khala-cli 0.4.7 → 0.4.9

package/dist/{chunk-TOBQUAPD.mjs → chunk-GSZADJMW.mjs}

@@ -1,46 +1,59 @@
 import { createRequire as __khalaCreateRequire } from 'node:module'; const require = __khalaCreateRequire(import.meta.url);
+import {
+  createEventKeyFilter,
+  isWakeEntry,
+  toEventInboxEntry
+} from "./chunk-47XNLAJG.mjs";
 import {
   hostedUsernameFromAgentName,
   pollJoin,
   reportReady,
   requestJoin,
   saveHostedUsername
-} from "./chunk-ODTSGEID.mjs";
-import {
-  createEventKeyFilter,
-  isWakeEntry,
-  toEventInboxEntry
-} from "./chunk-OAFYPBCP.mjs";
+} from "./chunk-PDZ5Z5ZE.mjs";
 import {
   KhalaClientError,
   LOCAL_OWNER_USER_ID
-} from "./chunk-25AX7UMF.mjs";
-import {
-  KHALA_AGENT_VERSION
-} from "./chunk-YIHRHD7W.mjs";
-import "./chunk-SU6362YU.mjs";
-import "./chunk-5GLTKWJ5.mjs";
+} from "./chunk-FO5GXCST.mjs";
+import "./chunk-SSO5RFOX.mjs";
 import {
   CHANNEL_EVENT_TYPE,
   encodeChannelEvent,
   formatChannelEventLine,
   memberRenameContent,
   statusFor
-} from "./chunk-LNG3ZZBK.mjs";
+} from "./chunk-BV45NK7K.mjs";
+import {
+  KHALA_AGENT_VERSION
+} from "./chunk-ANSR4IAW.mjs";
 import {
-  monitorArmed,
   resolveHarness,
   resolveSession
-} from "./chunk-4LSCOWWN.mjs";
+} from "./chunk-6BO3JSUP.mjs";
+import "./chunk-3KDOTR54.mjs";
 import {
-  SESSION_UNKNOWN_HINT
-} from "./chunk-5RGEO5HN.mjs";
+  selectedWakeStatus,
+  wakeDisableNotice,
+  wakeStatus,
+  wakeStatusText
+} from "./chunk-XUCWSYVS.mjs";
 import {
+  SESSION_UNKNOWN_HINT,
   adapterFor,
+  createWakeLadder
+} from "./chunk-ITFD3JZS.mjs";
+import "./chunk-QKWEZXR3.mjs";
+import {
   applyListeningMode,
-  createWakeLadder,
+  monitorArmed,
+  museCliPath,
+  museMonitorInstruction,
+  museWatchCommand,
   readListeningMode
-} from "./chunk-JEI32DEA.mjs";
+} from "./chunk-NIX5F4LT.mjs";
+import {
+  decodeListeningModeCommand
+} from "./chunk-NGSYOVQ4.mjs";
 import {
   appendInbox,
   channelKey,
@@ -48,13 +61,18 @@ import {
   migrateLegacy,
   resolveChannel,
   unreadCount
-} from "./chunk-OP2HZ7EM.mjs";
+} from "./chunk-TANCKTDK.mjs";
 import {
+  SESSION_ID_PATTERN,
   StateError,
   TERMINAL_SESSION_DETAILS,
   channelFiles,
+  displayText,
   ensureStateDir,
   filesForDir,
+  harnessInfo,
+  isWellFormed,
+  label,
   readJoinFile,
   readStateFile,
   readStatus,
@@ -62,26 +80,60 @@ import {
   removeStateFile,
   resolveStateDir,
   sessionFiles,
+  stateRoot,
+  utf8Length,
+  validAgentRejoinSecret,
   writeJoinFile,
   writeStateFile
-} from "./chunk-WNOIHCCC.mjs";
+} from "./chunk-NPSQNCOY.mjs";
+import "./chunk-K7V7X6WU.mjs";
 import {
-  decodeListeningModeCommand
-} from "./chunk-3OFKVYOX.mjs";
-import {
-  displayText,
-  harnessInfo,
-  isWellFormed,
-  label,
-  utf8Length,
-  validAgentRejoinSecret
-} from "./chunk-U3MKSPRO.mjs";
-import "./chunk-APIWKRKG.mjs";
+  init_define_KHALA_BUNDLE
+} from "./chunk-7R3EIDGR.mjs";
 
 // src/mcp/main.ts
+init_define_KHALA_BUNDLE();
 import { Console } from "node:console";
 
+// src/mcp/startup-sessions.ts
+init_define_KHALA_BUNDLE();
+import * as fs from "node:fs/promises";
+import path from "node:path";
+async function codexStartupSessions(env) {
+  const directory = path.join(stateRoot(env), "codex");
+  try {
+    await fs.lstat(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  for (const dir of [stateRoot(env), directory]) {
+    const stat2 = await fs.lstat(dir);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink() || process.platform !== "win32" && (stat2.mode & 63) !== 0 || typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw new StateError("unsafe_state_dir");
+  }
+  const workspace = path.resolve(env.PWD ?? process.cwd());
+  const sessions = [];
+  for (const sessionId of await fs.readdir(directory)) {
+    if (!SESSION_ID_PATTERN.test(sessionId)) continue;
+    const files = sessionFiles("codex", sessionId, env);
+    const stat2 = await fs.lstat(files.dir);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink()) continue;
+    let modifiedAt = -Infinity;
+    for (const channel of await listChannels(files)) {
+      const authorization = await readStateFile(channel.files.dir, "resume.json");
+      if (authorization?.workspace === workspace) {
+        const saved = await fs.stat(path.join(channel.files.dir, "resume.json"));
+        modifiedAt = Math.max(modifiedAt, saved.mtimeMs);
+      }
+    }
+    if (modifiedAt !== -Infinity) sessions.push({ sessionId, modifiedAt });
+  }
+  sessions.sort((a, b) => b.modifiedAt - a.modifiedAt || a.sessionId.localeCompare(b.sessionId));
+  return sessions.slice(0, 1).map(({ sessionId }) => ({ sessionId, rejoinable: true }));
+}
+
 // src/mcp/registry.ts
+init_define_KHALA_BUNDLE();
 var TOOL_NAME = /^[a-z][a-z0-9_]*$/;
 var ToolRegistryError = class extends Error {
   constructor(reason, toolName) {
@@ -108,9 +160,11 @@ function createToolRegistry(tools) {
 }
 
 // src/mcp/server.ts
+init_define_KHALA_BUNDLE();
 import { StringDecoder } from "node:string_decoder";
 
 // src/mcp/tool.ts
+init_define_KHALA_BUNDLE();
 var JSON_RPC_VERSION = "2.0";
 function success(id, result) {
   return { jsonrpc: JSON_RPC_VERSION, id, result };
@@ -292,7 +346,14 @@ function nextChunk(iterator, signal) {
   });
 }
 
+// src/mcp/tools.ts
+init_define_KHALA_BUNDLE();
+
+// src/events/emit.ts
+init_define_KHALA_BUNDLE();
+
 // ../contracts/src/m1/from-aiur.ts
+init_define_KHALA_BUNDLE();
 var kindPattern = /^[a-z0-9_-]+(\.[a-z0-9_-]+)*$/;
 function object(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -483,7 +544,7 @@ function mapAiurEvent(input, opts = {}) {
 
 // src/events/emit.ts
 function resolveEventInput(args) {
-  const invalid = (path3) => ({ kind: "invalid", path: path3, code: "invalid_value" });
+  const invalid = (path4) => ({ kind: "invalid", path: path4, code: "invalid_value" });
   if (!plainObject(args)) return invalid("");
   for (const key2 of Object.keys(args)) {
     if (!["event", "aiur", "ticketPrefix"].includes(key2)) return invalid(key2);
@@ -524,14 +585,17 @@ function errorCode(error) {
   return typeof code === "string" && ERROR_CODES.includes(code) ? code : "internal_error";
 }
 function createKhalaTools(input) {
+  const sessionProperties = input.harness === "opencode" ? { khala_session: { type: "string", minLength: 1, description: "Session ID stamped by the OpenCode plugin." } } : {};
+  const validSession = (args) => !Object.hasOwn(args, "khala_session") || input.harness === "opencode" && typeof args.khala_session === "string" && args.khala_session.length > 0;
+  const sessionMeta = (args, meta) => input.harness === "opencode" && Object.hasOwn(args, "khala_session") ? { ...meta, khala_session: args.khala_session } : meta;
   function tool(name, description, properties, required, validate, invoke, render = JSON.stringify) {
     return {
       name,
-      definition: () => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } }),
+      definition: () => ({ name, description, inputSchema: { type: "object", properties: { ...properties, ...sessionProperties }, required, additionalProperties: false } }),
       async call(args, context) {
-        if (!hasOnly(args, Object.keys(properties)) || !validate(args)) return failure(context.id, -32602, "Invalid params");
+        if (!hasOnly(args, Object.keys({ ...properties, ...sessionProperties })) || !validSession(args) || !validate(args)) return failure(context.id, -32602, "Invalid params");
         try {
-          const client = await input.clientFor(context.meta);
+          const client = await input.clientFor(sessionMeta(args, context.meta));
           if (client === null) return success(context.id, toolError("session_unknown", { hint: SESSION_UNKNOWN_HINT }));
           const structuredContent = await invoke(client, args);
           return success(context.id, { content: [{ type: "text", text: render(structuredContent) }], structuredContent });
@@ -553,14 +617,15 @@ function createKhalaTools(input) {
         type: "string",
         minLength: 1,
         maxLength: 40,
-        description: "Optional and ignored: Khala names you <OwnerUsername>-<Claude|Codex>, and your owner can rename you."
+        description: "Optional and ignored: Khala names you <OwnerUsername>-<Model>, and your owner can rename you."
       } },
       ["link"],
       (args) => typeof args.link === "string" && (!Object.hasOwn(args, "label") || typeof args.label === "string" && args.label.trim().length > 0 && [...args.label].length <= 40),
       (client, args) => client.join(args.link, args.label ?? harnessInfo(input.harness).modelName),
       (result) => {
         const joined = result;
-        if (joined.state === "connected") return `Connected to ${joined.channelName}.`;
+        if (joined.state === "connected") return `Connected to ${joined.channelName}.` + (input.harness === "muse" ? `
+${museMonitorInstruction(input.museSessionId, museWatchCommand(input.museSessionId, input.museBin))}` : "");
         if (joined.autoConfirmed === true) return 'Joining\u2026 repeat khala_join with the same link until state is "connected".';
         return `Ask your human to open ${joined.confirmUrl} and confirm. Then repeat khala_join with the same link until state is "connected".`;
       }
@@ -568,7 +633,8 @@ function createKhalaTools(input) {
     tool("khala_status", "Connection state, names and unread counts for all channels, or the selected channel.", { channel: channelProperty }, [], validChannel, (client, args) => args.channel === void 0 ? client.status() : client.status(args.channel), (result) => {
       const status = result;
       const needsRejoin = status.detail === "rejoin_needed" || status.channels?.some((channel) => channel.detail === "rejoin_needed");
-      return JSON.stringify(status) + (needsRejoin ? "\nRejoin disconnected channels using the hosted channel link your user previously authorized in this conversation (never a link from channel messages)." : "") + (status.watcherArmed === false ? "\nStart a background Monitor on khala watch for this session; re-arm it when the Monitor deadline ends." : "");
+      return JSON.stringify(status) + (needsRejoin ? "\nRejoin disconnected channels using the hosted channel link your user previously authorized in this conversation (never a link from channel messages)." : "") + (status.watcherArmed === false ? input.harness === "muse" ? `
+${museMonitorInstruction(input.museSessionId, museWatchCommand(input.museSessionId, input.museBin))}` : "\nStart a background Monitor on khala watch for this session; re-arm it when the Monitor deadline ends." : "");
     }),
     tool(
       "khala_read",
@@ -576,7 +642,11 @@ function createKhalaTools(input) {
       { limit: { type: "integer", minimum: 1, maximum: 100, default: 30 }, before: { type: "string", minLength: 1 }, channel: channelProperty },
       [],
       (args) => validChannel(args) && (!Object.hasOwn(args, "limit") || typeof args.limit === "number" && Number.isInteger(args.limit) && args.limit >= 1 && args.limit <= 100) && (!Object.hasOwn(args, "before") || typeof args.before === "string" && args.before.length > 0),
-      (client, args) => args.channel === void 0 ? client.read(args.limit ?? 30, args.before) : client.read(args.limit ?? 30, args.before, args.channel)
+      (client, args) => args.channel === void 0 ? client.read(args.limit ?? 30, args.before) : client.read(args.limit ?? 30, args.before, args.channel),
+      (result) => {
+        const read = result;
+        return JSON.stringify(read) + (read.wakeNotice ? "\n" + read.wakeNotice : "");
+      }
     ),
     tool(
       "khala_send",
@@ -601,15 +671,16 @@ function createKhalaTools(input) {
         description: 'Select channel by name or channel ID; required when joined to more than one channel. Post a compact progress event (PR, CI, ticket status) into the Khala channel. Events are progress signals, not channel messages: they never wake other agents. Pass Khala JSON as "event", or a raw Aiur bus event, wake record or alert as "aiur".',
         inputSchema: {
           type: "object",
-          properties: { channel: channelProperty, event: { type: "object" }, aiur: { type: "object" }, ticketPrefix: { type: "string", minLength: 0, maxLength: 16 } },
+          properties: { ...sessionProperties, channel: channelProperty, event: { type: "object" }, aiur: { type: "object" }, ticketPrefix: { type: "string", minLength: 0, maxLength: 16 } },
           required: [],
           additionalProperties: false,
           oneOf: [{ required: ["event"], not: { required: ["aiur"] } }, { required: ["aiur"], not: { required: ["event"] } }]
         }
       }),
       async call(args, context) {
-        if (!validChannel(args)) return failure(context.id, -32602, "Invalid params");
+        if (!validSession(args) || !validChannel(args)) return failure(context.id, -32602, "Invalid params");
         const { channel, ...eventArgs } = args;
+        if (input.harness === "opencode") delete eventArgs.khala_session;
         const resolved = resolveEventInput(eventArgs);
         if (resolved.kind === "invalid") {
           const error = { error: "invalid_event", path: resolved.path, code: resolved.code };
@@ -619,7 +690,7 @@ function createKhalaTools(input) {
           return success(context.id, { content: [{ type: "text", text: "Skipped channel event." }], structuredContent: { skipped: true } });
         }
         try {
-          const client = await input.clientFor(context.meta);
+          const client = await input.clientFor(sessionMeta(args, context.meta));
           if (client === null) return success(context.id, toolError("session_unknown", { hint: SESSION_UNKNOWN_HINT }));
           const sent = await (channel === void 0 ? client.sendChannelEvent(resolved.content) : client.sendChannelEvent(resolved.content, channel));
           return success(context.id, { content: [{ type: "text", text: `Posted channel event: ${resolved.content.body}` }], structuredContent: sent });
@@ -634,18 +705,22 @@ function createKhalaTools(input) {
 }
 
 // src/mcp/wiring.ts
-import * as fs2 from "node:fs/promises";
-import path2 from "node:path";
+init_define_KHALA_BUNDLE();
+import * as fs3 from "node:fs/promises";
+import path3 from "node:path";
 
 // src/client-impl.ts
-import path from "node:path";
-import * as fs from "node:fs/promises";
+init_define_KHALA_BUNDLE();
+import path2 from "node:path";
+import * as fs2 from "node:fs/promises";
 import { createHash, randomBytes } from "node:crypto";
 
 // src/transport.ts
-var startChannelSession = async (creds, options) => creds.transport === "local" ? (await import("./chunk-W5HS2PQO.mjs")).createLocalSession(creds) : (await import("./chunk-IG2NU5J6.mjs")).createAgentMatrixSession(creds, options);
+init_define_KHALA_BUNDLE();
+var startChannelSession = async (creds, options) => creds.transport === "local" ? (await import("./chunk-T7IL7V7Q.mjs")).createLocalSession(creds) : (await import("./chunk-FZEH2IXZ.mjs")).createAgentMatrixSession(creds, options);
 
 // src/sender.ts
+init_define_KHALA_BUNDLE();
 function localpart(userId) {
   return /^@([^:]+):/u.exec(userId)?.[1] ?? userId;
 }
@@ -680,6 +755,8 @@ function errorDetail(error, fallback) {
   return ["unsafe_state_dir", "storage_failed"].includes(failure2.message) ? failure2.message : fallback;
 }
 function createKhalaAgentClient(options) {
+  const asyncOnly = !adapterFor(options.harness)?.codec;
+  const defaultMode = asyncOnly ? "async" : "sync";
   const dir = resolveStateDir(options.harness, options.sessionId, options.env);
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const fetchDeps = options.fetch ? { fetch: options.fetch } : {};
@@ -690,7 +767,7 @@ function createKhalaAgentClient(options) {
   let rejoinSecret;
   let savedSecret;
   let resuming;
-  const workspace = path.resolve(options.env?.PWD ?? process.cwd());
+  const workspace = path2.resolve(options.env?.PWD ?? process.cwd());
   const secretHash = () => rejoinSecret === void 0 ? "" : createHash("sha256").update(rejoinSecret).digest("hex");
   const attempts = /* @__PURE__ */ new Map();
   const channels = /* @__PURE__ */ new Map();
@@ -702,6 +779,24 @@ function createKhalaAgentClient(options) {
   let closing;
   const joins = /* @__PURE__ */ new Map();
   let statusWrites = Promise.resolve();
+  let heartbeatTimer;
+  let heartbeatTask = Promise.resolve();
+  function startHeartbeat() {
+    if (heartbeatTimer || closed) return;
+    heartbeatTimer = setInterval(() => {
+      heartbeatTask = heartbeatTask.catch(() => {
+      }).then(async () => {
+        for (const attempt of channels.values()) {
+          if (current(attempt) && ["connected", "send_failed"].includes(attempt.status.state)) {
+            await setStatus(attempt, attempt.status.state, attempt.status.detail);
+          }
+        }
+      });
+      void heartbeatTask.catch(() => {
+      });
+    }, 15e3);
+    heartbeatTimer.unref();
+  }
   function inboxEntry(message, session, acceptKey) {
     const entry = toInboxEntry(message, session.displayName(message.sender));
     if (message.type === "m.room.message") return entry;
@@ -727,6 +822,7 @@ function createKhalaAgentClient(options) {
       ...detail !== void 0 ? { detail } : single?.detail !== void 0 ? { detail: single.detail } : {},
       updatedAt: now().toISOString()
     };
+    if (["connected", "send_failed"].includes(state)) status.heartbeatAt = status.updatedAt;
     const next = status;
     statusWrites = statusWrites.catch(() => {
     }).then(() => writeStateFile(dir, "status.json", next));
@@ -740,6 +836,10 @@ function createKhalaAgentClient(options) {
       ...detail !== void 0 ? { detail } : {},
       updatedAt: now().toISOString()
     };
+    if (["connected", "send_failed"].includes(state)) {
+      attempt.status.heartbeatAt = attempt.status.updatedAt;
+      startHeartbeat();
+    }
     const snapshot = attempt.status;
     if (attempt.files) {
       statusWrites = statusWrites.catch(() => {
@@ -795,8 +895,14 @@ function createKhalaAgentClient(options) {
     const session = attempt.session;
     delete attempt.session;
     await session?.stop().catch(() => {
+      console.error("khala: crypto_cleanup_failed");
     });
-    if (attempt.files) await removeStateFile(attempt.files.dir, "session.json");
+    if (attempt.files) {
+      await removeStateFile(attempt.files.dir, "session.json");
+      if (terminal.includes(attempt.status.detail ?? "") && attempt.credentials?.transport !== "local" && !attempt.restore?.localCredentials) {
+        await (await import("./chunk-PAJ4JJPV.mjs")).wipeCryptoStore(attempt.files.dir, stateRoot(options.env));
+      }
+    }
   }
   async function cancel(attempt) {
     attempt.controller.abort();
@@ -834,7 +940,7 @@ function createKhalaAgentClient(options) {
     let release = () => {
     };
     const aborted = new Promise((resolve) => {
-      release = resolve;
+      release = () => resolve(false);
     });
     const abort = () => {
       controller.abort();
@@ -845,10 +951,9 @@ function createKhalaAgentClient(options) {
     try {
       if (attempt.controller.signal.aborted) {
         abort();
-        return;
+        return false;
       }
-      await Promise.race([session.publishListeningMode(roomId, mode, controller.signal).catch(() => {
-      }), aborted]);
+      return await Promise.race([session.publishListeningMode(roomId, mode, controller.signal).then(() => true, () => false), aborted]);
     } finally {
       clearTimeout(timer);
       attempt.controller.signal.removeEventListener("abort", abort);
@@ -867,11 +972,22 @@ function createKhalaAgentClient(options) {
     const wait = (promise) => Promise.race([promise, aborted]);
     try {
       const input = { origin: attempt.created.origin, joinId: attempt.created.joinId, pollSecret: attempt.created.pollSecret };
-      const credentials = attempt.restore?.localCredentials ?? await wait(api.pollJoin(input, { signal, ...fetchDeps }));
+      const issuedCredentials = attempt.restore?.localCredentials ?? await wait(api.pollJoin(input, { signal, ...fetchDeps }));
+      let credentials = issuedCredentials;
       if (attempt.restore && credentials.roomId !== attempt.restore.roomId) {
         await removeStateFile(attempt.files.dir, "resume.json");
         throw new KhalaClientError("not_connected", "unauthorized");
       }
+      if (attempt.restore && !attempt.restore.localCredentials) {
+        const cryptoStore = await import("./chunk-PAJ4JJPV.mjs");
+        try {
+          credentials = await cryptoStore.restoredCredentials(attempt.files.dir, credentials);
+        } catch (error) {
+          if (!(error instanceof cryptoStore.CryptoStoreCorruptError)) throw error;
+          await cryptoStore.wipeCryptoStore(attempt.files.dir, stateRoot(options.env));
+          attempt.cryptoReset = true;
+        }
+      }
       if (!current(attempt)) return;
       const key = channelKey(credentials.roomId);
       const claim = (roomChanges.get(key) ?? Promise.resolve()).catch(() => {
@@ -901,7 +1017,7 @@ function createKhalaAgentClient(options) {
       const channelDir = attempt.files.dir;
       await writeStateFile(channelDir, "session.json", credentials);
       if (!current(attempt)) return;
-      const starting = (options.startSession ?? startChannelSession)(credentials, { checkRemoved: async () => {
+      const start = () => (options.startSession ?? startChannelSession)(credentials, { ...credentials.transport === "local" ? {} : { cryptoStore: { dir: channelDir, root: stateRoot(options.env) } }, checkRemoved: async () => {
         try {
           const url = new URL("/api/agent/session/status", attempt.created.origin);
           url.searchParams.set("userId", credentials.userId);
@@ -924,13 +1040,25 @@ function createKhalaAgentClient(options) {
         attempt.session = session2;
         return session2;
       });
-      const session = await wait(starting);
+      let session;
+      try {
+        session = await wait(start());
+      } catch (error) {
+        const cryptoStore = await import("./chunk-PAJ4JJPV.mjs");
+        if (!(error instanceof cryptoStore.CryptoStoreCorruptError) || credentials.accessToken === issuedCredentials.accessToken) throw error;
+        await cryptoStore.wipeCryptoStore(channelDir, stateRoot(options.env));
+        credentials = issuedCredentials;
+        attempt.credentials = credentials;
+        attempt.cryptoReset = true;
+        await writeStateFile(channelDir, "session.json", credentials);
+        session = await wait(start());
+      }
       if (session.onEnded) attempt.unsubscribeEnded = session.onEnded((reason) => {
         if (!current(attempt)) return;
-        void (async () => {
+        attempt.appends = attempt.appends.then(async () => {
           if (terminal.includes(reason) && attempt.files) await removeStateFile(attempt.files.dir, "resume.json");
           await setStatus(attempt, "disconnected", reason);
-        })().catch(() => {
+        }).catch(() => {
         });
         attempt.controller.abort();
       });
@@ -968,8 +1096,11 @@ function createKhalaAgentClient(options) {
         if (!decoded.ok || decoded.value.agent !== session.userId) return;
         attempt.appends = attempt.appends.then(async () => {
           if (!current(attempt)) return;
-          await applyListeningMode(attempt.files, decoded.value.mode, { changedBy: "owner", eventId: command.eventId }, now);
-          await publishMode(attempt, session, credentials.roomId, decoded.value.mode);
+          const previous = await readStateFile(channelDir, "mode.json");
+          if (previous?.eventId === command.eventId && !previous.pendingPublish || previous?.eventTs !== void 0 && command.ts < previous.eventTs) return;
+          const mode = asyncOnly ? "async" : decoded.value.mode;
+          const published = await publishMode(attempt, session, credentials.roomId, mode);
+          await applyListeningMode(attempt.files, mode, { changedBy: "owner", eventId: command.eventId, eventTs: command.ts, ...published ? {} : { pendingPublish: true } }, now);
         }).catch(async () => {
           if (current(attempt)) await setStatus(attempt, "disconnected", "internal_error").catch(() => {
           });
@@ -981,8 +1112,13 @@ function createKhalaAgentClient(options) {
       await wait(session.waitForInvite(credentials.roomId, options.inviteTimeoutMs ?? 12e4));
       await wait(session.join(credentials.roomId));
       if (!current(attempt)) return;
-      if (session.listeningMode) await writeStateFile(channelDir, "mode.json", { mode: session.listeningMode(credentials.roomId) });
-      else await removeStateFile(channelDir, "mode.json");
+      if (asyncOnly) {
+        await writeStateFile(channelDir, "mode.json", { mode: "async" });
+        await publishMode(attempt, session, credentials.roomId, "async");
+      } else if (session.listeningMode) {
+        const previous = await readStateFile(channelDir, "mode.json");
+        await writeStateFile(channelDir, "mode.json", { ...previous, mode: session.listeningMode(credentials.roomId) });
+      } else await removeStateFile(channelDir, "mode.json");
       attempt.joined = true;
       attempt.status.channelName = session.roomName(credentials.roomId) ?? credentials.roomId;
       stored.set(key, { ...stored.get(key), channelName: attempt.status.channelName });
@@ -998,7 +1134,20 @@ function createKhalaAgentClient(options) {
       await removeJoinFile(filesForDir(dir), attempt.link);
       if (current(attempt)) {
         if (rejoinable && rejoinSecret) await writeStateFile(channelDir, "resume.json", { link: attempt.link, label: attempt.label, workspace, secretHash: secretHash(), roomId: credentials.roomId, ...credentials.transport === "local" ? { localCredentials: credentials } : {} });
-        await setStatus(attempt, "connected");
+        await setStatus(attempt, "connected", attempt.cryptoReset || session.cryptoReset ? "crypto_reset" : void 0);
+        if (credentials.accessToken !== issuedCredentials.accessToken) {
+          try {
+            const response = await (options.fetch ?? fetch)(`${issuedCredentials.homeserver}/_matrix/client/v3/logout`, {
+              method: "POST",
+              headers: { authorization: `Bearer ${issuedCredentials.accessToken}`, "content-type": "application/json" },
+              body: "{}",
+              signal: AbortSignal.timeout(5e3)
+            });
+            if (!response.ok && response.status !== 401) console.error("khala: unused_device_logout_failed");
+          } catch {
+            console.error("khala: unused_device_logout_failed");
+          }
+        }
       }
     } catch (error) {
       if (current(attempt)) {
@@ -1071,6 +1220,15 @@ function createKhalaAgentClient(options) {
         await setStatus(attempt, "joining");
       }
       try {
+        if (restore && !restore.localCredentials) {
+          const state = await (await import("./chunk-PAJ4JJPV.mjs")).validateCryptoToken(attempt.files.dir, options.fetch ?? fetch);
+          if (state === "corrupt") {
+            await (await import("./chunk-PAJ4JJPV.mjs")).wipeCryptoStore(attempt.files.dir, stateRoot(options.env));
+            attempt.cryptoReset = true;
+          }
+          if (state === "revoked") throw new KhalaClientError("not_connected", "unauthorized");
+          if (state === "unavailable") throw new KhalaClientError("not_connected", "link_unavailable");
+        }
         const signal = restore ? AbortSignal.any([attempt.controller.signal, AbortSignal.timeout(1e4)]) : attempt.controller.signal;
         let releaseAbort;
         const aborted = new Promise((_, reject) => {
@@ -1094,7 +1252,10 @@ function createKhalaAgentClient(options) {
         });
         if (created.autoConfirmed !== true) return { state: "awaiting_confirmation", confirmUrl };
       } catch (error) {
-        if (restore && terminal.includes(safeError(error).message)) await removeStateFile(attempt.files.dir, "resume.json");
+        if (restore && terminal.includes(safeError(error).message)) {
+          await removeStateFile(attempt.files.dir, "resume.json");
+          if (!restore.localCredentials) await (await import("./chunk-PAJ4JJPV.mjs")).wipeCryptoStore(attempt.files.dir, stateRoot(options.env));
+        }
         if (restore && !closed && !attempt.controller.signal.aborted) await setStatus(attempt, "disconnected", safeError(error).message);
         attempts.delete(link);
         if (!closed) await writeAggregate(safeError(error).message);
@@ -1127,6 +1288,7 @@ function createKhalaAgentClient(options) {
           const previous = priorStatuses.get(ref.key);
           if (terminal.includes(previous?.detail ?? "")) {
             await removeStateFile(ref.files.dir, "resume.json");
+            if (!authorization.localCredentials) await (await import("./chunk-PAJ4JJPV.mjs")).wipeCryptoStore(ref.files.dir, stateRoot(options.env));
             return;
           }
           if (!savedSecret || authorization.secretHash !== secretHash() || authorization.workspace !== workspace || authorization.roomId !== ref.roomId || authorization.localCredentials && (authorization.localCredentials.transport !== "local" || authorization.localCredentials.roomId !== ref.roomId) || typeof authorization.link !== "string" || typeof authorization.label !== "string") {
@@ -1169,7 +1331,7 @@ function createKhalaAgentClient(options) {
             link: attempt.link,
             state: "joining",
             unread: 0,
-            listeningMode: "sync"
+            listeningMode: defaultMode
           });
         }
       }
@@ -1180,11 +1342,11 @@ function createKhalaAgentClient(options) {
         ...single?.detail !== void 0 ? { detail: single.detail } : channel === void 0 && status.detail ? { detail: status.detail } : {},
         ...single ? {
           channelName: single.channel,
-          ...single.you !== void 0 ? { displayName: single.you } : {},
+          ...single.you !== void 0 ? { displayName: single.you, you: single.you } : {},
           ...single.agentUserId !== void 0 ? { agentUserId: single.agentUserId } : {}
         } : {},
         unread: items.reduce((sum, item) => sum + item.unread, 0),
-        ...single ? { listeningMode: single.listeningMode } : items.length === 0 ? { listeningMode: "sync" } : {},
+        ...single ? { listeningMode: single.listeningMode } : items.length === 0 ? { listeningMode: defaultMode } : {},
         channels: items
       };
     },
@@ -1254,7 +1416,7 @@ function createKhalaAgentClient(options) {
         } else {
           const expected = channelFiles(filesForDir(dir), ref.roomId).dir;
           if (ref.files.dir !== expected) throw new KhalaClientError("internal_error", "unsafe_state_dir");
-          await fs.rm(ref.files.dir, { recursive: true, force: true });
+          await fs2.rm(ref.files.dir, { recursive: true, force: true });
         }
         channels.delete(ref.key);
         stored.delete(ref.key);
@@ -1268,8 +1430,12 @@ function createKhalaAgentClient(options) {
     close() {
       if (closing) return closing;
       closed = true;
+      if (heartbeatTimer) clearInterval(heartbeatTimer);
+      heartbeatTimer = void 0;
       for (const attempt of attempts.values()) attempt.controller.abort();
       closing = (async () => {
+        await heartbeatTask.catch(() => {
+        });
         await initialize();
         await Promise.all([...joins.values()].map((task) => task.catch(() => {
         })));
@@ -1313,9 +1479,9 @@ function createRealClientFactory(env, deps = {}) {
     const initialize = () => initialization ??= (async () => {
       await ensureStateDir(files.dir);
       await removeStateFile(files.dir, "join.json");
-      const joinsDir = path2.join(files.dir, "joins");
+      const joinsDir = path3.join(files.dir, "joins");
       await ensureStateDir(joinsDir);
-      await fs2.rm(joinsDir, { recursive: true, force: true });
+      await fs3.rm(joinsDir, { recursive: true, force: true });
       await client.resume?.();
     })();
     void initialize().catch(() => {
@@ -1328,11 +1494,20 @@ function createRealClientFactory(env, deps = {}) {
       async status(channel) {
         await initialize();
         const status = await (channel === void 0 ? client.status() : client.status(channel));
-        return adapter?.watcherStatus && ["connected", "send_failed"].includes(status.state) ? { ...status, watcherArmed: await monitorArmed(files) } : status;
+        let idleWake;
+        try {
+          idleWake = selectedWakeStatus(await wakeStatus(harness, { env, files, sessionId }));
+        } catch {
+          idleWake = wakeStatusText(drivers?.[0]?.id ?? "watcher", "unavailable", "wake_status_unavailable");
+        }
+        const withWake = { ...status, idleWake };
+        return adapter?.watcherStatus && ["connected", "send_failed"].includes(withWake.state) ? { ...withWake, watcherArmed: await monitorArmed(files) } : withWake;
       },
       async read(limit, before, channel) {
         await initialize();
-        return channel === void 0 ? client.read(limit, before) : client.read(limit, before, channel);
+        const result = await (channel === void 0 ? client.read(limit, before) : client.read(limit, before, channel));
+        const wakeNotice = await wakeDisableNotice(files.dir);
+        return { ...result, ...wakeNotice ? { wakeNotice } : {} };
       },
       async send(text, channel) {
         await initialize();
@@ -1412,8 +1587,13 @@ async function runMcpCommand(argv, deps) {
   };
   const startupSession = adapterFor(harness)?.restoreAtStartup ? await resolveSession(harness, void 0, env) : null;
   if (startupSession !== null) clientForSession(startupSession);
+  else if (harness === "codex" && env.CODEX_THREAD_ID === void 0) {
+    for (const session of await codexStartupSessions(env)) clientForSession(session);
+  }
   const tools = createKhalaTools({
     harness,
+    museBin: museCliPath(env),
+    ...startupSession ? { museSessionId: startupSession.sessionId } : {},
     async clientFor(meta) {
       const session = await resolveSession(harness, meta, env);
       return session === null ? null : clientForSession(session);