sparkecoder 0.1.130 → 0.1.132

package/dist/cli.js

@@ -819,8 +819,8 @@ var init_types = __esm({
       authKey: z.string().optional()
     }).optional();
     SparkcoderConfigSchema = z.object({
-      // Default model to use (Vercel AI Gateway format)
-      defaultModel: z.string().default("anthropic/claude-opus-4.7"),
+      // Default model to use (LiteLLM model id)
+      defaultModel: z.string().default("gpt-5.5"),
       // Working directory for file operations
       workingDirectory: z.string().optional(),
       // Tool approval settings
@@ -859,6 +859,14 @@ var init_types = __esm({
       webhooks: z.object({
         token: z.string().optional()
       }).optional(),
+      // Self-update: when running as the managed service, periodically check
+      // npm for a newer published version and, if found, re-run the hosted
+      // installer (full upgrade + restart). Disabled automatically when not
+      // running from a global install (e.g. dev/source checkouts).
+      autoUpdate: z.object({
+        enabled: z.boolean().optional().default(true),
+        intervalHours: z.number().positive().optional().default(6)
+      }).optional().default({}),
       // Database path (used for local SQLite - ignored if remoteServer is configured)
       databasePath: z.string().optional().default("./sparkecoder.db"),
       // Remote server configuration (for centralized storage)
@@ -966,6 +974,7 @@ __export(config_exports, {
   requiresApproval: () => requiresApproval,
   saveAuthKey: () => saveAuthKey,
   setApiKey: () => setApiKey,
+  setCfAccessConfig: () => setCfAccessConfig,
   setMcpServers: () => setMcpServers,
   setPublicUrl: () => setPublicUrl,
   setSkillsAdditionalDirectories: () => setSkillsAdditionalDirectories,
@@ -1154,12 +1163,12 @@ function loadConfig(configPath, workingDirectory) {
     ]
   };
   const DEFAULT_REMOTE_URL = "https://agent-remote-server.sparkecode.com";
-  const remoteUrl = process.env.SPARKECODER_REMOTE_URL || config.remoteServer?.url || DEFAULT_REMOTE_URL;
+  const remoteUrl2 = process.env.SPARKECODER_REMOTE_URL || config.remoteServer?.url || DEFAULT_REMOTE_URL;
   const remoteAuthKey = process.env.SPARKECODER_AUTH_KEY || config.remoteServer?.authKey || loadStoredAuthKey();
   const resolvedRemoteServer = {
-    url: remoteUrl,
+    url: remoteUrl2,
     authKey: remoteAuthKey,
-    isConfigured: !!remoteUrl && !!remoteAuthKey
+    isConfigured: !!remoteUrl2 && !!remoteAuthKey
   };
   const resolved = {
     ...config,
@@ -1315,6 +1324,40 @@ function setPublicUrl(publicUrl) {
     console.warn("[config] failed to persist publicUrl:", err?.message || err);
   }
 }
+function setCfAccessConfig(input) {
+  const applyToAuth = (auth) => {
+    const curAuth = auth || {};
+    const curCf = curAuth.cfAccess || {};
+    const nextCf = { ...curCf };
+    if (input.enabled !== void 0) nextCf.enabled = input.enabled;
+    if (input.teamDomain !== void 0) nextCf.teamDomain = input.teamDomain;
+    if (input.audTag !== void 0) nextCf.audTag = input.audTag;
+    const nextAuth = { ...curAuth, cfAccess: nextCf };
+    if (input.allowedEmails !== void 0) nextAuth.allowedEmails = input.allowedEmails;
+    return nextAuth;
+  };
+  if (cachedConfig) {
+    cachedConfig.auth = applyToAuth(cachedConfig.auth);
+  }
+  try {
+    const cwdPath = resolve(process.cwd(), "sparkecoder.config.json");
+    const target = existsSync(cwdPath) ? cwdPath : join(ensureAppDataDirectory(), "sparkecoder.config.json");
+    let raw = {};
+    if (existsSync(target)) {
+      try {
+        raw = JSON.parse(readFileSync(target, "utf-8"));
+      } catch {
+        raw = {};
+      }
+    } else {
+      raw = createDefaultConfig();
+    }
+    raw.auth = applyToAuth(raw.auth);
+    writeFileSync(target, JSON.stringify(raw, null, 2));
+  } catch (err) {
+    console.warn("[config] failed to persist cf-access config:", err?.message || err);
+  }
+}
 function clearSlackConfig() {
   if (cachedConfig) cachedConfig.slack = {};
   try {
@@ -1356,7 +1399,7 @@ function autoApproveAllTools(sessionConfig) {
 }
 function createDefaultConfig() {
   return {
-    defaultModel: "anthropic/claude-opus-4.7",
+    defaultModel: "gpt-5.5",
     // workingDirectory is intentionally not set - defaults to where CLI is run
     toolApprovals: {
       bash: true,
@@ -1378,6 +1421,10 @@ function createDefaultConfig() {
       port: 3141,
       host: "0.0.0.0"
     },
+    autoUpdate: {
+      enabled: true,
+      intervalHours: 6
+    },
     databasePath: "./sparkecoder.db"
   };
 }
@@ -1604,6 +1651,7 @@ var init_config = __esm({
       openai: "OPENAI_API_KEY",
       google: "GOOGLE_GENERATIVE_AI_API_KEY",
       xai: "XAI_API_KEY",
+      litellm: "LITELLM_API_KEY",
       "ai-gateway": "AI_GATEWAY_API_KEY"
     };
     SUPPORTED_PROVIDERS = Object.keys(PROVIDER_ENV_MAP);
@@ -4846,11 +4894,11 @@ async function getRepoNamespace(workingDirectory, configuredNamespace) {
   if (configuredNamespace) {
     return configuredNamespace;
   }
-  const remoteUrl = getGitRemoteUrl(workingDirectory);
-  if (!remoteUrl) {
+  const remoteUrl2 = getGitRemoteUrl(workingDirectory);
+  if (!remoteUrl2) {
     return null;
   }
-  const parsed = parseGitRemoteUrl(remoteUrl);
+  const parsed = parseGitRemoteUrl(remoteUrl2);
   if (!parsed) {
     return null;
   }
@@ -5449,7 +5497,7 @@ function isPathExcluded(relativePath, exclude) {
 }
 async function walkDirectory(dir, include, exclude, baseDir) {
   const { readdirSync: readdirSync4 } = await import("fs");
-  const { join: join19, relative: relative10 } = await import("path");
+  const { join: join21, relative: relative10 } = await import("path");
   const files = [];
   function walk(currentDir) {
     let entries;
@@ -5459,7 +5507,7 @@ async function walkDirectory(dir, include, exclude, baseDir) {
       return;
     }
     for (const entry2 of entries) {
-      const fullPath = join19(currentDir, entry2.name);
+      const fullPath = join21(currentDir, entry2.name);
       const relativePath = relative10(baseDir, fullPath);
       if (isPathExcluded(relativePath, exclude)) {
         continue;
@@ -7289,7 +7337,8 @@ async function buildSystemPrompt(options) {
     sessionId,
     discoveredSkills,
     activeFiles = [],
-    customInstructions
+    customInstructions,
+    taskScopedSkills
   } = options;
   let alwaysLoadedContent = "";
   let globMatchedContent = "";
@@ -7310,6 +7359,22 @@ async function buildSystemPrompt(options) {
     const skills2 = await loadAllSkills2(skillsDirectories);
     onDemandSkillsContext = formatSkillsForContext(skills2);
   }
+  let taskScopedSkillsBlock = "";
+  if (taskScopedSkills && (taskScopedSkills.always.length > 0 || taskScopedSkills.onDemand.length > 0)) {
+    const parts = ["<task_provided_skills>"];
+    parts.push("These skills were supplied with this task and are available for this run only.");
+    if (taskScopedSkills.always.length > 0) {
+      parts.push(formatAlwaysLoadedSkills(taskScopedSkills.always));
+    }
+    if (taskScopedSkills.onDemand.length > 0) {
+      parts.push("Load any of these on demand with the load_skill tool:");
+      for (const s of taskScopedSkills.onDemand) {
+        parts.push(`- ${s.name}: ${s.description}`);
+      }
+    }
+    parts.push("</task_provided_skills>");
+    taskScopedSkillsBlock = parts.join("\n");
+  }
   const todos = await todoQueries.getBySession(sessionId);
   const todosContext = formatTodosForContext(todos);
   const plans = await readSessionPlans(workingDirectory, sessionId);
@@ -7602,6 +7667,8 @@ ${globMatchedContent}
 ${onDemandSkillsContext}
 </on_demand_skills>
 
+${taskScopedSkillsBlock}
+
 <current_task_list>
 ${todosContext}
 </current_task_list>
@@ -8223,6 +8290,111 @@ var init_sanitize_messages = __esm({
   }
 });
 
+// src/utils/cap-image-count.ts
+function isImagePart(part) {
+  if (!part || typeof part !== "object") return false;
+  const t = part.type;
+  if (t === "image") return true;
+  if (t === "image-data") return true;
+  if (t === "media") {
+    const data = part.data;
+    const mt = part.mediaType;
+    if (typeof data === "string" && typeof mt === "string" && mt.startsWith("image/")) {
+      return true;
+    }
+  }
+  return false;
+}
+function makePlaceholder() {
+  return { type: "text", text: IMAGE_TRUNCATED_PLACEHOLDER };
+}
+function countImages(messages) {
+  let n = 0;
+  for (const msg of messages) {
+    if (!Array.isArray(msg.content)) continue;
+    for (const part of msg.content) {
+      if (isImagePart(part)) {
+        n++;
+        continue;
+      }
+      if (part && typeof part === "object" && part.type === "tool-result" && part.output && part.output.type === "content" && Array.isArray(part.output.value)) {
+        for (const sub of part.output.value) {
+          if (isImagePart(sub)) n++;
+        }
+      }
+    }
+  }
+  return n;
+}
+function capImageCount(messages, max = MAX_IMAGES_IN_CONTEXT) {
+  if (!Array.isArray(messages) || messages.length === 0) return messages;
+  if (max < 0) throw new Error("capImageCount: max must be >= 0");
+  const total = countImages(messages);
+  if (total <= max) return messages;
+  let toDrop = total - max;
+  let mutated = false;
+  const out = messages.slice();
+  for (let i = 0; i < out.length && toDrop > 0; i++) {
+    const msg = out[i];
+    if (!Array.isArray(msg.content)) continue;
+    let contentCloned = false;
+    const ensureContentCloned = () => {
+      if (contentCloned) return;
+      out[i] = { ...msg, content: [...msg.content] };
+      contentCloned = true;
+    };
+    const content = () => out[i].content;
+    for (let j = 0; j < content().length && toDrop > 0; j++) {
+      const part = content()[j];
+      if (isImagePart(part)) {
+        ensureContentCloned();
+        out[i].content[j] = makePlaceholder();
+        toDrop--;
+        mutated = true;
+        continue;
+      }
+      if (part && typeof part === "object" && part.type === "tool-result" && part.output && part.output.type === "content" && Array.isArray(part.output.value)) {
+        const innerImages = [];
+        const innerValue = part.output.value;
+        for (let k = 0; k < innerValue.length; k++) {
+          if (isImagePart(innerValue[k])) innerImages.push(k);
+        }
+        if (innerImages.length === 0) continue;
+        const dropHere = Math.min(innerImages.length, toDrop);
+        ensureContentCloned();
+        const newOutputValue = [...innerValue];
+        for (let d = 0; d < dropHere; d++) {
+          newOutputValue[innerImages[d]] = makePlaceholder();
+        }
+        const newPart = {
+          ...part,
+          output: {
+            ...part.output,
+            value: newOutputValue
+          }
+        };
+        out[i].content[j] = newPart;
+        toDrop -= dropHere;
+        mutated = true;
+      }
+    }
+  }
+  if (mutated) {
+    console.warn(
+      `[cap-image-count] Replaced ${total - max} oldest image(s) with text placeholder (total=${total}, kept=${max}). This prevents request-too-large errors at the model / tunnel layer.`
+    );
+  }
+  return mutated ? out : messages;
+}
+var MAX_IMAGES_IN_CONTEXT, IMAGE_TRUNCATED_PLACEHOLDER;
+var init_cap_image_count = __esm({
+  "src/utils/cap-image-count.ts"() {
+    "use strict";
+    MAX_IMAGES_IN_CONTEXT = 11;
+    IMAGE_TRUNCATED_PLACEHOLDER = "[image truncated due to length of conversation]";
+  }
+});
+
 // src/agent/model-limits.ts
 function getModelLimits(modelId) {
   const normalized = modelId.trim().toLowerCase();
@@ -8238,18 +8410,9 @@ var init_model_limits = __esm({
   "src/agent/model-limits.ts"() {
     "use strict";
     MODEL_LIMITS = {
-      "anthropic/claude-opus-4.7": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "anthropic/claude-opus-4-6": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "anthropic/claude-sonnet-4": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "anthropic/claude-3.5-sonnet": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "anthropic/claude-3-haiku": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "google/gemini-3-flash-preview": { contextWindow: 1e6, rollingTarget: 15e4 },
-      "google/gemini-2.5-pro": { contextWindow: 1e6, rollingTarget: 15e4 },
-      "google/gemini-2.5-flash": { contextWindow: 1e6, rollingTarget: 15e4 },
-      "openai/gpt-4o": { contextWindow: 128e3, rollingTarget: 78e3 },
-      "openai/gpt-4.1": { contextWindow: 1e6, rollingTarget: 15e4 },
-      "openai/o3": { contextWindow: 2e5, rollingTarget: 15e4 },
-      "xai/grok-3": { contextWindow: 131072, rollingTarget: 8e4 }
+      "claude-opus-4-8": { contextWindow: 2e5, rollingTarget: 15e4 },
+      "gpt-5.5": { contextWindow: 35e4, rollingTarget: 15e4 },
+      "claude-fable-5": { contextWindow: 2e5, rollingTarget: 15e4 }
     };
     DEFAULT_LIMITS = { contextWindow: 2e5, rollingTarget: 15e4 };
     PREFIX_DEFAULTS = {
@@ -8323,6 +8486,32 @@ var init_conversation_archive = __esm({
 
 // src/agent/context.ts
 import { generateText as generateText2 } from "ai";
+function stripBinaryContentForSummary(value) {
+  if (Array.isArray(value)) return value.map(stripBinaryContentForSummary);
+  if (!value || typeof value !== "object") return value;
+  const record = value;
+  const type = record.type;
+  if ((type === "image-data" || type === "file-data" || type === "media") && typeof record.data === "string") {
+    const mediaType = typeof record.mediaType === "string" ? record.mediaType : "unknown media type";
+    const filename = typeof record.filename === "string" ? ` ${record.filename}` : "";
+    return {
+      ...record,
+      data: `[${type}${filename}; ${mediaType}; ${record.data.length} base64 chars omitted for summary]`
+    };
+  }
+  if (type === "image" && typeof record.image === "string") {
+    const filename = typeof record.filename === "string" ? ` ${record.filename}` : "";
+    return {
+      ...record,
+      image: `[image${filename}; ${record.image.length} base64 chars omitted for summary]`
+    };
+  }
+  const out = {};
+  for (const [key2, nested] of Object.entries(record)) {
+    out[key2] = stripBinaryContentForSummary(nested);
+  }
+  return out;
+}
 function stripOrphanedToolResults(msg, removedIds) {
   if (!Array.isArray(msg.content)) return msg;
   const parts = msg.content.filter((part) => {
@@ -8483,6 +8672,7 @@ var init_context = __esm({
     init_tokens();
     init_prompts();
     init_sanitize_messages();
+    init_cap_image_count();
     init_model_limits();
     TOOL_OUTPUT_TRIM_CHARS = 400;
     COMPACTABLE_TOOLS = /* @__PURE__ */ new Set([
@@ -8532,6 +8722,7 @@ ${summaryContent}`
         messages = repairToolPairing(messages);
         messages = ensureToolResultsFollowCalls(messages);
         messages = ensureEndsWithUserOrTool(messages);
+        messages = capImageCount(messages);
         return messages;
       }
       // ---------------------------------------------------------------------------
@@ -8649,7 +8840,7 @@ ${summaryContent}`
       }
       async summarizeChunk(chunk) {
         const historyText = chunk.map((msg) => {
-          const content = typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content);
+          const content = typeof msg.content === "string" ? msg.content : JSON.stringify(stripBinaryContentForSummary(msg.content));
           return `[${msg.role}]: ${content}`;
         }).join("\n\n");
         try {
@@ -8897,6 +9088,127 @@ var init_persistence = __esm({
 });
 
 // src/integrations/slack/client.ts
+var client_exports = {};
+__export(client_exports, {
+  LOADING_REACTION: () => LOADING_REACTION,
+  RESULT_REACTIONS: () => RESULT_REACTIONS,
+  addLoadingReaction: () => addLoadingReaction,
+  addResultReaction: () => addResultReaction,
+  botParticipatedInThread: () => botParticipatedInThread,
+  ensureSlackSelfIdentity: () => ensureSlackSelfIdentity,
+  getCachedSlackSelfIdentity: () => getCachedSlackSelfIdentity,
+  getDefaultOrchestratorName: () => getDefaultOrchestratorName,
+  getSlackAdapter: () => getSlackAdapter,
+  getSlackAllowlistPolicy: () => getSlackAllowlistPolicy,
+  getSlackBotToken: () => getSlackBotToken,
+  getSlackDeniedReplyPolicy: () => getSlackDeniedReplyPolicy,
+  getSlackSigningSecret: () => getSlackSigningSecret,
+  isSlackConfigured: () => isSlackConfigured,
+  normalizeSlackMentions: () => normalizeSlackMentions,
+  noteBotPostedInThread: () => noteBotPostedInThread,
+  postThreadMessage: () => postThreadMessage,
+  removeLoadingReaction: () => removeLoadingReaction,
+  resolveSlackUserInfo: () => resolveSlackUserInfo,
+  resolveSlackUserName: () => resolveSlackUserName
+});
+function slackBackoffMs(attempt) {
+  const expo = SLACK_BACKOFF_BASE_MS * 2 ** attempt;
+  const jitter = Math.floor(Math.random() * SLACK_BACKOFF_BASE_MS);
+  return Math.min(expo + jitter, SLACK_BACKOFF_CAP_MS);
+}
+async function slackFetchWithRetry(url, init, attempts = SLACK_FETCH_ATTEMPTS) {
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    const isLast = i === attempts - 1;
+    try {
+      const res = await fetch(url, init);
+      if ((res.status === 429 || res.status >= 500) && !isLast) {
+        const ra = Number(res.headers.get("retry-after"));
+        const waitMs = Number.isFinite(ra) && ra > 0 ? Math.min(ra * 1e3, SLACK_BACKOFF_CAP_MS) : slackBackoffMs(i);
+        await new Promise((r) => setTimeout(r, waitMs));
+        continue;
+      }
+      return res;
+    } catch (err) {
+      lastErr = err;
+      if (isLast) throw err;
+      await new Promise((r) => setTimeout(r, slackBackoffMs(i)));
+    }
+  }
+  throw lastErr ?? new Error("slack fetch failed");
+}
+function reactionKey(channel, ts) {
+  return `${channel}\u241F${ts}`;
+}
+async function addLoadingReaction(channel, timestamp) {
+  const adapter = getSlackAdapter();
+  if (!adapter) return { ok: false, error: "slack_not_configured" };
+  const key2 = reactionKey(channel, timestamp);
+  const inFlight = (async () => {
+    try {
+      const res = await adapter.addReaction({ channel, timestamp, name: LOADING_REACTION });
+      if (!res.ok && !REACTION_SOFT_ERRORS.has(res.error || "")) {
+        console.warn(`[slack] addReaction ${LOADING_REACTION} failed on ${channel}/${timestamp}: ${res.error}`);
+      }
+      return res;
+    } catch (err) {
+      console.warn(`[slack] addReaction threw on ${channel}/${timestamp}:`, err?.message || err);
+      return { ok: false, error: err?.message || "unknown" };
+    }
+  })();
+  pendingAdds.set(key2, inFlight);
+  void inFlight.finally(() => {
+    if (pendingAdds.get(key2) === inFlight) pendingAdds.delete(key2);
+  });
+  return inFlight;
+}
+async function removeLoadingReaction(channel, timestamp) {
+  const adapter = getSlackAdapter();
+  if (!adapter) return { ok: false, error: "slack_not_configured" };
+  const pending = pendingAdds.get(reactionKey(channel, timestamp));
+  if (pending) {
+    try {
+      await pending;
+    } catch {
+    }
+  }
+  try {
+    const res = await adapter.removeReaction({ channel, timestamp, name: LOADING_REACTION });
+    if (!res.ok && !REACTION_SOFT_ERRORS.has(res.error || "")) {
+      console.warn(`[slack] removeReaction ${LOADING_REACTION} failed on ${channel}/${timestamp}: ${res.error}`);
+    }
+    return res;
+  } catch (err) {
+    console.warn(`[slack] removeReaction threw on ${channel}/${timestamp}:`, err?.message || err);
+    return { ok: false, error: err?.message || "unknown" };
+  }
+}
+async function addResultReaction(channel, timestamp, state2) {
+  const name = RESULT_REACTIONS[state2];
+  if (!name) return { ok: false, error: `no_reaction_for_state:${state2}` };
+  const adapter = getSlackAdapter();
+  if (!adapter) return { ok: false, error: "slack_not_configured" };
+  try {
+    const res = await adapter.addReaction({ channel, timestamp, name });
+    if (!res.ok && !REACTION_SOFT_ERRORS.has(res.error || "")) {
+      console.warn(`[slack] addReaction ${name} failed on ${channel}/${timestamp}: ${res.error}`);
+    }
+    return res;
+  } catch (err) {
+    console.warn(`[slack] addResultReaction threw on ${channel}/${timestamp}:`, err?.message || err);
+    return { ok: false, error: err?.message || "unknown" };
+  }
+}
+async function postThreadMessage(channel, threadTs, text) {
+  const adapter = getSlackAdapter();
+  if (!adapter) return { ok: false, error: "slack_not_configured" };
+  try {
+    return await adapter.postMessage({ channel, text, threadTs });
+  } catch (err) {
+    console.warn(`[slack] postThreadMessage threw on ${channel}/${threadTs}:`, err?.message || err);
+    return { ok: false, error: err?.message || "unknown" };
+  }
+}
 function readSlackConfig() {
   try {
     const cfg = getConfig();
@@ -8914,9 +9226,25 @@ function readSlackConfig() {
 function getSlackAdapter() {
   const cfg = readSlackConfig();
   if (!cfg) return void 0;
+  const slackForm = async (endpoint, params) => {
+    const body = new URLSearchParams(params).toString();
+    const res = await fetch(`https://slack.com/api/${endpoint}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
+        Authorization: `Bearer ${cfg.botToken}`
+      },
+      body
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || data?.ok === false) {
+      return { ok: false, error: data?.error || `HTTP ${res.status}` };
+    }
+    return { ok: true };
+  };
   return {
     async postMessage({ channel, text, threadTs }) {
-      const res = await fetch("https://slack.com/api/chat.postMessage", {
+      const res = await slackFetchWithRetry("https://slack.com/api/chat.postMessage", {
         method: "POST",
         headers: {
           "Content-Type": "application/json; charset=utf-8",
@@ -8929,6 +9257,12 @@ function getSlackAdapter() {
         return { ok: false, error: data?.error || `HTTP ${res.status}` };
       }
       return { ok: true, ts: data?.ts };
+    },
+    addReaction({ channel, timestamp, name }) {
+      return slackForm("reactions.add", { channel, timestamp, name });
+    },
+    removeReaction({ channel, timestamp, name }) {
+      return slackForm("reactions.remove", { channel, timestamp, name });
     }
   };
 }
@@ -9129,12 +9463,31 @@ function getSlackDeniedReplyPolicy() {
     return { enabled: true, template: DEFAULT_DENIED_TEMPLATE };
   }
 }
-var cachedSelf, selfInflight, USER_TTL_MS, USER_FAIL_TTL_MS, userInflight, THREAD_OWNED_TTL_MS, THREAD_NEG_TTL_MS, threadOwnedInflight, DEFAULT_DENIED_TEMPLATE;
+var LOADING_REACTION, RESULT_REACTIONS, SLACK_FETCH_ATTEMPTS, SLACK_BACKOFF_BASE_MS, SLACK_BACKOFF_CAP_MS, REACTION_SOFT_ERRORS, pendingAdds, cachedSelf, selfInflight, USER_TTL_MS, USER_FAIL_TTL_MS, userInflight, THREAD_OWNED_TTL_MS, THREAD_NEG_TTL_MS, threadOwnedInflight, DEFAULT_DENIED_TEMPLATE;
 var init_client3 = __esm({
   "src/integrations/slack/client.ts"() {
     "use strict";
     init_config();
     init_persistence();
+    LOADING_REACTION = "hourglass_flowing_sand";
+    RESULT_REACTIONS = {
+      responded: "white_check_mark",
+      skipped: "zzz",
+      handed_off: "eyes",
+      failed: "warning"
+    };
+    SLACK_FETCH_ATTEMPTS = 3;
+    SLACK_BACKOFF_BASE_MS = 400;
+    SLACK_BACKOFF_CAP_MS = 3e4;
+    REACTION_SOFT_ERRORS = /* @__PURE__ */ new Set([
+      "already_reacted",
+      // add: someone (or we) already added this emoji
+      "no_reaction",
+      // remove: the emoji isn't on the message
+      "message_not_found"
+      // remove/add: original message deleted
+    ]);
+    pendingAdds = /* @__PURE__ */ new Map();
     cachedSelf = null;
     selfInflight = null;
     USER_TTL_MS = 60 * 60 * 1e3;
@@ -9147,83 +9500,541 @@ var init_client3 = __esm({
   }
 });
 
-// src/integrations/channels/slack.ts
-function threadKey(channel, threadTs) {
-  return `${channel}\u241F${threadTs}`;
-}
-function markThreadOwned(channel, threadTs) {
-  ownedThreads.add(threadKey(channel, threadTs));
-}
-function isThreadOwned(channel, threadTs) {
-  return ownedThreads.has(threadKey(channel, threadTs));
+// src/agent/session-lock.ts
+async function withSessionLock(sessionId, fn) {
+  let state2 = locks.get(sessionId);
+  if (!state2) {
+    state2 = { tail: Promise.resolve(), pending: 0 };
+    locks.set(sessionId, state2);
+  }
+  state2.pending++;
+  const prev = state2.tail;
+  let release;
+  const next = new Promise((resolve14) => {
+    release = resolve14;
+  });
+  state2.tail = prev.then(() => next);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+    state2.pending--;
+    if (state2.pending === 0 && locks.get(sessionId) === state2) {
+      locks.delete(sessionId);
+    }
+  }
 }
-function isSelfAuthored(event, self) {
-  if (!self) return true;
-  if (self.botId && event.bot_id && event.bot_id === self.botId) return true;
-  if (self.botUserId && event.user && event.user === self.botUserId) return true;
-  return false;
+function isSessionLocked(sessionId) {
+  const s = locks.get(sessionId);
+  return !!s && s.pending > 0;
 }
-function slackEventToInboundResult(event, opts = {}) {
-  if (!event) return { event: null, dropReason: "empty_text" };
-  const self = opts.self ?? getCachedSlackSelfIdentity();
-  const isBotAuthored = !!event.bot_id || event.type === "message" && event.subtype === "bot_message";
-  if (isBotAuthored && isSelfAuthored(event, self)) {
-    return { event: null, dropReason: "bot_message" };
-  }
-  if (event.type === "message" && event.subtype && IGNORED_MESSAGE_SUBTYPES.has(event.subtype)) {
-    return { event: null, dropReason: "ignored_subtype" };
+var locks;
+var init_session_lock = __esm({
+  "src/agent/session-lock.ts"() {
+    "use strict";
+    locks = /* @__PURE__ */ new Map();
   }
-  const isDm = event.type === "message" && event.channel_type === "im";
-  const isThreadReply = event.type === "message" && !isDm && typeof event.thread_ts === "string" && event.thread_ts !== event.ts;
-  const isNonThreadChannelMsg = event.type === "message" && !isDm && !isThreadReply && (event.channel_type === "channel" || event.channel_type === "group" || event.channel_type === "mpim" || // Some payload shapes omit channel_type for channel messages.
-  typeof event.channel === "string");
-  if (event.type !== "app_mention" && !isDm && !isThreadReply) {
-    if (isNonThreadChannelMsg) {
-      return { event: null, dropReason: "non_thread_channel_msg" };
+});
+
+// src/orchestrator/webhook-events.ts
+import { existsSync as existsSync17, readFileSync as readFileSync8, appendFileSync as appendFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync7 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
+import { nanoid as nanoid4 } from "nanoid";
+function logFilePath() {
+  return join10(getAppDataDirectory(), "webhook-events.jsonl");
+}
+function ensureLoaded() {
+  if (cache !== null) return cache;
+  cache = [];
+  try {
+    const p = logFilePath();
+    if (!existsSync17(p)) return cache;
+    const lines = readFileSync8(p, "utf-8").split("\n").filter(Boolean);
+    for (const line of lines) {
+      try {
+        cache.push(JSON.parse(line));
+      } catch {
+      }
     }
-    if (event.type !== "message") {
-      return { event: null, dropReason: "non_message_event" };
+    if (cache.length > MAX_EVENTS) {
+      cache = cache.slice(-MAX_EVENTS);
+      try {
+        writeFileSync4(p, cache.map((e) => JSON.stringify(e)).join("\n") + "\n");
+      } catch {
+      }
     }
-    return { event: null, dropReason: "unsupported_type" };
+  } catch {
   }
-  const text = (event.text ?? "").trim();
-  if (!text) return { event: null, dropReason: "empty_text" };
-  const policy = getSlackAllowlistPolicy();
-  const userAllowlistActive = policy.allowedUsers.length > 0;
-  const userOk = !userAllowlistActive || event.user && policy.allowedUsers.includes(event.user);
-  if (isDm) {
-    if (!policy.allowDmsFromAnyone && !(event.user && policy.allowedUsers.includes(event.user))) {
-      return { event: null, dropReason: "dm_blocked" };
-    }
-  } else {
-    const channelAllowlistActive = policy.allowedChannels.length > 0;
-    if (channelAllowlistActive && !policy.allowedChannels.includes(event.channel)) {
-      return { event: null, dropReason: "channel_not_allowed" };
-    }
-    if (!userOk) {
-      return { event: null, dropReason: "user_not_allowed" };
-    }
+  return cache;
+}
+function appendEvent(ev) {
+  const list = ensureLoaded();
+  list.push(ev);
+  if (list.length > MAX_EVENTS) list.shift();
+  try {
+    const p = logFilePath();
+    mkdirSync7(dirname7(p), { recursive: true });
+    appendFileSync3(p, JSON.stringify(ev) + "\n");
+  } catch {
   }
-  const ref = {
-    channel: "slack",
-    slackChannel: event.channel,
-    threadTs: event.thread_ts || event.ts,
-    teamId: event.team,
-    user: event.user
-  };
-  const label = slackChannel.displayLabel(ref);
-  return {
-    event: {
-      ref,
-      content: `[${label}] ${text}`,
-      wake: "now",
-      enqueuedAt: /* @__PURE__ */ new Date()
-    }
-  };
 }
-var ownedThreads, slackChannel, IGNORED_MESSAGE_SUBTYPES;
-var init_slack = __esm({
-  "src/integrations/channels/slack.ts"() {
+function recordEvent(ev) {
+  const full = {
+    id: ev.id ?? nanoid4(),
+    ts: ev.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: ev.source,
+    status: ev.status,
+    subtype: ev.subtype,
+    channel: ev.channel,
+    user: ev.user,
+    textSnippet: ev.textSnippet?.slice(0, 200),
+    dropReason: ev.dropReason,
+    error: ev.error,
+    sessionId: ev.sessionId,
+    durationMs: ev.durationMs,
+    meta: ev.meta
+  };
+  appendEvent(full);
+  return full.id;
+}
+function updateEvent(id, patch) {
+  const list = ensureLoaded();
+  const i = list.findIndex((e) => e.id === id);
+  if (i < 0) return;
+  list[i] = { ...list[i], ...patch };
+  try {
+    const p = logFilePath();
+    mkdirSync7(dirname7(p), { recursive: true });
+    writeFileSync4(p, list.map((e) => JSON.stringify(e)).join("\n") + "\n");
+  } catch {
+  }
+}
+function listEvents(filter = {}) {
+  const list = ensureLoaded();
+  const q = filter.q?.toLowerCase();
+  const sinceTs = filter.since ? Date.parse(filter.since) : -Infinity;
+  const beforeTs = filter.before ? Date.parse(filter.before) : Infinity;
+  const matched = list.filter((e) => {
+    if (filter.source && e.source !== filter.source) return false;
+    if (filter.status && e.status !== filter.status) return false;
+    const t = Date.parse(e.ts);
+    if (t < sinceTs) return false;
+    if (t >= beforeTs) return false;
+    if (q) {
+      const hay = `${e.channel ?? ""} ${e.user ?? ""} ${e.textSnippet ?? ""} ${e.dropReason ?? ""} ${e.error ?? ""} ${e.subtype ?? ""}`.toLowerCase();
+      if (!hay.includes(q)) return false;
+    }
+    return true;
+  });
+  matched.reverse();
+  const offset = Math.max(0, filter.offset ?? 0);
+  const limit = Math.min(500, Math.max(1, filter.limit ?? 50));
+  return {
+    events: matched.slice(offset, offset + limit),
+    total: matched.length
+  };
+}
+function clearAllEvents() {
+  cache = [];
+  try {
+    writeFileSync4(logFilePath(), "");
+  } catch {
+  }
+}
+var MAX_EVENTS, cache;
+var init_webhook_events = __esm({
+  "src/orchestrator/webhook-events.ts"() {
+    "use strict";
+    init_config();
+    MAX_EVENTS = 1e3;
+    cache = null;
+  }
+});
+
+// src/orchestrator/inbox.ts
+var inbox_exports = {};
+__export(inbox_exports, {
+  clearInbox: () => clearInbox,
+  flush: () => flush,
+  peekInbox: () => peekInbox,
+  pushToInbox: () => pushToInbox,
+  setFlushHandler: () => setFlushHandler
+});
+function setFlushHandler(fn) {
+  flushHandler = fn;
+}
+function entryFor(sessionId) {
+  let e = inboxes.get(sessionId);
+  if (!e) {
+    e = { pending: [] };
+    inboxes.set(sessionId, e);
+  }
+  return e;
+}
+function pushToInbox(orchestratorSessionId, event) {
+  const e = entryFor(orchestratorSessionId);
+  e.pending.push(event);
+  try {
+    trackInbound(orchestratorSessionId, event);
+  } catch {
+  }
+  if (event.wake === "now") {
+    scheduleFlush(orchestratorSessionId);
+  }
+}
+function scheduleFlush(sessionId) {
+  const e = inboxes.get(sessionId);
+  if (!e) return;
+  if (e.timer) clearTimeout(e.timer);
+  e.timer = setTimeout(() => {
+    void flush(sessionId);
+  }, FLUSH_DEBOUNCE_MS);
+}
+async function flush(sessionId) {
+  const e = inboxes.get(sessionId);
+  if (!e) return;
+  if (e.timer) {
+    clearTimeout(e.timer);
+    e.timer = void 0;
+  }
+  const events = e.pending.splice(0);
+  if (events.length === 0) return;
+  if (!flushHandler) {
+    console.warn("[orchestrator-inbox] flush called with no handler installed; dropping events");
+    return;
+  }
+  try {
+    await flushHandler(sessionId, events);
+  } catch (err) {
+    console.error("[orchestrator-inbox] flush handler threw:", err?.message || err);
+  }
+}
+function peekInbox(sessionId) {
+  return inboxes.get(sessionId)?.pending.slice() ?? [];
+}
+function clearInbox(sessionId) {
+  const e = inboxes.get(sessionId);
+  if (!e) return;
+  if (e.timer) {
+    clearTimeout(e.timer);
+    e.timer = void 0;
+  }
+  e.pending.length = 0;
+}
+var inboxes, FLUSH_DEBOUNCE_MS, flushHandler;
+var init_inbox = __esm({
+  "src/orchestrator/inbox.ts"() {
+    "use strict";
+    init_inbox_acks();
+    inboxes = /* @__PURE__ */ new Map();
+    FLUSH_DEBOUNCE_MS = 200;
+    flushHandler = null;
+  }
+});
+
+// src/orchestrator/inbox-acks.ts
+var inbox_acks_exports = {};
+__export(inbox_acks_exports, {
+  MAX_ATTEMPTS: () => MAX_ATTEMPTS,
+  RECONCILE_EVERY_MS: () => RECONCILE_EVERY_MS,
+  REPLAY_AFTER_MS: () => REPLAY_AFTER_MS,
+  __getAck: () => __getAck,
+  __listAcks: () => __listAcks,
+  __resetAcks: () => __resetAcks,
+  eventKey: () => eventKey,
+  markRespondedForThread: () => markRespondedForThread,
+  markState: () => markState,
+  reconcileOnce: () => reconcileOnce,
+  resolveBatchOnTurnEnd: () => resolveBatchOnTurnEnd,
+  startReconciler: () => startReconciler,
+  stopReconciler: () => stopReconciler,
+  trackInbound: () => trackInbound
+});
+function eventKey(event) {
+  const ref = event.ref;
+  const ch = ref?.channel ?? "unknown";
+  switch (ch) {
+    case "slack":
+      return `slack${SEP}${ref.slackChannel}${SEP}${ref.messageTs ?? ref.threadTs ?? ""}`;
+    case "system":
+      return `system${SEP}${ref.workerId}${SEP}${ref.kind}`;
+    case "webhook":
+      return `webhook${SEP}${ref.webhookId}${SEP}${event.enqueuedAt instanceof Date ? event.enqueuedAt.getTime() : Date.now()}`;
+    case "schedule":
+      return `schedule${SEP}${ref.scheduleId}${SEP}${event.enqueuedAt instanceof Date ? event.enqueuedAt.getTime() : Date.now()}`;
+    default:
+      return `${ch}${SEP}${event.enqueuedAt instanceof Date ? event.enqueuedAt.getTime() : Date.now()}${SEP}${event.content.slice(0, 40)}`;
+  }
+}
+function trackInbound(sessionId, event) {
+  if (event.wake === "never") return null;
+  const key2 = eventKey(event);
+  const existing = ledger.get(key2);
+  if (existing) return key2;
+  const ref = event.ref;
+  const now = Date.now();
+  const entry2 = {
+    key: key2,
+    sessionId,
+    event,
+    channel: ref?.channel ?? "unknown",
+    state: "working",
+    attempts: 0,
+    trackedAt: now,
+    updatedAt: now
+  };
+  if (ref?.channel === "slack") {
+    entry2.slackChannel = ref.slackChannel;
+    entry2.threadTs = ref.threadTs;
+    entry2.messageTs = ref.messageTs;
+  }
+  ledger.set(key2, entry2);
+  if (ledger.size > MAX_ENTRIES) pruneOldest();
+  return key2;
+}
+function markState(key2, state2) {
+  const entry2 = ledger.get(key2);
+  if (!entry2) return;
+  if (TERMINAL.has(entry2.state)) return;
+  entry2.state = state2;
+  entry2.updatedAt = Date.now();
+  if (entry2.channel === "slack" && entry2.slackChannel && entry2.messageTs) {
+    fireResultReaction(entry2.slackChannel, entry2.messageTs, state2);
+  }
+}
+function markRespondedForThread(slackChannel2, threadTs) {
+  if (!slackChannel2 || !threadTs) return;
+  for (const entry2 of ledger.values()) {
+    if (entry2.channel === "slack" && entry2.state === "working" && entry2.slackChannel === slackChannel2 && entry2.threadTs === threadTs) {
+      markState(entry2.key, "responded");
+    }
+  }
+}
+function resolveBatchOnTurnEnd(events, ok) {
+  if (!ok) return;
+  for (const ev of events) {
+    const key2 = eventKey(ev);
+    const entry2 = ledger.get(key2);
+    if (!entry2 || entry2.state !== "working") continue;
+    if (entry2.channel === "slack") continue;
+    markState(key2, "responded");
+  }
+}
+async function reconcileOnce(now = Date.now()) {
+  let pushToInbox2 = null;
+  const toReplay = [];
+  for (const entry2 of ledger.values()) {
+    if (TERMINAL.has(entry2.state)) {
+      if (now - entry2.updatedAt > PRUNE_AFTER_MS) ledger.delete(entry2.key);
+      continue;
+    }
+    if (isSessionLocked(entry2.sessionId)) continue;
+    if (now - entry2.updatedAt < REPLAY_AFTER_MS) continue;
+    if (entry2.attempts >= MAX_ATTEMPTS) {
+      failEntry(entry2);
+      continue;
+    }
+    toReplay.push(entry2);
+  }
+  if (toReplay.length === 0) return;
+  try {
+    ({ pushToInbox: pushToInbox2 } = await Promise.resolve().then(() => (init_inbox(), inbox_exports)));
+  } catch {
+    return;
+  }
+  for (const entry2 of toReplay) {
+    entry2.attempts += 1;
+    entry2.updatedAt = Date.now();
+    const nudged = {
+      ...entry2.event,
+      content: `[REPLAY attempt ${entry2.attempts}/${MAX_ATTEMPTS} \u2014 you received this but have not yet replied to it or marked it handled. Respond now on the originating channel; if it genuinely needs no reply, you can ignore it.]
+${entry2.event.content}`,
+      wake: "now"
+    };
+    try {
+      pushToInbox2(entry2.sessionId, nudged);
+    } catch {
+    }
+  }
+}
+function failEntry(entry2) {
+  entry2.state = "failed";
+  entry2.updatedAt = Date.now();
+  if (entry2.channel === "slack" && entry2.slackChannel && entry2.messageTs) {
+    fireResultReaction(entry2.slackChannel, entry2.messageTs, "failed");
+    if (entry2.threadTs) {
+      fireFallback(
+        entry2.slackChannel,
+        entry2.threadTs,
+        `:warning: I wasn't able to handle this after ${entry2.attempts} attempt(s). It may need a human \u2014 flagging it here so it isn't lost.`
+      );
+    }
+  }
+  recordEvent({
+    source: "daemon",
+    status: "failed",
+    channel: entry2.channel,
+    sessionId: entry2.sessionId,
+    error: `unacknowledged after ${entry2.attempts} replay attempt(s)`,
+    textSnippet: entry2.event.content.slice(0, 200),
+    meta: { ackKey: entry2.key, ackState: "failed" }
+  });
+}
+function pruneOldest() {
+  const terminal = [];
+  for (const e of ledger.values()) if (TERMINAL.has(e.state)) terminal.push(e);
+  terminal.sort((a, b) => a.updatedAt - b.updatedAt);
+  for (const e of terminal) {
+    if (ledger.size <= MAX_ENTRIES) break;
+    ledger.delete(e.key);
+  }
+  while (ledger.size > MAX_ENTRIES) {
+    const oldest = ledger.keys().next().value;
+    if (!oldest) break;
+    ledger.delete(oldest);
+  }
+}
+function fireResultReaction(channel, ts, state2) {
+  if (typeof addResultReaction !== "function") return;
+  try {
+    void Promise.resolve(addResultReaction(channel, ts, state2)).catch(() => {
+    });
+  } catch {
+  }
+}
+function fireFallback(channel, threadTs, text) {
+  if (typeof postThreadMessage !== "function") return;
+  try {
+    void Promise.resolve(postThreadMessage(channel, threadTs, text)).catch(() => {
+    });
+  } catch {
+  }
+}
+function startReconciler() {
+  if (reconcileTimer) return;
+  reconcileTimer = setInterval(() => {
+    void reconcileOnce();
+  }, RECONCILE_EVERY_MS);
+  if (typeof reconcileTimer.unref === "function") reconcileTimer.unref();
+}
+function stopReconciler() {
+  if (reconcileTimer) {
+    clearInterval(reconcileTimer);
+    reconcileTimer = null;
+  }
+}
+function __getAck(key2) {
+  return ledger.get(key2);
+}
+function __listAcks() {
+  return [...ledger.values()];
+}
+function __resetAcks() {
+  ledger.clear();
+}
+var REPLAY_AFTER_MS, RECONCILE_EVERY_MS, MAX_ATTEMPTS, PRUNE_AFTER_MS, MAX_ENTRIES, TERMINAL, SEP, ledger, reconcileTimer;
+var init_inbox_acks = __esm({
+  "src/orchestrator/inbox-acks.ts"() {
+    "use strict";
+    init_session_lock();
+    init_webhook_events();
+    init_client3();
+    REPLAY_AFTER_MS = 3 * 6e4;
+    RECONCILE_EVERY_MS = 6e4;
+    MAX_ATTEMPTS = 2;
+    PRUNE_AFTER_MS = 60 * 6e4;
+    MAX_ENTRIES = 5e3;
+    TERMINAL = /* @__PURE__ */ new Set(["responded", "skipped", "handed_off", "failed"]);
+    SEP = "\u241F";
+    ledger = /* @__PURE__ */ new Map();
+    reconcileTimer = null;
+  }
+});
+
+// src/integrations/channels/slack.ts
+function threadKey(channel, threadTs) {
+  return `${channel}\u241F${threadTs}`;
+}
+function markThreadOwned(channel, threadTs) {
+  ownedThreads.add(threadKey(channel, threadTs));
+}
+function isThreadOwned(channel, threadTs) {
+  return ownedThreads.has(threadKey(channel, threadTs));
+}
+function isSelfAuthored(event, self) {
+  if (!self) return true;
+  if (self.botId && event.bot_id && event.bot_id === self.botId) return true;
+  if (self.botUserId && event.user && event.user === self.botUserId) return true;
+  return false;
+}
+function slackEventToInboundResult(event, opts = {}) {
+  if (!event) return { event: null, dropReason: "empty_text" };
+  const self = opts.self ?? getCachedSlackSelfIdentity();
+  const isBotAuthored = !!event.bot_id || event.type === "message" && event.subtype === "bot_message";
+  if (isBotAuthored && isSelfAuthored(event, self)) {
+    return { event: null, dropReason: "bot_message" };
+  }
+  if (event.type === "message" && event.subtype && IGNORED_MESSAGE_SUBTYPES.has(event.subtype)) {
+    return { event: null, dropReason: "ignored_subtype" };
+  }
+  const isDm = event.type === "message" && event.channel_type === "im";
+  const isThreadReply = event.type === "message" && !isDm && typeof event.thread_ts === "string" && event.thread_ts !== event.ts;
+  const isNonThreadChannelMsg = event.type === "message" && !isDm && !isThreadReply && (event.channel_type === "channel" || event.channel_type === "group" || event.channel_type === "mpim" || // Some payload shapes omit channel_type for channel messages.
+  typeof event.channel === "string");
+  if (event.type !== "app_mention" && !isDm && !isThreadReply) {
+    if (isNonThreadChannelMsg) {
+      return { event: null, dropReason: "non_thread_channel_msg" };
+    }
+    if (event.type !== "message") {
+      return { event: null, dropReason: "non_message_event" };
+    }
+    return { event: null, dropReason: "unsupported_type" };
+  }
+  const text = (event.text ?? "").trim();
+  const hasFiles = Array.isArray(event.files) && event.files.length > 0;
+  if (!text && !hasFiles) return { event: null, dropReason: "empty_text" };
+  const policy = getSlackAllowlistPolicy();
+  const userAllowlistActive = policy.allowedUsers.length > 0;
+  const userOk = !userAllowlistActive || event.user && policy.allowedUsers.includes(event.user);
+  if (isDm) {
+    if (!policy.allowDmsFromAnyone && !(event.user && policy.allowedUsers.includes(event.user))) {
+      return { event: null, dropReason: "dm_blocked" };
+    }
+  } else {
+    const channelAllowlistActive = policy.allowedChannels.length > 0;
+    if (channelAllowlistActive && !policy.allowedChannels.includes(event.channel)) {
+      return { event: null, dropReason: "channel_not_allowed" };
+    }
+    if (!userOk) {
+      return { event: null, dropReason: "user_not_allowed" };
+    }
+  }
+  const ref = {
+    channel: "slack",
+    slackChannel: event.channel,
+    // For thread replies, threadTs points at the parent (so our reply
+    // continues the thread). messageTs is the inbound message's own ts —
+    // used by reaction add/remove (which target the message itself, not
+    // its parent) and any future "edit this message" operations.
+    threadTs: event.thread_ts || event.ts,
+    messageTs: event.ts,
+    teamId: event.team,
+    user: event.user
+  };
+  const label = slackChannel.displayLabel(ref);
+  return {
+    event: {
+      ref,
+      content: `[${label}] ${text}`,
+      wake: "now",
+      enqueuedAt: /* @__PURE__ */ new Date()
+    }
+  };
+}
+var ownedThreads, slackChannel, IGNORED_MESSAGE_SUBTYPES;
+var init_slack = __esm({
+  "src/integrations/channels/slack.ts"() {
     "use strict";
     init_client3();
     ownedThreads = /* @__PURE__ */ new Set();
@@ -9243,6 +10054,8 @@ var init_slack = __esm({
         if (r.slackChannel && r.threadTs) {
           markThreadOwned(r.slackChannel, r.threadTs);
           noteBotPostedInThread(r.slackChannel, r.threadTs);
+          void Promise.resolve().then(() => (init_inbox_acks(), inbox_acks_exports)).then((m) => m.markRespondedForThread(r.slackChannel, r.threadTs)).catch(() => {
+          });
         }
       },
       displayLabel(ref) {
@@ -9275,8 +10088,14 @@ var init_slack = __esm({
       // also-broadcast-to-channel replies; the regular thread reply already fires
       "message_replied",
       // legacy parent-thread bump
-      "file_share",
-      // we'd handle these later; for now skip to avoid double-handling
+      // NOTE: `file_share` is intentionally NOT ignored. It's the subtype Slack
+      // attaches to a normal user message that includes file uploads — the
+      // event still has `text`, `user`, `channel`, and `files: [...]`. The
+      // route handler (src/server/routes/slack.ts) hands the `files[]` array
+      // to `ingestSlackFiles` (src/integrations/slack/files.ts), which
+      // downloads each file using the bot token, re-uploads it to GCS via
+      // the remote-server's /storage/upload-url endpoint, and appends the
+      // resulting short public URLs to the inbound message content.
       "reply_broadcast",
       "tombstone",
       "huddle_thread"
@@ -9485,7 +10304,7 @@ var init_messenger = __esm({
 });
 
 // src/orchestrator/schedules-store.ts
-import { nanoid as nanoid4 } from "nanoid";
+import { nanoid as nanoid5 } from "nanoid";
 async function readOrch(orchestratorSessionId) {
   const s = await sessionQueries.getById(orchestratorSessionId);
   if (!s) return null;
@@ -9500,7 +10319,7 @@ async function createSchedule(orchestratorSessionId, input) {
   const data = await readOrch(orchestratorSessionId);
   if (!data) throw new Error("orchestrator session not found");
   const row = {
-    id: `sch_${nanoid4(10)}`,
+    id: `sch_${nanoid5(10)}`,
     name: input.name,
     cron: input.cron,
     prompt: input.prompt,
@@ -9537,7 +10356,7 @@ var init_schedules_store = __esm({
 
 // src/orchestrator/webhooks-store.ts
 import { randomBytes } from "crypto";
-import { nanoid as nanoid5 } from "nanoid";
+import { nanoid as nanoid6 } from "nanoid";
 function newToken() {
   return randomBytes(24).toString("base64url");
 }
@@ -9554,7 +10373,7 @@ async function createWebhook(orchestratorSessionId, input) {
   const data = await readOrch2(orchestratorSessionId);
   if (!data) throw new Error("orchestrator session not found");
   const row = {
-    id: `whk_${nanoid5(10)}`,
+    id: `whk_${nanoid6(10)}`,
     name: input.name,
     token: newToken(),
     wake: input.wake ?? "now",
@@ -9699,7 +10518,9 @@ function buildAgentTool(opts) {
               workingDirectory: input.workingDirectory ?? opts.defaultWorkingDirectory,
               name: input.name,
               maxIterations: input.maxIterations ?? 100,
-              orchestratorSessionId: opts.orchestratorSessionId
+              orchestratorSessionId: opts.orchestratorSessionId,
+              ...input.mcpServers ? { mcpServers: input.mcpServers } : {},
+              ...input.skills ? { skills: input.skills } : {}
             }
           });
           return {
@@ -9872,6 +10693,26 @@ var init_orchestrator_actions = __esm({
       model: z14.string().optional().describe("spawn only: model override."),
       workingDirectory: z14.string().optional().describe("spawn only: working directory override."),
       maxIterations: z14.number().int().min(1).max(500).optional().describe("spawn only."),
+      mcpServers: z14.array(
+        z14.object({
+          name: z14.string(),
+          transport: z14.enum(["http", "sse", "stdio"]),
+          url: z14.string().optional(),
+          headers: z14.record(z14.string(), z14.string()).optional(),
+          command: z14.string().optional(),
+          args: z14.array(z14.string()).optional(),
+          env: z14.record(z14.string(), z14.string()).optional()
+        })
+      ).optional().describe("spawn only: task-scoped MCP servers (with auth headers) connected for this worker only, tools exposed as mcp_<name>_<tool>."),
+      skills: z14.array(
+        z14.object({
+          name: z14.string(),
+          description: z14.string().optional(),
+          content: z14.string(),
+          alwaysApply: z14.boolean().optional(),
+          globs: z14.array(z14.string()).optional()
+        })
+      ).optional().describe("spawn only: task-scoped skills (inline markdown) available to this worker only."),
       // message
       text: z14.string().optional().describe("message only: the text to deliver to the worker."),
       force: z14.boolean().optional().describe("message only: soft-interrupt the current step."),
@@ -9911,9 +10752,9 @@ var init_orchestrator_actions = __esm({
 });
 
 // src/integrations/mcp/store.ts
-import { nanoid as nanoid6 } from "nanoid";
-import { existsSync as existsSync17, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve10, join as join10 } from "path";
+import { nanoid as nanoid7 } from "nanoid";
+import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve10, join as join11 } from "path";
 function readServers() {
   try {
     const cfg = getConfig();
@@ -9925,12 +10766,12 @@ function readServers() {
 function refreshMcpServersFromDisk() {
   const candidates = [
     resolve10(process.cwd(), "sparkecoder.config.json"),
-    join10(ensureAppDataDirectory(), "sparkecoder.config.json")
+    join11(ensureAppDataDirectory(), "sparkecoder.config.json")
   ];
   for (const path of candidates) {
-    if (!existsSync17(path)) continue;
+    if (!existsSync18(path)) continue;
     try {
-      const raw = JSON.parse(readFileSync8(path, "utf-8"));
+      const raw = JSON.parse(readFileSync9(path, "utf-8"));
       const servers2 = Array.isArray(raw?.mcp?.servers) ? raw.mcp.servers : [];
       setMcpServers(servers2);
       return servers2;
@@ -9949,7 +10790,7 @@ function createMcpServer(input) {
   const all = readServers();
   validateInput(input);
   const row = {
-    id: `mcp_${nanoid6(10)}`,
+    id: `mcp_${nanoid7(10)}`,
     name: sanitizeName(input.name),
     transport: input.transport,
     url: input.url,
@@ -10120,6 +10961,159 @@ var init_pool = __esm({
   }
 });
 
+// src/integrations/mcp/task-scoped.ts
+import { createMCPClient as createMCPClient2 } from "@ai-sdk/mcp";
+function sanitizeName2(raw) {
+  return raw.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "_").replace(/_+/g, "_");
+}
+function buildHttpLikeTransport(server) {
+  if (!server.url) {
+    throw new Error(`${server.transport} transport requires a url`);
+  }
+  return {
+    type: server.transport,
+    url: server.url,
+    headers: server.headers
+  };
+}
+async function buildStdioTransport2(server) {
+  if (!server.command) {
+    throw new Error("stdio transport requires a command");
+  }
+  const mod = await import("@ai-sdk/mcp/mcp-stdio");
+  const Cls = mod.Experimental_StdioMCPTransport || mod.StdioClientTransport;
+  if (!Cls) throw new Error("@ai-sdk/mcp/mcp-stdio is missing the stdio transport class");
+  return new Cls({
+    command: server.command,
+    args: server.args ?? [],
+    env: server.env
+  });
+}
+async function buildTransport(server) {
+  return server.transport === "stdio" ? await buildStdioTransport2(server) : buildHttpLikeTransport(server);
+}
+async function connectTaskMcpServers(servers2, opts = {}) {
+  const tools = {};
+  const connected = [];
+  const errors = [];
+  const clients2 = [];
+  for (const raw of servers2 ?? []) {
+    const name = sanitizeName2(raw.name || "");
+    if (!name) {
+      errors.push({ name: raw.name || "(unnamed)", error: "server name is required" });
+      continue;
+    }
+    let client = null;
+    try {
+      const transport = await buildTransport(raw);
+      client = await createMCPClient2({ transport });
+      clients2.push(client);
+      const serverTools = await client.tools();
+      for (const [toolName, t] of Object.entries(serverTools)) {
+        tools[`mcp_${name}_${toolName}`] = t;
+      }
+      connected.push(name);
+    } catch (err) {
+      const message = err?.message || String(err);
+      errors.push({ name, error: message });
+      if (!opts.quiet) {
+        console.warn(`[mcp:task] connecting "${name}" failed: ${message}`);
+      }
+      if (client) {
+        try {
+          await client.close();
+        } catch {
+        }
+        const idx = clients2.indexOf(client);
+        if (idx >= 0) clients2.splice(idx, 1);
+      }
+    }
+  }
+  let closed = false;
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    await Promise.all(
+      clients2.map(async (c) => {
+        try {
+          await c.close();
+        } catch {
+        }
+      })
+    );
+  };
+  return { tools, connected, errors, close };
+}
+var init_task_scoped = __esm({
+  "src/integrations/mcp/task-scoped.ts"() {
+    "use strict";
+  }
+});
+
+// src/skills/task-scoped.ts
+import { mkdtemp, writeFile as writeFile5, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join12 } from "path";
+function safeFileName(name, index) {
+  const base = name.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return `${base || `skill-${index + 1}`}.md`;
+}
+function escapeFrontmatterValue(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function buildSkillFile(skill) {
+  const lines = ["---"];
+  lines.push(`name: ${escapeFrontmatterValue(skill.name)}`);
+  lines.push(`description: ${escapeFrontmatterValue(skill.description || skill.name)}`);
+  if (skill.alwaysApply) lines.push("alwaysApply: true");
+  if (skill.globs && skill.globs.length > 0) {
+    lines.push(`globs: [${skill.globs.map((g) => escapeFrontmatterValue(g)).join(", ")}]`);
+  }
+  lines.push("---");
+  lines.push("");
+  lines.push(skill.content);
+  return lines.join("\n");
+}
+async function materializeTaskSkills(skills2, taskId) {
+  if (!skills2 || skills2.length === 0) return null;
+  const safeTaskId = taskId.replace(/[^a-zA-Z0-9_-]+/g, "_");
+  const dir = await mkdtemp(join12(tmpdir(), `sparkecoder-task-skills-${safeTaskId}-`));
+  const seen = /* @__PURE__ */ new Set();
+  await Promise.all(
+    skills2.map(async (skill, i) => {
+      let fileName = safeFileName(skill.name, i);
+      while (seen.has(fileName)) fileName = `dup-${i}-${fileName}`;
+      seen.add(fileName);
+      await writeFile5(join12(dir, fileName), buildSkillFile(skill), "utf-8");
+    })
+  );
+  const loaded2 = await loadSkillsFromDirectory(dir, { priority: 1, defaultLoadType: "on_demand" });
+  const alwaysSkills = loaded2.filter((s) => s.alwaysApply || s.loadType === "always");
+  const onDemand = loaded2.filter((s) => !(s.alwaysApply || s.loadType === "always"));
+  const always = (await Promise.all(
+    alwaysSkills.map(async (s) => {
+      const withContent = await loadSkillContent(s.name, [dir]);
+      return withContent ? { ...s, content: withContent.content } : null;
+    })
+  )).filter((s) => s !== null);
+  let cleaned = false;
+  const cleanup2 = async () => {
+    if (cleaned) return;
+    cleaned = true;
+    try {
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+    }
+  };
+  return { dir, always, onDemand, cleanup: cleanup2 };
+}
+var init_task_scoped2 = __esm({
+  "src/skills/task-scoped.ts"() {
+    "use strict";
+    init_skills();
+  }
+});
+
 // src/utils/webhook.ts
 var webhook_exports = {};
 __export(webhook_exports, {
@@ -10278,79 +11272,57 @@ var init_pending_input = __esm({
   }
 });
 
-// src/orchestrator/inbox.ts
-var inbox_exports = {};
-__export(inbox_exports, {
-  clearInbox: () => clearInbox,
-  flush: () => flush,
-  peekInbox: () => peekInbox,
-  pushToInbox: () => pushToInbox,
-  setFlushHandler: () => setFlushHandler
-});
-function setFlushHandler(fn) {
-  flushHandler = fn;
-}
-function entryFor(sessionId) {
-  let e = inboxes.get(sessionId);
-  if (!e) {
-    e = { pending: [] };
-    inboxes.set(sessionId, e);
-  }
-  return e;
+// src/utils/local-device-time.ts
+function formatLocalDeviceTimeLine(now = /* @__PURE__ */ new Date()) {
+  const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  const formatted = now.toLocaleString("en-US", {
+    weekday: "long",
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+    second: "2-digit",
+    timeZoneName: "short"
+  });
+  return `${LOCAL_TIME_MARKER} ${formatted} (${timeZone})]`;
 }
-function pushToInbox(orchestratorSessionId, event) {
-  const e = entryFor(orchestratorSessionId);
-  e.pending.push(event);
-  if (event.wake === "now") {
-    scheduleFlush(orchestratorSessionId);
-  }
+function hasLocalDeviceTimeLine(text) {
+  return text.includes(LOCAL_TIME_MARKER);
 }
-function scheduleFlush(sessionId) {
-  const e = inboxes.get(sessionId);
-  if (!e) return;
-  if (e.timer) clearTimeout(e.timer);
-  e.timer = setTimeout(() => {
-    void flush(sessionId);
-  }, FLUSH_DEBOUNCE_MS);
+function prependLocalDeviceTimeToUserMessage(text, now) {
+  const trimmed = text.trim();
+  if (!trimmed || hasLocalDeviceTimeLine(text)) return text;
+  return `${formatLocalDeviceTimeLine(now)}
+${text}`;
 }
-async function flush(sessionId) {
-  const e = inboxes.get(sessionId);
-  if (!e) return;
-  if (e.timer) {
-    clearTimeout(e.timer);
-    e.timer = void 0;
-  }
-  const events = e.pending.splice(0);
-  if (events.length === 0) return;
-  if (!flushHandler) {
-    console.warn("[orchestrator-inbox] flush called with no handler installed; dropping events");
-    return;
+function prependLocalDeviceTimeToUserContent(content, now) {
+  if (typeof content === "string") {
+    return prependLocalDeviceTimeToUserMessage(content, now);
   }
-  try {
-    await flushHandler(sessionId, events);
-  } catch (err) {
-    console.error("[orchestrator-inbox] flush handler threw:", err?.message || err);
+  const line = formatLocalDeviceTimeLine(now);
+  if (content.some((p) => p.type === "text" && p.text && hasLocalDeviceTimeLine(p.text))) {
+    return content;
   }
-}
-function peekInbox(sessionId) {
-  return inboxes.get(sessionId)?.pending.slice() ?? [];
-}
-function clearInbox(sessionId) {
-  const e = inboxes.get(sessionId);
-  if (!e) return;
-  if (e.timer) {
-    clearTimeout(e.timer);
-    e.timer = void 0;
+  const userIdx = content.findIndex(
+    (p) => p.type === "text" && p.text?.includes("[USER MESSAGE]")
+  );
+  if (userIdx >= 0 && content[userIdx].text) {
+    const copy = content.map((p) => ({ ...p }));
+    copy[userIdx] = {
+      ...copy[userIdx],
+      text: `${line}
+${copy[userIdx].text}`
+    };
+    return copy;
   }
-  e.pending.length = 0;
+  return [{ type: "text", text: line }, ...content];
 }
-var inboxes, FLUSH_DEBOUNCE_MS, flushHandler;
-var init_inbox = __esm({
-  "src/orchestrator/inbox.ts"() {
+var LOCAL_TIME_MARKER;
+var init_local_device_time = __esm({
+  "src/utils/local-device-time.ts"() {
     "use strict";
-    inboxes = /* @__PURE__ */ new Map();
-    FLUSH_DEBOUNCE_MS = 200;
-    flushHandler = null;
+    LOCAL_TIME_MARKER = "[Local device time:";
   }
 });
 
@@ -10562,10 +11534,10 @@ __export(recorder_exports, {
 });
 import { exec as exec5 } from "child_process";
 import { promisify as promisify5 } from "util";
-import { writeFile as writeFile5, mkdir as mkdir4, readFile as readFile11, unlink as unlink2, readdir as readdir5, rm } from "fs/promises";
-import { join as join11 } from "path";
-import { tmpdir } from "os";
-import { nanoid as nanoid7 } from "nanoid";
+import { writeFile as writeFile6, mkdir as mkdir4, readFile as readFile11, unlink as unlink2, readdir as readdir5, rm as rm2 } from "fs/promises";
+import { join as join13 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { nanoid as nanoid8 } from "nanoid";
 async function checkFfmpeg() {
   try {
     await execAsync5("ffmpeg -version", { timeout: 5e3 });
@@ -10576,7 +11548,7 @@ async function checkFfmpeg() {
 }
 async function cleanup(dir) {
   try {
-    await rm(dir, { recursive: true, force: true });
+    await rm2(dir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -10620,21 +11592,21 @@ var init_recorder = __esm({
        */
       async encode() {
         if (this.frames.length === 0) return null;
-        const workDir = join11(tmpdir(), `sparkecoder-recording-${nanoid7(8)}`);
+        const workDir = join13(tmpdir2(), `sparkecoder-recording-${nanoid8(8)}`);
         await mkdir4(workDir, { recursive: true });
         try {
           for (let i = 0; i < this.frames.length; i++) {
-            const framePath = join11(workDir, `frame_${String(i).padStart(6, "0")}.jpg`);
-            await writeFile5(framePath, this.frames[i].data);
+            const framePath = join13(workDir, `frame_${String(i).padStart(6, "0")}.jpg`);
+            await writeFile6(framePath, this.frames[i].data);
           }
           const duration = (this.frames[this.frames.length - 1].timestamp - this.frames[0].timestamp) / 1e3;
           const fps = duration > 0 ? Math.round(this.frames.length / duration) : 10;
           const clampedFps = Math.max(1, Math.min(fps, 30));
-          const outputPath = join11(workDir, `recording_${this.sessionId}.mp4`);
+          const outputPath = join13(workDir, `recording_${this.sessionId}.mp4`);
           const hasFfmpeg = await checkFfmpeg();
           if (hasFfmpeg) {
             await execAsync5(
-              `ffmpeg -y -framerate ${clampedFps} -i "${join11(workDir, "frame_%06d.jpg")}" -c:v libx264 -pix_fmt yuv420p -preset fast -crf 23 "${outputPath}"`,
+              `ffmpeg -y -framerate ${clampedFps} -i "${join13(workDir, "frame_%06d.jpg")}" -c:v libx264 -pix_fmt yuv420p -preset fast -crf 23 "${outputPath}"`,
               { timeout: 12e4 }
             );
           } else {
@@ -10646,7 +11618,7 @@ var init_recorder = __esm({
           const files = await readdir5(workDir);
           for (const f of files) {
             if (f.startsWith("frame_")) {
-              await unlink2(join11(workDir, f)).catch(() => {
+              await unlink2(join13(workDir, f)).catch(() => {
               });
             }
           }
@@ -10675,7 +11647,7 @@ import {
   stepCountIs as stepCountIs2
 } from "ai";
 import { z as z15 } from "zod";
-import { nanoid as nanoid8 } from "nanoid";
+import { nanoid as nanoid9 } from "nanoid";
 function anySignal(signals) {
   const ctrl = new AbortController();
   for (const s of signals) {
@@ -10719,10 +11691,13 @@ var init_agent = __esm({
     init_prompts();
     init_orchestrator_actions();
     init_pool();
+    init_task_scoped();
+    init_task_scoped2();
     init_webhook2();
     init_questions();
     init_pending_input();
     init_inbox();
+    init_local_device_time();
     init_system();
     init_context();
     init_prompts();
@@ -10885,9 +11860,11 @@ ${prompt}` });
        */
       async stream(options) {
         const config = getConfig();
-        const userContent = this.buildUserMessageContent(options.prompt, options.attachments);
+        const prompt = this.session.config?.role === "orchestrator" ? prependLocalDeviceTimeToUserMessage(options.prompt) : options.prompt;
+        const userContent = this.buildUserMessageContent(prompt, options.attachments);
+        const persistedUserContent = this.session.config?.role === "orchestrator" ? prependLocalDeviceTimeToUserContent(userContent) : userContent;
         if (!options.skipSaveUserMessage) {
-          await this.context.addUserMessage(userContent);
+          await this.context.addUserMessage(persistedUserContent);
         }
         await sessionQueries.updateStatus(this.session.id, "active");
         let systemPrompt = await buildSystemPrompt({
@@ -10965,7 +11942,8 @@ ${personality.trim()}
        */
       async run(options) {
         const config = getConfig();
-        await this.context.addUserMessage(options.prompt);
+        const prompt = this.session.config?.role === "orchestrator" ? prependLocalDeviceTimeToUserMessage(options.prompt) : options.prompt;
+        await this.context.addUserMessage(prompt);
         const systemPrompt = await buildSystemPrompt({
           workingDirectory: this.session.workingDirectory,
           skillsDirectories: config.resolvedSkillsDirectories,
@@ -11009,355 +11987,387 @@ ${personality.trim()}
        */
       async runTask(options) {
         const config = getConfig();
-        const maxIterations = options.taskConfig.maxIterations ?? 50;
-        const webhookUrl = options.taskConfig.webhookUrl;
-        const parentTaskId = options.taskConfig.parentTaskId;
-        const fireWebhook = (type, data) => {
-          if (!webhookUrl) return;
-          sendWebhook(webhookUrl, {
-            type,
-            taskId: this.session.id,
-            sessionId: this.session.id,
-            ...parentTaskId ? { parentTaskId } : {},
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            data
-          });
-        };
-        const completion = { signal: null };
-        const onComplete = (signal) => {
-          completion.signal = signal;
-        };
-        let taskRecorder = null;
-        const sessionId = this.session.id;
-        const emit = options.writeSSE;
-        const bashProgressHandler = (progress) => {
-          options.onToolProgress?.({ toolName: "bash", data: progress });
-          if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "bash", data: progress })).catch(() => {
-          });
-          const port = progress.browserStreamPort;
-          if (port && progress.status === "started") {
-            Promise.resolve().then(() => (init_stream_proxy(), stream_proxy_exports)).then(({ getOrCreateProxy: getOrCreateProxy2 }) => {
-              const proxy = getOrCreateProxy2(sessionId, port);
-              if (!taskRecorder) {
-                Promise.resolve().then(() => (init_recorder(), recorder_exports)).then(({ FrameRecorder: FrameRecorder2 }) => {
-                  taskRecorder = new FrameRecorder2(sessionId);
-                  taskRecorder.start();
-                });
-              }
-              if (proxy.listenerCount("frame") === 0) {
-                proxy.on("frame", (frame) => {
-                  taskRecorder?.addFrame(frame);
-                  if (emit) emit(JSON.stringify({ type: "browser-frame", data: frame.data, metadata: frame.metadata })).catch(() => {
-                  });
-                });
-                proxy.on("status", (s) => {
-                  if (emit) emit(JSON.stringify({ type: "browser-status", ...s })).catch(() => {
-                  });
-                });
-              }
+        const taskScopedCleanups = [];
+        try {
+          const maxIterations = options.taskConfig.maxIterations ?? 50;
+          const webhookUrl = options.taskConfig.webhookUrl;
+          const parentTaskId = options.taskConfig.parentTaskId;
+          const fireWebhook = (type, data) => {
+            if (!webhookUrl) return;
+            sendWebhook(webhookUrl, {
+              type,
+              taskId: this.session.id,
+              sessionId: this.session.id,
+              ...parentTaskId ? { parentTaskId } : {},
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              data
             });
+          };
+          const completion = { signal: null };
+          const onComplete = (signal) => {
+            completion.signal = signal;
+          };
+          let taskMcpTools = {};
+          if (options.mcpServers && options.mcpServers.length > 0) {
+            const mcpConnection = await connectTaskMcpServers(options.mcpServers, { quiet: true });
+            taskScopedCleanups.push(mcpConnection.close);
+            taskMcpTools = mcpConnection.tools;
+            if (mcpConnection.connected.length > 0) {
+              console.log(`[TASK] connected ${mcpConnection.connected.length} task-scoped MCP server(s): ${mcpConnection.connected.join(", ")}`);
+            }
+            for (const e of mcpConnection.errors) {
+              console.warn(`[TASK] task-scoped MCP server "${e.name}" failed to connect: ${e.error}`);
+              if (options.writeSSE) await options.writeSSE(JSON.stringify({ type: "task-mcp-error", data: { name: e.name, error: e.error } }));
+            }
           }
-        };
-        const taskTools = await createTools({
-          sessionId: this.session.id,
-          workingDirectory: this.session.workingDirectory,
-          skillsDirectories: config.resolvedSkillsDirectories,
-          onBashProgress: bashProgressHandler,
-          onWriteFileProgress: (progress) => {
-            options.onToolProgress?.({ toolName: "write_file", data: progress });
-            if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "write_file", data: progress })).catch(() => {
-            });
-          },
-          onSearchProgress: (progress) => {
-            options.onToolProgress?.({ toolName: "explore_agent", data: progress });
-            if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "explore_agent", data: progress })).catch(() => {
+          const materializedSkills = await materializeTaskSkills(options.skills, this.session.id);
+          if (materializedSkills) taskScopedCleanups.push(materializedSkills.cleanup);
+          const taskSkillsDir = materializedSkills?.dir;
+          let taskRecorder = null;
+          const sessionId = this.session.id;
+          const emit = options.writeSSE;
+          const bashProgressHandler = (progress) => {
+            options.onToolProgress?.({ toolName: "bash", data: progress });
+            if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "bash", data: progress })).catch(() => {
             });
-          },
-          taskTools: {
-            outputSchema: options.taskConfig.outputSchema,
-            onComplete,
-            onQuestion: async (question) => {
-              const payload = {
-                questionId: question.questionId,
-                question: question.question,
-                context: question.context,
-                choices: question.choices,
-                status: "pending"
-              };
-              const answerPromise = waitForTaskQuestionAnswer({
-                taskId: this.session.id,
-                questionId: question.questionId,
-                question: question.question,
-                context: question.context,
-                choices: question.choices
+            const port = progress.browserStreamPort;
+            if (port && progress.status === "started") {
+              Promise.resolve().then(() => (init_stream_proxy(), stream_proxy_exports)).then(({ getOrCreateProxy: getOrCreateProxy2 }) => {
+                const proxy = getOrCreateProxy2(sessionId, port);
+                if (!taskRecorder) {
+                  Promise.resolve().then(() => (init_recorder(), recorder_exports)).then(({ FrameRecorder: FrameRecorder2 }) => {
+                    taskRecorder = new FrameRecorder2(sessionId);
+                    taskRecorder.start();
+                  });
+                }
+                if (proxy.listenerCount("frame") === 0) {
+                  proxy.on("frame", (frame) => {
+                    taskRecorder?.addFrame(frame);
+                    if (emit) emit(JSON.stringify({ type: "browser-frame", data: frame.data, metadata: frame.metadata })).catch(() => {
+                    });
+                  });
+                  proxy.on("status", (s) => {
+                    if (emit) emit(JSON.stringify({ type: "browser-status", ...s })).catch(() => {
+                    });
+                  });
+                }
               });
-              fireWebhook("task.question", payload);
-              if (emit) {
-                await emit(JSON.stringify({ type: "task-question", data: payload }));
-              }
-              const orchId = this.session.config?.orchestratorSessionId;
-              if (orchId) {
-                pushToInbox(orchId, workerQuestionEvent(
-                  this.session.id,
-                  this.session.name || "worker",
-                  question.question,
-                  question.questionId
-                ));
-              }
-              const answer = await answerPromise;
-              const answeredPayload = {
-                questionId: question.questionId,
-                answer: answer.answer,
-                answeredBy: answer.answeredBy
-              };
-              fireWebhook("task.question_answered", answeredPayload);
-              if (emit) {
-                await emit(JSON.stringify({ type: "task-question-answered", data: answeredPayload }));
+            }
+          };
+          const taskTools = await createTools({
+            sessionId: this.session.id,
+            workingDirectory: this.session.workingDirectory,
+            onBashProgress: bashProgressHandler,
+            onWriteFileProgress: (progress) => {
+              options.onToolProgress?.({ toolName: "write_file", data: progress });
+              if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "write_file", data: progress })).catch(() => {
+              });
+            },
+            onSearchProgress: (progress) => {
+              options.onToolProgress?.({ toolName: "explore_agent", data: progress });
+              if (emit) emit(JSON.stringify({ type: "tool-progress", toolName: "explore_agent", data: progress })).catch(() => {
+              });
+            },
+            // Add the task-scoped skills temp dir (if any) so load_skill can list
+            // and load the inline skills supplied with this task.
+            skillsDirectories: taskSkillsDir ? [...config.resolvedSkillsDirectories, taskSkillsDir] : config.resolvedSkillsDirectories,
+            taskTools: {
+              outputSchema: options.taskConfig.outputSchema,
+              onComplete,
+              onQuestion: async (question) => {
+                const payload = {
+                  questionId: question.questionId,
+                  question: question.question,
+                  context: question.context,
+                  choices: question.choices,
+                  status: "pending"
+                };
+                const answerPromise = waitForTaskQuestionAnswer({
+                  taskId: this.session.id,
+                  questionId: question.questionId,
+                  question: question.question,
+                  context: question.context,
+                  choices: question.choices
+                });
+                fireWebhook("task.question", payload);
+                if (emit) {
+                  await emit(JSON.stringify({ type: "task-question", data: payload }));
+                }
+                const orchId = this.session.config?.orchestratorSessionId;
+                if (orchId) {
+                  pushToInbox(orchId, workerQuestionEvent(
+                    this.session.id,
+                    this.session.name || "worker",
+                    question.question,
+                    question.questionId
+                  ));
+                }
+                const answer = await answerPromise;
+                const answeredPayload = {
+                  questionId: question.questionId,
+                  answer: answer.answer,
+                  answeredBy: answer.answeredBy
+                };
+                fireWebhook("task.question_answered", answeredPayload);
+                if (emit) {
+                  await emit(JSON.stringify({ type: "task-question-answered", data: answeredPayload }));
+                }
+                return answer;
               }
-              return answer;
             }
+          });
+          for (const [name, t] of Object.entries(taskMcpTools)) {
+            taskTools[name] = t;
           }
-        });
-        const baseSystemPrompt = await buildSystemPrompt({
-          workingDirectory: this.session.workingDirectory,
-          skillsDirectories: config.resolvedSkillsDirectories,
-          sessionId: this.session.id,
-          discoveredSkills: config.discoveredSkills,
-          activeFiles: []
-        });
-        const taskAddendum = buildTaskPromptAddendum(options.taskConfig.outputSchema);
-        const systemPrompt = `${baseSystemPrompt}
+          const baseSystemPrompt = await buildSystemPrompt({
+            workingDirectory: this.session.workingDirectory,
+            skillsDirectories: taskSkillsDir ? [...config.resolvedSkillsDirectories, taskSkillsDir] : config.resolvedSkillsDirectories,
+            sessionId: this.session.id,
+            discoveredSkills: config.discoveredSkills,
+            activeFiles: [],
+            taskScopedSkills: materializedSkills ? { always: materializedSkills.always, onDemand: materializedSkills.onDemand } : void 0
+          });
+          const taskAddendum = buildTaskPromptAddendum(options.taskConfig.outputSchema);
+          const systemPrompt = `${baseSystemPrompt}
 
 ${taskAddendum}`;
-        fireWebhook("task.started", { prompt: options.prompt });
-        if (emit) {
-          await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: options.prompt } }));
-        }
-        await this.context.addUserMessage(options.prompt);
-        let iteration = 0;
-        while (iteration < maxIterations) {
-          iteration++;
-          if (options.abortSignal?.aborted) {
-            const cancelError = "Task was cancelled";
-            fireWebhook("task.failed", { status: "failed", error: cancelError, iterations: iteration });
-            clearInterruptController(this.session.id);
-            return { status: "failed", error: cancelError, iterations: iteration };
-          }
-          const pending = drainInputs(this.session.id);
-          for (const p of pending) {
-            const labelled = p.source === "orchestrator" ? `[message from orchestrator]
-${p.text}` : p.source === "system" ? `[system note]
-${p.text}` : p.text;
-            if (emit) {
-              await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: labelled } }));
-            }
-            await this.context.addUserMessage(labelled);
-          }
-          const interruptController = new AbortController();
-          registerInterruptController(this.session.id, interruptController);
-          const combinedAbort = options.abortSignal ? anySignal([options.abortSignal, interruptController.signal]) : interruptController.signal;
-          const messages = await this.context.getMessages();
-          const useAnthropic = isAnthropicModel(this.session.model);
+          fireWebhook("task.started", { prompt: options.prompt });
           if (emit) {
-            await emit(JSON.stringify({ type: "start", messageId: `msg_${Date.now()}` }));
+            await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: options.prompt } }));
           }
-          let textStarted = false;
-          let textId = `text_${Date.now()}`;
-          let reasoningId = `reasoning_${Date.now()}`;
-          let reasoningStarted = false;
-          const toolCallStarts = /* @__PURE__ */ new Set();
-          const iterStream = streamText2({
-            model: resolveModel(this.session.model),
-            system: systemPrompt,
-            messages,
-            tools: wrapToolsNeverThrow(taskTools),
-            stopWhen: stepCountIs2(500),
-            abortSignal: combinedAbort,
-            providerOptions: useAnthropic ? {
-              anthropic: getAnthropicProviderOptions(this.session.model, { toolStreaming: true })
-            } : void 0,
-            // See the matching note in `stream()` — repair tool pairing before
-            // every step so we never feed the model an orphan tool-call.
-            prepareStep: async ({ messages: stepMessages }) => {
-              const paired = repairToolPairing(stepMessages);
-              const ordered = ensureToolResultsFollowCalls(paired);
-              if (ordered === stepMessages) return {};
-              return { messages: ordered };
-            },
-            onStepFinish: async (step) => {
-              options.onStepFinish?.(step);
-              fireWebhook("task.step_finished", { iteration, text: step.text });
-              if (emit) {
-                if (textStarted) {
-                  await emit(JSON.stringify({ type: "text-end", id: textId }));
-                  textStarted = false;
-                  textId = `text_${Date.now()}`;
-                }
-                await emit(JSON.stringify({ type: "finish-step" }));
-              }
-            }
-          });
-          for await (const part of iterStream.fullStream) {
-            if (part.type === "text-delta") {
-              if (emit) {
-                if (!textStarted) {
-                  await emit(JSON.stringify({ type: "text-start", id: textId }));
-                  textStarted = true;
-                }
-                await emit(JSON.stringify({ type: "text-delta", id: textId, delta: part.text }));
-              }
-            } else if (part.type === "reasoning-start") {
+          await this.context.addUserMessage(options.prompt);
+          let iteration = 0;
+          while (iteration < maxIterations) {
+            iteration++;
+            if (options.abortSignal?.aborted) {
+              const cancelError = "Task was cancelled";
+              fireWebhook("task.failed", { status: "failed", error: cancelError, iterations: iteration });
+              clearInterruptController(this.session.id);
+              return { status: "failed", error: cancelError, iterations: iteration };
+            }
+            const pending = drainInputs(this.session.id);
+            for (const p of pending) {
+              const labelled = p.source === "orchestrator" ? `[message from orchestrator]
+${p.text}` : p.source === "system" ? `[system note]
+${p.text}` : p.text;
               if (emit) {
-                await emit(JSON.stringify({ type: "reasoning-start", id: reasoningId }));
-                reasoningStarted = true;
+                await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: labelled } }));
               }
-            } else if (part.type === "reasoning-delta") {
-              if (emit) {
-                await emit(JSON.stringify({ type: "reasoning-delta", id: reasoningId, delta: part.text }));
+              await this.context.addUserMessage(labelled);
+            }
+            const interruptController = new AbortController();
+            registerInterruptController(this.session.id, interruptController);
+            const combinedAbort = options.abortSignal ? anySignal([options.abortSignal, interruptController.signal]) : interruptController.signal;
+            const messages = await this.context.getMessages();
+            const useAnthropic = isAnthropicModel(this.session.model);
+            if (emit) {
+              await emit(JSON.stringify({ type: "start", messageId: `msg_${Date.now()}` }));
+            }
+            let textStarted = false;
+            let textId = `text_${Date.now()}`;
+            let reasoningId = `reasoning_${Date.now()}`;
+            let reasoningStarted = false;
+            const toolCallStarts = /* @__PURE__ */ new Set();
+            const iterStream = streamText2({
+              model: resolveModel(this.session.model),
+              system: systemPrompt,
+              messages,
+              tools: wrapToolsNeverThrow(taskTools),
+              stopWhen: stepCountIs2(500),
+              abortSignal: combinedAbort,
+              providerOptions: useAnthropic ? {
+                anthropic: getAnthropicProviderOptions(this.session.model, { toolStreaming: true })
+              } : void 0,
+              // See the matching note in `stream()` — repair tool pairing before
+              // every step so we never feed the model an orphan tool-call.
+              prepareStep: async ({ messages: stepMessages }) => {
+                const paired = repairToolPairing(stepMessages);
+                const ordered = ensureToolResultsFollowCalls(paired);
+                if (ordered === stepMessages) return {};
+                return { messages: ordered };
+              },
+              onStepFinish: async (step) => {
+                options.onStepFinish?.(step);
+                fireWebhook("task.step_finished", { iteration, text: step.text });
+                if (emit) {
+                  if (textStarted) {
+                    await emit(JSON.stringify({ type: "text-end", id: textId }));
+                    textStarted = false;
+                    textId = `text_${Date.now()}`;
+                  }
+                  await emit(JSON.stringify({ type: "finish-step" }));
+                }
               }
-            } else if (part.type === "reasoning-end") {
-              if (emit && reasoningStarted) {
-                await emit(JSON.stringify({ type: "reasoning-end", id: reasoningId }));
-                reasoningStarted = false;
-                reasoningId = `reasoning_${Date.now()}`;
+            });
+            for await (const part of iterStream.fullStream) {
+              if (part.type === "text-delta") {
+                if (emit) {
+                  if (!textStarted) {
+                    await emit(JSON.stringify({ type: "text-start", id: textId }));
+                    textStarted = true;
+                  }
+                  await emit(JSON.stringify({ type: "text-delta", id: textId, delta: part.text }));
+                }
+              } else if (part.type === "reasoning-start") {
+                if (emit) {
+                  await emit(JSON.stringify({ type: "reasoning-start", id: reasoningId }));
+                  reasoningStarted = true;
+                }
+              } else if (part.type === "reasoning-delta") {
+                if (emit) {
+                  await emit(JSON.stringify({ type: "reasoning-delta", id: reasoningId, delta: part.text }));
+                }
+              } else if (part.type === "reasoning-end") {
+                if (emit && reasoningStarted) {
+                  await emit(JSON.stringify({ type: "reasoning-end", id: reasoningId }));
+                  reasoningStarted = false;
+                  reasoningId = `reasoning_${Date.now()}`;
+                }
+              } else if (part.type === "tool-call-streaming-start") {
+                if (emit) {
+                  const p = part;
+                  await emit(JSON.stringify({ type: "tool-input-start", toolCallId: p.toolCallId, toolName: p.toolName }));
+                  toolCallStarts.add(p.toolCallId);
+                }
+              } else if (part.type === "tool-call-delta") {
+                if (emit) {
+                  const p = part;
+                  await emit(JSON.stringify({ type: "tool-input-delta", toolCallId: p.toolCallId, argsTextDelta: p.argsTextDelta }));
+                }
+              } else if (part.type === "tool-call") {
+                if (emit) {
+                  if (!toolCallStarts.has(part.toolCallId)) {
+                    await emit(JSON.stringify({ type: "tool-input-start", toolCallId: part.toolCallId, toolName: part.toolName }));
+                    toolCallStarts.add(part.toolCallId);
+                  }
+                  const safeInput = part.toolName === "write_file" && part.input && typeof part.input === "object" ? truncateWriteFileInput(part.input) : part.input;
+                  await emit(JSON.stringify({ type: "tool-input-available", toolCallId: part.toolCallId, toolName: part.toolName, input: safeInput }));
+                }
+              } else if (part.type === "tool-result") {
+                if (emit) {
+                  await emit(JSON.stringify({ type: "tool-output-available", toolCallId: part.toolCallId, output: part.output }));
+                }
+              } else if (part.type === "error") {
+                console.error("Task stream error:", part.error);
+                if (emit) {
+                  await emit(JSON.stringify({ type: "error", errorText: String(part.error) }));
+                }
               }
-            } else if (part.type === "tool-call-streaming-start") {
-              if (emit) {
-                const p = part;
-                await emit(JSON.stringify({ type: "tool-input-start", toolCallId: p.toolCallId, toolName: p.toolName }));
-                toolCallStarts.add(p.toolCallId);
+            }
+            if (emit && textStarted) {
+              await emit(JSON.stringify({ type: "text-end", id: textId }));
+            }
+            if (emit && reasoningStarted) {
+              await emit(JSON.stringify({ type: "reasoning-end", id: reasoningId }));
+            }
+            const interrupted = interruptController.signal.aborted;
+            clearInterruptController(this.session.id);
+            const iterResponse = await iterStream.response;
+            const responseMessages = iterResponse.messages;
+            await this.context.addResponseMessages(responseMessages);
+            const resultText = await iterStream.text;
+            const resultSteps = await iterStream.steps;
+            if (resultText) {
+              options.onText?.(resultText);
+              fireWebhook("task.message", { iteration, text: resultText });
+            }
+            for (const step of resultSteps) {
+              if (step.toolCalls) {
+                for (const tc of step.toolCalls) {
+                  options.onToolCall?.({ toolCallId: tc.toolCallId, toolName: tc.toolName, input: tc.input });
+                  fireWebhook("task.tool_call", { iteration, toolName: tc.toolName, toolCallId: tc.toolCallId, input: tc.input });
+                }
               }
-            } else if (part.type === "tool-call-delta") {
-              if (emit) {
-                const p = part;
-                await emit(JSON.stringify({ type: "tool-input-delta", toolCallId: p.toolCallId, argsTextDelta: p.argsTextDelta }));
+              if (step.toolResults) {
+                for (const tr of step.toolResults) {
+                  options.onToolResult?.({ toolCallId: tr.toolCallId, toolName: tr.toolName, output: tr.output });
+                  fireWebhook("task.tool_result", { iteration, toolName: tr.toolName, toolCallId: tr.toolCallId, output: tr.output });
+                }
               }
-            } else if (part.type === "tool-call") {
-              if (emit) {
-                if (!toolCallStarts.has(part.toolCallId)) {
-                  await emit(JSON.stringify({ type: "tool-input-start", toolCallId: part.toolCallId, toolName: part.toolName }));
-                  toolCallStarts.add(part.toolCallId);
+            }
+            if (completion.signal) {
+              const sig = completion.signal;
+              const finalStatus = sig.status;
+              let fileUrls;
+              if (finalStatus === "completed" && sig.result && typeof sig.result === "object") {
+                const resultObj = sig.result;
+                const filePaths = Array.isArray(resultObj.files) ? resultObj.files : [];
+                if (filePaths.length > 0) {
+                  fileUrls = await this.uploadTaskFiles(filePaths);
                 }
-                const safeInput = part.toolName === "write_file" && part.input && typeof part.input === "object" ? truncateWriteFileInput(part.input) : part.input;
-                await emit(JSON.stringify({ type: "tool-input-available", toolCallId: part.toolCallId, toolName: part.toolName, input: safeInput }));
               }
-            } else if (part.type === "tool-result") {
-              if (emit) {
-                await emit(JSON.stringify({ type: "tool-output-available", toolCallId: part.toolCallId, output: part.output }));
+              const recordingUrls = await this.finishTaskRecording(taskRecorder);
+              const allFileUrls = [...fileUrls || [], ...recordingUrls];
+              const eventType = finalStatus === "completed" ? "task.completed" : "task.failed";
+              fireWebhook(eventType, {
+                status: finalStatus,
+                result: sig.result,
+                error: sig.error,
+                iterations: iteration,
+                fileUrls: allFileUrls.length > 0 ? allFileUrls : void 0,
+                browserRecordingUrls: recordingUrls.length > 0 ? recordingUrls : void 0
+              });
+              const updatedTask2 = {
+                ...options.taskConfig,
+                status: finalStatus,
+                result: sig.result,
+                error: sig.error,
+                iterations: iteration
+              };
+              await sessionQueries.update(this.session.id, {
+                config: { ...this.session.config, task: updatedTask2 }
+              });
+              const orchId = this.session.config?.orchestratorSessionId;
+              if (orchId) {
+                const summary = finalStatus === "completed" ? typeof sig.result?.summary === "string" ? sig.result.summary : JSON.stringify(sig.result) : sig.error || "unknown error";
+                pushToInbox(orchId, finalStatus === "completed" ? workerCompletedEvent(this.session.id, this.session.name || "worker", summary) : workerFailedEvent(this.session.id, this.session.name || "worker", summary));
               }
-            } else if (part.type === "error") {
-              console.error("Task stream error:", part.error);
+              return {
+                status: finalStatus,
+                result: sig.result,
+                error: sig.error,
+                iterations: iteration
+              };
+            }
+            if (!interrupted) {
+              const continuationPrompt = "Continue working on the task. Before calling `complete_task`, VERIFY your work is correct \u2014 re-read edited files, run the linter, run tests if applicable, and check the browser/server if you made UI or API changes. Make sure you searched the right directories and found everything relevant. When fully verified, call `complete_task` with the result. If you cannot complete it, call `task_failed` with a reason.";
               if (emit) {
-                await emit(JSON.stringify({ type: "error", errorText: String(part.error) }));
+                await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: continuationPrompt } }));
               }
+              await this.context.addUserMessage(continuationPrompt);
             }
           }
-          if (emit && textStarted) {
-            await emit(JSON.stringify({ type: "text-end", id: textId }));
-          }
-          if (emit && reasoningStarted) {
-            await emit(JSON.stringify({ type: "reasoning-end", id: reasoningId }));
-          }
-          const interrupted = interruptController.signal.aborted;
           clearInterruptController(this.session.id);
-          const iterResponse = await iterStream.response;
-          const responseMessages = iterResponse.messages;
-          await this.context.addResponseMessages(responseMessages);
-          const resultText = await iterStream.text;
-          const resultSteps = await iterStream.steps;
-          if (resultText) {
-            options.onText?.(resultText);
-            fireWebhook("task.message", { iteration, text: resultText });
-          }
-          for (const step of resultSteps) {
-            if (step.toolCalls) {
-              for (const tc of step.toolCalls) {
-                options.onToolCall?.({ toolCallId: tc.toolCallId, toolName: tc.toolName, input: tc.input });
-                fireWebhook("task.tool_call", { iteration, toolName: tc.toolName, toolCallId: tc.toolCallId, input: tc.input });
-              }
-            }
-            if (step.toolResults) {
-              for (const tr of step.toolResults) {
-                options.onToolResult?.({ toolCallId: tr.toolCallId, toolName: tr.toolName, output: tr.output });
-                fireWebhook("task.tool_result", { iteration, toolName: tr.toolName, toolCallId: tr.toolCallId, output: tr.output });
-              }
-            }
-          }
-          if (completion.signal) {
-            const sig = completion.signal;
-            const finalStatus = sig.status;
-            let fileUrls;
-            if (finalStatus === "completed" && sig.result && typeof sig.result === "object") {
-              const resultObj = sig.result;
-              const filePaths = Array.isArray(resultObj.files) ? resultObj.files : [];
-              if (filePaths.length > 0) {
-                fileUrls = await this.uploadTaskFiles(filePaths);
-              }
-            }
-            const recordingUrls = await this.finishTaskRecording(taskRecorder);
-            const allFileUrls = [...fileUrls || [], ...recordingUrls];
-            const eventType = finalStatus === "completed" ? "task.completed" : "task.failed";
-            fireWebhook(eventType, {
-              status: finalStatus,
-              result: sig.result,
-              error: sig.error,
-              iterations: iteration,
-              fileUrls: allFileUrls.length > 0 ? allFileUrls : void 0,
-              browserRecordingUrls: recordingUrls.length > 0 ? recordingUrls : void 0
-            });
-            const updatedTask2 = {
-              ...options.taskConfig,
-              status: finalStatus,
-              result: sig.result,
-              error: sig.error,
-              iterations: iteration
-            };
-            await sessionQueries.update(this.session.id, {
-              config: { ...this.session.config, task: updatedTask2 }
-            });
-            const orchId = this.session.config?.orchestratorSessionId;
-            if (orchId) {
-              const summary = finalStatus === "completed" ? typeof sig.result?.summary === "string" ? sig.result.summary : JSON.stringify(sig.result) : sig.error || "unknown error";
-              pushToInbox(orchId, finalStatus === "completed" ? workerCompletedEvent(this.session.id, this.session.name || "worker", summary) : workerFailedEvent(this.session.id, this.session.name || "worker", summary));
-            }
-            return {
-              status: finalStatus,
-              result: sig.result,
-              error: sig.error,
-              iterations: iteration
-            };
+          const timeoutError = `Task did not complete within ${maxIterations} iterations`;
+          const timeoutRecordingUrls = await this.finishTaskRecording(taskRecorder);
+          fireWebhook("task.failed", {
+            status: "failed",
+            error: timeoutError,
+            iterations: iteration,
+            browserRecordingUrls: timeoutRecordingUrls.length > 0 ? timeoutRecordingUrls : void 0
+          });
+          const updatedTask = {
+            ...options.taskConfig,
+            status: "failed",
+            error: timeoutError,
+            iterations: iteration
+          };
+          await sessionQueries.update(this.session.id, {
+            config: { ...this.session.config, task: updatedTask }
+          });
+          const orchIdTimeout = this.session.config?.orchestratorSessionId;
+          if (orchIdTimeout) {
+            pushToInbox(orchIdTimeout, workerFailedEvent(this.session.id, this.session.name || "worker", timeoutError));
           }
-          if (!interrupted) {
-            const continuationPrompt = "Continue working on the task. Before calling `complete_task`, VERIFY your work is correct \u2014 re-read edited files, run the linter, run tests if applicable, and check the browser/server if you made UI or API changes. Make sure you searched the right directories and found everything relevant. When fully verified, call `complete_task` with the result. If you cannot complete it, call `task_failed` with a reason.";
-            if (emit) {
-              await emit(JSON.stringify({ type: "data-user-message", data: { id: `user_${Date.now()}`, content: continuationPrompt } }));
+          return { status: "failed", error: timeoutError, iterations: iteration };
+        } finally {
+          for (const cleanup2 of taskScopedCleanups) {
+            try {
+              await cleanup2();
+            } catch {
             }
-            await this.context.addUserMessage(continuationPrompt);
           }
         }
-        clearInterruptController(this.session.id);
-        const timeoutError = `Task did not complete within ${maxIterations} iterations`;
-        const timeoutRecordingUrls = await this.finishTaskRecording(taskRecorder);
-        fireWebhook("task.failed", {
-          status: "failed",
-          error: timeoutError,
-          iterations: iteration,
-          browserRecordingUrls: timeoutRecordingUrls.length > 0 ? timeoutRecordingUrls : void 0
-        });
-        const updatedTask = {
-          ...options.taskConfig,
-          status: "failed",
-          error: timeoutError,
-          iterations: iteration
-        };
-        await sessionQueries.update(this.session.id, {
-          config: { ...this.session.config, task: updatedTask }
-        });
-        const orchIdTimeout = this.session.config?.orchestratorSessionId;
-        if (orchIdTimeout) {
-          pushToInbox(orchIdTimeout, workerFailedEvent(this.session.id, this.session.name || "worker", timeoutError));
-        }
-        return { status: "failed", error: timeoutError, iterations: iteration };
       }
       /**
        * Stop a task-mode browser recording, encode to MP4, upload to GCS.
@@ -11417,11 +12427,11 @@ ${p.text}` : p.text;
           const { isRemoteConfigured: isRemoteConfigured2, storageQueries: storageQueries2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
           if (!isRemoteConfigured2()) return [];
           const { readFile: readFile13 } = await import("fs/promises");
-          const { join: join19, basename: basename7 } = await import("path");
+          const { join: join21, basename: basename7 } = await import("path");
           const urls = [];
           for (const filePath of filePaths) {
             try {
-              const fullPath = filePath.startsWith("/") ? filePath : join19(this.session.workingDirectory, filePath);
+              const fullPath = filePath.startsWith("/") ? filePath : join21(this.session.workingDirectory, filePath);
               const fileName = basename7(fullPath);
               const ext = fileName.split(".").pop()?.toLowerCase() || "";
               const mimeMap = {
@@ -11483,7 +12493,7 @@ ${p.text}` : p.text;
             description: originalTool.description || "",
             inputSchema: originalTool.inputSchema || z15.object({}),
             execute: async (input, toolOptions) => {
-              const toolCallId = toolOptions.toolCallId || nanoid8();
+              const toolCallId = toolOptions.toolCallId || nanoid9();
               const execution = toolExecutionQueries.create({
                 sessionId: this.session.id,
                 toolName: name,
@@ -11555,188 +12565,40 @@ ${p.text}` : p.text;
       /**
        * Reject a pending tool execution
        */
-      async reject(toolCallId, reason) {
-        const resolver = approvalResolvers.get(toolCallId);
-        if (resolver) {
-          resolver.reason = reason;
-          resolver.resolve(false);
-          return { rejected: true };
-        }
-        const pendingFromDb = await toolExecutionQueries.getPendingApprovals(this.session.id);
-        const execution = pendingFromDb.find((e) => e.toolCallId === toolCallId);
-        if (!execution) {
-          throw new Error(`No pending approval for tool call: ${toolCallId}`);
-        }
-        await toolExecutionQueries.reject(execution.id);
-        return { rejected: true };
-      }
-      /**
-       * Get pending approvals
-       */
-      async getPendingApprovals() {
-        return toolExecutionQueries.getPendingApprovals(this.session.id);
-      }
-      /**
-       * Get context statistics
-       */
-      getContextStats() {
-        return this.context.getStats();
-      }
-      /**
-       * Clear conversation context (start fresh)
-       */
-      clearContext() {
-        this.context.clear();
-      }
-    };
-  }
-});
-
-// src/agent/session-lock.ts
-async function withSessionLock(sessionId, fn) {
-  let state2 = locks.get(sessionId);
-  if (!state2) {
-    state2 = { tail: Promise.resolve(), pending: 0 };
-    locks.set(sessionId, state2);
-  }
-  state2.pending++;
-  const prev = state2.tail;
-  let release;
-  const next = new Promise((resolve14) => {
-    release = resolve14;
-  });
-  state2.tail = prev.then(() => next);
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    release();
-    state2.pending--;
-    if (state2.pending === 0 && locks.get(sessionId) === state2) {
-      locks.delete(sessionId);
-    }
-  }
-}
-var locks;
-var init_session_lock = __esm({
-  "src/agent/session-lock.ts"() {
-    "use strict";
-    locks = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/orchestrator/webhook-events.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9, appendFileSync as appendFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname7, join as join12 } from "path";
-import { nanoid as nanoid9 } from "nanoid";
-function logFilePath() {
-  return join12(getAppDataDirectory(), "webhook-events.jsonl");
-}
-function ensureLoaded() {
-  if (cache !== null) return cache;
-  cache = [];
-  try {
-    const p = logFilePath();
-    if (!existsSync18(p)) return cache;
-    const lines = readFileSync9(p, "utf-8").split("\n").filter(Boolean);
-    for (const line of lines) {
-      try {
-        cache.push(JSON.parse(line));
-      } catch {
-      }
-    }
-    if (cache.length > MAX_EVENTS) {
-      cache = cache.slice(-MAX_EVENTS);
-      try {
-        writeFileSync4(p, cache.map((e) => JSON.stringify(e)).join("\n") + "\n");
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return cache;
-}
-function appendEvent(ev) {
-  const list = ensureLoaded();
-  list.push(ev);
-  if (list.length > MAX_EVENTS) list.shift();
-  try {
-    const p = logFilePath();
-    mkdirSync7(dirname7(p), { recursive: true });
-    appendFileSync3(p, JSON.stringify(ev) + "\n");
-  } catch {
-  }
-}
-function recordEvent(ev) {
-  const full = {
-    id: ev.id ?? nanoid9(),
-    ts: ev.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
-    source: ev.source,
-    status: ev.status,
-    subtype: ev.subtype,
-    channel: ev.channel,
-    user: ev.user,
-    textSnippet: ev.textSnippet?.slice(0, 200),
-    dropReason: ev.dropReason,
-    error: ev.error,
-    sessionId: ev.sessionId,
-    durationMs: ev.durationMs,
-    meta: ev.meta
-  };
-  appendEvent(full);
-  return full.id;
-}
-function updateEvent(id, patch) {
-  const list = ensureLoaded();
-  const i = list.findIndex((e) => e.id === id);
-  if (i < 0) return;
-  list[i] = { ...list[i], ...patch };
-  try {
-    const p = logFilePath();
-    mkdirSync7(dirname7(p), { recursive: true });
-    writeFileSync4(p, list.map((e) => JSON.stringify(e)).join("\n") + "\n");
-  } catch {
-  }
-}
-function listEvents(filter = {}) {
-  const list = ensureLoaded();
-  const q = filter.q?.toLowerCase();
-  const sinceTs = filter.since ? Date.parse(filter.since) : -Infinity;
-  const beforeTs = filter.before ? Date.parse(filter.before) : Infinity;
-  const matched = list.filter((e) => {
-    if (filter.source && e.source !== filter.source) return false;
-    if (filter.status && e.status !== filter.status) return false;
-    const t = Date.parse(e.ts);
-    if (t < sinceTs) return false;
-    if (t >= beforeTs) return false;
-    if (q) {
-      const hay = `${e.channel ?? ""} ${e.user ?? ""} ${e.textSnippet ?? ""} ${e.dropReason ?? ""} ${e.error ?? ""} ${e.subtype ?? ""}`.toLowerCase();
-      if (!hay.includes(q)) return false;
-    }
-    return true;
-  });
-  matched.reverse();
-  const offset = Math.max(0, filter.offset ?? 0);
-  const limit = Math.min(500, Math.max(1, filter.limit ?? 50));
-  return {
-    events: matched.slice(offset, offset + limit),
-    total: matched.length
-  };
-}
-function clearAllEvents() {
-  cache = [];
-  try {
-    writeFileSync4(logFilePath(), "");
-  } catch {
-  }
-}
-var MAX_EVENTS, cache;
-var init_webhook_events = __esm({
-  "src/orchestrator/webhook-events.ts"() {
-    "use strict";
-    init_config();
-    MAX_EVENTS = 1e3;
-    cache = null;
+      async reject(toolCallId, reason) {
+        const resolver = approvalResolvers.get(toolCallId);
+        if (resolver) {
+          resolver.reason = reason;
+          resolver.resolve(false);
+          return { rejected: true };
+        }
+        const pendingFromDb = await toolExecutionQueries.getPendingApprovals(this.session.id);
+        const execution = pendingFromDb.find((e) => e.toolCallId === toolCallId);
+        if (!execution) {
+          throw new Error(`No pending approval for tool call: ${toolCallId}`);
+        }
+        await toolExecutionQueries.reject(execution.id);
+        return { rejected: true };
+      }
+      /**
+       * Get pending approvals
+       */
+      async getPendingApprovals() {
+        return toolExecutionQueries.getPendingApprovals(this.session.id);
+      }
+      /**
+       * Get context statistics
+       */
+      getContextStats() {
+        return this.context.getStats();
+      }
+      /**
+       * Clear conversation context (start fresh)
+       */
+      clearContext() {
+        this.context.clear();
+      }
+    };
   }
 });
 
@@ -11812,7 +12674,24 @@ async function runDaemonTurn(sessionId, events) {
     durationMs: finishedAt.getTime() - startedAt.getTime(),
     meta: { triggeredBy: events.map((e) => e.content?.slice(0, 80)) }
   });
+  try {
+    resolveBatchOnTurnEnd(events, !error);
+  } catch (err) {
+    console.error("[daemon] ack bookkeeping threw:", err?.message || err);
+  }
   broadcast({ sessionId, text: trimmed, triggeredBy: events, startedAt, finishedAt, error });
+  const seen = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (ev.ref?.channel !== "slack") continue;
+    const ref = ev.ref;
+    const channel = ref.slackChannel;
+    const ts = ref.messageTs;
+    if (!channel || !ts) continue;
+    const key2 = `${channel}\u241F${ts}`;
+    if (seen.has(key2)) continue;
+    seen.add(key2);
+    void removeLoadingReaction(channel, ts);
+  }
 }
 var listeners;
 var init_daemon = __esm({
@@ -11823,6 +12702,8 @@ var init_daemon = __esm({
     init_db();
     init_inbox();
     init_webhook_events();
+    init_inbox_acks();
+    init_client3();
     listeners = /* @__PURE__ */ new Map();
   }
 });
@@ -11921,6 +12802,233 @@ var init_ensure_orchestrator = __esm({
   }
 });
 
+// src/orchestrator/self-update.ts
+var self_update_exports = {};
+__export(self_update_exports, {
+  __test: () => __test,
+  startSelfUpdater: () => startSelfUpdater,
+  stopSelfUpdater: () => stopSelfUpdater
+});
+import { spawn as spawn2, execFile } from "child_process";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname10, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function currentVersion2() {
+  const here = dirname10(fileURLToPath4(import.meta.url));
+  const candidates = [
+    join18(here, "..", "..", "package.json"),
+    join18(here, "..", "package.json"),
+    join18(process.cwd(), "package.json")
+  ];
+  for (const p of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync11(p, "utf8"));
+      if (pkg.name === "sparkecoder" && pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  return "0.0.0";
+}
+function isLikelyGlobalInstall() {
+  const here = dirname10(fileURLToPath4(import.meta.url));
+  return here.includes("/node_modules/sparkecoder/") || here.includes("\\node_modules\\sparkecoder\\");
+}
+function isEnabled() {
+  if (process.env.SPARKECODER_AUTO_UPDATE === "false" || process.env.SPARKECODER_AUTO_UPDATE === "0") return false;
+  try {
+    const cfg = getConfig();
+    if (cfg?.autoUpdate?.enabled === false) return false;
+  } catch {
+  }
+  return true;
+}
+function remoteUrl() {
+  try {
+    const cfg = getConfig();
+    const url = cfg?.remoteServer?.url;
+    return typeof url === "string" && url.length > 0 ? url.replace(/\/+$/, "") : null;
+  } catch {
+    return null;
+  }
+}
+function intervalMs() {
+  try {
+    const h = getConfig()?.autoUpdate?.intervalHours;
+    if (typeof h === "number" && h > 0) return h * 60 * 6e4;
+  } catch {
+  }
+  return DEFAULT_INTERVAL_HOURS * 60 * 6e4;
+}
+function semverGt(a, b) {
+  const parse = (v) => v.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x > y) return true;
+    if (x < y) return false;
+  }
+  return false;
+}
+function statePath() {
+  try {
+    return join18(getAppDataDirectory(), "self-update-state.json");
+  } catch {
+    return null;
+  }
+}
+function readState() {
+  const p = statePath();
+  if (!p) return {};
+  try {
+    return JSON.parse(readFileSync11(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeState(s) {
+  const p = statePath();
+  if (!p) return;
+  try {
+    mkdirSync10(dirname10(p), { recursive: true });
+    writeFileSync7(p, JSON.stringify(s));
+  } catch {
+  }
+}
+function attemptedRecently(target, now) {
+  const s = readState();
+  return s.lastTarget === target && typeof s.lastAttemptAt === "number" && now - s.lastAttemptAt < RETRY_COOLDOWN_MS;
+}
+function latestPublishedVersion() {
+  return new Promise((resolve14) => {
+    execFile("npm", ["view", "sparkecoder", "version"], { timeout: 3e4 }, (err, stdout) => {
+      if (err) {
+        resolve14(null);
+        return;
+      }
+      const v = String(stdout).trim();
+      resolve14(/^\d+\.\d+\.\d+/.test(v) ? v : null);
+    });
+  });
+}
+function runInstaller(url) {
+  const secret = process.env.SPARKECODER_SETUP_SECRET || process.env.SPARKECODER_TUNNEL_SECRET || "";
+  const query = secret ? `?secret=${encodeURIComponent(secret)}` : "";
+  const oneLiner = `bash -c "$(curl -fsSL '${url}/install.sh${query}')" >/tmp/sparkecoder-selfupdate.log 2>&1`;
+  const child = spawn2("bash", ["-lc", oneLiner], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+async function checkAndUpdate() {
+  if (upgrading || !isEnabled()) return;
+  const url = remoteUrl();
+  if (!url) return;
+  const latest = await latestPublishedVersion();
+  if (!latest) return;
+  const current = currentVersion2();
+  if (!semverGt(latest, current)) return;
+  const now = Date.now();
+  if (attemptedRecently(latest, now)) {
+    console.log(`[self-update] v${latest} already attempted recently; skipping until cooldown elapses`);
+    return;
+  }
+  upgrading = true;
+  const announced = await announceUpdate(latest);
+  const delay = announced ? ANNOUNCE_GRACE_MS : 0;
+  if (announced) {
+    console.log(`[self-update] announced v${latest} in Slack; updating in ${Math.round(delay / 6e4)}m`);
+  }
+  const t = setTimeout(() => doInstall(latest, url, current), delay);
+  if (typeof t.unref === "function") t.unref();
+}
+function doInstall(latest, url, current) {
+  const prev = readState();
+  writeState({
+    lastTarget: latest,
+    lastAttemptAt: Date.now(),
+    attempts: prev.lastTarget === latest ? (prev.attempts ?? 0) + 1 : 1
+  });
+  console.log(`[self-update] newer version available: v${current} \u2192 v${latest}; re-running installer`);
+  try {
+    runInstaller(url);
+  } catch (err) {
+    upgrading = false;
+    console.warn("[self-update] failed to launch installer:", err?.message || err);
+  }
+}
+async function findOrchestratorId() {
+  try {
+    const { sessionQueries: sessionQueries2 } = await Promise.resolve().then(() => (init_db(), db_exports));
+    const all = await sessionQueries2.list(500, 0);
+    const orch = all.find((s) => s?.config?.role === "orchestrator");
+    return orch?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+async function announceUpdate(target) {
+  try {
+    const { isSlackConfigured: isSlackConfigured2 } = await Promise.resolve().then(() => (init_client3(), client_exports));
+    if (!isSlackConfigured2()) return false;
+    const orchId = await findOrchestratorId();
+    if (!orchId) return false;
+    const { pushToInbox: pushToInbox2 } = await Promise.resolve().then(() => (init_inbox(), inbox_exports));
+    pushToInbox2(orchId, {
+      ref: { channel: "system", kind: "worker.completed", workerId: "self-update", workerName: "self-update" },
+      content: `[SYSTEM self-update] A software update to v${target} will begin in about 5 minutes and the service will restart briefly (expect ~1\u20132 minutes of downtime). Send a short Slack heads-up to whoever you normally talk to / the bot owner that you'll be offline for a quick update, then carry on. Use the messenger tool to deliver it. If you genuinely don't know who to tell, post in the most relevant channel you've recently been active in; if Slack isn't reachable, skip silently \u2014 the update will proceed regardless.`,
+      wake: "now",
+      enqueuedAt: /* @__PURE__ */ new Date()
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function startSelfUpdater() {
+  if (started) return;
+  started = true;
+  if (!isEnabled()) {
+    console.log("[self-update] disabled");
+    return;
+  }
+  if (!isLikelyGlobalInstall()) {
+    console.log("[self-update] skipped (not a global install)");
+    return;
+  }
+  const kickoff = setTimeout(() => {
+    void checkAndUpdate();
+    timer = setInterval(() => {
+      void checkAndUpdate();
+    }, intervalMs());
+    if (typeof timer.unref === "function") timer.unref();
+  }, INITIAL_DELAY_MS);
+  if (typeof kickoff.unref === "function") kickoff.unref();
+}
+function stopSelfUpdater() {
+  if (timer) {
+    clearInterval(timer);
+    timer = null;
+  }
+}
+var INITIAL_DELAY_MS, DEFAULT_INTERVAL_HOURS, ANNOUNCE_GRACE_MS, RETRY_COOLDOWN_MS, timer, started, upgrading, __test;
+var init_self_update = __esm({
+  "src/orchestrator/self-update.ts"() {
+    "use strict";
+    init_config();
+    INITIAL_DELAY_MS = 5 * 6e4;
+    DEFAULT_INTERVAL_HOURS = 6;
+    ANNOUNCE_GRACE_MS = 5 * 6e4;
+    RETRY_COOLDOWN_MS = 24 * 60 * 6e4;
+    timer = null;
+    started = false;
+    upgrading = false;
+    __test = { currentVersion: currentVersion2, semverGt, isLikelyGlobalInstall };
+  }
+});
+
 // src/tasks/scheduler.ts
 var scheduler_exports = {};
 __export(scheduler_exports, {
@@ -12223,8 +13331,8 @@ import chalk from "chalk";
 import ora from "ora";
 import "dotenv/config";
 import { createInterface } from "readline";
-import { dirname as dirname11 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { dirname as dirname12 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/server/index.ts
 import "dotenv/config";
@@ -12232,11 +13340,11 @@ import { Hono as Hono10 } from "hono";
 import { serve } from "@hono/node-server";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
-import { existsSync as existsSync22, mkdirSync as mkdirSync10, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve12, dirname as dirname10, join as join17 } from "path";
-import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve12, dirname as dirname11, join as join19 } from "path";
+import { spawn as spawn3 } from "child_process";
 import { createServer as createNetServer } from "net";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/server/routes/sessions.ts
 init_db();
@@ -12249,7 +13357,7 @@ import { zValidator } from "@hono/zod-validator";
 import { z as z16 } from "zod";
 import { existsSync as existsSync19, mkdirSync as mkdirSync8, writeFileSync as writeFileSync5, readdirSync as readdirSync3, statSync as statSync2, unlinkSync as unlinkSync2 } from "fs";
 import { readdir as readdir6 } from "fs/promises";
-import { join as join13, basename as basename5, extname as extname8, relative as relative9 } from "path";
+import { join as join14, basename as basename5, extname as extname8, relative as relative9 } from "path";
 import { nanoid as nanoid10 } from "nanoid";
 
 // src/tasks/agent-status.ts
@@ -12890,7 +13998,7 @@ sessions2.get("/:id/diff/:filePath", async (c) => {
 });
 function getAttachmentsDir(sessionId) {
   const appDataDir = getAppDataDirectory();
-  return join13(appDataDir, "attachments", sessionId);
+  return join14(appDataDir, "attachments", sessionId);
 }
 function ensureAttachmentsDir(sessionId) {
   const dir = getAttachmentsDir(sessionId);
@@ -12911,7 +14019,7 @@ sessions2.get("/:id/attachments", async (c) => {
   }
   const files = readdirSync3(dir);
   const attachments = files.map((filename) => {
-    const filePath = join13(dir, filename);
+    const filePath = join14(dir, filename);
     const stats = statSync2(filePath);
     return {
       id: filename.split("_")[0],
@@ -12946,7 +14054,7 @@ sessions2.post("/:id/attachments", async (c) => {
       const id = nanoid10(10);
       const ext = extname8(file.name) || "";
       const safeFilename = `${id}_${basename5(file.name).replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-      const filePath = join13(dir, safeFilename);
+      const filePath = join14(dir, safeFilename);
       const arrayBuffer = await file.arrayBuffer();
       writeFileSync5(filePath, Buffer.from(arrayBuffer));
       return c.json({
@@ -12972,7 +14080,7 @@ sessions2.post("/:id/attachments", async (c) => {
     const id = nanoid10(10);
     const ext = extname8(body.filename) || "";
     const safeFilename = `${id}_${basename5(body.filename).replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-    const filePath = join13(dir, safeFilename);
+    const filePath = join14(dir, safeFilename);
     let base64Data = body.data;
     if (base64Data.includes(",")) {
       base64Data = base64Data.split(",")[1];
@@ -13009,7 +14117,7 @@ sessions2.delete("/:id/attachments/:attachmentId", async (c) => {
   if (!file) {
     return c.json({ error: "Attachment not found" }, 404);
   }
-  const filePath = join13(dir, file);
+  const filePath = join14(dir, file);
   unlinkSync2(filePath);
   return c.json({ success: true, id: attachmentId });
 });
@@ -13092,7 +14200,7 @@ async function listWorkspaceFiles(baseDir, currentDir, query, limit, results = [
     const entries = await readdir6(currentDir, { withFileTypes: true });
     for (const entry2 of entries) {
       if (results.length >= limit * 2) break;
-      const fullPath = join13(currentDir, entry2.name);
+      const fullPath = join14(currentDir, entry2.name);
       const relativePath = relative9(baseDir, fullPath);
       if (entry2.isDirectory() && IGNORED_DIRECTORIES.has(entry2.name)) {
         continue;
@@ -13252,7 +14360,7 @@ import { Hono as Hono2 } from "hono";
 import { zValidator as zValidator2 } from "@hono/zod-validator";
 import { z as z17 } from "zod";
 import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/agent/missing-tool-recovery.ts
 init_db();
@@ -13519,6 +14627,7 @@ init_stream_proxy();
 init_recorder();
 init_remote();
 init_resize_image();
+init_local_device_time();
 var sessionRecorders = /* @__PURE__ */ new Map();
 var MAX_TOOL_INPUT_LENGTH = 8 * 1024;
 var MAX_TOOL_INPUT_PREVIEW = 2 * 1024;
@@ -13634,7 +14743,7 @@ var rejectSchema = z17.object({
 var streamAbortControllers = /* @__PURE__ */ new Map();
 function getAttachmentsDirectory(sessionId) {
   const appDataDir = getAppDataDirectory();
-  return join14(appDataDir, "attachments", sessionId);
+  return join15(appDataDir, "attachments", sessionId);
 }
 async function saveAttachmentToDisk(sessionId, attachment, index) {
   const attachmentsDir = getAttachmentsDirectory(sessionId);
@@ -13657,7 +14766,7 @@ async function saveAttachmentToDisk(sessionId, attachment, index) {
     attachment.mediaType = resized.mediaType;
     attachment.data = buffer.toString("base64");
   }
-  const filePath = join14(attachmentsDir, filename);
+  const filePath = join15(attachmentsDir, filename);
   writeFileSync6(filePath, buffer);
   return filePath;
 }
@@ -14034,9 +15143,12 @@ agents.post(
     if (!session) {
       return c.json({ error: "Session not found" }, 404);
     }
-    if (session.config?.role === "orchestrator" && !/^\[\w+/.test(prompt)) {
+    if (session.config?.role === "orchestrator" && !/^\[(WEB|SLACK|SYSTEM|SCHEDULE|WEBHOOK)\b/.test(prompt)) {
       prompt = `[WEB] ${prompt}`;
     }
+    if (session.config?.role === "orchestrator") {
+      prompt = prependLocalDeviceTimeToUserMessage(prompt);
+    }
     const nextSequence = await messageQueries.getNextSequence(id);
     await createCheckpoint(id, session.workingDirectory, nextSequence);
     let userMessageContent;
@@ -14646,17 +15758,17 @@ import { zValidator as zValidator3 } from "@hono/zod-validator";
 import { z as z18 } from "zod";
 import { readFileSync as readFileSync10 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname8, join as join15 } from "path";
+import { dirname as dirname8, join as join16 } from "path";
 var __filename = fileURLToPath3(import.meta.url);
 var __dirname = dirname8(__filename);
 var possiblePaths = [
-  join15(__dirname, "../package.json"),
+  join16(__dirname, "../package.json"),
   // From dist/server -> dist/../package.json
-  join15(__dirname, "../../package.json"),
+  join16(__dirname, "../../package.json"),
   // From dist/server (if nested differently)
-  join15(__dirname, "../../../package.json"),
+  join16(__dirname, "../../../package.json"),
   // From src/server/routes (development)
-  join15(process.cwd(), "package.json")
+  join16(process.cwd(), "package.json")
   // From current working directory
 ];
 var currentVersion = "0.0.0";
@@ -15117,6 +16229,25 @@ import { nanoid as nanoid12 } from "nanoid";
 init_questions();
 var tasks = new Hono5();
 var taskAbortControllers = /* @__PURE__ */ new Map();
+var taskMcpServerSchema = z20.object({
+  name: z20.string().min(1).describe("Tool prefix + display name."),
+  transport: z20.enum(["http", "sse", "stdio"]),
+  url: z20.string().url().optional().describe("http/sse transports."),
+  headers: z20.record(z20.string(), z20.string()).optional().describe("Auth / custom headers for http/sse."),
+  command: z20.string().optional().describe("stdio transport."),
+  args: z20.array(z20.string()).optional(),
+  env: z20.record(z20.string(), z20.string()).optional().describe("Env vars for stdio child process.")
+}).refine(
+  (s) => s.transport === "stdio" ? !!s.command : !!s.url,
+  { message: 'http/sse require "url"; stdio requires "command".' }
+);
+var taskSkillSchema = z20.object({
+  name: z20.string().min(1),
+  description: z20.string().optional(),
+  content: z20.string().min(1).describe("Full markdown body of the skill."),
+  alwaysApply: z20.boolean().optional().describe("Inject into the system prompt up-front (vs load on demand)."),
+  globs: z20.array(z20.string()).optional()
+});
 var createTaskSchema = z20.object({
   prompt: z20.string().min(1),
   outputSchema: z20.record(z20.string(), z20.unknown()),
@@ -15128,8 +16259,30 @@ var createTaskSchema = z20.object({
   parentTaskId: z20.string().optional(),
   /** When set, the spawning orchestrator's session id. Stamped on the
    *  worker's config so terminal events can wake the orchestrator. */
-  orchestratorSessionId: z20.string().optional()
+  orchestratorSessionId: z20.string().optional(),
+  /** Task-scoped MCP servers — auto-connected for this task only. */
+  mcpServers: z20.array(taskMcpServerSchema).optional(),
+  /** Task-scoped skills — available to this task only. */
+  skills: z20.array(taskSkillSchema).optional()
 });
+function redactMcpServers(servers2) {
+  if (!servers2 || servers2.length === 0) return void 0;
+  return servers2.map((s) => ({
+    name: s.name,
+    transport: s.transport,
+    url: s.url,
+    hasHeaders: !!(s.headers && Object.keys(s.headers).length > 0),
+    command: s.command
+  }));
+}
+function redactSkills(skills2) {
+  if (!skills2 || skills2.length === 0) return void 0;
+  return skills2.map((s) => ({
+    name: s.name,
+    description: s.description,
+    alwaysApply: s.alwaysApply
+  }));
+}
 tasks.post(
   "/",
   zValidator5("json", createTaskSchema),
@@ -15142,7 +16295,9 @@ tasks.post(
       webhookUrl: body.webhookUrl,
       maxIterations: body.maxIterations ?? 50,
       status: "running",
-      parentTaskId: body.parentTaskId
+      parentTaskId: body.parentTaskId,
+      mcpServers: redactMcpServers(body.mcpServers),
+      skills: redactSkills(body.skills)
     };
     let agent;
     if (body.parentTaskId) {
@@ -15219,7 +16374,9 @@ tasks.post(
             prompt: body.prompt,
             taskConfig,
             abortSignal: abortController.signal,
-            writeSSE
+            writeSSE,
+            mcpServers: body.mcpServers,
+            skills: body.skills
           });
           await writeSSE(JSON.stringify({ type: "finish" }));
         } catch (err) {
@@ -15313,6 +16470,8 @@ tasks.get("/:id", async (c) => {
     model: session.model,
     name: session.name,
     parentTaskId: task.parentTaskId,
+    mcpServers: task.mcpServers,
+    skills: task.skills,
     createdAt: session.createdAt.toISOString(),
     updatedAt: session.updatedAt.toISOString(),
     browserRecordings: browserRecordings.length > 0 ? browserRecordings : void 0
@@ -15435,6 +16594,204 @@ function verifySlackSignature(opts) {
 // src/server/routes/slack.ts
 init_client3();
 init_slack();
+
+// src/integrations/slack/files.ts
+init_client3();
+var MAX_BYTES = 100 * 1024 * 1024;
+var INGEST_TIMEOUT_MS = 2500;
+function inferFileName(file) {
+  return typeof file.name === "string" && file.name || typeof file.title === "string" && file.title || `slack-file-${file.id}`;
+}
+function inferContentType(file) {
+  if (typeof file.mimetype === "string" && file.mimetype) return file.mimetype;
+  return "application/octet-stream";
+}
+function formatBytes(n) {
+  if (!Number.isFinite(n) || n <= 0) return "?";
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(2)} MB`;
+}
+function withTimeout(p, ms, label) {
+  return new Promise((resolve14, reject) => {
+    const t = setTimeout(() => reject(new Error(`${label}_timeout`)), ms);
+    p.then(
+      (v) => {
+        clearTimeout(t);
+        resolve14(v);
+      },
+      (e) => {
+        clearTimeout(t);
+        reject(e);
+      }
+    );
+  });
+}
+async function ingestOne(file, sessionId, botToken) {
+  const fileName = inferFileName(file);
+  const contentType = inferContentType(file);
+  const declaredSize = typeof file.size === "number" ? file.size : 0;
+  const base = {
+    slackFileId: file.id,
+    fileName,
+    contentType,
+    sizeBytes: declaredSize
+  };
+  const sourceUrl = file.url_private_download || file.url_private;
+  if (!sourceUrl || typeof sourceUrl !== "string") {
+    return { ...base, shortUrl: null, error: "no_source_url" };
+  }
+  if (declaredSize > MAX_BYTES) {
+    return { ...base, shortUrl: null, error: "size_exceeded" };
+  }
+  let bytes;
+  try {
+    const res = await fetch(sourceUrl, {
+      headers: { Authorization: `Bearer ${botToken}` }
+    });
+    if (!res.ok) {
+      return { ...base, shortUrl: null, error: `slack_fetch_${res.status}` };
+    }
+    const ab = await res.arrayBuffer();
+    if (ab.byteLength > MAX_BYTES) {
+      return { ...base, shortUrl: null, error: "size_exceeded" };
+    }
+    bytes = Buffer.from(ab);
+  } catch (err) {
+    return { ...base, shortUrl: null, error: `slack_fetch_error:${err?.message || "unknown"}` };
+  }
+  const { storageQueries: storageQueries2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
+  let upload;
+  try {
+    upload = await storageQueries2.getUploadUrl(sessionId, fileName, contentType, "slack");
+  } catch (err) {
+    return { ...base, sizeBytes: bytes.length, shortUrl: null, error: `presign_failed:${err?.message || "unknown"}` };
+  }
+  try {
+    const putRes = await fetch(upload.uploadUrl, {
+      method: "PUT",
+      headers: { "Content-Type": contentType },
+      body: bytes
+    });
+    if (!putRes.ok) {
+      return {
+        ...base,
+        sizeBytes: bytes.length,
+        shortUrl: null,
+        error: `gcs_put_${putRes.status}`
+      };
+    }
+  } catch (err) {
+    return {
+      ...base,
+      sizeBytes: bytes.length,
+      shortUrl: null,
+      error: `gcs_put_error:${err?.message || "unknown"}`
+    };
+  }
+  try {
+    await storageQueries2.updateFile(upload.fileId, { sizeBytes: bytes.length });
+  } catch (err) {
+    console.warn(`[slack-files] sizeBytes patch failed for ${upload.fileId}:`, err?.message || err);
+  }
+  const shortUrl = upload.shortUrl || // Defensive fallback: build it from the upload URL's origin if the
+  // server somehow forgot to return it (older remote-server versions).
+  inferShortUrlFromUploadUrl(upload.uploadUrl, upload.fileId);
+  return {
+    ...base,
+    sizeBytes: bytes.length,
+    shortUrl
+  };
+}
+function inferShortUrlFromUploadUrl(uploadUrl, fileId) {
+  try {
+    const u = new URL(uploadUrl);
+    if (u.hostname.endsWith(".googleapis.com")) return null;
+    return `${u.origin}/f/${fileId}`;
+  } catch {
+    return null;
+  }
+}
+async function ingestSlackFiles(files, sessionId, options = {}) {
+  if (!Array.isArray(files) || files.length === 0) return [];
+  const { isRemoteConfigured: isRemoteConfigured2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
+  if (!isRemoteConfigured2()) {
+    console.warn(`[slack-files] storage not configured \u2014 skipping ingestion for ${files.length} file(s)`);
+    return files.map((f) => ({
+      slackFileId: f.id,
+      fileName: inferFileName(f),
+      contentType: inferContentType(f),
+      sizeBytes: typeof f.size === "number" ? f.size : 0,
+      shortUrl: null,
+      error: "storage_unconfigured"
+    }));
+  }
+  const botToken = getSlackBotToken();
+  if (!botToken) {
+    console.warn("[slack-files] no bot token \u2014 cannot download from Slack");
+    return files.map((f) => ({
+      slackFileId: f.id,
+      fileName: inferFileName(f),
+      contentType: inferContentType(f),
+      sizeBytes: typeof f.size === "number" ? f.size : 0,
+      shortUrl: null,
+      error: "no_bot_token"
+    }));
+  }
+  const timeoutMs = options.timeoutMs ?? INGEST_TIMEOUT_MS;
+  const startedAt = Date.now();
+  const pipeline = Promise.allSettled(
+    files.map((f) => ingestOne(f, sessionId, botToken))
+  );
+  let settled;
+  try {
+    settled = await withTimeout(pipeline, timeoutMs, "ingest");
+  } catch (err) {
+    console.warn(`[slack-files] pipeline timeout after ${Date.now() - startedAt}ms (${err?.message || "timeout"})`);
+    return files.map((f) => ({
+      slackFileId: f.id,
+      fileName: inferFileName(f),
+      contentType: inferContentType(f),
+      sizeBytes: typeof f.size === "number" ? f.size : 0,
+      shortUrl: null,
+      error: "timeout"
+    }));
+  }
+  const results = settled.map((s, i) => {
+    if (s.status === "fulfilled") return s.value;
+    const f = files[i];
+    return {
+      slackFileId: f.id,
+      fileName: inferFileName(f),
+      contentType: inferContentType(f),
+      sizeBytes: typeof f.size === "number" ? f.size : 0,
+      shortUrl: null,
+      error: `unexpected:${s.reason?.message || String(s.reason)}`
+    };
+  });
+  const okCount = results.filter((r) => r.shortUrl).length;
+  console.log(
+    `[slack-files] ingested ${okCount}/${files.length} file(s) in ${Date.now() - startedAt}ms`
+  );
+  return results;
+}
+function formatFileBlock(files) {
+  if (!files || files.length === 0) return "";
+  const lines = ["[files]"];
+  for (const f of files) {
+    const sizeLabel = formatBytes(f.sizeBytes);
+    if (f.shortUrl) {
+      lines.push(`  - ${f.fileName} (${f.contentType}, ${sizeLabel}): ${f.shortUrl}`);
+    } else {
+      lines.push(
+        `  - ${f.fileName} (${f.contentType}, ${sizeLabel}): [ingestion failed: ${f.error || "unknown"}]`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/server/routes/slack.ts
 init_webhook_events();
 init_inbox();
 var recentlyHandled = /* @__PURE__ */ new Map();
@@ -15521,9 +16878,43 @@ slack.post("/events", async (c) => {
             inbound.content = inbound.content.replace(`user=${ev.user}`, () => enriched);
           }
         }
-        pushToInbox(orchestratorId, inbound);
+        const slackFiles = Array.isArray(ev.files) ? ev.files : [];
         markHandled(ev.channel, ev.ts);
-        updateEvent(auditId, { status: "routed", sessionId: orchestratorId });
+        if (ev.channel && ev.ts) {
+          void addLoadingReaction(String(ev.channel), String(ev.ts));
+        }
+        let ingestedCount = 0;
+        if (slackFiles.length > 0) {
+          try {
+            const ingested = await ingestSlackFiles(slackFiles, orchestratorId);
+            const block = formatFileBlock(ingested);
+            if (block) inbound.content = `${inbound.content}
+${block}`;
+            ingestedCount = ingested.filter((f) => f.shortUrl).length;
+          } catch (err) {
+            console.warn("[slack-files] ingestion threw:", err?.message || err);
+            inbound.content = `${inbound.content}
+[files] (ingestion failed: ${err?.message || "unknown"})`;
+          }
+        }
+        pushToInbox(orchestratorId, inbound);
+        updateEvent(auditId, {
+          status: "routed",
+          sessionId: orchestratorId,
+          ...slackFiles.length > 0 ? {
+            // Preserve the original meta (ts, thread_ts, team,
+            // event_subtype) from recordEvent above — updateEvent does a
+            // shallow merge, so we have to re-include them.
+            meta: {
+              ts: ev.ts,
+              thread_ts: ev.thread_ts,
+              team: ev.team,
+              event_subtype: ev.subtype,
+              fileCount: slackFiles.length,
+              ingestedCount
+            }
+          } : {}
+        });
       } else {
         updateEvent(auditId, { status: "error", error: "no orchestrator session available" });
       }
@@ -15743,10 +17134,35 @@ integrations.get("/", async (c) => {
     cfAccess: {
       enabled: !!cfg?.auth?.cfAccess?.enabled,
       teamDomain: cfg?.auth?.cfAccess?.teamDomain || null,
+      audTag: cfg?.auth?.cfAccess?.audTag || null,
       allowedEmails: cfg?.auth?.allowedEmails || []
     }
   });
 });
+var cfAccessSchema = z21.object({
+  enabled: z21.boolean().optional(),
+  teamDomain: z21.string().optional(),
+  audTag: z21.string().optional(),
+  // Email allowlist for the public (cloudflared) surface. Empty array = allow
+  // any email that passes the Cloudflare Access policy (no extra filtering).
+  allowedEmails: z21.array(z21.string().trim().toLowerCase()).optional()
+});
+integrations.post("/cf-access", zValidator6("json", cfAccessSchema), async (c) => {
+  const body = c.req.valid("json");
+  if (body.enabled) {
+    const cfg = getConfig();
+    const teamDomain = body.teamDomain ?? cfg?.auth?.cfAccess?.teamDomain;
+    const audTag = body.audTag ?? cfg?.auth?.cfAccess?.audTag;
+    if (!teamDomain || !audTag) {
+      return c.json(
+        { error: "teamDomain and audTag are required to enable Cloudflare Access" },
+        400
+      );
+    }
+  }
+  setCfAccessConfig(body);
+  return c.json({ ok: true });
+});
 var slackConfigSchema = z21.object({
   botToken: z21.string().optional(),
   signingSecret: z21.string().optional(),
@@ -15929,8 +17345,8 @@ import { Hono as Hono9 } from "hono";
 import { zValidator as zValidator7 } from "@hono/zod-validator";
 import { z as z22 } from "zod";
 import { existsSync as existsSync21, statSync as statSync3 } from "fs";
-import { readFile as readFile12, writeFile as writeFile6, unlink as unlink3, mkdir as mkdir5 } from "fs/promises";
-import { resolve as resolve11, join as join16, basename as basename6, dirname as dirname9, extname as extname9 } from "path";
+import { readFile as readFile12, writeFile as writeFile7, unlink as unlink3, mkdir as mkdir5 } from "fs/promises";
+import { resolve as resolve11, join as join17, basename as basename6, dirname as dirname9, extname as extname9 } from "path";
 var skills = new Hono9();
 function encodeId(filePath) {
   return Buffer.from(filePath, "utf-8").toString("base64url");
@@ -16078,13 +17494,13 @@ skills.post(
     const safeName = basename6(fileName).replace(/[^A-Za-z0-9._-]/g, "-");
     const ext = extname9(safeName).toLowerCase();
     const finalName = ext === ".md" || ext === ".mdc" ? safeName : `${safeName}.md`;
-    const filePath = join16(targetDir, finalName);
+    const filePath = join17(targetDir, finalName);
     if (existsSync21(filePath)) {
       return c.json({ error: `file already exists: ${finalName}` }, 409);
     }
     try {
       await mkdir5(targetDir, { recursive: true });
-      await writeFile6(filePath, content, "utf-8");
+      await writeFile7(filePath, content, "utf-8");
     } catch (err) {
       return c.json({ error: err?.message || "write failed" }, 500);
     }
@@ -16100,7 +17516,7 @@ skills.put(
     if (filePath.includes("/skills/default")) {
       return c.json({ error: "built-in skills are read-only" }, 400);
     }
-    await writeFile6(filePath, c.req.valid("json").content, "utf-8");
+    await writeFile7(filePath, c.req.valid("json").content, "utf-8");
     return c.json({ ok: true });
   }
 );
@@ -16144,6 +17560,14 @@ skills.delete("/directories", (c) => {
 init_config();
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var EXEMPT_PATH_PREFIXES = ["/health", "/api/slack/events", "/api/inbox/", "/w/"];
+function isExemptPath(path) {
+  return EXEMPT_PATH_PREFIXES.some((p) => {
+    if (p.endsWith("/")) {
+      return path === p.slice(0, -1) || path === p || path.startsWith(p);
+    }
+    return path === p || path.startsWith(p + "/") || path.startsWith(p + "?");
+  });
+}
 var cachedJWKS = null;
 var cachedJWKSUrl = null;
 function getOrCreateJWKS(teamDomain) {
@@ -16173,12 +17597,13 @@ function cfAccessMiddleware() {
       return next();
     }
     const path = c.req.path;
-    if (EXEMPT_PATH_PREFIXES.some((p) => path === p || path.startsWith(p + "/") || path.startsWith(p + "?"))) {
+    if (isExemptPath(path)) {
       return next();
     }
     const host = c.req.header("host");
     const remote = c.req.raw?.socket?.remoteAddress;
-    if (isLoopback(host, remote)) {
+    const hasCfJwt = !!c.req.header("cf-access-jwt-assertion");
+    if (!hasCfJwt && isLoopback(host, remote)) {
       return next();
     }
     const teamDomain = cfg.teamDomain;
@@ -16197,8 +17622,10 @@ function cfAccessMiddleware() {
         audience: aud
       });
       const email = String(payload.email || "").toLowerCase();
-      const allowed = (auth?.allowedEmails || []).map((e) => e.toLowerCase());
-      if (allowed.length > 0 && !allowed.includes(email)) {
+      const emailDomain = email.split("@")[1] || "";
+      const allowed = (auth?.allowedEmails || []).map((e) => e.toLowerCase().trim().replace(/^@/, "")).filter(Boolean);
+      const isAllowed = allowed.length === 0 || allowed.some((entry2) => entry2.includes("@") ? entry2 === email : entry2 === emailDomain);
+      if (!isAllowed) {
         console.warn(`[cf-access] rejected ${email}: not in allowlist`);
         return c.json({ error: "Email not allowed" }, 403);
       }
@@ -16396,13 +17823,13 @@ var DEFAULT_WEB_PORT = 6969;
 var WEB_PORT_SEQUENCE = [6969, 6970, 6971, 6972, 6973, 6974, 6975, 6976, 6977, 6978];
 function getWebDirectory() {
   try {
-    const currentDir = dirname10(fileURLToPath4(import.meta.url));
+    const currentDir = dirname11(fileURLToPath5(import.meta.url));
     const webDir = resolve12(currentDir, "..", "web");
-    if (existsSync22(webDir) && existsSync22(join17(webDir, "package.json"))) {
+    if (existsSync22(webDir) && existsSync22(join19(webDir, "package.json"))) {
       return webDir;
     }
     const altWebDir = resolve12(currentDir, "..", "..", "web");
-    if (existsSync22(altWebDir) && existsSync22(join17(altWebDir, "package.json"))) {
+    if (existsSync22(altWebDir) && existsSync22(join19(altWebDir, "package.json"))) {
       return altWebDir;
     }
     return null;
@@ -16460,20 +17887,20 @@ async function findWebPort(preferredPort) {
   return { port: preferredPort, alreadyRunning: false };
 }
 function hasProductionBuild(webDir) {
-  const buildIdPath = join17(webDir, ".next", "BUILD_ID");
+  const buildIdPath = join19(webDir, ".next", "BUILD_ID");
   return existsSync22(buildIdPath);
 }
 function hasSourceFiles(webDir) {
-  const appDir = join17(webDir, "src", "app");
-  const pagesDir = join17(webDir, "src", "pages");
-  const rootAppDir = join17(webDir, "app");
-  const rootPagesDir = join17(webDir, "pages");
+  const appDir = join19(webDir, "src", "app");
+  const pagesDir = join19(webDir, "src", "pages");
+  const rootAppDir = join19(webDir, "app");
+  const rootPagesDir = join19(webDir, "pages");
   return existsSync22(appDir) || existsSync22(pagesDir) || existsSync22(rootAppDir) || existsSync22(rootPagesDir);
 }
 function getStandaloneServerPath(webDir) {
   const possiblePaths2 = [
-    join17(webDir, ".next", "standalone", "server.js"),
-    join17(webDir, ".next", "standalone", "web", "server.js")
+    join19(webDir, ".next", "standalone", "server.js"),
+    join19(webDir, ".next", "standalone", "web", "server.js")
   ];
   for (const serverPath of possiblePaths2) {
     if (existsSync22(serverPath)) {
@@ -16484,7 +17911,7 @@ function getStandaloneServerPath(webDir) {
 }
 function runCommand(command, args, cwd, env) {
   return new Promise((resolve14) => {
-    const child = spawn2(command, args, {
+    const child = spawn3(command, args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
       env,
@@ -16516,15 +17943,15 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
     if (!quiet) console.log(`  \u2713 Web UI already running at http://localhost:${actualPort}`);
     return { process: null, port: actualPort };
   }
-  const usePnpm = existsSync22(join17(webDir, "pnpm-lock.yaml"));
-  const useNpm = !usePnpm && existsSync22(join17(webDir, "package-lock.json"));
+  const usePnpm = existsSync22(join19(webDir, "pnpm-lock.yaml"));
+  const useNpm = !usePnpm && existsSync22(join19(webDir, "package-lock.json"));
   const pkgManager = usePnpm ? "pnpm" : useNpm ? "npm" : "npx";
   const { NODE_OPTIONS, TSX_TSCONFIG_PATH, ...cleanEnv } = process.env;
   const apiUrl = publicUrl || `http://127.0.0.1:${apiPort}`;
-  const runtimeConfig = { apiBaseUrl: apiUrl };
-  const runtimeConfigPath = join17(webDir, "runtime-config.json");
+  const runtimeConfig = { apiBaseUrl: apiUrl, localApiBaseUrl: `http://127.0.0.1:${apiPort}` };
+  const runtimeConfigPath = join19(webDir, "runtime-config.json");
   try {
-    writeFileSync7(runtimeConfigPath, JSON.stringify(runtimeConfig, null, 2));
+    writeFileSync8(runtimeConfigPath, JSON.stringify(runtimeConfig, null, 2));
     if (!quiet) console.log(`  \u{1F4DD} Runtime config written to ${runtimeConfigPath}`);
   } catch (err) {
     if (!quiet) console.warn(`  \u26A0 Could not write runtime config: ${err}`);
@@ -16544,7 +17971,7 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
   if (standaloneServerPath) {
     command = "node";
     args = ["server.js"];
-    cwd = dirname10(standaloneServerPath);
+    cwd = dirname11(standaloneServerPath);
     webEnv.PORT = String(actualPort);
     webEnv.HOSTNAME = "0.0.0.0";
     if (!quiet) console.log("  \u{1F4E6} Starting Web UI from standalone build...");
@@ -16574,7 +18001,7 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
     }
     return { process: null, port: actualPort };
   }
-  const child = spawn2(command, args, {
+  const child = spawn3(command, args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"],
     env: webEnv,
@@ -16582,12 +18009,12 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
     shell: true
   });
   const startupTimeout = 3e4;
-  let started = false;
+  let started2 = false;
   let exited = false;
   let exitCode = null;
   const startedPromise = new Promise((resolve14) => {
     const timeout = setTimeout(() => {
-      if (!started && !exited) {
+      if (!started2 && !exited) {
         resolve14(false);
       }
     }, startupTimeout);
@@ -16599,8 +18026,8 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
           console.log(`  Web UI: ${line}`);
         }
       }
-      if (!started && (output.includes("Ready") || output.includes("started") || output.includes("localhost"))) {
-        started = true;
+      if (!started2 && (output.includes("Ready") || output.includes("started") || output.includes("localhost"))) {
+        started2 = true;
         clearTimeout(timeout);
         resolve14(true);
       }
@@ -16619,7 +18046,7 @@ async function startWebUI(apiPort, webPort = DEFAULT_WEB_PORT, quiet = false, pu
     child.on("exit", (code) => {
       exited = true;
       exitCode = code;
-      if (!started) {
+      if (!started2) {
         clearTimeout(timeout);
         resolve14(false);
       }
@@ -16739,7 +18166,7 @@ async function startServer(options = {}) {
     config.resolvedWorkingDirectory = options.workingDirectory;
   }
   if (!existsSync22(config.resolvedWorkingDirectory)) {
-    mkdirSync10(config.resolvedWorkingDirectory, { recursive: true });
+    mkdirSync11(config.resolvedWorkingDirectory, { recursive: true });
     if (!options.quiet) console.log(`\u{1F4C1} Created agent workspace: ${config.resolvedWorkingDirectory}`);
   }
   if (!config.resolvedRemoteServer.url) {
@@ -16770,9 +18197,17 @@ async function startServer(options = {}) {
   try {
     const { startOrchestratorDaemon: startOrchestratorDaemon2 } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
     startOrchestratorDaemon2();
+    const { startReconciler: startReconciler2 } = await Promise.resolve().then(() => (init_inbox_acks(), inbox_acks_exports));
+    startReconciler2();
   } catch (err) {
     if (!options.quiet) console.warn(`[daemon] start skipped: ${err.message}`);
   }
+  try {
+    const { startSelfUpdater: startSelfUpdater2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
+    startSelfUpdater2();
+  } catch (err) {
+    if (!options.quiet) console.warn(`[self-update] start skipped: ${err.message}`);
+  }
   try {
     const { startScheduler: startScheduler2 } = await Promise.resolve().then(() => (init_scheduler(), scheduler_exports));
     startScheduler2({ quiet: options.quiet });
@@ -17297,18 +18732,18 @@ function generateOpenAPISpec() {
 init_config();
 init_semantic();
 init_db();
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync8, readFileSync as readFileSync11, existsSync as existsSync23, statSync as statSync4, unlinkSync as unlinkSync3 } from "fs";
-import { resolve as resolve13, join as join18 } from "path";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync9, readFileSync as readFileSync12, existsSync as existsSync23, statSync as statSync4, unlinkSync as unlinkSync3 } from "fs";
+import { resolve as resolve13, join as join20 } from "path";
 function getCliVersion() {
-  const here = dirname11(fileURLToPath5(import.meta.url));
+  const here = dirname12(fileURLToPath6(import.meta.url));
   const candidates = [
-    join18(here, "..", "package.json"),
-    join18(here, "..", "..", "package.json"),
-    join18(process.cwd(), "package.json")
+    join20(here, "..", "package.json"),
+    join20(here, "..", "..", "package.json"),
+    join20(process.cwd(), "package.json")
   ];
   for (const p of candidates) {
     try {
-      const pkg = JSON.parse(readFileSync11(p, "utf8"));
+      const pkg = JSON.parse(readFileSync12(p, "utf8"));
       if (pkg.name === "sparkecoder" && pkg.version) return pkg.version;
     } catch {
     }
@@ -17926,7 +19361,7 @@ program.command("server").description("Start the SparkECoder server (API + Web U
 program.command("chat").description("Start an interactive chat session").option("-s, --session <id>", "Resume an existing session").option("-n, --name <name>", "Name for the new session").option("-m, --model <model>", "Model to use").option("-w, --working-dir <path>", "Working directory").option("-c, --config <path>", "Path to config file").option("-p, --port <port>", "Server port", "3141").option("-H, --host <host>", "Server host", "127.0.0.1").option("--no-auto-start", "Do not auto-start server if not running").option("--web-port <port>", "Web UI port", "6969").option("--no-web", "Do not start web UI when auto-starting server").option("--public-url <url>", "Public URL for web UI to connect to API (for Docker/remote access)").option("-v, --verbose", "Enable verbose logging for web server").option("--dangerously-skip-approvals", "Auto-approve all tool calls (no confirmation prompts)").action(async (options) => {
   await runChat(options);
 });
-program.command("task").description("Run an autonomous task that completes without human interaction").requiredOption("--prompt <prompt>", "Task prompt describing what to do").requiredOption("--schema <schema>", "JSON Schema for the output (file path or inline JSON string)").option("--webhook <url>", "Webhook URL to receive task events").option("-m, --model <model>", "Model to use").option("-w, --working-dir <path>", "Working directory").option("-n, --name <name>", "Name for the task").option("--max-iterations <n>", "Maximum agent loop iterations", "50").option("-p, --port <port>", "Server port", "3141").option("-H, --host <host>", "Server host", "127.0.0.1").option("-c, --config <path>", "Path to config file").option("--no-auto-start", "Do not auto-start server if not running").option("--parent-task <id>", "Continue from a previous task (inherits its full conversation context)").option("--wait", "Block and poll until task completes").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+program.command("task").description("Run an autonomous task that completes without human interaction").requiredOption("--prompt <prompt>", "Task prompt describing what to do").requiredOption("--schema <schema>", "JSON Schema for the output (file path or inline JSON string)").option("--webhook <url>", "Webhook URL to receive task events").option("-m, --model <model>", "Model to use").option("-w, --working-dir <path>", "Working directory").option("-n, --name <name>", "Name for the task").option("--max-iterations <n>", "Maximum agent loop iterations", "50").option("-p, --port <port>", "Server port", "3141").option("-H, --host <host>", "Server host", "127.0.0.1").option("-c, --config <path>", "Path to config file").option("--no-auto-start", "Do not auto-start server if not running").option("--parent-task <id>", "Continue from a previous task (inherits its full conversation context)").option("--mcp <servers>", "Task-scoped MCP servers as a JSON array (file path or inline JSON). Each: {name, transport, url?, headers?, command?, args?, env?}").option("--skills <skills>", "Task-scoped skills as a JSON array (file path or inline JSON). Each: {name, description?, content, alwaysApply?, globs?}").option("--wait", "Block and poll until task completes").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
   await ensureDependencies({ quiet: true });
   loadApiKeysIntoEnv();
   const baseUrl = `http://${options.host}:${options.port}`;
@@ -17956,7 +19391,7 @@ program.command("task").description("Run an autonomous task that completes witho
   try {
     const schemaStr = options.schema;
     if (existsSync23(schemaStr)) {
-      outputSchema = JSON.parse(readFileSync11(schemaStr, "utf-8"));
+      outputSchema = JSON.parse(readFileSync12(schemaStr, "utf-8"));
     } else {
       outputSchema = JSON.parse(schemaStr);
     }
@@ -17975,6 +19410,30 @@ program.command("task").description("Run an autonomous task that completes witho
   if (options.workingDir) body.workingDirectory = options.workingDir;
   if (options.name) body.name = options.name;
   if (options.parentTask) body.parentTaskId = options.parentTask;
+  const parseJsonArrayOption = (raw, label) => {
+    const text = existsSync23(raw) ? readFileSync12(raw, "utf-8") : raw;
+    const parsed = JSON.parse(text);
+    if (!Array.isArray(parsed)) {
+      throw new Error(`${label} must be a JSON array`);
+    }
+    return parsed;
+  };
+  if (options.mcp) {
+    try {
+      body.mcpServers = parseJsonArrayOption(options.mcp, "--mcp");
+    } catch (err) {
+      console.error(chalk.red(`Invalid --mcp value: ${err.message}`));
+      process.exit(1);
+    }
+  }
+  if (options.skills) {
+    try {
+      body.skills = parseJsonArrayOption(options.skills, "--skills");
+    } catch (err) {
+      console.error(chalk.red(`Invalid --skills value: ${err.message}`));
+      process.exit(1);
+    }
+  }
   const spinner = ora("Creating task...").start();
   const response = await apiRequest(baseUrl, "/tasks", {
     method: "POST",
@@ -18023,7 +19482,7 @@ program.command("init").description("Create a sparkecoder.config.json file").opt
   let configLocation;
   if (options.global) {
     const appDataDir = ensureAppDataDirectory();
-    configPath = join18(appDataDir, "sparkecoder.config.json");
+    configPath = join20(appDataDir, "sparkecoder.config.json");
     configLocation = "global";
   } else {
     configPath = resolve13(process.cwd(), "sparkecoder.config.json");
@@ -18035,7 +19494,7 @@ program.command("init").description("Create a sparkecoder.config.json file").opt
     return;
   }
   const config = createDefaultConfig();
-  writeFileSync8(configPath, JSON.stringify(config, null, 2));
+  writeFileSync9(configPath, JSON.stringify(config, null, 2));
   console.log(chalk.green(`\u2713 Created ${configLocation} config`));
   console.log(chalk.dim(`  ${configPath}`));
   console.log(chalk.dim("Set AI_GATEWAY_API_KEY and run sparkecoder to start"));
@@ -18054,11 +19513,11 @@ program.command("slack-setup").description("Interactively configure Slack integr
       console.error(chalk.red("Both bot token and signing secret are required."));
       process.exit(1);
     }
-    const configPath = options.global ? join18(ensureAppDataDirectory(), "sparkecoder.config.json") : resolve13(process.cwd(), "sparkecoder.config.json");
+    const configPath = options.global ? join20(ensureAppDataDirectory(), "sparkecoder.config.json") : resolve13(process.cwd(), "sparkecoder.config.json");
     let existing = {};
     if (existsSync23(configPath)) {
       try {
-        existing = JSON.parse(readFileSync11(configPath, "utf-8"));
+        existing = JSON.parse(readFileSync12(configPath, "utf-8"));
       } catch {
       }
     } else {
@@ -18070,7 +19529,7 @@ program.command("slack-setup").description("Interactively configure Slack integr
       signingSecret,
       defaultOrchestratorName: existing.slack?.defaultOrchestratorName ?? "orchestrator"
     };
-    writeFileSync8(configPath, JSON.stringify(existing, null, 2));
+    writeFileSync9(configPath, JSON.stringify(existing, null, 2));
     console.log(chalk.green(`
 \u2713 Slack configured`));
     console.log(chalk.dim(`  ${configPath}`));
@@ -18138,15 +19597,15 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
   if (options.remote) {
     try {
       let config = loadConfig(options.config, process.cwd());
-      let remoteUrl = config.resolvedRemoteServer.url;
-      if (!remoteUrl) {
+      let remoteUrl2 = config.resolvedRemoteServer.url;
+      if (!remoteUrl2) {
         console.log(chalk.red("No remoteServer.url configured. Run `sparkecoder login` (or set remoteServer.url in your config) first."));
         process.exitCode = 1;
         return;
       }
       let authKey3 = config.resolvedRemoteServer.authKey;
       if (!authKey3) {
-        authKey3 = await ensureRemoteAuthKey(remoteUrl);
+        authKey3 = await ensureRemoteAuthKey(remoteUrl2);
       }
       const setupSecret = options.setupSecret || process.env.SPARKECODER_SETUP_SECRET || process.env.SPARKECODER_TUNNEL_SECRET;
       const hostname = options.hostname;
@@ -18160,7 +19619,7 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
         name: tunnelName
       };
       if (hostname) reqBody.hostname = hostname;
-      const res = await fetch(`${remoteUrl.replace(/\/$/, "")}${path}`, {
+      const res = await fetch(`${remoteUrl2.replace(/\/$/, "")}${path}`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -18175,7 +19634,7 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
         process.exitCode = 1;
         return;
       }
-      const { tunnelToken, hostname: provisionedHost, apiHostname, reused, webhookToken, webhookBaseUrl } = await res.json();
+      const { tunnelToken, hostname: provisionedHost, apiHostname, reused, webhookToken, webhookBaseUrl, cfAccess } = await res.json();
       if (reused) {
         console.log(chalk.dim("\u2713 Re-using existing tunnel \u2014 no new tunnel created on Cloudflare."));
       }
@@ -18193,6 +19652,20 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
           console.warn(chalk.yellow(`Could not persist webhook token: ${err?.message ?? err}`));
         }
       }
+      if (cfAccess?.teamDomain && cfAccess?.audTag) {
+        try {
+          setCfAccessConfig({
+            enabled: true,
+            teamDomain: cfAccess.teamDomain,
+            audTag: cfAccess.audTag,
+            allowedEmails: cfAccess.allowedEmails ?? []
+          });
+          const n = (cfAccess.allowedEmails ?? []).length;
+          console.log(chalk.dim(`\u2713 Enabled Cloudflare Access locally (allowlist: ${n} email${n === 1 ? "" : "s"}).`));
+        } catch (err) {
+          console.warn(chalk.yellow(`Could not persist Cloudflare Access config: ${err?.message ?? err}`));
+        }
+      }
       const cfPath = await installCloudflaredIfNeeded();
       if (!cfPath) {
         console.log(chalk.yellow("cloudflared not installed; run this once installed:"));
@@ -18322,8 +19795,8 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
     }
     const verOut = run("cloudflared", ["--version"]).stdout?.toString().split("\n")[0] || "installed";
     console.log(chalk.green("\u2713"), "cloudflared:", chalk.dim(verOut));
-    const cfDir = join18(homedir2(), ".cloudflared");
-    const certPath = join18(cfDir, "cert.pem");
+    const cfDir = join20(homedir2(), ".cloudflared");
+    const certPath = join20(cfDir, "cert.pem");
     if (!existsSync23(certPath)) {
       console.log(chalk.yellow("No Cloudflare login cert found."));
       if (await confirm("Run `cloudflared tunnel login` now (opens a browser)?", true)) {
@@ -18368,7 +19841,7 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
         return;
       }
     }
-    const credsFile = tunnel.credentials_file || join18(cfDir, `${tunnel.id}.json`);
+    const credsFile = tunnel.credentials_file || join20(cfDir, `${tunnel.id}.json`);
     if (!existsSync23(credsFile)) {
       console.log(chalk.yellow(`Credentials file not found at ${credsFile}. The tunnel may still work via cert.pem.`));
     }
@@ -18392,7 +19865,7 @@ program.command("cloudflared-setup").description("Auto-detect cloudflared + set
         console.log(chalk.yellow("DNS route warning:"), err.trim().split("\n").slice(-2).join(" "));
       }
     }
-    const configPath = join18(cfDir, "config.yml");
+    const configPath = join20(cfDir, "config.yml");
     const configBody = `tunnel: ${tunnel.id}
 credentials-file: ${credsFile}
 ingress:
@@ -18404,13 +19877,13 @@ ingress:
 `;
     let wroteConfig = false;
     if (existsSync23(configPath)) {
-      const existing = readFileSync11(configPath, "utf8");
+      const existing = readFileSync12(configPath, "utf8");
       if (existing.trim() === configBody.trim()) {
         console.log(chalk.green("\u2713"), `config.yml already up to date: ${configPath}`);
         wroteConfig = true;
       } else if (await confirm(`A different ${configPath} exists. Overwrite (a backup will be saved)?`, false)) {
         copyFileSync(configPath, `${configPath}.bak.${Date.now()}`);
-        writeFileSync8(configPath, configBody);
+        writeFileSync9(configPath, configBody);
         console.log(chalk.green("\u2713"), `wrote ${configPath} (previous saved as .bak.*)`);
         wroteConfig = true;
       } else {
@@ -18418,7 +19891,7 @@ ingress:
         console.log(chalk.cyan(configBody));
       }
     } else {
-      writeFileSync8(configPath, configBody);
+      writeFileSync9(configPath, configBody);
       console.log(chalk.green("\u2713"), `wrote ${configPath}`);
       wroteConfig = true;
     }
@@ -18521,8 +19994,8 @@ program.command("index").description("Index repository for semantic search").opt
   try {
     const workingDir = options.workingDir ? resolve13(options.workingDir) : process.cwd();
     let config = loadConfig(options.config, workingDir);
-    const remoteUrl = config.resolvedRemoteServer.url;
-    if (!remoteUrl) {
+    const remoteUrl2 = config.resolvedRemoteServer.url;
+    if (!remoteUrl2) {
       console.error(chalk.red("Error: Remote server not configured"));
       console.log(chalk.dim("Set REMOTE_SERVER_URL environment variable or remoteServer.url in config"));
       process.exit(1);
@@ -18530,7 +20003,7 @@ program.command("index").description("Index repository for semantic search").opt
     let authKey3 = config.resolvedRemoteServer.authKey;
     if (!authKey3) {
       console.log(chalk.dim("Registering with remote server..."));
-      authKey3 = await ensureRemoteAuthKey(remoteUrl);
+      authKey3 = await ensureRemoteAuthKey(remoteUrl2);
       config = loadConfig(options.config, workingDir);
       authKey3 = config.resolvedRemoteServer.authKey || authKey3;
     }
@@ -18539,7 +20012,7 @@ program.command("index").description("Index repository for semantic search").opt
       console.log(chalk.dim("Set SPARKECODER_AUTH_KEY or run sparkecoder to register with the remote server"));
       process.exit(1);
     }
-    initDatabase({ url: remoteUrl, authKey: authKey3 });
+    initDatabase({ url: remoteUrl2, authKey: authKey3 });
     if (!isGitRepository(workingDir)) {
       console.error(chalk.red("Error: Not a git repository"));
       console.log(chalk.dim("Semantic indexing requires a git repository with a remote configured."));
@@ -18655,20 +20128,20 @@ program.command("search").description("Search indexed repository using semantic
   try {
     const workingDir = options.workingDir ? resolve13(options.workingDir) : process.cwd();
     const config = loadConfig(options.config, workingDir);
-    const remoteUrl = config.resolvedRemoteServer.url;
-    if (!remoteUrl) {
+    const remoteUrl2 = config.resolvedRemoteServer.url;
+    if (!remoteUrl2) {
       console.error(chalk.red("Error: Remote server not configured"));
       process.exit(1);
     }
     let authKey3 = config.resolvedRemoteServer.authKey;
     if (!authKey3) {
-      authKey3 = await ensureRemoteAuthKey(remoteUrl);
+      authKey3 = await ensureRemoteAuthKey(remoteUrl2);
     }
     if (!authKey3) {
       console.error(chalk.red("Error: Remote auth key not available"));
       process.exit(1);
     }
-    initDatabase({ url: remoteUrl, authKey: authKey3 });
+    initDatabase({ url: remoteUrl2, authKey: authKey3 });
     const namespace = await getRepoNamespace(workingDir, config.resolvedVectorGateway.namespace);
     if (!namespace) {
       console.error(chalk.red("Error: Could not determine repository namespace"));
@@ -18910,17 +20383,17 @@ program.command("request-permissions").description("Open System Settings to the
   let shellEscape2 = function(str) {
     return `'${str.replace(/'/g, "'\\''")}'`;
   }, stateFilePath = function() {
-    return join18(ensureAppDataDirectory(), "recordings.json");
-  }, readState = function() {
+    return join20(ensureAppDataDirectory(), "recordings.json");
+  }, readState2 = function() {
     const p = stateFilePath();
     if (!existsSync23(p)) return [];
     try {
-      return JSON.parse(readFileSync11(p, "utf-8"));
+      return JSON.parse(readFileSync12(p, "utf-8"));
     } catch {
       return [];
     }
-  }, writeState = function(rows) {
-    writeFileSync8(stateFilePath(), JSON.stringify(rows, null, 2), { mode: 384 });
+  }, writeState2 = function(rows) {
+    writeFileSync9(stateFilePath(), JSON.stringify(rows, null, 2), { mode: 384 });
   }, isAlive = function(pid) {
     try {
       process.kill(pid, 0);
@@ -18931,7 +20404,7 @@ program.command("request-permissions").description("Open System Settings to the
   }, pruneDead = function(rows) {
     return rows.filter((r) => isAlive(r.pid));
   };
-  shellEscape3 = shellEscape2, stateFilePath2 = stateFilePath, readState2 = readState, writeState2 = writeState, isAlive2 = isAlive, pruneDead2 = pruneDead;
+  shellEscape3 = shellEscape2, stateFilePath2 = stateFilePath, readState3 = readState2, writeState3 = writeState2, isAlive2 = isAlive, pruneDead2 = pruneDead;
   async function stopRecorderPid(pid) {
     if (!isAlive(pid)) return;
     try {
@@ -18993,12 +20466,12 @@ program.command("request-permissions").description("Open System Settings to the
   const record = program.command("record").description("Start/stop screen recordings");
   record.command("start").description("Start a screen recording (returns id, path, pid as JSON)").option("--name <slug>", "Optional human-readable label for the recording").option("--dir <path>", "Output directory (default: ~/recordings)").action(async (opts) => {
     const { homedir: homedir2, platform: osPlatform } = await import("os");
-    const outDir = opts.dir ? resolve13(opts.dir.replace(/^~/, homedir2())) : join18(homedir2(), "recordings");
-    mkdirSync11(outDir, { recursive: true });
+    const outDir = opts.dir ? resolve13(opts.dir.replace(/^~/, homedir2())) : join20(homedir2(), "recordings");
+    mkdirSync12(outDir, { recursive: true });
     const id = `rec-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
     const ext = "mp4";
     const filename = `${id}${opts.name ? `-${String(opts.name).replace(/[^a-z0-9-]+/gi, "-").toLowerCase()}` : ""}.${ext}`;
-    const path = join18(outDir, filename);
+    const path = join20(outDir, filename);
     let cmd;
     let args;
     let capturePath;
@@ -19080,13 +20553,13 @@ program.command("request-permissions").description("Open System Settings to the
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       platform: osPlatform()
     };
-    const rows = pruneDead(readState());
+    const rows = pruneDead(readState2());
     rows.push(row);
-    writeState(rows);
+    writeState2(rows);
     console.log(JSON.stringify({ id, path, pid: child.pid, platform: osPlatform() }));
   });
   record.command("stop <id>").description("Stop a recording started by `sparkecoder record start`").action(async (id) => {
-    const rows = readState();
+    const rows = readState2();
     const row = rows.find((r) => r.id === id);
     if (!row) {
       console.error(JSON.stringify({ error: `No recording found with id ${id}` }));
@@ -19094,7 +20567,7 @@ program.command("request-permissions").description("Open System Settings to the
     }
     const startedAt = new Date(row.startedAt).getTime();
     const { path: finalPath, ok, sizeMb, warning } = await finalizeRecording(row);
-    writeState(rows.filter((r) => r.id !== id));
+    writeState2(rows.filter((r) => r.id !== id));
     console.log(JSON.stringify({
       id,
       path: finalPath,
@@ -19105,25 +20578,25 @@ program.command("request-permissions").description("Open System Settings to the
     }));
   });
   record.command("list").description("List active recordings").action(() => {
-    const rows = pruneDead(readState());
-    writeState(rows);
+    const rows = pruneDead(readState2());
+    writeState2(rows);
     console.log(JSON.stringify(rows, null, 2));
   });
   record.command("stop-all").description("Stop every active recording").action(async () => {
-    const rows = readState();
+    const rows = readState2();
     const stopped = [];
     for (const r of rows) {
       const { path: finalPath, ok, warning } = await finalizeRecording(r);
       stopped.push({ id: r.id, path: finalPath, ok, ...warning ? { warning } : {} });
     }
-    writeState([]);
+    writeState2([]);
     console.log(JSON.stringify({ stopped }));
   });
 }
 var shellEscape3;
 var stateFilePath2;
-var readState2;
-var writeState2;
+var readState3;
+var writeState3;
 var isAlive2;
 var pruneDead2;
 program.parse();