volute 0.39.0 → 0.40.1

package/dist/daemon.js

@@ -6,21 +6,21 @@ import {
   rejectPending,
   stageFile,
   validateFilePath
-} from "./chunk-TT4WT6Y7.js";
+} from "./chunk-YHWGN4FX.js";
 import {
   findOpenClawSession,
   importOpenClawConnectors,
   importPiSession,
   parseNameFromIdentity
-} from "./chunk-X7GM2OPM.js";
+} from "./chunk-SVXOBKQY.js";
 import {
   checkForUpdate,
   checkForUpdateCached,
   getCurrentVersion
-} from "./chunk-RAVQXKAG.js";
+} from "./chunk-MNUXL4XN.js";
 import {
   isHomeOnlyArchive
-} from "./chunk-IA2SZSLB.js";
+} from "./chunk-I57LLNAQ.js";
 import {
   computeTemplateHash
 } from "./chunk-KAB6UGOL.js";
@@ -30,7 +30,7 @@ import {
   fixModelEscapes,
   getPlatformDriver,
   routeOutboundBridge
-} from "./chunk-4BO4I7UF.js";
+} from "./chunk-LZ6CQYRO.js";
 import {
   getBridgeConfig,
   readBridgesConfig,
@@ -39,7 +39,7 @@ import {
   resolveChannelMapping,
   setBridgeConfig,
   setChannelMapping
-} from "./chunk-XOSAY7PY.js";
+} from "./chunk-PKGA23XM.js";
 import {
   PROMPT_DEFAULTS,
   PROMPT_KEYS,
@@ -47,12 +47,15 @@ import {
   RotatingLog,
   announceToSystem,
   assignSession,
+  clearDeliveredNotices,
   completeOrphanedTurns,
   completeTurn,
   createTurn,
   deleteSystemsConfig,
   deliverMessage,
+  drainNotices,
   ensureSystemChannel,
+  formatNotices,
   generateSystemReply,
   getActiveTurnId,
   getAllDiscoveredExtensions,
@@ -81,12 +84,14 @@ import {
   joinSystemChannel,
   linkToolResultToTurn,
   loadAllExtensions,
+  markErrored,
   notifyExtensionsDaemonStart,
   notifyExtensionsDaemonStop,
   publish as publish2,
   publishTypingForChannels,
   readSystemsConfig,
   recordInbound,
+  recordNotice,
   recordOutbound,
   resolveMindToken,
   setExtensionEnabled,
@@ -97,20 +102,22 @@ import {
   substitute,
   summarizeOrphanedTurns,
   summarizeTurn,
+  syncProviderToMinds,
   tagUntaggedInbound,
   tagUntaggedOutbound,
+  takeErrored,
   trackToolUse,
   uninstallNpmExtension,
   writeSystemsConfig
-} from "./chunk-CHCISTH7.js";
+} from "./chunk-BLAXARBZ.js";
 import {
   loadMergedEnv,
   mindEnvPath,
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-WUH54G5S.js";
-import "./chunk-Y4W3OS7Q.js";
+} from "./chunk-ITH5ZLZJ.js";
+import "./chunk-YTNBO7S6.js";
 import {
   applyInitFiles,
   composeTemplate,
@@ -137,7 +144,7 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-IBOU6Q3Y.js";
+} from "./chunk-QV7P3TYO.js";
 import {
   addMessage,
   createChannel,
@@ -169,25 +176,25 @@ import {
   setConversationPrivate,
   subscribe as subscribe2,
   updateChannelSettings
-} from "./chunk-QDWPM73D.js";
+} from "./chunk-3Y7UDHO7.js";
 import {
   readVoluteConfig,
   writeVoluteConfig
 } from "./chunk-CU6OFXMM.js";
-import "./chunk-EVKGKQ2P.js";
+import "./chunk-KMHC36CA.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-DZ4LYU6J.js";
+} from "./chunk-ANSTTB55.js";
 import {
   extractTextContent
-} from "./chunk-OS5MRIEP.js";
+} from "./chunk-NERYUSER.js";
 import {
   exec,
   gitExec,
   resolveVoluteBin
-} from "./chunk-OEXOFBW5.js";
+} from "./chunk-AEAZRTEV.js";
 import {
   chownMindDir,
   createMindUser,
@@ -195,7 +202,29 @@ import {
   ensureVoluteGroup,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-6FSSMAXU.js";
+} from "./chunk-6SYHHEQ7.js";
+import {
+  getAiConfig,
+  getAvailableModels,
+  getConfiguredProviders,
+  getEnabledModels,
+  getUtilityModel,
+  qualifyModelId,
+  removeAiConfig,
+  removeProviderConfig,
+  resolveApiKey,
+  resolveTemplate,
+  saveProviderConfig,
+  setEnabledModels,
+  setProviderRefreshHook,
+  setUtilityModel,
+  unqualifyModelId
+} from "./chunk-S4SXBQ7F.js";
+import {
+  isSetupComplete,
+  readGlobalConfig,
+  writeGlobalConfig
+} from "./chunk-DNU6XLE2.js";
 import {
   approveUser,
   changePassword,
@@ -214,32 +243,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-7W3UWCQD.js";
+} from "./chunk-E25SO3QW.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-7GZB3ZJP.js";
-import {
-  getAiConfig,
-  getAvailableModels,
-  getConfiguredProviders,
-  getEnabledModels,
-  getUtilityModel,
-  qualifyModelId,
-  removeAiConfig,
-  removeProviderConfig,
-  resolveApiKey,
-  resolveTemplate,
-  saveProviderConfig,
-  setEnabledModels,
-  setUtilityModel,
-  unqualifyModelId
-} from "./chunk-B7MWXFAH.js";
-import {
-  isSetupComplete,
-  readGlobalConfig,
-  writeGlobalConfig
-} from "./chunk-TCNCRDB5.js";
+} from "./chunk-QYI65HCL.js";
 import {
   logBuffer,
   logger_default
@@ -269,7 +277,7 @@ import {
   validateMindName,
   voluteHome,
   voluteSystemDir
-} from "./chunk-QDWP435B.js";
+} from "./chunk-B4WPXYPI.js";
 import {
   activity,
   channels,
@@ -281,14 +289,14 @@ import {
   systemPrompts,
   turns,
   users
-} from "./chunk-CJ26DXZL.js";
-import "./chunk-K3NQKI34.js";
+} from "./chunk-2HZRJ35V.js";
+import "./chunk-LMMQX4CK.js";
 
 // packages/daemon/src/daemon.ts
 import { randomBytes } from "crypto";
 import { mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { format } from "util";
 
 // packages/daemon/src/lib/daemon/bridge-manager.ts
@@ -498,8 +506,8 @@ var BridgeManager = class {
     if (!tracked) return;
     this.stopping.add(platform);
     this.bridges.delete(platform);
-    await new Promise((resolve17) => {
-      tracked.child.on("exit", () => resolve17());
+    await new Promise((resolve18) => {
+      tracked.child.on("exit", () => resolve18());
       try {
         if (tracked.child.pid) {
           process.kill(-tracked.child.pid, "SIGTERM");
@@ -510,7 +518,7 @@ var BridgeManager = class {
         if (err instanceof Error && err.code !== "ESRCH") {
           blog.warn(`failed to stop bridge ${platform}`, logger_default.errorData(err));
         }
-        resolve17();
+        resolve18();
       }
       setTimeout(() => {
         try {
@@ -521,7 +529,7 @@ var BridgeManager = class {
           }
         } catch {
         }
-        resolve17();
+        resolve18();
       }, 5e3);
     });
     this.stopping.delete(platform);
@@ -985,10 +993,10 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       stream.writeSSE({ data: JSON.stringify(entry) }).catch(() => {
       });
     });
-    await new Promise((resolve17) => {
+    await new Promise((resolve18) => {
       stream.onAbort(() => {
         unsubscribe();
-        resolve17();
+        resolve18();
       });
     });
   });
@@ -1301,8 +1309,8 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       createdAt: Date.now()
     };
     oauthFlows.set(flowId, flow);
-    const promptPromise = needsManualCode ? new Promise((resolve17) => {
-      flow.resolveCode = resolve17;
+    const promptPromise = needsManualCode ? new Promise((resolve18) => {
+      flow.resolveCode = resolve18;
     }) : void 0;
     oauthProvider.login({
       onAuth: (info) => {
@@ -1332,7 +1340,7 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
         existing.error = err instanceof Error ? err.message : String(err);
       }
     });
-    await new Promise((resolve17) => setTimeout(resolve17, 2e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 2e3));
     const state = oauthFlows.get(flowId);
     return c.json({
       flowId,
@@ -1590,8 +1598,8 @@ var app2 = new Hono2().get("/events", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve17) => {
-        stream.onAbort(() => resolve17());
+      await new Promise((resolve18) => {
+        stream.onAbort(() => resolve18());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -1994,7 +2002,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   }
   const participants = await getParticipants(channel.id);
   if (!participants.some((p) => p.userId === puppet.id)) {
-    const { addParticipant } = await import("./conversations-EUXHBWJD.js");
+    const { addParticipant } = await import("./conversations-AYLXPOGC.js");
     await addParticipant(channel.id, puppet.id);
   }
   const contentBlocks = body.content;
@@ -2087,8 +2095,8 @@ async function fanOutToBridgedMinds(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-7GWTTKWD.js");
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-EDCLALBF.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady2();
   const targetMinds = mindParticipants.filter((ap) => {
@@ -2174,13 +2182,13 @@ var config_default = config;
 
 // packages/daemon/src/web/api/env.ts
 import { Hono as Hono7 } from "hono";
-var app6 = new Hono7().get("/:name/env", async (c) => {
+var app6 = new Hono7().get("/:name/env", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const shared = readEnv(sharedEnvPath());
   const mind = readEnv(mindEnvPath(name));
   return c.json({ shared, mind });
-}).get("/:name/env/:key", async (c) => {
+}).get("/:name/env/:key", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const key = c.req.param("key");
@@ -2217,7 +2225,7 @@ var app6 = new Hono7().get("/:name/env", async (c) => {
   writeEnv(path, env);
   return c.json({ ok: true });
 });
-var sharedEnvApp = new Hono7().get("/", (c) => {
+var sharedEnvApp = new Hono7().get("/", requireAdmin, (c) => {
   return c.json(readEnv(sharedEnvPath()));
 }).put("/:key", requireAdmin, async (c) => {
   const key = c.req.param("key");
@@ -2253,7 +2261,7 @@ var app7 = new Hono8().get("/", (c) => {
 }).get("/all", (c) => {
   const detail = c.req.query("detail") === "true";
   return c.json(detail ? getAllDiscoveredExtensionsDetailed() : getAllDiscoveredExtensions());
-}).put("/:id/enabled", async (c) => {
+}).put("/:id/enabled", requireAdmin, async (c) => {
   const { id } = c.req.param();
   const body = await c.req.json().catch(() => null);
   if (!body || typeof body.enabled !== "boolean") {
@@ -2265,7 +2273,7 @@ var app7 = new Hono8().get("/", (c) => {
     return c.json({ error: err.message }, 404);
   }
   return c.json({ ok: true, requiresRestart: true });
-}).post("/install", async (c) => {
+}).post("/install", requireAdmin, async (c) => {
   const body = await c.req.json();
   const pkg = body.package?.trim();
   if (!pkg) {
@@ -2279,7 +2287,7 @@ var app7 = new Hono8().get("/", (c) => {
     const isValidation = message.includes("already installed") || message.includes("Invalid package");
     return c.json({ error: message }, isValidation ? 400 : 500);
   }
-}).delete("/uninstall/:package", async (c) => {
+}).delete("/uninstall/:package", requireAdmin, async (c) => {
   const pkg = c.req.param("package");
   try {
     await uninstallNpmExtension(pkg);
@@ -2300,7 +2308,7 @@ async function notifyMind(mindName, message) {
   const entry = await findMind(mindName);
   if (!entry) return;
   try {
-    const { sendSystemMessage } = await import("./system-chat-D343HYGR.js");
+    const { sendSystemMessage } = await import("./system-chat-LQSJVY55.js");
     await sendSystemMessage(mindName, message);
   } catch (err) {
     logger_default.warn(`[file-sharing] notify mind ${mindName} failed`, logger_default.errorData(err));
@@ -2349,11 +2357,11 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
     `[file] ${senderName} sent ${filename} (${sizeStr}) \u2014 run: volute chat accept ${id}`
   );
   return c.json({ status: "pending", id }, 200);
-}).get("/:name/files/pending", async (c) => {
+}).get("/:name/files/pending", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   return c.json(listPending(name));
-}).post("/:name/files/accept", async (c) => {
+}).post("/:name/files/accept", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -2375,7 +2383,7 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
   }
   await notifyMind(result.sender, `[file] ${name} accepted ${result.filename}`);
   return c.json({ ok: true, destPath: result.destPath });
-}).post("/:name/files/reject", async (c) => {
+}).post("/:name/files/reject", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const body = await c.req.json();
@@ -2392,7 +2400,7 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
   }
   await notifyMind(result.sender, `[file] ${name} rejected ${result.filename}`);
   return c.json({ ok: true });
-}).post("/:name/files/stage", async (c) => {
+}).post("/:name/files/stage", requireSelf(), async (c) => {
   const receiverName = c.req.param("name");
   const receiverEntry = await findMind(receiverName);
   if (!receiverEntry) return c.json({ error: "Mind not found" }, 404);
@@ -2425,8 +2433,34 @@ var file_sharing_default = app8;
 // packages/daemon/src/web/api/files.ts
 import { mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { readdir, readFile, realpath, stat } from "fs/promises";
-import { extname as extname2, resolve as resolve5 } from "path";
+import { extname as extname2, resolve as resolve6 } from "path";
 import { Hono as Hono10 } from "hono";
+
+// packages/daemon/src/lib/util/paths.ts
+import { resolve as resolve5, sep } from "path";
+var PathTraversalError = class extends Error {
+  constructor(base, userPath) {
+    super(`Path "${userPath}" escapes base directory "${base}"`);
+    this.name = "PathTraversalError";
+  }
+};
+function resolveWithinBase(base, userPath) {
+  const resolvedBase = resolve5(base);
+  const target = resolve5(resolvedBase, userPath);
+  if (target !== resolvedBase && !target.startsWith(resolvedBase + sep)) {
+    throw new PathTraversalError(base, userPath);
+  }
+  return target;
+}
+function safeResolveWithinBase(base, userPath) {
+  try {
+    return resolveWithinBase(base, userPath);
+  } catch {
+    return null;
+  }
+}
+
+// packages/daemon/src/web/api/files.ts
 var AVATAR_MIME2 = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -2470,13 +2504,14 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
     return c.json({ error: "Invalid file type (png, jpg, gif, webp only)" }, 400);
   }
   const dir = entry.dir ?? mindDir(name);
-  const homeDir = resolve5(dir, "home");
+  const homeDir = resolve6(dir, "home");
   const filename = `avatar${ext}`;
-  const avatarPath = resolve5(homeDir, filename);
+  const avatarPath = resolve6(homeDir, filename);
   const config2 = readVoluteConfig(dir) ?? {};
   const oldAvatar = config2.profile?.avatar;
   if (oldAvatar && oldAvatar !== filename) {
-    rmSync2(resolve5(homeDir, oldAvatar), { force: true });
+    const oldAvatarPath = safeResolveWithinBase(homeDir, oldAvatar);
+    if (oldAvatarPath) rmSync2(oldAvatarPath, { force: true });
   }
   const buffer2 = Buffer.from(await file.arrayBuffer());
   mkdirSync3(homeDir, { recursive: true });
@@ -2498,8 +2533,8 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const ext = extname2(config2.profile.avatar).toLowerCase();
   const mime = AVATAR_MIME2[ext];
   if (!mime) return c.json({ error: "Invalid avatar extension" }, 400);
-  const homeDir = resolve5(dir, "home");
-  const avatarPath = resolve5(homeDir, config2.profile.avatar);
+  const homeDir = resolve6(dir, "home");
+  const avatarPath = resolve6(homeDir, config2.profile.avatar);
   if (!avatarPath.startsWith(`${homeDir}/`)) return c.json({ error: "Invalid avatar path" }, 400);
   let realAvatarPath;
   try {
@@ -2527,7 +2562,7 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
   let entries;
   try {
     entries = await readdir(homeDir, { withFileTypes: true });
@@ -2542,10 +2577,10 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
   const wildcard = c.req.path.replace(new RegExp(`^.*/minds/${name}/files`), "") || "/";
   const relativePath = wildcard.slice(1);
-  const requestedPath = resolve5(homeDir, relativePath);
+  const requestedPath = resolve6(homeDir, relativePath);
   if (requestedPath !== homeDir && !requestedPath.startsWith(`${homeDir}/`))
     return c.text("Forbidden", 403);
   if (relativePath.split("/").some((seg) => seg.startsWith("."))) return c.text("Forbidden", 403);
@@ -2977,16 +3012,16 @@ import { Hono as Hono12 } from "hono";
 // packages/daemon/src/lib/mind/identity.ts
 import { createHash, generateKeyPairSync, sign, verify } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 function generateIdentity(mindDir2) {
-  const identityDir = resolve6(mindDir2, ".mind/identity");
+  const identityDir = resolve7(mindDir2, ".mind/identity");
   mkdirSync4(identityDir, { recursive: true });
   const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
     publicKeyEncoding: { type: "spki", format: "pem" },
     privateKeyEncoding: { type: "pkcs8", format: "pem" }
   });
-  const privatePath = resolve6(identityDir, "private.pem");
-  const publicPath = resolve6(identityDir, "public.pem");
+  const privatePath = resolve7(identityDir, "private.pem");
+  const publicPath = resolve7(identityDir, "public.pem");
   writeFileSync4(privatePath, privateKey, { mode: 384 });
   writeFileSync4(publicPath, publicKey, { mode: 420 });
   const config2 = readVoluteConfig(mindDir2) ?? {};
@@ -3001,7 +3036,7 @@ function getPublicKey(mindDir2) {
   const config2 = readVoluteConfig(mindDir2);
   const relPath = config2?.identity?.publicKey;
   if (!relPath) return null;
-  const fullPath = resolve6(mindDir2, relPath);
+  const fullPath = resolve7(mindDir2, relPath);
   if (!existsSync4(fullPath)) return null;
   return readFileSync5(fullPath, "utf-8");
 }
@@ -3051,14 +3086,14 @@ var keys_default = app10;
 // packages/daemon/src/web/api/logs.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 import { Hono as Hono13 } from "hono";
 import { streamSSE as streamSSE3 } from "hono/streaming";
-var app11 = new Hono13().get("/:name/logs", async (c) => {
+var app11 = new Hono13().get("/:name/logs", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve7(stateDir(name), "logs", "mind.log");
+  const logFile = resolve8(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3077,16 +3112,16 @@ var app11 = new Hono13().get("/:name/logs", async (c) => {
     stream.onAbort(() => {
       tail.kill();
     });
-    await new Promise((resolve17) => {
-      tail.on("exit", resolve17);
-      stream.onAbort(resolve17);
+    await new Promise((resolve18) => {
+      tail.on("exit", resolve18);
+      stream.onAbort(resolve18);
     });
   });
-}).get("/:name/logs/tail", async (c) => {
+}).get("/:name/logs/tail", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve7(stateDir(name), "logs", "mind.log");
+  const logFile = resolve8(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3097,8 +3132,8 @@ var app11 = new Hono13().get("/:name/logs", async (c) => {
   tail.stdout.on("data", (data) => {
     output += data.toString();
   });
-  await new Promise((resolve17) => {
-    tail.on("exit", resolve17);
+  await new Promise((resolve18) => {
+    tail.on("exit", resolve18);
   });
   return c.text(output);
 });
@@ -3195,26 +3230,63 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { resolve as resolve10 } from "path";
+import { basename, resolve as resolve11 } from "path";
 import { zValidator as zValidator5 } from "@hono/zod-validator";
 import { and as and4, desc as desc3, eq as eq5, sql as sql2 } from "drizzle-orm";
 import { Hono as Hono15 } from "hono";
 import { z as z5 } from "zod";
 
+// packages/daemon/src/lib/daemon/error-classify.ts
+function classify(raw) {
+  const s = (raw ?? "").toLowerCase();
+  if (/\b(401|403)\b|authentication_error|invalid authentication|invalid x-api-key|unauthorized|permission_error/.test(
+    s
+  )) {
+    return {
+      reason: "auth_error",
+      detail: "Your last turn failed because your model credentials were rejected (most often an expired token). The daemon refreshes them automatically, so this is normally transient \u2014 you're fine to continue."
+    };
+  }
+  if (/\b429\b|rate.?limit|too many requests/.test(s)) {
+    return {
+      reason: "rate_limit",
+      detail: "Your last turn failed because you hit the model provider's rate limit. This is temporary \u2014 it clears on its own shortly."
+    };
+  }
+  if (/\b529\b|overloaded/.test(s)) {
+    return {
+      reason: "overloaded",
+      detail: "Your last turn failed because the model provider was overloaded (a 529). This is transient and resolves on its own."
+    };
+  }
+  if (/econnreset|etimedout|enotfound|econnrefused|fetch failed|network|socket hang up|timeout/.test(
+    s
+  )) {
+    return {
+      reason: "network",
+      detail: "Your last turn failed due to a network error reaching the model provider. This is transient \u2014 the connection should recover."
+    };
+  }
+  return {
+    reason: "unknown",
+    detail: `Your last turn failed with an error: ${raw}`
+  };
+}
+
 // packages/daemon/src/lib/mind/consolidate.ts
 import { readdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 async function consolidateMemory(mindDir2) {
-  const soulPath = resolve8(mindDir2, "home/SOUL.md");
-  const memoryPath = resolve8(mindDir2, "home/MEMORY.md");
-  const memoryDir = resolve8(mindDir2, "home/memory");
+  const soulPath = resolve9(mindDir2, "home/SOUL.md");
+  const memoryPath = resolve9(mindDir2, "home/MEMORY.md");
+  const memoryDir = resolve9(mindDir2, "home/memory");
   const soul = readFileSync6(soulPath, "utf-8");
   const logs = [];
   try {
     const files = readdirSync(memoryDir).filter((f) => /^\d{4}-\d{2}-\d{2}\.md$/.test(f)).sort();
     for (const filename of files) {
       const date = filename.replace(".md", "");
-      const content2 = readFileSync6(resolve8(memoryDir, filename), "utf-8").trim();
+      const content2 = readFileSync6(resolve9(memoryDir, filename), "utf-8").trim();
       if (content2) {
         logs.push(`### ${date}
 
@@ -3282,7 +3354,7 @@ async function cleanupVariant(variantName, projectRoot, variantPath, opts) {
       logger_default.warn(`failed to stop variant ${variantName}`, logger_default.errorData(err));
     }
   }
-  const { findMind: findMind2 } = await import("./registry-LWEOAO53.js");
+  const { findMind: findMind2 } = await import("./registry-GV35XFT7.js");
   const variantEntry = await findMind2(variantName);
   const branchName = variantEntry?.branch ?? variantName;
   if (existsSync6(variantPath)) {
@@ -3334,7 +3406,7 @@ function validateBranchName(branch) {
 import { randomUUID } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { homedir } from "os";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 function convertSession(opts) {
   const lines = readFileSync7(opts.sessionPath, "utf-8").trim().split("\n");
   const sessionId = randomUUID();
@@ -3450,9 +3522,9 @@ function convertSession(opts) {
     }
   }
   const projectId = opts.projectDir.replace(/\//g, "-");
-  const sdkDir = resolve9(homedir(), ".claude", "projects", projectId);
+  const sdkDir = resolve10(homedir(), ".claude", "projects", projectId);
   mkdirSync5(sdkDir, { recursive: true });
-  const sdkPath = resolve9(sdkDir, `${sessionId}.jsonl`);
+  const sdkPath = resolve10(sdkDir, `${sessionId}.jsonl`);
   writeFileSync6(sdkPath, `${sdkEvents.join("\n")}
 `);
   console.log(`Converted ${sdkEvents.length} messages \u2192 ${sdkPath}`);
@@ -3520,13 +3592,26 @@ async function checkHealth(port) {
 
 // packages/daemon/src/web/api/minds.ts
 var SUBSTANTIVE_TYPES = /* @__PURE__ */ new Set(["thinking", "text", "tool_use", "tool_result", "outbound"]);
+var noticeDrainWatermarks = /* @__PURE__ */ new Map();
+function markDeliveredOnCleanTurn(mind, session) {
+  if (!session) return;
+  const wmKey = `${mind}:${session}`;
+  const watermark = noticeDrainWatermarks.get(wmKey);
+  noticeDrainWatermarks.delete(wmKey);
+  const errored = takeErrored(mind, session);
+  if (!errored && watermark != null) {
+    clearDeliveredNotices(mind, session, watermark).catch(
+      (err) => logger_default.warn(`failed to clear delivered notices for ${mind}:${session}`, logger_default.errorData(err))
+    );
+  }
+}
 var _lastActiveCache = { map: /* @__PURE__ */ new Map(), ts: 0 };
 var _LAST_ACTIVE_TTL = 6e4;
 async function getMindStatus(name, port, registryRunning) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
     if (getSleepManagerIfReady2()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -3572,7 +3657,7 @@ async function initTemplateBranch(projectRoot, composedDir, manifest, mindName,
   await gitExec(["commit", "-m", "initial commit"], opts);
 }
 async function updateTemplateBranch(projectRoot, template, mindName) {
-  const tempWorktree = resolve10(projectRoot, ".variants", "_template_update");
+  const tempWorktree = resolve11(projectRoot, ".variants", "_template_update");
   let branchExists = false;
   try {
     await gitExec(["rev-parse", "--verify", TEMPLATE_BRANCH], { cwd: projectRoot });
@@ -3604,15 +3689,15 @@ async function updateTemplateBranch(projectRoot, template, mindName) {
       });
     }
     copyTemplateToDir(composedDir, tempWorktree, mindName, manifest);
-    const initDir = resolve10(tempWorktree, ".init");
+    const initDir = resolve11(tempWorktree, ".init");
     if (existsSync7(initDir)) {
       rmSync4(initDir, { recursive: true, force: true });
     }
-    const homeDir = resolve10(tempWorktree, "home");
+    const homeDir = resolve11(tempWorktree, "home");
     if (existsSync7(homeDir)) {
       for (const entry of readdirSync2(homeDir)) {
         if (entry !== "VOLUTE.md") {
-          rmSync4(resolve10(homeDir, entry), { recursive: true, force: true });
+          rmSync4(resolve11(homeDir, entry), { recursive: true, force: true });
         }
       }
     }
@@ -3653,7 +3738,7 @@ async function mergeTemplateBranch(worktreeDir) {
 async function npmInstallAsMind(cwd, mindName) {
   if (isIsolationEnabled()) {
     const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
-    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve10(cwd, "home") } });
+    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve11(cwd, "home") } });
   } else {
     await exec("npm", ["install"], { cwd });
   }
@@ -3704,7 +3789,7 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
   return { ok: true };
 }
 async function importFromArchive(c, tempDir, nameOverride, manifest) {
-  const extractedMindDir = resolve10(tempDir, "mind");
+  const extractedMindDir = resolve11(tempDir, "mind");
   if (!existsSync7(extractedMindDir)) {
     return c.json({ error: "Invalid archive: missing mind/ directory" }, 400);
   }
@@ -3731,9 +3816,9 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve10(tempDir, "state/env.json");
+    const envJson = resolve11(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve10(state, "env.json"));
+      cpSync(envJson, resolve11(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
@@ -3742,23 +3827,23 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
     await npmInstallAsMind(dest, name);
     await importHistoryFromArchive(name, tempDir);
     importSessionsFromArchive(dest, tempDir);
-    if (!existsSync7(resolve10(dest, ".git"))) {
+    if (!existsSync7(resolve11(dest, ".git"))) {
       try {
-        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
+        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
         await gitExec(["init"], { cwd: dest, mindName: name, env });
         await configureGitIdentity(name, { cwd: dest, mindName: name, env });
         await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
         await gitExec(["commit", "-m", "import from archive"], { cwd: dest, mindName: name, env });
       } catch (err) {
         logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-        rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+        rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       }
     }
     chownMindDir(dest, name);
@@ -3791,22 +3876,22 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   try {
     copyTemplateToDir(composedDir, dest, name, templateManifest);
     applyInitFiles(dest);
-    const extractedHome = resolve10(extractedMindDir, "home");
+    const extractedHome = resolve11(extractedMindDir, "home");
     if (existsSync7(extractedHome)) {
-      cpSync(extractedHome, resolve10(dest, "home"), { recursive: true });
+      cpSync(extractedHome, resolve11(dest, "home"), { recursive: true });
     }
-    const extractedMindInternal = resolve10(extractedMindDir, ".mind");
+    const extractedMindInternal = resolve11(extractedMindDir, ".mind");
     if (existsSync7(extractedMindInternal)) {
-      cpSync(extractedMindInternal, resolve10(dest, ".mind"), { recursive: true });
+      cpSync(extractedMindInternal, resolve11(dest, ".mind"), { recursive: true });
     }
-    const identityDir = resolve10(dest, ".mind/identity");
+    const identityDir = resolve11(dest, ".mind/identity");
     let publicKeyPem;
-    if (!manifest.includes.identity || !existsSync7(resolve10(identityDir, "private.pem"))) {
+    if (!manifest.includes.identity || !existsSync7(resolve11(identityDir, "private.pem"))) {
       ({ publicKeyPem } = generateIdentity(dest));
     } else {
-      publicKeyPem = readFileSync8(resolve10(identityDir, "public.pem"), "utf-8");
+      publicKeyPem = readFileSync8(resolve11(identityDir, "public.pem"), "utf-8");
     }
-    const promptsPath = resolve10(dest, "home/.config/prompts.json");
+    const promptsPath = resolve11(dest, "home/.config/prompts.json");
     if (!existsSync7(promptsPath)) {
       const mindPrompts = await getMindPromptDefaults();
       writeFileSync7(promptsPath, `${JSON.stringify(mindPrompts, null, 2)}
@@ -3814,13 +3899,13 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve10(tempDir, "state/env.json");
+    const envJson = resolve11(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve10(state, "env.json"));
+      cpSync(envJson, resolve11(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -3833,7 +3918,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
       await initTemplateBranch(dest, composedDir, templateManifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     const skillSet = manifest.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions();
@@ -3876,7 +3961,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   }
 }
 async function importHistoryFromArchive(name, tempDir) {
-  const historyJsonl = resolve10(tempDir, "history.jsonl");
+  const historyJsonl = resolve11(tempDir, "history.jsonl");
   if (!existsSync7(historyJsonl)) return;
   try {
     const db = await getDb();
@@ -3916,13 +4001,13 @@ async function importHistoryFromArchive(name, tempDir) {
   }
 }
 function importSessionsFromArchive(dest, tempDir) {
-  const sessionsDir = resolve10(tempDir, "sessions");
+  const sessionsDir = resolve11(tempDir, "sessions");
   if (!existsSync7(sessionsDir)) return;
   try {
-    const destSessions = resolve10(dest, ".mind/sessions");
+    const destSessions = resolve11(dest, ".mind/sessions");
     mkdirSync6(destSessions, { recursive: true });
     for (const file of readdirSync2(sessionsDir)) {
-      cpSync(resolve10(sessionsDir, file), resolve10(destSessions, file));
+      cpSync(resolve11(sessionsDir, file), resolve11(destSessions, file));
     }
   } catch (err) {
     logger_default.error("Failed to import sessions from archive", logger_default.errorData(err));
@@ -3948,6 +4033,38 @@ function formatTimeAgo(date) {
   const days = Math.floor(hours / 24);
   return `${days}d ago`;
 }
+async function proxyToMind(c, path) {
+  const name = c.req.param("name");
+  const entry = await findMind(name);
+  if (!entry) return c.json({ error: "Mind not found" }, 404);
+  if (!getMindManager().isRunning(name)) {
+    return c.json({ error: "Mind is not running" }, 503);
+  }
+  try {
+    const res = await fetch(`http://127.0.0.1:${entry.port}/${path}`, {
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      const status = res.status >= 500 ? 502 : 404;
+      return c.json(
+        {
+          error: res.status >= 500 ? `Mind ${path} handler errored` : `${path} endpoint not available`
+        },
+        status
+      );
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      return c.json({ error: "Mind returned invalid response" }, 502);
+    }
+    return c.json(data);
+  } catch (err) {
+    console.error(`${path} proxy for ${name}:`, err);
+    return c.json({ error: "Failed to reach mind" }, 503);
+  }
+}
 var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", createMindSchema), async (c) => {
   const body = c.req.valid("json");
   const { name } = body;
@@ -3965,7 +4082,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
     {
-      const { readGlobalConfig: readGlobal } = await import("./setup-IFYS3TLS.js");
+      const { readGlobalConfig: readGlobal } = await import("./setup-OTEC3ZPM.js");
       const mindDefaults = readGlobal().mindDefaults;
       const config2 = readVoluteConfig(dest);
       if (!config2) throw new Error("Failed to read volute.json after identity generation");
@@ -4002,7 +4119,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       }
       writeVoluteConfig(dest, config2);
       const modelId = body.model ?? cog?.model;
-      const sdkConfigPath = resolve10(dest, "home/.config/config.json");
+      const sdkConfigPath = resolve11(dest, "home/.config/config.json");
       if (modelId || cog?.compaction) {
         const existing = existsSync7(sdkConfigPath) ? JSON.parse(readFileSync8(sdkConfigPath, "utf-8")) : {};
         if (modelId) {
@@ -4017,7 +4134,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     }
     const mindPrompts = await getMindPromptDefaults();
     writeFileSync7(
-      resolve10(dest, "home/.config/prompts.json"),
+      resolve11(dest, "home/.config/prompts.json"),
       `${JSON.stringify(mindPrompts, null, 2)}
 `
     );
@@ -4029,7 +4146,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -4042,7 +4159,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       await initTemplateBranch(dest, composedDir, manifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for ${name}`, logger_default.errorData(err));
-      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     chownMindDir(dest, name);
@@ -4052,11 +4169,11 @@ The human who planted you described you as: "${body.description}"
 ` : "";
       const seedSoulRaw = body.seedSoul ?? await getPrompt("seed_soul", { name, description: descLine });
       const seedSoul = body.seedSoul ? substitute(seedSoulRaw, { name, description: descLine }) : seedSoulRaw;
-      writeFileSync7(resolve10(dest, "home/SOUL.md"), seedSoul);
+      writeFileSync7(resolve11(dest, "home/SOUL.md"), seedSoul);
     }
     let skillSet = body.skills ?? (body.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions());
     if (body.stage === "seed" && !body.skills) {
-      const { isImagegenEnabled } = await import("./setup-IFYS3TLS.js");
+      const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
       if (isImagegenEnabled()) {
         skillSet = [...skillSet, "imagegen"];
       }
@@ -4074,7 +4191,7 @@ The human who planted you described you as: "${body.description}"
       try {
         const spiritEntry = await findMind("volute");
         if (spiritEntry) {
-          const { spiritDir } = await import("./spirit-U6MDQLYT.js");
+          const { spiritDir } = await import("./spirit-NVXWSVKM.js");
           const sDir = spiritEntry.dir ?? spiritDir();
           const spiritConfig = readVoluteConfig(sDir) ?? {};
           const schedules = spiritConfig.schedules ?? [];
@@ -4089,7 +4206,7 @@ The human who planted you described you as: "${body.description}"
             });
             spiritConfig.schedules = schedules;
             writeVoluteConfig(sDir, spiritConfig);
-            const { getScheduler: getScheduler2 } = await import("./scheduler-CGUPAEBA.js");
+            const { getScheduler: getScheduler2 } = await import("./scheduler-GQBDCGLU.js");
             getScheduler2().loadSchedules("volute", sDir);
           }
         }
@@ -4100,11 +4217,11 @@ The human who planted you described you as: "${body.description}"
     if (body.stage !== "seed") {
       const customSoul = await getPromptIfCustom("default_soul");
       if (customSoul) {
-        writeFileSync7(resolve10(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
+        writeFileSync7(resolve11(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
       }
       const customMemory = await getPromptIfCustom("default_memory");
       if (customMemory) {
-        writeFileSync7(resolve10(dest, "home/MEMORY.md"), customMemory);
+        writeFileSync7(resolve11(dest, "home/MEMORY.md"), customMemory);
       }
     }
     publishPublicKey(name, publicKeyPem).catch(
@@ -4153,12 +4270,12 @@ The human who planted you described you as: "${body.description}"
     return importFromArchive(c, body.archivePath, body.name, body.manifest);
   }
   const wsDir = body.workspacePath;
-  if (!wsDir || !existsSync7(resolve10(wsDir, "SOUL.md")) || !existsSync7(resolve10(wsDir, "IDENTITY.md"))) {
+  if (!wsDir || !existsSync7(resolve11(wsDir, "SOUL.md")) || !existsSync7(resolve11(wsDir, "IDENTITY.md"))) {
     return c.json({ error: "Invalid workspace: missing SOUL.md or IDENTITY.md" }, 400);
   }
-  const soul = readFileSync8(resolve10(wsDir, "SOUL.md"), "utf-8");
-  const identity = readFileSync8(resolve10(wsDir, "IDENTITY.md"), "utf-8");
-  const userPath = resolve10(wsDir, "USER.md");
+  const soul = readFileSync8(resolve11(wsDir, "SOUL.md"), "utf-8");
+  const identity = readFileSync8(resolve11(wsDir, "IDENTITY.md"), "utf-8");
+  const userPath = resolve11(wsDir, "USER.md");
   const user = existsSync7(userPath) ? readFileSync8(userPath, "utf-8") : "";
   const name = body.name ?? parseNameFromIdentity(identity) ?? "imported-mind";
   const template = body.template ?? "claude";
@@ -4186,26 +4303,26 @@ ${user.trimEnd()}
     copyTemplateToDir(composedDir, dest, name, manifest);
     applyInitFiles(dest);
     const { publicKeyPem: importPublicKey } = generateIdentity(dest);
-    writeFileSync7(resolve10(dest, "home/SOUL.md"), mergedSoul);
-    const wsMemoryPath = resolve10(wsDir, "MEMORY.md");
+    writeFileSync7(resolve11(dest, "home/SOUL.md"), mergedSoul);
+    const wsMemoryPath = resolve11(wsDir, "MEMORY.md");
     const hasMemory = existsSync7(wsMemoryPath);
     if (hasMemory) {
       const existingMemory = readFileSync8(wsMemoryPath, "utf-8");
       writeFileSync7(
-        resolve10(dest, "home/MEMORY.md"),
+        resolve11(dest, "home/MEMORY.md"),
         `${existingMemory.trimEnd()}${mergedMemoryExtra}`
       );
     } else if (user) {
-      writeFileSync7(resolve10(dest, "home/MEMORY.md"), `${user.trimEnd()}
+      writeFileSync7(resolve11(dest, "home/MEMORY.md"), `${user.trimEnd()}
 `);
     }
-    const wsMemoryDir = resolve10(wsDir, "memory");
+    const wsMemoryDir = resolve11(wsDir, "memory");
     let dailyLogCount = 0;
     if (existsSync7(wsMemoryDir)) {
-      const destMemoryDir = resolve10(dest, "home/memory");
+      const destMemoryDir = resolve11(dest, "home/memory");
       const files = readdirSync2(wsMemoryDir).filter((f) => f.endsWith(".md"));
       for (const file of files) {
-        cpSync(resolve10(wsMemoryDir, file), resolve10(destMemoryDir, file));
+        cpSync(resolve11(wsMemoryDir, file), resolve11(destMemoryDir, file));
       }
       dailyLogCount = files.length;
     }
@@ -4216,7 +4333,7 @@ ${user.trimEnd()}
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -4224,20 +4341,20 @@ ${user.trimEnd()}
     if (!hasMemory && dailyLogCount > 0) {
       await consolidateMemory(dest);
     }
-    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
+    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
     await gitExec(["init"], { cwd: dest, mindName: name, env });
     await configureGitIdentity(name, { cwd: dest, mindName: name, env });
     await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
     await gitExec(["commit", "-m", "import from OpenClaw"], { cwd: dest, mindName: name, env });
-    const sessionFile = body.sessionPath ? resolve10(body.sessionPath) : findOpenClawSession(wsDir);
+    const sessionFile = body.sessionPath ? resolve11(body.sessionPath) : findOpenClawSession(wsDir);
     if (sessionFile && existsSync7(sessionFile)) {
       if (template === "pi") {
         importPiSession(sessionFile, dest);
       } else if (template === "claude") {
         const sessionId = convertSession({ sessionPath: sessionFile, projectDir: dest });
-        const mindRuntimeDir = resolve10(dest, ".mind");
+        const mindRuntimeDir = resolve11(dest, ".mind");
         mkdirSync6(mindRuntimeDir, { recursive: true });
-        writeFileSync7(resolve10(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
+        writeFileSync7(resolve11(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
       }
     }
     importOpenClawConnectors(name, dest);
@@ -4278,7 +4395,7 @@ ${user.trimEnd()}
   const minds = await Promise.all(
     entries.map(async (entry) => {
       const mindStatus = await getMindStatus(entry.name, entry.port, entry.running);
-      const hasPages = existsSync7(resolve10(mindDir(entry.name), "home", "pages"));
+      const hasPages = existsSync7(resolve11(mindDir(entry.name), "home", "pages"));
       return {
         ...entry,
         ...mindStatus,
@@ -4307,35 +4424,9 @@ ${user.trimEnd()}
       return { name: s.name, port: s.port, status: variantStatus };
     })
   );
-  const hasPages = existsSync7(resolve10(mindDir(name), "home", "pages"));
+  const hasPages = existsSync7(resolve11(mindDir(name), "home", "pages"));
   return c.json({ ...entry, ...mindStatus, variants: variantStatuses, hasPages });
-}).get("/:name/context", async (c) => {
-  const name = c.req.param("name");
-  const entry = await findMind(name);
-  if (!entry) return c.json({ error: "Mind not found" }, 404);
-  if (!getMindManager().isRunning(name)) {
-    return c.json({ error: "Mind is not running" }, 503);
-  }
-  try {
-    const res = await fetch(`http://127.0.0.1:${entry.port}/context`, {
-      signal: AbortSignal.timeout(3e3)
-    });
-    if (!res.ok) {
-      const status = res.status >= 500 ? 502 : 404;
-      return c.json(
-        {
-          error: res.status >= 500 ? "Mind context handler errored" : "Context endpoint not available"
-        },
-        status
-      );
-    }
-    const data = await res.json();
-    return c.json(data);
-  } catch (err) {
-    console.error(`context proxy for ${name}:`, err);
-    return c.json({ error: "Failed to reach mind" }, 503);
-  }
-}).post("/:name/start", requireSelf(), async (c) => {
+}).get("/:name/context", requireSelf(), async (c) => proxyToMind(c, "context")).get("/:name/context/messages", requireSelf(), async (c) => proxyToMind(c, "context/messages")).post("/:name/start", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -4380,7 +4471,7 @@ ${user.trimEnd()}
   const manager = getMindManager();
   try {
     if (context?.type === "reload") {
-      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
       const sleepState = getSleepManagerIfReady2()?.getState(name);
       if (sleepState?.sleeping) {
         logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
@@ -4475,7 +4566,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -4483,7 +4574,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -4503,7 +4594,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const sleepState = sm.getState(name);
@@ -4518,7 +4609,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-6QRMUNHK.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-5277OBHI.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -4533,10 +4624,10 @@ ${user.trimEnd()}
   const profile = config2.profile ?? {};
   if (body.displayName !== void 0) profile.displayName = body.displayName;
   if (body.description !== void 0) profile.description = body.description;
-  if (body.avatar !== void 0) profile.avatar = body.avatar;
+  if (body.avatar !== void 0) profile.avatar = basename(body.avatar);
   config2.profile = profile;
   writeVoluteConfig(dir, config2);
-  const { syncMindProfile: syncMindProfile2 } = await import("./auth-OJ2YW3NR.js");
+  const { syncMindProfile: syncMindProfile2 } = await import("./auth-X6ZITZ7D.js");
   await syncMindProfile2(name, profile);
   broadcast({ type: "profile_updated", mind: name, summary: `${name} profile updated` });
   return c.json({ ok: true });
@@ -4576,14 +4667,14 @@ ${user.trimEnd()}
     return c.json({ output: "" });
   }
   const dir = entry.dir ?? mindDir(name);
-  const soulPath = resolve10(dir, "home/SOUL.md");
-  const memoryPath = resolve10(dir, "home/MEMORY.md");
+  const soulPath = resolve11(dir, "home/SOUL.md");
+  const memoryPath = resolve11(dir, "home/MEMORY.md");
   const soulCustom = existsSync7(soulPath) && !readFileSync8(soulPath, "utf-8").includes(ORIENTATION_MARKER);
   const memoryWritten = existsSync7(memoryPath) && readFileSync8(memoryPath, "utf-8").trim().length > 0;
   const config2 = readVoluteConfig(dir);
   const displayNameSet = !!config2?.profile?.displayName;
   const avatarSet = !!config2?.profile?.avatar;
-  const { isImagegenEnabled } = await import("./setup-IFYS3TLS.js");
+  const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
   const imagegenEnabled = isImagegenEnabled();
   const done = [];
   const remaining = [];
@@ -4621,7 +4712,7 @@ ${user.trimEnd()}
   try {
     const spiritEntry = await findMind("volute");
     if (spiritEntry) {
-      const { spiritDir } = await import("./spirit-U6MDQLYT.js");
+      const { spiritDir } = await import("./spirit-NVXWSVKM.js");
       const sDir = spiritEntry.dir ?? spiritDir();
       const spiritConfig = readVoluteConfig(sDir);
       if (spiritConfig?.schedules) {
@@ -4629,7 +4720,7 @@ ${user.trimEnd()}
         spiritConfig.schedules = spiritConfig.schedules.filter((s) => s.id !== nurtureId);
         if (spiritConfig.schedules.length === 0) spiritConfig.schedules = void 0;
         writeVoluteConfig(sDir, spiritConfig);
-        const { getScheduler: getScheduler2 } = await import("./scheduler-CGUPAEBA.js");
+        const { getScheduler: getScheduler2 } = await import("./scheduler-GQBDCGLU.js");
         getScheduler2().loadSchedules("volute", sDir);
       }
     }
@@ -4684,16 +4775,16 @@ ${user.trimEnd()}
   const template = body.template ?? entry.template ?? "claude";
   const UPGRADE_BRANCH = "upgrade";
   const upgradeVariantName = `${mindName}-upgrade`;
-  const worktreeDir = resolve10(dir, ".variants", UPGRADE_BRANCH);
+  const worktreeDir = resolve11(dir, ".variants", UPGRADE_BRANCH);
   if (body.abort) {
     if (!existsSync7(worktreeDir)) {
       return c.json({ error: "No upgrade in progress" }, 400);
     }
     try {
       try {
-        const gitDirContent = readFileSync8(resolve10(worktreeDir, ".git"), "utf-8").trim();
+        const gitDirContent = readFileSync8(resolve11(worktreeDir, ".git"), "utf-8").trim();
         const gitDir = gitDirContent.replace("gitdir: ", "");
-        if (existsSync7(resolve10(gitDir, "MERGE_HEAD"))) {
+        if (existsSync7(resolve11(gitDir, "MERGE_HEAD"))) {
           await gitExec(["merge", "--abort"], { cwd: worktreeDir });
         }
       } catch {
@@ -4776,7 +4867,7 @@ ${user.trimEnd()}
   }
   if (body.diff) {
     try {
-      if (!existsSync7(resolve10(dir, ".git"))) {
+      if (!existsSync7(resolve11(dir, ".git"))) {
         return c.json({ error: "Mind has no git history \u2014 nothing to diff against" }, 400);
       }
       await updateTemplateBranch(dir, template, mindName);
@@ -4800,16 +4891,16 @@ ${user.trimEnd()}
       409
     );
   }
-  if (!existsSync7(resolve10(dir, ".git"))) {
+  if (!existsSync7(resolve11(dir, ".git"))) {
     try {
-      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dir, "home") } : void 0;
+      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dir, "home") } : void 0;
       await gitExec(["init"], { cwd: dir, mindName, env });
       await configureGitIdentity(mindName, { cwd: dir, mindName, env });
       await gitExec(["add", "-A"], { cwd: dir, mindName, env });
       await gitExec(["commit", "-m", "initial commit"], { cwd: dir, mindName, env });
       chownMindDir(dir, mindName);
     } catch (err) {
-      rmSync4(resolve10(dir, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dir, ".git"), { recursive: true, force: true });
       return c.json(
         {
           error: `Git initialization failed: ${err instanceof Error ? err.message : String(err)}`
@@ -4824,7 +4915,7 @@ ${user.trimEnd()}
   } catch {
   }
   await updateTemplateBranch(dir, template, mindName);
-  const parentDir = resolve10(dir, ".variants");
+  const parentDir = resolve11(dir, ".variants");
   if (!existsSync7(parentDir)) {
     mkdirSync6(parentDir, { recursive: true });
   }
@@ -4943,13 +5034,13 @@ ${user.trimEnd()}
   }
   const result = await getMessagesPaginated(convId, { before, limit });
   return c.json({ items: result.messages, hasMore: result.hasMore });
-}).get("/:name/budget", async (c) => {
+}).get("/:name/budget", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   const usage = getTokenBudget().getUsage(baseName);
   if (!usage) return c.json({ error: "No budget configured" }, 404);
   return c.json(usage);
-}).get("/:name/config", async (c) => {
+}).get("/:name/config", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -4957,7 +5048,7 @@ ${user.trimEnd()}
   if (!existsSync7(dir)) return c.json({ error: "Mind directory missing" }, 404);
   let config2 = readVoluteConfig(dir);
   if (!config2 && entry.template === "pi") {
-    const piConfigPath = resolve10(dir, "home/.config/config.json");
+    const piConfigPath = resolve11(dir, "home/.config/config.json");
     if (existsSync7(piConfigPath)) {
       try {
         config2 = JSON.parse(readFileSync8(piConfigPath, "utf-8"));
@@ -4966,7 +5057,7 @@ ${user.trimEnd()}
     }
   }
   let templateConfig = {};
-  const configJsonPath = resolve10(dir, "home/.config/config.json");
+  const configJsonPath = resolve11(dir, "home/.config/config.json");
   if (existsSync7(configJsonPath)) {
     try {
       templateConfig = JSON.parse(readFileSync8(configJsonPath, "utf-8"));
@@ -5058,12 +5149,12 @@ ${user.trimEnd()}
     }
     writeVoluteConfig(dir, existing);
     if (body.unescapeNewlines !== void 0) {
-      const { clearEchoTextCache } = await import("./echo-text-N3BC3WNX.js");
+      const { clearEchoTextCache } = await import("./echo-text-QFCH3H6G.js");
       clearEchoTextCache(name);
     }
     const needsConfigJson = body.model !== void 0 || body.thinkingLevel !== void 0 || body.maxThinkingTokens !== void 0 || body.compaction !== void 0;
     if (needsConfigJson) {
-      const configJsonPath = resolve10(dir, "home/.config/config.json");
+      const configJsonPath = resolve11(dir, "home/.config/config.json");
       let templateConfig = {};
       if (existsSync7(configJsonPath)) {
         try {
@@ -5135,7 +5226,7 @@ ${user.trimEnd()}
     }
     if (entry.mindType === "spirit" && body.model !== void 0) {
       try {
-        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-IFYS3TLS.js");
+        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
         const globalConfig = readGlobalConfig2();
         globalConfig.spiritModel = body.model;
         writeGlobalConfig2(globalConfig);
@@ -5145,7 +5236,7 @@ ${user.trimEnd()}
     }
     return c.json({ ok: true });
   }
-).get("/:name/delivery/pending", async (c) => {
+).get("/:name/delivery/pending", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   try {
@@ -5163,7 +5254,7 @@ ${user.trimEnd()}
   if (!body.systemPrompt || !body.message) {
     return c.json({ error: "systemPrompt and message required" }, 400);
   }
-  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-PL7GKFQC.js");
+  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-AUWIPWLP.js");
   if (!isAiConfigured()) {
     return c.json({ error: "AI service not configured" }, 503);
   }
@@ -5270,6 +5361,18 @@ ${user.trimEnd()}
     const affected = map.deleteSender(baseName);
     publishTypingForChannels(affected, map);
   }
+  if (body.type === "error" && body.session) {
+    markErrored(baseName, body.session);
+    const { reason, detail } = classify(body.content ?? "");
+    await recordNotice({
+      mind: baseName,
+      session: body.session,
+      kind: "turn_error",
+      reason,
+      detail,
+      raw: body.content ?? null
+    });
+  }
   if (body.type === "done") {
     const map = getTypingMap();
     const affected = map.deleteSender(baseName);
@@ -5292,6 +5395,7 @@ ${user.trimEnd()}
             (err) => logger_default.warn("failed to tag orphaned outbound records", logger_default.errorData(err))
           );
         }
+        markDeliveredOnCleanTurn(baseName, body.session);
         if (insertedId != null) {
           summarizeTurn(baseName, body.session, body.channel, insertedId, completedTurnId).catch(
             (err) => logger_default.error("turn summarization failed", logger_default.errorData(err))
@@ -5308,6 +5412,7 @@ ${user.trimEnd()}
           (err2) => logger_default.warn("failed to tag orphaned outbound records", logger_default.errorData(err2))
         );
       }
+      markDeliveredOnCleanTurn(baseName, body.session);
       if (insertedId != null) {
         summarizeTurn(baseName, body.session, body.channel, insertedId, completedTurnId).catch(
           (err2) => logger_default.error("turn summarization failed", logger_default.errorData(err2))
@@ -5318,10 +5423,20 @@ ${user.trimEnd()}
   if (body.type === "usage" && body.metadata) {
     const inputTokens = body.metadata.input_tokens ?? 0;
     const outputTokens = body.metadata.output_tokens ?? 0;
-    getTokenBudget().recordUsage(baseName, inputTokens, outputTokens);
+    const tb = getTokenBudget();
+    tb.recordUsage(baseName, inputTokens, outputTokens);
+    if (body.session && tb.noteExceeded(baseName)) {
+      void recordNotice({
+        mind: baseName,
+        session: body.session,
+        kind: "budget",
+        reason: "token_budget",
+        detail: "You've reached your token budget for this period. Further activity may be paused until the budget resets \u2014 wrap up or prioritize accordingly."
+      });
+    }
   }
   return c.json({ ok: true });
-}).get("/:name/events", async (c) => {
+}).get("/:name/events", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   const entry = await findMind(baseName);
@@ -5403,7 +5518,7 @@ ${user.trimEnd()}
     return c.json({ error: "Failed to persist" }, 500);
   }
   return c.json({ ok: true });
-}).get("/:name/history/sessions", async (c) => {
+}).get("/:name/history/sessions", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
   const rows = await db.select({
@@ -5414,18 +5529,18 @@ ${user.trimEnd()}
     tool_count: sql2`SUM(CASE WHEN ${mindHistory.type}='tool_use' THEN 1 ELSE 0 END)`
   }).from(mindHistory).where(and4(eq5(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
   return c.json(rows);
-}).get("/:name/history/channels", async (c) => {
+}).get("/:name/history/channels", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
   const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq5(mindHistory.mind, name));
   return c.json(rows.map((r) => r.channel));
-}).get("/:name/history/export", async (c) => {
+}).get("/:name/history/export", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const db = await getDb();
   const rows = await db.select().from(mindHistory).where(eq5(mindHistory.mind, name));
   return c.json(rows);
-}).get("/:name/history/turn", async (c) => {
+}).get("/:name/history/turn", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const turnId = c.req.query("turn_id");
   const detail = c.req.query("detail") === "1";
@@ -5452,7 +5567,7 @@ ${user.trimEnd()}
     ).orderBy(mindHistory.id);
   }
   return c.json(rows);
-}).get("/:name/history/cross-session", async (c) => {
+}).get("/:name/history/cross-session", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const currentSession = c.req.query("session");
   const db = await getDb();
@@ -5498,7 +5613,17 @@ ${user.trimEnd()}
   });
   return c.json({ context: `[Session Activity]
 ${lines.join("\n")}` });
-}).get("/:name/history", async (c) => {
+}).get("/:name/history/notices", requireSelf(), async (c) => {
+  const name = c.req.param("name");
+  const baseName = await getBaseName(name);
+  const session = c.req.query("session");
+  if (!session) return c.json({ context: null, notices: [] });
+  const notices = await drainNotices(baseName, session);
+  if (notices.length === 0) return c.json({ context: null, notices: [] });
+  const maxId = notices.reduce((m, n) => Math.max(m, n.id), 0);
+  noticeDrainWatermarks.set(`${baseName}:${session}`, maxId);
+  return c.json({ context: formatNotices(notices), notices });
+}).get("/:name/history", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const channel = c.req.query("channel");
   const session = c.req.query("session");
@@ -5649,7 +5774,7 @@ function writeSchedules(name, dir, schedules) {
     data: { schedules }
   });
 }
-var app15 = new Hono17().get("/:name/clock/status", async (c) => {
+var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5708,7 +5833,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   upcoming.sort((a, b) => a.at.localeCompare(b.at));
   previous.sort((a, b) => b.at.localeCompare(a.at));
   return c.json({ sleep: sleepState, sleepConfig, schedules, upcoming, previous });
-}).get("/:name/sleep/config", async (c) => {
+}).get("/:name/sleep/config", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5740,7 +5865,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   writeVoluteConfig(dir, config2);
   getSleepManagerIfReady()?.invalidateSleepConfig(name);
   return c.json({ ok: true });
-}).get("/:name/schedules", async (c) => {
+}).get("/:name/schedules", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5865,7 +5990,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   }
   writeSchedules(name, dir, filtered);
   return c.json({ ok: true });
-}).post("/:name/webhook/:event", async (c) => {
+}).post("/:name/webhook/:event", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const event = c.req.param("event");
   const entry = await findMind(name);
@@ -5873,7 +5998,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   const body = await c.req.text();
   const message = `[webhook: ${event}] ${body}`;
   try {
-    const { sendSystemMessage } = await import("./system-chat-D343HYGR.js");
+    const { sendSystemMessage } = await import("./system-chat-LQSJVY55.js");
     await sendSystemMessage(name, message);
     return c.json({ ok: true });
   } catch (err) {
@@ -5886,14 +6011,14 @@ var schedules_default = app15;
 // packages/daemon/src/web/api/setup.ts
 import { mkdirSync as mkdirSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 import { Hono as Hono18 } from "hono";
 import { setCookie as setCookie2 } from "hono/cookie";
 var DEFAULT_API_URL2 = "https://volute.systems";
 var setup = new Hono18();
 function writeSetupConfig(systemName, description) {
-  const configHome = process.env.VOLUTE_HOME ?? resolve11(homedir2(), ".volute");
-  const mindsDir = resolve11(configHome, "minds");
+  const configHome = process.env.VOLUTE_HOME ?? resolve12(homedir2(), ".volute");
+  const mindsDir = resolve12(configHome, "minds");
   mkdirSync7(configHome, { recursive: true });
   mkdirSync7(mindsDir, { recursive: true });
   const existingConfig = readGlobalConfig();
@@ -5927,7 +6052,7 @@ setup.get("/status", async (c) => {
   let hasAccount = false;
   if (hasSystem) {
     try {
-      const { listUsersByType: listUsersByType2 } = await import("./auth-OJ2YW3NR.js");
+      const { listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
       const brains = await listUsersByType2("brain");
       hasAccount = brains.length > 0;
     } catch (err) {
@@ -6138,7 +6263,7 @@ setup.post("/account", async (c) => {
     }
   }
   try {
-    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-OJ2YW3NR.js");
+    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-X6ZITZ7D.js");
     const user = await createUser2(body.username.trim(), body.password);
     if (body.displayName?.trim()) {
       await updateUserProfile2(user.id, { display_name: body.displayName.trim() });
@@ -6184,7 +6309,7 @@ setup.post("/models", async (c) => {
     return c.json({ error: "Spirit model is required" }, 400);
   }
   try {
-    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-PL7GKFQC.js");
+    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-AUWIPWLP.js");
     setEnabledModels3(body.models);
     const config2 = readGlobalConfig();
     config2.spiritModel = body.spiritModel.trim();
@@ -6202,15 +6327,15 @@ setup.post("/complete", async (c) => {
     return c.json({ error: "Setup already complete" }, 400);
   }
   try {
-    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-U6MDQLYT.js");
-    const { startSpiritFull } = await import("./mind-service-MO2XJKJN.js");
+    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-NVXWSVKM.js");
+    const { startSpiritFull } = await import("./mind-service-WTOFVNLW.js");
     await ensureSpiritProject();
     await syncSpiritTemplate();
     const warnings = [];
     const config2 = readGlobalConfig();
     if (config2.setup?.service && config2.setup?.type === "local") {
       try {
-        const { installUserService } = await import("./service-install-KEBDNZVE.js");
+        const { installUserService } = await import("./service-install-W3FQXJKB.js");
         const installed = await installUserService(config2.port, config2.hostname);
         if (!installed) {
           warnings.push("Service installation is not supported on this platform.");
@@ -6238,8 +6363,8 @@ setup.post("/complete", async (c) => {
     }
     let spiritConversationId;
     try {
-      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-OJ2YW3NR.js");
-      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-EUXHBWJD.js");
+      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
+      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-AYLXPOGC.js");
       const spiritUser = await getOrCreateMindUser2("volute");
       const brains = await listUsersByType2("brain");
       const admin2 = brains.find((u) => u.role === "admin");
@@ -6261,8 +6386,8 @@ setup.post("/complete", async (c) => {
     logger_default.info("setup complete state", { spiritConversationId, spiritStarted });
     if (spiritConversationId && spiritStarted) {
       try {
-        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-X7MKA3TA.js");
-        const { listUsersByType: listUsers2 } = await import("./auth-OJ2YW3NR.js");
+        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-7BCYJLH2.js");
+        const { listUsersByType: listUsers2 } = await import("./auth-X6ZITZ7D.js");
         const admins = await listUsers2("brain");
         const admin2 = admins.find((u) => u.role === "admin");
         const adminName = admin2?.display_name || admin2?.username || "the admin";
@@ -6301,7 +6426,7 @@ var setup_default = setup;
 // packages/daemon/src/web/api/skills.ts
 import { existsSync as existsSync8, mkdtempSync, readdirSync as readdirSync3, rmSync as rmSync5 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve12 } from "path";
+import { join, resolve as resolve13 } from "path";
 import AdmZip from "adm-zip";
 import { Hono as Hono19 } from "hono";
 var app16 = new Hono19().get("/", async (c) => {
@@ -6377,7 +6502,7 @@ var app16 = new Hono19().get("/", async (c) => {
   try {
     const zip = new AdmZip(buffer2);
     for (const entry of zip.getEntries()) {
-      const target = resolve12(tmpDir, entry.entryName);
+      const target = resolve13(tmpDir, entry.entryName);
       if (!target.startsWith(tmpDir)) {
         return c.json({ error: "Invalid zip: paths must not escape archive" }, 400);
       }
@@ -6719,8 +6844,8 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve17) => {
-        stream.onAbort(() => resolve17());
+      await new Promise((resolve18) => {
+        stream.onAbort(() => resolve18());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -6736,15 +6861,15 @@ var events_default = app20;
 
 // packages/daemon/src/web/api/variants.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import { Hono as Hono24 } from "hono";
 
 // packages/daemon/src/lib/mind/spawn-server.ts
 import { spawn as spawn4 } from "child_process";
 import { closeSync, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 function tsxBin(cwd) {
-  return resolve13(cwd, "node_modules", ".bin", "tsx");
+  return resolve14(cwd, "node_modules", ".bin", "tsx");
 }
 function spawnServer(cwd, port, options) {
   if (options?.detached) {
@@ -6757,31 +6882,31 @@ function spawnAttached(cwd, port) {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  return new Promise((resolve17) => {
-    const timeout = setTimeout(() => resolve17(null), 3e4);
+  return new Promise((resolve18) => {
+    const timeout = setTimeout(() => resolve18(null), 3e4);
     function checkOutput(data) {
       const match = data.toString().match(/listening on :(\d+)/);
       if (match) {
         clearTimeout(timeout);
-        resolve17({ child, actualPort: parseInt(match[1], 10) });
+        resolve18({ child, actualPort: parseInt(match[1], 10) });
       }
     }
     child.stdout?.on("data", checkOutput);
     child.stderr?.on("data", checkOutput);
     child.on("error", () => {
       clearTimeout(timeout);
-      resolve17(null);
+      resolve18(null);
     });
     child.on("exit", () => {
       clearTimeout(timeout);
-      resolve17(null);
+      resolve18(null);
     });
   });
 }
 function spawnDetached(cwd, port, logDir) {
-  const logsDir = logDir ?? resolve13(cwd, ".mind", "logs");
+  const logsDir = logDir ?? resolve14(cwd, ".mind", "logs");
   mkdirSync8(logsDir, { recursive: true });
-  const logPath = resolve13(logsDir, "mind.log");
+  const logPath = resolve14(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
   const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
     cwd,
@@ -6897,11 +7022,11 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `Name already in use: ${variantName}` }, 409);
   }
   const projectRoot = mindDir(mindName);
-  const variantDir = resolve14(projectRoot, ".variants", variantName);
+  const variantDir = resolve15(projectRoot, ".variants", variantName);
   if (existsSync9(variantDir)) {
     return c.json({ error: `Variant directory already exists: ${variantDir}` }, 409);
   }
-  mkdirSync9(resolve14(projectRoot, ".variants"), { recursive: true });
+  mkdirSync9(resolve15(projectRoot, ".variants"), { recursive: true });
   try {
     await gitExec(["worktree", "add", "-b", variantName, variantDir], { cwd: projectRoot });
   } catch (e) {
@@ -6914,7 +7039,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: variantDir,
-        env: { ...process.env, HOME: resolve14(variantDir, "home") }
+        env: { ...process.env, HOME: resolve15(variantDir, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: variantDir });
@@ -6924,7 +7049,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `npm install failed: ${msg}` }, 500);
   }
   if (body.soul) {
-    writeFileSync8(resolve14(variantDir, "home/SOUL.md"), body.soul);
+    writeFileSync8(resolve15(variantDir, "home/SOUL.md"), body.soul);
   }
   const variantPort = body.port ?? await nextPort();
   await addVariant(variantName, mindName, variantPort, variantDir, variantName);
@@ -7019,8 +7144,8 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
   await cleanupVariant(variantName, projectRoot, variantEntry.dir);
   if (variantName.endsWith("-upgrade") || variantName === "upgrade") {
     try {
-      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-SSIBEEYK.js");
-      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-LWEOAO53.js");
+      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-DMHSLRDX.js");
+      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-GV35XFT7.js");
       const tmpl = parentEntry.template ?? "claude";
       await setMindTemplateHash2(mindName, computeTemplateHash2(tmpl));
     } catch (err) {
@@ -7033,7 +7158,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: projectRoot,
-        env: { ...process.env, HOME: resolve14(projectRoot, "home") }
+        env: { ...process.env, HOME: resolve15(projectRoot, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: projectRoot });
@@ -7450,11 +7575,11 @@ var app23 = new Hono26().get("/:name/conversations/:id/events", async (c) => {
         if (!stream.aborted) console.error("[chat] SSE ping error:", err);
       });
     }, 15e3);
-    await new Promise((resolve17) => {
+    await new Promise((resolve18) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve17();
+        resolve18();
       });
     });
   });
@@ -7667,7 +7792,7 @@ var app_default = app25;
 import { existsSync as existsSync10 } from "fs";
 import { readFile as readFile2, stat as stat2 } from "fs/promises";
 import { createServer as createHttpsServer } from "https";
-import { dirname as dirname2, extname as extname3, resolve as resolve15 } from "path";
+import { dirname as dirname2, extname as extname3, resolve as resolve16 } from "path";
 import { serve } from "@hono/node-server";
 var MIME_TYPES2 = {
   ".html": "text/html",
@@ -7686,7 +7811,7 @@ async function startServer({
   let assetsDir = "";
   let searchDir = dirname2(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
-    const candidate = resolve15(searchDir, "dist", "web-assets");
+    const candidate = resolve16(searchDir, "dist", "web-assets");
     if (existsSync10(candidate)) {
       assetsDir = candidate;
       break;
@@ -7697,20 +7822,20 @@ async function startServer({
     app_default.get("*", async (c) => {
       const urlPath = new URL(c.req.url).pathname;
       if (urlPath.startsWith("/api/") || urlPath.startsWith("/ext/")) return c.notFound();
-      const filePath = resolve15(assetsDir, urlPath.slice(1));
+      const filePath = resolve16(assetsDir, urlPath.slice(1));
       if (!filePath.startsWith(assetsDir)) return c.text("Forbidden", 403);
       const s = await stat2(filePath).catch(() => null);
       if (s?.isFile()) {
         const ext = extname3(filePath);
         const mime = MIME_TYPES2[ext] || "application/octet-stream";
         const body = await readFile2(filePath);
-        const basename = filePath.slice(filePath.lastIndexOf("/") + 1);
-        const nameWithoutExt = basename.slice(0, basename.lastIndexOf("."));
+        const basename2 = filePath.slice(filePath.lastIndexOf("/") + 1);
+        const nameWithoutExt = basename2.slice(0, basename2.lastIndexOf("."));
         const isHashed = /[-.][\da-f]{8,}$/.test(nameWithoutExt);
         const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
         return c.body(body, 200, { "Content-Type": mime, "Cache-Control": cacheControl });
       }
-      const indexPath = resolve15(assetsDir, "index.html");
+      const indexPath = resolve16(assetsDir, "index.html");
       const indexStat = await stat2(indexPath).catch(() => null);
       if (indexStat?.isFile()) {
         const body = await readFile2(indexPath, "utf-8");
@@ -7727,10 +7852,10 @@ async function startServer({
       createServer: createHttpsServer,
       serverOptions: { key: tls.key, cert: tls.cert }
     });
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       server2.on("listening", () => {
         logger_default.info("Volute UI running (https)", { hostname, port });
-        resolve17();
+        resolve18();
       });
       server2.on("error", (err) => {
         reject(err);
@@ -7738,13 +7863,13 @@ async function startServer({
     });
     const internalPort = port + 1;
     const internalServer = serve({ fetch: app_default.fetch, port: internalPort, hostname: "127.0.0.1" });
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       internalServer.on("listening", () => {
         logger_default.info("Volute API running (http, internal)", {
           hostname: "127.0.0.1",
           port: internalPort
         });
-        resolve17();
+        resolve18();
       });
       internalServer.on("error", (err) => {
         reject(err);
@@ -7753,10 +7878,10 @@ async function startServer({
     return { server: server2, internalPort };
   }
   const server = serve({ fetch: app_default.fetch, port, hostname });
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     server.on("listening", () => {
       logger_default.info("Volute API running (http)", { hostname, port });
-      resolve17();
+      resolve18();
     });
     server.on("error", (err) => {
       reject(err);
@@ -7767,7 +7892,7 @@ async function startServer({
 
 // packages/daemon/src/daemon.ts
 if (!process.env.VOLUTE_HOME) {
-  process.env.VOLUTE_HOME = resolve16(homedir3(), ".volute");
+  process.env.VOLUTE_HOME = resolve17(homedir3(), ".volute");
 }
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
@@ -7778,7 +7903,7 @@ async function startDaemon(opts) {
   const home = voluteHome();
   const systemDir = voluteSystemDir();
   if (!opts.foreground) {
-    const rotatingLog = new RotatingLog(resolve16(systemDir, "daemon.log"));
+    const rotatingLog = new RotatingLog(resolve17(systemDir, "daemon.log"));
     logger_default.setOutput((line) => rotatingLog.write(`${line}
 `));
     const write = (...args) => rotatingLog.write(`${format(...args)}
@@ -7788,22 +7913,22 @@ async function startDaemon(opts) {
     console.warn = write;
     console.info = write;
   }
-  const DAEMON_PID_PATH = resolve16(systemDir, "daemon.pid");
-  const DAEMON_JSON_PATH = resolve16(systemDir, "daemon.json");
+  const DAEMON_PID_PATH = resolve17(systemDir, "daemon.pid");
+  const DAEMON_JSON_PATH = resolve17(systemDir, "daemon.json");
   mkdirSync10(home, { recursive: true });
   ensureSystemDir();
-  const { migrateSetupCompleted } = await import("./setup-IFYS3TLS.js");
+  const { migrateSetupCompleted } = await import("./setup-OTEC3ZPM.js");
   migrateSetupCompleted();
-  await (await import("./db-32YFKMFL.js")).getDb();
+  await (await import("./db-ZEPKEJJD.js")).getDb();
   try {
     const { eq: eq7, and: and5 } = await import("drizzle-orm");
-    const { users: users2 } = await import("./schema-K575EBPE.js");
-    const db = await (await import("./db-32YFKMFL.js")).getDb();
+    const { users: users2 } = await import("./schema-LYQUDL7G.js");
+    const db = await (await import("./db-ZEPKEJJD.js")).getDb();
     await db.update(users2).set({ role: "system" }).where(and5(eq7(users2.user_type, "system"), eq7(users2.role, "user")));
   } catch (err) {
     logger_default.warn("failed to migrate system user role", logger_default.errorData(err));
   }
-  const { initSandbox } = await import("./sandbox-KUAVC37A.js");
+  const { initSandbox } = await import("./sandbox-5R32QKWQ.js");
   await initSandbox();
   try {
     await syncBuiltinSkills();
@@ -7830,7 +7955,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
   }
   try {
-    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-OJ2YW3NR.js");
+    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-X6ZITZ7D.js");
     await getOrCreateSystemUser2();
   } catch (err) {
     logger_default.warn(
@@ -7839,12 +7964,12 @@ async function startDaemon(opts) {
     );
   }
   const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes(32).toString("hex");
-  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-IFYS3TLS.js");
+  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
   const globalCfg = readGlobalConfig2();
   let tls;
   if (opts.tailscale || globalCfg.tailscale) {
     try {
-      const { getTailscaleTls } = await import("./tailscale-2KKXDMNK.js");
+      const { getTailscaleTls } = await import("./tailscale-X4HRKRTW.js");
       const tlsConfig = await getTailscaleTls();
       tls = { key: tlsConfig.key, cert: tlsConfig.cert };
       logger_default.info("Tailscale HTTPS enabled", { hostname: tlsConfig.hostname });
@@ -7923,10 +8048,10 @@ async function startDaemon(opts) {
     await Promise.all(workers);
   }
   try {
-    const { isSetupComplete: isSetupComplete2 } = await import("./setup-IFYS3TLS.js");
+    const { isSetupComplete: isSetupComplete2 } = await import("./setup-OTEC3ZPM.js");
     if (isSetupComplete2()) {
-      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-U6MDQLYT.js");
-      const { startSpiritFull } = await import("./mind-service-MO2XJKJN.js");
+      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-NVXWSVKM.js");
+      const { startSpiritFull } = await import("./mind-service-WTOFVNLW.js");
       await ensureSpiritProject();
       await syncSpiritTemplate();
       const spiritEntry = await findMind("volute");
@@ -7943,7 +8068,7 @@ async function startDaemon(opts) {
   bridgeManager.startBridges(daemonPort).catch((err) => {
     logger_default.warn("failed to start bridges", logger_default.errorData(err));
   });
-  import("./cloud-sync-NQCWJLYI.js").then(
+  import("./cloud-sync-MAQCJEFJ.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -7951,7 +8076,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-ZBMY2TEX.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-N37N2C4G.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));
@@ -7968,6 +8093,11 @@ async function startDaemon(opts) {
   cleanExpiredLogs().catch((err) => {
     logger_default.warn("failed to clean expired logs", logger_default.errorData(err));
   });
+  setProviderRefreshHook((provider) => {
+    void syncProviderToMinds(provider, {
+      listRunning: () => getMindManager().getRunningMinds()
+    }).catch((err) => logger_default.warn("credential sync to minds failed", logger_default.errorData(err)));
+  });
   startApiKeyRefresh();
   logger_default.info(`running on ${hostname}:${port}, pid ${myPid}`);
   function cleanup() {