@slock-ai/daemon 0.56.0 → 0.56.1-play.20260604141202

package/dist/{chunk-4H5XFLYA.js → chunk-IRYY762Z.js}

@@ -932,10 +932,22 @@ var channelAddMemberOperationSchema = z.object({
   agents: z.array(idOrHandleSchema).max(64).optional(),
   draftHint: draftHintSchema
 });
+var integrationApproveAgentLoginOperationSchema = z.object({
+  type: z.literal("integration:approve_agent_login"),
+  requestId: uuidSchema,
+  agentId: uuidSchema,
+  agentName: z.string().trim().min(1).max(120),
+  clientId: uuidSchema,
+  clientKey: z.string().trim().min(1).max(120),
+  clientName: z.string().trim().min(1).max(120),
+  scopes: z.array(z.string().trim().min(1).max(120)).max(64),
+  draftHint: draftHintSchema
+});
 var actionCardActionSchema = z.discriminatedUnion("type", [
   channelCreateOperationSchema,
   agentCreateOperationSchema,
-  channelAddMemberOperationSchema
+  channelAddMemberOperationSchema,
+  integrationApproveAgentLoginOperationSchema
 ]);
 
 // ../shared/src/agentInbox.ts
@@ -1276,6 +1288,329 @@ import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { createRequire } from "module";
 import path2 from "path";
 
+// src/drivers/slockCliGuide.ts
+var MESSAGE_HEREDOC_DELIMITER = "SLOCKMSG";
+function describeSlockInstallation(audience) {
+  if (audience === "managed-runner") {
+    return "The daemon injects a local `slock` wrapper into PATH for you.";
+  }
+  return "Install the published agent CLI: `npm i -g @slock-ai/cli@latest`. Discover/select a valid external-CLI agent identity first, for example with `slock agent list --server <serverUrl>` or a Slock setup card; then run `slock agent login --server <serverUrl> --agent <id> --profile-slug <slug>` for the selected agent. After login succeeds, invoke commands as `slock --profile <slug> ...` (or set `SLOCK_PROFILE=<slug>`).";
+}
+function buildCommunicationSection(audience) {
+  const installation = describeSlockInstallation(audience);
+  return `## Communication \u2014 slock CLI ONLY
+
+Use the \`slock\` CLI for chat / task / attachment operations. ${installation} Use ONLY these commands for communication:
+
+1. **\`slock message check\`** \u2014 Non-blocking check for new messages. Use freely during work \u2014 at natural breakpoints or after notifications.
+2. **\`slock message send\`** \u2014 Send a message to a channel or DM.
+3. **\`slock server info\`** \u2014 List channels in this server, which ones you have joined, plus all agents and humans.
+4. **\`slock channel members\`** \u2014 List the members (agents and humans) of a specific channel, DM, or thread target.
+5. **\`slock channel join\`** \u2014 Join a visible public channel. This only affects your own agent membership.
+6. **\`slock channel leave\`** \u2014 Leave a regular channel you have joined. This only affects your own agent membership.
+7. **\`slock thread unfollow\`** \u2014 Stop receiving ordinary delivery for a thread you no longer need to follow. This only affects your own agent attention state.
+8. **\`slock message read\`** \u2014 Read past messages from a channel, DM, or thread. Supports \`before\` / \`after\` anchors and \`around\` for centered context.
+9. **\`slock message search\`** \u2014 Search messages visible to you, then inspect a hit with \`slock message read\`.
+10. **\`slock message resolve\`** \u2014 Verify that a cited message id exists exactly and print its canonical message row. Use this when checking whether a referenced id is real; \`read --around\` is for context, not proof.
+11. **\`slock message react\`** \u2014 Add or remove your reaction on a message. Use sparingly: prefer acknowledgement/follow-up signals like \u{1F440}, and do not auto-react to every merge, deploy, or task completion with celebratory emoji.
+12. **\`slock task list\`** \u2014 View a channel's task board.
+13. **\`slock task create\`** \u2014 Create new task-messages in a channel (supports batch titles; equivalent to sending a new message and publishing it as a task-message, not claiming it for yourself).
+14. **\`slock task claim\`** \u2014 Claim tasks by number or message ID (supports batch, handles conflicts).
+15. **\`slock task unclaim\`** \u2014 Release your claim on a task.
+16. **\`slock task update\`** \u2014 Change a task's status (e.g. to in_review or done).
+17. **\`slock attachment upload\`** \u2014 Upload a file to attach to a message. Uses content sniffing for image previews; pass \`--mime-type\` only when you know the exact type. Returns an attachment ID to pass to \`slock message send\`.
+18. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
+19. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
+20. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--avatar-url pixel:random:<seed>\`, \`--display-name <name>\`, and \`--description <text>\`. Use \`--avatar-url pixel:random:<seed>\` when you want a new pixel avatar but do not have a local image file. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
+21. **\`slock integration list\`** \u2014 List built-in Slock apps, registered third-party services, and this agent's active Slock Agent Logins.
+22. **\`slock integration login\`** \u2014 Provision or reuse this agent's login for a built-in Slock app or registered third-party service.
+23. **\`slock integration env\`** \u2014 Print per-agent local CLI environment for a manifest-backed service that requires isolated HOME/XDG state.
+24. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
+25. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
+26. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
+27. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
+28. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
+29. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
+30. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
+
+The CLI prints human-readable canonical text on success (matching the format you see in received messages and history). On failure it prints canonical labeled text to stderr:
+- \`Error:\` human-readable error summary
+- \`Code:\` stable machine-oriented error code
+- \`Next action:\` optional recovery hint
+
+Error code prefixes tell you the layer:
+- \`MISSING_*\` / \`TOKEN_*\` = local auth bootstrap
+- \`*_FAILED\` = 4xx from server
+- \`SERVER_5XX\` = server unreachable / crashed`;
+}
+function buildCredentialHygieneSection() {
+  return `### Credential hygiene
+
+**Never paste credentials into Slock messages, attachments, or task fields.** Agent tokens (\`sk_agent_*\`), legacy machine API keys (\`sk_machine_*\`), session bearers, JWTs, \`.env\` files, or \`credential.json\` contents must never appear in chat \u2014 not in debug traces, error reports, "for context" snippets, or screenshots. If you accidentally paste one, immediately tell the credential owner so they can rotate it; deleting the message does not erase it from message history visible to channel members or search indexes.
+
+If a tool or error output contains credential-shaped strings, redact them to \`sk_agent_<redacted>\` / \`sk_machine_<redacted>\` shape before reposting.
+
+**Profile credential resolution is strict.** When invoked as \`slock --profile <slug>\` or with \`SLOCK_PROFILE=<slug>\`, the CLI resolves credentials from \`$SLOCK_PROFILE_DIR\` \u2192 \`$SLOCK_HOME/profiles/<slug>\` \u2192 \`$HOME/.slock/profiles/<slug>\` in that order. It does **not** fall back to a different profile's credential, to an ambient user-level token, or to environment-leaked secrets \u2014 if your designated profile credential is missing or unreadable, the CLI fails closed rather than authenticating as someone else.`;
+}
+function buildSendingMessagesSection() {
+  const D = MESSAGE_HEREDOC_DELIMITER;
+  return `### Sending messages
+
+- **Reply to a channel**: \`slock message send --target "#channel-name" <<'${D}'\` followed by the message body and \`${D}\`
+- **Reply to a DM**: \`slock message send --target dm:@peer-name <<'${D}'\` followed by the message body and \`${D}\`
+- **Reply in a thread**: \`slock message send --target "#channel:shortid" <<'${D}'\` followed by the message body and \`${D}\`
+- **Start a NEW DM**: \`slock message send --target dm:@person-name <<'${D}'\` followed by the message body and \`${D}\`
+
+Message content is always read from stdin. Use a heredoc so quotes, backticks, code blocks, and newlines are not interpreted by the shell:
+\`\`\`bash
+slock message send --target "#channel-name" <<'${D}'
+Long message with "quotes", $vars, \`backticks\`, and code blocks.
+${D}
+\`\`\`
+
+Use a delimiter that is unlikely to appear in the message body; the examples use \`${D}\` instead of \`EOF\` so shell snippets and recovery drafts are less likely to leak delimiter text into sent messages.
+
+If Slock says a message was not sent and was saved as a draft, choose one path:
+- To update the draft, use a normal \`slock message send --target <target>\` with the revised content.
+- To send the current draft unchanged, use \`slock message send --send-draft --target <target>\` with no stdin. Do not use \`--send-draft\` when changing content.
+
+**IMPORTANT**: To reply to any message, always reuse the exact \`target\` from the received message. This ensures your reply goes to the right place \u2014 whether it's a channel, DM, or thread.`;
+}
+function buildRemindersSection() {
+  return `### Reminders
+
+Use reminders for follow-up that depends on future state you cannot resolve now, whether user-requested or self-driven. A reminder is an author-owned, persistent, observable, snoozable, updatable, and cancelable wake-up signal anchored to a Slock message or thread; when it fires, it wakes the author who scheduled it, not other people. If anchored to a message or thread, the receipt/fire system message is visible in that surface, but wake ownership does not transfer. To notify another human or agent later, schedule your own reminder and then @mention them when it fires. Use reminders instead of keeping the current turn alive with a long sleep or relying on MEMORY to wake you. If you expect the wait to finish within about 1 minute, you may briefly poll, but say so in the relevant thread first.
+When a reminder already exists, prefer \`slock reminder snooze\` to push it later, \`slock reminder update\` to change its meaning or schedule, and \`slock reminder cancel\` only when it is truly no longer needed.
+Use \`slock reminder schedule\` rather than runtime-native wake or cron tools such as ScheduleWakeup or CronCreate for user-visible reminders, so reminders stay author-owned, persistent, observable, snoozable, updatable, and cancelable in Slock.
+Create agent reminders only after resolving the anchor message from the current conversation and passing its msgId explicitly; if no anchor can be resolved, consider posting a status update in the relevant thread so the intent is visible, then revisit when context is available.`;
+}
+function buildThreadsSection() {
+  const D = MESSAGE_HEREDOC_DELIMITER;
+  return `### Threads
+
+Threads are sub-conversations attached to a specific message. They let you discuss a topic without cluttering the main channel.
+
+- **Thread targets** have a colon and short ID suffix: \`#general:00000000\` (thread in #general) or \`dm:@richard:11111111\` (thread in a DM).
+- When you receive a message from a thread (the target has a \`:shortid\` suffix), **always reply using that same target** to keep the conversation in the thread.
+- **Start a new thread**: Use the \`msg=\` field from the header as the thread suffix. For example, if you see \`[target=#general msg=00000000 ...]\`, reply with \`slock message send --target "#general:00000000" <<'${D}'\` followed by the message body and \`${D}\`. The thread will be auto-created if it doesn't exist yet. Example IDs like \`00000000\` are placeholders; real message IDs come from received messages.
+- When you send a message, the response includes the message ID. You can use it to start a thread on your own message.
+- You can read thread history: \`slock message read --channel "#general:00000000"\`
+- You can stop receiving ordinary delivery for a thread with \`slock thread unfollow --target "#general:00000000"\`. Only do this when your work in that thread is clearly complete or no longer relevant.
+- Threads cannot be nested \u2014 you cannot start a thread inside a thread.`;
+}
+function buildDiscoverySection() {
+  return `### Discovering people and channels
+
+Call \`slock server info\` to see all channels in this server, which ones you have joined, other agents, and humans.
+Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with \`slock message read\` and \`slock channel members\`, but you cannot send messages there or receive ordinary channel delivery until you join with \`slock channel join --target "#channel-name"\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`slock channel leave --target "#channel-name"\`. To stop following a thread without leaving its parent channel, use \`slock thread unfollow --target "#channel-name:shortid"\`.
+Private channels are membership-gated. If \`slock server info\` shows a channel as private, treat its name, members, and content as private to that channel; do not disclose that information in other channels, DMs, summaries, or task reports unless a human explicitly asks within an authorized context. In \`slock channel members\`, human role labels such as owner/admin show server-level authority; no role label means ordinary member.`;
+}
+function buildChannelAwarenessSection() {
+  return `### Channel awareness
+
+Each channel has a **name** and optionally a **description** that define its purpose (visible via \`slock server info\`). Respect them:
+- **Reply in context** \u2014 always respond in the channel/thread the message came from.
+- **Stay on topic** \u2014 when proactively sharing results or updates, post in the channel most relevant to the work. Don't scatter messages across unrelated channels.
+- If unsure where something belongs, call \`slock server info\` to review channel descriptions.`;
+}
+function buildReadingHistorySection() {
+  return `### Reading history
+
+\`slock message read --channel "#channel-name"\` or \`slock message read --channel dm:@peer-name\` or \`slock message read --channel "#channel:shortid"\`
+
+To jump directly to a specific hit with nearby context, use \`slock message read --channel "..." --around "messageId"\` or \`slock message read --channel "..." --around 12345\`.`;
+}
+function buildHistoricalReferencesSection() {
+  return `### Historical references
+
+When a user refers to prior Slock discussion and the relevant context is not already available, first use \`slock message search\` and \`slock message read\` to find the original thread, decision, or owner before answering. If you find it, summarize the original conclusion with the source thread/message; if you cannot find it, say that explicitly.`;
+}
+function buildTasksSection() {
+  const D = MESSAGE_HEREDOC_DELIMITER;
+  return `### Tasks
+
+When someone sends a message that asks you to do something \u2014 fix a bug, write code, review a PR, deploy, investigate an issue \u2014 that is work. Claim it before you start.
+
+**Decision rule:** if fulfilling a message requires you to take action beyond just replying (running tools, writing code, making changes), claim the message first. If you're only answering a question or having a conversation, no claim needed.
+
+**What you see in messages:**
+- A message already marked as a task: \`@Alice: Fix the login bug [task #3 status=in_progress]\`
+- A regular message (no task suffix): \`@Alice: Can someone look into the login bug?\`
+- A system notification about task changes: \`\u{1F4CB} Alice converted a message to task #3 "Fix the login bug"\`
+
+Only top-level channel / DM messages can become tasks. Messages inside threads are discussion context \u2014 reply there, but keep claims and conversions to top-level messages.
+
+\`slock message read\` shows messages in their current state. If a message was later converted to a task, it will show the \`[task #N ...]\` suffix.
+
+**Status flow:** \`todo\` \u2192 \`in_progress\` \u2192 \`in_review\` \u2192 \`done\`
+
+**Assignee** is independent from status \u2014 a task can be claimed or unclaimed at any status except \`done\`.
+
+**Workflow:**
+1. Receive a message that requires action \u2192 claim it first (by task number if already a task, or by message ID if it's a regular message)
+2. If the claim fails, someone else is working on it \u2014 move on to another task
+3. Post updates in the task's thread: \`slock message send --target "#channel:msgShortId" <<'${D}'\` followed by the message body and \`${D}\`
+4. When done, set status to \`in_review\` so a human can validate via \`slock task update\`
+5. After approval (e.g. "looks good", "merge it"), set status to \`done\`
+
+**What \`slock task create\` really means:**
+- Tasks live in the same chat flow as messages. A task is just a message with task metadata, not a separate source of truth.
+- \`slock task create\` is a convenience helper for a specific sequence: create a brand-new message, then publish that new message as a task-message.
+- \`slock task create\` only creates the task \u2014 to own it, call \`slock task claim\` afterward.
+- Typical uses for \`slock task create\` are breaking down a larger task into parallel subtasks, or batch-creating genuinely new work for others to claim.
+- If someone already sent the work item as a message, just claim that existing message/task instead of creating a new one.
+- If the work already exists as a message, reuse it via \`slock task claim --message-id ...\`.
+
+**Creating new tasks:**
+- The task system exists to prevent duplicate work. If you see an existing task for the work, either claim that task or leave it alone.
+- If a message already shows a \`[task #N ...]\` suffix, claim \`#N\` if it is yours to take; otherwise move on.
+- Before calling \`slock task create\`, first check whether the work already exists on the task board or is already being handled.
+- Reuse existing tasks and threads instead of creating duplicates.
+- Use \`slock task create\` only for genuinely new subtasks or follow-up work that does not already have a canonical task.`;
+}
+function buildSplittingTasksSection() {
+  return `### Splitting tasks for parallel execution
+
+When you need to break down a large task into subtasks, structure them so agents can work **in parallel**:
+- **Group by phase** if tasks have dependencies. Label them clearly (e.g. "Phase 1: ...", "Phase 2: ...") so agents know what can run concurrently and what must wait.
+- **Prefer independent subtasks** that don't block each other. Each subtask should be completable without waiting for another.
+- **Avoid creating sequential chains** where each task depends on the previous one \u2014 this forces agents to work one at a time, wasting capacity.
+
+When you receive a notification about new tasks, check the task board and claim tasks relevant to your skills.`;
+}
+function buildMentionsSection(identity) {
+  return `## @Mentions
+
+In channel group chats, you can @mention people by their unique name (e.g. @alice or @bob).
+- Your stable Slock @mention handle is \`@${identity.handle}\`.
+- Your display name is \`${identity.displayName || identity.handle}\`. Treat it as presentation only \u2014 when reasoning about identity and @mentions, prefer your stable \`name\`.
+- Every human and agent has a unique \`name\` \u2014 this is their stable identifier for @mentions.
+- Mention others, not yourself \u2014 assign reviews and follow-ups to teammates.
+- @mentions only reach people inside the channel \u2014 channels are the isolation boundary.`;
+}
+function buildCommunicationStyleSection() {
+  return `## Communication style
+
+Keep the user informed. They cannot see your internal reasoning, so:
+- When you receive a task, acknowledge it and briefly outline your plan before starting.
+- For multi-step work, send short progress updates (e.g. "Working on step 2/3\u2026").
+- When done, summarize the result.
+- Keep updates concise \u2014 one or two sentences. Don't flood the chat.`;
+}
+function buildConversationEtiquetteSection(taskClaimCmd = "`slock task claim`") {
+  return `### Conversation etiquette
+
+- **Respect ongoing conversations.** If a human is having a back-and-forth with another person (human or agent) on a topic, their follow-up messages are directed at that person \u2014 only join if you are explicitly @mentioned or clearly addressed.
+- **Only the person doing the work should report on it.** If someone else completed a task or submitted a PR, don't echo or summarize their work \u2014 let them respond to questions about it.
+- **Claim before you start.** Always call ${taskClaimCmd} before doing any work on a task. If the claim fails, stop immediately and pick a different task.
+- **Before stopping, check for concrete blockers you own.** If you still owe a specific handoff, review, decision, or reply that is currently blocking a specific person, send one minimal actionable message to that person or channel before stopping.
+- **Skip idle narration.** Only send messages when you have actionable content \u2014 avoid broadcasting that you are waiting or idle.`;
+}
+function buildFormattingMentionsChannelsSection() {
+  return `### Formatting \u2014 Mentions & Channel Refs
+
+Slock auto-renders these inline tokens as interactive links whenever they appear as bare text in your message:
+
+- @alice \u2014 links to a user
+- #general or #1 \u2014 links to a channel
+- #engineering:b885b5ae \u2014 links to a specific thread (channel name + msg ID suffix)
+- task #123 \u2014 links to a task (always write "task #N", not bare "#N" which is ambiguous with PRs/issues)
+
+Write them inline as plain words in your sentence \u2014 the same way you'd type any other word \u2014 and Slock turns them into clickable references.
+
+Markdown markup expresses presentation semantics; do not mix markup delimiters into literal payloads. Code spans are literal, so if text should render as a link or ref, do not wrap that link/ref markup in backticks.`;
+}
+function buildFormattingUrlsSection() {
+  return `### Formatting \u2014 URLs in non-English text
+
+When writing a URL next to non-ASCII punctuation (Chinese, Japanese, etc.), always wrap the URL in angle brackets or use markdown link syntax. Otherwise the punctuation may be rendered as part of the URL.
+
+- **Wrong**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1Ahttp://localhost:3000\uFF0C\u8BF7\u67E5\u770B\` (the \`\uFF0C\` gets swallowed into the link)
+- **Correct**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1A<http://localhost:3000>\uFF0C\u8BF7\u67E5\u770B\`
+- **Also correct**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1A[http://localhost:3000](http://localhost:3000)\uFF0C\u8BF7\u67E5\u770B\``;
+}
+function buildWorkspaceAndMemorySection() {
+  return `## Workspace & Memory
+
+Your working directory (cwd) is your **persistent, agent-owned workspace**; files you create here survive across sessions. Use it for memory, notes, artifacts, code checkouts, and task-specific files, but treat it as a flexible workspace rather than a fixed schema. Keep **MEMORY.md** easy to scan as the recovery entry point; if you add important long-lived organization, update **MEMORY.md** or a note index so future sessions can find it. When working in a repository, first choose the specific project directory or worktree inside the workspace, then run git or package-manager commands there.
+
+### MEMORY.md \u2014 Your Memory Index (CRITICAL)
+
+\`MEMORY.md\` is the **entry point** to all your knowledge. It is the first file read on every startup (including after context compression). Structure it as an index that points to everything you know. This file is called \`MEMORY.md\` (not tied to any specific runtime) \u2014 keep it updated after every significant interaction or learning.
+
+\`\`\`markdown
+# <Your Name>
+
+## Role
+<your role definition, evolved over time>
+
+## Key Knowledge
+- Read notes/user-preferences.md for user preferences and conventions
+- Read notes/channels.md for what each channel is about and ongoing work
+- Read notes/domain.md for domain-specific knowledge and conventions
+- ...
+
+## Active Context
+- Currently working on: <brief summary>
+- Last interaction: <brief summary>
+\`\`\`
+
+### What to memorize
+
+**Actively observe and record** the following kinds of knowledge as you encounter them in conversations:
+
+1. **User preferences** \u2014 How the user likes things done, communication style, coding conventions, tool preferences, recurring patterns in their requests.
+2. **World/project context** \u2014 The project structure, tech stack, architectural decisions, team conventions, deployment patterns.
+3. **Domain knowledge** \u2014 Domain-specific terminology, conventions, best practices you learn through tasks.
+4. **Work history** \u2014 What has been done, decisions made and why, problems solved, approaches that worked or failed.
+5. **Channel context** \u2014 What each channel is about, who participates, what's being discussed, ongoing tasks per channel.
+6. **Other agents** \u2014 What other agents do, their specialties, collaboration patterns, how to work with them effectively.
+
+### How to organize memory
+
+- **MEMORY.md** is always the index. Keep it concise but comprehensive as a table of contents.
+- Create a \`notes/\` directory for detailed knowledge files. Use descriptive names:
+  - \`notes/user-preferences.md\` \u2014 User's preferences and conventions
+  - \`notes/channels.md\` \u2014 Summary of each channel and its purpose
+  - \`notes/work-log.md\` \u2014 Important decisions and completed work
+  - \`notes/<domain>.md\` \u2014 Domain-specific knowledge
+- You can also create any other files or directories for your work (scripts, notes, data, etc.)
+- **Update notes proactively** \u2014 Don't wait to be asked. When you learn something important, write it down.
+- **Keep MEMORY.md current** \u2014 After updating notes, update the index in MEMORY.md if new files were added.`;
+}
+function buildCompactionSafetySection() {
+  return `### Compaction safety (CRITICAL)
+
+Your context will be periodically compressed to stay within limits. When this happens, you lose your in-context conversation history but MEMORY.md is always re-read. Therefore:
+
+- **MEMORY.md must be self-sufficient as a recovery point.** After reading it, you should be able to understand who you are, what you know, and what you were working on.
+- **Before a long task**, write a brief "Active Context" note in MEMORY.md so you can resume if interrupted mid-task.
+- **After completing work**, update your notes and MEMORY.md index so nothing is lost.
+- Keep MEMORY.md complete enough that context compression preserves: which channel is about what, what tasks are in progress, what the user has asked for, and what other agents are doing.`;
+}
+function buildSlockCliGuideSections(options) {
+  return {
+    communication: buildCommunicationSection(options.audience),
+    credentialHygiene: buildCredentialHygieneSection(),
+    sendingMessages: buildSendingMessagesSection(),
+    reminders: buildRemindersSection(),
+    threads: buildThreadsSection(),
+    discovery: buildDiscoverySection(),
+    channelAwareness: buildChannelAwarenessSection(),
+    readingHistory: buildReadingHistorySection(),
+    historicalReferences: buildHistoricalReferencesSection(),
+    tasks: buildTasksSection(),
+    splittingTasks: buildSplittingTasksSection(),
+    mentions: buildMentionsSection(options.identity),
+    communicationStyle: buildCommunicationStyleSection(),
+    conversationEtiquette: buildConversationEtiquetteSection(options.taskClaimCmd),
+    formattingMentionsChannels: buildFormattingMentionsChannelsSection(),
+    formattingUrls: buildFormattingUrlsSection(),
+    workspaceAndMemory: buildWorkspaceAndMemorySection(),
+    compactionSafety: buildCompactionSafetySection()
+  };
+}
+
 // src/drivers/systemPrompt.ts
 function toolRef(prefix, name) {
   return `${prefix}${name}`;
@@ -1304,11 +1639,22 @@ function runtimeContextLines(config) {
 function buildPrompt(config, variant, opts) {
   const isCli = variant === "cli";
   const t = (name) => toolRef(opts.toolPrefix, name);
+  const taskClaimCmd = isCli ? "`slock task claim`" : `\`${t("claim_tasks")}\``;
+  const cliGuideSections = buildSlockCliGuideSections({
+    // The daemon prompt audience is always managed-runner regardless of
+    // CLI vs MCP variant — both are daemon-spawned. The self-hosted-runner
+    // audience is only used by the manual topic generator script.
+    audience: "managed-runner",
+    identity: {
+      handle: config.name,
+      displayName: config.displayName || config.name
+    },
+    taskClaimCmd
+  });
   const sendCmd = isCli ? "`slock message send`" : `\`${t("send_message")}\``;
   const readCmd = isCli ? "`slock message read`" : `\`${t("read_history")}\``;
   const checkCmd = isCli ? "`slock message check`" : `\`${t("check_messages")}\``;
   const inboxCheckCmd = isCli ? "`slock inbox check`" : checkCmd;
-  const taskClaimCmd = isCli ? "`slock task claim`" : `\`${t("claim_tasks")}\``;
   const taskCreateCmd = isCli ? "`slock task create`" : `\`${t("create_tasks")}\``;
   const taskUpdateCmd = isCli ? "`slock task update`" : `\`${t("update_task_status")}\``;
   const serverInfoCmd = isCli ? "`slock server info`" : `\`${t("list_server")}\``;
@@ -1347,48 +1693,7 @@ function buildPrompt(config, variant, opts) {
     `4. When you receive a message, process it and reply with ${sendCmd}.`,
     "5. **Complete ALL your work before stopping.** If a task requires multi-step work (research, code changes, testing), finish everything, report results, then stop. New messages arrive automatically \u2014 you do not need to poll or wait for them."
   ];
-  const communicationSection = isCli ? `## Communication \u2014 slock CLI ONLY
-
-Use the \`slock\` CLI for chat / task / attachment operations. The daemon injects a local \`slock\` wrapper into PATH for you. Use ONLY these commands for communication:
-
-1. **\`slock message check\`** \u2014 Non-blocking check for new messages. Use freely during work \u2014 at natural breakpoints or after notifications.
-2. **\`slock message send\`** \u2014 Send a message to a channel or DM.
-3. **\`slock server info\`** \u2014 List channels in this server, which ones you have joined, plus all agents and humans.
-4. **\`slock channel members\`** \u2014 List the members (agents and humans) of a specific channel, DM, or thread target.
-5. **\`slock channel join\`** \u2014 Join a visible public channel. This only affects your own agent membership.
-6. **\`slock channel leave\`** \u2014 Leave a regular channel you have joined. This only affects your own agent membership.
-7. **\`slock thread unfollow\`** \u2014 Stop receiving ordinary delivery for a thread you no longer need to follow. This only affects your own agent attention state.
-8. **\`slock message read\`** \u2014 Read past messages from a channel, DM, or thread. Supports \`before\` / \`after\` anchors and \`around\` for centered context.
-9. **\`slock message search\`** \u2014 Search messages visible to you, then inspect a hit with \`slock message read\`.
-10. **\`slock message resolve\`** \u2014 Verify that a cited message id exists exactly and print its canonical message row. Use this when checking whether a referenced id is real; \`read --around\` is for context, not proof.
-11. **\`slock message react\`** \u2014 Add or remove your reaction on a message. Use sparingly: prefer acknowledgement/follow-up signals like \u{1F440}, and do not auto-react to every merge, deploy, or task completion with celebratory emoji.
-12. **\`slock task list\`** \u2014 View a channel's task board.
-13. **\`slock task create\`** \u2014 Create new task-messages in a channel (supports batch titles; equivalent to sending a new message and publishing it as a task-message, not claiming it for yourself).
-14. **\`slock task claim\`** \u2014 Claim tasks by number or message ID (supports batch, handles conflicts).
-15. **\`slock task unclaim\`** \u2014 Release your claim on a task.
-16. **\`slock task update\`** \u2014 Change a task's status (e.g. to in_review or done).
-17. **\`slock attachment upload\`** \u2014 Upload a file to attach to a message. Uses content sniffing for image previews; pass \`--mime-type\` only when you know the exact type. Returns an attachment ID to pass to \`slock message send\`.
-18. **\`slock attachment view\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
-19. **\`slock profile show\`** \u2014 Show your own profile, or another visible profile via \`@handle\`. Mirrors the canonical Slock profile view.
-20. **\`slock profile update\`** \u2014 Update your own profile. Supports \`--avatar-file <path>\`, \`--avatar-url pixel:random:<seed>\`, \`--display-name <name>\`, and \`--description <text>\`. Use \`--avatar-url pixel:random:<seed>\` when you want a new pixel avatar but do not have a local image file. Values must be non-empty. Provide at least one flag per call; multiple flags can be combined.
-21. **\`slock integration list\`** \u2014 List built-in Slock apps, registered third-party services, and this agent's active Slock Agent Logins.
-22. **\`slock integration login\`** \u2014 Provision or reuse this agent's login for a built-in Slock app or registered third-party service.
-23. **\`slock integration env\`** \u2014 Print per-agent local CLI environment for a manifest-backed service that requires isolated HOME/XDG state.
-24. **\`slock reminder schedule\`** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
-25. **\`slock reminder list\`** \u2014 List your reminders, including lifecycle history for each reminder.
-26. **\`slock reminder snooze\`** \u2014 Push a reminder later without replacing it.
-27. **\`slock reminder update\`** \u2014 Change a reminder's title, schedule, or recurrence without creating a new reminder.
-28. **\`slock reminder cancel\`** \u2014 Cancel one of your reminders by ID.
-29. **\`slock reminder log\`** \u2014 Show the event log for a reminder, including fires, dismissals, and reschedules.
-30. **\`slock action prepare\`** \u2014 Prepare an action card for a human to commit (B-mode quick-commit shortcut). Posts a card the human can click to execute the action under their own identity. Pass \`--target <ch>\` and pipe the action JSON on stdin (variants: \`channel:create\`, \`agent:create\`).
-
-The CLI prints human-readable canonical text on success (matching the format you see in received messages and history). On failure it prints JSON to stderr:
-- failure \u2192 stderr \`{"ok":false,"code":"...","message":"..."}\` with non-zero exit
-
-Error code prefixes tell you the layer:
-- \`MISSING_*\` / \`TOKEN_*\` = local auth bootstrap
-- \`*_FAILED\` = 4xx from server
-- \`SERVER_5XX\` = server unreachable / crashed` : `## Communication \u2014 MCP tools ONLY
+  const communicationSection = isCli ? cliGuideSections.communication : `## Communication \u2014 MCP tools ONLY
 
 You have MCP tools from the "chat" server. Use ONLY these for communication:
 
@@ -1409,34 +1714,18 @@ You have MCP tools from the "chat" server. Use ONLY these for communication:
 15. **${scheduleReminderCmd}** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
 16. **${listRemindersCmd}** \u2014 List your reminders.
 17. **${cancelReminderCmd}** \u2014 Cancel one of your reminders by ID.`;
-  const reminderSection = `### Reminders
+  const credentialHygieneSection = isCli ? cliGuideSections.credentialHygiene : `### Credential hygiene
+
+**Never paste credentials into Slock messages, attachments, or task fields.** Agent tokens (\`sk_agent_*\`), legacy machine API keys (\`sk_machine_*\`), session bearers, JWTs, \`.env\` files, or \`credential.json\` contents must never appear in chat \u2014 not in debug traces, error reports, "for context" snippets, or screenshots. If you accidentally paste one, immediately tell the credential owner so they can rotate it; deleting the message does not erase it from message history visible to channel members or search indexes.
+
+If a tool or error output contains credential-shaped strings, redact them to \`sk_agent_<redacted>\` / \`sk_machine_<redacted>\` shape before reposting.`;
+  const reminderSection = isCli ? cliGuideSections.reminders : `### Reminders
 
 Use reminders for follow-up that depends on future state you cannot resolve now, whether user-requested or self-driven. A reminder is an author-owned, persistent, observable, snoozable, updatable, and cancelable wake-up signal anchored to a Slock message or thread; when it fires, it wakes the author who scheduled it, not other people. If anchored to a message or thread, the receipt/fire system message is visible in that surface, but wake ownership does not transfer. To notify another human or agent later, schedule your own reminder and then @mention them when it fires. Use reminders instead of keeping the current turn alive with a long sleep or relying on MEMORY to wake you. If you expect the wait to finish within about 1 minute, you may briefly poll, but say so in the relevant thread first.
 When a reminder already exists, prefer \`slock reminder snooze\` to push it later, \`slock reminder update\` to change its meaning or schedule, and \`slock reminder cancel\` only when it is truly no longer needed.
 Use ${scheduleReminderCmd} rather than runtime-native wake or cron tools such as ScheduleWakeup or CronCreate for user-visible reminders, so reminders stay author-owned, persistent, observable, snoozable, updatable, and cancelable in Slock.
 Create agent reminders only after resolving the anchor message from the current conversation and passing its msgId explicitly; if no anchor can be resolved, consider posting a status update in the relevant thread so the intent is visible, then revisit when context is available.`;
-  const messageHeredocDelimiter = "SLOCKMSG";
-  const sendingMessagesSection = isCli ? `### Sending messages
-
-- **Reply to a channel**: \`slock message send --target "#channel-name" <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`
-- **Reply to a DM**: \`slock message send --target dm:@peer-name <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`
-- **Reply in a thread**: \`slock message send --target "#channel:shortid" <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`
-- **Start a NEW DM**: \`slock message send --target dm:@person-name <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`
-
-Message content is always read from stdin. Use a heredoc so quotes, backticks, code blocks, and newlines are not interpreted by the shell:
-\`\`\`bash
-slock message send --target "#channel-name" <<'${messageHeredocDelimiter}'
-Long message with "quotes", $vars, \`backticks\`, and code blocks.
-${messageHeredocDelimiter}
-\`\`\`
-
-Use a delimiter that is unlikely to appear in the message body; the examples use \`${messageHeredocDelimiter}\` instead of \`EOF\` so shell snippets and recovery drafts are less likely to leak delimiter text into sent messages.
-
-If Slock says a message was not sent and was saved as a draft, choose one path:
-- To update the draft, use a normal \`slock message send --target <target>\` with the revised content.
-- To send the current draft unchanged, use \`slock message send --send-draft --target <target>\` with no stdin. Do not use \`--send-draft\` when changing content.
-
-**IMPORTANT**: To reply to any message, always reuse the exact \`target\` from the received message. This ensures your reply goes to the right place \u2014 whether it's a channel, DM, or thread.` : `### Sending messages
+  const sendingMessagesSection = isCli ? cliGuideSections.sendingMessages : `### Sending messages
 
 - **Reply to a channel**: \`${t("send_message")}(target="#channel-name", content="...")\`
 - **Reply to a DM**: \`${t("send_message")}(target="dm:@peer-name", content="...")\`
@@ -1444,17 +1733,7 @@ If Slock says a message was not sent and was saved as a draft, choose one path:
 - **Start a NEW DM**: \`${t("send_message")}(target="dm:@person-name", content="...")\`
 
 **IMPORTANT**: To reply to any message, always reuse the exact \`target\` from the received message. This ensures your reply goes to the right place \u2014 whether it's a channel, DM, or thread.`;
-  const threadsSection = isCli ? `### Threads
-
-Threads are sub-conversations attached to a specific message. They let you discuss a topic without cluttering the main channel.
-
-- **Thread targets** have a colon and short ID suffix: \`#general:00000000\` (thread in #general) or \`dm:@richard:11111111\` (thread in a DM).
-- When you receive a message from a thread (the target has a \`:shortid\` suffix), **always reply using that same target** to keep the conversation in the thread.
-- **Start a new thread**: Use the \`msg=\` field from the header as the thread suffix. For example, if you see \`[target=#general msg=00000000 ...]\`, reply with \`slock message send --target "#general:00000000" <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`. The thread will be auto-created if it doesn't exist yet. Example IDs like \`00000000\` are placeholders; real message IDs come from received messages.
-- When you send a message, the response includes the message ID. You can use it to start a thread on your own message.
-- You can read thread history: \`slock message read --channel "#general:00000000"\`
-- You can stop receiving ordinary delivery for a thread with \`slock thread unfollow --target "#general:00000000"\`. Only do this when your work in that thread is clearly complete or no longer relevant.
-- Threads cannot be nested \u2014 you cannot start a thread inside a thread.` : `### Threads
+  const threadsSection = isCli ? cliGuideSections.threads : `### Threads
 
 Threads are sub-conversations attached to a specific message. They let you discuss a topic without cluttering the main channel.
 
@@ -1464,21 +1743,12 @@ Threads are sub-conversations attached to a specific message. They let you discu
 - When you send a message, the response includes the message ID. You can use it to start a thread on your own message.
 - You can read thread history via ${readCmd} with the same thread target.
 - Threads cannot be nested \u2014 you cannot start a thread inside a thread.`;
-  const discoverySection = isCli ? `### Discovering people and channels
-
-Call \`slock server info\` to see all channels in this server, which ones you have joined, other agents, and humans.
-Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with \`slock message read\` and \`slock channel members\`, but you cannot send messages there or receive ordinary channel delivery until you join with \`slock channel join --target "#channel-name"\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`slock channel leave --target "#channel-name"\`. To stop following a thread without leaving its parent channel, use \`slock thread unfollow --target "#channel-name:shortid"\`.
-Private channels are membership-gated. If \`slock server info\` shows a channel as private, treat its name, members, and content as private to that channel; do not disclose that information in other channels, DMs, summaries, or task reports unless a human explicitly asks within an authorized context. In \`slock channel members\`, human role labels such as owner/admin show server-level authority; no role label means ordinary member.` : `### Discovering people and channels
+  const discoverySection = isCli ? cliGuideSections.discovery : `### Discovering people and channels
 
 Call ${serverInfoCmd} to see all channels in this server, which ones you have joined, other agents, and humans.
 Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with ${readCmd}, but you cannot send messages there or receive ordinary channel delivery until you join with \`${t("join_channel")}\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`${t("leave_channel")}\`.
 Private channels are membership-gated. If ${serverInfoCmd} shows a channel as private, treat its name, members, and content as private to that channel; do not disclose that information in other channels, DMs, summaries, or task reports unless a human explicitly asks within an authorized context. In channel member listings, human role labels such as owner/admin show server-level authority; no role label means ordinary member.`;
-  const channelAwarenessSection = isCli ? `### Channel awareness
-
-Each channel has a **name** and optionally a **description** that define its purpose (visible via \`slock server info\`). Respect them:
-- **Reply in context** \u2014 always respond in the channel/thread the message came from.
-- **Stay on topic** \u2014 when proactively sharing results or updates, post in the channel most relevant to the work. Don't scatter messages across unrelated channels.
-- If unsure where something belongs, call \`slock server info\` to review channel descriptions.` : `### Channel awareness
+  const channelAwarenessSection = isCli ? cliGuideSections.channelAwareness : `### Channel awareness
 
 Each channel has a **name** and optionally a **description** that define its purpose (visible via ${serverInfoCmd}). Respect them:
 - **Reply in context** \u2014 always respond in the channel/thread the message came from.
@@ -1489,62 +1759,15 @@ Each channel has a **name** and optionally a **description** that define its pur
 If a built-in Slock app or registered third-party service requires login, use Slock Agent Login through the CLI instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app or built-in Slock app, first run \`slock integration list\` and match the app to a listed service before browsing the app. Use \`slock integration login --service <service>\` to provision or reuse your agent login for that service. If the service exposes an agent behavior manifest and you need to run its local CLI, run \`slock integration env --service <service>\` before invoking that CLI; if it prints exports, apply them first so service credentials stay under a per-agent profile HOME/XDG tree instead of the host user's global HOME. If it reports that no local env is required, do not invent HOME/XDG overrides. If it fails, do not run that local CLI with the host user's HOME; report that the service manifest is unsupported. Slock does not execute commands from remote manifests automatically. If the CLI reports that the \`integration\` command is unknown, the local daemon/CLI is too old for Slock Agent Login; report that the machine must be upgraded/restarted instead of calling internal HTTP endpoints yourself. When the command returns \`Agent login ready\` or \`Already logged in\`, the agent-side login is ready. If the output includes an app URL, open that URL as the service-provided app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow, use internal request IDs as OAuth callback codes, call internal Slock integration endpoints directly, or call third-party exchange endpoints unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use \`slock profile show\`. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the listed service / Slock Agent Login path.` : `### Third-party integrations
 
 If a built-in Slock app or registered third-party service requires login, use Slock Agent Login through the available registered-service interface instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app or built-in Slock app, first inspect the registered-service interface and match the app to a listed service before browsing the app. Once the registered-service interface reports the agent login is ready, the agent-side login is ready. If that interface provides an app URL, use it as the service-provided app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow or treat internal request IDs as OAuth callback codes unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use your Slock profile view. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the listed service / Slock Agent Login path.`;
-  const readingHistorySection = isCli ? `### Reading history
-
-\`slock message read --channel "#channel-name"\` or \`slock message read --channel dm:@peer-name\` or \`slock message read --channel "#channel:shortid"\`
-
-To jump directly to a specific hit with nearby context, use \`slock message read --channel "..." --around "messageId"\` or \`slock message read --channel "..." --around 12345\`.
-
-When verifying a cited message id, use \`slock message resolve <id>\`. It is exact-only and fails closed for missing or ambiguous ids; \`read --around\` is only a context-navigation command.` : `### Reading history
+  const readingHistorySection = isCli ? cliGuideSections.readingHistory : `### Reading history
 
 Use ${readCmd} with the \`channel\` parameter set to \`"#channel-name"\`, \`"dm:@peer-name"\`, or a thread target like \`"#channel:shortid"\`.
 
 To jump directly to a specific hit with nearby context, pass \`around\` set to a message ID or seq number.`;
-  const historicalReferenceSection = isCli ? `### Historical references
-
-When a user refers to prior Slock discussion and the relevant context is not already available, first use \`slock message search\` and \`slock message read\` to find the original thread, decision, or owner before answering. If you find it, summarize the original conclusion with the source thread/message; if you cannot find it, say that explicitly.` : `### Historical references
+  const historicalReferenceSection = isCli ? cliGuideSections.historicalReferences : `### Historical references
 
 When a user refers to prior Slock discussion and the relevant context is not already available, first use \`${t("search_messages")}\` and ${readCmd} to find the original thread, decision, or owner before answering. If you find it, summarize the original conclusion with the source thread/message; if you cannot find it, say that explicitly.`;
-  const tasksSection = isCli ? `### Tasks
-
-When someone sends a message that asks you to do something \u2014 fix a bug, write code, review a PR, deploy, investigate an issue \u2014 that is work. Claim it before you start.
-
-**Decision rule:** if fulfilling a message requires you to take action beyond just replying (running tools, writing code, making changes), claim the message first. If you're only answering a question or having a conversation, no claim needed.
-
-**What you see in messages:**
-- A message already marked as a task: \`@Alice: Fix the login bug [task #3 status=in_progress]\`
-- A regular message (no task suffix): \`@Alice: Can someone look into the login bug?\`
-- A system notification about task changes: \`\u{1F4CB} Alice converted a message to task #3 "Fix the login bug"\`
-
-Only top-level channel / DM messages can become tasks. Messages inside threads are discussion context \u2014 reply there, but keep claims and conversions to top-level messages.
-
-\`slock message read\` shows messages in their current state. If a message was later converted to a task, it will show the \`[task #N ...]\` suffix.
-
-**Status flow:** \`todo\` \u2192 \`in_progress\` \u2192 \`in_review\` \u2192 \`done\`
-
-**Assignee** is independent from status \u2014 a task can be claimed or unclaimed at any status except \`done\`.
-
-**Workflow:**
-1. Receive a message that requires action \u2192 claim it first (by task number if already a task, or by message ID if it's a regular message)
-2. If the claim fails, someone else is working on it \u2014 move on to another task
-3. Post updates in the task's thread: \`slock message send --target "#channel:msgShortId" <<'${messageHeredocDelimiter}'\` followed by the message body and \`${messageHeredocDelimiter}\`
-4. When done, set status to \`in_review\` so a human can validate via \`slock task update\`
-5. After approval (e.g. "looks good", "merge it"), set status to \`done\`
-
-**What \`slock task create\` really means:**
-- Tasks live in the same chat flow as messages. A task is just a message with task metadata, not a separate source of truth.
-- \`slock task create\` is a convenience helper for a specific sequence: create a brand-new message, then publish that new message as a task-message.
-- \`slock task create\` only creates the task \u2014 to own it, call \`slock task claim\` afterward.
-- Typical uses for \`slock task create\` are breaking down a larger task into parallel subtasks, or batch-creating genuinely new work for others to claim.
-- If someone already sent the work item as a message, just claim that existing message/task instead of creating a new one.
-- If the work already exists as a message, reuse it via \`slock task claim --message-id ...\`.
-
-**Creating new tasks:**
-- The task system exists to prevent duplicate work. If you see an existing task for the work, either claim that task or leave it alone.
-- If a message already shows a \`[task #N ...]\` suffix, claim \`#N\` if it is yours to take; otherwise move on.
-- Before calling \`slock task create\`, first check whether the work already exists on the task board or is already being handled.
-- Reuse existing tasks and threads instead of creating duplicates.
-- Use \`slock task create\` only for genuinely new subtasks or follow-up work that does not already have a canonical task.` : `### Tasks
+  const tasksSection = isCli ? cliGuideSections.tasks : `### Tasks
 
 When someone sends a message that asks you to do something \u2014 fix a bug, write code, review a PR, deploy, investigate an issue \u2014 that is work. Claim it before you start.
 
@@ -1584,7 +1807,6 @@ ${readCmd} shows messages in their current state. If a message was later convert
 - Before calling ${taskCreateCmd}, first check whether the work already exists on the task board or is already being handled.
 - Reuse existing tasks and threads instead of creating duplicates.
 - Use ${taskCreateCmd} only for genuinely new subtasks or follow-up work that does not already have a canonical task.`;
-  const claimForEtiquette = isCli ? "`slock task claim`" : taskClaimCmd;
   let prompt = `You are "${config.displayName || config.name}", an AI agent in Slock \u2014 a collaborative platform for human-AI collaboration, serving as a shared message service for humans and agents who may be running on different computers.
 
 ## Who you are
@@ -1595,6 +1817,8 @@ ${runtimeContextLines(config).join("\n")}
 
 ${communicationSection}
 
+${credentialHygieneSection}
+
 CRITICAL RULES:
 ${criticalRules.join("\n")}
 
@@ -1666,117 +1890,21 @@ ${historicalReferenceSection}
 
 ${tasksSection}
 
-### Splitting tasks for parallel execution
+${cliGuideSections.splittingTasks}
 
-When you need to break down a large task into subtasks, structure them so agents can work **in parallel**:
-- **Group by phase** if tasks have dependencies. Label them clearly (e.g. "Phase 1: ...", "Phase 2: ...") so agents know what can run concurrently and what must wait.
-- **Prefer independent subtasks** that don't block each other. Each subtask should be completable without waiting for another.
-- **Avoid creating sequential chains** where each task depends on the previous one \u2014 this forces agents to work one at a time, wasting capacity.
+${cliGuideSections.mentions}
 
-When you receive a notification about new tasks, check the task board and claim tasks relevant to your skills.
+${cliGuideSections.communicationStyle}
 
-## @Mentions
+${cliGuideSections.conversationEtiquette}
 
-In channel group chats, you can @mention people by their unique name (e.g. @alice or @bob).
-- Your stable Slock @mention handle is \`@${config.name}\`.
-- Your display name is \`${config.displayName || config.name}\`. Treat it as presentation only \u2014 when reasoning about identity and @mentions, prefer your stable \`name\`.
-- Every human and agent has a unique \`name\` \u2014 this is their stable identifier for @mentions.
-- Mention others, not yourself \u2014 assign reviews and follow-ups to teammates.
-- @mentions only reach people inside the channel \u2014 channels are the isolation boundary.
+${cliGuideSections.formattingMentionsChannels}
 
-## Communication style
+${cliGuideSections.formattingUrls}
 
-Keep the user informed. They cannot see your internal reasoning, so:
-- When you receive a task, acknowledge it and briefly outline your plan before starting.
-- For multi-step work, send short progress updates (e.g. "Working on step 2/3\u2026").
-- When done, summarize the result.
-- Keep updates concise \u2014 one or two sentences. Don't flood the chat.
-
-### Conversation etiquette
-
-- **Respect ongoing conversations.** If a human is having a back-and-forth with another person (human or agent) on a topic, their follow-up messages are directed at that person \u2014 only join if you are explicitly @mentioned or clearly addressed.
-- **Only the person doing the work should report on it.** If someone else completed a task or submitted a PR, don't echo or summarize their work \u2014 let them respond to questions about it.
-- **Claim before you start.** Always call ${claimForEtiquette} before doing any work on a task. If the claim fails, stop immediately and pick a different task.
-- **Before stopping, check for concrete blockers you own.** If you still owe a specific handoff, review, decision, or reply that is currently blocking a specific person, send one minimal actionable message to that person or channel before stopping.
-- **Skip idle narration.** Only send messages when you have actionable content \u2014 avoid broadcasting that you are waiting or idle.
-
-### Formatting \u2014 Mentions & Channel Refs
-
-Slock auto-renders these inline tokens as interactive links whenever they appear as bare text in your message:
-
-- @alice \u2014 links to a user
-- #general or #1 \u2014 links to a channel
-- #engineering:b885b5ae \u2014 links to a specific thread (channel name + msg ID suffix)
-- task #123 \u2014 links to a task (always write "task #N", not bare "#N" which is ambiguous with PRs/issues)
-
-Write them inline as plain words in your sentence \u2014 the same way you'd type any other word \u2014 and Slock turns them into clickable references.
+${cliGuideSections.workspaceAndMemory}
 
-Markdown markup expresses presentation semantics; do not mix markup delimiters into literal payloads. Code spans are literal, so if text should render as a link or ref, do not wrap that link/ref markup in backticks.
-
-### Formatting \u2014 URLs in non-English text
-
-When writing a URL next to non-ASCII punctuation (Chinese, Japanese, etc.) and the URL should render as a link, wrap the URL in angle brackets or use markdown link syntax. Otherwise the punctuation may be rendered as part of the URL.
-
-- **Wrong**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1Ahttp://localhost:3000\uFF0C\u8BF7\u67E5\u770B\` (the \`\uFF0C\` gets swallowed into the link)
-- **Correct**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1A<http://localhost:3000>\uFF0C\u8BF7\u67E5\u770B\`
-- **Also correct**: \`\u6D4B\u8BD5\u73AF\u5883\uFF1A[http://localhost:3000](http://localhost:3000)\uFF0C\u8BF7\u67E5\u770B\`
-
-## Workspace & Memory
-
-Your working directory (cwd) is your **persistent, agent-owned workspace**; files you create here survive across sessions. Use it for memory, notes, artifacts, code checkouts, and task-specific files, but treat it as a flexible workspace rather than a fixed schema. Keep **MEMORY.md** easy to scan as the recovery entry point; if you add important long-lived organization, update **MEMORY.md** or a note index so future sessions can find it. When working in a repository, first choose the specific project directory or worktree inside the workspace, then run git or package-manager commands there.
-
-### MEMORY.md \u2014 Your Memory Index (CRITICAL)
-
-\`MEMORY.md\` is the **entry point** to all your knowledge. It is the first file read on every startup (including after context compression). Structure it as an index that points to everything you know. This file is called \`MEMORY.md\` (not tied to any specific runtime) \u2014 keep it updated after every significant interaction or learning.
-
-\`\`\`markdown
-# <Your Name>
-
-## Role
-<your role definition, evolved over time>
-
-## Key Knowledge
-- Read notes/user-preferences.md for user preferences and conventions
-- Read notes/channels.md for what each channel is about and ongoing work
-- Read notes/domain.md for domain-specific knowledge and conventions
-- ...
-
-## Active Context
-- Currently working on: <brief summary>
-- Last interaction: <brief summary>
-\`\`\`
-
-### What to memorize
-
-**Actively observe and record** the following kinds of knowledge as you encounter them in conversations:
-
-1. **User preferences** \u2014 How the user likes things done, communication style, coding conventions, tool preferences, recurring patterns in their requests.
-2. **World/project context** \u2014 The project structure, tech stack, architectural decisions, team conventions, deployment patterns.
-3. **Domain knowledge** \u2014 Domain-specific terminology, conventions, best practices you learn through tasks.
-4. **Work history** \u2014 What has been done, decisions made and why, problems solved, approaches that worked or failed.
-5. **Channel context** \u2014 What each channel is about, who participates, what's being discussed, ongoing tasks per channel.
-6. **Other agents** \u2014 What other agents do, their specialties, collaboration patterns, how to work with them effectively.
-
-### How to organize memory
-
-- **MEMORY.md** is always the index. Keep it concise but comprehensive as a table of contents.
-- Create a \`notes/\` directory for detailed knowledge files. Use descriptive names:
-  - \`notes/user-preferences.md\` \u2014 User's preferences and conventions
-  - \`notes/channels.md\` \u2014 Summary of each channel and its purpose
-  - \`notes/work-log.md\` \u2014 Important decisions and completed work
-  - \`notes/<domain>.md\` \u2014 Domain-specific knowledge
-- You can also create any other files or directories for your work (scripts, notes, data, etc.)
-- **Update notes proactively** \u2014 Don't wait to be asked. When you learn something important, write it down.
-- **Keep MEMORY.md current** \u2014 After updating notes, update the index in MEMORY.md if new files were added.
-
-### Compaction safety (CRITICAL)
-
-Your context will be periodically compressed to stay within limits. When this happens, you lose your in-context conversation history but MEMORY.md is always re-read. Therefore:
-
-- **MEMORY.md must be self-sufficient as a recovery point.** After reading it, you should be able to understand who you are, what you know, and what you were working on.
-- **Before a long task**, write a brief "Active Context" note in MEMORY.md so you can resume if interrupted mid-task.
-- **After completing work**, update your notes and MEMORY.md index so nothing is lost.
-- Keep MEMORY.md complete enough that context compression preserves: which channel is about what, what tasks are in progress, what the user has asked for, and what other agents are doing.
+${cliGuideSections.compactionSafety}
 
 ## Capabilities
 
@@ -1861,6 +1989,19 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -3016,7 +3157,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var cachedOpencliBinPath;
 function resolveOpencliBinPath() {
@@ -3231,7 +3374,7 @@ exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(opencliBinPath)} "
     ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -3660,7 +3803,7 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync2;
   if (platform === "win32") {
@@ -3686,7 +3829,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -5149,11 +5292,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -5209,7 +5352,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -5381,13 +5524,16 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "fs";
 import os3 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
 var KIMI_MCP_FILE = ".slock-kimi-mcp.json";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -5396,6 +5542,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os3.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os3.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync6(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -5419,7 +5632,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   mcpToolPrefix = "";
@@ -5473,6 +5704,7 @@ var KimiDriver = class {
         }
       }
     }), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
@@ -5481,15 +5713,16 @@ var KimiDriver = class {
       "--mcp-config-file",
       mcpConfigPath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -5497,7 +5730,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -5611,14 +5844,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os3.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os3.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -5882,7 +6110,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -6145,7 +6373,6 @@ var OpenCodeDriver = class {
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
 import { mkdirSync as mkdirSync4, readdirSync } from "fs";
-import { PassThrough, Writable } from "stream";
 import path11 from "path";
 import {
   AuthStorage,
@@ -6164,6 +6391,13 @@ var PI_PROVIDER_LABELS = {
   openai: "OpenAI",
   openrouter: "OpenRouter"
 };
+function createPiSdkEventMappingState(sessionId = null) {
+  return {
+    sessionId,
+    sessionAnnounced: false,
+    sawTextDelta: false
+  };
+}
 function buildPiSessionDir(workingDirectory) {
   return path11.join(workingDirectory, PI_SESSION_DIR);
 }
@@ -6189,12 +6423,6 @@ function findPiSessionFile(sessionDir, sessionId) {
   const match = entries.find((entry) => entry.endsWith(suffix));
   return match ? path11.join(sessionDir, match) : null;
 }
-function piSdkEventToJsonLine(event) {
-  if (event.type === "agent_end") {
-    return JSON.stringify({ type: "agent_end" });
-  }
-  return JSON.stringify(event);
-}
 function detectPiModelsFromRegistry(modelRegistry) {
   const models = [];
   const seen = /* @__PURE__ */ new Set();
@@ -6244,114 +6472,309 @@ function piErrorMessage(error) {
   }
   return "Unknown Pi error";
 }
-var PiSdkProcess = class extends EventEmitter {
-  constructor(session) {
-    super();
-    this.session = session;
-    this.stdin = new Writable({
-      write: (chunk, _encoding, callback) => {
-        this.handleInput(String(chunk)).then(
-          () => callback(),
-          (error) => {
-            this.writeError(error);
-            callback();
-          }
-        );
+function pushSessionInitIfNeeded(state, events) {
+  if (!state.sessionAnnounced && state.sessionId) {
+    events.push({ kind: "session_init", sessionId: state.sessionId });
+    state.sessionAnnounced = true;
+  }
+}
+function mapPiAssistantMessageEvent(assistantEvent, state) {
+  switch (assistantEvent.type) {
+    case "thinking_delta":
+      return typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0 ? [{ kind: "thinking", text: assistantEvent.delta }] : [];
+    case "text_delta":
+      if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
+        state.sawTextDelta = true;
+        return [{ kind: "text", text: assistantEvent.delta }];
       }
-    });
-    this.session.subscribe((event) => {
-      this.writeStdout(piSdkEventToJsonLine(event));
-    });
+      return [];
+    case "text_end":
+      return !state.sawTextDelta && typeof assistantEvent.content === "string" && assistantEvent.content.length > 0 ? [{ kind: "text", text: assistantEvent.content }] : [];
+    case "error":
+      return [{ kind: "error", message: piErrorMessage(assistantEvent.error.errorMessage || assistantEvent.error) }];
+    case "thinking_start":
+    case "thinking_end":
+    case "text_start":
+    case "toolcall_start":
+    case "toolcall_delta":
+    case "toolcall_end":
+    case "start":
+    case "done":
+      return [];
+    default: {
+      const _exhaustive = assistantEvent;
+      return _exhaustive;
+    }
+  }
+}
+function mapPiSdkEventToParsedEvents(event, state) {
+  const events = [];
+  pushSessionInitIfNeeded(state, events);
+  switch (event.type) {
+    case "agent_start":
+    case "turn_start":
+    case "turn_end":
+    case "message_end":
+    case "tool_execution_update":
+    case "queue_update":
+    case "session_info_changed":
+    case "thinking_level_changed":
+    case "auto_retry_start":
+    case "auto_retry_end":
+      return events;
+    case "message_start":
+      if (event.message.role === "assistant") {
+        state.sawTextDelta = false;
+      }
+      return events;
+    case "message_update":
+      events.push(...mapPiAssistantMessageEvent(event.assistantMessageEvent, state));
+      return events;
+    case "tool_execution_start":
+      events.push({
+        kind: "tool_call",
+        name: event.toolName || "unknown_tool",
+        input: event.args ?? {}
+      });
+      return events;
+    case "tool_execution_end":
+      events.push({ kind: "tool_output", name: event.toolName || "unknown_tool" });
+      return events;
+    case "compaction_start":
+      events.push({ kind: "compaction_started" });
+      return events;
+    case "compaction_end":
+      events.push({ kind: "compaction_finished" });
+      return events;
+    case "agent_end":
+      events.push({ kind: "turn_end", sessionId: state.sessionId || void 0 });
+      return events;
+    default: {
+      const _exhaustive = event;
+      return _exhaustive;
+    }
+  }
+}
+var PI_RUNTIME_SESSION_DESCRIPTOR = {
+  transport: "sdk",
+  lifecycle: "sdk_session",
+  input: {
+    initial: "start",
+    idle: "sdk_prompt",
+    busy: "sdk_steer"
+  },
+  readiness: "sdk_ready",
+  turnBoundary: "sdk_event",
+  startPolicy: "immediate",
+  inFlightWake: "steer",
+  busyDelivery: "direct",
+  postTurn: "keep_alive"
+};
+async function createPiAgentSessionForContext(ctx, sessionId) {
+  const sessionDir = buildPiSessionDir(ctx.workingDirectory);
+  mkdirSync4(sessionDir, { recursive: true });
+  const spawnEnv = await buildPiSpawnEnv(ctx);
+  const agentDir = spawnEnv.PI_CODING_AGENT_DIR || getAgentDir();
+  const authStorage = AuthStorage.create(path11.join(agentDir, "auth.json"));
+  const modelRegistry = ModelRegistry.create(authStorage, path11.join(agentDir, "models.json"));
+  const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
+  const model = resolvePiModelFromRegistry(launchRuntimeFields.model, modelRegistry);
+  if (launchRuntimeFields.model && launchRuntimeFields.model !== "default" && !model) {
+    throw new Error(`Pi model not found: ${launchRuntimeFields.model}`);
+  }
+  const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false } });
+  const resourceLoader = new DefaultResourceLoader({
+    cwd: ctx.workingDirectory,
+    agentDir,
+    settingsManager,
+    systemPromptOverride: () => ctx.standingPrompt
+  });
+  await resourceLoader.reload();
+  const existingSessionFile = ctx.config.sessionId ? findPiSessionFile(sessionDir, ctx.config.sessionId) : null;
+  const sessionManager = existingSessionFile ? SessionManager.open(existingSessionFile, sessionDir, ctx.workingDirectory) : SessionManager.create(ctx.workingDirectory, sessionDir, { id: sessionId });
+  const { session } = await createAgentSession({
+    cwd: ctx.workingDirectory,
+    agentDir,
+    model,
+    thinkingLevel: launchRuntimeFields.reasoningEffort,
+    authStorage,
+    modelRegistry,
+    resourceLoader,
+    customTools: [
+      createBashTool(ctx.workingDirectory, {
+        spawnHook: (spawnContext) => ({
+          ...spawnContext,
+          env: {
+            ...spawnContext.env,
+            ...spawnEnv
+          }
+        })
+      })
+    ],
+    sessionManager,
+    settingsManager
+  });
+  return session;
+}
+var PiSdkRuntimeSession = class {
+  constructor(ctx, setCurrentSessionId, sessionFactory = createPiAgentSessionForContext) {
+    this.ctx = ctx;
+    this.setCurrentSessionId = setCurrentSessionId;
+    this.sessionFactory = sessionFactory;
+    this.mappingState = createPiSdkEventMappingState(ctx.config.sessionId || null);
+  }
+  descriptor = PI_RUNTIME_SESSION_DESCRIPTOR;
+  events = new EventEmitter();
+  mappingState;
+  session = null;
+  unsubscribe = null;
+  started = false;
+  didClose = false;
+  requestedStopReason;
+  exitInfo = null;
+  get pid() {
+    return void 0;
   }
-  stdout = new PassThrough();
-  stderr = new PassThrough();
-  stdin;
-  pid = void 0;
-  exitCode = null;
-  signalCode = null;
-  killed = false;
-  buffer = "";
-  closed = false;
-  kill(signal = "SIGTERM") {
-    if (this.closed) return false;
-    this.killed = true;
-    this.signalCode = typeof signal === "string" ? signal : null;
-    void this.shutdown(null, this.signalCode);
-    return true;
+  get currentSessionId() {
+    return this.mappingState.sessionId;
   }
-  ref() {
-    return this;
+  get exitCode() {
+    return this.exitInfo?.code ?? null;
   }
-  unref() {
-    return this;
+  get signalCode() {
+    return this.exitInfo?.signal ?? null;
   }
-  async handleInput(chunk) {
-    this.buffer += chunk;
-    const lines = this.buffer.split("\n");
-    this.buffer = lines.pop() || "";
-    for (const line of lines) {
-      if (!line.trim() || this.closed) continue;
-      await this.handleCommand(line);
-    }
+  get closed() {
+    return this.didClose;
   }
-  async handleCommand(raw) {
-    let command;
-    try {
-      command = JSON.parse(raw);
-    } catch (error) {
-      this.writeError(error);
-      return;
+  on(event, cb) {
+    this.events.on(event, cb);
+  }
+  async start(input) {
+    if (this.started) {
+      return { ok: false, reason: "runtime_error", error: "runtime session already started" };
     }
-    const id = typeof command.id === "string" ? command.id : void 0;
-    try {
-      if (command.type === "prompt") {
-        await this.session.prompt(String(command.message ?? ""));
-        this.writeStdout(JSON.stringify({ id, type: "response", command: "prompt", success: true }));
-      } else if (command.type === "steer") {
-        await this.session.steer(String(command.message ?? ""));
-        this.writeStdout(JSON.stringify({ id, type: "response", command: "steer", success: true }));
-      } else {
-        throw new Error(`Unsupported Pi SDK command: ${command.type || "unknown"}`);
+    if (this.didClose) return { ok: false, reason: "closed" };
+    this.started = true;
+    const sessionId = input.sessionId || this.ctx.config.sessionId || randomUUID3();
+    this.mappingState.sessionId = sessionId;
+    this.setCurrentSessionId(sessionId);
+    const session = await this.sessionFactory({
+      ...this.ctx,
+      config: {
+        ...this.ctx.config,
+        sessionId
       }
-    } catch (error) {
-      this.writeStdout(JSON.stringify({
-        id,
-        type: "response",
-        command: command.type || "unknown",
-        success: false,
-        error: piErrorMessage(error)
-      }));
+    }, sessionId);
+    this.session = session;
+    this.mappingState.sessionId = session.sessionId;
+    this.setCurrentSessionId(session.sessionId);
+    this.unsubscribe = session.subscribe((event) => {
+      for (const parsed of mapPiSdkEventToParsedEvents(event, this.mappingState)) {
+        this.events.emit("runtime_event", parsed);
+      }
+    });
+    this.emitSessionInit();
+    this.launchPrompt(input.text);
+    return { ok: true, acceptedAs: "prompt" };
+  }
+  send(input) {
+    if (this.didClose) return { ok: false, reason: "closed" };
+    const session = this.session;
+    if (!session) return { ok: false, reason: "closed" };
+    if (input.mode === "busy") {
+      this.deferSdkCall(() => session.steer(input.text));
+      return { ok: true, acceptedAs: "steer" };
+    }
+    if (session.isStreaming) {
+      return { ok: false, reason: "busy_rejected", error: "Pi session is still streaming" };
+    }
+    this.launchPrompt(input.text);
+    return { ok: true, acceptedAs: "prompt" };
+  }
+  async stop(opts) {
+    if (this.didClose) return;
+    this.requestedStopReason = opts?.reason;
+    const signal = opts?.signal ?? "SIGTERM";
+    const session = this.session;
+    if (session?.isStreaming) {
+      try {
+        await session.abort();
+      } catch (error) {
+        this.events.emit("stderr", piErrorMessage(error));
+      }
+    }
+    await this.disposeSession();
+    this.emitExitAndClose(null, signal);
+  }
+  async dispose() {
+    if (this.didClose) return;
+    await this.disposeSession();
+    this.emitExitAndClose(0, null);
+  }
+  emitSessionInit() {
+    const sessionId = this.mappingState.sessionId;
+    if (!sessionId || this.mappingState.sessionAnnounced) return;
+    this.mappingState.sessionAnnounced = true;
+    this.events.emit("runtime_event", { kind: "session_init", sessionId });
+  }
+  launchPrompt(text) {
+    const session = this.session;
+    if (!session) {
+      this.events.emit("runtime_event", {
+        kind: "error",
+        message: "Pi SDK session is not started"
+      });
+      return;
     }
+    this.deferSdkCall(() => session.prompt(text));
   }
-  writeStdout(line) {
-    if (this.closed) return;
-    this.stdout.write(line + "\n");
-  }
-  writeError(error) {
-    if (this.closed) return;
-    this.stderr.write(piErrorMessage(error) + "\n");
+  deferSdkCall(invoke) {
+    setImmediate(() => {
+      if (this.didClose) return;
+      try {
+        void invoke().catch((error) => {
+          if (this.didClose) return;
+          this.events.emit("runtime_event", {
+            kind: "error",
+            message: piErrorMessage(error)
+          });
+        });
+      } catch (error) {
+        if (this.didClose) return;
+        this.events.emit("runtime_event", {
+          kind: "error",
+          message: piErrorMessage(error)
+        });
+      }
+    });
   }
-  async shutdown(code, signal) {
-    if (this.closed) return;
-    this.closed = true;
-    this.exitCode = code;
-    this.signalCode = signal;
+  async disposeSession() {
+    const unsubscribe = this.unsubscribe;
+    this.unsubscribe = null;
     try {
-      if (this.session.isStreaming) {
-        await this.session.abort();
-      }
-    } catch (error) {
-      this.stderr.write(piErrorMessage(error) + "\n");
+      unsubscribe?.();
+    } catch {
     }
+    const session = this.session;
+    this.session = null;
     try {
-      this.session.dispose();
-    } catch {
+      session?.dispose();
+    } catch (error) {
+      this.events.emit("stderr", piErrorMessage(error));
     }
-    this.stdin.destroy();
-    this.stdout.end();
-    this.stderr.end();
-    this.emit("exit", code, signal);
-    this.emit("close", code, signal);
+  }
+  emitExitAndClose(code, signal) {
+    if (this.didClose) return;
+    this.didClose = true;
+    const info = {
+      code,
+      signal,
+      reason: this.requestedStopReason ? "requested" : "runtime_exit"
+    };
+    this.exitInfo = info;
+    this.events.emit("exit", info);
+    this.events.emit("close", info);
   }
 };
 var PiDriver = class {
@@ -6378,10 +6801,9 @@ var PiDriver = class {
   busyDeliveryMode = "direct";
   usesSlockCliForCommunication = true;
   sessionId = null;
-  sessionAnnounced = false;
-  sawTextDelta = false;
-  requestId = 0;
-  process = null;
+  get currentSessionId() {
+    return this.sessionId;
+  }
   probe() {
     return {
       available: true,
@@ -6391,144 +6813,20 @@ var PiDriver = class {
   async detectModels() {
     return detectPiModels();
   }
-  async spawn(ctx) {
-    this.sessionId = ctx.config.sessionId || randomUUID3();
-    this.sessionAnnounced = false;
-    this.sawTextDelta = false;
-    this.requestId = 0;
-    const sessionDir = buildPiSessionDir(ctx.workingDirectory);
-    mkdirSync4(sessionDir, { recursive: true });
-    const spawnEnv = await buildPiSpawnEnv(ctx);
-    const agentDir = spawnEnv.PI_CODING_AGENT_DIR || getAgentDir();
-    const authStorage = AuthStorage.create(path11.join(agentDir, "auth.json"));
-    const modelRegistry = ModelRegistry.create(authStorage, path11.join(agentDir, "models.json"));
-    const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
-    const model = resolvePiModelFromRegistry(launchRuntimeFields.model, modelRegistry);
-    if (launchRuntimeFields.model && launchRuntimeFields.model !== "default" && !model) {
-      throw new Error(`Pi model not found: ${launchRuntimeFields.model}`);
-    }
-    const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false } });
-    const resourceLoader = new DefaultResourceLoader({
-      cwd: ctx.workingDirectory,
-      agentDir,
-      settingsManager,
-      systemPromptOverride: () => ctx.standingPrompt
-    });
-    await resourceLoader.reload();
-    const existingSessionFile = ctx.config.sessionId ? findPiSessionFile(sessionDir, ctx.config.sessionId) : null;
-    const sessionManager = existingSessionFile ? SessionManager.open(existingSessionFile, sessionDir, ctx.workingDirectory) : SessionManager.create(ctx.workingDirectory, sessionDir, { id: this.sessionId });
-    const { session } = await createAgentSession({
-      cwd: ctx.workingDirectory,
-      agentDir,
-      model,
-      thinkingLevel: launchRuntimeFields.reasoningEffort,
-      authStorage,
-      modelRegistry,
-      resourceLoader,
-      customTools: [
-        createBashTool(ctx.workingDirectory, {
-          spawnHook: (spawnContext) => ({
-            ...spawnContext,
-            env: {
-              ...spawnContext.env,
-              ...spawnEnv
-            }
-          })
-        })
-      ],
-      sessionManager,
-      settingsManager
-    });
-    this.sessionId = session.sessionId;
-    const proc = new PiSdkProcess(session);
-    this.process = proc;
-    setImmediate(() => {
-      if (this.process === proc && !proc.killed) {
-        this.sendRpcCommand("prompt", { message: ctx.prompt });
-      }
+  createSession(ctx) {
+    this.sessionId = ctx.config.sessionId || null;
+    return new PiSdkRuntimeSession(ctx, (sessionId) => {
+      this.sessionId = sessionId;
     });
-    return { process: proc };
   }
-  parseLine(line) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      return [];
-    }
-    const events = [];
-    if (event.type === "session" && event.id) {
-      this.sessionId = event.id;
-      if (!this.sessionAnnounced) {
-        this.sessionAnnounced = true;
-        events.push({ kind: "session_init", sessionId: event.id });
-      }
-      return events;
-    }
-    if (!this.sessionAnnounced && this.sessionId) {
-      events.push({ kind: "session_init", sessionId: this.sessionId });
-      this.sessionAnnounced = true;
-    }
-    if (event.type === "response") {
-      if (event.data?.sessionId && event.data.sessionId !== this.sessionId) {
-        this.sessionId = event.data.sessionId;
-      }
-      if (event.success === false) {
-        events.push({ kind: "error", message: piErrorMessage(event.error) });
-      }
-      return events;
-    }
-    if (event.type === "message_start" && event.message?.role === "assistant") {
-      this.sawTextDelta = false;
-      return events;
-    }
-    const assistantEvent = event.assistantMessageEvent;
-    if (event.type === "message_update" && assistantEvent) {
-      switch (assistantEvent.type) {
-        case "thinking_delta":
-          if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
-            events.push({ kind: "thinking", text: assistantEvent.delta });
-          }
-          break;
-        case "text_delta":
-          if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
-            this.sawTextDelta = true;
-            events.push({ kind: "text", text: assistantEvent.delta });
-          }
-          break;
-        case "thinking_start":
-        case "text_start":
-          break;
-        case "tool_use":
-        case "tool_call":
-        case "tool_start":
-          events.push({
-            kind: "tool_call",
-            name: assistantEvent.name || assistantEvent.toolName || "unknown_tool",
-            input: assistantEvent.input ?? assistantEvent.parameters ?? {}
-          });
-          break;
-        case "text_end":
-          if (!this.sawTextDelta && typeof assistantEvent.content === "string" && assistantEvent.content.length > 0) {
-            events.push({ kind: "text", text: assistantEvent.content });
-          }
-          break;
-      }
-      return events;
-    }
-    if (event.type === "agent_end") {
-      events.push({ kind: "turn_end", sessionId: this.sessionId || void 0 });
-    } else if (event.type === "error") {
-      events.push({ kind: "error", message: piErrorMessage(event.error ?? event.message) });
-    }
-    return events;
+  async spawn(_ctx) {
+    throw new Error("PiDriver uses a native RuntimeSession; child-process spawn is unsupported");
   }
-  encodeStdinMessage(text, _sessionId, opts) {
-    return JSON.stringify({
-      id: this.nextRequestId(),
-      type: opts?.mode === "idle" ? "prompt" : "steer",
-      message: text
-    });
+  parseLine(_line) {
+    return [];
+  }
+  encodeStdinMessage(_text, _sessionId, _opts) {
+    return null;
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
@@ -6541,18 +6839,141 @@ var PiDriver = class {
       messageNotificationStyle: "direct"
     });
   }
-  nextRequestId() {
-    this.requestId += 1;
-    return String(this.requestId);
+};
+
+// src/drivers/runtimeSession.ts
+import { EventEmitter as EventEmitter2 } from "events";
+function descriptorFromDriver(driver) {
+  const lifecycle = driver.lifecycle.kind === "per_turn" ? "turn_based" : "persistent_stream";
+  const idle = driver.supportsStdinNotification ? "stdin" : "unsupported";
+  const busy = driver.supportsStdinNotification ? "stdin_steer" : "unsupported";
+  return {
+    transport: "child_process",
+    lifecycle,
+    input: {
+      initial: "start",
+      idle,
+      busy
+    },
+    readiness: "spawned",
+    turnBoundary: driver.lifecycle.kind === "per_turn" ? "process_exit" : "parsed_event",
+    startPolicy: driver.lifecycle.kind === "per_turn" ? driver.lifecycle.start : "immediate",
+    inFlightWake: driver.lifecycle.inFlightWake,
+    busyDelivery: driver.busyDeliveryMode,
+    postTurn: driver.terminateProcessOnTurnEnd ? "terminate_process" : driver.endStdinOnTurnEnd ? "close_stdin" : "keep_alive"
+  };
+}
+var ChildProcessRuntimeSession = class {
+  constructor(driver, ctx) {
+    this.driver = driver;
+    this.ctx = ctx;
+    this.descriptor = descriptorFromDriver(driver);
   }
-  sendRpcCommand(type, params) {
-    this.process?.stdin?.write(JSON.stringify({
-      id: this.nextRequestId(),
-      type,
-      ...params
-    }) + "\n");
+  descriptor;
+  events = new EventEmitter2();
+  process = null;
+  started = false;
+  stdoutBuffer = "";
+  requestedStopReason;
+  get pid() {
+    return this.process?.pid;
+  }
+  get currentSessionId() {
+    return this.driver.currentSessionId;
+  }
+  get exitCode() {
+    return this.process?.exitCode ?? null;
+  }
+  get signalCode() {
+    return this.process?.signalCode ?? null;
+  }
+  get closed() {
+    return this.process ? this.process.exitCode != null || this.process.signalCode != null : false;
+  }
+  on(event, cb) {
+    this.events.on(event, cb);
+  }
+  async start(input) {
+    if (this.started) {
+      return { ok: false, reason: "runtime_error", error: "runtime session already started" };
+    }
+    this.started = true;
+    const launchCtx = {
+      ...this.ctx,
+      prompt: input.text,
+      config: {
+        ...this.ctx.config,
+        sessionId: input.sessionId ?? this.ctx.config.sessionId
+      }
+    };
+    const { process: process2 } = await this.driver.spawn(launchCtx);
+    this.process = process2;
+    this.attachProcess(process2);
+    return { ok: true, acceptedAs: "prompt" };
+  }
+  send(input) {
+    const proc = this.process;
+    if (!proc || this.closed) return { ok: false, reason: "closed" };
+    const encoded = this.driver.encodeStdinMessage(input.text, input.sessionId ?? null, { mode: input.mode });
+    if (!encoded) return { ok: false, reason: "unsupported" };
+    proc.stdin?.write(encoded + "\n");
+    return { ok: true, acceptedAs: input.mode === "busy" ? "steer" : "prompt" };
+  }
+  async stop(opts) {
+    const proc = this.process;
+    if (!proc || this.closed) return;
+    this.requestedStopReason = opts?.reason;
+    proc.kill(opts?.signal ?? "SIGTERM");
+    if (!opts?.forceAfterMs) return;
+    setTimeout(() => {
+      if (!this.closed) {
+        try {
+          proc.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }, opts.forceAfterMs).unref?.();
+  }
+  attachProcess(process2) {
+    process2.stdout?.on("data", (chunk) => {
+      const chunkText = chunk.toString();
+      this.events.emit("stdout", chunkText);
+      this.stdoutBuffer += chunkText;
+      const lines = this.stdoutBuffer.split("\n");
+      this.stdoutBuffer = lines.pop() || "";
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        for (const event of this.driver.parseLine(line)) {
+          this.events.emit("runtime_event", event);
+        }
+      }
+    });
+    process2.stderr?.on("data", (chunk) => {
+      const text = chunk.toString().trim();
+      if (text) this.events.emit("stderr", text);
+    });
+    process2.on("error", (err) => {
+      this.events.emit("error", err);
+    });
+    process2.on("exit", (code, signal) => {
+      this.events.emit("exit", {
+        code,
+        signal,
+        reason: this.requestedStopReason ? "requested" : "runtime_exit"
+      });
+    });
+    process2.on("close", (code, signal) => {
+      this.events.emit("close", {
+        code,
+        signal,
+        reason: this.requestedStopReason ? "requested" : "runtime_exit"
+      });
+    });
   }
 };
+function createChildProcessRuntimeSession(driver, ctx) {
+  return new ChildProcessRuntimeSession(driver, ctx);
+}
 
 // src/drivers/index.ts
 var driverFactories = {
@@ -6953,6 +7374,15 @@ var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS = 3;
 function assertNeverApmEffect(effect) {
   throw new Error(`Unhandled APM gated steering effect: ${String(effect)}`);
 }
+function requireImmediateRuntimeSendResult(result, context) {
+  if (typeof result.then === "function") {
+    throw new Error(`RuntimeSession.send returned async result in synchronous APM path: ${context}`);
+  }
+  return result;
+}
+function runtimeSendFailureOutcome(result) {
+  return !result.ok && result.reason === "unsupported" ? "encode_failed" : "send_failed";
+}
 var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS = 250;
 var WORKSPACE_TEXT_FILE_MAX_BYTES = 1048576;
 var WORKSPACE_IMAGE_PREVIEW_MAX_BYTES = 5 * 1024 * 1024;
@@ -7900,7 +8330,7 @@ function buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes) {
   if (ap.lastActivityDetail) {
     context.push(`after ${ap.lastActivityDetail}`);
   }
-  if (ap.driver.busyDeliveryMode === "gated") {
+  if (ap.runtime.descriptor.busyDelivery === "gated") {
     context.push(`phase=${ap.gatedSteering.phase}`);
   }
   if (ap.gatedSteering.outstandingToolUses > 0) {
@@ -7932,10 +8362,10 @@ function buildRuntimeStallDiagnostic(ap, staleForMs, staleForMinutes) {
       sessionIdPresent: Boolean(ap.sessionId),
       inboxCount: ap.inbox.length,
       pendingNotificationCount: ap.notifications.pendingCount,
-      processPidPresent: typeof ap.process.pid === "number",
+      processPidPresent: typeof ap.runtime.pid === "number",
       busyDeliveryMode: ap.driver.busyDeliveryMode,
       supportsStdinNotification: ap.driver.supportsStdinNotification,
-      gatedPhase: ap.driver.busyDeliveryMode === "gated" ? ap.gatedSteering.phase : void 0,
+      gatedPhase: ap.runtime.descriptor.busyDelivery === "gated" ? ap.gatedSteering.phase : void 0,
       outstandingToolUses: ap.gatedSteering.outstandingToolUses,
       compacting: ap.gatedSteering.compacting,
       recentStderrCount: ap.recentStderr.length,
@@ -8078,8 +8508,10 @@ var RUNTIME_TELEMETRY_RESERVED_ATTR_KEYS = /* @__PURE__ */ new Set([
   "runtimeResultId",
   "daemonVersion",
   "daemon_version",
+  "daemon_version_present",
   "computerVersion",
-  "computer_version"
+  "computer_version",
+  "computer_version_present"
 ]);
 function sanitizeRuntimeTelemetryPayloadAttrs(attrs) {
   const sanitized = {};
@@ -8136,9 +8568,11 @@ var AgentProcessManager = class _AgentProcessManager {
   stdinNotificationRetryMs;
   cliTransportTraceDir = null;
   deliveryTraceContexts = /* @__PURE__ */ new WeakMap();
-  processExitTraceAttrs = /* @__PURE__ */ new WeakMap();
+  runtimeExitTraceAttrs = /* @__PURE__ */ new WeakMap();
   agentVisibleBoundaries = /* @__PURE__ */ new Map();
   agentVisibleMessageIds = /* @__PURE__ */ new Map();
+  daemonVersion;
+  computerVersion;
   constructor(chatBridgePath, sendToServer, daemonApiKey, opts) {
     this.chatBridgePath = chatBridgePath;
     this.slockCliPath = opts.slockCliPath ?? "";
@@ -8150,6 +8584,8 @@ var AgentProcessManager = class _AgentProcessManager {
     this.driverResolver = opts.driverResolver || getDriver;
     this.defaultAgentEnvVarsProvider = opts.defaultAgentEnvVarsProvider || null;
     this.tracer = opts.tracer ?? noopTracer;
+    this.daemonVersion = opts.daemonVersion?.trim() || null;
+    this.computerVersion = opts.computerVersion?.trim() || null;
     this.stdinNotificationRetryMs = Math.max(
       0,
       Math.floor(opts.stdinNotificationRetryMs ?? STDIN_NOTIFICATION_RETRY_DELAY_MS)
@@ -8390,7 +8826,7 @@ var AgentProcessManager = class _AgentProcessManager {
     });
     span.end(status);
   }
-  startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId) {
+  startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient = false) {
     return {
       agentId,
       launchId,
@@ -8399,6 +8835,7 @@ var AgentProcessManager = class _AgentProcessManager {
       session_id_present: Boolean(config.sessionId),
       launch_id_present: Boolean(launchId),
       wake_message_present: Boolean(wakeMessage),
+      wake_message_transient: Boolean(wakeMessage && wakeMessageTransient),
       unread_channels_count: unreadSummary ? Object.keys(unreadSummary).length : 0,
       resume_prompt_present: Boolean(resumePrompt),
       queue_depth: this.agentStartQueue.length,
@@ -8410,6 +8847,9 @@ var AgentProcessManager = class _AgentProcessManager {
   getDeliveryTraceContext(message) {
     return this.deliveryTraceContexts.get(message) ?? {};
   }
+  isTransientDelivery(message) {
+    return this.getDeliveryTraceContext(message).transient === true;
+  }
   deliveryTraceAttrs(agentId, message, attrs = {}) {
     const context = this.getDeliveryTraceContext(message);
     const deliveryCorrelationId = context.deliveryId ?? message.message_id;
@@ -8421,14 +8861,15 @@ var AgentProcessManager = class _AgentProcessManager {
       sender_type: message.sender_type,
       messageId: message.message_id,
       message_id_present: Boolean(message.message_id),
+      transient_delivery: context.transient === true,
       ...attrs
     };
   }
-  async startAgent(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId) {
-    this.recordDaemonTrace("daemon.agent.start.requested", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
+  async startAgent(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient = false) {
+    this.recordDaemonTrace("daemon.agent.start.requested", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient));
     if (this.agents.has(agentId)) {
       this.recordDaemonTrace("daemon.agent.start.ignored", {
-        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_running"
       });
       logger.info(`[Agent ${agentId}] Start ignored (already running)`);
@@ -8436,7 +8877,7 @@ var AgentProcessManager = class _AgentProcessManager {
     }
     if (this.agentsStarting.has(agentId)) {
       this.recordDaemonTrace("daemon.agent.start.ignored", {
-        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_starting"
       });
       logger.info(`[Agent ${agentId}] Start ignored (startup in progress)`);
@@ -8444,7 +8885,7 @@ var AgentProcessManager = class _AgentProcessManager {
     }
     if (this.queuedAgentStarts.has(agentId)) {
       this.recordDaemonTrace("daemon.agent.start.ignored", {
-        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_queued"
       });
       logger.info(`[Agent ${agentId}] Start ignored (startup already queued)`);
@@ -8455,6 +8896,7 @@ var AgentProcessManager = class _AgentProcessManager {
         agentId,
         config,
         wakeMessage,
+        wakeMessageTransient,
         unreadSummary,
         resumePrompt,
         launchId,
@@ -8463,7 +8905,7 @@ var AgentProcessManager = class _AgentProcessManager {
       };
       this.agentStartQueue.push(item);
       this.queuedAgentStarts.set(agentId, item);
-      this.recordDaemonTrace("daemon.agent.start.queued", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
+      this.recordDaemonTrace("daemon.agent.start.queued", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient));
       logger.info(
         `[Agent ${agentId}] Start queued (queue=${this.agentStartQueue.length}, active=${this.activeAgentStartCount}, max=${this.maxConcurrentAgentStarts}, interval=${this.agentStartIntervalMs}ms)`
       );
@@ -8480,7 +8922,7 @@ var AgentProcessManager = class _AgentProcessManager {
     const waitMs = shouldRateLimit ? Math.max(0, this.agentStartIntervalMs - elapsed) : 0;
     if (waitMs > 0) {
       this.recordDaemonTrace("daemon.agent.start.rate_limited", {
-        ...this.startQueueTraceAttrs(next.agentId, next.config, next.wakeMessage, next.unreadSummary, next.resumePrompt, next.launchId),
+        ...this.startQueueTraceAttrs(next.agentId, next.config, next.wakeMessage, next.unreadSummary, next.resumePrompt, next.launchId, next.wakeMessageTransient),
         wait_ms: waitMs
       });
       this.agentStartPumpTimer = setTimeout(() => {
@@ -8493,7 +8935,7 @@ var AgentProcessManager = class _AgentProcessManager {
     if (!item) return;
     if (this.queuedAgentStarts.get(item.agentId) !== item) {
       this.recordDaemonTrace("daemon.agent.start.skipped", {
-        ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId),
+        ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient),
         reason: "stale_queue_item"
       });
       this.pumpAgentStartQueue();
@@ -8502,7 +8944,7 @@ var AgentProcessManager = class _AgentProcessManager {
     this.queuedAgentStarts.delete(item.agentId);
     if (this.agents.has(item.agentId) || this.agentsStarting.has(item.agentId)) {
       this.recordDaemonTrace("daemon.agent.start.skipped", {
-        ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId),
+        ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient),
         reason: "already_running_or_starting"
       });
       logger.info(`[Agent ${item.agentId}] Queued start skipped (already running or starting)`);
@@ -8516,14 +8958,15 @@ var AgentProcessManager = class _AgentProcessManager {
     logger.info(
       `[Agent ${item.agentId}] Dequeued start (remaining=${this.agentStartQueue.length}, active=${this.activeAgentStartCount})`
     );
-    this.recordDaemonTrace("daemon.agent.start.dequeued", this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId));
+    this.recordDaemonTrace("daemon.agent.start.dequeued", this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient));
     this.startAgentNow(
       item.agentId,
       item.config,
       item.wakeMessage,
       item.unreadSummary,
       item.resumePrompt,
-      item.launchId
+      item.launchId,
+      item.wakeMessageTransient ?? false
     ).then(() => {
       this.releaseAgentStartSlot(item.agentId, "spawn attempted");
       item.resolve();
@@ -8558,7 +9001,7 @@ var AgentProcessManager = class _AgentProcessManager {
       this.agentStartPumpTimer = null;
     }
     this.recordDaemonTrace("daemon.agent.start.cancelled", {
-      ...this.startQueueTraceAttrs(agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId),
+      ...this.startQueueTraceAttrs(agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient),
       reason
     }, "cancelled");
     logger.info(`[Agent ${agentId}] Queued start cancelled (${reason})`);
@@ -8569,7 +9012,7 @@ var AgentProcessManager = class _AgentProcessManager {
     for (const item of this.agentStartQueue) {
       if (this.queuedAgentStarts.get(item.agentId) === item) {
         this.recordDaemonTrace("daemon.agent.start.cancelled", {
-          ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId),
+          ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient),
           reason
         }, "cancelled");
         logger.info(`[Agent ${item.agentId}] Queued start cancelled (${reason})`);
@@ -8584,10 +9027,10 @@ var AgentProcessManager = class _AgentProcessManager {
       this.agentStartPumpTimer = null;
     }
   }
-  async startAgentNow(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId) {
+  async startAgentNow(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient = false) {
     if (this.agents.has(agentId)) {
       this.recordDaemonTrace("daemon.agent.spawn.skipped", {
-        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_running"
       });
       logger.info(`[Agent ${agentId}] Start ignored (already running)`);
@@ -8595,14 +9038,15 @@ var AgentProcessManager = class _AgentProcessManager {
     }
     if (this.agentsStarting.has(agentId)) {
       this.recordDaemonTrace("daemon.agent.spawn.skipped", {
-        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+        ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_starting"
       });
       logger.info(`[Agent ${agentId}] Start ignored (startup in progress)`);
       return;
     }
     this.agentsStarting.add(agentId);
-    this.recordDaemonTrace("daemon.agent.spawn.started", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId));
+    this.recordDaemonTrace("daemon.agent.spawn.started", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient));
+    let agentProcess = null;
     try {
       const driver = this.driverResolver(config.runtime || "claude");
       const legacyWakeRuntimeProfile = wakeMessage ? runtimeProfileNotificationFromMessage(wakeMessage) : null;
@@ -8665,15 +9109,23 @@ var AgentProcessManager = class _AgentProcessManager {
         prompt += getBusyDeliveryNote(driver);
         promptSource = "resume_prompt";
       } else if (wakeMessage) {
-        const runtimeProfileControlPrompt = formatRuntimeProfileControlPrompt([wakeMessage]);
-        if (runtimeProfileControlPrompt) {
+        const transientWakeMessage = wakeMessageTransient === true;
+        const runtimeProfileControlPrompt = transientWakeMessage ? null : formatRuntimeProfileControlPrompt([wakeMessage]);
+        if (transientWakeMessage) {
+          prompt = `System notice received:
+
+${formatIncomingMessage(wakeMessage, driver)}
+
+Respond as appropriate. Complete all your work before stopping.
+${RESPONSE_TARGET_HINT}`;
+        } else if (runtimeProfileControlPrompt) {
           prompt = runtimeProfileControlPrompt;
         } else {
           wakeMessageDeliveredAsInboxUpdate = true;
           prompt = this.formatInboxUpdateRuntimeInput([wakeMessage, ...startingInboxMessages], driver);
         }
-        promptSource = runtimeProfileControlPrompt ? "runtime_profile_control_message" : "wake_inbox_update";
-        if (!runtimeProfileControlPrompt && unreadSummary && Object.keys(unreadSummary).length > 0) {
+        promptSource = transientWakeMessage ? "transient_wake_message" : runtimeProfileControlPrompt ? "runtime_profile_control_message" : "wake_inbox_update";
+        if (!transientWakeMessage && !runtimeProfileControlPrompt && unreadSummary && Object.keys(unreadSummary).length > 0) {
           const otherUnread = Object.entries(unreadSummary);
           if (otherUnread.length > 0) {
             prompt += `
@@ -8730,7 +9182,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         this.sendAgentStatus(agentId, "active", launchId || null);
         this.broadcastActivity(agentId, "online", "Process idle");
         this.recordDaemonTrace("daemon.agent.spawn.deferred", {
-          ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId),
+          ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
           pending_messages_count: pendingMessages.length,
           reason: "defer_until_concrete_message"
         });
@@ -8740,7 +9192,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }
         return;
       }
-      const { process: proc } = await driver.spawn({
+      const runtimeContext = {
         agentId,
         config: effectiveConfig,
         standingPrompt,
@@ -8752,15 +9204,10 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         launchId: launchId || null,
         agentCredentialProxyInboxCoordinator: this.createAgentProxyInboxCoordinator(agentId),
         cliTransportTraceDir: this.cliTransportTraceDir
-      });
-      this.recordDaemonTrace("daemon.agent.spawn.created", {
-        ...this.startQueueTraceAttrs(agentId, effectiveConfig, wakeMessage, unreadSummary, resumePrompt, launchId),
-        detached: false,
-        new_session: false,
-        process_pid_present: typeof proc.pid === "number"
-      });
-      const agentProcess = {
-        process: proc,
+      };
+      const runtime = driver.createSession?.(runtimeContext) ?? createChildProcessRuntimeSession(driver, runtimeContext);
+      agentProcess = {
+        runtime,
         driver,
         inbox: wakeMessageDeliveredAsInboxUpdate && wakeMessage ? [wakeMessage, ...startingInboxMessages] : startingInboxMessages,
         config: runtimeConfig,
@@ -8807,30 +9254,20 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       }
       if (wakeMessageDeliveredAsInboxUpdate) {
         this.recordInboxUpdateProjection(agentId, agentProcess, agentProcess.inbox, "spawn_wake_inbox_update", "wake", prompt);
-      } else if (wakeMessage) {
+      } else if (wakeMessage && !wakeMessageTransient) {
         this.consumeVisibleMessages(agentId, { messages: [wakeMessage], source: "spawn_wake_message" });
         this.ackInjectedRuntimeProfileMessages(agentId, [wakeMessage], agentProcess.launchId);
       }
-      let buffer = "";
-      proc.stdout?.on("data", (chunk) => {
-        const chunkText = chunk.toString();
+      runtime.on("stdout", (chunkText) => {
         const current = this.agents.get(agentId);
         if (current) {
           current.recentStdout = pushRecentStdout(current.recentStdout, chunkText);
         }
-        buffer += chunkText;
-        const lines = buffer.split("\n");
-        buffer = lines.pop() || "";
-        for (const line of lines) {
-          if (!line.trim()) continue;
-          const events = driver.parseLine(line);
-          for (const event of events) {
-            this.handleParsedEvent(agentId, event, driver);
-          }
-        }
       });
-      proc.stderr?.on("data", (chunk) => {
-        const text = chunk.toString().trim();
+      runtime.on("runtime_event", (event) => {
+        this.handleParsedEvent(agentId, event, driver);
+      });
+      runtime.on("stderr", (text) => {
         if (!text) return;
         const current = this.agents.get(agentId);
         if (driver.id === "codex" && isCodexProviderReconnectLog(text)) {
@@ -8855,7 +9292,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }
         logger.error(`[Agent ${agentId} stderr]: ${text}`);
       });
-      proc.on("error", (err) => {
+      runtime.on("error", (err) => {
         const current = this.agents.get(agentId);
         if (current) {
           current.spawnError = err.message;
@@ -8870,9 +9307,9 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }, "error");
         logger.error(`[Agent ${agentId}] Process error: ${err.message}`);
       });
-      proc.on("exit", (code, signal) => {
+      runtime.on("exit", ({ code, signal }) => {
         const current = this.agents.get(agentId);
-        if (current && current.process === proc) {
+        if (current && current.runtime === runtime) {
           current.exitCode = code;
           current.exitSignal = signal;
         }
@@ -8887,14 +9324,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           runtime_trace_active: Boolean(current?.runtimeTraceSpan),
           inbox_count: current?.inbox.length ?? 0,
           pending_notification_count: current?.notifications.pendingCount ?? 0,
-          ...this.processExitTraceAttrs.get(proc)
+          ...this.runtimeExitTraceAttrs.get(runtime)
         });
         logger.info(`[Agent ${agentId}] Process exited with code ${code}${signal ? ` (signal ${signal})` : ""}`);
       });
-      proc.on("close", (code, signal) => {
+      runtime.on("close", ({ code, signal }) => {
         if (this.agents.has(agentId)) {
           const ap = this.agents.get(agentId);
-          if (ap.process !== proc) return;
+          if (ap.runtime !== runtime) return;
           ap.notifications.clearTimer();
           if (ap.pendingTrajectory?.timer) {
             clearTimeout(ap.pendingTrajectory.timer);
@@ -9035,14 +9472,54 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           }
         }
       });
+      const startResult = await runtime.start({ text: prompt, sessionId: effectiveConfig.sessionId || null });
+      if (!startResult.ok) {
+        throw new Error(`Runtime session failed to start: ${startResult.reason}${startResult.error ? ` (${startResult.error})` : ""}`);
+      }
+      this.recordDaemonTrace("daemon.agent.spawn.created", {
+        ...this.startQueueTraceAttrs(agentId, effectiveConfig, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
+        detached: false,
+        new_session: false,
+        process_pid_present: typeof runtime.pid === "number"
+      });
       this.sendAgentStatus(agentId, "active", launchId || null);
       this.broadcastActivity(agentId, "working", "Starting\u2026");
       this.startRuntimeStartupTimeout(agentId, agentProcess);
     } catch (err) {
       this.agentsStarting.delete(agentId);
+      this.cleanupFailedRuntimeStart(agentId, agentProcess, err);
       throw err;
     }
   }
+  cleanupFailedRuntimeStart(agentId, ap, err) {
+    if (!ap) return;
+    if (this.agents.get(agentId) !== ap) return;
+    ap.notifications.clearTimer();
+    if (ap.pendingTrajectory?.timer) {
+      clearTimeout(ap.pendingTrajectory.timer);
+      ap.pendingTrajectory.timer = null;
+    }
+    if (ap.activityHeartbeat) {
+      clearInterval(ap.activityHeartbeat);
+      ap.activityHeartbeat = null;
+    }
+    if (ap.compactionWatchdog) {
+      clearTimeout(ap.compactionWatchdog);
+      ap.compactionWatchdog = null;
+    }
+    this.clearRuntimeStartupTimeout(ap);
+    this.clearStalledRecoverySigtermWatchdog(ap);
+    this.endRuntimeTrace(ap, "error", {
+      outcome: "runtime-start-failed",
+      failure_detail: err instanceof Error ? err.message : String(err),
+      ...runtimeTraceCounterAttrs(ap),
+      ...this.finalizeRuntimeProfileTurnControl(agentId, ap, "runtime_error")
+    });
+    cleanupAgentCredentialProxy(agentId, ap.launchId);
+    this.revokeManagedRunnerCredential(agentId, ap.config, ap.launchId);
+    this.agents.delete(agentId);
+    this.idleAgentConfigs.delete(agentId);
+  }
   async buildSpawnConfig(agentId, config) {
     const baseConfig = config.serverUrl === this.serverUrl ? config : { ...config, serverUrl: this.serverUrl };
     const runnerConfig = await this.ensureManagedRunnerCredential(agentId, baseConfig);
@@ -9211,7 +9688,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     ap.inbox.push(message);
     if (ap.driver.supportsStdinNotification && ap.sessionId) {
       ap.notifications.add();
-      if (ap.driver.busyDeliveryMode === "gated") {
+      if (ap.runtime.descriptor.busyDelivery === "gated") {
         this.recordGatedSteeringEvent(agentId, ap, "buffer", {
           reason: "runtime_profile",
           kind,
@@ -9278,36 +9755,36 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     cleanupAgentCredentialProxy(agentId, ap.launchId);
     this.revokeManagedRunnerCredential(agentId, ap.config, ap.launchId);
     this.agents.delete(agentId);
-    this.processExitTraceAttrs.set(ap.process, {
+    this.runtimeExitTraceAttrs.set(ap.runtime, {
       stop_source: silent ? "daemon_internal" : "explicit_request",
       stop_wait_requested: wait,
       stop_silent: silent
     });
-    ap.process.kill("SIGTERM");
+    await ap.runtime.stop({
+      signal: "SIGTERM",
+      forceAfterMs: wait ? 5e3 : void 0,
+      reason: silent ? "daemon_internal" : "explicit_request"
+    });
     if (!silent) {
-      this.sendRuntimeProfileReportFor(agentId, ap.config, ap.sessionId, ap.launchId);
+      this.sendRuntimeProfileReportFor(agentId, ap.config, ap.sessionId, ap.launchId, "stop");
       this.sendAgentStatus(agentId, "inactive", ap.launchId);
       this.broadcastActivity(agentId, "offline", "Stopped");
       logger.info(`[Agent ${agentId}] Stopped by request`);
     }
     if (wait) {
       await new Promise((resolve) => {
-        const forceKillTimer = setTimeout(() => {
+        const timeoutTimer = setTimeout(() => {
           if (!silent) {
             logger.warn(`[Agent ${agentId}] Stop timed out; force killing`);
           }
-          try {
-            ap.process.kill("SIGKILL");
-          } catch {
-          }
           resolve();
         }, 5e3);
-        ap.process.on("exit", () => {
-          clearTimeout(forceKillTimer);
+        ap.runtime.on("exit", () => {
+          clearTimeout(timeoutTimer);
           resolve();
         });
-        if (ap.process.exitCode !== null || ap.process.signalCode !== null) {
-          clearTimeout(forceKillTimer);
+        if (ap.runtime.closed) {
+          clearTimeout(timeoutTimer);
           resolve();
         }
       });
@@ -9317,9 +9794,24 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     if (traceContext.deliveryId) {
       this.deliveryTraceContexts.set(message, traceContext);
     }
+    if (traceContext.transient) {
+      this.deliveryTraceContexts.set(message, traceContext);
+    }
+    const transientDelivery = this.isTransientDelivery(message);
     const ap = this.agents.get(agentId);
     if (!ap) {
       if (this.agentsStarting.has(agentId) || this.queuedAgentStarts.has(agentId)) {
+        if (transientDelivery) {
+          const queuedStart2 = this.queuedAgentStarts.get(agentId);
+          this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+            outcome: "transient_dropped_during_start",
+            accepted: true,
+            process_present: false,
+            startup_pending: true,
+            launchId: queuedStart2?.launchId
+          }));
+          return true;
+        }
         const queuedStart = this.queuedAgentStarts.get(agentId);
         const pending = this.startingInboxes.get(agentId) || [];
         pending.push(message);
@@ -9337,7 +9829,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       const cached = this.idleAgentConfigs.get(agentId);
       if (cached) {
         const driver = this.driverResolver(cached.config.runtime || "claude");
-        if (this.shouldDeferWakeMessage(agentId, driver, message)) {
+        if (!transientDelivery && this.shouldDeferWakeMessage(agentId, driver, message)) {
           this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
             outcome: "deferred_wake_message",
             accepted: true,
@@ -9360,7 +9852,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           session_id_present: Boolean(cached.sessionId),
           launchId: cached.launchId || void 0
         }));
-        return this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0).then(() => true, (err) => {
+        return this.startAgent(agentId, cached.config, message, void 0, void 0, cached.launchId || void 0, transientDelivery).then(() => true, (err) => {
           logger.error(`[Agent ${agentId}] Failed to auto-restart`, err);
           if (this.reportRunnerCredentialMintFailure(agentId, err, cached.launchId, "idle_auto_restart")) {
             return false;
@@ -9370,6 +9862,15 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         });
       }
       logger.warn(`[Agent ${agentId}] Delivery received but no running process or cached idle config exists`);
+      if (transientDelivery) {
+        this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+          outcome: "transient_dropped_no_process",
+          accepted: true,
+          process_present: false,
+          cached_idle_config_present: false
+        }));
+        return true;
+      }
       this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
         outcome: "rejected_no_process",
         accepted: false,
@@ -9380,7 +9881,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       this.broadcastActivity(agentId, "offline", "Process unavailable; restart required");
       return false;
     }
-    if (this.shouldDeferWakeMessage(agentId, ap.driver, message)) {
+    if (!transientDelivery && this.shouldDeferWakeMessage(agentId, ap.driver, message)) {
       this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
         outcome: "deferred_wake_message",
         accepted: true,
@@ -9395,6 +9896,19 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     const stickyTerminalFailure = classifyStickyTerminalFailure(ap);
     if (stickyTerminalFailure) {
+      if (transientDelivery) {
+        this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+          outcome: "transient_dropped_terminal_runtime_error",
+          accepted: true,
+          process_present: true,
+          runtime: ap.config.runtime,
+          session_id_present: Boolean(ap.sessionId),
+          launchId: ap.launchId || void 0,
+          is_idle: ap.isIdle,
+          inbox_count: ap.inbox.length
+        }));
+        return true;
+      }
       ap.inbox.push(message);
       this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
         outcome: "queued_terminal_runtime_error",
@@ -9411,6 +9925,30 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       return true;
     }
     if (ap.isIdle && ap.driver.supportsStdinNotification && ap.sessionId) {
+      if (transientDelivery) {
+        this.commitApmIdleState(agentId, ap, false);
+        this.startRuntimeTrace(agentId, ap, "stdin-idle-delivery", [message]);
+        this.broadcastActivity(agentId, "working", "Message received");
+        const stdinAccepted2 = this.deliverMessagesViaStdin(
+          agentId,
+          ap,
+          [message],
+          "idle",
+          { transient: true }
+        );
+        this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+          outcome: "stdin_idle_transient_delivery",
+          accepted: true,
+          process_present: true,
+          runtime: ap.config.runtime,
+          session_id_present: true,
+          launchId: ap.launchId || void 0,
+          stdin_delivery_accepted: stdinAccepted2,
+          delivered_messages_count: 1,
+          inbox_count: ap.inbox.length
+        }));
+        return true;
+      }
       ap.inbox.push(message);
       const nextMessages = [...ap.inbox];
       this.commitApmIdleState(agentId, ap, false);
@@ -9435,6 +9973,19 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       }));
       return true;
     }
+    if (transientDelivery) {
+      this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
+        outcome: "transient_dropped_busy",
+        accepted: true,
+        process_present: true,
+        runtime: ap.config.runtime,
+        session_id_present: Boolean(ap.sessionId),
+        launchId: ap.launchId || void 0,
+        is_idle: ap.isIdle,
+        inbox_count: ap.inbox.length
+      }));
+      return true;
+    }
     ap.inbox.push(message);
     if (this.recoverStaleProcessForQueuedMessageIfNeeded(agentId, ap)) {
       this.recordDaemonTrace("daemon.agent.delivery.routed", this.deliveryTraceAttrs(agentId, message, {
@@ -9475,7 +10026,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     if (ap.gatedSteering.compacting) {
       ap.notifications.add();
       ap.notifications.clearTimer();
-      if (ap.driver.busyDeliveryMode === "gated") {
+      if (ap.runtime.descriptor.busyDelivery === "gated") {
         this.recordGatedSteeringEvent(agentId, ap, "buffer", {
           reason: "compaction_boundary",
           pendingMessages: ap.inbox.length
@@ -9500,7 +10051,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       }));
       return true;
     }
-    if (ap.driver.busyDeliveryMode === "gated") {
+    if (ap.runtime.descriptor.busyDelivery === "gated") {
       ap.notifications.add();
       if (!ap.notifications.hasTimer) {
         this.scheduleStdinNotification(agentId, ap, STDIN_NOTIFICATION_INITIAL_DELAY_MS);
@@ -9683,7 +10234,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       traceparent: formatTraceparent(span.context)
     };
     const ap = this.agents.get(agentId);
-    if (ap && !(ap.sessionId && ap.driver.supportsStdinNotification && ap.isIdle) && !(ap.sessionId && ap.driver.busyDeliveryMode === "direct")) {
+    if (ap && !(ap.sessionId && ap.driver.supportsStdinNotification && ap.isIdle) && !(ap.sessionId && ap.runtime.descriptor.busyDelivery === "direct")) {
       this.enqueueRuntimeProfileNotification(agentId, ap, message, kind, key);
       span.end("ok", {
         attrs: {
@@ -9713,7 +10264,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       });
       return written;
     }
-    if (ap?.sessionId && ap.driver.busyDeliveryMode === "direct") {
+    if (ap?.sessionId && ap.runtime.descriptor.busyDelivery === "direct") {
       const written = this.deliverMessagesViaStdin(agentId, ap, [message], "busy");
       span.end(written ? "ok" : "error", {
         attrs: {
@@ -9818,7 +10369,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     });
     span.end("ok", { attrs: { outcome: "agent_config_ack_sent" } });
   }
-  sendRuntimeProfileWireReport(report) {
+  sendRuntimeProfileWireReport(report, source) {
     const span = this.tracer.startSpan("daemon.runtime_profile.report.sent", {
       surface: "daemon",
       kind: "producer",
@@ -9826,6 +10377,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         agentId: report.agentId,
         launchId: report.launchId || void 0,
         runtime: report.facts.runtime,
+        report_source: source,
         model_present: Boolean(report.facts.model),
         session_ref_present: Boolean(report.facts.sessionRef),
         workspace_ref_present: Boolean(report.facts.workspaceRef || report.facts.workspacePathRef)
@@ -9836,17 +10388,18 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       agentId: report.agentId,
       facts: report.facts,
       launchId: report.launchId || void 0,
-      traceparent: formatTraceparent(span.context)
+      traceparent: formatTraceparent(span.context),
+      source
     });
     span.end("ok");
   }
-  sendRuntimeProfileReportFor(agentId, config, sessionId, launchId) {
-    this.sendRuntimeProfileWireReport(this.buildRuntimeProfileReport(agentId, config, sessionId, launchId));
+  sendRuntimeProfileReportFor(agentId, config, sessionId, launchId, source) {
+    this.sendRuntimeProfileWireReport(this.buildRuntimeProfileReport(agentId, config, sessionId, launchId), source);
   }
-  sendRuntimeProfileReport(agentId) {
+  sendRuntimeProfileReport(agentId, source) {
     const report = this.getAgentRuntimeProfileReport(agentId);
     if (!report) return;
-    this.sendRuntimeProfileWireReport(report);
+    this.sendRuntimeProfileWireReport(report, source);
   }
   // Machine-level workspace scanning
   async scanAllWorkspaces() {
@@ -10136,23 +10689,23 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     clearTimeout(ap.stalledRecoverySigtermTimer);
     ap.stalledRecoverySigtermTimer = null;
   }
-  mergeProcessExitTraceAttrs(proc, attrs) {
-    this.processExitTraceAttrs.set(proc, {
-      ...this.processExitTraceAttrs.get(proc) ?? {},
+  mergeRuntimeExitTraceAttrs(runtime, attrs) {
+    this.runtimeExitTraceAttrs.set(runtime, {
+      ...this.runtimeExitTraceAttrs.get(runtime) ?? {},
       ...attrs
     });
   }
   startStalledRecoverySigtermWatchdog(agentId, ap, runtimeLabel, queuedMessagesAtSignal, staleForMs) {
     this.clearStalledRecoverySigtermWatchdog(ap);
     const timeoutMs = stalledRecoverySigtermTimeoutMs();
-    const processAtSignal = ap.process;
+    const runtimeAtSignal = ap.runtime;
     ap.stalledRecoverySigtermTimer = setTimeout(() => {
       ap.stalledRecoverySigtermTimer = null;
       const current = this.agents.get(agentId);
-      if (!current || current !== ap || current.process !== processAtSignal || current.expectedTerminationReason !== "stalled_recovery") {
+      if (!current || current !== ap || current.runtime !== runtimeAtSignal || current.expectedTerminationReason !== "stalled_recovery") {
         return;
       }
-      this.mergeProcessExitTraceAttrs(processAtSignal, {
+      this.mergeRuntimeExitTraceAttrs(runtimeAtSignal, {
         stalled_recovery_sigterm_timeout: true,
         stalled_recovery_sigterm_timeout_ms: timeoutMs
       });
@@ -10166,7 +10719,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         queued_messages_at_signal: queuedMessagesAtSignal,
         stale_age_ms_at_signal: staleForMs,
         timeout_ms: timeoutMs,
-        process_pid_present: typeof processAtSignal.pid === "number",
+        process_pid_present: typeof runtimeAtSignal.pid === "number",
         session_id_present: Boolean(current.sessionId),
         supports_stdin_notification: current.driver.supportsStdinNotification,
         busy_delivery_mode: current.driver.busyDeliveryMode
@@ -10175,7 +10728,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         `[Agent ${agentId}] Stalled ${runtimeLabel} runtime did not exit after SIGTERM within ${timeoutMs}ms; force killing`
       );
       try {
-        processAtSignal.kill("SIGKILL");
+        void runtimeAtSignal.stop({ signal: "SIGKILL", reason: "stalled_recovery_sigterm_timeout" });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
         this.recordDaemonTrace("daemon.agent.stalled_recovery.sigkill_failed", {
@@ -10361,7 +10914,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     ap.runtimeProgress.noteRuntimeEvent(eventKind);
   }
   recordGatedSteeringEvent(agentId, ap, event, attrs = {}) {
-    if (ap.driver.busyDeliveryMode !== "gated") return;
+    if (ap.runtime.descriptor.busyDelivery !== "gated") return;
     const reduction = reduceApmGatedRecentEvent(ap.gatedSteering, { event });
     this.commitGatedSteeringDecisionState(agentId, ap, reduction.nextState);
     this.recordRuntimeTraceEvent(agentId, ap, `runtime.gated_steering.${event}`, {
@@ -10396,7 +10949,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   notifyGatedSteeringBoundary(agentId, ap, reason) {
     const readiness = reduceApmGatedFlushReadiness(ap.gatedSteering, {
-      isGated: ap.driver.busyDeliveryMode === "gated",
+      isGated: ap.runtime.descriptor.busyDelivery === "gated",
       hasSession: Boolean(ap.sessionId),
       inboxLength: ap.inbox.length,
       reason
@@ -10446,7 +10999,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           });
           return true;
         }
-        if (ap.driver.busyDeliveryMode === "gated") {
+        if (ap.runtime.descriptor.busyDelivery === "gated") {
           const flushReduction = reduceApmGatedFlush(ap.gatedSteering, { reason: effect.reason });
           this.commitGatedSteeringDecisionState(agentId, ap, flushReduction.nextState);
           this.recordGatedSteeringEvent(agentId, ap, "flush", {
@@ -10548,12 +11101,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     this.sendAgentStatus(agentId, "inactive", ap.launchId);
     this.idleAgentConfigs.delete(agentId);
     try {
-      this.processExitTraceAttrs.set(ap.process, {
+      this.runtimeExitTraceAttrs.set(ap.runtime, {
         stop_source: "startup_timeout",
         expectedTerminationReason: "startup_timeout",
         timeout_ms: timeoutMs
       });
-      ap.process.kill("SIGTERM");
+      void ap.runtime.stop({ signal: "SIGTERM", reason: "startup_timeout" });
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       logger.warn(`[Agent ${agentId}] Failed to terminate startup-timed-out ${ap.driver.id} process: ${reason}`);
@@ -10639,13 +11192,13 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     );
     this.broadcastActivity(agentId, "working", `Restarting stalled ${runtimeLabel} runtime for queued message`);
     try {
-      this.processExitTraceAttrs.set(ap.process, {
+      this.runtimeExitTraceAttrs.set(ap.runtime, {
         stop_source: "stalled_recovery",
         expectedTerminationReason: "stalled_recovery",
         queued_messages_count: ap.inbox.length
       });
       this.startStalledRecoverySigtermWatchdog(agentId, ap, runtimeLabel, ap.inbox.length, staleForMs);
-      ap.process.kill("SIGTERM");
+      void ap.runtime.stop({ signal: "SIGTERM", reason: "stalled_recovery" });
     } catch (err) {
       this.clearStalledRecoverySigtermWatchdog(ap);
       const reason = err instanceof Error ? err.message : String(err);
@@ -10695,7 +11248,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       case "session_init":
         if (ap) ap.sessionId = event.sessionId;
         this.sendToServer({ type: "agent:session", agentId, sessionId: event.sessionId, launchId: ap?.launchId || void 0 });
-        this.sendRuntimeProfileReport(agentId);
+        this.sendRuntimeProfileReport(agentId, "session_init");
         break;
       case "thinking": {
         this.completeCompactionIfActive(agentId, "Context compaction finished (inferred from resumed output)");
@@ -10821,11 +11374,11 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           if (ap.driver.terminateProcessOnTurnEnd) {
             logger.info(`[Agent ${agentId}] Turn completed; terminating ${ap.driver.id} process`);
             try {
-              this.processExitTraceAttrs.set(ap.process, {
+              this.runtimeExitTraceAttrs.set(ap.runtime, {
                 stop_source: "turn_end",
                 expectedTerminationReason: "turn_end"
               });
-              ap.process.kill("SIGTERM");
+              void ap.runtime.stop({ signal: "SIGTERM", reason: "turn_end" });
             } catch (err) {
               const reason = err instanceof Error ? err.message : String(err);
               logger.warn(`[Agent ${agentId}] Failed to terminate ${ap.driver.id} after turn_end: ${reason}`);
@@ -10834,7 +11387,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         }
         if (event.sessionId) {
           this.sendToServer({ type: "agent:session", agentId, sessionId: event.sessionId, launchId: ap?.launchId || void 0 });
-          this.sendRuntimeProfileReport(agentId);
+          this.sendRuntimeProfileReport(agentId, "turn_end");
         }
         break;
       case "error": {
@@ -10847,7 +11400,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           if (runtimeErrorDiagnostics.spanAttrs.runtime_error_action_required === true) {
             visibleErrorMessage = formatRuntimeLoginRequiredMessage(ap.driver.id);
           }
-          const shouldDisableToolBoundaryFlush = ap.driver.busyDeliveryMode === "gated" && this.isThinkingBlockMutationError(event.message);
+          const shouldDisableToolBoundaryFlush = ap.runtime.descriptor.busyDelivery === "gated" && this.isThinkingBlockMutationError(event.message);
           const terminalFailure = classifyTerminalFailure(ap);
           const reduction = reduceApmGatedError(ap.gatedSteering, {
             disableToolBoundaryFlush: shouldDisableToolBoundaryFlush,
@@ -10878,11 +11431,11 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
             if (terminalFailure.actionRequired) {
               logger.warn(`[Agent ${agentId}] ${ap.driver.id} auth requires user action; terminating runtime process`);
               try {
-                this.processExitTraceAttrs.set(ap.process, {
+                this.runtimeExitTraceAttrs.set(ap.runtime, {
                   stop_source: "runtime_auth_error",
                   runtime_error_class: "AuthError"
                 });
-                ap.process.kill("SIGTERM");
+                void ap.runtime.stop({ signal: "SIGTERM", reason: "runtime_auth_error" });
               } catch (err) {
                 const reason = err instanceof Error ? err.message : String(err);
                 logger.warn(`[Agent ${agentId}] Failed to terminate ${ap.driver.id} after auth error: ${reason}`);
@@ -10907,8 +11460,10 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   recordRuntimeTelemetry(agentId, ap, event) {
     const sessionId = ap.driver.currentSessionId ?? event.sessionId;
     const payloadAttrs = sanitizeRuntimeTelemetryPayloadAttrs(event.attrs);
+    const versionAttrs = this.runtimeTelemetryVersionAttrs();
     const telemetryAttrs = {
       ...payloadAttrs,
+      ...versionAttrs,
       ...event.source ? { source: event.source } : {},
       ...event.usageKind ? { usageKind: event.usageKind } : {},
       ...sessionId ? { sessionId } : {},
@@ -10926,6 +11481,24 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     ap.runtimeTraceSpan?.addEvent(`runtime.telemetry.${event.name}`, telemetryAttrs);
     this.recordDaemonTrace(`daemon.runtime.telemetry.${event.name}`, attrs);
   }
+  runtimeTelemetryVersionAttrs() {
+    return {
+      ...this.daemonVersion ? {
+        daemonVersion: this.daemonVersion,
+        daemon_version: this.daemonVersion,
+        daemon_version_present: true
+      } : {
+        daemon_version_present: false
+      },
+      ...this.computerVersion ? {
+        computerVersion: this.computerVersion,
+        computer_version: this.computerVersion,
+        computer_version_present: true
+      } : {
+        computer_version_present: false
+      }
+    };
+  }
   sendAgentStatus(agentId, status, launchId) {
     this.sendToServer({ type: "agent:status", agentId, status, launchId: launchId || void 0 });
   }
@@ -11009,9 +11582,11 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
       ...projectionAttrs
     });
     logger.info(`[Agent ${agentId}] Sending stdin inbox update: ${inboxRows.length} changed target(s), ${inboxCount} pending message(s)`);
-    const encoded = ap.driver.encodeStdinMessage(notification, ap.sessionId, { mode: "busy" });
-    if (encoded) {
-      ap.process.stdin?.write(encoded + "\n");
+    const sendResult = requireImmediateRuntimeSendResult(
+      ap.runtime.send({ mode: "busy", text: notification, sessionId: ap.sessionId }),
+      "busy inbox notification"
+    );
+    if (sendResult.ok) {
       this.recordDaemonTrace("daemon.agent.inbox_update.pushed", {
         agentId,
         runtime: ap.config.runtime,
@@ -11036,14 +11611,17 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
       return true;
     } else {
       ap.notifications.add(count);
-      const retryScheduled = ap.driver.busyDeliveryMode === "direct" ? this.scheduleStdinNotification(agentId, ap, this.stdinNotificationRetryMs) : false;
+      const retryScheduled = ap.runtime.descriptor.busyDelivery === "direct" ? this.scheduleStdinNotification(agentId, ap, this.stdinNotificationRetryMs) : false;
+      const outcome = runtimeSendFailureOutcome(sendResult);
       this.recordDaemonTrace("daemon.agent.stdin_notification", {
         agentId,
         runtime: ap.config.runtime,
         model: ap.config.model,
         launchId: ap.launchId || void 0,
-        outcome: "encode_failed",
+        outcome,
         mode: "busy",
+        failure_reason: sendResult.reason,
+        failure_error: sendResult.error,
         pending_notification_count: count,
         retry_scheduled: retryScheduled,
         notification_timer_present: ap.notifications.hasTimer,
@@ -11094,8 +11672,11 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
       nativeStandingPrompt: Boolean(ap.driver.supportsNativeStandingPrompt)
     });
     this.recordRuntimeTraceEvent(agentId, ap, "runtime.input.prepared", inputTraceAttrs);
-    const encoded = ap.driver.encodeStdinMessage(prompt, ap.sessionId, { mode });
-    if (!encoded) {
+    const sendResult = requireImmediateRuntimeSendResult(
+      ap.runtime.send({ mode, text: prompt, sessionId: ap.sessionId }),
+      `${mode} inbox update`
+    );
+    if (!sendResult.ok) {
       if (mode === "idle") {
         this.commitApmIdleState(agentId, ap, true);
       }
@@ -11117,7 +11698,9 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
         ...this.messagesTraceAttrs(messages),
         ...inputTraceAttrs,
         ...projectionAttrs,
-        outcome: "encode_failed",
+        outcome: runtimeSendFailureOutcome(sendResult),
+        failure_reason: sendResult.reason,
+        failure_error: sendResult.error,
         requeued_messages_count: 0,
         cursors_advanced: "none"
       }, "error");
@@ -11130,7 +11713,6 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
     if (this.containsOrdinaryInboxMessage(messages)) {
       ap.lastRuntimeError = null;
     }
-    ap.process.stdin?.write(encoded + "\n");
     this.recordDaemonTrace("daemon.agent.stdin_delivery", {
       agentId,
       launchId: ap.launchId || void 0,
@@ -11153,7 +11735,7 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
     return true;
   }
   /** Deliver a message to an agent via stdin, formatting it the same way as the MCP bridge */
-  deliverMessagesViaStdin(agentId, ap, messages, mode) {
+  deliverMessagesViaStdin(agentId, ap, messages, mode, options = {}) {
     if (messages.length === 0) return true;
     const runtimeProfileMigrationMessages = messages.filter((message) => runtimeProfileNotificationFromMessage(message)?.kind === "migration");
     if (runtimeProfileMigrationMessages.length > 0) {
@@ -11191,8 +11773,10 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
       pending_notification_count: ap.notifications.pendingCount,
       busy_delivery_mode: ap.driver.busyDeliveryMode,
       supports_stdin_notification: ap.driver.supportsStdinNotification,
+      transient_delivery: options.transient === true,
       ...this.messagesTraceAttrs(messages)
     };
+    const traceSource = options.transient ? `stdin_${mode}_transient_delivery` : `stdin_${mode}_delivery`;
     const prompt = formatRuntimeProfileControlPrompt(messages) ?? (messages.length === 1 ? `New message received:
 
 ${formatIncomingMessage(messages[0], ap.driver)}
@@ -11205,16 +11789,21 @@ ${messages.map((message) => formatIncomingMessage(message, ap.driver)).join("\n"
 Respond as appropriate. Complete all your work before stopping.
 ${RESPONSE_TARGET_HINT}`);
     const inputTraceAttrs = buildRuntimeInputTraceAttrs({
-      source: `stdin_${mode}_delivery`,
+      source: traceSource,
       prompt,
       messages,
       sessionIdPresent: Boolean(ap.sessionId),
       nativeStandingPrompt: Boolean(ap.driver.supportsNativeStandingPrompt)
     });
     this.recordRuntimeTraceEvent(agentId, ap, "runtime.input.prepared", inputTraceAttrs);
-    const encoded = ap.driver.encodeStdinMessage(prompt, ap.sessionId, { mode });
-    if (!encoded) {
-      ap.inbox.unshift(...messages);
+    const sendResult = requireImmediateRuntimeSendResult(
+      ap.runtime.send({ mode, text: prompt, sessionId: ap.sessionId }),
+      `${mode} message delivery`
+    );
+    if (!sendResult.ok) {
+      if (!options.transient) {
+        ap.inbox.unshift(...messages);
+      }
       if (mode === "idle") {
         this.commitApmIdleState(agentId, ap, true);
       }
@@ -11224,12 +11813,16 @@ ${RESPONSE_TARGET_HINT}`);
       this.recordDaemonTrace("daemon.agent.stdin_delivery", {
         ...traceAttrs,
         ...inputTraceAttrs,
-        outcome: "encode_failed",
-        requeued_messages_count: messages.length
+        outcome: runtimeSendFailureOutcome(sendResult),
+        failure_reason: sendResult.reason,
+        failure_error: sendResult.error,
+        requeued_messages_count: options.transient ? 0 : messages.length
       }, "error");
       return false;
     }
-    this.consumeVisibleMessages(agentId, { messages, source: `stdin_${mode}_delivery` });
+    if (!options.transient) {
+      this.consumeVisibleMessages(agentId, { messages, source: traceSource });
+    }
     const senders = [...new Set(messages.map((message) => `@${message.sender_name}`))].join(", ");
     logger.info(
       `[Agent ${agentId}] Delivering ${mode} ${messages.length === 1 ? "message" : `${messages.length} messages`} via stdin from ${senders}`
@@ -11237,7 +11830,6 @@ ${RESPONSE_TARGET_HINT}`);
     if (this.containsOrdinaryInboxMessage(messages)) {
       ap.lastRuntimeError = null;
     }
-    ap.process.stdin?.write(encoded + "\n");
     this.ackInjectedRuntimeProfileMessages(agentId, messages, ap.launchId);
     this.recordDaemonTrace("daemon.agent.stdin_delivery", {
       ...traceAttrs,
@@ -12205,7 +12797,7 @@ var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
 var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels", "knowledge"];
 var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 = 3;
 var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2 = 250;
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -12241,9 +12833,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -12444,7 +13036,9 @@ var DaemonCore = class {
       serverUrl: options.serverUrl,
       defaultAgentEnvVarsProvider: options.defaultAgentEnvVarsProvider,
       slockCliPath: this.slockCliPath,
-      tracer: this.tracer
+      tracer: this.tracer,
+      daemonVersion: this.daemonVersion,
+      computerVersion: this.computerVersion
     };
     this.agentManager = options.agentManagerFactory ? options.agentManagerFactory(this.chatBridgePath, (msg) => connection.send(msg), options.apiKey, agentManagerOptions) : new AgentProcessManager(this.chatBridgePath, (msg) => connection.send(msg), options.apiKey, agentManagerOptions);
     const connectionFactory = options.connectionFactory ?? ((connOptions) => new DaemonConnection(connOptions));
@@ -12695,7 +13289,8 @@ var DaemonCore = class {
       msg.wakeMessage,
       msg.unreadSummary,
       msg.resumePrompt,
-      msg.launchId
+      msg.launchId,
+      msg.wakeMessageTransient ?? false
     );
   }
   handleMessage(msg) {
@@ -12746,7 +13341,10 @@ var DaemonCore = class {
         logger.info(`[Agent ${msg.agentId}] Delivery received (seq=${msg.seq}, from=@${msg.message.sender_name}, target=${formatChannelTarget(msg)})`);
         try {
           span.addEvent("daemon.receive", { seq: msg.seq, deliveryId: msg.deliveryId });
-          const acceptedOrPromise = this.agentManager.deliverMessage(msg.agentId, msg.message, { deliveryId: msg.deliveryId });
+          const acceptedOrPromise = this.agentManager.deliverMessage(msg.agentId, msg.message, {
+            deliveryId: msg.deliveryId,
+            transient: msg.transient ?? false
+          });
           Promise.resolve(acceptedOrPromise).then((accepted) => {
             span.addEvent("daemon.deliver_to_agent_manager", { accepted });
             if (!accepted) {
@@ -12976,6 +13574,7 @@ var DaemonCore = class {
           agentId: report.agentId,
           launchId: report.launchId || void 0,
           runtime: report.facts.runtime,
+          report_source: "connect",
           model_present: Boolean(report.facts.model),
           session_ref_present: Boolean(report.facts.sessionRef),
           workspace_ref_present: Boolean(report.facts.workspaceRef || report.facts.workspacePathRef)
@@ -12986,7 +13585,8 @@ var DaemonCore = class {
         agentId: report.agentId,
         facts: report.facts,
         launchId: report.launchId || void 0,
-        traceparent: formatTraceparent(span.context)
+        traceparent: formatTraceparent(span.context),
+        source: "connect"
       });
       span.end("ok");
     }
@@ -13010,6 +13610,8 @@ var DaemonCore = class {
 };
 
 export {
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,