@slock-ai/daemon 0.51.0 → 0.51.1-play.20260519174619

package/dist/{chunk-NAMH7BB6.js → chunk-NZM6RHMZ.js}

@@ -7,11 +7,11 @@ import {
 } from "./chunk-KNMCE6WB.js";
 
 // src/core.ts
-import path16 from "path";
+import path17 from "path";
 import os8 from "os";
 import { createRequire } from "module";
 import { accessSync } from "fs";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../shared/src/tracing/index.ts
 var DEFAULT_TRACE_FLAGS = "00";
@@ -723,6 +723,7 @@ var SERVER_CAPABILITY_MATRIX = {
 var RUNTIMES = [
   { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
   { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
+  { id: "pi", displayName: "Pi", binary: "pi", supported: true },
   { id: "kimi", displayName: "Kimi CLI", binary: "kimi", supported: true },
   { id: "copilot", displayName: "Copilot CLI", binary: "copilot", supported: true },
   { id: "cursor", displayName: "Cursor CLI", binary: "cursor-agent", supported: true },
@@ -764,10 +765,10 @@ var DISPLAY_PLAN_CONFIG = {
 };
 
 // src/agentProcessManager.ts
-import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2 } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import path12 from "path";
+import path13 from "path";
 import os6 from "os";
 
 // src/drivers/claude.ts
@@ -871,13 +872,15 @@ Use the \`slock\` CLI for chat / task / attachment operations. The daemon inject
 17. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
 18. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
 19. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--avatar-url pixel:random:<seed>\`, \`--display-name <name>\`, and \`--description <text>\`. Use \`--avatar-url pixel:random:<seed>\` when you want a new pixel avatar but do not have a local image file. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
-20. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
-21. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
-22. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
-23. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
-24. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
-25. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
-26. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
+20. **\`slock integration list\`** \u2014 List registered third-party services and this agent's active Slock Agent Logins.
+21. **\`slock integration login\`** \u2014 Provision or reuse this agent's login for a registered third-party service.
+22. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
+23. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
+24. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
+25. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
+26. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
+27. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
+28. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
 
 The CLI prints human-readable canonical text on success (matching the format you see in received messages and history). On failure it prints JSON to stderr:
 - failure \u2192 stderr \`{"ok":false,"code":"...","message":"..."}\` with non-zero exit
@@ -978,6 +981,11 @@ Each channel has a **name** and optionally a **description** that define its pur
 - **Reply in context** \u2014 always respond in the channel/thread the message came from.
 - **Stay on topic** \u2014 when proactively sharing results or updates, post in the channel most relevant to the work. Don't scatter messages across unrelated channels.
 - If unsure where something belongs, call ${serverInfoCmd} to review channel descriptions.`;
+  const thirdPartyIntegrationsSection = isCli ? `### Third-party integrations
+
+If a registered third-party service requires login, use Slock Agent Login through the CLI instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app, first run \`slock integration list\` and match the app to a registered service before browsing the app. Use \`slock integration login --service <service>\` to provision or reuse your agent login for that service. When the command returns \`Agent login ready\` or \`Already logged in\`, the agent-side login is ready. If the output includes an app URL, open that URL as the service-provided third-party app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow, use internal request IDs as OAuth callback codes, or call third-party exchange endpoints unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use \`slock profile show\`. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the registered service / Slock Agent Login path.` : `### Third-party integrations
+
+If a registered third-party service requires login, use Slock Agent Login through the available registered-service interface instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app, first inspect the registered-service interface and match the app to a registered service before browsing the app. Once the registered-service interface reports the agent login is ready, the agent-side login is ready. If that interface provides an app URL, use it as the service-provided third-party app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow or treat internal request IDs as OAuth callback codes unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use your Slock profile view. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the registered service / Slock Agent Login path.`;
   const readingHistorySection = isCli ? `### Reading history
 
 \`slock message read --channel "#channel-name"\` or \`slock message read --channel dm:@peer-name\` or \`slock message read --channel "#channel:shortid"\`
@@ -1149,6 +1157,8 @@ ${discoverySection}
 
 ${channelAwarenessSection}
 
+${thirdPartyIntegrationsSection}
+
 ${readingHistorySection}
 
 ${historicalReferenceSection}
@@ -1180,6 +1190,17 @@ Keep the user informed. They cannot see your internal reasoning, so:
 - For multi-step work, send short progress updates (e.g. "Working on step 2/3\u2026").
 - When done, summarize the result.
 - Keep updates concise \u2014 one or two sentences. Don't flood the chat.
+- For long answers where users need the conclusion first but details still matter, put the conclusion and next action outside any collapse, then use sanitized HTML details blocks for optional depth:
+
+\`\`\`html
+<details>
+<summary>Evidence, logs, or edge cases</summary>
+
+Detailed notes go here.
+</details>
+\`\`\`
+
+  Do not hide the main recommendation, blocker, or required action inside \`<details>\`; only fold supporting evidence, logs, alternatives, or extended rationale.
 
 ### Conversation etiquette
 
@@ -1349,12 +1370,26 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
 import { URL as URL2 } from "url";
 var registrations = /* @__PURE__ */ new Map();
 var servers = /* @__PURE__ */ new Map();
+var DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["content-encoding", "content-length", "transfer-encoding"]);
 function allocatePort() {
   return 43e3 + randomBytes(2).readUInt16BE(0) % 1e4;
 }
@@ -1370,6 +1405,14 @@ function ensureServer(port) {
   server.unref();
   servers.set(port, server);
 }
+function responseHeadersForLocalProxy(upstream) {
+  const headers = {};
+  for (const [name, value] of upstream.headers.entries()) {
+    if (DECODED_RESPONSE_HEADERS.has(name.toLowerCase())) continue;
+    headers[name] = value;
+  }
+  return headers;
+}
 async function handleProxyRequest(req, res) {
   const auth = req.headers.authorization;
   const token = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
@@ -1423,11 +1466,11 @@ async function handleProxyRequest(req, res) {
     if (shouldBufferJsonResponse(upstream, target.pathname, registration)) {
       const responseText = await upstream.text();
       consumeVisibleResponse(registration, target, sendTarget, responseText);
-      res.writeHead(upstream.status, Object.fromEntries(upstream.headers.entries()));
+      res.writeHead(upstream.status, responseHeadersForLocalProxy(upstream));
       res.end(responseText);
       return;
     }
-    res.writeHead(upstream.status, Object.fromEntries(upstream.headers.entries()));
+    res.writeHead(upstream.status, responseHeadersForLocalProxy(upstream));
     if (upstream.body) {
       const reader = upstream.body.getReader();
       try {
@@ -1724,7 +1767,7 @@ ${cmdCredentialLine}"${process.execPath}" "${ctx.slockCliPath}" %*\r
     ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   delete spawnEnv.SLOCK_AGENT_CREDENTIAL_KEY;
   delete spawnEnv.SLOCK_AGENT_CREDENTIAL_KEY_FILE;
   delete spawnEnv.SLOCK_AGENT_PROXY_URL;
@@ -1771,7 +1814,7 @@ function resolveCommandOnWindows(command, env, execFileSyncFn) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   if (platform === "win32") {
     return resolveCommandOnWindows(command, env, execFileSyncFn);
@@ -1796,7 +1839,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -3093,7 +3136,7 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
-    env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3
   });
@@ -3140,7 +3183,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync6;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -3314,13 +3357,16 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID } from "crypto";
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
 var KIMI_MCP_FILE = ".slock-kimi-mcp.json";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -3329,6 +3375,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync6(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -3352,7 +3465,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   mcpToolPrefix = "";
@@ -3406,6 +3537,7 @@ var KimiDriver = class {
         }
       }
     }), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
@@ -3414,14 +3546,15 @@ var KimiDriver = class {
       "--mcp-config-file",
       mcpConfigPath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     if (ctx.config.model && ctx.config.model !== "default") {
       args.push("--model", ctx.config.model);
     }
     const spawnEnv = prepareCliTransport(ctx, { NO_COLOR: "1" }).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn6(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn6(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -3429,7 +3562,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -3545,14 +3678,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -3813,7 +3941,7 @@ function detectOpenCodeModels(home = os5.homedir(), runCommand = runOpenCodeMode
 }
 function runOpenCodeModelsCommand(home) {
   const result = spawnSync2("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3
   });
@@ -3971,6 +4099,297 @@ var OpenCodeDriver = class {
   }
 };
 
+// src/drivers/pi.ts
+import { spawn as spawn8 } from "child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
+import path11 from "path";
+import { fileURLToPath } from "url";
+import { getAgentDir, VERSION as PI_SDK_VERSION } from "@earendil-works/pi-coding-agent";
+var CHAT_MCP_TOOL_PREFIX2 = "chat_";
+var NO_MESSAGE_PROMPT2 = "No new messages are pending. Stop now.";
+var FIRST_MESSAGE_TASK_PREFIX2 = "First message task (system-triggered):";
+var MIN_SUPPORTED_PI_VERSION = "0.74.0";
+function parseSemver2(version) {
+  const match = version.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isSupportedPiVersion(version) {
+  if (!version) return true;
+  const actual = parseSemver2(version);
+  const minimum = parseSemver2(MIN_SUPPORTED_PI_VERSION);
+  if (!actual || !minimum) return true;
+  for (let i = 0; i < 3; i += 1) {
+    if (actual[i] > minimum[i]) return true;
+    if (actual[i] < minimum[i]) return false;
+  }
+  return true;
+}
+function unsupportedPiVersionMessage(version) {
+  if (!version || isSupportedPiVersion(version)) return null;
+  return `Pi SDK ${version} is unsupported; requires @earendil-works/pi-coding-agent >= ${MIN_SUPPORTED_PI_VERSION}. Upgrade the daemon Pi dependency before starting this runtime.`;
+}
+function probePi(version = PI_SDK_VERSION) {
+  const unsupportedMessage = unsupportedPiVersionMessage(version);
+  if (unsupportedMessage) {
+    return {
+      available: false,
+      version: `${version} (requires @earendil-works/pi-coding-agent >= ${MIN_SUPPORTED_PI_VERSION})`
+    };
+  }
+  return { available: true, version };
+}
+function resolvePiSdkRunnerPath(moduleUrl = import.meta.url) {
+  const moduleDir = path11.dirname(fileURLToPath(moduleUrl));
+  const sourceSibling = path11.join(moduleDir, "piSdkRunner.ts");
+  if (existsSync8(sourceSibling)) return sourceSibling;
+  const bundledEntry = path11.join(moduleDir, "drivers", "piSdkRunner.js");
+  if (existsSync8(bundledEntry)) return bundledEntry;
+  return path11.join(moduleDir, "piSdkRunner.js");
+}
+function buildPiSdkNodeArgs(runnerPath = resolvePiSdkRunnerPath()) {
+  if (runnerPath.endsWith(".ts")) {
+    return [...process.execArgv, runnerPath];
+  }
+  return [runnerPath];
+}
+function buildPiLaunchOptions(ctx, opts = {}) {
+  const command = opts.command ?? process.execPath;
+  const piDir = path11.join(ctx.workingDirectory, ".slock", "pi");
+  const sessionDir = path11.join(piDir, "sessions");
+  mkdirSync4(sessionDir, { recursive: true });
+  const slock = prepareCliTransport(ctx, { NO_COLOR: "1" });
+  const runnerPath = opts.runnerPath ?? resolvePiSdkRunnerPath();
+  const agentDir = opts.agentDir ?? getAgentDir();
+  const runnerConfigPath = path11.join(
+    piDir,
+    `sdk-run-${(ctx.launchId || "launch").replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`
+  );
+  const turnPrompt = ctx.prompt === ctx.standingPrompt ? NO_MESSAGE_PROMPT2 : ctx.prompt;
+  const runnerConfig = {
+    cwd: ctx.workingDirectory,
+    agentDir,
+    sessionDir,
+    sessionId: ctx.config.sessionId || null,
+    standingPrompt: ctx.standingPrompt,
+    prompt: turnPrompt,
+    model: ctx.config.model && ctx.config.model !== "default" ? ctx.config.model : null
+  };
+  writeFileSync7(runnerConfigPath, `${JSON.stringify(runnerConfig)}
+`, { encoding: "utf8", mode: 384 });
+  const args = [
+    ...buildPiSdkNodeArgs(runnerPath),
+    "--config",
+    runnerConfigPath
+  ];
+  return {
+    command,
+    args,
+    env: slock.spawnEnv,
+    sessionDir,
+    agentDir,
+    runnerConfigPath,
+    sdkVersion: PI_SDK_VERSION
+  };
+}
+function isSystemFirstMessageTask2(message) {
+  return message.sender_id === "system" && message.channel_type === "channel" && message.channel_name === "all" && message.content.trimStart().startsWith(FIRST_MESSAGE_TASK_PREFIX2);
+}
+function buildPiSystemPrompt(config) {
+  return buildCliTransportSystemPrompt(config, {
+    toolPrefix: CHAT_MCP_TOOL_PREFIX2,
+    extraCriticalRules: [
+      "- Runtime Profile migration controls are not available in the Pi runtime yet. If asked to acknowledge a runtime migration, explain the blocker instead of inventing a command."
+    ],
+    postStartupNotes: [
+      "**Pi runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
+    ],
+    includeStdinNotificationSection: false,
+    messageNotificationStyle: "poll"
+  });
+}
+function contentText(content) {
+  if (!content) return "";
+  const chunks = [];
+  for (const item of content) {
+    if (item.type === "text" && typeof item.text === "string") {
+      chunks.push(item.text);
+    }
+  }
+  return chunks.join("");
+}
+function apiKeyErrorMessage(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  if (/no api key found/i.test(trimmed)) return trimmed;
+  if (/api key.+required/i.test(trimmed)) return trimmed;
+  if (/no models available/i.test(trimmed)) return trimmed;
+  return null;
+}
+var PiDriver = class {
+  id = "pi";
+  lifecycle = {
+    kind: "per_turn",
+    start: "defer_until_concrete_message",
+    exit: "terminate_on_turn_end",
+    inFlightWake: "coalesce_into_pending"
+  };
+  communication = {
+    chat: "slock_cli",
+    runtimeControl: "none"
+  };
+  session = {
+    recovery: "resume_or_fresh"
+  };
+  model = {
+    detectedModelsVerifiedAs: "launchable",
+    toLaunchSpec: (modelId, ctx) => {
+      if (!ctx) return modelId && modelId !== "default" ? { args: ["--model", modelId] } : { args: [] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildPiLaunchOptions(launchCtx);
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: [launch.runnerConfigPath],
+        params: {
+          agentDir: launch.agentDir,
+          sessionDir: launch.sessionDir,
+          sdkVersion: launch.sdkVersion,
+          resources: "extensions/skills/prompt-templates/themes/context-files disabled by Slock policy"
+        }
+      };
+    }
+  };
+  supportsStdinNotification = false;
+  mcpToolPrefix = CHAT_MCP_TOOL_PREFIX2;
+  busyDeliveryMode = "none";
+  terminateProcessOnTurnEnd = true;
+  deferSpawnUntilMessage = true;
+  usesSlockCliForCommunication = true;
+  sessionId = null;
+  sessionAnnounced = false;
+  apiKeyErrorAnnounced = false;
+  turnEnded = false;
+  assistantTextByMessageId = /* @__PURE__ */ new Map();
+  shouldDeferWakeMessage(message) {
+    return isSystemFirstMessageTask2(message);
+  }
+  probe() {
+    return probePi();
+  }
+  async detectModels() {
+    return null;
+  }
+  spawn(ctx) {
+    this.sessionId = ctx.config.sessionId || null;
+    this.sessionAnnounced = false;
+    this.apiKeyErrorAnnounced = false;
+    this.turnEnded = false;
+    this.assistantTextByMessageId.clear();
+    const unsupportedMessage = unsupportedPiVersionMessage(PI_SDK_VERSION);
+    if (unsupportedMessage) throw new Error(unsupportedMessage);
+    const launch = buildPiLaunchOptions(ctx);
+    const proc = spawn8(launch.command, launch.args, {
+      cwd: ctx.workingDirectory,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: launch.env,
+      shell: false
+    });
+    proc.stdin?.end();
+    return { process: proc };
+  }
+  parseLine(line) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      if (this.apiKeyErrorAnnounced) return [];
+      const message = apiKeyErrorMessage(line);
+      if (!message) return [];
+      this.apiKeyErrorAnnounced = true;
+      this.turnEnded = true;
+      return [
+        { kind: "error", message },
+        { kind: "turn_end", sessionId: this.sessionId || void 0 }
+      ];
+    }
+    const events = [];
+    if (event.type === "session" && event.id) {
+      this.sessionId = event.id;
+    }
+    if (!this.sessionAnnounced && this.sessionId) {
+      events.push({ kind: "session_init", sessionId: this.sessionId });
+      this.sessionAnnounced = true;
+    }
+    switch (event.type) {
+      case "agent_start":
+      case "turn_start":
+        events.push({ kind: "thinking", text: "" });
+        break;
+      case "message_update":
+      case "message_end":
+        if (event.message?.role === "assistant") {
+          const key = event.message.id || "current";
+          const currentText = contentText(event.message.content);
+          const previousText = this.assistantTextByMessageId.get(key) ?? "";
+          if (currentText.length > previousText.length && currentText.startsWith(previousText)) {
+            events.push({ kind: "text", text: currentText.slice(previousText.length) });
+          } else if (currentText && currentText !== previousText) {
+            events.push({ kind: "text", text: currentText });
+          }
+          this.assistantTextByMessageId.set(key, currentText);
+          if (event.message.stopReason === "error" || event.message.stopReason === "aborted") {
+            events.push({ kind: "error", message: event.message.errorMessage || `Request ${event.message.stopReason}` });
+          }
+        }
+        break;
+      case "tool_execution_start":
+        events.push({
+          kind: "tool_call",
+          name: event.toolName || "unknown_tool",
+          input: event.args
+        });
+        break;
+      case "tool_execution_end":
+        events.push({
+          kind: "tool_output",
+          name: event.toolName || "unknown_tool"
+        });
+        if (event.isError) {
+          events.push({ kind: "error", message: `Pi tool ${event.toolName || "unknown_tool"} failed` });
+        }
+        break;
+      case "compaction_start":
+        events.push({ kind: "compaction_started" });
+        break;
+      case "compaction_end":
+        events.push({ kind: "compaction_finished" });
+        if (event.errorMessage) events.push({ kind: "error", message: event.errorMessage });
+        break;
+      case "turn_end":
+      case "agent_end":
+        if (!this.turnEnded) {
+          events.push({ kind: "turn_end", sessionId: this.sessionId || void 0 });
+          this.turnEnded = true;
+        }
+        break;
+    }
+    return events;
+  }
+  encodeStdinMessage(_text, _sessionId, _opts) {
+    return null;
+  }
+  buildSystemPrompt(config, _agentId) {
+    return buildPiSystemPrompt(config);
+  }
+};
+
 // src/drivers/index.ts
 var driverFactories = {
   claude: () => new ClaudeDriver(),
@@ -3979,7 +4398,8 @@ var driverFactories = {
   cursor: () => new CursorDriver(),
   gemini: () => new GeminiDriver(),
   kimi: () => new KimiDriver(),
-  opencode: () => new OpenCodeDriver()
+  opencode: () => new OpenCodeDriver(),
+  pi: () => new PiDriver()
 };
 function getDriver(runtimeId) {
   const createDriver = driverFactories[runtimeId];
@@ -3992,7 +4412,7 @@ function getDriver(runtimeId) {
 
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 function isValidWorkspaceDirectoryName(directoryName) {
   return !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..");
 }
@@ -4000,7 +4420,7 @@ function resolveWorkspaceDirectoryPath(dataDir, directoryName) {
   if (!isValidWorkspaceDirectoryName(directoryName)) {
     return null;
   }
-  return path11.join(dataDir, directoryName);
+  return path12.join(dataDir, directoryName);
 }
 function emptyWorkspaceDirectorySummary(latestMtime = /* @__PURE__ */ new Date(0)) {
   return {
@@ -4049,7 +4469,7 @@ async function summarizeWorkspaceDirectory(dirPath) {
     return summary;
   }
   const childSummaries = await Promise.all(
-    entries.map((entry) => summarizeWorkspaceEntry(path11.join(dirPath, entry.name), entry))
+    entries.map((entry) => summarizeWorkspaceEntry(path12.join(dirPath, entry.name), entry))
   );
   for (const childSummary of childSummaries) {
     summary = mergeWorkspaceDirectorySummaries(summary, childSummary);
@@ -4068,7 +4488,7 @@ async function scanWorkspaceDirectories(dataDir) {
       if (!entry.isDirectory()) {
         return null;
       }
-      const dirPath = path11.join(dataDir, entry.name);
+      const dirPath = path12.join(dataDir, entry.name);
       try {
         const summary = await summarizeWorkspaceDirectory(dirPath);
         return {
@@ -4325,12 +4745,12 @@ function findSessionJsonl(root, predicate) {
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isFile() || !predicate(entry.name)) continue;
-      return path12.join(dir, entry.name);
+      return path13.join(dir, entry.name);
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isDirectory()) continue;
-      const found = visit(path12.join(dir, entry.name), depth - 1);
+      const found = visit(path13.join(dir, entry.name), depth - 1);
       if (found) return found;
     }
     return null;
@@ -4343,10 +4763,10 @@ function safeSessionFilename(value) {
 }
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
-    const dir = path12.join(fallbackDir, ".slock", "runtime-sessions");
-    mkdirSync4(dir, { recursive: true });
-    const filePath = path12.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
-    writeFileSync7(filePath, JSON.stringify({
+    const dir = path13.join(fallbackDir, ".slock", "runtime-sessions");
+    mkdirSync5(dir, { recursive: true });
+    const filePath = path13.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
+    writeFileSync8(filePath, JSON.stringify({
       type: "runtime_session_handoff",
       runtime,
       sessionId,
@@ -4365,7 +4785,7 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   }
 }
 function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), fallbackDir) {
-  const directPath = path12.isAbsolute(sessionId) ? sessionId : null;
+  const directPath = path13.isAbsolute(sessionId) ? sessionId : null;
   if (directPath) {
     try {
       if (statSync2(directPath).isFile()) {
@@ -4374,7 +4794,7 @@ function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), f
     } catch {
     }
   }
-  const resolvedPath = runtime === "claude" ? findSessionJsonl(path12.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path12.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
+  const resolvedPath = runtime === "claude" ? findSessionJsonl(path13.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path13.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
   if (!resolvedPath && fallbackDir) {
     const fallback = writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir);
     if (fallback) return fallback;
@@ -5608,26 +6028,26 @@ var AgentProcessManager = class _AgentProcessManager {
     this.recordDaemonTrace("daemon.agent.spawn.started", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
     try {
       const driver = this.driverResolver(config.runtime || "claude");
-      const agentDataDir = path12.join(this.dataDir, agentId);
+      const agentDataDir = path13.join(this.dataDir, agentId);
       await mkdir(agentDataDir, { recursive: true });
       const runtimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
-      const memoryMdPath = path12.join(agentDataDir, "MEMORY.md");
+      const memoryMdPath = path13.join(agentDataDir, "MEMORY.md");
       try {
         await access(memoryMdPath);
       } catch {
         const initialMemoryMd = buildInitialMemoryMd(runtimeConfig);
         await writeFile(memoryMdPath, initialMemoryMd);
       }
-      const notesDir = path12.join(agentDataDir, "notes");
+      const notesDir = path13.join(agentDataDir, "notes");
       await mkdir(notesDir, { recursive: true });
       if (getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE) {
         const seedFiles = buildOnboardingSeedFiles();
         for (const { relativePath, content } of seedFiles) {
-          const fullPath = path12.join(agentDataDir, relativePath);
+          const fullPath = path13.join(agentDataDir, relativePath);
           try {
             await access(fullPath);
           } catch {
-            await mkdir(path12.dirname(fullPath), { recursive: true });
+            await mkdir(path13.dirname(fullPath), { recursive: true });
             await writeFile(fullPath, content);
           }
         }
@@ -6472,7 +6892,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return true;
   }
   async resetWorkspace(agentId) {
-    const agentDataDir = path12.join(this.dataDir, agentId);
+    const agentDataDir = path13.join(this.dataDir, agentId);
     try {
       await rm2(agentDataDir, { recursive: true, force: true });
       logger.info(`[Agent ${agentId}] Workspace reset complete (${agentDataDir})`);
@@ -6509,7 +6929,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return result;
   }
   buildRuntimeProfileReport(agentId, config, sessionId, launchId) {
-    const workspacePath = path12.join(this.dataDir, agentId);
+    const workspacePath = path13.join(this.dataDir, agentId);
     return {
       agentId,
       launchId,
@@ -6766,7 +7186,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   // Workspace file browsing
   async getFileTree(agentId, dirPath) {
-    const agentDir = path12.join(this.dataDir, agentId);
+    const agentDir = path13.join(this.dataDir, agentId);
     try {
       await stat2(agentDir);
     } catch {
@@ -6774,8 +7194,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     let targetDir = agentDir;
     if (dirPath) {
-      const resolved = path12.resolve(agentDir, dirPath);
-      if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
+      const resolved = path13.resolve(agentDir, dirPath);
+      if (!resolved.startsWith(agentDir + path13.sep) && resolved !== agentDir) {
         return [];
       }
       targetDir = resolved;
@@ -6783,14 +7203,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return this.listDirectoryChildren(targetDir, agentDir);
   }
   async readFile(agentId, filePath) {
-    const agentDir = path12.join(this.dataDir, agentId);
-    const resolved = path12.resolve(agentDir, filePath);
-    if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
+    const agentDir = path13.join(this.dataDir, agentId);
+    const resolved = path13.resolve(agentDir, filePath);
+    if (!resolved.startsWith(agentDir + path13.sep) && resolved !== agentDir) {
       throw new Error("Access denied");
     }
     const info = await stat2(resolved);
     if (info.isDirectory()) throw new Error("Cannot read a directory");
-    const ext = path12.extname(resolved).toLowerCase();
+    const ext = path13.extname(resolved).toLowerCase();
     if (WORKSPACE_TEXT_EXTENSIONS.has(ext) || ext === "") {
       if (info.size > WORKSPACE_TEXT_FILE_MAX_BYTES) throw new Error("File too large");
       const content = await readFile(resolved, "utf-8");
@@ -6825,13 +7245,13 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const agent = this.agents.get(agentId);
     const runtime = runtimeHint || agent?.config.runtime || "claude";
     const home = os6.homedir();
-    const workspaceDir = path12.join(this.dataDir, agentId);
+    const workspaceDir = path13.join(this.dataDir, agentId);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalResults = await Promise.all(
-      paths.global.map((p) => this.scanSkillsDir(path12.join(home, p)))
+      paths.global.map((p) => this.scanSkillsDir(path13.join(home, p)))
     );
     const workspaceResults = await Promise.all(
-      paths.workspace.map((p) => this.scanSkillsDir(path12.join(workspaceDir, p)))
+      paths.workspace.map((p) => this.scanSkillsDir(path13.join(workspaceDir, p)))
     );
     const dedup = (skills) => {
       const seen = /* @__PURE__ */ new Set();
@@ -6860,7 +7280,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const skills = [];
     for (const entry of entries) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        const skillMd = path12.join(dir, entry.name, "SKILL.md");
+        const skillMd = path13.join(dir, entry.name, "SKILL.md");
         try {
           const content = await readFile(skillMd, "utf-8");
           const skill = this.parseSkillMd(entry.name, content);
@@ -6871,7 +7291,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       } else if (entry.name.endsWith(".md")) {
         const cmdName = entry.name.replace(/\.md$/, "");
         try {
-          const content = await readFile(path12.join(dir, entry.name), "utf-8");
+          const content = await readFile(path13.join(dir, entry.name), "utf-8");
           const skill = this.parseSkillMd(cmdName, content);
           skill.sourcePath = dir;
           skills.push(skill);
@@ -7859,8 +8279,8 @@ ${RESPONSE_TARGET_HINT}`);
     const nodes = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const fullPath = path12.join(dir, entry.name);
-      const relativePath = path12.relative(rootDir, fullPath);
+      const fullPath = path13.join(dir, entry.name);
+      const relativePath = path13.relative(rootDir, fullPath);
       let info;
       try {
         info = await stat2(fullPath);
@@ -8163,9 +8583,9 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
 import os7 from "os";
-import path13 from "path";
+import path14 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
   code = "DAEMON_MACHINE_LOCK_HELD";
@@ -8187,7 +8607,7 @@ function resolveDefaultMachineStateRoot() {
   return resolveSlockHomePath("machines");
 }
 function ownerPath(lockDir) {
-  return path13.join(lockDir, "owner.json");
+  return path14.join(lockDir, "owner.json");
 }
 function readOwner(lockDir) {
   try {
@@ -8217,13 +8637,13 @@ function acquireDaemonMachineLock(options) {
   const rootDir = options.rootDir ?? resolveDefaultMachineStateRoot();
   const fingerprint = apiKeyFingerprint(options.apiKey);
   const lockId = getDaemonMachineLockId(options.apiKey);
-  const machineDir = path13.join(rootDir, lockId);
-  const lockDir = path13.join(machineDir, "daemon.lock");
+  const machineDir = path14.join(rootDir, lockId);
+  const lockDir = path14.join(machineDir, "daemon.lock");
   const token = randomUUID2();
-  mkdirSync5(machineDir, { recursive: true });
+  mkdirSync6(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync5(lockDir);
+      mkdirSync6(lockDir);
       const owner = {
         pid: process.pid,
         token,
@@ -8233,7 +8653,7 @@ function acquireDaemonMachineLock(options) {
         apiKeyFingerprint: fingerprint.slice(0, 16)
       };
       try {
-        writeFileSync8(ownerPath(lockDir), `${JSON.stringify(owner, null, 2)}
+        writeFileSync9(ownerPath(lockDir), `${JSON.stringify(owner, null, 2)}
 `, { mode: 384 });
       } catch (err) {
         rmSync3(lockDir, { recursive: true, force: true });
@@ -8270,8 +8690,8 @@ function acquireDaemonMachineLock(options) {
 }
 
 // src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
-import path14 from "path";
+import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
+import path15 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_FILES = 8;
@@ -8307,7 +8727,7 @@ var LocalRotatingTraceSink = class {
   currentSize = 0;
   sequence = 0;
   constructor(options) {
-    this.traceDir = path14.join(options.machineDir, "traces");
+    this.traceDir = path15.join(options.machineDir, "traces");
     this.maxFileBytes = Math.max(1024, Math.floor(options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES));
     const baseAgeMs = Math.max(1e3, Math.floor(options.maxFileAgeMs ?? DEFAULT_MAX_FILE_AGE_MS));
     const ageJitterMs = Math.max(0, Math.floor(options.maxFileAgeJitterMs ?? 0));
@@ -8333,15 +8753,15 @@ var LocalRotatingTraceSink = class {
     return this.currentFile;
   }
   ensureFile(nextBytes) {
-    mkdirSync6(this.traceDir, { recursive: true, mode: 448 });
+    mkdirSync7(this.traceDir, { recursive: true, mode: 448 });
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
-      this.currentFile = path14.join(
+      this.currentFile = path15.join(
         this.traceDir,
         `daemon-trace-${safeTimestamp(nowMs)}-${process.pid}-${String(this.sequence++).padStart(4, "0")}.jsonl`
       );
-      writeFileSync9(this.currentFile, "", { flag: "a", mode: 384 });
+      writeFileSync10(this.currentFile, "", { flag: "a", mode: 384 });
       this.currentSize = statSync4(this.currentFile).size;
       this.currentFileOpenedAtMs = nowMs;
       this.pruneOldFiles();
@@ -8352,7 +8772,7 @@ var LocalRotatingTraceSink = class {
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync4(path14.join(this.traceDir, file), { force: true });
+      rmSync4(path15.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -8439,11 +8859,11 @@ function isDiagnosticErrorAttr(key) {
 import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 import { gzipSync } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 
 // src/directUploadCapability.ts
-function joinUrl(base, path17) {
-  return `${base.replace(/\/+$/, "")}${path17}`;
+function joinUrl(base, path18) {
+  return `${base.replace(/\/+$/, "")}${path18}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -8662,7 +9082,7 @@ var DaemonTraceBundleUploader = class {
     }, nextMs);
   }
   async findUploadCandidates() {
-    const traceDir = path15.join(this.options.machineDir, "traces");
+    const traceDir = path16.join(this.options.machineDir, "traces");
     let names;
     try {
       names = await readdir3(traceDir);
@@ -8674,8 +9094,8 @@ var DaemonTraceBundleUploader = class {
     const currentFile = this.options.currentFileProvider?.();
     const candidates = [];
     for (const name of names.filter((entry) => entry.startsWith("daemon-trace-") && entry.endsWith(".jsonl")).sort()) {
-      const file = path15.join(traceDir, name);
-      if (currentFile && path15.resolve(file) === path15.resolve(currentFile)) continue;
+      const file = path16.join(traceDir, name);
+      if (currentFile && path16.resolve(file) === path16.resolve(currentFile)) continue;
       if (await this.isUploaded(file)) continue;
       try {
         const info = await stat3(file);
@@ -8749,8 +9169,8 @@ var DaemonTraceBundleUploader = class {
     }
   }
   uploadStatePath(file) {
-    const stateDir = path15.join(this.options.machineDir, "trace-uploads");
-    return path15.join(stateDir, `${path15.basename(file)}.uploaded.json`);
+    const stateDir = path16.join(this.options.machineDir, "trace-uploads");
+    return path16.join(stateDir, `${path16.basename(file)}.uploaded.json`);
   }
   async isUploaded(file) {
     try {
@@ -8762,9 +9182,9 @@ var DaemonTraceBundleUploader = class {
   }
   async markUploaded(file, metadata) {
     const stateFile = this.uploadStatePath(file);
-    await mkdir2(path15.dirname(stateFile), { recursive: true, mode: 448 });
+    await mkdir2(path16.dirname(stateFile), { recursive: true, mode: 448 });
     await writeFile2(stateFile, `${JSON.stringify({
-      file: path15.basename(file),
+      file: path16.basename(file),
       uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...metadata
     }, null, 2)}
@@ -8786,7 +9206,7 @@ var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
 var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels"];
 var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 = 3;
 var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2 = 250;
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -8822,9 +9242,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -8841,23 +9261,23 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveChatBridgePath(moduleUrl = import.meta.url) {
-  const dirname = path16.dirname(fileURLToPath(moduleUrl));
-  const jsPath = path16.resolve(dirname, "chat-bridge.js");
+  const dirname = path17.dirname(fileURLToPath2(moduleUrl));
+  const jsPath = path17.resolve(dirname, "chat-bridge.js");
   try {
     accessSync(jsPath);
     return jsPath;
   } catch {
-    return path16.resolve(dirname, "chat-bridge.ts");
+    return path17.resolve(dirname, "chat-bridge.ts");
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path16.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path16.resolve(thisDir, "cli", "index.js");
+  const thisDir = path17.dirname(fileURLToPath2(moduleUrl));
+  const bundledDistPath = path17.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path16.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path17.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -9036,7 +9456,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path16.join(path16.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path17.join(path17.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -9538,6 +9958,8 @@ var DaemonCore = class {
 };
 
 export {
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,