volute 0.50.0 → 0.51.0

package/dist/{chunk-ALIVXDM4.js → chunk-VAEZCIJC.js}

@@ -2,31 +2,33 @@
 import {
   clearMind,
   summarizeOrphanedTurns
-} from "./chunk-7DXLIYPY.js";
+} from "./chunk-CDKQJWGK.js";
 import {
   deliverEvent,
   recordNotice
-} from "./chunk-7OZWKHA3.js";
+} from "./chunk-ICL6T4SN.js";
 import {
   getPrompt
-} from "./chunk-5TPC4KCV.js";
+} from "./chunk-FXWBFDQR.js";
 import {
   isSandboxEnabled,
   wrapForSandbox
-} from "./chunk-ZUG76D3P.js";
+} from "./chunk-5Y54AE3L.js";
 import {
   chownMindDir,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-AJWFDIEY.js";
+} from "./chunk-M77B73VV.js";
 import {
   loadMergedEnv
-} from "./chunk-7UWXAJMK.js";
+} from "./chunk-GLM7TVWP.js";
 import {
+  OAuthRefreshError,
   getAiConfig,
   resolveApiKey,
-  resolveOAuthCredentials
-} from "./chunk-632FJ23O.js";
+  resolveOAuthCredentials,
+  resolveProviderKey
+} from "./chunk-EGV6R6UF.js";
 import {
   logger_default
 } from "./chunk-QUSMYGNQ.js";
@@ -40,7 +42,7 @@ import {
   setMindRunning,
   stateDir,
   voluteSystemDir
-} from "./chunk-CAIYV33P.js";
+} from "./chunk-H6X6CKDN.js";
 
 // packages/daemon/src/lib/util/json-state.ts
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "fs";
@@ -154,6 +156,18 @@ var RotatingLog = class extends Writable {
 import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { resolve } from "path";
 var slog = logger_default.child("cred-sync");
+var DAEMON_ONLY_OAUTH = /* @__PURE__ */ new Set(["xai"]);
+var PI_PROVIDER_ENV_VAR = {
+  openrouter: "OPENROUTER_API_KEY",
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  google: "GEMINI_API_KEY",
+  groq: "GROQ_API_KEY",
+  cerebras: "CEREBRAS_API_KEY",
+  xai: "XAI_API_KEY",
+  mistral: "MISTRAL_API_KEY",
+  zai: "ZAI_API_KEY"
+};
 async function writeClaudeCredentials(homeDir, baseName, oauth) {
   const claudeDir = resolve(homeDir, ".claude");
   mkdirSync(claudeDir, { recursive: true });
@@ -194,6 +208,46 @@ async function writePiProviderOAuth(piAgentDir, baseName, provider, oauth) {
     await chownMindDir(piAgentDir, baseName);
   }
 }
+async function injectPiProviderCredentials(opts) {
+  const { provider, piAgentDir, baseName, mindName, env } = opts;
+  let oauthCreds;
+  let oauthError;
+  try {
+    oauthCreds = await resolveOAuthCredentials(provider);
+  } catch (err) {
+    if (!(err instanceof OAuthRefreshError)) throw err;
+    slog.warn(
+      `OAuth token refresh failing for provider "${provider}" (mind ${mindName}); falling back to a static key if available`,
+      logger_default.errorData(err)
+    );
+    oauthError = err;
+  }
+  if (oauthCreds && !DAEMON_ONLY_OAUTH.has(provider)) {
+    await writePiProviderOAuth(piAgentDir, baseName, provider, oauthCreds);
+    env.PI_CODING_AGENT_DIR = piAgentDir;
+    return;
+  }
+  let apiKey;
+  if (oauthCreds) {
+    apiKey = oauthCreds.access;
+  } else if (oauthError) {
+    apiKey = await resolveProviderKey(provider, getAiConfig()?.providers[provider]?.apiKey);
+  } else {
+    apiKey = await resolveApiKey(provider);
+  }
+  if (apiKey) {
+    await writePiProviderKey(piAgentDir, baseName, provider, apiKey);
+    env.PI_CODING_AGENT_DIR = piAgentDir;
+    const providerEnv = PI_PROVIDER_ENV_VAR[provider];
+    if (providerEnv) env[providerEnv] = apiKey;
+  } else if (oauthError) {
+    slog.warn(
+      `OAuth token refresh is temporarily failing for provider "${provider}" and no static key is available \u2014 mind ${mindName} may start but stay silent until it recovers`
+    );
+  } else {
+    slog.warn(`no API key found for provider "${provider}" \u2014 mind ${mindName} may fail to start`);
+  }
+}
 function piUsesProvider(piAgentDir, provider) {
   try {
     const authPath = resolve(piAgentDir, "auth.json");
@@ -325,7 +379,6 @@ var RestartTracker = class {
 // packages/daemon/src/lib/daemon/mind-manager.ts
 var mlog = logger_default.child("minds");
 var execFileAsync = promisify(execFile);
-var DAEMON_ONLY_OAUTH = /* @__PURE__ */ new Set(["xai"]);
 var MIND_ENV_ALLOWLIST = [
   "PATH",
   "HOME",
@@ -461,10 +514,10 @@ var MindManager = class {
     if (!existsSync4(dir)) throw new Error(`Mind directory missing: ${dir}`);
     return { dir, port: entry.port, baseName: name, template: entry.template };
   }
-  async startMind(name) {
-    return this.withLock(name, () => this._startMind(name));
+  async startMind(name, opts) {
+    return this.withLock(name, () => this._startMind(name, opts));
   }
-  async _startMind(name) {
+  async _startMind(name, opts) {
     if (this.minds.has(name)) {
       throw new Error(`Mind ${name} is already running`);
     }
@@ -554,34 +607,13 @@ var MindManager = class {
           if (modelStr?.includes(":")) {
             const provider = modelStr.split(":")[0];
             const piAgentDir = resolve2(dir, ".mind", "pi-agent");
-            const oauthCreds = await resolveOAuthCredentials(provider);
-            if (oauthCreds && !DAEMON_ONLY_OAUTH.has(provider)) {
-              await writePiProviderOAuth(piAgentDir, baseName, provider, oauthCreds);
-              env.PI_CODING_AGENT_DIR = piAgentDir;
-            } else {
-              const apiKey = oauthCreds?.access ?? await resolveApiKey(provider);
-              if (apiKey) {
-                await writePiProviderKey(piAgentDir, baseName, provider, apiKey);
-                env.PI_CODING_AGENT_DIR = piAgentDir;
-                const providerEnvVars = {
-                  openrouter: "OPENROUTER_API_KEY",
-                  openai: "OPENAI_API_KEY",
-                  anthropic: "ANTHROPIC_API_KEY",
-                  google: "GEMINI_API_KEY",
-                  groq: "GROQ_API_KEY",
-                  cerebras: "CEREBRAS_API_KEY",
-                  xai: "XAI_API_KEY",
-                  mistral: "MISTRAL_API_KEY",
-                  zai: "ZAI_API_KEY"
-                };
-                const providerEnv = providerEnvVars[provider];
-                if (providerEnv) env[providerEnv] = apiKey;
-              } else {
-                mlog.warn(
-                  `no API key found for provider "${provider}" \u2014 mind ${name} may fail to start`
-                );
-              }
-            }
+            await injectPiProviderCredentials({
+              provider,
+              piAgentDir,
+              baseName,
+              mindName: name,
+              env
+            });
           }
         }
       } catch (err) {
@@ -647,6 +679,17 @@ var MindManager = class {
           if (key && oauth) {
             const claudeDir = await writeClaudeCredentials(resolve2(dir, "home"), baseName, oauth);
             env.CLAUDE_CONFIG_DIR = claudeDir;
+          } else {
+            mlog.error(
+              `Anthropic OAuth token refresh is failing for ${name}; it will spawn without credentials and stay silent until the provider recovers and it is restarted`
+            );
+            void recordNotice({
+              mind: name,
+              thread: "main",
+              kind: "startup",
+              reason: "oauth_refresh_failed",
+              detail: "Anthropic authentication is temporarily unavailable (OAuth token refresh is failing), so you started without model credentials and may be unable to respond until it recovers. This is usually transient; if it persists, ask your host to re-check the anthropic provider."
+            });
           }
         } else {
           const apiKey = await resolveApiKey("anthropic");
@@ -692,9 +735,10 @@ var MindManager = class {
       while (recentStderr.length > 20) recentStderr.shift();
     });
     try {
+      const healthTimeoutMs = opts?.healthTimeoutMs ?? 3e4;
       await new Promise((resolve3, reject) => {
         let settled = false;
-        const deadline = Date.now() + 3e4;
+        const deadline = Date.now() + healthTimeoutMs;
         const onExit = (code) => {
           const errorLine = recentStderr.find((l) => l.includes("Error:"));
           const detail = errorLine ? `: ${errorLine.trim()}` : "";
@@ -729,7 +773,7 @@ var MindManager = class {
             finish(
               () => reject(
                 new MindStartupError(
-                  `Mind ${name} did not become healthy within 30s`,
+                  `Mind ${name} did not become healthy within ${Math.round(healthTimeoutMs / 1e3)}s`,
                   recentStderr.join("\n")
                 )
               )
@@ -761,9 +805,9 @@ var MindManager = class {
     mlog.info(`started mind ${name} on port ${port}`);
     await this.deliverPendingContext(name);
     try {
-      const { getSleepManagerIfReady } = await import("./sleep-manager-LIEPO6WG.js");
+      const { getSleepManagerIfReady } = await import("./sleep-manager-7JXEQQ2P.js");
       if (!getSleepManagerIfReady()?.isSleeping(name)) {
-        const { flushQueuedEvents } = await import("./system-events-A6IGCEC3.js");
+        const { flushQueuedEvents } = await import("./system-events-ZPSH63QX.js");
         const flushed = await flushQueuedEvents(name);
         if (flushed > 0) mlog.info(`redelivered ${flushed} pending event(s) to ${name}`);
       }
@@ -799,7 +843,7 @@ var MindManager = class {
       if (this.shuttingDown || this.stopping.has(name)) return;
       mlog.error(`mind ${name} exited with code ${code}`);
       try {
-        const { getSleepManagerIfReady } = await import("./sleep-manager-LIEPO6WG.js");
+        const { getSleepManagerIfReady } = await import("./sleep-manager-7JXEQQ2P.js");
         const sleepMgr = getSleepManagerIfReady();
         const sleepState = sleepMgr?.getState(name);
         if (sleepState?.sleeping) {
@@ -829,15 +873,15 @@ var MindManager = class {
         (err) => mlog.warn(`failed to clear turn state for ${name} after crash`, logger_default.errorData(err))
       );
       try {
-        const { getDeliveryManager } = await import("./delivery-manager-B4OKWD2P.js");
+        const { getDeliveryManager } = await import("./delivery-manager-HGVZSEES.js");
         getDeliveryManager().clearMindSessions(name);
       } catch (err) {
         if (!(err instanceof Error && err.message.includes("not initialized"))) {
           mlog.warn(`failed to clear delivery state for ${name} after crash`, logger_default.errorData(err));
         }
       }
-      import("./mind-activity-tracker-L7GCYXQR.js").then(({ markIdle }) => markIdle(name)).catch((err) => mlog.warn(`failed to mark ${name} idle after crash`, logger_default.errorData(err)));
-      import("./activity-events-H7YI3BTF.js").then(
+      import("./mind-activity-tracker-QF6DCX2X.js").then(({ markIdle }) => markIdle(name)).catch((err) => mlog.warn(`failed to mark ${name} idle after crash`, logger_default.errorData(err)));
+      import("./activity-events-LQII6PZS.js").then(
         ({ publish }) => publish({ type: "mind_stopped", mind: name, summary: `${name} crashed (exit ${code})` })
       ).catch((err) => mlog.warn(`failed to publish crash event for ${name}`, logger_default.errorData(err)));
       const { shouldRestart, delay, attempt } = this.restartTracker.recordCrash(name);
@@ -895,7 +939,7 @@ var MindManager = class {
       mlog.warn(`failed to clear turn state for ${name} on stop`, logger_default.errorData(err));
     }
     try {
-      const { getDeliveryManager } = await import("./delivery-manager-B4OKWD2P.js");
+      const { getDeliveryManager } = await import("./delivery-manager-HGVZSEES.js");
       getDeliveryManager().clearMindSessions(name);
     } catch (err) {
       if (!(err instanceof Error && err.message.includes("not initialized"))) {
@@ -903,7 +947,7 @@ var MindManager = class {
       }
     }
     try {
-      const { clearEchoTextCache } = await import("./echo-text-WYAAODBV.js");
+      const { clearEchoTextCache } = await import("./echo-text-6ANI5HHN.js");
       clearEchoTextCache(name);
     } catch (err) {
       mlog.debug(`failed to clear echo-text cache for ${name}`, logger_default.errorData(err));

package/dist/{chunk-EQKSRVDE.js → chunk-VP5PFNZO.js}

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import {
   spiritDir
-} from "./chunk-SFRYRW37.js";
+} from "./chunk-VSBMLB2W.js";
 import {
   getScheduler
-} from "./chunk-7FDWPQCU.js";
+} from "./chunk-Q7XQLKZB.js";
 import {
   getDeliveryManager
-} from "./chunk-JI67D7O2.js";
+} from "./chunk-7HN63Q7J.js";
 import {
   getMindManager,
   resolveMindToken
-} from "./chunk-ALIVXDM4.js";
+} from "./chunk-VAEZCIJC.js";
 import {
   extractTextContent,
   getRoutingConfig,
   resolveRoute,
   shouldGate
-} from "./chunk-6BM2I736.js";
+} from "./chunk-UDZLPR34.js";
 import {
   hashSkillDir,
   importSkillFromDir,
   removeSharedSkill,
   sharedSkillsDir
-} from "./chunk-TGJHGVBZ.js";
+} from "./chunk-QT4D5XCI.js";
 import {
   getOrCreateMindUser,
   getOrCreateSystemUser,
   getUser,
   getUserByUsername,
   syncMindProfile
-} from "./chunk-UC6BNMGT.js";
+} from "./chunk-HKP6OAJP.js";
 import {
   MIND_LEVEL_THREAD,
   deliverEvent,
@@ -38,13 +38,13 @@ import {
   pendingEventCount,
   pendingEventsLine,
   recordNotice
-} from "./chunk-7OZWKHA3.js";
+} from "./chunk-ICL6T4SN.js";
 import {
   publish as publish2
 } from "./chunk-LNNI3MS4.js";
 import {
   getPrompt
-} from "./chunk-5TPC4KCV.js";
+} from "./chunk-FXWBFDQR.js";
 import {
   addMessage,
   createChannel,
@@ -55,14 +55,14 @@ import {
   getParticipants,
   joinChannel,
   updateChannelSettings
-} from "./chunk-574M6I7F.js";
+} from "./chunk-TPX6E6PL.js";
 import {
   markIdle
-} from "./chunk-E5S3ILVA.js";
+} from "./chunk-UFTDRTCP.js";
 import {
   publish,
   subscribe
-} from "./chunk-3BAFMGCJ.js";
+} from "./chunk-U54PJPTB.js";
 import {
   readVoluteConfig,
   resolveWakeTriggers
@@ -70,10 +70,10 @@ import {
 import {
   isIsolationEnabled,
   mindUserName
-} from "./chunk-AJWFDIEY.js";
+} from "./chunk-M77B73VV.js";
 import {
   missingCredentialWarning
-} from "./chunk-632FJ23O.js";
+} from "./chunk-EGV6R6UF.js";
 import {
   logger_default
 } from "./chunk-QUSMYGNQ.js";
@@ -90,14 +90,15 @@ import {
   voluteHome,
   voluteSystemDir,
   writeGlobalConfig
-} from "./chunk-CAIYV33P.js";
+} from "./chunk-H6X6CKDN.js";
 import {
   activity,
+  apiTokens,
   deliveryQueue,
   messages,
   mindHistory,
   sessions
-} from "./chunk-5IIVOWSP.js";
+} from "./chunk-2RNMBXD2.js";
 
 // packages/daemon/src/lib/extensions.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
@@ -105,9 +106,43 @@ import { dirname, resolve as resolve5 } from "path";
 
 // packages/daemon/src/web/middleware/auth.ts
 import { timingSafeEqual } from "crypto";
-import { eq, lt } from "drizzle-orm";
+import { eq as eq2, lt } from "drizzle-orm";
 import { getCookie } from "hono/cookie";
 import { createMiddleware } from "hono/factory";
+
+// packages/daemon/src/lib/api-tokens.ts
+import { createHash, randomBytes } from "crypto";
+import { and, eq } from "drizzle-orm";
+var API_TOKEN_PREFIX = "vmt_";
+function generateToken() {
+  return API_TOKEN_PREFIX + randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+async function issueApiToken(userId, label) {
+  const db = await getDb();
+  const token = generateToken();
+  const [row] = await db.insert(apiTokens).values({ user_id: userId, token_hash: hashToken(token), label: label ?? null }).returning({ id: apiTokens.id, label: apiTokens.label, created_at: apiTokens.created_at });
+  return { id: row.id, token, label: row.label, created_at: row.created_at };
+}
+async function resolveApiToken(token) {
+  if (!token.startsWith(API_TOKEN_PREFIX)) return null;
+  const db = await getDb();
+  const row = await db.select({ user_id: apiTokens.user_id }).from(apiTokens).where(eq(apiTokens.token_hash, hashToken(token))).get();
+  return row?.user_id ?? null;
+}
+async function revokeApiToken(userId, id) {
+  const db = await getDb();
+  const rows = await db.delete(apiTokens).where(and(eq(apiTokens.id, id), eq(apiTokens.user_id, userId))).returning({ id: apiTokens.id });
+  return rows.length > 0;
+}
+async function listApiTokens(userId) {
+  const db = await getDb();
+  return db.select({ id: apiTokens.id, label: apiTokens.label, created_at: apiTokens.created_at }).from(apiTokens).where(eq(apiTokens.user_id, userId)).orderBy(apiTokens.id).all();
+}
+
+// packages/daemon/src/web/middleware/auth.ts
 var MIND_USER_CACHE_TTL = 5 * 60 * 1e3;
 var mindUserCache = /* @__PURE__ */ new Map();
 var alog = logger_default.child("auth");
@@ -142,14 +177,14 @@ async function createSession(userId) {
 async function deleteSession(sessionId) {
   sessionCache.delete(sessionId);
   const db = await getDb();
-  await db.delete(sessions).where(eq(sessions.id, sessionId));
+  await db.delete(sessions).where(eq2(sessions.id, sessionId));
 }
 async function getSessionUserId(sessionId) {
   const db = await getDb();
-  const row = await db.select().from(sessions).where(eq(sessions.id, sessionId)).get();
+  const row = await db.select().from(sessions).where(eq2(sessions.id, sessionId)).get();
   if (!row) return void 0;
   if (Date.now() - row.createdAt > SESSION_MAX_AGE) {
-    await db.delete(sessions).where(eq(sessions.id, sessionId));
+    await db.delete(sessions).where(eq2(sessions.id, sessionId));
     return void 0;
   }
   return row.userId;
@@ -231,6 +266,18 @@ var authMiddleware = createMiddleware(async (c, next) => {
       await next();
       return;
     }
+    if (token.startsWith(API_TOKEN_PREFIX)) {
+      const userId = await resolveApiToken(token);
+      if (userId != null) {
+        const user2 = await getUser(userId);
+        if (user2) {
+          if (user2.role === "pending") return c.json({ error: "Account pending approval" }, 403);
+          c.set("user", user2);
+          await next();
+          return;
+        }
+      }
+    }
     if (token) {
       const user2 = await resolveSession(token);
       if (user2) {
@@ -262,7 +309,7 @@ var requireSelf = (paramName = "name") => createMiddleware(async (c, next) => {
 });
 
 // packages/daemon/src/lib/delivery/message-delivery.ts
-import { and as and2, eq as eq3, inArray as inArray2 } from "drizzle-orm";
+import { and as and3, eq as eq4, inArray as inArray2 } from "drizzle-orm";
 
 // packages/daemon/src/lib/daemon/sleep-manager.ts
 import { execFile, spawn as spawnChild } from "child_process";
@@ -278,7 +325,7 @@ import {
 import { resolve as resolve4 } from "path";
 import { promisify } from "util";
 import { CronExpressionParser } from "cron-parser";
-import { and, eq as eq2, inArray } from "drizzle-orm";
+import { and as and2, eq as eq3, inArray } from "drizzle-orm";
 
 // packages/daemon/src/lib/daemon/mind-service.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
@@ -292,7 +339,7 @@ async function ensureSystemDM(mindName) {
   const systemUser = await getOrCreateSystemUser();
   const mindUser = await getOrCreateMindUser(mindName);
   if (systemUser.id === mindUser.id) {
-    throw new Error(`Cannot create system DM: mind "${mindName}" is the system user`);
+    return null;
   }
   const existing = await findDMConversation([systemUser.id, mindUser.id]);
   if (existing) {
@@ -868,7 +915,7 @@ async function startMindFull(name) {
   notifyExtensionsMindStart(baseName);
 }
 async function recordMissingCredentialsNotice(mind, template) {
-  const { hasUndeliveredEvent, recordNotice: recordNotice2, MIND_LEVEL_THREAD: MIND_LEVEL_THREAD2 } = await import("./system-events-A6IGCEC3.js");
+  const { hasUndeliveredEvent, recordNotice: recordNotice2, MIND_LEVEL_THREAD: MIND_LEVEL_THREAD2 } = await import("./system-events-ZPSH63QX.js");
   const warning = await missingCredentialWarning(template, readMindModel(mind, template), mind);
   if (!warning) return;
   if (await hasUndeliveredEvent(mind, "no_credentials")) return;
@@ -912,7 +959,7 @@ async function wakeMind(name) {
 async function startSpiritFull(name) {
   const entry = await findMind(name);
   if (entry?.dir) {
-    const { registerMindDir } = await import("./delivery-router-JE7SHYNU.js");
+    const { registerMindDir } = await import("./delivery-router-RHANNTAC.js");
     registerMindDir(name, entry.dir);
   }
   await getMindManager().startMind(name);
@@ -945,7 +992,7 @@ function buildSeedOrientation(createdBy, creatorType) {
 async function sendSeedOrientation(mindName, createdBy) {
   let creatorType;
   if (createdBy) {
-    const { getUserByUsername: getUserByUsername2 } = await import("./auth-DT7GY7EZ.js");
+    const { getUserByUsername: getUserByUsername2 } = await import("./auth-X6EMNEGB.js");
     creatorType = (await getUserByUsername2(createdBy))?.user_type;
   }
   await deliverEvent(mindName, {
@@ -954,8 +1001,8 @@ async function sendSeedOrientation(mindName, createdBy) {
   });
 }
 async function ensureCreatorDM(mindName, creatorUsername) {
-  const { getOrCreateMindUser: getOrCreateMindUser2, getUserByUsername: getUserByUsername2 } = await import("./auth-DT7GY7EZ.js");
-  const { findDMConversation: findDMConversation2, createConversation: createConversation2 } = await import("./conversations-S2232Y5I.js");
+  const { getOrCreateMindUser: getOrCreateMindUser2, getUserByUsername: getUserByUsername2 } = await import("./auth-X6EMNEGB.js");
+  const { findDMConversation: findDMConversation2, createConversation: createConversation2 } = await import("./conversations-ZL6PHROD.js");
   const mindUser = await getOrCreateMindUser2(mindName);
   const creatorUser = await getUserByUsername2(creatorUsername);
   if (!creatorUser) {
@@ -1318,7 +1365,7 @@ var SleepManager = class {
   async flushQueuedMessages(name) {
     try {
       const db = await getDb();
-      const rows = await db.select().from(deliveryQueue).where(and(eq2(deliveryQueue.mind, name), eq2(deliveryQueue.status, "sleep-queued"))).all();
+      const rows = await db.select().from(deliveryQueue).where(and2(eq3(deliveryQueue.mind, name), eq3(deliveryQueue.status, "sleep-queued"))).all();
       if (rows.length === 0) return 0;
       const groups = /* @__PURE__ */ new Map();
       for (const row of rows) {
@@ -1330,7 +1377,7 @@ var SleepManager = class {
             `dropping unparseable queued message ${row.id} for ${name}`,
             logger_default.errorData(err)
           );
-          await db.delete(deliveryQueue).where(eq2(deliveryQueue.id, row.id));
+          await db.delete(deliveryQueue).where(eq3(deliveryQueue.id, row.id));
           continue;
         }
         const channel = payload.channel ?? "unknown";
@@ -1373,7 +1420,7 @@ var SleepManager = class {
    * the real delivery stack. Returns whether the batch was handed off to the mind.
    */
   async deliverQueuedBatch(name, payloads) {
-    const { deliverBatch: deliverBatch2 } = await import("./message-delivery-3456PXB7.js");
+    const { deliverBatch: deliverBatch2 } = await import("./message-delivery-JHMAJ2GU.js");
     return deliverBatch2(name, payloads);
   }
   // --- Wake failure handling (#419) ---
@@ -1653,7 +1700,7 @@ var SleepManager = class {
   async buildQueuedSummary(name) {
     try {
       const db = await getDb();
-      const rows = await db.select({ channel: deliveryQueue.channel, sender: deliveryQueue.sender }).from(deliveryQueue).where(and(eq2(deliveryQueue.mind, name), eq2(deliveryQueue.status, "sleep-queued"))).all();
+      const rows = await db.select({ channel: deliveryQueue.channel, sender: deliveryQueue.sender }).from(deliveryQueue).where(and2(eq3(deliveryQueue.mind, name), eq3(deliveryQueue.status, "sleep-queued"))).all();
       if (rows.length === 0) return "No messages arrived while you slept.";
       const channelCounts = /* @__PURE__ */ new Map();
       const senders = /* @__PURE__ */ new Set();
@@ -1824,7 +1871,7 @@ async function linkToolResultToTurn(mind, turnId, toolResultContent, toolUseEven
         content: mindHistory.content,
         message_id: mindHistory.message_id,
         turn_id: mindHistory.turn_id
-      }).from(mindHistory).where(and2(eq3(mindHistory.id, outboundId), eq3(mindHistory.mind, mind))).limit(1);
+      }).from(mindHistory).where(and3(eq4(mindHistory.id, outboundId), eq4(mindHistory.mind, mind))).limit(1);
       const row = rows[0];
       if (!row) {
         dlog.warn(`outbound marker references missing record: mind=${mind} id=${outboundId}`);
@@ -1832,13 +1879,13 @@ async function linkToolResultToTurn(mind, turnId, toolResultContent, toolUseEven
       }
       const alreadyTagged = row.turn_id != null;
       if (!alreadyTagged) {
-        await db.update(mindHistory).set({ turn_id: turnId }).where(eq3(mindHistory.id, outboundId));
+        await db.update(mindHistory).set({ turn_id: turnId }).where(eq4(mindHistory.id, outboundId));
       }
       if (row.message_id) {
         await db.update(messages).set({
           turn_id: turnId,
           ...toolUseEventId != null ? { source_event_id: toolUseEventId } : {}
-        }).where(eq3(messages.id, Number(row.message_id)));
+        }).where(eq4(messages.id, Number(row.message_id)));
       }
       if (!alreadyTagged) {
         publish2(mind, {
@@ -2029,9 +2076,7 @@ async function backfillSystemChannelMembers() {
 }
 async function announceToSystem(text) {
   const channelId = await ensureSystemChannel();
-  const systemUser = await getOrCreateSystemUser();
-  await joinChannel(channelId, systemUser.id);
-  await addMessage(channelId, "user", systemUser.username, [{ type: "text", text }]);
+  await addMessage(channelId, "event", null, [{ type: "text", text }]);
   const participants = await getParticipants(channelId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const channel = "#system";
@@ -2040,7 +2085,7 @@ async function announceToSystem(text) {
       content: [{ type: "text", text }],
       channel,
       conversationId: channelId,
-      sender: systemUser.username,
+      sender: null,
       participants: participants.map((p) => p.username),
       participantCount: participants.length,
       isDM: false
@@ -2683,7 +2728,7 @@ async function installNpmExtension(pkg) {
     throw new Error(`Extension "${pkg}" is already installed`);
   }
   const dir = ensureExtensionsNpmDir();
-  const { exec } = await import("./exec-2H65LMTA.js");
+  const { exec } = await import("./exec-ABD3DYA2.js");
   try {
     await exec("npm", ["install", "--ignore-scripts", pkg], { cwd: dir });
   } catch (err) {
@@ -2704,7 +2749,7 @@ async function uninstallNpmExtension(pkg) {
   packages.splice(idx, 1);
   writeExtensionsConfig(packages);
   try {
-    const { exec } = await import("./exec-2H65LMTA.js");
+    const { exec } = await import("./exec-ABD3DYA2.js");
     await exec("npm", ["uninstall", "--ignore-scripts", pkg], { cwd: extensionsNpmDir() });
   } catch (err) {
     logger_default.warn(
@@ -2798,6 +2843,9 @@ function notifyExtensionsMindStop(mindName) {
 }
 
 export {
+  issueApiToken,
+  revokeApiToken,
+  listApiTokens,
   invalidateMindUserCache,
   SESSION_MAX_AGE,
   invalidateSessionCache,