@turmind/halo 0.2.1 → 0.2.3

package/dist/index.js

@@ -198,6 +198,10 @@ function generalSection() {
       { key: "theme", type: "enum", options: ["dark", "light", "midnight", "warm"], optionLabels: ["Dark", "Light", "Midnight", "Warm"], globalOnly: true, description: "Admin UI color theme.", description_zh: "Admin \u754C\u9762\u914D\u8272\u4E3B\u9898\u3002", default: "dark" },
       // agent scaffold
       { key: "agent.default_provider", type: "enum", options: providerIds, description: "Provider used when scaffolding a new agent. Model id, endpoint, prompt-caching TTL, and thinking defaults are read from that provider's YAML.", description_zh: "\u65B0\u5EFA agent \u65F6\u4F7F\u7528\u7684\u4F9B\u5E94\u5546\u3002\u6A21\u578B id\u3001endpoint\u3001\u63D0\u793A\u7F13\u5B58 TTL\u3001Thinking \u9ED8\u8BA4\u503C\u90FD\u4ECE\u8BE5\u4F9B\u5E94\u5546\u7684 YAML \u8BFB\u53D6\u3002", default: defaultProvider2 },
+      { key: "agent.max_retries", type: "int", description: "Max attempts per model call on transient errors (rate limit, 5xx, network). Backoff grows between attempts.", description_zh: "\u5355\u6B21\u6A21\u578B\u8C03\u7528\u9047\u5230\u77AC\u6001\u9519\u8BEF\uFF08\u9650\u6D41\u30015xx\u3001\u7F51\u7EDC\uFF09\u65F6\u7684\u6700\u5927\u5C1D\u8BD5\u6B21\u6570\uFF0C\u91CD\u8BD5\u95F4\u9694\u9012\u589E\u3002", default: "5" },
+      // server — network-facing knobs; global-only since they alter how the
+      // server itself authenticates clients.
+      { key: "server.trust_proxy", type: "boolean", globalOnly: true, description: "Trust the x-forwarded-for header for client IP resolution (brute-force rate limiting). Enable ONLY when a reverse proxy you control sits in front and rewrites the header \u2014 otherwise clients can forge it to bypass lockouts.", description_zh: "\u4FE1\u4EFB x-forwarded-for \u8BF7\u6C42\u5934\u89E3\u6790\u5BA2\u6237\u7AEF IP\uFF08\u66B4\u529B\u7834\u89E3\u9650\u901F\u7528\uFF09\u3002\u4EC5\u5F53\u524D\u9762\u6709\u4F60\u63A7\u5236\u7684\u53CD\u5411\u4EE3\u7406\u5E76\u4F1A\u91CD\u5199\u8BE5\u5934\u65F6\u624D\u5F00\u542F\u2014\u2014\u5426\u5219\u5BA2\u6237\u7AEF\u53EF\u4F2A\u9020\u7ED5\u8FC7\u9501\u5B9A\u3002", default: "false" },
       // session
       { key: "session.max_queue_size", type: "int", description: "Maximum queued messages per session", description_zh: "\u6BCF\u4E2A\u4F1A\u8BDD\u6700\u5927\u6392\u961F\u6D88\u606F\u6570", default: "256" },
       { key: "session.max_nesting_depth", type: "int", description: "Maximum session nesting depth for agent delegation", description_zh: "Agent \u59D4\u6D3E\u7684\u6700\u5927\u4F1A\u8BDD\u5D4C\u5957\u6DF1\u5EA6", default: "16" },
@@ -207,22 +211,24 @@ function generalSection() {
       { key: "compact.max_summary_input", type: "int", description: "Max chars fed into local truncation fallback", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u7684\u603B\u8F93\u5165\u5B57\u7B26\u4E0A\u9650", default: "15000" },
       { key: "compact.max_message_slice", type: "int", description: "Max chars kept per old message during local truncation", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u6BCF\u6761\u65E7\u6D88\u606F\u4FDD\u7559\u7684\u6700\u5927\u5B57\u7B26\u6570", default: "800" },
       { key: "compact.summarize_timeout_sec", type: "int", description: "LLM summarization timeout (seconds)", description_zh: "LLM \u6458\u8981\u8D85\u65F6\u65F6\u95F4\uFF08\u79D2\uFF09", default: "300" },
-      // sandbox (Linux bwrap only)
-      { key: "sandbox.hidden_dirs", description: "Comma-separated dirs hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 bwrap tmpfs \u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker" },
-      { key: "sandbox.writable_dirs", description: "Comma-separated dirs bind-mounted read-write inside the bwrap sandbox (Linux only) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u5728 bwrap \u6C99\u7BB1\u5185\u4EE5\u53EF\u5199\u65B9\u5F0F\u6302\u8F7D\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
-      { key: "sandbox.hidden_files", description: "Comma-separated files hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 /dev/null bind \u9690\u85CF\u7684\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig" },
+      // sandbox (Linux bwrap only) — global-only: these define the security
+      // boundary agents run inside; a workspace overriding them could lift
+      // its own sandbox constraints.
+      { key: "sandbox.hidden_dirs", globalOnly: true, description: "Comma-separated dirs hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 bwrap tmpfs \u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs" },
+      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs bind-mounted read-write inside the bwrap sandbox (Linux only) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u5728 bwrap \u6C99\u7BB1\u5185\u4EE5\u53EF\u5199\u65B9\u5F0F\u6302\u8F7D\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
+      { key: "sandbox.hidden_files", globalOnly: true, description: "Comma-separated files hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 /dev/null bind \u9690\u85CF\u7684\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm" },
       // logging
       { key: "logging.level", type: "enum", options: ["debug", "info", "warn", "error"], description: "Log level", description_zh: "\u65E5\u5FD7\u7EA7\u522B", default: "warn" },
       // self-evolution (see plans/self-evolution.md). All evo settings are
       // global-only — the worker / ticker live in the server process and
       // would have to reload mid-flight if a workspace could override them.
-      { key: "evolution.level", type: "enum", options: ["L0", "L1"], globalOnly: true, description: "Self-evolution capability ladder. L0: manual only \u2014 drafts via /note, manual approve/reject. L1: L0 plus automatic drafting on pre-compact. (Queued runs always execute regardless of level; the level only gates how they get enqueued.)", description_zh: "\u81EA\u6211\u8FDB\u5316\u7B49\u7EA7\u3002L0\uFF1A\u4EC5\u624B\u52A8\u2014\u2014\u901A\u8FC7 /note \u8D77\u8349\uFF0C\u624B\u52A8 approve/reject\u3002L1\uFF1A\u5728 L0 \u57FA\u7840\u4E0A\uFF0C\u538B\u7F29\u524D\uFF08pre-compact\uFF09\u81EA\u52A8\u8D77\u8349\u3002\uFF08\u5DF2\u6392\u961F\u7684 run \u59CB\u7EC8\u6267\u884C\uFF0Clevel \u53EA\u51B3\u5B9A\u5982\u4F55\u5165\u961F\u3002\uFF09", default: "L0" },
+      { key: "evolution.level", type: "enum", options: ["L0", "L1"], globalOnly: true, description: "Self-evolution capability ladder. L0: manual only \u2014 drafts via /evo, manual approve/reject. L1: L0 plus automatic drafting on pre-compact. (Queued runs always execute regardless of level; the level only gates how they get enqueued.)", description_zh: "\u81EA\u6211\u8FDB\u5316\u7B49\u7EA7\u3002L0\uFF1A\u4EC5\u624B\u52A8\u2014\u2014\u901A\u8FC7 /evo \u8D77\u8349\uFF0C\u624B\u52A8 approve/reject\u3002L1\uFF1A\u5728 L0 \u57FA\u7840\u4E0A\uFF0C\u538B\u7F29\u524D\uFF08pre-compact\uFF09\u81EA\u52A8\u8D77\u8349\u3002\uFF08\u5DF2\u6392\u961F\u7684 run \u59CB\u7EC8\u6267\u884C\uFF0Clevel \u53EA\u51B3\u5B9A\u5982\u4F55\u5165\u961F\u3002\uFF09", default: "L0" },
       { key: "evolution.max_concurrent_run", type: "int", globalOnly: true, description: "Max concurrent evo run wrappers (drafting patches).", description_zh: "\u540C\u65F6\u8FD0\u884C\u7684 evo run wrapper \u4E0A\u9650\uFF08\u8D77\u8349 patch\uFF09\u3002", default: "1" },
       { key: "evolution.max_concurrent_apply", type: "int", globalOnly: true, description: "Max concurrent evo apply wrappers (merging patches).", description_zh: "\u540C\u65F6\u8FD0\u884C\u7684 evo apply wrapper \u4E0A\u9650\uFF08\u5408\u5E76 patch\uFF09\u3002", default: "1" },
-      { key: "evolution.run_timeout_minutes", type: "int", globalOnly: true, description: "Heartbeat timeout for run wrappers; older than this with status=running is marked timeout. Must exceed the wrapper per-phase cap (10min) so a healthy slow phase is never wrongly requeued.", description_zh: "run wrapper \u5FC3\u8DF3\u8D85\u65F6\uFF08\u5206\u949F\uFF09\uFF1B\u8D85\u8FC7\u4ECD\u6807 running \u7684\u8BB0\u5F55\u4F1A\u88AB\u6807 timeout\u3002\u987B\u5927\u4E8E wrapper \u5355\u9636\u6BB5\u4E0A\u9650\uFF0810 \u5206\u949F\uFF09\uFF0C\u5426\u5219\u6B63\u5E38\u7684\u6162\u9636\u6BB5\u4F1A\u88AB\u8BEF\u5224\u91CD\u6392\u3002", default: "12" },
+      { key: "evolution.run_timeout_minutes", type: "int", globalOnly: true, description: "Heartbeat timeout for run wrappers. The wrapper writes a heartbeat every 60s for as long as it lives, so exceeding this means the wrapper process died \u2014 the row is requeued (or marked timeout past max_attempts). This is dead-wrapper detection latency, NOT a budget for slow models; the per-phase model budget is the wrapper-internal 30min cap.", description_zh: "run wrapper \u5FC3\u8DF3\u8D85\u65F6\uFF08\u5206\u949F\uFF09\u3002wrapper \u5B58\u6D3B\u671F\u95F4\u6BCF 60 \u79D2\u5199\u4E00\u6B21\u5FC3\u8DF3\uFF0C\u8D85\u65F6\u5373\u89C6\u4E3A wrapper \u8FDB\u7A0B\u5DF2\u6B7B\uFF0C\u4EFB\u52A1\u91CD\u6392\uFF08\u8D85\u8FC7 max_attempts \u5219\u6807 timeout\uFF09\u3002\u8FD9\u662F\u6B7B wrapper \u7684\u68C0\u6D4B\u5EF6\u8FDF\uFF0C\u4E0D\u662F\u6162\u6A21\u578B\u7684\u8FD0\u884C\u9884\u7B97\u2014\u2014\u5355\u9636\u6BB5\u6A21\u578B\u9884\u7B97\u662F wrapper \u5185\u90E8\u7684 30 \u5206\u949F\u4E0A\u9650\u3002", default: "12" },
       { key: "evolution.apply_timeout_minutes", type: "int", globalOnly: true, description: "Heartbeat timeout for apply wrappers.", description_zh: "apply wrapper \u5FC3\u8DF3\u8D85\u65F6\uFF08\u5206\u949F\uFF09\u3002", default: "5" },
       { key: "evolution.max_attempts", type: "int", globalOnly: true, description: "How many times the ticker may try to spawn a wrapper for a single row before giving up. Stops infinite retry loops on permanently broken tasks.", description_zh: "ticker \u4E3A\u5355\u6761\u4EFB\u52A1\u5C1D\u8BD5\u62C9\u8D77 wrapper \u7684\u6700\u5927\u6B21\u6570\uFF0C\u8D85\u8FC7\u540E\u653E\u5F03\u3002\u907F\u514D\u574F\u4EFB\u52A1\u65E0\u9650\u91CD\u8BD5\u3002", default: "3" },
-      { key: "evolution.triggers.pre_compact", type: "boolean", globalOnly: true, description: "Snapshot the session right before compaction so evo can analyze it. /note is always available regardless of this setting.", description_zh: "\u5728 compact \u524D\u5FEB\u7167\u4F1A\u8BDD\u4F9B evo \u5206\u6790\u3002/note \u603B\u662F\u53EF\u7528\uFF0C\u4E0E\u6B64\u5F00\u5173\u65E0\u5173\u3002", default: "true" },
+      { key: "evolution.triggers.pre_compact", type: "boolean", globalOnly: true, description: "Snapshot the session right before compaction so evo can analyze it. /evo is always available regardless of this setting.", description_zh: "\u5728 compact \u524D\u5FEB\u7167\u4F1A\u8BDD\u4F9B evo \u5206\u6790\u3002/evo \u603B\u662F\u53EF\u7528\uFF0C\u4E0E\u6B64\u5F00\u5173\u65E0\u5173\u3002", default: "true" },
       // limits — runtime caps that protect against runaway tool output / UI
       // freezes. All read live from settings.yaml so changes take effect on
       // the next tool call without a server restart.
@@ -231,6 +237,7 @@ function generalSection() {
       { key: "limits.grep_default_matches", type: "int", globalOnly: true, description: "Default match cap for the grep tool when the call site does not pass an explicit `max`.", description_zh: "grep \u5DE5\u5177\u672A\u663E\u5F0F\u4F20 `max` \u53C2\u6570\u65F6\u7684\u9ED8\u8BA4\u5339\u914D\u4E0A\u9650\u3002", default: "50" },
       { key: "limits.tool_result_render_chars", type: "int", globalOnly: true, description: 'Per-tool-result cap on the content fed back to the LLM. Larger results are truncated (with a "[Content truncated]" marker telling the model to re-run with narrower scope) to protect the context window and prompt cache. The UI/admin chat panel shows a far larger slice \u2014 see tool_result_ui_chars.', description_zh: "\u6BCF\u6761 tool result \u56DE\u4F20\u7ED9 LLM \u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8D85\u51FA\u90E8\u5206\u4F1A\u88AB\u622A\u65AD\uFF08\u5E76\u9644 [Content truncated] \u6807\u8BB0\u63D0\u793A\u6A21\u578B\u7F29\u5C0F\u8303\u56F4\u91CD\u67E5\uFF09\uFF0C\u4EE5\u4FDD\u62A4\u4E0A\u4E0B\u6587\u7A97\u53E3\u548C\u63D0\u793A\u8BCD\u7F13\u5B58\u3002UI/admin \u804A\u5929\u9762\u677F\u5C55\u793A\u7684\u5185\u5BB9\u4E0A\u9650\u8981\u5927\u5F97\u591A\uFF0C\u89C1 tool_result_ui_chars\u3002", default: "8000" },
       { key: "limits.tool_result_ui_chars", type: "int", globalOnly: true, description: "Per-tool-result cap on the content stored for UI display (admin/web chat panel). Far larger than the LLM cap so the full output of a normal command stays visible, but bounded so a multi-MB `cat` does not bloat the session file, the WS payload, or the browser render. Output past this is truncated with a marker pointing at file_read for the complete content.", description_zh: "\u6BCF\u6761 tool result \u5B58\u7ED9 UI \u5C55\u793A\uFF08admin/web \u804A\u5929\u9762\u677F\uFF09\u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8FDC\u5927\u4E8E LLM \u4E0A\u9650\uFF0C\u4FDD\u8BC1\u666E\u901A\u547D\u4EE4\u7684\u5B8C\u6574\u8F93\u51FA\u90FD\u80FD\u770B\u5230\uFF1B\u4F46\u4ECD\u6709\u754C\uFF0C\u907F\u514D cat \u4E2A\u51E0 MB \u7684\u6587\u4EF6\u6491\u7206\u4F1A\u8BDD\u6587\u4EF6\u3001WS \u4F20\u8F93\u548C\u6D4F\u89C8\u5668\u6E32\u67D3\u3002\u8D85\u51FA\u90E8\u5206\u622A\u65AD\u5E76\u9644\u6807\u8BB0\uFF0C\u63D0\u793A\u7528 file_read \u770B\u5B8C\u6574\u5185\u5BB9\u3002", default: String(64 * 1024) },
+      { key: "limits.auto_report_chars", type: "int", globalOnly: true, description: "Cap on the auto-report a finished sub-agent delivers to its parent. Longer reports are truncated with a pointer to get_session_output for the full text.", description_zh: "\u5B50\u4F1A\u8BDD\u5B8C\u6210\u540E\u81EA\u52A8\u4E0A\u62A5\u7ED9\u7236\u4F1A\u8BDD\u7684\u5185\u5BB9\u957F\u5EA6\u4E0A\u9650\u3002\u8D85\u51FA\u622A\u65AD\uFF0C\u5E76\u63D0\u793A\u7528 get_session_output \u53D6\u5168\u6587\u3002", default: "8192" },
       { key: "limits.ws_event_buffer", type: "int", globalOnly: true, description: "Events buffered per detached WebSocket session before the oldest are dropped on reattach.", description_zh: "WebSocket \u4F1A\u8BDD\u5728\u65AD\u5F00\u671F\u95F4\u6700\u591A\u7F13\u5B58\u591A\u5C11\u4E8B\u4EF6\uFF0C\u8D85\u51FA\u540E\u4ECE\u6700\u65E9\u7684\u5F00\u59CB\u4E22\u3002", default: "5000" },
       { key: "limits.terminal_scrollback_bytes", type: "int", globalOnly: true, description: "Off-screen scrollback bytes retained per persistent terminal while detached.", description_zh: "\u7EC8\u7AEF\u65AD\u5F00\u671F\u95F4\u4FDD\u7559\u7684\u56DE\u6EDA\u7F13\u51B2\u5B57\u8282\u6570\u3002", default: "50000" }
     ].map((f) => ({ ...f, kind: "param" }))
@@ -716,7 +723,21 @@ var init_config = __esm({
         // Random base64 JWT signing key, set by `halo setup`. Empty = not set up.
         jwtSecret: systemString("HALO_JWT_SECRET", "server.jwt_secret", null),
         // Empty allowlist means "reflect any origin" (see CORS setup in index.ts).
-        corsOrigins: systemStringArray("HALO_CORS_ORIGINS", "server.cors_origins", [])
+        corsOrigins: systemStringArray("HALO_CORS_ORIGINS", "server.cors_origins", []),
+        /** Trust `x-forwarded-for` for client-IP resolution (brute-force
+         *  buckets). Off by default — the header is client-forgeable unless a
+         *  reverse proxy the operator controls rewrites it. */
+        get trustProxy() {
+          return settingsBool("general.server.trust_proxy", false);
+        },
+        /** `HALO_RUNTIME_MODE=agentcore` runs the server as an Amazon Bedrock
+         *  AgentCore Runtime container: auth is terminated upstream by AgentCore,
+         *  so password/JWT checks, channels, cron/evolution and the instance lock
+         *  are skipped, and the /ping + /invocations + WS /ws adapter is mounted
+         *  (see routes/agentcore.ts). Unset / any other value → normal server. */
+        runtimeMode: process.env.HALO_RUNTIME_MODE ?? null,
+        /** Workspace for agentcore mode. Env `HALO_WORKSPACE`, fallback cwd. */
+        agentcoreWorkspace: process.env.HALO_WORKSPACE ?? process.cwd()
       },
       // `model.compressAt` is intentionally a getter — it reads from
       // settings.yaml (`general.compact.compress_at`) on every access so a
@@ -820,8 +841,8 @@ var init_config = __esm({
         maxNestingDepth: settingsInt("general.session.max_nesting_depth", 16)
       },
       sandbox: {
-        hiddenDirs: settingsStr("general.sandbox.hidden_dirs", "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker").split(",").map((s) => s.trim()).filter(Boolean),
-        hiddenFiles: settingsStr("general.sandbox.hidden_files", "~/.npmrc,~/.bash_history,~/.gitconfig").split(",").map((s) => s.trim()).filter(Boolean),
+        hiddenDirs: settingsStr("general.sandbox.hidden_dirs", "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs").split(",").map((s) => s.trim()).filter(Boolean),
+        hiddenFiles: settingsStr("general.sandbox.hidden_files", "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm").split(",").map((s) => s.trim()).filter(Boolean),
         writableDirs: settingsStr("general.sandbox.writable_dirs", "").split(",").map((s) => s.trim()).filter(Boolean)
       },
       logging: {
@@ -870,8 +891,8 @@ var init_config = __esm({
         }
       }
     };
-    HIDDEN_DIRS_DEFAULT = "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker";
-    HIDDEN_FILES_DEFAULT = "~/.npmrc,~/.bash_history,~/.gitconfig";
+    HIDDEN_DIRS_DEFAULT = "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs";
+    HIDDEN_FILES_DEFAULT = "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm";
   }
 });
 
@@ -1848,11 +1869,11 @@ function copyTemplate(srcAbs, dstAbs) {
   const content = fs6.readFileSync(srcAbs, "utf-8");
   fs6.writeFileSync(dstAbs, content, "utf-8");
 }
-function writeIfMissing(filePath, content) {
+function writeIfMissing(filePath, content, mode) {
   if (fs6.existsSync(filePath))
     return;
   fs6.mkdirSync(path6.dirname(filePath), { recursive: true });
-  fs6.writeFileSync(filePath, content, "utf-8");
+  fs6.writeFileSync(filePath, content, mode === void 0 ? { encoding: "utf-8" } : { encoding: "utf-8", mode });
   console.log(`[Init] Created ${filePath}`);
 }
 function mergeAgentYaml(srcAbs, dstAbs) {
@@ -1969,7 +1990,7 @@ function forceCopyDir(srcDir, dstDir) {
 function migrateSecrets(haloHome2) {
   const globalDir2 = path6.join(haloHome2, "global");
   const secretsDir = path6.join(haloHome2, "secrets");
-  fs6.mkdirSync(secretsDir, { recursive: true });
+  fs6.mkdirSync(secretsDir, { recursive: true, mode: 448 });
   const fileMoves = [
     [path6.join(globalDir2, "settings.yaml"), path6.join(secretsDir, "settings.yaml")],
     [path6.join(globalDir2, "config.yaml"), path6.join(secretsDir, "config.yaml")]
@@ -2045,7 +2066,11 @@ function ensureHaloHome(haloHome2) {
   const globalDir2 = path6.join(haloHome2, "global");
   const secretsDir = path6.join(haloHome2, "secrets");
   fs6.mkdirSync(globalDir2, { recursive: true });
-  fs6.mkdirSync(secretsDir, { recursive: true });
+  fs6.mkdirSync(secretsDir, { recursive: true, mode: 448 });
+  try {
+    fs6.chmodSync(secretsDir, 448);
+  } catch {
+  }
   migrateSecrets(haloHome2);
   const versionPath = path6.join(globalDir2, VERSION_FILE);
   let existingVersion = 0;
@@ -2098,7 +2123,7 @@ function ensureHaloHome(haloHome2) {
     }
   }
   mergeConfigYaml(path6.join(TEMPLATES_DIR, "config.yaml"), path6.join(secretsDir, "config.yaml"));
-  writeIfMissing(path6.join(secretsDir, "settings.yaml"), "");
+  writeIfMissing(path6.join(secretsDir, "settings.yaml"), "", 384);
   const aliasesSrc = path6.join(TEMPLATES_DIR, "aliases.yaml");
   if (fs6.existsSync(aliasesSrc)) {
     writeIfMissing(path6.join(globalDir2, "aliases.yaml"), fs6.readFileSync(aliasesSrc, "utf-8"));
@@ -2511,7 +2536,8 @@ function buildSessionTools(sm, sessionId) {
         agent_id: { type: "string", description: "The agent ID \u2014 must be one of the agents listed in your system prompt. Do not invent ids." },
         message: { type: "string", description: "Task description / initial message for the agent" },
         system_prompt_context: { type: "string", description: "Optional background material prepended to the opening message BEFORE your task text \u2014 despite the name, it is NOT injected into the system prompt. Put here what frames the whole task: relevant file paths, prior findings, user-stated constraints, role framing. Keep one-shot task instructions in `message` itself so it stays a clean task statement. Note the cost: this text lives in the child's conversation history and is re-sent on every one of its model calls until compaction \u2014 include what the child genuinely needs throughout, not bulk material it could read from files instead." },
-        working_dir: { type: "string", description: "Optional focus directory for the sub-agent (workspace-relative or absolute; must be inside the workspace). The platform bakes the directory-scoped INSTRUCTIONS.md found along the path from the workspace root down to this directory into the sub-agent's system prompt (present every turn), and tags its prompt with this focus. Does NOT change where tools run (shell/file tools still operate from the project root). Omit for project-root scope." }
+        working_dir: { type: "string", description: "Optional focus directory for the sub-agent (workspace-relative or absolute; must be inside the workspace). The platform bakes the directory-scoped INSTRUCTIONS.md found along the path from the workspace root down to this directory into the sub-agent's system prompt (present every turn), and tags its prompt with this focus. Does NOT change where tools run (shell/file tools still operate from the project root). Omit for project-root scope." },
+        title: { type: "string", description: "Optional session title shown in the admin sidebar. When omitted, auto-generated from the task message." }
       },
       required: ["agent_id", "message"]
     },
@@ -2548,7 +2574,7 @@ function buildSessionTools(sm, sessionId) {
       const displayName = agentYaml.name ?? params.agent_id;
       const parentSession = sm.sessions.get(sessionId);
       const inheritedAccessLevel = parentSession?.accessLevel ?? null;
-      const childSessionId = await sm.createSession(params.agent_id, sessionId, params.message.slice(0, 200), displayName, void 0, resolvedWorkingDir, inheritedAccessLevel);
+      const childSessionId = await sm.createSession(params.agent_id, sessionId, params.message.slice(0, 200), displayName, void 0, resolvedWorkingDir, inheritedAccessLevel, params.title);
       let initialMessage = `[Session ${childSessionId}]
 
 `;
@@ -6330,11 +6356,23 @@ function assertPathAllowed(filePath, opts, write = false) {
     }
     return resolved;
   }
-  if (!write && (resolved === GLOBAL_DIR || resolved.startsWith(GLOBAL_DIR + "/"))) {
+  if (!write && (resolved === GLOBAL_DIR || resolved.startsWith(GLOBAL_DIR + "/")) && !isHiddenGlobalPath(resolved)) {
     return resolved;
   }
   throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
 }
+function isHiddenGlobalPath(resolved) {
+  for (const raw of _hiddenFiles) {
+    if (resolved === expandTilde(raw))
+      return true;
+  }
+  for (const raw of _hiddenDirs) {
+    const dir = expandTilde(raw);
+    if (resolved === dir || resolved.startsWith(dir + "/"))
+      return true;
+  }
+  return false;
+}
 function buildExecScriptArgs(workspaceRoot, command) {
   return ["bash", "-c", `cd "$1" && shift && ${command}`, "bash", workspaceRoot];
 }
@@ -6554,12 +6592,32 @@ var init_sandbox = __esm({
       "~/.aws",
       "~/.ssh",
       "~/.gnupg",
-      "~/.docker"
+      "~/.docker",
+      "~/.config/gh",
+      // Cross-workspace state under ~/.halo/global — internal-agent session
+      // transcripts and server/cron logs would leak other workspaces' activity
+      // to a workspace/readonly session (global/ is readable by design for
+      // skills/agents/prompts, so the sensitive subtrees are hidden explicitly).
+      "~/.halo/global/internal-sessions",
+      "~/.halo/global/logs"
     ];
     DEFAULT_HIDDEN_FILES = [
       "~/.npmrc",
       "~/.bash_history",
-      "~/.gitconfig"
+      "~/.gitconfig",
+      // Halo's own git-credential store (git-credentials.ts writes tokens here
+      // in plaintext) — must be hidden like ~/.aws & co.
+      "~/.git-credentials",
+      "~/.netrc",
+      // Global evolution / cron databases (plus sqlite WAL/SHM sidecars) carry
+      // cross-workspace prompts, run history and channel targets — hidden from
+      // workspace/readonly sessions like the dirs above.
+      "~/.halo/global/evo.db",
+      "~/.halo/global/evo.db-wal",
+      "~/.halo/global/evo.db-shm",
+      "~/.halo/global/cron.db",
+      "~/.halo/global/cron.db-wal",
+      "~/.halo/global/cron.db-shm"
     ];
     _hiddenDirs = DEFAULT_HIDDEN_DIRS;
     _hiddenFiles = DEFAULT_HIDDEN_FILES;
@@ -6762,6 +6820,13 @@ async function substituteSecrets(cmd, workspaceRoot, allowedNamespaces) {
     return { cmd, secrets: [] };
   const secrets = [];
   const settings = await loadMergedSettings(workspaceRoot);
+  const declaredSecretParams = /* @__PURE__ */ new Set();
+  for (const section of loadSettingsSchema(workspaceRoot)) {
+    for (const f of section.fields) {
+      if (f.kind === "param" && f.secret === true)
+        declaredSecretParams.add(`${section.namespaceId}.${f.key}`);
+    }
+  }
   const result = cmd.replace(PARAMS_PATTERN, (_match, namespace, dotted) => {
     if (allowedNamespaces && !allowedNamespaces.has(namespace)) {
       console.log(`[workspace-tools] {{${namespace}.params.${dotted}}} rejected \u2014 namespace not in allowed list`);
@@ -6795,7 +6860,7 @@ async function substituteSecrets(cmd, workspaceRoot, allowedNamespaces) {
       envInjected = true;
       return val;
     });
-    if (envInjected && expanded !== "")
+    if ((envInjected || declaredSecretParams.has(`${namespace}.${dotted}`)) && expanded !== "")
       secrets.push(expanded);
     return expanded;
   });
@@ -7344,6 +7409,7 @@ var init_workspace_tools = __esm({
     init_config();
     init_sandbox();
     init_md_vars();
+    init_settings_schema();
     init_media_store();
     init_agent_loop();
     SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", "dist", ".halo"]);
@@ -8810,7 +8876,7 @@ var init_session_manager = __esm({
        * Create a new session. Inserts metadata into SQLite, builds agent, stores in-memory.
        * @param explicitId - Optional explicit session ID (for unifying frontend sessionId with agent sessionId)
        */
-      async createSession(agentId, parentId, description, agentName, explicitId, workingDir, accessLevel = null) {
+      async createSession(agentId, parentId, description, agentName, explicitId, workingDir, accessLevel = null, title) {
         const segment = generateSessionId();
         const sessionId = explicitId ?? (parentId ? `${parentId}>${segment}` : segment);
         const now = Date.now();
@@ -8827,6 +8893,15 @@ var init_session_manager = __esm({
           createdAt: now,
           updatedAt: now
         }).run();
+        if (title) {
+          try {
+            const dir = this.sessionDir(agentId);
+            fsSync6.mkdirSync(dir, { recursive: true });
+            atomicWriteSessionFile(path20.join(dir, `${fileSegment(sessionId)}.json`), JSON.stringify({ id: sessionId, agentId, title, createdAt: new Date(now).toISOString() }, null, 2));
+          } catch (err) {
+            console.warn(`[SessionManager] Failed to pre-seed title for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
         const createdImageOverride = createdYaml?.model?.image;
         const session = this.createAgentSession(sessionId, parentId, agentId, resolvedAgentName, agent, description, contextConfig, modelId, systemPrompt, thinkingEffort, workingDir ?? null, accessLevel, meta, createdImageOverride, draftReset);
         this.sessions.set(sessionId, session);
@@ -10415,22 +10490,22 @@ function expandAlias(command, arg) {
   }
   return { command: cmd, arg: a };
 }
-function findActiveSessionId(sm, userId, sessionPrefix2, activeOverrides, accessLevel) {
-  const override = activeOverrides.get(userId);
+function findActiveSessionId(sm, userId, sessionPrefix2, activeOverrides2, accessLevel) {
+  const override = activeOverrides2.get(userId);
   if (override && accessLevel === "full") {
     if (sm.getSessionById(override))
       return override;
-    activeOverrides.delete(userId);
+    activeOverrides2.delete(userId);
     return null;
   }
   if (override && override.startsWith(sessionPrefix2)) {
     if (sm.getSessionById(override))
       return override;
-    activeOverrides.delete(userId);
+    activeOverrides2.delete(userId);
   }
   const latest = sm.findLatestByPrefix(sessionPrefix2);
   if (!latest) {
-    activeOverrides.delete(userId);
+    activeOverrides2.delete(userId);
     return null;
   }
   return latest.id;
@@ -10542,7 +10617,7 @@ async function execNew(ctx) {
 }
 function visibleSessions(ctx) {
   const { sessions: sessions2 } = ctx.sm.listSessions(ctx.accessLevel === "full" ? { rootOnly: true, limit: CHANNEL_LIST_LIMIT } : { rootOnly: true, prefix: ctx.sessionPrefix, limit: CHANNEL_LIST_LIMIT });
-  return sessions2;
+  return sessions2.sort((a, b) => b.createdAt - a.createdAt);
 }
 function execList(ctx) {
   const sessions2 = visibleSessions(ctx);
@@ -11118,7 +11193,7 @@ async function createHarness(opts) {
   const lang = opts.lang ?? "en";
   const agentId = opts.agentId ?? "default";
   const accessLevel = !opts.accessLevel || opts.accessLevel === "full" ? null : opts.accessLevel;
-  const activeOverrides = /* @__PURE__ */ new Map();
+  const activeOverrides2 = /* @__PURE__ */ new Map();
   async function bindWorkspace(workspace, requestedSessionId, newSession = false) {
     const sm = registry2.getOrCreate(workspace);
     let sessionId;
@@ -11132,7 +11207,7 @@ async function createHarness(opts) {
       await sm.createSession(agentId, null, "CLI", agentId, newId, void 0, accessLevel);
       sessionId = newId;
     } else {
-      const existing = findActiveSessionId(sm, USER_ID, SESSION_PREFIX, activeOverrides, opts.accessLevel ?? "full");
+      const existing = findActiveSessionId(sm, USER_ID, SESSION_PREFIX, activeOverrides2, opts.accessLevel ?? "full");
       if (existing) {
         sessionId = existing;
       } else {
@@ -11141,7 +11216,7 @@ async function createHarness(opts) {
         sessionId = newId;
       }
     }
-    activeOverrides.set(USER_ID, sessionId);
+    activeOverrides2.set(USER_ID, sessionId);
     const disabledSet = getDisabledSet(sm.getDb(), "agent");
     const agents = await scanAvailableAgents(workspace, disabledSet);
     const agentEntry = agents.find((a) => a.id === agentId);
@@ -11169,7 +11244,7 @@ async function createHarness(opts) {
       sessionPrefix: SESSION_PREFIX,
       accessLevel: opts.accessLevel ?? "full",
       channelLabel: "CLI",
-      activeOverrides,
+      activeOverrides: activeOverrides2,
       workspacePath: state.workspace,
       lang
     };
@@ -11211,7 +11286,7 @@ async function createHarness(opts) {
   async function command(cmd, arg) {
     const result = await dispatchCommand(buildCommandContext(), cmd, arg, { channelName: "cli" });
     if (result?.switchTo) {
-      activeOverrides.set(USER_ID, result.switchTo);
+      activeOverrides2.set(USER_ID, result.switchTo);
       state.unsubPersistent();
       state = {
         ...state,
@@ -11287,7 +11362,7 @@ async function createHarness(opts) {
       throw new Error(`Workspace does not exist: ${resolved}`);
     }
     state.unsubPersistent();
-    activeOverrides.delete(USER_ID);
+    activeOverrides2.delete(USER_ID);
     state = await bindWorkspace(resolved);
   }
   return {
@@ -11372,8 +11447,14 @@ async function verifyPassword(plain, stored) {
     return false;
   const salt = Buffer.from(saltB64, "base64");
   const expected = Buffer.from(hashB64, "base64");
-  const actual = await scryptAsync(plain, salt, expected.length, { N, r, p });
-  return crypto2.timingSafeEqual(actual, expected);
+  if (expected.length !== KEY_LEN)
+    return false;
+  try {
+    const actual = await scryptAsync(plain, salt, expected.length, { N, r, p });
+    return crypto2.timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
 }
 function generateJwtSecret() {
   return crypto2.randomBytes(32).toString("base64");
@@ -11523,12 +11604,17 @@ var init_setup_settings = __esm({
 // packages/server/dist/setup-providers.js
 var setup_providers_exports = {};
 __export(setup_providers_exports, {
+  AWS_CREDENTIAL_CHAIN_PROVIDER: () => AWS_CREDENTIAL_CHAIN_PROVIDER,
+  bindBuiltinAgentsToProvider: () => bindBuiltinAgentsToProvider,
+  listConfiguredSwitchableProviders: () => listConfiguredSwitchableProviders,
   listModelProviders: () => listModelProviders,
   listOptionalSkills: () => listOptionalSkills,
-  listRequiredSkillsWithSecrets: () => listRequiredSkillsWithSecrets
+  listRequiredSkillsWithSecrets: () => listRequiredSkillsWithSecrets,
+  readDefaultAgentProvider: () => readDefaultAgentProvider
 });
 import fs22 from "node:fs";
 import path26 from "node:path";
+import { homedir as homedir14 } from "node:os";
 import YAML9 from "yaml";
 function readYamlFile2(filePath) {
   if (!fs22.existsSync(filePath))
@@ -11617,6 +11703,69 @@ function listOptionalSkills() {
   }
   return out.sort((a, b) => a.id.localeCompare(b.id));
 }
+function listConfiguredSwitchableProviders() {
+  return listModelProviders().filter((p) => {
+    if (p.id === AWS_CREDENTIAL_CHAIN_PROVIDER)
+      return false;
+    return p.fields.some((f) => {
+      const v = readSetting(`${p.id}.secrets.${f.key}`);
+      return v != null && v.length > 0;
+    });
+  });
+}
+function readDefaultAgentProvider() {
+  const data = readYamlFile2(path26.join(GLOBAL_AGENTS_DIR3, "default", "agent.yaml"));
+  const provider = data?.model && typeof data.model === "object" ? data.model.provider : void 0;
+  return typeof provider === "string" && provider.length > 0 ? provider : void 0;
+}
+function buildTemplateModelBlock(providerId) {
+  const data = readYamlFile2(path26.join(TEMPLATES_DIR, "models", `${providerId}.yaml`));
+  if (!data || typeof data !== "object")
+    return null;
+  const models = Array.isArray(data.models) ? data.models : [];
+  const modelId = (typeof data.defaultModelId === "string" ? data.defaultModelId : void 0) ?? (models[0] ? models[0].id : void 0);
+  const endpoint = typeof data.defaultEndpoint === "string" ? data.defaultEndpoint : void 0;
+  const model = models.find((m) => m.id === modelId);
+  const caps = model?.capabilities ?? {};
+  const promptCaching = caps.promptCaching?.default;
+  const thinkingCap = caps.thinking;
+  const block = { provider: providerId };
+  if (modelId)
+    block.id = modelId;
+  if (endpoint)
+    block.endpoint = endpoint;
+  if (promptCaching)
+    block.promptCaching = promptCaching;
+  if (thinkingCap?.defaultEnabled) {
+    const thinking = { enabled: true };
+    if (thinkingCap.default)
+      thinking.effort = thinkingCap.default;
+    if (thinkingCap.defaultBudgetTokens != null)
+      thinking.budget_tokens = thinkingCap.defaultBudgetTokens;
+    block.thinking = thinking;
+  }
+  return block;
+}
+function bindBuiltinAgentsToProvider(providerId) {
+  const block = buildTemplateModelBlock(providerId);
+  if (!block)
+    return null;
+  const agents = [];
+  for (const id of REBIND_BUILTIN_AGENT_IDS) {
+    const yamlPath = path26.join(GLOBAL_AGENTS_DIR3, id, "agent.yaml");
+    if (!fs22.existsSync(yamlPath))
+      continue;
+    try {
+      const doc = YAML9.parseDocument(fs22.readFileSync(yamlPath, "utf-8"));
+      doc.set("model", block);
+      fs22.writeFileSync(yamlPath, doc.toString(), "utf-8");
+      agents.push(id);
+    } catch {
+    }
+  }
+  writeSetting("general.agent.default_provider", providerId);
+  return { modelId: typeof block.id === "string" ? block.id : void 0, agents };
+}
 function listRequiredSkillsWithSecrets() {
   const dir = path26.join(TEMPLATES_DIR, "skills");
   if (!fs22.existsSync(dir))
@@ -11656,10 +11805,62 @@ function listRequiredSkillsWithSecrets() {
   }
   return out.sort((a, b) => a.id.localeCompare(b.id));
 }
+var AWS_CREDENTIAL_CHAIN_PROVIDER, REBIND_BUILTIN_AGENT_IDS, GLOBAL_AGENTS_DIR3;
 var init_setup_providers = __esm({
   "packages/server/dist/setup-providers.js"() {
     "use strict";
     init_init();
+    init_setup_settings();
+    AWS_CREDENTIAL_CHAIN_PROVIDER = "aws-bedrock-claude-invoke";
+    REBIND_BUILTIN_AGENT_IDS = ["default", "executor", "deep-executor"];
+    GLOBAL_AGENTS_DIR3 = path26.join(homedir14(), ".halo", "global", "agents");
+  }
+});
+
+// packages/cli/src/setup-bind-provider.ts
+var setup_bind_provider_exports = {};
+__export(setup_bind_provider_exports, {
+  AWS_CHAIN_PROVIDER: () => AWS_CHAIN_PROVIDER,
+  KEEP_CURRENT: () => KEEP_CURRENT,
+  buildBindProviderPlan: () => buildBindProviderPlan
+});
+function buildBindProviderPlan(configured, currentProvider, currentProviderHasKeys) {
+  if (configured.length === 0) return null;
+  const current = currentProvider ?? AWS_CHAIN_PROVIDER;
+  if (configured.some((p) => p.id === current)) return null;
+  const currentIsAwsChain = current === AWS_CHAIN_PROVIDER;
+  const intro = [
+    `Default agent model provider: ${current}${currentIsAwsChain ? " (works with zero keys via the AWS credential chain: env / ~/.aws / EC2-ECS machine role)" : ""}`
+  ];
+  if (currentIsAwsChain) {
+    intro.push('If you rely on AWS credentials / a machine role for Bedrock access, choose "Keep" to stay on Bedrock.');
+  }
+  const options = [
+    ...configured.map((p) => ({
+      value: p.id,
+      label: `Switch default agent to ${p.displayName}`,
+      hint: `(${p.id})`
+    })),
+    {
+      value: KEEP_CURRENT,
+      label: `Keep ${current}`,
+      hint: currentIsAwsChain ? "(AWS credential chain / machine role)" : ""
+    }
+  ];
+  const initialIndex = configured.length === 1 && !currentProviderHasKeys ? 0 : options.length - 1;
+  return {
+    intro,
+    question: "Bind the default agent to a provider you just configured?",
+    options,
+    initialIndex
+  };
+}
+var AWS_CHAIN_PROVIDER, KEEP_CURRENT;
+var init_setup_bind_provider = __esm({
+  "packages/cli/src/setup-bind-provider.ts"() {
+    "use strict";
+    AWS_CHAIN_PROVIDER = "aws-bedrock-claude-invoke";
+    KEEP_CURRENT = "__keep__";
   }
 });
 
@@ -12472,7 +12673,7 @@ function scanCandidates(partial, workspace, kind) {
 function applyPathPick(value, ref, pick) {
   let markerStart = ref.pathStart - 1;
   if (value[markerStart - 1] === '"') markerStart -= 1;
-  const explicitMatch = value.slice(0, markerStart + 1).match(/@(file|image|scope)\s+$/);
+  const explicitMatch = value.slice(0, markerStart + 1).match(/@(file|image|scope)\s+"?$/);
   if (explicitMatch) markerStart = explicitMatch.index ?? markerStart;
   else {
     markerStart = ref.pathStart - 1 - (value[ref.pathStart - 1] === '"' ? 1 : 0);
@@ -12480,8 +12681,8 @@ function applyPathPick(value, ref, pick) {
   const before = value.slice(0, markerStart);
   const kind = ref.kind === "scope" ? "scope" : ref.kind === "image" ? "image" : pick.isImage ? "image" : "file";
   const needsQuote = pick.insertPath.includes(" ");
-  const path62 = pick.isDir ? needsQuote ? `"${pick.insertPath}/` : `${pick.insertPath}/` : needsQuote ? `"${pick.insertPath}" ` : `${pick.insertPath} `;
-  return `${before}@${kind} ${path62}`;
+  const path63 = pick.isDir ? needsQuote ? `"${pick.insertPath}/` : `${pick.insertPath}/` : needsQuote ? `"${pick.insertPath}" ` : `${pick.insertPath} `;
+  return `${before}@${kind} ${path63}`;
 }
 var IMAGE_EXTS2;
 var init_path_suggest_engine = __esm({
@@ -13961,7 +14162,8 @@ var init_cli = __esm({
 
 // packages/core/dist/workspace/workspace.js
 import { readFile, writeFile, mkdir, readdir, access } from "node:fs/promises";
-import { resolve, relative, join, isAbsolute } from "node:path";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { resolve, relative, join, isAbsolute, sep } from "node:path";
 var WorkspaceError, SKIP_DIRS2, Workspace;
 var init_workspace = __esm({
   "packages/core/dist/workspace/workspace.js"() {
@@ -14000,12 +14202,12 @@ None yet.
         }
         console.log(`[Workspace] Initialized workspace: ${this.projectRoot}`);
       }
-      async readFile(path62) {
-        const fullPath = this.validatePath(path62);
+      async readFile(path63) {
+        const fullPath = this.validatePath(path63);
         return readFile(fullPath, "utf-8");
       }
-      async writeFile(path62, content) {
-        const fullPath = this.validatePath(path62);
+      async writeFile(path63, content) {
+        const fullPath = this.validatePath(path63);
         const dir = resolve(fullPath, "..");
         await mkdir(dir, { recursive: true });
         await writeFile(fullPath, content, "utf-8");
@@ -14025,19 +14227,30 @@ None yet.
         }
         return results;
       }
-      async fileExists(path62) {
+      async fileExists(path63) {
         try {
-          const fullPath = this.validatePath(path62);
+          const fullPath = this.validatePath(path63);
           await access(fullPath);
           return true;
         } catch {
           return false;
         }
       }
-      validatePath(path62) {
-        const fullPath = isAbsolute(path62) ? resolve(path62) : resolve(this.projectRoot, path62);
-        if (!fullPath.startsWith(this.projectRoot)) {
-          throw new WorkspaceError(`Path "${path62}" is outside the workspace directory "${this.projectRoot}"`);
+      validatePath(path63) {
+        const fullPath = isAbsolute(path63) ? resolve(path63) : resolve(this.projectRoot, path63);
+        const root = resolve(this.projectRoot);
+        if (fullPath !== root && !fullPath.startsWith(root + sep)) {
+          throw new WorkspaceError(`Path "${path63}" is outside the workspace directory "${this.projectRoot}"`);
+        }
+        try {
+          const real = realpathSync2(fullPath);
+          const realRoot = realpathSync2(root);
+          if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+            throw new WorkspaceError(`Path "${path63}" is outside the workspace directory "${this.projectRoot}"`);
+          }
+        } catch (err) {
+          if (err instanceof WorkspaceError)
+            throw err;
         }
         return fullPath;
       }
@@ -14146,10 +14359,10 @@ var init_git_manager = __esm({
           throw new GitManagerError(`Failed to commit: ${message2}`);
         }
       }
-      async getDiff(path62) {
+      async getDiff(path63) {
         try {
-          if (path62) {
-            return await this.git.diff(["HEAD", "--", path62]);
+          if (path63) {
+            return await this.git.diff(["HEAD", "--", path63]);
           }
           return await this.git.diff(["HEAD"]);
         } catch {
@@ -14225,6 +14438,7 @@ var init_git_manager = __esm({
             "--name-status",
             "-r",
             "-m",
+            "-M",
             "--root",
             hash
           ]);
@@ -14237,12 +14451,12 @@ var init_git_manager = __esm({
             const code = parts[0];
             const status = code[0];
             const isRenameOrCopy = status === "R" || status === "C";
-            const path62 = isRenameOrCopy ? parts[2] : parts[1];
-            if (!path62 || seen.has(path62))
+            const path63 = isRenameOrCopy ? parts[2] : parts[1];
+            if (!path63 || seen.has(path63))
               continue;
-            seen.add(path62);
+            seen.add(path63);
             files.push({
-              path: path62,
+              path: path63,
               status,
               from: isRenameOrCopy ? parts[1] : void 0
             });
@@ -14390,9 +14604,9 @@ var init_git_manager = __esm({
        *  empty for an added file or the root commit) and `modified` is the version
        *  at `commit` (empty for a deletion). The working-tree/staged path above is
        *  left entirely untouched (commit === undefined preserves existing behavior). */
-      async getFileDiff(path62, staged, from, commit) {
+      async getFileDiff(path63, staged, from, commit) {
         if (commit) {
-          const parentPath = from || path62;
+          const parentPath = from || path63;
           let original2 = "";
           try {
             original2 = await this.git.show([`${commit}^:${parentPath}`]);
@@ -14401,13 +14615,13 @@ var init_git_manager = __esm({
           }
           let modified2 = "";
           try {
-            modified2 = await this.git.show([`${commit}:${path62}`]);
+            modified2 = await this.git.show([`${commit}:${path63}`]);
           } catch {
             modified2 = "";
           }
           return { original: original2, modified: modified2 };
         }
-        const headPath = from || path62;
+        const headPath = from || path63;
         let original = "";
         try {
           original = await this.git.show([`HEAD:${headPath}`]);
@@ -14417,13 +14631,13 @@ var init_git_manager = __esm({
         let modified = "";
         if (staged) {
           try {
-            modified = await this.git.show([`:${path62}`]);
+            modified = await this.git.show([`:${path63}`]);
           } catch {
             modified = "";
           }
         } else {
           try {
-            modified = await this.workspace.readFile(path62);
+            modified = await this.workspace.readFile(path63);
           } catch {
             modified = "";
           }
@@ -14480,7 +14694,7 @@ import fs27 from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { Readable } from "node:stream";
 import path32 from "node:path";
-import { homedir as homedir14 } from "node:os";
+import { homedir as homedir15 } from "node:os";
 function createFileRoutes() {
   const app2 = new Hono();
   async function resolveProjectPath(projectId) {
@@ -15025,7 +15239,7 @@ function createFileRoutes() {
     }
   });
   app2.get("/fs/home", (c) => {
-    return c.json({ home: homedir14() });
+    return c.json({ home: homedir15() });
   });
   app2.post("/fs/workspace/resolve", async (c) => {
     const body = await c.req.json();
@@ -15051,7 +15265,7 @@ function createFileRoutes() {
     }
   });
   app2.get("/fs/browse", async (c) => {
-    const target = c.req.query("path") ?? homedir14();
+    const target = c.req.query("path") ?? homedir15();
     if (!path32.isAbsolute(target))
       return c.json({ error: "absolute path required" }, 400);
     try {
@@ -15076,7 +15290,7 @@ var init_files = __esm({
 // packages/server/dist/git-credentials.js
 import fs28 from "node:fs";
 import path33 from "node:path";
-import { homedir as homedir15 } from "node:os";
+import { homedir as homedir16 } from "node:os";
 import { spawnSync } from "node:child_process";
 function writeGitCredentialsFile(host, username, token) {
   const line = `https://${encodeURIComponent(username)}:${encodeURIComponent(token)}@${host}`;
@@ -15150,7 +15364,7 @@ var GIT_CREDENTIALS_PATH;
 var init_git_credentials = __esm({
   "packages/server/dist/git-credentials.js"() {
     "use strict";
-    GIT_CREDENTIALS_PATH = path33.join(homedir15(), ".git-credentials");
+    GIT_CREDENTIALS_PATH = path33.join(homedir16(), ".git-credentials");
   }
 });
 
@@ -15711,7 +15925,7 @@ var init_git = __esm({
 import { Hono as Hono3 } from "hono";
 import fs31 from "node:fs/promises";
 import path36 from "node:path";
-import { homedir as homedir16 } from "node:os";
+import { homedir as homedir17 } from "node:os";
 import YAML10 from "yaml";
 function getAvailableTools() {
   if (_cachedTools)
@@ -15872,9 +16086,9 @@ function createAgentConfigRoutes() {
     return c.json(getModelsRegistry());
   });
   app2.get("/agent-configs", async (c) => {
-    await ensureDir2(GLOBAL_AGENTS_DIR3);
-    await ensureDefaultAgent(GLOBAL_AGENTS_DIR3);
-    const globalAgents = await scanAgentsDir(GLOBAL_AGENTS_DIR3, "global");
+    await ensureDir2(GLOBAL_AGENTS_DIR4);
+    await ensureDefaultAgent(GLOBAL_AGENTS_DIR4);
+    const globalAgents = await scanAgentsDir(GLOBAL_AGENTS_DIR4, "global");
     const projectId = c.req.query("projectId");
     let workspaceAgents = [];
     if (projectId) {
@@ -15912,7 +16126,7 @@ function createAgentConfigRoutes() {
         return c.json({ error: "projectId required for workspace agents" }, 400);
       baseDir = path36.join(body.projectId, ".halo", "agents");
     } else {
-      baseDir = GLOBAL_AGENTS_DIR3;
+      baseDir = GLOBAL_AGENTS_DIR4;
     }
     const agentDir = path36.join(baseDir, id);
     try {
@@ -15923,7 +16137,7 @@ function createAgentConfigRoutes() {
     let conflictScope = null;
     if (scope === "workspace") {
       try {
-        await fs31.access(path36.join(GLOBAL_AGENTS_DIR3, id));
+        await fs31.access(path36.join(GLOBAL_AGENTS_DIR4, id));
         conflictScope = "global";
       } catch {
       }
@@ -15952,7 +16166,7 @@ ${body.description ?? ""}
     if (scope === "workspace" && projectId) {
       agentDir = path36.join(projectId, ".halo", "agents", id);
     } else {
-      agentDir = path36.join(GLOBAL_AGENTS_DIR3, id);
+      agentDir = path36.join(GLOBAL_AGENTS_DIR4, id);
     }
     const yamlPath = path36.join(agentDir, "agent.yaml");
     try {
@@ -15975,7 +16189,7 @@ ${body.description ?? ""}
     if (scope === "workspace" && body.projectId) {
       agentDir = path36.join(body.projectId, ".halo", "agents", id);
     } else {
-      agentDir = path36.join(GLOBAL_AGENTS_DIR3, id);
+      agentDir = path36.join(GLOBAL_AGENTS_DIR4, id);
     }
     const yamlPath = path36.join(agentDir, "agent.yaml");
     try {
@@ -15995,7 +16209,7 @@ ${body.description ?? ""}
     if (scope === "workspace" && projectId) {
       agentDir = path36.join(projectId, ".halo", "agents", id);
     } else {
-      agentDir = path36.join(GLOBAL_AGENTS_DIR3, id);
+      agentDir = path36.join(GLOBAL_AGENTS_DIR4, id);
     }
     try {
       await fs31.access(agentDir);
@@ -16003,7 +16217,7 @@ ${body.description ?? ""}
       return c.json({ error: "Agent not found" }, 404);
     }
     if (scope === "global") {
-      const globalAgents = await scanAgentsDir(GLOBAL_AGENTS_DIR3, "global");
+      const globalAgents = await scanAgentsDir(GLOBAL_AGENTS_DIR4, "global");
       if (globalAgents.length <= 1) {
         return c.json({ error: "Cannot delete the last global agent. At least one global agent must remain." }, 400);
       }
@@ -16083,9 +16297,9 @@ ${body.description ?? ""}
   });
   function getSessionsDir(agentId, _source, projectId) {
     if (agentId.startsWith("__") && agentId.endsWith("__")) {
-      return path36.join(homedir16(), ".halo", "global", "internal-sessions", agentId);
+      return path36.join(homedir17(), ".halo", "global", "internal-sessions", agentId);
     }
-    const base = projectId ? path36.join(projectId, ".halo") : path36.join(homedir16(), ".halo");
+    const base = projectId ? path36.join(projectId, ".halo") : path36.join(homedir17(), ".halo");
     return path36.join(base, "sessions", agentId);
   }
   app2.get("/agent-configs/:id/sessions", async (c) => {
@@ -16198,7 +16412,7 @@ ${body.description ?? ""}
   });
   return app2;
 }
-var _cachedTools, GLOBAL_AGENTS_DIR3, FALLBACK_SCAFFOLD_PROVIDER, _yamlCache;
+var _cachedTools, GLOBAL_AGENTS_DIR4, FALLBACK_SCAFFOLD_PROVIDER, _yamlCache;
 var init_agent_configs = __esm({
   "packages/server/dist/routes/agent-configs.js"() {
     "use strict";
@@ -16208,7 +16422,7 @@ var init_agent_configs = __esm({
     init_config();
     init_db();
     _cachedTools = null;
-    GLOBAL_AGENTS_DIR3 = path36.join(homedir16(), ".halo", "global", "agents");
+    GLOBAL_AGENTS_DIR4 = path36.join(homedir17(), ".halo", "global", "agents");
     FALLBACK_SCAFFOLD_PROVIDER = "aws-bedrock-claude-invoke";
     _yamlCache = /* @__PURE__ */ new Map();
   }
@@ -16218,7 +16432,7 @@ var init_agent_configs = __esm({
 import { Hono as Hono4 } from "hono";
 import fs32 from "node:fs/promises";
 import path37 from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { homedir as homedir18 } from "node:os";
 import YAML11 from "yaml";
 function defaultSkillSettings() {
   return {
@@ -16416,7 +16630,7 @@ var init_skills = __esm({
     "use strict";
     init_agent_loader();
     init_db();
-    GLOBAL_SETTINGS_PATH = path37.join(homedir17(), ".halo", "secrets", "settings.yaml");
+    GLOBAL_SETTINGS_PATH = path37.join(homedir18(), ".halo", "secrets", "settings.yaml");
     _skillMdCache = /* @__PURE__ */ new Map();
   }
 });
@@ -16425,7 +16639,7 @@ var init_skills = __esm({
 import { Hono as Hono5 } from "hono";
 import fs33 from "node:fs/promises";
 import path38 from "node:path";
-import { homedir as homedir18 } from "node:os";
+import { homedir as homedir19 } from "node:os";
 import YAML12 from "yaml";
 async function readSettingsFile(filePath) {
   try {
@@ -16437,7 +16651,11 @@ async function readSettingsFile(filePath) {
 }
 async function writeSettingsFile(filePath, data) {
   await fs33.mkdir(path38.dirname(filePath), { recursive: true });
-  await fs33.writeFile(filePath, YAML12.stringify(data, { lineWidth: 120 }), "utf-8");
+  await fs33.writeFile(filePath, YAML12.stringify(data, { lineWidth: 120 }), { encoding: "utf-8", mode: 384 });
+  try {
+    await fs33.chmod(filePath, 384);
+  } catch {
+  }
 }
 function deepMerge2(base, override) {
   const result = { ...base };
@@ -16546,8 +16764,8 @@ function detectOrphans(tree, declared) {
       if (!block || typeof block !== "object")
         continue;
       for (const k of Object.keys(block)) {
-        const path62 = `${namespaceId}.${kindWord}.${k}`;
-        if (!declaredMap.has(path62)) {
+        const path63 = `${namespaceId}.${kindWord}.${k}`;
+        if (!declaredMap.has(path63)) {
           out.push({ namespaceId, kind: kindWord === "params" ? "param" : "secret", key: k });
         }
       }
@@ -16673,16 +16891,16 @@ var init_settings = __esm({
   "packages/server/dist/routes/settings.js"() {
     "use strict";
     init_settings_schema();
-    GLOBAL_SETTINGS_PATH2 = path38.join(homedir18(), ".halo", "secrets", "settings.yaml");
+    GLOBAL_SETTINGS_PATH2 = path38.join(homedir19(), ".halo", "secrets", "settings.yaml");
     _changeListeners = [];
   }
 });
 
 // packages/server/dist/paths.js
 import path39 from "node:path";
-import { homedir as homedir19 } from "node:os";
+import { homedir as homedir20 } from "node:os";
 function haloHome() {
-  return path39.join(homedir19(), ".halo");
+  return path39.join(homedir20(), ".halo");
 }
 function globalDir() {
   return path39.join(haloHome(), "global");
@@ -16876,7 +17094,7 @@ import { Hono as Hono6 } from "hono";
 import { eq as eq7, desc as desc2, asc, inArray as inArray2, lt as lt3, and as and5, or, sql } from "drizzle-orm";
 import fs35 from "node:fs/promises";
 import path41 from "node:path";
-import { homedir as homedir20 } from "node:os";
+import { homedir as homedir21 } from "node:os";
 function runDirOf(workspacePath, runId) {
   return path41.join(workspacePath, ".halo", "evo", "runs", runId);
 }
@@ -16955,7 +17173,7 @@ function createEvolutionRoutes() {
     }
     let wrapperLog = null;
     try {
-      wrapperLog = await fs35.readFile(path41.join(homedir20(), ".halo", "global", "logs", "evo", `run-${id}.log`), "utf-8");
+      wrapperLog = await fs35.readFile(path41.join(homedir21(), ".halo", "global", "logs", "evo", `run-${id}.log`), "utf-8");
     } catch {
     }
     let subCliLog = null;
@@ -17644,6 +17862,7 @@ var init_accounts2 = __esm({
 });
 
 // packages/server/dist/middleware/brute-force.js
+import { getConnInfo } from "@hono/node-server/conninfo";
 function bucket(name) {
   let b = buckets.get(name);
   if (!b) {
@@ -17653,9 +17872,17 @@ function bucket(name) {
   return b;
 }
 function getClientIp(c) {
-  const forwarded = c.req.header("x-forwarded-for");
-  if (forwarded)
-    return forwarded.split(",")[0].trim();
+  if (config.server.trustProxy) {
+    const forwarded = c.req.header("x-forwarded-for");
+    if (forwarded)
+      return forwarded.split(",")[0].trim();
+  }
+  try {
+    const addr = getConnInfo(c).remote.address;
+    if (addr)
+      return addr;
+  } catch {
+  }
   return "unknown";
 }
 function isLockedOut(bucketName, ip) {
@@ -17687,6 +17914,7 @@ var MAX_ATTEMPTS, LOCKOUT_MS, buckets;
 var init_brute_force = __esm({
   "packages/server/dist/middleware/brute-force.js"() {
     "use strict";
+    init_config();
     MAX_ATTEMPTS = 5;
     LOCKOUT_MS = 15 * 60 * 1e3;
     buckets = /* @__PURE__ */ new Map();
@@ -17912,6 +18140,29 @@ function snapshotWorkspaceReadonly(wsPath, label) {
     skills: scanSkills2(path43.join(wsPath, ".halo", "skills"))
   };
 }
+function readonlySessionCounts(wsPath, limit) {
+  const counts = { running: 0, idle: 0, stopped: 0, total: 0 };
+  const reader = roReader(wsPath);
+  if (!reader)
+    return counts;
+  try {
+    const rows = reader.listPage.all(limit);
+    const liveParents = new Set(reader.liveParents.all().map((r) => r.parent_id));
+    counts.total = rows.length;
+    for (const r of rows) {
+      if (r.stopped_at)
+        counts.stopped++;
+      else if (liveParents.has(r.id))
+        counts.running++;
+      else
+        counts.idle++;
+    }
+  } catch (err) {
+    console.log(`[Show] read-only query failed ${wsPath}: ${err instanceof Error ? err.message : String(err)}`);
+    dropRoReader(wsPath);
+  }
+  return counts;
+}
 function trimSessionMessages(messages2) {
   return messages2.slice(-SESSION_LOG_MAX_MSGS).map((m) => ({
     id: m.id,
@@ -18141,9 +18392,18 @@ function createMetricsRoutes(registry2) {
     let workspaces = 0;
     for (const wsPath of discoverWorkspaces2(registry2)) {
       try {
-        const sm = registry2.getOrCreate(wsPath);
-        const { sessions: sessions2 } = sm.listSessions({ includeArchived: false, limit: SESSIONS_PER_WS2 });
+        const sm = registry2.peek(wsPath);
         workspaces++;
+        if (!sm) {
+          const counts = readonlySessionCounts(wsPath, SESSIONS_PER_WS2);
+          running += counts.running;
+          idle += counts.idle;
+          stopped += counts.stopped;
+          total += counts.total;
+          continue;
+        }
+        dropRoReader(wsPath);
+        const { sessions: sessions2 } = sm.listSessions({ includeArchived: false, limit: SESSIONS_PER_WS2 });
         for (const r of sessions2) {
           total++;
           if (r.status === "running")
@@ -18186,6 +18446,7 @@ var init_metrics = __esm({
     init_channel_db();
     init_accounts2();
     init_brute_force();
+    init_show();
     TOKEN_BUCKET2 = "web-token";
     SESSIONS_PER_WS2 = 500;
   }
@@ -18221,16 +18482,300 @@ var init_commands3 = __esm({
   }
 });
 
-// packages/server/dist/ws/file-watcher.js
-import fs40 from "node:fs";
+// packages/server/dist/sessions/session-types.js
+function inferMessageType(msg) {
+  if (msg.type)
+    return msg.type;
+  if (msg.role === "user")
+    return "user";
+  if (msg.role === "assistant")
+    return "assistant";
+  if (msg.toolName)
+    return "tool_call";
+  if (msg.toolOutput !== void 0 && !msg.toolName)
+    return "tool_result";
+  if (msg.usage)
+    return "usage";
+  if (msg.systemPrompt)
+    return "context";
+  return "notification";
+}
+var init_session_types = __esm({
+  "packages/server/dist/sessions/session-types.js"() {
+    "use strict";
+  }
+});
+
+// packages/server/dist/routes/agentcore.js
+import { Hono as Hono11 } from "hono";
 import path44 from "node:path";
+import fs40 from "node:fs";
+function haloSessionId(runtimeSessionId) {
+  return `agentcore_${runtimeSessionId.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 80)}`;
+}
+function userWorkspace(base, runtimeSessionId) {
+  const dir = path44.join(base, "users", runtimeSessionId.replace(/[^a-zA-Z0-9_-]/g, "-").slice(0, 80));
+  fs40.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+async function ensureSession(sm, workspace, sessionId) {
+  if (sm.getSessionById(sessionId))
+    return;
+  const agentId = await resolveDefaultAgentId(sm, workspace);
+  await sm.createSession(agentId, null, "AgentCore Runtime", void 0, sessionId);
+}
+function runTurnCollect(sm, sessionId, prompt) {
+  return new Promise((resolve2, reject) => {
+    let text5 = "";
+    const unsubscribe = sm.registerEventListener(sessionId, (event) => {
+      if (event.taskId)
+        return;
+      if (event.type === "stream") {
+        text5 += event.text ?? "";
+      } else if (event.type === "complete" && !event.batchBoundary) {
+        unsubscribe();
+        resolve2(text5);
+      } else if (event.type === "error") {
+        unsubscribe();
+        resolve2(text5 ? `${text5}
+
+[error] ${event.error}` : `[error] ${event.error ?? "unknown error"}`);
+      }
+    });
+    sm.appendUserMessage(sessionId, prompt);
+    sm.sendUserMessage(sessionId, `[channel: agentcore]
+
+${prompt}`).then((result) => {
+      if (result === "queued") {
+        unsubscribe();
+        resolve2("(agent busy \u2014 message queued and will be processed with the current turn)");
+      }
+    }).catch((err) => {
+      unsubscribe();
+      reject(err);
+    });
+  });
+}
+function createAgentCoreRoutes(deps) {
+  const { registry: registry2, workspace } = deps;
+  const app2 = new Hono11();
+  app2.get("/ping", (c) => {
+    const busy = registry2.list().some(({ sm }) => sm.hasRunningSessions());
+    return c.json({ status: busy ? "HealthyBusy" : "Healthy" });
+  });
+  app2.post("/invocations", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const prompt = typeof body.input?.prompt === "string" ? body.input.prompt.trim() : "";
+    if (!prompt)
+      return c.json({ error: "input.prompt required" }, 400);
+    const runtimeSessionId = c.req.header(SESSION_HEADER) || `inv-${Date.now().toString(36)}`;
+    const sessionId = haloSessionId(runtimeSessionId);
+    const userWs = userWorkspace(workspace, runtimeSessionId);
+    const sm = registry2.getOrCreate(userWs);
+    await ensureSession(sm, userWs, sessionId);
+    const text5 = await runTurnCollect(sm, sessionId, prompt);
+    return c.json({ output: { message: { role: "assistant", content: [{ text: text5 }] } } });
+  });
+  return app2;
+}
+function buildHistory(sm, sessionId) {
+  const state = sm.getUIState(sessionId);
+  if (!state)
+    return { messages: [], running: false };
+  const messages2 = [];
+  for (const m of createSaveSnapshot(state)) {
+    if (m.taskId)
+      continue;
+    const type = inferMessageType(m);
+    if (type !== "user" && type !== "assistant")
+      continue;
+    const blocks = [];
+    for (const b of m.contentBlocks ?? []) {
+      if (b.type === "thinking") {
+        blocks.push({ type: "thinking", text: b.text });
+      } else if (b.type === "tool_call") {
+        blocks.push({ type: "tool_call", toolCall: { name: b.toolCall.name, input: b.toolCall.input, output: b.toolCall.output?.slice(0, 500) } });
+      }
+    }
+    messages2.push({
+      role: m.role,
+      content: m.content,
+      ts: m.timestamp,
+      ...blocks.length > 0 ? { contentBlocks: blocks } : {}
+    });
+  }
+  return { messages: messages2, running: sm.isSessionRunning(sessionId) };
+}
+function setupAgentCoreWebSocket(deps) {
+  const { wss: wss2, registry: registry2, workspace } = deps;
+  wss2.on("connection", (ws, req) => {
+    const url = new URL(req.url ?? "/ws", "http://localhost");
+    const runtimeSessionId = req.headers[SESSION_HEADER] || url.searchParams.get("sessionId") || `ws-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+    let sessionId = haloSessionId(runtimeSessionId);
+    const userWs = userWorkspace(workspace, runtimeSessionId);
+    const sm = registry2.getOrCreate(userWs);
+    const send = (obj) => {
+      if (ws.readyState !== ws.OPEN)
+        return;
+      try {
+        ws.send(JSON.stringify(obj));
+      } catch {
+      }
+    };
+    let unsubscribe = null;
+    const attachListener = () => {
+      unsubscribe ??= sm.registerEventListener(sessionId, (event) => {
+        if (event.taskId)
+          return;
+        switch (event.type) {
+          case "stream":
+            if (event.text)
+              send({ type: "stream", text: event.text });
+            break;
+          case "thinking":
+            send({ type: "thinking", text: event.text ?? "" });
+            break;
+          case "tool_call":
+            send({ type: "tool_call", toolName: event.toolName, toolInput: event.toolInput });
+            break;
+          case "tool_result":
+            send({ type: "tool_result", toolName: event.toolName, result: event.toolResult?.slice(0, 500) });
+            break;
+          case "complete":
+            if (!event.batchBoundary)
+              send({ type: "complete" });
+            break;
+          case "error":
+            send({ type: "error", error: event.error ?? "unknown error" });
+            break;
+        }
+      });
+    };
+    let ready = null;
+    const ensureOnce = () => {
+      ready ??= ensureSession(sm, userWs, sessionId).then(() => attachListener());
+      return ready;
+    };
+    ws.on("message", (raw) => {
+      let msg;
+      try {
+        msg = JSON.parse(String(raw));
+      } catch {
+        send({ type: "error", error: "invalid JSON" });
+        return;
+      }
+      if (msg.type === "init" || typeof msg.inputText === "string" && msg.inputText.trim() === "/init") {
+        if (sm.getSessionById(sessionId)) {
+          attachListener();
+          send({ type: "history", ...buildHistory(sm, sessionId) });
+        } else {
+          send({ type: "history", messages: [], running: false });
+        }
+        return;
+      }
+      if (msg.type === "stop") {
+        if (!sm.getSessionById(sessionId))
+          return;
+        sm.stopSession(sessionId).catch((err) => {
+          send({ type: "error", error: err instanceof Error ? err.message : String(err) });
+        });
+        return;
+      }
+      const text5 = typeof msg.inputText === "string" ? msg.inputText.trim() : "";
+      if (!text5) {
+        return;
+      }
+      if (text5.startsWith("/")) {
+        void (async () => {
+          try {
+            await ensureOnce();
+            const spaceIdx = text5.indexOf(" ");
+            const command = spaceIdx === -1 ? text5 : text5.slice(0, spaceIdx);
+            const arg = spaceIdx === -1 ? "" : text5.slice(spaceIdx + 1).trim();
+            const ctx = {
+              sm,
+              userId: runtimeSessionId,
+              sessionPrefix: "agentcore_",
+              accessLevel: "full",
+              channelLabel: "AgentCore Runtime",
+              activeOverrides,
+              workspacePath: userWs,
+              lang: "en"
+            };
+            const cmdResult = await dispatchCommand(ctx, command, arg, { channelName: "agentcore" });
+            if (cmdResult) {
+              send({ type: "stream", text: cmdResult.text });
+              if (cmdResult.switchTo) {
+                unsubscribe?.();
+                unsubscribe = null;
+                sessionId = cmdResult.switchTo;
+                attachListener();
+                send({ type: "switch" });
+                send({ type: "history", ...buildHistory(sm, sessionId) });
+              }
+              if (cmdResult.startedTurn && cmdResult.sessionId) {
+                if (cmdResult.sessionId !== sessionId) {
+                  unsubscribe?.();
+                  unsubscribe = null;
+                  sessionId = cmdResult.sessionId;
+                  attachListener();
+                }
+              } else {
+                send({ type: "complete" });
+              }
+            } else {
+              send({ type: "stream", text: `Unknown command: ${command}` });
+              send({ type: "complete" });
+            }
+          } catch (err) {
+            send({ type: "error", error: err instanceof Error ? err.message : String(err) });
+          }
+        })();
+        return;
+      }
+      void (async () => {
+        try {
+          await ensureOnce();
+          sm.appendUserMessage(sessionId, text5);
+          const result = await sm.sendUserMessage(sessionId, `[channel: agentcore]
+
+${text5}`);
+          if (result === "queued")
+            send({ type: "queued" });
+        } catch (err) {
+          send({ type: "error", error: err instanceof Error ? err.message : String(err) });
+        }
+      })();
+    });
+    ws.on("close", () => {
+      unsubscribe?.();
+      unsubscribe = null;
+    });
+    console.log(`[AgentCore] ws connected \u2014 session ${sessionId}`);
+  });
+}
+var SESSION_HEADER, activeOverrides;
+var init_agentcore = __esm({
+  "packages/server/dist/routes/agentcore.js"() {
+    "use strict";
+    init_commands2();
+    init_ui_log_builder();
+    init_session_types();
+    SESSION_HEADER = "x-amzn-bedrock-agentcore-runtime-session-id";
+    activeOverrides = /* @__PURE__ */ new Map();
+  }
+});
+
+// packages/server/dist/ws/file-watcher.js
+import fs41 from "node:fs";
+import path45 from "node:path";
 function isUnwatchablePath(absPath) {
-  const norm = path44.resolve(absPath);
-  if (norm === "/" || norm === path44.parse(norm).root)
+  const norm = path45.resolve(absPath);
+  if (norm === "/" || norm === path45.parse(norm).root)
     return "filesystem root";
   const banned = ["/System", "/Library", "/private", "/usr", "/bin", "/sbin", "/etc"];
   for (const b of banned) {
-    if (norm === b || norm.startsWith(b + path44.sep))
+    if (norm === b || norm.startsWith(b + path45.sep))
       return `system path ${b}`;
   }
   return null;
@@ -18345,10 +18890,10 @@ var init_file_watcher = __esm({
         const root = this.workspaceRoot;
         if (!root)
           return;
-        const raw = path44.relative(root, absPath);
+        const raw = path45.relative(root, absPath);
         if (!raw || raw.startsWith(".."))
           return;
-        const rel = raw.split(path44.sep).join("/");
+        const rel = raw.split(path45.sep).join("/");
         let action;
         if (type === "delete") {
           action = "unlink";
@@ -18357,7 +18902,7 @@ var init_file_watcher = __esm({
         } else {
           let isDir = false;
           try {
-            isDir = fs40.statSync(absPath).isDirectory();
+            isDir = fs41.statSync(absPath).isDirectory();
           } catch {
           }
           action = isDir ? "addDir" : "add";
@@ -18427,8 +18972,8 @@ var init_file_watcher = __esm({
 });
 
 // packages/server/dist/ws/git-dir-watcher.js
-import fs41 from "node:fs";
-import path45 from "node:path";
+import fs42 from "node:fs";
+import path46 from "node:path";
 var GitDirWatcher;
 var init_git_dir_watcher = __esm({
   "packages/server/dist/ws/git-dir-watcher.js"() {
@@ -18452,8 +18997,8 @@ var init_git_dir_watcher = __esm({
           return;
         this.stop();
         this.workspaceRoot = workspaceRoot;
-        const gitDir = path45.join(workspaceRoot, ".git");
-        if (fs41.existsSync(gitDir)) {
+        const gitDir = path46.join(workspaceRoot, ".git");
+        if (fs42.existsSync(gitDir)) {
           this.watchGitDir(gitDir);
         } else {
           this.watchParentForGit(workspaceRoot);
@@ -18462,7 +19007,7 @@ var init_git_dir_watcher = __esm({
       /** Watch the `.git` dir for index/HEAD changes (steady state). */
       watchGitDir(gitDir) {
         try {
-          this.watcher = fs41.watch(gitDir, { persistent: true, recursive: false }, (_eventType, filename) => {
+          this.watcher = fs42.watch(gitDir, { persistent: true, recursive: false }, (_eventType, filename) => {
             this.handleGitEvent(filename);
           });
           this.mode = "git";
@@ -18476,7 +19021,7 @@ var init_git_dir_watcher = __esm({
        *  Exists solely during the non-repo window; upgraded away on first `.git`. */
       watchParentForGit(workspaceRoot) {
         try {
-          this.watcher = fs41.watch(workspaceRoot, { persistent: true, recursive: false }, (_eventType, filename) => {
+          this.watcher = fs42.watch(workspaceRoot, { persistent: true, recursive: false }, (_eventType, filename) => {
             this.handleParentEvent(filename);
           });
           this.mode = "parent";
@@ -18507,8 +19052,8 @@ var init_git_dir_watcher = __esm({
         const root = this.workspaceRoot;
         if (!root)
           return;
-        const gitDir = path45.join(root, ".git");
-        if (!fs41.existsSync(gitDir))
+        const gitDir = path46.join(root, ".git");
+        if (!fs42.existsSync(gitDir))
           return;
         this.closeWatcher();
         this.watchGitDir(gitDir);
@@ -18646,7 +19191,7 @@ var init_event_processor = __esm({
 });
 
 // packages/server/dist/ws/terminal-manager.js
-import { homedir as homedir21 } from "node:os";
+import { homedir as homedir22 } from "node:os";
 import { basename } from "node:path";
 import { createRequire } from "node:module";
 function getPty() {
@@ -18702,7 +19247,7 @@ var init_terminal_manager = __esm({
             clearTimeout(existing.graceTimer);
           terminals.delete(terminalId);
         }
-        const cwd = opts.cwd === "~" || !opts.cwd ? homedir21() : opts.cwd;
+        const cwd = opts.cwd === "~" || !opts.cwd ? homedir22() : opts.cwd;
         const cols = opts.cols ?? 80;
         const rows = opts.rows ?? 24;
         const shell = process.env.SHELL ?? (process.platform === "win32" ? process.env.ComSpec || "powershell.exe" : "/bin/bash");
@@ -18810,12 +19355,12 @@ var init_terminal_manager = __esm({
 });
 
 // packages/server/dist/ws/handler.js
-import path46 from "node:path";
+import path47 from "node:path";
 function setupWebSocketHandler(deps) {
   const { wss: wss2, registry: registry2 } = deps;
   const clients = /* @__PURE__ */ new Set();
   function resolveProjectPath(projectId) {
-    if (path46.isAbsolute(projectId))
+    if (path47.isAbsolute(projectId))
       return projectId;
     return null;
   }
@@ -19337,11 +19882,11 @@ var init_handler = __esm({
 import Database5 from "better-sqlite3";
 import { drizzle as drizzle4 } from "drizzle-orm/better-sqlite3";
 import { sqliteTable as sqliteTable4, text as text4, integer as integer4 } from "drizzle-orm/sqlite-core";
-import path47 from "node:path";
-import fs42 from "node:fs";
+import path48 from "node:path";
+import fs43 from "node:fs";
 function createCronDb(globalDir2) {
-  fs42.mkdirSync(globalDir2, { recursive: true });
-  const dbPath = path47.join(globalDir2, "cron.db");
+  fs43.mkdirSync(globalDir2, { recursive: true });
+  const dbPath = path48.join(globalDir2, "cron.db");
   const sqlite = new Database5(dbPath);
   sqlite.pragma("journal_mode = WAL");
   sqlite.exec(CREATE_SQL3);
@@ -19510,11 +20055,24 @@ var init_dispatcher = __esm({
   }
 });
 
+// packages/server/dist/child-env.js
+function cleanChildEnv() {
+  const env = { ...process.env };
+  delete env.HALO_PASSWORD;
+  delete env.HALO_JWT_SECRET;
+  return env;
+}
+var init_child_env = __esm({
+  "packages/server/dist/child-env.js"() {
+    "use strict";
+  }
+});
+
 // packages/server/dist/cron/runner.js
 import { spawn as spawn2 } from "node:child_process";
-import fs43 from "node:fs";
-import path48 from "node:path";
-import { homedir as homedir22 } from "node:os";
+import fs44 from "node:fs";
+import path49 from "node:path";
+import { homedir as homedir23 } from "node:os";
 import { Cron } from "croner";
 import { eq as eq10, lt as lt4 } from "drizzle-orm";
 function resolveHaloCli() {
@@ -19523,16 +20081,16 @@ function resolveHaloCli() {
   return process.platform === "win32" ? "halo.cmd" : "halo";
 }
 function logsDir() {
-  return path48.join(homedir22(), ".halo", "global", "logs", "cron");
+  return path49.join(homedir23(), ".halo", "global", "logs", "cron");
 }
 function logPathFor(runId) {
-  return path48.join(logsDir(), `${runId}.log`);
+  return path49.join(logsDir(), `${runId}.log`);
 }
 function newRunId() {
   return `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}`;
 }
 function startCronDaemon() {
-  fs43.mkdirSync(logsDir(), { recursive: true });
+  fs44.mkdirSync(logsDir(), { recursive: true });
   reloadAll();
   setInterval(pruneOldLogs, DAY_MS2);
   setInterval(reconcileFromDb, 1e4);
@@ -19677,7 +20235,7 @@ async function runJob(jobId, triggerKind) {
   const runId = newRunId();
   const startedAt = Date.now();
   const logPath = logPathFor(runId);
-  fs43.mkdirSync(logsDir(), { recursive: true });
+  fs44.mkdirSync(logsDir(), { recursive: true });
   if (_inflight.has(jobId)) {
     db.insert(cronRuns).values({
       id: runId,
@@ -19712,7 +20270,7 @@ async function runJob(jobId, triggerKind) {
     }).run();
     broadcast({ type: "cron:run_changed", jobId, runId, status: "running" });
     const targets = parseTargets(job.targets);
-    if (!fs43.existsSync(job.workspacePath)) {
+    if (!fs44.existsSync(job.workspacePath)) {
       finalize(runId, jobId, {
         status: "failed",
         output: null,
@@ -19726,7 +20284,7 @@ async function runJob(jobId, triggerKind) {
     const sessionId = `cron-${job.id}`;
     const args = ["cli", "-a", job.agentId, "-s", sessionId, "-w", job.workspacePath];
     const [spawnBin, spawnArgs] = process.platform === "win32" && cli.endsWith(".cmd") ? ["cmd.exe", ["/c", cli, ...args]] : [cli, args];
-    const teeStream = fs43.createWriteStream(logPath, { flags: "a" });
+    const teeStream = fs44.createWriteStream(logPath, { flags: "a" });
     teeStream.write(`=== ${(/* @__PURE__ */ new Date()).toISOString()} cron run ${runId} job=${jobId} trigger=${triggerKind} ===
 `);
     teeStream.write(`agent=${job.agentId} workspace=${job.workspacePath} schedule=${job.schedule}
@@ -19739,7 +20297,7 @@ async function runJob(jobId, triggerKind) {
     const result = await new Promise((resolve2) => {
       const child = spawn2(spawnBin, spawnArgs, {
         stdio: ["pipe", "pipe", "pipe"],
-        env: process.env,
+        env: cleanChildEnv(),
         // Suppress the console window the `cmd.exe /c` wrapper would otherwise
         // pop up on Windows (CREATE_NO_WINDOW). No-op on macOS/Linux.
         windowsHide: true
@@ -19879,15 +20437,15 @@ function pruneOldRuns(jobId) {
 }
 function pruneOldLogs() {
   const dir = logsDir();
-  if (!fs43.existsSync(dir))
+  if (!fs44.existsSync(dir))
     return;
   const cutoff = Date.now() - LOG_RETENTION_DAYS * DAY_MS2;
-  for (const name of fs43.readdirSync(dir)) {
-    const p = path48.join(dir, name);
+  for (const name of fs44.readdirSync(dir)) {
+    const p = path49.join(dir, name);
     try {
-      const stat = fs43.statSync(p);
+      const stat = fs44.statSync(p);
       if (stat.mtimeMs < cutoff)
-        fs43.rmSync(p, { force: true });
+        fs44.rmSync(p, { force: true });
     } catch {
     }
   }
@@ -19902,6 +20460,7 @@ var init_runner = __esm({
     init_cron_db();
     init_dispatcher();
     init_broadcast();
+    init_child_env();
     DAY_MS2 = 24 * 60 * 60 * 1e3;
     CLI_TIMEOUT_SEC = 3600;
     RUNS_PER_JOB_KEEP = 100;
@@ -19914,9 +20473,9 @@ var init_runner = __esm({
 });
 
 // packages/server/dist/routes/cron.js
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 import { eq as eq11, desc as desc4, lt as lt5, and as and7 } from "drizzle-orm";
-import fs44 from "node:fs/promises";
+import fs45 from "node:fs/promises";
 import { Cron as Cron2 } from "croner";
 function newJobId() {
   return `cron-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -19930,7 +20489,7 @@ function validateSchedule(expr) {
   }
 }
 function createCronRoutes() {
-  const router = new Hono11();
+  const router = new Hono12();
   router.get("/cron/jobs", async (c) => {
     const db = getCronDb();
     const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "20", 10) || 20, 1), 100);
@@ -20093,7 +20652,7 @@ function createCronRoutes() {
       return c.json({ log: null });
     let log = null;
     try {
-      log = await fs44.readFile(row.logPath, "utf-8");
+      log = await fs45.readFile(row.logPath, "utf-8");
     } catch {
     }
     return c.json({ log });
@@ -20389,20 +20948,21 @@ var init_ticker = __esm({
 });
 
 // packages/server/dist/evolution/spawn.js
-import path49 from "node:path";
+import path50 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var __dirname2, WRAPPER_PATH, realEvoSpawner;
 var init_spawn = __esm({
   "packages/server/dist/evolution/spawn.js"() {
     "use strict";
-    __dirname2 = path49.dirname(fileURLToPath2(import.meta.url));
-    WRAPPER_PATH = path49.resolve(__dirname2, "evo-wrapper.js");
+    init_child_env();
+    __dirname2 = path50.dirname(fileURLToPath2(import.meta.url));
+    WRAPPER_PATH = path50.resolve(__dirname2, "evo-wrapper.js");
     realEvoSpawner = (mode, id) => {
       const child = spawn3(process.execPath, [WRAPPER_PATH, `--mode=${mode}`, `--id=${id}`], {
         detached: true,
         stdio: "ignore",
-        env: process.env,
+        env: cleanChildEnv(),
         // Without this, a detached console process on Windows gets a freshly
         // allocated console window (a black box pops up for every evo/score/apply
         // run). cron doesn't hit this — it spawns the cli inline, not via a
@@ -20643,7 +21203,7 @@ var init_session_prefix = __esm({
 
 // packages/server/dist/channels/telegram/handler.js
 import { Bot, InputFile } from "grammy";
-import path50 from "node:path";
+import path51 from "node:path";
 function inferMediaKind(filePath) {
   const cls = classifyMedia(filePath);
   if (cls === "image")
@@ -20694,7 +21254,7 @@ function startTelegramChannel(deps) {
     }
     const abort = new AbortController();
     const unsubscribers = /* @__PURE__ */ new Map();
-    const activeOverrides = /* @__PURE__ */ new Map();
+    const activeOverrides2 = /* @__PURE__ */ new Map();
     const restartSelf = () => {
       queueMicrotask(() => {
         void stopAccount(accountId).then(() => {
@@ -20703,8 +21263,8 @@ function startTelegramChannel(deps) {
       });
     };
     const bot = new Bot(account.botToken);
-    const promise = runBot({ registry: registry2, db, account, bot, abort, unsubscribers, activeOverrides, restartSelf }).catch((err) => console.log(`[telegram] account ${accountId} bot crashed: ${String(err)}`));
-    runners.set(accountId, { accountId, bot, abort, promise, unsubscribers, activeOverrides });
+    const promise = runBot({ registry: registry2, db, account, bot, abort, unsubscribers, activeOverrides: activeOverrides2, restartSelf }).catch((err) => console.log(`[telegram] account ${accountId} bot crashed: ${String(err)}`));
+    runners.set(accountId, { accountId, bot, abort, promise, unsubscribers, activeOverrides: activeOverrides2 });
     console.log(`[telegram] account ${accountId} started (@${account.botUsername}, workspace=${account.workspacePath})`);
   }
   async function stopAccount(accountId) {
@@ -20729,7 +21289,7 @@ function startTelegramChannel(deps) {
   return { startAccount, stopAccount, stopAll };
 }
 async function runBot(args) {
-  const { registry: registry2, db, account, bot, unsubscribers, activeOverrides, restartSelf } = args;
+  const { registry: registry2, db, account, bot, unsubscribers, activeOverrides: activeOverrides2, restartSelf } = args;
   bot.catch((err) => {
     console.log(`[telegram] ${account.accountId} bot error: ${String(err)}`);
   });
@@ -20744,7 +21304,7 @@ async function runBot(args) {
       sessionPrefix: buildTgSessionPrefix(userId),
       accessLevel: account.accessLevel,
       channelLabel: `Telegram: ${userId}`,
-      activeOverrides,
+      activeOverrides: activeOverrides2,
       workspacePath: account.workspacePath,
       lang,
       channel: {
@@ -20805,7 +21365,7 @@ async function runBot(args) {
         }
       }
     }
-    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, lang, unsubscribers, activeOverrides });
+    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, lang, unsubscribers, activeOverrides: activeOverrides2 });
   });
   bot.on("message:photo", async (ctx) => {
     const userId = ctx.from.id;
@@ -20841,7 +21401,7 @@ async function runBot(args) {
     }
     const text5 = caption ? `${caption}
 ${imageNote}` : imageNote;
-    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, images, lang, unsubscribers, activeOverrides });
+    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, images, lang, unsubscribers, activeOverrides: activeOverrides2 });
   });
   bot.on("message:document", async (ctx) => {
     const userId = ctx.from.id;
@@ -20865,7 +21425,7 @@ ${imageNote}` : imageNote;
     }
     const text5 = caption ? `${caption}
 ${fileNote}` : fileNote;
-    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, lang, unsubscribers, activeOverrides });
+    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, lang, unsubscribers, activeOverrides: activeOverrides2 });
   });
   bot.on("message:voice", async (ctx) => {
     const userId = ctx.from.id;
@@ -20885,7 +21445,7 @@ ${fileNote}` : fileNote;
       }
     } catch {
     }
-    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: voiceNote, lang, unsubscribers, activeOverrides });
+    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: voiceNote, lang, unsubscribers, activeOverrides: activeOverrides2 });
   });
   bot.on("message:video_note", async (ctx) => {
     const userId = ctx.from.id;
@@ -20904,7 +21464,7 @@ ${fileNote}` : fileNote;
       }
     } catch {
     }
-    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: vnNote, lang, unsubscribers, activeOverrides });
+    await handleUserMessage({ registry: registry2, db, account, bot, ctx, userId, workspace, text: vnNote, lang, unsubscribers, activeOverrides: activeOverrides2 });
   });
   console.log(`[telegram] ${account.accountId} starting long-poll\u2026`);
   await bot.start({
@@ -20913,12 +21473,12 @@ ${fileNote}` : fileNote;
   });
 }
 async function handleUserMessage(args) {
-  const { registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, images, lang, unsubscribers, activeOverrides } = args;
+  const { registry: registry2, db, account, bot, ctx, userId, workspace, text: text5, images, lang, unsubscribers, activeOverrides: activeOverrides2 } = args;
   const chatId = ctx.chat.id;
   rememberLastActiveChat(db, account.accountId, String(chatId));
   const sm = registry2.getOrCreate(workspace);
   const accessLevel = account.accessLevel === "full" ? null : account.accessLevel === "workspace" ? "workspace" : "readonly";
-  const sessionId = await getOrCreateActiveSession(sm, userId, activeOverrides, accessLevel, workspace);
+  const sessionId = await getOrCreateActiveSession(sm, userId, activeOverrides2, accessLevel, workspace);
   if (sm.isSessionCompacting(sessionId)) {
     await ctx.reply(t("handler.compacting", lang));
     return;
@@ -20932,9 +21492,9 @@ async function handleUserMessage(args) {
         await bot.api.sendMessage(chatId, chunk, { parse_mode: void 0 });
       },
       sendMedia: async (filePath) => {
-        const resolved = path50.resolve(filePath);
-        const ws = path50.resolve(workspace);
-        const inWorkspace = resolved === ws || resolved.startsWith(ws + path50.sep);
+        const resolved = path51.resolve(filePath);
+        const ws = path51.resolve(workspace);
+        const inWorkspace = resolved === ws || resolved.startsWith(ws + path51.sep);
         if (!inWorkspace && !isInTempDir(resolved)) {
           console.log(`[telegram] sendMedia blocked: ${filePath} not under workspace`);
           return;
@@ -20971,11 +21531,11 @@ ${text5}`;
     console.log(`[telegram] sendUserMessage ${sessionId}: ${String(err)}`);
   });
 }
-function findActiveTgSession(sm, userId, activeOverrides, accessLevel) {
-  return findActiveSessionId(sm, String(userId), buildTgSessionPrefix(userId), activeOverrides, accessLevel);
+function findActiveTgSession(sm, userId, activeOverrides2, accessLevel) {
+  return findActiveSessionId(sm, String(userId), buildTgSessionPrefix(userId), activeOverrides2, accessLevel);
 }
-async function getOrCreateActiveSession(sm, userId, activeOverrides, accessLevel, workspacePath) {
-  const existing = findActiveTgSession(sm, userId, activeOverrides, accessLevel === null ? "full" : accessLevel);
+async function getOrCreateActiveSession(sm, userId, activeOverrides2, accessLevel, workspacePath) {
+  const existing = findActiveTgSession(sm, userId, activeOverrides2, accessLevel === null ? "full" : accessLevel);
   if (existing)
     return existing;
   const newId = `${buildTgSessionPrefix(userId)}${Date.now().toString(36)}`;
@@ -20999,20 +21559,20 @@ var init_handler2 = __esm({
 });
 
 // packages/server/dist/routes/telegram.js
-import { Hono as Hono12 } from "hono";
-import path51 from "node:path";
+import { Hono as Hono13 } from "hono";
+import path52 from "node:path";
 import { Bot as Bot2 } from "grammy";
-import fs45 from "node:fs";
+import fs46 from "node:fs";
 function createTelegramRoutes(deps) {
   const { db, channel } = deps;
-  const app2 = new Hono12();
+  const app2 = new Hono13();
   app2.get("/telegram/accounts", (c) => {
     const accounts = listAccounts3(db).map((acc) => {
       return {
         accountId: acc.accountId,
         botUsername: acc.botUsername,
         workspacePath: acc.workspacePath,
-        workspaceMissing: !fs45.existsSync(acc.workspacePath),
+        workspaceMissing: !fs46.existsSync(acc.workspacePath),
         label: acc.label,
         enabled: acc.enabled,
         accessLevel: acc.accessLevel,
@@ -21030,9 +21590,9 @@ function createTelegramRoutes(deps) {
       return c.json({ error: "botToken required" }, 400);
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path51.isAbsolute(body.workspacePath))
+    if (!path52.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
-    if (!fs45.existsSync(body.workspacePath))
+    if (!fs46.existsSync(body.workspacePath))
       return c.json({ error: "workspace path not found" }, 400);
     ensureWorkspaceHalo(body.workspacePath);
     let botUsername;
@@ -21091,7 +21651,7 @@ function createTelegramRoutes(deps) {
     if (body.enabled !== void 0)
       patch.enabled = body.enabled ? 1 : 0;
     if (body.workspacePath) {
-      if (!fs45.existsSync(body.workspacePath))
+      if (!fs46.existsSync(body.workspacePath))
         return c.json({ error: "workspace path not found" }, 400);
       ensureWorkspaceHalo(body.workspacePath);
       patch.workspacePath = body.workspacePath;
@@ -21737,8 +22297,8 @@ var init_cdn = __esm({
 });
 
 // packages/server/dist/channels/wechat/send-media.js
-import fs46 from "node:fs/promises";
-import path52 from "node:path";
+import fs47 from "node:fs/promises";
+import path53 from "node:path";
 function inferKind(filePath) {
   const cls = classifyMedia(filePath);
   if (cls === "image")
@@ -21750,7 +22310,7 @@ function inferKind(filePath) {
 async function sendMediaFile(params) {
   const { baseUrl, token, toUserId, contextToken, filePath } = params;
   const kind = params.kind ?? inferKind(filePath);
-  const plaintext = await fs46.readFile(filePath);
+  const plaintext = await fs47.readFile(filePath);
   const prep = prepareUpload(plaintext);
   console.log(`[weixin] sendMediaFile: path=${filePath} kind=${kind} rawsize=${prep.rawsize} filesize=${prep.filesize}`);
   const mediaType = kind === "image" ? UploadMediaType.IMAGE : kind === "video" ? UploadMediaType.VIDEO : UploadMediaType.FILE;
@@ -21788,7 +22348,7 @@ async function sendMediaFile(params) {
     aesKeyBase64,
     fileSizeCiphertext: prep.filesize,
     fileSize: prep.rawsize,
-    fileName: path52.basename(filePath)
+    fileName: path53.basename(filePath)
   });
   const clientId = `halo-media-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const body = {
@@ -21951,12 +22511,12 @@ var init_login = __esm({
 });
 
 // packages/server/dist/channels/wechat/handler.js
-import fs47 from "node:fs";
-import path53 from "node:path";
+import fs48 from "node:fs";
+import path54 from "node:path";
 import QRCode from "qrcode";
 function isPathAllowed(filePath, workspacePath) {
-  const resolved = path53.resolve(filePath);
-  return resolved.startsWith(path53.resolve(workspacePath)) || isInTempDir(resolved);
+  const resolved = path54.resolve(filePath);
+  return resolved.startsWith(path54.resolve(workspacePath)) || isInTempDir(resolved);
 }
 function startWeixinChannel(deps) {
   const { registry: registry2, db } = deps;
@@ -21977,7 +22537,7 @@ function startWeixinChannel(deps) {
     }
     const abort = new AbortController();
     const unsubscribers = /* @__PURE__ */ new Map();
-    const activeOverrides = /* @__PURE__ */ new Map();
+    const activeOverrides2 = /* @__PURE__ */ new Map();
     const sessionContextTokens = /* @__PURE__ */ new Map();
     const restartSelf = () => {
       queueMicrotask(() => {
@@ -21986,8 +22546,8 @@ function startWeixinChannel(deps) {
         });
       });
     };
-    const promise = runAccountLoop({ registry: registry2, db, account, abort: abort.signal, unsubscribers, activeOverrides, sessionContextTokens, restartSelf, startNewAccount: startAccount }).catch((err) => console.log(`[weixin] account ${accountId} loop crashed: ${String(err)}`));
-    runners.set(accountId, { accountId, abort, promise, unsubscribers, activeOverrides });
+    const promise = runAccountLoop({ registry: registry2, db, account, abort: abort.signal, unsubscribers, activeOverrides: activeOverrides2, sessionContextTokens, restartSelf, startNewAccount: startAccount }).catch((err) => console.log(`[weixin] account ${accountId} loop crashed: ${String(err)}`));
+    runners.set(accountId, { accountId, abort, promise, unsubscribers, activeOverrides: activeOverrides2 });
     console.log(`[weixin] account ${accountId} started (workspace=${account.workspacePath})`);
   }
   async function stopAccount(accountId) {
@@ -22019,7 +22579,7 @@ function startWeixinChannel(deps) {
   return { startAccount, stopAccount, stopAll };
 }
 async function runAccountLoop(args) {
-  const { registry: registry2, db, account, abort, unsubscribers, activeOverrides, sessionContextTokens, restartSelf, startNewAccount } = args;
+  const { registry: registry2, db, account, abort, unsubscribers, activeOverrides: activeOverrides2, sessionContextTokens, restartSelf, startNewAccount } = args;
   try {
     await notifyStart({ baseUrl: account.baseUrl, token: account.botToken });
   } catch (err) {
@@ -22058,7 +22618,7 @@ async function runAccountLoop(args) {
         saveSyncBuf(db, account.accountId, getUpdatesBuf);
       }
       for (const msg of resp.msgs ?? []) {
-        await handleInbound({ registry: registry2, db, account, msg, unsubscribers, activeOverrides, sessionContextTokens, restartSelf, startNewAccount });
+        await handleInbound({ registry: registry2, db, account, msg, unsubscribers, activeOverrides: activeOverrides2, sessionContextTokens, restartSelf, startNewAccount });
       }
     } catch (err) {
       if (abort.aborted)
@@ -22181,11 +22741,11 @@ async function processItems(args) {
 function buildWxSessionPrefix(fromUserId) {
   return sessionPrefix("wx", normalizeAccountId(fromUserId));
 }
-function findActiveWxSession(sm, fromUserId, activeOverrides, accessLevel) {
-  return findActiveSessionId(sm, fromUserId, buildWxSessionPrefix(fromUserId), activeOverrides, accessLevel);
+function findActiveWxSession(sm, fromUserId, activeOverrides2, accessLevel) {
+  return findActiveSessionId(sm, fromUserId, buildWxSessionPrefix(fromUserId), activeOverrides2, accessLevel);
 }
-async function getOrCreateActiveSession2(sm, fromUserId, activeOverrides, accessLevel, workspacePath) {
-  const existing = findActiveWxSession(sm, fromUserId, activeOverrides, accessLevel === null ? "full" : accessLevel);
+async function getOrCreateActiveSession2(sm, fromUserId, activeOverrides2, accessLevel, workspacePath) {
+  const existing = findActiveWxSession(sm, fromUserId, activeOverrides2, accessLevel === null ? "full" : accessLevel);
   if (existing)
     return existing;
   const newId = `${buildWxSessionPrefix(fromUserId)}${Date.now().toString(36)}`;
@@ -22194,7 +22754,7 @@ async function getOrCreateActiveSession2(sm, fromUserId, activeOverrides, access
   return newId;
 }
 async function handleInbound(args) {
-  const { registry: registry2, db, account: storedAccount, msg, unsubscribers, activeOverrides, sessionContextTokens, restartSelf, startNewAccount } = args;
+  const { registry: registry2, db, account: storedAccount, msg, unsubscribers, activeOverrides: activeOverrides2, sessionContextTokens, restartSelf, startNewAccount } = args;
   const fromUserId = msg.from_user_id ?? "";
   if (!fromUserId)
     return;
@@ -22228,7 +22788,7 @@ async function handleInbound(args) {
       restartSelf,
       startNewAccount,
       registry: registry2,
-      activeOverrides,
+      activeOverrides: activeOverrides2,
       unsubscribers,
       sessionContextTokens,
       lang
@@ -22240,7 +22800,7 @@ async function handleInbound(args) {
   rememberLastActiveChat(db, account.accountId, fromUserId);
   const sm = registry2.getOrCreate(account.workspacePath);
   const sessionAccessLevel = account.accessLevel === "full" ? null : account.accessLevel === "workspace" ? "workspace" : "readonly";
-  const sessionId = await getOrCreateActiveSession2(sm, fromUserId, activeOverrides, sessionAccessLevel, account.workspacePath);
+  const sessionId = await getOrCreateActiveSession2(sm, fromUserId, activeOverrides2, sessionAccessLevel, account.workspacePath);
   if (sm.isSessionCompacting(sessionId)) {
     await sendToUser({
       account,
@@ -22298,7 +22858,7 @@ ${userText}`;
   });
 }
 async function handleSlashCommand(args) {
-  const { text: text5, account, db, fromUserId, contextToken, restartSelf, startNewAccount, registry: registry2, activeOverrides, unsubscribers, sessionContextTokens, lang } = args;
+  const { text: text5, account, db, fromUserId, contextToken, restartSelf, startNewAccount, registry: registry2, activeOverrides: activeOverrides2, unsubscribers, sessionContextTokens, lang } = args;
   const reply = (msg) => sendToUser({ account, toUserId: fromUserId, text: msg, contextToken });
   function ensureListener(sm2, sessionId) {
     if (unsubscribers.has(sessionId))
@@ -22340,7 +22900,7 @@ async function handleSlashCommand(args) {
     sessionPrefix: buildWxSessionPrefix(fromUserId),
     accessLevel: account.accessLevel,
     channelLabel: `WeChat: ${fromUserId}`,
-    activeOverrides,
+    activeOverrides: activeOverrides2,
     workspacePath: account.workspacePath,
     lang,
     // WeChat's "chat id" for cron purposes is the openId of the user
@@ -22366,7 +22926,7 @@ async function handleSlashCommand(args) {
       restartSelf();
     } else {
       if (result.switchTo) {
-        const oldSid = findActiveSessionId(sm, fromUserId, ctx.sessionPrefix, activeOverrides, ctx.accessLevel);
+        const oldSid = findActiveSessionId(sm, fromUserId, ctx.sessionPrefix, activeOverrides2, ctx.accessLevel);
         if (oldSid && oldSid !== result.switchTo) {
           unsubscribers.get(oldSid)?.();
           unsubscribers.delete(oldSid);
@@ -22393,7 +22953,7 @@ async function handleSlashCommand(args) {
         await reply(login.message);
         return true;
       }
-      const tmpPath = path53.join(tempDir(), `halo-qr-${login.sessionKey}.png`);
+      const tmpPath = path54.join(tempDir(), `halo-qr-${login.sessionKey}.png`);
       await QRCode.toFile(tmpPath, login.qrcodeUrl, { width: 256, margin: 2 });
       await sendMediaFile({
         baseUrl: account.baseUrl,
@@ -22402,7 +22962,7 @@ async function handleSlashCommand(args) {
         contextToken,
         filePath: tmpPath
       });
-      await fs47.promises.unlink(tmpPath).catch(() => {
+      await fs48.promises.unlink(tmpPath).catch(() => {
       });
       await reply(t("wechat.qr_sent", lang, { level, path: account.workspacePath }));
       waitLogin({ sessionKey: login.sessionKey }).then(async (result2) => {
@@ -22480,18 +23040,18 @@ var init_handler3 = __esm({
 });
 
 // packages/server/dist/routes/weixin.js
-import { Hono as Hono13 } from "hono";
-import path54 from "node:path";
-import fs48 from "node:fs";
+import { Hono as Hono14 } from "hono";
+import path55 from "node:path";
+import fs49 from "node:fs";
 function createWeixinRoutes(deps) {
   const { db, channel } = deps;
-  const app2 = new Hono13();
+  const app2 = new Hono14();
   app2.get("/weixin/accounts", (c) => {
     const accounts = listAccounts4(db).map((acc) => {
       return {
         ...stripSecrets(acc),
         workspacePath: acc.workspacePath,
-        workspaceMissing: !fs48.existsSync(acc.workspacePath)
+        workspaceMissing: !fs49.existsSync(acc.workspacePath)
       };
     });
     return c.json({ accounts });
@@ -22507,14 +23067,14 @@ function createWeixinRoutes(deps) {
       return c.json({ error: "sessionKey required" }, 400);
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path54.isAbsolute(body.workspacePath))
+    if (!path55.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
     const accessLevel = body.accessLevel === "full" ? "full" : body.accessLevel === "workspace" ? "workspace" : "readonly";
     const result = await waitLogin({ sessionKey: body.sessionKey, timeoutMs: body.timeoutMs });
     if (!result.connected || !result.accountId || !result.botToken || !result.baseUrl) {
       return c.json({ connected: false, message: result.message }, 200);
     }
-    if (!fs48.existsSync(body.workspacePath))
+    if (!fs49.existsSync(body.workspacePath))
       return c.json({ error: "workspace path not found" }, 400);
     ensureWorkspaceHalo(body.workspacePath);
     const normalized = normalizeAccountId(result.accountId);
@@ -22552,7 +23112,7 @@ function createWeixinRoutes(deps) {
     if (!existing)
       return c.json({ error: "not found" }, 404);
     const body = await c.req.json().catch(() => ({}));
-    if (body.workspacePath !== void 0 && !path54.isAbsolute(body.workspacePath)) {
+    if (body.workspacePath !== void 0 && !path55.isAbsolute(body.workspacePath)) {
       return c.json({ error: "workspacePath must be absolute" }, 400);
     }
     if (body.accessLevel !== void 0 && body.accessLevel !== "full" && body.accessLevel !== "workspace" && body.accessLevel !== "readonly") {
@@ -22560,7 +23120,7 @@ function createWeixinRoutes(deps) {
     }
     const patch = { ...body };
     if (body.workspacePath !== void 0) {
-      if (!fs48.existsSync(body.workspacePath))
+      if (!fs49.existsSync(body.workspacePath))
         return c.json({ error: "workspace path not found" }, 400);
       ensureWorkspaceHalo(body.workspacePath);
       patch.workspacePath = body.workspacePath;
@@ -22679,20 +23239,20 @@ function buildWebSessionPrefix(accountId) {
 }
 function createWebChannel(deps) {
   const { registry: registry2, db } = deps;
-  const activeOverrides = /* @__PURE__ */ new Map();
+  const activeOverrides2 = /* @__PURE__ */ new Map();
   function getActiveSessionId(sm, accountId) {
     const prefix = buildWebSessionPrefix(accountId);
-    return findActiveSessionId(sm, accountId, prefix, activeOverrides, "full") ?? void 0;
+    return findActiveSessionId(sm, accountId, prefix, activeOverrides2, "full") ?? void 0;
   }
   function resolveWorkspace(account, override) {
-    let path62 = account.workspacePath;
+    let path63 = account.workspacePath;
     if (override && override !== account.workspacePath) {
       if (account.accessLevel !== "full") {
         return { ok: false, error: "workspace override requires a full-access token" };
       }
-      path62 = override;
+      path63 = override;
     }
-    const resolved = resolveAccountWorkspace({ ...account, workspacePath: path62 });
+    const resolved = resolveAccountWorkspace({ ...account, workspacePath: path63 });
     if (!resolved)
       return { ok: false, error: "workspace not found" };
     return { ok: true, path: resolved };
@@ -22704,7 +23264,7 @@ function createWebChannel(deps) {
       sessionPrefix: buildWebSessionPrefix(account.accountId),
       accessLevel: account.accessLevel,
       channelLabel: `Web: ${account.label || account.accountId}`,
-      activeOverrides,
+      activeOverrides: activeOverrides2,
       workspacePath: account.workspacePath,
       lang: getLang(account),
       // Web is SSE-only, no per-conversation chat id — but the channel
@@ -22805,7 +23365,7 @@ function createWebChannel(deps) {
       const agentId = opts?.agentId || await resolveDefaultAgentId(sm, workspace);
       await sm.createSession(agentId, null, `Web: ${account.label || account.accountId}`, void 0, sessionId, void 0, accessLevel);
       if (!opts?.sessionId)
-        activeOverrides.set(account.accountId, sessionId);
+        activeOverrides2.set(account.accountId, sessionId);
     }
     yield sseData({ type: "session", sessionId });
     const queue = [];
@@ -23075,21 +23635,21 @@ var init_handler4 = __esm({
 });
 
 // packages/server/dist/routes/web.js
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 import { streamSSE } from "hono/streaming";
 import crypto4 from "node:crypto";
-import path55 from "node:path";
-import fs49 from "node:fs";
+import path56 from "node:path";
+import fs50 from "node:fs";
 function createWebRoutes(deps) {
   const { db, channel } = deps;
-  const app2 = new Hono14();
+  const app2 = new Hono15();
   app2.get("/web/accounts", (c) => {
     const accounts = listAccounts2(db).map((acc) => {
       return {
         accountId: acc.accountId,
         token: acc.token,
         workspacePath: acc.workspacePath,
-        workspaceMissing: !fs49.existsSync(acc.workspacePath),
+        workspaceMissing: !fs50.existsSync(acc.workspacePath),
         label: acc.label,
         enabled: acc.enabled,
         accessLevel: acc.accessLevel,
@@ -23104,9 +23664,9 @@ function createWebRoutes(deps) {
     const body = await c.req.json().catch(() => ({}));
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path55.isAbsolute(body.workspacePath))
+    if (!path56.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
-    if (!fs49.existsSync(body.workspacePath))
+    if (!fs50.existsSync(body.workspacePath))
       return c.json({ error: "workspace path not found" }, 400);
     ensureWorkspaceHalo(body.workspacePath);
     const accountId = crypto4.randomUUID().slice(0, 8);
@@ -23137,7 +23697,7 @@ function createWebRoutes(deps) {
     if (body.enabled !== void 0)
       patch.enabled = body.enabled ? 1 : 0;
     if (body.workspacePath) {
-      if (!fs49.existsSync(body.workspacePath))
+      if (!fs50.existsSync(body.workspacePath))
         return c.json({ error: "workspace path not found" }, 400);
       ensureWorkspaceHalo(body.workspacePath);
       patch.workspacePath = body.workspacePath;
@@ -23242,18 +23802,27 @@ function createWebRoutes(deps) {
     const filePath = c.req.query("path");
     if (!filePath)
       return c.json({ error: "path required" }, 400);
-    const path62 = await import("node:path");
-    const resolved = path62.default.resolve(account.workspacePath, filePath);
-    const root = path62.default.resolve(account.workspacePath);
-    if (resolved !== root && !resolved.startsWith(root + path62.default.sep)) {
+    const path63 = await import("node:path");
+    const resolved = path63.default.resolve(account.workspacePath, filePath);
+    const root = path63.default.resolve(account.workspacePath);
+    if (resolved !== root && !resolved.startsWith(root + path63.default.sep)) {
       return c.json({ error: "path traversal not allowed" }, 403);
     }
-    if (!fs49.existsSync(resolved))
+    let real;
+    let realRoot;
+    try {
+      real = fs50.realpathSync(resolved);
+      realRoot = fs50.realpathSync(root);
+    } catch {
       return c.json({ error: "file not found" }, 404);
-    const stat = fs49.statSync(resolved);
+    }
+    if (real !== realRoot && !real.startsWith(realRoot + path63.default.sep)) {
+      return c.json({ error: "path traversal not allowed" }, 403);
+    }
+    const stat = fs50.statSync(real);
     if (stat.isDirectory())
       return c.json({ error: "cannot serve directory" }, 400);
-    const ext = path62.default.extname(resolved).toLowerCase();
+    const ext = path63.default.extname(real).toLowerCase();
     const mimeMap = {
       ".png": "image/png",
       ".jpg": "image/jpeg",
@@ -23267,8 +23836,8 @@ function createWebRoutes(deps) {
       ".txt": "text/plain"
     };
     const contentType = mimeMap[ext] || "application/octet-stream";
-    const fileName = path62.default.basename(resolved);
-    const data = fs49.readFileSync(resolved);
+    const fileName = path63.default.basename(resolved);
+    const data = fs50.readFileSync(real);
     c.header("content-type", contentType);
     c.header("content-disposition", `inline; filename="${fileName}"`);
     return c.body(data);
@@ -23429,12 +23998,12 @@ function splitInlineCode(line) {
   return segs.length > 0 ? segs : [{ text: line, code: false }];
 }
 function transformProse(text5) {
-  text5 = text5.replace(/^(#{1,6})\s+(.*)$/, (_m, _h, body) => `*${body}*`);
   text5 = text5.replace(/(?<!!)\[([^\]]+)\]\(([^)\s]+)\)/g, "<$2|$1>");
-  text5 = text5.replace(/\*\*([^*\n]+?)\*\*/g, "*$1*");
-  text5 = text5.replace(/__([^_\n]+?)__/g, "*$1*");
   text5 = text5.replace(/(?<![*_])\*(?!\*)([^*\n]+?)(?<!\*)\*(?!\*)/g, "_$1_");
   text5 = text5.replace(/(?<![_*])_(?!_)([^_\n]+?)(?<!_)_(?!_)/g, "_$1_");
+  text5 = text5.replace(/\*\*([^*\n]+?)\*\*/g, "*$1*");
+  text5 = text5.replace(/__([^_\n]+?)__/g, "*$1*");
+  text5 = text5.replace(/^(#{1,6})\s+(.*)$/, (_m, _h, body) => `*${body}*`);
   return text5;
 }
 function formatForFeishu(input) {
@@ -23598,10 +24167,10 @@ async function authTest(botToken) {
   return slackPost("auth.test", botToken, {});
 }
 async function uploadFile(args) {
-  const fs54 = await import("node:fs");
-  const path62 = await import("node:path");
-  const filename = args.filename ?? path62.basename(args.filePath);
-  const stat = fs54.statSync(args.filePath);
+  const fs55 = await import("node:fs");
+  const path63 = await import("node:path");
+  const filename = args.filename ?? path63.basename(args.filePath);
+  const stat = fs55.statSync(args.filePath);
   if (!stat.isFile())
     throw new Error(`[slack:uploadFile] not a regular file: ${args.filePath}`);
   const length = stat.size;
@@ -23619,7 +24188,7 @@ async function uploadFile(args) {
   if (step1Parsed.ok === false || !step1Parsed.upload_url || !step1Parsed.file_id) {
     throw new Error(`[slack:files.getUploadURLExternal] ${step1Parsed.error ?? "unknown"}`);
   }
-  const buf = fs54.readFileSync(args.filePath);
+  const buf = fs55.readFileSync(args.filePath);
   const step2 = await fetch(step1Parsed.upload_url, {
     method: "POST",
     body: buf
@@ -23764,7 +24333,7 @@ var init_api2 = __esm({
 });
 
 // packages/server/dist/channels/slack/handler.js
-import path56 from "node:path";
+import path57 from "node:path";
 import { WebSocket } from "ws";
 function slashToBang(text5, commandNames) {
   if (commandNames.length === 0)
@@ -23774,9 +24343,9 @@ function slashToBang(text5, commandNames) {
   return text5.replace(re, "$1!$2");
 }
 function isPathAllowed2(filePath, workspacePath) {
-  const resolved = path56.resolve(filePath);
-  const wsResolved = path56.resolve(workspacePath);
-  return resolved.startsWith(wsResolved + path56.sep) || resolved === wsResolved || isInTempDir(resolved);
+  const resolved = path57.resolve(filePath);
+  const wsResolved = path57.resolve(workspacePath);
+  return resolved.startsWith(wsResolved + path57.sep) || resolved === wsResolved || isInTempDir(resolved);
 }
 function rememberEventId(id) {
   if (SEEN_EVENT_IDS.has(id))
@@ -24048,7 +24617,7 @@ async function handleInbound2(args) {
         await postMessage({ botToken: account.botToken, channel: channelId, threadTs: replyTs, text: chunk });
       },
       sendMedia: async (filePath) => {
-        const resolved = path56.resolve(filePath);
+        const resolved = path57.resolve(filePath);
         if (!isPathAllowed2(resolved, workspace)) {
           console.log(`[slack] sendMedia blocked: ${filePath} not under workspace`);
           return;
@@ -24066,7 +24635,7 @@ async function handleInbound2(args) {
             botToken: account.botToken,
             channel: channelId,
             threadTs: replyTs,
-            text: `\u26A0\uFE0F Failed to upload \`${path56.basename(filePath)}\`: ${err instanceof Error ? err.message : String(err)}`
+            text: `\u26A0\uFE0F Failed to upload \`${path57.basename(filePath)}\`: ${err instanceof Error ? err.message : String(err)}`
           }).catch(() => {
           });
         }
@@ -24142,12 +24711,12 @@ var init_handler5 = __esm({
 });
 
 // packages/server/dist/routes/slack.js
-import { Hono as Hono15 } from "hono";
-import fs50 from "node:fs";
-import path57 from "node:path";
+import { Hono as Hono16 } from "hono";
+import fs51 from "node:fs";
+import path58 from "node:path";
 function createSlackRoutes(deps) {
   const { db, channel } = deps;
-  const app2 = new Hono15();
+  const app2 = new Hono16();
   app2.get("/slack/accounts/:id/search", async (c) => {
     const id = c.req.param("id");
     const q = c.req.query("q") ?? "";
@@ -24167,7 +24736,7 @@ function createSlackRoutes(deps) {
       botUserId: a.botUserId,
       teamId: a.teamId,
       workspacePath: a.workspacePath,
-      workspaceMissing: !fs50.existsSync(a.workspacePath),
+      workspaceMissing: !fs51.existsSync(a.workspacePath),
       label: a.label,
       enabled: a.enabled,
       accessLevel: a.accessLevel,
@@ -24187,9 +24756,9 @@ function createSlackRoutes(deps) {
       return c.json({ error: "appToken must start with xapp-" }, 400);
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path57.isAbsolute(body.workspacePath))
+    if (!path58.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
-    if (!fs50.existsSync(body.workspacePath))
+    if (!fs51.existsSync(body.workspacePath))
       return c.json({ error: "workspace path not found" }, 400);
     ensureWorkspaceHalo(body.workspacePath);
     let identity;
@@ -24249,7 +24818,7 @@ function createSlackRoutes(deps) {
     if (body.enabled !== void 0)
       patch.enabled = body.enabled ? 1 : 0;
     if (body.workspacePath) {
-      if (!fs50.existsSync(body.workspacePath))
+      if (!fs51.existsSync(body.workspacePath))
         return c.json({ error: "workspace path not found" }, 400);
       ensureWorkspaceHalo(body.workspacePath);
       patch.workspacePath = body.workspacePath;
@@ -24663,10 +25232,10 @@ async function replyMessage(args) {
   return { message_id: parsed.data?.message_id ?? "" };
 }
 async function uploadImage(args) {
-  const fs54 = await import("node:fs");
-  const path62 = await import("node:path");
-  const buf = fs54.readFileSync(args.filePath);
-  const filename = path62.basename(args.filePath);
+  const fs55 = await import("node:fs");
+  const path63 = await import("node:path");
+  const buf = fs55.readFileSync(args.filePath);
+  const filename = path63.basename(args.filePath);
   const send = async (token2) => {
     const form = new FormData();
     form.append("image_type", "message");
@@ -24697,10 +25266,10 @@ async function uploadImage(args) {
   return { imageKey: parsed.data.image_key };
 }
 async function uploadFile2(args) {
-  const fs54 = await import("node:fs");
-  const path62 = await import("node:path");
-  const buf = fs54.readFileSync(args.filePath);
-  const filename = args.filename ?? path62.basename(args.filePath);
+  const fs55 = await import("node:fs");
+  const path63 = await import("node:path");
+  const buf = fs55.readFileSync(args.filePath);
+  const filename = args.filename ?? path63.basename(args.filePath);
   const send = async (token2) => {
     const form = new FormData();
     form.append("file_type", args.fileType);
@@ -24806,12 +25375,12 @@ var init_api3 = __esm({
 });
 
 // packages/server/dist/channels/feishu/handler.js
-import path58 from "node:path";
+import path59 from "node:path";
 import * as Lark from "@larksuiteoapi/node-sdk";
 function isPathAllowed3(filePath, workspacePath) {
-  const resolved = path58.resolve(filePath);
-  const wsResolved = path58.resolve(workspacePath);
-  return resolved.startsWith(wsResolved + path58.sep) || resolved === wsResolved || isInTempDir(resolved);
+  const resolved = path59.resolve(filePath);
+  const wsResolved = path59.resolve(workspacePath);
+  return resolved.startsWith(wsResolved + path59.sep) || resolved === wsResolved || isInTempDir(resolved);
 }
 function newAccountState2() {
   return {
@@ -25053,7 +25622,7 @@ async function handleInbound3(args) {
         await replyToInbound({ account, inboundMessageId, isP2P, chatId, text: chunk });
       },
       sendMedia: async (filePath) => {
-        const resolved = path58.resolve(filePath);
+        const resolved = path59.resolve(filePath);
         if (!isPathAllowed3(resolved, workspace)) {
           console.log(`[feishu] sendMedia blocked: ${filePath} not under workspace`);
           return;
@@ -25073,7 +25642,7 @@ async function handleInbound3(args) {
             inboundMessageId,
             isP2P,
             chatId,
-            text: `\u26A0\uFE0F \u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF1A${path58.basename(filePath)} \u2014 ${err instanceof Error ? err.message : String(err)}`
+            text: `\u26A0\uFE0F \u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF1A${path59.basename(filePath)} \u2014 ${err instanceof Error ? err.message : String(err)}`
           }).catch(() => {
           });
         }
@@ -25103,7 +25672,7 @@ async function replyToInbound(args) {
 async function sendFeishuMedia(args) {
   const { account, inboundMessageId, isP2P, chatId, filePath } = args;
   const cls = classifyMedia(filePath);
-  const ext = path58.extname(filePath).toLowerCase();
+  const ext = path59.extname(filePath).toLowerCase();
   if (cls === "image") {
     const { imageKey } = await uploadImage({ appId: account.appId, appSecret: account.appSecret, filePath });
     await replyToInboundRaw({
@@ -25241,12 +25810,12 @@ var init_handler6 = __esm({
 });
 
 // packages/server/dist/routes/feishu.js
-import { Hono as Hono16 } from "hono";
-import fs51 from "node:fs";
-import path59 from "node:path";
+import { Hono as Hono17 } from "hono";
+import fs52 from "node:fs";
+import path60 from "node:path";
 function createFeishuRoutes(deps) {
   const { db, channel } = deps;
-  const app2 = new Hono16();
+  const app2 = new Hono17();
   app2.get("/feishu/accounts/:id/search", async (c) => {
     const id = c.req.param("id");
     const q = c.req.query("q") ?? "";
@@ -25267,7 +25836,7 @@ function createFeishuRoutes(deps) {
       botOpenId: a.botOpenId,
       hasEncryptKey: !!a.encryptKey,
       workspacePath: a.workspacePath,
-      workspaceMissing: !fs51.existsSync(a.workspacePath),
+      workspaceMissing: !fs52.existsSync(a.workspacePath),
       label: a.label,
       enabled: a.enabled,
       accessLevel: a.accessLevel,
@@ -25285,9 +25854,9 @@ function createFeishuRoutes(deps) {
       return c.json({ error: "appSecret required" }, 400);
     if (!body.workspacePath)
       return c.json({ error: "workspacePath required" }, 400);
-    if (!path59.isAbsolute(body.workspacePath))
+    if (!path60.isAbsolute(body.workspacePath))
       return c.json({ error: "workspacePath must be absolute" }, 400);
-    if (!fs51.existsSync(body.workspacePath))
+    if (!fs52.existsSync(body.workspacePath))
       return c.json({ error: "workspace path not found" }, 400);
     ensureWorkspaceHalo(body.workspacePath);
     let botOpenId;
@@ -25351,7 +25920,7 @@ function createFeishuRoutes(deps) {
     if (body.enabled !== void 0)
       patch.enabled = body.enabled ? 1 : 0;
     if (body.workspacePath) {
-      if (!fs51.existsSync(body.workspacePath))
+      if (!fs52.existsSync(body.workspacePath))
         return c.json({ error: "workspace path not found" }, 400);
       ensureWorkspaceHalo(body.workspacePath);
       patch.workspacePath = body.workspacePath;
@@ -25480,7 +26049,7 @@ var init_descriptors = __esm({
 });
 
 // packages/server/dist/middleware/auth.js
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
 import crypto5 from "node:crypto";
 function passwordHash() {
@@ -25581,7 +26150,7 @@ function setTokenCookie(c, token) {
   });
 }
 function createAuthRoutes() {
-  const app2 = new Hono17();
+  const app2 = new Hono18();
   app2.post("/auth/login", async (c) => {
     const ip = getClientIp(c);
     if (isLockedOut2(ip)) {
@@ -25623,14 +26192,14 @@ function createAuthRoutes() {
 }
 function authMiddleware() {
   return async (c, next) => {
-    const path62 = c.req.path;
-    if (PUBLIC_PATHS.some((p) => path62 === p || path62.startsWith(p + "?"))) {
+    const path63 = c.req.path;
+    if (PUBLIC_PATHS.some((p) => path63 === p || path63.startsWith(p + "?"))) {
       return next();
     }
     const token = getCookie(c, COOKIE_NAME);
     const payload = validateToken(token);
     if (!payload) {
-      if (!path62.startsWith("/api/")) {
+      if (!path63.startsWith("/api/")) {
         return next();
       }
       return c.json({ error: "Unauthorized" }, 401);
@@ -25662,22 +26231,22 @@ var init_auth = __esm({
 
 // packages/server/dist/index.js
 var dist_exports = {};
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 import { cors } from "hono/cors";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { WebSocketServer } from "ws";
-import path60 from "node:path";
-import fs52 from "node:fs";
+import path61 from "node:path";
+import fs53 from "node:fs";
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { homedir as homedir23 } from "node:os";
+import { homedir as homedir24 } from "node:os";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function findProjectRoot() {
   let dir = process.cwd();
   for (let i = 0; i < 32; i++) {
-    if (fs52.existsSync(path60.join(dir, "pnpm-workspace.yaml")))
+    if (fs53.existsSync(path61.join(dir, "pnpm-workspace.yaml")))
       return dir;
-    const parent = path60.dirname(dir);
+    const parent = path61.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -25686,15 +26255,15 @@ function findProjectRoot() {
   return process.cwd();
 }
 function acquireSingleInstanceLock(lockFile) {
-  fs52.mkdirSync(path60.dirname(lockFile), { recursive: true });
-  const fd = fs52.openSync(lockFile, fs52.constants.O_RDWR | fs52.constants.O_CREAT, 420);
+  fs53.mkdirSync(path61.dirname(lockFile), { recursive: true });
+  const fd = fs53.openSync(lockFile, fs53.constants.O_RDWR | fs53.constants.O_CREAT, 420);
   const result = spawnSync4("flock", ["-n", "3"], {
     stdio: ["ignore", "ignore", "ignore", fd]
   });
   if (result.error) {
     const content = readLockPid(fd);
     if (content > 0 && isProcessAlive(content)) {
-      fs52.closeSync(fd);
+      fs53.closeSync(fd);
       console.error(`[Server] another halo server is already running (pid ${content}). kill it first.`);
       process.exit(1);
     }
@@ -25703,19 +26272,19 @@ function acquireSingleInstanceLock(lockFile) {
     if (content > 0 && !isProcessAlive(content)) {
       console.warn(`[Server] removing stale server.lock (pid ${content} not running)`);
     } else {
-      fs52.closeSync(fd);
+      fs53.closeSync(fd);
       console.error(`[Server] another halo server is already running${content > 0 ? ` (pid ${content})` : ""}. kill it first.`);
       process.exit(1);
     }
   }
-  fs52.ftruncateSync(fd);
-  fs52.writeSync(fd, String(process.pid));
-  fs52.fsyncSync(fd);
+  fs53.ftruncateSync(fd);
+  fs53.writeSync(fd, String(process.pid));
+  fs53.fsyncSync(fd);
 }
 function readLockPid(fd) {
   try {
     const buf = Buffer.alloc(32);
-    const n = fs52.readSync(fd, buf, 0, 32, 0);
+    const n = fs53.readSync(fd, buf, 0, 32, 0);
     return parseInt(buf.subarray(0, n).toString("utf-8").trim(), 10) || 0;
   } catch {
     return 0;
@@ -25744,14 +26313,14 @@ function isProcessAlive(pid) {
 }
 function resolveFrontendDir() {
   if (process.env.HALO_FRONTEND_DIR)
-    return path60.resolve(process.env.HALO_FRONTEND_DIR);
-  const bundled = path60.resolve(__dirname3, "..", "admin-out");
-  if (fs52.existsSync(path60.join(bundled, "index.html")))
+    return path61.resolve(process.env.HALO_FRONTEND_DIR);
+  const bundled = path61.resolve(__dirname3, "..", "admin-out");
+  if (fs53.existsSync(path61.join(bundled, "index.html")))
     return bundled;
-  const sibling = path60.resolve(__dirname3, "..", "..", "admin", "out");
-  if (fs52.existsSync(path60.join(sibling, "index.html")))
+  const sibling = path61.resolve(__dirname3, "..", "..", "admin", "out");
+  if (fs53.existsSync(path61.join(sibling, "index.html")))
     return sibling;
-  return path60.resolve(PROJECT_ROOT, "packages", "admin", "out");
+  return path61.resolve(PROJECT_ROOT, "packages", "admin", "out");
 }
 async function gracefulShutdown(signal) {
   console.log(`[Server] Received ${signal}, shutting down gracefully...`);
@@ -25768,7 +26337,7 @@ async function gracefulShutdown(signal) {
   console.log("[Server] Shutdown complete");
   process.exit(0);
 }
-var __dirname3, PORT, HALO_VERSION, PROJECT_ROOT, HALO_HOME4, app, allowlist, authRoutes, fileRoutes, gitRoutes, agentConfigRoutes, skillRoutes, settingsRoutes, evolutionRoutes, cronRoutes, channelDb, registry, sessionRoutes, showRoutes, metricsRoutes, commandRoutes, FRONTEND_DIR, server, wss;
+var __dirname3, PORT, HALO_VERSION, PROJECT_ROOT, HALO_HOME4, AGENTCORE, app, allowlist, authRoutes, fileRoutes, gitRoutes, agentConfigRoutes, skillRoutes, settingsRoutes, evolutionRoutes, cronRoutes, channelDb, registry, sessionRoutes, showRoutes, metricsRoutes, commandRoutes, FRONTEND_DIR, server, wss;
 var init_dist2 = __esm({
   async "packages/server/dist/index.js"() {
     "use strict";
@@ -25782,6 +26351,7 @@ var init_dist2 = __esm({
     init_show();
     init_metrics();
     init_commands3();
+    init_agentcore();
     init_commands();
     init_commands2();
     init_handler();
@@ -25803,12 +26373,12 @@ var init_dist2 = __esm({
     init_sandbox();
     init_init();
     init_git_ssh();
-    __dirname3 = path60.dirname(fileURLToPath3(import.meta.url));
+    __dirname3 = path61.dirname(fileURLToPath3(import.meta.url));
     PORT = config.server.port;
-    HALO_VERSION = "0.2.1";
+    HALO_VERSION = "0.2.3";
     PROJECT_ROOT = findProjectRoot();
-    HALO_HOME4 = path60.join(homedir23(), ".halo");
-    if (!fs52.existsSync(path60.join(HALO_HOME4, "global", ".template-version"))) {
+    HALO_HOME4 = path61.join(homedir24(), ".halo");
+    if (!fs53.existsSync(path61.join(HALO_HOME4, "global", ".template-version"))) {
       process.stderr.write("\x1B[31m[Server] ~/.halo/global/ not initialized. Run `halo setup` first.\x1B[0m\n");
       process.exit(1);
     }
@@ -25823,11 +26393,13 @@ var init_dist2 = __esm({
         }
       }
     }
-    if (!config.server.password && !config.server.passwordEnvPlaintext || !config.server.jwtSecret) {
+    AGENTCORE = config.server.runtimeMode === "agentcore";
+    if (!AGENTCORE && (!config.server.password && !config.server.passwordEnvPlaintext || !config.server.jwtSecret)) {
       process.stderr.write("\x1B[31m[Server] admin password not configured. Run `halo setup` to set one, or set the HALO_PASSWORD env.\x1B[0m\n");
       process.exit(1);
     }
-    acquireSingleInstanceLock(path60.join(HALO_HOME4, "global", "server.lock"));
+    if (!AGENTCORE)
+      acquireSingleInstanceLock(path61.join(HALO_HOME4, "global", "server.lock"));
     {
       const declared = new Set(commandRegistry.listDescriptors().filter((d) => d.source === "builtin").map((d) => d.slashName));
       const dispatched = new Set(DISPATCH_COMMANDS);
@@ -25852,7 +26424,7 @@ var init_dist2 = __esm({
     ensureSshAgent();
     console.log(`[Server] Halo home: ${HALO_HOME4}`);
     console.log("[Server] Services initialized (ModelRuntime)");
-    app = new Hono18();
+    app = new Hono19();
     allowlist = config.server.corsOrigins;
     app.use("/*", cors({
       origin: allowlist.length > 0 ? (origin) => origin && allowlist.includes(origin) ? origin : null : (origin) => origin ?? "*",
@@ -25892,13 +26464,15 @@ var init_dist2 = __esm({
     app.route("/api", evolutionRoutes);
     cronRoutes = createCronRoutes();
     app.route("/api", cronRoutes);
-    channelDb = createChannelDb(path60.join(HALO_HOME4, "secrets"));
+    channelDb = createChannelDb(path61.join(HALO_HOME4, "secrets"));
     setChannelDb(channelDb);
-    setEvoDb(createEvoDb(path60.join(HALO_HOME4, "global")));
-    setCronDb(createCronDb(path60.join(HALO_HOME4, "global")));
+    setEvoDb(createEvoDb(path61.join(HALO_HOME4, "global")));
+    setCronDb(createCronDb(path61.join(HALO_HOME4, "global")));
     setEvoSpawner(realEvoSpawner);
-    startEvoTicker();
-    startArchiveDaemon();
+    if (!AGENTCORE) {
+      startEvoTicker();
+      startArchiveDaemon();
+    }
     registry = new SessionManagerRegistry({ reconcileOrphansOnBoot: true });
     sessionRoutes = createSessionRoutes(registry);
     app.route("/api", sessionRoutes);
@@ -25908,14 +26482,20 @@ var init_dist2 = __esm({
     app.route("/api", metricsRoutes);
     commandRoutes = createCommandRoutes(commandRegistry, registry);
     app.route("/api", commandRoutes);
-    bootChannels(app, defaultChannelDescriptors, { registry, db: channelDb });
-    startCronDaemon();
+    if (!AGENTCORE) {
+      bootChannels(app, defaultChannelDescriptors, { registry, db: channelDb });
+      startCronDaemon();
+    } else {
+      const agentcoreRoutes = createAgentCoreRoutes({ registry, workspace: config.server.agentcoreWorkspace });
+      app.route("/", agentcoreRoutes);
+      console.log(`[Server] AgentCore runtime mode \u2014 workspace: ${config.server.agentcoreWorkspace}`);
+    }
     FRONTEND_DIR = resolveFrontendDir();
-    app.use("/*", serveStatic({ root: path60.relative(process.cwd(), FRONTEND_DIR) }));
+    app.use("/*", serveStatic({ root: path61.relative(process.cwd(), FRONTEND_DIR) }));
     app.get("/*", (c) => {
-      const indexPath = path60.join(FRONTEND_DIR, "index.html");
+      const indexPath = path61.join(FRONTEND_DIR, "index.html");
       try {
-        const html = fs52.readFileSync(indexPath, "utf-8");
+        const html = fs53.readFileSync(indexPath, "utf-8");
         return c.html(html);
       } catch {
         return c.text("Frontend not built. Run: cd packages/admin && npx next build", 503);
@@ -25934,7 +26514,9 @@ var init_dist2 = __esm({
     wss = new WebSocketServer({
       server,
       path: "/ws",
-      verifyClient: (info, callback) => {
+      // AgentCore terminates auth upstream (SigV4/OAuth) before the connection
+      // reaches the container, so its /ws is open; normal mode keeps cookie auth.
+      verifyClient: AGENTCORE ? void 0 : (info, callback) => {
         const token = getTokenFromCookieHeader(info.req.headers.cookie);
         if (isAuthenticated(token)) {
           callback(true);
@@ -25943,8 +26525,12 @@ var init_dist2 = __esm({
         }
       }
     });
-    setupWebSocketHandler({ wss, registry });
-    setBroadcastWss(wss);
+    if (AGENTCORE) {
+      setupAgentCoreWebSocket({ wss, registry, workspace: config.server.agentcoreWorkspace });
+    } else {
+      setupWebSocketHandler({ wss, registry });
+      setBroadcastWss(wss);
+    }
     console.log(`[Server] WebSocket server ready on ws://localhost:${PORT}/ws`);
     process.on("SIGINT", () => gracefulShutdown("SIGINT"));
     process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
@@ -26678,11 +27264,11 @@ process.emitWarning = (warning, ...args) => {
 };
 
 // packages/cli/src/index.ts
-import path61 from "node:path";
-import fs53 from "node:fs";
-import { homedir as homedir24 } from "node:os";
+import path62 from "node:path";
+import fs54 from "node:fs";
+import { homedir as homedir25 } from "node:os";
 import { parseArgs as parseArgs2 } from "node:util";
-var VERSION = "0.2.1";
+var VERSION = "0.2.3";
 var HELP_TOP = `Usage: halo <command> [options]
 
 Commands:
@@ -26918,11 +27504,19 @@ async function cmdSetup(argv = []) {
   const { hashPassword: hashPassword2, generateJwtSecret: generateJwtSecret2 } = await Promise.resolve().then(() => (init_password_hash(), password_hash_exports));
   const { updateConfigLeaves: updateConfigLeaves2, configLeafSet: configLeafSet2, readConfigLeaf: readConfigLeaf2 } = await Promise.resolve().then(() => (init_setup_config(), setup_config_exports));
   const { readSetting: readSetting2, writeSetting: writeSetting2, maskSecret: maskSecret2 } = await Promise.resolve().then(() => (init_setup_settings(), setup_settings_exports));
-  const { listModelProviders: listModelProviders2, listOptionalSkills: listOptionalSkills2, listRequiredSkillsWithSecrets: listRequiredSkillsWithSecrets2 } = await Promise.resolve().then(() => (init_setup_providers(), setup_providers_exports));
+  const {
+    listModelProviders: listModelProviders2,
+    listOptionalSkills: listOptionalSkills2,
+    listRequiredSkillsWithSecrets: listRequiredSkillsWithSecrets2,
+    listConfiguredSwitchableProviders: listConfiguredSwitchableProviders2,
+    readDefaultAgentProvider: readDefaultAgentProvider2,
+    bindBuiltinAgentsToProvider: bindBuiltinAgentsToProvider2
+  } = await Promise.resolve().then(() => (init_setup_providers(), setup_providers_exports));
+  const { buildBindProviderPlan: buildBindProviderPlan2, KEEP_CURRENT: KEEP_CURRENT2, AWS_CHAIN_PROVIDER: AWS_CHAIN_PROVIDER2 } = await Promise.resolve().then(() => (init_setup_bind_provider(), setup_bind_provider_exports));
   const { promptText: promptText2, promptPassword: promptPassword2, promptSelect: promptSelect2, promptMultiSelect: promptMultiSelect2 } = await Promise.resolve().then(() => (init_setup_prompts(), setup_prompts_exports));
   const nonInteractive = argv.includes("--non-interactive") || argv.includes("-y");
-  const haloHome2 = path61.join(homedir24(), ".halo");
-  const globalDir2 = path61.join(haloHome2, "global");
+  const haloHome2 = path62.join(homedir25(), ".halo");
+  const globalDir2 = path62.join(haloHome2, "global");
   ensureHaloHome2(haloHome2);
   process.stderr.write(`[setup] ${haloHome2}/ ready
 `);
@@ -26935,6 +27529,17 @@ async function cmdSetup(argv = []) {
     if (!process.env.HALO_PASSWORD || process.env.HALO_PASSWORD.length === 0) {
       if (!configLeafSet2("server.password")) {
         process.stderr.write(`[setup] WARNING: no password set. Either set HALO_PASSWORD env, or re-run \`halo setup\` interactively.
+`);
+      }
+    }
+    const envProvider = process.env.HALO_DEFAULT_PROVIDER;
+    if (envProvider && envProvider.length > 0) {
+      const bound = bindBuiltinAgentsToProvider2(envProvider);
+      if (bound) {
+        process.stderr.write(`[setup] built-in agents (${bound.agents.join(", ")}) bound to ${envProvider}${bound.modelId ? ` / ${bound.modelId}` : ""} (HALO_DEFAULT_PROVIDER)
+`);
+      } else {
+        process.stderr.write(`[setup] WARNING: HALO_DEFAULT_PROVIDER=${envProvider} is not a known provider \u2014 agents unchanged
 `);
       }
     }
@@ -26946,12 +27551,22 @@ async function cmdSetup(argv = []) {
   await stepPassword();
   await stepPort();
   await stepModelProviders();
+  await stepBindDefaultAgent();
   await stepOptionalSkills();
   await stepRequiredSkillSecrets();
   if (!configLeafSet2("server.jwt_secret")) {
     updateConfigLeaves2({ "server.jwt_secret": generateJwtSecret2() });
   }
   process.stderr.write("\n[setup] done\n");
+  {
+    const portLeaf = readConfigLeaf2("server.port");
+    const port = typeof portLeaf === "number" ? portLeaf : 9527;
+    process.stderr.write("\nNext steps:\n");
+    process.stderr.write("  1. halo server start\n");
+    process.stderr.write(`  2. Open http://localhost:${port} and log in with the password you just set
+`);
+    process.stderr.write("  3. Agents, model providers, and channels (Telegram / Slack / \u2026) are all configurable in the admin UI\n");
+  }
   async function stepPassword() {
     const passwordSet = configLeafSet2("server.password");
     const envSet = process.env.HALO_PASSWORD ? process.env.HALO_PASSWORD.length > 0 : false;
@@ -27050,6 +27665,36 @@ async function cmdSetup(argv = []) {
     }
     process.stderr.write("\n");
   }
+  async function stepBindDefaultAgent() {
+    const configured = listConfiguredSwitchableProviders2();
+    const current = readDefaultAgentProvider2();
+    const currentHasKeys = current != null && listModelProviders2().some((p) => p.id === current && p.fields.some((f) => {
+      const v = readSetting2(`${p.id}.secrets.${f.key}`);
+      return v != null && v.length > 0;
+    }));
+    const plan = buildBindProviderPlan2(configured, current, currentHasKeys);
+    if (!plan) return;
+    for (const line of plan.intro) process.stderr.write(`${line}
+`);
+    const pick = await promptSelect2(plan.question, plan.options, plan.initialIndex);
+    if (pick == null) abort();
+    if (pick === KEEP_CURRENT2) {
+      process.stderr.write(`[setup] default agent unchanged (${current ?? AWS_CHAIN_PROVIDER2})
+
+`);
+      return;
+    }
+    const bound = bindBuiltinAgentsToProvider2(pick);
+    if (bound) {
+      process.stderr.write(`[setup] built-in agents (${bound.agents.join(", ")}) bound to ${pick}${bound.modelId ? ` / ${bound.modelId}` : ""}
+
+`);
+    } else {
+      process.stderr.write(`[setup] could not bind agents to ${pick} \u2014 provider template missing; agents unchanged
+
+`);
+    }
+  }
   async function stepOptionalSkills() {
     const skills = listOptionalSkills2();
     if (skills.length === 0) return;
@@ -27215,7 +27860,7 @@ halo: upgrade failed (npm exited ${install.status}). ${hint}
 async function cmdAgents(flags) {
   const { initRuntime: initRuntime2, listAgents: listAgents2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
   await initRuntime2();
-  const workspace = path61.resolve(flags.workspace ?? process.cwd());
+  const workspace = path62.resolve(flags.workspace ?? process.cwd());
   const agents = await listAgents2(workspace);
   if (agents.length === 0) {
     process.stderr.write("No agents found.\n");
@@ -27231,7 +27876,7 @@ async function cmdAgents(flags) {
 async function cmdSessions(flags) {
   const { initRuntime: initRuntime2, listSessions: listSessions2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
   await initRuntime2();
-  const workspace = path61.resolve(flags.workspace ?? process.cwd());
+  const workspace = path62.resolve(flags.workspace ?? process.cwd());
   const sessions2 = listSessions2(workspace);
   if (sessions2.length === 0) {
     process.stderr.write("No sessions found.\n");
@@ -27333,11 +27978,11 @@ ${stdinContent}` : stdinContent;
     harness.destroy();
   }
 }
-var SERVER_LOCK_PATH = path61.join(homedir24(), ".halo", "global", "server.lock");
-var SERVER_LOG_PATH = path61.join(homedir24(), ".halo", "logs", "server.log");
+var SERVER_LOCK_PATH = path62.join(homedir25(), ".halo", "global", "server.lock");
+var SERVER_LOG_PATH = path62.join(homedir25(), ".halo", "logs", "server.log");
 function readServerPid() {
   try {
-    const txt = fs53.readFileSync(SERVER_LOCK_PATH, "utf-8").trim();
+    const txt = fs54.readFileSync(SERVER_LOCK_PATH, "utf-8").trim();
     const n = parseInt(txt, 10);
     return Number.isFinite(n) && n > 0 ? n : null;
   } catch {
@@ -27419,8 +28064,8 @@ async function cmdServerStart(argv, _unused) {
     return;
   }
   const { spawn: spawn4 } = await import("node:child_process");
-  fs53.mkdirSync(path61.dirname(SERVER_LOG_PATH), { recursive: true });
-  const out = fs53.openSync(SERVER_LOG_PATH, "a");
+  fs54.mkdirSync(path62.dirname(SERVER_LOG_PATH), { recursive: true });
+  const out = fs54.openSync(SERVER_LOG_PATH, "a");
   const child = spawn4(process.argv[0], [process.argv[1], "server", "start"], {
     detached: true,
     stdio: ["ignore", out, out],
@@ -27520,7 +28165,7 @@ async function cmdServerLogs(argv) {
       lines: { type: "string", short: "n" }
     }
   });
-  if (!fs53.existsSync(SERVER_LOG_PATH)) {
+  if (!fs54.existsSync(SERVER_LOG_PATH)) {
     process.stderr.write(`No log file at ${SERVER_LOG_PATH}
 `);
     return;
@@ -27538,7 +28183,7 @@ function exitMissingSetup() {
   process.exit(1);
 }
 function isHaloHomeReady() {
-  return fs53.existsSync(path61.join(homedir24(), ".halo", "global", ".template-version"));
+  return fs54.existsSync(path62.join(homedir25(), ".halo", "global", ".template-version"));
 }
 async function main2() {
   const argv = process.argv.slice(2);