usebeeline 0.0.100 → 0.0.105

package/dist/usebeeline.mjs

@@ -3987,7 +3987,7 @@ __export(self_update_exports, {
 import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { access, chmod as chmod5, lstat as lstat3, mkdir as mkdir15, open, readFile as readFile10, rename as rename4, rm as rm6, symlink as symlink3, writeFile as writeFile10 } from "node:fs/promises";
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
 import { dirname as dirname11, join as join9, resolve as resolve22 } from "node:path";
 function anchorLayout(rawLibDir) {
@@ -4137,7 +4137,7 @@ async function fetchText(url, fetchImpl) {
 }
 function run(command, args, timeoutMs) {
   return new Promise((resolveRun) => {
-    const child = spawn4(command, args, { stdio: ["ignore", "ignore", "pipe"] });
+    const child = spawn5(command, args, { stdio: ["ignore", "ignore", "pipe"] });
     let stderr = "";
     child.stderr?.setEncoding("utf8");
     child.stderr?.on("data", (chunk) => {
@@ -4210,7 +4210,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     }
     await writeFile10(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
-      const child = spawn4("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
+      const child = spawn5("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
       child.stdout?.on("data", (chunk) => {
         out += chunk.toString("utf8");
@@ -4389,44 +4389,44 @@ async function readUpdateAttempt(layout) {
     return void 0;
   }
 }
-async function writeUpdateAttempt(layout, record2) {
+async function writeUpdateAttempt(layout, record3) {
   await mkdir15(join9(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile10(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile10(staged, `${JSON.stringify(record3, null, 2)}
 `, { mode: 384 });
   await rename4(staged, path);
 }
-async function replaceUpdateAttempt(layout, record2) {
-  await writeUpdateAttempt(layout, record2);
+async function replaceUpdateAttempt(layout, record3) {
+  await writeUpdateAttempt(layout, record3);
 }
-async function writeUpdateAttemptFixture(layout, record2) {
+async function writeUpdateAttemptFixture(layout, record3) {
   await writeUpdateAttempt(layout, {
-    ...record2,
-    version: record2.version ?? 1,
-    confirmBy: record2.confirmBy ?? record2.appliedAt + DEFAULT_UPDATE_CONFIRM_WINDOW_MS,
-    status: record2.status ?? "pending"
+    ...record3,
+    version: record3.version ?? 1,
+    confirmBy: record3.confirmBy ?? record3.appliedAt + DEFAULT_UPDATE_CONFIRM_WINDOW_MS,
+    status: record3.status ?? "pending"
   });
 }
 async function settleUpdateAttemptOnStart(layout, opts = {}) {
-  const record2 = await readUpdateAttempt(layout);
-  if (!record2 || record2.status !== "pending")
+  const record3 = await readUpdateAttempt(layout);
+  if (!record3 || record3.status !== "pending")
     return { kind: "none" };
   const now2 = opts.now ?? Date.now;
-  const confirmAt = opts.confirmWindowMs ? record2.appliedAt + opts.confirmWindowMs : record2.confirmBy;
+  const confirmAt = opts.confirmWindowMs ? record3.appliedAt + opts.confirmWindowMs : record3.confirmBy;
   if (now2() <= confirmAt) {
-    return { kind: "pending", confirmAt, record: record2 };
+    return { kind: "pending", confirmAt, record: record3 };
   }
-  if (record2.previousReleaseId) {
-    await rollbackToPreviousRelease(layout, record2.previousReleaseId);
+  if (record3.previousReleaseId) {
+    await rollbackToPreviousRelease(layout, record3.previousReleaseId);
   }
   await writeUpdateAttempt(layout, {
-    ...record2,
+    ...record3,
     confirmBy: confirmAt,
     status: "reverted",
     failure: "update did not serve a verified turn before its confirmation deadline"
   });
-  return { kind: "rolled-back", record: record2 };
+  return { kind: "rolled-back", record: record3 };
 }
 function describeIdentity(identity) {
   if (!identity)
@@ -6864,13 +6864,13 @@ function parseAvailableCommands(value) {
   for (const entry of value) {
     if (!entry || typeof entry !== "object")
       continue;
-    const record2 = entry;
-    const rawName = typeof record2.name === "string" ? record2.name.trim().replace(/^\/+/, "") : "";
+    const record3 = entry;
+    const rawName = typeof record3.name === "string" ? record3.name.trim().replace(/^\/+/, "") : "";
     if (!rawName || rawName.length > 80 || seen.has(rawName))
       continue;
     seen.add(rawName);
-    const description = typeof record2.description === "string" && record2.description.trim() ? record2.description.trim().slice(0, 300) : void 0;
-    const input = record2.input;
+    const description = typeof record3.description === "string" && record3.description.trim() ? record3.description.trim().slice(0, 300) : void 0;
+    const input = record3.input;
     const hintRaw = input && typeof input.hint === "string" ? input.hint : void 0;
     const inputHint = hintRaw && hintRaw.trim() ? hintRaw.trim().slice(0, 120) : void 0;
     result.push({
@@ -6898,13 +6898,8 @@ var PI_ACP_HARNESS = /(^|[/\\])pi-acp(?:\.[a-z]+)?$/i;
 function isPiAcpHarness(agentLabel) {
   return Boolean(agentLabel && PI_ACP_HARNESS.test(agentLabel));
 }
-function withoutOneTrailingLineEnding(text2) {
-  if (/\r?\n\r?\n$/.test(text2))
-    return text2;
-  return text2.replace(/\r?\n$/, "");
-}
-function normalizeStreamDelta(text2, agentLabel) {
-  return agentLabel && PI_ACP_HARNESS.test(agentLabel) ? withoutOneTrailingLineEnding(text2) : text2;
+function normalizeStreamDelta(text2, _agentLabel) {
+  return text2;
 }
 function agentMessageRuns(updates, agentLabel) {
   const runs = [];
@@ -7727,12 +7722,12 @@ function parseAdvertisedConfigOptions(raw, preferredModelId, includeLaunchEffort
   for (const entry of Array.isArray(configOptions) ? configOptions : []) {
     if (!entry || typeof entry !== "object")
       continue;
-    const record2 = entry;
-    const id = record2.id;
-    const category = record2.category;
+    const record3 = entry;
+    const id = record3.id;
+    const category = record3.category;
     if (typeof id !== "string" || typeof category !== "string")
       continue;
-    const rawChoices = Array.isArray(record2.options) ? record2.options : [];
+    const rawChoices = Array.isArray(record3.options) ? record3.options : [];
     const choices = [];
     for (const rawChoice of rawChoices) {
       if (!rawChoice || typeof rawChoice !== "object")
@@ -7749,7 +7744,7 @@ function parseAdvertisedConfigOptions(raw, preferredModelId, includeLaunchEffort
     result.push({
       id,
       category,
-      ...typeof record2.currentValue === "string" ? { currentValue: record2.currentValue } : {},
+      ...typeof record3.currentValue === "string" ? { currentValue: record3.currentValue } : {},
       options: category === "model" ? sortModelChoicesNewestFirst(choices) : choices
     });
   }
@@ -7857,8 +7852,8 @@ function credentialedPiCustomProviders(env) {
     };
     if (Array.isArray(providers)) {
       for (const provider of providers) {
-        const record2 = provider;
-        remember(record2?.name ?? record2?.id, record2);
+        const record3 = provider;
+        remember(record3?.name ?? record3?.id, record3);
       }
     } else if (providers && typeof providers === "object") {
       for (const [name, config] of Object.entries(providers)) {
@@ -8161,6 +8156,483 @@ async function syncAgentModelCatalog(input) {
   }
 }
 
+// apps/body/dist/connector-squire.js
+import { execFile } from "node:child_process";
+var REMOTE_LOGIN_BINARIES = ["Xvfb", "x11vnc", "websockify", "cloudflared"];
+var SQUIRE_CONNECT_PACKAGE = "@trusty-squire/mcp";
+var defaultShellRunner = (command, args) => new Promise((resolve31) => {
+  execFile(command, [...args], { timeout: 12e4, maxBuffer: 4 * 1024 * 1024, encoding: "utf8" }, (error, stdout6, stderr) => {
+    const code = error?.code;
+    resolve31({
+      code: typeof code === "number" ? code : error ? 1 : 0,
+      stdout: String(stdout6 ?? ""),
+      stderr: String(stderr ?? "")
+    });
+  });
+});
+var step = (label, status, reason) => ({
+  label,
+  status,
+  ...reason ? { reason } : {}
+});
+function binaryExists(binary) {
+  return new Promise((resolve31) => {
+    execFile("sh", ["-c", `command -v ${JSON.stringify(binary)}`], (error, stdout6) => {
+      const path = String(stdout6 ?? "").trim();
+      resolve31({ binary, found: !error && path.length > 0, ...path ? { path } : {} });
+    });
+  });
+}
+async function checkRemoteLoginPrerequisites(probe = binaryExists) {
+  return Promise.all(REMOTE_LOGIN_BINARIES.map(probe));
+}
+function missingPrerequisiteStep(checks) {
+  const missing = checks.filter((check) => !check.found).map((check) => check.binary);
+  return step("remote sign-in prerequisites", "failed", `missing on this helper: ${missing.join(", ")}`);
+}
+function parseConnectOutput(output) {
+  const url = output.match(/https:\/\/[^\s"'<>]+/)?.[0];
+  if (!url)
+    return void 0;
+  if (/oauth|authorize/i.test(url) || /oauth/i.test(output)) {
+    return { method: "oauth", url };
+  }
+  if (/novnc|vnc\.html|remote|stream/i.test(url) || /novnc|remote login|vnc/i.test(output)) {
+    return { method: "streamed-page", url };
+  }
+  return { method: "streamed-page", url };
+}
+async function installedSquireVersion(run2) {
+  const probe = await run2("npx", ["-y", SQUIRE_CONNECT_PACKAGE, "--version"]);
+  const version = probe.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0];
+  return version;
+}
+function parseSignedInAs(output) {
+  return output.match(/signed in as ([^\s,;]+)/i)?.[1];
+}
+async function installSquire(options) {
+  const run2 = options.run ?? defaultShellRunner;
+  const steps = [step("helper reached", "done")];
+  const emit = () => options.onProgress?.([...steps]);
+  const push = (next) => {
+    steps.push(next);
+    emit();
+  };
+  const fail = (reason) => {
+    steps.push(step("waiting for sign-in", "pending"));
+    emit();
+    return { status: "error", steps, errorMessage: reason };
+  };
+  emit();
+  const checks = await checkRemoteLoginPrerequisites(options.probeBinary);
+  if (checks.some((check) => !check.found)) {
+    push(missingPrerequisiteStep(checks));
+    return fail("this helper cannot host the remote sign-in surface");
+  }
+  push(step("remote sign-in prerequisites", "done"));
+  const install = await run2("npx", [
+    "-y",
+    SQUIRE_CONNECT_PACKAGE,
+    "connect",
+    "--target=pi",
+    "--skip-browser"
+  ]);
+  if (install.code !== 0) {
+    push(step("trusty-squire installed", "failed", install.stderr.trim() || "connect failed"));
+    return fail("the trusty-squire install command failed");
+  }
+  const version = await installedSquireVersion(run2);
+  push(step(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
+  const output = `${install.stdout}
+${install.stderr}`;
+  const signIn = parseConnectOutput(output);
+  if (!signIn) {
+    push(step("waiting for sign-in", "failed", "connect printed no sign-in URL"));
+    return fail("the trusty-squire connect command printed no sign-in surface");
+  }
+  push(step("waiting for sign-in", "done"));
+  const signedInAs = parseSignedInAs(output);
+  const pair = await pairSquire(options.mcp, options.workspaceId);
+  if (!pair.ok) {
+    push(step("paired to workspace", "failed", pair.reason));
+    return {
+      status: "installing",
+      steps,
+      signIn,
+      ...version ? { squireVersion: version } : {},
+      ...signedInAs ? { signedInAs } : {}
+    };
+  }
+  push(step("paired to workspace", "done"));
+  return {
+    status: "connected",
+    steps,
+    signIn,
+    ...version ? { squireVersion: version } : {},
+    ...signedInAs ? { signedInAs } : {}
+  };
+}
+async function pairSquire(mcp, _workspaceId) {
+  if (!mcp)
+    return { ok: false, reason: "the Squire MCP surface is not mounted on this helper" };
+  try {
+    await mcp.call("list_credentials", { fields: "summary" });
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function stringList(value) {
+  return asArray(value).filter((entry) => typeof entry === "string");
+}
+function numberOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function vaultConnectionMeta(raw) {
+  const record3 = asRecord(raw);
+  const reference = String(record3.reference ?? record3.id ?? "");
+  return {
+    reference,
+    service: typeof record3.service === "string" ? record3.service : null,
+    label: String(record3.label ?? record3.service ?? reference),
+    fieldNames: stringList(record3.field_names ?? record3.fieldNames),
+    allowedHosts: stringList(record3.allowed_hosts ?? record3.allowedHosts ?? record3.login_hosts),
+    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
+    stale: record3.stale === true,
+    state: record3.state === "error" ? "error" : "active"
+  };
+}
+async function readVault(mcp) {
+  const result = asRecord(await mcp.call("list_credentials"));
+  return asArray(result.credentials ?? result.items ?? result).map(vaultConnectionMeta);
+}
+function connectionGrant(raw) {
+  const record3 = asRecord(raw);
+  return {
+    grantId: String(record3.grant_id ?? record3.grantId ?? record3.id ?? ""),
+    credentialRef: String(record3.credential_ref ?? record3.credentialRef ?? record3.reference ?? ""),
+    createdAt: numberOrNull(record3.created_at ?? record3.createdAt) ?? 0,
+    ...numberOrNull(record3.revoked_at ?? record3.revokedAt) !== null ? { revokedAt: numberOrNull(record3.revoked_at ?? record3.revokedAt) } : {},
+    ...numberOrNull(record3.rate_limit_per_hour) !== null ? { rateLimitPerHour: numberOrNull(record3.rate_limit_per_hour) } : {},
+    ...numberOrNull(record3.spend_cap_usd) !== null ? { spendCapUsd: numberOrNull(record3.spend_cap_usd) } : {}
+  };
+}
+async function readGrants(mcp, ref) {
+  const result = asRecord(await mcp.call("list_app_access", {}));
+  return asArray(result.grants ?? result.items ?? result).map(connectionGrant).filter((grant) => grant.credentialRef === ref && grant.revokedAt === void 0);
+}
+async function revokeGrants(mcp, ref) {
+  const grants = await readGrants(mcp, ref);
+  let revoked = 0;
+  let failed = 0;
+  for (const grant of grants) {
+    try {
+      const result = asRecord(await mcp.call("revoke_app_access", { grant_id: grant.grantId }));
+      if (result.revoked === false)
+        failed += 1;
+      else
+        revoked += 1;
+    } catch {
+      failed += 1;
+    }
+  }
+  return { revoked, failed };
+}
+
+// apps/body/dist/squire-mcp-client.js
+import { spawn as spawn2 } from "node:child_process";
+var INITIALIZE_TIMEOUT_MS = 3e4;
+var CALL_TIMEOUT_MS = 12e4;
+var StdioSquireMcpClient = class {
+  options;
+  child;
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  buffer = "";
+  initialized;
+  closed = false;
+  log;
+  constructor(options = {}) {
+    this.options = options;
+    this.log = options.log ?? (() => {
+    });
+  }
+  /** One Squire MCP tool call; resolves with the tool's parsed result. */
+  async call(tool, args = {}) {
+    await this.ensureSession();
+    const response = await this.request("tools/call", { name: tool, arguments: args });
+    if (response.isError) {
+      const text3 = response.content?.find((entry) => entry.type === "text")?.text ?? "tool error";
+      throw new Error(`${tool} failed: ${text3}`);
+    }
+    const text2 = response.content?.find((entry) => entry.type === "text")?.text;
+    if (typeof text2 !== "string")
+      return response;
+    try {
+      return JSON.parse(text2);
+    } catch {
+      return response;
+    }
+  }
+  /** Tear the session down; safe to call repeatedly. */
+  close() {
+    this.closed = true;
+    this.initialized = void 0;
+    for (const entry of this.pending.values()) {
+      clearTimeout(entry.timer);
+      entry.reject(new Error("Squire MCP session closed"));
+    }
+    this.pending.clear();
+    this.child?.kill();
+    this.child = void 0;
+  }
+  ensureSession() {
+    if (this.closed)
+      throw new Error("Squire MCP client is closed");
+    this.initialized ??= this.initialize().catch((error) => {
+      this.initialized = void 0;
+      throw error;
+    });
+    return this.initialized;
+  }
+  initialize() {
+    const child = (this.options.spawn ?? spawn2)(this.options.command ?? "npx", [
+      ...this.options.args ?? ["-y", "@trusty-squire/mcp"]
+    ]);
+    this.child = child;
+    this.buffer = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => this.onData(chunk));
+    child.stderr.on("data", (chunk) => this.log(`squire mcp stderr: ${chunk.trim()}`));
+    child.on("exit", (code) => {
+      this.log(`squire mcp exited (${String(code)})`);
+      this.initialized = void 0;
+      this.child = void 0;
+      for (const entry of this.pending.values()) {
+        clearTimeout(entry.timer);
+        entry.reject(new Error("Squire MCP server exited"));
+      }
+      this.pending.clear();
+    });
+    return this.request("initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: "beeline-helper", version: "1.0.0" }
+    }).then(() => {
+      this.notify("notifications/initialized");
+    });
+  }
+  notify(method, params) {
+    this.child?.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, ...params ? { params } : {} })}
+`);
+  }
+  request(method, params) {
+    const id = this.nextId++;
+    const child = this.child;
+    if (!child)
+      return Promise.reject(new Error("Squire MCP session is not running"));
+    return new Promise((resolve31, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`${method} timed out`));
+      }, method === "initialize" ? INITIALIZE_TIMEOUT_MS : CALL_TIMEOUT_MS);
+      this.pending.set(id, { resolve: resolve31, reject, timer });
+      child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
+`);
+    });
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    for (; ; ) {
+      const newline = this.buffer.indexOf("\n");
+      if (newline < 0)
+        return;
+      const line = this.buffer.slice(0, newline).trim();
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line)
+        continue;
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      const id = typeof message.id === "number" ? message.id : void 0;
+      if (id === void 0)
+        continue;
+      const entry = this.pending.get(id);
+      if (!entry)
+        continue;
+      this.pending.delete(id);
+      clearTimeout(entry.timer);
+      if (message.error) {
+        const error = message.error;
+        entry.reject(new Error(error.message ?? "Squire MCP error"));
+      } else {
+        entry.resolve(message.result);
+      }
+    }
+  }
+};
+function defaultSquireMcpClient() {
+  return new StdioSquireMcpClient();
+}
+
+// apps/body/dist/connector-assignments.js
+var CONNECTOR_POLL_INTERVAL_MS = 1e4;
+var ConnectorAssignmentLoop = class {
+  agentId;
+  api;
+  intervalMs;
+  log;
+  install;
+  readVaultFn;
+  revokeGrantsFn;
+  schedule;
+  cancel;
+  timer;
+  started = false;
+  stopped = false;
+  /** One install at a time per connector; other polls skip it. */
+  inFlight = /* @__PURE__ */ new Set();
+  mcp;
+  constructor(options) {
+    this.agentId = options.agentId;
+    this.api = options.api;
+    this.intervalMs = options.intervalMs ?? CONNECTOR_POLL_INTERVAL_MS;
+    this.log = options.log ?? (() => {
+    });
+    this.install = options.install ?? installSquire;
+    this.readVaultFn = options.readVault ?? readVault;
+    this.revokeGrantsFn = options.revokeGrants ?? revokeGrants;
+    this.schedule = options.schedule ?? ((fn, ms) => {
+      const timer = setTimeout(fn, ms);
+      timer.unref?.();
+      return timer;
+    });
+    this.cancel = options.cancel ?? ((handle) => clearTimeout(handle));
+  }
+  start() {
+    if (this.stopped || this.started)
+      return;
+    this.started = true;
+    void this.runOnce();
+    this.timer = this.schedule(() => this.poll(), this.intervalMs);
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer !== void 0) {
+      this.cancel(this.timer);
+      this.timer = void 0;
+    }
+  }
+  /** One interval tick: poll, then re-arm. */
+  poll() {
+    if (this.stopped)
+      return;
+    void this.runOnce();
+    this.timer = this.schedule(() => this.poll(), this.intervalMs);
+  }
+  /** Drain the queue once; every failure is logged, never raised. */
+  async runOnce() {
+    let assignments;
+    try {
+      const result = await this.api.execute("getConnectorAssignments", { agentId: this.agentId });
+      assignments = result.assignments;
+    } catch (error) {
+      this.log(`connector assignments unavailable: ${describe(error)}`);
+      return;
+    }
+    for (const assignment of assignments) {
+      const key = `${assignment.kind}:${assignment.connectorId}`;
+      if (assignment.kind === "uninstall")
+        continue;
+      if (this.inFlight.has(key))
+        continue;
+      this.inFlight.add(key);
+      void this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe(error)}`)).finally(() => this.inFlight.delete(key));
+    }
+  }
+  squire() {
+    this.mcp ??= defaultSquireMcpClient();
+    return this.mcp;
+  }
+  async handle(assignment) {
+    if (assignment.kind === "install")
+      await this.runInstall(assignment.connectorId);
+    else if (assignment.kind === "sync")
+      await this.runSync();
+    else if (assignment.kind === "revoke-grants")
+      await this.runRevoke(assignment.connectorId, assignment.reference);
+  }
+  /** Install Trusty Squire, reporting every step as it settles. */
+  async runInstall(connectorId) {
+    const report = async (steps) => {
+      try {
+        await this.api.execute("postConnectorStatus", { agentId: this.agentId, connectorId, steps });
+      } catch (error) {
+        this.log(`step report failed: ${describe(error)}`);
+      }
+    };
+    const result = await this.install({
+      workspaceId: this.agentId,
+      mcp: this.squire(),
+      onProgress: report
+    });
+    if (result.status === "error") {
+      await this.api.execute("postConnectorStatus", {
+        agentId: this.agentId,
+        connectorId,
+        steps: result.steps,
+        errorMessage: result.errorMessage
+      });
+      return;
+    }
+    if (result.status === "connected") {
+      await this.api.execute("installConnector", {
+        agentId: this.agentId,
+        connectorId,
+        ...result.squireVersion ? { squireVersion: result.squireVersion } : {},
+        ...result.signedInAs ? { signedInAs: result.signedInAs } : {},
+        ...result.signIn ? { signIn: result.signIn } : {}
+      });
+      await this.reportVault(connectorId);
+      return;
+    }
+    await this.api.execute("postConnectorStatus", {
+      agentId: this.agentId,
+      connectorId,
+      steps: result.steps,
+      ...result.squireVersion ? { squireVersion: result.squireVersion } : {},
+      ...result.signedInAs ? { signedInAs: result.signedInAs } : {},
+      ...result.signIn ? { signIn: result.signIn } : {}
+    });
+  }
+  /** One vault report covers every live trusty-squire connector on this helper. */
+  async runSync() {
+    await this.reportVault();
+  }
+  async runRevoke(connectorId, reference) {
+    const outcome = await this.revokeGrantsFn(this.squire(), reference);
+    this.log(`revoked ${outcome.revoked} grant(s) on ${reference}` + (outcome.failed ? `, ${outcome.failed} failed` : ""));
+    void connectorId;
+  }
+  async reportVault(_connectorId) {
+    const connections = await this.readVaultFn(this.squire());
+    await this.api.execute("postConnectorVault", { agentId: this.agentId, connections });
+  }
+};
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // packages/api-contract/dist/daemon-operations.js
 function isAgentCommand(value) {
   if (!value || typeof value !== "object")
@@ -8183,6 +8655,9 @@ function isAgentCommand(value) {
   return Boolean(source && typeof source.id === "string" && typeof source.authorId === "string" && typeof source.body === "string" && typeof source.createdAt === "number" && Array.isArray(source.attachments));
 }
 
+// packages/api-contract/dist/artifacts.js
+var ARTIFACT_MAXIMUM_BYTES = 25 * 1024 * 1024;
+
 // packages/api-contract/dist/system-events.js
 var SERVER_EVENT_KINDS = [
   "joined",
@@ -8212,12 +8687,12 @@ var wrapper_default = import_websocket.default;
 
 // apps/body/dist/runtime.js
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { mkdir, readFile as readFile2, readdir, rename, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, resolve as resolve6 } from "node:path";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { promisify } from "node:util";
 
 // node_modules/@noble/hashes/_u64.js
@@ -16340,13 +16815,13 @@ var NegentropyStorageVector = class {
     let count = last - first;
     while (count > 0) {
       let it = first;
-      let step = Math.floor(count / 2);
-      it += step;
+      let step2 = Math.floor(count / 2);
+      it += step2;
       if (cmp(arr[it])) {
         first = ++it;
-        count -= step + 1;
+        count -= step2 + 1;
       } else {
-        count = step;
+        count = step2;
       }
     }
     return first;
@@ -16748,7 +17223,7 @@ function decodeNsec(nsec) {
 }
 
 // apps/body/dist/runtime.js
-var execFileAsync = promisify(execFile);
+var execFileAsync = promisify(execFile2);
 var DEFAULT_AGENT_IDENTITY_NAME = "beeline-agent";
 var DEFAULT_BODY_IDENTITY_NAME = "beeline-body";
 var DEFAULT_DAEMON_MONOLITH_BASE_URL = "https://server.usebeeline.app";
@@ -16938,7 +17413,7 @@ async function launchRuntimeDaemon(configPath, opts = {}) {
   const entrypoint = opts.entrypoint ?? process.argv[1];
   if (!entrypoint)
     throw new Error("cannot resolve daemon CLI entrypoint");
-  const child = spawn2(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve6(configPath)], {
+  const child = spawn3(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve6(configPath)], {
     cwd: directory,
     env: opts.env ?? process.env,
     detached: !foreground,
@@ -17209,7 +17684,7 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 }
 
 // apps/body/dist/room-runtime.js
-import { execFile as execFile5 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync } from "node:fs";
 import { mkdir as mkdir13, rm as rm5 } from "node:fs/promises";
@@ -17217,7 +17692,7 @@ import { dirname as dirname8, resolve as resolve20 } from "node:path";
 import { promisify as promisify4 } from "node:util";
 
 // apps/body/dist/grant-runner.js
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 import { createHash as createHash2, randomBytes as randomBytes6 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -17876,9 +18351,9 @@ var GrantCommandRunner = class {
       ...Object.fromEntries(secrets)
     };
     const cap = this.options.outputCapBytes ?? GRANT_COMMAND_OUTPUT_CAP_BYTES;
-    const spawn8 = surfaceAllows(policy.surface, "run-host-command") ? { command: argv[0], args: argv.slice(1) } : roomSandboxCommand(policy, room.cwd, argv);
+    const spawn9 = surfaceAllows(policy.surface, "run-host-command") ? { command: argv[0], args: argv.slice(1) } : roomSandboxCommand(policy, room.cwd, argv);
     const outcome = await new Promise((resolveRun) => {
-      const child = execFile2(spawn8.command, spawn8.args, {
+      const child = execFile3(spawn9.command, spawn9.args, {
         cwd: room.cwd,
         env,
         timeout: this.options.timeoutMs ?? GRANT_COMMAND_TIMEOUT_MS,
@@ -18047,6 +18522,106 @@ var GrantRunnerServer = class {
   }
 };
 
+// apps/body/dist/connector-runner.js
+function toolName(call) {
+  const raw = `${call.title ?? ""} ${call.kind ?? ""}`;
+  const match = raw.match(/(?:^|__|\b)(use_credential|fetch_credential|grant_app_access|revoke_app_access)\b/);
+  return match?.[1] ?? "";
+}
+var SQUIRE_EVENT_CLASS = {
+  fetch_credential: "approval",
+  // the credential was read in clear
+  grant_app_access: "approval",
+  // a host was added to a key
+  revoke_app_access: "vault-change"
+  // access removed on the owner's behalf
+};
+function record(call) {
+  return call && typeof call === "object" ? call : {};
+}
+function serializedSize(value) {
+  if (value == null)
+    return 0;
+  if (typeof value === "string")
+    return value.length;
+  try {
+    return JSON.stringify(value).length;
+  } catch {
+    return 0;
+  }
+}
+function squireUsageFromToolCall(call) {
+  const tool = toolName(call);
+  if (!tool)
+    return void 0;
+  const args = record(call.rawInput);
+  const result = record(call.content ?? call.rawOutput);
+  const resultPayload = record(result.content ?? result);
+  const url = typeof args.url === "string" ? args.url : "";
+  const method = typeof args.method === "string" ? args.method.toUpperCase() : tool;
+  const operation = url ? `${method} ${url}` : `${method} ${String(args.reference ?? "")}`.trim();
+  const statusCode = typeof resultPayload.status === "number" ? resultPayload.status : /failed|error|denied/i.test(call.status ?? "") ? 0 : 200;
+  return {
+    ref: String(args.reference ?? args.service ?? ""),
+    service: typeof args.service === "string" ? args.service : null,
+    operation: operation.slice(0, 300),
+    statusCode,
+    bytes: serializedSize(resultPayload.body ?? resultPayload),
+    ...typeof args.grant_id === "string" ? { grantId: args.grant_id } : {},
+    ...SQUIRE_EVENT_CLASS[tool] ? { eventClass: SQUIRE_EVENT_CLASS[tool] } : {}
+  };
+}
+var ConnectorUsageRecorder = class {
+  batches = /* @__PURE__ */ new Map();
+  turns = /* @__PURE__ */ new Map();
+  record(turn, usage2) {
+    if (!usage2.ref)
+      return;
+    const existing = this.batches.get(turn.requestId) ?? [];
+    existing.push(usage2);
+    this.batches.set(turn.requestId, existing);
+    if (!this.turns.has(turn.requestId))
+      this.turns.set(turn.requestId, turn);
+  }
+  /** Everything recorded for this turn so far; used by tests and diagnostics. */
+  pending(requestId) {
+    return this.batches.get(requestId) ?? [];
+  }
+  /**
+   * Publish the turn's whole batch as ONE operation call and clear it.
+   * Returns the published record count (0 when nothing was recorded or the
+   * publish failed — a failed usage report never fails the agent turn).
+   */
+  async flush(api, requestId) {
+    const usage2 = this.batches.get(requestId);
+    const turn = this.turns.get(requestId);
+    if (!usage2?.length || !turn)
+      return 0;
+    this.batches.delete(requestId);
+    this.turns.delete(requestId);
+    try {
+      await api.execute("postConnectionUsage", {
+        requestId: turn.requestId,
+        agentId: turn.agentId,
+        ...turn.roomId ? { roomId: turn.roomId } : {},
+        ...turn.cornerId ? { cornerId: turn.cornerId } : {},
+        usage: usage2
+      });
+      return usage2.length;
+    } catch (error) {
+      console.error("[connector] connection usage report failed:", error);
+      return 0;
+    }
+  }
+};
+function captureConnectionUsage(recorder, turn, calls) {
+  for (const call of calls) {
+    const usage2 = squireUsageFromToolCall(call);
+    if (usage2)
+      recorder.record(turn, usage2);
+  }
+}
+
 // apps/body/dist/server-command-intake.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile4 } from "node:fs/promises";
@@ -18214,7 +18789,7 @@ async function runServerCommandIntake(options) {
 }
 
 // apps/body/dist/monolith-corner-turn.js
-import { execFile as execFile4 } from "node:child_process";
+import { execFile as execFile5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { mkdir as mkdir12 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
@@ -18248,6 +18823,9 @@ function isAgentPairingCode(value) {
 // apps/body/dist/beeline-skill.js
 var USING_BEELINE_SKILL_NAME = "using-beeline";
 var BEELINE_REVIEW_SKILL_NAME = "beeline-review";
+function isConfiguredReviewer(agentHandle, reviewerHandle) {
+  return Boolean(agentHandle && reviewerHandle && agentHandle.replace(/^@/, "") === reviewerHandle.replace(/^@/, ""));
+}
 var BEELINE_ROOM_CAPABILITIES = [
   "The repository filesystem is read-only in this Room session.",
   "You may address any Room member, including another agent, by writing @name in your reply; the server routes that mention to them. Each turn prompt lists the Room members and the exact spelling that tags each one - use those spellings, and never guess or reuse one from an older message.",
@@ -18255,7 +18833,7 @@ var BEELINE_ROOM_CAPABILITIES = [
   "Tag the user only when you need a decision or input, or when the task they asked for is finished. Never tag for progress, acknowledgement, or questions the transcript already answers.",
   "Every MCP server mounted into this session is approved tool by tool - use operator and host tools freely; the read-only filesystem sandbox is the boundary, not a tool list. Network web search is enabled.",
   "Files and photos people share are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline); never fetch the reference URL.",
-  "To create a file (this Room has no other way to write one), call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent attach_file with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote); it is attached to your reply. write_scratch_file produces the file, not a picture - turning it into a raster image needs a converter, which needs shell, which this Room does not have.",
+  "To create a file (this Room has no other way to write one), call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent post_artifact with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote), or with html/bytes content directly; it is uploaded and attached to your reply, and title and mime default from the file when you post by path. write_scratch_file produces the file, not a picture - turning it into a raster image needs a converter, which needs shell, which this Room does not have.",
   "To run something later or repeatedly, call beeline-agent create_schedule (interval in minutes or a 5-field cron, optional maxRuns); list_schedules / delete_schedule manage them.",
   `To react to things that HAPPEN in this Room rather than only to what is said to you, call beeline-agent subscribe_events with the kinds you want (${SERVER_EVENT_KINDS.join(", ")}); each one then wakes you for a turn. It replaces your list, so send every kind you want - list_event_subscriptions shows the current one. You do this yourself: nobody has to configure it for you. grant-decided carries the grant id and status and resumes the turn that asked for the grant.`,
   "To state something that happened so the Room and other agents can act on it, call beeline-agent emit_event with your own agent:<slug> kind, one sentence, and optionally the agent members to wake. Chains of events are bounded and a refused emit posts nothing.",
@@ -18271,7 +18849,7 @@ var BEELINE_DM_CAPABILITIES = [
   "The repository filesystem is read-only in this session.",
   "Every MCP server mounted into this session is approved tool by tool - use operator and host tools freely; the read-only filesystem sandbox is the boundary, not a tool list. Network web search is enabled.",
   "Files and photos people share are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline); never fetch the reference URL.",
-  "To create a file (this Room has no other way to write one), call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent attach_file with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote); it is attached to your reply. write_scratch_file produces the file, not a picture - turning it into a raster image needs a converter, which needs shell, which this Room does not have.",
+  "To create a file (this Room has no other way to write one), call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent post_artifact with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote), or with html/bytes content directly; it is uploaded and attached to your reply, and title and mime default from the file when you post by path. write_scratch_file produces the file, not a picture - turning it into a raster image needs a converter, which needs shell, which this Room does not have.",
   "Tag the person only when you need a decision or input, or when the task they asked for is finished.",
   "Never claim an action or reply happened unless the prompt or a tool result proves it."
 ].join(" ");
@@ -18312,6 +18890,22 @@ description: How to answer inside a Beeline Room.
 # Using Beeline
 
 You are answering inside a Room whose filesystem is read-only. ${BEELINE_ROOM_CAPABILITIES}
+
+When your corner's pull request is ready, merging is your step: once the configured reviewer approves and tags you, you run \`gh pr merge\` yourself - nothing merges it for you.
+
+## Tools and the Workbench
+
+A **tool** is something you can use once a human pairs it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
+
+This build knows one tool: Trusty Squire - vaulted credentials and a browser that signs in for you. Wallet and Tailscale are named in the Workbench but not yet available.
+
+You NEVER pair a tool and never ask for a raw credential in chat. When a task needs one you do not have, say so plainly, name the tool that would solve it, and tell the person exactly where to go: Settings \u2192 Workbench \u2192 Tools.
+
+Keys are sovereign: they belong to the human who provisioned them. You cannot use another member's key and must not ask a member to share one.
+
+## Showing a mock
+
+When a design decision needs eyes, show it instead of describing it. Build ONE self-contained HTML page and post it with beeline-agent post_artifact (mime "text/html", pass the document as html). Everything is inline: a single <style> element for all CSS and data: URLs for any image - no script, no external dependencies, no network references. The validator refuses every <script>, <link>, <iframe>, <object>, <embed>, <form>, inline event handler, and http(s) URL, so a page that reaches for the network never posts. Use the Obsidian Refined tokens: grayscale surfaces, one brass accent #d7af5f, 3px radii, IBM Plex Sans/Mono type. Lay the user stories out as frames - one bordered, labelled block per story, so each story can be judged on its own. After posting, ask for feedback here in the corner: the artifact is the thing people react to, not your prose.
 `;
 }
 function beelineReviewSkillMarkdown(releaseId) {
@@ -18389,7 +18983,7 @@ Then take exactly one action:
 
 - FAIL: reply \`@author\` with the confirmed findings to fix.
 - PASS: call \`approve_merge\` with the reviewed head SHA, then reply \`@author approved <reviewed sha>, merge\`.
-- Never merge the pull request yourself.
+- Approving is your last step as reviewer. The author merges it; you never do, and nothing merges it automatically.
 `;
 }
 
@@ -18437,8 +19031,8 @@ function openRouterModelId(model, env = {}) {
 }
 function parseOpenRouterEndpoints(payload) {
   const data = payload?.data;
-  const record2 = data && typeof data === "object" ? data : {};
-  const raw = Array.isArray(record2.endpoints) ? record2.endpoints : [];
+  const record3 = data && typeof data === "object" ? data : {};
+  const raw = Array.isArray(record3.endpoints) ? record3.endpoints : [];
   const endpoints = [];
   for (const entry of raw) {
     if (!entry || typeof entry !== "object")
@@ -18453,11 +19047,11 @@ function parseOpenRouterEndpoints(payload) {
     const supported = Array.isArray(endpoint2.supported_parameters) ? endpoint2.supported_parameters : [];
     endpoints.push({ provider, uptime, contextLength, tools: supported.includes("tools") });
   }
-  const architecture = record2.architecture && typeof record2.architecture === "object" ? record2.architecture : {};
+  const architecture = record3.architecture && typeof record3.architecture === "object" ? record3.architecture : {};
   const modalities = Array.isArray(architecture.input_modalities) ? architecture.input_modalities.filter((value) => typeof value === "string" && value.length > 0) : void 0;
   return {
     endpoints,
-    contextLength: typeof record2.context_length === "number" ? record2.context_length : advertisedContextLength(endpoints),
+    contextLength: typeof record3.context_length === "number" ? record3.context_length : advertisedContextLength(endpoints),
     inputModalities: modalities?.length ? modalities : void 0
   };
 }
@@ -19059,7 +19653,7 @@ async function prepareRoomAgentHome(input) {
     await symlink(source, target).catch(() => void 0);
   }
   const prior = agentHomeProvisionQueues.get(root) ?? Promise.resolve();
-  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? [], agentSkillDir(input.agentKind), input.openRouterRouting));
+  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? [], agentSkillDir(input.agentKind), input.openRouterRouting, input.isReviewer ?? false));
   agentHomeProvisionQueues.set(root, provision);
   try {
     await provision;
@@ -19069,10 +19663,10 @@ async function prepareRoomAgentHome(input) {
   }
   return roomAgentHomeEnv(root);
 }
-async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills, skillDir, openRouterRouting) {
+async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills, skillDir, openRouterRouting, isReviewer) {
   const managedSkills = [
     { name: USING_BEELINE_SKILL_NAME, content: usingBeelineSkillMarkdown(skillReleaseId) },
-    { name: BEELINE_REVIEW_SKILL_NAME, content: beelineReviewSkillMarkdown(skillReleaseId) }
+    ...isReviewer ? [{ name: BEELINE_REVIEW_SKILL_NAME, content: beelineReviewSkillMarkdown(skillReleaseId) }] : []
   ];
   const shared = await resolveSharedSkillSources(operatorHome, sharedSkills);
   await provisionManagedSkillsDir(resolve13(root, skillDir, "skills"), managedSkills, shared, sharedSkills.length === 0);
@@ -19904,8 +20498,8 @@ function toolCallText(content) {
     }
     if (!value || typeof value !== "object")
       return;
-    const record2 = value;
-    for (const [key, nested] of Object.entries(record2)) {
+    const record3 = value;
+    for (const [key, nested] of Object.entries(record3)) {
       if (["text", "content", "message", "error", "output"].includes(key.toLowerCase())) {
         walk(nested, depth + 1);
       }
@@ -20127,9 +20721,9 @@ export default async function (pi) {
 `;
 
 // apps/body/dist/corner-branch-sync.js
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-var execFileAsync2 = promisify2(execFile3);
+var execFileAsync2 = promisify2(execFile4);
 async function syncCornerBranch(input) {
   const git = input.git ?? (async (args) => (await execFileAsync2("git", ["-C", input.worktreePath, ...args], {
     ...input.env ? { env: input.env } : {},
@@ -20204,8 +20798,8 @@ function shellPayload(toolCall) {
     return true;
   if (!rawInput || typeof rawInput !== "object" || Array.isArray(rawInput))
     return false;
-  const record2 = rawInput;
-  return typeof record2.command === "string" || typeof record2.cmd === "string";
+  const record3 = rawInput;
+  return typeof record3.command === "string" || typeof record3.cmd === "string";
 }
 var ROOM_MOUNTED_MCP_SERVERS = [
   READ_ONLY_MCP_SERVER_NAME,
@@ -20217,10 +20811,10 @@ var TOOL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 function permissionRecord(rawInput) {
   return rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput : void 0;
 }
-function dispatchedPayloadIsShell(record2) {
-  if (!record2)
+function dispatchedPayloadIsShell(record3) {
+  if (!record3)
     return false;
-  return DISPATCHER_TOOL_INPUT_KEYS.some((key) => key in record2 && shellPayload({ rawInput: record2[key] }));
+  return DISPATCHER_TOOL_INPUT_KEYS.some((key) => key in record3 && shellPayload({ rawInput: record3[key] }));
 }
 function toolIdentityCandidates(toolCall) {
   const candidates = [];
@@ -20229,9 +20823,9 @@ function toolIdentityCandidates(toolCall) {
       candidates.push(value.trim());
   };
   add(toolCall?.title);
-  const record2 = permissionRecord(toolCall?.rawInput);
+  const record3 = permissionRecord(toolCall?.rawInput);
   for (const key of DISPATCHER_TOOL_NAME_KEYS)
-    add(record2?.[key]);
+    add(record3?.[key]);
   return candidates;
 }
 function normalizedServerName(name) {
@@ -20241,8 +20835,8 @@ function resolveMountedMcpToolCall(request, mountedServers) {
   const toolCall = request.toolCall;
   if (shellPayload(toolCall))
     return void 0;
-  const record2 = permissionRecord(toolCall?.rawInput);
-  if (dispatchedPayloadIsShell(record2))
+  const record3 = permissionRecord(toolCall?.rawInput);
+  if (dispatchedPayloadIsShell(record3))
     return void 0;
   const candidates = toolIdentityCandidates(toolCall);
   for (const server of mountedServers) {
@@ -20308,7 +20902,7 @@ function isMountedMcpToolPermissionRequest(request, mountedServers = ROOM_MOUNTE
 var AGENT_SURFACE_TOOL_NAMES = [
   "open_corner",
   "pr_checks_status",
-  "attach_file",
+  "post_artifact",
   "write_scratch_file"
 ];
 var SQUIRE_TITLE_PREFIXES = [
@@ -20519,25 +21113,25 @@ async function explainEmptyAgentTurn(input) {
   const streamFact = describeEmptyTurn(input.result, input.agentLabel);
   if (!isPiAcpHarness(input.agentLabel))
     return { reason: streamFact };
-  const record2 = await readPiTurnRecord({ agentEnv: input.agentEnv, sessionId: input.sessionId });
-  if (!record2)
+  const record3 = await readPiTurnRecord({ agentEnv: input.agentEnv, sessionId: input.sessionId });
+  if (!record3)
     return { reason: `pi left no readable turn record; ${streamFact}` };
-  switch (record2.kind) {
+  switch (record3.kind) {
     case "error":
-      return { reason: record2.reason, record: record2 };
+      return { reason: record3.reason, record: record3 };
     case "empty":
       return {
-        reason: `the model ended its turn with no text (stop reason ${record2.stopReason})`,
-        record: record2
+        reason: `the model ended its turn with no text (stop reason ${record3.stopReason})`,
+        record: record3
       };
     case "answer":
       return {
-        recoveredText: record2.text,
+        recoveredText: record3.text,
         reason: "pi recorded the answer but the ACP stream delivered no text",
-        record: record2
+        record: record3
       };
     case "missing":
-      return { reason: `pi recorded no assistant message for this turn; ${streamFact}`, record: record2 };
+      return { reason: `pi recorded no assistant message for this turn; ${streamFact}`, record: record3 };
   }
 }
 function shouldRetryEmptyTurn(explanation) {
@@ -20564,10 +21158,10 @@ function turnFailureReasonWithProvider(reason, providers) {
   const served = describeTurnProviders(providers);
   return served ? `${reason} \xB7 ${served}` : reason;
 }
-function isAccountOrProviderRefusal(record2) {
-  if (!record2 || record2.kind !== "error" || record2.status === void 0)
+function isAccountOrProviderRefusal(record3) {
+  if (!record3 || record3.kind !== "error" || record3.status === void 0)
     return false;
-  return [401, 402, 403, 407, 408, 429].includes(record2.status) || record2.status >= 500;
+  return [401, 402, 403, 407, 408, 429].includes(record3.status) || record3.status >= 500;
 }
 
 // apps/body/dist/response-directives.js
@@ -20824,11 +21418,11 @@ var TurnTrace = class {
         this.end(phase);
       this.promptSettled();
     }
-    const record2 = this.snapshot(outcome, reason);
-    await this.options.sink?.write(record2).catch((error) => {
+    const record3 = this.snapshot(outcome, reason);
+    await this.options.sink?.write(record3).catch((error) => {
       console.error("[thin-core] turn trace write failed:", error);
     });
-    return record2;
+    return record3;
   }
 };
 function round(ms) {
@@ -20853,9 +21447,9 @@ function formatTurnAttempt(attempt) {
     parts.push(`${attempt.toolCalls} tool call${attempt.toolCalls === 1 ? "" : "s"}`);
   return parts.join(" \xB7 ");
 }
-function formatTurnTraceLine(record2) {
-  const head = `${record2.surface} ${record2.roomId} turn ${record2.requestId} ${record2.outcome} ${formatDuration(record2.totalMs)}`;
-  return [head, ...record2.attempts.map((attempt) => formatTurnAttempt(attempt))].join("\n  ");
+function formatTurnTraceLine(record3) {
+  const head = `${record3.surface} ${record3.roomId} turn ${record3.requestId} ${record3.outcome} ${formatDuration(record3.totalMs)}`;
+  return [head, ...record3.attempts.map((attempt) => formatTurnAttempt(attempt))].join("\n  ");
 }
 function turnTraceDirectory(runtimeDir) {
   return resolve17(runtimeDir, "turn-traces");
@@ -20877,16 +21471,16 @@ var TurnTraceFile = class {
   path(now2 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))()) {
     return resolve17(this.directory, traceFileName(now2));
   }
-  write(record2) {
+  write(record3) {
     this.tail = this.tail.catch(() => void 0).then(async () => {
       const now2 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))();
       const path = this.path(now2);
       await mkdir8(this.directory, { recursive: true, mode: 448 });
-      await appendFile(path, `${JSON.stringify(record2)}
+      await appendFile(path, `${JSON.stringify(record3)}
 `, { mode: 384 });
       await this.prune(now2);
       const log2 = this.options.log ?? ((line) => console.log(line));
-      log2(`[thin-core] turn trace ${formatTurnTraceLine(record2)}${this.announced ? "" : `
+      log2(`[thin-core] turn trace ${formatTurnTraceLine(record3)}${this.announced ? "" : `
   recorded in ${path}`}`);
       this.announced = true;
     });
@@ -21149,7 +21743,7 @@ async function seedWarmNodeModules(input) {
     for (const target of placed) {
       await rm4(target, { recursive: true, force: true }).catch(() => void 0);
     }
-    return { reason: "failed", key: plan.key, detail: describe(error) };
+    return { reason: "failed", key: plan.key, detail: describe2(error) };
   } finally {
     await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
   }
@@ -21192,7 +21786,7 @@ async function harvestWarmNodeModules(input) {
   } catch (error) {
     if (await pathExists(entry))
       return { reason: "already-warm", key: plan.key };
-    return { reason: "failed", key: plan.key, detail: describe(error) };
+    return { reason: "failed", key: plan.key, detail: describe2(error) };
   } finally {
     await rm4(staging, { recursive: true, force: true }).catch(() => void 0);
   }
@@ -21335,7 +21929,7 @@ async function deviceOf(path) {
 async function isDirectory(path) {
   return stat2(path).then((info) => info.isDirectory(), () => false);
 }
-function describe(error) {
+function describe2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -21613,10 +22207,13 @@ var MonolithRoomTurnLoop = class {
     });
     const directMessage = Array.isArray(repositoryState.directParticipants) && repositoryState.directParticipants.length === 2;
     await mkdir11(this.options.cwd, { recursive: true });
-    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
+    const selectionModel = configuration.model ?? this.options.config.modelSelection?.model;
+    const selectionEffort = configuration.effort ?? this.options.config.modelSelection?.effort;
+    const selection = selectionModel || selectionEffort ? { model: selectionModel, effort: selectionEffort } : void 0;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
+      isReviewer: isConfiguredReviewer(self?.handle, configuration.reviewerHandle),
       ...this.options.config.agentKind ? { agentKind: this.options.config.agentKind } : {},
       ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
       ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl, {
@@ -21839,6 +22436,7 @@ var MonolithRoomTurnLoop = class {
     this.busy = true;
     const trace = this.beginTurnTrace(item.id);
     let liveStream;
+    let liveCornerOpened = false;
     try {
       if (!this.memberNames.has(item.authorId))
         await this.roster().catch(() => void 0);
@@ -21920,7 +22518,11 @@ ${JSON.stringify((corners.corners ?? []).filter((corner) => !corner.archived))}`
                 result2 = await this.client.sessionPrompt(this.sessionId, nextPrompt, ROOM_PROMPT_INACTIVITY_TIMEOUT_MS, (delta, full) => {
                   trace.firstModelOutput();
                   stream.onChunk(delta, full);
-                }, void 0, (calls) => trace.toolCalls(calls));
+                }, void 0, (calls) => {
+                  trace.toolCalls(calls);
+                  if (openedACorner(openCornerToolCall(calls)))
+                    liveCornerOpened = true;
+                });
               } catch (error) {
                 promptError = error;
               }
@@ -22014,6 +22616,22 @@ ${JSON.stringify((corners.corners ?? []).filter((corner) => !corner.archived))}`
         await trace.finish("cancelled");
         return;
       }
+      if (liveCornerOpened && error instanceof AcpRequestTimeoutError && error.inactivity && error.method === "session/prompt") {
+        console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id}: inactivity timeout after opening a corner; the work continues in the corner`);
+        this.options.onCornerOpened?.();
+        await liveStream?.retract().catch((retractError) => {
+          console.error(`[thin-core] monolith Room ${this.options.roomId} draft retract failed:`, retractError);
+        });
+        await api.execute("postAgentTurnReceipt", {
+          agentId: this.agent.publicKey,
+          roomId: this.options.roomId,
+          requestId: item.id,
+          status: "complete",
+          generationId: this.commandContext.generationId
+        });
+        await trace.finish("complete");
+        return;
+      }
       await liveStream?.retract().catch((retractError) => {
         console.error(`[thin-core] monolith Room ${this.options.roomId} draft retract failed:`, retractError);
       });
@@ -22083,7 +22701,7 @@ function roomMessagePrompt(author, body, attachments, delivered, harnessAcceptsI
 }
 
 // apps/body/dist/monolith-corner-turn.js
-var execFileAsync3 = promisify3(execFile4);
+var execFileAsync3 = promisify3(execFile5);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
 var TOOL_OUTPUT_MAX_BYTES = 3200;
 var TOOL_PATH_LIMIT = 12;
@@ -22100,6 +22718,11 @@ function cornerReviewerInstruction(input) {
   const headSha = input.headSha ?? "<head sha>";
   return `Checks are green on PR #${number} at ${headSha}. Review it now with the beeline-review skill against that exact head. FAIL: reply \`@${author}\` with the confirmed findings to fix. PASS: call the approve_merge tool for ${headSha}, then reply \`@${author} approved ${headSha}, merge\`. Never merge yourself. Never say you are holding or waiting for checks.`;
 }
+function cornerSelfReviewerInstruction(input) {
+  if (!input.reviewerHandle || !input.agentHandle || !input.openedByAgent || input.agentHandle.replace(/^@/, "") !== input.reviewerHandle.replace(/^@/, ""))
+    return void 0;
+  return "You are this Room's reviewer, so your own pull request needs no review: do not request one, do not tag any agent for review, and merge yourself with gh once checks pass and no hold exists.";
+}
 var CORNER_AUTHOR_CONTRACT = `The objective text is the user's ask. Keep it verbatim in your head and do not reinterpret it.
 Before any code, write its end-user story in one sentence: "a person who does X sees Y".
 If the objective reports a defect, reproduce it first at the layer where it lives: the command, request, or tap sequence, and what was observed.
@@ -22159,7 +22782,7 @@ function serialized(value) {
     return "";
   }
 }
-function record(value) {
+function record2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function clampBytes(value, maxBytes) {
@@ -22199,7 +22822,7 @@ function filePaths(value, worktreePath) {
       candidate.forEach((entry) => visit(entry));
       return;
     }
-    const object = record(candidate);
+    const object = record2(candidate);
     if (object)
       Object.entries(object).forEach(([entryKey, entry]) => visit(entry, entryKey));
   };
@@ -22207,9 +22830,9 @@ function filePaths(value, worktreePath) {
   return [...paths];
 }
 function resultStatus(call) {
-  const content = record(call.content) ?? (typeof call.content === "string" ? (() => {
+  const content = record2(call.content) ?? (typeof call.content === "string" ? (() => {
     try {
-      return record(JSON.parse(call.content));
+      return record2(JSON.parse(call.content));
     } catch {
       return void 0;
     }
@@ -22224,7 +22847,7 @@ function resultStatus(call) {
   return /(?:failed|error|denied)/i.test(call.status ?? "") ? "error" : "ok";
 }
 function toolArguments(call) {
-  const raw = record(call.rawInput);
+  const raw = record2(call.rawInput);
   const command = typeof call.rawInput === "string" ? call.rawInput : typeof raw?.command === "string" ? raw.command : typeof raw?.cmd === "string" ? raw.cmd : void 0;
   if (command)
     return { command: clampBytes(redactToolDetail(command), TOOL_ARGUMENT_MAX_BYTES) };
@@ -22462,12 +23085,14 @@ var MonolithCornerTurnLoop = class {
         headSha: restore.lifecycle?.pr?.headSha
       });
     }
-    this.cornerTurnEndNudge = reviewerInstruction ?? cornerMergeInstruction(configuration.yoloMode, configuration.reviewerHandle);
+    const selfReviewerInstruction = cornerSelfReviewerInstruction(reviewerInput);
+    this.cornerTurnEndNudge = reviewerInstruction ?? selfReviewerInstruction ?? cornerMergeInstruction(configuration.yoloMode, configuration.reviewerHandle);
     await mkdir12(this.options.worktreePath, { recursive: true });
     const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
+      isReviewer: isConfiguredReviewer(self?.handle, configuration.reviewerHandle),
       ...this.options.config.agentKind ? { agentKind: this.options.config.agentKind } : {},
       ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
       ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl, {
@@ -22612,13 +23237,13 @@ var MonolithCornerTurnLoop = class {
           ...reviewerInstruction ? [reviewerInstruction] : [
             configuration.reviewerHandle ? `Once the pull request exists, reply with its full URL and end the turn; do not tag the reviewer, check, or wait for CI.` : 'Once the pull request exists, reply only with its full URL and end the turn; do not check or wait for CI. On a later checks turn, call pr_checks_status. Merge only when checks="passed", held=false, and approvalPending=false; if checks="unknown", reply in this corner with the tool reason and stop instead of retrying. Only a later explicit human resume clears a hold.',
             CORNER_AUTHOR_CONTRACT,
-            cornerMergeInstruction(configuration.yoloMode, configuration.reviewerHandle)
+            selfReviewerInstruction ?? cornerMergeInstruction(configuration.yoloMode, configuration.reviewerHandle)
           ],
           "Do not tag the user when a corner turn finishes: the server posts the merge summary card and its push already cover completion. Tag a human only mid-turn, and only when you need a decision or input.",
-          "Never restate server check or merge notes. On a checks turn, say nothing unless you merge or push a fix, then use one short line. Never merge while approvalPending is true. When approval is pending, wait for the reviewer to tag you. Never merge another pull request."
+          "Never restate server check or merge notes. On a checks turn, say nothing unless you merge or push a fix, then use one short line. Never merge while approvalPending is true. When approval is pending, wait for the reviewer to tag you. Never merge another pull request. Never create a schedule to poll pr_checks_status or the merge gate: the green transition wakes the reviewer and the reviewer's approval tag wakes you, and tagging any agent other than the configured reviewer cannot clear the gate. If a schedule wakes you in this corner anyway, follow the same rule as a checks turn: say nothing unless you merge, push a fix, or report a genuinely new blocker."
         ] : [
           "This is a chat-only corner with no repository or GitHub workflow.",
-          "Work in this corner's writable workspace. Use write_scratch_file or ordinary tools to create files, then attach_file to send them back to the corner.",
+          "Work in this corner's writable workspace. Use write_scratch_file or ordinary tools to create files, then post_artifact with the path to send them back to the corner.",
           "Do not initialize a repository, create a branch, push, open a pull request, or wait for GitHub checks."
         ]
       ].filter(Boolean).join("\n\n")
@@ -22781,7 +23406,7 @@ ${trigger}`,
           const pendingToolActivities = /* @__PURE__ */ new Map();
           let lastNarratedToolCall;
           let activityAttempt = 0;
-          const publishToolCalls = (calls, settledOnly) => {
+          const publishToolCalls = (calls, settledOnly, exceptKey) => {
             calls.forEach((call, index) => {
               const key = `${activityAttempt}:${toolCallKey(call, index)}`;
               if (settledOnly && !observedToolCalls.has(key)) {
@@ -22791,7 +23416,7 @@ ${trigger}`,
                 if (narration2)
                   lastNarratedToolCall = key;
               }
-              if (settledOnly || publishedToolCalls.has(key) || !toolCallSettled(call))
+              if (settledOnly || publishedToolCalls.has(key) || !toolCallSettled(call) || key === exceptKey)
                 return;
               publishedToolCalls.add(key);
               const narration = pendingToolNarrations.get(key) ?? "";
@@ -22827,12 +23452,18 @@ ${trigger}`,
               });
             });
           };
-          const flushToolCalls = async (calls, finalReply) => {
+          const flushToolCalls = async (calls, finalReply, final = false) => {
             await this.activityTail;
             if (lastNarratedToolCall && pendingToolNarrations.get(lastNarratedToolCall) === finalReply)
               pendingToolNarrations.delete(lastNarratedToolCall);
             publishToolCalls(calls, false);
             await this.activityTail;
+            if (this.options.connectorUsage) {
+              captureConnectionUsage(this.options.connectorUsage, { requestId, agentId: this.agent.publicKey, cornerId }, calls);
+              if (final)
+                await this.options.connectorUsage.flush(api, requestId);
+            }
+            await this.activityTail;
             publishToolCalls(calls, false);
             await this.activityTail;
           };
@@ -22864,6 +23495,7 @@ ${trigger}`,
             }, void 0, (calls) => {
               trace.toolCalls(calls);
               publishToolCalls(calls, true);
+              publishToolCalls(calls, false, lastNarratedToolCall);
             });
           };
           let result = await runPrompt();
@@ -22901,7 +23533,7 @@ ${trigger}`,
           if (!reply && explained?.recoveredText)
             reply = durableReplyText(explained.recoveredText);
           reply = [replyBeforeNudge, reply].filter(Boolean).join("\n\n");
-          await flushToolCalls(result.toolCalls, reply);
+          await flushToolCalls(result.toolCalls, reply, true);
           for (const call of result.toolCalls) {
             const failure = toolCallFailureLine(call);
             if (failure)
@@ -23598,7 +24230,7 @@ async function removeCornerWorktreeAndBranches(worktree) {
     ]);
   }
 }
-var execFileAsync4 = promisify4(execFile5);
+var execFileAsync4 = promisify4(execFile6);
 async function removeCornerScratchWorkspace(input) {
   const expected = resolve20(input.roomRoot, "scratch");
   if (resolve20(input.scratchPath) !== expected) {
@@ -23632,6 +24264,8 @@ var RoomRuntimeCoordinator = class {
   /** One command-grant runner per daemon; Rooms and corners register their checkouts on it. */
   grantRunner;
   grantRunnerServer;
+  /** Connection usage capture, batched per agent turn. */
+  connectorUsage;
   constructor(runtime, configPath, baseConfig, options) {
     this.configPath = configPath;
     this.baseConfig = baseConfig;
@@ -23646,6 +24280,7 @@ var RoomRuntimeCoordinator = class {
       agentId: this.agent.publicKey
     });
     this.grantRunnerServer = new GrantRunnerServer(this.grantRunner);
+    this.connectorUsage = new ConnectorUsageRecorder();
     this.watchdogStaleMs = options.watchdogStaleMs ?? DEFAULT_ROOM_WATCHDOG_STALE_MS;
     this.reconcileHeartbeatMs = options.reconcileHeartbeatMs ?? DEFAULT_RECONCILE_HEARTBEAT_MS;
     this.drainDeadlineMs = options.drainDeadlineMs ?? DEFAULT_DRAIN_DEADLINE_MS;
@@ -23962,6 +24597,7 @@ var RoomRuntimeCoordinator = class {
         cornerId: corner.cornerId,
         grantRunner: this.grantRunner,
         ...grantRunnerEndpoint ? { grantRunnerEndpoint } : {},
+        connectorUsage: this.connectorUsage,
         parentRoomId: corner.parentRoomId,
         workspaceId: this.runtime.communityId,
         ...corner.openedBy ? { openedBy: corner.openedBy } : {},
@@ -24329,13 +24965,13 @@ var ThinDaemonCore = class {
 };
 
 // apps/body/dist/systemd.js
-import { execFile as execFile6 } from "node:child_process";
+import { execFile as execFile7 } from "node:child_process";
 import { mkdir as mkdir14, readFile as readFile9, writeFile as writeFile9 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname9, resolve as resolve21 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify5 } from "node:util";
-var execFileAsync5 = promisify5(execFile6);
+var execFileAsync5 = promisify5(execFile7);
 var DELIBERATE_REMOVAL_EXIT_STATUS = 78;
 var DAEMON_DISTRESS_EXIT_STATUS = 77;
 var UNKNOWN_AGENT_EXIT_STATUS = 79;
@@ -24574,7 +25210,7 @@ async function runStartCommand(args, interactiveUi) {
 }
 
 // apps/body/dist/connect-command.js
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { chmod as chmod6, mkdir as mkdir16, readFile as readFile11, unlink as unlink2, writeFile as writeFile11 } from "node:fs/promises";
 import { dirname as dirname12, resolve as resolve23 } from "node:path";
@@ -24661,7 +25297,7 @@ async function verifyProviderKey(input) {
 }
 
 // apps/body/dist/pair-agent-selection.js
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import { stdin as stdin2, stdout as stdout3 } from "node:process";
 var NO_AGENT_MESSAGE = `No supported ACP-capable coding agent was detected.
 Install one of these supported agents:
@@ -24689,7 +25325,7 @@ async function clackSelectAgent(candidates) {
 }
 async function installAdapter(install, opts) {
   await new Promise((resolveInstall, rejectInstall) => {
-    const child = spawn3(install.command, install.args, {
+    const child = spawn4(install.command, install.args, {
       cwd: opts.cwd,
       env: opts.env ?? process.env,
       stdio: "inherit"
@@ -25284,7 +25920,7 @@ async function writeProviderEnv(selection, agentPubkey) {
 }
 async function runInstalledFinish(binary, grantPath) {
   await new Promise((resolveRun, rejectRun) => {
-    const child = spawn5(binary, ["connect-finish", grantPath], {
+    const child = spawn6(binary, ["connect-finish", grantPath], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let diagnostic = "";
@@ -25457,7 +26093,7 @@ init_self_update_manifest();
 
 // apps/body/dist/managed-update.js
 init_self_update();
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { mkdir as mkdir18, rm as rm7, stat as stat3, writeFile as writeFile13 } from "node:fs/promises";
 import { dirname as dirname14, resolve as resolve25 } from "node:path";
 
@@ -25668,7 +26304,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
           libDir: resolve25(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
-        const record2 = {
+        const record3 = {
           version: 1,
           from,
           to,
@@ -25679,7 +26315,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
           status: "pending",
           ...this.#requiredProbeIds.length > 0 ? { requiredProbeIds: this.#requiredProbeIds, confirmedProbeIds: [] } : {}
         };
-        await writeUpdateAttempt(this.#layout, record2);
+        await writeUpdateAttempt(this.#layout, record3);
       } else if (this.#requiredProbeIds.length > 0) {
         const requiredProbeIds = [
           .../* @__PURE__ */ new Set([...attempt.requiredProbeIds ?? [], ...this.#requiredProbeIds])
@@ -25871,7 +26507,7 @@ async function runManagedUpdateWorkerProcess() {
   if (!entrypoint)
     throw new Error("cannot resolve the current Beeline entrypoint");
   await new Promise((resolveWorker, rejectWorker) => {
-    const child = spawn6(process.execPath, [entrypoint, "managed-update-worker"], {
+    const child = spawn7(process.execPath, [entrypoint, "managed-update-worker"], {
       detached: true,
       env: { ...process.env, BEELINE_INTERNAL_UPDATE_WORKER: "1" },
       stdio: ["ignore", "pipe", "pipe"]
@@ -26198,11 +26834,11 @@ async function readFailureRecord(runtimeDir) {
     return void 0;
   }
 }
-async function writeFailureRecord(runtimeDir, record2) {
+async function writeFailureRecord(runtimeDir, record3) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
   await mkdir19(dirname15(path), { recursive: true, mode: 448 });
-  await writeFile14(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile14(staged, `${JSON.stringify(record3, null, 2)}
 `, { mode: 384 });
   await rename6(staged, path);
 }
@@ -26210,13 +26846,13 @@ async function recordDaemonStartFailure(runtimeDir, error, now2 = Date.now()) {
   const prior = await readFailureRecord(runtimeDir);
   const failures = [...prior?.failures ?? [], now2].filter((failure) => now2 - failure <= DAEMON_FAILURE_WINDOW_MS);
   const distressed = failures.length >= DAEMON_FAILURE_LIMIT;
-  const record2 = {
+  const record3 = {
     version: 1,
     failures,
     lastError: (error instanceof Error ? error.message : String(error)).slice(0, 1e3),
     ...distressed ? { distressedAt: now2 } : {}
   };
-  await writeFailureRecord(runtimeDir, record2);
+  await writeFailureRecord(runtimeDir, record3);
   return { distressed, count: failures.length, path: daemonFailurePath(runtimeDir) };
 }
 async function clearDaemonStartFailures(runtimeDir) {
@@ -26503,7 +27139,7 @@ async function runUpdateFunctionalProbe(input) {
 }
 
 // apps/body/dist/current-release-probe.js
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import { dirname as dirname16, join as join10 } from "node:path";
 init_self_update();
 var CURRENT_RELEASE_PROBE_TIMEOUT_MS = 12e4;
@@ -26554,7 +27190,7 @@ async function probeReleaseInSubprocess(input) {
   }
   const timeoutMs = input.timeoutMs ?? CURRENT_RELEASE_PROBE_TIMEOUT_MS;
   return new Promise((resolve31) => {
-    const child = spawn7(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn8(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
     let stdout6 = "";
     let stderr = "";
     let settled = false;
@@ -26899,6 +27535,7 @@ async function runStoredDaemon(pathOrPointer) {
   const scratchSweepTimer = setInterval(() => runScratchSweepLogged(runtimeDir), SCRATCH_SWEEP_INTERVAL_MS);
   scratchSweepTimer.unref();
   let ready = false;
+  let connectorLoop;
   let stoppingStatus = "daemon stopped";
   try {
     const core = new ThinDaemonCore(runtime, configPath, config, { daemonApi });
@@ -26971,6 +27608,12 @@ async function runStoredDaemon(pathOrPointer) {
           ...runtime.modelSelection ? { runtimeSelection: runtime.modelSelection } : {},
           ...config.modelUnavailable ? { startupUnavailable: config.modelUnavailable.unavailable.label } : {}
         });
+        connectorLoop ??= new ConnectorAssignmentLoop({
+          api: daemonApi,
+          agentId: runtime.agent.publicKey,
+          log: (message) => console.log(`[body] connector: ${message}`)
+        });
+        connectorLoop.start();
       },
       onProgress: async (status) => {
         void drainRollbackAlert(core.activeRoomIds()[0] ?? runtime.rooms[0]?.channelId);