@symerian/symi 2.8.17 → 2.9.0

package/dist/{register.status-health-sessions-DaPK2tow.js → register.status-health-sessions-CCQs235z.js}

@@ -15,7 +15,7 @@ import "./client-CJIMV1WD.js";
 import "./call-M4YyUnwu.js";
 import "./message-channel-C9dERklz.js";
 import "./pairing-token-Byh6drgn.js";
-import "./subagent-registry-CncIZPCd.js";
+import "./subagent-registry-D0IYimMO.js";
 import "./sessions-BPD85pWA.js";
 import "./tokens-Csntmwwn.js";
 import "./plugins-CwSlLxM8.js";
@@ -53,8 +53,8 @@ import "./tool-images-CVLISeRT.js";
 import "./thinking-8sKPnzpp.js";
 import "./models-config-J1x_DaPn.js";
 import "./reply-prefix-BUN71nd5.js";
-import "./memory-cli-lJe72a5i.js";
-import "./manager-CgQo1mIM.js";
+import "./memory-cli-OW9XfyYu.js";
+import "./manager-QPF0UtOC.js";
 import "./gemini-auth-DEakvf-D.js";
 import "./retry-C4Q_VPOo.js";
 import "./sqlite-BP8tiuca.js";
@@ -109,8 +109,8 @@ import "./service-RxN7lQKN.js";
 import "./diagnostics-C6xPE2ln.js";
 import "./table-Bka4fasy.js";
 import "./audit-CuKP86d_.js";
-import { n as statusCommand } from "./status-Ca_VZkZV.js";
-import { r as healthCommand } from "./health-C4tWTDu_.js";
+import { n as statusCommand } from "./status-PfvX-BjO.js";
+import { r as healthCommand } from "./health-CcV5nKIK.js";
 import "./update-check-BNjupSIM.js";
 import "./dm-policy-shared-JiSNSaKz.js";
 import "./node-service-B-qdOCNb.js";

package/dist/{register.status-health-sessions-DsptpS7K.js → register.status-health-sessions-CT_SmmOH.js}

@@ -1,7 +1,7 @@
 import "./paths-Cqn-zk3M.js";
 import { B as theme, P as setVerbose, k as info, z as isRich } from "./utils-B-0b9bGM.js";
 import "./thinking-EAliFiVK.js";
-import { S as resolveSessionModelRef, h as classifySessionKey, mr as lookupContextTokens } from "./reply-2awhibgG.js";
+import { S as resolveSessionModelRef, h as classifySessionKey, mr as lookupContextTokens } from "./reply-CgyjcoxC.js";
 import { S as parseAgentSessionKey } from "./session-key-DCt45XZa.js";
 import "./registry-Cja8eT7G.js";
 import { f as defaultRuntime } from "./subsystem-D9vIQve0.js";
@@ -61,8 +61,8 @@ import "./diagnostic-session-state-CUslJyKP.js";
 import "./send-DpMnSIi5.js";
 import "./model-ECsJuJew.js";
 import "./reply-prefix-CE2YmmsD.js";
-import "./memory-cli-BMb31chU.js";
-import "./manager-DhGfNqfc.js";
+import "./memory-cli-BTByRgM0.js";
+import "./manager-9Mni2AA9.js";
 import "./retry-BoS4e4X_.js";
 import "./sqlite-D55gRQbH.js";
 import "./target-errors-C9e6dMU_.js";
@@ -115,8 +115,8 @@ import "./service-DzLem5vL.js";
 import "./diagnostics-1uBuB9IE.js";
 import "./table-BWuvjnmY.js";
 import "./audit-C9nq99IR.js";
-import { t as statusCommand } from "./status-Dkr4Celv.js";
-import { r as healthCommand } from "./health-dA8r4WJ4.js";
+import { t as statusCommand } from "./status-CG5iHUJ6.js";
+import { r as healthCommand } from "./health-Dl2WRoTa.js";
 import "./update-check-Bbvpax6u.js";
 import "./dm-policy-shared-KlzpDeT_.js";
 import "./node-service-DxPZ_ZFk.js";

package/dist/{register.subclis-17z5d7uO.js → register.subclis-ByZAz4st.js}

@@ -49,7 +49,7 @@ const entries = [
 		description: "Run, inspect, and query the WebSocket Gateway",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./gateway-cli-eNV6kb1V.js")).registerGatewayCli(program);
+			(await import("./gateway-cli-Bnh42-56.js")).registerGatewayCli(program);
 		}
 	},
 	{
@@ -81,7 +81,7 @@ const entries = [
 		description: "Discover, scan, and configure models",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./models-cli-CHjxevMe.js")).registerModelsCli(program);
+			(await import("./models-cli-Cy6H1sFq.js")).registerModelsCli(program);
 		}
 	},
 	{
@@ -161,7 +161,7 @@ const entries = [
 		description: "Manage internal agent hooks",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./hooks-cli-DYn9nXX0.js")).registerHooksCli(program);
+			(await import("./hooks-cli-CTcHtm_0.js")).registerHooksCli(program);
 		}
 	},
 	{
@@ -185,7 +185,7 @@ const entries = [
 		description: "Secure DM pairing (approve inbound requests)",
 		hasSubcommands: true,
 		register: async (program) => {
-			const { registerPluginCliCommands } = await import("./cli-B1QQv1cb.js");
+			const { registerPluginCliCommands } = await import("./cli-BX54CAM7.js");
 			registerPluginCliCommands(program, await loadConfig());
 			(await import("./pairing-cli-7X1qlhzF.js")).registerPairingCli(program);
 		}
@@ -195,8 +195,8 @@ const entries = [
 		description: "Manage Symi plugins and extensions",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./plugins-cli-ByG6o7D2.js")).registerPluginsCli(program);
-			const { registerPluginCliCommands } = await import("./cli-B1QQv1cb.js");
+			(await import("./plugins-cli-3h1N5N8n.js")).registerPluginsCli(program);
+			const { registerPluginCliCommands } = await import("./cli-BX54CAM7.js");
 			registerPluginCliCommands(program, await loadConfig());
 		}
 	},
@@ -205,7 +205,7 @@ const entries = [
 		description: "Manage connected chat channels (Telegram, Discord, etc.)",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./channels-cli-By_SbriI.js")).registerChannelsCli(program);
+			(await import("./channels-cli-h3GnmmM9.js")).registerChannelsCli(program);
 		}
 	},
 	{
@@ -237,7 +237,7 @@ const entries = [
 		description: "Update Symi and inspect update channel status",
 		hasSubcommands: true,
 		register: async (program) => {
-			(await import("./update-cli-BO1uw-SU.js")).registerUpdateCli(program);
+			(await import("./update-cli-CL1_LPBS.js")).registerUpdateCli(program);
 		}
 	},
 	{
@@ -245,7 +245,7 @@ const entries = [
 		description: "Generate shell completion script",
 		hasSubcommands: false,
 		register: async (program) => {
-			(await import("./completion-cli-B6s_3rEE.js").then((n) => n.n)).registerCompletionCli(program);
+			(await import("./completion-cli-BYXofVqv.js").then((n) => n.n)).registerCompletionCli(program);
 		}
 	}
 ];

package/dist/{reply-2awhibgG.js → reply-CgyjcoxC.js}

@@ -60,8 +60,8 @@ import { r as getDiagnosticSessionState } from "./diagnostic-session-state-CUslJ
 import { A as hasBotMention, B as resolveSenderAllowMatch, C as buildTelegramGroupPeerId, D as describeReplyTarget, E as buildTypingThreadParams, F as resolveTelegramReplyId, G as toLocationContext, H as isSenderIdAllowed, I as resolveTelegramStreamMode, J as parseTelegramTarget, K as withTelegramApiErrorLogging, L as resolveTelegramThreadSpec, M as resolveTelegramForumThreadId, N as resolveTelegramGroupAllowFromContext, O as expandTextLinks, P as resolveTelegramMediaPlaceholder, R as isSenderAllowed$1, S as buildTelegramGroupFrom, T as buildTelegramThreadParams, U as mergeAllowFromSources, V as firstDefined$1, W as formatLocationText, Y as resolveTelegramTargetChatType, _ as resolveTelegramFetch, a as reactMessageTelegram, b as buildSenderLabel, c as sendStickerTelegram, d as wasSentByBot, f as isRecoverableTelegramNetworkError, g as wrapFileReferencesInHtml, h as renderTelegramHtmlText, i as editMessageTelegram, j as normalizeForwardedContext, k as extractTelegramLocation, m as markdownToTelegramHtml, n as createForumTopicTelegram, o as sendMessageTelegram, p as markdownToTelegramChunks, q as isVoiceCompatibleAudio, r as deleteMessageTelegram, s as sendPollTelegram, t as buildInlineKeyboard, u as resolveTelegramVoiceSend, v as splitTelegramCaption, w as buildTelegramParentPeer, x as buildSenderName, y as buildGroupLabel, z as normalizeAllowFromWithStore$1 } from "./send-DpMnSIi5.js";
 import { a as buildModelAliasLines, n as resolveModel } from "./model-ECsJuJew.js";
 import { a as resolveAgentIdentity, i as resolveAckReaction, o as resolveEffectiveMessagesConfig, r as resolveResponsePrefixTemplate, s as resolveHumanDelayConfig, t as createReplyPrefixOptions } from "./reply-prefix-CE2YmmsD.js";
-import { i as resolveMemoryBackendConfig, n as registerMemoryCli, r as getMemorySearchManager } from "./memory-cli-BMb31chU.js";
-import { a as resolveMemorySearchConfig, t as MemoryIndexManager } from "./manager-DhGfNqfc.js";
+import { i as resolveMemoryBackendConfig, n as registerMemoryCli, r as getMemorySearchManager } from "./memory-cli-BTByRgM0.js";
+import { a as resolveMemorySearchConfig, t as MemoryIndexManager } from "./manager-9Mni2AA9.js";
 import { n as retryAsync } from "./retry-BoS4e4X_.js";
 import { c as imageResultFromFile, d as readNumberParam, f as readReactionParams, h as readStringParam, l as jsonResult, m as readStringOrNumberParam, n as missingTargetError, o as createActionGate, p as readStringArrayParam, r as unknownTargetError, s as imageResult, t as ambiguousTargetError, u as parseAvailableTags } from "./target-errors-C9e6dMU_.js";
 import { a as chunkText, c as resolveChunkMode, d as isSafeFenceBreak, f as parseFenceSpans, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit, o as chunkTextWithMode, r as chunkMarkdownText, t as chunkByNewline, u as findFenceSpanAt } from "./chunk-DIi9uyC6.js";
@@ -9782,16 +9782,16 @@ function shouldComputeCommandAuthorized(text, cfg, options) {
 
 //#endregion
 //#region src/channels/sender-label.ts
-function normalize(value) {
+function normalize$1(value) {
 	const trimmed = value?.trim();
 	return trimmed ? trimmed : void 0;
 }
 function resolveSenderLabel(params) {
-	const name = normalize(params.name);
-	const username = normalize(params.username);
-	const tag = normalize(params.tag);
-	const e164 = normalize(params.e164);
-	const id = normalize(params.id);
+	const name = normalize$1(params.name);
+	const username = normalize$1(params.username);
+	const tag = normalize$1(params.tag);
+	const e164 = normalize$1(params.e164);
+	const id = normalize$1(params.id);
 	const display = name ?? username ?? tag ?? "";
 	const idPart = e164 ?? id ?? "";
 	if (display && idPart && display !== idPart) return `${display} (${idPart})`;
@@ -31935,7 +31935,7 @@ async function runAgentTurn(params) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-Dn33Cd3-.js");
+			const { sendMessageWhatsApp } = await import("./web-DmgQtLx3.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
@@ -50366,7 +50366,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-Dn33Cd3-.js");
+	webChannelPromise ??= import("./web-DmgQtLx3.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {
@@ -54060,6 +54060,91 @@ function wrapToolWithAbortSignal(tool, abortSignal) {
 	};
 }
 
+//#endregion
+//#region src/agents/pi-tools.read-edit-guard.ts
+const RETRY_GUIDANCE_SUFFIX$1 = " Read the file first, then retry the edit.";
+function readGuardError(filePath) {
+	return /* @__PURE__ */ new Error(`Edit refused: '${filePath}' has not been read in this session. The edit tool requires the agent to read the file first so oldText can match real content rather than hallucinated content.${RETRY_GUIDANCE_SUFFIX$1}`);
+}
+function extractPath(args) {
+	if (!args || typeof args !== "object") return;
+	const record = args;
+	const candidate = record.path ?? record.file_path;
+	if (typeof candidate !== "string") return;
+	const trimmed = candidate.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function wrapReadToolWithTracker(tool, tracker) {
+	return {
+		...tool,
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const result = await tool.execute(toolCallId, args, signal, onUpdate);
+			if (!(!!result && typeof result === "object" && result.isError === true)) {
+				const filePath = extractPath(args);
+				if (filePath) tracker.recordRead(filePath);
+			}
+			return result;
+		}
+	};
+}
+function wrapWriteToolWithTracker(tool, tracker) {
+	return {
+		...tool,
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const result = await tool.execute(toolCallId, args, signal, onUpdate);
+			if (!(!!result && typeof result === "object" && result.isError === true)) {
+				const filePath = extractPath(args);
+				if (filePath) tracker.recordWrite(filePath);
+			}
+			return result;
+		}
+	};
+}
+function wrapEditToolWithGuard(tool, tracker) {
+	return {
+		...tool,
+		execute: async (toolCallId, args, signal, onUpdate) => {
+			const filePath = extractPath(args);
+			if (filePath && !tracker.hasObserved(filePath)) throw readGuardError(filePath);
+			return tool.execute(toolCallId, args, signal, onUpdate);
+		}
+	};
+}
+
+//#endregion
+//#region src/agents/pi-tools.read-edit-tracker.ts
+function normalize(filePath, workspaceRoot) {
+	if (!workspaceRoot) return filePath;
+	if (path.isAbsolute(filePath)) return path.normalize(filePath);
+	return path.resolve(workspaceRoot, filePath);
+}
+function createReadEditTracker(opts = {}) {
+	const observed = /* @__PURE__ */ new Map();
+	const record = (filePath, kind) => {
+		if (typeof filePath !== "string" || !filePath.trim()) return;
+		const key = normalize(filePath.trim(), opts.workspaceRoot);
+		const prior = observed.get(key);
+		if (kind === "written" || prior !== "written") observed.set(key, kind);
+	};
+	return {
+		recordRead: (filePath) => record(filePath, "read"),
+		recordWrite: (filePath) => record(filePath, "written"),
+		observation: (filePath) => {
+			if (typeof filePath !== "string" || !filePath.trim()) return null;
+			const key = normalize(filePath.trim(), opts.workspaceRoot);
+			return observed.get(key) ?? null;
+		},
+		hasObserved: (filePath) => {
+			if (typeof filePath !== "string" || !filePath.trim()) return false;
+			const key = normalize(filePath.trim(), opts.workspaceRoot);
+			return observed.has(key);
+		},
+		reset: () => {
+			observed.clear();
+		}
+	};
+}
+
 //#endregion
 //#region src/media/sniff-mime-from-base64.ts
 async function sniffMimeFromBase64(base64) {
@@ -56961,8 +57046,39 @@ const GatewayToolSchema = Type.Object({
 	baseHash: Type.Optional(Type.String()),
 	sessionKey: Type.Optional(Type.String()),
 	note: Type.Optional(Type.String()),
-	restartDelayMs: Type.Optional(Type.Number())
+	restartDelayMs: Type.Optional(Type.Number()),
+	userRequestAcknowledgment: Type.Optional(Type.String())
 });
+/** Actions that mutate gateway state and require explicit user authorization. */
+const DESTRUCTIVE_ACTIONS = new Set([
+	"config.apply",
+	"config.patch",
+	"update.run"
+]);
+/** Minimum length for a meaningful authorization message. */
+const MIN_AUTHORIZATION_LENGTH = 10;
+/**
+* Asserts the user's request was explicitly acknowledged for destructive
+* actions. Throws a descriptive error if the acknowledgment is missing,
+* empty, or trivially short.
+*
+* NOTE: This is defense-in-depth, not a hard barrier. A determined model
+* could still populate the field with fabricated text. The barrier exists
+* to:
+*   1. Force the agent to deliberately compose a justification (vs. blind
+*      tool invocation).
+*   2. Provide an audit trail (the acknowledgment is logged with the tool
+*      call args).
+*   3. Surface for future tightening (e.g., matching against real session
+*      history).
+*/
+function assertUserAuthorization(action, params) {
+	if (!DESTRUCTIVE_ACTIONS.has(action)) return;
+	const ack = params.userRequestAcknowledgment;
+	const trimmed = typeof ack === "string" ? ack.trim() : "";
+	if (!trimmed) throw new Error(`Action '${action}' requires an explicit user authorization. Pass userRequestAcknowledgment with a paraphrase of the user's request (e.g., "user said: please update Symi"). If the user did not explicitly request this action, ask them first instead of invoking it.`);
+	if (trimmed.length < MIN_AUTHORIZATION_LENGTH) throw new Error(`Action '${action}' requires a substantive userRequestAcknowledgment (minimum ${MIN_AUTHORIZATION_LENGTH} characters describing the user's request). Received: ${JSON.stringify(trimmed)}.`);
+}
 function createGatewayTool(opts) {
 	return {
 		label: "Gateway",
@@ -56973,6 +57089,7 @@ function createGatewayTool(opts) {
 		execute: async (_toolCallId, args) => {
 			const params = args;
 			const action = readStringParam(params, "action", { required: true });
+			assertUserAuthorization(action, params);
 			if (action === "restart") {
 				if (!isRestartEnabled(opts?.config)) throw new Error("Gateway restart is disabled (commands.restart=false).");
 				const sessionKey = typeof params.sessionKey === "string" && params.sessionKey.trim() ? params.sessionKey.trim() : opts?.agentSessionKey?.trim() || void 0;
@@ -65265,33 +65382,34 @@ function createSymiCodingTools(options) {
 	});
 	if (sandboxRoot && !sandboxFsBridge) throw new Error("Sandbox filesystem bridge is unavailable.");
 	const imageSanitization = resolveImageSanitizationLimits(options?.config);
+	const readEditTracker = createReadEditTracker({ workspaceRoot: sandboxRoot ?? workspaceRoot });
 	const base = codingTools.flatMap((tool) => {
 		if (tool.name === readTool.name) {
 			if (sandboxRoot) {
-				const sandboxed = createSandboxedReadTool({
+				const tracked = wrapReadToolWithTracker(createSandboxedReadTool({
 					root: sandboxRoot,
 					bridge: sandboxFsBridge,
 					modelContextWindowTokens: options?.modelContextWindowTokens,
 					imageSanitization
-				});
-				return [workspaceOnly ? wrapToolWorkspaceRootGuard(sandboxed, sandboxRoot) : sandboxed];
+				}), readEditTracker);
+				return [workspaceOnly ? wrapToolWorkspaceRootGuard(tracked, sandboxRoot) : tracked];
 			}
-			const wrapped = createSymiReadTool(createReadTool(workspaceRoot), {
+			const tracked = wrapReadToolWithTracker(createSymiReadTool(createReadTool(workspaceRoot), {
 				modelContextWindowTokens: options?.modelContextWindowTokens,
 				imageSanitization
-			});
-			return [workspaceOnly ? wrapToolWorkspaceRootGuard(wrapped, workspaceRoot) : wrapped];
+			}), readEditTracker);
+			return [workspaceOnly ? wrapToolWorkspaceRootGuard(tracked, workspaceRoot) : tracked];
 		}
 		if (tool.name === "bash" || tool.name === execToolName) return [];
 		if (tool.name === "write") {
 			if (sandboxRoot) return [];
-			const wrapped = wrapToolParamNormalization(createWriteTool(workspaceRoot), CLAUDE_PARAM_GROUPS.write);
-			return [workspaceOnly ? wrapToolWorkspaceRootGuard(wrapped, workspaceRoot) : wrapped];
+			const tracked = wrapWriteToolWithTracker(wrapToolParamNormalization(createWriteTool(workspaceRoot), CLAUDE_PARAM_GROUPS.write), readEditTracker);
+			return [workspaceOnly ? wrapToolWorkspaceRootGuard(tracked, workspaceRoot) : tracked];
 		}
 		if (tool.name === "edit") {
 			if (sandboxRoot) return [];
-			const wrapped = wrapToolParamNormalization(createEditTool(workspaceRoot), CLAUDE_PARAM_GROUPS.edit);
-			return [workspaceOnly ? wrapToolWorkspaceRootGuard(wrapped, workspaceRoot) : wrapped];
+			const guarded = wrapEditToolWithGuard(wrapToolParamNormalization(createEditTool(workspaceRoot), CLAUDE_PARAM_GROUPS.edit), readEditTracker);
+			return [workspaceOnly ? wrapToolWorkspaceRootGuard(guarded, workspaceRoot) : guarded];
 		}
 		return [tool];
 	});
@@ -65334,22 +65452,18 @@ function createSymiCodingTools(options) {
 		} : void 0,
 		workspaceOnly: applyPatchWorkspaceOnly
 	});
+	const sandboxedEditTool = sandboxRoot ? wrapEditToolWithGuard(createSandboxedEditTool({
+		root: sandboxRoot,
+		bridge: sandboxFsBridge
+	}), readEditTracker) : null;
+	const sandboxedWriteTool = sandboxRoot ? wrapWriteToolWithTracker(createSandboxedWriteTool({
+		root: sandboxRoot,
+		bridge: sandboxFsBridge
+	}), readEditTracker) : null;
 	const withHooks = applyToolPolicyPipeline({
 		tools: applyOwnerOnlyToolPolicy([
 			...base,
-			...sandboxRoot ? allowWorkspaceWrites ? [workspaceOnly ? wrapToolWorkspaceRootGuard(createSandboxedEditTool({
-				root: sandboxRoot,
-				bridge: sandboxFsBridge
-			}), sandboxRoot) : createSandboxedEditTool({
-				root: sandboxRoot,
-				bridge: sandboxFsBridge
-			}), workspaceOnly ? wrapToolWorkspaceRootGuard(createSandboxedWriteTool({
-				root: sandboxRoot,
-				bridge: sandboxFsBridge
-			}), sandboxRoot) : createSandboxedWriteTool({
-				root: sandboxRoot,
-				bridge: sandboxFsBridge
-			})] : [] : [],
+			...sandboxRoot ? allowWorkspaceWrites && sandboxedEditTool && sandboxedWriteTool ? [workspaceOnly ? wrapToolWorkspaceRootGuard(sandboxedEditTool, sandboxRoot) : sandboxedEditTool, workspaceOnly ? wrapToolWorkspaceRootGuard(sandboxedWriteTool, sandboxRoot) : sandboxedWriteTool] : [] : [],
 			...applyPatchTool ? [applyPatchTool] : [],
 			execTool,
 			processTool,

package/dist/{run-main-CfVO6DFS.js → run-main-xmWpjZL9.js}

@@ -14,7 +14,7 @@ import "./client-CJIMV1WD.js";
 import "./call-M4YyUnwu.js";
 import "./message-channel-C9dERklz.js";
 import "./pairing-token-Byh6drgn.js";
-import "./subagent-registry-CncIZPCd.js";
+import "./subagent-registry-D0IYimMO.js";
 import "./sessions-BPD85pWA.js";
 import "./tokens-Csntmwwn.js";
 import "./plugins-CwSlLxM8.js";
@@ -52,8 +52,8 @@ import "./tool-images-CVLISeRT.js";
 import "./thinking-8sKPnzpp.js";
 import "./models-config-J1x_DaPn.js";
 import "./reply-prefix-BUN71nd5.js";
-import "./memory-cli-lJe72a5i.js";
-import "./manager-CgQo1mIM.js";
+import "./memory-cli-OW9XfyYu.js";
+import "./manager-QPF0UtOC.js";
 import "./gemini-auth-DEakvf-D.js";
 import "./retry-C4Q_VPOo.js";
 import "./sqlite-BP8tiuca.js";
@@ -102,9 +102,9 @@ import { t as ensureSymiCliOnPath } from "./path-env-CaiY2aOj.js";
 import "./catalog-KcLvtTfa.js";
 import "./note-DewoEWtc.js";
 import "./plugin-auto-enable-pQEg2Mly.js";
-import { t as ensurePluginRegistryLoaded } from "./plugin-registry-DEhkDNDx.js";
+import { t as ensurePluginRegistryLoaded } from "./plugin-registry-Bn9Mj8mP.js";
 import { t as assertSupportedRuntime } from "./runtime-guard-BofkqBu7.js";
-import { t as emitCliBanner } from "./banner-S1NGA6-s.js";
+import { t as emitCliBanner } from "./banner-Bf46tqiY.js";
 import "./doctor-config-flow-B2dVxbL7.js";
 import { n as ensureConfigReady } from "./config-guard-BvqCjFPk.js";
 import process$1 from "node:process";
@@ -119,7 +119,7 @@ const routeHealth = {
 		const verbose = getVerboseFlag(argv, { includeDebug: true });
 		const timeoutMs = getPositiveIntFlagValue(argv, "--timeout");
 		if (timeoutMs === null) return false;
-		const { healthCommand } = await import("./health-C4tWTDu_.js").then((n) => n.i);
+		const { healthCommand } = await import("./health-CcV5nKIK.js").then((n) => n.i);
 		await healthCommand({
 			json,
 			timeoutMs,
@@ -139,7 +139,7 @@ const routeStatus = {
 		const verbose = getVerboseFlag(argv, { includeDebug: true });
 		const timeoutMs = getPositiveIntFlagValue(argv, "--timeout");
 		if (timeoutMs === null) return false;
-		const { statusCommand } = await import("./status-Ca_VZkZV.js").then((n) => n.t);
+		const { statusCommand } = await import("./status-PfvX-BjO.js").then((n) => n.t);
 		await statusCommand({
 			json,
 			deep,
@@ -173,7 +173,7 @@ const routeAgentsList = {
 	run: async (argv) => {
 		const json = hasFlag(argv, "--json");
 		const bindings = hasFlag(argv, "--bindings");
-		const { agentsListCommand } = await import("./agents-9cAyC5ED.js").then((n) => n.t);
+		const { agentsListCommand } = await import("./agents-CvNeiuSB.js").then((n) => n.t);
 		await agentsListCommand({
 			json,
 			bindings
@@ -190,7 +190,7 @@ const routeMemoryStatus = {
 		const deep = hasFlag(argv, "--deep");
 		const index = hasFlag(argv, "--index");
 		const verbose = hasFlag(argv, "--verbose");
-		const { runMemoryStatus } = await import("./memory-cli-lJe72a5i.js").then((n) => n.t);
+		const { runMemoryStatus } = await import("./memory-cli-OW9XfyYu.js").then((n) => n.t);
 		await runMemoryStatus({
 			agent,
 			json,
@@ -244,7 +244,7 @@ const routes = [
 			const pathArg = getCommandPositionals(argv)[2];
 			if (!pathArg) return false;
 			const json = hasFlag(argv, "--json");
-			const { runConfigGet } = await import("./config-cli-DCGgd-ZL.js");
+			const { runConfigGet } = await import("./config-cli-Deoo6r2K.js");
 			await runConfigGet({
 				path: pathArg,
 				json
@@ -257,7 +257,7 @@ const routes = [
 		run: async (argv) => {
 			const pathArg = getCommandPositionals(argv)[2];
 			if (!pathArg) return false;
-			const { runConfigUnset } = await import("./config-cli-DCGgd-ZL.js");
+			const { runConfigUnset } = await import("./config-cli-Deoo6r2K.js");
 			await runConfigUnset({ path: pathArg });
 			return true;
 		}
@@ -271,7 +271,7 @@ const routes = [
 			const local = hasFlag(argv, "--local");
 			const json = hasFlag(argv, "--json");
 			const plain = hasFlag(argv, "--plain");
-			const { modelsListCommand } = await import("./models-BITN17gY.js").then((n) => n.t);
+			const { modelsListCommand } = await import("./models-Q1jV8ArL.js").then((n) => n.t);
 			await modelsListCommand({
 				all,
 				local,
@@ -302,7 +302,7 @@ const routes = [
 			const plain = hasFlag(argv, "--plain");
 			const check = hasFlag(argv, "--check");
 			const probe = hasFlag(argv, "--probe");
-			const { modelsStatusCommand } = await import("./models-BITN17gY.js").then((n) => n.t);
+			const { modelsStatusCommand } = await import("./models-Q1jV8ArL.js").then((n) => n.t);
 			await modelsStatusCommand({
 				json,
 				plain,
@@ -380,7 +380,7 @@ async function runCli(argv = process$1.argv) {
 	assertSupportedRuntime();
 	if (await tryRouteCli(normalizedArgv)) return;
 	enableConsoleCapture();
-	const { buildProgram } = await import("./program-Q44fKoq6.js");
+	const { buildProgram } = await import("./program-D3_xE9BL.js");
 	const program = buildProgram();
 	installUnhandledRejectionHandler();
 	process$1.on("uncaughtException", (error) => {
@@ -412,10 +412,10 @@ async function runCli(argv = process$1.argv) {
 		const { getProgramContext } = await import("./program-context-DeZ44oQ9.js").then((n) => n.n);
 		const ctx = getProgramContext(program);
 		if (ctx) {
-			const { registerCoreCliByName } = await import("./command-registry-uMOPbrbY.js").then((n) => n.t);
+			const { registerCoreCliByName } = await import("./command-registry-BiRjJ2Sy.js").then((n) => n.t);
 			await registerCoreCliByName(program, ctx, primary, parseArgv);
 		}
-		const { registerSubCliByName } = await import("./register.subclis-17z5d7uO.js").then((n) => n.a);
+		const { registerSubCliByName } = await import("./register.subclis-ByZAz4st.js").then((n) => n.a);
 		await registerSubCliByName(program, primary);
 	}
 	const hasBuiltinPrimary = primary !== null && program.commands.some((command) => command.name() === primary);
@@ -424,7 +424,7 @@ async function runCli(argv = process$1.argv) {
 		primary,
 		hasBuiltinPrimary
 	})) {
-		const { registerPluginCliCommands } = await import("./cli-B1QQv1cb.js");
+		const { registerPluginCliCommands } = await import("./cli-BX54CAM7.js");
 		const { loadConfig } = await import("./config-DXt3pc08.js").then((n) => n.t);
 		registerPluginCliCommands(program, loadConfig());
 	}

package/dist/{runner-D633VT13.js → runner-ecX1WzDt.js}

@@ -4,7 +4,7 @@ import { A as normalizeGoogleModelId, B as resolveApiKeyForProvider, C as normal
 import { d as DEFAULT_IMESSAGE_ATTACHMENT_ROOTS, f as isInboundPathAllowed, m as resolveIMessageAttachmentRoots, n as loadConfig, p as mergeInboundPathRoots } from "./config-BkZ9HOKT.js";
 import { c as detectMime, f as isAudioFileName, m as kindFromMime, u as getFileExtension } from "./image-ops-C7CauEK8.js";
 import { t as normalizeChatType } from "./chat-type-3FRbbjbq.js";
-import { S as ensureSymiModelsJson, t as describeImageWithModel } from "./image-C6rCON9L.js";
+import { S as ensureSymiModelsJson, t as describeImageWithModel } from "./image-BuVL0jHI.js";
 import { n as collectProviderApiKeysForExecution, r as executeWithApiKeyRotation, t as parseGeminiAuth } from "./gemini-auth-BefM10YB.js";
 import { n as fetchWithTimeout } from "./fetch-timeout-CVCBkyv1.js";
 import { i as fetchRemoteMedia, n as getDefaultMediaLocalRoots, o as fetchWithSsrFGuard, r as MediaFetchError } from "./local-roots-ClipCZ9s.js";

package/dist/{server-methods-Bdgs89ve.js → server-methods-CBn954AO.js}

@@ -1,7 +1,7 @@
 import { g as resolveStateDir, t as CONFIG_PATH } from "./paths-Cqn-zk3M.js";
 import { D as isPlainObject, U as getResolvedLoggerSettings, r as clamp, y as resolveUserPath } from "./utils-B-0b9bGM.js";
 import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, n as formatXHighModelHint, o as normalizeReasoningLevel, s as normalizeThinkLevel, t as formatThinkingLevels } from "./thinking-EAliFiVK.js";
-import { $n as textToSpeech, At as resolveAgentOutboundTarget, Bn as onAgentEvent, Cr as isSystemEventContextChanged, Dt as agentCommand, En as stopSubagentsForRequester, Fr as resolveAgentTimeoutMs, G as normalizeCronJobCreate, Gn as isTtsProviderConfigured, Hn as resolveUserTimezone, It as normalizeSendPolicy, Jn as resolveTtsConfig, K as normalizeCronJobPatch, Kn as resolveTtsApiKey, Lt as resolveSendPolicy, Mn as listDescendantRunsForRequester, Nn as listSubagentRunsForRequester, Nt as resolveOutboundTarget, P as scheduleGatewaySigusr1Restart, Qn as setTtsProvider, R as formatDoctorNonInteractiveHint, S as resolveSessionModelRef, Sn as formatZonedTimestamp, Sr as enqueueSystemEvent, T as resolveOutboundSessionRoute, Tn as isAbortTrigger, U as writeRestartSentinel, Un as getTtsProvider, Ut as waitForEmbeddedPiRunEnd, Vn as registerAgentRunContext, Vt as abortEmbeddedPiRun, Wn as isTtsEnabled, Xn as resolveTtsProviderOrder, Yn as resolveTtsPrefsPath, Zn as setTtsEnabled, _ as listSessionsFromStore, _t as loadProviderUsageSummary, an as unbindThreadBindingsBySessionKey, at as applyBrowserProxyPaths, b as pruneLegacyStoreKeys, br as applyVerboseOverride, c as clearSessionQueues, er as OPENAI_TTS_MODELS, f as listTasksInWorkdir, g as listAgentsForGateway, hn as createReplyDispatcher, ht as normalizeGroupActivation, kt as resolveAgentDeliveryPlan, m as canonicalizeSpawnedByForAgent, mn as dispatchInboundMessage, n as BARE_SESSION_RESET_PROMPT, ot as persistBrowserProxyFiles, pt as loadSymiPlugins, qn as resolveTtsAutoMode, tr as OPENAI_TTS_VOICES, v as loadCombinedSessionStoreForGateway, w as ensureOutboundSessionEntry, x as resolveGatewaySessionStoreTarget, xr as parseVerboseOverride, y as loadSessionEntry, yr as applyModelOverrideToSessionEntry, zt as createOutboundSendDeps } from "./reply-2awhibgG.js";
+import { $n as textToSpeech, At as resolveAgentOutboundTarget, Bn as onAgentEvent, Cr as isSystemEventContextChanged, Dt as agentCommand, En as stopSubagentsForRequester, Fr as resolveAgentTimeoutMs, G as normalizeCronJobCreate, Gn as isTtsProviderConfigured, Hn as resolveUserTimezone, It as normalizeSendPolicy, Jn as resolveTtsConfig, K as normalizeCronJobPatch, Kn as resolveTtsApiKey, Lt as resolveSendPolicy, Mn as listDescendantRunsForRequester, Nn as listSubagentRunsForRequester, Nt as resolveOutboundTarget, P as scheduleGatewaySigusr1Restart, Qn as setTtsProvider, R as formatDoctorNonInteractiveHint, S as resolveSessionModelRef, Sn as formatZonedTimestamp, Sr as enqueueSystemEvent, T as resolveOutboundSessionRoute, Tn as isAbortTrigger, U as writeRestartSentinel, Un as getTtsProvider, Ut as waitForEmbeddedPiRunEnd, Vn as registerAgentRunContext, Vt as abortEmbeddedPiRun, Wn as isTtsEnabled, Xn as resolveTtsProviderOrder, Yn as resolveTtsPrefsPath, Zn as setTtsEnabled, _ as listSessionsFromStore, _t as loadProviderUsageSummary, an as unbindThreadBindingsBySessionKey, at as applyBrowserProxyPaths, b as pruneLegacyStoreKeys, br as applyVerboseOverride, c as clearSessionQueues, er as OPENAI_TTS_MODELS, f as listTasksInWorkdir, g as listAgentsForGateway, hn as createReplyDispatcher, ht as normalizeGroupActivation, kt as resolveAgentDeliveryPlan, m as canonicalizeSpawnedByForAgent, mn as dispatchInboundMessage, n as BARE_SESSION_RESET_PROMPT, ot as persistBrowserProxyFiles, pt as loadSymiPlugins, qn as resolveTtsAutoMode, tr as OPENAI_TTS_VOICES, v as loadCombinedSessionStoreForGateway, w as ensureOutboundSessionEntry, x as resolveGatewaySessionStoreTarget, xr as parseVerboseOverride, y as loadSessionEntry, yr as applyModelOverrideToSessionEntry, zt as createOutboundSendDeps } from "./reply-CgyjcoxC.js";
 import { S as parseAgentSessionKey, l as resolveAgentIdFromSessionKey, m as DEFAULT_ACCOUNT_ID, o as classifySessionKeyShape, s as normalizeAgentId, t as DEFAULT_AGENT_ID, x as isSubagentSessionKey } from "./session-key-DCt45XZa.js";
 import { t as resolveSymiPackageRoot } from "./symi-root-CrGJbkzf.js";
 import { C as createInternalHookEvent, T as triggerInternalHook, d as getActivePluginRegistry, r as DEFAULT_CHAT_CHANNEL, t as CHANNEL_IDS } from "./registry-Cja8eT7G.js";
@@ -20,7 +20,7 @@ import { i as normalizeInputProvenance } from "./input-provenance-BzbXHcaD.js";
 import { n as createBrowserRouteDispatcher } from "./with-timeout-DwriPEWn.js";
 import { C as getGlobalHookRunner, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-D7BQXt0l.js";
 import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-CE2YmmsD.js";
-import { r as getMemorySearchManager } from "./memory-cli-BMb31chU.js";
+import { r as getMemorySearchManager } from "./memory-cli-BTByRgM0.js";
 import { $ as validateNodePairRejectParams, A as validateCronStatusParams, At as validateWebLoginWaitParams, B as validateExecApprovalsGetParams, C as validateConfigSetParams, Ct as validateSkillsUpdateParams, D as validateCronRemoveParams, Dt as validateUpdateRunParams, E as validateCronListParams, Et as validateTasksListParams, F as validateDevicePairRemoveParams, G as validateModelsListParams, Gt as rejectDevicePairing, H as validateExecApprovalsNodeSetParams, I as validateDeviceTokenRevokeParams, It as ErrorCodes, J as validateNodeInvokeParams, Jt as revokeDeviceToken, K as validateNodeDescribeParams, Kt as removePairedDevice, L as validateDeviceTokenRotateParams, Lt as errorShape, M as validateDevicePairApproveParams, Mt as validateWizardNextParams, N as validateDevicePairListParams, Nt as validateWizardStartParams, O as validateCronRunParams, Ot as validateWakeParams, P as validateDevicePairRejectParams, Pt as validateWizardStatusParams, Q as validateNodePairListParams, S as validateConfigSchemaParams, St as validateSkillsStatusParams, T as validateCronAddParams, Tt as validateTalkModeParams, U as validateExecApprovalsSetParams, V as validateExecApprovalsNodeGetParams, Vt as approveDevicePairing, W as validateLogsTailParams, Wt as listDevicePairing, X as validateNodeListParams, Xt as summarizeDeviceTokens, Y as validateNodeInvokeResultParams, Yt as rotateDeviceToken, Z as validateNodePairApproveParams, _ as validateChatInjectParams, _t as validateSessionsRestoreParams, a as validateAgentWaitParams, b as validateConfigGetParams, bt as validateSkillsBinsParams, c as validateAgentsFilesGetParams, ct as validateSessionsCompactParams, d as validateAgentsListParams, dt as validateSessionsFavoriteFileParams, et as validateNodePairRequestParams, f as validateAgentsUpdateParams, ft as validateSessionsListParams, g as validateChatHistoryParams, gt as validateSessionsResolveParams, h as validateChatAbortParams, ht as validateSessionsResetParams, i as validateAgentParams, it as validatePushTestParams, j as validateCronUpdateParams, jt as validateWizardCancelParams, k as validateCronRunsParams, kt as validateWebLoginStartParams, l as validateAgentsFilesListParams, lt as validateSessionsDeleteFileParams, m as validateChannelsStatusParams, mt as validateSessionsPreviewParams, n as formatValidationErrors, nt as validateNodeRenameParams, o as validateAgentsCreateParams, ot as validateSendParams, p as validateChannelsLogoutParams, pt as validateSessionsPatchParams, q as validateNodeEventParams, r as validateAgentIdentityParams, rt as validatePollParams, s as validateAgentsDeleteParams, st as validateSessionsAdoptFileParams, tt as validateNodePairVerifyParams, u as validateAgentsFilesSetParams, ut as validateSessionsDeleteParams, v as validateChatSendParams, vt as validateSessionsSearchParams, wt as validateTalkConfigParams, x as validateConfigPatchParams, xt as validateSkillsInstallParams, y as validateConfigApplyParams, yt as validateSessionsUsageParams, zt as parseSessionLabel } from "./client-pd8kwOFJ.js";
 import { l as authorizeOperatorScopesForMethod, s as ADMIN_SCOPE$2, u as isNodeRoleMethod } from "./call-DYfKEdwh.js";
 import { c as writeJsonAtomic, o as createAsyncLock, s as readJsonFile } from "./pairing-token-pooyuU2J.js";
@@ -40,14 +40,14 @@ import { t as WizardCancelledError } from "./prompts-NOUgk6FH.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-D-MrrYmt.js";
 import { t as buildChannelAccountSnapshot } from "./status-TtGsgDjP.js";
 import { o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-C9nq99IR.js";
-import { n as getStatusSummary } from "./status-Dkr4Celv.js";
-import { s as setHeartbeatsEnabled } from "./health-dA8r4WJ4.js";
+import { n as getStatusSummary } from "./status-CG5iHUJ6.js";
+import { s as setHeartbeatsEnabled } from "./health-Dl2WRoTa.js";
 import { m as normalizeUpdateChannel } from "./update-check-Bbvpax6u.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration } from "./push-apns-CRD9IH1s.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DuwhYjpi.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration } from "./push-apns-BNzgqUl3.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-Ct64cGQ8.js";
 import { t as resolveSystemRunCommand } from "./system-run-command-DKiCEPJc.js";
 import { t as installSkill } from "./skills-install-B8r7cGKR.js";
-import { t as runGatewayUpdate } from "./update-runner-DFp9PDMN.js";
+import { t as runGatewayUpdate } from "./update-runner-DMucmRlv.js";
 import * as fs$2 from "node:fs";
 import fs from "node:fs";
 import * as os$1 from "node:os";
@@ -7509,7 +7509,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-Cvgmf8fS.js");
+			const { handleNodeEvent } = await import("./server-node-events-BUEZ3py9.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,