lody 0.101.1 → 0.102.0

package/dist/index.js

@@ -13,7 +13,7 @@ import crypto__default, { createHash as createHash$1, randomUUID as randomUUID$1
 import os__default, { homedir, userInfo, cpus } from "node:os";
 import * as path from "node:path";
 import path__default, { posix as posix$1, basename, win32, join as join$2, resolve, relative as relative$1, dirname as dirname$1, isAbsolute as isAbsolute$2, sep as sep$1, delimiter, normalize } from "node:path";
-import { _ as _coercedNumber, Z as ZodNumber, o as object, s as string$1, l as literal$1, b as boolean, a as _enum, n as number$4, d as discriminatedUnion, c as array$2, r as record$3, u as unknown, e as union$7, f as custom$1, g as ZodObject, h as ZodLiteral, j as json$1, p as preprocess, i as ZodError, k as safeParse, m as ZodOptional, q as ZodNullable, t as ZodPipe, v as ZodUnion, w as ZodArray, x as ZodNever, y as ZodDiscriminatedUnion, z as _instanceof, A as uuid, N as NEVER, B as _null, C as lazy, D as looseObject, E as intersection, F as optional$1, G as datetime, H as url, I as any, J as toJSONSchema, K as date, L as email, M as never$1, O as xor } from "./chunks/schemas-9JpFbIUJ.js";
+import { _ as _coercedNumber, Z as ZodNumber, o as object, s as string$1, l as literal$1, b as boolean, a as _enum, n as number$4, d as discriminatedUnion, c as array$2, r as record$3, u as unknown, e as union$7, f as custom$1, g as ZodObject, h as ZodLiteral, j as json$1, p as preprocess, i as ZodError, k as safeParse, m as ZodOptional, q as ZodNullable, t as ZodPipe, v as ZodUnion, w as ZodArray, x as ZodNever, y as ZodDiscriminatedUnion, z as _instanceof, A as uuid, N as NEVER, B as _null, C as looseObject, D as lazy, E as intersection, F as optional$1, G as datetime, H as url, I as any, J as toJSONSchema, K as date, L as email, M as xor, O as never$1 } from "./chunks/schemas-WuyisFi9.js";
 import require$$0$4, { EventEmitter as EventEmitter$1, once as once$1 } from "node:events";
 import require$$1$2, { execFile, spawn as spawn$1, execFileSync } from "node:child_process";
 import process$2 from "node:process";
@@ -37,7 +37,7 @@ import fs__default$2, { readFile, readdir, rm, mkdir as mkdir$1, mkdtemp, chmod,
 import zlib__default, { gzip, gunzip as gunzip$1, gunzipSync, brotliDecompressSync } from "node:zlib";
 import require$$1$8, { exec, execFile as execFile$1, spawn as spawn$2 } from "child_process";
 import { c as createPlanModeConfigOption, L as LODY_PLAN_MODE_CONFIG_ID } from "./chunks/plan-mode-D0D5cnMs.js";
-import { D as DEEPSEEK_HARNESS_PERMISSION_MODES, a as DEEPSEEK_HARNESS_AGENT_PRESETS, A as ACP_EXTENSION_DSH_CAPABILITY_SOURCE_VERSION, c as createDeepSeekHarnessProfileFiles, b as DEEPSEEK_HARNESS_PROFILE_NAME, d as DEEPSEEK_HARNESS_PROFILE_FILENAMES, e as ACP_EXTENSION_DSH_QUERY_PATH_ENV, f as ACP_EXTENSION_DSH_SESSION_ROOT_ENV, g as createDeepSeekHarnessNpxSpecifiers, h as DEEPSEEK_HARNESS_DEFAULT_SESSION_COMPRESSION, i as DEEPSEEK_HARNESS_VERSION, j as DEEPSEEK_HARNESS_BASE_URL_ENV, R as RequestError$1, C as ClientSideConnection, P as PROTOCOL_VERSION, n as ndJsonStream, k as client$2, m as methods$1 } from "./chunks/acp-w0Ug9k0u.js";
+import { D as DEEPSEEK_HARNESS_PERMISSION_MODES, a as DEEPSEEK_HARNESS_AGENT_PRESETS, A as ACP_EXTENSION_DSH_CAPABILITY_SOURCE_VERSION, c as createDeepSeekHarnessProfileFiles, b as DEEPSEEK_HARNESS_PROFILE_NAME, d as DEEPSEEK_HARNESS_PROFILE_FILENAMES, e as ACP_EXTENSION_DSH_QUERY_PATH_ENV, f as ACP_EXTENSION_DSH_SESSION_ROOT_ENV, g as createDeepSeekHarnessNpxSpecifiers, h as DEEPSEEK_HARNESS_DEFAULT_SESSION_COMPRESSION, i as DEEPSEEK_HARNESS_VERSION, j as DEEPSEEK_HARNESS_BASE_URL_ENV, R as RequestError$1, C as ClientSideConnection, P as PROTOCOL_VERSION, n as ndJsonStream, k as client$2, m as methods$1 } from "./chunks/acp-Bsd2Lmd6.js";
 import { i as isLodySubagentProgress, a as isLodySubagentSnapshot, b as isLodySubagentEvent, c as isLodySubagentOutput, L as LODY_EXTENSION_METHODS, M as MAX_USAGE_SCOPE_ID_LENGTH, n as normalizeLodyExtensionMethod, d as LODY_SUBAGENT_EVENT_METHOD } from "./chunks/subagent-events-BJ9JwZva.js";
 import { i as imports, _ as __wbg_set_wasm$1, r as rawWasm, L as LoroDoc, E as EphemeralStoreWasm, U as UndoManager, a as isValidContainerId, c as callPendingEvents$3, b as LoroTree, d as LoroText, e as LoroMovableList, f as LoroList, g as LoroMap, V as VersionVector, h as __vite__initWasm, j as decodeImportBlobMeta } from "./chunks/loro_wasm_bg-DIxpLA2J.js";
 import { performance as performance$1 } from "perf_hooks";
@@ -62,17 +62,18 @@ import require$$1$4, { Worker as Worker$1 } from "node:worker_threads";
 import require$$1$5, { fileURLToPath, pathToFileURL } from "node:url";
 import require$$1$6 from "node:console";
 import require$$1$7 from "node:dns";
-import { C as CodeCollabV2FileIndexRequestSchema, a as CodeCollabV2OpenTextRequestSchema, b as CodeCollabV2RefreshTextRequestSchema, c as CodeCollabV2SaveTextRequestSchema, d as CodeCollabV2OpenCurrentDiffRequestSchema, e as CodeCollabV2OpenAllChangesDiffRequestSchema, f as CodeCollabV2OpenTurnDiffRequestSchema, g as CodeCollabV2InitDirectoryRequestSchema, h as CodeCollabV2FileIndexSnapshotSchema, i as CodeCollabV2OpenTextOkSchema, j as CodeCollabV2RefreshTextResponseSchema, k as CodeCollabV2SaveTextResponseSchema, l as CodeCollabV2OpenCurrentDiffResponseSchema, m as CodeCollabV2OpenAllChangesDiffResponseSchema, n as CodeCollabV2OpenTurnDiffResponseSchema, o as CodeCollabV2InitDirectoryOkSchema, p as CodeCollabV2LspUnsupportedSchema, q as CodeCollabV2ErrorSchema, r as CodeCollabV2RpcContentEnvelopeSchema, s as deriveCodeCollabV2ContentKeyId, t as CodeCollabV2ErrorCodeSchema, u as CodeCollabV2RpcResponseSchema, v as deriveCodeCollabV2ContentKeyBytes, w as readCodeCollabFileIndexSignalFromFlock, x as writeCodeCollabFileIndexSignalToFlock, y as writeCodeCollabFileIndexToFlock, z as buildCodeCollabFileIndexState, A as CODE_COLLAB_V2_TEXT_LIMITS, B as CODE_COLLAB_V2_ALL_CHANGES_DIFF_LIMITS, D as computeAllChanges, E as codeCollabFileIndexStatesEqual, F as scanGitDirectoryEntries, G as closeDirectoryQuietly } from "./chunks/directory-handle-CjQk33eZ.js";
+import { C as CodeCollabV2FileIndexRequestSchema, a as CodeCollabV2OpenTextRequestSchema, b as CodeCollabV2RefreshTextRequestSchema, c as CodeCollabV2SaveTextRequestSchema, d as CodeCollabV2OpenCurrentDiffRequestSchema, e as CodeCollabV2OpenAllChangesDiffRequestSchema, f as CodeCollabV2OpenTurnDiffRequestSchema, g as CodeCollabV2InitDirectoryRequestSchema, h as CodeCollabV2FileIndexSnapshotSchema, i as CodeCollabV2OpenTextOkSchema, j as CodeCollabV2RefreshTextResponseSchema, k as CodeCollabV2SaveTextResponseSchema, l as CodeCollabV2OpenCurrentDiffResponseSchema, m as CodeCollabV2OpenAllChangesDiffResponseSchema, n as CodeCollabV2OpenTurnDiffResponseSchema, o as CodeCollabV2InitDirectoryOkSchema, p as CodeCollabV2LspUnsupportedSchema, q as CodeCollabV2ErrorSchema, r as CodeCollabV2RpcContentEnvelopeSchema, s as deriveCodeCollabV2ContentKeyId, t as CodeCollabV2ErrorCodeSchema, u as CodeCollabV2RpcResponseSchema, v as deriveCodeCollabV2ContentKeyBytes, w as readCodeCollabFileIndexSignalFromFlock, x as writeCodeCollabFileIndexSignalToFlock, y as writeCodeCollabFileIndexToFlock, z as buildCodeCollabFileIndexState, A as CODE_COLLAB_V2_TEXT_LIMITS, B as CODE_COLLAB_V2_ALL_CHANGES_DIFF_LIMITS, D as computeAllChanges, E as codeCollabFileIndexStatesEqual, F as scanGitDirectoryEntries, G as closeDirectoryQuietly } from "./chunks/directory-handle-CtdCjbNh.js";
 import { finished, pipeline } from "node:stream/promises";
 import { StringDecoder } from "node:string_decoder";
 import { p as packageJson } from "./chunks/package-BoOO46ct.js";
+import { L as LODY_TOOL_NAMES } from "./chunks/session-DyqwlJbY.js";
 import { AsyncLocalStorage as AsyncLocalStorage$1 } from "async_hooks";
 import { createRequire } from "module";
 import { c as computeLineCounts, a as countTextLines } from "./chunks/diff-line-counts-DDGc5P-T.js";
 import { r as runDiffWorkerTask } from "./chunks/diff-worker-task-MZsLArT5.js";
 import { C as CODE_COLLAB_IGNORED_DIRECTORY_NAMES, p as parseWorkspaceWatchChildMessage } from "./chunks/workspace-watch-protocol-POg9Lpeq.js";
 import { Resolver } from "node:dns/promises";
-import { C as CloudflaredError } from "./chunks/cloudflared-native-BPe7OSUZ.js";
+import { C as CloudflaredError } from "./chunks/cloudflared-native-DbUToPHH.js";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createRequire as createRequire$1 } from "node:module";
 import v8 from "node:v8";
@@ -4316,7 +4317,7 @@ function resolvePlatformKind(raw2) {
 }
 const name$3 = "lody";
 const name$2 = "@lody/cli-cloud";
-const version$d = "0.101.1";
+const version$d = "0.102.0";
 const type = "module";
 const scripts = { "dev": "node dev.mjs", "dev:staging": "LODY_ENV=staging NODE_ENV=production node dev.mjs", "build": "node build.mjs", "prepare:publish": "node prepare-publish.js", "test": "node --test pnpm-runner.test.mjs vite-config.test.mjs" };
 const devDependencies = { "dotenv": "^16.6.1", "vite": "^7.0.0", "vite-plugin-wasm": "catalog:" };
@@ -4611,9 +4612,6 @@ const mergeSubagentTaskPayload = (prev, incoming) => {
   }
   return merged;
 };
-const LODY_TOOL_NAMES = {
-  imageGeneration: "ImageGeneration"
-};
 const MANAGED_BUILTIN_RUNTIMES = [
   { runtimeName: "kimi-code", agentType: "kimi", displayName: "Kimi Code" },
   { runtimeName: "grok-build", agentType: "grok", displayName: "Grok" },
@@ -27051,7 +27049,23 @@ const SessionActiveInvocationContextResultSchema = discriminatedUnion("active",
     inputConfig: record$3(string$1(), unknown())
   }).strict()
 ]);
+const SessionToolResultSchema = object({
+  type: literal$1("session/tool-result"),
+  content: array$2(object({ type: literal$1("text"), text: string$1() }).strict()),
+  isError: boolean().optional()
+}).strict();
 const LocalMachineRpcRequestSchema = discriminatedUnion("method", [
+  BaseLocalMachineRpcRequestSchema.extend({
+    method: literal$1("session/call-tool"),
+    params: object({
+      sessionId: SessionIdSchema$1,
+      name: string$1().min(1).max(100),
+      arguments: record$3(string$1(), json$1()).refine(
+        (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 256 * 1024,
+        "Session tool arguments exceed 256 KiB"
+      )
+    }).strict()
+  }).strict(),
   BaseLocalMachineRpcRequestSchema.extend({
     method: literal$1("session/get-active-invocation-context"),
     params: object({
@@ -27219,6 +27233,7 @@ const LocalMachineRpcRequestSchema = discriminatedUnion("method", [
   }).strict()
 ]);
 const LocalMachineRpcResultSchema = union$7([
+  SessionToolResultSchema,
   SessionActiveInvocationContextResultSchema,
   CodeCollabV2FileIndexSnapshotSchema,
   CodeCollabV2OpenTextOkSchema,
@@ -127633,10 +127648,15 @@ const ProfileRecordSchema = object({
   configId: string$1().min(1),
   profile: CodexAuthProfileSchema,
   state: _enum(["pending", "ready", "removed"]),
+  authStore: _enum(["codex-default", "keyring"]).optional(),
   activeGeneration: uuid().optional(),
   generations: array$2(uuid()),
   credentialsRemoved: boolean().optional()
 }).strict();
+function resolveAuthStore(record2) {
+  if (record2.authStore) return record2.authStore;
+  return record2.profile.mode === "chatgpt" && record2.state !== "pending" ? "keyring" : "codex-default";
+}
 const identity$1 = (owner) => createHash("sha256").update(JSON.stringify([owner.workspaceId, owner.machineId, owner.configId])).digest("hex");
 class CodexProfileStore {
   constructor(root = path__default.join(getLodyDataDir(), "codex-profiles"), vault = new SystemCodexCredentialVault(), logout = logoutNativeProfile) {
@@ -127724,7 +127744,14 @@ class CodexProfileStore {
       if (!record2) {
         if (!allowPending)
           throw new Error("This Codex account has not been authenticated on this machine");
-        record2 = { version: 1, ...owner, profile, state: "pending", generations: [] };
+        record2 = {
+          version: 1,
+          ...owner,
+          profile,
+          state: "pending",
+          authStore: "codex-default",
+          generations: []
+        };
         await this.write(directory, record2);
       }
       this.assertBinding(record2, owner, profile);
@@ -127736,7 +127763,7 @@ class CodexProfileStore {
       });
       if ((await lstat(home)).isSymbolicLink() || await realpath(home) !== home)
         throw new Error("Invalid Codex account home");
-      return { ...owner, profile, home };
+      return { ...owner, profile, home, authStore: resolveAuthStore(record2) };
     });
   }
   credentialId(owner, profileId, generation) {
@@ -127797,7 +127824,7 @@ class CodexProfileStore {
       const record2 = await this.read(directory);
       if (!record2) throw new Error("Codex account is unavailable");
       this.assertBinding(record2, resolved, resolved.profile);
-      await this.write(directory, { ...record2, state: "ready" });
+      await this.write(directory, { ...record2, state: "ready", authStore: resolved.authStore });
     });
   }
   async remove(resolved) {
@@ -127807,7 +127834,7 @@ class CodexProfileStore {
       if (!record2) return true;
       if (identity$1(record2) !== identity$1(resolved)) throw new Error("Codex account owner mismatch");
       if (record2.credentialsRemoved) return true;
-      await this.write(directory, { ...record2, state: "removed" });
+      await this.write(directory, { ...record2, state: "removed", authStore: resolved.authStore });
       if (record2.profile.mode === "chatgpt") {
         if (!await reconcileCodexProfileProcesses(resolved)) return false;
         const lease = await registerCodexProfileProcess(resolved, {
@@ -127826,6 +127853,7 @@ class CodexProfileStore {
       await this.write(directory, {
         ...record2,
         state: "removed",
+        authStore: resolved.authStore,
         generations: [],
         activeGeneration: void 0,
         credentialsRemoved: true
@@ -127864,7 +127892,11 @@ class CodexProfileStore {
       const directory = await this.directory(entry.name);
       const record2 = await this.read(directory);
       if (record2?.workspaceId === workspaceId)
-        profiles.push({ ...record2, home: path__default.join(directory, "home") });
+        profiles.push({
+          ...record2,
+          home: path__default.join(directory, "home"),
+          authStore: resolveAuthStore(record2)
+        });
     }
     return profiles;
   }
@@ -127884,7 +127916,10 @@ async function logoutNativeProfile(profile, lease) {
   await new Promise((resolve2, reject2) => {
     const child = execFile(
       launch.command,
-      ["-c", 'cli_auth_credentials_store="keyring"', "logout"],
+      [
+        ...profile.authStore === "keyring" ? ["-c", 'cli_auth_credentials_store="keyring"'] : [],
+        "logout"
+      ],
       { env: env2, timeout: 2e4, windowsHide: true },
       (error2) => {
         if (error2) reject2(new Error("Codex account cleanup could not complete"));
@@ -142036,7 +142071,7 @@ async function startCodexCredentialBroker(options) {
 }
 function codexProfileConfig(profile, baseUrl) {
   const base = {
-    cli_auth_credentials_store: "keyring",
+    ...profile.authStore === "keyring" ? { cli_auth_credentials_store: "keyring" } : {},
     check_for_update_on_startup: false,
     shell_environment_policy: {
       inherit: "all",
@@ -142849,7 +142884,7 @@ function getBuiltinDisplayName(agentType) {
 function formatAuthenticationExitError(agentType, displayName, exitCode) {
   const base = `${displayName} authentication exited with code ${exitCode ?? "unknown"}`;
   if (agentType !== "codex") return base;
-  return `${base}. Make sure device-code login is enabled in your ChatGPT security settings or workspace permissions, then try again.`;
+  return `${base}. Check the Codex login log on the execution machine for the cause, then try again.`;
 }
 async function buildAuthenticationProcessEnv(options) {
   const loginShellEnv = await options.resolveLoginShellEnv();
@@ -142973,8 +143008,6 @@ class AcpAuthenticationManager {
     this.resolveLoginShellEnv = options.resolveLoginShellEnv ?? getLoginShellEnv;
     this.resolveAuthenticationProcessLaunch = options.resolveAuthenticationProcessLaunch ?? resolveBuiltinAuthenticationProcessLaunch;
   }
-  // Each builtin provider has one shared credential store, so concurrent login
-  // attempts are intentionally keyed by agent type.
   runningByAgentType = /* @__PURE__ */ new Map();
   authenticationTimeoutMs;
   terminationGraceMs;
@@ -143094,13 +143127,7 @@ class AcpAuthenticationManager {
       options.onProgress?.({ status: "starting" });
       const child = this.spawnProcess(
         launch.command,
-        options.codexProfile ? [
-          "-c",
-          'cli_auth_credentials_store="keyring"',
-          "-c",
-          'forced_login_method="chatgpt"',
-          ...launch.args
-        ] : launch.args,
+        options.codexProfile ? ["-c", 'forced_login_method="chatgpt"', ...launch.args] : launch.args,
         {
           cwd: os__default$1.homedir(),
           env: env2,
@@ -158335,12 +158362,13 @@ class LodyOperationCoordinator {
         }
         claimedMaterialization = true;
         try {
-          await this.options.workspaceDocument.syncRemoteDocOrThrow(
-            getSessionRoomId(target.sessionId),
-            {
-              reason: `orchestration.materialize:${operation.operationId}:${index}`
-            }
-          );
+          const docId = getSessionRoomId(target.sessionId);
+          const reason = `orchestration.materialize:${operation.operationId}:${index}`;
+          if (this.options.confirmTargetReadable) {
+            await this.options.confirmTargetReadable(docId, reason);
+          } else {
+            await this.options.workspaceDocument.syncRemoteDocOrThrow(docId, { reason });
+          }
         } catch (error2) {
           if (signal.aborted) return item;
           if (!isAtDeadline()) {
@@ -159099,6 +159127,40 @@ class LodyOperationCoordinator {
     });
   }
 }
+const environments = new AsyncLocalStorage();
+const getSessionCommandEnvironment = () => environments.getStore();
+const runWithSessionCommandEnvironment = (environment2, run2) => environments.run(environment2, run2);
+function createLocalSessionCommandEnvironment(args2) {
+  const { manager, workspaceId, machineId, userId } = args2;
+  return {
+    auth: {
+      token: "",
+      userId,
+      userName: userId,
+      userEmail: "",
+      machineId,
+      machineName: args2.machineName
+    },
+    workspace: { id: workspaceId, name: "Lody", slug: "local", role: "owner" },
+    manager,
+    host: args2.host,
+    async checkMachineAccess(target) {
+      if (target.workspaceId !== workspaceId || target.requesterUserId !== userId)
+        return { allowed: false, reason: "requester_not_member" };
+      if (target.machineId !== machineId)
+        return { allowed: false, reason: "machine_not_registered" };
+      const row = await manager.repo.getDocMeta(getMachineRoomId(machineId));
+      if (!row?.meta || isLoroRepoDocDeleted(row) || row.meta.ownerUserId !== userId)
+        return { allowed: false, reason: "not_visible" };
+      if (target.localProjectId) {
+        const projects = await readMachineLocalProjects(manager.repo, workspaceId, machineId);
+        const project = Object.values(projects).find((entry) => entry.id === target.localProjectId);
+        if (!project) return { allowed: false, reason: "project_not_shared" };
+      }
+      return { allowed: true };
+    }
+  };
+}
 function hasSessionDispatchEvidence(meta, history, userTurnId) {
   const user = history.find((entry) => entry.id === userTurnId && entry.role === "user");
   return !!user && (meta.latestUserMsgId === userTurnId || meta.processingUserMsgId === userTurnId || meta.lastHandledUserMsgId === userTurnId || user.status === "handled" || user.status === "failed" || user.status === "canceled" || history.some(
@@ -167332,6 +167394,25 @@ async function canUseMachineForCliToken(input2) {
     throw error2;
   }
 }
+const MISSING_PUBLIC_FUNCTION_ERROR = /Could not find (public )?function/;
+async function canDelegateMachineUseForCliToken(input2) {
+  const client2 = createAuthConvexClient();
+  try {
+    const raw2 = await client2.query(api.machines.canDelegateMachineUseFromCliToken, {
+      cliToken: input2.token,
+      workspaceId: input2.workspaceId,
+      machineId: input2.machineId,
+      requesterUserId: input2.requesterUserId,
+      ...input2.localProjectId !== void 0 ? { localProjectId: input2.localProjectId } : {}
+    });
+    return MachineAccessCheckResultSchema.parse(raw2);
+  } catch (error2) {
+    if (error2 instanceof Error && MISSING_PUBLIC_FUNCTION_ERROR.test(error2.message)) {
+      return null;
+    }
+    throw error2;
+  }
+}
 async function canRequestMachineForCliToken(input2) {
   const client2 = createAuthConvexClient();
   const raw2 = await client2.query(api.machines.canRequestMachineFromCliToken, {
@@ -168755,6 +168836,8 @@ function selectWorkspaceSummary(workspaces, selector) {
   );
 }
 function getAuthContextOrThrow$1(loggerName) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) return environment2.auth;
   const authClient = new AuthClient(getLogger(loggerName));
   const authInfo = authClient.getAuthInfo();
   if (!authInfo) {
@@ -168770,11 +168853,22 @@ function getAuthContextOrThrow$1(loggerName) {
   };
 }
 async function resolveWorkspaceOrThrow$1(auth, selector) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    if (auth !== environment2.auth) throw new Error("Session command identity mismatch");
+    return selectWorkspaceSummary([environment2.workspace], selector);
+  }
   const workspaces = await listWorkspacesForToken(auth.token);
   const effectiveSelector = normalizeCliValue(selector) ?? normalizeCliValue(process.env.LODY_WORKSPACE_ID);
   return selectWorkspaceSummary(workspaces, effectiveSelector);
 }
 async function withWorkspaceManager$1(auth, workspace, loggerName, fn) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    if (auth !== environment2.auth || workspace.id !== environment2.workspace.id)
+      throw new Error("Session command workspace mismatch");
+    return fn(environment2.manager);
+  }
   if (!LODY_AUTH_URL) {
     throw new Error("Cloud workspace commands require LODY_AUTH_URL");
   }
@@ -171026,8 +171120,6 @@ class ResourceDiscovery {
       const modeId = role.runConfig.modeId ?? role.runConfig.configOptionValues?._permission;
       if (state2.state === "available" && capability && modeId && !(permission ? permission.options.some((option2) => option2.value === modeId) : capability.modes.some((mode2) => mode2.id === modeId)))
         state2 = { state: "unavailable", reason: "mode_unavailable" };
-      if (state2.state === "available" && source2.roleMachineScope && role.machineId !== source2.roleMachineScope)
-        state2 = { state: "unavailable", reason: "outside_work_context" };
       return {
         id: role.id,
         name: role.name,
@@ -171075,14 +171167,6 @@ class ResourceDiscovery {
 async function createResourceDiscovery(args2) {
   const { manager, auth, workspaceId } = args2;
   if (!args2.offline) await syncWorkspaceMetaForRead(manager, "resource.discovery");
-  let roleMachineScope;
-  if (args2.requesterSessionId) {
-    const record2 = await manager.repo.getDocMeta(getSessionRoomId(args2.requesterSessionId));
-    if (!record2?.meta || isLoroRepoDocDeleted(record2))
-      throw new Error("Requester Session not found.");
-    const session2 = record2.meta;
-    if (session2.project?.kind !== "github") roleMachineScope = session2.machineId;
-  }
   const synced = /* @__PURE__ */ new Set();
   async function sync2(id2) {
     if (!args2.offline && !synced.has(id2)) {
@@ -171094,9 +171178,8 @@ async function createResourceDiscovery(args2) {
     workspaceId,
     userId: args2.delegatedRequester?.userId ?? auth.userId,
     selectedMcpServerIds: args2.selectedMcpServerIds,
-    roleMachineScope,
     machines: async () => (await listAliveDocMetas(manager, isMachineDocRoomId)).map((row) => row.meta),
-    onlineMachineIds: async () => args2.offline ? null : manager.getOnlineMachineIds(),
+    onlineMachineIds: async () => getSessionCommandEnvironment() ? /* @__PURE__ */ new Set([auth.machineId]) : args2.offline ? null : manager.getOnlineMachineIds(),
     canAccess: async (machineId, localProjectId) => (await readSessionMachineAccess({
       auth,
       workspaceId,
@@ -173136,6 +173219,12 @@ async function withMachineRpcClient(args2, fn) {
   }
 }
 async function ensureTargetMachineOnline(args2) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    if (args2.workspaceId !== environment2.workspace.id || args2.machineId !== environment2.auth.machineId)
+      throw new Error("Target machine is unavailable in this workspace");
+    return;
+  }
   if (args2.machineId === args2.auth.machineId) {
     await ensureLocalRuntimeAvailable(args2.machineId, args2.workspaceId);
     return;
@@ -173176,16 +173265,48 @@ async function readSessionMachineAccess(args2) {
     ...args2.localProjectId ? { localProjectId: args2.localProjectId } : {}
   });
 }
+const defaultMachineAccessReaders = {
+  delegated: canDelegateMachineUseForCliToken,
+  asTokenUser: canRequestMachineForCliToken,
+  asServedRequester: canUseMachineForCliToken
+};
+async function readDelegatedMachineAccess(input2, readers = defaultMachineAccessReaders) {
+  const target = {
+    token: input2.token,
+    workspaceId: input2.workspaceId,
+    machineId: input2.machineId,
+    ...input2.localProjectId ? { localProjectId: input2.localProjectId } : {}
+  };
+  const verdict = await readers.delegated({ ...target, requesterUserId: input2.requesterUserId });
+  if (verdict) {
+    return verdict;
+  }
+  const owner = await readers.asTokenUser({ ...target, requesterUserId: input2.tokenUserId });
+  if (!owner.allowed || input2.requesterUserId === input2.tokenUserId) {
+    return owner;
+  }
+  return await readers.asServedRequester({ ...target, requesterUserId: input2.requesterUserId });
+}
 async function readResolvedSessionMachineAccess(args2) {
-  const readAccess = args2.requester.isDelegated ? canUseMachineForCliToken : canRequestMachineForCliToken;
-  return await readMachineAccessWithBoundedRetry({
-    verify: async () => await readAccess({
-      token: args2.auth.token,
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    if (args2.auth !== environment2.auth) throw new Error("Session command identity mismatch");
+    return environment2.checkMachineAccess({
       workspaceId: args2.workspaceId,
       machineId: args2.machineId,
       requesterUserId: args2.requester.userId,
-      ...args2.localProjectId ? { localProjectId: args2.localProjectId } : {}
-    }),
+      localProjectId: args2.localProjectId
+    });
+  }
+  const target = {
+    token: args2.auth.token,
+    workspaceId: args2.workspaceId,
+    machineId: args2.machineId,
+    requesterUserId: args2.requester.userId,
+    ...args2.localProjectId ? { localProjectId: args2.localProjectId } : {}
+  };
+  return await readMachineAccessWithBoundedRetry({
+    verify: async () => args2.requester.isDelegated ? await readDelegatedMachineAccess({ ...target, tokenUserId: args2.auth.userId }) : await canRequestMachineForCliToken(target),
     onRetry: ({ attempt, maxAttempts, delayMs, error: error2 }) => {
       getLogger("session").warn(
         `Machine access verification unavailable; retrying (attempt=${attempt}/${maxAttempts} delayMs=${delayMs}): ${error2}`
@@ -173200,6 +173321,11 @@ async function assertMachineAccess(args2) {
   }
 }
 async function dispatchTurnFastPath(args2) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    await environment2.host.dispatchSession(args2.sessionId);
+    return;
+  }
   if (!args2.inputConfig) {
     return;
   }
@@ -173430,6 +173556,8 @@ async function resolveAgentConfigForCreate(args2) {
   );
 }
 async function assertGitHubRepoAccess(args2) {
+  if (getSessionCommandEnvironment())
+    throw new Error("Hosted repository contexts are unavailable; use a registered local project.");
   const repos = await listWorkspaceGitHubRepositoriesForCliToken({
     token: args2.auth.token,
     workspaceId: args2.workspaceId,
@@ -174175,6 +174303,22 @@ async function readSessionLiveStatus(args2) {
   }
 }
 async function readSessionLiveStatusesMany(args2) {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) {
+    const output2 = /* @__PURE__ */ new Map();
+    for (const session2 of args2.sessions) {
+      output2.set(
+        session2.id,
+        session2.machineId === environment2.auth.machineId ? await environment2.host.readLiveStatus(session2.id) : {
+          sessionId: session2.id,
+          machineOnline: false,
+          fresh: false,
+          reason: "Machine unavailable in local workspace"
+        }
+      );
+    }
+    return output2;
+  }
   const groups = /* @__PURE__ */ new Map();
   for (const session2 of args2.sessions) {
     const group = groups.get(session2.machineId) ?? [];
@@ -175019,6 +175163,7 @@ const session = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePrope
   normalizeLocalProjectPathSelector,
   prepareSessionInput,
   readAgentAcpCapability,
+  readDelegatedMachineAccess,
   readLocalProjectGitStateOnMachine,
   readSessionLiveStatusesMany,
   readSessionMachineAccess,
@@ -185761,7 +185906,14 @@ class MessageHandler {
       dispatchWatcher: this.sessionDispatchWatcher,
       userResolver: this.sessionUserResolver,
       logger: this.logger,
-      materializeTarget: async (operation, item, index) => await this.materializeOperationTarget(operation, item, index)
+      ...this.cloudPort.kind === "local" ? {
+        confirmTargetReadable: async () => {
+          await this.workspaceDocument.repo.flush();
+        }
+      } : {},
+      materializeTarget: async (operation, item, index) => await this.withSessionCommandEnvironment(
+        () => this.materializeOperationTarget(operation, item, index)
+      )
     });
     this.setupSessionEventHandlers();
     this.setupSessionLifecycleWatchers();
@@ -187348,7 +187500,7 @@ class MessageHandler {
     if (!prompt2) {
       throw new Error(`Operation ${operation.operationId} item ${index} has no prompt.`);
     }
-    const auth = {
+    const auth = getSessionCommandEnvironment()?.auth ?? {
       token: this.token,
       userId: this.userId,
       userName: this.userId,
@@ -189681,6 +189833,61 @@ class MessageHandler {
     const ownerUserId = args2.ownerMeta?.userId?.trim();
     return requester === ownerUserId || requester === this.userId;
   }
+  withSessionCommandEnvironment(run2) {
+    if (this.cloudPort.kind !== "local") return run2();
+    return runWithSessionCommandEnvironment(
+      createLocalSessionCommandEnvironment({
+        manager: this.workspaceDocument,
+        workspaceId: this.workspaceId,
+        machineId: this.machineId,
+        machineName: this.machineName,
+        userId: this.userId,
+        host: {
+          readInvocation: (sessionId) => {
+            const invocation = this.executionService.getActiveInvocationContext(sessionId);
+            return invocation ? {
+              type: "session/active-invocation-context",
+              sessionId,
+              active: true,
+              ...invocation
+            } : { type: "session/active-invocation-context", sessionId, active: false };
+          },
+          readLiveStatus: async (sessionId) => {
+            const live = resolveSessionLiveStatus({
+              presence: this.sessionActivePresence.getStatus(sessionId),
+              execution: this.executionService.getExecutionSnapshot(sessionId),
+              hasPendingDispatch: this.sessionDispatchWatcher.hasPendingDispatch(sessionId)
+            });
+            return {
+              sessionId,
+              machineOnline: true,
+              fresh: true,
+              state: live.state,
+              observedAt: getServerNow()
+            };
+          },
+          cancelSession: async (sessionId, turnId) => {
+            const targetTurnId = turnId ?? this.executionService.getExecutionSnapshot(sessionId).activeTurnId;
+            if (!targetTurnId) return { success: false, error: "Session has no active turn" };
+            return this.executionService.cancelSession(
+              {
+                type: "session/cancel",
+                machineId: this.machineId,
+                workspaceId: this.workspaceId,
+                sessionId,
+                turnId: targetTurnId
+              },
+              { pendingInput: "promote", prePromptSession: "discard" }
+            );
+          },
+          dispatchSession: async (sessionId) => {
+            void this.sessionDispatchWatcher.enqueueSessionCheck(sessionId);
+          }
+        }
+      }),
+      run2
+    );
+  }
   async handleLocalMachineRpc(request2) {
     try {
       const result = await this.dispatchLocalMachineRpc(request2);
@@ -189707,6 +189914,27 @@ class MessageHandler {
       }
     };
     switch (request2.method) {
+      case "session/call-tool": {
+        if (this.cloudPort.kind !== "local")
+          throw new Error("Daemon Session tools require a local workspace");
+        const { sessionId, name: name2, arguments: args2 } = request2.params;
+        if (request2.workspaceId !== this.workspaceId || request2.machineId !== this.machineId || request2.ownerSessionId !== sessionId)
+          throw new Error("Session tool scope mismatch");
+        const { executeDaemonSessionTool } = await import("./chunks/daemon-session-tools-BeXk1A1E.js");
+        return this.withSessionCommandEnvironment(
+          () => executeDaemonSessionTool(
+            {
+              machineId: this.machineId,
+              workspaceId: this.workspaceId,
+              sessionId,
+              localControlSocketPath: void 0,
+              workdir: process.cwd()
+            },
+            name2,
+            args2
+          )
+        );
+      }
       case "code-collab/get-file-index":
         await assertOwner(request2.params.sessionId);
         return await this.codeCollabV2Service.getFileIndex(request2.params);
@@ -194750,6 +194978,11 @@ class GitCredentialBroker {
     this.startHealthCheck();
     return this.env;
   }
+  /** Rotate only sessions that opted into managed credentials during preparation. */
+  refreshSessionContext(context2) {
+    if (!this.sessionContextTokens.has(context2.sessionId)) return void 0;
+    return this.activateSessionContext(context2);
+  }
   activateSessionContext(context2) {
     const existingToken = this.sessionContextTokens.get(context2.sessionId);
     if (existingToken) {
@@ -198262,6 +198495,7 @@ class SessionManager extends EventEmitter {
     });
   }
   async prepareGitHubRepoSessionConfig(config2) {
+    if (config2.project?.kind === "local") return;
     const githubRepo = config2.githubRepo ?? tryDeriveGitHubRepoFromUrl(config2.githubRepoUrl);
     if (githubRepo) {
       config2.githubRepo = githubRepo;
@@ -198340,7 +198574,7 @@ class SessionManager extends EventEmitter {
     };
   }
   async refreshGhTokenForSession(session2, _githubRepo, requesterUserId) {
-    const contextToken = this.gitCredentialBroker?.activateSessionContext({
+    const contextToken = this.gitCredentialBroker?.refreshSessionContext({
       sessionId: session2.sessionId,
       requesterUserId,
       machineId: this.machineId
@@ -233902,7 +234136,7 @@ async function runRender(file2, options) {
     data = createReviewBundleSnapshot(bundle);
   }
   const { injectReviewSnapshot } = await import("./chunks/index-BeRTvYK1.js");
-  const { resolveReviewViewerTemplate } = await import("./chunks/review-viewer-CEUQAboP.js");
+  const { resolveReviewViewerTemplate } = await import("./chunks/review-viewer-B6wZ9fN1.js");
   const template = await resolveReviewViewerTemplate();
   const html = injectReviewSnapshot(template, data);
   const outputPath = options.output ? path__default.resolve(options.output) : defaultHtmlOutputPath(inputPath);
@@ -252338,7 +252572,7 @@ async function configureWorkspaceMcpServer(manager, workspaceId, userId, rawInpu
     };
   });
 }
-function registerDiscoveryTools(server, withDiscovery) {
+function registerDiscoveryTools(registerTool, withDiscovery) {
   const descriptions = {
     machine: "List readable machines, including offline machines, with online/offline/unknown presence and protocol capabilities.",
     project: "List readable local projects across machines and enabled GitHub repositories. kind and machineId restrict the catalog. Local project identity includes machineId.",
@@ -252364,7 +252598,7 @@ function registerDiscoveryTools(server, withDiscovery) {
     }
   };
   for (const resource of Object.keys(ResourceListSchemas)) {
-    server.registerTool(
+    registerTool(
       `lody_${resource}_list`,
       {
         description: `${descriptions[resource]} Returns a bounded page (default 20, maximum 100); follow nextCursor with the same filters to enumerate all entries.`,
@@ -252375,7 +252609,7 @@ function registerDiscoveryTools(server, withDiscovery) {
     );
   }
   for (const resource of ["agent_config", "agent_role"]) {
-    server.registerTool(
+    registerTool(
       `lody_${resource}_get`,
       {
         description: `Read one ${resource} by stable id from its list tool.`,
@@ -252386,6 +252620,20 @@ function registerDiscoveryTools(server, withDiscovery) {
     );
   }
 }
+function createSessionToolRegistrar(server, route2, handlers) {
+  return (name2, config2, callback) => {
+    handlers?.set(name2, async (args2) => callback(await config2.inputSchema.parseAsync(args2)));
+    const inputSchema = config2.inputSchema;
+    return server.registerTool(
+      name2,
+      { ...config2, inputSchema },
+      async (args2) => (
+        // The SDK has already parsed MCP input; only direct daemon calls need parsing here.
+        route2(name2, args2, () => callback(args2))
+      )
+    );
+  };
+}
 const PREVIEW_TOOL_NAME = "lody_report_preview_candidate";
 const IMAGE_UPLOAD_TOOL_NAME = "lody_upload_images";
 const FILE_UPLOAD_TOOL_NAME = "lody_upload_files";
@@ -252850,6 +253098,8 @@ const postSessionControl = async (request2, localControlSocketPath, timeoutMs =
   return responses.map((response2) => LocalSessionControlResponseSchema.parse(response2));
 };
 const readActiveInvocationContext = async (ctx) => {
+  const environment2 = getSessionCommandEnvironment();
+  if (environment2) return environment2.host.readInvocation(ctx.sessionId);
   const response2 = await runPromise(
     makeLocalControlClientAuto({ socketPath: ctx.localControlSocketPath }).machineRpc(
       {
@@ -253035,13 +253285,6 @@ const resolveMcpSessionCreate = (input2, invoking, requester, role) => {
     );
   }
   const project = requester.project;
-  if (project?.kind !== "github" && role.machineId !== requester.machineId) {
-    throw new LodyOperationStoreError(
-      "AGENT_ROLE_MACHINE_MISMATCH",
-      project?.kind === "local" ? `Agent Role ${role.name} must run on the Local Project's Machine.` : `Agent Role ${role.name} must run on the current Machine in a chat Session.`,
-      false
-    );
-  }
   let useCurrentSessionAsParent = input2.useCurrentSessionAsParent;
   let workContext = input2.workContext;
   if (project?.kind === "github" && useCurrentSessionAsParent !== true && workContext === void 0) {
@@ -253050,7 +253293,7 @@ const resolveMcpSessionCreate = (input2, invoking, requester, role) => {
       repo: project.repoFullName,
       ...project.branch ? { branch: project.branch } : {}
     };
-  } else if (project?.kind === "local" && useCurrentSessionAsParent === void 0 && workContext === void 0) {
+  } else if (project?.kind === "local" && role.machineId === requester.machineId && useCurrentSessionAsParent === void 0 && workContext === void 0) {
     useCurrentSessionAsParent = true;
   }
   const resolvedInput = {
@@ -253851,7 +254094,7 @@ const buildSessionCreateOptions = async (input2) => {
       )
     );
     const repoQuery = normalizeCliValue(input2.repoQuery)?.toLowerCase();
-    const repos = repoQuery ? (await listWorkspaceGitHubRepositoriesForCliToken({
+    const repos = repoQuery && !getSessionCommandEnvironment() ? (await listWorkspaceGitHubRepositoriesForCliToken({
       token: auth.token,
       workspaceId,
       requesterUserId,
@@ -254731,6 +254974,9 @@ const ReviewSubmitToolInputSchema = object({
   summary: string$1().trim().max(2e3).optional()
 }).strict();
 function buildLodyMcpServer() {
+  return buildSessionToolServer();
+}
+function buildSessionToolServer(handlers) {
   initCliAnalytics();
   const server = new McpServer(
     {
@@ -254755,10 +255001,41 @@ function buildLodyMcpServer() {
       });
     }
   });
-  registerDiscoveryTools(server, async (read) => {
-    if (getCliPlatformKind() === "local") {
-      throw new Error("Workspace catalog discovery is unavailable on the local platform.");
-    }
+  const registerSessionTool = createSessionToolRegistrar(
+    server,
+    async (name2, args2, execute) => {
+      if (getCliPlatformKind() !== "local" || getSessionCommandEnvironment()) return execute();
+      try {
+        const ctx = getSessionContext();
+        const outcome = await runPromise(
+          makeLocalControlClientAuto({ socketPath: ctx.localControlSocketPath }).machineRpc(
+            {
+              method: "session/call-tool",
+              machineId: ctx.machineId,
+              workspaceId: ctx.workspaceId,
+              ownerSessionId: ctx.sessionId,
+              params: {
+                sessionId: ctx.sessionId,
+                name: name2,
+                arguments: record$3(string$1(), json$1()).parse(args2)
+              }
+            },
+            { timeoutMs: SESSION_CONTROL_TIMEOUT_MS }
+          ).pipe(either)
+        );
+        if (outcome._tag === "Left") throw classifyLocalDaemonIpcError(outcome.left);
+        const response2 = outcome.right;
+        if (!response2.ok) throw new Error(response2.error);
+        if (!("type" in response2.result) || response2.result.type !== "session/tool-result")
+          throw new Error("Unexpected Session tool response");
+        return { content: response2.result.content, isError: response2.result.isError };
+      } catch (error2) {
+        return mcpErrorResult(error2);
+      }
+    },
+    handlers
+  );
+  registerDiscoveryTools(registerSessionTool, async (read) => {
     const ctx = getSessionContext();
     const source2 = await resolveInvokingTurnSource();
     const auth = getAuthContextOrThrow$1("mcp");
@@ -254772,7 +255049,6 @@ function buildLodyMcpServer() {
           manager,
           auth,
           workspaceId: workspace.id,
-          requesterSessionId: ctx.sessionId,
           delegatedRequester: { userId: source2.userId },
           selectedMcpServerIds: source2.inputConfig.mcpServerIds
         })
@@ -255014,7 +255290,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CREATE_OPTIONS_TOOL_NAME,
     {
       title: "List session create options",
@@ -255029,11 +255305,11 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CREATE_TOOL_NAME,
     {
       title: "Create a Lody session",
-      description: "Start durable asynchronous work that creates a Lody session. Supply operationId; the result arrives automatically as a continuation, so do not poll operation_get. To use an Agent Role, pass agentRoleId; the current workspace catalog row supplies the exact Machine, Agent config, model, reasoning, and permission mode. If manual machine or run-config fields are also present, the Role takes precedence and those fields are ignored. To recover an already accepted create without resending its prompt, send only operationId with resume=true. useCurrentSessionAsParent=true and workContext are mutually exclusive schema branches. Machine/config ids and runConfig values for non-Role creates come from lody_session_create_options. The wait field is temporary legacy compatibility only.",
+      description: "Start durable asynchronous work that creates a Lody session. Supply operationId; the result arrives automatically as a continuation, so do not poll operation_get. To use an Agent Role, pass agentRoleId; the current workspace catalog row supplies the exact Machine, Agent config, model, reasoning, and permission mode. If manual machine or run-config fields are also present, the Role takes precedence and those fields are ignored. A Role may run on any Machine the owner of this Machine can use; to work in a project there, pass workContext for a local project on that Machine (find it with lody_session_create_options machineId + localProjectQuery). Without workContext a Role on another Machine starts as a plain chat there. To recover an already accepted create without resending its prompt, send only operationId with resume=true. useCurrentSessionAsParent=true and workContext are mutually exclusive schema branches. Machine/config ids and runConfig values for non-Role creates come from lody_session_create_options. The wait field is temporary legacy compatibility only.",
       inputSchema: SessionCreateToolInputSchema
     },
     async (input2) => {
@@ -255117,7 +255393,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CHAT_TOOL_NAME,
     {
       title: "Send a prompt to a Lody session",
@@ -255180,7 +255456,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CREATE_MANY_TOOL_NAME,
     {
       title: "Create multiple Lody sessions",
@@ -255196,7 +255472,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CHAT_MANY_TOOL_NAME,
     {
       title: "Chat multiple Lody sessions",
@@ -255211,7 +255487,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_CANCEL_TOOL_NAME,
     {
       title: "Cancel a Lody session turn",
@@ -255223,6 +255499,14 @@ ${lines2.join("\n")}` : ""}${suffix}`
         const ctx = getSessionContext();
         const auth = getAuthContextOrThrow$1("mcp");
         await resolveWorkspaceOrThrow$1(auth, getMcpWorkspaceId(ctx));
+        const environment2 = getSessionCommandEnvironment();
+        if (environment2) {
+          const sessionId = resolveMcpSessionId(args2.sessionId, ctx);
+          const session2 = await readCurrentSessionMeta(environment2.manager, sessionId);
+          if (!session2 || session2.machineId !== auth.machineId)
+            throw new Error("Session not found on this machine");
+          return jsonTextResult(await environment2.host.cancelSession(sessionId));
+        }
         return jsonTextResult(
           await runLodyCliJson([
             "session",
@@ -255238,7 +255522,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     "lody_operation_list",
     {
       description: "List durable Operation summaries owned by the current Session and invoking user. Optional state filter and keyset pagination. Completion is automatic; do not poll.",
@@ -255266,7 +255550,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     OPERATION_GET_TOOL_NAME,
     {
       title: "Get a Lody Operation snapshot",
@@ -255284,7 +255568,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     OPERATION_CANCEL_TOOL_NAME,
     {
       title: "Cancel a Lody Operation",
@@ -255302,12 +255586,13 @@ ${lines2.join("\n")}` : ""}${suffix}`
           (store) => store.cancel(requesterSessionId, args2.operationId)
         );
         if (cancellation.didCancel && before.state === "active") {
+          const environment2 = getSessionCommandEnvironment();
           const startedTargets = before.items.filter(
             (item) => item.status === "active" && item.inputDurable
           );
           await Promise.allSettled(
             startedTargets.map(
-              (item) => item.status === "active" ? runLodyCliJson(buildOperationTargetCancelArgs(getMcpWorkspaceId(ctx), item)) : Promise.resolve()
+              (item) => item.status === "active" ? environment2 ? environment2.host.cancelSession(item.target.sessionId, item.target.userTurnId) : runLodyCliJson(buildOperationTargetCancelArgs(getMcpWorkspaceId(ctx), item)) : Promise.resolve()
             )
           );
         }
@@ -255319,7 +255604,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_RENAME_TOOL_NAME,
     {
       title: "Rename a Lody session",
@@ -255340,7 +255625,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_RENAME_MANY_TOOL_NAME,
     {
       title: "Rename multiple Lody sessions",
@@ -255386,7 +255671,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_LIST_TOOL_NAME,
     {
       title: "List Lody sessions",
@@ -255401,7 +255686,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_STATUS_MANY_TOOL_NAME,
     {
       title: "Get Lody session statuses",
@@ -255416,7 +255701,7 @@ ${lines2.join("\n")}` : ""}${suffix}`
       }
     }
   );
-  server.registerTool(
+  registerSessionTool(
     SESSION_HISTORY_TOOL_NAME,
     {
       title: "Read Lody session history",
@@ -257141,7 +257426,13 @@ void (async () => {
   }
 })();
 export {
+  SessionToolResultSchema as S,
+  getSessionCommandEnvironment as a,
+  getSessionRoomId as b,
+  buildSessionToolServer as c,
   program as default,
-  getLodyDataDir as g
+  getLodyDataDir as g,
+  isLoroRepoDocDeleted as i,
+  runWithMcpSessionContext as r
 };
 //# sourceMappingURL=index.js.map