@slock-ai/daemon 0.57.3 → 0.57.5-play.20260611173452

package/dist/{chunk-H2QU4LAU.js → chunk-NHANGBTA.js}

@@ -1,6 +1,6 @@
 // src/core.ts
-import path15 from "path";
-import os7 from "os";
+import path16 from "path";
+import os8 from "os";
 import { createRequire as createRequire2 } from "module";
 import { accessSync } from "fs";
 import { fileURLToPath } from "url";
@@ -1058,6 +1058,143 @@ function shortMessageId(value) {
   return value.slice(0, 8);
 }
 
+// ../shared/src/externalAgentIntegration.ts
+import { z as z2 } from "zod";
+var EXTERNAL_AGENT_COMMS_PROTOCOL_VERSION = "agent-comms-core.v1";
+var EXTERNAL_AGENT_PROOF_SCHEMA_VERSION = "agent-proof.v1";
+var EXTERNAL_RUNTIME_INTEGRATION_MANIFEST_SCHEMA = "slock-external-runtime-integration.v1";
+var EXTERNAL_AGENT_WAKE_EVENT_SCHEMA = "slock-external-agent-wake-event.v1";
+var externalAgentCommsModeValues = ["spawn-core", "attach-core", "import-core"];
+var externalAgentIntegrationPatternValues = ["external-harness-plugin", "integrated-runtime"];
+var externalAgentIsolationValues = ["profile-scoped", "session-scoped"];
+var externalAgentWakeAdapterKindValues = ["claude-code-channels", "hermes-in-process"];
+var externalAgentWakeProofLevelValues = [
+  "server_delivered",
+  "harness_accepted",
+  "wake_injected"
+];
+var externalAgentProofLevelValues = [
+  ...externalAgentWakeProofLevelValues,
+  "model_seen"
+];
+var externalAgentCommsLifecycleStateValues = [
+  "unbound",
+  "bound_stopped",
+  "starting",
+  "connected_replaying",
+  "listening_idle",
+  "handoff_pending",
+  "degraded_backoff",
+  "stopping",
+  "stopped",
+  "auth_revoked"
+];
+var externalAgentLifecycleSourceValues = ["server_core", "comms_core", "wake_adapter", "server"];
+var externalAgentLifecycleProvenanceValues = [
+  "slock_core",
+  "adapter_observed",
+  "agent_reported"
+];
+var externalAgentAdapterFailureValues = [
+  "no_session",
+  "busy",
+  "injection_failed",
+  "protocol_mismatch",
+  "auth_revoked"
+];
+var externalAgentServerApiModeValues = ["interim-agent-api-events", "agent-inbox-protocol"];
+var nonEmptyStringSchema = z2.string().min(1);
+var isoTimestampSchema = z2.string().refine((value) => !Number.isNaN(Date.parse(value)), {
+  message: "must be a parseable timestamp"
+});
+var externalRuntimeIntegrationManifestSchema = z2.object({
+  schema: z2.literal(EXTERNAL_RUNTIME_INTEGRATION_MANIFEST_SCHEMA),
+  runtimeId: nonEmptyStringSchema,
+  integrationPattern: z2.enum(externalAgentIntegrationPatternValues),
+  commsMode: z2.enum(externalAgentCommsModeValues),
+  commsProtocolVersion: z2.literal(EXTERNAL_AGENT_COMMS_PROTOCOL_VERSION),
+  proofSchemaVersion: z2.literal(EXTERNAL_AGENT_PROOF_SCHEMA_VERSION),
+  minSlockCliVersion: nonEmptyStringSchema,
+  multiplex: z2.boolean(),
+  agentIsolation: z2.enum(externalAgentIsolationValues),
+  bridgeLifecycle: z2.object({
+    explicitStartOnly: z2.literal(true),
+    oneShotCommandsBridgeIndependent: z2.literal(true),
+    requiresBridgeFailureCodes: z2.array(z2.enum(["BRIDGE_NOT_RUNNING", "NO_CORE_SESSION"])).min(1),
+    autoStartDefault: z2.literal(false)
+  }).strict(),
+  serverApi: z2.object({
+    mode: z2.enum(externalAgentServerApiModeValues),
+    deliveryOnly: z2.boolean(),
+    cursorAuthority: z2.literal("model_seen_only")
+  }).strict(),
+  wakeAdapter: z2.object({
+    kind: z2.enum(externalAgentWakeAdapterKindValues),
+    protocol: nonEmptyStringSchema,
+    requiresInteractiveSession: z2.boolean().optional()
+  }).strict()
+}).strict().superRefine((value, ctx) => {
+  if (!value.bridgeLifecycle.requiresBridgeFailureCodes.includes("BRIDGE_NOT_RUNNING")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["bridgeLifecycle", "requiresBridgeFailureCodes"],
+      message: "bridge-dependent surfaces must include BRIDGE_NOT_RUNNING"
+    });
+  }
+  if (!value.bridgeLifecycle.requiresBridgeFailureCodes.includes("NO_CORE_SESSION")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["bridgeLifecycle", "requiresBridgeFailureCodes"],
+      message: "bridge-dependent surfaces must include NO_CORE_SESSION"
+    });
+  }
+  if (value.serverApi.mode === "interim-agent-api-events" && value.serverApi.deliveryOnly !== true) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["serverApi", "deliveryOnly"],
+      message: "interim agent-api events mode must be delivery-only"
+    });
+  }
+});
+var externalAgentWakeEventBaseSchema = z2.object({
+  schema: z2.literal(EXTERNAL_AGENT_WAKE_EVENT_SCHEMA),
+  eventId: nonEmptyStringSchema,
+  attemptId: nonEmptyStringSchema,
+  messageId: nonEmptyStringSchema,
+  agentId: nonEmptyStringSchema,
+  profile: nonEmptyStringSchema,
+  coreSessionId: nonEmptyStringSchema,
+  adapterInstance: nonEmptyStringSchema,
+  runtimeSession: nonEmptyStringSchema.nullable(),
+  occurredAt: isoTimestampSchema,
+  lifecycleState: z2.enum(externalAgentCommsLifecycleStateValues),
+  authority: z2.object({
+    source: z2.enum(externalAgentLifecycleSourceValues),
+    provenance: z2.enum(externalAgentLifecycleProvenanceValues)
+  }).strict()
+}).strict();
+var externalAgentProofEventEnvelopeSchema = externalAgentWakeEventBaseSchema.extend({
+  kind: z2.literal("proof"),
+  proofLevel: z2.enum(externalAgentWakeProofLevelValues),
+  outcome: z2.literal("ok"),
+  failureMeta: z2.undefined().optional(),
+  reason: z2.string().optional()
+});
+var externalAgentFailedWakeEventEnvelopeSchema = externalAgentWakeEventBaseSchema.extend({
+  kind: z2.literal("wake_attempt"),
+  proofLevel: z2.undefined().optional(),
+  outcome: z2.literal("failed"),
+  failureMeta: z2.object({
+    failureClass: z2.enum(externalAgentAdapterFailureValues),
+    retryAfterMs: z2.number().int().positive().optional()
+  }).strict(),
+  reason: nonEmptyStringSchema
+});
+var externalAgentWakeEventEnvelopeSchema = z2.discriminatedUnion("kind", [
+  externalAgentProofEventEnvelopeSchema,
+  externalAgentFailedWakeEventEnvelopeSchema
+]);
+
 // ../shared/src/translationLanguages.ts
 var SUPPORTED_TRANSLATION_LANGUAGE_CODES = [
   "en",
@@ -1164,6 +1301,7 @@ var RUNTIME_MODELS = {
     { id: "claude-opus-4-8", label: "Claude Opus 4.8" },
     { id: "claude-opus-4-7", label: "Claude Opus 4.7" },
     { id: "claude-opus-4-6", label: "Claude Opus 4.6" },
+    { id: "fable", label: "Claude Fable" },
     { id: "sonnet", label: "Claude Sonnet" },
     { id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6" },
     { id: "haiku", label: "Claude Haiku" },
@@ -1366,11 +1504,11 @@ var DISPLAY_PLAN_CONFIG = {
 };
 
 // src/agentProcessManager.ts
-import { mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync4 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2 } from "fs/promises";
 import { createHash as createHash3 } from "crypto";
-import path11 from "path";
-import os5 from "os";
+import path12 from "path";
+import os6 from "os";
 
 // src/drivers/claude.ts
 import { spawn } from "child_process";
@@ -1704,9 +1842,6 @@ function buildSlockCliGuideSections(options) {
 }
 
 // src/drivers/systemPrompt.ts
-function toolRef(prefix, name) {
-  return `${prefix}${name}`;
-}
 function runtimeContextLines(config) {
   const ctx = config.runtimeContext;
   if (!ctx) return [];
@@ -1728,10 +1863,8 @@ function runtimeContextLines(config) {
   if (ctx.workspacePath) lines.push(`- Workspace: ${ctx.workspacePath}`);
   return lines.length > 4 ? lines : [];
 }
-function buildPrompt(config, variant, opts) {
-  const isCli = variant === "cli";
-  const t = (name) => toolRef(opts.toolPrefix, name);
-  const taskClaimCmd = isCli ? "`slock task claim`" : `\`${t("claim_tasks")}\``;
+function buildPrompt(config, opts) {
+  const taskClaimCmd = "`slock task claim`";
   const cliGuideSections = buildSlockCliGuideSections({
     // The daemon prompt audience is always managed-runner regardless of
     // CLI vs MCP variant — both are daemon-spawned. The self-hosted-runner
@@ -1743,162 +1876,42 @@ function buildPrompt(config, variant, opts) {
     },
     taskClaimCmd
   });
-  const sendCmd = isCli ? "`slock message send`" : `\`${t("send_message")}\``;
-  const readCmd = isCli ? "`slock message read`" : `\`${t("read_history")}\``;
-  const checkCmd = isCli ? "`slock message check`" : `\`${t("check_messages")}\``;
-  const inboxCheckCmd = isCli ? "`slock inbox check`" : checkCmd;
-  const taskCreateCmd = isCli ? "`slock task create`" : `\`${t("create_tasks")}\``;
-  const taskUpdateCmd = isCli ? "`slock task update`" : `\`${t("update_task_status")}\``;
-  const serverInfoCmd = isCli ? "`slock server info`" : `\`${t("list_server")}\``;
-  const scheduleReminderCmd = isCli ? "`slock reminder schedule`" : `\`${t("schedule_reminder")}\``;
-  const listRemindersCmd = isCli ? "`slock reminder list`" : `\`${t("list_reminders")}\``;
-  const cancelReminderCmd = isCli ? "`slock reminder cancel`" : `\`${t("cancel_reminder")}\``;
+  const checkCmd = "`slock message check`";
+  const inboxCheckCmd = "`slock inbox check`";
   const messageDeliveryText = opts.includeStdinNotificationSection ? "New messages may be delivered to you automatically while your process stays alive." : "The daemon will automatically restart you when new messages arrive.";
-  const criticalRules = isCli ? [
+  const noConcreteMessageStartupStep = opts.includeStdinNotificationSection ? `3. If there is no concrete incoming message to handle, but this turn includes a Slock inbox notice, treat it as a wake signal: call ${checkCmd} to read the pending message content before deciding there is no work. If there is neither a concrete message nor an inbox notice, stop and wait. ${messageDeliveryText}` : `3. If there is no concrete incoming message to handle, stop and wait. ${messageDeliveryText}`;
+  const criticalRules = [
     "- Always communicate through `slock` CLI commands. This is your only output channel: text you produce outside a `slock` command is not delivered to anyone.",
     ...opts.extraCriticalRules,
     "- Use only the provided `slock` CLI commands for messaging.",
     "- Do not combine multiple `slock` CLI commands in one shell command. Run one `slock` command per tool call, read its output, then decide the next command.",
     "- Always claim a task via `slock task claim` before starting work on it. If the claim fails, move on to a different task."
-  ] : [
-    `- Always communicate through ${sendCmd}. This is your only output channel: text you produce outside a messaging tool is not delivered to anyone.`,
-    ...opts.extraCriticalRules,
-    "- Use only the provided MCP tools for messaging \u2014 they are already available and ready.",
-    `- Always claim a task via ${taskClaimCmd} before starting work on it. If the claim fails, move on to a different task.`
   ];
   const runtimeProfileControl = config.runtimeProfileControl?.kind === "daemon_release_notice" ? config.runtimeProfileControl : null;
   const runtimeProfileControlStartupStep = runtimeProfileControl ? [
     "0. If this system prompt contains a **Runtime Profile Control** section, read that notice first. It is informational only; no runtime control action or chat reply is required. Do not read MEMORY.md, check messages, or respond to inbox messages before reading it."
   ] : [];
-  const startupSteps = isCli ? [
+  const startupSteps = [
     ...runtimeProfileControlStartupStep,
     "1. If this turn already includes a concrete incoming message, first decide whether that message needs a visible acknowledgment, blocker question, or ownership signal. If it does, send it early with `slock message send` before deep context gathering.",
     "2. Read MEMORY.md (in your cwd) and then only the additional memory/files you need to handle the current turn well.",
-    `3. If there is no concrete incoming message to handle, stop and wait. ${messageDeliveryText}`,
+    noConcreteMessageStartupStep,
     "4. When you receive a message, process it and reply with `slock message send`.",
     "5. **Complete ALL your work before stopping.** If a task requires multi-step work (research, code changes, testing), finish everything, report results, then stop. New messages arrive automatically \u2014 you do not need to poll or wait for them."
-  ] : [
-    ...runtimeProfileControlStartupStep,
-    `1. If this turn already includes a concrete incoming message, first decide whether that message needs a visible acknowledgment, blocker question, or ownership signal. If it does, send it early with ${sendCmd} before deep context gathering.`,
-    "2. Read MEMORY.md (in your cwd) and then only the additional memory/files you need to handle the current turn well.",
-    `3. If there is no concrete incoming message to handle, stop and wait. ${messageDeliveryText}`,
-    `4. When you receive a message, process it and reply with ${sendCmd}.`,
-    "5. **Complete ALL your work before stopping.** If a task requires multi-step work (research, code changes, testing), finish everything, report results, then stop. New messages arrive automatically \u2014 you do not need to poll or wait for them."
   ];
-  const communicationSection = isCli ? cliGuideSections.communication : `## Communication \u2014 MCP tools ONLY
-
-You have MCP tools from the "chat" server. Use ONLY these for communication:
-
-1. **${checkCmd}** \u2014 Non-blocking check for new messages. Use freely during work \u2014 at natural breakpoints or after notifications.
-2. **${sendCmd}** \u2014 Send a message to a channel or DM.
-3. **${serverInfoCmd}** \u2014 List all channels in this server, which ones you have joined, plus all agents and humans.
-4. **\`${t("join_channel")}\`** \u2014 Join a visible public channel. This only affects your own agent membership.
-5. **\`${t("leave_channel")}\`** \u2014 Leave a regular channel you have joined. This only affects your own agent membership.
-6. **${readCmd}** \u2014 Read past messages from a channel, DM, or thread. Supports \`before\` / \`after\` pagination and \`around\` for centered context.
-7. **\`${t("search_messages")}\`** \u2014 Search messages visible to you, then inspect a hit with ${readCmd}.
-8. **\`${t("list_tasks")}\`** \u2014 View a channel's task board.
-9. **${taskCreateCmd}** \u2014 Create new task-messages in a channel (supports batch titles; equivalent to sending a new message and publishing it as a task-message, not claiming it for yourself).
-10. **${taskClaimCmd}** \u2014 Claim tasks by number or message ID (supports batch, handles conflicts).
-11. **\`${t("unclaim_task")}\`** \u2014 Release your claim on a task.
-12. **${taskUpdateCmd}** \u2014 Change a task's status (e.g. to in_review or done).
-13. **\`${t("upload_file")}\`** \u2014 Upload a file up to 50MB to attach to a message. Returns an attachment ID to pass to ${sendCmd}. Videos are downloadable attachments and are not parsed by agents; large PDFs may need to be downloaded and inspected in smaller chunks.
-14. **\`${t("view_file")}\`** \u2014 Download an attached file by its attachment ID so you can inspect it locally.
-15. **${scheduleReminderCmd}** \u2014 Schedule a reminder for yourself later, at a specific time, or on a recurring cadence.
-16. **${listRemindersCmd}** \u2014 List your reminders.
-17. **${cancelReminderCmd}** \u2014 Cancel one of your reminders by ID.`;
-  const credentialHygieneSection = isCli ? cliGuideSections.credentialHygiene : `### Credential hygiene
-
-**Never paste credentials into public Slock channels, public-channel threads, or public-channel task/attachment fields.** Agent tokens (\`sk_agent_*\`), legacy machine API keys (\`sk_machine_*\`), session bearers, JWTs, \`.env\` files, or \`credential.json\` contents must not appear in public channel chat. DMs and private channels are allowed for authorized secret handoff, but verify the audience first. If you accidentally paste one into a public channel, immediately tell the credential owner so they can rotate it.
-
-If a tool or error output contains credential-shaped strings, redact them to \`sk_agent_<redacted>\` / \`sk_machine_<redacted>\` shape before posting to a public channel.`;
-  const reminderSection = isCli ? cliGuideSections.reminders : `### Reminders
-
-Use reminders for follow-up that depends on future state you cannot resolve now, whether user-requested or self-driven. A reminder is an author-owned, persistent, observable, snoozable, updatable, and cancelable wake-up signal anchored to a Slock message or thread; when it fires, it wakes the author who scheduled it, not other people. If anchored to a message or thread, the receipt/fire system message is visible in that surface, but wake ownership does not transfer. To notify another human or agent later, schedule your own reminder and then @mention them when it fires. Use reminders instead of keeping the current turn alive with a long sleep or relying on MEMORY to wake you. If you expect the wait to finish within about 1 minute, you may briefly poll, but say so in the relevant thread first.
-When a reminder already exists, prefer \`slock reminder snooze\` to push it later, \`slock reminder update\` to change its meaning or schedule, and \`slock reminder cancel\` only when it is truly no longer needed.
-Use ${scheduleReminderCmd} rather than runtime-native wake or cron tools such as ScheduleWakeup or CronCreate for user-visible reminders, so reminders stay author-owned, persistent, observable, snoozable, updatable, and cancelable in Slock.
-Create agent reminders only after resolving the anchor message from the current conversation and passing its msgId explicitly; if no anchor can be resolved, consider posting a status update in the relevant thread so the intent is visible, then revisit when context is available.`;
-  const sendingMessagesSection = isCli ? cliGuideSections.sendingMessages : `### Sending messages
-
-- **Reply to a channel**: \`${t("send_message")}(target="#channel-name", content="...")\`
-- **Reply to a DM**: \`${t("send_message")}(target="dm:@peer-name", content="...")\`
-- **Reply in a thread**: \`${t("send_message")}(target="#channel:shortid", content="...")\` or \`${t("send_message")}(target="dm:@peer:shortid", content="...")\`
-- **Start a NEW DM**: \`${t("send_message")}(target="dm:@person-name", content="...")\`
-
-**IMPORTANT**: To reply to any message, always reuse the exact \`target\` from the received message. This ensures your reply goes to the right place \u2014 whether it's a channel, DM, or thread.`;
-  const threadsSection = isCli ? cliGuideSections.threads : `### Threads
-
-Threads are sub-conversations attached to a specific message. They let you discuss a topic without cluttering the main channel.
-
-- **Thread targets** have a colon and short ID suffix: \`#general:00000000\` (thread in #general) or \`dm:@richard:11111111\` (thread in a DM).
-- When you receive a message from a thread (the target has a \`:shortid\` suffix), **always reply using that same target** to keep the conversation in the thread.
-- **Start a new thread**: Use the \`msg=\` field from the header as the thread suffix. For example, if you see \`[target=#general msg=00000000 ...]\`, call \`${t("send_message")}(target="#general:00000000", content="...")\`. The thread will be auto-created if it doesn't exist yet. Example IDs like \`00000000\` are placeholders; real message IDs come from received messages.
-- When you send a message, the response includes the message ID. You can use it to start a thread on your own message.
-- You can read thread history via ${readCmd} with the same thread target.
-- Threads cannot be nested \u2014 you cannot start a thread inside a thread.`;
-  const discoverySection = isCli ? cliGuideSections.discovery : `### Discovering people and channels
-
-Call ${serverInfoCmd} to see all channels in this server, which ones you have joined, other agents, and humans.
-Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with ${readCmd}, but you cannot send messages there or receive ordinary channel delivery until you join with \`${t("join_channel")}\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`${t("leave_channel")}\`.
-Private channels are membership-gated. If ${serverInfoCmd} shows a channel as private, treat its name, members, and content as private to that channel; do not disclose that information in other channels, DMs, summaries, or task reports unless a human explicitly asks within an authorized context. In channel member listings, human role labels such as owner/admin show server-level authority; no role label means ordinary member.`;
-  const channelAwarenessSection = isCli ? cliGuideSections.channelAwareness : `### Channel awareness
-
-Each channel has a **name** and optionally a **description** that define its purpose (visible via ${serverInfoCmd}). Respect them:
-- **Reply in context** \u2014 always respond in the channel/thread the message came from.
-- **Stay on topic** \u2014 when proactively sharing results or updates, post in the channel most relevant to the work. Don't scatter messages across unrelated channels.
-- If unsure where something belongs, call ${serverInfoCmd} to review channel descriptions.`;
-  const thirdPartyIntegrationsSection = isCli ? `### Third-party integrations
-
-If a built-in Slock app or registered third-party service requires login, use Slock Agent Login through the CLI instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app or built-in Slock app, first run \`slock integration list\` and match the app to a listed service before browsing the app. Use \`slock integration login --service <service>\` to provision or reuse your agent login for that service. If the service exposes an agent behavior manifest and you need to run its local CLI, run \`slock integration env --service <service>\` before invoking that CLI; if it prints exports, apply them first so service credentials stay under a per-agent profile HOME/XDG tree instead of the host user's global HOME. If it reports that no local env is required, do not invent HOME/XDG overrides. If it fails, do not run that local CLI with the host user's HOME; report that the service manifest is unsupported. Slock does not execute commands from remote manifests automatically. If the CLI reports that the \`integration\` command is unknown, the local daemon/CLI is too old for Slock Agent Login; report that the machine must be upgraded/restarted instead of calling internal HTTP endpoints yourself. When the command returns \`Agent login ready\` or \`Already logged in\`, the agent-side login is ready. If the output includes an app URL, open that URL as the service-provided app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow, use internal request IDs as OAuth callback codes, call internal Slock integration endpoints directly, or call third-party exchange endpoints unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use \`slock profile show\`. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the listed service / Slock Agent Login path.` : `### Third-party integrations
-
-If a built-in Slock app or registered third-party service requires login, use Slock Agent Login through the available registered-service interface instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app or built-in Slock app, first inspect the registered-service interface and match the app to a listed service before browsing the app. Once the registered-service interface reports the agent login is ready, the agent-side login is ready. If that interface provides an app URL, use it as the service-provided app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow or treat internal request IDs as OAuth callback codes unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use your Slock profile view. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the listed service / Slock Agent Login path.`;
-  const readingHistorySection = isCli ? cliGuideSections.readingHistory : `### Reading history
-
-Use ${readCmd} with the \`channel\` parameter set to \`"#channel-name"\`, \`"dm:@peer-name"\`, or a thread target like \`"#channel:shortid"\`.
-
-To jump directly to a specific hit with nearby context, pass \`around\` set to a message ID or seq number.`;
-  const historicalReferenceSection = isCli ? cliGuideSections.historicalReferences : `### Historical references
-
-When a user refers to prior Slock discussion and the relevant context is not already available, first use \`${t("search_messages")}\` and ${readCmd} to find the original thread, decision, or owner before answering. If you find it, summarize the original conclusion with the source thread/message; if you cannot find it, say that explicitly.`;
-  const tasksSection = isCli ? cliGuideSections.tasks : `### Tasks
-
-When someone sends a message that asks you to do something \u2014 fix a bug, write code, review a PR, deploy, investigate an issue \u2014 that is work. Claim it before you start.
-
-**Decision rule:** if fulfilling a message requires you to take action beyond just replying (running tools, writing code, making changes), claim the message first. If you're only answering a question or having a conversation, no claim needed.
-
-**What you see in messages:**
-- A message already marked as a task: \`@Alice: Fix the login bug [task #3 status=in_progress]\`
-- A regular message (no task suffix): \`@Alice: Can someone look into the login bug?\`
-- A system notification about task changes: \`\u{1F4CB} Alice converted a message to task #3 "Fix the login bug"\`
-
-Only top-level channel / DM messages can become tasks. Messages inside threads are discussion context \u2014 reply there, but keep claims and conversions to top-level messages.
-
-${readCmd} shows messages in their current state. If a message was later converted to a task, it will show the \`[task #N ...]\` suffix.
-
-**Status flow:** \`todo\` \u2192 \`in_progress\` \u2192 \`in_review\` \u2192 \`done\`
-
-**Assignee** is independent from status \u2014 a task can be claimed or unclaimed at any status except \`done\`.
-
-**Workflow:**
-1. Receive a message that requires action \u2192 claim it first (by task number if already a task, or by message ID if it's a regular message)
-2. If the claim fails, someone else is working on it \u2014 move on to another task
-3. Post updates in the task's thread via ${sendCmd} with \`target="#channel:msgShortId"\`
-4. When done, set status to \`in_review\` so a human can validate via ${taskUpdateCmd}
-5. After approval (e.g. "looks good", "merge it"), set status to \`done\`
-
-**What ${taskCreateCmd} really means:**
-- Tasks live in the same chat flow as messages. A task is just a message with task metadata, not a separate source of truth.
-- ${taskCreateCmd} is a convenience helper for a specific sequence: create a brand-new message, then publish that new message as a task-message.
-- ${taskCreateCmd} only creates the task \u2014 to own it, call ${taskClaimCmd} afterward.
-- Typical uses for ${taskCreateCmd} are breaking down a larger task into parallel subtasks, or batch-creating genuinely new work for others to claim.
-- If someone already sent the work item as a message, just claim that existing message/task instead of creating a new one.
-- If the work already exists as a message, reuse it via ${taskClaimCmd} with the message ID.
-
-**Creating new tasks:**
-- The task system exists to prevent duplicate work. If you see an existing task for the work, either claim that task or leave it alone.
-- If a message already shows a \`[task #N ...]\` suffix, claim \`#N\` if it is yours to take; otherwise move on.
-- Before calling ${taskCreateCmd}, first check whether the work already exists on the task board or is already being handled.
-- Reuse existing tasks and threads instead of creating duplicates.
-- Use ${taskCreateCmd} only for genuinely new subtasks or follow-up work that does not already have a canonical task.`;
+  const communicationSection = cliGuideSections.communication;
+  const credentialHygieneSection = cliGuideSections.credentialHygiene;
+  const reminderSection = cliGuideSections.reminders;
+  const sendingMessagesSection = cliGuideSections.sendingMessages;
+  const threadsSection = cliGuideSections.threads;
+  const discoverySection = cliGuideSections.discovery;
+  const channelAwarenessSection = cliGuideSections.channelAwareness;
+  const thirdPartyIntegrationsSection = `### Third-party integrations
+
+If a built-in Slock app or registered third-party service requires login, use Slock Agent Login through the CLI instead of asking the human to copy tokens or complete human OAuth for you. If a human asks you to sign into, open, use, or fetch identity from a third-party app or built-in Slock app, first run \`slock integration list\` and match the app to a listed service before browsing the app. Use \`slock integration login --service <service>\` to provision or reuse your agent login for that service. If the service exposes an agent behavior manifest and you need to run its local CLI, run \`slock integration env --service <service>\` before invoking that CLI; if it prints exports, apply them first so service credentials stay under a per-agent profile HOME/XDG tree instead of the host user's global HOME. If it reports that no local env is required, do not invent HOME/XDG overrides. If it fails, do not run that local CLI with the host user's HOME; report that the service manifest is unsupported. Slock does not execute commands from remote manifests automatically. If the CLI reports that the \`integration\` command is unknown, the local daemon/CLI is too old for Slock Agent Login; report that the machine must be upgraded/restarted instead of calling internal HTTP endpoints yourself. When the command returns \`Agent login ready\` or \`Already logged in\`, the agent-side login is ready. If the output includes an app URL, open that URL as the service-provided app surface; it should look like the service's normal Login with Slock callback and not require you to understand Slock's internal grant/request protocol. Do not crawl third-party routes looking for a session before trying the registered-service login path. Do not open the human \`Login with Slock\` browser flow, use internal request IDs as OAuth callback codes, call internal Slock integration endpoints directly, or call third-party exchange endpoints unless a human explicitly asks you to debug that server-to-server protocol. If the service or human asks for your Slock Agent identity card, use \`slock profile show\`. Third-party pages may show \`Login with Slock\`; for agent-facing access, prefer the listed service / Slock Agent Login path.`;
+  const readingHistorySection = cliGuideSections.readingHistory;
+  const historicalReferenceSection = cliGuideSections.historicalReferences;
+  const tasksSection = cliGuideSections.tasks;
   let prompt = `You are "${config.displayName || config.name}", an AI agent in Slock \u2014 a collaborative platform for human-AI collaboration, serving as a shared message service for humans and agents who may be running on different computers.
 
 ## Who you are
@@ -2012,10 +2025,11 @@ While you are working, the daemon may write a batched, content-free inbox update
 
 How to handle these:
 - Treat the notification as a non-urgent signal that new Slock messages are waiting; it does not include the message content and does not require an immediate interruption.
-- Keep working until a natural breakpoint. If you then choose to inspect pending targets, call ${inboxCheckCmd}; use ${checkCmd} / ${readCmd} when you choose to inspect message content.
+- If an inbox notice is the only input that woke this turn, call ${checkCmd} to read the pending message content before deciding there is no action to take.
+- Keep working until a natural breakpoint. If you then choose to inspect pending targets, call ${inboxCheckCmd}; use ${checkCmd} / \`slock message read\` when you choose to inspect message content.
 - If a message you explicitly read is higher priority, pivot to it. If not, continue your current work.`;
     } else {
-      const notifyExample = isCli ? `\`[Slock inbox notice:\\nInbox update: N unread messages total; M changed targets\\n#channel  pending: K messages ...]\`` : `\`[Slock inbox notice:\\nInbox update: N unread messages total; M changed targets\\n#channel  pending: K messages ...]\``;
+      const notifyExample = `\`[Slock inbox notice:\\nInbox update: N unread messages total; M changed targets\\n#channel  pending: K messages ...]\``;
       prompt += `
 
 ## Message Notifications
@@ -2026,7 +2040,8 @@ ${notifyExample}
 
 How to handle these:
 - The notice is target-scoped and content-free. Its header may show total unread/pending count, while detail rows list the targets changed by this update; it never includes message bodies.
-- Do not interrupt the current step just because a notice arrived. At a natural breakpoint, call ${inboxCheckCmd} if you choose to inspect pending targets, or use ${checkCmd} / ${readCmd} when you choose to inspect message content.
+- If an inbox notice is the only input that woke this turn, call ${checkCmd} to read the pending message content before deciding there is no action to take.
+- Do not interrupt the current step just because a notice arrived. At a natural breakpoint, call ${inboxCheckCmd} if you choose to inspect pending targets, or use ${checkCmd} / \`slock message read\` when you choose to inspect message content.
 - If a message you explicitly read is higher priority, you may pivot to it. If not, continue your current work.`;
     }
   }
@@ -2039,7 +2054,7 @@ ${config.description}. This may evolve.`;
   return prompt;
 }
 function buildCliSystemPrompt(config, opts) {
-  return buildPrompt(config, "cli", opts);
+  return buildPrompt(config, opts);
 }
 
 // src/slockHome.ts
@@ -2081,6 +2096,19 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -3567,7 +3595,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var cachedOpencliBinPath;
 function resolveOpencliBinPath() {
@@ -3782,7 +3812,7 @@ exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(opencliBinPath)} "
     ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -4211,7 +4241,7 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync2;
   if (platform === "win32") {
@@ -4237,7 +4267,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -4331,6 +4361,52 @@ function buildClaudeSpawnSpec(claudeCommand, platform = process.platform) {
   };
 }
 
+// src/drivers/claudeProviderIsolation.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, symlinkSync } from "fs";
+import os2 from "os";
+import path5 from "path";
+function isClaudeCustomProviderConfig(config) {
+  const launchRuntimeFields = runtimeConfigToLaunchFields(config);
+  return launchRuntimeFields.runtime === "claude" && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_BASE_URL) && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_API_KEY);
+}
+function getClaudeProviderStatePaths(workingDirectory) {
+  const root = path5.join(workingDirectory, ".slock", "claude-provider");
+  const home = path5.join(root, "home");
+  return {
+    root,
+    home,
+    configDir: path5.join(home, ".claude")
+  };
+}
+function linkIfPresent(source, target) {
+  try {
+    if (!existsSync3(source) || existsSync3(target)) return;
+    mkdirSync2(path5.dirname(target), { recursive: true, mode: 448 });
+    symlinkSync(source, target, "dir");
+  } catch {
+  }
+}
+function ensureClaudeProviderStatePaths(workingDirectory, hostClaudeHome = path5.join(os2.homedir(), ".claude")) {
+  const paths = getClaudeProviderStatePaths(workingDirectory);
+  mkdirSync2(paths.home, { recursive: true, mode: 448 });
+  mkdirSync2(paths.configDir, { recursive: true, mode: 448 });
+  linkIfPresent(path5.join(hostClaudeHome, "skills"), path5.join(paths.configDir, "skills"));
+  linkIfPresent(path5.join(hostClaudeHome, "commands"), path5.join(paths.configDir, "commands"));
+  return paths;
+}
+function buildClaudeProviderIsolationEnv(ctx) {
+  if (!isClaudeCustomProviderConfig(ctx.config)) {
+    return {};
+  }
+  const paths = ensureClaudeProviderStatePaths(ctx.workingDirectory);
+  return {
+    HOME: paths.home,
+    USERPROFILE: paths.home,
+    CLAUDE_CONFIG_DIR: paths.configDir,
+    CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST: "1"
+  };
+}
+
 // src/drivers/claude.ts
 var ClaudeDriver = class {
   id = "claude";
@@ -4351,8 +4427,6 @@ var ClaudeDriver = class {
     toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = true;
-  mcpToolPrefix = "";
-  usesSlockCliForCommunication = true;
   // Claude Code supports same-turn steering, but raw stdin injection at an
   // arbitrary busy instant can collide with active signed thinking blocks. The
   // daemon therefore gates busy delivery on Claude stream-json boundaries.
@@ -4366,7 +4440,10 @@ var ClaudeDriver = class {
     return buildClaudeArgs(config, opts);
   }
   async spawn(ctx) {
-    const { slockDir, tokenFile, spawnEnv } = await prepareCliTransport(ctx);
+    const { slockDir, tokenFile, spawnEnv } = await prepareCliTransport(
+      ctx,
+      buildClaudeProviderIsolationEnv(ctx)
+    );
     const systemPromptPath = writeClaudeSystemPromptFile(ctx.standingPrompt, slockDir);
     const args = this.buildClaudeArgs(ctx.config, {
       standingPromptFilePath: systemPromptPath
@@ -4412,7 +4489,6 @@ var ClaudeDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Claude runtime note:** While you are busy, Slock batches inbox-count notifications instead of injecting message content. Use `slock message check` at natural breakpoints to pull the pending messages before side-effect actions that depend on current context."
@@ -4425,9 +4501,9 @@ var ClaudeDriver = class {
 
 // src/drivers/codex.ts
 import { spawn as spawn2, execFileSync as execFileSync2, execSync } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import os2 from "os";
-import path5 from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import os3 from "os";
+import path6 from "path";
 
 // src/runtimeTurnState.ts
 var RuntimeTurnState = class {
@@ -4584,16 +4660,17 @@ function rawResponseItemProgressEvent(message) {
 function nonEmptyString2(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function codexMcpToolName(item) {
+  const tool = nonEmptyString2(item.tool) ?? "unknown";
+  const server = nonEmptyString2(item.server);
+  return server ? `mcp_${server}_${tool}` : `mcp_${tool}`;
+}
 var CodexEventNormalizer = class {
-  mcpToolPrefix;
   currentThreadId = null;
   sessionAnnounced = false;
   streamedAgentMessageIds = /* @__PURE__ */ new Set();
   streamedReasoningIds = /* @__PURE__ */ new Set();
   turnState = new RuntimeTurnState();
-  constructor(opts) {
-    this.mcpToolPrefix = opts.mcpToolPrefix;
-  }
   reset(opts = {}) {
     this.currentThreadId = opts.threadId ?? null;
     this.turnState.reset();
@@ -4753,11 +4830,11 @@ var CodexEventNormalizer = class {
             break;
           case "mcpToolCall":
             if (isStarted) {
-              const toolName = item.server === "chat" ? `${this.mcpToolPrefix}${item.tool}` : `${this.mcpToolPrefix.replace(/_$/, "")}_${item.server}_${item.tool}`;
+              const toolName = codexMcpToolName(item);
               events.push({ kind: "tool_call", name: toolName, input: item.arguments });
             }
             if (isCompleted) {
-              const toolName = item.server === "chat" ? `${this.mcpToolPrefix}${item.tool}` : `${this.mcpToolPrefix.replace(/_$/, "")}_${item.server}_${item.tool}`;
+              const toolName = codexMcpToolName(item);
               events.push({ kind: "tool_output", name: toolName });
               this.turnState.markToolBoundary();
             }
@@ -4813,9 +4890,9 @@ var CodexEventNormalizer = class {
 
 // src/drivers/codex.ts
 function ensureGitRepoForCodex(workingDirectory, deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync3;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
   const execSyncFn = deps.execSyncFn ?? execSync;
-  const gitDir = path5.join(workingDirectory, ".git");
+  const gitDir = path6.join(workingDirectory, ".git");
   if (existsSyncFn(gitDir)) return;
   execSyncFn("git init", { cwd: workingDirectory, stdio: "pipe" });
   execSyncFn(
@@ -4828,13 +4905,13 @@ function ensureGitRepoForCodex(workingDirectory, deps = {}) {
 }
 var CODEX_DESKTOP_BUNDLE_PATH = "/Applications/Codex.app/Contents/Resources/codex";
 function isWindowsSandboxRunner(commandPath) {
-  return path5.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
+  return path6.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
 }
 function resolveWindowsNpmCodexEntry(deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync3;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
   const env = deps.env ?? process.env;
-  const winPath = path5.win32;
+  const winPath = path6.win32;
   try {
     const globalRoot = String(execFileSyncFn("npm", ["root", "-g"], {
       encoding: "utf8",
@@ -4853,10 +4930,10 @@ function resolveWindowsNpmCodexEntry(deps = {}) {
   return null;
 }
 function resolveWindowsCodexDesktopEntry(deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync3;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
   const env = deps.env ?? process.env;
   const homeDir = deps.homeDir;
-  const winPath = path5.win32;
+  const winPath = path6.win32;
   const candidates = [
     env.LOCALAPPDATA ? winPath.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin", "codex.exe") : null,
     env.USERPROFILE ? winPath.join(env.USERPROFILE, "AppData", "Local", "OpenAI", "Codex", "bin", "codex.exe") : null,
@@ -4944,8 +5021,6 @@ var CodexDriver = class {
     toLaunchSpec: (modelId) => ({ params: { model: modelId } })
   };
   supportsStdinNotification = true;
-  mcpToolPrefix = "mcp_chat_";
-  usesSlockCliForCommunication = true;
   busyDeliveryMode = "direct";
   supportsNativeStandingPrompt = true;
   probe() {
@@ -4992,7 +5067,7 @@ var CodexDriver = class {
   initializeRequestId = null;
   pendingThreadRequest = null;
   initialTurnStarted = false;
-  normalizer = new CodexEventNormalizer({ mcpToolPrefix: this.mcpToolPrefix });
+  normalizer = new CodexEventNormalizer();
   async spawn(ctx) {
     ensureGitRepoForCodex(ctx.workingDirectory);
     const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" });
@@ -5084,7 +5159,6 @@ var CodexDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**IMPORTANT**: Your process stays alive across turns. While you are working, Slock may write batched inbox-count notifications into the current turn; call `slock message check` at natural breakpoints to read the pending messages."
@@ -5128,9 +5202,9 @@ var CodexDriver = class {
     return detectCodexModels();
   }
 };
-function detectCodexModels(home = os2.homedir()) {
-  const cachePath = path5.join(home, ".codex", "models_cache.json");
-  const configPath = path5.join(home, ".codex", "config.toml");
+function detectCodexModels(home = os3.homedir()) {
+  const cachePath = path6.join(home, ".codex", "models_cache.json");
+  const configPath = path6.join(home, ".codex", "config.toml");
   let models = [];
   try {
     const raw = readFileSync2(cachePath, "utf8");
@@ -5224,9 +5298,7 @@ var AntigravityDriver = class {
     toLaunchSpec: (_modelId) => ({ args: [] })
   };
   supportsStdinNotification = false;
-  mcpToolPrefix = "";
   busyDeliveryMode = "none";
-  usesSlockCliForCommunication = true;
   sessionId = null;
   sessionAnnounced = false;
   probe() {
@@ -5274,7 +5346,6 @@ var AntigravityDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Antigravity runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
@@ -5313,9 +5384,7 @@ var CopilotDriver = class {
     toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = false;
-  mcpToolPrefix = "";
   busyDeliveryMode = "none";
-  usesSlockCliForCommunication = true;
   sessionId = null;
   sessionAnnounced = false;
   async spawn(ctx) {
@@ -5421,7 +5490,6 @@ var CopilotDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Copilot runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
@@ -5458,9 +5526,7 @@ var CursorDriver = class {
     toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = false;
-  mcpToolPrefix = "mcp__chat__";
   busyDeliveryMode = "none";
-  usesSlockCliForCommunication = true;
   async spawn(ctx) {
     const args = [
       "--print",
@@ -5546,7 +5612,6 @@ var CursorDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "mcp__chat__",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Cursor runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
@@ -5591,11 +5656,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -5607,8 +5672,8 @@ function runCursorModelsCommand() {
 
 // src/drivers/gemini.ts
 import { execFileSync as execFileSync3, spawn as spawn6 } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import path6 from "path";
+import { existsSync as existsSync5 } from "fs";
+import path7 from "path";
 async function buildGeminiSpawnEnv(ctx, platform = process.platform) {
   const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" }, platform);
   const launchEnvVars = runtimeConfigToLaunchFields(ctx.config).envVars;
@@ -5650,9 +5715,9 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
     return { command: resolveCommandOnPath("gemini", deps) ?? "gemini", args: commandArgs };
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
-  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
-  const env = deps.env ?? process.env;
-  const winPath = path6.win32;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync5;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
+  const winPath = path7.win32;
   let geminiEntry = null;
   try {
     const globalRoot = normalizeExecOutput2(execFileSyncFn("npm", ["root", "-g"], {
@@ -5706,9 +5771,7 @@ var GeminiDriver = class {
     toLaunchSpec: (modelId) => modelId && modelId !== "default" ? { args: ["--model", modelId] } : { args: [] }
   };
   supportsStdinNotification = false;
-  mcpToolPrefix = "";
   busyDeliveryMode = "none";
-  usesSlockCliForCommunication = true;
   sessionId = null;
   sessionAnnounced = false;
   async spawn(ctx) {
@@ -5777,7 +5840,6 @@ var GeminiDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Gemini runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
@@ -5791,12 +5853,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import os3 from "os";
-import path7 from "path";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import os4 from "os";
+import path8 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -5805,6 +5870,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path8.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path8.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -5828,12 +5960,28 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
-  mcpToolPrefix = "";
   busyDeliveryMode = "direct";
-  usesSlockCliForCommunication = true;
   sessionId = null;
   sessionAnnounced = false;
   promptRequestId = null;
@@ -5842,9 +5990,9 @@ var KimiDriver = class {
     this.sessionId = ctx.config.sessionId || randomUUID2();
     this.sessionAnnounced = false;
     this.promptRequestId = randomUUID2();
-    const systemPromptPath = path7.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
-    const agentFilePath = path7.join(ctx.workingDirectory, KIMI_AGENT_FILE);
-    if (!isResume || !existsSync5(systemPromptPath)) {
+    const systemPromptPath = path8.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
+    const agentFilePath = path8.join(ctx.workingDirectory, KIMI_AGENT_FILE);
+    if (!isResume || !existsSync6(systemPromptPath)) {
       writeFileSync3(systemPromptPath, ctx.prompt, "utf8");
     }
     writeFileSync3(agentFilePath, [
@@ -5854,21 +6002,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -5876,7 +6026,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -5979,7 +6129,6 @@ var KimiDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [],
       includeStdinNotificationSection: true,
@@ -5990,14 +6139,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os3.homedir()) {
-  const configPath = path7.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -6018,11 +6162,9 @@ function detectKimiModels(home = os3.homedir()) {
 
 // src/drivers/opencode.ts
 import { spawn as spawn8, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import os4 from "os";
-import path8 from "path";
-var CHAT_MCP_SERVER_NAME = "chat";
-var CHAT_MCP_TOOL_PREFIX = `${CHAT_MCP_SERVER_NAME}_`;
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import os5 from "os";
+import path9 from "path";
 var SLOCK_AGENT_NAME = "slock";
 var NO_MESSAGE_PROMPT = "No new messages are pending. Stop now.";
 var FIRST_MESSAGE_TASK_PREFIX = "First message task (system-triggered):";
@@ -6050,8 +6192,8 @@ function parseUserOpenCodeConfig(ctx) {
   const raw = runtimeConfigToLaunchFields(ctx.config).envVars?.OPENCODE_CONFIG_CONTENT;
   return parseOpenCodeConfigContent(raw);
 }
-function readLocalOpenCodeConfig(home = os4.homedir()) {
-  const configPath = path8.join(home, ".config", "opencode", "opencode.json");
+function readLocalOpenCodeConfig(home = os5.homedir()) {
+  const configPath = path9.join(home, ".config", "opencode", "opencode.json");
   try {
     return parseOpenCodeConfigContent(readFileSync4(configPath, "utf8"));
   } catch {
@@ -6111,7 +6253,7 @@ function mergeOpenCodeConfigs(localConfig, envConfig) {
     }
   };
 }
-function buildOpenCodeConfig(ctx, home = os4.homedir()) {
+function buildOpenCodeConfig(ctx, home = os5.homedir()) {
   const userConfig = mergeOpenCodeConfigs(readLocalOpenCodeConfig(home), parseUserOpenCodeConfig(ctx));
   const userAgents = recordField(userConfig.agent);
   const userSlockAgent = recordField(userAgents[SLOCK_AGENT_NAME]);
@@ -6129,7 +6271,7 @@ function buildOpenCodeConfig(ctx, home = os4.homedir()) {
     mcp: recordField(userConfig.mcp)
   };
 }
-async function buildOpenCodeLaunchOptions(ctx, home = os4.homedir(), version = null) {
+async function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
   const slock = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const config = buildOpenCodeConfig(ctx, home);
   const env = {
@@ -6228,7 +6370,7 @@ function formatOpenCodeLabelToken(token) {
   if (/^\d/.test(token)) return token;
   return normalized.charAt(0).toUpperCase() + normalized.slice(1);
 }
-function detectOpenCodeModels(home = os4.homedir(), runCommand = runOpenCodeModelsCommand) {
+function detectOpenCodeModels(home = os5.homedir(), runCommand = runOpenCodeModelsCommand) {
   const commandResult = runCommand(home);
   if (commandResult.error || commandResult.status !== 0) return null;
   return parseOpenCodeModelsOutput(commandResult.stdout);
@@ -6237,7 +6379,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -6249,11 +6391,11 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   };
 }
 function isWindowsCommandShim(commandPath) {
-  const ext = path8.win32.extname(commandPath).toLowerCase();
+  const ext = path9.win32.extname(commandPath).toLowerCase();
   return ext === ".cmd" || ext === ".bat";
 }
 function opencodePackageEntryCandidates(packageRoot) {
-  const winPath = path8.win32;
+  const winPath = path9.win32;
   return [
     winPath.join(packageRoot, "bin", "opencode.exe"),
     winPath.join(packageRoot, "bin", "opencode.js"),
@@ -6262,16 +6404,16 @@ function opencodePackageEntryCandidates(packageRoot) {
   ];
 }
 function openCodeSpecForEntry(entry, commandArgs) {
-  if (path8.win32.extname(entry).toLowerCase() === ".exe") {
+  if (path9.win32.extname(entry).toLowerCase() === ".exe") {
     return { command: entry, args: commandArgs, shell: false };
   }
   return { command: process.execPath, args: [entry, ...commandArgs], shell: false };
 }
 function resolveWindowsOpenCodePackageEntry(commandPath, deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync6;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync7;
   const execFileSyncFn = deps.execFileSyncFn;
   const env = deps.env ?? process.env;
-  const winPath = path8.win32;
+  const winPath = path9.win32;
   const candidates = [];
   if (execFileSyncFn) {
     try {
@@ -6299,7 +6441,7 @@ function resolveWindowsOpenCodePackageEntry(commandPath, deps = {}) {
 function extractWindowsShimTargets(commandPath, deps = {}) {
   if (!isWindowsCommandShim(commandPath)) return [];
   const readFileSyncFn = deps.readFileSyncFn ?? readFileSync4;
-  const commandDir = path8.win32.dirname(commandPath);
+  const commandDir = path9.win32.dirname(commandPath);
   let raw;
   try {
     raw = String(readFileSyncFn(commandPath, "utf8"));
@@ -6310,7 +6452,7 @@ function extractWindowsShimTargets(commandPath, deps = {}) {
   const dp0Pattern = /%~dp0\\?([^"\r\n]*?opencode\.(?:exe|js|mjs|cjs))/gi;
   for (const match of raw.matchAll(dp0Pattern)) {
     const relative = match[1]?.replace(/^\\+/, "");
-    if (relative) candidates.push(path8.win32.normalize(path8.win32.join(commandDir, relative)));
+    if (relative) candidates.push(path9.win32.normalize(path9.win32.join(commandDir, relative)));
   }
   return candidates;
 }
@@ -6324,7 +6466,7 @@ function resolveOpenCodeSpawn(commandArgs, deps = {}) {
     };
   }
   const command = resolveCommandOnPath("opencode", deps);
-  if (command && path8.win32.extname(command).toLowerCase() === ".exe") {
+  if (command && path9.win32.extname(command).toLowerCase() === ".exe") {
     return { command, args: commandArgs, shell: false };
   }
   const packageEntry = resolveWindowsOpenCodePackageEntry(command, deps);
@@ -6349,7 +6491,6 @@ function isSystemFirstMessageTask(message) {
 }
 function buildOpenCodeSystemPrompt(config) {
   return buildCliTransportSystemPrompt(config, {
-    toolPrefix: CHAT_MCP_TOOL_PREFIX,
     extraCriticalRules: [],
     postStartupNotes: [
       "**OpenCode runtime note:** Slock launches you as a per-turn process. Complete the current wake using `slock` CLI commands, then stop; the daemon will restart you when new messages arrive."
@@ -6394,11 +6535,9 @@ var OpenCodeDriver = class {
     }
   };
   supportsStdinNotification = false;
-  mcpToolPrefix = CHAT_MCP_TOOL_PREFIX;
   busyDeliveryMode = "none";
   terminateProcessOnTurnEnd = true;
   deferSpawnUntilMessage = true;
-  usesSlockCliForCommunication = true;
   shouldDeferWakeMessage(message) {
     return isSystemFirstMessageTask(message);
   }
@@ -6432,7 +6571,7 @@ var OpenCodeDriver = class {
     if (unsupportedMessage) {
       throw new Error(unsupportedMessage);
     }
-    const launch = await buildOpenCodeLaunchOptions(ctx, os4.homedir(), version);
+    const launch = await buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
     const spawnSpec = resolveOpenCodeSpawn(launch.args);
     const proc = spawn8(spawnSpec.command, spawnSpec.args, {
       cwd: ctx.workingDirectory,
@@ -6499,8 +6638,8 @@ var OpenCodeDriver = class {
 // src/drivers/pi.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
-import { mkdirSync as mkdirSync2, readdirSync } from "fs";
-import path9 from "path";
+import { mkdirSync as mkdirSync3, readdirSync } from "fs";
+import path10 from "path";
 import {
   AuthStorage,
   createBashTool,
@@ -6513,6 +6652,7 @@ import {
   VERSION as PI_SDK_VERSION
 } from "@earendil-works/pi-coding-agent";
 var PI_SESSION_DIR = ".pi-sessions";
+var PI_SDK_COMPACTION_ENABLED = true;
 var PI_PROVIDER_LABELS = {
   google: "Google",
   openai: "OpenAI",
@@ -6526,7 +6666,7 @@ function createPiSdkEventMappingState(sessionId = null) {
   };
 }
 function buildPiSessionDir(workingDirectory) {
-  return path9.join(workingDirectory, PI_SESSION_DIR);
+  return path10.join(workingDirectory, PI_SESSION_DIR);
 }
 async function buildPiSpawnEnv(ctx) {
   return (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
@@ -6548,7 +6688,7 @@ function findPiSessionFile(sessionDir, sessionId) {
   }
   const suffix = `_${sessionId}.jsonl`;
   const match = entries.find((entry) => entry.endsWith(suffix));
-  return match ? path9.join(sessionDir, match) : null;
+  return match ? path10.join(sessionDir, match) : null;
 }
 function detectPiModelsFromRegistry(modelRegistry) {
   const models = [];
@@ -6701,17 +6841,17 @@ var PI_IDLE_PROMPT_RETRY_MS = 25;
 var PI_IDLE_PROMPT_MAX_WAIT_MS = 1e3;
 async function createPiAgentSessionForContext(ctx, sessionId) {
   const sessionDir = buildPiSessionDir(ctx.workingDirectory);
-  mkdirSync2(sessionDir, { recursive: true });
+  mkdirSync3(sessionDir, { recursive: true });
   const spawnEnv = await buildPiSpawnEnv(ctx);
   const agentDir = spawnEnv.PI_CODING_AGENT_DIR || getAgentDir();
-  const authStorage = AuthStorage.create(path9.join(agentDir, "auth.json"));
-  const modelRegistry = ModelRegistry.create(authStorage, path9.join(agentDir, "models.json"));
+  const authStorage = AuthStorage.create(path10.join(agentDir, "auth.json"));
+  const modelRegistry = ModelRegistry.create(authStorage, path10.join(agentDir, "models.json"));
   const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
   const model = resolvePiModelFromRegistry(launchRuntimeFields.model, modelRegistry);
   if (launchRuntimeFields.model && launchRuntimeFields.model !== "default" && !model) {
     throw new Error(`Pi model not found: ${launchRuntimeFields.model}`);
   }
-  const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false } });
+  const settingsManager = SettingsManager.inMemory({ compaction: { enabled: PI_SDK_COMPACTION_ENABLED } });
   const resourceLoader = new DefaultResourceLoader({
     cwd: ctx.workingDirectory,
     agentDir,
@@ -6948,9 +7088,7 @@ var PiDriver = class {
     toLaunchSpec: (modelId) => ({ params: { model: modelId } })
   };
   supportsStdinNotification = true;
-  mcpToolPrefix = "";
   busyDeliveryMode = "direct";
-  usesSlockCliForCommunication = true;
   sessionId = null;
   get currentSessionId() {
     return this.sessionId;
@@ -6981,7 +7119,6 @@ var PiDriver = class {
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
-      toolPrefix: "",
       extraCriticalRules: [],
       postStartupNotes: [
         "**Pi runtime note:** Slock keeps Pi running as a persistent SDK session. While you are working, Slock may send inbox-count notifications into the current turn; call `slock message check` at natural breakpoints."
@@ -7155,7 +7292,7 @@ function getDriver(runtimeId) {
 
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
-import path10 from "path";
+import path11 from "path";
 function isValidWorkspaceDirectoryName(directoryName) {
   return !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..");
 }
@@ -7163,7 +7300,7 @@ function resolveWorkspaceDirectoryPath(dataDir, directoryName) {
   if (!isValidWorkspaceDirectoryName(directoryName)) {
     return null;
   }
-  return path10.join(dataDir, directoryName);
+  return path11.join(dataDir, directoryName);
 }
 function emptyWorkspaceDirectorySummary(latestMtime = /* @__PURE__ */ new Date(0)) {
   return {
@@ -7212,7 +7349,7 @@ async function summarizeWorkspaceDirectory(dirPath) {
     return summary;
   }
   const childSummaries = await Promise.all(
-    entries.map((entry) => summarizeWorkspaceEntry(path10.join(dirPath, entry.name), entry))
+    entries.map((entry) => summarizeWorkspaceEntry(path11.join(dirPath, entry.name), entry))
   );
   for (const childSummary of childSummaries) {
     summary = mergeWorkspaceDirectorySummaries(summary, childSummary);
@@ -7231,7 +7368,7 @@ async function scanWorkspaceDirectories(dataDir) {
       if (!entry.isDirectory()) {
         return null;
       }
-      const dirPath = path10.join(dataDir, entry.name);
+      const dirPath = path11.join(dataDir, entry.name);
       try {
         const summary = await summarizeWorkspaceDirectory(dirPath);
         return {
@@ -7782,12 +7919,12 @@ function findSessionJsonl(root, predicate) {
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isFile() || !predicate(entry.name)) continue;
-      return path11.join(dir, entry.name);
+      return path12.join(dir, entry.name);
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isDirectory()) continue;
-      const found = visit(path11.join(dir, entry.name), depth - 1);
+      const found = visit(path12.join(dir, entry.name), depth - 1);
       if (found) return found;
     }
     return null;
@@ -7800,9 +7937,9 @@ function safeSessionFilename(value) {
 }
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
-    const dir = path11.join(fallbackDir, ".slock", "runtime-sessions");
-    mkdirSync3(dir, { recursive: true });
-    const filePath = path11.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
+    const dir = path12.join(fallbackDir, ".slock", "runtime-sessions");
+    mkdirSync4(dir, { recursive: true });
+    const filePath = path12.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
     writeFileSync4(filePath, JSON.stringify({
       type: "runtime_session_handoff",
       runtime,
@@ -7821,8 +7958,20 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
     return null;
   }
 }
-function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os5.homedir(), fallbackDir) {
-  const directPath = path11.isAbsolute(sessionId) ? sessionId : null;
+function resolveRuntimeHomeDir(config, defaultHomeDir, workspacePath) {
+  if (isClaudeCustomProviderConfig(config)) {
+    return getClaudeProviderStatePaths(workspacePath).home;
+  }
+  return defaultHomeDir;
+}
+function ensureRuntimeHomeDir(config, defaultHomeDir, workspacePath) {
+  if (isClaudeCustomProviderConfig(config)) {
+    return ensureClaudeProviderStatePaths(workspacePath).home;
+  }
+  return defaultHomeDir;
+}
+function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), fallbackDir) {
+  const directPath = path12.isAbsolute(sessionId) ? sessionId : null;
   if (directPath) {
     try {
       if (statSync(directPath).isFile()) {
@@ -7831,7 +7980,7 @@ function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os5.homedir(), f
     } catch {
     }
   }
-  const resolvedPath = runtime === "claude" ? findSessionJsonl(path11.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path11.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
+  const resolvedPath = runtime === "claude" ? findSessionJsonl(path12.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`) : runtime === "codex" ? findSessionJsonl(path12.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId)) : null;
   if (!resolvedPath && fallbackDir) {
     const fallback = writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir);
     if (fallback) return fallback;
@@ -7892,13 +8041,7 @@ function formatThreadContextMessage(message) {
   const senderType = formatVisibleActorType(message.sender_type);
   return `- [msg=${msgId} time=${time}${senderType}] ${formatSenderHandle(message)}: ${message.content}`;
 }
-function mcpToolName(driver, name) {
-  return `${driver?.mcpToolPrefix ?? ""}${name}`;
-}
-function communicationCommand(driver, name) {
-  if (!driver?.usesSlockCliForCommunication) {
-    return mcpToolName(driver, name);
-  }
+function communicationCommand(name) {
   switch (name) {
     case "send_message":
       return "slock message send";
@@ -7912,18 +8055,18 @@ function communicationCommand(driver, name) {
       return `slock ${name.replace(/_/g, " ")}`;
   }
 }
-function dynamicReplyInstruction(driver) {
-  return driver?.usesSlockCliForCommunication ? "reply using `slock message send --target <exact target>`" : `reply with ${communicationCommand(driver, "send_message")}`;
+function dynamicReplyInstruction() {
+  return "reply using `slock message send --target <exact target>`";
 }
-function dynamicClaimInstruction(driver) {
-  return driver?.usesSlockCliForCommunication ? "claim the relevant task with `slock task claim`" : `claim the relevant task with ${communicationCommand(driver, "claim_tasks")}`;
+function dynamicClaimInstruction() {
+  return "claim the relevant task with `slock task claim`";
 }
-function formatIncomingMessage(message, driver) {
+function formatIncomingMessage(message) {
   const threadJoinPrefix = message.thread_join_context ? [
     `[Slock thread context: you were added to a new thread via @mention.]`,
     `parent: ${message.thread_join_context.parent_target}`,
     `thread: ${message.thread_join_context.thread_target}`,
-    `suggested next step: ${driver?.usesSlockCliForCommunication ? `slock message read --channel "${message.thread_join_context.suggested_read_history_target}"` : `${communicationCommand(driver, "read_history")}(channel="${message.thread_join_context.suggested_read_history_target}")`}`,
+    `suggested next step: slock message read --channel "${message.thread_join_context.suggested_read_history_target}"`,
     "",
     "Parent message:",
     formatThreadContextMessage(message.thread_join_context.parent_message),
@@ -8843,6 +8986,7 @@ var AgentProcessManager = class _AgentProcessManager {
   maxConcurrentAgentStarts;
   agentStartIntervalMs;
   startingInboxes = /* @__PURE__ */ new Map();
+  pendingStartRebinds = /* @__PURE__ */ new Map();
   /** Cached configs for agents whose process exited normally — enables auto-restart on next message */
   idleAgentConfigs = /* @__PURE__ */ new Map();
   slockCliPath;
@@ -8877,7 +9021,7 @@ var AgentProcessManager = class _AgentProcessManager {
     this.daemonApiKey = daemonApiKey;
     this.serverUrl = opts.serverUrl;
     this.dataDir = opts.dataDir || resolveSlockHomePath("agents");
-    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os5.homedir();
+    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os6.homedir();
     this.driverResolver = opts.driverResolver || getDriver;
     this.defaultAgentEnvVarsProvider = opts.defaultAgentEnvVarsProvider || null;
     this.tracer = opts.tracer ?? noopTracer;
@@ -9488,6 +9632,92 @@ var AgentProcessManager = class _AgentProcessManager {
       ...attrs
     };
   }
+  recordStartRebind(agentId, start, reason, previousLaunchId, nextLaunchId, sessionId) {
+    this.recordDaemonTrace("daemon.agent.start.rebound", {
+      ...this.startQueueTraceAttrs(
+        agentId,
+        start.config,
+        start.wakeMessage,
+        start.unreadSummary,
+        start.resumePrompt,
+        start.launchId,
+        start.wakeMessageTransient ?? false
+      ),
+      reason,
+      previous_launch_id_present: Boolean(previousLaunchId),
+      next_launch_id_present: Boolean(nextLaunchId),
+      session_id_present: Boolean(sessionId)
+    });
+  }
+  sameWakeMessage(left, right) {
+    if (!left || !right) return left === right;
+    if (left.message_id && right.message_id) return left.message_id === right.message_id;
+    return left === right;
+  }
+  rebindQueuedStart(agentId, start, reason) {
+    const item = this.queuedAgentStarts.get(agentId);
+    if (!item) {
+      return false;
+    }
+    const previousLaunchId = item.launchId || null;
+    const nextLaunchId = start.launchId || previousLaunchId;
+    const previousWakeMessage = item.wakeMessage;
+    if (previousWakeMessage && start.wakeMessage && !this.sameWakeMessage(previousWakeMessage, start.wakeMessage)) {
+      const pending = this.startingInboxes.get(agentId) || [];
+      pending.push(previousWakeMessage);
+      this.startingInboxes.set(agentId, pending);
+    }
+    item.config = start.config;
+    item.unreadSummary = start.unreadSummary;
+    item.resumePrompt = start.resumePrompt;
+    item.launchId = nextLaunchId || void 0;
+    if (start.wakeMessage) {
+      item.wakeMessage = start.wakeMessage;
+      item.wakeMessageTransient = start.wakeMessageTransient;
+    }
+    this.recordStartRebind(
+      agentId,
+      { ...start, launchId: nextLaunchId || void 0 },
+      reason,
+      previousLaunchId,
+      nextLaunchId,
+      null
+    );
+    return true;
+  }
+  rebindRunningStart(agentId, start, reason) {
+    const ap = this.agents.get(agentId);
+    if (!ap) {
+      this.pendingStartRebinds.set(agentId, start);
+      return false;
+    }
+    const previousLaunchId = ap.launchId;
+    const nextLaunchId = start.launchId || ap.launchId || null;
+    const nextSessionId = ap.sessionId || start.config.sessionId || null;
+    ap.launchId = nextLaunchId;
+    ap.sessionId = nextSessionId;
+    ap.config = {
+      ...start.config,
+      sessionId: nextSessionId
+    };
+    this.idleAgentConfigs.set(agentId, {
+      config: { ...stripManagedRunnerCredential(ap.config), sessionId: nextSessionId },
+      sessionId: nextSessionId,
+      launchId: nextLaunchId
+    });
+    this.recordStartRebind(agentId, start, reason, previousLaunchId, nextLaunchId, nextSessionId);
+    this.sendAgentStatus(agentId, "active", nextLaunchId);
+    if (nextSessionId) {
+      this.sendToServer({ type: "agent:session", agentId, sessionId: nextSessionId, launchId: nextLaunchId || void 0 });
+    }
+    if (start.wakeMessage) {
+      const accepted = this.deliverMessage(agentId, start.wakeMessage, { transient: start.wakeMessageTransient === true });
+      if (accepted instanceof Promise) {
+        accepted.catch((err) => logger.error(`[Agent ${agentId}] Failed to deliver wake message after start rebind`, err));
+      }
+    }
+    return true;
+  }
   async startAgent(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient = false) {
     this.recordDaemonTrace("daemon.agent.start.requested", this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient));
     if (this.agents.has(agentId)) {
@@ -9495,7 +9725,8 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_running"
       });
-      logger.info(`[Agent ${agentId}] Start ignored (already running)`);
+      this.rebindRunningStart(agentId, { config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient }, "already_running");
+      logger.info(`[Agent ${agentId}] Start rebound (already running)`);
       return;
     }
     if (this.agentsStarting.has(agentId)) {
@@ -9503,7 +9734,8 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_starting"
       });
-      logger.info(`[Agent ${agentId}] Start ignored (startup in progress)`);
+      this.pendingStartRebinds.set(agentId, { config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient });
+      logger.info(`[Agent ${agentId}] Start rebind deferred (startup in progress)`);
       return;
     }
     if (this.queuedAgentStarts.has(agentId)) {
@@ -9511,7 +9743,8 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_queued"
       });
-      logger.info(`[Agent ${agentId}] Start ignored (startup already queued)`);
+      this.rebindQueuedStart(agentId, { config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient }, "already_queued");
+      logger.info(`[Agent ${agentId}] Queued start rebound (startup already queued)`);
       return;
     }
     return new Promise((resolve, reject) => {
@@ -9570,6 +9803,11 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(item.agentId, item.config, item.wakeMessage, item.unreadSummary, item.resumePrompt, item.launchId, item.wakeMessageTransient),
         reason: "already_running_or_starting"
       });
+      if (this.agents.has(item.agentId)) {
+        this.rebindRunningStart(item.agentId, item, "already_running_or_starting");
+      } else {
+        this.pendingStartRebinds.set(item.agentId, item);
+      }
       logger.info(`[Agent ${item.agentId}] Queued start skipped (already running or starting)`);
       item.resolve();
       this.pumpAgentStartQueue();
@@ -9656,7 +9894,8 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_running"
       });
-      logger.info(`[Agent ${agentId}] Start ignored (already running)`);
+      this.rebindRunningStart(agentId, { config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient }, "already_running");
+      logger.info(`[Agent ${agentId}] Start rebound (already running)`);
       return;
     }
     if (this.agentsStarting.has(agentId)) {
@@ -9664,7 +9903,8 @@ var AgentProcessManager = class _AgentProcessManager {
         ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
         reason: "already_starting"
       });
-      logger.info(`[Agent ${agentId}] Start ignored (startup in progress)`);
+      this.pendingStartRebinds.set(agentId, { config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient });
+      logger.info(`[Agent ${agentId}] Start rebind deferred (startup in progress)`);
       return;
     }
     this.agentsStarting.add(agentId);
@@ -9683,7 +9923,7 @@ var AgentProcessManager = class _AgentProcessManager {
         );
         wakeMessage = void 0;
       }
-      const agentDataDir = path11.join(this.dataDir, agentId);
+      const agentDataDir = path12.join(this.dataDir, agentId);
       await mkdir(agentDataDir, { recursive: true });
       let runtimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
       const legacyRuntimeProfileControl = runtimeConfig.runtimeProfileControl?.kind === "migration" ? runtimeConfig.runtimeProfileControl : null;
@@ -9697,23 +9937,23 @@ var AgentProcessManager = class _AgentProcessManager {
         );
         runtimeConfig = { ...runtimeConfig, runtimeProfileControl: null };
       }
-      const memoryMdPath = path11.join(agentDataDir, "MEMORY.md");
+      const memoryMdPath = path12.join(agentDataDir, "MEMORY.md");
       try {
         await access(memoryMdPath);
       } catch {
         const initialMemoryMd = buildInitialMemoryMd(runtimeConfig);
         await writeFile(memoryMdPath, initialMemoryMd);
       }
-      const notesDir = path11.join(agentDataDir, "notes");
+      const notesDir = path12.join(agentDataDir, "notes");
       await mkdir(notesDir, { recursive: true });
       if (getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE) {
         const seedFiles = buildOnboardingSeedFiles();
         for (const { relativePath, content } of seedFiles) {
-          const fullPath = path11.join(agentDataDir, relativePath);
+          const fullPath = path12.join(agentDataDir, relativePath);
           try {
             await access(fullPath);
           } catch {
-            await mkdir(path11.dirname(fullPath), { recursive: true });
+            await mkdir(path12.dirname(fullPath), { recursive: true });
             await writeFile(fullPath, content);
           }
         }
@@ -9737,7 +9977,7 @@ var AgentProcessManager = class _AgentProcessManager {
         if (transientWakeMessage) {
           prompt = `System notice received:
 
-${formatIncomingMessage(wakeMessage, driver)}
+${formatIncomingMessage(wakeMessage)}
 
 Respond as appropriate. Complete all your work before stopping.
 ${RESPONSE_TARGET_HINT}`;
@@ -9771,7 +10011,7 @@ Use the inbox/read commands at a natural breakpoint if you choose to inspect tho
         }
         prompt += `
 
-Use ${communicationCommand(driver, "read_history")} to catch up on the channels listed above, then stop. Read each listed channel at most once unless a read fails. Do NOT call ${communicationCommand(driver, "check_messages")} in this mode. If the history reveals a direct request, assignment, @mention, review request, or task clearly addressed to you, switch into active handling instead of stopping: ${dynamicReplyInstruction(driver)} and ${dynamicClaimInstruction(driver)} before starting work. Otherwise, do NOT send any message in this mode. ${getMessageDeliveryText(driver)}`;
+Use ${communicationCommand("read_history")} to catch up on the channels listed above, then stop. Read each listed channel at most once unless a read fails. Do NOT call ${communicationCommand("check_messages")} in this mode. If the history reveals a direct request, assignment, @mention, review request, or task clearly addressed to you, switch into active handling instead of stopping: ${dynamicReplyInstruction()} and ${dynamicClaimInstruction()} before starting work. Otherwise, do NOT send any message in this mode. ${getMessageDeliveryText(driver)}`;
         promptSource = "resume_unread_summary";
       } else if (isResume) {
         prompt = `No new messages while you were away. Nothing to do \u2014 just stop. ${getMessageDeliveryText(driver)}`;
@@ -9792,7 +10032,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         nativeStandingPrompt: Boolean(driver.supportsNativeStandingPrompt)
       });
       const effectiveConfig = await this.buildSpawnConfig(agentId, runtimeConfig);
-      const canDeferEmptyStart = driver.deferSpawnUntilMessage === true && !wakeMessage && !runtimeConfig.runtimeProfileControl && (!unreadSummary || Object.keys(unreadSummary).length === 0);
+      const pendingStartRebind = this.pendingStartRebinds.get(agentId);
+      if (pendingStartRebind) {
+        this.pendingStartRebinds.delete(agentId);
+      }
+      const effectiveLaunchId = pendingStartRebind?.launchId || launchId || null;
+      const canDeferEmptyStart = driver.deferSpawnUntilMessage === true && !wakeMessage && !pendingStartRebind?.wakeMessage && !runtimeConfig.runtimeProfileControl && (!unreadSummary || Object.keys(unreadSummary).length === 0);
       if (canDeferEmptyStart) {
         const pendingMessages = this.startingInboxes.get(agentId) || [];
         this.startingInboxes.delete(agentId);
@@ -9800,12 +10045,12 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         this.idleAgentConfigs.set(agentId, {
           config: effectiveConfig,
           sessionId: effectiveConfig.sessionId || null,
-          launchId: launchId || null
+          launchId: effectiveLaunchId
         });
-        this.sendAgentStatus(agentId, "active", launchId || null);
+        this.sendAgentStatus(agentId, "active", effectiveLaunchId);
         this.broadcastActivity(agentId, "online", "Process idle");
         this.recordDaemonTrace("daemon.agent.spawn.deferred", {
-          ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
+          ...this.startQueueTraceAttrs(agentId, config, wakeMessage, unreadSummary, resumePrompt, effectiveLaunchId || void 0, wakeMessageTransient),
           pending_messages_count: pendingMessages.length,
           reason: "defer_until_concrete_message"
         });
@@ -9823,7 +10068,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         workingDirectory: agentDataDir,
         slockCliPath: this.slockCliPath,
         daemonApiKey: this.daemonApiKey,
-        launchId: launchId || null,
+        launchId: effectiveLaunchId,
         agentCredentialProxyInboxCoordinator: this.createAgentProxyInboxCoordinator(agentId),
         cliTransportTraceDir: this.cliTransportTraceDir
       };
@@ -9834,7 +10079,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         inbox: wakeMessageDeliveredAsInboxUpdate && wakeMessage ? [wakeMessage, ...startingInboxMessages] : startingInboxMessages,
         config: runtimeConfig,
         sessionId: runtimeConfig.sessionId || null,
-        launchId: launchId || null,
+        launchId: effectiveLaunchId,
         startupWakeMessage: wakeMessage,
         startupUnreadSummary: unreadSummary,
         startupResumePrompt: resumePrompt,
@@ -9870,8 +10115,11 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       this.idleAgentConfigs.set(agentId, {
         config: { ...effectiveConfig, sessionId: effectiveConfig.sessionId || null },
         sessionId: effectiveConfig.sessionId || null,
-        launchId: launchId || null
+        launchId: effectiveLaunchId
       });
+      if (pendingStartRebind) {
+        this.recordStartRebind(agentId, pendingStartRebind, "startup_registered", launchId || null, effectiveLaunchId, agentProcess.sessionId);
+      }
       this.startRuntimeTrace(agentId, agentProcess, "spawn", wakeMessage ? [wakeMessage] : void 0, runtimeInputTraceAttrs);
       this.agentsStarting.delete(agentId);
       if (runtimeConfig.runtimeProfileControl) {
@@ -10106,16 +10354,26 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
         throw new Error(`Runtime session failed to start: ${startResult.reason}${startResult.error ? ` (${startResult.error})` : ""}`);
       }
       this.recordDaemonTrace("daemon.agent.spawn.created", {
-        ...this.startQueueTraceAttrs(agentId, effectiveConfig, wakeMessage, unreadSummary, resumePrompt, launchId, wakeMessageTransient),
+        ...this.startQueueTraceAttrs(agentId, effectiveConfig, wakeMessage, unreadSummary, resumePrompt, agentProcess.launchId || void 0, wakeMessageTransient),
         detached: false,
         new_session: false,
         process_pid_present: typeof runtime.pid === "number"
       });
-      this.sendAgentStatus(agentId, "active", launchId || null);
+      this.sendAgentStatus(agentId, "active", agentProcess.launchId);
+      if (pendingStartRebind && agentProcess.sessionId) {
+        this.sendToServer({ type: "agent:session", agentId, sessionId: agentProcess.sessionId, launchId: agentProcess.launchId || void 0 });
+      }
+      if (pendingStartRebind?.wakeMessage) {
+        const accepted = this.deliverMessage(agentId, pendingStartRebind.wakeMessage, { transient: pendingStartRebind.wakeMessageTransient === true });
+        if (accepted instanceof Promise) {
+          accepted.catch((err) => logger.error(`[Agent ${agentId}] Failed to deliver wake message after startup rebind`, err));
+        }
+      }
       this.broadcastActivity(agentId, "working", "Starting\u2026");
       this.startRuntimeStartupTimeout(agentId, agentProcess);
     } catch (err) {
       this.agentsStarting.delete(agentId);
+      this.pendingStartRebinds.delete(agentId);
       this.cleanupFailedRuntimeStart(agentId, agentProcess, err);
       throw err;
     }
@@ -10384,6 +10642,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   async stopAgent(agentId, { wait = false, silent = false } = {}) {
     this.cancelQueuedAgentStart(agentId, "stop requested");
+    this.pendingStartRebinds.delete(agentId);
     this.idleAgentConfigs.delete(agentId);
     const ap = this.agents.get(agentId);
     if (!ap) {
@@ -10830,7 +11089,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return true;
   }
   async resetWorkspace(agentId) {
-    const agentDataDir = path11.join(this.dataDir, agentId);
+    const agentDataDir = path12.join(this.dataDir, agentId);
     try {
       await rm2(agentDataDir, { recursive: true, force: true });
       logger.info(`[Agent ${agentId}] Workspace reset complete (${agentDataDir})`);
@@ -10891,7 +11150,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return result;
   }
   buildRuntimeProfileReport(agentId, config, sessionId, launchId) {
-    const workspacePath = path11.join(this.dataDir, agentId);
+    const workspacePath = path12.join(this.dataDir, agentId);
+    const runtimeHomeDir = resolveRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspacePath);
     return {
       agentId,
       launchId,
@@ -10905,7 +11165,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
           path: workspacePath,
           reachable: true
         },
-        sessionRef: sessionId ? resolveRuntimeSessionRef(config.runtime, sessionId, this.runtimeSessionHomeDir, workspacePath) : null
+        sessionRef: sessionId ? resolveRuntimeSessionRef(config.runtime, sessionId, runtimeHomeDir, workspacePath) : null
       }
     };
   }
@@ -11184,7 +11444,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   }
   // Workspace file browsing
   async getFileTree(agentId, dirPath) {
-    const agentDir = path11.join(this.dataDir, agentId);
+    const agentDir = path12.join(this.dataDir, agentId);
     try {
       await stat2(agentDir);
     } catch {
@@ -11192,8 +11452,8 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     }
     let targetDir = agentDir;
     if (dirPath) {
-      const resolved = path11.resolve(agentDir, dirPath);
-      if (!resolved.startsWith(agentDir + path11.sep) && resolved !== agentDir) {
+      const resolved = path12.resolve(agentDir, dirPath);
+      if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
         return [];
       }
       targetDir = resolved;
@@ -11201,14 +11461,14 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     return this.listDirectoryChildren(targetDir, agentDir);
   }
   async readFile(agentId, filePath) {
-    const agentDir = path11.join(this.dataDir, agentId);
-    const resolved = path11.resolve(agentDir, filePath);
-    if (!resolved.startsWith(agentDir + path11.sep) && resolved !== agentDir) {
+    const agentDir = path12.join(this.dataDir, agentId);
+    const resolved = path12.resolve(agentDir, filePath);
+    if (!resolved.startsWith(agentDir + path12.sep) && resolved !== agentDir) {
       throw new Error("Access denied");
     }
     const info = await stat2(resolved);
     if (info.isDirectory()) throw new Error("Cannot read a directory");
-    const ext = path11.extname(resolved).toLowerCase();
+    const ext = path12.extname(resolved).toLowerCase();
     if (WORKSPACE_TEXT_EXTENSIONS.has(ext) || ext === "") {
       if (info.size > WORKSPACE_TEXT_FILE_MAX_BYTES) throw new Error("File too large");
       const content = await readFile(resolved, "utf-8");
@@ -11241,15 +11501,17 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
   };
   async listSkills(agentId, runtimeHint) {
     const agent = this.agents.get(agentId);
-    const runtime = runtimeHint || agent?.config.runtime || "claude";
-    const home = os5.homedir();
-    const workspaceDir = path11.join(this.dataDir, agentId);
+    const idle = this.idleAgentConfigs.get(agentId);
+    const config = agent?.config ?? idle?.config ?? null;
+    const runtime = runtimeHint || config?.runtime || "claude";
+    const workspaceDir = path12.join(this.dataDir, agentId);
+    const home = config ? ensureRuntimeHomeDir(config, os6.homedir(), workspaceDir) : os6.homedir();
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalResults = await Promise.all(
-      paths.global.map((p) => this.scanSkillsDir(path11.join(home, p)))
+      paths.global.map((p) => this.scanSkillsDir(path12.join(home, p)))
     );
     const workspaceResults = await Promise.all(
-      paths.workspace.map((p) => this.scanSkillsDir(path11.join(workspaceDir, p)))
+      paths.workspace.map((p) => this.scanSkillsDir(path12.join(workspaceDir, p)))
     );
     const dedup = (skills) => {
       const seen = /* @__PURE__ */ new Set();
@@ -11278,7 +11540,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
     const skills = [];
     for (const entry of entries) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        const skillMd = path11.join(dir, entry.name, "SKILL.md");
+        const skillMd = path12.join(dir, entry.name, "SKILL.md");
         try {
           const content = await readFile(skillMd, "utf-8");
           const skill = this.parseSkillMd(entry.name, content);
@@ -11289,7 +11551,7 @@ Use ${communicationCommand(driver, "read_history")} to catch up on the channels
       } else if (entry.name.endsWith(".md")) {
         const cmdName = entry.name.replace(/\.md$/, "");
         try {
-          const content = await readFile(path11.join(dir, entry.name), "utf-8");
+          const content = await readFile(path12.join(dir, entry.name), "utf-8");
           const skill = this.parseSkillMd(cmdName, content);
           skill.sourcePath = dir;
           skills.push(skill);
@@ -12693,12 +12955,12 @@ ${formatAgentInboxDelta(inboxRows, { totalPendingMessages: inboxCount })}]`;
     const traceSource = options.transient ? `stdin_${mode}_transient_delivery` : `stdin_${mode}_delivery`;
     const prompt = formatRuntimeProfileControlPrompt(messages) ?? (messages.length === 1 ? `New message received:
 
-${formatIncomingMessage(messages[0], ap.driver)}
+${formatIncomingMessage(messages[0])}
 
 Respond as appropriate. Complete all your work before stopping.
 ${RESPONSE_TARGET_HINT}` : `New messages received:
 
-${messages.map((message) => formatIncomingMessage(message, ap.driver)).join("\n")}
+${messages.map((message) => formatIncomingMessage(message)).join("\n")}
 
 Respond as appropriate. Complete all your work before stopping.
 ${RESPONSE_TARGET_HINT}`);
@@ -12769,8 +13031,8 @@ ${RESPONSE_TARGET_HINT}`);
     const nodes = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const fullPath = path11.join(dir, entry.name);
-      const relativePath = path11.relative(rootDir, fullPath);
+      const fullPath = path12.join(dir, entry.name);
+      const relativePath = path12.relative(rootDir, fullPath);
       let info;
       try {
         info = await stat2(fullPath);
@@ -13144,9 +13406,9 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import os6 from "os";
-import path12 from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import os7 from "os";
+import path13 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
   code = "DAEMON_MACHINE_LOCK_HELD";
@@ -13168,7 +13430,7 @@ function resolveDefaultMachineStateRoot() {
   return resolveSlockHomePath("machines");
 }
 function ownerPath(lockDir) {
-  return path12.join(lockDir, "owner.json");
+  return path13.join(lockDir, "owner.json");
 }
 function readOwner(lockDir) {
   try {
@@ -13198,17 +13460,17 @@ function acquireDaemonMachineLock(options) {
   const rootDir = options.rootDir ?? resolveDefaultMachineStateRoot();
   const fingerprint = apiKeyFingerprint(options.apiKey);
   const lockId = getDaemonMachineLockId(options.apiKey);
-  const machineDir = path12.join(rootDir, lockId);
-  const lockDir = path12.join(machineDir, "daemon.lock");
+  const machineDir = path13.join(rootDir, lockId);
+  const lockDir = path13.join(machineDir, "daemon.lock");
   const token = randomUUID4();
-  mkdirSync4(machineDir, { recursive: true });
+  mkdirSync5(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync4(lockDir);
+      mkdirSync5(lockDir);
       const owner = {
         pid: process.pid,
         token,
-        hostname: os6.hostname(),
+        hostname: os7.hostname(),
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         serverUrl: options.serverUrl,
         apiKeyFingerprint: fingerprint.slice(0, 16)
@@ -13259,8 +13521,8 @@ function acquireDaemonMachineLock(options) {
 }
 
 // src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync5, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import path13 from "path";
+import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync3, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import path14 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_FILES = 8;
@@ -13297,7 +13559,7 @@ var LocalRotatingTraceSink = class {
   currentSize = 0;
   sequence = 0;
   constructor(options) {
-    this.traceDir = path13.join(options.machineDir, "traces");
+    this.traceDir = path14.join(options.machineDir, "traces");
     this.maxFileBytes = Math.max(1024, Math.floor(options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES));
     const baseAgeMs = Math.max(1e3, Math.floor(options.maxFileAgeMs ?? DEFAULT_MAX_FILE_AGE_MS));
     const ageJitterMs = Math.max(0, Math.floor(options.maxFileAgeJitterMs ?? 0));
@@ -13323,11 +13585,11 @@ var LocalRotatingTraceSink = class {
     return this.currentFile;
   }
   ensureFile(nextBytes) {
-    mkdirSync5(this.traceDir, { recursive: true, mode: 448 });
+    mkdirSync6(this.traceDir, { recursive: true, mode: 448 });
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
-      this.currentFile = path13.join(
+      this.currentFile = path14.join(
         this.traceDir,
         `daemon-trace-${safeTimestamp(nowMs)}-${process.pid}-${String(this.sequence++).padStart(4, "0")}.jsonl`
       );
@@ -13342,7 +13604,7 @@ var LocalRotatingTraceSink = class {
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync4(path13.join(this.traceDir, file), { force: true });
+      rmSync4(path14.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -13433,7 +13695,7 @@ function isDiagnosticErrorAttr(key) {
 import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
 import { gzipSync } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 
 // src/chatBridgeRequest.ts
 var DEFAULT_CHAT_BRIDGE_TOOL_TIMEOUT_MS = Number.parseInt(
@@ -13533,8 +13795,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path16) {
-  return `${base.replace(/\/+$/, "")}${path16}`;
+function joinUrl(base, path17) {
+  return `${base.replace(/\/+$/, "")}${path17}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -13753,7 +14015,7 @@ var DaemonTraceBundleUploader = class {
     }, nextMs);
   }
   async findUploadCandidates() {
-    const traceDir = path14.join(this.options.machineDir, "traces");
+    const traceDir = path15.join(this.options.machineDir, "traces");
     let names;
     try {
       names = await readdir3(traceDir);
@@ -13765,8 +14027,8 @@ var DaemonTraceBundleUploader = class {
     const currentFile = this.options.currentFileProvider?.();
     const candidates = [];
     for (const name of names.filter((entry) => entry.startsWith("daemon-trace-") && entry.endsWith(".jsonl")).sort()) {
-      const file = path14.join(traceDir, name);
-      if (currentFile && path14.resolve(file) === path14.resolve(currentFile)) continue;
+      const file = path15.join(traceDir, name);
+      if (currentFile && path15.resolve(file) === path15.resolve(currentFile)) continue;
       if (await this.isUploaded(file)) continue;
       try {
         const info = await stat3(file);
@@ -13840,8 +14102,8 @@ var DaemonTraceBundleUploader = class {
     }
   }
   uploadStatePath(file) {
-    const stateDir = path14.join(this.options.machineDir, "trace-uploads");
-    return path14.join(stateDir, `${path14.basename(file)}.uploaded.json`);
+    const stateDir = path15.join(this.options.machineDir, "trace-uploads");
+    return path15.join(stateDir, `${path15.basename(file)}.uploaded.json`);
   }
   async isUploaded(file) {
     try {
@@ -13853,9 +14115,9 @@ var DaemonTraceBundleUploader = class {
   }
   async markUploaded(file, metadata) {
     const stateFile = this.uploadStatePath(file);
-    await mkdir2(path14.dirname(stateFile), { recursive: true, mode: 448 });
+    await mkdir2(path15.dirname(stateFile), { recursive: true, mode: 448 });
     await writeFile2(stateFile, `${JSON.stringify({
-      file: path14.basename(file),
+      file: path15.basename(file),
       uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...metadata
     }, null, 2)}
@@ -13922,7 +14184,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["running_agents_count", "idle_agents_count"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -13958,9 +14220,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -13977,13 +14239,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path15.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path15.resolve(thisDir, "cli", "index.js");
+  const thisDir = path16.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path16.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path15.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path16.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -14172,7 +14434,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path15.join(path15.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path16.join(path16.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -14199,7 +14461,7 @@ var DaemonCore = class {
       sink: this.localTraceSink
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path15.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path16.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -14676,8 +14938,8 @@ var DaemonCore = class {
       capabilities: ["agent:start", "agent:stop", "agent:deliver", "workspace:files"],
       runtimes,
       runningAgents: runningAgentIds,
-      hostname: this.options.hostname ?? os7.hostname(),
-      os: this.options.osDescription ?? `${os7.platform()} ${os7.arch()}`,
+      hostname: this.options.hostname ?? os8.hostname(),
+      os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
       daemonVersion: this.daemonVersion,
       ...this.computerVersion ? { computerVersion: this.computerVersion } : {}
     });
@@ -14741,6 +15003,8 @@ var DaemonCore = class {
 };
 
 export {
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   subscribeDaemonLogs,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,