zooid 0.13.0 → 0.14.0

package/dist/bin.js

@@ -5,28 +5,31 @@ import {
   MediaClient,
   SpawnRegistry,
   buildAcpRegistry,
+  contextEligibleAgents,
   createMatrixTransport,
   ensureDefaultChannel,
   ensureWorkforceSpace,
+  evaluateMatch,
   findConfigFile,
   findHttpTransport,
   findMatrixTransport,
   loadZooidConfig,
   mergeCliFlags,
   renderRegistration,
-  startDaemonSocketServer,
+  renderTemplate,
+  startAgentSocketServers,
   startWorkforcePublisher
-} from "./chunk-YZ4IO5MR.js";
+} from "./chunk-R5S26T7B.js";
 
 // src/bin.ts
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 import { cac } from "cac";
 
 // src/commands/dev.ts
 import chalk from "chalk";
 import { Listr } from "listr2";
-import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname6, join as join13, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname7, join as join15, resolve as resolve4 } from "path";
 import { fileURLToPath } from "url";
 import { serve as serve2 } from "@hono/node-server";
 
@@ -215,10 +218,10 @@ MATRIX_HS_TOKEN=${tokens.hsToken}
 }
 
 // src/daemon/start-daemon.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { mkdir, unlink } from "fs/promises";
+import { readFileSync as readFileSync6 } from "fs";
+import { mkdir } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname2, isAbsolute, join as join6, resolve } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "path";
 import { serve } from "@hono/node-server";
 
 // ../transport-http/src/server.ts
@@ -431,6 +434,37 @@ function createApp({
   return app;
 }
 
+// src/pi-extension-install.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join4, resolve } from "path";
+function resolvePiAgentDir(opts) {
+  const override = opts.env?.PI_CODING_AGENT_DIR;
+  if (override) {
+    return {
+      dir: isAbsolute(override) ? override : resolve(opts.agentWorkdir, override),
+      scope: "project"
+    };
+  }
+  return { dir: join4(opts.daemonHome, ".pi", "agent"), scope: "home" };
+}
+function installPiExtension(opts) {
+  if (!opts.createMissing && !existsSync2(opts.agentDir)) {
+    return { status: "skipped", reason: "no Pi home" };
+  }
+  const target = join4(opts.agentDir, "extensions", "zooid-tasks.js");
+  mkdirSync3(dirname2(target), { recursive: true });
+  const source = readFileSync2(opts.bundlePath);
+  if (existsSync2(target) && readFileSync2(target).equals(source)) return { status: "unchanged", target };
+  writeFileSync3(target, source);
+  return { status: "installed", target };
+}
+
+// ../pi-extension/src/index.ts
+import { createRequire } from "module";
+function resolvePiExtensionBundle() {
+  return createRequire(import.meta.url).resolve("@zooid/pi-extension/bundle");
+}
+
 // src/prepull-images.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -576,22 +610,22 @@ function pushGateway(opts) {
 }
 
 // src/push-gateway/vapid.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 import webpush2 from "web-push";
 var VAPID_FILENAME = "vapid.json";
 function loadOrCreateVapidKeys(dataDir) {
-  const path = join4(dataDir, VAPID_FILENAME);
+  const path = join5(dataDir, VAPID_FILENAME);
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
     if (typeof parsed.publicKey === "string" && typeof parsed.privateKey === "string")
       return { publicKey: parsed.publicKey, privateKey: parsed.privateKey };
     console.warn(`[push] ${path} is malformed; generating a new VAPID keypair.`);
   } catch {
   }
   const keys = webpush2.generateVAPIDKeys();
-  mkdirSync3(dataDir, { recursive: true });
-  writeFileSync3(path, JSON.stringify(keys, null, 2), { mode: 384 });
+  mkdirSync4(dataDir, { recursive: true });
+  writeFileSync4(path, JSON.stringify(keys, null, 2), { mode: 384 });
   return keys;
 }
 
@@ -603,21 +637,53 @@ function mountPushGateway(app, opts) {
 }
 
 // src/daemon/sync-cursors.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 function makeSyncCursorStore(agentsDir) {
-  const fileFor = (agentName) => join5(agentsDir, agentName, "sync-since");
+  const fileFor = (agentName) => join6(agentsDir, agentName, "sync-since");
   return {
     loadSince(agentName) {
       try {
-        return readFileSync3(fileFor(agentName), "utf8").trim() || null;
+        return readFileSync4(fileFor(agentName), "utf8").trim() || null;
       } catch {
         return null;
       }
     },
     saveSince(agentName, since) {
-      mkdirSync4(join5(agentsDir, agentName), { recursive: true });
-      writeFileSync4(fileFor(agentName), since, "utf8");
+      mkdirSync5(join6(agentsDir, agentName), { recursive: true });
+      writeFileSync5(fileFor(agentName), since, "utf8");
+    }
+  };
+}
+
+// src/daemon/task-journal.ts
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, renameSync, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
+function makeTaskJournal(dataDir) {
+  const path = join7(dataDir, "tasks.json");
+  return {
+    load() {
+      try {
+        const value = JSON.parse(readFileSync5(path, "utf8"));
+        return value.version === 1 && Array.isArray(value.tasks) ? value.tasks : [];
+      } catch (error) {
+        if (error.code !== "ENOENT") console.warn("[tasks] journal unavailable; starting empty:", error);
+        return [];
+      }
+    },
+    save(tasks) {
+      mkdirSync6(dataDir, { recursive: true });
+      const temp = `${path}.tmp-${process.pid}`;
+      try {
+        writeFileSync6(temp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
+        renameSync(temp, path);
+      } catch (error) {
+        console.warn("[tasks] journal write failed:", error);
+        try {
+          unlinkSync(temp);
+        } catch {
+        }
+      }
     }
   };
 }
@@ -627,55 +693,425 @@ function shouldBindHttpListener(mode) {
   return mode !== "client";
 }
 
+// src/daemon/trigger-scheduler.ts
+import { Cron } from "croner";
+
+// src/daemon/trigger-runner.ts
+async function fireTrigger(deps) {
+  const { name, as, message, agentUserId, resolveRoom, ensureBot, sendMessage } = deps;
+  try {
+    const roomId = await resolveRoom(message.room);
+    if (!roomId) {
+      console.warn(`[trigger:${name}] cannot resolve room ${message.room} \u2014 skipping`);
+      return;
+    }
+    await ensureBot(as, roomId);
+    await sendMessage({
+      roomId,
+      asUserId: as,
+      content: {
+        msgtype: "m.text",
+        body: message.text,
+        // Structural mention: routes deterministically AND disarms the raw-body
+        // fallback in extractMentions, which only fires when nothing matched.
+        "m.mentions": { user_ids: [agentUserId] }
+      }
+    });
+  } catch (err) {
+    console.warn(`[trigger:${name}] failed:`, err.message);
+  }
+}
+
+// src/daemon/trigger-scheduler.ts
+function validateCron(name, expr) {
+  try {
+    new Cron(expr, { paused: true }).stop();
+  } catch (err) {
+    throw new Error(`triggers.${name}.schedule: ${err.message}`);
+  }
+}
+function startTriggerScheduler(deps) {
+  const { triggers, agentUserIds, resolveRoom, ensureBot, sendMessage } = deps;
+  const jobs = [];
+  for (const [name, trigger] of Object.entries(triggers)) {
+    if (!trigger.schedule) continue;
+    const job = new Cron(trigger.schedule, () => {
+      for (const message of trigger.messages) {
+        const agentUserId = agentUserIds[message.mention];
+        if (!agentUserId) {
+          console.warn(`[trigger:${name}] unknown agent "${message.mention}" \u2014 skipping`);
+          continue;
+        }
+        void fireTrigger({ name, as: trigger.as, message, agentUserId, resolveRoom, ensureBot, sendMessage });
+      }
+    });
+    jobs.push(job);
+  }
+  return {
+    async stop() {
+      for (const job of jobs) job.stop();
+    }
+  };
+}
+
+// src/daemon/webhook-verify.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FRESHNESS_S = 300;
+function safeEqual(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  return ab.length === bb.length && timingSafeEqual2(ab, bb);
+}
+function hmacHex(secret, baseString) {
+  return createHmac("sha256", secret).update(baseString).digest("hex");
+}
+function verifyGithub(input) {
+  const header = input.headers["x-hub-signature-256"];
+  if (!header) return { ok: false };
+  const [scheme, sig] = header.split("=");
+  if (scheme !== "sha256" || !sig) return { ok: false };
+  const expected = hmacHex(input.secret, input.rawBody);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifyStripe(input) {
+  const header = input.headers["stripe-signature"];
+  if (!header) return { ok: false };
+  const parts = Object.fromEntries(
+    header.split(",").map((p) => p.split("=", 2)).filter(([, v]) => v !== void 0)
+  );
+  const ts = parts.t;
+  const sig = parts.v1;
+  if (!ts || !sig) return { ok: false };
+  if (!isFresh(ts)) return { ok: false };
+  const expected = hmacHex(input.secret, `${ts}.${input.rawBody}`);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifySlack(input) {
+  const header = input.headers["x-slack-signature"];
+  const ts = input.headers["x-slack-request-timestamp"];
+  if (!header || !ts) return { ok: false };
+  if (!header.startsWith("v0=")) return { ok: false };
+  const sig = header.slice("v0=".length);
+  if (!isFresh(ts)) return { ok: false };
+  const expected = hmacHex(input.secret, `v0:${ts}:${input.rawBody}`);
+  return safeEqual(sig, expected) ? { ok: true } : { ok: false };
+}
+function verifyStandard(input) {
+  const header = input.headers["webhook-signature"];
+  const id = input.headers["webhook-id"];
+  const ts = input.headers["webhook-timestamp"];
+  if (!header || !id || !ts) return { ok: false };
+  if (!isFresh(ts)) return { ok: false };
+  const candidate = header.split(" ").map((p) => p.startsWith("v1,") ? p.slice("v1,".length) : void 0).find((v) => v !== void 0);
+  if (!candidate) return { ok: false };
+  const expected = createHmac("sha256", input.secret).update(`${id}.${ts}.${input.rawBody}`).digest("base64");
+  return safeEqual(candidate, expected) ? { ok: true } : { ok: false };
+}
+function isFresh(tsRaw) {
+  const ts = Number(tsRaw);
+  if (!Number.isFinite(ts)) return false;
+  const nowS = Date.now() / 1e3;
+  return Math.abs(nowS - ts) <= FRESHNESS_S;
+}
+var VERIFIERS = {
+  github: verifyGithub,
+  stripe: verifyStripe,
+  slack: verifySlack,
+  standard: verifyStandard
+};
+function verifySignature(provider, input) {
+  try {
+    return VERIFIERS[provider](input);
+  } catch {
+    return { ok: false };
+  }
+}
+async function verifyCustomSignature(verifier, input) {
+  if (typeof verifier !== "function") return { ok: false };
+  try {
+    const result = await verifier(input);
+    if (result === true) return { ok: true };
+    if (result === false || result === null || typeof result !== "object") return { ok: false };
+    if (result.ok !== true) return { ok: false };
+    return typeof result.deliveryId === "string" ? { ok: true, deliveryId: result.deliveryId } : { ok: true };
+  } catch {
+    return { ok: false };
+  }
+}
+
+// src/daemon/delivery-cache.ts
+var DeliveryCache = class {
+  ttlMs;
+  expiryById = /* @__PURE__ */ new Map();
+  constructor(ttlMs) {
+    this.ttlMs = ttlMs;
+  }
+  get size() {
+    return this.expiryById.size;
+  }
+  /** Returns true if `id` was already seen (and still within its TTL). */
+  seen(id) {
+    this.evictExpired();
+    const now = Date.now();
+    const expiry = this.expiryById.get(id);
+    if (expiry !== void 0 && expiry > now) return true;
+    this.expiryById.set(id, now + this.ttlMs);
+    return false;
+  }
+  evictExpired() {
+    const now = Date.now();
+    for (const [id, expiry] of this.expiryById) {
+      if (expiry <= now) this.expiryById.delete(id);
+    }
+  }
+};
+
+// src/daemon/webhook-routes.ts
+var MAX_BODY2 = 1e6;
+var MAX_OUTPUT_CHARS = 6e4;
+var TRUNCATION_MARKER = "\n\n\u2026 (truncated)";
+var DELIVERY_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var EVENT_HEADER_BY_PROVIDER = {
+  github: "x-github-event"
+};
+var DELIVERY_ID_HEADER_BY_PROVIDER = {
+  github: "x-github-delivery",
+  standard: "webhook-id"
+};
+var RELEVANT_HEADERS = [
+  "x-hub-signature-256",
+  "x-github-event",
+  "x-github-delivery",
+  "stripe-signature",
+  "x-slack-signature",
+  "x-slack-request-timestamp",
+  "webhook-signature",
+  "webhook-id",
+  "webhook-timestamp"
+];
+function headersOf(c, all) {
+  const out = {};
+  if (all) {
+    c.req.raw.headers.forEach((value, key) => {
+      out[key.toLowerCase()] = value;
+    });
+    return out;
+  }
+  for (const h of RELEVANT_HEADERS) out[h] = c.req.header(h);
+  return out;
+}
+function definedHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function renderPayload(raw) {
+  let pretty;
+  try {
+    pretty = JSON.stringify(JSON.parse(raw), null, 2);
+  } catch {
+    pretty = raw;
+  }
+  if (pretty.length <= MAX_OUTPUT_CHARS) return pretty;
+  return pretty.slice(0, MAX_OUTPUT_CHARS) + TRUNCATION_MARKER;
+}
+async function handleDelivery(deps, name, trigger, raw, headers, cache, customDeliveryId) {
+  try {
+    const webhook = trigger.webhook;
+    if (!webhook) return;
+    const idHeader = DELIVERY_ID_HEADER_BY_PROVIDER[webhook.provider];
+    const deliveryId = customDeliveryId ?? (idHeader ? headers[idHeader] : void 0);
+    if (deliveryId !== void 0 && cache.seen(`${name}:${deliveryId}`)) return;
+    const eventHeader = EVENT_HEADER_BY_PROVIDER[webhook.provider];
+    const event = eventHeader ? headers[eventHeader] : void 0;
+    let body;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      body = void 0;
+    }
+    const ctx = {
+      event,
+      body,
+      headers: definedHeaders(headers),
+      output: renderPayload(raw)
+    };
+    for (const message of trigger.messages) {
+      if (message.match !== void 0 && !evaluateMatch(message.match, ctx)) continue;
+      const agentUserId = deps.agentUserIds[message.mention];
+      if (!agentUserId) {
+        console.warn(`[webhook:${name}] unknown agent "${message.mention}" \u2014 skipping`);
+        continue;
+      }
+      await fireTrigger({
+        name,
+        as: trigger.as,
+        message: { ...message, text: renderTemplate(message.text, ctx) },
+        agentUserId,
+        resolveRoom: deps.resolveRoom,
+        ensureBot: deps.ensureBot,
+        sendMessage: deps.sendMessage
+      });
+    }
+  } catch (err) {
+    console.warn(`[webhook:${name}] failed:`, err.message);
+  }
+}
+var WEBHOOK_ROUTE_PREFIX = "/_zooid/webhooks";
+function mountWebhookRoutes(app, deps) {
+  const cache = new DeliveryCache(DELIVERY_CACHE_TTL_MS);
+  const receive = async (c) => {
+    const name = c.req.param("name");
+    const trigger = deps.triggers[name];
+    const raw = await c.req.text();
+    if (raw.length > MAX_BODY2) return c.text("too large", 413);
+    if (!trigger?.webhook) return c.text("unauthorized", 401);
+    const webhook = trigger.webhook;
+    const headers = headersOf(c, webhook.provider === "custom");
+    let customDeliveryId;
+    if (webhook.provider === "custom") {
+      const v = await verifyCustomSignature(deps.customVerifiers?.[name], {
+        rawBody: raw,
+        headers: definedHeaders(headers),
+        secret: webhook.secret
+      });
+      if (!v.ok) return c.text("unauthorized", 401);
+      customDeliveryId = v.deliveryId;
+    } else {
+      const v = verifySignature(webhook.provider, {
+        rawBody: raw,
+        headers,
+        secret: webhook.secret
+      });
+      if (!v.ok) return c.text("unauthorized", 401);
+    }
+    void handleDelivery(deps, name, trigger, raw, headers, cache, customDeliveryId);
+    return c.text("accepted", 202);
+  };
+  app.post(`${WEBHOOK_ROUTE_PREFIX}/:name`, receive);
+}
+
+// src/daemon/load-custom-verifiers.ts
+import { pathToFileURL } from "url";
+async function loadCustomVerifiers(triggers) {
+  const out = {};
+  for (const [name, trigger] of Object.entries(triggers)) {
+    const path = trigger.webhook?.provider === "custom" ? trigger.webhook.verify : void 0;
+    if (!path) continue;
+    let mod;
+    try {
+      mod = await import(pathToFileURL(path).href);
+    } catch (err) {
+      throw new Error(
+        `triggers.${name}.webhook.verify: cannot load ${path} \u2014 ${err.message}`
+      );
+    }
+    const fn = mod.default ?? mod.verify;
+    if (typeof fn !== "function") {
+      throw new Error(
+        `triggers.${name}.webhook.verify: ${path} must export a function as \`default\` (or as \`verify\`), got ${typeof fn}`
+      );
+    }
+    out[name] = fn;
+  }
+  return out;
+}
+
+// src/daemon/trigger-rooms.ts
+async function joinTriggerRooms(deps) {
+  const { triggers, resolveRoom, ensureBot } = deps;
+  const seen = /* @__PURE__ */ new Set();
+  for (const trigger of Object.values(triggers)) {
+    for (const message of trigger.messages) {
+      const key = `${trigger.as}\0${message.room}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const roomId = await resolveRoom(message.room);
+      if (!roomId) {
+        console.warn(`[trigger] cannot resolve room ${message.room} \u2014 skipping join`);
+        continue;
+      }
+      await ensureBot(trigger.as, roomId);
+    }
+  }
+}
+
 // src/daemon/start-daemon.ts
 function listenAsync(server) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const check = () => {
       const addr = server.address();
-      if (addr && typeof addr === "object") resolve8(addr.port);
+      if (addr && typeof addr === "object") resolve9(addr.port);
       else setImmediate(check);
     };
     check();
   });
 }
 function closeAsync(server) {
-  return new Promise((resolve8) => {
-    server.close(() => resolve8());
+  return new Promise((resolve9) => {
+    server.close(() => resolve9());
   });
 }
+function localpart(userId) {
+  const m = /^@([^:]+):/.exec(userId);
+  if (!m) throw new Error(`bad user id: ${userId}`);
+  return m[1];
+}
 async function startDaemon(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   const found = opts.configPath ? { path: opts.configPath } : findConfigFile(cwd);
   if (!found) throw new Error("zooid.yaml is required");
-  const configDir = dirname2(found.path);
-  const base = loadZooidConfig(readFileSync4(found.path, "utf8"), { configDir });
+  const configDir = dirname3(found.path);
+  const base = loadZooidConfig(readFileSync6(found.path, "utf8"), { configDir, validateCron });
   const config = mergeCliFlags(base, opts.cliFlags ?? {});
   const approvals = new ApprovalCorrelator();
-  const daemonSockPath = opts.agentsDir ? join6(opts.agentsDir, "..", "run", "context.sock") : join6(tmpdir(), `zooid-context-${process.pid}.sock`);
-  await mkdir(dirname2(daemonSockPath), { recursive: true }).catch(() => {
+  const runDir = opts.agentsDir ? join8(opts.agentsDir, "..", "run") : join8(tmpdir(), `zooid-context-${process.pid}`);
+  await mkdir(runDir, { recursive: true }).catch(() => {
   });
   const contextSpawnRegistry = new SpawnRegistry();
-  let contextSocket = null;
-  try {
-    contextSocket = await startDaemonSocketServer({
-      sockPath: daemonSockPath,
-      registry: contextSpawnRegistry
-    });
-  } catch (err) {
-    console.warn("[context] daemon socket startup failed; zooid-context MCP disabled:", err);
-  }
-  const dataDir = opts.agentsDir ? dirname2(opts.agentsDir) : void 0;
+  const contextSockets = await startAgentSocketServers({
+    runDir,
+    registry: contextSpawnRegistry,
+    agentNames: contextEligibleAgents(config)
+  });
+  const dataDir = opts.agentsDir ? dirname3(opts.agentsDir) : void 0;
   const registry = buildAcpRegistry(config, {
     approvals,
     onTap: opts.onTap,
     agentsDir: opts.agentsDir,
-    contextSpawnRegistry: contextSocket ? contextSpawnRegistry : void 0,
-    daemonSockPath: contextSocket ? daemonSockPath : void 0,
+    contextSpawnRegistry,
+    daemonSockPaths: contextSockets.paths,
     configDir,
     dataDir,
     daemonHome: process.env.HOME
   });
   const agentNames = Object.keys(config.agents);
+  const piAgents = agentNames.filter(
+    (name) => config.agents[name].acp?.preset === "pi"
+  );
+  if (piAgents.length > 0) {
+    const bundlePath = resolvePiExtensionBundle();
+    const installed = /* @__PURE__ */ new Set();
+    for (const name of piAgents) {
+      const { dir, scope } = resolvePiAgentDir({
+        agentWorkdir: resolve2(configDir, config.agents[name].workdir),
+        daemonHome: process.env.HOME ?? "",
+        env: process.env
+      });
+      if (installed.has(dir)) continue;
+      installed.add(dir);
+      const result = installPiExtension({
+        agentDir: dir,
+        bundlePath,
+        createMissing: scope === "project"
+      });
+      const where = result.target ? ` extension=${result.target}` : "";
+      const why = result.reason ? ` reason=${result.reason}` : "";
+      console.log(`[pi] agent=${name}${where} status=${result.status}${why}`);
+    }
+  }
   if (config.runtime !== "local") {
     await prepullImages(registry, {
       engine: config.runtime === "podman" ? "podman" : "docker",
@@ -685,11 +1121,13 @@ async function startDaemon(opts = {}) {
       log: opts.prepullLog
     });
   }
-  console.log(
-    `[context] socket=${daemonSockPath} status=${contextSocket ? "listening" : "disabled"} agents={${agentNames.map((n) => `${n}:${registry.hasContextSpawn(n) ? "yes" : "no"}`).join(", ")}}`
-  );
+  console.log(`[context] runDir=${runDir}`);
+  for (const name of agentNames) {
+    console.log(`[context] agent=${name} socket=${contextSockets.paths[name] ?? "(disabled)"}`);
+  }
   let server = null;
   let syncLoops;
+  let triggers;
   let stopped = false;
   let resolveStopped;
   const whenStopped = new Promise((r) => {
@@ -724,7 +1162,7 @@ async function startDaemon(opts = {}) {
         trigger: a.matrix.trigger
       };
       if (a.matrix.display_name !== void 0) binding.displayName = a.matrix.display_name;
-      const workspaceDir = isAbsolute(a.workdir) ? a.workdir : resolve(configDir, a.workdir);
+      const workspaceDir = isAbsolute2(a.workdir) ? a.workdir : resolve2(configDir, a.workdir);
       binding.workspaceDir = workspaceDir;
       binding.agentWorkspacePath = isContainerRuntime ? "/workspace" : workspaceDir;
       bindings.push(binding);
@@ -741,6 +1179,7 @@ async function startDaemon(opts = {}) {
       adminUserId: opts.adminUserId,
       botUserId: asUserId,
       media: mediaClient,
+      taskJournal: dataDir ? makeTaskJournal(dataDir) : void 0,
       mode,
       loadSince: (uid) => {
         const name = nameByUserId.get(uid);
@@ -751,6 +1190,21 @@ async function startDaemon(opts = {}) {
         if (name && cursors) cursors.saveSince(name, since);
       }
     });
+    contextSpawnRegistry.setTaskActions(transport.taskActions);
+    let spaceRoomId;
+    const agentUserIds = Object.fromEntries(bindings.map((b) => [b.name, b.userId]));
+    const resolveRoom = async (r) => r.startsWith("!") ? r : await client.resolveAlias(r);
+    const ensureBot = async (mxid, roomId) => {
+      await client.registerBot(localpart(mxid)).catch(() => {
+      });
+      if (spaceRoomId) {
+        await client.invite({ roomId: spaceRoomId, asUserId, targetUserId: mxid }).catch(() => {
+        });
+        await client.joinRoom(spaceRoomId, mxid).catch(() => {
+        });
+      }
+      await client.joinRoom(roomId, mxid);
+    };
     if (shouldBindHttpListener(mode)) {
       const requestedPort = matrix.transport.port ?? 9e3;
       if (dataDir) {
@@ -759,14 +1213,32 @@ async function startDaemon(opts = {}) {
           subject: `https://${serverName}`
         }).publicKey;
       }
-      server = serve({ fetch: transport.app.fetch, port: requestedPort, hostname: "0.0.0.0" });
+      const webhookTriggers = Object.entries(config.triggers).filter(([, t]) => t.webhook);
+      if (webhookTriggers.length > 0) {
+        const customVerifiers = await loadCustomVerifiers(config.triggers);
+        mountWebhookRoutes(transport.app, {
+          triggers: config.triggers,
+          customVerifiers,
+          agentUserIds,
+          resolveRoom,
+          ensureBot,
+          sendMessage: (m) => client.sendMessage(m)
+        });
+        for (const [name] of webhookTriggers) {
+          console.log(`[webhook] POST ${WEBHOOK_ROUTE_PREFIX}/${name}`);
+        }
+      }
+      server = serve({
+        fetch: transport.app.fetch,
+        port: requestedPort,
+        hostname: "0.0.0.0"
+      });
       port = await listenAsync(server);
     } else {
       port = 0;
     }
     const spaceLocalpart = matrix.transport.space ?? "dev";
     const adminUserIds = opts.adminUserId ? [opts.adminUserId] : [];
-    let spaceRoomId;
     try {
       spaceRoomId = await ensureWorkforceSpace({
         client,
@@ -777,11 +1249,36 @@ async function startDaemon(opts = {}) {
         admins: adminUserIds,
         joinRule: opts.publicWorkforceSpace ? "public" : "invite"
       });
-      console.log(`[matrix] ensured workforce space #${spaceLocalpart}:${serverName} \u2192 ${spaceRoomId}`);
+      console.log(
+        `[matrix] ensured workforce space #${spaceLocalpart}:${serverName} \u2192 ${spaceRoomId}`
+      );
     } catch (err) {
       console.warn("[matrix] workforce space provisioning failed:", err);
     }
     await transport.bootstrap({ spaceRoomId, asUserId, adminUserIds });
+    if (Object.keys(config.triggers).length > 0) {
+      await joinTriggerRooms({ triggers: config.triggers, resolveRoom, ensureBot });
+      console.log(
+        `[trigger] joined rooms for ${Object.keys(config.triggers).length} trigger(s)`
+      );
+      triggers = startTriggerScheduler({
+        triggers: config.triggers,
+        agentUserIds,
+        resolveRoom,
+        ensureBot,
+        sendMessage: (m) => client.sendMessage(m)
+      });
+      const scheduled = Object.values(config.triggers).filter((t) => t.schedule).length;
+      if (scheduled > 0) console.log(`[trigger] scheduled ${scheduled} trigger(s)`);
+      if (!shouldBindHttpListener(mode)) {
+        const webhooks = Object.values(config.triggers).filter((t) => t.webhook).length;
+        if (webhooks > 0) {
+          console.warn(
+            `[webhook] ${webhooks} webhook trigger(s) configured, but pull mode binds no inbound listener \u2014 these will never fire.`
+          );
+        }
+      }
+    }
     syncLoops = transport.syncLoops;
     if (syncLoops?.length) {
       for (const loop of syncLoops) void loop.run();
@@ -819,12 +1316,20 @@ async function startDaemon(opts = {}) {
     const token = process.env.ZOOID_TOKEN;
     if (!token) throw new Error("ZOOID_TOKEN is required for http transport");
     const app = createApp({ agents: registry, approvals, token });
-    server = serve({ fetch: app.fetch, port: http.transport.port, hostname: "0.0.0.0" });
+    server = serve({
+      fetch: app.fetch,
+      port: http.transport.port,
+      hostname: "0.0.0.0"
+    });
     port = await listenAsync(server);
   }
   const stop = async () => {
     if (stopped) return whenStopped;
     stopped = true;
+    try {
+      await triggers?.stop();
+    } catch {
+    }
     try {
       if (syncLoops) for (const loop of syncLoops) loop.stop();
     } catch {
@@ -839,9 +1344,7 @@ async function startDaemon(opts = {}) {
       console.error("stopAll:", err);
     }
     try {
-      if (contextSocket) await contextSocket.close();
-      await unlink(daemonSockPath).catch(() => {
-      });
+      await contextSockets.close();
     } catch {
     }
     resolveStopped();
@@ -901,13 +1404,13 @@ var TuwunelService = class {
     if (this.child && this.child.exitCode === null) {
       const child = this.child;
       child.kill("SIGTERM");
-      await new Promise((resolve8) => {
+      await new Promise((resolve9) => {
         let done = false;
         const finish = () => {
           if (done) return;
           done = true;
           clearTimeout(timer);
-          resolve8();
+          resolve9();
         };
         const timer = setTimeout(() => {
           try {
@@ -933,7 +1436,7 @@ var TuwunelService = class {
           `Tuwunel container exited before serving HTTP (exit=${state.exitCode}${state.error ? `, error=${state.error}` : ""}). Check the engine logs (\`${this.opts.engine} logs ${this.opts.name}\`).`
         );
       }
-      await new Promise((resolve8) => setTimeout(resolve8, 500));
+      await new Promise((resolve9) => setTimeout(resolve9, 500));
     }
     while (Date.now() < deadline) {
       try {
@@ -941,7 +1444,7 @@ var TuwunelService = class {
         if (r.ok) return;
       } catch {
       }
-      await new Promise((resolve8) => setTimeout(resolve8, 500));
+      await new Promise((resolve9) => setTimeout(resolve9, 500));
     }
     const finalState = await this.inspectState().catch(() => null);
     const detail = finalState ? ` (container status=${finalState.status}${finalState.exitCode !== void 0 ? `, exit=${finalState.exitCode}` : ""})` : "";
@@ -974,12 +1477,12 @@ var TuwunelService = class {
   }
 };
 function execEngine(engine, args) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn(engine, args, { stdio: "pipe" });
     let stderr = "";
     child.stderr.on("data", (b) => stderr += String(b));
     child.on("exit", (code) => {
-      if (code === 0) resolve8();
+      if (code === 0) resolve9();
       else reject(new Error(`${engine} ${args.join(" ")} failed: ${stderr.trim()}`));
     });
     child.on("error", reject);
@@ -987,20 +1490,20 @@ function execEngine(engine, args) {
 }
 
 // src/web/resolve.ts
-import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname3, join as join8, resolve as resolve2 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname4, join as join10, resolve as resolve3 } from "path";
 
 // src/web/fetch.ts
-import { mkdirSync as mkdirSync5, renameSync, rmSync, existsSync as existsSync2, readdirSync, writeFileSync as writeFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync7, renameSync as renameSync2, rmSync, existsSync as existsSync3, readdirSync, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
 import { createHash, randomUUID as randomUUID2 } from "crypto";
 import * as tar from "tar";
 var PKG = "@zooid/web";
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 async function fetchWebBundle(opts) {
-  const target = join7(opts.cacheDir, opts.version);
-  if (existsSync2(join7(target, "index.html"))) return target;
-  if (existsSync2(target)) rmSync(target, { recursive: true, force: true });
+  const target = join9(opts.cacheDir, opts.version);
+  if (existsSync3(join9(target, "index.html"))) return target;
+  if (existsSync3(target)) rmSync(target, { recursive: true, force: true });
   const f = opts.fetch ?? globalThis.fetch;
   const registry = (opts.registryUrl ?? DEFAULT_REGISTRY).replace(/\/$/, "");
   let tgz;
@@ -1027,11 +1530,11 @@ async function fetchWebBundle(opts) {
   Cause: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const tmp = join7(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
-  mkdirSync5(tmp, { recursive: true });
-  const tgzPath = join7(tmp, ".bundle.tgz");
+  const tmp = join9(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
+  mkdirSync7(tmp, { recursive: true });
+  const tgzPath = join9(tmp, ".bundle.tgz");
   try {
-    writeFileSync5(tgzPath, tgz);
+    writeFileSync7(tgzPath, tgz);
     await tar.extract({
       file: tgzPath,
       cwd: tmp,
@@ -1040,17 +1543,17 @@ async function fetchWebBundle(opts) {
       filter: (p) => p === "package/dist" || p.startsWith("package/dist/")
     });
     rmSync(tgzPath);
-    if (!existsSync2(join7(tmp, "index.html"))) {
+    if (!existsSync3(join9(tmp, "index.html"))) {
       throw new Error(`${PKG}@${opts.version} tarball has no dist/index.html`);
     }
-    renameSync(tmp, target);
+    renameSync2(tmp, target);
   } catch (err) {
     rmSync(tmp, { recursive: true, force: true });
     throw err;
   }
   for (const entry of readdirSync(opts.cacheDir)) {
     if (entry !== opts.version) {
-      rmSync(join7(opts.cacheDir, entry), { recursive: true, force: true });
+      rmSync(join9(opts.cacheDir, entry), { recursive: true, force: true });
     }
   }
   return target;
@@ -1060,10 +1563,10 @@ async function fetchWebBundle(opts) {
 var ENV_OVERRIDE = "ZOOID_DEV_WEB_ROOT_OVERRIDE";
 async function ensureWebRoot(opts) {
   const override = process.env[ENV_OVERRIDE];
-  if (override && existsSync3(join8(override, "index.html"))) return resolve2(override);
+  if (override && existsSync4(join10(override, "index.html"))) return resolve3(override);
   const fromSource = webSourcePackage(opts.cliRoot);
-  if (fromSource && existsSync3(join8(fromSource, "dist", "index.html"))) {
-    return join8(fromSource, "dist");
+  if (fromSource && existsSync4(join10(fromSource, "dist", "index.html"))) {
+    return join10(fromSource, "dist");
   }
   if (!opts.version) {
     throw new Error(
@@ -1076,17 +1579,17 @@ Set ${ENV_OVERRIDE} to a built dist, or run from the monorepo.`
   return fetchBundleFn({ version: opts.version, cacheDir: opts.cacheDir });
 }
 function webSourcePackage(cliRoot) {
-  const workspaceRoot = dirname3(dirname3(dirname3(cliRoot)));
-  const candidate = join8(workspaceRoot, "zooid-clients", "packages", "web");
-  return existsSync3(join8(candidate, "package.json")) ? candidate : null;
+  const workspaceRoot = dirname4(dirname4(dirname4(cliRoot)));
+  const candidate = join10(workspaceRoot, "zooid-clients", "packages", "web");
+  return existsSync4(join10(candidate, "package.json")) ? candidate : null;
 }
 
 // src/web/pin.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join11 } from "path";
 function readZoonWebPin(cliRoot) {
   try {
-    const pkg = JSON.parse(readFileSync5(join9(cliRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join11(cliRoot, "package.json"), "utf8"));
     return pkg.zooid?.webVersion;
   } catch {
     return void 0;
@@ -1094,8 +1597,8 @@ function readZoonWebPin(cliRoot) {
 }
 
 // src/web/static.ts
-import { readFileSync as readFileSync6, statSync } from "fs";
-import { extname, join as join10, normalize } from "path";
+import { readFileSync as readFileSync8, statSync } from "fs";
+import { extname, join as join12, normalize } from "path";
 import { Hono as Hono3 } from "hono";
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -1128,19 +1631,19 @@ function webStatic(opts) {
     const requested = decodeURIComponent(url.pathname);
     const wantFile = requested === "/" ? "/index.html" : requested;
     const safe = normalize(wantFile).replace(/^(\.\.[/\\])+/g, "");
-    const filePath = join10(opts.webRoot, safe);
+    const filePath = join12(opts.webRoot, safe);
     if (!filePath.startsWith(opts.webRoot)) return c.notFound();
     try {
       const stat = statSync(filePath);
       if (stat.isFile()) {
-        const body = readFileSync6(filePath);
+        const body = readFileSync8(filePath);
         const ct = MIME[extname(filePath)] ?? "application/octet-stream";
         return c.body(body, 200, { "content-type": ct });
       }
     } catch {
     }
     if (isAssetPath(requested)) return c.notFound();
-    const indexBytes = readFileSync6(join10(opts.webRoot, "index.html"));
+    const indexBytes = readFileSync8(join12(opts.webRoot, "index.html"));
     return c.body(indexBytes, 200, {
       "content-type": MIME[".html"]
     });
@@ -1150,11 +1653,11 @@ function webStatic(opts) {
 
 // src/web/watch.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
+import { join as join13 } from "path";
 async function startWebWatch(opts) {
-  const distPath = join11(opts.webPackageDir, "dist");
-  const indexPath = join11(distPath, "index.html");
+  const distPath = join13(opts.webPackageDir, "dist");
+  const indexPath = join13(distPath, "index.html");
   const timeoutMs = opts.firstBuildTimeoutMs ?? 6e4;
   const spawnTime = Date.now();
   const child = spawn2(
@@ -1188,7 +1691,7 @@ async function startWebWatch(opts) {
       attachStdio();
       throw new Error(`vite build --watch exited before first build (code ${child.exitCode})`);
     }
-    if (existsSync4(indexPath)) {
+    if (existsSync5(indexPath)) {
       const m = statSync2(indexPath).mtimeMs;
       if (m >= spawnTime - 500) return makeHandle();
     }
@@ -1208,12 +1711,12 @@ async function startWebWatch(opts) {
 async function stopChild(child) {
   if (child.exitCode !== null) return;
   child.kill("SIGTERM");
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     let done = false;
     const finish = () => {
       if (done) return;
       done = true;
-      resolve8();
+      resolve9();
     };
     child.once("exit", finish);
     setTimeout(() => {
@@ -1227,8 +1730,8 @@ async function stopChild(child) {
 }
 
 // src/observability/paths.ts
-import { mkdir as mkdir2, readdir, rm, symlink, unlink as unlink2 } from "fs/promises";
-import { join as join12 } from "path";
+import { mkdir as mkdir2, readdir, rm, symlink, unlink } from "fs/promises";
+import { join as join14 } from "path";
 function localDateSlug(d) {
   const y = d.getFullYear();
   const m = String(d.getMonth() + 1).padStart(2, "0");
@@ -1238,32 +1741,32 @@ function localDateSlug(d) {
 var DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
 function resolveLogPaths({ dataDir, now }) {
   const slug = localDateSlug(now ?? /* @__PURE__ */ new Date());
-  const logsDir = join12(dataDir, "logs");
-  const dayDir = join12(logsDir, slug);
+  const logsDir = join14(dataDir, "logs");
+  const dayDir = join14(logsDir, slug);
   return {
     dataDir,
     logsDir,
     dayDir,
     daySlug: slug,
-    todayLink: join12(logsDir, "today"),
-    tuwunelLog: join12(dayDir, "tuwunel.log"),
-    daemonLog: join12(dayDir, "daemon.log"),
-    devLog: join12(dayDir, "dev.log"),
-    agentLog: (n) => join12(dayDir, `agent-${n}.log`),
-    agentTap: (n) => join12(dayDir, `agent-${n}.acp.jsonl`)
+    todayLink: join14(logsDir, "today"),
+    tuwunelLog: join14(dayDir, "tuwunel.log"),
+    daemonLog: join14(dayDir, "daemon.log"),
+    devLog: join14(dayDir, "dev.log"),
+    agentLog: (n) => join14(dayDir, `agent-${n}.log`),
+    agentTap: (n) => join14(dayDir, `agent-${n}.acp.jsonl`)
   };
 }
 async function ensureDayFolder(p) {
   await mkdir2(p.dayDir, { recursive: true });
   try {
-    await unlink2(p.todayLink);
+    await unlink(p.todayLink);
   } catch {
   }
   await symlink(p.daySlug, p.todayLink);
 }
 async function pruneOldDays(opts) {
   if (opts.retainDays <= 0) return [];
-  const logsDir = join12(opts.dataDir, "logs");
+  const logsDir = join14(opts.dataDir, "logs");
   let entries;
   try {
     entries = await readdir(logsDir);
@@ -1282,7 +1785,7 @@ async function pruneOldDays(opts) {
     const [y, m, d] = name.split("-").map(Number);
     const t = new Date(y, m - 1, d).getTime();
     if (t < cutoff) {
-      await rm(join12(logsDir, name), { recursive: true, force: true });
+      await rm(join14(logsDir, name), { recursive: true, force: true });
       removed.push(name);
     }
   }
@@ -1292,14 +1795,14 @@ async function pruneOldDays(opts) {
 // src/observability/file-sink.ts
 import { createWriteStream } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 var TRUNC_MARKER = "\u2026[truncated]";
 var JsonlSink = class {
   constructor(path, opts = {}) {
     this.path = path;
     this.maxStringLen = opts.maxStringLen ?? 4096;
     this.readyPromise = (async () => {
-      await mkdir3(dirname4(this.path), { recursive: true });
+      await mkdir3(dirname5(this.path), { recursive: true });
       this.stream = createWriteStream(this.path, { flags: "a" });
     })();
   }
@@ -1311,14 +1814,14 @@ var JsonlSink = class {
     await this.readyPromise;
     const capped = capStrings(obj, this.maxStringLen);
     const line = JSON.stringify(capped) + "\n";
-    return new Promise((resolve8, reject) => {
-      this.stream.write(line, (err) => err ? reject(err) : resolve8());
+    return new Promise((resolve9, reject) => {
+      this.stream.write(line, (err) => err ? reject(err) : resolve9());
     });
   }
   async close() {
     await this.readyPromise;
-    return new Promise((resolve8) => {
-      this.stream.end(() => resolve8());
+    return new Promise((resolve9) => {
+      this.stream.end(() => resolve9());
     });
   }
 };
@@ -1386,15 +1889,15 @@ function wireAgentCapture(opts) {
 // src/observability/capture-tuwunel.ts
 import { createWriteStream as createWriteStream2 } from "fs";
 import { mkdir as mkdir4 } from "fs/promises";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 function captureChildToFile(child, path) {
   return (async () => {
-    await mkdir4(dirname5(path), { recursive: true });
+    await mkdir4(dirname6(path), { recursive: true });
     const stream = createWriteStream2(path, { flags: "a" });
     if (child.stdout) child.stdout.on("data", (b) => stream.write(b));
     if (child.stderr) child.stderr.on("data", (b) => stream.write(b));
-    await new Promise((resolve8) => {
-      child.on("exit", () => stream.end(() => resolve8()));
+    await new Promise((resolve9) => {
+      child.on("exit", () => stream.end(() => resolve9()));
     });
   })();
 }
@@ -1427,17 +1930,17 @@ function buildShutdown(layers) {
 
 // src/commands/dev.ts
 var CLI_ROOT = (() => {
-  let dir = dirname6(fileURLToPath(import.meta.url));
+  let dir = dirname7(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
-    const pkgPath = resolve3(dir, "package.json");
-    if (existsSync5(pkgPath)) {
+    const pkgPath = resolve4(dir, "package.json");
+    if (existsSync6(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
         if (pkg.name === "zooid" || pkg.name === "@zooid/cli") return dir;
       } catch {
       }
     }
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1448,15 +1951,15 @@ async function runDev(flags) {
   const found = findConfigFile(cwd);
   if (!found) throw new Error(`zooid.yaml not found in ${cwd}`);
   loadEnvFiles(cwd);
-  const dataRoot = resolve3(cwd, flags.dataDir);
+  const dataRoot = resolve4(cwd, flags.dataDir);
   const layout = resolveDataLayout(dataRoot);
   const paths = resolvePaths(layout.matrixDir);
   const logPaths = resolveLogPaths({ dataDir: layout.dataRoot });
   const tokens = ensureTokens(paths.envPath);
   process.env.MATRIX_AS_TOKEN = tokens.asToken;
   process.env.MATRIX_HS_TOKEN = tokens.hsToken;
-  const rawYaml = readFileSync7(found.path, "utf8");
-  const preview = loadZooidConfig(rawYaml, { configDir: dirname6(found.path) });
+  const rawYaml = readFileSync9(found.path, "utf8");
+  const preview = loadZooidConfig(rawYaml, { configDir: dirname7(found.path) });
   const matrix = findMatrixTransport(preview);
   if (!matrix) {
     throw new Error("zooid.yaml: zooid dev requires at least one matrix transport");
@@ -1551,9 +2054,9 @@ async function runDev(flags) {
         {
           title: "Start @zooid/web watcher (vite build --watch)",
           task: async () => {
-            const pkgDir = typeof flags.watchWeb === "string" ? resolve3(flags.watchWeb) : webSourcePackage(CLI_ROOT);
+            const pkgDir = typeof flags.watchWeb === "string" ? resolve4(flags.watchWeb) : webSourcePackage(CLI_ROOT);
             if (!pkgDir) {
-              const defaultPath = dirname6(dirname6(dirname6(CLI_ROOT))) + "/zooid-clients/packages/web";
+              const defaultPath = dirname7(dirname7(dirname7(CLI_ROOT))) + "/zooid-clients/packages/web";
               throw new Error(
                 `--watch-web: @zooid/web not found at ${defaultPath}.
 Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
@@ -1568,7 +2071,7 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
         task: async (_, t) => {
           const webRoot = ctx.webWatch?.distPath ?? await ensureWebRoot({
             cliRoot: CLI_ROOT,
-            cacheDir: join13(layout.dataRoot, "web"),
+            cacheDir: join15(layout.dataRoot, "web"),
             version: readZoonWebPin(CLI_ROOT),
             onProgress: (msg) => {
               t.output = msg;
@@ -1660,8 +2163,8 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
 }
 function loadEnvFiles(cwd) {
   for (const name of [".env.local", ".env"]) {
-    const path = resolve3(cwd, name);
-    if (!existsSync5(path)) continue;
+    const path = resolve4(cwd, name);
+    if (!existsSync6(path)) continue;
     try {
       process.loadEnvFile(path);
     } catch (err) {
@@ -1671,9 +2174,9 @@ function loadEnvFiles(cwd) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync8, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join15, resolve as resolve4 } from "path";
+import { dirname as dirname8, join as join17, resolve as resolve5 } from "path";
 
 // src/commands/init/generators.ts
 function generateZooidYaml(opts) {
@@ -1854,20 +2357,20 @@ function findPiProvider(id) {
 }
 
 // src/commands/init/sniff.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 import { homedir } from "os";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 function sniffCredentials(preset, home = homedir()) {
   const rel = preset === "pi" ? PI_AUTH_FILE : findSimplePreset(preset)?.credentialDir;
   if (!rel) return { found: false };
-  const full = join14(home, rel);
-  if (existsSync6(full)) return { found: true, path: full };
+  const full = join16(home, rel);
+  if (existsSync7(full)) return { found: true, path: full };
   return { found: false };
 }
 function sniffPiDefaults(home = homedir()) {
-  const source = join14(home, PI_SETTINGS_FILE);
+  const source = join16(home, PI_SETTINGS_FILE);
   try {
-    const raw = JSON.parse(readFileSync8(source, "utf8"));
+    const raw = JSON.parse(readFileSync10(source, "utf8"));
     const provider = raw.defaultProvider;
     const model = raw.defaultModel;
     if (typeof provider !== "string" || !provider) return void 0;
@@ -1891,8 +2394,8 @@ var IGNORED_PREEXISTING = /* @__PURE__ */ new Set([
   "yarn.lock"
 ]);
 async function runInit(opts) {
-  const dir = resolve4(opts.dir);
-  mkdirSync6(dir, { recursive: true });
+  const dir = resolve5(opts.dir);
+  mkdirSync8(dir, { recursive: true });
   if (!opts.force) {
     const blocking = readdirSync2(dir).filter((n) => !IGNORED_PREEXISTING.has(n));
     if (blocking.length > 0) {
@@ -1988,14 +2491,14 @@ async function runInit(opts) {
   }
   writes.push({ path: ".gitignore", content: generateGitignore() });
   for (const w of writes) {
-    const full = join15(dir, w.path);
-    const exists = existsSync7(full);
+    const full = join17(dir, w.path);
+    const exists = existsSync8(full);
     if (exists && !opts.overwrite) {
       console.warn(`\u26A0 ${w.path} exists; left as-is (use --force --overwrite to replace)`);
       continue;
     }
-    mkdirSync6(dirname7(full), { recursive: true });
-    writeFileSync6(full, w.content);
+    mkdirSync8(dirname8(full), { recursive: true });
+    writeFileSync8(full, w.content);
     console.log(`\u2713 Created ${w.path}`);
   }
   if ((opts.preset === "claude" || opts.preset === "codex") && opts.auth === "subscription") {
@@ -2020,10 +2523,10 @@ async function runInit(opts) {
     }
     const s = sniffCredentials("pi", opts.home);
     if (opts.auth === "subscription" && s.found) {
-      const authSource = join15(opts.home ?? homedir2(), PI_AUTH_FILE);
-      const linkPath = join15(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
-      if (!existsSync7(linkPath)) {
-        mkdirSync6(dirname7(linkPath), { recursive: true });
+      const authSource = join17(opts.home ?? homedir2(), PI_AUTH_FILE);
+      const linkPath = join17(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
+      if (!existsSync8(linkPath)) {
+        mkdirSync8(dirname8(linkPath), { recursive: true });
         symlinkSync(authSource, linkPath);
       }
       console.log(
@@ -2155,8 +2658,8 @@ async function resolveOptions(flags) {
 
 // src/commands/logs.ts
 import { readFile, readdir as readdir2, readlink } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { join as join18 } from "path";
 var KNOWN_SOURCES = ["tuwunel", "daemon", "dev"];
 async function runLogs(flags) {
   const writer = flags.writer ?? ((s) => process.stdout.write(s));
@@ -2175,8 +2678,8 @@ async function runLogs(flags) {
     writer("no logs yet\n");
     return;
   }
-  const dayDir = join16(flags.dataDir, "logs", day);
-  if (!existsSync8(dayDir)) {
+  const dayDir = join18(flags.dataDir, "logs", day);
+  if (!existsSync9(dayDir)) {
     writer(`no logs for ${day}
 `);
     return;
@@ -2196,7 +2699,7 @@ async function runLogs(flags) {
     return;
   }
   const path = resolveSourcePath(dayDir, flags.source);
-  if (!existsSync8(path)) {
+  if (!existsSync9(path)) {
     writer(`no such source: ${flags.source}
 `);
     return;
@@ -2204,7 +2707,7 @@ async function runLogs(flags) {
   writer(await readFile(path, "utf8"));
 }
 async function resolveTodaySlug(dataDir) {
-  const link = join16(dataDir, "logs", "today");
+  const link = join18(dataDir, "logs", "today");
   try {
     return await readlink(link);
   } catch {
@@ -2213,18 +2716,18 @@ async function resolveTodaySlug(dataDir) {
 }
 function resolveSourcePath(dayDir, source) {
   if (source.startsWith("agent-")) {
-    if (source.endsWith(".acp")) return join16(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
-    return join16(dayDir, `${source}.log`);
+    if (source.endsWith(".acp")) return join18(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
+    return join18(dayDir, `${source}.log`);
   }
   if (KNOWN_SOURCES.includes(source))
-    return join16(dayDir, `${source}.log`);
-  return join16(dayDir, source);
+    return join18(dayDir, `${source}.log`);
+  return join18(dayDir, source);
 }
 async function dumpByTurn(dayDir, turnId, writer) {
   const entries = await readdir2(dayDir);
   const taps = entries.filter((e) => e.endsWith(".acp.jsonl")).sort();
   for (const f of taps) {
-    const text = await readFile(join16(dayDir, f), "utf8");
+    const text = await readFile(join18(dayDir, f), "utf8");
     for (const line of text.split("\n")) {
       if (!line) continue;
       try {
@@ -2238,14 +2741,14 @@ async function dumpByTurn(dayDir, turnId, writer) {
 
 // src/commands/start.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 async function runStart(flags) {
   if (flags.printToken) {
     process.stdout.write(`${randomBytes2(32).toString("hex")}
 `);
     return;
   }
-  const dataRoot = resolve5(process.cwd(), flags.dataDir ?? "./data");
+  const dataRoot = resolve6(process.cwd(), flags.dataDir ?? "./data");
   const layout = resolveDataLayout(dataRoot);
   const handle = await startDaemon({
     cliFlags: flags,
@@ -2258,12 +2761,12 @@ async function runStart(flags) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname8, join as join17, resolve as resolve6 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname9, join as join19, resolve as resolve7 } from "path";
 import chalk2 from "chalk";
 function readVapidPublicKey(dataDir) {
   try {
-    const parsed = JSON.parse(readFileSync9(join17(dataDir, VAPID_FILENAME), "utf8"));
+    const parsed = JSON.parse(readFileSync11(join19(dataDir, VAPID_FILENAME), "utf8"));
     return typeof parsed.publicKey === "string" ? parsed.publicKey : void 0;
   } catch {
     return void 0;
@@ -2293,8 +2796,8 @@ async function collectStatus(opts) {
       ...vapidPublicKey ? { vapidPublicKey } : {}
     };
   }
-  const cfg = loadZooidConfig(readFileSync9(found.path, "utf8"), {
-    configDir: dirname8(found.path)
+  const cfg = loadZooidConfig(readFileSync11(found.path, "utf8"), {
+    configDir: dirname9(found.path)
   });
   const matrixEntry = Object.entries(cfg.transports).find(
     ([, t]) => t.type === "matrix"
@@ -2325,8 +2828,8 @@ async function runStatus(flags) {
   if (port === void 0) {
     const found = findConfigFile(cwd);
     if (found) {
-      const cfg = loadZooidConfig(readFileSync9(found.path, "utf8"), {
-        configDir: dirname8(found.path)
+      const cfg = loadZooidConfig(readFileSync11(found.path, "utf8"), {
+        configDir: dirname9(found.path)
       });
       const matrix = findMatrixTransport(cfg);
       if (matrix) {
@@ -2336,7 +2839,7 @@ async function runStatus(flags) {
     }
   }
   const tuwunelUrl = `http://localhost:${port ?? 8448}`;
-  const dataDir = resolve6(cwd, flags.dataDir ?? "./data");
+  const dataDir = resolve7(cwd, flags.dataDir ?? "./data");
   const s = await collectStatus({ cwd, tuwunelUrl, dataDir });
   const fmt = (st) => st === "up" ? chalk2.green("up") : st === "down" ? chalk2.red("down") : chalk2.yellow("unknown");
   process.stdout.write(
@@ -2353,11 +2856,11 @@ async function runStatus(flags) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 function readCliVersion(url = import.meta.url) {
   try {
     const manifest = new URL("../package.json", url);
-    const raw = JSON.parse(readFileSync10(manifest, "utf8"));
+    const raw = JSON.parse(readFileSync12(manifest, "utf8"));
     if (typeof raw.version === "string" && raw.version) return raw.version;
     return "unknown";
   } catch {
@@ -2395,14 +2898,14 @@ cli.command(
 ).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).example("$ zooid logs daemon").example("$ zooid logs agent-support.acp --turn 3f9c1a --day 2026-09-06").example("$ zooid logs prune --keep 7").action(async (source, flags) => {
   if (source === "prune") {
     await runLogs({
-      dataDir: resolve7(process.cwd(), flags.data),
+      dataDir: resolve8(process.cwd(), flags.data),
       subcommand: "prune",
       keep: Number(flags.keep)
     });
     return;
   }
   await runLogs({
-    dataDir: resolve7(process.cwd(), flags.data),
+    dataDir: resolve8(process.cwd(), flags.data),
     source,
     day: flags.day,
     turn: flags.turn,