npm - pikiloom - Versions diffs - 0.4.40 → 0.4.42 - Mend

pikiloom 0.4.40 → 0.4.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (68) hide show

package/dashboard/dist/assets/AgentTab-B9z4W2mh.js +1 -0
package/dashboard/dist/assets/{ConnectionModal-g_6IHAWE.js → ConnectionModal-2bL7sFKk.js} +1 -1
package/dashboard/dist/assets/{DirBrowser-DVe6q12N.js → DirBrowser-CA4k8E_A.js} +1 -1
package/dashboard/dist/assets/{ExtensionsTab-GqxD61Pp.js → ExtensionsTab-CRjTmFRl.js} +1 -1
package/dashboard/dist/assets/{IMAccessTab-DIqTzZJ9.js → IMAccessTab-DDb7rsHe.js} +1 -1
package/dashboard/dist/assets/{Modal-CIYrMwm0.js → Modal-DDiBG4kb.js} +1 -1
package/dashboard/dist/assets/{Modals-B-Afu2rD.js → Modals-CsUQjpxn.js} +1 -1
package/dashboard/dist/assets/{Select-B1UL27gw.js → Select-CG_7h_Tz.js} +1 -1
package/dashboard/dist/assets/SessionPanel-B5964GUj.js +1 -0
package/dashboard/dist/assets/{SystemTab-Bv1uT5-h.js → SystemTab-D7r1PsC9.js} +1 -1
package/dashboard/dist/assets/index-BbplxgnQ.js +3 -0
package/dashboard/dist/assets/index-CULTTvtY.js +23 -0
package/dashboard/dist/assets/index-DwmXPtDd.css +1 -0
package/dashboard/dist/assets/{shared-624PaUfm.js → shared-Bv8WvQSo.js} +1 -1
package/dashboard/dist/index.html +2 -2
package/dist/agent/accounts.js +181 -0
package/dist/agent/drivers/claude.js +108 -3
package/dist/agent/kernel-bridge.js +45 -1
package/dist/agent/session.js +6 -2
package/dist/agent/stream.js +26 -0
package/dist/bot/bot.js +45 -10
package/dist/bot/command-ui.js +69 -4
package/dist/bot/render-shared.js +2 -1
package/dist/cli/kernel-app.js +4 -2
package/dist/core/config/runtime-config.js +14 -22
package/dist/dashboard/routes/accounts.js +113 -0
package/dist/dashboard/server.js +2 -0
package/dist/model/responses-bridge.js +37 -0
package/package.json +1 -1
package/packages/kernel/README.md +35 -0
package/packages/kernel/dist/accounts.d.ts +6 -0
package/packages/kernel/dist/accounts.js +29 -0
package/packages/kernel/dist/contracts/driver.d.ts +15 -0
package/packages/kernel/dist/contracts/ports.d.ts +2 -0
package/packages/kernel/dist/drivers/acp.d.ts +24 -0
package/packages/kernel/dist/drivers/acp.js +477 -0
package/packages/kernel/dist/drivers/claude.d.ts +5 -1
package/packages/kernel/dist/drivers/claude.js +4 -0
package/packages/kernel/dist/drivers/codex.d.ts +5 -1
package/packages/kernel/dist/drivers/codex.js +24 -12
package/packages/kernel/dist/drivers/gemini.d.ts +5 -1
package/packages/kernel/dist/drivers/gemini.js +4 -0
package/packages/kernel/dist/drivers/hermes.d.ts +3 -12
package/packages/kernel/dist/drivers/hermes.js +8 -191
package/packages/kernel/dist/drivers/index.d.ts +1 -0
package/packages/kernel/dist/drivers/index.js +1 -0
package/packages/kernel/dist/index.d.ts +4 -1
package/packages/kernel/dist/index.js +5 -0
package/packages/kernel/dist/ports/defaults.js +7 -1
package/packages/kernel/dist/runtime/loom.d.ts +10 -0
package/packages/kernel/dist/runtime/loom.js +18 -2
package/packages/kernel/dist/workspace/index.d.ts +5 -0
package/packages/kernel/dist/workspace/index.js +7 -0
package/packages/kernel/dist/workspace/mcp.d.ts +44 -0
package/packages/kernel/dist/workspace/mcp.js +82 -0
package/packages/kernel/dist/workspace/native.d.ts +14 -0
package/packages/kernel/dist/workspace/native.js +340 -0
package/packages/kernel/dist/workspace/paths.d.ts +33 -0
package/packages/kernel/dist/workspace/paths.js +40 -0
package/packages/kernel/dist/workspace/sessions.d.ts +49 -0
package/packages/kernel/dist/workspace/sessions.js +130 -0
package/packages/kernel/dist/workspace/skills.d.ts +44 -0
package/packages/kernel/dist/workspace/skills.js +173 -0
package/dashboard/dist/assets/AgentTab-Cj7sekcS.js +0 -1
package/dashboard/dist/assets/SessionPanel-BHuG5hxj.js +0 -1
package/dashboard/dist/assets/index-BOEW0RIx.js +0 -23
package/dashboard/dist/assets/index-Bthwt6K_.css +0 -1
package/dashboard/dist/assets/index-qKexKdJl.js +0 -3

package/dashboard/dist/assets/{shared-624PaUfm.js → shared-Bv8WvQSo.js} RENAMED Viewed

	@@ -1 +1 @@
1	- import{j as s}from"./react-vendor-C7Sl8SE7.js";import{N as t,m as i,S as a}from"./index-~~qKexKdJl~~.js";function o({primary:e,secondary:l,tertiary:n}){return s.jsxs("div",{className:"flex flex-col gap-2 pt-1 sm:flex-row sm:flex-wrap sm:items-center sm:justify-between",children:[s.jsxs("div",{className:"flex flex-wrap items-center gap-2",children:[e&&s.jsxs(i,{tone:"primary",onClick:e.onClick,disabled:e.disabled,children:[e.loading&&s.jsx(a,{}),e.label]}),l&&s.jsx(i,{tone:"secondary",onClick:l.onClick,disabled:l.disabled,children:l.label})]}),n&&s.jsx("div",{className:"text-xs leading-relaxed text-fg-4",children:n})]})}function c({children:e,className:l}){return s.jsx(t,{padding:"md",elevation:"flat",className:l,children:e})}export{o as A,c as S};
1	+ import{j as s}from"./react-vendor-C7Sl8SE7.js";import{O as t,m as i,S as a}from"./index-BbplxgnQ.js";function o({primary:e,secondary:l,tertiary:n}){return s.jsxs("div",{className:"flex flex-col gap-2 pt-1 sm:flex-row sm:flex-wrap sm:items-center sm:justify-between",children:[s.jsxs("div",{className:"flex flex-wrap items-center gap-2",children:[e&&s.jsxs(i,{tone:"primary",onClick:e.onClick,disabled:e.disabled,children:[e.loading&&s.jsx(a,{}),e.label]}),l&&s.jsx(i,{tone:"secondary",onClick:l.onClick,disabled:l.disabled,children:l.label})]}),n&&s.jsx("div",{className:"text-xs leading-relaxed text-fg-4",children:n})]})}function c({children:e,className:l}){return s.jsx(t,{padding:"md",elevation:"flat",className:l,children:e})}export{o as A,c as S};

package/dashboard/dist/index.html CHANGED Viewed

@@ -6,10 +6,10 @@
   <link rel="icon" type="image/png" href="/logo.png">
   <title>Pikiloom</title>
   <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <script type="module" crossorigin src="/assets/index-qKexKdJl.js"></script>
+  <script type="module" crossorigin src="/assets/index-BbplxgnQ.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/react-vendor-C7Sl8SE7.js">
   <link rel="modulepreload" crossorigin href="/assets/router-DHISdpPk.js">
-  <link rel="stylesheet" crossorigin href="/assets/index-Bthwt6K_.css">
+  <link rel="stylesheet" crossorigin href="/assets/index-DwmXPtDd.css">
 </head>
 <body>
   <div id="root"></div>

package/dist/agent/accounts.js ADDED Viewed

@@ -0,0 +1,181 @@
+// Multi-account store (app layer): local subscription accounts for an agent, switched by
+// injecting a long-lived auth token at spawn. Each account = a user-named token (minted via
+// `claude setup-token`), stored in the credential vault (not plaintext). The agent keeps
+// using its normal single config home; only CLAUDE_CODE_OAUTH_TOKEN changes.
+//
+// claude only for now — codex has no token-based switch (see kernel accounts.ts).
+import { randomUUID } from 'node:crypto';
+import { loadUserConfig, saveUserConfig } from '../core/config/user-config.js';
+import { persistSecret, forgetSecret, resolveCredential, isCredentialRef } from '../core/secrets/index.js';
+import { loadKernel } from './kernel-bridge.js';
+import { claudeUsageForToken } from './drivers/claude.js';
+import { agentWarn } from './utils.js';
+// Agents whose local accounts are switched by a token (kept in sync with the kernel).
+const ACCOUNT_AGENTS = new Set(['claude']);
+export const MAX_ACCOUNTS_PER_AGENT = 5;
+const TOKEN_RE = /^sk-ant-oat/;
+export function accountAgentSupported(agent) {
+    return ACCOUNT_AGENTS.has(agent);
+}
+function getLayer() {
+    return loadUserConfig().accounts || {};
+}
+function writeLayer(layer) {
+    saveUserConfig({ ...loadUserConfig(), accounts: layer });
+}
+// Only records that carry a resolvable credential are real accounts; this also drops stale
+// records from the earlier config-directory implementation (which had no credential).
+function validRecords(agent) {
+    return (getLayer().byAgent?.[agent] || []).filter(r => r && isCredentialRef(r.credential));
+}
+export function listAccounts(agent) {
+    return validRecords(agent).slice().sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+}
+export function getAccount(agent, id) {
+    return validRecords(agent).find(a => a.id === id) || null;
+}
+export async function addAccount(agent, label, token) {
+    if (!accountAgentSupported(agent))
+        throw new Error(`Agent ${agent} does not support multiple accounts`);
+    const name = (label || '').trim();
+    if (!name)
+        throw new Error('Account name is required');
+    const t = (token || '').trim();
+    if (!TOKEN_RE.test(t))
+        throw new Error('Expected a token starting with "sk-ant-oat" (the output of `claude setup-token`)');
+    const existing = listAccounts(agent);
+    if (existing.length >= MAX_ACCOUNTS_PER_AGENT)
+        throw new Error(`At most ${MAX_ACCOUNTS_PER_AGENT} accounts per agent`);
+    const id = randomUUID().slice(0, 8);
+    const credential = await persistSecret(`account/${agent}/${id}`, t);
+    const rec = { id, label: name, credential, createdAt: new Date().toISOString(), lastUsedAt: null };
+    const layer = getLayer();
+    const byAgent = { ...(layer.byAgent || {}) };
+    byAgent[agent] = [...existing, rec];
+    writeLayer({ ...layer, byAgent });
+    return rec;
+}
+export async function updateAccount(agent, id, patch) {
+    const list = listAccounts(agent);
+    const idx = list.findIndex(a => a.id === id);
+    if (idx < 0)
+        throw new Error(`Account not found: ${id}`);
+    const cur = list[idx];
+    let credential = cur.credential;
+    if (patch.token !== undefined) {
+        const t = patch.token.trim();
+        if (!TOKEN_RE.test(t))
+            throw new Error('Expected a token starting with "sk-ant-oat"');
+        credential = await persistSecret(`account/${agent}/${id}`, t);
+    }
+    const next = {
+        ...cur,
+        credential,
+        ...('label' in patch && patch.label !== undefined ? { label: patch.label.trim() || cur.label } : {}),
+        ...('lastUsedAt' in patch ? { lastUsedAt: patch.lastUsedAt ?? null } : {}),
+    };
+    list[idx] = next;
+    const layer = getLayer();
+    writeLayer({ ...layer, byAgent: { ...(layer.byAgent || {}), [agent]: list } });
+    return next;
+}
+export async function removeAccount(agent, id) {
+    const rec = getAccount(agent, id);
+    if (!rec)
+        return false;
+    const layer = getLayer();
+    const byAgent = { ...(layer.byAgent || {}) };
+    byAgent[agent] = listAccounts(agent).filter(a => a.id !== id);
+    const activeByAgent = { ...(layer.activeByAgent || {}) };
+    if (activeByAgent[agent] === id)
+        activeByAgent[agent] = null;
+    writeLayer({ ...layer, byAgent, activeByAgent });
+    try {
+        await forgetSecret(rec.credential);
+    }
+    catch { /* best-effort */ }
+    return true;
+}
+export function getActiveAccountId(agent) {
+    const id = getLayer().activeByAgent?.[agent] || null;
+    if (id && !getAccount(agent, id))
+        return null;
+    return id;
+}
+export function setActiveAccount(agent, id) {
+    if (id && !getAccount(agent, id))
+        throw new Error(`Account not found: ${id}`);
+    const layer = getLayer();
+    writeLayer({ ...layer, activeByAgent: { ...(layer.activeByAgent || {}), [agent]: id } });
+}
+/**
+ * Resolve the env to inject for a turn. Tri-state override (mirrors profileId):
+ *   undefined -> use the agent's globally-active account
+ *   null      -> no account (default login)
+ *   <id>      -> that specific account
+ */
+export async function resolveAccountEnv(agent, accountIdOverride) {
+    if (!accountAgentSupported(agent))
+        return null;
+    const id = accountIdOverride === undefined ? getActiveAccountId(agent) : accountIdOverride;
+    if (!id)
+        return null;
+    const rec = getAccount(agent, id);
+    if (!rec)
+        return null;
+    let token = '';
+    try {
+        token = await resolveCredential(rec.credential);
+    }
+    catch (e) {
+        agentWarn(`[account] could not resolve token for ${agent}/${id}: ${e?.message || e}`);
+        return null;
+    }
+    if (!token)
+        return null;
+    const kernel = await loadKernel();
+    const env = kernel.accountTokenEnv(agent, token);
+    return { env, accountId: id };
+}
+// Last-known per-account usage, kept so synchronous surfaces (the IM `/agents` view builder)
+// can render usage without awaiting a probe. Filled whenever `probeAccountUsage` resolves.
+const accountUsageById = new Map();
+const usageKey = (agent, id) => `${agent}/${id}`;
+/** Best-effort per-account usage: read the account's quota from its token (see claudeUsageForToken). */
+export async function probeAccountUsage(agent, id) {
+    if (agent !== 'claude')
+        return null;
+    const rec = getAccount(agent, id);
+    if (!rec)
+        return null;
+    try {
+        const token = await resolveCredential(rec.credential);
+        const usage = token ? await claudeUsageForToken(token) : null;
+        accountUsageById.set(usageKey(agent, id), usage);
+        return usage;
+    }
+    catch {
+        return null;
+    }
+}
+/** Synchronous read of the last-probed usage for an account (no network), or null. */
+export function getCachedAccountUsage(agent, id) {
+    return accountUsageById.get(usageKey(agent, id)) ?? null;
+}
+/** Fire-and-forget refresh of every account's usage (cached + de-duped under the hood). */
+export function warmAccountUsages(agent) {
+    if (!accountAgentSupported(agent))
+        return;
+    for (const rec of listAccounts(agent))
+        void probeAccountUsage(agent, rec.id);
+}
+/** Compact "5h 100% · 7d 19%" summary from the cached usage, or null. */
+export function accountUsageSummary(agent, id) {
+    const usage = getCachedAccountUsage(agent, id);
+    if (!usage?.ok || !usage.windows.length)
+        return null;
+    const parts = usage.windows
+        .filter(w => w.usedPercent != null)
+        .map(w => `${w.label} ${Math.round(w.usedPercent)}%`);
+    return parts.length ? parts.join(' · ') : null;
+}

package/dist/agent/drivers/claude.js CHANGED Viewed

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { execSync, spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { registerDriver } from '../driver.js';
-import { Q, run, agentError, agentLog, agentWarn, buildStreamPreviewMeta, computeContext, pushRecentActivity, summarizeClaudeToolUse, summarizeClaudeToolResult, joinErrorMessages, parseTodoWriteAsPlan, previewToolCallInput, previewToolCallResult, detectClaudeApiError, isRetryableClaudeApiError, detectClaudeModelError, claudeModelErrorMessage, emitSessionIdUpdate, IMAGE_EXTS, mimeForExt, listPikiloomSessions, mergeManagedAndNativeSessions, managedRecordToSessionInfo, readTailLines, stripInjectedPrompts, sanitizeSessionUserPreviewText, SESSION_PREVIEW_IMAGE_PLACEHOLDER_RE, CLAUDE_AT_MENTION_IMAGE_RE, extractClaudeAtMentionImagePaths, attachAgentImage, applyTurnWindow, shortValue, roundPercent, modelFamily, normalizeClaudeModelId, emptyUsage, normalizeUsageStatus, collapseSkillPrompt, } from '../index.js';
+import { Q, run, agentError, agentLog, agentWarn, buildStreamPreviewMeta, computeContext, pushRecentActivity, summarizeClaudeToolUse, summarizeClaudeToolResult, joinErrorMessages, parseTodoWriteAsPlan, previewToolCallInput, previewToolCallResult, detectClaudeApiError, isRetryableClaudeApiError, detectClaudeModelError, claudeModelErrorMessage, emitSessionIdUpdate, IMAGE_EXTS, mimeForExt, listPikiloomSessions, mergeManagedAndNativeSessions, managedRecordToSessionInfo, readTailLines, stripInjectedPrompts, sanitizeSessionUserPreviewText, SESSION_PREVIEW_IMAGE_PLACEHOLDER_RE, CLAUDE_AT_MENTION_IMAGE_RE, extractClaudeAtMentionImagePaths, attachAgentImage, applyTurnWindow, shortValue, roundPercent, toIsoFromEpochSeconds, modelFamily, normalizeClaudeModelId, emptyUsage, normalizeUsageStatus, collapseSkillPrompt, } from '../index.js';
 import { AGENT_STREAM_HARD_KILL_GRACE_MS, AGENT_GRACEFUL_ABORT_GRACE_MS, SESSION_RUNNING_THRESHOLD_MS } from '../../core/constants.js';
 import { terminateProcessTree } from '../../core/process-control.js';
 import { getHome, IS_MAC, encodePathAsDirName } from '../../core/platform.js';
@@ -1775,8 +1775,8 @@ function getClaudeOAuthToken() {
         return null;
     }
 }
-function getClaudeUsageFromOAuth() {
-    const token = getClaudeOAuthToken();
+function getClaudeUsageFromOAuth(tokenOverride) {
+    const token = tokenOverride || getClaudeOAuthToken();
     if (!token)
         return null;
     try {
@@ -1824,6 +1824,111 @@ function getClaudeUsageFromOAuth() {
         return null;
     }
 }
+// Per-account usage for a specific account's `claude setup-token`.
+//
+// IMPORTANT: setup-tokens are minted with the `user:inference` scope only — they do NOT carry
+// `user:profile`, so the read-only OAuth usage endpoint (`/api/oauth/usage`) rejects them with
+// `permission_error … scope requirement user:profile`. The native/default-login token works
+// there because it's a full login. So for account tokens we read the limit state from the
+// `anthropic-ratelimit-unified-*` *response headers* of a tiny inference call instead — those
+// headers come back on every `/v1/messages` response regardless of scope, and are exactly what
+// Claude Code itself uses to learn 5h / 7d limits. Cost is ~1 output token per probe, cached
+// for 5min per token (60s back-off on failure), with in-flight de-dup so concurrent surfaces
+// (cards + header + IM) share one probe.
+const TOKEN_USAGE_OK_TTL_MS = CLAUDE_USAGE_QUERY_TTL_MS;
+const TOKEN_USAGE_RETRY_TTL_MS = 60_000;
+const CLAUDE_USAGE_PROBE_MODEL = 'claude-haiku-4-5-20251001';
+const claudeTokenUsageCache = new Map();
+const claudeTokenUsageInflight = new Map();
+function usageFromRatelimitHeaders(h) {
+    const makeWindow = (label, prefix) => {
+        const raw = h.get(`anthropic-ratelimit-unified-${prefix}-utilization`);
+        if (raw == null || raw === '')
+            return null;
+        const usedPercent = roundPercent(Number(raw) * 100);
+        if (usedPercent == null)
+            return null;
+        const remainingPercent = Math.max(0, Math.round((100 - usedPercent) * 10) / 10);
+        const resetAt = toIsoFromEpochSeconds(h.get(`anthropic-ratelimit-unified-${prefix}-reset`));
+        let resetAfterSeconds = null;
+        if (resetAt) {
+            const resetAtMs = Date.parse(resetAt);
+            if (Number.isFinite(resetAtMs))
+                resetAfterSeconds = Math.max(0, Math.round((resetAtMs - Date.now()) / 1000));
+        }
+        return {
+            label, usedPercent, remainingPercent, resetAt, resetAfterSeconds,
+            status: usedPercent >= 100 ? 'limit_reached' : usedPercent >= 80 ? 'warning' : 'allowed',
+        };
+    };
+    // Only 5h + 7d are real here. The inference headers expose an overage (Extra) on/off STATUS
+    // but never a utilization number, and `/api/oauth/usage` (which returns the actual extra_usage
+    // figure) is scope-blocked for setup-tokens — so we deliberately do NOT synthesize an "Extra"
+    // window for token accounts. Showing a fabricated 0% misrepresents real Extra spend.
+    const windows = [makeWindow('5h', '5h'), makeWindow('7d', '7d')].filter((w) => w != null);
+    if (!windows.length)
+        return null;
+    const overallStatus = windows.some(w => w.status === 'limit_reached') ? 'limit_reached'
+        : windows.some(w => w.status === 'warning') ? 'warning' : 'allowed';
+    return { ok: true, agent: 'claude', source: 'ratelimit-headers', capturedAt: new Date().toISOString(), status: overallStatus, windows, error: null };
+}
+async function claudeUsageFromInferenceHeaders(token) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 10_000);
+    try {
+        const res = await fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${token}`,
+                'anthropic-beta': 'oauth-2025-04-20',
+                'anthropic-version': '2023-06-01',
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ model: CLAUDE_USAGE_PROBE_MODEL, max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] }),
+            signal: controller.signal,
+        });
+        // The unified rate-limit headers ride on every response (incl. 429), so parse them before
+        // worrying about the status code. Drain the body so the socket can be reused/closed.
+        const usage = usageFromRatelimitHeaders(res.headers);
+        void res.text().catch(() => { });
+        return usage;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function claudeUsageForToken(token) {
+    const t = String(token || '');
+    if (!t)
+        return Promise.resolve(null);
+    const now = Date.now();
+    const cached = claudeTokenUsageCache.get(t);
+    if (cached) {
+        const ttl = cached.ok ? TOKEN_USAGE_OK_TTL_MS : TOKEN_USAGE_RETRY_TTL_MS;
+        if (now - cached.at < ttl)
+            return Promise.resolve(cached.value);
+    }
+    const inflight = claudeTokenUsageInflight.get(t);
+    if (inflight)
+        return inflight;
+    const p = (async () => {
+        const fresh = await claudeUsageFromInferenceHeaders(t);
+        const at = Date.now();
+        if (fresh) {
+            claudeTokenUsageCache.set(t, { value: fresh, at, ok: true });
+            return fresh;
+        }
+        // Probe failed (network / transient): keep serving last-good, but back off retries.
+        const value = claudeTokenUsageCache.get(t)?.value ?? null;
+        claudeTokenUsageCache.set(t, { value, at, ok: false });
+        return value;
+    })().finally(() => claudeTokenUsageInflight.delete(t));
+    claudeTokenUsageInflight.set(t, p);
+    return p;
+}
 function getClaudeUsageFromTelemetry(home, model) {
     const telemetryRoot = path.join(home, '.claude', 'telemetry');
     if (!fs.existsSync(telemetryRoot))

package/dist/agent/kernel-bridge.js CHANGED Viewed

@@ -15,8 +15,44 @@ import { humanizeCodexError } from './drivers/codex.js';
 // Tests always run legacy (the unit suite asserts legacy driver behavior). The bridge
 // re-applies app-level parity the pure kernel must not own (claude jsonl entrypoint, codex humanize).
 const KERNEL_AGENTS = new Set(['claude', 'codex', 'gemini', 'hermes']);
+// Generic ACP agents the kernel can drive via @pikiloom/kernel's AcpDriver. Hermes is its
+// own built-in preset; this registry is for ANY other ACP CLI (OpenCode, Zed, …). Extend
+// without a code edit via PIKILOOM_ACP_AGENTS='{"zed":{"command":"zed","args":["--acp"]}}'.
+const DEFAULT_ACP_AGENTS = {
+    opencode: { command: 'opencode', args: ['acp'] },
+};
+export function acpAgentConfig(agent) {
+    if (DEFAULT_ACP_AGENTS[agent])
+        return DEFAULT_ACP_AGENTS[agent];
+    try {
+        const extra = process.env.PIKILOOM_ACP_AGENTS ? JSON.parse(process.env.PIKILOOM_ACP_AGENTS) : null;
+        const c = extra?.[agent];
+        if (c && (c.command || agent))
+            return { command: String(c.command || agent), args: Array.isArray(c.args) ? c.args.map(String) : ['acp'] };
+    }
+    catch { /* malformed env → ignore */ }
+    return null;
+}
+// pikiloom's mcpServers (Record) -> kernel McpServerSpec[] for ACP session/new forwarding.
+function mcpRecordToKernelSpecs(servers) {
+    if (!servers)
+        return [];
+    const out = [];
+    for (const [name, cfg] of Object.entries(servers)) {
+        if (!cfg || typeof cfg !== 'object')
+            continue;
+        const type = String(cfg.type || '').toLowerCase();
+        if ((type === 'http' || type === 'sse') && cfg.url) {
+            out.push({ name, type: 'http', url: String(cfg.url), headers: cfg.headers || {} });
+            continue;
+        }
+        if (cfg.command)
+            out.push({ name, type: 'stdio', command: String(cfg.command), args: Array.isArray(cfg.args) ? cfg.args.map(String) : [], env: cfg.env || {} });
+    }
+    return out;
+}
 export function shouldUseKernelPipeline(agent) {
-    if (!KERNEL_AGENTS.has(agent))
+    if (!KERNEL_AGENTS.has(agent) && !acpAgentConfig(agent))
         return false;
     if (process.env.VITEST || process.env.NODE_ENV === 'test')
         return false; // tests assert legacy
@@ -41,7 +77,15 @@ function buildKernelDriver(kernel, opts) {
         effort: opts.thinkingEffort,
         env: opts.extraEnv,
         mcpConfigPath: opts.mcpConfigPath ?? null,
+        // Consumed by the ACP path (Hermes + generic AcpDriver) for session/new forwarding;
+        // ignored by claude/codex/gemini (they carry MCP via config file / native registration).
+        extraMcpServers: mcpRecordToKernelSpecs(opts.mcpServers),
     };
+    // Any registered generic ACP agent (OpenCode, …) -> the kernel's AcpDriver.
+    const acp = acpAgentConfig(opts.agent);
+    if (acp) {
+        return { driver: new kernel.AcpDriver({ id: opts.agent, command: acp.command, args: acp.args }), input: { ...common, model: opts.model ?? null } };
+    }
     switch (opts.agent) {
         case 'codex': {
             // codexExtraArgs is a flattened ['-c','k=v','-c','k=v',...]; extract the k=v values

package/dist/agent/session.js CHANGED Viewed

@@ -184,6 +184,7 @@ function normalizeSessionRecord(raw, workdir) {
         thinkingEffort: typeof raw?.thinkingEffort === 'string' && raw.thinkingEffort.trim() ? raw.thinkingEffort.trim() : null,
         workflowEnabled: typeof raw?.workflowEnabled === 'boolean' ? raw.workflowEnabled : null,
         profileId: typeof raw?.profileId === 'string' && raw.profileId.trim() ? raw.profileId.trim() : null,
+        accountId: typeof raw?.accountId === 'string' && raw.accountId.trim() ? raw.accountId.trim() : null,
         stagedFiles: Array.isArray(raw?.stagedFiles) ? dedupeStrings(raw.stagedFiles.filter((v) => typeof v === 'string')) : [],
         lastUserAttachments: Array.isArray(raw?.lastUserAttachments)
             ? dedupeStrings(raw.lastUserAttachments.filter((v) => typeof v === 'string'))
@@ -327,7 +328,7 @@ function writeSessionMeta(record) {
         workspacePath: record.workspacePath,
         threadId: record.threadId,
         createdAt: record.createdAt, updatedAt: record.updatedAt,
-        title: record.title, model: record.model, thinkingEffort: record.thinkingEffort, workflowEnabled: record.workflowEnabled, profileId: record.profileId, stagedFiles: record.stagedFiles,
+        title: record.title, model: record.model, thinkingEffort: record.thinkingEffort, workflowEnabled: record.workflowEnabled, profileId: record.profileId, accountId: record.accountId ?? null, stagedFiles: record.stagedFiles,
         runState: record.runState, runDetail: record.runDetail, runUpdatedAt: record.runUpdatedAt,
         runPid: record.runPid,
         classification: record.classification,
@@ -563,7 +564,7 @@ export function ensureSessionWorkspace(opts) {
             workspacePath: sessionWorkspacePath(workdir, opts.agent, sessionId),
             threadId,
             createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(),
-            title: summarizePromptTitle(opts.title) || null, model: null, thinkingEffort: null, workflowEnabled: null, profileId: null, stagedFiles: [], lastUserAttachments: [],
+            title: summarizePromptTitle(opts.title) || null, model: null, thinkingEffort: null, workflowEnabled: null, profileId: null, accountId: null, stagedFiles: [], lastUserAttachments: [],
             runState: 'completed', runDetail: null, runUpdatedAt: new Date().toISOString(),
             runPid: null,
             classification: null, userStatus: null, userNote: null,
@@ -597,6 +598,7 @@ export function managedRecordToSessionInfo(record) {
         thinkingEffort: record.thinkingEffort,
         workflowEnabled: record.workflowEnabled ?? null,
         profileId: record.profileId ?? null,
+        accountId: record.accountId ?? null,
         createdAt: record.createdAt,
         title,
         running: record.runState === 'running',
@@ -680,6 +682,7 @@ export function getSessionStoredConfig(workdir, agent, sessionId) {
         thinkingEffort: record?.thinkingEffort ?? null,
         workflowEnabled: record?.workflowEnabled ?? null,
         profileId: record?.profileId ?? null,
+        accountId: record?.accountId ?? null,
     };
 }
 export function ensureManagedSession(opts) {
@@ -774,6 +777,7 @@ export function mergeManagedAndNativeSessions(managedSessions, nativeSessions) {
             thinkingEffort: managed.thinkingEffort ?? native.thinkingEffort ?? null,
             workflowEnabled: managed.workflowEnabled ?? native.workflowEnabled ?? null,
             profileId: managed.profileId ?? native.profileId ?? null,
+            accountId: managed.accountId ?? native.accountId ?? null,
             createdAt: native.createdAt || managed.createdAt,
             classification: managed.classification ?? native.classification ?? null,
             userStatus: managed.userStatus ?? native.userStatus ?? null,

package/dist/agent/stream.js CHANGED Viewed

@@ -13,6 +13,7 @@ import { saveSessionRecord, setSessionRunState, applySessionRunResult, ensureSes
 import { clearAwaitResume } from './await-resume.js';
 import { collapseSkillPrompt } from './skills.js';
 import { shouldUseKernelPipeline, kernelStream } from './kernel-bridge.js';
+import { accountAgentSupported, resolveAccountEnv, updateAccount } from './accounts.js';
 function trimSessionText(value, max = 24_000) {
     const text = typeof value === 'string' ? value.trim() : '';
     if (!text)
@@ -531,6 +532,29 @@ export async function doStream(opts) {
     catch (e) {
         agentWarn(`[byok] failed to apply Profile injection: ${e?.message || e}`);
     }
+    // Multi-account (native subscription): when NO BYOK profile is bound, route the turn
+    // through the agent's active local account by injecting its isolated config dir
+    // (CLAUDE_CONFIG_DIR / CODEX_HOME). A BYOK profile owns the credential, so it takes over
+    // and account injection is skipped — the two axes are mutually exclusive per turn.
+    try {
+        if (accountAgentSupported(prepared.agent)) {
+            const profileBound = prepared.profileId === undefined
+                ? !!getActiveProfile(prepared.agent)
+                : !!(prepared.profileId && getProfile(prepared.profileId));
+            if (!profileBound) {
+                const resolved = await resolveAccountEnv(prepared.agent, prepared.accountId);
+                if (resolved) {
+                    prepared.extraEnv = { ...(prepared.extraEnv || {}), ...resolved.env };
+                    prepared.accountId = resolved.accountId;
+                    agentLog(`[account] ${prepared.agent} turn → account=${resolved.accountId} (${Object.keys(resolved.env).join('+')})`);
+                    void updateAccount(prepared.agent, resolved.accountId, { lastUsedAt: new Date().toISOString() }).catch(() => { });
+                }
+            }
+        }
+    }
+    catch (e) {
+        agentWarn(`[account] injection failed: ${e?.message || e}`);
+    }
     try {
         if (prepared.thinkingEffort) {
             session.record.thinkingEffort = prepared.thinkingEffort.trim().toLowerCase() || session.record.thinkingEffort;
@@ -548,6 +572,8 @@ export async function doStream(opts) {
             session.record.model = turnModel;
         if (prepared.profileId !== undefined)
             session.record.profileId = prepared.profileId || null;
+        if (prepared.accountId !== undefined)
+            session.record.accountId = prepared.accountId || null;
         saveSessionRecord(opts.workdir, session.record);
     }
     catch (e) {

package/dist/bot/bot.js CHANGED Viewed

@@ -2,7 +2,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { execSync, spawn } from 'node:child_process';
 import { getActiveUserConfig, loadWorkspaces, onUserConfigChange, resolveUserWorkdir, setUserWorkdir, updateUserConfig } from '../core/config/user-config.js';
-import { doStream, ensureManagedSession, findManagedThreadSession, getSessionStoredConfig, getUsage, initializeProjectSkills, listAgents, resolveAgentModels, resolveDefaultAgent, listSkills, stageSessionFiles, reconcileOrphanedRunningSessions, getAgentBoundModelId, setAgentBoundModelId, collapseSkillPrompt, readGoal, accountTurn, shouldContinueAfterTurn, renderContinuationPrompt, renderBudgetLimitPrompt, bumpContinuationCount, pauseGoal, resumeGoal, setGoal as setGoalState, clearGoal as clearGoalState, setCodexGoal, getCodexGoal, clearCodexGoal, pauseCodexGoal, resumeCodexGoal, getClaudeNativeGoal, buildClaudeSetGoalPrompt, buildClaudeClearGoalPrompt, deliverArtifact, attachmentUrl, isPendingSessionId, } from '../agent/index.js';
+import { doStream, ensureManagedSession, findManagedThreadSession, getSessionStoredConfig, getUsage, initializeProjectSkills, listAgents, resolveAgentModels, resolveDefaultAgent, listSkills, stageSessionFiles, reconcileOrphanedRunningSessions, getAgentBoundModelId, setAgentBoundModelId, collapseSkillPrompt, readGoal, accountTurn, shouldContinueAfterTurn, renderContinuationPrompt, renderBudgetLimitPrompt, bumpContinuationCount, pauseGoal, resumeGoal, setGoal as setGoalState, clearGoal as clearGoalState, setCodexGoal, getCodexGoal, clearCodexGoal, pauseCodexGoal, resumeCodexGoal, getClaudeNativeGoal, buildClaudeSetGoalPrompt, buildClaudeClearGoalPrompt, deliverArtifact, attachmentUrl, attachAgentImage, rewriteAttachmentBlocksForTransport, isPendingSessionId, } from '../agent/index.js';
 import { compactForHandover, describeHandoverRef } from '../agent/handover.js';
 import { getActiveProfileId, getActiveProfile, setActiveProfile } from '../model/index.js';
 import { querySessions, querySessionTail, updateSession, } from './session-hub.js';
@@ -160,16 +160,48 @@ export class Bot {
         const snap = this.streamSnapshots.get(this.resolveSessionKey(sessionKey));
         return snap ? this.enrichSnapshot(snap) : null;
     }
+    taskAttachmentBlocks(task) {
+        if (!task?.attachments?.length)
+            return [];
+        const session = this.getSessionRuntimeByKey(task.sessionKey, { allowAnyWorkdir: true });
+        const sessionId = session?.sessionId || task.sessionKey.slice(task.agent.length + 1);
+        if (!sessionId)
+            return [];
+        const blocks = task.attachments
+            .map(imagePath => attachAgentImage({ imagePath, inlineThresholdBytes: 0 }))
+            .filter((block) => !!block);
+        return blocks.length
+            ? rewriteAttachmentBlocksForTransport(blocks, { agent: task.agent, sessionId })
+            : [];
+    }
+    taskPreview(taskId) {
+        const task = this.activeTasks.get(taskId) || null;
+        const raw = task?.prompt || '';
+        const attachments = this.taskAttachmentBlocks(task);
+        return {
+            taskId,
+            prompt: collapseSkillPrompt(raw) ?? raw,
+            ...(attachments.length ? { attachments } : {}),
+        };
+    }
     enrichSnapshot(snap) {
         let next = snap;
-        const runningPrompt = next.taskId ? this.activeTasks.get(next.taskId)?.prompt : '';
-        if (runningPrompt)
-            next = { ...next, question: collapseSkillPrompt(runningPrompt) ?? runningPrompt };
-        if (next.queuedTaskIds?.length) {
-            const queuedTasks = next.queuedTaskIds.map(taskId => {
-                const raw = this.activeTasks.get(taskId)?.prompt || '';
-                return { taskId, prompt: collapseSkillPrompt(raw) ?? raw };
-            });
+        const runningTask = next.taskId ? this.activeTasks.get(next.taskId) : null;
+        const runningPrompt = runningTask?.prompt || '';
+        if (runningPrompt) {
+            const questionBlocks = this.taskAttachmentBlocks(runningTask);
+            next = {
+                ...next,
+                question: collapseSkillPrompt(runningPrompt) ?? runningPrompt,
+                ...(questionBlocks.length ? { questionBlocks } : {}),
+            };
+        }
+        const queuedIds = [
+            ...(next.phase === 'queued' && next.taskId ? [next.taskId] : []),
+            ...(next.queuedTaskIds || []),
+        ].filter((taskId, index, all) => taskId && all.indexOf(taskId) === index);
+        if (queuedIds.length) {
+            const queuedTasks = queuedIds.map(taskId => this.taskPreview(taskId));
             next = { ...next, queuedTasks };
         }
         if (next.interactions?.length) {
@@ -234,13 +266,16 @@ export class Bot {
         switch (event.type) {
             case 'queued': {
                 const existing = this.streamSnapshots.get(sessionKey);
-                if (existing && (existing.phase === 'streaming' || existing.phase === 'done')) {
+                if (existing && existing.phase === 'streaming') {
                     const list = existing.queuedTaskIds ? [...existing.queuedTaskIds] : [];
                     if (existing.taskId !== event.taskId && !list.includes(event.taskId))
                         list.push(event.taskId);
                     existing.queuedTaskIds = list.length ? list : undefined;
                     existing.updatedAt = now;
                 }
+                else if (existing && existing.phase === 'done') {
+                    this.streamSnapshots.set(sessionKey, { phase: 'queued', taskId: event.taskId, updatedAt: now });
+                }
                 else if (existing && existing.phase === 'queued') {
                     const list = existing.queuedTaskIds ? [...existing.queuedTaskIds] : [];
                     if (existing.taskId !== event.taskId && !list.includes(event.taskId))