === "POST" && target.pathname === "/internal/agent-api/send") {
+      const rawBody = await readRequestBody(req);
+      const prepared = await prepareAgentApiSendForward(registration, headers, rawBody);
+      if (prepared.localResponse) {
+        const responseText = JSON.stringify(prepared.localResponse);
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(responseText);
+        return;
+      }
+      body = prepared.bodyText;
+      sendTarget = prepared.target;
+      headers.set("content-type", "application/json");
+      headers.set("content-length", String(Buffer.byteLength(prepared.bodyText)));
+    }
+    const upstream = await fetch(target, {
+      method,
+      headers,
+      body,
+      // Required by undici when forwarding a Node stream.
+      duplex: body ? "half" : void 0
+    });
+    if (shouldBufferJsonResponse(upstream, target.pathname, registration)) {
+      const responseText = await upstream.text();
+      consumeVisibleResponse(registration, target, sendTarget, responseText);
+      res.writeHead(upstream.status, Object.fromEntries(upstream.headers.entries()));
+      res.end(responseText);
+      return;
+    }
+    res.writeHead(upstream.status, Object.fromEntries(upstream.headers.entries()));
+    if (upstream.body) {
+      const reader = upstream.body.getReader();
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          res.write(Buffer.from(value));
+        }
+      } finally {
+        res.end();
+      }
+    } else {
+      res.end();
+    }
+  } catch (err) {
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(JSON.stringify({
+      error: "failed to proxy local agent request",
+      code: "agent_proxy_failed",
+      detail: err instanceof Error ? err.message : String(err)
+    }));
+  }
+}
+async function readRequestBody(req) {
+  let body = "";
+  req.setEncoding("utf8");
+  for await (const chunk of req) {
+    body += String(chunk);
+  }
+  return body;
+}
+function messageSeq(message) {
+  return Number(message.seq ?? 0);
+}
+function boundaryBefore(messages) {
+  let minSeq = Number.POSITIVE_INFINITY;
+  for (const message of messages) {
+    const seq = Math.floor(messageSeq(message));
+    if (Number.isFinite(seq) && seq > 0) minSeq = Math.min(minSeq, seq);
+  }
+  return Number.isFinite(minSeq) ? Math.max(0, minSeq - 1) : void 0;
+}
+function maxMessageSeq(messages) {
+  let maxSeq = 0;
+  for (const message of messages) {
+    const seq = Math.floor(messageSeq(message));
+    if (Number.isFinite(seq) && seq > 0) maxSeq = Math.max(maxSeq, seq);
+  }
+  return maxSeq > 0 ? maxSeq : void 0;
+}
+function parseTargetFields(target) {
+  if (target.startsWith("dm:@")) {
+    const rest = target.slice("dm:@".length);
+    const [peer, threadId] = rest.split(":", 2);
+    if (threadId) {
+      return {
+        channel_type: "thread",
+        channel_name: threadId,
+        parent_channel_type: "dm",
+        parent_channel_name: peer
+      };
+    }
+    return { channel_type: "dm", channel_name: peer };
+  }
+  if (target.startsWith("#")) {
+    const rest = target.slice(1);
+    const [channel, threadId] = rest.split(":", 2);
+    if (threadId) {
+      return {
+        channel_type: "thread",
+        channel_name: threadId,
+        parent_channel_type: "channel",
+        parent_channel_name: channel
+      };
+    }
+    return { channel_type: "channel", channel_name: channel };
+  }
+  return {};
+}
+function normalizeVisibleMessage(message, target) {
+  const targetFields = target ? parseTargetFields(target) : {};
+  return {
+    ...targetFields,
+    ...message,
+    message_id: message.message_id ?? message.id,
+    timestamp: message.timestamp ?? message.createdAt,
+    sender_type: message.sender_type ?? message.senderType,
+    sender_name: message.sender_name ?? message.senderName,
+    sender_description: message.sender_description ?? message.senderDescription ?? null
+  };
+}
+function normalizeVisibleMessages(messages, target) {
+  return messages.map((message) => normalizeVisibleMessage(message, target));
+}
+async function loadRecentTargetMessages(registration, headers, target) {
+  const historyUrl = new URL2("/internal/agent-api/history", registration.serverUrl);
+  historyUrl.searchParams.set("channel", target);
+  historyUrl.searchParams.set("limit", "3");
+  const historyHeaders = new Headers(headers);
+  historyHeaders.delete("content-length");
+  historyHeaders.delete("content-type");
+  const res = await fetch(historyUrl, { method: "GET", headers: historyHeaders });
+  if (!res.ok) return [];
+  const parsed = await res.json().catch(() => null);
+  return Array.isArray(parsed?.messages) ? normalizeVisibleMessages(parsed.messages, target) : [];
+}
+async function prepareAgentApiSendForward(registration, headers, rawBody) {
+  let body;
+  try {
+    body = rawBody ? JSON.parse(rawBody) : {};
+  } catch {
+    return { bodyText: rawBody };
+  }
+  const target = typeof body.target === "string" ? body.target : void 0;
+  const coordinator = registration.inboxCoordinator;
+  if (!target || !coordinator || body.continueAnyway === true) {
+    return { bodyText: JSON.stringify(body), target };
+  }
+  const pending = coordinator.getPendingMessages(target);
+  if (pending.length > 0) {
+    const staleBoundary = boundaryBefore(pending);
+    if (staleBoundary !== void 0) {
+      body.seenUpToSeq = staleBoundary;
+    }
+    return { bodyText: JSON.stringify(body), target };
+  }
+  const existingBoundary = typeof body.seenUpToSeq === "number" && Number.isFinite(body.seenUpToSeq) ? Math.max(0, Math.floor(body.seenUpToSeq)) : void 0;
+  const loadedBoundary = coordinator.getBoundary(target);
+  const boundary = Math.max(existingBoundary ?? 0, loadedBoundary ?? 0);
+  if (boundary > 0) {
+    body.seenUpToSeq = boundary;
+    return { bodyText: JSON.stringify(body), target };
+  }
+  const recent = await loadRecentTargetMessages(registration, headers, target);
+  if (recent.length > 0) {
+    const seenUpToSeq = maxMessageSeq(recent);
+    coordinator.consumeVisibleMessages({ target, messages: recent, boundarySeq: seenUpToSeq, source: "send_preflight_context" });
+    return {
+      bodyText: JSON.stringify(body),
+      target,
+      localResponse: {
+        state: "held",
+        seenUpToSeq,
+        heldMessages: recent,
+        newMessageCount: recent.length,
+        shownMessageCount: recent.length,
+        omittedMessageCount: 0
+      }
+    };
+  }
+  return { bodyText: JSON.stringify(body), target };
+}
+function shouldBufferJsonResponse(upstream, pathname, registration) {
+  if (!registration.inboxCoordinator) return false;
+  const contentType = upstream.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) return false;
+  return pathname === "/internal/agent-api/send" || pathname === "/internal/agent-api/events" || pathname === "/internal/agent-api/history";
+}
+function consumeVisibleResponse(registration, targetUrl, sendTarget, responseText) {
+  const coordinator = registration.inboxCoordinator;
+  if (!coordinator) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(responseText);
+  } catch {
+    return;
+  }
+  if (targetUrl.pathname === "/internal/agent-api/send" && parsed.state === "held" && Array.isArray(parsed.heldMessages)) {
+    coordinator.consumeVisibleMessages({
+      target: sendTarget,
+      messages: normalizeVisibleMessages(parsed.heldMessages, sendTarget),
+      boundarySeq: typeof parsed.seenUpToSeq === "number" ? parsed.seenUpToSeq : void 0,
+      source: "server_held_context"
+    });
+    return;
+  }
+  if (targetUrl.pathname === "/internal/agent-api/events" && Array.isArray(parsed.events)) {
+    coordinator.consumeVisibleMessages({ messages: normalizeVisibleMessages(parsed.events), source: "agent_api_events" });
+    return;
+  }
+  if (targetUrl.pathname === "/internal/agent-api/history" && Array.isArray(parsed.messages)) {
+    const target = targetUrl.searchParams.get("channel") ?? void 0;
+    const messages = normalizeVisibleMessages(parsed.messages, target);
+    coordinator.consumeVisibleMessages({ target, messages, boundarySeq: maxMessageSeq(messages), source: "agent_api_history" });
+  }
+}
+function registerAgentCredentialProxy(input) {
+  const port = allocatePort();
+  ensureServer(port);
+  const proxyToken = `sap_${randomBytes(32).toString("base64url")}`;
+  registrations.set(proxyToken, {
+    serverUrl: input.serverUrl,
+    apiKey: input.apiKey,
+    agentId: input.agentId,
+    launchId: input.launchId ?? null,
+    activeCapabilities: input.activeCapabilities,
+    inboxCoordinator: input.inboxCoordinator
+  });
+  return {
+    proxyUrl: `http://127.0.0.1:${port}`,
+    proxyToken
+  };
+}
+function unregisterAgentCredentialProxyForLaunch(input) {
+  let removed = 0;
+  const launchId = input.launchId ?? null;
+  for (const [token, registration] of registrations) {
+    if (registration.agentId === input.agentId && registration.launchId === launchId) {
+      registrations.delete(token);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+
 // src/drivers/cliTransport.ts
 var shellSingleQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+var DEFAULT_ACTIVE_CAPABILITIES = "send,read,mentions,tasks,reactions,server,channels";
+var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 function runtimeContextEnv(config) {
   const ctx = config.runtimeContext;
   if (!ctx) return {};
@@ -1374,17 +1670,43 @@ function prepareCliTransport(ctx, extraEnv = {}, platform = process.platform) {
   }
   const slockDir = path2.join(ctx.workingDirectory, ".slock");
   mkdirSync(slockDir, { recursive: true });
+  const slockHome = resolveSlockHome();
   const tokenFile = path2.join(slockDir, "agent-token");
-  writeFileSync(tokenFile, ctx.config.authToken || ctx.daemonApiKey, { mode: 384 });
+  const agentCredentialKey = ctx.config.agentCredentialKey;
+  let agentCredentialProxy = null;
+  let agentCredentialProxyTokenFile = null;
+  if (typeof agentCredentialKey === "string" && agentCredentialKey.length > 0) {
+    rmSync(tokenFile, { force: true });
+    agentCredentialProxy = registerAgentCredentialProxy({
+      agentId: ctx.agentId,
+      launchId: ctx.launchId,
+      serverUrl: ctx.config.serverUrl,
+      apiKey: agentCredentialKey,
+      activeCapabilities: DEFAULT_ACTIVE_CAPABILITIES,
+      inboxCoordinator: ctx.agentCredentialProxyInboxCoordinator
+    });
+    const launchPart = safePathPart(ctx.launchId || `pid-${process.pid}`);
+    const proxyTokenDir = path2.join(slockHome, "agent-proxy-tokens", safePathPart(ctx.agentId));
+    mkdirSync(proxyTokenDir, { recursive: true, mode: 448 });
+    agentCredentialProxyTokenFile = path2.join(proxyTokenDir, `${launchPart}.token`);
+    writeFileSync(agentCredentialProxyTokenFile, agentCredentialProxy.proxyToken, { mode: 384 });
+  } else {
+    writeFileSync(tokenFile, ctx.config.authToken || ctx.daemonApiKey, { mode: 384 });
+  }
   const posixWrapper = path2.join(slockDir, "slock");
+  const posixCredentialPrefix = agentCredentialProxy ? `SLOCK_AGENT_PROXY_URL=${shellSingleQuote(agentCredentialProxy.proxyUrl)} SLOCK_AGENT_PROXY_TOKEN_FILE=${shellSingleQuote(agentCredentialProxyTokenFile)} SLOCK_AGENT_ACTIVE_CAPABILITIES=${shellSingleQuote(DEFAULT_ACTIVE_CAPABILITIES)} ` : "";
   const posixBody = `#!/usr/bin/env bash
-exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(ctx.slockCliPath)} "$@"
+${posixCredentialPrefix}exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(ctx.slockCliPath)} "$@"
 `;
   writeFileSync(posixWrapper, posixBody, { mode: 493 });
   if (platform === "win32") {
     const cmdWrapper = path2.join(slockDir, "slock.cmd");
+    const cmdCredentialLine = agentCredentialProxy ? `set "SLOCK_AGENT_PROXY_URL=${agentCredentialProxy.proxyUrl}"\r
+set "SLOCK_AGENT_PROXY_TOKEN_FILE=${agentCredentialProxyTokenFile}"\r
+set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
+` : "";
     const cmdBody = `@echo off\r
-"${process.execPath}" "${ctx.slockCliPath}" %*\r
+${cmdCredentialLine}"${process.execPath}" "${ctx.slockCliPath}" %*\r
 `;
     writeFileSync(cmdWrapper, cmdBody);
   }
@@ -1395,17 +1717,27 @@ exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(ctx.slockCliPath)}
     ...ctx.config.envVars || {},
     ...extraEnv,
     ...runtimeContextEnv(ctx.config),
-    [SLOCK_HOME_ENV]: resolveSlockHome(),
+    [SLOCK_HOME_ENV]: slockHome,
     SLOCK_AGENT_ID: ctx.agentId,
     ...ctx.launchId ? { SLOCK_AGENT_LAUNCH_ID: ctx.launchId } : {},
     SLOCK_SERVER_URL: ctx.config.serverUrl,
-    SLOCK_AGENT_TOKEN_FILE: tokenFile,
+    ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
   delete spawnEnv.SLOCK_AGENT_TOKEN;
+  delete spawnEnv.SLOCK_AGENT_CREDENTIAL_KEY;
+  delete spawnEnv.SLOCK_AGENT_CREDENTIAL_KEY_FILE;
+  delete spawnEnv.SLOCK_AGENT_PROXY_URL;
+  delete spawnEnv.SLOCK_AGENT_PROXY_TOKEN;
+  delete spawnEnv.SLOCK_AGENT_PROXY_TOKEN_FILE;
+  delete spawnEnv.SLOCK_AGENT_ACTIVE_CAPABILITIES;
+  if (agentCredentialProxy) {
+    delete spawnEnv.SLOCK_AGENT_TOKEN_FILE;
+  }
   return {
     slockDir,
     tokenFile,
+    agentCredentialProxyUrl: agentCredentialProxy?.proxyUrl ?? null,
     wrapperPath,
     spawnEnv
   };
@@ -1573,7 +1905,7 @@ function collectClaudeMcpConfigFiles(ctx, home) {
   return files;
 }
 function buildClaudeUserMcpServers(ctx, home) {
-  const servers = /* @__PURE__ */ Object.create(null);
+  const servers2 = /* @__PURE__ */ Object.create(null);
   for (const configFile of collectClaudeMcpConfigFiles(ctx, home)) {
     const mcpServers = readClaudeMcpServers(configFile.path, configFile.vars);
     if (!mcpServers) continue;
@@ -1582,10 +1914,10 @@ function buildClaudeUserMcpServers(ctx, home) {
         logger.warn(`[Claude] ignoring invalid MCP server "${name}" in ${configFile.path}`);
         continue;
       }
-      servers[name] = server;
+      servers2[name] = server;
     }
   }
-  return servers;
+  return servers2;
 }
 var ClaudeDriver = class {
   id = "claude";
@@ -1633,9 +1965,9 @@ var ClaudeDriver = class {
       CLAUDE_DISALLOWED_TOOLS
     ];
     if (opts.standingPromptFilePath) {
-      args.push("--system-prompt-file", opts.standingPromptFilePath);
+      args.push("--append-system-prompt-file", opts.standingPromptFilePath);
     } else {
-      args.push("--system-prompt", standingPrompt);
+      args.push("--append-system-prompt", standingPrompt);
     }
     if (config.sessionId) {
       args.push("--resume", config.sessionId);
@@ -1883,13 +2215,29 @@ function resolveWindowsNpmCodexEntry(deps = {}) {
   }
   return null;
 }
+function resolveWindowsCodexDesktopEntry(deps = {}) {
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
+  const env = deps.env ?? process.env;
+  const homeDir = deps.homeDir;
+  const winPath = path5.win32;
+  const candidates = [
+    env.LOCALAPPDATA ? winPath.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin", "codex.exe") : null,
+    env.USERPROFILE ? winPath.join(env.USERPROFILE, "AppData", "Local", "OpenAI", "Codex", "bin", "codex.exe") : null,
+    homeDir ? winPath.join(homeDir, "AppData", "Local", "OpenAI", "Codex", "bin", "codex.exe") : null
+  ].filter((candidate) => Boolean(candidate));
+  for (const candidate of candidates) {
+    if (existsSyncFn(candidate)) return candidate;
+  }
+  return null;
+}
 function resolveCodexCommand(deps = {}) {
   const platform = deps.platform ?? process.platform;
   if (platform === "win32") {
     const npmEntry = resolveWindowsNpmCodexEntry(deps);
     if (npmEntry) return npmEntry;
     const command = resolveCommandOnPath("codex", deps);
-    return command && !isWindowsSandboxRunner(command) ? command : null;
+    if (command && !isWindowsSandboxRunner(command)) return command;
+    return resolveWindowsCodexDesktopEntry(deps);
   }
   const pathCommand = resolveCommandOnPath("codex", deps);
   if (pathCommand) return pathCommand;
@@ -1932,6 +2280,10 @@ function resolveCodexSpawn(commandArgs, deps = {}) {
   if (command && !isWindowsSandboxRunner(command)) {
     return { command, args: commandArgs };
   }
+  const desktopEntry = resolveWindowsCodexDesktopEntry(deps);
+  if (desktopEntry) {
+    return { command: desktopEntry, args: commandArgs };
+  }
   throw new Error(
     "Cannot resolve Codex CLI entry point on Windows. Install Codex Desktop or install @openai/codex globally via npm (npm i -g @openai/codex). Ignoring .codex/.sandbox-bin/codex-command-runner because it is a sandbox helper, not the Codex CLI."
   );
@@ -3297,6 +3649,18 @@ function isSupportedOpenCodeVersion(version) {
   }
   return true;
 }
+var AGENT_FLAG_CUTOFF_VERSION = "1.15.0";
+function requiresAgentCliFlag(version) {
+  if (!version) return true;
+  const actual = parseSemver(version);
+  const cutoff = parseSemver(AGENT_FLAG_CUTOFF_VERSION);
+  if (!actual || !cutoff) return true;
+  for (let i = 0; i < 3; i += 1) {
+    if (actual[i] > cutoff[i]) return false;
+    if (actual[i] < cutoff[i]) return true;
+  }
+  return false;
+}
 function unsupportedOpenCodeVersionMessage(version) {
   if (!version || isSupportedOpenCodeVersion(version)) return null;
   return `OpenCode CLI ${version} is unsupported; requires OpenCode >= ${MIN_SUPPORTED_OPENCODE_VERSION}. Upgrade opencode before starting this runtime.`;
@@ -3344,7 +3708,7 @@ function buildOpenCodeConfig(ctx, home = os5.homedir()) {
     }
   };
 }
-function buildOpenCodeLaunchOptions(ctx, home = os5.homedir()) {
+function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
   const slock = prepareCliTransport(ctx, { NO_COLOR: "1" });
   const config = buildOpenCodeConfig(ctx, home);
   const env = {
@@ -3363,7 +3727,9 @@ function buildOpenCodeLaunchOptions(ctx, home = os5.homedir()) {
   if (ctx.config.model && ctx.config.model !== "default") {
     args.push("--model", ctx.config.model);
   }
-  args.push("--agent", SLOCK_AGENT_NAME);
+  if (requiresAgentCliFlag(version)) {
+    args.push("--agent", SLOCK_AGENT_NAME);
+  }
   if (ctx.config.sessionId) {
     args.push("--session", ctx.config.sessionId);
   }
@@ -3499,7 +3865,8 @@ var OpenCodeDriver = class {
           model: modelId
         }
       };
-      const launch = buildOpenCodeLaunchOptions(launchCtx, opts?.home);
+      const version = readCommandVersion("opencode");
+      const launch = buildOpenCodeLaunchOptions(launchCtx, opts?.home, version);
       return {
         args: launch.args,
         env: launch.env,
@@ -3536,11 +3903,12 @@ var OpenCodeDriver = class {
   spawn(ctx) {
     this.sessionId = ctx.config.sessionId || null;
     this.sessionAnnounced = false;
-    const unsupportedMessage = unsupportedOpenCodeVersionMessage(readCommandVersion("opencode"));
+    const version = readCommandVersion("opencode");
+    const unsupportedMessage = unsupportedOpenCodeVersionMessage(version);
     if (unsupportedMessage) {
       throw new Error(unsupportedMessage);
     }
-    const launch = buildOpenCodeLaunchOptions(ctx);
+    const launch = buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
     const proc = spawn7("opencode", launch.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
@@ -3813,6 +4181,8 @@ function redactUrlQuery(value) {
 // src/agentProcessManager.ts
 var DEFAULT_MAX_CONCURRENT_AGENT_STARTS = 5;
 var DEFAULT_AGENT_START_INTERVAL_MS = 500;
+var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS = 3;
+var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS = 250;
 var WORKSPACE_TEXT_FILE_MAX_BYTES = 1048576;
 var WORKSPACE_IMAGE_PREVIEW_MAX_BYTES = 5 * 1024 * 1024;
 var WORKSPACE_TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -3857,6 +4227,41 @@ function readNonNegativeIntegerEnv(name, fallback) {
   if (!Number.isFinite(parsed) || parsed < 0) return fallback;
   return Math.floor(parsed);
 }
+var RunnerCredentialMintError = class extends Error {
+  code;
+  retryable;
+  status;
+  constructor(message, opts) {
+    super(message);
+    this.name = "RunnerCredentialMintError";
+    this.code = opts.code;
+    this.retryable = opts.retryable ?? false;
+    this.status = opts.status;
+  }
+};
+function isRetryableMintHttpFailure(status, code) {
+  if (code === "experimental_surface_disabled") return false;
+  return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function runnerCredentialErrorDetail(error) {
+  if (error instanceof RunnerCredentialMintError) {
+    return {
+      message: error.message,
+      code: error.code,
+      retryable: error.retryable,
+      status: error.status
+    };
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    message,
+    code: "runner_credential_mint_network_error",
+    retryable: true
+  };
+}
+async function waitForRunnerCredentialRetry() {
+  await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS));
+}
 function stalledRecoverySigtermTimeoutMs() {
   return readNonNegativeIntegerEnv(
     "SLOCK_DAEMON_STALLED_RECOVERY_SIGTERM_TIMEOUT_MS",
@@ -3885,6 +4290,22 @@ function formatMessageTarget(message) {
   }
   return `#${message.channel_name}`;
 }
+function formatVisibleMessageTarget(message) {
+  if (message.channel_type === "thread" && message.parent_channel_name && message.channel_name) {
+    const shortId = getMessageShortId(String(message.channel_name));
+    if (message.parent_channel_type === "dm") {
+      return `dm:@${message.parent_channel_name}:${shortId}`;
+    }
+    return `#${message.parent_channel_name}:${shortId}`;
+  }
+  if (message.channel_type === "dm" && message.channel_name) {
+    return `dm:@${message.channel_name}`;
+  }
+  if (message.channel_name) {
+    return `#${message.channel_name}`;
+  }
+  return null;
+}
 function getMessageShortId(messageId) {
   return messageId.startsWith("thread-") ? messageId.slice(7) : messageId.slice(0, 8);
 }
@@ -4505,6 +4926,14 @@ function createRuntimeTraceCounters() {
     thinkingEvents: 0
   };
 }
+function cleanupAgentCredentialProxy(agentId, launchId) {
+  unregisterAgentCredentialProxyForLaunch({ agentId, launchId });
+}
+function stripManagedRunnerCredential(config) {
+  if (!config.agentCredentialKey && !config.agentCredentialId) return config;
+  const { agentCredentialKey: _agentCredentialKey, agentCredentialId: _agentCredentialId, ...rest } = config;
+  return rest;
+}
 function createGatedSteeringState() {
   return {
     phase: "idle",
@@ -4836,6 +5265,7 @@ var AgentProcessManager = class _AgentProcessManager {
   tracer;
   deliveryTraceContexts = /* @__PURE__ */ new WeakMap();
   processExitTraceAttrs = /* @__PURE__ */ new WeakMap();
+  agentVisibleBoundaries = /* @__PURE__ */ new Map();
   constructor(chatBridgePath, sendToServer, daemonApiKey, opts) {
     this.chatBridgePath = chatBridgePath;
     this.slockCliPath = opts.slockCliPath ?? "";
@@ -4863,6 +5293,97 @@ var AgentProcessManager = class _AgentProcessManager {
   setTracer(tracer) {
     this.tracer = tracer;
   }
+  visibleBoundaryMap(agentId) {
+    let map = this.agentVisibleBoundaries.get(agentId);
+    if (!map) {
+      map = /* @__PURE__ */ new Map();
+      this.agentVisibleBoundaries.set(agentId, map);
+    }
+    return map;
+  }
+  getVisibleBoundary(agentId, target) {
+    return this.agentVisibleBoundaries.get(agentId)?.get(target);
+  }
+  pendingVisibleMessages(agentId, target) {
+    const collect = (messages) => (messages ?? []).filter((message) => formatMessageTarget(message) === target && typeof message.seq === "number" && message.seq > 0);
+    return [
+      ...collect(this.agents.get(agentId)?.inbox),
+      ...collect(this.startingInboxes.get(agentId))
+    ];
+  }
+  /**
+   * Single-inbox consume point for messages that have been rendered into the
+   * agent-visible input surface. Daemon pending inbox is only a runner cache:
+   * once a message is visible through wake/stdin/check/read/held/preflight, the
+   * same seq must not be injected later through the local pending queue.
+   */
+  consumeVisibleMessages(agentId, input) {
+    if (input.messages.length === 0 && (!input.target || typeof input.boundarySeq !== "number")) return;
+    const byTarget = /* @__PURE__ */ new Map();
+    const ensureBucket = (target) => {
+      let bucket = byTarget.get(target);
+      if (!bucket) {
+        bucket = { maxSeq: 0, boundarySeq: 0, seqs: /* @__PURE__ */ new Set(), ids: /* @__PURE__ */ new Set() };
+        byTarget.set(target, bucket);
+      }
+      return bucket;
+    };
+    for (const message of input.messages) {
+      const seq = Number(message.seq ?? 0);
+      if (!Number.isFinite(seq) || seq <= 0) continue;
+      const target = input.target ?? formatVisibleMessageTarget(message);
+      if (!target) continue;
+      const bucket = ensureBucket(target);
+      bucket.maxSeq = Math.max(bucket.maxSeq, Math.floor(seq));
+      bucket.seqs.add(Math.floor(seq));
+      const id = typeof message.id === "string" ? message.id : typeof message.message_id === "string" ? message.message_id : null;
+      if (id) bucket.ids.add(id);
+    }
+    if (input.target && typeof input.boundarySeq === "number" && Number.isFinite(input.boundarySeq) && input.boundarySeq > 0) {
+      const bucket = ensureBucket(input.target);
+      bucket.boundarySeq = Math.max(bucket.boundarySeq, Math.floor(input.boundarySeq));
+    }
+    if (byTarget.size === 0) return;
+    const boundaryMap = this.visibleBoundaryMap(agentId);
+    for (const [target, bucket] of byTarget) {
+      const highWaterSeq = Math.max(bucket.maxSeq, bucket.boundarySeq);
+      const previous = boundaryMap.get(target) ?? 0;
+      boundaryMap.set(target, Math.max(previous, highWaterSeq));
+    }
+    const suppress = (messages) => {
+      if (!messages || messages.length === 0) return 0;
+      let removed = 0;
+      const retained = messages.filter((message) => {
+        const target = formatMessageTarget(message);
+        const bucket = byTarget.get(target);
+        if (!bucket) return true;
+        const seq = typeof message.seq === "number" ? Math.floor(message.seq) : 0;
+        const id = message.message_id ?? "";
+        const matched = seq > 0 && bucket.boundarySeq > 0 && seq <= bucket.boundarySeq || seq > 0 && bucket.seqs.has(seq) || id.length > 0 && bucket.ids.has(id);
+        if (matched) removed += 1;
+        return !matched;
+      });
+      messages.splice(0, messages.length, ...retained);
+      return removed;
+    };
+    const active = this.agents.get(agentId);
+    const removedActive = suppress(active?.inbox);
+    const removedStarting = suppress(this.startingInboxes.get(agentId));
+    this.recordDaemonTrace("daemon.agent.inbox.visible_consumed", {
+      agentId,
+      source: input.source,
+      targets: [...byTarget.keys()],
+      messages_count: input.messages.length,
+      suppressed_pending_count: removedActive + removedStarting
+    });
+  }
+  createAgentProxyInboxCoordinator(agentId) {
+    return {
+      getBoundary: (target) => this.getVisibleBoundary(agentId, target),
+      getPendingMessages: (target) => this.pendingVisibleMessages(agentId, target),
+      consumeVisibleMessages: (input) => this.consumeVisibleMessages(agentId, input)
+    };
+  }
   recordDaemonTrace(name, attrs, status = "ok", parentTraceparent) {
     const span = this.tracer.startSpan(name, {
       parent: parseTraceparent(parentTraceparent),
@@ -5214,7 +5735,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         chatBridgePath: this.chatBridgePath,
         slockCliPath: this.slockCliPath,
         daemonApiKey: this.daemonApiKey,
-        launchId: launchId || null
+        launchId: launchId || null,
+        agentCredentialProxyInboxCoordinator: this.createAgentProxyInboxCoordinator(agentId)
       });
       this.recordDaemonTrace("daemon.agent.spawn.created", {
         ...this.startQueueTraceAttrs(agentId, effectiveConfig, wakeMessage, unreadSummary, resumePrompt, launchId),
@@ -5270,6 +5792,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         this.ackInjectedRuntimeProfileControl(agentId, config.runtimeProfileControl, agentProcess.launchId);
       }
       if (wakeMessage) {
+        this.consumeVisibleMessages(agentId, { messages: [wakeMessage], source: "spawn_wake_message" });
         this.ackInjectedRuntimeProfileMessages(agentId, [wakeMessage], agentProcess.launchId);
       }
       let buffer = "";
@@ -5362,16 +5885,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             ...runtimeTraceCounterAttrs(ap),
             ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "process_exit")
           });
-          if (processEndedCleanly) {
-            this.finishCompactionIfActive(agentId, "Context compaction finished (inferred from process exit)");
-          } else {
-            this.clearCompactionWatchdog(ap);
-          }
+          this.interruptCompactionIfActive(agentId);
+          cleanupAgentCredentialProxy(agentId, ap.launchId);
+          this.revokeManagedRunnerCredential(agentId, ap.config, ap.launchId);
           this.agents.delete(agentId);
           if (missingResumeSession) {
             const staleSessionId = ap.sessionId;
             const runtimeLabel = ap.driver.id === "opencode" ? "OpenCode" : "Claude";
-            const restartConfig = { ...ap.config, sessionId: null };
+            const restartConfig = { ...stripManagedRunnerCredential(ap.config), sessionId: null };
             logger.warn(
               `[Agent ${agentId}] Stored ${runtimeLabel} session ${staleSessionId} is unavailable locally; falling back to cold start`
             );
@@ -5408,7 +5929,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             const unreadSummary2 = queuedWakeMessage ? buildUnreadSummary(ap.inbox, formatChannelLabel(queuedWakeMessage)) : void 0;
             if (queuedWakeMessage) {
               logger.info(`[Agent ${agentId}] Turn completed; restarting immediately for queued message`);
-              const nextConfig = { ...ap.config, sessionId: ap.sessionId };
+              const nextConfig = { ...stripManagedRunnerCredential(ap.config), sessionId: ap.sessionId };
               this.idleAgentConfigs.set(agentId, {
                 config: nextConfig,
                 sessionId: ap.sessionId,
@@ -5418,6 +5939,9 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
               this.idleAgentConfigs.delete(agentId);
               this.startAgent(agentId, nextConfig, queuedWakeMessage, unreadSummary2, void 0, ap.launchId || void 0).catch((err) => {
                 logger.error(`[Agent ${agentId}] Failed to continue with queued message`, err);
+                if (this.reportRunnerCredentialMintFailure(agentId, err, ap.launchId, "queued_continuation")) {
+                  return;
+                }
                 this.idleAgentConfigs.set(agentId, {
                   config: nextConfig,
                   sessionId: ap.sessionId,
@@ -5428,7 +5952,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
               return;
             }
             this.idleAgentConfigs.set(agentId, {
-              config: { ...ap.config, sessionId: ap.sessionId },
+              config: { ...stripManagedRunnerCredential(ap.config), sessionId: ap.sessionId },
               sessionId: ap.sessionId,
               launchId: ap.launchId
             });
@@ -5464,27 +5988,28 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   async buildSpawnConfig(agentId, config) {
     const baseConfig = config.serverUrl === this.serverUrl ? config : { ...config, serverUrl: this.serverUrl };
+    const runnerConfig = await this.ensureManagedRunnerCredential(agentId, baseConfig);
     if (!this.defaultAgentEnvVarsProvider) {
-      return baseConfig;
+      return runnerConfig;
     }
     try {
       const defaultEnvVars = await this.defaultAgentEnvVarsProvider({
-        runtime: baseConfig.runtime,
-        model: baseConfig.model,
-        envVars: baseConfig.envVars
+        runtime: runnerConfig.runtime,
+        model: runnerConfig.model,
+        envVars: runnerConfig.envVars
       });
       if (!defaultEnvVars || Object.keys(defaultEnvVars).length === 0) {
-        return baseConfig;
+        return runnerConfig;
       }
       const mergedEnvVars = {
         ...defaultEnvVars,
-        ...baseConfig.envVars ?? {}
+        ...runnerConfig.envVars ?? {}
       };
-      if (this.sameEnvVars(mergedEnvVars, baseConfig.envVars)) {
-        return baseConfig;
+      if (this.sameEnvVars(mergedEnvVars, runnerConfig.envVars)) {
+        return runnerConfig;
       }
       return {
-        ...baseConfig,
+        ...runnerConfig,
         envVars: mergedEnvVars
       };
     } catch (error) {
@@ -5492,9 +6017,131 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       logger.warn(
         `[Agent ${agentId}] Failed to resolve default runtime env vars \u2014 continuing without machine-level defaults (${reason})`
       );
-      return baseConfig;
+      return runnerConfig;
     }
   }
+  async requestManagedRunnerCredentialOnce(agentId, config) {
+    const url = new URL(`/internal/computer/runners/${encodeURIComponent(agentId)}/credentials`, this.serverUrl);
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.daemonApiKey}`,
+        "Content-Type": "application/json",
+        "X-Slock-Client": "daemon-server-session-worker"
+      },
+      body: JSON.stringify({
+        scopes: ["send", "read", "mentions", "tasks", "reactions", "server", "channels"],
+        name: `runner:${config.runtime}:${agentId.slice(0, 8)}`
+      })
+    });
+    if (!res.ok) {
+      const contentType = res.headers.get("content-type") ?? "";
+      let detail = `HTTP ${res.status}`;
+      let code = null;
+      if (contentType.includes("application/json")) {
+        const body2 = await res.json().catch(() => null);
+        const error = typeof body2?.error === "string" ? body2.error : null;
+        code = typeof body2?.code === "string" ? body2.code : null;
+        detail = [detail, code, error].filter(Boolean).join(" ");
+      }
+      throw new RunnerCredentialMintError(detail, {
+        code: code ?? "runner_credential_mint_http_error",
+        retryable: isRetryableMintHttpFailure(res.status, code),
+        status: res.status
+      });
+    }
+    const body = await res.json().catch(() => null);
+    if (typeof body?.apiKey !== "string" || !body.apiKey.startsWith("sk_agent_")) {
+      throw new RunnerCredentialMintError("invalid_agent_credential_payload", {
+        code: "invalid_agent_credential_payload"
+      });
+    }
+    return {
+      apiKey: body.apiKey,
+      credentialId: typeof body.credentialId === "string" ? body.credentialId : null
+    };
+  }
+  async ensureManagedRunnerCredential(agentId, config) {
+    if (config.agentCredentialKey) return config;
+    if (process.env.SLOCK_AGENT_RUNNER_CREDENTIALS_DISABLED === "1") {
+      throw new RunnerCredentialMintError("runner credential mint is disabled by SLOCK_AGENT_RUNNER_CREDENTIALS_DISABLED", {
+        code: "runner_credentials_disabled"
+      });
+    }
+    let lastError = null;
+    for (let attempt = 1; attempt <= RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS; attempt += 1) {
+      try {
+        const credential = await this.requestManagedRunnerCredentialOnce(agentId, config);
+        return {
+          ...config,
+          agentCredentialKey: credential.apiKey,
+          agentCredentialId: credential.credentialId
+        };
+      } catch (err) {
+        lastError = err;
+        const detail2 = runnerCredentialErrorDetail(err);
+        this.recordDaemonTrace("daemon.runner_credential_mint.retry", {
+          agentId,
+          runtime: config.runtime,
+          attempt,
+          max_attempts: RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS,
+          status: detail2.status,
+          code: detail2.code,
+          reason: detail2.message,
+          retryable: detail2.retryable
+        }, detail2.retryable && attempt < RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS ? "ok" : "error");
+        if (!detail2.retryable || attempt >= RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS) break;
+        await waitForRunnerCredentialRetry();
+      }
+    }
+    const detail = runnerCredentialErrorDetail(lastError);
+    this.recordDaemonTrace("daemon.runner_credential_mint.failed", {
+      agentId,
+      runtime: config.runtime,
+      status: detail.status,
+      code: detail.code,
+      reason: detail.message,
+      retryable: detail.retryable,
+      max_attempts: RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS
+    }, "error");
+    throw new RunnerCredentialMintError(
+      `runner_credential_mint_failed: ${detail.message}. Managed runner startup requires /internal/computer credential mint; deploy server first or roll back the daemon binary.`,
+      {
+        code: detail.code,
+        retryable: detail.retryable,
+        status: detail.status
+      }
+    );
+  }
+  revokeManagedRunnerCredential(agentId, config, launchId) {
+    const credentialId = config.agentCredentialId;
+    if (!credentialId) return;
+    const url = new URL(
+      `/internal/computer/runners/${encodeURIComponent(agentId)}/credentials/${encodeURIComponent(credentialId)}`,
+      this.serverUrl
+    );
+    void fetch(url, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.daemonApiKey}`,
+        "X-Slock-Client": "daemon-server-session-worker"
+      }
+    }).then((res) => {
+      this.recordDaemonTrace("daemon.runner_credential.revoke", {
+        agentId,
+        launchId: launchId || void 0,
+        credentialId,
+        status: res.status
+      }, res.ok ? "ok" : "error");
+    }).catch((err) => {
+      this.recordDaemonTrace("daemon.runner_credential.revoke", {
+        agentId,
+        launchId: launchId || void 0,
+        credentialId,
+        reason: err instanceof Error ? err.message : String(err)
+      }, "error");
+    });
+  }
   sameEnvVars(left, right) {
     const leftKeys = Object.keys(left ?? {});
     const rightKeys = Object.keys(right ?? {});
@@ -5583,6 +6230,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     this.clearCompactionWatchdog(ap);
     this.clearStalledRecoverySigtermWatchdog(ap);
+    cleanupAgentCredentialProxy(agentId, ap.launchId);
+    this.revokeManagedRunnerCredential(agentId, ap.config, ap.launchId);
     this.agents.delete(agentId);
     this.processExitTraceAttrs.set(ap.process, {
       stop_source: silent ? "daemon_internal" : "explicit_request",
@@ -5666,10 +6315,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           session_id_present: Boolean(cached.sessionId),
           launchId: cached.launchId || void 0
         }));
-        this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0).catch((err) => {
+        return this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0).then(() => true, (err) => {
           logger.error(`[Agent ${agentId}] Failed to auto-restart`, err);
+          if (this.reportRunnerCredentialMintFailure(agentId, err, cached.launchId, "idle_auto_restart")) {
+            return false;
+          }
+          this.idleAgentConfigs.set(agentId, cached);
+          return false;
         });
-        return true;
       }
       logger.warn(`[Agent ${agentId}] Delivery received but no running process or cached idle config exists`);
       this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
@@ -5751,6 +6404,37 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       }));
       return true;
     }
+    if (ap.gatedSteering.compacting) {
+      ap.pendingNotificationCount++;
+      if (ap.notificationTimer) {
+        clearTimeout(ap.notificationTimer);
+        ap.notificationTimer = null;
+      }
+      if (ap.driver.busyDeliveryMode === "gated") {
+        this.recordGatedSteeringEvent(agentId, ap, "buffer", {
+          reason: "compaction_boundary",
+          pendingMessages: ap.inbox.length
+        });
+      }
+      this.recordRuntimeTraceEvent(agentId, ap, "runtime.compaction_boundary.delivery_buffered", {
+        pendingNotificationCount: ap.pendingNotificationCount,
+        pendingMessages: ap.inbox.length,
+        busyDeliveryMode: ap.driver.busyDeliveryMode
+      });
+      this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+        outcome: "queued_compaction_boundary",
+        accepted: true,
+        process_present: true,
+        runtime: ap.config.runtime,
+        session_id_present: true,
+        launchId: ap.launchId || void 0,
+        inbox_count: ap.inbox.length,
+        pending_notification_count: ap.pendingNotificationCount,
+        busy_delivery_mode: ap.driver.busyDeliveryMode,
+        notification_timer_present: false
+      }));
+      return true;
+    }
     if (ap.driver.busyDeliveryMode === "gated") {
       ap.pendingNotificationCount++;
       this.recordGatedSteeringEvent(agentId, ap, "buffer", {
@@ -5957,19 +6641,28 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     if (cached) {
       logger.info(`[Agent ${agentId}] Starting from idle state for runtime profile ${kind} ${key}`);
       this.idleAgentConfigs.delete(agentId);
-      this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0).catch((err) => {
+      return this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0).then(() => true, (err) => {
         logger.error(`[Agent ${agentId}] Failed to auto-restart for runtime profile notification`, err);
-        this.idleAgentConfigs.set(agentId, cached);
-      });
-      span.end("ok", {
-        attrs: {
-          outcome: "restart_queued",
-          runtime: cached.config.runtime,
-          launchId: cached.launchId || void 0,
-          session_id_present: Boolean(cached.sessionId)
+        if (this.reportRunnerCredentialMintFailure(agentId, err, cached.launchId, "runtime_profile_auto_restart")) {
+          span.end("error", {
+            attrs: {
+              outcome: "runner_credential_mint_failed",
+              runtime: cached.config.runtime,
+              launchId: cached.launchId || void 0
+            }
+          });
+          return false;
         }
+        this.idleAgentConfigs.set(agentId, cached);
+        span.end("error", {
+          attrs: {
+            outcome: "restart_failed",
+            runtime: cached.config.runtime,
+            launchId: cached.launchId || void 0
+          }
+        });
+        return false;
       });
-      return true;
     }
     logger.warn(`[Agent ${agentId}] Runtime profile ${kind} ${key} has no runtime injection path yet; leaving unacked for retry`);
     span.end("ok", { attrs: { outcome: "no_path" } });
@@ -6419,11 +7112,23 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     ap.compactionWatchdog = null;
     this.broadcastActivity(agentId, "working", "Context compaction still running; no finish event observed");
   }
-  finishCompactionIfActive(agentId, detail = "Context compaction finished") {
+  completeCompactionIfActive(agentId, detail = "Context compaction finished", options = {}) {
     const ap = this.agents.get(agentId);
     if (!ap || !ap.compactionStartedAt) return;
     this.clearCompactionWatchdog(ap);
     this.broadcastActivity(agentId, "working", detail, [{ kind: "compaction_finished" }]);
+    ap.gatedSteering.compacting = false;
+    this.setGatedSteeringPhase(agentId, ap, "assistant_continuation", { event: "compaction_finished", inferred: true });
+    if (options.flushBoundaryMessages ?? true) {
+      this.flushCompactionBoundaryMessages(agentId, ap);
+    }
+    ap.isIdle = false;
+  }
+  interruptCompactionIfActive(agentId) {
+    const ap = this.agents.get(agentId);
+    if (!ap || !ap.compactionStartedAt && !ap.gatedSteering.compacting) return;
+    this.clearCompactionWatchdog(ap);
+    ap.gatedSteering.compacting = false;
   }
   messagesTraceAttrs(messages) {
     if (!messages || messages.length === 0) return {};
@@ -6746,28 +7451,28 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         this.sendRuntimeProfileReport(agentId);
         break;
       case "thinking": {
-        this.finishCompactionIfActive(agentId, "Context compaction finished (inferred from resumed output)");
+        if (ap) this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
+        this.completeCompactionIfActive(agentId, "Context compaction finished (inferred from resumed output)");
         this.queueTrajectoryText(agentId, "thinking", event.text);
         if (ap) ap.isIdle = false;
-        if (ap) this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
         this.setGatedSteeringPhase(agentId, ap, "assistant_continuation", { event: "thinking" });
         break;
       }
       case "text": {
-        this.finishCompactionIfActive(agentId, "Context compaction finished (inferred from resumed output)");
+        if (ap) this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
+        this.completeCompactionIfActive(agentId, "Context compaction finished (inferred from resumed output)");
         this.queueTrajectoryText(agentId, "text", event.text);
         if (ap) ap.isIdle = false;
-        if (ap) this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
         this.setGatedSteeringPhase(agentId, ap, "assistant_continuation", { event: "text" });
         break;
       }
       case "tool_call": {
-        this.finishCompactionIfActive(agentId, "Context compaction finished (inferred from resumed tool use)");
+        if (ap) this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
+        this.completeCompactionIfActive(agentId, "Context compaction finished (inferred from resumed tool use)");
         this.flushPendingTrajectory(agentId);
         const invocation = normalizeToolDisplayInvocation(event.name, event.input);
         if (ap) {
           ap.gatedSteering.outstandingToolUses++;
-          this.clearGatedInFlightBatch(agentId, ap, "non_error_progress");
           this.noteRuntimeProfileToolCall(agentId, ap, invocation.toolName);
           this.recordRuntimeTraceEvent(agentId, ap, "tool.call.started", { tool: invocation.toolName });
           this.setGatedSteeringPhase(agentId, ap, "tool_wait", {
@@ -6828,7 +7533,9 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         break;
       case "turn_end":
         if (ap) this.recordRuntimeTraceEvent(agentId, ap, "runtime.turn.completed");
-        this.finishCompactionIfActive(agentId, "Context compaction finished (inferred from turn end)");
+        this.completeCompactionIfActive(agentId, "Context compaction finished (inferred from turn end)", {
+          flushBoundaryMessages: false
+        });
         this.flushPendingTrajectory(agentId);
         if (ap) {
           this.clearGatedInFlightBatch(agentId, ap, "turn_end");
@@ -6885,7 +7592,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }
         break;
       case "error": {
-        this.finishCompactionIfActive(agentId, "Context compaction interrupted by runtime error");
+        this.interruptCompactionIfActive(agentId);
         this.flushPendingTrajectory(agentId);
         if (ap) ap.lastRuntimeError = event.message;
         if (ap) {
@@ -6933,6 +7640,29 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   sendAgentStatus(agentId, status, launchId) {
     this.sendToServer({ type: "agent:status", agentId, status, launchId: launchId || void 0 });
   }
+  reportRunnerCredentialMintFailure(agentId, err, launchId, source) {
+    if (!(err instanceof RunnerCredentialMintError)) return false;
+    const detail = runnerCredentialErrorDetail(err);
+    this.recordDaemonTrace("daemon.runner_credential_mint.hard_fail", {
+      agentId,
+      launchId: launchId || void 0,
+      source,
+      status: detail.status,
+      code: detail.code,
+      reason: detail.message,
+      retryable: detail.retryable
+    }, "error");
+    const reason = err.message;
+    this.sendAgentStatus(agentId, "inactive", launchId);
+    this.broadcastActivity(
+      agentId,
+      "error",
+      `Start failed: ${reason}`,
+      [{ kind: "text", text: `Error: ${reason}` }],
+      launchId
+    );
+    return true;
+  }
   noteRuntimeTraceCounter(ap, event) {
     ap.runtimeTraceCounters.events++;
     switch (event.kind) {
@@ -7095,6 +7825,7 @@ ${RESPONSE_TARGET_HINT}`);
       }, "error");
       return false;
     }
+    this.consumeVisibleMessages(agentId, { messages, source: `stdin_${mode}_delivery` });
     const senders = [...new Set(messages.map((message) => `@${message.sender_name}`))].join(", ");
     logger.info(
       `[Agent ${agentId}] Delivering ${mode} ${messages.length === 1 ? "message" : `${messages.length} messages`} via stdin from ${senders}`
@@ -7432,7 +8163,7 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
 import os7 from "os";
 import path13 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
@@ -7505,7 +8236,7 @@ function acquireDaemonMachineLock(options) {
         writeFileSync8(ownerPath(lockDir), `${JSON.stringify(owner, null, 2)}
 `, { mode: 384 });
       } catch (err) {
-        rmSync2(lockDir, { recursive: true, force: true });
+        rmSync3(lockDir, { recursive: true, force: true });
         throw err;
       }
       return {
@@ -7515,7 +8246,7 @@ function acquireDaemonMachineLock(options) {
         release: () => {
           const currentOwner = readOwner(lockDir);
           if (currentOwner?.pid === process.pid && currentOwner.token === token) {
-            rmSync2(lockDir, { recursive: true, force: true });
+            rmSync3(lockDir, { recursive: true, force: true });
           }
         }
       };
@@ -7532,14 +8263,14 @@ function acquireDaemonMachineLock(options) {
           throw new DaemonMachineLockConflictError(lockDir, null);
         }
       }
-      rmSync2(lockDir, { recursive: true, force: true });
+      rmSync3(lockDir, { recursive: true, force: true });
     }
   }
   throw new DaemonMachineLockConflictError(lockDir, readOwner(lockDir));
 }
 
 // src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
 import path14 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
@@ -7621,7 +8352,7 @@ var LocalRotatingTraceSink = class {
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync3(path14.join(this.traceDir, file), { force: true });
+      rmSync4(path14.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -8052,7 +8783,45 @@ function readPositiveIntegerEnv2(name, fallback) {
 
 // src/core.ts
 var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
+var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels"];
+var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 = 3;
+var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2 = 250;
 var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var RunnerCredentialMintError2 = class extends Error {
+  code;
+  retryable;
+  status;
+  constructor(message, opts) {
+    super(message);
+    this.name = "RunnerCredentialMintError";
+    this.code = opts.code;
+    this.retryable = opts.retryable ?? false;
+    this.status = opts.status;
+  }
+};
+function isRetryableMintHttpFailure2(status, code) {
+  if (code === "experimental_surface_disabled") return false;
+  return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function runnerCredentialErrorDetail2(error) {
+  if (error instanceof RunnerCredentialMintError2) {
+    return {
+      message: error.message,
+      code: error.code,
+      retryable: error.retryable,
+      status: error.status
+    };
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    message,
+    code: "runner_credential_mint_network_error",
+    retryable: true
+  };
+}
+async function waitForRunnerCredentialRetry2() {
+  await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
+}
 function parseDaemonCliArgs(args) {
   let serverUrl = "";
   let apiKey = "";
@@ -8384,13 +9153,115 @@ var DaemonCore = class {
     });
     span.end(status);
   }
+  async requestRunnerCredentialOnce(agentId, config) {
+    const url = new URL(`/internal/computer/runners/${encodeURIComponent(agentId)}/credentials`, this.options.serverUrl);
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${this.options.apiKey}`,
+        "Content-Type": "application/json",
+        "X-Slock-Client": "daemon-server-session-worker"
+      },
+      body: JSON.stringify({
+        scopes: RUNNER_CREDENTIAL_SCOPES,
+        name: `runner:${config.runtime}:${agentId.slice(0, 8)}`
+      })
+    });
+    if (!res.ok) {
+      const contentType = res.headers.get("content-type") ?? "";
+      let detail = `HTTP ${res.status}`;
+      let code = null;
+      if (contentType.includes("application/json")) {
+        const body2 = await res.json().catch(() => null);
+        const error = typeof body2?.error === "string" ? body2.error : null;
+        code = typeof body2?.code === "string" ? body2.code : null;
+        detail = [detail, code, error].filter(Boolean).join(" ");
+      }
+      throw new RunnerCredentialMintError2(detail, {
+        code: code ?? "runner_credential_mint_http_error",
+        retryable: isRetryableMintHttpFailure2(res.status, code),
+        status: res.status
+      });
+    }
+    const body = await res.json().catch(() => null);
+    if (typeof body?.apiKey !== "string" || !body.apiKey.startsWith("sk_agent_")) {
+      throw new RunnerCredentialMintError2("invalid_agent_credential_payload", {
+        code: "invalid_agent_credential_payload"
+      });
+    }
+    return {
+      apiKey: body.apiKey,
+      credentialId: typeof body.credentialId === "string" ? body.credentialId : null
+    };
+  }
+  async mintRunnerCredential(agentId, config) {
+    if (config.agentCredentialKey) {
+      return { apiKey: config.agentCredentialKey, credentialId: config.agentCredentialId ?? null };
+    }
+    if (process.env.SLOCK_AGENT_RUNNER_CREDENTIALS_DISABLED === "1") {
+      throw new RunnerCredentialMintError2("runner credential mint is disabled by SLOCK_AGENT_RUNNER_CREDENTIALS_DISABLED", {
+        code: "runner_credentials_disabled"
+      });
+    }
+    let lastError = null;
+    for (let attempt = 1; attempt <= RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2; attempt += 1) {
+      try {
+        return await this.requestRunnerCredentialOnce(agentId, config);
+      } catch (err) {
+        lastError = err;
+        const detail2 = runnerCredentialErrorDetail2(err);
+        this.recordDaemonTrace("daemon.runner_credential_mint.retry", {
+          agentId,
+          runtime: config.runtime,
+          attempt,
+          max_attempts: RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2,
+          status: detail2.status,
+          code: detail2.code,
+          reason: detail2.message,
+          retryable: detail2.retryable
+        }, detail2.retryable && attempt < RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 ? "ok" : "error");
+        if (!detail2.retryable || attempt >= RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2) break;
+        await waitForRunnerCredentialRetry2();
+      }
+    }
+    const detail = runnerCredentialErrorDetail2(lastError);
+    this.recordDaemonTrace("daemon.runner_credential_mint.failed", {
+      agentId,
+      runtime: config.runtime,
+      status: detail.status,
+      code: detail.code,
+      reason: detail.message,
+      retryable: detail.retryable,
+      max_attempts: RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2
+    }, "error");
+    throw new RunnerCredentialMintError2(
+      `runner_credential_mint_failed: ${detail.message}. Managed runner startup requires /internal/computer credential mint; deploy server first or roll back the daemon binary.`,
+      {
+        code: detail.code,
+        retryable: detail.retryable,
+        status: detail.status
+      }
+    );
+  }
+  async startAgentFromMessage(msg) {
+    const agentCredential = await this.mintRunnerCredential(msg.agentId, msg.config);
+    const config = { ...msg.config, agentCredentialKey: agentCredential.apiKey, agentCredentialId: agentCredential.credentialId };
+    await this.agentManager.startAgent(
+      msg.agentId,
+      config,
+      msg.wakeMessage,
+      msg.unreadSummary,
+      msg.resumePrompt,
+      msg.launchId
+    );
+  }
   handleMessage(msg) {
     const summary = summarizeIncomingMessage(msg);
     logger.info(`[Daemon] Received ${msg.type}${summary ? ` ${summary}` : ""}`);
     switch (msg.type) {
       case "agent:start":
         logger.info(`[Agent ${msg.agentId}] Start requested (runtime=${msg.config.runtime}, model=${msg.config.model}, session=${msg.config.sessionId || "new"}${msg.wakeMessage ? ", wake=true" : ""})`);
-        this.agentManager.startAgent(msg.agentId, msg.config, msg.wakeMessage, msg.unreadSummary, msg.resumePrompt, msg.launchId).catch((err) => {
+        this.startAgentFromMessage(msg).catch((err) => {
           const reason = err instanceof Error ? err.message : String(err);
           logger.error(`[Agent ${msg.agentId}] Start failed (${reason})`);
           this.connection.send({ type: "agent:status", agentId: msg.agentId, status: "inactive", launchId: msg.launchId });
@@ -8423,22 +9294,27 @@ var DaemonCore = class {
         logger.info(`[Agent ${msg.agentId}] Delivery received (seq=${msg.seq}, from=@${msg.message.sender_name}, target=${formatChannelTarget(msg)})`);
         try {
           span.addEvent("daemon.receive", { seq: msg.seq, deliveryId: msg.deliveryId });
-          const accepted = this.agentManager.deliverMessage(msg.agentId, msg.message, { deliveryId: msg.deliveryId });
-          span.addEvent("daemon.deliver_to_agent_manager", { accepted });
-          if (!accepted) {
-            span.end("ok", { attrs: { outcome: "not-accepted" } });
-            break;
-          }
-          const ackSeq = msg.seq > 0 ? msg.seq : msg.message.seq ?? 0;
-          span.addEvent("daemon.ack.sent", { seq: ackSeq });
-          this.connection.send({
-            type: "agent:deliver:ack",
-            agentId: msg.agentId,
-            seq: ackSeq,
-            traceparent: formatTraceparent(span.context),
-            deliveryId: msg.deliveryId
+          const acceptedOrPromise = this.agentManager.deliverMessage(msg.agentId, msg.message, { deliveryId: msg.deliveryId });
+          Promise.resolve(acceptedOrPromise).then((accepted) => {
+            span.addEvent("daemon.deliver_to_agent_manager", { accepted });
+            if (!accepted) {
+              span.end("ok", { attrs: { outcome: "not-accepted" } });
+              return;
+            }
+            const ackSeq = msg.seq > 0 ? msg.seq : msg.message.seq ?? 0;
+            span.addEvent("daemon.ack.sent", { seq: ackSeq });
+            this.connection.send({
+              type: "agent:deliver:ack",
+              agentId: msg.agentId,
+              seq: ackSeq,
+              traceparent: formatTraceparent(span.context),
+              deliveryId: msg.deliveryId
+            });
+            span.end("ok", { attrs: { outcome: "ack-sent", ackSeq, deliveryId: msg.deliveryId } });
+          }, (err) => {
+            logger.error(`[Agent ${msg.agentId}] Delivery handling failed`, err);
+            span.end("error", { attrs: { error_class: err instanceof Error ? err.name : typeof err } });
           });
-          span.end("ok", { attrs: { outcome: "ack-sent", ackSeq, deliveryId: msg.deliveryId } });
         } catch (err) {
           span.end("error", { attrs: { error_class: err instanceof Error ? err.name : typeof err } });
           throw err;
@@ -8458,8 +9334,14 @@ var DaemonCore = class {
           }
         });
         logger.info(`[Agent ${msg.agentId}] Runtime profile migration received (${msg.migrationKey})`);
-        const accepted = this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.migrationKey, "migration", msg.message, formatTraceparent(span.context));
-        span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
+        Promise.resolve(
+          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.migrationKey, "migration", msg.message, formatTraceparent(span.context))
+        ).then((accepted) => {
+          span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
+        }, (err) => {
+          logger.error(`[Agent ${msg.agentId}] Runtime profile migration handling failed`, err);
+          span.end("error", { attrs: { error_class: err instanceof Error ? err.name : typeof err } });
+        });
         break;
       }
       case "agent:runtime_profile:daemon_release_notice": {
@@ -8475,8 +9357,14 @@ var DaemonCore = class {
           }
         });
         logger.info(`[Agent ${msg.agentId}] Runtime profile daemon release notice received (${msg.noticeKey})`);
-        const accepted = this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.noticeKey, "daemon_release_notice", msg.message, formatTraceparent(span.context));
-        span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
+        Promise.resolve(
+          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.noticeKey, "daemon_release_notice", msg.message, formatTraceparent(span.context))
+        ).then((accepted) => {
+          span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
+        }, (err) => {
+          logger.error(`[Agent ${msg.agentId}] Runtime profile daemon release notice handling failed`, err);
+          span.end("error", { attrs: { error_class: err instanceof Error ? err.name : typeof err } });
+        });
         break;
       }
       case "agent:workspace:list":