@workerdeck/server 3.3.0 → 3.5.0

package/build/index.mjs

@@ -1,9 +1,9 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
-import { BrowserBridgeExecutor, PEER_MESSAGE_MAX_CHARS, PEER_RECENT_DEFAULT, PEER_RECENT_MAX, SHELL_REFUSAL, SHELL_REFUSAL as SHELL_REFUSAL$1, SessionRunner, TTY_REDRAW_CARRY, agentMayWrite, attachmentKind, checkClaudeAuth, clampShellTail, createEngineSession, encodeShellKeys, getEngineAdapter, installPeerDirectory, installShellDirectory, isSlashCommand, normalizeMediaType, peerDirectoryHandle, peerSummary, recentLines, shellDirectoryHandle, shellOwnershipRefusal, shellSummary, shellTail, shellToolNeedsCard, ttyRedraws, ttyText, withoutGatewaySecrets } from "@workerdeck/core";
+import { BrowserBridgeExecutor, PEER_MESSAGE_MAX_CHARS, PEER_RECENT_DEFAULT, PEER_RECENT_MAX, SHELL_REFUSAL, SHELL_REFUSAL as SHELL_REFUSAL$1, SessionRunner, TTY_REDRAW_CARRY, agentMayWrite, attachmentKind, checkClaudeAuth, clampShellTail, composeInstructions, contextResetDirectoryHandle, createEngineSession, encodeShellKeys, getEngineAdapter, installContextResetDirectory, installPeerDirectory, installShellDirectory, isSlashCommand, normalizeMediaType, peerDirectoryHandle, peerSummary, recentLines, shellDirectoryHandle, shellOwnershipRefusal, shellSummary, shellTail, shellToolNeedsCard, ttyRedraws, ttyText, withoutGatewaySecrets } from "@workerdeck/core";
 import { JobQueue } from "@workerdeck/queue";
-import { ENGINE_CAPABILITIES, PEER_MENTION_MAX, PROTOCOL_VERSION, SHELL_ARTIFACT_MAX_BYTES, SHELL_ARTIFACT_TTL_MS, SHELL_ATTACH_REPLAY_BYTES, SHELL_COLS, SHELL_COMMAND_MAX, SHELL_INPUT_MAX, SHELL_LABEL_MAX, SHELL_LINGER_MS, SHELL_MAX_COLS, SHELL_MAX_ROWS, SHELL_MAX_RUNNING_PER_SESSION, SHELL_MAX_RUNNING_TOTAL, SHELL_MIN_COLS, SHELL_MIN_ROWS, SHELL_READ_MAX_LINES, SHELL_ROWS, SHELL_SPILL_BYTES, SHELL_TAIL_FLUSH_MS, SHELL_TAIL_RING_BYTES, SHELL_WAIT_DEFAULT_MS, SHELL_WAIT_MAX_MS, costOfByModel, imagePartRef, isJobRun, mergeByModel, mergePricing, peerMentionKey, peerMentionSlug, pickCreateSessionRequest, scanPeerMentions, sessionState, subscriptionComparison, supportsPermissionMode } from "@workerdeck/protocol";
+import { AGENT_SLEEP_AFTER_MS_DEFAULT, ENGINE_CAPABILITIES, PEER_MENTION_MAX, PROTOCOL_VERSION, SHELL_ARTIFACT_MAX_BYTES, SHELL_ARTIFACT_TTL_MS, SHELL_ATTACH_REPLAY_BYTES, SHELL_COLS, SHELL_COMMAND_MAX, SHELL_INPUT_MAX, SHELL_LABEL_MAX, SHELL_LINGER_MS, SHELL_MAX_COLS, SHELL_MAX_ROWS, SHELL_MAX_RUNNING_PER_SESSION, SHELL_MAX_RUNNING_TOTAL, SHELL_MIN_COLS, SHELL_MIN_ROWS, SHELL_READ_MAX_LINES, SHELL_ROWS, SHELL_SPILL_BYTES, SHELL_TAIL_FLUSH_MS, SHELL_TAIL_RING_BYTES, SHELL_WAIT_DEFAULT_MS, SHELL_WAIT_MAX_MS, agentRef, costOfByModel, imagePartRef, isJobRun, mergeByModel, mergePricing, peerMentionKey, peerMentionSlug, pickCreateSessionRequest, scanPeerMentions, sessionState, subscriptionComparison, supportsPermissionMode, teamReaches } from "@workerdeck/protocol";
 import { chmodSync, closeSync, constants, createReadStream, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { arch, homedir, hostname, platform, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -79,6 +79,7 @@ function closeServer(deps) {
 		shells?.killAll("server_stopped");
 		const flushed = shells?.flush().catch((error) => deps.diagnose(error, "shell-flush")) ?? Promise.resolve();
 		parking.close();
+		deps.engineSleep.close();
 		registry.closeAll();
 		for (const ws of wss.clients) ws.close(1001, "server shutting down");
 		deps.closeQueueSockets();
@@ -222,6 +223,23 @@ function cwdAllowed(cwd, roots) {
 		return resolved === r || resolved.startsWith(r + sep);
 	});
 }
+function listDirs(path) {
+	try {
+		return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+	} catch {
+		return [];
+	}
+}
+function listMd(path) {
+	try {
+		return readdirSync(path).filter((file) => file.endsWith(".md")).map((file) => file.slice(0, -3)).sort();
+	} catch {
+		return [];
+	}
+}
+function count(rules) {
+	return Array.isArray(rules) ? rules.length : 0;
+}
 function readProfileConfig(profile) {
 	const dir = profile.configDir;
 	if (!dir) return {
@@ -230,22 +248,8 @@ function readProfileConfig(profile) {
 		agents: [],
 		commands: []
 	};
-	const listDirs = (path) => {
-		try {
-			return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
-		} catch {
-			return [];
-		}
-	};
-	const listMd = (path) => {
-		try {
-			return readdirSync(path).filter((file) => file.endsWith(".md")).map((file) => file.slice(0, -3)).sort();
-		} catch {
-			return [];
-		}
-	};
 	const snapshot = {
-		hasUserMemory: existsSync(join(dir, "CLAUDE.md")),
+		hasUserMemory: ["CLAUDE.md", "AGENTS.md"].some((name) => existsSync(join(dir, name))),
 		skills: listDirs(join(dir, "skills")),
 		agents: listMd(join(dir, "agents")),
 		commands: listMd(join(dir, "commands"))
@@ -253,7 +257,6 @@ function readProfileConfig(profile) {
 	try {
 		const raw = JSON.parse(readFileSync(join(dir, "settings.json"), "utf8"));
 		const permissions = raw.permissions ?? {};
-		const count = (rules) => Array.isArray(rules) ? rules.length : 0;
 		snapshot.settings = {
 			model: typeof raw.model === "string" ? raw.model : void 0,
 			defaultPermissionMode: typeof permissions.defaultMode === "string" ? permissions.defaultMode : void 0,
@@ -388,6 +391,15 @@ function itemRoute(rawId, parts) {
 		id: decode(rawId),
 		stopTaskId: decode(third)
 	};
+	if (length === 3 && section === "tasks" && third === "background") return {
+		kind: "background-task",
+		id: decode(rawId)
+	};
+	if (length === 4 && section === "tasks" && fourth === "background") return {
+		kind: "background-task",
+		id: decode(rawId),
+		backgroundTaskId: decode(third)
+	};
 	if (length === 3 && section === "project" && third === "icon") return {
 		kind: "project-icon",
 		id: decode(rawId)
@@ -400,6 +412,14 @@ function itemRoute(rawId, parts) {
 			resultSeq: seq
 		} : null;
 	}
+	if (length === 2 && section === "sleep") return {
+		kind: "sleep",
+		id: decode(rawId)
+	};
+	if (length === 2 && section === "peers") return {
+		kind: "peers",
+		id: decode(rawId)
+	};
 	if (length <= 3 && section === "mcp") return {
 		kind: "mcp",
 		id: decode(rawId),
@@ -464,6 +484,307 @@ function permissionDecision(input) {
 	};
 }
 //#endregion
+//#region src/lib/scope.ts
+const MAX_SCOPE_KEYS = 16;
+const MAX_SCOPE_LEN = 200;
+function readScope(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	const entries = Object.entries(value);
+	if (entries.some(([, v]) => typeof v !== "string")) return;
+	return Object.fromEntries(entries);
+}
+function checkScope(value) {
+	if (value === void 0) return null;
+	const scope = readScope(value);
+	if (!scope) return "scope must be an object of string values";
+	const entries = Object.entries(scope);
+	if (entries.length > MAX_SCOPE_KEYS) return `scope may carry at most ${MAX_SCOPE_KEYS} keys`;
+	for (const [key, val] of entries) {
+		if (key.length === 0) return "scope keys must not be empty";
+		if (key.length > MAX_SCOPE_LEN || val.length > MAX_SCOPE_LEN) return `scope keys and values must be at most ${MAX_SCOPE_LEN} characters`;
+	}
+	return null;
+}
+function sameScope(a, b) {
+	const left = Object.entries(a ?? {}).sort(([x], [y]) => x < y ? -1 : 1);
+	const right = Object.entries(b ?? {}).sort(([x], [y]) => x < y ? -1 : 1);
+	return left.length === right.length && left.every(([key, value], i) => right[i][0] === key && right[i][1] === value);
+}
+function scopeMatches(principal, session) {
+	if (!principal) return true;
+	return Object.entries(principal).every(([key, value]) => session?.[key] === value);
+}
+//#endregion
+//#region src/services/peers.ts
+const DEFAULT_PER_MINUTE = 10;
+const DEFAULT_MAX_HOPS = 12;
+const WINDOW_MS = 6e4;
+function visible(from, to) {
+	return to.id !== from.id && scopeMatches(from.scope, to.scope) && teamReaches(from.agent, to.agent);
+}
+function relayable(info, exposed) {
+	return info.status !== "closed" && info.agent?.lead === void 0 && scopeMatches(exposed, info.scope);
+}
+function relayEntry(info, live) {
+	const items = info.checklist;
+	return {
+		id: info.id,
+		engine: info.engine,
+		status: info.status,
+		title: info.title,
+		project: info.project ? {
+			name: info.project.name,
+			root: info.project.root
+		} : void 0,
+		cwd: info.cwd,
+		profile: info.profile,
+		model: info.model,
+		permissionMode: info.permissionMode,
+		contextUsage: info.contextUsage,
+		checklist: items?.length ? {
+			done: items.filter((item) => item.status === "completed").length,
+			total: items.length
+		} : void 0,
+		numTurns: info.numTurns,
+		createdAt: info.createdAt,
+		lastActivityAt: info.lastActivityAt,
+		pendingPermissionCount: info.pendingPermissionCount,
+		live
+	};
+}
+function createPeerService(deps) {
+	const perMinute = deps.options?.perMinute ?? DEFAULT_PER_MINUTE;
+	const maxChars = deps.options?.maxMessageChars ?? PEER_MESSAGE_MAX_CHARS;
+	const maxHops = deps.options?.maxHops ?? DEFAULT_MAX_HOPS;
+	const sent = /* @__PURE__ */ new Map();
+	const inbound = /* @__PURE__ */ new Map();
+	const registry = () => {
+		const found = deps.refs.registry;
+		if (!found) throw new Error("peer messaging is not ready");
+		return found;
+	};
+	const allSessions = async () => {
+		const live = registry().list();
+		const dormant = await deps.refs.parking?.listInfo() ?? [];
+		return [...live, ...dormant].map((info) => deps.projects.withProject(info));
+	};
+	const infoOf = async (id) => {
+		const live = registry().get(id)?.info();
+		if (live) return deps.projects.withProject(live);
+		const record = await deps.refs.parking?.get(id);
+		return record ? deps.projects.withProject(record.info) : void 0;
+	};
+	const sender = async (from) => {
+		const info = await infoOf(from);
+		if (!info) throw new Error(`unknown sender session: ${from}`);
+		return info;
+	};
+	const recentOf = (sessionId, recent) => {
+		const limit = Math.min(Math.max(recent ?? PEER_RECENT_DEFAULT, 0), PEER_RECENT_MAX);
+		const runner = registry().get(sessionId);
+		const events = [];
+		if (runner && limit > 0) runner.subscribe((event) => events.push(event), 0, {
+			truncateResults: true,
+			imageRefs: true
+		})();
+		return {
+			runner,
+			lines: recentLines(events, limit)
+		};
+	};
+	const underRateLimit = (from, to) => {
+		const key = `${from}->${to}`;
+		const now = Date.now();
+		const recent = (sent.get(key) ?? []).filter((at) => now - at < WINDOW_MS);
+		if (recent.length >= perMinute) {
+			sent.set(key, recent);
+			return false;
+		}
+		recent.push(now);
+		sent.set(key, recent);
+		return true;
+	};
+	const list = async (from) => {
+		const me = await sender(from);
+		return (await allSessions()).filter((info) => visible(me, info)).sort((a, b) => (b.lastActivityAt ?? b.createdAt) - (a.lastActivityAt ?? a.createdAt)).map(peerSummary);
+	};
+	const peek = async (from, sessionId, options) => {
+		const me = await sender(from);
+		const info = await infoOf(sessionId);
+		if (!info || !visible(me, info)) return;
+		const { runner, lines } = recentOf(sessionId, options?.recent);
+		return {
+			...peerSummary(info),
+			live: runner !== void 0,
+			checklist: info.checklist,
+			pendingApprovals: runner ? runner.pendingApprovals.map((request) => request.title ?? request.toolName) : [],
+			recent: lines
+		};
+	};
+	const send = async (from, sessionId, text, options) => {
+		const me = await sender(from);
+		if (sessionId === from) return {
+			delivered: false,
+			reason: "that is this session"
+		};
+		if (text.length > maxChars) return {
+			delivered: false,
+			reason: `message is ${text.length} characters; the limit is ${maxChars}. Write it to a file and send the path.`
+		};
+		const target = await infoOf(sessionId);
+		if (!target || !visible(me, target)) return {
+			delivered: false,
+			reason: `no such session: ${sessionId}`
+		};
+		const hops = [...options?.hops ?? inbound.get(from) ?? [], from];
+		return deliver(target, text, {
+			kind: "peer",
+			sessionId: from,
+			name: me.title,
+			engine: me.engine,
+			hops
+		}, from);
+	};
+	const deliver = async (target, text, origin, rateKey) => {
+		const sessionId = target.id;
+		if (target.status === "closed" || target.status === "failed") return {
+			delivered: false,
+			reason: `session ${sessionId} is ${target.status}`
+		};
+		const hops = origin.hops ?? [];
+		if (hops.length > maxHops) return {
+			delivered: false,
+			reason: `${hops.length} messages have passed between sessions without a person speaking; stop and ask your user before continuing.`
+		};
+		if (!underRateLimit(rateKey, sessionId)) return {
+			delivered: false,
+			reason: `rate limit: at most ${perMinute} messages a minute to one session. Batch what you have to say.`
+		};
+		const runner = await deps.refs.parking?.ensureLive(sessionId) ?? registry().get(sessionId);
+		if (!runner) return {
+			delivered: false,
+			reason: `session ${sessionId} could not be woken`
+		};
+		const before = runner.info().status;
+		try {
+			runner.sendMessage(text, void 0, { origin });
+		} catch (error) {
+			return {
+				delivered: false,
+				reason: error instanceof Error ? error.message : String(error)
+			};
+		}
+		inbound.set(sessionId, hops);
+		return {
+			delivered: true,
+			sessionId,
+			name: target.title,
+			queued: before === "running" || before === "awaiting_approval"
+		};
+	};
+	const exposedInfo = async (sessionId, exposed) => {
+		const info = await infoOf(sessionId);
+		return info && relayable(info, exposed) ? info : void 0;
+	};
+	const relayEntries = async (exposed) => {
+		const live = new Set(registry().list().map((info) => info.id));
+		return (await allSessions()).filter((info) => relayable(info, exposed)).map((info) => relayEntry(info, live.has(info.id)));
+	};
+	const relayPeek = async (sessionId, recent, exposed) => {
+		const info = await exposedInfo(sessionId, exposed);
+		if (!info) return;
+		const { runner, lines } = recentOf(sessionId, recent);
+		return {
+			...relayEntry(info, runner !== void 0),
+			checklistItems: info.checklist,
+			pendingApprovals: runner ? runner.pendingApprovals.map((request) => request.title ?? request.toolName) : [],
+			recent: lines
+		};
+	};
+	const relaySend = async (origin, sessionId, text, exposed) => {
+		if (text.length === 0 || text.length > maxChars) return {
+			delivered: false,
+			reason: `message is ${text.length} characters; the limit is ${maxChars}. Write it to a file and send the path.`
+		};
+		const target = await exposedInfo(sessionId, exposed);
+		if (!target) return {
+			delivered: false,
+			reason: `no such session: ${sessionId}`
+		};
+		const from = `${origin.gateway}:${origin.sessionId}`;
+		return deliver(target, text, {
+			kind: "peer",
+			sessionId: from,
+			hostId: origin.gateway,
+			name: origin.name,
+			engine: origin.engine,
+			hops: origin.hops
+		}, from);
+	};
+	const watch = (runner) => runner.subscribe((event) => {
+		if (event.type === "user_message" && !event.origin && !event.synthetic && event.parentToolUseId == null && !event.replay) inbound.delete(runner.id);
+	}, runner.info().lastSeq);
+	return {
+		list,
+		peek,
+		send,
+		watch,
+		relaySender: sender,
+		relayChain: (from) => [...inbound.get(from) ?? [], from],
+		relayEntries,
+		relayPeek,
+		relaySend
+	};
+}
+function resolvePeerMentions(rows, text) {
+	const tokens = scanPeerMentions(text);
+	if (tokens.length === 0) return [];
+	const byKey = /* @__PURE__ */ new Map();
+	const add = (key, row) => {
+		const held = byKey.get(key);
+		if (held) held.push(row);
+		else byKey.set(key, [row]);
+	};
+	for (const row of rows) {
+		const keys = /* @__PURE__ */ new Set([peerMentionKey(peerMentionSlug(row.title, row.id)), peerMentionKey(row.id)]);
+		if (row.agent) keys.add(peerMentionKey(peerMentionSlug(row.agent, row.id)));
+		for (const key of keys) add(key, row);
+	}
+	const resolved = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const token of tokens) {
+		const key = peerMentionKey(token.body);
+		const exact = byKey.get(key);
+		const matches = exact ?? (key.length >= 4 ? rows.filter((row) => row.id.startsWith(key)) : []);
+		const target = matches[0];
+		if (!target || matches.length > 1 && !exact) continue;
+		if (seen.has(target.id)) continue;
+		seen.add(target.id);
+		const others = matches.slice(1, 4).map((row) => row.id);
+		resolved.push({
+			typed: token.body,
+			id: target.id,
+			name: target.agent ?? target.title,
+			engine: target.engine,
+			status: target.status,
+			cwd: target.cwd,
+			...others.length ? { ambiguousWith: others } : {}
+		});
+		if (resolved.length >= PEER_MENTION_MAX) break;
+	}
+	return resolved;
+}
+async function mentionsFor(directory, from, text) {
+	return scanPeerMentions(text).length === 0 ? [] : resolvePeerMentions(await directory.list(from), text);
+}
+//#endregion
+//#region src/routes/sleep.ts
+async function sleepRunner(runner) {
+	if (!runner.sleep) throw new HttpError(501, `the ${engineOf(runner.info())} engine has no process to put to sleep`);
+	const result = await runner.sleep();
+	if (!result.ok) throw new HttpError(409, `cannot sleep: ${result.reason}`);
+}
+//#endregion
 //#region src/services/shell-directory.ts
 function createShellDirectory(registry, deps = {}) {
 	const take = async (from, shellId, options) => {
@@ -1853,13 +2174,14 @@ function attachClient(ctx, ws, runner, req, access) {
 		unsubscribe();
 		detachBridge();
 		parking.onDetach(runner.id);
+		ctx.engineSleep.onDetach(runner.id);
 	});
 }
 async function handleCommand(ctx, frame, runner, access, client) {
 	const { attachmentStore, bridge } = ctx;
 	switch (frame.type) {
 		case "user_message": {
-			const mentions = ctx.peers && !isSlashCommand(frame.text) ? await ctx.peers.mentions(runner.id, frame.text).catch(() => []) : [];
+			const mentions = ctx.peers && !isSlashCommand(frame.text) ? await mentionsFor(ctx.peers, runner.id, frame.text).catch(() => []) : [];
 			const options = mentions.length > 0 ? { mentions } : void 0;
 			if (!frame.attachmentIds?.length) {
 				runner.sendMessage(frame.text, void 0, options);
@@ -1876,6 +2198,13 @@ async function handleCommand(ctx, frame, runner, access, client) {
 		case "interrupt":
 			await runner.interrupt();
 			return;
+		case "sleep":
+			await sleepRunner(runner);
+			return;
+		case "background_task":
+			if (!runner.backgroundTask) throw new Error(`the ${engineOf(runner.info())} engine cannot move a task to the background`);
+			await runner.backgroundTask(frame.toolUseId);
+			return;
 		case "clear_context":
 			if (!runner.clearContext) throw new Error(`the ${engineOf(runner.info())} engine cannot clear a conversation`);
 			await runner.clearContext();
@@ -1892,6 +2221,11 @@ async function handleCommand(ctx, frame, runner, access, client) {
 		case "set_model":
 			await runner.setModel(frame.model);
 			return;
+		case "set_effort":
+			if (!runner.setEffort) throw new Error(`the ${engineOf(runner.info())} engine cannot change its reasoning effort`);
+			if (frame.effort !== void 0 && typeof frame.effort !== "string") throw new Error("effort must be a string");
+			await runner.setEffort(frame.effort);
+			return;
 		case "tool_call_result":
 			bridge.resolve(runner.id, frame.executionId, {
 				output: frame.output,
@@ -1993,53 +2327,623 @@ async function attachShell(shells, client, sessionId, shellId, size) {
 		scrollback
 	});
 }
-function detachShell(client, shellId) {
-	client.shells.get(shellId)?.();
-	client.shells.delete(shellId);
-}
-function detachShells(client) {
-	for (const detach of client.shells.values()) detach();
-	client.shells.clear();
-}
-//#endregion
-//#region src/routes/session-upgrade.ts
-async function upgradeSession(ctx, wss, req, socket, head) {
-	const { auth, parking } = ctx;
-	const route = parseSessionRoute(ctx.basePath, req.url ?? "/");
-	if (route?.kind !== "ws") {
-		socket.destroy();
+function detachShell(client, shellId) {
+	client.shells.get(shellId)?.();
+	client.shells.delete(shellId);
+}
+function detachShells(client) {
+	for (const detach of client.shells.values()) detach();
+	client.shells.clear();
+}
+//#endregion
+//#region src/routes/session-upgrade.ts
+async function upgradeSession(ctx, wss, req, socket, head) {
+	const { auth, parking } = ctx;
+	const route = parseSessionRoute(ctx.basePath, req.url ?? "/");
+	if (route?.kind !== "ws") {
+		socket.destroy();
+		return;
+	}
+	const authCtx = await auth.authenticate(req);
+	if (!authCtx.ok) {
+		refuseUpgrade(socket, "401 Unauthorized");
+		return;
+	}
+	const known = await sessionInfoOf(ctx, route.id);
+	if (known && !auth.canSee(authCtx, known)) {
+		refuseUpgrade(socket, "404 Not Found");
+		return;
+	}
+	const runner = await parking.ensureLive(route.id).catch(() => void 0);
+	if (!runner || !auth.canSee(authCtx, runner.info())) {
+		refuseUpgrade(socket, "404 Not Found");
+		return;
+	}
+	wss.handleUpgrade(req, socket, head, (ws) => {
+		attachClient(ctx, ws, runner, req, { operator: auth.isOperator(authCtx) });
+	});
+}
+//#endregion
+//#region src/lib/machine-id.ts
+let cached;
+function machineId() {
+	cached ??= createHash("sha256").update([
+		hostname(),
+		platform(),
+		arch(),
+		homedir()
+	].join("\0")).digest("hex").slice(0, 32);
+	return cached;
+}
+//#endregion
+//#region src/services/agents.ts
+const NAMES = [
+	"Atlas",
+	"Juno",
+	"Pip",
+	"Rook",
+	"Marlow",
+	"Orbit",
+	"Fern",
+	"Quill",
+	"Sable",
+	"Wren",
+	"Ember",
+	"Moss",
+	"Nova",
+	"Otto",
+	"Pike",
+	"Rune",
+	"Sage",
+	"Tansy",
+	"Vale",
+	"Yarrow",
+	"Basil",
+	"Cedar",
+	"Dune",
+	"Flint",
+	"Hazel",
+	"Iris",
+	"Kestrel",
+	"Lark",
+	"Maple",
+	"Nettle",
+	"Onyx",
+	"Piper",
+	"Reed",
+	"Sorrel",
+	"Thistle",
+	"Umber",
+	"Willow",
+	"Zephyr"
+];
+const MAX_NAME = 64;
+const MAX_BRIEF = 16e3;
+const CONFIG_KEYS = [
+	"cwd",
+	"profile",
+	"model",
+	"reasoningEffort",
+	"permissionMode",
+	"brief",
+	"agentContextReset",
+	"sleepAfterMs"
+];
+var AgentService = class {
+	#store;
+	#basePath;
+	#avatars;
+	#sleepAfterMs;
+	#now;
+	#agents = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#store = options.store;
+		this.#basePath = options.basePath;
+		this.#avatars = options.avatars ?? false;
+		this.#sleepAfterMs = options.sleepAfterMs ?? AGENT_SLEEP_AFTER_MS_DEFAULT;
+		this.#now = options.now ?? Date.now;
+	}
+	async hydrate() {
+		this.#agents = new Map((await this.#store.list()).map((agent) => [agent.id, agent]));
+	}
+	list() {
+		return [...this.#agents.values()].map((agent) => this.public(agent));
+	}
+	get(id) {
+		return this.#agents.get(id);
+	}
+	bySession(sessionId) {
+		for (const agent of this.#agents.values()) if (agent.sessionId === sessionId) return agent;
+	}
+	decorate(info) {
+		const agent = this.bySession(info.id);
+		if (!agent) return info;
+		const leadName = agent.lead === void 0 ? void 0 : this.#agents.get(agent.lead)?.name;
+		return {
+			...info,
+			agent: agentRef(this.public(agent), {
+				leadName,
+				leads: this.hasMembers(agent.id)
+			})
+		};
+	}
+	briefFor(sessionId) {
+		return (sessionId === void 0 ? void 0 : this.bySession(sessionId)?.config.brief?.trim()) || void 0;
+	}
+	sleepAfterFor(sessionId) {
+		const agent = this.bySession(sessionId);
+		return agent ? agent.config.sleepAfterMs ?? this.#sleepAfterMs : void 0;
+	}
+	public(agent) {
+		const { avatarSeed: _seed, avatarRecipe: _recipe, avatar: _avatar, ...info } = agent;
+		return this.#avatars ? {
+			...info,
+			avatar: `${this.#basePath}/agents/${agent.id}/avatar.png`
+		} : info;
+	}
+	draft(input) {
+		const config = readConfig(input.config);
+		if ("error" in config) return config;
+		const name = input.name === void 0 ? this.#suggestName() : readName(input.name);
+		if (typeof name !== "string") return name;
+		const id = randomUUID();
+		const at = this.#now();
+		const agent = {
+			id,
+			name,
+			createdAt: at,
+			updatedAt: at,
+			avatarSeed: id,
+			pastSessions: [],
+			config
+		};
+		if (input.lead !== void 0 && input.lead !== null) {
+			const refused = typeof input.lead === "string" ? this.leadRefusal(agent, input.lead) : {
+				status: 400,
+				error: "lead must be an agent id"
+			};
+			if (refused) return refused;
+			agent.lead = input.lead;
+		}
+		return agent;
+	}
+	async save(agent) {
+		const stored = {
+			...agent,
+			updatedAt: this.#now()
+		};
+		await this.#store.save(stored);
+		this.#agents.set(stored.id, stored);
+		return stored;
+	}
+	async bind(agent, sessionId) {
+		const past = agent.sessionId !== void 0 && agent.sessionId !== sessionId ? [...agent.pastSessions, agent.sessionId] : agent.pastSessions;
+		return this.save({
+			...agent,
+			sessionId,
+			pastSessions: past
+		});
+	}
+	hasMembers(id) {
+		for (const agent of this.#agents.values()) if (agent.lead === id) return true;
+		return false;
+	}
+	members(id) {
+		return [...this.#agents.values()].filter((agent) => agent.lead === id).sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+	}
+	leadRefusal(mover, leadId) {
+		if (leadId === mover.id) return {
+			status: 409,
+			error: "an agent cannot lead its own team"
+		};
+		const lead = this.#agents.get(leadId);
+		if (!lead) return {
+			status: 404,
+			error: `no such agent: ${leadId}`
+		};
+		if (lead.lead !== void 0) return {
+			status: 409,
+			error: `${lead.name} is a member of a team; teams are one level deep`
+		};
+		if (this.hasMembers(mover.id)) return {
+			status: 409,
+			error: `${mover.name} leads a team; teams are one level deep`
+		};
+		return null;
+	}
+	async update(id, patch) {
+		const agent = this.#agents.get(id);
+		if (!agent) return {
+			status: 404,
+			error: `no such agent: ${id}`
+		};
+		const next = { ...agent };
+		if (patch.name !== void 0) {
+			const name = readName(patch.name);
+			if (typeof name !== "string") return name;
+			next.name = name;
+		}
+		if (patch.config !== void 0) {
+			if (!isRecord$1(patch.config)) return {
+				status: 400,
+				error: "config must be an object"
+			};
+			const config = readConfig({
+				...agent.config,
+				...patch.config
+			});
+			if ("error" in config) return config;
+			next.config = config;
+		}
+		if (patch.lead === null) delete next.lead;
+		else if (patch.lead !== void 0) {
+			if (typeof patch.lead !== "string") return {
+				status: 400,
+				error: "lead must be an agent id or null"
+			};
+			const refused = this.leadRefusal(agent, patch.lead);
+			if (refused) return refused;
+			next.lead = patch.lead;
+		}
+		if (patch.order !== void 0) {
+			if (typeof patch.order !== "number" || !Number.isFinite(patch.order)) return {
+				status: 400,
+				error: "order must be a number"
+			};
+			next.order = patch.order;
+		}
+		return this.save(next);
+	}
+	async retire(id, members) {
+		const agent = this.#agents.get(id);
+		if (!agent) return {
+			status: 404,
+			error: `no such agent: ${id}`
+		};
+		const crew = this.members(id);
+		const retired = [agent, ...members === "retire" ? crew : []];
+		const released = [];
+		if (members === "release") for (const member of crew) {
+			const { lead: _lead, ...rest } = member;
+			released.push(await this.save(rest));
+		}
+		for (const gone of retired) {
+			await this.#store.delete(gone.id);
+			this.#agents.delete(gone.id);
+		}
+		return {
+			retired,
+			released
+		};
+	}
+	#suggestName() {
+		const taken = new Set([...this.#agents.values()].map((agent) => agent.name.toLowerCase()));
+		const free = NAMES.find((name) => !taken.has(name.toLowerCase()));
+		if (free) return free;
+		for (let n = 2;; n++) {
+			const name = `${NAMES[n % NAMES.length]} ${n}`;
+			if (!taken.has(name.toLowerCase())) return name;
+		}
+	}
+};
+function isAgentRefusal(value) {
+	return isRecord$1(value) && typeof value.status === "number" && typeof value.error === "string";
+}
+function readName(value) {
+	if (typeof value !== "string" || value.trim() === "") return {
+		status: 400,
+		error: "name must be a non-empty string"
+	};
+	const name = value.trim();
+	return name.length > MAX_NAME ? {
+		status: 400,
+		error: `name is longer than ${MAX_NAME} characters`
+	} : name;
+}
+function readConfig(value) {
+	if (value === void 0) return {};
+	if (!isRecord$1(value)) return {
+		status: 400,
+		error: "config must be an object"
+	};
+	const config = {};
+	for (const key of CONFIG_KEYS) if (value[key] !== void 0) config[key] = value[key];
+	for (const key of [
+		"cwd",
+		"profile",
+		"model",
+		"reasoningEffort",
+		"permissionMode",
+		"brief"
+	]) if (config[key] !== void 0 && typeof config[key] !== "string") return {
+		status: 400,
+		error: `config.${key} must be a string`
+	};
+	if (config.agentContextReset !== void 0 && typeof config.agentContextReset !== "boolean") return {
+		status: 400,
+		error: "config.agentContextReset must be a boolean"
+	};
+	const sleep = config.sleepAfterMs;
+	if (sleep !== void 0 && (typeof sleep !== "number" || !Number.isFinite(sleep) || sleep < 0)) return {
+		status: 400,
+		error: "config.sleepAfterMs must be a non-negative number"
+	};
+	if (typeof config.brief === "string" && config.brief.length > MAX_BRIEF) return {
+		status: 400,
+		error: `config.brief is longer than ${MAX_BRIEF} characters`
+	};
+	return config;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/lib/host-only-keys.ts
+const HOST_ONLY_KEY_TABLE = {
+	epoch: "durable",
+	pricing: "transient",
+	queryFn: "transient",
+	env: "transient",
+	pathToClaudeCodeExecutable: "durable",
+	extraOptions: "transient",
+	instructions: "transient",
+	defaultApprovalTimeoutMs: "durable",
+	backfillHistory: "durable",
+	historyFn: "transient",
+	sessionInfoFn: "transient",
+	peers: "transient",
+	contextReset: "transient",
+	shells: "transient",
+	shellAgentWrite: "transient",
+	createdByOperator: "durable",
+	fallbackTitle: "transient",
+	startAsleep: "transient",
+	effortDefaults: "transient",
+	connectFn: "transient",
+	codexHome: "durable",
+	codexPathOverride: "durable",
+	languageModel: "transient",
+	tools: "transient",
+	maxSteps: "durable",
+	executor: "transient",
+	executableTools: "transient",
+	vfs: "transient",
+	executionLimits: "durable",
+	executionBackend: "transient",
+	toolTitles: "transient",
+	shouldApprove: "transient",
+	resolveModel: "transient",
+	contextWindow: "transient",
+	reportMcpServers: "transient",
+	onClose: "transient",
+	restore: "transient"
+};
+const HOST_ONLY_KEYS = new Set(Object.keys(HOST_ONLY_KEY_TABLE));
+const DURABLE_HOST_KEYS = Object.entries(HOST_ONLY_KEY_TABLE).filter(([, lifetime]) => lifetime === "durable").map(([key]) => key);
+//#endregion
+//#region src/routes/create-vet.ts
+function vetCreateRequest(ctx, body, auth) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) return {
+		ok: false,
+		status: 400,
+		error: "request body must be a JSON object"
+	};
+	const hostOnly = Object.keys(body).filter((key) => HOST_ONLY_KEYS.has(key));
+	if (hostOnly.length > 0) return {
+		ok: false,
+		status: 400,
+		error: `host-only runner config is not accepted on a session request: ${hostOnly.join(", ")} (set it from the gateway's buildRunnerConfig hook)`
+	};
+	const req = pickCreateSessionRequest(body);
+	const { availability, factory } = ctx;
+	const early = factory.applyScope(req, auth) ?? refusal(403, factory.applyBypassPolicy(req));
+	if (early) return {
+		ok: false,
+		...early
+	};
+	const resolved = factory.resolveProfile(req.profile, auth.allowedProfiles);
+	if (!resolved.ok) return resolved;
+	const refused = refusal(403, refuseHostAuthority(ctx, req, resolved.profile, auth)) ?? availability.checkAvailable(resolved.profile) ?? factory.checkCwd(req, resolved.profile) ?? refusal(400, factory.checkPermissionMode(req.permissionMode, resolved.profile) ?? factory.checkEngineGrants(req, resolved.profile));
+	if (refused) return {
+		ok: false,
+		...refused
+	};
+	factory.stripInertFields(req, resolved.profile);
+	req.profile = resolved.profile?.name;
+	return {
+		ok: true,
+		request: req
+	};
+}
+function refusal(status, error) {
+	return error === null ? null : {
+		status,
+		error
+	};
+}
+function refuseHostAuthority(ctx, req, profile, auth) {
+	if (ctx.auth.isOperator(auth)) return null;
+	const engine = engineOf(profile);
+	const name = profile?.name ?? "default";
+	if ((engine === "claude" || engine === "codex") && !auth.allowedProfiles?.includes(name)) return `profile '${name}' runs the ${engine} engine on the host; a non-operator caller needs it named in its allowedProfiles`;
+	const mode = refusePermissionMode(req.permissionMode, { operator: false });
+	if (mode) return mode;
+	if (req.allowDangerouslySkipPermissions) return "allowDangerouslySkipPermissions is reserved to operators";
+	if (req.settingSources !== void 0 && req.settingSources.length > 0) return "settingSources is reserved to operators: it loads hooks and settings from the host";
+	if (!(typeof req.mcpServers === "object" && req.mcpServers !== null ? Object.values(req.mcpServers) : []).every(isRemoteMcpServer)) return "a stdio MCP server is reserved to operators: it runs a command on the host";
+	if (req.resume !== void 0 && !ownsSdkSession(ctx, auth, req.resume)) return "resume is limited to a live session this caller can see";
+	return null;
+}
+function ownsSdkSession(ctx, auth, sdkSessionId) {
+	return ctx.registry.list().some((info) => info.sdkSessionId === sdkSessionId && ctx.auth.canSee(auth, info));
+}
+function isRemoteMcpServer(server) {
+	const type = server?.type;
+	return type === "http" || type === "sse";
+}
+//#endregion
+//#region src/routes/agents.ts
+async function handleAgents(ctx, req, res, pathname, auth) {
+	const agents = ctx.agents;
+	const rest = pathname.slice((ctx.basePath + "/agents").length).replace(/^\//, "");
+	if (rest === "") {
+		requireMethod(req, "GET", "POST");
+		if (req.method === "GET") {
+			json(res, 200, { agents: agents.list() });
+			return;
+		}
+		await createAgent(ctx, agents, req, res, auth);
+		return;
+	}
+	const [id, action, ...extra] = rest.split("/").map(decodeURIComponent);
+	const agent = id === void 0 ? void 0 : agents.get(id);
+	if (!agent || extra.length > 0) fail(404, "agent not found");
+	if (action === "restart") {
+		requireMethod(req, "POST");
+		const body = await readJsonBody(req, ctx.maxBodyBytes) ?? {};
+		const previous = agent.sessionId === void 0 ? void 0 : ctx.registry.get(agent.sessionId);
+		const created = await startSession(ctx, agent, typeof body.prompt === "string" ? body.prompt : void 0, auth);
+		const status = previous?.info().status;
+		if (previous && status !== "closed" && status !== "failed") previous.close("server");
+		await respond(ctx, res, 200, await bindWithAvatar(ctx, agent, created), created);
+		return;
+	}
+	if (action === "avatar.png" || action === "avatar-busy.png") {
+		requireMethod(req, "GET");
+		await sendAvatar(ctx, req, res, agent, action === "avatar-busy.png");
+		return;
+	}
+	if (action !== void 0) fail(404, "agent not found");
+	requireMethod(req, "GET", "PATCH", "DELETE");
+	if (req.method === "GET") {
+		await respond(ctx, res, 200, agent);
+		return;
+	}
+	if (req.method === "PATCH") {
+		const patch = await readJsonBody(req, ctx.maxBodyBytes);
+		const updated = await agents.update(agent.id, isRecord(patch) ? patch : {});
+		if (isAgentRefusal(updated)) fail(updated.status, updated.error);
+		await respond(ctx, res, 200, updated);
+		return;
+	}
+	const members = (await readJsonBody(req, ctx.maxBodyBytes) ?? {}).members === "retire" ? "retire" : "release";
+	const outcome = await agents.retire(agent.id, members);
+	if (isAgentRefusal(outcome)) fail(outcome.status, outcome.error);
+	for (const gone of outcome.retired) {
+		const runner = gone.sessionId === void 0 ? void 0 : ctx.registry.get(gone.sessionId);
+		const status = runner?.info().status;
+		if (runner && status !== "closed" && status !== "failed") runner.close("client");
+	}
+	json(res, 200, {
+		retired: outcome.retired.map((a) => a.id),
+		released: outcome.released.map((a) => a.id)
+	});
+}
+async function createAgent(ctx, agents, req, res, auth) {
+	const body = await readJsonBody(req, ctx.maxBodyBytes);
+	if (!isRecord(body)) fail(400, "request body must be a JSON object");
+	if (body.adopt !== void 0) {
+		await adoptSession(ctx, agents, res, body);
 		return;
 	}
-	const authCtx = await auth.authenticate(req);
-	if (!authCtx.ok) {
-		refuseUpgrade(socket, "401 Unauthorized");
+	const draft = agents.draft(body);
+	if (isAgentRefusal(draft)) fail(draft.status, draft.error);
+	const created = await startSession(ctx, draft, typeof body.prompt === "string" ? body.prompt : void 0, auth);
+	await respond(ctx, res, 201, await bindWithAvatar(ctx, draft, created), created);
+}
+async function adoptSession(ctx, agents, res, body) {
+	if (typeof body.adopt !== "string") fail(400, "adopt must be a session id");
+	const info = await sessionInfoOf(ctx, body.adopt);
+	if (!info) fail(404, "session not found");
+	if (agents.bySession(info.id)) fail(409, "that session already belongs to an agent");
+	const draft = agents.draft({
+		name: body.name ?? info.title,
+		config: {
+			...configOf(info),
+			...body.config
+		},
+		lead: body.lead
+	});
+	if (isAgentRefusal(draft)) fail(draft.status, draft.error);
+	await respond(ctx, res, 201, await bindWithAvatar(ctx, draft, info));
+}
+async function bindWithAvatar(ctx, agent, session) {
+	const recipe = agent.avatarRecipe ?? await rollAvatar(ctx, agent, session);
+	return ctx.agents.bind(recipe === void 0 ? agent : {
+		...agent,
+		avatarRecipe: recipe
+	}, session.id);
+}
+async function rollAvatar(ctx, agent, session) {
+	if (!ctx.avatars) return;
+	const project = session ? ctx.projects.withProject(session).project?.root ?? session.cwd : void 0;
+	try {
+		return await ctx.avatars.roll(agent.avatarSeed, session?.engine, project || void 0);
+	} catch {
 		return;
 	}
-	const known = await sessionInfoOf(ctx, route.id);
-	if (known && !auth.canSee(authCtx, known)) {
-		refuseUpgrade(socket, "404 Not Found");
-		return;
+}
+async function sendAvatar(ctx, req, res, agent, busy) {
+	const avatars = ctx.avatars;
+	if (!avatars) fail(404, "this gateway draws no avatars");
+	let recipe = agent.avatarRecipe;
+	if (recipe === void 0) {
+		recipe = await rollAvatar(ctx, agent, agent.sessionId === void 0 ? void 0 : await sessionInfoOf(ctx, agent.sessionId));
+		if (recipe === void 0) fail(503, "the avatar pack could not be loaded");
+		await ctx.agents.save({
+			...agent,
+			avatarRecipe: recipe
+		});
 	}
-	const runner = await parking.ensureLive(route.id).catch(() => void 0);
-	if (!runner || !auth.canSee(authCtx, runner.info())) {
-		refuseUpgrade(socket, "404 Not Found");
+	const image = busy ? await avatars.busy(recipe) : await avatars.still(recipe);
+	if (!image) fail(404, "this avatar pack has no busy animation");
+	const headers = {
+		"content-type": "image/png",
+		etag: image.etag,
+		"cache-control": "private, max-age=86400"
+	};
+	if (image.durations) headers["x-frame-durations"] = image.durations.join(",");
+	if (req.headers["if-none-match"] === image.etag) {
+		res.writeHead(304, headers).end();
 		return;
 	}
-	wss.handleUpgrade(req, socket, head, (ws) => {
-		attachClient(ctx, ws, runner, req, { operator: auth.isOperator(authCtx) });
+	res.writeHead(200, headers).end(Buffer.from(image.png));
+}
+async function startSession(ctx, agent, prompt, auth) {
+	const { config } = agent;
+	const vetted = vetCreateRequest(ctx, stripUndefined({
+		cwd: config.cwd,
+		profile: config.profile,
+		model: config.model,
+		reasoningEffort: config.reasoningEffort,
+		permissionMode: config.permissionMode,
+		allowDangerouslySkipPermissions: config.permissionMode === "bypassPermissions" ? true : void 0,
+		agentContextReset: config.agentContextReset ?? true,
+		prompt
+	}), auth);
+	if (!vetted.ok) fail(vetted.status, vetted.error);
+	return (await ctx.factory.createRunner(ctx.factory.buildRunnerConfig(vetted.request, { operator: ctx.auth.isOperator(auth) }), { brief: config.brief?.trim() || void 0 })).info();
+}
+async function respond(ctx, res, status, agent, session) {
+	const info = session ?? (agent.sessionId === void 0 ? void 0 : await sessionInfoOf(ctx, agent.sessionId));
+	const body = { agent: ctx.agents.public(agent) };
+	if (info) body.session = ctx.projects.withProject(info);
+	json(res, status, body);
+}
+function configOf(info) {
+	return stripUndefined({
+		cwd: info.cwd || void 0,
+		profile: info.profile,
+		model: info.model,
+		reasoningEffort: info.effort ?? void 0,
+		permissionMode: info.permissionMode
 	});
 }
-//#endregion
-//#region src/lib/machine-id.ts
-let cached;
-function machineId() {
-	cached ??= createHash("sha256").update([
-		hostname(),
-		platform(),
-		arch(),
-		homedir()
-	].join("\0")).digest("hex").slice(0, 32);
-	return cached;
+function stripUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
 //#region src/routes/executions.ts
@@ -2489,106 +3393,6 @@ async function handleWrite({ ctx, hostFiles, req, res }) {
 	});
 }
 //#endregion
-//#region src/lib/host-only-keys.ts
-const HOST_ONLY_KEY_TABLE = {
-	epoch: "durable",
-	pricing: "transient",
-	queryFn: "transient",
-	env: "transient",
-	pathToClaudeCodeExecutable: "durable",
-	extraOptions: "transient",
-	instructions: "transient",
-	defaultApprovalTimeoutMs: "durable",
-	backfillHistory: "durable",
-	historyFn: "transient",
-	sessionInfoFn: "transient",
-	peers: "transient",
-	shells: "transient",
-	shellAgentWrite: "transient",
-	createdByOperator: "durable",
-	fallbackTitle: "transient",
-	connectFn: "transient",
-	codexHome: "durable",
-	codexPathOverride: "durable",
-	languageModel: "transient",
-	tools: "transient",
-	maxSteps: "durable",
-	executor: "transient",
-	executableTools: "transient",
-	vfs: "transient",
-	executionLimits: "durable",
-	executionBackend: "transient",
-	toolTitles: "transient",
-	shouldApprove: "transient",
-	resolveModel: "transient",
-	reportMcpServers: "transient",
-	onClose: "transient",
-	restore: "transient"
-};
-const HOST_ONLY_KEYS = new Set(Object.keys(HOST_ONLY_KEY_TABLE));
-const DURABLE_HOST_KEYS = Object.entries(HOST_ONLY_KEY_TABLE).filter(([, lifetime]) => lifetime === "durable").map(([key]) => key);
-//#endregion
-//#region src/routes/create-vet.ts
-function vetCreateRequest(ctx, body, auth) {
-	if (typeof body !== "object" || body === null || Array.isArray(body)) return {
-		ok: false,
-		status: 400,
-		error: "request body must be a JSON object"
-	};
-	const hostOnly = Object.keys(body).filter((key) => HOST_ONLY_KEYS.has(key));
-	if (hostOnly.length > 0) return {
-		ok: false,
-		status: 400,
-		error: `host-only runner config is not accepted on a session request: ${hostOnly.join(", ")} (set it from the gateway's buildRunnerConfig hook)`
-	};
-	const req = pickCreateSessionRequest(body);
-	const { availability, factory } = ctx;
-	const early = factory.applyScope(req, auth) ?? refusal(403, factory.applyBypassPolicy(req));
-	if (early) return {
-		ok: false,
-		...early
-	};
-	const resolved = factory.resolveProfile(req.profile, auth.allowedProfiles);
-	if (!resolved.ok) return resolved;
-	const refused = refusal(403, refuseHostAuthority(ctx, req, resolved.profile, auth)) ?? availability.checkAvailable(resolved.profile) ?? factory.checkCwd(req, resolved.profile) ?? refusal(400, factory.checkPermissionMode(req.permissionMode, resolved.profile) ?? factory.checkEngineGrants(req, resolved.profile));
-	if (refused) return {
-		ok: false,
-		...refused
-	};
-	factory.stripInertFields(req, resolved.profile);
-	req.profile = resolved.profile?.name;
-	return {
-		ok: true,
-		request: req
-	};
-}
-function refusal(status, error) {
-	return error === null ? null : {
-		status,
-		error
-	};
-}
-function refuseHostAuthority(ctx, req, profile, auth) {
-	if (ctx.auth.isOperator(auth)) return null;
-	const engine = engineOf(profile);
-	const name = profile?.name ?? "default";
-	if ((engine === "claude" || engine === "codex") && !auth.allowedProfiles?.includes(name)) return `profile '${name}' runs the ${engine} engine on the host; a non-operator caller needs it named in its allowedProfiles`;
-	const mode = refusePermissionMode(req.permissionMode, { operator: false });
-	if (mode) return mode;
-	if (req.allowDangerouslySkipPermissions) return "allowDangerouslySkipPermissions is reserved to operators";
-	if (req.settingSources !== void 0 && req.settingSources.length > 0) return "settingSources is reserved to operators: it loads hooks and settings from the host";
-	if (!(typeof req.mcpServers === "object" && req.mcpServers !== null ? Object.values(req.mcpServers) : []).every(isRemoteMcpServer)) return "a stdio MCP server is reserved to operators: it runs a command on the host";
-	if (req.resume !== void 0 && !ownsSdkSession(ctx, auth, req.resume)) return "resume is limited to a live session this caller can see";
-	return null;
-}
-function ownsSdkSession(ctx, auth, sdkSessionId) {
-	return ctx.registry.list().some((info) => info.sdkSessionId === sdkSessionId && ctx.auth.canSee(auth, info));
-}
-function isRemoteMcpServer(server) {
-	const type = server?.type;
-	return type === "http" || type === "sse";
-}
-//#endregion
 //#region src/routes/jobs.ts
 async function handleJobs(ctx, req, res, pathname, auth) {
 	const { auth: authSvc, basePath, queue } = ctx;
@@ -3260,12 +4064,15 @@ const ITEM_HANDLERS = {
 	produced: ({ ctx, req, res, route }) => handleProducedFiles(ctx, req, res, route.id, route.producedFileId),
 	shells: ({ ctx, req, res, route, runner, auth }) => handleShells(ctx, req, res, route, runner ?? null, ctx.auth.isOperator(auth)),
 	"stop-task": handleStopTask,
+	"background-task": handleBackgroundTask,
 	"project-icon": ({ ctx, req, res, info }) => handleProjectIcon(ctx.projects, req, res, info.cwd),
 	"tool-result": ({ req, res, route, runner, parked }) => {
 		const snapshot = parked && !isDormant(parked) ? parked.snapshot.events : void 0;
 		handleToolResult(req, res, runner?.eventAt?.bind(runner) ?? (snapshot && ((seq) => snapshot.find((event) => event.seq === seq))), route.resultSeq);
 	},
-	permission: handlePermission
+	permission: handlePermission,
+	peers: handlePeers,
+	sleep: handleSleep
 };
 async function handleSessions(ctx, req, res, route, auth) {
 	if (route.kind === "collection") {
@@ -3329,6 +4136,11 @@ async function handleSession({ ctx, req, res, route, runner, parked, info }) {
 		status: "closed"
 	}) });
 }
+async function handlePeers({ ctx, req, res, route }) {
+	requireMethod(req, "GET");
+	if (!ctx.peers) fail(404, "peer messaging is off on this gateway");
+	json(res, 200, { peers: await ctx.peers.list(route.id) });
+}
 function handleFiles({ req, res, route, runner, parked }) {
 	requireMethod(req, "GET");
 	const snapshotFiles = parked && !isDormant(parked) ? parked.snapshot.vfs : void 0;
@@ -3356,6 +4168,18 @@ async function handleStopTask({ req, res, route, runner }) {
 	if (!await live.stopTask(route.stopTaskId)) fail(404, "no running task to stop");
 	json(res, 200, { ok: true });
 }
+async function handleBackgroundTask({ req, res, route, runner }) {
+	requireMethod(req, "POST");
+	const live = requireLive(runner, "it has no running tasks");
+	if (!live.backgroundTask) fail(501, `the ${engineOf(live.info())} engine cannot move a task to the background`);
+	if (!await live.backgroundTask(route.backgroundTaskId)) fail(404, "no foreground task to move to the background");
+	json(res, 200, { ok: true });
+}
+async function handleSleep({ ctx, req, res, runner, info }) {
+	requireMethod(req, "POST");
+	if (runner) await sleepRunner(runner);
+	json(res, 200, { session: ctx.projects.withProject(runner?.info() ?? info) });
+}
 async function handlePermission({ ctx, req, res, route, runner }) {
 	requireMethod(req, "POST");
 	const body = await readJsonBody(req, ctx.maxBodyBytes);
@@ -3403,6 +4227,11 @@ function httpRoutes(ctx) {
 			auth: "any",
 			handler: (req, res, pathname, auth) => handleProfiles(ctx, req, res, pathname, auth)
 		}),
+		route({
+			match: pathWhere(under("/agents")),
+			auth: "operator",
+			handler: (req, res, pathname, auth) => handleAgents(ctx, req, res, pathname, auth)
+		}),
 		route({
 			match: pathWhere((pathname) => pathname.startsWith(base + "/executions/")),
 			auth: "any",
@@ -3470,6 +4299,36 @@ function pathWhere(test) {
 	return (pathname) => test(pathname) ? pathname : void 0;
 }
 //#endregion
+//#region src/services/agent-store.ts
+function createMemoryAgentStore(seed = []) {
+	const agents = new Map(seed.map((a) => [a.id, a]));
+	return {
+		list: () => [...agents.values()],
+		save: (agent) => void agents.set(agent.id, agent),
+		delete: (id) => void agents.delete(id)
+	};
+}
+function createFileAgentStore(path = join(process.cwd(), ".workerdeck", "agents.json")) {
+	const read = () => {
+		const parsed = readJsonOrSync(path, []);
+		if (!Array.isArray(parsed)) return /* @__PURE__ */ new Map();
+		return new Map(parsed.filter((a) => a && typeof a.id === "string" && typeof a.name === "string").map((a) => [a.id, a]));
+	};
+	const write = (agents) => writeJsonAtomicSync(path, [...agents.values()], { indent: 2 });
+	return {
+		list: () => [...read().values()],
+		save: (agent) => {
+			const agents = read();
+			agents.set(agent.id, agent);
+			write(agents);
+		},
+		delete: (id) => {
+			const agents = read();
+			if (agents.delete(id)) write(agents);
+		}
+	};
+}
+//#endregion
 //#region src/services/attachments.ts
 const DEFAULT_MAX_FILE_BYTES = 10485760;
 const DEFAULT_MAX_SESSION_BYTES = 67108864;
@@ -3568,37 +4427,6 @@ function safeName(name) {
 	return cleaned.length > 120 ? cleaned.slice(0, 120) : cleaned;
 }
 //#endregion
-//#region src/lib/scope.ts
-const MAX_SCOPE_KEYS = 16;
-const MAX_SCOPE_LEN = 200;
-function readScope(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
-	const entries = Object.entries(value);
-	if (entries.some(([, v]) => typeof v !== "string")) return;
-	return Object.fromEntries(entries);
-}
-function checkScope(value) {
-	if (value === void 0) return null;
-	const scope = readScope(value);
-	if (!scope) return "scope must be an object of string values";
-	const entries = Object.entries(scope);
-	if (entries.length > MAX_SCOPE_KEYS) return `scope may carry at most ${MAX_SCOPE_KEYS} keys`;
-	for (const [key, val] of entries) {
-		if (key.length === 0) return "scope keys must not be empty";
-		if (key.length > MAX_SCOPE_LEN || val.length > MAX_SCOPE_LEN) return `scope keys and values must be at most ${MAX_SCOPE_LEN} characters`;
-	}
-	return null;
-}
-function sameScope(a, b) {
-	const left = Object.entries(a ?? {}).sort(([x], [y]) => x < y ? -1 : 1);
-	const right = Object.entries(b ?? {}).sort(([x], [y]) => x < y ? -1 : 1);
-	return left.length === right.length && left.every(([key, value], i) => right[i][0] === key && right[i][1] === value);
-}
-function scopeMatches(principal, session) {
-	if (!principal) return true;
-	return Object.entries(principal).every(([key, value]) => session?.[key] === value);
-}
-//#endregion
 //#region src/services/auth.ts
 function createAuthService(deps) {
 	const { options, registry } = deps;
@@ -3708,6 +4536,192 @@ var AvailabilityTracker = class {
 	}
 };
 //#endregion
+//#region src/services/engine-sleep.ts
+var EngineSleepTimers = class {
+	#options;
+	#timers = /* @__PURE__ */ new Map();
+	#runners = /* @__PURE__ */ new Map();
+	#closed = false;
+	constructor(options) {
+		this.#options = options;
+	}
+	get enabled() {
+		return this.#options.afterMs > 0 && !this.#closed;
+	}
+	watch(runner) {
+		if (this.#closed || !runner.sleep || !this.enabled && !this.#options.afterMsFor) return;
+		this.#runners.set(runner.id, runner);
+		const unsubscribe = runner.subscribe((event) => {
+			if (event.type === "status_changed") this.#rearm(runner);
+		}, runner.info().lastSeq);
+		this.#rearm(runner);
+		return () => {
+			unsubscribe();
+			this.#disarm(runner.id);
+			if (this.#runners.get(runner.id) === runner) this.#runners.delete(runner.id);
+		};
+	}
+	onDetach(sessionId) {
+		const runner = this.#runners.get(sessionId);
+		if (runner) this.#rearm(runner);
+	}
+	close() {
+		this.#closed = true;
+		for (const timer of this.#timers.values()) clearTimeout(timer);
+		this.#timers.clear();
+		this.#runners.clear();
+	}
+	#afterMs(sessionId) {
+		return this.#closed ? 0 : this.#options.afterMsFor?.(sessionId) ?? this.#options.afterMs;
+	}
+	#rearm(runner) {
+		this.#disarm(runner.id);
+		const afterMs = this.#afterMs(runner.id);
+		if (afterMs <= 0 || !this.#sleepable(runner)) return;
+		const timer = setTimeout(() => {
+			this.#timers.delete(runner.id);
+			if (this.#afterMs(runner.id) <= 0 || !this.#sleepable(runner)) return;
+			runner.sleep?.().catch((error) => this.#options.onError?.(error, runner.id));
+		}, afterMs);
+		timer.unref?.();
+		this.#timers.set(runner.id, timer);
+	}
+	#sleepable(runner) {
+		const info = runner.info();
+		return info.status === "idle" && info.engineAsleep !== true && this.#options.attachedCount(runner.id) === 0;
+	}
+	#disarm(sessionId) {
+		clearTimeout(this.#timers.get(sessionId));
+		this.#timers.delete(sessionId);
+	}
+};
+const HOUR_MS = 36e5;
+const RESET_TIMEOUT_MS = 6e4;
+const CONTEXT_RESET_SCHEDULED = "Reset scheduled. It runs when this turn ends: your conversation is cleared and your prompt becomes the first message of a fresh one. End your turn now and start no new work. If the turn is interrupted or ends in an error, the reset is cancelled.";
+var ContextResetService = class {
+	#options;
+	#runners = /* @__PURE__ */ new Map();
+	#pending = /* @__PURE__ */ new Map();
+	#running = /* @__PURE__ */ new Set();
+	#history = /* @__PURE__ */ new Map();
+	#turnFailed = /* @__PURE__ */ new Set();
+	#closed = false;
+	constructor(options = {}) {
+		this.#options = options;
+	}
+	get defaultEnabled() {
+		return this.#options.default === true;
+	}
+	watch(runner) {
+		if (this.#closed) return;
+		this.#runners.set(runner.id, runner);
+		const unsubscribe = runner.subscribe((event) => this.#observe(runner, event), runner.info().lastSeq);
+		return () => {
+			unsubscribe();
+			if (this.#runners.get(runner.id) === runner) {
+				this.#runners.delete(runner.id);
+				this.#pending.delete(runner.id);
+			}
+		};
+	}
+	async request(sessionId, request) {
+		const runner = this.#runners.get(sessionId);
+		if (this.#closed || !runner || runner.info().agentContextReset !== true) throw new Error("context reset is not enabled for this session");
+		if (!runner.clearContext) throw new Error("this engine cannot clear its conversation");
+		if (this.#pending.has(sessionId) || this.#running.has(sessionId)) throw new Error("a reset is already scheduled for this session");
+		const refused = this.#rateRefusal(sessionId);
+		if (refused) throw new Error(refused);
+		this.#pending.set(sessionId, {
+			prompt: request.prompt,
+			reason: request.reason
+		});
+		this.#turnFailed.delete(sessionId);
+		return CONTEXT_RESET_SCHEDULED;
+	}
+	close() {
+		this.#closed = true;
+		this.#pending.clear();
+		this.#runners.clear();
+	}
+	#rateRefusal(sessionId) {
+		const now = this.#now();
+		const minInterval = this.#options.minIntervalMs ?? 6e5;
+		const maxPerHour = this.#options.maxPerHour ?? 3;
+		const recent = (this.#history.get(sessionId) ?? []).filter((at) => now - at < HOUR_MS);
+		const last = recent.at(-1);
+		if (last !== void 0 && now - last < minInterval) return `refused: the last reset was ${minutes(now - last)} ago and resets need ${minutes(minInterval)} between them; keep working`;
+		if (maxPerHour <= 0 || recent.length >= maxPerHour) return `refused: this session already reset ${recent.length} time(s) in the last hour (limit ${maxPerHour}); keep working`;
+		return null;
+	}
+	#observe(runner, event) {
+		if (!this.#pending.has(runner.id)) return;
+		if (event.type === "turn_result" && event.isError) {
+			this.#turnFailed.add(runner.id);
+			return;
+		}
+		if (event.type === "session_closed") {
+			this.#pending.delete(runner.id);
+			return;
+		}
+		if (event.type !== "status_changed" || event.status !== "idle") return;
+		const request = this.#pending.get(runner.id);
+		this.#pending.delete(runner.id);
+		if (this.#turnFailed.delete(runner.id)) return;
+		this.#run(runner, request);
+	}
+	async #run(runner, request) {
+		this.#running.add(runner.id);
+		try {
+			const reset = nextReset(runner, this.#options.resetTimeoutMs ?? RESET_TIMEOUT_MS);
+			try {
+				await runner.clearContext({ agentReason: request.reason });
+				await reset.done;
+			} finally {
+				reset.cancel();
+			}
+			const history = (this.#history.get(runner.id) ?? []).filter((at) => this.#now() - at < HOUR_MS);
+			history.push(this.#now());
+			this.#history.set(runner.id, history);
+			runner.sendMessage(request.prompt);
+		} catch (error) {
+			this.#options.onError?.(error, runner.id);
+		} finally {
+			this.#running.delete(runner.id);
+		}
+	}
+	#now() {
+		return this.#options.now?.() ?? Date.now();
+	}
+};
+function nextReset(runner, timeoutMs) {
+	let timer;
+	let unsubscribe;
+	const cancel = () => {
+		clearTimeout(timer);
+		unsubscribe?.();
+	};
+	return {
+		done: new Promise((resolve, reject) => {
+			timer = setTimeout(() => {
+				cancel();
+				reject(/* @__PURE__ */ new Error("the engine did not confirm the reset"));
+			}, timeoutMs);
+			timer.unref?.();
+			unsubscribe = runner.subscribe((event) => {
+				if (event.type === "conversation_reset") {
+					cancel();
+					resolve();
+				}
+			}, runner.info().lastSeq);
+		}),
+		cancel
+	};
+}
+function minutes(ms) {
+	const value = Math.max(1, Math.round(ms / 6e4));
+	return `${value} minute${value === 1 ? "" : "s"}`;
+}
+//#endregion
 //#region src/services/bridge.ts
 var BridgeHub = class {
 	#sessions = /* @__PURE__ */ new Map();
@@ -4023,7 +5037,10 @@ var SessionParkManager = class {
 	}
 	async listInfo() {
 		await Promise.all(this.#storeOps.values());
-		return (await this.#options.store.list()).filter((record) => this.#options.registry.get(record.id) === void 0).map((record) => record.info);
+		return (await this.#options.store.list()).filter((record) => this.#options.registry.get(record.id) === void 0).map((record) => isDormant(record) ? {
+			...record.info,
+			engineAsleep: true
+		} : record.info);
 	}
 	async ensureLive(id) {
 		const live = this.#options.registry.get(id);
@@ -4273,7 +5290,7 @@ var SessionParkManager = class {
 	}
 };
 function idleRecordBase(runner, config) {
-	const info = runner.info();
+	const { engineAsleep: _engineAsleep, ...info } = runner.info();
 	return {
 		id: runner.id,
 		info: {
@@ -4338,6 +5355,8 @@ var ProfileService = class {
 			if (p.codexHome && !existsSync(p.codexHome)) return `profile '${p.name}' codexHome does not exist: ${p.codexHome}`;
 		} else if (!p.configDir || !existsSync(p.configDir)) return `profile '${p.name}' configDir does not exist: ${p.configDir}`;
 		if (disableBypassPermissions && p.defaults?.permissionMode === "bypassPermissions") return `profile '${p.name}' defaults to bypassPermissions but disableBypassPermissions is set`;
+		const efforts = p.defaults?.efforts;
+		if (efforts !== void 0 && !isEffortMap(efforts)) return `profile '${p.name}' defaults.efforts must map model names to effort levels`;
 		const fallbackMode = p.defaults?.permissionMode;
 		if (fallbackMode && !supportsPermissionMode(p.engine, fallbackMode)) return `profile '${p.name}' defaults to permission mode '${fallbackMode}', which engine '${engineOf(p)}' does not support (supported: ${adapterFor(engineOf(p)).capabilities.permissionModes.join(", ")})`;
 		return null;
@@ -4439,6 +5458,9 @@ var ProfileService = class {
 		};
 	}
 };
+function isEffortMap(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.entries(value).every(([model, effort]) => model !== "" && typeof effort === "string" && effort !== "");
+}
 //#endregion
 //#region src/services/profile-usage.ts
 var ProfileUsageTracker = class {
@@ -4716,7 +5738,7 @@ function createRelayLink(options, peers, log) {
 	const remoteTarget = parseRelayPeerId;
 	const reachesRemote = async (from) => {
 		const me = await peers.relaySender(from);
-		return me.scope === void 0 || Object.keys(me.scope).length === 0;
+		return (me.scope === void 0 || Object.keys(me.scope).length === 0) && me.agent?.lead === void 0;
 	};
 	return {
 		directory: {
@@ -4783,264 +5805,6 @@ function createRelayLink(options, peers, log) {
 	};
 }
 //#endregion
-//#region src/services/peers.ts
-const DEFAULT_PER_MINUTE = 10;
-const DEFAULT_MAX_HOPS = 12;
-const WINDOW_MS = 6e4;
-function visible(from, to) {
-	return to.id !== from.id && scopeMatches(from.scope, to.scope);
-}
-function relayEntry(info, live) {
-	const items = info.checklist;
-	return {
-		id: info.id,
-		engine: info.engine,
-		status: info.status,
-		title: info.title,
-		project: info.project ? {
-			name: info.project.name,
-			root: info.project.root
-		} : void 0,
-		cwd: info.cwd,
-		profile: info.profile,
-		model: info.model,
-		permissionMode: info.permissionMode,
-		contextUsage: info.contextUsage,
-		checklist: items?.length ? {
-			done: items.filter((item) => item.status === "completed").length,
-			total: items.length
-		} : void 0,
-		numTurns: info.numTurns,
-		createdAt: info.createdAt,
-		lastActivityAt: info.lastActivityAt,
-		pendingPermissionCount: info.pendingPermissionCount,
-		live
-	};
-}
-function createPeerService(deps) {
-	const perMinute = deps.options?.perMinute ?? DEFAULT_PER_MINUTE;
-	const maxChars = deps.options?.maxMessageChars ?? PEER_MESSAGE_MAX_CHARS;
-	const maxHops = deps.options?.maxHops ?? DEFAULT_MAX_HOPS;
-	const sent = /* @__PURE__ */ new Map();
-	const inbound = /* @__PURE__ */ new Map();
-	const registry = () => {
-		const found = deps.refs.registry;
-		if (!found) throw new Error("peer messaging is not ready");
-		return found;
-	};
-	const allSessions = async () => {
-		const live = registry().list();
-		const dormant = await deps.refs.parking?.listInfo() ?? [];
-		return [...live, ...dormant].map((info) => deps.projects.withProject(info));
-	};
-	const infoOf = async (id) => {
-		const live = registry().get(id)?.info();
-		if (live) return deps.projects.withProject(live);
-		const record = await deps.refs.parking?.get(id);
-		return record ? deps.projects.withProject(record.info) : void 0;
-	};
-	const sender = async (from) => {
-		const info = await infoOf(from);
-		if (!info) throw new Error(`unknown sender session: ${from}`);
-		return info;
-	};
-	const recentOf = (sessionId, recent) => {
-		const limit = Math.min(Math.max(recent ?? PEER_RECENT_DEFAULT, 0), PEER_RECENT_MAX);
-		const runner = registry().get(sessionId);
-		const events = [];
-		if (runner && limit > 0) runner.subscribe((event) => events.push(event), 0, {
-			truncateResults: true,
-			imageRefs: true
-		})();
-		return {
-			runner,
-			lines: recentLines(events, limit)
-		};
-	};
-	const underRateLimit = (from, to) => {
-		const key = `${from}->${to}`;
-		const now = Date.now();
-		const recent = (sent.get(key) ?? []).filter((at) => now - at < WINDOW_MS);
-		if (recent.length >= perMinute) {
-			sent.set(key, recent);
-			return false;
-		}
-		recent.push(now);
-		sent.set(key, recent);
-		return true;
-	};
-	const list = async (from) => {
-		const me = await sender(from);
-		return (await allSessions()).filter((info) => visible(me, info)).sort((a, b) => (b.lastActivityAt ?? b.createdAt) - (a.lastActivityAt ?? a.createdAt)).map(peerSummary);
-	};
-	const peek = async (from, sessionId, options) => {
-		const me = await sender(from);
-		const info = await infoOf(sessionId);
-		if (!info || !visible(me, info)) return;
-		const { runner, lines } = recentOf(sessionId, options?.recent);
-		return {
-			...peerSummary(info),
-			live: runner !== void 0,
-			checklist: info.checklist,
-			pendingApprovals: runner ? runner.pendingApprovals.map((request) => request.title ?? request.toolName) : [],
-			recent: lines
-		};
-	};
-	const send = async (from, sessionId, text, options) => {
-		const me = await sender(from);
-		if (sessionId === from) return {
-			delivered: false,
-			reason: "that is this session"
-		};
-		if (text.length > maxChars) return {
-			delivered: false,
-			reason: `message is ${text.length} characters; the limit is ${maxChars}. Write it to a file and send the path.`
-		};
-		const target = await infoOf(sessionId);
-		if (!target || !visible(me, target)) return {
-			delivered: false,
-			reason: `no such session: ${sessionId}`
-		};
-		const hops = [...options?.hops ?? inbound.get(from) ?? [], from];
-		return deliver(target, text, {
-			kind: "peer",
-			sessionId: from,
-			name: me.title,
-			engine: me.engine,
-			hops
-		}, from);
-	};
-	const deliver = async (target, text, origin, rateKey) => {
-		const sessionId = target.id;
-		if (target.status === "closed" || target.status === "failed") return {
-			delivered: false,
-			reason: `session ${sessionId} is ${target.status}`
-		};
-		const hops = origin.hops ?? [];
-		if (hops.length > maxHops) return {
-			delivered: false,
-			reason: `${hops.length} messages have passed between sessions without a person speaking; stop and ask your user before continuing.`
-		};
-		if (!underRateLimit(rateKey, sessionId)) return {
-			delivered: false,
-			reason: `rate limit: at most ${perMinute} messages a minute to one session. Batch what you have to say.`
-		};
-		const runner = await deps.refs.parking?.ensureLive(sessionId) ?? registry().get(sessionId);
-		if (!runner) return {
-			delivered: false,
-			reason: `session ${sessionId} could not be woken`
-		};
-		const before = runner.info().status;
-		try {
-			runner.sendMessage(text, void 0, { origin });
-		} catch (error) {
-			return {
-				delivered: false,
-				reason: error instanceof Error ? error.message : String(error)
-			};
-		}
-		inbound.set(sessionId, hops);
-		return {
-			delivered: true,
-			sessionId,
-			name: target.title,
-			queued: before === "running" || before === "awaiting_approval"
-		};
-	};
-	const exposedInfo = async (sessionId, exposed) => {
-		const info = await infoOf(sessionId);
-		return info && info.status !== "closed" && scopeMatches(exposed, info.scope) ? info : void 0;
-	};
-	const relayEntries = async (exposed) => {
-		const live = new Set(registry().list().map((info) => info.id));
-		return (await allSessions()).filter((info) => info.status !== "closed" && scopeMatches(exposed, info.scope)).map((info) => relayEntry(info, live.has(info.id)));
-	};
-	const relayPeek = async (sessionId, recent, exposed) => {
-		const info = await exposedInfo(sessionId, exposed);
-		if (!info) return;
-		const { runner, lines } = recentOf(sessionId, recent);
-		return {
-			...relayEntry(info, runner !== void 0),
-			checklistItems: info.checklist,
-			pendingApprovals: runner ? runner.pendingApprovals.map((request) => request.title ?? request.toolName) : [],
-			recent: lines
-		};
-	};
-	const relaySend = async (origin, sessionId, text, exposed) => {
-		if (text.length === 0 || text.length > maxChars) return {
-			delivered: false,
-			reason: `message is ${text.length} characters; the limit is ${maxChars}. Write it to a file and send the path.`
-		};
-		const target = await exposedInfo(sessionId, exposed);
-		if (!target) return {
-			delivered: false,
-			reason: `no such session: ${sessionId}`
-		};
-		const from = `${origin.gateway}:${origin.sessionId}`;
-		return deliver(target, text, {
-			kind: "peer",
-			sessionId: from,
-			hostId: origin.gateway,
-			name: origin.name,
-			engine: origin.engine,
-			hops: origin.hops
-		}, from);
-	};
-	const mentions = async (from, text) => {
-		const tokens = scanPeerMentions(text);
-		if (tokens.length === 0) return [];
-		const rows = await list(from);
-		const byKey = /* @__PURE__ */ new Map();
-		const add = (key, row) => {
-			const held = byKey.get(key);
-			if (held) held.push(row);
-			else byKey.set(key, [row]);
-		};
-		for (const row of rows) {
-			add(peerMentionKey(peerMentionSlug(row.title, row.id)), row);
-			add(peerMentionKey(row.id), row);
-		}
-		const resolved = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const token of tokens) {
-			const key = peerMentionKey(token.body);
-			const exact = byKey.get(key);
-			const matches = exact ?? (key.length >= 4 ? rows.filter((row) => row.id.startsWith(key)) : []);
-			const target = matches[0];
-			if (!target || matches.length > 1 && !exact) continue;
-			if (seen.has(target.id)) continue;
-			seen.add(target.id);
-			const others = matches.slice(1, 4).map((row) => row.id);
-			resolved.push({
-				typed: token.body,
-				id: target.id,
-				name: target.title,
-				engine: target.engine,
-				status: target.status,
-				cwd: target.cwd,
-				...others.length ? { ambiguousWith: others } : {}
-			});
-			if (resolved.length >= PEER_MENTION_MAX) break;
-		}
-		return resolved;
-	};
-	const watch = (runner) => runner.subscribe((event) => {
-		if (event.type === "user_message" && !event.origin && !event.synthetic && event.parentToolUseId == null && !event.replay) inbound.delete(runner.id);
-	}, runner.info().lastSeq);
-	return {
-		list,
-		peek,
-		send,
-		mentions,
-		watch,
-		relaySender: sender,
-		relayChain: (from) => [...inbound.get(from) ?? [], from],
-		relayEntries,
-		relayPeek,
-		relaySend
-	};
-}
-//#endregion
 //#region src/services/registry.ts
 var SessionRegistry = class {
 	#sessions = /* @__PURE__ */ new Map();
@@ -5252,7 +6016,7 @@ function createSessionFactory(deps) {
 			return adapterFor(profile.engine).sessionEnv?.(profile, process.env) ?? process.env;
 		}
 	};
-	const buildRunner = async (built, restore, id) => {
+	const buildRunner = async (built, restore, id, options) => {
 		const name = built.profile;
 		const profile = name !== void 0 ? profiles.get(name) : void 0;
 		if (name !== void 0 && !profile) throw new Error(`unknown profile: ${name}`);
@@ -5262,13 +6026,23 @@ function createSessionFactory(deps) {
 			...deps.peers ? { peers: deps.peers } : {},
 			...deps.pricing ? { pricing: deps.pricing } : {}
 		};
+		delete config.contextReset;
 		delete config.shells;
 		delete config.shellAgentWrite;
+		delete config.effortDefaults;
+		const efforts = {
+			...deps.effortDefaults,
+			...profile?.defaults?.efforts
+		};
+		if (Object.keys(efforts).length > 0) config.effortDefaults = efforts;
+		if (deps.contextReset && (built.agentContextReset ?? profile?.defaults?.agentContextReset ?? deps.contextReset.defaultEnabled)) config.contextReset = deps.contextReset.directory;
 		if (deps.shells && capabilities.hostCwd === true) {
 			config.shells = deps.shells;
 			const write = deps.shellAgentWrite ?? "read-only";
 			if (write !== "read-only" && built.createdByOperator === true) config.shellAgentWrite = write;
 		}
+		const brief = options?.brief ?? deps.agentBrief?.(id ?? restore?.id);
+		if (brief) config.instructions = composeInstructions(config.instructions, brief);
 		if (config.instructions !== void 0 && capabilities.systemInstructions === false) throw new Error(`the ${engineOf(profile)} engine cannot deliver system instructions`);
 		const runner = profile && isProviderProfile(profile) ? await deps.createEngineRunner({
 			config,
@@ -5286,8 +6060,8 @@ function createSessionFactory(deps) {
 		if (!sameScope(reported, config.scope)) throw new Error(`runner for session ${runner.id} reports scope ${JSON.stringify(reported)}, expected ${JSON.stringify(config.scope)} - echo config.scope from info()`);
 		return runner;
 	};
-	const createRunner = async (config) => {
-		const runner = registry.register(await buildRunner(config));
+	const createRunner = async (config, options) => {
+		const runner = registry.register(await buildRunner(config, void 0, void 0, options));
 		parking.remember(runner.id, config);
 		parking.watch(runner);
 		runner.start();
@@ -5406,13 +6180,31 @@ function createWorkerServer(options = {}) {
 	}
 	const generation = randomUUID();
 	const shells = options.shell?.enabled === true ? shellRegistryFor(options.shell, generation) : null;
-	const projects = new ProjectInfoService({ decorate: (info) => shells ? shells.decorate(info) : info });
+	const agents = new AgentService({
+		store: options.agentStore ?? createMemoryAgentStore(),
+		basePath,
+		avatars: options.avatars !== void 0,
+		sleepAfterMs: options.agentSleepAfterMs
+	});
+	const projects = new ProjectInfoService({ decorate: (info) => agents.decorate(shells ? shells.decorate(info) : info) });
 	const notifier = new SessionNotifier({
 		...options.notifications,
 		decorateInfo: (info) => projects.withProject(info),
 		onError: options.notifications?.onError ?? ((error, context) => diagnose(error, `notification-${context.op}`))
 	});
 	const producedFiles = new ProducedFileStore();
+	const engineSleep = new EngineSleepTimers({
+		afterMs: options.engineSleepAfterMs ?? 0,
+		afterMsFor: (sessionId) => agents.sleepAfterFor(sessionId),
+		attachedCount: (sessionId) => bridge.attachedCount(sessionId),
+		onError: (error) => diagnose(error, "engine-sleep")
+	});
+	const contextResets = options.agentContextReset === false ? void 0 : new ContextResetService({
+		...options.agentContextReset,
+		onError: (error) => diagnose(error, "context-reset")
+	});
+	let ownContextResets = contextResets;
+	installContextResetDirectory(contextResets);
 	const registry = new SessionRegistry({ onRegister: (runner) => {
 		const detachers = [
 			notifier.watch(runner),
@@ -5421,7 +6213,9 @@ function createWorkerServer(options = {}) {
 			spendLedger.watch(runner),
 			shells?.watch(runner),
 			peers?.watch(runner),
-			factory.watchAuthSource(runner)
+			factory.watchAuthSource(runner),
+			engineSleep.watch(runner),
+			contextResets?.watch(runner)
 		];
 		const profile = runner.info().profile;
 		if (profile) detachers.push(runner.subscribe((event) => {
@@ -5467,6 +6261,7 @@ function createWorkerServer(options = {}) {
 	let ownShells = shellDirectory;
 	if (ownPeers) installPeerDirectory(ownPeers);
 	installShellDirectory(shellDirectory);
+	if (options.effortDefaults !== void 0 && !isEffortMap(options.effortDefaults)) throw new Error("createWorkerServer: `effortDefaults` must map model names to effort levels");
 	const factory = createSessionFactory({
 		adapterFor,
 		profiles,
@@ -5475,14 +6270,20 @@ function createWorkerServer(options = {}) {
 		allowedCwdRoots: options.allowedCwdRoots,
 		disableBypassPermissions: options.disableBypassPermissions,
 		approvalTimeoutMs: options.approvalTimeoutMs,
+		effortDefaults: options.effortDefaults,
 		requireApiKey: options.requireApiKey,
 		peers: peers ? peerDirectoryHandle(() => ownPeers) : void 0,
+		contextReset: contextResets ? {
+			directory: contextResetDirectoryHandle(() => ownContextResets),
+			defaultEnabled: contextResets.defaultEnabled
+		} : void 0,
 		shells: shellDirectory ? shellDirectoryHandle(() => ownShells) : void 0,
 		shellAgentWrite: options.shell?.agentWrite,
 		pricing: pricing.pricing,
 		registry,
 		parking,
-		bridge
+		bridge,
+		agentBrief: (sessionId) => agents.briefFor(sessionId)
 	});
 	const availability = new AvailabilityTracker({
 		checkCredentials: options.checkCredentials,
@@ -5530,9 +6331,12 @@ function createWorkerServer(options = {}) {
 		availability,
 		auth,
 		factory,
+		agents,
+		avatars: options.avatars,
 		registry,
 		parking,
-		peers,
+		engineSleep,
+		peers: peers ? peerDirectoryHandle(() => ownPeers) : void 0,
 		bridge,
 		projects,
 		queue,
@@ -5579,12 +6383,15 @@ function createWorkerServer(options = {}) {
 		parking,
 		shells,
 		queue,
+		engineSleep,
 		closeQueueSockets: queueSockets.clear,
 		diagnose,
 		releaseDirectories: () => {
 			relay?.close();
 			ownPeers = void 0;
 			ownShells = void 0;
+			contextResets?.close();
+			ownContextResets = void 0;
 		}
 	});
 	return {
@@ -5597,6 +6404,7 @@ function createWorkerServer(options = {}) {
 		listen: async (port, host) => {
 			await profiles.refreshStored();
 			await profiles.seedStore();
+			await agents.hydrate();
 			await parking.hydrate();
 			await shells?.hydrate();
 			return new Promise((resolve, reject) => {
@@ -5684,7 +6492,8 @@ function rebuildRunner(factory, record) {
 			resume: record.sdkSessionId
 		}),
 		epoch: (record.info.epoch ?? 0) + 1,
-		fallbackTitle: record.info.title
+		fallbackTitle: record.info.title,
+		startAsleep: true
 	}, void 0, record.id);
 }
 //#endregion
@@ -5791,6 +6600,6 @@ function createFileProfileStore(path = join(process.cwd(), ".workerdeck", "profi
 	};
 }
 //#endregion
-export { AttachmentStore, BridgeHub, MemorySessionStore, ProducedFileStore, ProfileUsageTracker, SHELL_REFUSAL, SessionNotifier, SessionParkManager, SessionRegistry, SpendLedger, createFileProfileStore, createFileSessionStore, createFileSpendStore, createMemoryProfileStore, createProviderRunner, createShellDirectory, createShellRegistry, createWorkerServer, dayKey, isDormant, isMissing, readJsonOr, reloadPlan, sandboxedProviderProfile, shellPermitted, toDurableRecord, writeFileAtomic, writeJsonAtomic };
+export { AttachmentStore, BridgeHub, MemorySessionStore, ProducedFileStore, ProfileUsageTracker, SHELL_REFUSAL, SessionNotifier, SessionParkManager, SessionRegistry, SpendLedger, createFileAgentStore, createFileProfileStore, createFileSessionStore, createFileSpendStore, createMemoryAgentStore, createMemoryProfileStore, createProviderRunner, createShellDirectory, createShellRegistry, createWorkerServer, dayKey, isDormant, isMissing, readJsonOr, reloadPlan, sandboxedProviderProfile, shellPermitted, toDurableRecord, writeFileAtomic, writeJsonAtomic };
 
 //# sourceMappingURL=index.mjs.map