@slock-ai/daemon 0.53.1-alpha.3 → 0.53.1-alpha.4

package/dist/{chunk-QVULOADZ.js → chunk-WJZJFOKB.js}

@@ -723,6 +723,7 @@ var SERVER_CAPABILITY_MATRIX = {
 var RUNTIMES = [
   { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
   { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
+  { id: "antigravity", displayName: "Antigravity CLI", binary: "agy", supported: true },
   { id: "kimi", displayName: "Kimi CLI", binary: "kimi", supported: true },
   { id: "copilot", displayName: "Copilot CLI", binary: "copilot", supported: true },
   { id: "cursor", displayName: "Cursor CLI", binary: "cursor-agent", supported: true },
@@ -832,8 +833,9 @@ function buildPrompt(config, variant, opts) {
     "- Use only the provided MCP tools for messaging \u2014 they are already available and ready.",
     `- Always claim a task via ${taskClaimCmd} before starting work on it. If the claim fails, move on to a different task.`
   ];
-  const runtimeProfileControlStartupStep = config.runtimeProfileControl ? [
-    "0. If this system prompt contains a **Runtime Profile Control** section, complete that runtime-control instruction first. Do not read MEMORY.md, check messages, or respond to inbox messages until the required runtime control action has succeeded."
+  const runtimeProfileControl = config.runtimeProfileControl?.kind === "daemon_release_notice" ? config.runtimeProfileControl : null;
+  const runtimeProfileControlStartupStep = runtimeProfileControl ? [
+    "0. If this system prompt contains a **Runtime Profile Control** section, read that notice first. It is informational only; no runtime control action or chat reply is required. Do not read MEMORY.md, check messages, or respond to inbox messages before reading it."
   ] : [];
   const startupSteps = isCli ? [
     ...runtimeProfileControlStartupStep,
@@ -1105,28 +1107,19 @@ ${startupSteps.join("\n")}`;
 
 ${opts.postStartupNotes.join("\n")}`;
   }
-  if (config.runtimeProfileControl) {
-    const control = config.runtimeProfileControl;
+  if (runtimeProfileControl) {
+    const control = runtimeProfileControl;
     prompt += `
 
 ## Runtime Profile Control
 
 `;
-    prompt += `This section is a trusted daemon runtime-control instruction. It overrides the normal startup sequence: complete this section before reading MEMORY.md, checking messages, or responding to inbox messages.
+    prompt += `This section is a trusted daemon release notice. Read it before normal startup work; it does not require a runtime control action, chat reply, or migration acknowledgment.
 
 `;
-    if (control.kind === "migration") {
-      prompt += `You are currently in Runtime Profile migration. Before handling normal inbox messages, re-ground yourself in the new runtime context and then invoke the runtime control action \`${t("runtime_profile_migration_done")}\` with exactly this migration_key: \`${control.key}\`.
-
-`;
-      prompt += `Do not use ${sendCmd}, ${checkCmd}, or any chat reply as the migration acknowledgment. Normal inbox delivery is gated until the runtime control action succeeds.
+    prompt += `Read the daemon release notice below before handling normal inbox messages. No chat reply is required for this notice.
 
 `;
-    } else {
-      prompt += `Read the daemon release notice below before handling normal inbox messages. No chat reply is required for this notice.
-
-`;
-    }
     prompt += control.message;
   }
   prompt += `
@@ -1367,30 +1360,85 @@ import { randomBytes } from "crypto";
 import http from "http";
 import { URL as URL2 } from "url";
 var registrations = /* @__PURE__ */ new Map();
-var servers = /* @__PURE__ */ new Map();
+var proxyServerState = null;
+var proxyServerStartPromise = null;
+var proxyServerFactory = createProxyServer;
 var DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["content-encoding", "content-length", "transfer-encoding"]);
 var LOCAL_HELD_CONTEXT_LIMIT = 3;
-function allocatePort() {
-  return 43e3 + randomBytes(2).readUInt16BE(0) % 1e4;
-}
-function ensureServer(port) {
-  if (servers.has(port)) return;
-  const server = http.createServer((req, res) => {
-    void handleProxyRequest(req, res).catch((err) => {
-      logger.error(`[Agent Credential Proxy] unhandled local proxy error: ${err.message}`);
-      writeProxyFailureResponse(res, {
-        error: "failed to proxy local agent request",
-        code: "agent_proxy_failed",
-        detail: truncateProxyErrorMessage(err.message)
+var AGENT_CREDENTIAL_PROXY_HOST = "127.0.0.1";
+var AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS = 3;
+function createProxyRequestHandler() {
+  return (req, res) => {
+    void handleProxyRequest(req, res);
+  };
+}
+function createProxyServer(handler) {
+  return http.createServer(handler);
+}
+function listenOnLoopback(server) {
+  return new Promise((resolve, reject) => {
+    const onError = (err) => {
+      server.off("listening", onListening);
+      reject(err);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      const address = server.address();
+      if (!address || typeof address.port !== "number") {
+        reject(new Error("local proxy listen succeeded without a TCP port"));
+        return;
+      }
+      resolve({
+        server,
+        proxyUrl: `http://${AGENT_CREDENTIAL_PROXY_HOST}:${address.port}`
       });
-    });
-  });
-  server.on("error", (err) => {
-    logger.warn(`[Agent Credential Proxy] local proxy on port ${port} failed: ${err.message}`);
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(0, AGENT_CREDENTIAL_PROXY_HOST);
   });
-  server.listen(port, "127.0.0.1");
-  server.unref();
-  servers.set(port, server);
+}
+function closeServerBestEffort(server) {
+  try {
+    server.close();
+  } catch {
+  }
+}
+async function startProxyServer() {
+  let lastError;
+  for (let attempt = 1; attempt <= AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS; attempt += 1) {
+    const server = proxyServerFactory(createProxyRequestHandler());
+    try {
+      const state = await listenOnLoopback(server);
+      state.server.on("error", (err) => {
+        logger.warn(`[Agent Credential Proxy] local proxy failed after bind: ${err.message}`);
+      });
+      state.server.unref();
+      return state;
+    } catch (err) {
+      lastError = err;
+      closeServerBestEffort(server);
+      logger.warn(
+        `[Agent Credential Proxy] local proxy bind attempt ${attempt}/${AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS} failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const detail = lastError instanceof Error ? lastError.message : String(lastError ?? "unknown error");
+  throw new Error(
+    `Agent Credential Proxy local proxy failed to bind ${AGENT_CREDENTIAL_PROXY_HOST} after ${AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS} attempts: ${detail}`
+  );
+}
+async function ensureServer() {
+  if (proxyServerState) return proxyServerState;
+  if (!proxyServerStartPromise) {
+    proxyServerStartPromise = startProxyServer();
+  }
+  try {
+    proxyServerState = await proxyServerStartPromise;
+    return proxyServerState;
+  } finally {
+    proxyServerStartPromise = null;
+  }
 }
 function responseHeadersForLocalProxy(upstream) {
   const headers = {};
@@ -1411,7 +1459,6 @@ async function handleProxyRequest(req, res) {
   }
   const method = req.method ?? "GET";
   let target;
-  let upstreamStatus = null;
   try {
     target = new URL2(req.url ?? "/", registration.serverUrl);
     const headers = new Headers();
@@ -1461,7 +1508,6 @@ async function handleProxyRequest(req, res) {
       // Required by undici when forwarding a Node stream.
       duplex: body ? "half" : void 0
     });
-    upstreamStatus = upstream.status;
     if (shouldBufferJsonResponse(upstream, target.pathname, registration)) {
       const responseText = await upstream.text();
       consumeVisibleResponse(registration, target, sendTarget, responseText);
@@ -1485,45 +1531,26 @@ async function handleProxyRequest(req, res) {
       res.end();
     }
   } catch (err) {
-    const failure = proxyFailureForError(method, target, res, upstreamStatus, err);
+    const failure = proxyFailureForError(method, target, err);
     logger.warn(
-      `[Agent Credential Proxy] request failed (agent=${registration.agentId}, launch=${registration.launchId ?? "none"}, method=${failure.method}, path=${failure.pathname}, query_keys=${failure.queryKeys.join(",") || "none"}): ${failure.errorClass}: ${failure.errorMessage}`
+      `[Agent Credential Proxy] request failed (agent=${registration.agentId}, launch=${registration.launchId ?? "none"}, method=${failure.method}, path=${failure.pathname}, query_keys=${failure.queryKeys.join(",") || "none"}): ${failure.errorName}: ${failure.errorMessage}`
     );
     registration.inboxCoordinator?.recordProxyFailure?.(failure);
-    writeProxyFailureResponse(res, {
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(JSON.stringify({
       error: "failed to proxy local agent request",
       code: "agent_proxy_failed",
       detail: failure.errorMessage
-    });
-  }
-}
-function writeProxyFailureResponse(res, body) {
-  if (res.destroyed || res.writableEnded) return;
-  if (proxyResponseStarted(res)) {
-    try {
-      res.end();
-    } catch {
-    }
-    return;
-  }
-  try {
-    res.writeHead(502, { "content-type": "application/json" });
-    res.end(JSON.stringify(body));
-  } catch {
+    }));
   }
 }
-function proxyResponseStarted(res) {
-  return res.headersSent || res.writableEnded;
-}
-function proxyFailureForError(method, target, res, upstreamStatus, err) {
+function proxyFailureForError(method, target, err) {
   const queryKeys = target ? [.../* @__PURE__ */ new Set([...target.searchParams.keys()])].sort() : [];
   return {
     method,
     pathname: target?.pathname ?? "unknown",
     queryKeys,
-    responseStarted: proxyResponseStarted(res),
-    upstreamStatus,
-    errorClass: err instanceof Error ? err.name : typeof err,
+    errorName: err instanceof Error ? err.name : typeof err,
     errorMessage: truncateProxyErrorMessage(err instanceof Error ? err.message : String(err))
   };
 }
@@ -1882,9 +1909,8 @@ function consumeVisibleResponse(registration, targetUrl, sendTarget, responseTex
     coordinator.consumeVisibleMessages({ target, messages, boundarySeq: maxMessageSeq(messages), source: "agent_api_history" });
   }
 }
-function registerAgentCredentialProxy(input) {
-  const port = allocatePort();
-  ensureServer(port);
+async function registerAgentCredentialProxy(input) {
+  const server = await ensureServer();
   const proxyToken = `sap_${randomBytes(32).toString("base64url")}`;
   registrations.set(proxyToken, {
     serverUrl: input.serverUrl,
@@ -1895,7 +1921,7 @@ function registerAgentCredentialProxy(input) {
     inboxCoordinator: input.inboxCoordinator
   });
   return {
-    proxyUrl: `http://127.0.0.1:${port}`,
+    proxyUrl: server.proxyUrl,
     proxyToken
   };
 }
@@ -1975,7 +2001,7 @@ function runtimeContextEnv(config) {
 function buildCliTransportSystemPrompt(config, opts) {
   return buildCliSystemPrompt(config, opts);
 }
-function prepareCliTransport(ctx, extraEnv = {}, platform = process.platform) {
+async function prepareCliTransport(ctx, extraEnv = {}, platform = process.platform) {
   if (!ctx.slockCliPath) {
     throw new Error(`${ctx.config.runtime} driver: slockCliPath is required (daemon must inject it)`);
   }
@@ -1988,7 +2014,7 @@ function prepareCliTransport(ctx, extraEnv = {}, platform = process.platform) {
   let agentCredentialProxyTokenFile = null;
   if (typeof agentCredentialKey === "string" && agentCredentialKey.length > 0) {
     rmSync(tokenFile, { force: true });
-    agentCredentialProxy = registerAgentCredentialProxy({
+    agentCredentialProxy = await registerAgentCredentialProxy({
       agentId: ctx.agentId,
       launchId: ctx.launchId,
       serverUrl: ctx.config.serverUrl,
@@ -2122,12 +2148,6 @@ import path3 from "path";
 function normalizeExecOutput(raw) {
   return Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw ?? "");
 }
-function preferWindowsCmdShim(resolved, existsSyncFn) {
-  const parsed = path3.win32.parse(resolved);
-  if (parsed.ext.toLowerCase() !== ".ps1") return resolved;
-  const cmdShim = path3.win32.join(parsed.dir, `${parsed.name}.cmd`);
-  return existsSyncFn(cmdShim) ? cmdShim : resolved;
-}
 function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
   const script = "& {$cmd = Get-Command -Name $args[0] -ErrorAction Stop | Select-Object -First 1; if ($cmd.Path) { $cmd.Path } elseif ($cmd.Source) { $cmd.Source } elseif ($cmd.Definition) { $cmd.Definition } }";
   try {
@@ -2142,7 +2162,23 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
       env
     }));
     const resolved = output.trim().split(/\r?\n/)[0];
-    return resolved ? preferWindowsCmdShim(resolved, existsSyncFn) : command;
+    if (!resolved) return null;
+    const lowerResolved = resolved.toLowerCase();
+    if (lowerResolved.endsWith(".ps1")) {
+      const dir = path3.dirname(resolved);
+      const base = path3.basename(resolved, ".ps1");
+      const alternatives = [
+        path3.join(dir, `${base}.cmd`),
+        path3.join(dir, `${base}.bat`),
+        path3.join(dir, `${base}.exe`),
+        path3.join(dir, base)
+      ];
+      for (const alt of alternatives) {
+        if (existsSyncFn(alt)) return alt;
+      }
+      return null;
+    }
+    return resolved;
   } catch {
     return null;
   }
@@ -2230,7 +2266,8 @@ function isRecord(value) {
 function expandClaudeMcpConfigVariables(raw, vars) {
   let expanded = raw;
   for (const [name, value] of Object.entries(vars)) {
-    expanded = expanded.replaceAll(`\${${name}}`, value);
+    const escapedValue = process.platform === "win32" ? value.replace(/\\/g, "\\\\") : value;
+    expanded = expanded.replaceAll(`\${${name}}`, escapedValue);
   }
   return expanded;
 }
@@ -2284,7 +2321,7 @@ function collectClaudeMcpConfigFiles(ctx, home) {
   return files;
 }
 function buildClaudeUserMcpServers(ctx, home) {
-  const servers2 = /* @__PURE__ */ Object.create(null);
+  const servers = /* @__PURE__ */ Object.create(null);
   for (const configFile of collectClaudeMcpConfigFiles(ctx, home)) {
     const mcpServers = readClaudeMcpServers(configFile.path, configFile.vars);
     if (!mcpServers) continue;
@@ -2293,10 +2330,10 @@ function buildClaudeUserMcpServers(ctx, home) {
         logger.warn(`[Claude] ignoring invalid MCP server "${name}" in ${configFile.path}`);
         continue;
       }
-      servers2[name] = server;
+      servers[name] = server;
     }
   }
-  return servers2;
+  return servers;
 }
 var ClaudeDriver = class {
   id = "claude";
@@ -2395,8 +2432,8 @@ var ClaudeDriver = class {
     writeFileSync2(mcpConfigPath, this.buildRuntimeActionsMcpConfig(ctx, home), { mode: 384 });
     return { systemPromptPath, mcpConfigPath };
   }
-  spawn(ctx) {
-    const { slockDir, tokenFile, spawnEnv } = prepareCliTransport(ctx);
+  async spawn(ctx) {
+    const { slockDir, tokenFile, spawnEnv } = await prepareCliTransport(ctx);
     const { systemPromptPath, mcpConfigPath } = this.writeClaudeLaunchFiles(ctx, slockDir);
     const args = this.buildClaudeArgs(ctx.config, ctx.standingPrompt, {
       standingPromptFilePath: systemPromptPath
@@ -2406,11 +2443,18 @@ var ClaudeDriver = class {
     logger.info(
       `[Agent ${ctx.agentId}] transport=cli cli=${ctx.slockCliPath} token_file=${tokenFile}`
     );
-    const proc = spawn(resolveClaudeCommand() ?? "claude", args, {
+    const claudeCommand = resolveClaudeCommand();
+    const isWindows = process.platform === "win32";
+    const lowerClaudeCommand = claudeCommand?.toLowerCase();
+    const isBatchFile = Boolean(
+      isWindows && lowerClaudeCommand && (lowerClaudeCommand.endsWith(".cmd") || lowerClaudeCommand.endsWith(".bat"))
+    );
+    const useShell = isWindows && (!claudeCommand || isBatchFile);
+    const proc = spawn(claudeCommand ?? "claude", args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
-      shell: process.platform === "win32"
+      shell: useShell
     });
     const stdinMsg = JSON.stringify({
       type: "user",
@@ -2525,9 +2569,7 @@ var ClaudeDriver = class {
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
       toolPrefix: "mcp__chat__",
-      extraCriticalRules: [
-        "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `mcp__chat__runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-      ],
+      extraCriticalRules: [],
       postStartupNotes: [
         "**Claude runtime note:** While you are busy, Slock batches inbox-count notifications instead of injecting message content. Use `slock message check` at natural breakpoints to pull the pending messages before side-effect actions that depend on current context."
       ],
@@ -2779,9 +2821,9 @@ var CodexDriver = class {
   sessionAnnounced = false;
   streamedAgentMessageIds = /* @__PURE__ */ new Set();
   streamedReasoningIds = /* @__PURE__ */ new Set();
-  spawn(ctx) {
+  async spawn(ctx) {
     ensureGitRepoForCodex(ctx.workingDirectory);
-    const { spawnEnv } = prepareCliTransport(ctx, { NO_COLOR: "1" });
+    const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" });
     this.process = null;
     this.requestId = 0;
     this.threadId = ctx.config.sessionId || null;
@@ -3102,12 +3144,142 @@ function detectCodexModels(home = os3.homedir()) {
   return { models, default: defaultModel };
 }
 
-// src/drivers/copilot.ts
+// src/drivers/antigravity.ts
+import { randomUUID } from "crypto";
 import { spawn as spawn3 } from "child_process";
+var DEFAULT_PRINT_TIMEOUT = "30m";
+var ANTIGRAVITY_ENV_OVERRIDES = {
+  // `agy` switches to a separate file-based token store when it detects an SSH
+  // session. Daemon agents commonly run under SSH-managed hosts, while the
+  // human login lives in the normal local Antigravity credential store.
+  SSH_CLIENT: void 0,
+  SSH_CONNECTION: void 0,
+  SSH_TTY: void 0
+};
+function resolveAntigravitySpawn(commandArgs, deps = {}) {
+  return {
+    command: resolveCommandOnPath("agy", deps) ?? "agy",
+    args: commandArgs,
+    shell: false
+  };
+}
+function buildAntigravityArgs(ctx) {
+  const args = [
+    "--print",
+    "--print-timeout",
+    ctx.config.envVars?.ANTIGRAVITY_PRINT_TIMEOUT || DEFAULT_PRINT_TIMEOUT,
+    "--dangerously-skip-permissions"
+  ];
+  if (ctx.config.sessionId) {
+    args.push("--continue");
+  }
+  return args;
+}
+var ERROR_LINE_PREFIX_RE = /^(?:(?:error|fatal|exception|failure):\s*|failed(?:\b|:))/i;
+var ERROR_LINE_PATTERNS = [
+  /authentication timed out/i,
+  /\bpermission denied\b/i,
+  /\bunauthorized\b/i,
+  /\brate limit(?:ed)?\b/i,
+  /\bserver error\b/i,
+  /\bnetwork error\b/i,
+  /\brequest timed out\b/i,
+  /\btimed out waiting\b/i,
+  /\b(?:http|status)\s+(?:401|403|429|500|502|503|504)\b/i
+];
+function isErrorLine(line) {
+  return ERROR_LINE_PREFIX_RE.test(line) || ERROR_LINE_PATTERNS.some((pattern) => pattern.test(line));
+}
+var AntigravityDriver = class {
+  id = "antigravity";
+  lifecycle = {
+    kind: "per_turn",
+    start: "immediate",
+    exit: "natural",
+    inFlightWake: "spawn_new"
+  };
+  communication = {
+    chat: "slock_cli",
+    runtimeControl: "none"
+  };
+  session = {
+    recovery: "resume_or_fresh"
+  };
+  model = {
+    detectedModelsVerifiedAs: "suggestion_only",
+    toLaunchSpec: (_modelId) => ({ args: [] })
+  };
+  supportsStdinNotification = false;
+  mcpToolPrefix = "";
+  busyDeliveryMode = "none";
+  usesSlockCliForCommunication = true;
+  sessionId = null;
+  sessionAnnounced = false;
+  probe() {
+    const command = resolveCommandOnPath("agy");
+    if (!command) return { available: false };
+    return {
+      available: true,
+      version: readCommandVersion(command) ?? void 0
+    };
+  }
+  async spawn(ctx) {
+    this.sessionId = ctx.config.sessionId || randomUUID();
+    this.sessionAnnounced = false;
+    const { command, args, shell } = resolveAntigravitySpawn(buildAntigravityArgs(ctx));
+    const { spawnEnv } = await prepareCliTransport(ctx, {
+      NO_COLOR: "1",
+      ...ANTIGRAVITY_ENV_OVERRIDES
+    });
+    const proc = spawn3(command, args, {
+      cwd: ctx.workingDirectory,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: spawnEnv,
+      shell
+    });
+    proc.stdin?.end(ctx.prompt);
+    return { process: proc };
+  }
+  parseLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return [];
+    const events = [];
+    if (!this.sessionAnnounced && this.sessionId) {
+      events.push({ kind: "session_init", sessionId: this.sessionId });
+      this.sessionAnnounced = true;
+    }
+    if (isErrorLine(trimmed)) {
+      events.push({ kind: "error", message: trimmed });
+      return events;
+    }
+    events.push({ kind: "text", text: line });
+    return events;
+  }
+  encodeStdinMessage(_text, _sessionId, _opts) {
+    return null;
+  }
+  buildSystemPrompt(config, _agentId) {
+    return buildCliTransportSystemPrompt(config, {
+      toolPrefix: "",
+      extraCriticalRules: [],
+      postStartupNotes: [
+        "**Antigravity runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
+      ],
+      includeStdinNotificationSection: false,
+      messageNotificationStyle: "poll"
+    });
+  }
+  async detectModels() {
+    return null;
+  }
+};
+
+// src/drivers/copilot.ts
+import { spawn as spawn4 } from "child_process";
 import path6 from "path";
 import { writeFileSync as writeFileSync3 } from "fs";
-function buildCopilotSpawnEnv(ctx) {
-  return prepareCliTransport(ctx, { NO_COLOR: "1" }).spawnEnv;
+async function buildCopilotSpawnEnv(ctx) {
+  return (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
 }
 var CopilotDriver = class {
   id = "copilot";
@@ -3159,7 +3331,7 @@ var CopilotDriver = class {
       }
     });
   }
-  spawn(ctx) {
+  async spawn(ctx) {
     this.sessionId = ctx.config.sessionId || null;
     this.sessionAnnounced = false;
     const mcpConfigPath = path6.join(ctx.workingDirectory, ".slock-copilot-mcp.json");
@@ -3183,8 +3355,8 @@ var CopilotDriver = class {
     if (ctx.config.sessionId) {
       args.push(`--resume=${ctx.config.sessionId}`);
     }
-    const spawnEnv = buildCopilotSpawnEnv(ctx);
-    const proc = spawn3("copilot", args, {
+    const spawnEnv = await buildCopilotSpawnEnv(ctx);
+    const proc = spawn4("copilot", args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -3266,9 +3438,7 @@ var CopilotDriver = class {
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
       toolPrefix: "",
-      extraCriticalRules: [
-        "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-      ],
+      extraCriticalRules: [],
       postStartupNotes: [
         "**Copilot runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
       ],
@@ -3279,11 +3449,11 @@ var CopilotDriver = class {
 };
 
 // src/drivers/cursor.ts
-import { spawn as spawn4, spawnSync } from "child_process";
+import { spawn as spawn5, spawnSync } from "child_process";
 import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync2, existsSync as existsSync5 } from "fs";
 import path7 from "path";
-function buildCursorSpawnEnv(ctx) {
-  return prepareCliTransport(ctx, { NO_COLOR: "1" }).spawnEnv;
+async function buildCursorSpawnEnv(ctx) {
+  return (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
 }
 var CursorDriver = class {
   id = "cursor";
@@ -3333,7 +3503,7 @@ var CursorDriver = class {
       }
     });
   }
-  spawn(ctx) {
+  async spawn(ctx) {
     const cursorDir = path7.join(ctx.workingDirectory, ".cursor");
     if (!existsSync5(cursorDir)) {
       mkdirSync2(cursorDir, { recursive: true });
@@ -3355,8 +3525,8 @@ var CursorDriver = class {
       args.push("--resume", ctx.config.sessionId);
     }
     args.push(ctx.prompt);
-    const spawnEnv = buildCursorSpawnEnv(ctx);
-    const proc = spawn4("cursor-agent", args, {
+    const spawnEnv = await buildCursorSpawnEnv(ctx);
+    const proc = spawn5("cursor-agent", args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -3424,9 +3594,7 @@ var CursorDriver = class {
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
       toolPrefix: "mcp__chat__",
-      extraCriticalRules: [
-        "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-      ],
+      extraCriticalRules: [],
       postStartupNotes: [
         "**Cursor runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
       ],
@@ -3478,17 +3646,14 @@ function runCursorModelsCommand() {
 }
 
 // src/drivers/gemini.ts
-import { execFileSync as execFileSync3, spawn as spawn5 } from "child_process";
+import { execFileSync as execFileSync3, spawn as spawn6 } from "child_process";
 import { existsSync as existsSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
 import path8 from "path";
-function buildGeminiSpawnEnv(ctx, platform = process.platform) {
-  const { spawnEnv } = prepareCliTransport(ctx, { NO_COLOR: "1" }, platform);
+async function buildGeminiSpawnEnv(ctx, platform = process.platform) {
+  const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" }, platform);
   if (!Object.prototype.hasOwnProperty.call(ctx.config.envVars ?? {}, "GEMINI_CLI_TRUST_WORKSPACE")) {
     spawnEnv.GEMINI_CLI_TRUST_WORKSPACE = "true";
   }
-  if (platform === "win32" && !Object.prototype.hasOwnProperty.call(ctx.config.envVars ?? {}, "GEMINI_PTY_INFO")) {
-    spawnEnv.GEMINI_PTY_INFO = "child_process";
-  }
   return spawnEnv;
 }
 function normalizeExecOutput2(raw) {
@@ -3581,13 +3746,13 @@ var GeminiDriver = class {
   usesSlockCliForCommunication = true;
   sessionId = null;
   sessionAnnounced = false;
-  spawn(ctx) {
+  async spawn(ctx) {
     this.sessionId = ctx.config.sessionId || null;
     this.sessionAnnounced = false;
     this.writeGeminiSettings(ctx);
     const { command, args } = resolveGeminiSpawn(buildGeminiArgs(ctx.config));
-    const spawnEnv = buildGeminiSpawnEnv(ctx);
-    const proc = spawn5(command, args, {
+    const spawnEnv = await buildGeminiSpawnEnv(ctx);
+    const proc = spawn6(command, args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -3649,9 +3814,7 @@ var GeminiDriver = class {
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
       toolPrefix: "",
-      extraCriticalRules: [
-        "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-      ],
+      extraCriticalRules: [],
       postStartupNotes: [
         "**Gemini runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
       ],
@@ -3693,8 +3856,8 @@ var GeminiDriver = class {
 };
 
 // src/drivers/kimi.ts
-import { randomUUID } from "crypto";
-import { spawn as spawn6 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { spawn as spawn7 } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "fs";
 import os4 from "os";
 import path9 from "path";
@@ -3758,11 +3921,11 @@ var KimiDriver = class {
       "--runtime-actions-only"
     ];
   }
-  spawn(ctx) {
+  async spawn(ctx) {
     const isResume = !!ctx.config.sessionId;
-    this.sessionId = ctx.config.sessionId || randomUUID();
+    this.sessionId = ctx.config.sessionId || randomUUID2();
     this.sessionAnnounced = false;
-    this.promptRequestId = randomUUID();
+    this.promptRequestId = randomUUID2();
     const isTsSource = ctx.chatBridgePath.endsWith(".ts");
     const command = isTsSource ? "npx" : "node";
     const bridgeArgs = this.buildChatBridgeArgs(ctx);
@@ -3800,9 +3963,9 @@ var KimiDriver = class {
     if (ctx.config.model && ctx.config.model !== "default") {
       args.push("--model", ctx.config.model);
     }
-    const spawnEnv = prepareCliTransport(ctx, { NO_COLOR: "1" }).spawnEnv;
+    const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
     const launch = resolveKimiSpawn(args);
-    const proc = spawn6(launch.command, launch.args, {
+    const proc = spawn7(launch.command, launch.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -3814,7 +3977,7 @@ var KimiDriver = class {
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
-      id: randomUUID(),
+      id: randomUUID2(),
       method: "initialize",
       params: {
         protocol_version: KIMI_WIRE_PROTOCOL_VERSION,
@@ -3895,7 +4058,7 @@ var KimiDriver = class {
     if (mode === "idle") {
       return JSON.stringify({
         jsonrpc: "2.0",
-        id: randomUUID(),
+        id: randomUUID2(),
         method: "prompt",
         params: {
           user_input: _text
@@ -3904,7 +4067,7 @@ var KimiDriver = class {
     }
     return JSON.stringify({
       jsonrpc: "2.0",
-      id: randomUUID(),
+      id: randomUUID2(),
       method: "steer",
       params: {
         user_input: _text
@@ -3914,9 +4077,7 @@ var KimiDriver = class {
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
       toolPrefix: "",
-      extraCriticalRules: [
-        "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-      ],
+      extraCriticalRules: [],
       postStartupNotes: [],
       includeStdinNotificationSection: true,
       messageNotificationStyle: "direct"
@@ -3953,7 +4114,7 @@ function detectKimiModels(home = os4.homedir()) {
 }
 
 // src/drivers/opencode.ts
-import { spawn as spawn7, spawnSync as spawnSync2 } from "child_process";
+import { spawn as spawn8, spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
 import os5 from "os";
 import path10 from "path";
@@ -4089,8 +4250,8 @@ function buildOpenCodeConfig(ctx, home = os5.homedir()) {
     }
   };
 }
-function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
-  const slock = prepareCliTransport(ctx, { NO_COLOR: "1" });
+async function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
+  const slock = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const config = buildOpenCodeConfig(ctx, home);
   const env = {
     ...slock.spawnEnv,
@@ -4309,9 +4470,7 @@ function isSystemFirstMessageTask(message) {
 function buildOpenCodeSystemPrompt(config) {
   return buildCliTransportSystemPrompt(config, {
     toolPrefix: CHAT_MCP_TOOL_PREFIX,
-    extraCriticalRules: [
-      "- Runtime Profile migration completion is the only exception to CLI-only operation: when a migration notice tells you to acknowledge with `runtime_profile_migration_done`, call the `chat_runtime_profile_migration_done` tool with the exact `migration_key`; do not use `slock` CLI or reply in chat as the acknowledgment."
-    ],
+    extraCriticalRules: [],
     postStartupNotes: [
       "**OpenCode runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
     ],
@@ -4336,7 +4495,7 @@ var OpenCodeDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId, ctx, opts) => {
+    toLaunchSpec: async (modelId, ctx, opts) => {
       if (!ctx) return { args: ["--model", modelId] };
       const launchCtx = {
         ...ctx,
@@ -4346,7 +4505,7 @@ var OpenCodeDriver = class {
         }
       };
       const version = readOpenCodeVersion();
-      const launch = buildOpenCodeLaunchOptions(launchCtx, opts?.home, version);
+      const launch = await buildOpenCodeLaunchOptions(launchCtx, opts?.home, version);
       return {
         args: launch.args,
         env: launch.env,
@@ -4385,7 +4544,7 @@ var OpenCodeDriver = class {
   async detectModels() {
     return detectOpenCodeModels();
   }
-  spawn(ctx) {
+  async spawn(ctx) {
     this.sessionId = ctx.config.sessionId || null;
     this.sessionAnnounced = false;
     const version = readOpenCodeVersion();
@@ -4393,9 +4552,9 @@ var OpenCodeDriver = class {
     if (unsupportedMessage) {
       throw new Error(unsupportedMessage);
     }
-    const launch = buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
+    const launch = await buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
     const spawnSpec = resolveOpenCodeSpawn(launch.args);
-    const proc = spawn7(spawnSpec.command, spawnSpec.args, {
+    const proc = spawn8(spawnSpec.command, spawnSpec.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: launch.env,
@@ -4461,6 +4620,7 @@ var OpenCodeDriver = class {
 var driverFactories = {
   claude: () => new ClaudeDriver(),
   codex: () => new CodexDriver(),
+  antigravity: () => new AntigravityDriver(),
   copilot: () => new CopilotDriver(),
   cursor: () => new CursorDriver(),
   gemini: () => new GeminiDriver(),
@@ -4588,15 +4748,38 @@ async function deleteWorkspaceDirectory(dataDir, directoryName) {
 // src/runtimeErrorDiagnostics.ts
 import { createHash } from "crypto";
 var MAX_RUNTIME_ERROR_MESSAGE_EXCERPT_CHARS = 4096;
+var RUNTIME_AUTH_ACTION_REQUIRED_PATTERNS = [
+  /access token could not be refreshed/i,
+  /refresh token was already used/i,
+  /authentication token has been invalidated/i,
+  /logged out or signed in to another account/i,
+  /not logged in/i,
+  /not signed in/i,
+  /login required/i,
+  /log in first/i,
+  /please log in/i,
+  /authentication failed/i,
+  /auth(?:entication)? failed/i,
+  /authentication timed out/i,
+  /missing (?:api )?token/i,
+  /no (?:api )?token/i,
+  /missing credentials/i,
+  /credentials? not found/i,
+  /invalid api key/i,
+  /api key (?:is )?not set/i
+];
 function buildRuntimeErrorDiagnosticEnvelope(message) {
   const rawMessage = String(message || "");
   const scrubbed = scrubRuntimeErrorDiagnosticText(rawMessage);
   const { value: excerpt, truncated } = truncateDiagnosticText(scrubbed, MAX_RUNTIME_ERROR_MESSAGE_EXCERPT_CHARS);
   const httpStatus = extractHttpStatus(rawMessage);
   const runtimeErrorClass = classifyRuntimeError(rawMessage, httpStatus);
+  const runtimeErrorAction = classifyRuntimeErrorAction(rawMessage, runtimeErrorClass);
   const fingerprint = fingerprintRuntimeError(scrubbed);
   const spanAttrs = {
     runtime_error_class: runtimeErrorClass,
+    runtime_error_action: runtimeErrorAction,
+    runtime_error_action_required: runtimeErrorAction !== "none",
     runtime_error_fingerprint: fingerprint,
     runtime_error_message_present: rawMessage.length > 0,
     runtime_error_message_length_bucket: bucketLength(rawMessage.length),
@@ -4613,6 +4796,14 @@ function buildRuntimeErrorDiagnosticEnvelope(message) {
     }
   };
 }
+function formatRuntimeLoginRequiredMessage(runtimeId) {
+  const runtimeLabel = runtimeDisplayName(runtimeId);
+  return `${runtimeLabel} is not logged in on this machine. Please log in to ${runtimeLabel} locally, then retry starting this agent.`;
+}
+function formatRuntimeStartTimeoutMessage(runtimeId) {
+  const runtimeLabel = runtimeDisplayName(runtimeId);
+  return `${runtimeLabel} did not finish starting on this machine. Check that ${runtimeLabel} is installed, logged in, and can run non-interactively, then retry starting this agent.`;
+}
 function scrubRuntimeErrorDiagnosticText(value) {
   return value.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer [REDACTED_TOKEN]").replace(/\b(?:sk|sk-ant|sk-proj|xox[baprs]?)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED_TOKEN]").replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]").replace(/https?:\/\/[^\s"'<>]+/gi, (url) => redactUrlQuery(url)).replace(/\/Users\/[^\s"'<>:]+(?:\/[^\s"'<>:]+)*/g, "[REDACTED_PATH]").replace(/\/home\/[^\s"'<>:]+(?:\/[^\s"'<>:]+)*/g, "[REDACTED_PATH]").replace(/[A-Za-z]:\\Users\\[^\s"'<>:]+(?:\\[^\s"'<>:]+)*/g, "[REDACTED_PATH]");
 }
@@ -4636,12 +4827,44 @@ function classifyRuntimeError(message, httpStatus) {
     if (httpStatus >= 500) return "ProviderServerError";
     return "ProviderApiError";
   }
+  if (isRuntimeAuthActionRequiredText(message)) return "AuthError";
   if (/\btimeout|timed out\b/i.test(message)) return "TimeoutError";
   if (/stream closed before response\.completed|error decoding response body/i.test(message)) return "ProviderStreamError";
   if (/\brate.?limit|too many requests\b/i.test(message)) return "RateLimitError";
   if (/\bnot found\b/i.test(message)) return "NotFoundError";
   return "RuntimeError";
 }
+function classifyRuntimeErrorAction(message, runtimeErrorClass) {
+  if (runtimeErrorClass === "AuthError" && isRuntimeAuthActionRequiredText(message)) {
+    return "user_reauth";
+  }
+  return "none";
+}
+function isRuntimeAuthActionRequiredText(text) {
+  return RUNTIME_AUTH_ACTION_REQUIRED_PATTERNS.some((pattern) => pattern.test(text));
+}
+function runtimeDisplayName(runtimeId) {
+  switch (runtimeId) {
+    case "antigravity":
+      return "Antigravity CLI";
+    case "claude":
+      return "Claude Code";
+    case "codex":
+      return "Codex";
+    case "copilot":
+      return "GitHub Copilot CLI";
+    case "cursor":
+      return "Cursor CLI";
+    case "gemini":
+      return "Gemini CLI";
+    case "kimi":
+      return "Kimi CLI";
+    case "opencode":
+      return "OpenCode";
+    default:
+      return runtimeId || "This runtime";
+  }
+}
 function fingerprintRuntimeError(value) {
   const normalized = value.toLowerCase().replace(/[0-9a-f]{12,}/g, "<hex>").replace(/\b\d+\b/g, "<num>").replace(/\s+/g, " ").trim();
   return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
@@ -4755,6 +4978,12 @@ function stalledRecoverySigtermTimeoutMs() {
     DEFAULT_STALLED_RECOVERY_SIGTERM_TIMEOUT_MS
   );
 }
+function runtimeStartTimeoutMs() {
+  return readNonNegativeIntegerEnv(
+    "SLOCK_DAEMON_RUNTIME_START_TIMEOUT_MS",
+    DEFAULT_RUNTIME_START_TIMEOUT_MS
+  );
+}
 function toLocalTime(iso) {
   const d = new Date(iso);
   if (isNaN(d.getTime())) return iso;
@@ -4838,7 +5067,7 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
       runtime,
       sessionId,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      note: "The native runtime transcript file was not found on this machine; this daemon-created handoff records the previous session identity for Runtime Profile migration."
+      note: "The native runtime transcript file was not found on this machine; this daemon-created handoff records the runtime session identity for diagnostics."
     }) + "\n", { mode: 384 });
     return {
       label: sessionId,
@@ -4947,43 +5176,23 @@ function formatRuntimeProfileControlPrompt(messages) {
     message,
     notification: runtimeProfileNotificationFromMessage(message)
   }));
-  if (controls.length === 0 || controls.some(({ notification }) => !notification)) {
+  if (controls.length === 0 || controls.some(({ notification }) => !notification || notification.kind !== "daemon_release_notice")) {
     return null;
   }
   const body = controls.map(({ message }) => message.content).join("\n\n---\n\n");
-  const hasMigration = controls.some(({ notification }) => notification?.kind === "migration");
-  if (!hasMigration) {
-    return [
-      "Runtime Profile daemon release notice.",
-      "",
-      "Read the notice below before continuing. No chat reply or runtime control action is required for this notice \u2014 resume normal inbox processing afterward.",
-      "",
-      body
-    ].join("\n");
-  }
   return [
-    "Runtime Profile control notice.",
-    "",
-    "Complete the required runtime control action before reading or responding to normal inbox messages.",
+    "Runtime Profile notice.",
     "",
-    body,
+    "Read the daemon release notice below before continuing. No chat reply or runtime control action is required \u2014 resume normal inbox processing afterward.",
     "",
-    "Do not answer this notice in prose as the acknowledgment."
+    body
   ].join("\n");
 }
 function formatRuntimeProfileControlStartupInput(control, driver) {
-  if (control.kind !== "migration") {
-    return [
-      "Read the Runtime Profile daemon release notice from your system prompt before normal work.",
-      "No chat reply is required for this notice. Stop after reading it; queued inbox messages will be delivered separately."
-    ].join("\n");
-  }
-  const actionName = `${driver.mcpToolPrefix}runtime_profile_migration_done`;
+  void driver;
   return [
-    "Runtime Profile migration is required before normal work.",
-    `Invoke the available runtime control action \`${actionName}\` with exactly this migration_key: \`${control.key}\`.`,
-    "Do not read MEMORY.md, check messages, or send a chat reply before this tool call.",
-    "After the runtime control action succeeds, stop. Queued inbox messages will be delivered separately.",
+    "Read the Runtime Profile daemon release notice from your system prompt before normal work.",
+    "No chat reply or runtime control action is required for this notice. Stop after reading it; queued inbox messages will be delivered separately.",
     "",
     control.message
   ].join("\n");
@@ -5002,6 +5211,7 @@ var TRAJECTORY_COALESCE_MS = 350;
 var ACTIVITY_HEARTBEAT_MS = 6e4;
 var COMPACTION_STALE_MS = 5 * 6e4;
 var RUNTIME_PROGRESS_STALE_MS = 15 * 6e4;
+var DEFAULT_RUNTIME_START_TIMEOUT_MS = 2 * 6e4;
 var DEFAULT_STALLED_RECOVERY_SIGTERM_TIMEOUT_MS = 1e4;
 var MAX_STDOUT_LINES = 8;
 var MAX_STDOUT_LINE_LENGTH = 240;
@@ -5444,7 +5654,7 @@ function runtimeProfileNotificationFromMessage(message) {
   return null;
 }
 function runtimeProfileNotificationTitle(kind) {
-  return kind === "migration" ? "Runtime Profile migration" : "Runtime Profile notice";
+  return kind === "migration" ? "Runtime Profile reset" : "Runtime Profile notice";
 }
 function hashRuntimeProfileKey(key) {
   if (!key) return void 0;
@@ -5511,9 +5721,14 @@ function classifyTerminalFailure(ap) {
     ...ap.recentStderr
   ].filter((value) => !!value);
   for (const text of candidates) {
+    const diagnostics = buildRuntimeErrorDiagnosticEnvelope(text);
     const lower = text.toLowerCase();
-    if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || isProviderStreamFailureText(text)) {
-      return text;
+    if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || diagnostics.spanAttrs.runtime_error_action_required === true || isProviderStreamFailureText(text) || isRuntimeStartTimeoutText(text)) {
+      const actionRequired = diagnostics.spanAttrs.runtime_error_action_required === true;
+      return {
+        detail: actionRequired ? formatRuntimeLoginRequiredMessage(ap.driver.id) : text,
+        actionRequired
+      };
     }
   }
   return null;
@@ -5521,6 +5736,9 @@ function classifyTerminalFailure(ap) {
 function isProviderStreamFailureText(text) {
   return /stream closed before response\.completed|error decoding response body/i.test(text);
 }
+function isRuntimeStartTimeoutText(text) {
+  return /did not finish starting on this machine/i.test(text);
+}
 function isCodexProviderReconnectLog(text) {
   return /Reconnecting\.\.\.\s*\d+\s*\/\s*\d+/i.test(text);
 }
@@ -5607,6 +5825,8 @@ function buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes) {
       lastActivityDetailKind: classifyActivityDetailForTrace(ap.lastActivityDetail),
       runtime: ap.config.runtime,
       model: ap.config.model,
+      platform: process.platform,
+      arch: process.arch,
       launchId: ap.launchId || void 0,
       sessionIdPresent: Boolean(ap.sessionId),
       inboxCount: ap.inbox.length,
@@ -5623,6 +5843,12 @@ function buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes) {
     }
   };
 }
+function classifyRuntimeStallReason(ap) {
+  if (ap.lastRuntimeEventKind === "tool_output" && ap.gatedSteering.outstandingToolUses === 0) {
+    return "harness_post_tool_silent_wedge";
+  }
+  return "no_runtime_events";
+}
 function bucketBytes(value) {
   const bytes = typeof value === "string" ? Buffer.byteLength(value, "utf8") : Math.max(0, Math.floor(value ?? 0));
   if (bytes === 0) return "0";
@@ -5927,9 +6153,7 @@ var AgentProcessManager = class _AgentProcessManager {
       method: input.method,
       path: input.pathname,
       query_keys: input.queryKeys,
-      response_started: input.responseStarted,
-      upstream_status: input.upstreamStatus,
-      error_class: input.errorClass,
+      error_name: input.errorName,
       error_message: input.errorMessage
     }, "error");
   }
@@ -6182,9 +6406,31 @@ var AgentProcessManager = class _AgentProcessManager {
     this.recordDaemonTrace("daemon.agent.spawn.started", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
     try {
       const driver = this.driverResolver(config.runtime || "claude");
+      const legacyWakeRuntimeProfile = wakeMessage ? runtimeProfileNotificationFromMessage(wakeMessage) : null;
+      if (legacyWakeRuntimeProfile?.kind === "migration") {
+        this.completeDeprecatedRuntimeProfileMigration(
+          agentId,
+          legacyWakeRuntimeProfile.key,
+          launchId || null,
+          wakeMessage?.traceparent,
+          "wake_message"
+        );
+        wakeMessage = void 0;
+      }
       const agentDataDir = path12.join(this.dataDir, agentId);
       await mkdir(agentDataDir, { recursive: true });
-      const runtimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
+      let runtimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
+      const legacyRuntimeProfileControl = runtimeConfig.runtimeProfileControl?.kind === "migration" ? runtimeConfig.runtimeProfileControl : null;
+      if (legacyRuntimeProfileControl) {
+        this.completeDeprecatedRuntimeProfileMigration(
+          agentId,
+          legacyRuntimeProfileControl.key,
+          launchId || null,
+          void 0,
+          "agent_config"
+        );
+        runtimeConfig = { ...runtimeConfig, runtimeProfileControl: null };
+      }
       const memoryMdPath = path12.join(agentDataDir, "MEMORY.md");
       try {
         await access(memoryMdPath);
@@ -6300,7 +6546,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }
         return;
       }
-      const { process: proc } = driver.spawn({
+      const { process: proc } = await driver.spawn({
         agentId,
         config: effectiveConfig,
         standingPrompt,
@@ -6332,9 +6578,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         notificationTimer: null,
         pendingNotificationCount: 0,
         activityHeartbeat: null,
+        startupTimeoutTimer: null,
+        startupTimedOut: false,
         compactionWatchdog: null,
         compactionStartedAt: null,
         lastRuntimeEventAt: Date.now(),
+        lastRuntimeEventKind: null,
         runtimeProgressStaleSince: null,
         runtimeTraceSpan: null,
         runtimeTraceCounters: createRuntimeTraceCounters(),
@@ -6362,8 +6611,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       });
       this.startRuntimeTrace(agentId, agentProcess, "spawn", wakeMessage ? [wakeMessage] : void 0, runtimeInputTraceAttrs);
       this.agentsStarting.delete(agentId);
-      if (config.runtimeProfileControl) {
-        this.ackInjectedRuntimeProfileControl(agentId, config.runtimeProfileControl, agentProcess.launchId);
+      if (runtimeConfig.runtimeProfileControl) {
+        this.ackInjectedRuntimeProfileControl(agentId, runtimeConfig.runtimeProfileControl, agentProcess.launchId);
       }
       if (wakeMessage) {
         this.consumeVisibleMessages(agentId, { messages: [wakeMessage], source: "spawn_wake_message" });
@@ -6415,7 +6664,10 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       });
       proc.on("error", (err) => {
         const current = this.agents.get(agentId);
-        if (current) current.spawnError = err.message;
+        if (current) {
+          current.spawnError = err.message;
+          this.clearRuntimeStartupTimeout(current);
+        }
         this.recordDaemonTrace("daemon.agent.process.error", {
           agentId,
           launchId: current?.launchId || void 0,
@@ -6459,10 +6711,11 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           if (ap.activityHeartbeat) {
             clearInterval(ap.activityHeartbeat);
           }
+          this.clearRuntimeStartupTimeout(ap);
           this.clearStalledRecoverySigtermWatchdog(ap);
           const finalCode = ap.exitCode ?? code;
           const finalSignal = ap.exitSignal ?? signal;
-          const expectedTermination = Boolean(ap.expectedTerminationReason);
+          const expectedTermination = Boolean(ap.expectedTerminationReason) || ap.startupTimedOut;
           const processEndedCleanly = finalCode === 0 || expectedTermination && !ap.lastRuntimeError;
           const terminalFailureDetail = processEndedCleanly ? null : classifyTerminalFailure(ap);
           const missingResumeSession = isMissingResumeSession(ap);
@@ -6555,7 +6808,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             this.broadcastActivity(agentId, "online", "Process idle");
           } else {
             const reason = formatCrashReason(finalCode, finalSignal, ap);
-            if (terminalFailureDetail && isProviderStreamFailureText(terminalFailureDetail)) {
+            if (terminalFailureDetail && isProviderStreamFailureText(terminalFailureDetail.detail)) {
               this.idleAgentConfigs.set(agentId, {
                 config: { ...ap.config, sessionId: ap.sessionId },
                 sessionId: ap.sessionId,
@@ -6563,19 +6816,23 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
               });
               logger.warn(`[Agent ${agentId}] Recoverable provider stream failure (${reason}) \u2014 keeping agent wakeable`);
               this.sendAgentStatus(agentId, "active", ap.launchId);
+            } else if (ap.startupTimedOut) {
+              logger.warn(`[Agent ${agentId}] Startup timeout cleanup completed (${reason})`);
             } else {
               this.idleAgentConfigs.delete(agentId);
               logger.error(`[Agent ${agentId}] Process crashed (${reason}) \u2014 marking inactive`);
               this.sendAgentStatus(agentId, "inactive", ap.launchId);
             }
             if (terminalFailureDetail) {
-              this.broadcastActivity(
-                agentId,
-                "error",
-                terminalFailureDetail,
-                [{ kind: "text", text: `Error: ${terminalFailureDetail}` }],
-                ap.launchId
-              );
+              if (!ap.startupTimedOut) {
+                this.broadcastActivity(
+                  agentId,
+                  "error",
+                  terminalFailureDetail.detail,
+                  [{ kind: "text", text: `Error: ${terminalFailureDetail.detail}` }],
+                  ap.launchId
+                );
+              }
             } else {
               this.broadcastActivity(agentId, "offline", `Crashed (${summary})`, [], ap.launchId);
             }
@@ -6584,6 +6841,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       });
       this.sendAgentStatus(agentId, "active", launchId || null);
       this.broadcastActivity(agentId, "working", "Starting\u2026");
+      this.startRuntimeStartupTimeout(agentId, agentProcess);
     } catch (err) {
       this.agentsStarting.delete(agentId);
       throw err;
@@ -7103,6 +7361,30 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     logger.info(`[Agent ${agentId}] Deferred non-concrete wake message for ${driver.id}`);
     return true;
   }
+  completeDeprecatedRuntimeProfileMigration(agentId, migrationKey, launchId, traceparent, source) {
+    this.sendToServer({
+      type: "agent:runtime_profile:migration:ack",
+      agentId,
+      migrationKey,
+      launchId: launchId || void 0,
+      traceparent
+    });
+    this.sendToServer({
+      type: "agent:runtime_profile:migration_done",
+      agentId,
+      migrationKey,
+      launchId: launchId || void 0,
+      traceparent
+    });
+    this.recordDaemonTrace("daemon.runtime_profile.migration.deprecated_noop", {
+      agentId,
+      key_present: Boolean(migrationKey),
+      key_hash: hashRuntimeProfileKey(migrationKey),
+      launchId: launchId || void 0,
+      source
+    });
+    logger.info(`[Agent ${agentId}] Completed deprecated Runtime Profile migration ${migrationKey} as reset-session no-op`);
+  }
   getAgentSessionId(agentId) {
     return this.agents.get(agentId)?.sessionId ?? null;
   }
@@ -7164,7 +7446,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     return reports;
   }
-  deliverRuntimeProfileNotification(agentId, key, kind, content, traceparent) {
+  deliverRuntimeProfileNotification(agentId, key, kind, content, traceparent, launchId) {
     const span = this.tracer.startSpan("daemon.runtime_profile.control.inject", {
       parent: parseTraceparent(traceparent),
       surface: "daemon",
@@ -7176,6 +7458,17 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         key_hash: hashRuntimeProfileKey(key)
       }
     });
+    if (kind === "migration") {
+      this.completeDeprecatedRuntimeProfileMigration(
+        agentId,
+        key,
+        launchId || null,
+        formatTraceparent(span.context),
+        "runtime_profile_message"
+      );
+      span.end("ok", { attrs: { outcome: "deprecated_noop_completed", launchId: launchId || void 0 } });
+      return true;
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const message = {
       channel_id: "system",
@@ -7186,7 +7479,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       sender_type: "system",
       content,
       timestamp: now,
-      message_id: `${kind === "migration" ? RUNTIME_PROFILE_MIGRATION_MESSAGE_PREFIX : RUNTIME_PROFILE_DAEMON_NOTICE_MESSAGE_PREFIX}${key}`,
+      message_id: `${RUNTIME_PROFILE_DAEMON_NOTICE_MESSAGE_PREFIX}${key}`,
       traceparent: formatTraceparent(span.context)
     };
     const ap = this.agents.get(agentId);
@@ -7281,25 +7574,19 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     for (const message of messages) {
       const notification = runtimeProfileNotificationFromMessage(message);
       if (!notification) continue;
-      const title = runtimeProfileNotificationTitle(notification.kind);
-      this.broadcastActivity(agentId, "working", title, [{ kind: "system", title, text: message.content }], launchId);
       if (notification.kind === "migration") {
-        this.sendToServer({
-          type: "agent:runtime_profile:migration:ack",
-          agentId,
-          migrationKey: notification.key,
-          launchId: launchId || void 0,
-          traceparent: message.traceparent
-        });
-      } else {
-        this.sendToServer({
-          type: "agent:runtime_profile:daemon_release_notice:ack",
-          agentId,
-          noticeKey: notification.key,
-          launchId: launchId || void 0,
-          traceparent: message.traceparent
-        });
+        this.completeDeprecatedRuntimeProfileMigration(agentId, notification.key, launchId, message.traceparent, "runtime_profile_message");
+        continue;
       }
+      const title = runtimeProfileNotificationTitle(notification.kind);
+      this.broadcastActivity(agentId, "working", title, [{ kind: "system", title, text: message.content }], launchId);
+      this.sendToServer({
+        type: "agent:runtime_profile:daemon_release_notice:ack",
+        agentId,
+        noticeKey: notification.key,
+        launchId: launchId || void 0,
+        traceparent: message.traceparent
+      });
     }
   }
   ackInjectedRuntimeProfileControl(agentId, control, launchId) {
@@ -7316,24 +7603,19 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       }
     });
     const title = runtimeProfileNotificationTitle(control.kind);
-    this.broadcastActivity(agentId, "working", title, [{ kind: "system", title, text: control.message }], launchId);
     if (control.kind === "migration") {
-      this.sendToServer({
-        type: "agent:runtime_profile:migration:ack",
-        agentId,
-        migrationKey: control.key,
-        launchId: launchId || void 0,
-        traceparent: formatTraceparent(span.context)
-      });
-    } else {
-      this.sendToServer({
-        type: "agent:runtime_profile:daemon_release_notice:ack",
-        agentId,
-        noticeKey: control.key,
-        launchId: launchId || void 0,
-        traceparent: formatTraceparent(span.context)
-      });
+      this.completeDeprecatedRuntimeProfileMigration(agentId, control.key, launchId, formatTraceparent(span.context), "agent_config");
+      span.end("ok", { attrs: { outcome: "deprecated_noop_completed" } });
+      return;
     }
+    this.broadcastActivity(agentId, "working", title, [{ kind: "system", title, text: control.message }], launchId);
+    this.sendToServer({
+      type: "agent:runtime_profile:daemon_release_notice:ack",
+      agentId,
+      noticeKey: control.key,
+      launchId: launchId || void 0,
+      traceparent: formatTraceparent(span.context)
+    });
     span.end("ok", { attrs: { outcome: "agent_config_ack_sent" } });
   }
   sendRuntimeProfileWireReport(report) {
@@ -7774,7 +8056,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       runtime_profile_key_hash: control.keyHash || void 0,
       runtime_profile_key_present: control.keyPresent,
       runtime_profile_pending_age_ms: pendingAgeMs,
-      runtime_profile_requires_ack: control.kind === "migration",
+      runtime_profile_requires_ack: false,
       runtime_profile_migration_done_observed: control.kind === "migration" ? control.migrationDoneToolObserved : void 0
     };
   }
@@ -7801,19 +8083,11 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const control = ap.runtimeProfileTurnControl;
     if (!control) return {};
     const attrs = this.runtimeProfileTurnControlTraceAttrs(control);
-    if (control.kind === "migration" && !control.migrationDoneToolObserved) {
-      this.recordRuntimeTraceEvent(agentId, ap, "runtime_profile.migration.turn_without_ack", {
-        ...attrs,
-        terminal,
-        inbox_count: ap.inbox.length,
-        pending_notification_count: ap.pendingNotificationCount
-      });
-    }
     ap.runtimeProfileTurnControl = null;
     return {
       ...attrs,
       runtime_profile_turn_terminal: terminal,
-      runtime_profile_turn_outcome: control.kind === "migration" ? control.migrationDoneToolObserved ? "migration_done_observed" : "missing_migration_done" : "notice_only"
+      runtime_profile_turn_outcome: control.kind === "migration" ? control.migrationDoneToolObserved ? "deprecated_migration_done_observed" : "reset_session_notice" : "notice_only"
     };
   }
   startRuntimeTrace(agentId, ap, reason, messages, inputTraceAttrs = {}) {
@@ -7854,10 +8128,42 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   recordRuntimeTraceEvent(agentId, ap, name, attrs) {
     this.startRuntimeTrace(agentId, ap, "runtime-progress").addEvent(name, attrs);
   }
-  noteRuntimeProgress(ap) {
+  noteRuntimeProgress(ap, eventKind) {
     ap.lastRuntimeEventAt = Date.now();
+    ap.lastRuntimeEventKind = eventKind ?? null;
     ap.runtimeProgressStaleSince = null;
   }
+  observeRuntimeTranscriptProgress(agentId, ap, staleForMs, source) {
+    if (ap.config.runtime !== "codex" || !ap.sessionId) return false;
+    const ref = resolveRuntimeSessionRef(ap.config.runtime, ap.sessionId, this.runtimeSessionHomeDir);
+    if (!ref.reachable || !ref.path) return false;
+    let mtimeMs;
+    try {
+      const stats = statSync2(ref.path);
+      if (!stats.isFile()) return false;
+      mtimeMs = stats.mtimeMs;
+    } catch {
+      return false;
+    }
+    if (mtimeMs <= ap.lastRuntimeEventAt) return false;
+    const now = Date.now();
+    const transcriptAgeMs = Math.max(0, now - mtimeMs);
+    if (transcriptAgeMs >= RUNTIME_PROGRESS_STALE_MS) return false;
+    ap.lastRuntimeEventAt = mtimeMs;
+    ap.runtimeProgressStaleSince = null;
+    this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.internal_observed", {
+      turn_outcome: "held",
+      turn_subtype: "runtime_progress",
+      turn_reason: "internal_activity_observed",
+      signal: "runtime_transcript_mtime",
+      source,
+      runtime: ap.config.runtime,
+      sessionRefReachable: true,
+      transcriptAgeMs,
+      previousStaleForMs: staleForMs
+    });
+    return true;
+  }
   recordGatedSteeringEvent(agentId, ap, event, attrs = {}) {
     if (ap.driver.busyDeliveryMode !== "gated") return;
     const summary = `${event}:${ap.gatedSteering.phase}:tools=${ap.gatedSteering.outstandingToolUses}:compact=${ap.gatedSteering.compacting}`;
@@ -7937,6 +8243,66 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     ap.gatedSteering.inFlightBatch = null;
     this.recordGatedSteeringEvent(agentId, ap, "ack", { reason, messageCount });
   }
+  startRuntimeStartupTimeout(agentId, ap) {
+    const timeoutMs = runtimeStartTimeoutMs();
+    if (timeoutMs <= 0) return;
+    ap.startupTimeoutTimer = setTimeout(() => {
+      this.handleRuntimeStartupTimeout(agentId, ap, timeoutMs);
+    }, timeoutMs);
+    ap.startupTimeoutTimer.unref?.();
+  }
+  clearRuntimeStartupTimeout(ap) {
+    if (!ap.startupTimeoutTimer) return;
+    clearTimeout(ap.startupTimeoutTimer);
+    ap.startupTimeoutTimer = null;
+  }
+  handleRuntimeStartupTimeout(agentId, ap, timeoutMs) {
+    const current = this.agents.get(agentId);
+    if (current !== ap) return;
+    if (ap.lastRuntimeEventKind) {
+      this.clearRuntimeStartupTimeout(ap);
+      return;
+    }
+    this.clearRuntimeStartupTimeout(ap);
+    const terminalFailureDetail = classifyTerminalFailure(ap);
+    const detail = terminalFailureDetail?.detail ?? formatRuntimeStartTimeoutMessage(ap.driver.id);
+    ap.startupTimedOut = true;
+    ap.lastRuntimeError = detail;
+    ap.runtimeProgressStaleSince = Date.now();
+    const staleForMs = Math.max(timeoutMs, Date.now() - ap.lastRuntimeEventAt);
+    const diagnostic = buildRuntimeStallDiagnostic(ap, staleForMs, Math.max(1, Math.floor(staleForMs / 6e4)));
+    this.recordRuntimeTraceEvent(agentId, ap, "runtime.start.timeout", {
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: "no_runtime_events",
+      runtime_start_failure_kind: "runtime_start_timeout",
+      timeout_ms: timeoutMs,
+      ...diagnostic.traceAttrs
+    });
+    this.endRuntimeTrace(ap, "error", {
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: "no_runtime_events",
+      runtime_start_failure_kind: "runtime_start_timeout",
+      timeout_ms: timeoutMs,
+      ...runtimeTraceCounterAttrs(ap),
+      ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_stalled")
+    });
+    logger.warn(`[Agent ${agentId}] ${ap.driver.id} did not emit a startup runtime event within ${timeoutMs}ms; terminating process`);
+    this.broadcastActivity(agentId, "error", detail, [{ kind: "text", text: `Error: ${detail}` }], ap.launchId);
+    this.sendAgentStatus(agentId, "inactive", ap.launchId);
+    this.idleAgentConfigs.delete(agentId);
+    try {
+      this.processExitTraceAttrs.set(ap.process, {
+        stop_source: "startup_timeout",
+        timeout_ms: timeoutMs
+      });
+      ap.process.kill("SIGTERM");
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      logger.warn(`[Agent ${agentId}] Failed to terminate startup-timed-out ${ap.driver.id} process: ${reason}`);
+    }
+  }
   requeueGatedInFlightBatch(agentId, ap, reason) {
     if (ap.driver.busyDeliveryMode !== "gated" || !ap.gatedSteering.inFlightBatch) return;
     const batch = ap.gatedSteering.inFlightBatch;
@@ -7957,12 +8323,21 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     if (ap.runtimeProgressStaleSince) return true;
     const staleForMs = Date.now() - ap.lastRuntimeEventAt;
     if (staleForMs < RUNTIME_PROGRESS_STALE_MS) return false;
+    if (this.observeRuntimeTranscriptProgress(agentId, ap, staleForMs, "activity_heartbeat")) return false;
     ap.runtimeProgressStaleSince = Date.now();
     const staleForMinutes = Math.max(1, Math.floor(staleForMs / 6e4));
     const diagnostic = buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes);
-    this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.stalled", diagnostic.traceAttrs);
+    const turnReason = classifyRuntimeStallReason(ap);
+    this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.stalled", {
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: turnReason,
+      ...diagnostic.traceAttrs
+    });
     this.endRuntimeTrace(ap, "error", {
-      outcome: "runtime-stalled",
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: turnReason,
       ageMs: staleForMs,
       lastActivity: ap.lastActivity,
       lastActivityDetailPresent: Boolean(ap.lastActivityDetail),
@@ -7984,16 +8359,23 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     if (!canRestartStalledProcess) return false;
     const staleForMs = Date.now() - ap.lastRuntimeEventAt;
     if (staleForMs < RUNTIME_PROGRESS_STALE_MS && !ap.runtimeProgressStaleSince) return false;
+    if (this.observeRuntimeTranscriptProgress(agentId, ap, staleForMs, "queued_recovery")) return false;
     const staleForMinutes = Math.max(1, Math.floor(staleForMs / 6e4));
     ap.runtimeProgressStaleSince ??= Date.now();
     const diagnostic = buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes);
+    const turnReason = classifyRuntimeStallReason(ap);
     this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.stalled", {
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: turnReason,
       ...diagnostic.traceAttrs,
       pendingMessages: ap.inbox.length,
       recovery: "terminate_for_queued_message"
     });
     this.endRuntimeTrace(ap, "error", {
-      outcome: "runtime-stalled",
+      turn_outcome: "failed",
+      turn_subtype: "runtime_stalled",
+      turn_reason: turnReason,
       ageMs: staleForMs,
       lastActivity: ap.lastActivity,
       lastActivityDetailPresent: Boolean(ap.lastActivityDetail),
@@ -8030,12 +8412,13 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const ap = this.agents.get(agentId);
     if (ap) {
       const wasStalled = Boolean(ap.runtimeProgressStaleSince);
+      this.clearRuntimeStartupTimeout(ap);
       this.noteRuntimeTraceCounter(ap, event);
       this.recordRuntimeTraceEvent(agentId, ap, "runtime.event.received", { kind: event.kind });
       if (wasStalled) {
         this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.observed", { afterStall: true });
       }
-      this.noteRuntimeProgress(ap);
+      this.noteRuntimeProgress(ap, event.kind);
     }
     switch (event.kind) {
       case "session_init":
@@ -8192,8 +8575,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         this.interruptCompactionIfActive(agentId);
         this.flushPendingTrajectory(agentId);
         if (ap) ap.lastRuntimeError = event.message;
+        let visibleErrorMessage = event.message;
         if (ap) {
           const runtimeErrorDiagnostics = buildRuntimeErrorDiagnosticEnvelope(event.message);
+          if (runtimeErrorDiagnostics.spanAttrs.runtime_error_action_required === true) {
+            visibleErrorMessage = formatRuntimeLoginRequiredMessage(ap.driver.id);
+          }
           this.setGatedSteeringPhase(agentId, ap, "error", { event: "error" });
           if (ap.driver.busyDeliveryMode === "gated" && this.isThinkingBlockMutationError(event.message)) {
             this.requeueGatedInFlightBatch(agentId, ap, "thinking_block_mutation_error");
@@ -8217,18 +8604,33 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             ...runtimeTraceCounterAttrs(ap),
             ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_error")
           });
-          if (ap.driver.supportsStdinNotification && classifyTerminalFailure(ap)) {
-            ap.isIdle = true;
-            ap.pendingNotificationCount = 0;
-            if (ap.notificationTimer) {
-              clearTimeout(ap.notificationTimer);
-              ap.notificationTimer = null;
+          const terminalFailure = classifyTerminalFailure(ap);
+          if (ap.driver.supportsStdinNotification && terminalFailure) {
+            if (terminalFailure.actionRequired) {
+              logger.warn(`[Agent ${agentId}] ${ap.driver.id} auth requires user action; terminating runtime process`);
+              try {
+                this.processExitTraceAttrs.set(ap.process, {
+                  stop_source: "runtime_auth_error",
+                  runtime_error_class: "AuthError"
+                });
+                ap.process.kill("SIGTERM");
+              } catch (err) {
+                const reason = err instanceof Error ? err.message : String(err);
+                logger.warn(`[Agent ${agentId}] Failed to terminate ${ap.driver.id} after auth error: ${reason}`);
+              }
+            } else {
+              ap.isIdle = true;
+              ap.pendingNotificationCount = 0;
+              if (ap.notificationTimer) {
+                clearTimeout(ap.notificationTimer);
+                ap.notificationTimer = null;
+              }
+              logger.info(`[Agent ${agentId}] Marked ${ap.driver.id} wakeable after terminal runtime error`);
             }
-            logger.info(`[Agent ${agentId}] Marked ${ap.driver.id} wakeable after terminal runtime error`);
           }
         }
-        this.broadcastActivity(agentId, "error", event.message, [
-          { kind: "text", text: `Error: ${event.message}` }
+        this.broadcastActivity(agentId, "error", visibleErrorMessage, [
+          { kind: "text", text: `Error: ${visibleErrorMessage}` }
         ]);
         break;
       }
@@ -8346,6 +8748,30 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   /** Deliver a message to an agent via stdin, formatting it the same way as the MCP bridge */
   deliverMessagesViaStdin(agentId, ap, messages, mode) {
     if (messages.length === 0) return true;
+    const runtimeProfileMigrationMessages = messages.filter((message) => runtimeProfileNotificationFromMessage(message)?.kind === "migration");
+    if (runtimeProfileMigrationMessages.length > 0) {
+      for (const message of runtimeProfileMigrationMessages) {
+        const notification = runtimeProfileNotificationFromMessage(message);
+        if (notification?.kind === "migration") {
+          this.completeDeprecatedRuntimeProfileMigration(agentId, notification.key, ap.launchId, message.traceparent, "runtime_profile_message");
+        }
+      }
+      messages = messages.filter((message) => runtimeProfileNotificationFromMessage(message)?.kind !== "migration");
+      this.recordDaemonTrace("daemon.agent.runtime_profile.deprecated_migration_filtered", {
+        agentId,
+        launchId: ap.launchId || void 0,
+        runtime: ap.config.runtime,
+        mode,
+        filtered_messages_count: runtimeProfileMigrationMessages.length,
+        remaining_messages_count: messages.length
+      });
+      if (messages.length === 0) {
+        if (mode === "idle") {
+          ap.isIdle = true;
+        }
+        return true;
+      }
+    }
     const split = this.splitRuntimeProfileControlBatch(messages);
     if (split.deferredMessages.length > 0) {
       ap.inbox.unshift(...split.deferredMessages);
@@ -8751,7 +9177,7 @@ var ReminderCache = class {
 };
 
 // src/machineLock.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
 import os7 from "os";
 import path13 from "path";
@@ -8808,7 +9234,7 @@ function acquireDaemonMachineLock(options) {
   const lockId = getDaemonMachineLockId(options.apiKey);
   const machineDir = path13.join(rootDir, lockId);
   const lockDir = path13.join(machineDir, "daemon.lock");
-  const token = randomUUID2();
+  const token = randomUUID3();
   mkdirSync5(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
@@ -9025,7 +9451,7 @@ function isDiagnosticErrorAttr(key) {
 }
 
 // src/traceBundleUpload.ts
-import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
 import { gzipSync } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
 import path15 from "path";
@@ -9296,7 +9722,7 @@ var DaemonTraceBundleUploader = class {
       }
       const gzipped = gzipSync(raw);
       const bundleSha256 = sha256Hex(gzipped);
-      const bundleId = randomUUID3();
+      const bundleId = randomUUID4();
       await uploadWithSignedCapability({
         serverUrl: this.options.serverUrl,
         apiKey: this.options.apiKey,
@@ -9924,7 +10350,7 @@ var DaemonCore = class {
         });
         logger.info(`[Agent ${msg.agentId}] Runtime profile migration received (${msg.migrationKey})`);
         Promise.resolve(
-          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.migrationKey, "migration", msg.message, formatTraceparent(span.context))
+          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.migrationKey, "migration", msg.message, formatTraceparent(span.context), msg.launchId || null)
         ).then((accepted) => {
           span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
         }, (err) => {
@@ -9947,7 +10373,7 @@ var DaemonCore = class {
         });
         logger.info(`[Agent ${msg.agentId}] Runtime profile daemon release notice received (${msg.noticeKey})`);
         Promise.resolve(
-          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.noticeKey, "daemon_release_notice", msg.message, formatTraceparent(span.context))
+          this.agentManager.deliverRuntimeProfileNotification(msg.agentId, msg.noticeKey, "daemon_release_notice", msg.message, formatTraceparent(span.context), msg.launchId || null)
         ).then((accepted) => {
           span.end("ok", { attrs: { outcome: accepted ? "accepted" : "no_injection_path" } });
         }, (err) => {