@themoltnet/agent-daemon 0.56.2 → 0.57.0

package/dist/cli.js

@@ -12,9 +12,9 @@ import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
-import { FILE_SECRET_PROVIDER, FileSecretProvider, connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
-import { constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, isCanonicalConfig, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
+import { FILE_SECRET_PROVIDER, FileSecretProvider, RegisterIdentityError, boundedIdentitySignal, connect, createNodeSecretProviderRegistry, register } from "@themoltnet/sdk/node";
+import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
 import { execFile, spawn } from "node:child_process";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
 import { once } from "node:events";
@@ -26,6 +26,8 @@ import { MeterProvider, PeriodicExportingMetricReader } from "@opentelemetry/sdk
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
+import { homedir, platform, tmpdir } from "node:os";
+import { writePiConfig } from "@themoltnet/pi-runtime/pi-config";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdir, open, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
@@ -37,13 +39,11 @@ import { isIP } from "node:net";
 import cors from "@fastify/cors";
 import helmet from "@fastify/helmet";
 import { Transform, Writable } from "node:stream";
-import { writePiConfig } from "@themoltnet/pi-runtime/pi-config";
 import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
 import "reflect-metadata";
-import { homedir, platform } from "node:os";
 import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, X509CertificateGenerator } from "@peculiar/x509";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/rubric.ts
@@ -1612,6 +1612,55 @@ Type.Object({
 	edges: Type.Array(ProvenanceGraphEdgeSchema)
 }, { $id: "ProvenanceGraph" });
 //#endregion
+//#region ../../libs/models/src/render-method.ts
+/**
+* The `renderMethod` convention for rendered packs (#1857).
+*
+* `renderedPacks.renderMethod` is a free-text `varchar(100)`. The server
+* bifurcates on exactly one thing — whether the label starts with `server:`
+* — and everything else is a caller-authored render whose markdown the
+* caller must supply. This module is the single owner of that convention:
+* the service, the API schemas, the runtime default and the console's
+* trust-tier derivation all read from here.
+*
+* The Go CLI (`apps/moltnet-cli/cobra_pack.go`) cannot import this module;
+* it carries a pointer comment and its default must be kept in sync with
+* `DEFAULT_SERVER_RENDER_METHOD` by hand.
+*
+* Values observed in production data and accepted unchanged:
+* `server:pack-to-docs-v1`, `agent:pack-to-docs-v1`, `agent-refined`.
+* `pi:pack-to-docs-v1` is the live pi-runtime default.
+*/
+/** Labels carrying this prefix are rendered deterministically by the server. */
+var SERVER_RENDER_PREFIX = "server:";
+/**
+* Prefixes that identify caller-authored markdown.
+*
+* `agent:` is the canonical documented label, `pi:` is what the pi-runtime
+* emits by default, and `agent-` covers the `agent-refined` family that is
+* live in production data.
+*/
+var CALLER_AUTHORED_PREFIXES = [
+	"agent:",
+	"pi:",
+	"agent-"
+];
+var DEFAULT_SERVER_RENDER_METHOD = "server:pack-to-docs-v1";
+var DEFAULT_AGENT_RENDER_METHOD = "agent:pack-to-docs-v1";
+/**
+* Write-side validation pattern: a known prefix followed by at least one
+* non-whitespace character. Stored rows are never re-validated against
+* this; it applies to new writes at the API boundary only.
+*/
+var RENDER_METHOD_PATTERN = `^(${[SERVER_RENDER_PREFIX, ...CALLER_AUTHORED_PREFIXES].join("|")})\\S+$`;
+var RenderMethodSchema = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: RENDER_METHOD_PATTERN,
+	description: "Render method label. Server render methods start with \"server:\" and must omit renderedMarkdown; caller-authored methods start with \"agent:\", \"pi:\" or \"agent-\" and require it.",
+	examples: [DEFAULT_SERVER_RENDER_METHOD, DEFAULT_AGENT_RENDER_METHOD]
+});
+//#endregion
 //#region ../../libs/models/src/signer-constraint.ts
 var SIGNER_CONSTRAINT_TYPE = {
 	Human: "human",
@@ -2719,7 +2768,7 @@ var RenderPackInput = Type.Object({
 var RenderPackOutput = Type.Object({
 	renderedPackId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
 	renderedCid: Type.String({ minLength: 1 }),
-	renderMethod: Type.String({ minLength: 1 }),
+	renderMethod: RenderMethodSchema,
 	byteSize: Type.Number({ minimum: 0 }),
 	entriesRendered: Type.Number({ minimum: 0 }),
 	summary: Type.String({ minLength: 1 }),
@@ -3384,8 +3433,7 @@ Type.Object({
 	outputCid: Type.Union([Cid, Type.Null()]),
 	usage: TaskUsage,
 	durationMs: Type.Number({ minimum: 0 }),
-	error: Type.Optional(TaskError),
-	contentSignature: Type.Optional(Type.String())
+	error: Type.Optional(TaskError)
 }, {
 	$id: "TaskOutput",
 	additionalProperties: false
@@ -3893,6 +3941,7 @@ function loadConfig() {
 		profilePrerequisiteEnv: process.env,
 		profilePrerequisitePath: process.env.PATH ?? "",
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
+		agentServerRoot: process.env["MOLTNET_AGENT_SERVER_ROOT"] ?? "",
 		credentialSource: detectCredentialSource(process.env),
 		apiUrl: process.env["MOLTNET_API_URL"] ?? "",
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
@@ -3936,8 +3985,9 @@ function readBoolean(name, value) {
 	if (value === "false") return false;
 	throw new Error(`${name} must be either true or false`);
 }
-function activatePiCodingAgentDir(path) {
+function activatePiCodingAgentDir(path, env = {}) {
 	process.env["PI_CODING_AGENT_DIR"] = path;
+	Object.assign(process.env, env);
 }
 function loadAgentServerEnvConfig() {
 	return {
@@ -4803,7 +4853,6 @@ async function finalizeTask(agent, output, ctx = {}) {
 				output: output.output,
 				outputCid: output.outputCid,
 				usage: output.usage,
-				...output.contentSignature ? { contentSignature: output.contentSignature } : {},
 				...daemonState ? { daemonState } : {},
 				...attestation
 			});
@@ -5381,1345 +5430,1173 @@ function initWorkerOtel(options) {
 		})]);
 	});
 }
-//#endregion
-//#region src/lib/pi-agent-dir.ts
-function ensurePiAgentDir(repoRoot, explicitPath) {
-	if (explicitPath) {
-		mkdirSync(explicitPath, { recursive: true });
-		return {
-			path: explicitPath,
-			source: "env"
-		};
+var NAME_RE = IDENTITY_ALIAS_PATTERN;
+var PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function assertStoreName(kind, value) {
+	try {
+		return assertIdentityAlias(value);
+	} catch {
+		throw new AgentServerStoreError("invalid_name", `${kind} must match ${NAME_RE.source}`);
 	}
-	const path = join(repoRoot, ".pi");
-	mkdirSync(path, { recursive: true });
-	return {
-		path,
-		source: "repo"
-	};
-}
-//#endregion
-//#region src/lib/runtime-context.ts
-var storage = new AsyncLocalStorage();
-function runWithDaemonRuntimeContext(context, callback) {
-	return storage.run(context, callback);
 }
-//#endregion
-//#region src/lib/runtime-profile-retry-triage.ts
-function createRuntimeProfileRetryTriage(options) {
-	return async (input) => {
-		const { modelHandle, modelRuntime } = await resolveRuntimeProfileModel(options.piAgentDir, options.runtimeProfile.provider, options.runtimeProfile.model);
-		return createPiRetryTriage({
-			model: modelHandle,
-			modelRuntime,
-			thinkingLevel: options.runtimeProfile.thinkingLevel,
-			piAgentDir: options.piAgentDir,
-			timeoutMs: options.timeoutMs,
-			cwd: options.cwd
-		})(input);
-	};
+function assertProviderId(value) {
+	if (!PROVIDER_ID_RE.test(value)) throw new AgentServerStoreError("invalid_name", `provider id must match ${PROVIDER_ID_RE.source}`);
+	return value;
 }
-//#endregion
-//#region src/lib/runtime-resource-reaper.ts
-var RUNTIME_SLOT_PAGE_LIMIT = 200;
-var ATTEMPT_LOOKUP_CONCURRENCY = 8;
-var TERMINAL_ATTEMPT_STATUSES = new Set([
-	"completed",
-	"failed",
-	"cancelled",
-	"aborted",
-	"timed_out"
-]);
+var AgentServerStoreError = class extends Error {
+	name = "AgentServerStoreError";
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+	}
+};
 /**
-* Reap daemon-owned local resources whose runtime slot is no longer usable.
-* The destructive path is deliberately conservative: uncertainty about slot
-* ownership, attempt state, listing completeness, or real filesystem
-* containment retains resources rather than risking another daemon's data.
+* `MOLTNET_AGENT_SERVER_ROOT` override, else `~/.config/moltnet`.
+*
+* Deliberately does NOT consult `XDG_CONFIG_HOME`. The Go CLI's GetConfigDir
+* and @moltnet/agent-config's getConfigDir both resolve `~/.config/moltnet`,
+* so honouring XDG here gave one application two config roots: on a machine
+* with the variable set, the daemon wrote identities the CLI and SDK could not
+* read. `MOLTNET_AGENT_SERVER_ROOT` remains the explicit escape hatch for a
+* genuinely custom location.
 */
-async function reapRuntimeSlotResources(deps, input) {
-	const now = input.now ?? Date.now();
-	const [activePage, idlePage] = await Promise.all([listOwnedSlots(deps.runtimeSlotStore, input, "active"), listOwnedSlots(deps.runtimeSlotStore, input, "idle")]);
-	const active = activePage.items;
-	const idle = idlePage.items;
-	const slots = [...active, ...idle];
-	const result = {
-		failed: 0,
-		failures: [],
-		removedSessions: 0,
-		removedWorkspaces: 0,
-		scanned: slots.length,
-		truncated: activePage.truncated || idlePage.truncated,
-		unsafePathDetails: [],
-		unsafePaths: 0
-	};
-	const reaped = new Set(idle.filter((item) => item.slot.expiresAtMs <= now).map((item) => item.slot.id));
-	for (const slotId of await findTerminalActiveSlotIds(deps, active, result)) reaped.add(slotId);
-	const retainedSessionDirs = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.session?.sessionDir ? [resolve(item.session.sessionDir)] : []));
-	const retainedWorkspacePaths = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.workspace?.worktreePath ? [resolve(item.workspace.worktreePath)] : []));
-	const worktrees = input.mainWorktree ? await listRegisteredWorktrees(input.mainWorktree) : {
-		kind: "ready",
-		paths: /* @__PURE__ */ new Set()
-	};
-	for (const item of slots) {
-		if (!reaped.has(item.slot.id)) continue;
-		if (!await slotStillQualifiesForReaping(deps, input, item, now, result)) continue;
-		const sessionDir = item.session?.sessionDir;
-		if (sessionDir && !retainedSessionDirs.has(resolve(sessionDir)) && existsSync(sessionDir)) if (!isRealPathInsideRoot(sessionDir, input.sessionRootDir)) recordUnsafePath(deps, result, item.slot.id, sessionDir, input.sessionRootDir);
-		else try {
-			rmSync(sessionDir, {
-				force: true,
-				recursive: true
-			});
-			result.removedSessions++;
-		} catch (err) {
-			recordFailure(deps, result, item.slot.id, sessionDir, input.sessionRootDir, err);
-		}
-		const workspacePath = item.workspace?.worktreePath;
-		if (!workspacePath || retainedWorkspacePaths.has(resolve(workspacePath))) continue;
-		const workspaceRoot = item.workspace?.kind === "scratch" ? input.scratchRootDir : input.mainWorktree ? resolve(input.mainWorktree, ".worktrees") : null;
-		if (!workspaceRoot) {
-			recordUnsafePath(deps, result, item.slot.id, workspacePath, null);
-			continue;
-		}
-		await removeWorkspace(deps, result, worktrees, input.mainWorktree, item.slot.id, workspacePath, workspaceRoot, item.workspace?.kind === "scratch");
-	}
-	if (!result.truncated) await reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result);
-	return result;
+function resolveAgentServerRoot(input) {
+	const override = input.root?.trim();
+	if (override) return override;
+	return getConfigDir();
 }
-async function listOwnedSlots(store, input, state) {
-	const listed = await store.listSlots({
-		agentName: input.agentName,
-		limit: RUNTIME_SLOT_PAGE_LIMIT,
-		runtimeProfileId: input.runtimeProfileId,
-		state,
-		teamId: input.teamId
-	});
-	return {
-		items: listed.filter((item) => runtimeSlotKeyBelongsToInstance(item.slot.slotKey, input.runtimeInstanceId)),
-		truncated: listed.length === RUNTIME_SLOT_PAGE_LIMIT
-	};
+function providerEnvName(providerId) {
+	return `MOLTNET_PROVIDER_${assertProviderId(providerId).replaceAll("-", "_").toUpperCase()}_API_KEY`;
 }
-async function findTerminalActiveSlotIds(deps, active, result) {
-	const byTask = /* @__PURE__ */ new Map();
-	for (const item of active) {
-		const taskSlots = byTask.get(item.slot.lastTaskId) ?? [];
-		taskSlots.push(item);
-		byTask.set(item.slot.lastTaskId, taskSlots);
-	}
-	const terminal = /* @__PURE__ */ new Set();
-	await mapWithConcurrency([...byTask.entries()], ATTEMPT_LOOKUP_CONCURRENCY, async ([taskId, taskSlots]) => {
-		let attempts;
-		try {
-			attempts = await deps.taskReader.listAttempts(taskId);
-		} catch (err) {
-			recordFailure(deps, result, null, `task:${taskId}`, null, err);
-			return;
-		}
-		for (const item of taskSlots) {
-			const attempt = attempts.find((candidate) => candidate.attemptN === item.slot.lastAttemptN);
-			if (attempt && TERMINAL_ATTEMPT_STATUSES.has(attempt.status)) terminal.add(item.slot.id);
-		}
-	});
-	return terminal;
+function assertProviderEnvName(providerId, value) {
+	const expected = providerEnvName(providerId);
+	if (value !== expected) throw new AgentServerStoreError("invalid_state", `provider envName must be ${expected}`);
+	return value;
 }
-async function slotStillQualifiesForReaping(deps, input, original, now, result) {
-	let page;
+function readJson(path) {
+	let raw;
 	try {
-		page = await listOwnedSlots(deps.runtimeSlotStore, input, original.slot.state);
-	} catch (err) {
-		recordFailure(deps, result, original.slot.id, `slot:${original.slot.id}`, null, err);
-		return false;
+		raw = readFileSync(path, "utf8");
+	} catch (cause) {
+		if (cause.code === "ENOENT") return null;
+		throw new AgentServerStoreError("io_error", `could not read state at ${path}`, { cause });
 	}
-	const current = page.items.find((candidate) => candidate.slot.id === original.slot.id);
-	if (!current) return false;
-	if (current.slot.lastTaskId !== original.slot.lastTaskId || current.slot.lastAttemptN !== original.slot.lastAttemptN) return false;
-	return current.slot.state === "active" || current.slot.state === "idle" && current.slot.expiresAtMs <= now;
-}
-async function reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result) {
-	if (!input.mainWorktree) return;
-	const workspaceRoot = resolve(input.mainWorktree, ".worktrees");
-	if (!existsSync(workspaceRoot)) return;
-	let entries;
 	try {
-		entries = readdirSync(workspaceRoot, { withFileTypes: true });
-	} catch (err) {
-		recordFailure(deps, result, null, workspaceRoot, workspaceRoot, err);
-		return;
-	}
-	for (const entry of entries) {
-		if (!entry.isDirectory() || !entry.name.startsWith("session-agent%3A")) continue;
-		const workspacePath = resolve(workspaceRoot, entry.name);
-		if (retainedWorkspacePaths.has(workspacePath)) continue;
-		const sessionDir = resolve(input.sessionRootDir, entry.name.slice(8));
-		if (retainedSessionDirs.has(sessionDir) || existsSync(sessionDir)) continue;
-		await removeWorkspace(deps, result, worktrees, input.mainWorktree, null, workspacePath, workspaceRoot, false);
+		return JSON.parse(raw);
+	} catch (cause) {
+		throw new AgentServerStoreError("invalid_state", `corrupt JSON at ${path}`, { cause });
 	}
 }
-async function removeWorkspace(deps, result, worktrees, mainWorktree, slotId, workspacePath, workspaceRoot, scratch) {
-	if (!existsSync(workspacePath)) return;
-	if (!isRealPathInsideRoot(workspacePath, workspaceRoot)) {
-		recordUnsafePath(deps, result, slotId, workspacePath, workspaceRoot);
-		return;
-	}
-	if (scratch || !mainWorktree) {
+function writeJsonAtomic(path, value) {
+	const temp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+	try {
+		writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+		renameSync(temp, path);
+	} catch (cause) {
 		try {
-			rmSync(workspacePath, {
-				force: true,
-				recursive: true
-			});
-			result.removedWorkspaces++;
-		} catch (err) {
-			recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
-		}
-		return;
+			rmSync(temp, { force: true });
+		} catch {}
+		throw cause;
 	}
-	if (worktrees.kind === "unavailable") {
-		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, new Error(worktrees.reason));
-		return;
+}
+var AgentServerStore = class {
+	root;
+	identitiesDir;
+	runsDir;
+	secretsDir;
+	/** Shared Pi credential dir; `auth.json` inside is pi-managed (lockfiled). */
+	piDir;
+	constructor(root) {
+		this.root = root;
+		this.identitiesDir = join(root, "identities");
+		this.runsDir = join(root, "runs");
+		this.secretsDir = join(root, "secrets");
+		this.piDir = join(root, "pi");
 	}
-	try {
-		const canonical = realpathSync(workspacePath);
-		if (worktrees.paths.has(canonical)) {
-			await execFileText("git", [
-				"-C",
-				mainWorktree,
-				"worktree",
-				"remove",
-				"--force",
-				workspacePath
-			]);
-			worktrees.paths.delete(canonical);
-		} else rmSync(workspacePath, {
-			force: true,
-			recursive: true
+	get piAuthJsonPath() {
+		return join(this.piDir, "auth.json");
+	}
+	/** Create the directory layout (0700) if missing. Idempotent. */
+	ensure() {
+		for (const dir of [
+			this.root,
+			this.identitiesDir,
+			this.runsDir,
+			this.secretsDir
+		]) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
 		});
-		result.removedWorkspaces++;
-	} catch (err) {
-		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
+		return this;
 	}
-}
-async function listRegisteredWorktrees(mainWorktree) {
-	try {
-		const list = await execFileText("git", [
-			"-C",
-			mainWorktree,
-			"worktree",
-			"list",
-			"--porcelain"
-		]);
-		return {
-			kind: "ready",
-			paths: new Set(list.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => canonicalPath(line.slice(9))))
+	get statePath() {
+		return join(this.root, "agent-server.json");
+	}
+	readAgentServerState() {
+		const state = readJson(this.statePath);
+		if (!state) return {
+			version: 2,
+			pendingRegistrations: {},
+			activations: {}
 		};
-	} catch (err) {
+		if (!isRecord$1(state) || state.version !== 2) throw new AgentServerStoreError("invalid_state", `agent-server.json version ${String(isRecord$1(state) ? state.version : void 0)} is not supported; move agent-server.json aside, run \`moltnet config migrate\`, then add or attach the agents again`);
+		if ("pairedOrigins" in state) throw new AgentServerStoreError("invalid_state", "agent-server.json uses the obsolete pairing format; move agent-server.json aside and configure the agent server again");
+		if (!isRecord$1(state.pendingRegistrations) || !isRecord$1(state.activations)) throw new AgentServerStoreError("invalid_state", "agent-server.json is missing the version 2 activation map; move agent-server.json aside, run `moltnet config migrate`, then add or attach the agents again");
+		for (const [alias, activation] of Object.entries(state.activations)) validateActivation(alias, activation);
+		for (const [alias, registration] of Object.entries(state.pendingRegistrations)) {
+			assertStoreName("agent name", alias);
+			if (!isRecord$1(registration) || typeof registration.apiUrl !== "string" || registration.apiUrl.length === 0 || typeof registration.createdAt !== "string" || registration.createdAt.length === 0) throw new AgentServerStoreError("invalid_state", `pending registration "${alias}" is not valid`);
+		}
 		return {
-			kind: "unavailable",
-			reason: errorMessage(err)
+			version: 2,
+			pendingRegistrations: state.pendingRegistrations,
+			activations: state.activations
 		};
 	}
-}
-function isRealPathInsideRoot(path, root) {
-	try {
-		return isResolvedPathInsideRoot(realpathSync(path), realpathSync(root));
-	} catch {
-		return false;
+	writeAgentServerState(state) {
+		writeJsonAtomic(this.statePath, state);
 	}
-}
-function canonicalPath(path) {
-	try {
-		return realpathSync(path);
-	} catch {
-		return resolve(path);
+	agentPath(name) {
+		return join(storeChildPath(this.identitiesDir, "identity alias", name), "moltnet.json");
 	}
-}
-function recordUnsafePath(deps, result, slotId, path, root) {
-	const issue = {
-		kind: "unsafe_path",
-		path,
-		reason: root === null ? "No daemon-owned root was available for this workspace." : "Candidate or root could not be resolved inside the daemon-owned root.",
-		root,
-		slotId
-	};
-	result.unsafePaths++;
-	result.unsafePathDetails.push(issue);
-	emitIssue(deps, issue);
-}
-function recordFailure(deps, result, slotId, path, root, err) {
-	const issue = {
-		kind: "failure",
-		path,
-		reason: errorMessage(err),
-		root,
-		slotId
-	};
-	result.failed++;
-	result.failures.push(issue);
-	emitIssue(deps, issue);
-}
-function emitIssue(deps, issue) {
-	try {
-		deps.onIssue?.(issue);
-	} catch {}
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-async function execFileText(file, args) {
-	return new Promise((resolvePromise, reject) => {
-		execFile(file, args, {
-			encoding: "utf8",
-			maxBuffer: 10 * 1024 * 1024
-		}, (err, stdout) => {
-			if (err) reject(err instanceof Error ? err : /* @__PURE__ */ new Error("Child process failed without an Error instance."));
-			else resolvePromise(stdout);
+	/** Central identity directory, shared with the Go CLI layout. */
+	identityDir(name) {
+		return storeChildPath(this.identitiesDir, "identity alias", name);
+	}
+	get identitySelectorPath() {
+		return join(this.root, "identity-selector.json");
+	}
+	readIdentitySelector() {
+		const selector = readJson(this.identitySelectorPath);
+		if (!selector) return null;
+		if (!isRecord$1(selector) || selector.version !== 1 || selector.default_identity !== void 0 && typeof selector.default_identity !== "string") throw new AgentServerStoreError("invalid_state", "identity-selector.json is not a supported selector document");
+		if (selector.default_identity) assertStoreName("identity alias", selector.default_identity);
+		return selector;
+	}
+	writeIdentitySelector(alias) {
+		writeJsonAtomic(this.identitySelectorPath, {
+			version: 1,
+			default_identity: assertStoreName("identity alias", alias)
 		});
-	});
-}
-async function mapWithConcurrency(items, concurrency, worker) {
-	for (let index = 0; index < items.length; index += concurrency) await Promise.all(items.slice(index, index + concurrency).map(worker));
-}
-//#endregion
-//#region src/lib/runtime-sessions.ts
-function resolveRuntimeSessionKind(claimedTask) {
-	const continueFrom = resolveContinueFrom(claimedTask);
-	if (!continueFrom) return "root";
-	return continueFrom.mode === "fork" ? "fork" : "extend";
-}
-async function resolveParentRuntimeSession(runtimeSessionStore, claimedTask) {
-	const continueFrom = resolveContinueFrom(claimedTask);
-	if (!continueFrom) return null;
-	return runtimeSessionStore.findRuntimeSessionByTaskAttempt(claimedTask.task.teamId, continueFrom.taskId, continueFrom.attemptN);
-}
-function applyRuntimeSessionUploadFailure(output, err) {
-	if (output.status !== "completed") return output;
-	return {
-		...output,
-		contentSignature: void 0,
-		error: {
-			code: "runtime_session_upload_failed",
-			message: "Task completed, but durable runtime session checkpoint upload failed: " + (err instanceof Error ? err.message : String(err)),
-			retryable: isTransientUploadError(err)
-		},
-		output: null,
-		outputCid: null,
-		status: "failed"
-	};
-}
-/**
-* Transient faults worth retrying in-attempt: network-level errors
-* (no HTTP status at all) and 5xx/429 responses. A 4xx (auth,
-* validation, not-found) will not heal on retry.
-*/
-function isTransientUploadError(error) {
-	if (!(error instanceof Error)) return false;
-	const statusCode = error.statusCode;
-	if (typeof statusCode !== "number") return true;
-	return statusCode >= 500 || statusCode === 429;
-}
-var defaultSleep = (ms) => new Promise((resolve) => {
-	setTimeout(resolve, ms);
-});
-function createApiRuntimeSessionStore(args) {
-	const { agent, logger, uploadRetry } = args;
-	return {
-		async findRuntimeSessionByTaskAttempt(teamId, taskId, attemptN) {
-			return agent.runtimeSessions.getForAttempt({
-				attemptN,
-				taskId
-			}, { teamId });
-		},
-		async hydrateSession(input) {
-			const downloaded = await agent.runtimeSessions.download({
-				attemptN: input.attemptN,
-				taskId: input.taskId
-			}, { teamId: input.teamId });
-			await mkdir(input.destinationDir, { recursive: true });
-			const sessionPath = join(input.destinationDir, `remote-${input.taskId}-attempt-${input.attemptN}.jsonl`);
-			await pipeline(downloaded, createWriteStream(sessionPath));
-			return sessionPath;
-		},
-		async uploadAttemptFinal(input) {
-			const sessionPath = resolveLatestPiSessionPath(input.sessionDir);
-			if (!sessionPath) throw new Error(`Cannot upload runtime session for ${input.taskId}/${input.attemptN}: no local session file in ${input.sessionDir}`);
-			const maxTries = uploadRetry?.maxTries ?? 3;
-			const baseDelayMs = uploadRetry?.baseDelayMs ?? 750;
-			const sleep = uploadRetry?.sleep ?? defaultSleep;
-			for (let tryN = 1;; tryN += 1) try {
-				await agent.runtimeSessions.upload({
-					attemptN: input.attemptN,
-					taskId: input.taskId
-				}, createReadStream(sessionPath), {
-					parentSessionId: input.parentSessionId ?? void 0,
-					sessionKind: input.sessionKind,
-					sourceRuntimeProfileId: input.sourceRuntimeProfileId ?? void 0,
-					sourceSlotId: input.sourceSlotId ?? void 0
-				}, { teamId: input.teamId });
-				return;
-			} catch (error) {
-				if (tryN >= maxTries || !isTransientUploadError(error)) throw error;
-				const delayMs = baseDelayMs * tryN;
-				logger?.warn({
-					event: "agent-daemon.runtime_session_upload_retry",
-					attemptN: input.attemptN,
-					delayMs,
-					statusCode: uploadStatusCode(error),
-					taskId: input.taskId,
-					tryN
-				}, "Retrying durable runtime session upload");
-				await sleep(delayMs);
-			}
-		}
-	};
-}
-function uploadStatusCode(error) {
-	const statusCode = error?.statusCode;
-	return typeof statusCode === "number" ? statusCode : void 0;
-}
-function resolveContinueFrom(claimedTask) {
-	return claimedTask.task.input.continueFrom;
-}
-//#endregion
-//#region src/lib/runtime-slots.ts
-function createApiRuntimeSlotStore(args) {
-	const { agent } = args;
-	return {
-		async beginSlot(input) {
-			await agent.runtimeSlots.begin({
-				agentName: input.agentName,
-				runtimeProfileId: input.runtimeProfileId,
-				lastAttemptN: input.lastAttemptN,
-				lastTaskId: input.lastTaskId,
-				model: input.model,
-				provider: input.provider,
-				sessionDir: input.sessionDir ?? void 0,
-				sessionPath: input.sessionPath ?? void 0,
-				slotKey: input.slotKey,
-				taskType: input.taskType,
-				workspaceId: input.workspaceId ?? void 0,
-				workspaceKind: input.workspaceKind,
-				worktreeBranch: input.worktreeBranch ?? void 0,
-				worktreePath: input.worktreePath ?? void 0
-			}, { teamId: input.teamId });
-		},
-		async finishSlot(teamId, taskId, attemptN, identity, slotKey, provider, model, sessionPath) {
-			await agent.runtimeSlots.finish({
-				agentName: identity.agentName,
-				attemptN,
-				runtimeProfileId: identity.runtimeProfileId,
-				model,
-				provider,
-				sessionPath: sessionPath ?? void 0,
-				slotKey,
-				taskId
-			}, { teamId });
-		},
-		async findLatestSlotByTaskAttempt(teamId, taskId, attemptN) {
-			const resolved = await agent.runtimeSlots.findLatestForAttempt({
-				attemptN,
-				taskId
-			}, { teamId });
-			if (!resolved) return null;
-			return {
-				slot: {
-					expiresAtMs: resolved.slot.expiresAtMs,
-					id: resolved.slot.id,
-					runtimeProfileId: resolved.slot.runtimeProfileId
-				},
-				session: resolved.slot.sessionDir ? {
-					sessionDir: resolved.slot.sessionDir,
-					sessionPath: resolved.slot.sessionPath
-				} : null,
-				workspace: resolved.workspace ? {
-					kind: resolved.workspace.kind,
-					workspaceId: resolved.workspace.workspaceId,
-					worktreeBranch: resolved.workspace.worktreeBranch,
-					worktreePath: resolved.workspace.worktreePath
-				} : null
-			};
-		},
-		async listSlots(input) {
-			const query = {
-				agentName: input.agentName,
-				...input.limit === void 0 ? {} : { limit: input.limit },
-				...input.runtimeProfileId === void 0 ? {} : { runtimeProfileId: input.runtimeProfileId },
-				...input.state === void 0 ? {} : { state: input.state }
-			};
-			return (await agent.runtimeSlots.list(query, { teamId: input.teamId })).map((resolved) => ({
-				slot: {
-					expiresAtMs: resolved.slot.expiresAtMs,
-					id: resolved.slot.id,
-					lastAttemptN: resolved.slot.lastAttemptN,
-					lastTaskId: resolved.slot.lastTaskId,
-					runtimeProfileId: resolved.slot.runtimeProfileId,
-					slotKey: resolved.slot.slotKey,
-					state: resolved.slot.state,
-					taskType: resolved.slot.taskType
-				},
-				session: resolved.slot.sessionDir ? {
-					sessionDir: resolved.slot.sessionDir,
-					sessionPath: resolved.slot.sessionPath
-				} : null,
-				workspace: resolved.workspace ? {
-					kind: resolved.workspace.kind,
-					workspaceId: resolved.workspace.workspaceId,
-					worktreeBranch: resolved.workspace.worktreeBranch,
-					worktreePath: resolved.workspace.worktreePath
-				} : null
-			}));
-		},
-		async close() {}
-	};
-}
-//#endregion
-//#region src/lib/secret-redaction.ts
-var REDACTED = "[REDACTED]";
-var MIN_SECRET_LENGTH = 8;
-/**
-* Redact required runtime-profile environment values before task output leaves
-* the daemon. This is defense in depth for shell-capable profiles: a model may
-* read a forwarded provider key, but it must not be able to publish that exact
-* value through a task result.
-*/
-function redactRequiredEnvValues(value, requiredEnv, env) {
-	const secrets = [...new Set(requiredEnv.map((name) => env[name]).filter((secret) => typeof secret === "string" && secret.length >= MIN_SECRET_LENGTH))];
-	if (secrets.length === 0) return value;
-	const redact = (candidate) => {
-		if (typeof candidate === "string") return secrets.reduce((text, secret) => text.replaceAll(secret, REDACTED), candidate);
-		if (Array.isArray(candidate)) return candidate.map(redact);
-		if (candidate && typeof candidate === "object") return Object.fromEntries(Object.entries(candidate).map(([key, nested]) => [key, redact(nested)]));
-		return candidate;
-	};
-	return redact(value);
-}
-//#endregion
-//#region src/lib/shutdown-signal.ts
-function installShutdownSignalHandlers(opts) {
-	const proc = opts.proc ?? process;
-	let drainingSignal = null;
-	const onSignal = (signal) => {
-		if (drainingSignal) {
-			proc.stderr.write(`[agent-daemon] ${signal} received while already draining from ${drainingSignal}; waiting for cleanup.\n`);
-			proc.exitCode = signalExitCode(signal);
+	}
+	/** Identity aliases available in the shared user-level store. */
+	listIdentityAliases() {
+		return readdirSync(this.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && IDENTITY_ALIAS_PATTERN.test(entry.name)).map((entry) => entry.name).sort((left, right) => left.localeCompare(right));
+	}
+	resolveIdentityAlias(explicit, active) {
+		const alias = explicit?.trim() || active?.trim() || this.readIdentitySelector()?.default_identity;
+		if (!alias) throw new AgentServerStoreError("not_found", "no active identity selected");
+		return assertStoreName("identity alias", alias);
+	}
+	readAgentConfig(alias) {
+		return readJson(this.agentPath(alias));
+	}
+	writeAgentConfig(alias, config) {
+		mkdirSync(this.identityDir(alias), {
+			recursive: true,
+			mode: 448
+		});
+		writeJsonAtomic(this.agentPath(alias), config);
+		if (!this.readIdentitySelector()?.default_identity) this.writeIdentitySelector(alias);
+	}
+	removeAgentConfig(alias) {
+		rmSync(this.agentPath(alias), { force: true });
+		this.clearIdentitySelectorIfDefault(alias);
+	}
+	/** Clears the persisted default when it names `alias`. */
+	clearIdentitySelectorIfDefault(alias) {
+		let selector = null;
+		try {
+			selector = this.readIdentitySelector();
+		} catch {
 			return;
 		}
-		drainingSignal = signal;
-		proc.exitCode = signalExitCode(signal);
+		if (!selector || selector.default_identity !== alias) return;
+		writeJsonAtomic(this.identitySelectorPath, { version: 1 });
+	}
+	readActivation(alias) {
+		return this.readAgentServerState().activations[assertStoreName("agent name", alias)] ?? null;
+	}
+	hasPendingRegistration(alias) {
+		return Boolean(this.readAgentServerState().pendingRegistrations[assertStoreName("agent name", alias)]);
+	}
+	reserveRegistration(alias, apiUrl) {
+		const name = assertStoreName("agent name", alias);
+		const state = this.readAgentServerState();
+		if (state.activations[name] || state.pendingRegistrations[name]) throw new AgentServerStoreError("already_exists", `agent "${name}" already exists in the agent server store`);
+		state.pendingRegistrations[name] = {
+			apiUrl,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		this.writeAgentServerState(state);
+	}
+	clearPendingRegistration(alias) {
+		const name = assertStoreName("agent name", alias);
+		const state = this.readAgentServerState();
+		delete state.pendingRegistrations[name];
+		this.writeAgentServerState(state);
+	}
+	writeActivation(activation) {
+		const alias = assertStoreName("agent name", activation.alias);
+		validateActivation(alias, activation);
+		const state = this.readAgentServerState();
+		state.activations[alias] = activation;
+		if (activation.source === "managed") delete state.pendingRegistrations[alias];
+		this.writeAgentServerState(state);
+	}
+	listActivations() {
+		return Object.values(this.readAgentServerState().activations).sort((a, b) => a.alias.localeCompare(b.alias));
+	}
+	get providersPath() {
+		return join(this.root, "providers.json");
+	}
+	readProviders() {
+		const state = readJson(this.providersPath) ?? {};
+		this.validateProviders(state);
+		return state;
+	}
+	writeProviders(state) {
+		this.validateProviders(state);
+		writeJsonAtomic(this.providersPath, state);
+	}
+	validateProviders(state) {
+		for (const [id, provider] of Object.entries(state)) {
+			assertProviderId(id);
+			assertProviderEnvName(id, provider.envName);
+		}
+	}
+	runDir(id) {
+		return storeChildPath(this.runsDir, "run id", id);
+	}
+	resolveRunLogPath(id) {
+		let root;
+		let runDir;
 		try {
-			opts.logDrain(signal);
-		} catch (err) {
-			proc.stderr.write(`[agent-daemon] failed to log ${signal}: ` + (err instanceof Error ? err.message : String(err)) + "\n");
+			root = realpathSync(this.runsDir);
+			runDir = realpathSync(this.runDir(id));
+		} catch (cause) {
+			throw new AgentServerStoreError("io_error", "could not resolve run directory", { cause });
 		}
-		opts.drain(signal);
-	};
-	const handleSigint = () => onSignal("SIGINT");
-	const handleSigterm = () => onSignal("SIGTERM");
-	proc.on("SIGINT", handleSigint);
-	proc.on("SIGTERM", handleSigterm);
-	return { dispose: () => {
-		proc.off("SIGINT", handleSigint);
-		proc.off("SIGTERM", handleSigterm);
-	} };
-}
-function signalExitCode(signal) {
-	return signal === "SIGINT" ? 130 : 143;
-}
-//#endregion
-//#region src/lib/source-attempts.ts
-function createApiSourceAttemptResolver(args) {
-	const { agent } = args;
-	return {
-		async findOutputBranch(input) {
-			const attempt = (await agent.tasks.listAttempts(input.taskId, { teamId: input.teamId })).find((candidate) => candidate.attemptN === input.attemptN);
-			if (!attempt || attempt.status !== "completed") return null;
-			return resolveOutputBranch(attempt.output);
-		},
-		async findInputRevision(input) {
-			const task = await agent.tasks.get(input.taskId, { teamId: input.teamId });
-			if (task.status !== "completed" || task.acceptedAttemptN !== input.attemptN) return null;
-			return resolveTaskWorkspaceRevision(task.input);
+		if (!isStrictDescendant(root, runDir)) throw new AgentServerStoreError("invalid_state", "run directory escapes its store");
+		const logPath = join(runDir, "daemon.log");
+		try {
+			if (lstatSync(logPath).isSymbolicLink()) throw new AgentServerStoreError("invalid_state", "run log must not be a symbolic link");
+			const resolvedLog = realpathSync(logPath);
+			if (!isStrictDescendant(runDir, resolvedLog)) throw new AgentServerStoreError("invalid_state", "run log escapes its store");
+		} catch (cause) {
+			if (cause instanceof AgentServerStoreError) throw cause;
+			if (cause.code !== "ENOENT") throw new AgentServerStoreError("io_error", "could not resolve run log", { cause });
 		}
-	};
-}
-function resolveOutputBranch(output) {
-	if (!output || typeof output !== "object") return null;
-	const branch = output.branch;
-	return typeof branch === "string" && branch.length > 0 ? branch : null;
+		return logPath;
+	}
+	createRunDir(id) {
+		const dir = this.runDir(id);
+		const piDir = join(dir, "pi");
+		mkdirSync(piDir, {
+			recursive: true,
+			mode: 448
+		});
+		return {
+			dir,
+			piDir,
+			logPath: join(dir, "daemon.log")
+		};
+	}
+	readRun(id) {
+		return readJson(join(this.runDir(id), "run.json"));
+	}
+	writeRun(record) {
+		writeJsonAtomic(join(this.runDir(record.id), "run.json"), record);
+	}
+	listRuns(limit = Number.POSITIVE_INFINITY) {
+		let ids;
+		try {
+			ids = readdirSync(this.runsDir);
+		} catch {
+			return [];
+		}
+		const sortedIds = ids.filter((id) => NAME_RE.test(id)).sort().reverse();
+		const selectedIds = Number.isFinite(limit) ? sortedIds.slice(0, Math.max(0, limit)) : sortedIds;
+		const records = [];
+		for (const id of selectedIds) {
+			const record = this.readRun(id);
+			if (record) records.push(record);
+		}
+		return records.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+	}
+	/** Remove only completed run directories outside the configured budget. */
+	pruneCompletedRuns(options) {
+		const now = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+		let retainedBytes = 0;
+		let retainedCount = 0;
+		const removed = [];
+		for (const record of this.listRuns()) {
+			if (record.status === "running") continue;
+			const dir = this.runDir(record.id);
+			const bytes = directoryBytes(dir);
+			const endedAt = Date.parse(record.endedAt ?? record.startedAt);
+			const expired = !Number.isFinite(endedAt) || now - endedAt > options.maxAgeMs;
+			const overCount = retainedCount >= options.maxCount;
+			const overBytes = retainedBytes + bytes > options.maxBytes;
+			if (expired || overCount || overBytes) {
+				rmSync(dir, {
+					recursive: true,
+					force: true
+				});
+				removed.push(record.id);
+				continue;
+			}
+			retainedCount += 1;
+			retainedBytes += bytes;
+		}
+		return removed;
+	}
+};
+function directoryBytes(path) {
+	let info;
+	try {
+		info = lstatSync(path);
+	} catch {
+		return 0;
+	}
+	if (info.isSymbolicLink()) return 0;
+	if (!info.isDirectory()) return info.size;
+	let total = 0;
+	for (const entry of readdirSync(path, { withFileTypes: true })) total += directoryBytes(join(path, entry.name));
+	return total;
 }
-//#endregion
-//#region src/lib/state-dir.ts
-function ensureDaemonStateDirs(mountPath) {
-	const rootDir = join(mountPath, ".moltnet", "d");
-	const piSessionsDir = join(rootDir, "pi-sessions");
-	mkdirSync(piSessionsDir, { recursive: true });
-	return {
-		rootDir,
-		piSessionsDir
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function storeChildPath(root, kind, value, suffix = "") {
+	const name = assertStoreName(kind, value);
+	const normalizedRoot = resolve(root);
+	const candidate = resolve(normalizedRoot, `${name}${suffix}`);
+	if (!isStrictDescendant(normalizedRoot, candidate)) throw new AgentServerStoreError("invalid_name", `${kind} escapes its store`);
+	return candidate;
+}
+function isStrictDescendant(root, candidate) {
+	const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+	return candidate !== root && candidate.startsWith(rootPrefix);
+}
+function validateActivation(alias, value) {
+	const invalid = () => {
+		throw new AgentServerStoreError("invalid_state", `activation "${alias}" is not a valid version 2 activation`);
 	};
+	if (!isRecord$1(value)) invalid();
+	const activation = value;
+	if (activation.alias !== alias) invalid();
+	if (![
+		"subjectId",
+		"publicKey",
+		"fingerprint",
+		"createdAt"
+	].every((field) => typeof activation[field] === "string" && activation[field].length > 0)) invalid();
+	if (activation.source === "managed") {
+		if (typeof activation.apiUrl !== "string" || activation.apiUrl.length === 0 || activation.configPath !== void 0 || activation.configApiUrl !== void 0) invalid();
+		return;
+	}
+	if (activation.source !== "external" || typeof activation.configPath !== "string" || activation.configPath.length === 0 || typeof activation.configApiUrl !== "string" || activation.configApiUrl.length === 0 || activation.apiUrl !== void 0 && typeof activation.apiUrl !== "string") invalid();
 }
 //#endregion
-//#region src/lib/turn-event-logger.ts
-function makeTurnEventHandler(base, context = {}) {
-	const log = base.child({
-		name: "agent-daemon.turn",
-		...context
+//#region src/lib/agent-server/pi-store-config.ts
+/**
+* Materialise the Agent Server provider store as a Pi agent dir. Shared by
+* supervised runs (`runs.ts`) and direct `once`/`poll`/`drain` runs
+* (`pi-agent-dir.ts`) so both generate the same `models.json`.
+*/
+/**
+* Write `models.json` + `settings.json` for the stored providers. API keys
+* appear only as `$MOLTNET_PROVIDER_<ID>_API_KEY` placeholders.
+*/
+function writeStorePiConfig(piDir, providers) {
+	writePiConfig({
+		piDir,
+		providers: Object.fromEntries(Object.entries(providers).map(([providerId, provider]) => [providerId, {
+			api: provider.api,
+			...provider.apiKeyRef ? { apiKeyEnvRef: `$${provider.envName}` } : {},
+			baseUrl: provider.baseUrl,
+			models: provider.models
+		}]))
 	});
-	return (event, summary) => {
-		if (event === "text_delta") return;
-		log[event === "error" ? "warn" : event === "turn_end" ? "info" : "debug"]({
-			event,
-			...summary
-		}, `turn.${event}`);
-	};
 }
-function makeTurnEventHandlerFactory(base) {
-	return (claimedTask) => makeTurnEventHandler(base, {
-		taskId: claimedTask.task.id,
-		attemptN: claimedTask.attemptN
-	});
+/**
+* Link a shared Pi `auth.json` into `piDir`. Pi lockfiles the target and
+* rotates tokens in place, so a link (never a copy) keeps one credential
+* document. A dangling link is fine — Pi treats a missing auth.json as "no
+* subscription auth". Failing to create the link is not: the run would start
+* with a connected subscription silently unavailable.
+*/
+function linkPiAuth(authPath, piDir, symlinkImpl = symlinkSync) {
+	try {
+		symlinkImpl(authPath, join(piDir, "auth.json"));
+	} catch (cause) {
+		throw new AgentServerStoreError("io_error", "could not link subscription credentials into the run", { cause });
+	}
 }
 //#endregion
-//#region src/cli/poll-shared.ts
-async function runPolling(opts) {
-	if (isHelpFlag(opts.argv)) {
-		console.log(opts.helpText);
-		return 0;
-	}
-	const { values } = parseArgs({
-		args: opts.argv,
-		options: {
-			...commonOptionDefs(),
-			team: { type: "string" },
-			"task-types": { type: "string" },
-			"correlation-id": { type: "string" },
-			"diary-ids": { type: "string" },
-			"wait-for-first-task-sec": { type: "string" },
-			"wait-after-task-sec": { type: "string" },
-			"poll-interval-ms": { type: "string" },
-			"max-poll-interval-ms": { type: "string" },
-			"list-limit": { type: "string" },
-			sandbox: { type: "string" },
-			profile: {
-				type: "string",
-				multiple: true
-			}
-		}
-	});
-	if (!values.team) {
-		console.error("Missing required flag: --team\n");
-		console.error(opts.helpText);
-		return 1;
-	}
-	const teamId = values.team;
-	const profileValues = parseProfileValues(values.profile);
-	if (profileValues.length === 0) {
-		console.error("Missing required flag: --profile\n");
-		console.error(opts.helpText);
-		return 1;
+//#region src/lib/pi-agent-dir.ts
+/**
+* Pick the Pi agent dir for direct `once`/`poll`/`drain` runs:
+*
+* 1. `PI_CODING_AGENT_DIR`, unchanged (`env`).
+* 2. When the Agent Server store has providers or a subscription login, a
+*    private dir built like an Agent Server run, with `<agentRoot>/.pi`
+*    config the store does not define layered in (`store`).
+* 3. `<agentRoot>/.pi` (`repo`).
+*/
+async function resolvePiAgentDir(cfg, agentRoot, profiles, options = {}) {
+	const noop = () => void 0;
+	if (cfg.piCodingAgentDir) {
+		mkdirSync(cfg.piCodingAgentDir, { recursive: true });
+		return {
+			path: cfg.piCodingAgentDir,
+			source: "env",
+			env: {},
+			cleanup: noop
+		};
 	}
-	let taskTypes;
-	try {
-		taskTypes = validateTaskTypes(parseCsv(values["task-types"]));
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		console.error(message);
-		return 1;
+	const repoPiDir = join(agentRoot, ".pi");
+	const store = new AgentServerStore(resolveAgentServerRoot({ root: cfg.agentServerRoot }));
+	const providers = store.readProviders();
+	const storeHasAuth = existsSync(store.piAuthJsonPath);
+	if (Object.keys(providers).length === 0 && !storeHasAuth) {
+		mkdirSync(repoPiDir, { recursive: true });
+		return {
+			path: repoPiDir,
+			source: "repo",
+			env: {},
+			cleanup: noop
+		};
 	}
-	const diaryIds = parseCsv(values["diary-ids"]);
-	let baseCommon;
+	const path = mkdtempSync(join(options.tempRoot ?? tmpdir(), "moltnet-pi-"));
+	const cleanup = () => rmSync(path, {
+		recursive: true,
+		force: true
+	});
 	try {
-		baseCommon = parseCommonOptions(values);
-	} catch (err) {
-		if (err instanceof MissingRequiredOptionError) {
-			console.error(`${err.message}\n`);
-			console.error(opts.helpText);
-			return 1;
+		writeStorePiConfig(path, providers);
+		const repoModelsPath = join(repoPiDir, "models.json");
+		if (existsSync(repoModelsPath)) {
+			const modelsPath = join(path, "models.json");
+			const merged = mergePiModels(readPiModels(modelsPath), readPiModels(repoModelsPath));
+			writeFileSync(modelsPath, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+		}
+		const repoSettingsPath = join(repoPiDir, "settings.json");
+		if (existsSync(repoSettingsPath)) copyFileSync(repoSettingsPath, join(path, "settings.json"));
+		const repoAuthPath = join(repoPiDir, "auth.json");
+		linkPiAuth(storeHasAuth || !existsSync(repoAuthPath) ? store.piAuthJsonPath : repoAuthPath, path);
+		const secretProviders = options.secretProviders ?? createNodeSecretProviderRegistry().register(new FileSecretProvider({ root: store.secretsDir }));
+		const env = {};
+		for (const providerId of new Set(profiles.map((p) => p.provider))) {
+			const provider = providers[providerId];
+			if (!provider?.apiKeyRef) continue;
+			if (cfg.profilePrerequisiteEnv[provider.envName]) continue;
+			try {
+				env[provider.envName] = await secretProviders.resolve(parseSecretReferenceString(provider.apiKeyRef));
+			} catch {
+				throw new Error(`provider "${providerId}" API key could not be resolved from the Agent Server store`);
+			}
 		}
-		throw err;
-	}
-	const pollIntervalMs = optionalPositiveInt(values["poll-interval-ms"], "poll-interval-ms", 2e3);
-	const maxPollIntervalMs = optionalPositiveInt(values["max-poll-interval-ms"], "max-poll-interval-ms", 3e4);
-	const listLimit = optionalPositiveInt(values["list-limit"], "list-limit", 10);
-	const waitForFirstTaskSec = optionalNonNegativeInt(values["wait-for-first-task-sec"], "wait-for-first-task-sec", 0);
-	const waitAfterTaskSec = optionalNonNegativeInt(values["wait-after-task-sec"], "wait-after-task-sec", 0);
-	if (!opts.stopWhenEmpty && (waitForFirstTaskSec > 0 || waitAfterTaskSec > 0)) {
-		console.error(`[${opts.modeLabel}] --wait-for-first-task-sec and --wait-after-task-sec are only valid with drain.`);
-		return 1;
-	}
-	if (values.sandbox) {
-		console.error(`[${opts.modeLabel}] Cannot use --sandbox. Remote runtime profiles define sandbox policy.`);
-		return 1;
+		return {
+			path,
+			source: "store",
+			env,
+			cleanup
+		};
+	} catch (error) {
+		cleanup();
+		throw error;
 	}
-	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
-	const cfg = loadConfig();
-	const credentialSources = {
-		profileRequirements: cfg.profileCredentialRequirements,
-		bindings: cfg.credentialBindings
+}
+function readPiModels(path) {
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof parsed?.providers === "object" && parsed.providers !== null) return parsed;
+	} catch {}
+	throw new Error(`${path} is not a valid Pi models document`);
+}
+/**
+* Store entries win per provider id. Repo models the store lacks are appended
+* with their metadata; repo-only providers are added unchanged.
+*/
+function mergePiModels(store, repo) {
+	const providers = {
+		...repo.providers,
+		...store.providers
 	};
-	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
-	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
-	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
-		let gate = "resolve_agent_context";
-		try {
-			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
-				agentRootDir: explicitAgentRootDir,
-				credentialSource: cfg.credentialSource,
-				envApiUrl: cfg.apiUrl
-			});
-			gate = "authenticate_and_bind";
-			const whoami = await validateStartupBinding({
-				agent: resolvedContext.agent,
-				teamId,
-				expectedAgent: cfg.expectedAgent
-			});
-			gate = "resolve_signing_material";
-			const privateKey = await resolveExecutorSigningPrivateKey({
-				credentialSource: cfg.credentialSource,
-				agentDir: resolvedContext.agentDir,
-				configuredPrivateKey: cfg.signingPrivateKey,
-				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
-			});
-			gate = "validate_scopes";
-			validateDaemonScopes(whoami);
-			gate = "validate_signing_identity";
-			await validateExecutorSigningIdentity({
-				whoami,
-				signingPrivateKey: privateKey
-			});
-			gate = "resolve_agent_identity";
-			const agentIdentity = await resolveDaemonAgentIdentity({
-				agentName: baseCommon.agent,
-				whoami,
-				credentialSource: cfg.credentialSource,
-				agentDir: resolvedContext.agentDir,
-				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
-			});
-			return {
-				ctx: resolvedContext,
-				signingPrivateKey: privateKey,
-				startupWhoami: whoami,
-				agentIdentity,
-				hostCapabilitySigner: createLocalSeedSigner({
-					privateKeySeed: privateKey,
-					agent: resolvedContext.agent,
-					identity: agentIdentity
-				})
-			};
-		} catch (error) {
-			await logDaemonStartupFailure({
-				serviceName: `agent-daemon.${opts.modeLabel}`,
-				level: cfg.logLevel || (baseCommon.debug ? "debug" : "info"),
-				gate,
-				agent: baseCommon.agent,
-				credentialSource: cfg.credentialSource,
-				error
+	for (const [id, storeProvider] of Object.entries(store.providers)) {
+		const repoModels = repo.providers[id]?.models ?? [];
+		const known = new Set((storeProvider.models ?? []).map((m) => m.id));
+		providers[id] = {
+			...storeProvider,
+			models: [...storeProvider.models ?? [], ...repoModels.filter((m) => !known.has(m.id))]
+		};
+	}
+	return { providers };
+}
+//#endregion
+//#region src/lib/runtime-context.ts
+var storage = new AsyncLocalStorage();
+function runWithDaemonRuntimeContext(context, callback) {
+	return storage.run(context, callback);
+}
+//#endregion
+//#region src/lib/runtime-profile-retry-triage.ts
+function createRuntimeProfileRetryTriage(options) {
+	return async (input) => {
+		const { modelHandle, modelRuntime } = await resolveRuntimeProfileModel(options.piAgentDir, options.runtimeProfile.provider, options.runtimeProfile.model);
+		return createPiRetryTriage({
+			model: modelHandle,
+			modelRuntime,
+			thinkingLevel: options.runtimeProfile.thinkingLevel,
+			piAgentDir: options.piAgentDir,
+			timeoutMs: options.timeoutMs,
+			cwd: options.cwd
+		})(input);
+	};
+}
+//#endregion
+//#region src/lib/runtime-resource-reaper.ts
+var RUNTIME_SLOT_PAGE_LIMIT = 200;
+var ATTEMPT_LOOKUP_CONCURRENCY = 8;
+var TERMINAL_ATTEMPT_STATUSES = new Set([
+	"completed",
+	"failed",
+	"cancelled",
+	"aborted",
+	"timed_out"
+]);
+/**
+* Reap daemon-owned local resources whose runtime slot is no longer usable.
+* The destructive path is deliberately conservative: uncertainty about slot
+* ownership, attempt state, listing completeness, or real filesystem
+* containment retains resources rather than risking another daemon's data.
+*/
+async function reapRuntimeSlotResources(deps, input) {
+	const now = input.now ?? Date.now();
+	const [activePage, idlePage] = await Promise.all([listOwnedSlots(deps.runtimeSlotStore, input, "active"), listOwnedSlots(deps.runtimeSlotStore, input, "idle")]);
+	const active = activePage.items;
+	const idle = idlePage.items;
+	const slots = [...active, ...idle];
+	const result = {
+		failed: 0,
+		failures: [],
+		removedSessions: 0,
+		removedWorkspaces: 0,
+		scanned: slots.length,
+		truncated: activePage.truncated || idlePage.truncated,
+		unsafePathDetails: [],
+		unsafePaths: 0
+	};
+	const reaped = new Set(idle.filter((item) => item.slot.expiresAtMs <= now).map((item) => item.slot.id));
+	for (const slotId of await findTerminalActiveSlotIds(deps, active, result)) reaped.add(slotId);
+	const retainedSessionDirs = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.session?.sessionDir ? [resolve(item.session.sessionDir)] : []));
+	const retainedWorkspacePaths = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.workspace?.worktreePath ? [resolve(item.workspace.worktreePath)] : []));
+	const worktrees = input.mainWorktree ? await listRegisteredWorktrees(input.mainWorktree) : {
+		kind: "ready",
+		paths: /* @__PURE__ */ new Set()
+	};
+	for (const item of slots) {
+		if (!reaped.has(item.slot.id)) continue;
+		if (!await slotStillQualifiesForReaping(deps, input, item, now, result)) continue;
+		const sessionDir = item.session?.sessionDir;
+		if (sessionDir && !retainedSessionDirs.has(resolve(sessionDir)) && existsSync(sessionDir)) if (!isRealPathInsideRoot(sessionDir, input.sessionRootDir)) recordUnsafePath(deps, result, item.slot.id, sessionDir, input.sessionRootDir);
+		else try {
+			rmSync(sessionDir, {
+				force: true,
+				recursive: true
 			});
-			throw error;
+			result.removedSessions++;
+		} catch (err) {
+			recordFailure(deps, result, item.slot.id, sessionDir, input.sessionRootDir, err);
 		}
-	})();
-	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
-	const resolvedProfiles = await resolveRuntimeProfiles({
-		agent: ctx.agent,
-		profiles: profileValues,
-		teamId,
-		cwd: daemonRootDir
-	});
-	const runtimeAdapter = opts.runtimeAdapter ?? defaultPiDaemonAdapter;
-	const preparedRuntimes = /* @__PURE__ */ new Map();
-	const profiles = [];
-	const skippedProfileBoundaries = [];
-	for (const profile of resolvedProfiles) try {
-		assertRuntimeAdapterSupportsProfile(runtimeAdapter, profile);
-		const prepared = attestPreparedRuntime(await runtimeAdapter.prepare({ profile }), signingPrivateKey);
-		validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, {
-			tools: prepared.tools,
-			executables: prepared.executables
-		});
-		assertGuestEnvironmentBoundary({
-			forwardEnv: profile.requiredEnv,
-			sandboxEnv: profile.sandboxConfig.env
-		});
-		await ctx.agent.tasks.registerExecutorManifest(await prepared.attestor.registration());
-		preparedRuntimes.set(profile.id, prepared);
-		profiles.push(profile);
-	} catch (error) {
-		if (!(error instanceof GuestEnvironmentBoundaryError)) throw error;
-		skippedProfileBoundaries.push({
-			profile,
-			error
-		});
-	}
-	if (profiles.length === 0) {
-		const details = skippedProfileBoundaries.map(({ profile, error }) => `${profile.name}: ${error.message}`).join("; ");
-		throw new Error(`No safe runtime profiles remain. ${details}`);
+		const workspacePath = item.workspace?.worktreePath;
+		if (!workspacePath || retainedWorkspacePaths.has(resolve(workspacePath))) continue;
+		const workspaceRoot = item.workspace?.kind === "scratch" ? input.scratchRootDir : input.mainWorktree ? resolve(input.mainWorktree, ".worktrees") : null;
+		if (!workspaceRoot) {
+			recordUnsafePath(deps, result, item.slot.id, workspacePath, null);
+			continue;
+		}
+		await removeWorkspace(deps, result, worktrees, input.mainWorktree, item.slot.id, workspacePath, workspaceRoot, item.workspace?.kind === "scratch");
 	}
-	const slotRegistry = createApiRuntimeSlotStore({ agent: ctx.agent });
-	const runtimeSessionStore = createApiRuntimeSessionStore({
-		agent: ctx.agent,
-		logger: { warn: (context, message) => rootLogger.warn(context, message) }
+	if (!result.truncated) await reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result);
+	return result;
+}
+async function listOwnedSlots(store, input, state) {
+	const listed = await store.listSlots({
+		agentName: input.agentName,
+		limit: RUNTIME_SLOT_PAGE_LIMIT,
+		runtimeProfileId: input.runtimeProfileId,
+		state,
+		teamId: input.teamId
 	});
-	const sourceAttemptResolver = createApiSourceAttemptResolver({ agent: ctx.agent });
-	const runtimeInstanceId = createRuntimeInstanceId();
-	const runtimes = /* @__PURE__ */ new Map();
-	for (const profile of profiles) {
-		const common = parseCommonOptions(values, { runtimeDefaults: {
-			leaseTtlSec: profile.leaseTtlSec,
-			heartbeatIntervalMs: profile.heartbeatIntervalMs,
-			maxBatchSize: profile.maxBatchSize,
-			maxTurns: profile.maxTurns,
-			maxBashTimeouts: profile.maxBashTimeouts,
-			warmSessionTtlSec: resolveProfileWarmSessionTtlSec(profile)
-		} });
-		const sandbox = {
-			config: profile.sandboxConfig,
-			rootDir: profile.mountPath,
-			path: profile.source
-		};
-		const piAgentDir = ensurePiAgentDir(sandbox.rootDir, cfg.piCodingAgentDir);
-		const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
-		const slotIdentity = {
-			agentName: common.agent,
-			runtimeProfileId: profile.id,
-			runtimeInstanceId
-		};
-		const executionPlans = createExecutionPlanCache({
-			stateDirs,
-			slotIdentity,
-			warmSessionTtlSec: common.warmSessionTtlSec,
-			workspacePolicy: {
-				defaultWorkspaceMode: profile.defaultWorkspaceMode,
-				allowedWorkspaceModes: profile.allowedWorkspaceModes
-			},
-			slotRegistry,
-			runtimeSessionStore,
-			sourceAttemptResolver
-		});
-		runtimes.set(profile.id, {
-			common,
-			profile,
-			sandbox,
-			stateDirs,
-			piAgentDir,
-			slotIdentity,
-			executionPlans,
-			preparedRuntime: preparedRuntimes.get(profile.id)
-		});
+	return {
+		items: listed.filter((item) => runtimeSlotKeyBelongsToInstance(item.slot.slotKey, input.runtimeInstanceId)),
+		truncated: listed.length === RUNTIME_SLOT_PAGE_LIMIT
+	};
+}
+async function findTerminalActiveSlotIds(deps, active, result) {
+	const byTask = /* @__PURE__ */ new Map();
+	for (const item of active) {
+		const taskSlots = byTask.get(item.slot.lastTaskId) ?? [];
+		taskSlots.push(item);
+		byTask.set(item.slot.lastTaskId, taskSlots);
 	}
-	const firstRuntime = runtimes.get(profiles[0].id);
-	if (!firstRuntime) throw new Error("No runtime profiles resolved");
-	const piAgentDir = firstRuntime.piAgentDir;
-	activatePiCodingAgentDir(piAgentDir.path);
-	const otelShutdown = await initWorkerOtel({
-		serviceName: opts.serviceName,
-		agent: ctx.agent,
-		endpoint: cfg.otelEndpoint,
-		resourceAttributes: {
-			"moltnet.team.id": teamId,
-			"moltnet.agent.name": baseCommon.agent,
-			"moltnet.credential.source": ctx.credentialSource,
-			"moltnet.runtime_profile.count": String(profiles.length),
-			"moltnet.runtime_profile.ids": profiles.map((p) => p.id).join(",")
+	const terminal = /* @__PURE__ */ new Set();
+	await mapWithConcurrency([...byTask.entries()], ATTEMPT_LOOKUP_CONCURRENCY, async ([taskId, taskSlots]) => {
+		let attempts;
+		try {
+			attempts = await deps.taskReader.listAttempts(taskId);
+		} catch (err) {
+			recordFailure(deps, result, null, `task:${taskId}`, null, err);
+			return;
+		}
+		for (const item of taskSlots) {
+			const attempt = attempts.find((candidate) => candidate.attemptN === item.slot.lastAttemptN);
+			if (attempt && TERMINAL_ATTEMPT_STATUSES.has(attempt.status)) terminal.add(item.slot.id);
 		}
 	});
-	const { logger, shutdown: shutdownLogger } = createRootLogger({
-		name: `agent-daemon.${opts.modeLabel}`,
-		level: cfg.logLevel || (baseCommon.debug ? "debug" : "info")
-	});
-	const rootLogger = logger.child({
-		mode: opts.modeLabel,
-		agent: baseCommon.agent,
-		teamId,
-		runtimeProfileIds: profiles.map((p) => p.id),
-		runtimeProfileNames: profiles.map((p) => p.name)
-	});
-	for (const { profile, error } of skippedProfileBoundaries) rootLogger.warn({
-		runtimeProfileId: profile.id,
-		runtimeProfileName: profile.name,
-		refusedEnvironmentNames: error.refusedNames
-	}, "agent-daemon.runtime_profile_skipped_credential_boundary");
-	const abort = new AbortController();
-	let runtime = null;
-	let active = null;
-	const signalHandlers = installShutdownSignalHandlers({
-		logDrain: (signal) => {
-			rootLogger.warn({ signal }, "agent-daemon.draining");
-		},
-		drain: (signal) => {
-			abort.abort();
-			runtime?.stop(`agent-daemon received ${signal}`);
-			abortActiveAttemptOnSignal({
-				active,
-				signal,
-				abortAttempt: (taskId, attemptN, body) => ctx.agent.tasks.abortAttempt(taskId, attemptN, body),
-				logFailure: (err, current) => {
-					try {
-						rootLogger.warn({
-							err: err instanceof Error ? err.message : String(err),
-							taskId: current.taskId,
-							attemptN: current.attemptN
-						}, "agent-daemon.abort_on_signal_failed");
-					} catch {}
-				}
-			});
-		}
-	});
-	rootLogger.info({
-		credentialSource: cfg.credentialSource,
-		subjectType: startupWhoami.subjectType,
-		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
-		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
-		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
-		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
-		correlationId: values["correlation-id"] ?? null,
-		diaryIds: diaryIds.length > 0 ? diaryIds : ["*"],
-		pollIntervalMs,
-		maxPollIntervalMs,
-		profiles: profiles.map((profile) => {
-			const runtime = requireRuntime(runtimes, profile.id);
-			return {
-				id: profile.id,
-				name: profile.name,
-				provider: profile.provider,
-				model: profile.model,
-				thinkingLevel: profile.thinkingLevel,
-				temperature: profile.temperature,
-				topP: profile.topP,
-				topK: profile.topK,
-				maxOutputTokens: profile.maxOutputTokens,
-				sandbox: runtime.sandbox.path,
-				leaseTtlSec: runtime.common.leaseTtlSec,
-				heartbeatIntervalMs: runtime.common.heartbeatIntervalMs,
-				maxTurns: runtime.common.maxTurns,
-				maxBashTimeouts: runtime.common.maxBashTimeouts,
-				warmSessionTtlSec: runtime.common.warmSessionTtlSec,
-				profileSessionTtlSec: profile.sessionTtlSec,
-				profileWorkspaceTtlSec: profile.workspaceTtlSec,
-				defaultWorkspaceMode: profile.defaultWorkspaceMode,
-				allowedWorkspaceModes: profile.allowedWorkspaceModes
-			};
-		}),
-		piAgentDir: piAgentDir.path,
-		piAgentDirSource: piAgentDir.source
-	}, "agent-daemon.starting");
-	let reaperRunning = false;
-	const reapRuntimeResources = async () => {
-		if (reaperRunning) return;
-		reaperRunning = true;
+	return terminal;
+}
+async function slotStillQualifiesForReaping(deps, input, original, now, result) {
+	let page;
+	try {
+		page = await listOwnedSlots(deps.runtimeSlotStore, input, original.slot.state);
+	} catch (err) {
+		recordFailure(deps, result, original.slot.id, `slot:${original.slot.id}`, null, err);
+		return false;
+	}
+	const current = page.items.find((candidate) => candidate.slot.id === original.slot.id);
+	if (!current) return false;
+	if (current.slot.lastTaskId !== original.slot.lastTaskId || current.slot.lastAttemptN !== original.slot.lastAttemptN) return false;
+	return current.slot.state === "active" || current.slot.state === "idle" && current.slot.expiresAtMs <= now;
+}
+async function reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result) {
+	if (!input.mainWorktree) return;
+	const workspaceRoot = resolve(input.mainWorktree, ".worktrees");
+	if (!existsSync(workspaceRoot)) return;
+	let entries;
+	try {
+		entries = readdirSync(workspaceRoot, { withFileTypes: true });
+	} catch (err) {
+		recordFailure(deps, result, null, workspaceRoot, workspaceRoot, err);
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory() || !entry.name.startsWith("session-agent%3A")) continue;
+		const workspacePath = resolve(workspaceRoot, entry.name);
+		if (retainedWorkspacePaths.has(workspacePath)) continue;
+		const sessionDir = resolve(input.sessionRootDir, entry.name.slice(8));
+		if (retainedSessionDirs.has(sessionDir) || existsSync(sessionDir)) continue;
+		await removeWorkspace(deps, result, worktrees, input.mainWorktree, null, workspacePath, workspaceRoot, false);
+	}
+}
+async function removeWorkspace(deps, result, worktrees, mainWorktree, slotId, workspacePath, workspaceRoot, scratch) {
+	if (!existsSync(workspacePath)) return;
+	if (!isRealPathInsideRoot(workspacePath, workspaceRoot)) {
+		recordUnsafePath(deps, result, slotId, workspacePath, workspaceRoot);
+		return;
+	}
+	if (scratch || !mainWorktree) {
 		try {
-			for (const profile of profiles) {
-				const selected = requireRuntime(runtimes, profile.id);
-				const result = await reapRuntimeSlotResources({
-					onIssue: (issue) => {
-						rootLogger.warn({
-							...issue,
-							runtimeProfileId: profile.id
-						}, "agent-daemon.runtime_resource_reap_issue");
-					},
-					runtimeSlotStore: slotRegistry,
-					taskReader: ctx.agent.tasks
-				}, {
-					agentName: selected.common.agent,
-					mainWorktree: resolveMainWorktree$1(selected.sandbox.rootDir),
-					runtimeInstanceId,
-					runtimeProfileId: profile.id,
-					sessionRootDir: selected.stateDirs.piSessionsDir,
-					scratchRootDir: join(selected.stateDirs.rootDir, "task-workspaces"),
-					teamId
-				});
-				if (result.removedSessions > 0 || result.removedWorkspaces > 0 || result.failed > 0 || result.unsafePaths > 0 || result.truncated) rootLogger.info({
-					...result,
-					runtimeProfileId: profile.id
-				}, "agent-daemon.runtime_resources_reaped");
-			}
+			rmSync(workspacePath, {
+				force: true,
+				recursive: true
+			});
+			result.removedWorkspaces++;
 		} catch (err) {
-			rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
-		} finally {
-			reaperRunning = false;
+			recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
 		}
+		return;
+	}
+	if (worktrees.kind === "unavailable") {
+		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, new Error(worktrees.reason));
+		return;
+	}
+	try {
+		const canonical = realpathSync(workspacePath);
+		if (worktrees.paths.has(canonical)) {
+			await execFileText("git", [
+				"-C",
+				mainWorktree,
+				"worktree",
+				"remove",
+				"--force",
+				workspacePath
+			]);
+			worktrees.paths.delete(canonical);
+		} else rmSync(workspacePath, {
+			force: true,
+			recursive: true
+		});
+		result.removedWorkspaces++;
+	} catch (err) {
+		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
+	}
+}
+async function listRegisteredWorktrees(mainWorktree) {
+	try {
+		const list = await execFileText("git", [
+			"-C",
+			mainWorktree,
+			"worktree",
+			"list",
+			"--porcelain"
+		]);
+		return {
+			kind: "ready",
+			paths: new Set(list.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => canonicalPath(line.slice(9))))
+		};
+	} catch (err) {
+		return {
+			kind: "unavailable",
+			reason: errorMessage(err)
+		};
+	}
+}
+function isRealPathInsideRoot(path, root) {
+	try {
+		return isResolvedPathInsideRoot(realpathSync(path), realpathSync(root));
+	} catch {
+		return false;
+	}
+}
+function canonicalPath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+function recordUnsafePath(deps, result, slotId, path, root) {
+	const issue = {
+		kind: "unsafe_path",
+		path,
+		reason: root === null ? "No daemon-owned root was available for this workspace." : "Candidate or root could not be resolved inside the daemon-owned root.",
+		root,
+		slotId
 	};
-	await reapRuntimeResources();
-	const reaperTimer = setInterval(() => {
-		reapRuntimeResources();
-	}, 6e4);
-	reaperTimer.unref();
-	const outputs = [];
+	result.unsafePaths++;
+	result.unsafePathDetails.push(issue);
+	emitIssue(deps, issue);
+}
+function recordFailure(deps, result, slotId, path, root, err) {
+	const issue = {
+		kind: "failure",
+		path,
+		reason: errorMessage(err),
+		root,
+		slotId
+	};
+	result.failed++;
+	result.failures.push(issue);
+	emitIssue(deps, issue);
+}
+function emitIssue(deps, issue) {
 	try {
-		runtime = new AgentRuntime({
-			logger: rootLogger,
-			source: new PollingApiTaskSource({
-				agent: ctx.agent,
-				teamId,
-				taskTypes: taskTypes.length > 0 ? taskTypes : void 0,
-				correlationId: values["correlation-id"],
-				profiles: profiles.map((profile) => ({
-					profileId: profile.id,
-					leaseTtlSec: requireRuntime(runtimes, profile.id).common.leaseTtlSec
-				})),
-				diaryIds: diaryIds.length > 0 ? diaryIds : void 0,
-				leaseTtlSec: firstRuntime.common.leaseTtlSec,
-				listLimit,
-				pollIntervalMs,
-				maxPollIntervalMs,
-				signal: abort.signal,
-				stopWhenEmpty: opts.stopWhenEmpty,
-				waitForFirstTaskMs: waitForFirstTaskSec * 1e3,
-				waitAfterTaskMs: waitAfterTaskSec * 1e3,
-				debug: baseCommon.debug,
-				traceIdlePolling: cfg.traceIdlePolling,
-				logger: rootLogger,
-				executorFingerprints: Object.fromEntries(profiles.map((profile) => [profile.id, requireRuntime(runtimes, profile.id).preparedRuntime.attestor.fingerprint])),
-				slotRegistry,
-				sessionRegistry: runtimeSessionStore,
-				sourceAttemptResolver
-			}),
-			makeReporter: (claimedTask) => {
-				const selected = runtimeForClaimedTask(runtimes, claimedTask);
-				return new ApiTaskReporter({
-					tasks: ctx.agent.tasks,
-					teamId: claimedTask.task.teamId,
-					leaseTtlSec: selected.common.leaseTtlSec,
-					heartbeatIntervalMs: selected.common.heartbeatIntervalMs,
-					maxBatchSize: selected.common.maxBatchSize,
-					flushIntervalMs: selected.common.flushIntervalMs
-				});
-			},
-			onTaskFinished: async (output, claimedTask) => {
-				const selected = runtimeForClaimedTask(runtimes, claimedTask);
-				const resolved = await slotRegistry.findLatestSlotByTaskAttempt(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN);
-				let terminalOutput = redactRequiredEnvValues(output, selected.profile.requiredEnv, cfg.profilePrerequisiteEnv);
-				if (resolved?.session?.sessionDir) try {
-					const parentSession = await resolveParentRuntimeSession(runtimeSessionStore, claimedTask);
-					await runtimeSessionStore.uploadAttemptFinal({
-						attemptN: claimedTask.attemptN,
-						parentSessionId: parentSession?.id ?? null,
-						sessionDir: resolved.session.sessionDir,
-						sessionKind: resolveRuntimeSessionKind(claimedTask),
-						sourceRuntimeProfileId: resolved.slot.runtimeProfileId,
-						sourceSlotId: resolved.slot.id,
-						taskId: claimedTask.task.id,
-						teamId: claimedTask.task.teamId
-					});
-				} catch (err) {
-					rootLogger.error({
-						err,
-						taskId: claimedTask.task.id,
-						attemptN: claimedTask.attemptN
-					}, "agent-daemon.runtime_session_upload_failed");
-					terminalOutput = applyRuntimeSessionUploadFailure(terminalOutput, err);
-				}
-				return finalizeTask(ctx.agent, terminalOutput, {
-					task: claimedTask.task,
-					slot: resolved ? { expiresAtMs: resolved.slot.expiresAtMs } : null,
-					retryTriage: createRuntimeProfileRetryTriage({
-						runtimeProfile: selected.profile,
-						piAgentDir: selected.piAgentDir.path,
-						cwd: ctx.agentRootDir
-					}),
-					executorAttestor: selected.preparedRuntime.attestor,
-					writeCorrelationAnchors: makePrBodyAnchorWriter({
-						gh: createGhCliClient(),
-						logger: rootLogger.child({
-							runtimeProfileId: selected.profile.id,
-							runtimeProfileName: selected.profile.name
-						})
-					}),
-					log: (msg, fields) => rootLogger.warn(fields ?? {}, msg)
-				});
-			},
-			executeTask: async (claimedTask, reporter) => {
-				const selected = runtimeForClaimedTask(runtimes, claimedTask);
-				const { common, executionPlans, profile, sandbox, slotIdentity, stateDirs } = selected;
-				if (runtimeCredentialConfig) await observeGovernancePlanSafely({
-					config: runtimeCredentialConfig,
-					profile,
-					offer: runtimeExecutionOffer(selected.preparedRuntime, selected.preparedRuntime.attestor.fingerprint),
-					registry: createNodeSecretProviderRegistry(),
-					executorFingerprint: selected.preparedRuntime.attestor.fingerprint,
-					claimAuthority: claimedTask.claimAuthority ?? {},
-					taskId: claimedTask.task.id,
-					attemptN: claimedTask.attemptN,
-					logger: rootLogger
-				});
-				const taskLogger = rootLogger.child({
-					runtimeProfileId: profile.id,
-					runtimeProfileName: profile.name,
-					provider: profile.provider,
-					model: profile.model,
-					thinkingLevel: profile.thinkingLevel,
-					temperature: profile.temperature,
-					topP: profile.topP,
-					topK: profile.topK,
-					maxOutputTokens: profile.maxOutputTokens
-				});
-				let executionPlan;
-				try {
-					executionPlan = await executionPlans.getOrCreate(claimedTask);
-				} catch (err) {
-					const message = err instanceof Error ? err.message : String(err);
-					taskLogger.warn({
-						taskId: claimedTask.task.id,
-						attemptN: claimedTask.attemptN,
-						err: message
-					}, "agent-daemon.execution_plan_failed");
-					return {
-						taskId: claimedTask.task.id,
-						attemptN: claimedTask.attemptN,
-						status: "failed",
-						output: null,
-						outputCid: null,
-						usage: {
-							inputTokens: 0,
-							outputTokens: 0
-						},
-						durationMs: 0,
-						error: {
-							code: err instanceof ProducerContextResolutionError ? "producer_context_missing" : "execution_plan_failed",
-							message,
-							retryable: false
-						}
-					};
-				}
-				const sessionDescriptor = executionPlan.descriptor;
-				taskLogger.debug({
-					taskId: claimedTask.task.id,
-					taskType: claimedTask.task.taskType,
-					resumable: sessionDescriptor.policy.resumable,
-					workspaceMode: executionPlan.workspaceMode,
-					workspaceScope: sessionDescriptor.policy.workspaceScope,
-					sessionScope: sessionDescriptor.policy.sessionScope,
-					slotKey: executionPlan.slotKey,
-					slotId: executionPlan.slotId,
-					sessionKey: executionPlan.sessionKey,
-					piSessionDir: executionPlan.sessionPersistence?.sessionDir ?? null,
-					workspaceId: executionPlan.workspaceId
-				}, "agent-daemon.task_execution_policy");
-				if (taskTypes.length > 0 && !taskTypes.includes(claimedTask.task.taskType)) return {
-					taskId: claimedTask.task.id,
-					attemptN: claimedTask.attemptN,
-					status: "failed",
-					output: null,
-					outputCid: null,
-					usage: {
-						inputTokens: 0,
-						outputTokens: 0
-					},
-					durationMs: 0,
-					error: {
-						code: "unsupported_task_type",
-						message: `Daemon does not support task type "${claimedTask.task.taskType}". Configured types: ${taskTypes.join(", ")}.`,
-						retryable: true
-					}
-				};
-				if (reporter.cancelSignal.aborted) return {
-					taskId: claimedTask.task.id,
-					attemptN: claimedTask.attemptN,
-					status: "cancelled",
-					output: null,
-					outputCid: null,
-					usage: {
-						inputTokens: 0,
-						outputTokens: 0
-					},
-					durationMs: 0,
-					error: {
-						code: "task_cancelled",
-						message: reporter.cancelReason ?? "Task cancelled before executor started.",
-						retryable: false
-					}
-				};
-				if (executionPlan.slotKey && executionPlan.sessionPersistence) await slotRegistry.beginSlot({
-					...slotIdentity,
-					runtimeProfileId: profile.id,
-					provider: profile.provider,
-					model: profile.model,
-					teamId: claimedTask.task.teamId,
-					slotKey: executionPlan.slotKey,
-					taskType: claimedTask.task.taskType,
-					sessionDir: executionPlan.sessionPersistence.sessionDir,
-					sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
-					workspaceId: executionPlan.workspaceId,
-					worktreePath: resolveRecordedWorkspacePath$1(stateDirs.rootDir, sandbox.rootDir, executionPlan),
-					worktreeBranch: executionPlan.worktreeBranch,
-					workspaceKind: executionPlan.workspaceKind,
-					lastTaskId: claimedTask.task.id,
-					lastAttemptN: claimedTask.attemptN
-				});
-				const rawExecuteTask = selected.preparedRuntime.createTaskExecutor({
-					agentName: common.agent,
-					moltnetAgent: ctx.agent,
-					agentIdentity,
-					hostCapabilitySigner,
-					hostCapabilityLogger: taskLogger,
-					agentRootDir: ctx.agentRootDir,
-					mountPath: sandbox.rootDir,
-					provider: profile.provider,
-					model: profile.model,
-					thinkingLevel: profile.thinkingLevel,
-					temperature: profile.temperature,
-					topP: profile.topP,
-					topK: profile.topK,
-					maxOutputTokens: profile.maxOutputTokens,
-					sandboxConfig: sandbox.config,
-					forwardEnv: profile.requiredEnv,
-					onVmDiagnostic: (diagnostic) => {
-						const fields = {
-							event: diagnostic.event,
-							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
-						};
-						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
-						else taskLogger.info(fields, diagnostic.message);
-					},
-					runtimeProfileContext: profile.context,
-					runtimeProfileId: profile.id,
-					toolEnforcement: profile.toolEnforcement,
-					makeExecutionPlan: (task) => executionPlans.getOrCreate(task),
-					makeOnTurnEvent: makeTurnEventHandlerFactory(taskLogger),
-					toolPolicyLogger: taskLogger,
-					maxTurns: common.maxTurns,
-					maxBashTimeouts: common.maxBashTimeouts
-				});
-				try {
-					active = {
-						taskId: claimedTask.task.id,
-						attemptN: claimedTask.attemptN
-					};
-					return await runWithDaemonRuntimeContext({
-						profileId: profile.id,
-						profileName: profile.name,
-						provider: profile.provider,
-						model: profile.model,
-						thinkingLevel: profile.thinkingLevel,
-						temperature: profile.temperature,
-						topP: profile.topP,
-						topK: profile.topK,
-						maxOutputTokens: profile.maxOutputTokens
-					}, () => rawExecuteTask(claimedTask, reporter));
-				} finally {
-					active = null;
-					executionPlans.delete(claimedTask);
-					if (executionPlan.slotKey) await slotRegistry.finishSlot(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN, slotIdentity, executionPlan.slotKey, profile.provider, profile.model, executionPlan.sessionPersistence ? resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir) : null);
-				}
-			}
+		deps.onIssue?.(issue);
+	} catch {}
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function execFileText(file, args) {
+	return new Promise((resolvePromise, reject) => {
+		execFile(file, args, {
+			encoding: "utf8",
+			maxBuffer: 10 * 1024 * 1024
+		}, (err, stdout) => {
+			if (err) reject(err instanceof Error ? err : /* @__PURE__ */ new Error("Child process failed without an Error instance."));
+			else resolvePromise(stdout);
 		});
-		const drained = await runtime.start();
-		outputs.push(...drained);
-		rootLogger.info({ processed: drained.length }, "agent-daemon.drained");
-		return drained.some((o) => o.status !== "completed") ? 1 : 0;
-	} finally {
-		clearInterval(reaperTimer);
-		signalHandlers.dispose();
-		await slotRegistry.close();
-		await otelShutdown();
-		await shutdownLogger();
-	}
+	});
 }
-function resolveRecordedWorkspacePath$1(stateRootDir, mountPath, executionPlan) {
-	if (!executionPlan.workspaceId) return null;
-	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
+async function mapWithConcurrency(items, concurrency, worker) {
+	for (let index = 0; index < items.length; index += concurrency) await Promise.all(items.slice(index, index + concurrency).map(worker));
 }
-function resolveMainWorktree$1(mountPath) {
-	try {
-		return findMainWorktree(mountPath);
-	} catch {
-		return null;
-	}
+//#endregion
+//#region src/lib/runtime-sessions.ts
+function resolveRuntimeSessionKind(claimedTask) {
+	const continueFrom = resolveContinueFrom(claimedTask);
+	if (!continueFrom) return "root";
+	return continueFrom.mode === "fork" ? "fork" : "extend";
+}
+async function resolveParentRuntimeSession(runtimeSessionStore, claimedTask) {
+	const continueFrom = resolveContinueFrom(claimedTask);
+	if (!continueFrom) return null;
+	return runtimeSessionStore.findRuntimeSessionByTaskAttempt(claimedTask.task.teamId, continueFrom.taskId, continueFrom.attemptN);
+}
+function applyRuntimeSessionUploadFailure(output, err) {
+	if (output.status !== "completed") return output;
+	return {
+		...output,
+		error: {
+			code: "runtime_session_upload_failed",
+			message: "Task completed, but durable runtime session checkpoint upload failed: " + (err instanceof Error ? err.message : String(err)),
+			retryable: isTransientUploadError(err)
+		},
+		output: null,
+		outputCid: null,
+		status: "failed"
+	};
+}
+/**
+* Transient faults worth retrying in-attempt: network-level errors
+* (no HTTP status at all) and 5xx/429 responses. A 4xx (auth,
+* validation, not-found) will not heal on retry.
+*/
+function isTransientUploadError(error) {
+	if (!(error instanceof Error)) return false;
+	const statusCode = error.statusCode;
+	if (typeof statusCode !== "number") return true;
+	return statusCode >= 500 || statusCode === 429;
+}
+var defaultSleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+function createApiRuntimeSessionStore(args) {
+	const { agent, logger, uploadRetry } = args;
+	return {
+		async findRuntimeSessionByTaskAttempt(teamId, taskId, attemptN) {
+			return agent.runtimeSessions.getForAttempt({
+				attemptN,
+				taskId
+			}, { teamId });
+		},
+		async hydrateSession(input) {
+			const downloaded = await agent.runtimeSessions.download({
+				attemptN: input.attemptN,
+				taskId: input.taskId
+			}, { teamId: input.teamId });
+			await mkdir(input.destinationDir, { recursive: true });
+			const sessionPath = join(input.destinationDir, `remote-${input.taskId}-attempt-${input.attemptN}.jsonl`);
+			await pipeline(downloaded, createWriteStream(sessionPath));
+			return sessionPath;
+		},
+		async uploadAttemptFinal(input) {
+			const sessionPath = resolveLatestPiSessionPath(input.sessionDir);
+			if (!sessionPath) throw new Error(`Cannot upload runtime session for ${input.taskId}/${input.attemptN}: no local session file in ${input.sessionDir}`);
+			const maxTries = uploadRetry?.maxTries ?? 3;
+			const baseDelayMs = uploadRetry?.baseDelayMs ?? 750;
+			const sleep = uploadRetry?.sleep ?? defaultSleep;
+			for (let tryN = 1;; tryN += 1) try {
+				await agent.runtimeSessions.upload({
+					attemptN: input.attemptN,
+					taskId: input.taskId
+				}, createReadStream(sessionPath), {
+					parentSessionId: input.parentSessionId ?? void 0,
+					sessionKind: input.sessionKind,
+					sourceRuntimeProfileId: input.sourceRuntimeProfileId ?? void 0,
+					sourceSlotId: input.sourceSlotId ?? void 0
+				}, { teamId: input.teamId });
+				return;
+			} catch (error) {
+				if (tryN >= maxTries || !isTransientUploadError(error)) throw error;
+				const delayMs = baseDelayMs * tryN;
+				logger?.warn({
+					event: "agent-daemon.runtime_session_upload_retry",
+					attemptN: input.attemptN,
+					delayMs,
+					statusCode: uploadStatusCode(error),
+					taskId: input.taskId,
+					tryN
+				}, "Retrying durable runtime session upload");
+				await sleep(delayMs);
+			}
+		}
+	};
+}
+function uploadStatusCode(error) {
+	const statusCode = error?.statusCode;
+	return typeof statusCode === "number" ? statusCode : void 0;
+}
+function resolveContinueFrom(claimedTask) {
+	return claimedTask.task.input.continueFrom;
+}
+//#endregion
+//#region src/lib/runtime-slots.ts
+function createApiRuntimeSlotStore(args) {
+	const { agent } = args;
+	return {
+		async beginSlot(input) {
+			await agent.runtimeSlots.begin({
+				agentName: input.agentName,
+				runtimeProfileId: input.runtimeProfileId,
+				lastAttemptN: input.lastAttemptN,
+				lastTaskId: input.lastTaskId,
+				model: input.model,
+				provider: input.provider,
+				sessionDir: input.sessionDir ?? void 0,
+				sessionPath: input.sessionPath ?? void 0,
+				slotKey: input.slotKey,
+				taskType: input.taskType,
+				workspaceId: input.workspaceId ?? void 0,
+				workspaceKind: input.workspaceKind,
+				worktreeBranch: input.worktreeBranch ?? void 0,
+				worktreePath: input.worktreePath ?? void 0
+			}, { teamId: input.teamId });
+		},
+		async finishSlot(teamId, taskId, attemptN, identity, slotKey, provider, model, sessionPath) {
+			await agent.runtimeSlots.finish({
+				agentName: identity.agentName,
+				attemptN,
+				runtimeProfileId: identity.runtimeProfileId,
+				model,
+				provider,
+				sessionPath: sessionPath ?? void 0,
+				slotKey,
+				taskId
+			}, { teamId });
+		},
+		async findLatestSlotByTaskAttempt(teamId, taskId, attemptN) {
+			const resolved = await agent.runtimeSlots.findLatestForAttempt({
+				attemptN,
+				taskId
+			}, { teamId });
+			if (!resolved) return null;
+			return {
+				slot: {
+					expiresAtMs: resolved.slot.expiresAtMs,
+					id: resolved.slot.id,
+					runtimeProfileId: resolved.slot.runtimeProfileId
+				},
+				session: resolved.slot.sessionDir ? {
+					sessionDir: resolved.slot.sessionDir,
+					sessionPath: resolved.slot.sessionPath
+				} : null,
+				workspace: resolved.workspace ? {
+					kind: resolved.workspace.kind,
+					workspaceId: resolved.workspace.workspaceId,
+					worktreeBranch: resolved.workspace.worktreeBranch,
+					worktreePath: resolved.workspace.worktreePath
+				} : null
+			};
+		},
+		async listSlots(input) {
+			const query = {
+				agentName: input.agentName,
+				...input.limit === void 0 ? {} : { limit: input.limit },
+				...input.runtimeProfileId === void 0 ? {} : { runtimeProfileId: input.runtimeProfileId },
+				...input.state === void 0 ? {} : { state: input.state }
+			};
+			return (await agent.runtimeSlots.list(query, { teamId: input.teamId })).map((resolved) => ({
+				slot: {
+					expiresAtMs: resolved.slot.expiresAtMs,
+					id: resolved.slot.id,
+					lastAttemptN: resolved.slot.lastAttemptN,
+					lastTaskId: resolved.slot.lastTaskId,
+					runtimeProfileId: resolved.slot.runtimeProfileId,
+					slotKey: resolved.slot.slotKey,
+					state: resolved.slot.state,
+					taskType: resolved.slot.taskType
+				},
+				session: resolved.slot.sessionDir ? {
+					sessionDir: resolved.slot.sessionDir,
+					sessionPath: resolved.slot.sessionPath
+				} : null,
+				workspace: resolved.workspace ? {
+					kind: resolved.workspace.kind,
+					workspaceId: resolved.workspace.workspaceId,
+					worktreeBranch: resolved.workspace.worktreeBranch,
+					worktreePath: resolved.workspace.worktreePath
+				} : null
+			}));
+		},
+		async close() {}
+	};
 }
-function runtimeForClaimedTask(runtimes, claimedTask) {
-	if (!claimedTask.profileId) throw new Error(`Claimed task ${claimedTask.task.id} did not include a selected runtime profile`);
-	return requireRuntime(runtimes, claimedTask.profileId);
+//#endregion
+//#region src/lib/secret-redaction.ts
+var REDACTED = "[REDACTED]";
+var MIN_SECRET_LENGTH = 8;
+/**
+* Redact required runtime-profile environment values before task output leaves
+* the daemon. This is defense in depth for shell-capable profiles: a model may
+* read a forwarded provider key, but it must not be able to publish that exact
+* value through a task result.
+*/
+function redactRequiredEnvValues(value, requiredEnv, env) {
+	const secrets = [...new Set(requiredEnv.map((name) => env[name]).filter((secret) => typeof secret === "string" && secret.length >= MIN_SECRET_LENGTH))];
+	if (secrets.length === 0) return value;
+	const redact = (candidate) => {
+		if (typeof candidate === "string") return secrets.reduce((text, secret) => text.replaceAll(secret, REDACTED), candidate);
+		if (Array.isArray(candidate)) return candidate.map(redact);
+		if (candidate && typeof candidate === "object") return Object.fromEntries(Object.entries(candidate).map(([key, nested]) => [key, redact(nested)]));
+		return candidate;
+	};
+	return redact(value);
 }
-function requireRuntime(runtimes, profileId) {
-	const runtime = runtimes.get(profileId);
-	if (!runtime) throw new Error(`No runtime profile configured for ${profileId}`);
-	return runtime;
+//#endregion
+//#region src/lib/shutdown-signal.ts
+function installShutdownSignalHandlers(opts) {
+	const proc = opts.proc ?? process;
+	let drainingSignal = null;
+	const onSignal = (signal) => {
+		if (drainingSignal) {
+			proc.stderr.write(`[agent-daemon] ${signal} received while already draining from ${drainingSignal}; waiting for cleanup.\n`);
+			proc.exitCode = signalExitCode(signal);
+			return;
+		}
+		drainingSignal = signal;
+		proc.exitCode = signalExitCode(signal);
+		try {
+			opts.logDrain(signal);
+		} catch (err) {
+			proc.stderr.write(`[agent-daemon] failed to log ${signal}: ` + (err instanceof Error ? err.message : String(err)) + "\n");
+		}
+		opts.drain(signal);
+	};
+	const handleSigint = () => onSignal("SIGINT");
+	const handleSigterm = () => onSignal("SIGTERM");
+	proc.on("SIGINT", handleSigint);
+	proc.on("SIGTERM", handleSigterm);
+	return { dispose: () => {
+		proc.off("SIGINT", handleSigint);
+		proc.off("SIGTERM", handleSigterm);
+	} };
 }
-function parseProfileValues(raw) {
-	return (raw ?? []).map((s) => s.trim()).filter((s) => s.length > 0);
+function signalExitCode(signal) {
+	return signal === "SIGINT" ? 130 : 143;
 }
-function parseCsv(raw) {
-	return (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+//#endregion
+//#region src/lib/source-attempts.ts
+function createApiSourceAttemptResolver(args) {
+	const { agent } = args;
+	return {
+		async findOutputBranch(input) {
+			const attempt = (await agent.tasks.listAttempts(input.taskId, { teamId: input.teamId })).find((candidate) => candidate.attemptN === input.attemptN);
+			if (!attempt || attempt.status !== "completed") return null;
+			return resolveOutputBranch(attempt.output);
+		},
+		async findInputRevision(input) {
+			const task = await agent.tasks.get(input.taskId, { teamId: input.teamId });
+			if (task.status !== "completed" || task.acceptedAttemptN !== input.attemptN) return null;
+			return resolveTaskWorkspaceRevision(task.input);
+		}
+	};
 }
-function optionalPositiveInt(raw, name, defaultValue) {
-	if (raw === void 0) return defaultValue;
-	const v = Number(raw);
-	if (!Number.isInteger(v) || v < 1) throw new Error(`Invalid --${name} "${raw}": must be a positive integer`);
-	return v;
+function resolveOutputBranch(output) {
+	if (!output || typeof output !== "object") return null;
+	const branch = output.branch;
+	return typeof branch === "string" && branch.length > 0 ? branch : null;
 }
-function optionalNonNegativeInt(raw, name, defaultValue) {
-	if (raw === void 0) return defaultValue;
-	const v = Number(raw);
-	if (!Number.isInteger(v) || v < 0) throw new Error(`Invalid --${name} "${raw}": must be a non-negative integer`);
-	return v;
+//#endregion
+//#region src/lib/state-dir.ts
+function ensureDaemonStateDirs(mountPath) {
+	const rootDir = join(mountPath, ".moltnet", "d");
+	const piSessionsDir = join(rootDir, "pi-sessions");
+	mkdirSync(piSessionsDir, { recursive: true });
+	return {
+		rootDir,
+		piSessionsDir
+	};
 }
 //#endregion
-//#region src/cli/drain.ts
-function runDrain(argv, runtimeAdapter) {
-	return runPolling({
-		argv,
-		serviceName: "moltnet.agent-daemon.drain",
-		stopWhenEmpty: true,
-		modeLabel: "drain",
-		helpText: DRAIN_HELP,
-		runtimeAdapter
+//#region src/lib/turn-event-logger.ts
+function makeTurnEventHandler(base, context = {}) {
+	const log = base.child({
+		name: "agent-daemon.turn",
+		...context
+	});
+	return (event, summary) => {
+		if (event === "text_delta") return;
+		log[event === "error" ? "warn" : event === "turn_end" ? "info" : "debug"]({
+			event,
+			...summary
+		}, `turn.${event}`);
+	};
+}
+function makeTurnEventHandlerFactory(base) {
+	return (claimedTask) => makeTurnEventHandler(base, {
+		taskId: claimedTask.task.id,
+		attemptN: claimedTask.attemptN
 	});
 }
 //#endregion
-//#region src/cli/once.ts
-async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
-	if (isHelpFlag(argv)) {
-		console.log(ONCE_HELP);
+//#region src/cli/poll-shared.ts
+async function runPolling(opts) {
+	if (isHelpFlag(opts.argv)) {
+		console.log(opts.helpText);
 		return 0;
 	}
 	const { values } = parseArgs({
-		args: argv,
+		args: opts.argv,
 		options: {
 			...commonOptionDefs(),
-			"task-id": {
-				type: "string",
-				short: "t"
-			},
 			team: { type: "string" },
+			"task-types": { type: "string" },
+			"correlation-id": { type: "string" },
+			"diary-ids": { type: "string" },
+			"wait-for-first-task-sec": { type: "string" },
+			"wait-after-task-sec": { type: "string" },
+			"poll-interval-ms": { type: "string" },
+			"max-poll-interval-ms": { type: "string" },
+			"list-limit": { type: "string" },
 			sandbox: { type: "string" },
-			profile: { type: "string" }
+			profile: {
+				type: "string",
+				multiple: true
+			}
 		}
 	});
-	if (!values["task-id"]) {
-		console.error("Missing required flag: --task-id\n");
-		console.error(ONCE_HELP);
+	if (!values.team) {
+		console.error("Missing required flag: --team\n");
+		console.error(opts.helpText);
 		return 1;
 	}
-	const taskId = values["task-id"];
-	if (!values.profile) {
+	const teamId = values.team;
+	const profileValues = parseProfileValues(values.profile);
+	if (profileValues.length === 0) {
 		console.error("Missing required flag: --profile\n");
-		console.error(ONCE_HELP);
+		console.error(opts.helpText);
 		return 1;
 	}
-	let opts;
+	let taskTypes;
 	try {
-		opts = parseCommonOptions(values);
+		taskTypes = validateTaskTypes(parseCsv(values["task-types"]));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(message);
+		return 1;
+	}
+	const diaryIds = parseCsv(values["diary-ids"]);
+	let baseCommon;
+	try {
+		baseCommon = parseCommonOptions(values);
 	} catch (err) {
 		if (err instanceof MissingRequiredOptionError) {
 			console.error(`${err.message}\n`);
-			console.error(ONCE_HELP);
+			console.error(opts.helpText);
 			return 1;
 		}
 		throw err;
 	}
+	const pollIntervalMs = optionalPositiveInt(values["poll-interval-ms"], "poll-interval-ms", 2e3);
+	const maxPollIntervalMs = optionalPositiveInt(values["max-poll-interval-ms"], "max-poll-interval-ms", 3e4);
+	const listLimit = optionalPositiveInt(values["list-limit"], "list-limit", 10);
+	const waitForFirstTaskSec = optionalNonNegativeInt(values["wait-for-first-task-sec"], "wait-for-first-task-sec", 0);
+	const waitAfterTaskSec = optionalNonNegativeInt(values["wait-after-task-sec"], "wait-after-task-sec", 0);
+	if (!opts.stopWhenEmpty && (waitForFirstTaskSec > 0 || waitAfterTaskSec > 0)) {
+		console.error(`[${opts.modeLabel}] --wait-for-first-task-sec and --wait-after-task-sec are only valid with drain.`);
+		return 1;
+	}
 	if (values.sandbox) {
-		console.error("Cannot use --sandbox. Remote runtime profiles define sandbox policy.");
+		console.error(`[${opts.modeLabel}] Cannot use --sandbox. Remote runtime profiles define sandbox policy.`);
 		return 1;
 	}
+	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
 	const credentialSources = {
 		profileRequirements: cfg.profileCredentialRequirements,
 		bindings: cfg.credentialBindings
 	};
 	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
-	const initialOpts = opts;
 	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
-	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
+	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
-			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
+			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
 				agentRootDir: explicitAgentRootDir,
 				credentialSource: cfg.credentialSource,
 				envApiUrl: cfg.apiUrl
@@ -6727,7 +6604,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
-				teamId: values.team,
+				teamId,
 				expectedAgent: cfg.expectedAgent
 			});
 			gate = "resolve_signing_material";
@@ -6746,7 +6623,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			});
 			gate = "resolve_agent_identity";
 			const agentIdentity = await resolveDaemonAgentIdentity({
-				agentName: initialOpts.agent,
+				agentName: baseCommon.agent,
 				whoami,
 				credentialSource: cfg.credentialSource,
 				agentDir: resolvedContext.agentDir,
@@ -6755,6 +6632,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			return {
 				ctx: resolvedContext,
 				signingPrivateKey: privateKey,
+				startupWhoami: whoami,
 				agentIdentity,
 				hostCapabilitySigner: createLocalSeedSigner({
 					privateKeySeed: privateKey,
@@ -6764,10 +6642,10 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			};
 		} catch (error) {
 			await logDaemonStartupFailure({
-				serviceName: "agent-daemon.once",
-				level: cfg.logLevel || (initialOpts.debug ? "debug" : "info"),
+				serviceName: `agent-daemon.${opts.modeLabel}`,
+				level: cfg.logLevel || (baseCommon.debug ? "debug" : "info"),
 				gate,
-				agent: initialOpts.agent,
+				agent: baseCommon.agent,
 				credentialSource: cfg.credentialSource,
 				error
 			});
@@ -6775,39 +6653,41 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		}
 	})();
 	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
-	const profile = await resolveRuntimeProfile({
+	const resolvedProfiles = await resolveRuntimeProfiles({
 		agent: ctx.agent,
-		profile: values.profile,
-		teamId: values.team,
+		profiles: profileValues,
+		teamId,
 		cwd: daemonRootDir
 	});
-	assertRuntimeAdapterSupportsProfile(runtimeAdapter, profile);
-	const preparedRuntime = attestPreparedRuntime(await runtimeAdapter.prepare({ profile }), signingPrivateKey);
-	validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, {
-		tools: preparedRuntime.tools,
-		executables: preparedRuntime.executables
-	});
-	assertGuestEnvironmentBoundary({
-		forwardEnv: profile.requiredEnv,
-		sandboxEnv: profile.sandboxConfig.env
-	});
-	await ctx.agent.tasks.registerExecutorManifest(await preparedRuntime.attestor.registration());
-	opts = parseCommonOptions(values, { runtimeDefaults: {
-		leaseTtlSec: profile.leaseTtlSec,
-		heartbeatIntervalMs: profile.heartbeatIntervalMs,
-		maxBatchSize: profile.maxBatchSize,
-		maxTurns: profile.maxTurns,
-		maxBashTimeouts: profile.maxBashTimeouts,
-		warmSessionTtlSec: resolveProfileWarmSessionTtlSec(profile)
-	} });
-	const sandbox = {
-		config: profile.sandboxConfig,
-		rootDir: profile.mountPath,
-		path: profile.source
-	};
-	const piAgentDir = ensurePiAgentDir(sandbox.rootDir, cfg.piCodingAgentDir);
-	activatePiCodingAgentDir(piAgentDir.path);
-	const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
+	const runtimeAdapter = opts.runtimeAdapter ?? defaultPiDaemonAdapter;
+	const preparedRuntimes = /* @__PURE__ */ new Map();
+	const profiles = [];
+	const skippedProfileBoundaries = [];
+	for (const profile of resolvedProfiles) try {
+		assertRuntimeAdapterSupportsProfile(runtimeAdapter, profile);
+		const prepared = attestPreparedRuntime(await runtimeAdapter.prepare({ profile }), signingPrivateKey);
+		validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, {
+			tools: prepared.tools,
+			executables: prepared.executables
+		});
+		assertGuestEnvironmentBoundary({
+			forwardEnv: profile.requiredEnv,
+			sandboxEnv: profile.sandboxConfig.env
+		});
+		await ctx.agent.tasks.registerExecutorManifest(await prepared.attestor.registration());
+		preparedRuntimes.set(profile.id, prepared);
+		profiles.push(profile);
+	} catch (error) {
+		if (!(error instanceof GuestEnvironmentBoundaryError)) throw error;
+		skippedProfileBoundaries.push({
+			profile,
+			error
+		});
+	}
+	if (profiles.length === 0) {
+		const details = skippedProfileBoundaries.map(({ profile, error }) => `${profile.name}: ${error.message}`).join("; ");
+		throw new Error(`No safe runtime profiles remain. ${details}`);
+	}
 	const slotRegistry = createApiRuntimeSlotStore({ agent: ctx.agent });
 	const runtimeSessionStore = createApiRuntimeSessionStore({
 		agent: ctx.agent,
@@ -6815,260 +6695,232 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 	});
 	const sourceAttemptResolver = createApiSourceAttemptResolver({ agent: ctx.agent });
 	const runtimeInstanceId = createRuntimeInstanceId();
-	const slotIdentity = {
-		agentName: opts.agent,
-		runtimeProfileId: profile.id,
-		runtimeInstanceId
-	};
-	const executionPlans = createExecutionPlanCache({
-		stateDirs,
-		slotIdentity,
-		warmSessionTtlSec: opts.warmSessionTtlSec,
-		workspacePolicy: {
-			defaultWorkspaceMode: profile.defaultWorkspaceMode,
-			allowedWorkspaceModes: profile.allowedWorkspaceModes
-		},
-		slotRegistry,
-		runtimeSessionStore,
-		sourceAttemptResolver
-	});
+	const piAgentDir = await resolvePiAgentDir(cfg, profiles[0].mountPath, profiles);
+	process.once("exit", piAgentDir.cleanup);
+	activatePiCodingAgentDir(piAgentDir.path, piAgentDir.env);
+	const runtimes = /* @__PURE__ */ new Map();
+	for (const profile of profiles) {
+		const common = parseCommonOptions(values, { runtimeDefaults: {
+			leaseTtlSec: profile.leaseTtlSec,
+			heartbeatIntervalMs: profile.heartbeatIntervalMs,
+			maxBatchSize: profile.maxBatchSize,
+			maxTurns: profile.maxTurns,
+			maxBashTimeouts: profile.maxBashTimeouts,
+			warmSessionTtlSec: resolveProfileWarmSessionTtlSec(profile)
+		} });
+		const sandbox = {
+			config: profile.sandboxConfig,
+			rootDir: profile.mountPath,
+			path: profile.source
+		};
+		const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
+		const slotIdentity = {
+			agentName: common.agent,
+			runtimeProfileId: profile.id,
+			runtimeInstanceId
+		};
+		const executionPlans = createExecutionPlanCache({
+			stateDirs,
+			slotIdentity,
+			warmSessionTtlSec: common.warmSessionTtlSec,
+			workspacePolicy: {
+				defaultWorkspaceMode: profile.defaultWorkspaceMode,
+				allowedWorkspaceModes: profile.allowedWorkspaceModes
+			},
+			slotRegistry,
+			runtimeSessionStore,
+			sourceAttemptResolver
+		});
+		runtimes.set(profile.id, {
+			common,
+			profile,
+			sandbox,
+			stateDirs,
+			slotIdentity,
+			executionPlans,
+			preparedRuntime: preparedRuntimes.get(profile.id)
+		});
+	}
+	const firstRuntime = runtimes.get(profiles[0].id);
+	if (!firstRuntime) throw new Error("No runtime profiles resolved");
 	const otelShutdown = await initWorkerOtel({
-		serviceName: "moltnet.agent-daemon.once",
+		serviceName: opts.serviceName,
 		agent: ctx.agent,
 		endpoint: cfg.otelEndpoint,
 		resourceAttributes: {
-			"moltnet.task.id": taskId,
-			"moltnet.agent.name": opts.agent,
+			"moltnet.team.id": teamId,
+			"moltnet.agent.name": baseCommon.agent,
 			"moltnet.credential.source": ctx.credentialSource,
-			"moltnet.llm.provider": profile.provider,
-			"moltnet.llm.model": profile.model,
-			...profile.thinkingLevel ? { "moltnet.llm.thinking_level": profile.thinkingLevel } : {},
-			...profile.temperature !== null ? { "moltnet.llm.temperature": String(profile.temperature) } : {},
-			...profile.topP !== null ? { "moltnet.llm.top_p": String(profile.topP) } : {},
-			...profile.topK !== null ? { "moltnet.llm.top_k": String(profile.topK) } : {},
-			...profile.maxOutputTokens !== null ? { "moltnet.llm.max_output_tokens": String(profile.maxOutputTokens) } : {},
-			"moltnet.runtime_profile.id": profile.id
+			"moltnet.runtime_profile.count": String(profiles.length),
+			"moltnet.runtime_profile.ids": profiles.map((p) => p.id).join(",")
 		}
 	});
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
-		name: "agent-daemon.once",
-		level: cfg.logLevel || (opts.debug ? "debug" : "info")
+		name: `agent-daemon.${opts.modeLabel}`,
+		level: cfg.logLevel || (baseCommon.debug ? "debug" : "info")
 	});
 	const rootLogger = logger.child({
-		mode: "once",
-		agent: opts.agent,
-		provider: profile.provider,
-		model: profile.model,
-		thinkingLevel: profile.thinkingLevel,
-		temperature: profile.temperature,
-		topP: profile.topP,
-		topK: profile.topK,
-		maxOutputTokens: profile.maxOutputTokens,
-		runtimeProfileId: profile.id,
-		runtimeProfileName: profile.name
+		mode: opts.modeLabel,
+		agent: baseCommon.agent,
+		teamId,
+		runtimeProfileIds: profiles.map((p) => p.id),
+		runtimeProfileNames: profiles.map((p) => p.name)
 	});
-	rootLogger.info({
-		sandbox: sandbox.path,
-		taskId,
-		leaseTtlSec: opts.leaseTtlSec,
-		heartbeatIntervalMs: opts.heartbeatIntervalMs,
-		maxTurns: opts.maxTurns,
-		maxBashTimeouts: opts.maxBashTimeouts,
-		warmSessionTtlSec: opts.warmSessionTtlSec,
-		profileId: profile.id,
-		profileSessionTtlSec: profile.sessionTtlSec,
-		profileWorkspaceTtlSec: profile.workspaceTtlSec,
-		piAgentDir: piAgentDir.path,
-		piAgentDirSource: piAgentDir.source
-	}, "agent-daemon.starting");
-	try {
-		const reaped = await reapRuntimeSlotResources({
-			onIssue: (issue) => {
-				rootLogger.warn(issue, "agent-daemon.runtime_resource_reap_issue");
-			},
-			runtimeSlotStore: slotRegistry,
-			taskReader: ctx.agent.tasks
-		}, {
-			agentName: opts.agent,
-			mainWorktree: resolveMainWorktree(sandbox.rootDir),
-			runtimeInstanceId,
-			runtimeProfileId: profile.id,
-			sessionRootDir: stateDirs.piSessionsDir,
-			scratchRootDir: join(stateDirs.rootDir, "task-workspaces"),
-			teamId: profile.teamId
-		});
-		if (reaped.removedSessions > 0 || reaped.removedWorkspaces > 0 || reaped.failed > 0 || reaped.unsafePaths > 0 || reaped.truncated) rootLogger.info(reaped, "agent-daemon.runtime_resources_reaped");
-	} catch (err) {
-		rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
-	}
+	for (const { profile, error } of skippedProfileBoundaries) rootLogger.warn({
+		runtimeProfileId: profile.id,
+		runtimeProfileName: profile.name,
+		refusedEnvironmentNames: error.refusedNames
+	}, "agent-daemon.runtime_profile_skipped_credential_boundary");
+	const abort = new AbortController();
 	let runtime = null;
-	let activeAttemptN = null;
+	let active = null;
 	const signalHandlers = installShutdownSignalHandlers({
 		logDrain: (signal) => {
-			rootLogger.warn({
-				signal,
-				taskId
-			}, "agent-daemon.draining");
+			rootLogger.warn({ signal }, "agent-daemon.draining");
 		},
 		drain: (signal) => {
+			abort.abort();
 			runtime?.stop(`agent-daemon received ${signal}`);
 			abortActiveAttemptOnSignal({
-				active: activeAttemptN === null ? null : {
-					taskId,
-					attemptN: activeAttemptN
-				},
+				active,
 				signal,
-				abortAttempt: (activeTaskId, attemptN, body) => ctx.agent.tasks.abortAttempt(activeTaskId, attemptN, body),
+				abortAttempt: (taskId, attemptN, body) => ctx.agent.tasks.abortAttempt(taskId, attemptN, body),
 				logFailure: (err, current) => {
 					try {
 						rootLogger.warn({
 							err: err instanceof Error ? err.message : String(err),
-							taskId: current.taskId,
-							attemptN: current.attemptN
-						}, "agent-daemon.abort_on_signal_failed");
-					} catch (logErr) {
-						process.stderr.write(`[agent-daemon] failed to log abort error: ` + (logErr instanceof Error ? logErr.message : String(logErr)) + "\n");
-					}
-				}
-			});
-		}
-	});
-	try {
-		const rawExecuteTask = preparedRuntime.createTaskExecutor({
-			agentName: opts.agent,
-			moltnetAgent: ctx.agent,
-			agentIdentity,
-			hostCapabilitySigner,
-			hostCapabilityLogger: rootLogger,
-			agentRootDir: ctx.agentRootDir,
-			mountPath: sandbox.rootDir,
-			provider: profile.provider,
-			model: profile.model,
-			thinkingLevel: profile.thinkingLevel,
-			temperature: profile.temperature,
-			topP: profile.topP,
-			topK: profile.topK,
-			maxOutputTokens: profile.maxOutputTokens,
-			sandboxConfig: sandbox.config,
-			forwardEnv: profile.requiredEnv,
-			onVmDiagnostic: (diagnostic) => {
-				const fields = {
-					event: diagnostic.event,
-					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
-				};
-				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);
-				else rootLogger.info(fields, diagnostic.message);
-			},
-			runtimeProfileContext: profile.context,
-			runtimeProfileId: profile.id,
-			toolEnforcement: profile.toolEnforcement,
-			makeExecutionPlan: (claimedTask) => executionPlans.getOrCreate(claimedTask),
-			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId }),
-			toolPolicyLogger: rootLogger,
-			maxTurns: opts.maxTurns,
-			maxBashTimeouts: opts.maxBashTimeouts
-		});
-		const executeTask = async (claimedTask, reporter) => {
-			if (runtimeCredentialConfig) await observeGovernancePlanSafely({
-				config: runtimeCredentialConfig,
-				profile,
-				offer: runtimeExecutionOffer(preparedRuntime, preparedRuntime.attestor.fingerprint),
-				registry: createNodeSecretProviderRegistry(),
-				executorFingerprint: preparedRuntime.attestor.fingerprint,
-				claimAuthority: claimedTask.claimAuthority ?? {},
-				taskId: claimedTask.task.id,
-				attemptN: claimedTask.attemptN,
-				logger: rootLogger
-			});
-			let executionPlan;
-			try {
-				executionPlan = await executionPlans.getOrCreate(claimedTask);
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				rootLogger.warn({
-					taskId: claimedTask.task.id,
-					attemptN: claimedTask.attemptN,
-					err: message
-				}, "agent-daemon.execution_plan_failed");
-				return {
-					taskId: claimedTask.task.id,
-					attemptN: claimedTask.attemptN,
-					status: "failed",
-					output: null,
-					outputCid: null,
-					usage: {
-						inputTokens: 0,
-						outputTokens: 0
-					},
-					durationMs: 0,
-					error: {
-						code: err instanceof ProducerContextResolutionError ? "producer_context_missing" : "execution_plan_failed",
-						message,
-						retryable: false
-					}
-				};
-			}
-			if (executionPlan.slotKey && executionPlan.sessionPersistence) await slotRegistry.beginSlot({
-				...slotIdentity,
-				runtimeProfileId: profile.id,
+							taskId: current.taskId,
+							attemptN: current.attemptN
+						}, "agent-daemon.abort_on_signal_failed");
+					} catch {}
+				}
+			});
+		}
+	});
+	rootLogger.info({
+		credentialSource: cfg.credentialSource,
+		subjectType: startupWhoami.subjectType,
+		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
+		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
+		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
+		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
+		correlationId: values["correlation-id"] ?? null,
+		diaryIds: diaryIds.length > 0 ? diaryIds : ["*"],
+		pollIntervalMs,
+		maxPollIntervalMs,
+		profiles: profiles.map((profile) => {
+			const runtime = requireRuntime(runtimes, profile.id);
+			return {
+				id: profile.id,
+				name: profile.name,
 				provider: profile.provider,
 				model: profile.model,
-				teamId: claimedTask.task.teamId,
-				slotKey: executionPlan.slotKey,
-				taskType: claimedTask.task.taskType,
-				sessionDir: executionPlan.sessionPersistence.sessionDir,
-				sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
-				workspaceId: executionPlan.workspaceId,
-				worktreePath: resolveRecordedWorkspacePath(stateDirs.rootDir, sandbox.rootDir, executionPlan),
-				worktreeBranch: executionPlan.worktreeBranch,
-				workspaceKind: executionPlan.workspaceKind,
-				lastTaskId: claimedTask.task.id,
-				lastAttemptN: claimedTask.attemptN
-			});
-			activeAttemptN = claimedTask.attemptN;
-			try {
-				return await runWithDaemonRuntimeContext({
-					profileId: profile.id,
-					profileName: profile.name,
-					provider: profile.provider,
-					model: profile.model,
-					thinkingLevel: profile.thinkingLevel,
-					temperature: profile.temperature,
-					topP: profile.topP,
-					topK: profile.topK,
-					maxOutputTokens: profile.maxOutputTokens
-				}, () => rawExecuteTask(claimedTask, reporter));
-			} finally {
-				activeAttemptN = null;
-				executionPlans.delete(claimedTask);
-				if (executionPlan.slotKey) await slotRegistry.finishSlot(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN, slotIdentity, executionPlan.slotKey, profile.provider, profile.model, executionPlan.sessionPersistence ? resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir) : null);
+				thinkingLevel: profile.thinkingLevel,
+				temperature: profile.temperature,
+				topP: profile.topP,
+				topK: profile.topK,
+				maxOutputTokens: profile.maxOutputTokens,
+				sandbox: runtime.sandbox.path,
+				leaseTtlSec: runtime.common.leaseTtlSec,
+				heartbeatIntervalMs: runtime.common.heartbeatIntervalMs,
+				maxTurns: runtime.common.maxTurns,
+				maxBashTimeouts: runtime.common.maxBashTimeouts,
+				warmSessionTtlSec: runtime.common.warmSessionTtlSec,
+				profileSessionTtlSec: profile.sessionTtlSec,
+				profileWorkspaceTtlSec: profile.workspaceTtlSec,
+				defaultWorkspaceMode: profile.defaultWorkspaceMode,
+				allowedWorkspaceModes: profile.allowedWorkspaceModes
+			};
+		}),
+		piAgentDir: piAgentDir.path,
+		piAgentDirSource: piAgentDir.source
+	}, "agent-daemon.starting");
+	let reaperRunning = false;
+	const reapRuntimeResources = async () => {
+		if (reaperRunning) return;
+		reaperRunning = true;
+		try {
+			for (const profile of profiles) {
+				const selected = requireRuntime(runtimes, profile.id);
+				const result = await reapRuntimeSlotResources({
+					onIssue: (issue) => {
+						rootLogger.warn({
+							...issue,
+							runtimeProfileId: profile.id
+						}, "agent-daemon.runtime_resource_reap_issue");
+					},
+					runtimeSlotStore: slotRegistry,
+					taskReader: ctx.agent.tasks
+				}, {
+					agentName: selected.common.agent,
+					mainWorktree: resolveMainWorktree$1(selected.sandbox.rootDir),
+					runtimeInstanceId,
+					runtimeProfileId: profile.id,
+					sessionRootDir: selected.stateDirs.piSessionsDir,
+					scratchRootDir: join(selected.stateDirs.rootDir, "task-workspaces"),
+					teamId
+				});
+				if (result.removedSessions > 0 || result.removedWorkspaces > 0 || result.failed > 0 || result.unsafePaths > 0 || result.truncated) rootLogger.info({
+					...result,
+					runtimeProfileId: profile.id
+				}, "agent-daemon.runtime_resources_reaped");
 			}
-		};
-		const writeCorrelationAnchors = makePrBodyAnchorWriter({
-			gh: createGhCliClient(),
-			logger: rootLogger
-		});
+		} catch (err) {
+			rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
+		} finally {
+			reaperRunning = false;
+		}
+	};
+	await reapRuntimeResources();
+	const reaperTimer = setInterval(() => {
+		reapRuntimeResources();
+	}, 6e4);
+	reaperTimer.unref();
+	const outputs = [];
+	try {
 		runtime = new AgentRuntime({
 			logger: rootLogger,
-			source: new ApiTaskSource({
+			source: new PollingApiTaskSource({
 				agent: ctx.agent,
-				taskId,
-				teamId: profile.teamId,
-				leaseTtlSec: opts.leaseTtlSec,
-				profileId: profile.id,
-				executorFingerprint: preparedRuntime.attestor.fingerprint
-			}),
-			makeReporter: () => new ApiTaskReporter({
-				tasks: ctx.agent.tasks,
-				teamId: profile.teamId,
-				leaseTtlSec: opts.leaseTtlSec,
-				heartbeatIntervalMs: opts.heartbeatIntervalMs,
-				maxBatchSize: opts.maxBatchSize,
-				flushIntervalMs: opts.flushIntervalMs
+				teamId,
+				taskTypes: taskTypes.length > 0 ? taskTypes : void 0,
+				correlationId: values["correlation-id"],
+				profiles: profiles.map((profile) => ({
+					profileId: profile.id,
+					leaseTtlSec: requireRuntime(runtimes, profile.id).common.leaseTtlSec
+				})),
+				diaryIds: diaryIds.length > 0 ? diaryIds : void 0,
+				leaseTtlSec: firstRuntime.common.leaseTtlSec,
+				listLimit,
+				pollIntervalMs,
+				maxPollIntervalMs,
+				signal: abort.signal,
+				stopWhenEmpty: opts.stopWhenEmpty,
+				waitForFirstTaskMs: waitForFirstTaskSec * 1e3,
+				waitAfterTaskMs: waitAfterTaskSec * 1e3,
+				debug: baseCommon.debug,
+				traceIdlePolling: cfg.traceIdlePolling,
+				logger: rootLogger,
+				executorFingerprints: Object.fromEntries(profiles.map((profile) => [profile.id, requireRuntime(runtimes, profile.id).preparedRuntime.attestor.fingerprint])),
+				slotRegistry,
+				sessionRegistry: runtimeSessionStore,
+				sourceAttemptResolver
 			}),
+			makeReporter: (claimedTask) => {
+				const selected = runtimeForClaimedTask(runtimes, claimedTask);
+				return new ApiTaskReporter({
+					tasks: ctx.agent.tasks,
+					teamId: claimedTask.task.teamId,
+					leaseTtlSec: selected.common.leaseTtlSec,
+					heartbeatIntervalMs: selected.common.heartbeatIntervalMs,
+					maxBatchSize: selected.common.maxBatchSize,
+					flushIntervalMs: selected.common.flushIntervalMs
+				});
+			},
 			onTaskFinished: async (output, claimedTask) => {
+				const selected = runtimeForClaimedTask(runtimes, claimedTask);
 				const resolved = await slotRegistry.findLatestSlotByTaskAttempt(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN);
-				let terminalOutput = redactRequiredEnvValues(output, profile.requiredEnv, cfg.profilePrerequisiteEnv);
+				let terminalOutput = redactRequiredEnvValues(output, selected.profile.requiredEnv, cfg.profilePrerequisiteEnv);
 				if (resolved?.session?.sessionDir) try {
 					const parentSession = await resolveParentRuntimeSession(runtimeSessionStore, claimedTask);
 					await runtimeSessionStore.uploadAttemptFinal({
@@ -7093,422 +6945,738 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 					task: claimedTask.task,
 					slot: resolved ? { expiresAtMs: resolved.slot.expiresAtMs } : null,
 					retryTriage: createRuntimeProfileRetryTriage({
-						runtimeProfile: profile,
+						runtimeProfile: selected.profile,
 						piAgentDir: piAgentDir.path,
 						cwd: ctx.agentRootDir
 					}),
-					executorAttestor: preparedRuntime.attestor,
-					writeCorrelationAnchors,
+					executorAttestor: selected.preparedRuntime.attestor,
+					writeCorrelationAnchors: makePrBodyAnchorWriter({
+						gh: createGhCliClient(),
+						logger: rootLogger.child({
+							runtimeProfileId: selected.profile.id,
+							runtimeProfileName: selected.profile.name
+						})
+					}),
 					log: (msg, fields) => rootLogger.warn(fields ?? {}, msg)
 				});
-			},
-			executeTask
-		});
-		const [output] = await runtime.start();
-		if (!output) {
-			rootLogger.error({}, "agent-daemon.no_output");
-			return 1;
-		}
-		console.log("\n[done] TaskOutput:");
-		console.log(JSON.stringify(output, null, 2));
-		return output.status === "completed" ? 0 : 1;
-	} finally {
-		signalHandlers.dispose();
-		await slotRegistry.close();
-		await otelShutdown();
-		await shutdownLogger();
-	}
-}
-function resolveRecordedWorkspacePath(stateRootDir, mountPath, executionPlan) {
-	if (!executionPlan.workspaceId) return null;
-	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
-}
-function resolveMainWorktree(mountPath) {
-	try {
-		return findMainWorktree(mountPath);
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/cli/poll.ts
-function runPoll(argv, runtimeAdapter) {
-	return runPolling({
-		argv,
-		serviceName: "moltnet.agent-daemon.poll",
-		stopWhenEmpty: false,
-		modeLabel: "poll",
-		helpText: POLL_HELP,
-		runtimeAdapter
-	});
-}
-var NAME_RE = IDENTITY_ALIAS_PATTERN;
-var PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
-function assertStoreName(kind, value) {
-	try {
-		return assertIdentityAlias(value);
-	} catch {
-		throw new AgentServerStoreError("invalid_name", `${kind} must match ${NAME_RE.source}`);
-	}
-}
-function assertProviderId(value) {
-	if (!PROVIDER_ID_RE.test(value)) throw new AgentServerStoreError("invalid_name", `provider id must match ${PROVIDER_ID_RE.source}`);
-	return value;
-}
-var AgentServerStoreError = class extends Error {
-	name = "AgentServerStoreError";
-	constructor(code, message, options) {
-		super(message, options);
-		this.code = code;
-	}
-};
-/**
-* `MOLTNET_AGENT_SERVER_ROOT` override, else `~/.config/moltnet`.
-*
-* Deliberately does NOT consult `XDG_CONFIG_HOME`. The Go CLI's GetConfigDir
-* and @moltnet/agent-config's getConfigDir both resolve `~/.config/moltnet`,
-* so honouring XDG here gave one application two config roots: on a machine
-* with the variable set, the daemon wrote identities the CLI and SDK could not
-* read. `MOLTNET_AGENT_SERVER_ROOT` remains the explicit escape hatch for a
-* genuinely custom location.
-*/
-function resolveAgentServerRoot(input) {
-	const override = input.root?.trim();
-	if (override) return override;
-	return getConfigDir();
-}
-function providerEnvName(providerId) {
-	return `MOLTNET_PROVIDER_${assertProviderId(providerId).replaceAll("-", "_").toUpperCase()}_API_KEY`;
-}
-function assertProviderEnvName(providerId, value) {
-	const expected = providerEnvName(providerId);
-	if (value !== expected) throw new AgentServerStoreError("invalid_state", `provider envName must be ${expected}`);
-	return value;
-}
-function readJson(path) {
-	let raw;
-	try {
-		raw = readFileSync(path, "utf8");
-	} catch (cause) {
-		if (cause.code === "ENOENT") return null;
-		throw new AgentServerStoreError("io_error", `could not read state at ${path}`, { cause });
-	}
-	try {
-		return JSON.parse(raw);
-	} catch (cause) {
-		throw new AgentServerStoreError("invalid_state", `corrupt JSON at ${path}`, { cause });
-	}
-}
-function writeJsonAtomic(path, value) {
-	const temp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
-	try {
-		writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-		renameSync(temp, path);
-	} catch (cause) {
-		try {
-			rmSync(temp, { force: true });
-		} catch {}
-		throw cause;
-	}
-}
-var AgentServerStore = class {
-	root;
-	identitiesDir;
-	runsDir;
-	secretsDir;
-	/** Shared Pi credential dir; `auth.json` inside is pi-managed (lockfiled). */
-	piDir;
-	constructor(root) {
-		this.root = root;
-		this.identitiesDir = join(root, "identities");
-		this.runsDir = join(root, "runs");
-		this.secretsDir = join(root, "secrets");
-		this.piDir = join(root, "pi");
-	}
-	get piAuthJsonPath() {
-		return join(this.piDir, "auth.json");
-	}
-	/** Create the directory layout (0700) if missing. Idempotent. */
-	ensure() {
-		for (const dir of [
-			this.root,
-			this.identitiesDir,
-			this.runsDir,
-			this.secretsDir
-		]) mkdirSync(dir, {
-			recursive: true,
-			mode: 448
-		});
-		return this;
-	}
-	get statePath() {
-		return join(this.root, "agent-server.json");
-	}
-	readAgentServerState() {
-		const state = readJson(this.statePath);
-		if (!state) return {
-			version: 2,
-			pendingRegistrations: {},
-			activations: {}
-		};
-		if (!isRecord$1(state) || state.version !== 2) throw new AgentServerStoreError("invalid_state", `agent-server.json version ${String(isRecord$1(state) ? state.version : void 0)} is not supported; move agent-server.json aside, run \`moltnet config migrate\`, then add or attach the agents again`);
-		if ("pairedOrigins" in state) throw new AgentServerStoreError("invalid_state", "agent-server.json uses the obsolete pairing format; move agent-server.json aside and configure the agent server again");
-		if (!isRecord$1(state.pendingRegistrations) || !isRecord$1(state.activations)) throw new AgentServerStoreError("invalid_state", "agent-server.json is missing the version 2 activation map; move agent-server.json aside, run `moltnet config migrate`, then add or attach the agents again");
-		for (const [alias, activation] of Object.entries(state.activations)) validateActivation(alias, activation);
-		for (const [alias, registration] of Object.entries(state.pendingRegistrations)) {
-			assertStoreName("agent name", alias);
-			if (!isRecord$1(registration) || typeof registration.apiUrl !== "string" || registration.apiUrl.length === 0 || typeof registration.createdAt !== "string" || registration.createdAt.length === 0) throw new AgentServerStoreError("invalid_state", `pending registration "${alias}" is not valid`);
-		}
-		return {
-			version: 2,
-			pendingRegistrations: state.pendingRegistrations,
-			activations: state.activations
-		};
-	}
-	writeAgentServerState(state) {
-		writeJsonAtomic(this.statePath, state);
-	}
-	agentPath(name) {
-		return join(storeChildPath(this.identitiesDir, "identity alias", name), "moltnet.json");
-	}
-	/** Central identity directory, shared with the Go CLI layout. */
-	identityDir(name) {
-		return storeChildPath(this.identitiesDir, "identity alias", name);
-	}
-	get identitySelectorPath() {
-		return join(this.root, "identity-selector.json");
-	}
-	readIdentitySelector() {
-		const selector = readJson(this.identitySelectorPath);
-		if (!selector) return null;
-		if (!isRecord$1(selector) || selector.version !== 1 || selector.default_identity !== void 0 && typeof selector.default_identity !== "string") throw new AgentServerStoreError("invalid_state", "identity-selector.json is not a supported selector document");
-		if (selector.default_identity) assertStoreName("identity alias", selector.default_identity);
-		return selector;
-	}
-	writeIdentitySelector(alias) {
-		writeJsonAtomic(this.identitySelectorPath, {
-			version: 1,
-			default_identity: assertStoreName("identity alias", alias)
+			},
+			executeTask: async (claimedTask, reporter) => {
+				const selected = runtimeForClaimedTask(runtimes, claimedTask);
+				const { common, executionPlans, profile, sandbox, slotIdentity, stateDirs } = selected;
+				if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+					config: runtimeCredentialConfig,
+					profile,
+					offer: runtimeExecutionOffer(selected.preparedRuntime, selected.preparedRuntime.attestor.fingerprint),
+					registry: createNodeSecretProviderRegistry(),
+					executorFingerprint: selected.preparedRuntime.attestor.fingerprint,
+					claimAuthority: claimedTask.claimAuthority ?? {},
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					logger: rootLogger
+				});
+				const taskLogger = rootLogger.child({
+					runtimeProfileId: profile.id,
+					runtimeProfileName: profile.name,
+					provider: profile.provider,
+					model: profile.model,
+					thinkingLevel: profile.thinkingLevel,
+					temperature: profile.temperature,
+					topP: profile.topP,
+					topK: profile.topK,
+					maxOutputTokens: profile.maxOutputTokens
+				});
+				let executionPlan;
+				try {
+					executionPlan = await executionPlans.getOrCreate(claimedTask);
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					taskLogger.warn({
+						taskId: claimedTask.task.id,
+						attemptN: claimedTask.attemptN,
+						err: message
+					}, "agent-daemon.execution_plan_failed");
+					return {
+						taskId: claimedTask.task.id,
+						attemptN: claimedTask.attemptN,
+						status: "failed",
+						output: null,
+						outputCid: null,
+						usage: {
+							inputTokens: 0,
+							outputTokens: 0
+						},
+						durationMs: 0,
+						error: {
+							code: err instanceof ProducerContextResolutionError ? "producer_context_missing" : "execution_plan_failed",
+							message,
+							retryable: false
+						}
+					};
+				}
+				const sessionDescriptor = executionPlan.descriptor;
+				taskLogger.debug({
+					taskId: claimedTask.task.id,
+					taskType: claimedTask.task.taskType,
+					resumable: sessionDescriptor.policy.resumable,
+					workspaceMode: executionPlan.workspaceMode,
+					workspaceScope: sessionDescriptor.policy.workspaceScope,
+					sessionScope: sessionDescriptor.policy.sessionScope,
+					slotKey: executionPlan.slotKey,
+					slotId: executionPlan.slotId,
+					sessionKey: executionPlan.sessionKey,
+					piSessionDir: executionPlan.sessionPersistence?.sessionDir ?? null,
+					workspaceId: executionPlan.workspaceId
+				}, "agent-daemon.task_execution_policy");
+				if (taskTypes.length > 0 && !taskTypes.includes(claimedTask.task.taskType)) return {
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					status: "failed",
+					output: null,
+					outputCid: null,
+					usage: {
+						inputTokens: 0,
+						outputTokens: 0
+					},
+					durationMs: 0,
+					error: {
+						code: "unsupported_task_type",
+						message: `Daemon does not support task type "${claimedTask.task.taskType}". Configured types: ${taskTypes.join(", ")}.`,
+						retryable: true
+					}
+				};
+				if (reporter.cancelSignal.aborted) return {
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					status: "cancelled",
+					output: null,
+					outputCid: null,
+					usage: {
+						inputTokens: 0,
+						outputTokens: 0
+					},
+					durationMs: 0,
+					error: {
+						code: "task_cancelled",
+						message: reporter.cancelReason ?? "Task cancelled before executor started.",
+						retryable: false
+					}
+				};
+				if (executionPlan.slotKey && executionPlan.sessionPersistence) await slotRegistry.beginSlot({
+					...slotIdentity,
+					runtimeProfileId: profile.id,
+					provider: profile.provider,
+					model: profile.model,
+					teamId: claimedTask.task.teamId,
+					slotKey: executionPlan.slotKey,
+					taskType: claimedTask.task.taskType,
+					sessionDir: executionPlan.sessionPersistence.sessionDir,
+					sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
+					workspaceId: executionPlan.workspaceId,
+					worktreePath: resolveRecordedWorkspacePath$1(stateDirs.rootDir, sandbox.rootDir, executionPlan),
+					worktreeBranch: executionPlan.worktreeBranch,
+					workspaceKind: executionPlan.workspaceKind,
+					lastTaskId: claimedTask.task.id,
+					lastAttemptN: claimedTask.attemptN
+				});
+				const rawExecuteTask = selected.preparedRuntime.createTaskExecutor({
+					agentName: common.agent,
+					moltnetAgent: ctx.agent,
+					agentIdentity,
+					hostCapabilitySigner,
+					hostCapabilityLogger: taskLogger,
+					agentRootDir: ctx.agentRootDir,
+					mountPath: sandbox.rootDir,
+					provider: profile.provider,
+					model: profile.model,
+					thinkingLevel: profile.thinkingLevel,
+					temperature: profile.temperature,
+					topP: profile.topP,
+					topK: profile.topK,
+					maxOutputTokens: profile.maxOutputTokens,
+					sandboxConfig: sandbox.config,
+					forwardEnv: profile.requiredEnv,
+					onVmDiagnostic: (diagnostic) => {
+						const fields = {
+							event: diagnostic.event,
+							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
+						};
+						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
+						else taskLogger.info(fields, diagnostic.message);
+					},
+					runtimeProfileContext: profile.context,
+					runtimeProfileId: profile.id,
+					toolEnforcement: profile.toolEnforcement,
+					makeExecutionPlan: (task) => executionPlans.getOrCreate(task),
+					makeOnTurnEvent: makeTurnEventHandlerFactory(taskLogger),
+					toolPolicyLogger: taskLogger,
+					maxTurns: common.maxTurns,
+					maxBashTimeouts: common.maxBashTimeouts
+				});
+				try {
+					active = {
+						taskId: claimedTask.task.id,
+						attemptN: claimedTask.attemptN
+					};
+					return await runWithDaemonRuntimeContext({
+						profileId: profile.id,
+						profileName: profile.name,
+						provider: profile.provider,
+						model: profile.model,
+						thinkingLevel: profile.thinkingLevel,
+						temperature: profile.temperature,
+						topP: profile.topP,
+						topK: profile.topK,
+						maxOutputTokens: profile.maxOutputTokens
+					}, () => rawExecuteTask(claimedTask, reporter));
+				} finally {
+					active = null;
+					executionPlans.delete(claimedTask);
+					if (executionPlan.slotKey) await slotRegistry.finishSlot(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN, slotIdentity, executionPlan.slotKey, profile.provider, profile.model, executionPlan.sessionPersistence ? resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir) : null);
+				}
+			}
 		});
+		const drained = await runtime.start();
+		outputs.push(...drained);
+		rootLogger.info({ processed: drained.length }, "agent-daemon.drained");
+		return drained.some((o) => o.status !== "completed") ? 1 : 0;
+	} finally {
+		clearInterval(reaperTimer);
+		signalHandlers.dispose();
+		await slotRegistry.close();
+		await otelShutdown();
+		await shutdownLogger();
 	}
-	/** Identity aliases available in the shared user-level store. */
-	listIdentityAliases() {
-		return readdirSync(this.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && IDENTITY_ALIAS_PATTERN.test(entry.name)).map((entry) => entry.name).sort((left, right) => left.localeCompare(right));
-	}
-	resolveIdentityAlias(explicit, active) {
-		const alias = explicit?.trim() || active?.trim() || this.readIdentitySelector()?.default_identity;
-		if (!alias) throw new AgentServerStoreError("not_found", "no active identity selected");
-		return assertStoreName("identity alias", alias);
-	}
-	readAgentConfig(alias) {
-		return readJson(this.agentPath(alias));
-	}
-	writeAgentConfig(alias, config) {
-		mkdirSync(this.identityDir(alias), {
-			recursive: true,
-			mode: 448
-		});
-		writeJsonAtomic(this.agentPath(alias), config);
-		if (!this.readIdentitySelector()?.default_identity) this.writeIdentitySelector(alias);
+}
+function resolveRecordedWorkspacePath$1(stateRootDir, mountPath, executionPlan) {
+	if (!executionPlan.workspaceId) return null;
+	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
+}
+function resolveMainWorktree$1(mountPath) {
+	try {
+		return findMainWorktree(mountPath);
+	} catch {
+		return null;
 	}
-	removeAgentConfig(alias) {
-		rmSync(this.agentPath(alias), { force: true });
-		this.clearIdentitySelectorIfDefault(alias);
+}
+function runtimeForClaimedTask(runtimes, claimedTask) {
+	if (!claimedTask.profileId) throw new Error(`Claimed task ${claimedTask.task.id} did not include a selected runtime profile`);
+	return requireRuntime(runtimes, claimedTask.profileId);
+}
+function requireRuntime(runtimes, profileId) {
+	const runtime = runtimes.get(profileId);
+	if (!runtime) throw new Error(`No runtime profile configured for ${profileId}`);
+	return runtime;
+}
+function parseProfileValues(raw) {
+	return (raw ?? []).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseCsv(raw) {
+	return (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function optionalPositiveInt(raw, name, defaultValue) {
+	if (raw === void 0) return defaultValue;
+	const v = Number(raw);
+	if (!Number.isInteger(v) || v < 1) throw new Error(`Invalid --${name} "${raw}": must be a positive integer`);
+	return v;
+}
+function optionalNonNegativeInt(raw, name, defaultValue) {
+	if (raw === void 0) return defaultValue;
+	const v = Number(raw);
+	if (!Number.isInteger(v) || v < 0) throw new Error(`Invalid --${name} "${raw}": must be a non-negative integer`);
+	return v;
+}
+//#endregion
+//#region src/cli/drain.ts
+function runDrain(argv, runtimeAdapter) {
+	return runPolling({
+		argv,
+		serviceName: "moltnet.agent-daemon.drain",
+		stopWhenEmpty: true,
+		modeLabel: "drain",
+		helpText: DRAIN_HELP,
+		runtimeAdapter
+	});
+}
+//#endregion
+//#region src/cli/once.ts
+async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
+	if (isHelpFlag(argv)) {
+		console.log(ONCE_HELP);
+		return 0;
 	}
-	/** Clears the persisted default when it names `alias`. */
-	clearIdentitySelectorIfDefault(alias) {
-		let selector = null;
-		try {
-			selector = this.readIdentitySelector();
-		} catch {
-			return;
+	const { values } = parseArgs({
+		args: argv,
+		options: {
+			...commonOptionDefs(),
+			"task-id": {
+				type: "string",
+				short: "t"
+			},
+			team: { type: "string" },
+			sandbox: { type: "string" },
+			profile: { type: "string" }
 		}
-		if (!selector || selector.default_identity !== alias) return;
-		writeJsonAtomic(this.identitySelectorPath, { version: 1 });
-	}
-	readActivation(alias) {
-		return this.readAgentServerState().activations[assertStoreName("agent name", alias)] ?? null;
-	}
-	hasPendingRegistration(alias) {
-		return Boolean(this.readAgentServerState().pendingRegistrations[assertStoreName("agent name", alias)]);
-	}
-	reserveRegistration(alias, apiUrl) {
-		const name = assertStoreName("agent name", alias);
-		const state = this.readAgentServerState();
-		if (state.activations[name] || state.pendingRegistrations[name]) throw new AgentServerStoreError("already_exists", `agent "${name}" already exists in the agent server store`);
-		state.pendingRegistrations[name] = {
-			apiUrl,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		this.writeAgentServerState(state);
-	}
-	clearPendingRegistration(alias) {
-		const name = assertStoreName("agent name", alias);
-		const state = this.readAgentServerState();
-		delete state.pendingRegistrations[name];
-		this.writeAgentServerState(state);
-	}
-	writeActivation(activation) {
-		const alias = assertStoreName("agent name", activation.alias);
-		validateActivation(alias, activation);
-		const state = this.readAgentServerState();
-		state.activations[alias] = activation;
-		if (activation.source === "managed") delete state.pendingRegistrations[alias];
-		this.writeAgentServerState(state);
-	}
-	listActivations() {
-		return Object.values(this.readAgentServerState().activations).sort((a, b) => a.alias.localeCompare(b.alias));
-	}
-	get providersPath() {
-		return join(this.root, "providers.json");
-	}
-	readProviders() {
-		const state = readJson(this.providersPath) ?? {};
-		this.validateProviders(state);
-		return state;
+	});
+	if (!values["task-id"]) {
+		console.error("Missing required flag: --task-id\n");
+		console.error(ONCE_HELP);
+		return 1;
 	}
-	writeProviders(state) {
-		this.validateProviders(state);
-		writeJsonAtomic(this.providersPath, state);
+	const taskId = values["task-id"];
+	if (!values.profile) {
+		console.error("Missing required flag: --profile\n");
+		console.error(ONCE_HELP);
+		return 1;
 	}
-	validateProviders(state) {
-		for (const [id, provider] of Object.entries(state)) {
-			assertProviderId(id);
-			assertProviderEnvName(id, provider.envName);
+	let opts;
+	try {
+		opts = parseCommonOptions(values);
+	} catch (err) {
+		if (err instanceof MissingRequiredOptionError) {
+			console.error(`${err.message}\n`);
+			console.error(ONCE_HELP);
+			return 1;
 		}
+		throw err;
 	}
-	runDir(id) {
-		return storeChildPath(this.runsDir, "run id", id);
+	if (values.sandbox) {
+		console.error("Cannot use --sandbox. Remote runtime profiles define sandbox policy.");
+		return 1;
 	}
-	resolveRunLogPath(id) {
-		let root;
-		let runDir;
+	const cfg = loadConfig();
+	const credentialSources = {
+		profileRequirements: cfg.profileCredentialRequirements,
+		bindings: cfg.credentialBindings
+	};
+	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
+	const initialOpts = opts;
+	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
+	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
+		let gate = "resolve_agent_context";
 		try {
-			root = realpathSync(this.runsDir);
-			runDir = realpathSync(this.runDir(id));
-		} catch (cause) {
-			throw new AgentServerStoreError("io_error", "could not resolve run directory", { cause });
+			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
+				agentRootDir: explicitAgentRootDir,
+				credentialSource: cfg.credentialSource,
+				envApiUrl: cfg.apiUrl
+			});
+			gate = "authenticate_and_bind";
+			const whoami = await validateStartupBinding({
+				agent: resolvedContext.agent,
+				teamId: values.team,
+				expectedAgent: cfg.expectedAgent
+			});
+			gate = "resolve_signing_material";
+			const privateKey = await resolveExecutorSigningPrivateKey({
+				credentialSource: cfg.credentialSource,
+				agentDir: resolvedContext.agentDir,
+				configuredPrivateKey: cfg.signingPrivateKey,
+				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
+			});
+			gate = "validate_scopes";
+			validateDaemonScopes(whoami);
+			gate = "validate_signing_identity";
+			await validateExecutorSigningIdentity({
+				whoami,
+				signingPrivateKey: privateKey
+			});
+			gate = "resolve_agent_identity";
+			const agentIdentity = await resolveDaemonAgentIdentity({
+				agentName: initialOpts.agent,
+				whoami,
+				credentialSource: cfg.credentialSource,
+				agentDir: resolvedContext.agentDir,
+				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
+			});
+			return {
+				ctx: resolvedContext,
+				signingPrivateKey: privateKey,
+				agentIdentity,
+				hostCapabilitySigner: createLocalSeedSigner({
+					privateKeySeed: privateKey,
+					agent: resolvedContext.agent,
+					identity: agentIdentity
+				})
+			};
+		} catch (error) {
+			await logDaemonStartupFailure({
+				serviceName: "agent-daemon.once",
+				level: cfg.logLevel || (initialOpts.debug ? "debug" : "info"),
+				gate,
+				agent: initialOpts.agent,
+				credentialSource: cfg.credentialSource,
+				error
+			});
+			throw error;
 		}
-		if (!isStrictDescendant(root, runDir)) throw new AgentServerStoreError("invalid_state", "run directory escapes its store");
-		const logPath = join(runDir, "daemon.log");
-		try {
-			if (lstatSync(logPath).isSymbolicLink()) throw new AgentServerStoreError("invalid_state", "run log must not be a symbolic link");
-			const resolvedLog = realpathSync(logPath);
-			if (!isStrictDescendant(runDir, resolvedLog)) throw new AgentServerStoreError("invalid_state", "run log escapes its store");
-		} catch (cause) {
-			if (cause instanceof AgentServerStoreError) throw cause;
-			if (cause.code !== "ENOENT") throw new AgentServerStoreError("io_error", "could not resolve run log", { cause });
+	})();
+	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
+	const profile = await resolveRuntimeProfile({
+		agent: ctx.agent,
+		profile: values.profile,
+		teamId: values.team,
+		cwd: daemonRootDir
+	});
+	assertRuntimeAdapterSupportsProfile(runtimeAdapter, profile);
+	const preparedRuntime = attestPreparedRuntime(await runtimeAdapter.prepare({ profile }), signingPrivateKey);
+	validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, {
+		tools: preparedRuntime.tools,
+		executables: preparedRuntime.executables
+	});
+	assertGuestEnvironmentBoundary({
+		forwardEnv: profile.requiredEnv,
+		sandboxEnv: profile.sandboxConfig.env
+	});
+	await ctx.agent.tasks.registerExecutorManifest(await preparedRuntime.attestor.registration());
+	opts = parseCommonOptions(values, { runtimeDefaults: {
+		leaseTtlSec: profile.leaseTtlSec,
+		heartbeatIntervalMs: profile.heartbeatIntervalMs,
+		maxBatchSize: profile.maxBatchSize,
+		maxTurns: profile.maxTurns,
+		maxBashTimeouts: profile.maxBashTimeouts,
+		warmSessionTtlSec: resolveProfileWarmSessionTtlSec(profile)
+	} });
+	const sandbox = {
+		config: profile.sandboxConfig,
+		rootDir: profile.mountPath,
+		path: profile.source
+	};
+	const piAgentDir = await resolvePiAgentDir(cfg, sandbox.rootDir, [profile]);
+	process.once("exit", piAgentDir.cleanup);
+	activatePiCodingAgentDir(piAgentDir.path, piAgentDir.env);
+	const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
+	const slotRegistry = createApiRuntimeSlotStore({ agent: ctx.agent });
+	const runtimeSessionStore = createApiRuntimeSessionStore({
+		agent: ctx.agent,
+		logger: { warn: (context, message) => rootLogger.warn(context, message) }
+	});
+	const sourceAttemptResolver = createApiSourceAttemptResolver({ agent: ctx.agent });
+	const runtimeInstanceId = createRuntimeInstanceId();
+	const slotIdentity = {
+		agentName: opts.agent,
+		runtimeProfileId: profile.id,
+		runtimeInstanceId
+	};
+	const executionPlans = createExecutionPlanCache({
+		stateDirs,
+		slotIdentity,
+		warmSessionTtlSec: opts.warmSessionTtlSec,
+		workspacePolicy: {
+			defaultWorkspaceMode: profile.defaultWorkspaceMode,
+			allowedWorkspaceModes: profile.allowedWorkspaceModes
+		},
+		slotRegistry,
+		runtimeSessionStore,
+		sourceAttemptResolver
+	});
+	const otelShutdown = await initWorkerOtel({
+		serviceName: "moltnet.agent-daemon.once",
+		agent: ctx.agent,
+		endpoint: cfg.otelEndpoint,
+		resourceAttributes: {
+			"moltnet.task.id": taskId,
+			"moltnet.agent.name": opts.agent,
+			"moltnet.credential.source": ctx.credentialSource,
+			"moltnet.llm.provider": profile.provider,
+			"moltnet.llm.model": profile.model,
+			...profile.thinkingLevel ? { "moltnet.llm.thinking_level": profile.thinkingLevel } : {},
+			...profile.temperature !== null ? { "moltnet.llm.temperature": String(profile.temperature) } : {},
+			...profile.topP !== null ? { "moltnet.llm.top_p": String(profile.topP) } : {},
+			...profile.topK !== null ? { "moltnet.llm.top_k": String(profile.topK) } : {},
+			...profile.maxOutputTokens !== null ? { "moltnet.llm.max_output_tokens": String(profile.maxOutputTokens) } : {},
+			"moltnet.runtime_profile.id": profile.id
 		}
-		return logPath;
+	});
+	const { logger, shutdown: shutdownLogger } = createRootLogger({
+		name: "agent-daemon.once",
+		level: cfg.logLevel || (opts.debug ? "debug" : "info")
+	});
+	const rootLogger = logger.child({
+		mode: "once",
+		agent: opts.agent,
+		provider: profile.provider,
+		model: profile.model,
+		thinkingLevel: profile.thinkingLevel,
+		temperature: profile.temperature,
+		topP: profile.topP,
+		topK: profile.topK,
+		maxOutputTokens: profile.maxOutputTokens,
+		runtimeProfileId: profile.id,
+		runtimeProfileName: profile.name
+	});
+	rootLogger.info({
+		sandbox: sandbox.path,
+		taskId,
+		leaseTtlSec: opts.leaseTtlSec,
+		heartbeatIntervalMs: opts.heartbeatIntervalMs,
+		maxTurns: opts.maxTurns,
+		maxBashTimeouts: opts.maxBashTimeouts,
+		warmSessionTtlSec: opts.warmSessionTtlSec,
+		profileId: profile.id,
+		profileSessionTtlSec: profile.sessionTtlSec,
+		profileWorkspaceTtlSec: profile.workspaceTtlSec,
+		piAgentDir: piAgentDir.path,
+		piAgentDirSource: piAgentDir.source
+	}, "agent-daemon.starting");
+	try {
+		const reaped = await reapRuntimeSlotResources({
+			onIssue: (issue) => {
+				rootLogger.warn(issue, "agent-daemon.runtime_resource_reap_issue");
+			},
+			runtimeSlotStore: slotRegistry,
+			taskReader: ctx.agent.tasks
+		}, {
+			agentName: opts.agent,
+			mainWorktree: resolveMainWorktree(sandbox.rootDir),
+			runtimeInstanceId,
+			runtimeProfileId: profile.id,
+			sessionRootDir: stateDirs.piSessionsDir,
+			scratchRootDir: join(stateDirs.rootDir, "task-workspaces"),
+			teamId: profile.teamId
+		});
+		if (reaped.removedSessions > 0 || reaped.removedWorkspaces > 0 || reaped.failed > 0 || reaped.unsafePaths > 0 || reaped.truncated) rootLogger.info(reaped, "agent-daemon.runtime_resources_reaped");
+	} catch (err) {
+		rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
 	}
-	createRunDir(id) {
-		const dir = this.runDir(id);
-		const piDir = join(dir, "pi");
-		mkdirSync(piDir, {
-			recursive: true,
-			mode: 448
+	let runtime = null;
+	let activeAttemptN = null;
+	const signalHandlers = installShutdownSignalHandlers({
+		logDrain: (signal) => {
+			rootLogger.warn({
+				signal,
+				taskId
+			}, "agent-daemon.draining");
+		},
+		drain: (signal) => {
+			runtime?.stop(`agent-daemon received ${signal}`);
+			abortActiveAttemptOnSignal({
+				active: activeAttemptN === null ? null : {
+					taskId,
+					attemptN: activeAttemptN
+				},
+				signal,
+				abortAttempt: (activeTaskId, attemptN, body) => ctx.agent.tasks.abortAttempt(activeTaskId, attemptN, body),
+				logFailure: (err, current) => {
+					try {
+						rootLogger.warn({
+							err: err instanceof Error ? err.message : String(err),
+							taskId: current.taskId,
+							attemptN: current.attemptN
+						}, "agent-daemon.abort_on_signal_failed");
+					} catch (logErr) {
+						process.stderr.write(`[agent-daemon] failed to log abort error: ` + (logErr instanceof Error ? logErr.message : String(logErr)) + "\n");
+					}
+				}
+			});
+		}
+	});
+	try {
+		const rawExecuteTask = preparedRuntime.createTaskExecutor({
+			agentName: opts.agent,
+			moltnetAgent: ctx.agent,
+			agentIdentity,
+			hostCapabilitySigner,
+			hostCapabilityLogger: rootLogger,
+			agentRootDir: ctx.agentRootDir,
+			mountPath: sandbox.rootDir,
+			provider: profile.provider,
+			model: profile.model,
+			thinkingLevel: profile.thinkingLevel,
+			temperature: profile.temperature,
+			topP: profile.topP,
+			topK: profile.topK,
+			maxOutputTokens: profile.maxOutputTokens,
+			sandboxConfig: sandbox.config,
+			forwardEnv: profile.requiredEnv,
+			onVmDiagnostic: (diagnostic) => {
+				const fields = {
+					event: diagnostic.event,
+					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
+				};
+				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);
+				else rootLogger.info(fields, diagnostic.message);
+			},
+			runtimeProfileContext: profile.context,
+			runtimeProfileId: profile.id,
+			toolEnforcement: profile.toolEnforcement,
+			makeExecutionPlan: (claimedTask) => executionPlans.getOrCreate(claimedTask),
+			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId }),
+			toolPolicyLogger: rootLogger,
+			maxTurns: opts.maxTurns,
+			maxBashTimeouts: opts.maxBashTimeouts
 		});
-		return {
-			dir,
-			piDir,
-			logPath: join(dir, "daemon.log")
+		const executeTask = async (claimedTask, reporter) => {
+			if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+				config: runtimeCredentialConfig,
+				profile,
+				offer: runtimeExecutionOffer(preparedRuntime, preparedRuntime.attestor.fingerprint),
+				registry: createNodeSecretProviderRegistry(),
+				executorFingerprint: preparedRuntime.attestor.fingerprint,
+				claimAuthority: claimedTask.claimAuthority ?? {},
+				taskId: claimedTask.task.id,
+				attemptN: claimedTask.attemptN,
+				logger: rootLogger
+			});
+			let executionPlan;
+			try {
+				executionPlan = await executionPlans.getOrCreate(claimedTask);
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				rootLogger.warn({
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					err: message
+				}, "agent-daemon.execution_plan_failed");
+				return {
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					status: "failed",
+					output: null,
+					outputCid: null,
+					usage: {
+						inputTokens: 0,
+						outputTokens: 0
+					},
+					durationMs: 0,
+					error: {
+						code: err instanceof ProducerContextResolutionError ? "producer_context_missing" : "execution_plan_failed",
+						message,
+						retryable: false
+					}
+				};
+			}
+			if (executionPlan.slotKey && executionPlan.sessionPersistence) await slotRegistry.beginSlot({
+				...slotIdentity,
+				runtimeProfileId: profile.id,
+				provider: profile.provider,
+				model: profile.model,
+				teamId: claimedTask.task.teamId,
+				slotKey: executionPlan.slotKey,
+				taskType: claimedTask.task.taskType,
+				sessionDir: executionPlan.sessionPersistence.sessionDir,
+				sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
+				workspaceId: executionPlan.workspaceId,
+				worktreePath: resolveRecordedWorkspacePath(stateDirs.rootDir, sandbox.rootDir, executionPlan),
+				worktreeBranch: executionPlan.worktreeBranch,
+				workspaceKind: executionPlan.workspaceKind,
+				lastTaskId: claimedTask.task.id,
+				lastAttemptN: claimedTask.attemptN
+			});
+			activeAttemptN = claimedTask.attemptN;
+			try {
+				return await runWithDaemonRuntimeContext({
+					profileId: profile.id,
+					profileName: profile.name,
+					provider: profile.provider,
+					model: profile.model,
+					thinkingLevel: profile.thinkingLevel,
+					temperature: profile.temperature,
+					topP: profile.topP,
+					topK: profile.topK,
+					maxOutputTokens: profile.maxOutputTokens
+				}, () => rawExecuteTask(claimedTask, reporter));
+			} finally {
+				activeAttemptN = null;
+				executionPlans.delete(claimedTask);
+				if (executionPlan.slotKey) await slotRegistry.finishSlot(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN, slotIdentity, executionPlan.slotKey, profile.provider, profile.model, executionPlan.sessionPersistence ? resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir) : null);
+			}
 		};
-	}
-	readRun(id) {
-		return readJson(join(this.runDir(id), "run.json"));
-	}
-	writeRun(record) {
-		writeJsonAtomic(join(this.runDir(record.id), "run.json"), record);
-	}
-	listRuns(limit = Number.POSITIVE_INFINITY) {
-		let ids;
-		try {
-			ids = readdirSync(this.runsDir);
-		} catch {
-			return [];
-		}
-		const sortedIds = ids.filter((id) => NAME_RE.test(id)).sort().reverse();
-		const selectedIds = Number.isFinite(limit) ? sortedIds.slice(0, Math.max(0, limit)) : sortedIds;
-		const records = [];
-		for (const id of selectedIds) {
-			const record = this.readRun(id);
-			if (record) records.push(record);
-		}
-		return records.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
-	}
-	/** Remove only completed run directories outside the configured budget. */
-	pruneCompletedRuns(options) {
-		const now = (options.now ?? /* @__PURE__ */ new Date()).getTime();
-		let retainedBytes = 0;
-		let retainedCount = 0;
-		const removed = [];
-		for (const record of this.listRuns()) {
-			if (record.status === "running") continue;
-			const dir = this.runDir(record.id);
-			const bytes = directoryBytes(dir);
-			const endedAt = Date.parse(record.endedAt ?? record.startedAt);
-			const expired = !Number.isFinite(endedAt) || now - endedAt > options.maxAgeMs;
-			const overCount = retainedCount >= options.maxCount;
-			const overBytes = retainedBytes + bytes > options.maxBytes;
-			if (expired || overCount || overBytes) {
-				rmSync(dir, {
-					recursive: true,
-					force: true
+		const writeCorrelationAnchors = makePrBodyAnchorWriter({
+			gh: createGhCliClient(),
+			logger: rootLogger
+		});
+		runtime = new AgentRuntime({
+			logger: rootLogger,
+			source: new ApiTaskSource({
+				agent: ctx.agent,
+				taskId,
+				teamId: profile.teamId,
+				leaseTtlSec: opts.leaseTtlSec,
+				profileId: profile.id,
+				executorFingerprint: preparedRuntime.attestor.fingerprint
+			}),
+			makeReporter: () => new ApiTaskReporter({
+				tasks: ctx.agent.tasks,
+				teamId: profile.teamId,
+				leaseTtlSec: opts.leaseTtlSec,
+				heartbeatIntervalMs: opts.heartbeatIntervalMs,
+				maxBatchSize: opts.maxBatchSize,
+				flushIntervalMs: opts.flushIntervalMs
+			}),
+			onTaskFinished: async (output, claimedTask) => {
+				const resolved = await slotRegistry.findLatestSlotByTaskAttempt(claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN);
+				let terminalOutput = redactRequiredEnvValues(output, profile.requiredEnv, cfg.profilePrerequisiteEnv);
+				if (resolved?.session?.sessionDir) try {
+					const parentSession = await resolveParentRuntimeSession(runtimeSessionStore, claimedTask);
+					await runtimeSessionStore.uploadAttemptFinal({
+						attemptN: claimedTask.attemptN,
+						parentSessionId: parentSession?.id ?? null,
+						sessionDir: resolved.session.sessionDir,
+						sessionKind: resolveRuntimeSessionKind(claimedTask),
+						sourceRuntimeProfileId: resolved.slot.runtimeProfileId,
+						sourceSlotId: resolved.slot.id,
+						taskId: claimedTask.task.id,
+						teamId: claimedTask.task.teamId
+					});
+				} catch (err) {
+					rootLogger.error({
+						err,
+						taskId: claimedTask.task.id,
+						attemptN: claimedTask.attemptN
+					}, "agent-daemon.runtime_session_upload_failed");
+					terminalOutput = applyRuntimeSessionUploadFailure(terminalOutput, err);
+				}
+				return finalizeTask(ctx.agent, terminalOutput, {
+					task: claimedTask.task,
+					slot: resolved ? { expiresAtMs: resolved.slot.expiresAtMs } : null,
+					retryTriage: createRuntimeProfileRetryTriage({
+						runtimeProfile: profile,
+						piAgentDir: piAgentDir.path,
+						cwd: ctx.agentRootDir
+					}),
+					executorAttestor: preparedRuntime.attestor,
+					writeCorrelationAnchors,
+					log: (msg, fields) => rootLogger.warn(fields ?? {}, msg)
 				});
-				removed.push(record.id);
-				continue;
-			}
-			retainedCount += 1;
-			retainedBytes += bytes;
+			},
+			executeTask
+		});
+		const [output] = await runtime.start();
+		if (!output) {
+			rootLogger.error({}, "agent-daemon.no_output");
+			return 1;
 		}
-		return removed;
+		console.log("\n[done] TaskOutput:");
+		console.log(JSON.stringify(output, null, 2));
+		return output.status === "completed" ? 0 : 1;
+	} finally {
+		signalHandlers.dispose();
+		await slotRegistry.close();
+		await otelShutdown();
+		await shutdownLogger();
 	}
-};
-function directoryBytes(path) {
-	let info;
+}
+function resolveRecordedWorkspacePath(stateRootDir, mountPath, executionPlan) {
+	if (!executionPlan.workspaceId) return null;
+	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
+}
+function resolveMainWorktree(mountPath) {
 	try {
-		info = lstatSync(path);
+		return findMainWorktree(mountPath);
 	} catch {
-		return 0;
+		return null;
 	}
-	if (info.isSymbolicLink()) return 0;
-	if (!info.isDirectory()) return info.size;
-	let total = 0;
-	for (const entry of readdirSync(path, { withFileTypes: true })) total += directoryBytes(join(path, entry.name));
-	return total;
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function storeChildPath(root, kind, value, suffix = "") {
-	const name = assertStoreName(kind, value);
-	const normalizedRoot = resolve(root);
-	const candidate = resolve(normalizedRoot, `${name}${suffix}`);
-	if (!isStrictDescendant(normalizedRoot, candidate)) throw new AgentServerStoreError("invalid_name", `${kind} escapes its store`);
-	return candidate;
-}
-function isStrictDescendant(root, candidate) {
-	const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
-	return candidate !== root && candidate.startsWith(rootPrefix);
 }
-function validateActivation(alias, value) {
-	const invalid = () => {
-		throw new AgentServerStoreError("invalid_state", `activation "${alias}" is not a valid version 2 activation`);
-	};
-	if (!isRecord$1(value)) invalid();
-	const activation = value;
-	if (activation.alias !== alias) invalid();
-	if (![
-		"subjectId",
-		"publicKey",
-		"fingerprint",
-		"createdAt"
-	].every((field) => typeof activation[field] === "string" && activation[field].length > 0)) invalid();
-	if (activation.source === "managed") {
-		if (typeof activation.apiUrl !== "string" || activation.apiUrl.length === 0 || activation.configPath !== void 0 || activation.configApiUrl !== void 0) invalid();
-		return;
-	}
-	if (activation.source !== "external" || typeof activation.configPath !== "string" || activation.configPath.length === 0 || typeof activation.configApiUrl !== "string" || activation.configApiUrl.length === 0 || activation.apiUrl !== void 0 && typeof activation.apiUrl !== "string") invalid();
+//#endregion
+//#region src/cli/poll.ts
+function runPoll(argv, runtimeAdapter) {
+	return runPolling({
+		argv,
+		serviceName: "moltnet.agent-daemon.poll",
+		stopWhenEmpty: false,
+		modeLabel: "poll",
+		helpText: POLL_HELP,
+		runtimeAdapter
+	});
 }
 //#endregion
 //#region src/lib/provider-lock.ts
@@ -9199,7 +9367,6 @@ function snapshot(login) {
 * the current config and verifies it with authenticated `whoami` before use.
 */
 var MAX_CONFIG_BYTES = 64 * 1024;
-var IDENTITY_OPERATION_TIMEOUT_MS = 15e3;
 var pendingAliases = /* @__PURE__ */ new WeakMap();
 var AgentServerIdentityError = class extends Error {
 	name = "AgentServerIdentityError";
@@ -9222,7 +9389,7 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 	const alias = assertStoreName("agent name", input.name);
 	if (!input.enrollmentToken.trim()) throw new AgentServerIdentityError("enrollment_required", "an enrollment token from the target team is required — a self-registered agent would be stranded in its own personal team");
 	const releaseAlias = reserveAlias(store, alias);
-	let registered = false;
+	let registered;
 	try {
 		let apiUrl;
 		try {
@@ -9231,61 +9398,40 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 			throw new AgentServerIdentityError("registration_failed", "registration API URL must use HTTPS or HTTP loopback", { cause });
 		}
 		store.reserveRegistration(alias, apiUrl);
-		const result = await register({
-			credentialType: "agent_key",
-			apiUrl,
-			enrollmentToken: input.enrollmentToken,
-			signal: boundedIdentitySignal(input.signal)
-		});
-		if (result.credentials.type !== "agent_key") throw new AgentServerIdentityError("unsupported_credential", `registration returned credential type "${result.credentials.type}"; agent server manages agent-key credentials only`);
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const { subjectId, fingerprint, publicKey, privateKey } = result.identity;
-		registered = true;
-		const agentKeyReference = {
-			provider: FILE_SECRET_PROVIDER,
-			key: agentKeyKey(subjectId)
-		};
-		const seedReference = {
-			provider: FILE_SECRET_PROVIDER,
-			key: identitySeedKey(fingerprint)
-		};
-		const config = {
-			subject_id: subjectId,
-			subject_type: "agent",
-			registered_at: now,
-			agent_key_ref: agentKeyReference,
-			keys: {
-				public_key: publicKey,
-				fingerprint,
-				private_key_ref: seedReference
-			},
-			endpoints: {
-				api: result.apiUrl,
-				mcp: deriveMcpUrl(result.apiUrl)
+		try {
+			registered = await register({
+				name: alias,
+				apiUrl,
+				credentialType: "agent_key",
+				enrollmentToken: input.enrollmentToken,
+				secretProvider: secrets,
+				configDir: store.identityDir(alias),
+				publishAlias: false,
+				signal: input.signal,
+				connectAgent
+			});
+		} catch (cause) {
+			if (cause instanceof RegisterIdentityError) {
+				if (cause.nothingRegistered) {
+					store.clearPendingRegistration(alias);
+					throw new AgentServerIdentityError(cause.code === "alias_exists" ? "agent_exists" : "registration_failed", cause.message, { cause });
+				}
+				if (cause.code === "unsupported_credential") throw new AgentServerIdentityError("unsupported_credential", `${cause.message}; agent server manages agent-key credentials only`, { cause });
+				if (cause.code === "identity_mismatch") throw new AgentServerIdentityError("verification_failed", cause.message, { cause });
 			}
-		};
-		store.writeAgentConfig(alias, config);
-		await secrets.write(agentKeyReference.key, result.credentials.secret);
-		await secrets.write(seedReference.key, privateKey);
-		const whoami = await callWhoami(connectAgent, {
-			agentKey: result.credentials.secret,
-			apiUrl: result.apiUrl
-		}, store.agentPath(alias), input.signal);
-		assertIdentityMatches(whoami, {
-			publicKey,
-			fingerprint
-		}, "authenticated whoami", `new managed agent "${alias}"`);
-		assertSubjectMatches(whoami, config, "authenticated whoami", `managed config ${store.agentPath(alias)}`);
+			throw new AgentServerIdentityError("registration_incomplete", incompleteRegistrationMessage(alias, cause instanceof RegisterIdentityError ? cause : {}), { cause });
+		}
+		const { config, whoami, identity } = registered;
 		const boundTeamId = boundTeamIdFromWhoami(whoami);
 		const activation = {
 			alias,
 			source: "managed",
 			subjectId: whoami.subjectId,
-			publicKey,
-			fingerprint,
+			publicKey: identity.publicKey,
+			fingerprint: identity.fingerprint,
 			...boundTeamId ? { boundTeamId } : {},
-			createdAt: now,
-			apiUrl: result.apiUrl
+			createdAt: config.registered_at,
+			apiUrl: config.endpoints.api
 		};
 		store.writeActivation(activation);
 		return {
@@ -9294,18 +9440,27 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 			...boundTeamId ? { boundTeamId } : {}
 		};
 	} catch (cause) {
-		if (!registered && cause instanceof MoltNetError && cause.statusCode !== void 0 && cause.statusCode >= 400 && cause.statusCode < 500) {
-			store.clearPendingRegistration(alias);
-			throw new AgentServerIdentityError("registration_failed", registrationRejectionMessage(alias, cause), { cause });
-		}
-		if (store.hasPendingRegistration(alias)) throw new AgentServerIdentityError("registration_incomplete", registered ? `the remote agent was registered but local activation is incomplete; reconcile or clear its pending Agent Server record before retrying` : `registration for "${alias}" may be incomplete; inspect the remote API before changing its pending Agent Server record`, { cause });
+		if (cause instanceof AgentServerIdentityError) throw cause;
+		if (store.hasPendingRegistration(alias)) throw new AgentServerIdentityError("registration_incomplete", incompleteRegistrationMessage(alias, registered ? {
+			...registered.identity,
+			configPath: registered.configPath
+		} : {}), { cause });
 		throw cause;
 	} finally {
 		releaseAlias();
 	}
 }
-function registrationRejectionMessage(alias, cause) {
-	return `registration for "${alias}" was rejected${cause.statusCode === void 0 ? "" : ` (${cause.statusCode})`}: ${cause.detail?.trim() || cause.message}`;
+/**
+* Guidance for a registration that may have committed. The HTTP response
+* carries only this message, so it names the reconcile call and, when the
+* server outcome is unknown, the fingerprint to look up first. Resume needs
+* the written config, so without one only abandon is offered.
+*/
+function incompleteRegistrationMessage(alias, known) {
+	const endpoint = `POST /v1/agents/${alias}/reconcile`;
+	const reconcile = known.configPath ? `Finish it with ${endpoint} and {"action":"resume"}, or discard the local record with {"action":"abandon"}.` : `No local config was written, so it cannot be resumed; discard the local record with ${endpoint} and {"action":"abandon"}.`;
+	if (known.subjectId) return `the remote agent ${known.subjectId} was registered but local activation is incomplete. ${reconcile}`;
+	return `registration for "${alias}" may have completed on the server${known.fingerprint ? ` (fingerprint ${known.fingerprint})` : ""}; look the agent up first. ${reconcile}`;
 }
 /** Resume a fully persisted registration or explicitly abandon local recovery. */
 async function reconcileManagedRegistration(store, secrets, aliasInput, action, connectAgent = connect, signal) {
@@ -9528,10 +9683,6 @@ async function callWhoami(connectAgent, options, source, signal) {
 		throw verificationError(`could not authenticate ${source} against the API`, cause);
 	}
 }
-function boundedIdentitySignal(signal) {
-	const timeout = AbortSignal.timeout(IDENTITY_OPERATION_TIMEOUT_MS);
-	return signal ? AbortSignal.any([signal, timeout]) : timeout;
-}
 function identityFromConfig(config) {
 	const publicKey = config?.keys?.public_key?.trim();
 	const fingerprint = config?.keys?.fingerprint?.trim();
@@ -9776,20 +9927,8 @@ var RunManager = class {
 				recursive: true,
 				mode: 448
 			});
-			writePiConfig({
-				piDir,
-				providers: Object.fromEntries(Object.entries(providers).map(([providerId, provider]) => [providerId, {
-					api: provider.api,
-					...provider.apiKeyRef ? { apiKeyEnvRef: `$${provider.envName}` } : {},
-					baseUrl: provider.baseUrl,
-					models: provider.models
-				}]))
-			});
-			try {
-				(this.options.symlinkImpl ?? symlinkSync)(this.store.piAuthJsonPath, join(piDir, "auth.json"));
-			} catch (cause) {
-				throw new AgentServerStoreError("io_error", "could not link subscription credentials into the run", { cause });
-			}
+			writeStorePiConfig(piDir, providers);
+			linkPiAuth(this.store.piAuthJsonPath, piDir, this.options.symlinkImpl ?? symlinkSync);
 			const entry = this.entrypoint();
 			logStream = createWriteStream(logPath, {
 				fd: openSync(logPath, "a", 384),
@@ -11163,7 +11302,7 @@ function normalizeAgentServerError(error) {
 		message: error.message
 	};
 	if (error instanceof AgentServerIdentityError) return {
-		statusCode: error.code === "agent_exists" ? 409 : 400,
+		statusCode: error.code === "agent_exists" || error.code === "registration_incomplete" ? 409 : 400,
 		code: error.code,
 		message: error.message
 	};
@@ -11864,7 +12003,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.56.2";
+var DAEMON_VERSION = "0.57.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {