@slock-ai/daemon 0.57.5-play.20260611173452 → 0.57.6

package/dist/{chunk-NHANGBTA.js → chunk-XQ3HLMCZ.js}

@@ -1879,7 +1879,7 @@ function buildPrompt(config, opts) {
   const checkCmd = "`slock message check`";
   const inboxCheckCmd = "`slock inbox check`";
   const messageDeliveryText = opts.includeStdinNotificationSection ? "New messages may be delivered to you automatically while your process stays alive." : "The daemon will automatically restart you when new messages arrive.";
-  const noConcreteMessageStartupStep = opts.includeStdinNotificationSection ? `3. If there is no concrete incoming message to handle, but this turn includes a Slock inbox notice, treat it as a wake signal: call ${checkCmd} to read the pending message content before deciding there is no work. If there is neither a concrete message nor an inbox notice, stop and wait. ${messageDeliveryText}` : `3. If there is no concrete incoming message to handle, stop and wait. ${messageDeliveryText}`;
+  const noConcreteMessageStartupStep = opts.includeStdinNotificationSection ? `3. If there is no concrete incoming message to handle but this turn includes a Slock inbox notice: the notice means messages exist that you have not seen \u2014 their bodies are withheld to avoid flooding you, not absent (unobserved is not the same as nonexistent). Whether and when to read them is your judgment, now or later; ${checkCmd} reads them and the notice metadata (who, where, how many) helps you triage. Never derive "no work" from a content-free notice alone \u2014 if you choose not to read, that is a deferral to report honestly, not a conclusion that nothing is pending. If there is neither a concrete message nor an inbox notice, stop and wait. ${messageDeliveryText}` : `3. If there is no concrete incoming message to handle, stop and wait. ${messageDeliveryText}`;
   const criticalRules = [
     "- Always communicate through `slock` CLI commands. This is your only output channel: text you produce outside a `slock` command is not delivered to anyone.",
     ...opts.extraCriticalRules,
@@ -2025,7 +2025,7 @@ While you are working, the daemon may write a batched, content-free inbox update
 
 How to handle these:
 - Treat the notification as a non-urgent signal that new Slock messages are waiting; it does not include the message content and does not require an immediate interruption.
-- If an inbox notice is the only input that woke this turn, call ${checkCmd} to read the pending message content before deciding there is no action to take.
+- A content-free notice means messages exist that you have not seen \u2014 not that there is no content or no action. Whether and when to read them is your judgment, now or later; ${checkCmd} is one cheap command and the notice metadata helps you triage. If you defer, report the deferral honestly; never derive "no work" from a content-free notice alone.
 - Keep working until a natural breakpoint. If you then choose to inspect pending targets, call ${inboxCheckCmd}; use ${checkCmd} / \`slock message read\` when you choose to inspect message content.
 - If a message you explicitly read is higher priority, pivot to it. If not, continue your current work.`;
     } else {
@@ -2040,7 +2040,7 @@ ${notifyExample}
 
 How to handle these:
 - The notice is target-scoped and content-free. Its header may show total unread/pending count, while detail rows list the targets changed by this update; it never includes message bodies.
-- If an inbox notice is the only input that woke this turn, call ${checkCmd} to read the pending message content before deciding there is no action to take.
+- A content-free notice means messages exist that you have not seen \u2014 not that there is no content or no action. Whether and when to read them is your judgment, now or later; ${checkCmd} is one cheap command and the notice metadata helps you triage. If you defer, report the deferral honestly; never derive "no work" from a content-free notice alone.
 - Do not interrupt the current step just because a notice arrived. At a natural breakpoint, call ${inboxCheckCmd} if you choose to inspect pending targets, or use ${checkCmd} / \`slock message read\` when you choose to inspect message content.
 - If a message you explicitly read is higher priority, you may pivot to it. If not, continue your current work.`;
     }
@@ -2096,19 +2096,6 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
-// src/authEnv.ts
-var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
-var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
-function scrubDaemonAuthEnv(env) {
-  delete env[DAEMON_API_KEY_ENV];
-  return env;
-}
-function scrubDaemonChildEnv(env) {
-  delete env[DAEMON_API_KEY_ENV];
-  delete env[SLOCK_AGENT_TOKEN_ENV];
-  return env;
-}
-
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -3297,6 +3284,7 @@ function routeFamilyForPath(pathname) {
   if (pathname === "/internal/agent-api/tasks/claim") return "tasks/claim";
   if (pathname === "/internal/agent-api/tasks/update-status") return "tasks/update";
   if (pathname === "/internal/agent-api/tasks" || pathname.startsWith("/internal/agent-api/tasks/")) return "tasks";
+  if (/^\/internal\/agent-api\/attachments\/[^/]+\/comments/.test(pathname)) return "agent-api/attachments/comments";
   if (pathname.startsWith("/internal/agent-api/attachments/")) return "agent-api/attachments";
   if (/^\/internal\/agent-api\/messages\/[^/]+\/resolve$/.test(pathname)) return "agent-api/messages/resolve";
   if (/^\/internal\/agent-api\/messages\/[^/]+\/reactions$/.test(pathname)) return "agent-api/messages/reactions";
@@ -3595,9 +3583,7 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_TOKEN",
-  "SLOCK_AGENT_CREDENTIAL_KEY",
-  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
+  "SLOCK_AGENT_CREDENTIAL_KEY"
 ];
 var cachedOpencliBinPath;
 function resolveOpencliBinPath() {
@@ -3812,7 +3798,7 @@ exec ${shellSingleQuote(process.execPath)} ${shellSingleQuote(opencliBinPath)} "
     ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  scrubDaemonChildEnv(spawnEnv);
+  delete spawnEnv.SLOCK_AGENT_TOKEN;
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -4241,7 +4227,7 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync2;
   if (platform === "win32") {
@@ -4267,7 +4253,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -5656,11 +5642,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return scrubDaemonChildEnv(withWindowsUserEnvironment({
+  return withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps));
+  }, deps);
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -5716,7 +5702,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
+  const env = deps.env ?? process.env;
   const winPath = path7.win32;
   let geminiEntry = null;
   try {
@@ -5853,15 +5839,12 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path8 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
-var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
-var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
-var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -5870,73 +5853,6 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
-function readKimiConfigSource(home = os4.homedir(), env = process.env) {
-  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  if (inlineConfig && inlineConfig.trim()) {
-    return {
-      raw: inlineConfig,
-      explicitPath: null,
-      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
-    };
-  }
-  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
-  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path8.join(home, ".kimi", "config.toml");
-  try {
-    return {
-      raw: readFileSync3(configPath, "utf8"),
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  } catch {
-    return {
-      raw: null,
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  }
-}
-function buildKimiSpawnEnv(env = process.env) {
-  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
-  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
-  return scrubDaemonChildEnv(spawnEnv);
-}
-function buildKimiEffectiveEnv(ctx, overrideEnv) {
-  return {
-    ...process.env,
-    ...ctx.config.envVars || {},
-    ...overrideEnv || {}
-  };
-}
-function buildKimiLaunchOptions(ctx, opts = {}) {
-  const env = buildKimiEffectiveEnv(ctx, opts.env);
-  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
-  const args = [];
-  let configFilePath = null;
-  let configContent = null;
-  if (source.explicitPath) {
-    configFilePath = source.explicitPath;
-  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
-    configFilePath = path8.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
-    configContent = source.raw;
-    if (opts.writeGeneratedConfig !== false) {
-      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
-      chmodSync(configFilePath, 384);
-    }
-  }
-  if (configFilePath) {
-    args.push("--config-file", configFilePath);
-  }
-  if (ctx.config.model && ctx.config.model !== "default") {
-    args.push("--model", ctx.config.model);
-  }
-  return {
-    args,
-    env: buildKimiSpawnEnv(env),
-    configFilePath,
-    configContent
-  };
-}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -5960,25 +5876,7 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId, ctx, opts) => {
-      if (!ctx) return { args: ["--model", modelId] };
-      const launchCtx = {
-        ...ctx,
-        config: {
-          ...ctx.config,
-          model: modelId
-        }
-      };
-      const launch = buildKimiLaunchOptions(launchCtx, {
-        home: opts?.home,
-        writeGeneratedConfig: false
-      });
-      return {
-        args: launch.args,
-        env: launch.env,
-        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
-      };
-    }
+    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -6002,23 +5900,21 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
-    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId,
-      ...launch.args
+      this.sessionId
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const spawnTarget = resolveKimiSpawn(args);
-    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
+    const launch = resolveKimiSpawn(args);
+    const proc = spawn7(launch.command, launch.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -6026,7 +5922,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: spawnTarget.shell
+      shell: launch.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -6139,9 +6035,14 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir(), opts = {}) {
-  const raw = readKimiConfigSource(home, opts.env).raw;
-  if (raw === null) return null;
+function detectKimiModels(home = os4.homedir()) {
+  const configPath = path8.join(home, ".kimi", "config.toml");
+  let raw;
+  try {
+    raw = readFileSync3(configPath, "utf8");
+  } catch {
+    return null;
+  }
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -6379,7 +6280,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
+    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -14184,7 +14085,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["running_agents_count", "idle_agents_count"]
   }
 };
-var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
+var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -14220,9 +14121,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args, env = {}) {
+function parseDaemonCliArgs(args) {
   let serverUrl = "";
-  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
+  let apiKey = "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -14250,6 +14151,17 @@ function resolveSlockCliPath(moduleUrl = import.meta.url) {
     return workspaceDistPath;
   }
 }
+function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
+  try {
+    return resolveSlockCliPath(moduleUrl);
+  } catch {
+    return "";
+  }
+}
+async function runBundledSlockCli(argv) {
+  process.argv = [process.execPath, "slock", ...argv];
+  await import("./dist-CYKZS5JA.js");
+}
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
   const versions = {};
@@ -14399,7 +14311,7 @@ var DaemonCore = class {
     this.options = options;
     this.daemonVersion = options.daemonVersion ?? readDaemonVersion();
     this.computerVersion = (process.env.SLOCK_COMPUTER_VERSION || "").trim() || null;
-    this.slockCliPath = options.slockCliPath ?? resolveSlockCliPath();
+    this.slockCliPath = options.slockCliPath ?? resolveSlockCliPathOrEmpty();
     this.slockHome = resolveSlockHome();
     process.env[SLOCK_HOME_ENV] = this.slockHome;
     this.injectedTracer = Boolean(options.tracer);
@@ -14897,18 +14809,29 @@ var DaemonCore = class {
       case "computer:restart":
       case "computer:upgrade": {
         const action = msg.type === "computer:restart" ? "restart" : "upgrade";
+        const requestId = msg.requestId;
         this.recordDaemonTrace("daemon.computer_control.received", {
           action,
-          handled: Boolean(this.options.onComputerControl)
+          handled: Boolean(this.options.onComputerControl),
+          ...requestId ? { request_id: requestId } : {}
         });
         if (this.options.onComputerControl) {
-          try {
-            this.options.onComputerControl(action);
-          } catch (err) {
+          const ctx = {
+            requestId,
+            emitUpgradeProgress: (ev) => {
+              if (!requestId) return;
+              this.connection.send({ type: "computer:upgrade:progress", requestId, ...ev });
+            },
+            emitUpgradeDone: (ev) => {
+              if (!requestId) return;
+              this.connection.send({ type: "computer:upgrade:done", requestId, ...ev });
+            }
+          };
+          void Promise.resolve().then(() => this.options.onComputerControl(action, ctx)).catch((err) => {
             logger.error(
               `[Daemon] computer:${action} control handler failed: ${err instanceof Error ? err.message : String(err)}`
             );
-          }
+          });
         } else {
           logger.info(`[Daemon] Ignoring computer:${action} \u2014 not launched by a Computer service.`);
         }
@@ -14949,6 +14872,22 @@ var DaemonCore = class {
       idle_agents_count: idleAgentSessions.length,
       runtime_profile_reports_count: runtimeProfileReports.length
     });
+    if (this.options.onComputerUpgradeReconcile) {
+      void Promise.resolve().then(
+        () => this.options.onComputerUpgradeReconcile((done) => {
+          this.connection.send({ type: "computer:upgrade:done", ...done });
+          this.recordDaemonTrace("daemon.computer_upgrade.reconciled", {
+            request_id: done.requestId,
+            ok: done.ok,
+            ...done.newVersion ? { new_version: done.newVersion } : {}
+          });
+        })
+      ).catch((err) => {
+        logger.error(
+          `[Daemon] computer upgrade reconcile failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+    }
     for (const agentId of runningAgentIds) {
       const sessionId = this.agentManager.getAgentSessionId(agentId);
       const launchId = this.agentManager.getAgentLaunchId(agentId);
@@ -15003,8 +14942,6 @@ var DaemonCore = class {
 };
 
 export {
-  DAEMON_API_KEY_ENV,
-  scrubDaemonAuthEnv,
   subscribeDaemonLogs,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
@@ -15013,6 +14950,8 @@ export {
   parseDaemonCliArgs,
   readDaemonVersion,
   resolveSlockCliPath,
+  resolveSlockCliPathOrEmpty,
+  runBundledSlockCli,
   detectRuntimes,
   DaemonCore
 };

package/dist/cli/index.js

@@ -166,6 +166,8 @@ function routeFamilyForPath(pathname) {
   if (normalized === "/internal/agent-api/tasks" || normalized.startsWith("/internal/agent-api/tasks/")) {
     return "tasks";
   }
+  if (/^\/internal\/agent-api\/attachments\/[^/]+\/comments/.test(normalized)) return "agent-api/attachments/comments";
+  if (/^\/api\/attachments\/[^/]+\/comments/.test(normalized)) return "agent-api/attachments/comments";
   if (normalized.startsWith("/internal/agent-api/attachments/")) return "agent-api/attachments";
   if (normalized.startsWith("/api/attachments/")) return "attachments/download";
   if (/^\/internal\/agent-api\/messages\/[^/]+\/reactions$/.test(normalized)) return "agent-api/messages/reactions";
@@ -18751,6 +18753,76 @@ function registerAttachmentViewCommand(parent, runtimeOptions) {
   registerCliCommand(parent, attachmentViewCommand, runtimeOptions);
 }
 
+// src/commands/attachment/comments.ts
+function anchorSummary(anchor) {
+  if (anchor.type === "md-section") {
+    const title = anchor.data.headingTitle ?? anchor.data.headingId;
+    return typeof title === "string" && title ? `\xA7 ${title}` : "\xA7 section";
+  }
+  if (anchor.type === "lines" || anchor.type === "csv-rows") {
+    const start = Number(anchor.data.start);
+    const end = Number(anchor.data.end ?? start);
+    if (!Number.isFinite(start)) return anchor.type;
+    const prefix = anchor.type === "lines" ? "L" : "rows ";
+    return start === (Number.isFinite(end) ? end : start) ? `${prefix}${start}` : `${prefix}${start}\u2013${end}`;
+  }
+  if (anchor.type === "html-region") {
+    const quote = anchor.data.quote;
+    if (typeof quote === "string" && quote.trim().length > 0) {
+      const trimmed = quote.trim();
+      return trimmed.length > 60 ? `${trimmed.slice(0, 60)}\u2026` : trimmed;
+    }
+    return "HTML region";
+  }
+  return anchor.type;
+}
+var attachmentCommentsCommand = defineCommand(
+  {
+    name: "comments",
+    description: "List comments scoped to an attachment",
+    options: [
+      { flags: "--id <attachmentId>", description: "Attachment UUID" },
+      { flags: "--limit <n>", description: "Max comments to return (default 200)" }
+    ]
+  },
+  async (ctx, opts) => {
+    const id = opts.id?.trim();
+    if (!id) {
+      throw new CliError({ code: "INVALID_ARG", message: "--id is required" });
+    }
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const limitParam = opts.limit && Number.isFinite(Number(opts.limit)) ? `?limit=${Number(opts.limit)}` : "";
+    const res = await client.request(
+      "GET",
+      `/api/attachments/${encodeURIComponent(id)}/comments${limitParam}`
+    );
+    if (!res.ok || !res.data) {
+      const code = res.status >= 500 ? "SERVER_5XX" : "COMMENTS_FAILED";
+      throw new CliError({ code, message: res.error ?? `HTTP ${res.status}` });
+    }
+    const { comments, threadChannelId } = res.data;
+    if (comments.length === 0) {
+      writeText(ctx.io, `No comments on attachment ${id.slice(0, 8)}.
+`);
+      return;
+    }
+    const lines = [`## Comments on attachment ${id.slice(0, 8)} (${comments.length})`];
+    for (const c of comments) {
+      const check2 = c.reactions.some((r) => r.emoji === "\u2705") ? " \u2705" : "";
+      const anchor = c.anchor ? ` [anchor: ${anchorSummary(c.anchor)}]` : "";
+      lines.push(`[msg=${c.id.slice(0, 8)} time=${c.createdAt} type=${c.senderType}]${check2}${anchor} @${c.senderName}: ${c.content}`);
+    }
+    if (threadChannelId) {
+      lines.push(`(full conversation lives in thread channel ${threadChannelId})`);
+    }
+    writeText(ctx.io, lines.join("\n") + "\n");
+  }
+);
+function registerAttachmentCommentsCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, attachmentCommentsCommand, runtimeOptions);
+}
+
 // src/commands/task/_format.ts
 function formatTaskList(channel, data, statusFilter) {
   if (!data.tasks || data.tasks.length === 0) {
@@ -20390,6 +20462,7 @@ registerReactCommand(messageCmd);
 var attachmentCmd = program.command("attachment").description("Attachment operations");
 registerAttachmentUploadCommand(attachmentCmd);
 registerAttachmentViewCommand(attachmentCmd);
+registerAttachmentCommentsCommand(attachmentCmd);
 var taskCmd = program.command("task").description("Task board operations");
 registerTaskListCommand(taskCmd);
 registerTaskCreateCommand(taskCmd);

package/dist/core.js

@@ -1,5 +1,4 @@
 import {
-  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -7,13 +6,13 @@ import {
   parseDaemonCliArgs,
   readDaemonVersion,
   resolveSlockCliPath,
+  resolveSlockCliPathOrEmpty,
   resolveWorkspaceDirectoryPath,
+  runBundledSlockCli,
   scanWorkspaceDirectories,
-  scrubDaemonAuthEnv,
   subscribeDaemonLogs
-} from "./chunk-NHANGBTA.js";
+} from "./chunk-XQ3HLMCZ.js";
 export {
-  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -21,8 +20,9 @@ export {
   parseDaemonCliArgs,
   readDaemonVersion,
   resolveSlockCliPath,
+  resolveSlockCliPathOrEmpty,
   resolveWorkspaceDirectoryPath,
+  runBundledSlockCli,
   scanWorkspaceDirectories,
-  scrubDaemonAuthEnv,
   subscribeDaemonLogs
 };