@corenel/cli 0.1.1 → 0.2.1

package/dist/cli.js

@@ -1500,7 +1500,7 @@ var require_stringify = __commonJS({
         props.push(doc.directives.tagString(tag));
       return props.join(" ");
     }
-    function stringify2(item, ctx, onComment, onChompKeep) {
+    function stringify3(item, ctx, onComment, onChompKeep) {
       if (identity.isPair(item))
         return item.toString(ctx, onComment, onChompKeep);
       if (identity.isAlias(item)) {
@@ -1529,7 +1529,7 @@ var require_stringify = __commonJS({
 ${ctx.indent}${str5}`;
     }
     exports.createStringifyContext = createStringifyContext;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -1539,7 +1539,7 @@ var require_stringifyPair = __commonJS({
     "use strict";
     var identity = require_identity();
     var Scalar = require_Scalar();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -1561,7 +1561,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str5 = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str5 = stringify3.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str5.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1613,7 +1613,7 @@ ${indent}:`;
         ctx.indent = ctx.indent.substring(2);
       }
       let valueCommentDone = false;
-      const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+      const valueStr = stringify3.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
       let ws = " ";
       if (keyComment || vsb || vcb) {
         ws = vsb ? "\n" : "";
@@ -1754,7 +1754,7 @@ var require_addPairToJSMap = __commonJS({
     "use strict";
     var log = require_log();
     var merge = require_merge();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
     function addPairToJSMap(ctx, map, { key, value }) {
@@ -1790,7 +1790,7 @@ var require_addPairToJSMap = __commonJS({
       if (typeof jsKey !== "object")
         return String(jsKey);
       if (identity.isNode(key) && ctx?.doc) {
-        const strCtx = stringify2.createStringifyContext(ctx.doc, {});
+        const strCtx = stringify3.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
@@ -1857,12 +1857,12 @@ var require_stringifyCollection = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyCollection.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyCollection(collection, ctx, options) {
       const flow = ctx.inFlow ?? collection.flow;
-      const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-      return stringify3(collection, ctx, options);
+      const stringify4 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+      return stringify4(collection, ctx, options);
     }
     function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
       const { indent, options: { commentString } } = ctx;
@@ -1887,7 +1887,7 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str6 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str6 = stringify3.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
           str6 += stringifyComment.lineComment(str6, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
@@ -1954,7 +1954,7 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str5 = stringify2.stringify(item, itemCtx, () => comment = null);
+        let str5 = stringify3.stringify(item, itemCtx, () => comment = null);
         reqNewline || (reqNewline = lines.length > linesAtValue || str5.includes("\n"));
         if (i < items.length - 1) {
           str5 += ",";
@@ -3315,7 +3315,7 @@ var require_stringifyDocument = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyDocument.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyDocument(doc, options) {
       const lines = [];
@@ -3330,7 +3330,7 @@ var require_stringifyDocument = __commonJS({
       }
       if (hasDirectives)
         lines.push("---");
-      const ctx = stringify2.createStringifyContext(doc, options);
+      const ctx = stringify3.createStringifyContext(doc, options);
       const { commentString } = ctx.options;
       if (doc.commentBefore) {
         if (lines.length !== 1)
@@ -3352,7 +3352,7 @@ var require_stringifyDocument = __commonJS({
           contentComment = doc.contents.comment;
         }
         const onChompKeep = contentComment ? void 0 : () => chompKeep = true;
-        let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+        let body = stringify3.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
         if (contentComment)
           body += stringifyComment.lineComment(body, "", commentString(contentComment));
         if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -3360,7 +3360,7 @@ var require_stringifyDocument = __commonJS({
         } else
           lines.push(body);
       } else {
-        lines.push(stringify2.stringify(doc.contents, ctx));
+        lines.push(stringify3.stringify(doc.contents, ctx));
       }
       if (doc.directives?.docEnd) {
         if (doc.comment) {
@@ -5490,7 +5490,7 @@ var require_cst_scalar = __commonJS({
 var require_cst_stringify = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/parse/cst-stringify.js"(exports) {
     "use strict";
-    var stringify2 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
+    var stringify3 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
     function stringifyToken(token) {
       switch (token.type) {
         case "block-scalar": {
@@ -5543,7 +5543,7 @@ var require_cst_stringify = __commonJS({
         res += stringifyToken(value);
       return res;
     }
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -7245,7 +7245,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse2(src, reviver, options) {
+    function parse3(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7264,7 +7264,7 @@ var require_public_api = __commonJS({
       }
       return doc.toJS(Object.assign({ reviver: _reviver }, options));
     }
-    function stringify2(value, replacer, options) {
+    function stringify3(value, replacer, options) {
       let _replacer = null;
       if (typeof replacer === "function" || Array.isArray(replacer)) {
         _replacer = replacer;
@@ -7286,10 +7286,10 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse2;
+    exports.parse = parse3;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument;
-    exports.stringify = stringify2;
+    exports.stringify = stringify3;
   }
 });
 
@@ -7812,7 +7812,7 @@ var require_parse = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/parse.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = (version, options, throwErrors = false) => {
+    var parse3 = (version, options, throwErrors = false) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -7825,7 +7825,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module.exports = parse2;
+    module.exports = parse3;
   }
 });
 
@@ -7833,9 +7833,9 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/valid.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var valid = (version, options) => {
-      const v = parse2(version, options);
+      const v = parse3(version, options);
       return v ? v.version : null;
     };
     module.exports = valid;
@@ -7846,9 +7846,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var clean = (version, options) => {
-      const s = parse2(version.trim().replace(/^[=v]+/, ""), options);
+      const s = parse3(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module.exports = clean;
@@ -7883,10 +7883,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/diff.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var diff = (version1, version2) => {
-      const v1 = parse2(version1, null, true);
-      const v2 = parse2(version2, null, true);
+      const v1 = parse3(version1, null, true);
+      const v2 = parse3(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -7957,9 +7957,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/prerelease.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var prerelease = (version, options) => {
-      const parsed = parse2(version, options);
+      const parsed = parse3(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module.exports = prerelease;
@@ -8145,7 +8145,7 @@ var require_coerce = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/coerce.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var { safeRe: re, t } = require_re();
     var coerce = (version, options) => {
       if (version instanceof SemVer) {
@@ -8180,7 +8180,7 @@ var require_coerce = __commonJS({
       const patch = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse2(`${major}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse3(`${major}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module.exports = coerce;
   }
@@ -8190,7 +8190,7 @@ var require_coerce = __commonJS({
 var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var constants = require_constants();
     var SemVer = require_semver();
     var truncate = (version, truncation, options) => {
@@ -8202,7 +8202,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version, options) => {
       const versionStringToParse = version instanceof SemVer ? version.version : version;
-      return parse2(versionStringToParse, options);
+      return parse3(versionStringToParse, options);
     };
     var doTruncation = (version, truncation) => {
       if (isPrerelease(truncation)) {
@@ -9244,7 +9244,7 @@ var require_semver2 = __commonJS({
     var constants = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse2 = require_parse();
+    var parse3 = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -9283,7 +9283,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module.exports = {
-      parse: parse2,
+      parse: parse3,
       valid,
       clean,
       inc,
@@ -11670,7 +11670,7 @@ var require_parser2 = __commonJS({
         }
         return buf;
       };
-      _proto.parse = function parse2() {
+      _proto.parse = function parse3() {
         return new nodes.NodeList(0, 0, this.parseNodes());
       };
       _proto.parseAsRoot = function parseAsRoot() {
@@ -11679,7 +11679,7 @@ var require_parser2 = __commonJS({
       return Parser2;
     }(Obj);
     module.exports = {
-      parse: function parse2(src, extensions, opts) {
+      parse: function parse3(src, extensions, opts) {
         var p = new Parser(lexer.lex(src, opts));
         if (extensions !== void 0) {
           p.extensions = extensions;
@@ -15074,10 +15074,21 @@ async function streamCompletion(client, params, signal, onText) {
         messages: params.messages,
         tools: params.tools,
         tool_choice: params.tool_choice,
+        // Undefined is dropped by the SDK's JSON serialization, so an unset cap
+        // leaves output unbounded (unchanged behavior).
+        max_completion_tokens: params.max_completion_tokens,
+        // Undefined is dropped by the SDK, so an unset temperature leaves the
+        // provider default in place (unchanged behavior).
+        temperature: params.temperature,
         stream: true,
         stream_options: { include_usage: true }
       },
-      { signal }
+      // The agent loop (loop.ts) is the SOLE retry authority — it owns the bounded
+      // backoff retry for transient failures. Disable the OpenAI SDK's own retries
+      // (default 2) so they don't MULTIPLY with the loop's: a gateway timeout was
+      // being retried SDK(1+2) x loop(1+3) = ~12 times, turning one 300s timeout
+      // into ~12 minutes of dead attempts.
+      { signal, maxRetries: 0 }
     );
   } catch (e) {
     const err = e;
@@ -15119,7 +15130,7 @@ async function streamCompletion(client, params, signal, onText) {
   alog("stream:end", { chunks: chunkN, contentLen: content.length, toolCalls: toolCalls.length, finishReason, usage });
   return { content, toolCalls, usage, finishReason };
 }
-function createChatClient(auth) {
+function createChatClient(auth, opts = {}) {
   return new OpenAI({
     baseURL: gatewayBaseURL(),
     // Real key lives server-side; this placeholder is replaced per-request by the
@@ -15132,6 +15143,7 @@ function createChatClient(auth) {
       const token = await auth.getToken().catch(() => null);
       if (token) headers.set("Authorization", `Bearer ${token}`);
       else headers.delete("Authorization");
+      if (opts.origin) headers.set("X-Prompd-Origin", opts.origin);
       alog("gateway:fetch", { url: String(url), hasToken: !!token });
       try {
         const res = await fetch(url, { ...init, headers });
@@ -15163,6 +15175,7 @@ function statusOf(message) {
 }
 function classifyStreamError(message, status) {
   if (/\baborted\b|AbortError/i.test(message)) return "fatal";
+  if (/\b(timed out|request timeout|gateway timeout|deadline exceeded)\b/i.test(message)) return "fatal";
   const code = status ?? statusOf(message);
   if (code != null) {
     if (FATAL_STATUS.has(code)) return "fatal";
@@ -15370,7 +15383,25 @@ var BUILTIN_NAMESPACES = {
   ask_user: "agent",
   spawn_agent: "agent",
   spawn_agents: "agent",
-  todo_write: "agent"
+  todo_write: "agent",
+  // Named here as a backstop; the sidecar's own decls also carry `namespace`,
+  // and an explicit field always wins (resolveNamespace). Both say the same
+  // thing so a sidecar that predates this still lands in the right namespace.
+  sidecar_fs_read_file: "sidecar",
+  sidecar_fs_write_file: "sidecar",
+  sidecar_fs_read_bytes: "sidecar",
+  sidecar_fs_list_dir: "sidecar",
+  sidecar_fs_delete: "sidecar",
+  sidecar_shell_exec: "sidecar",
+  // Host-side orchestration tools. They are not in allTools() - they reach the
+  // agent as remote decls (workerFactory) - but they are still governed by the
+  // policy, so they need a canonical address like everything else.
+  create_strategy: "agent",
+  edit_strategy: "agent",
+  view_strategy: "agent",
+  run_strategy: "agent",
+  list_strategies: "agent",
+  list_saved_strategies: "agent"
 };
 function resolveNamespace(tool) {
   if (tool.namespace) return tool.namespace;
@@ -15390,6 +15421,14 @@ function toolAddress(tool) {
     const m = new RegExp(`^${ns}__?`).exec(leaf);
     if (m) leaf = leaf.slice(m[0].length);
   }
+  if (ns === "sidecar") {
+    for (const p of ["sidecar_fs_", "sidecar_"]) {
+      if (leaf.startsWith(p)) {
+        leaf = leaf.slice(p.length);
+        break;
+      }
+    }
+  }
   return `${ns}:${leaf}`;
 }
 
@@ -15408,6 +15447,16 @@ function formatOffloadRef(ref) {
 ${ref.preview}${ref.bytes > ref.preview.length ? "\n\u2026(truncated)" : ""}` : head;
 }
 
+// ../harness/prompts/toolsMarker.ts
+var TOOLS_MARKER = "\uE000PROMPD_TOOLS\uE000";
+function formatToolLines(tools) {
+  return tools.map((t) => `- \`${t.name}\`: ${t.description}`).join("\n");
+}
+function fillToolsMarker(system, tools) {
+  if (!system.includes(TOOLS_MARKER)) return system;
+  return system.replaceAll(TOOLS_MARKER, tools.length ? formatToolLines(tools) : "(no tools available this run)");
+}
+
 // ../harness/core/loop.ts
 async function runAgent(args) {
   const { client, system, tools, toolCtx } = args;
@@ -15423,8 +15472,9 @@ async function runAgent(args) {
   const recovery = resolveRecovery(args.recovery);
   const toolFails = new ToolFailureTracker();
   const messages = [...args.messages];
-  if (system && !messages.some((m) => m.role === "system")) {
-    messages.unshift({ role: "system", content: system });
+  const filledSystem = system ? fillToolsMarker(system, tools) : system;
+  if (filledSystem && !messages.some((m) => m.role === "system")) {
+    messages.unshift({ role: "system", content: filledSystem });
   }
   const toolDefs = tools.map((t) => ({
     type: "function",
@@ -15462,7 +15512,9 @@ async function runAgent(args) {
             model,
             messages,
             tools: toolDefs.length ? toolDefs : void 0,
-            tool_choice: toolDefs.length ? "auto" : void 0
+            tool_choice: toolDefs.length ? "auto" : void 0,
+            max_completion_tokens: args.maxCompletionTokens,
+            temperature: args.temperature
           },
           signal,
           (delta) => emit({ type: "assistant-delta", delta })
@@ -15910,6 +15962,18 @@ var todoWriteTool = {
   name: "todo_write",
   noOffload: true,
   // the task list is what the user wants to see — keep it inline
+  /* DECLARED, not left to the policy's default. It is a write in name only: it
+   * touches no file, no network and no state outside the run's own task panel,
+   * so there is nothing for a person to approve. Without this it inherited
+   * `policy.defaultPermission` — `ask` under any careful policy — and an agent
+   * doing multi-step work stopped to request approval every time it ticked off a
+   * step, which trains people to approve without reading.
+   *
+   * `permission` sits BELOW an explicit `policy.permissions` entry in the
+   * precedence chain (permission-service.ts), so anyone who genuinely wants to
+   * gate it still can; it only replaces the blanket default. And it is not
+   * `mutates`, so a policy's mutating backstop correctly does not catch it. */
+  permission: "allow",
   description: 'Maintain a visible task list for a multi-step job. Pass the COMPLETE list each time (a rewrite). Keep exactly one task "in_progress" while you work it; mark tasks "completed" as you finish; use "blocked" + blockedBy for tasks waiting on others; nest a subtask one level with parentId. Reuse a short stable id per task across updates so its progress and activity persist. Call it when you start a multi-step task and after each meaningful step.',
   parameters: {
     type: "object",
@@ -16103,17 +16167,29 @@ async function prmdCompileError(content, ctx) {
 }
 var proposeEditTool = {
   name: "propose_edit",
-  description: "Propose a replacement for the current editor file. The user reviews a diff and applies or rejects it \u2014 this does NOT write the file directly. Provide the COMPLETE new file content (not a patch) plus a short explanation. Use the editor file shown in the system context as the basis. This call WAITS for the review and returns the outcome: applied, partially applied (with the rejected changes), or rejected \u2014 rely on that outcome, not on the proposal, for any follow-up work.",
+  description: "Propose a replacement for the CURRENTLY OPEN editor file. It takes no path and can only ever replace that one file, so never use it to create a new file or to edit a different one \u2014 use create_file or write_file for those. The user reviews a diff and applies or rejects it \u2014 this does NOT write the file directly. Provide the COMPLETE new file content (not a patch) plus a short explanation. Use the editor file shown in the system context as the basis. This call WAITS for the review and returns the outcome: applied, partially applied (with the rejected changes), or rejected \u2014 rely on that outcome, not on the proposal, for any follow-up work.",
   parameters: {
     type: "object",
     properties: {
       explanation: { type: "string", description: "One line describing the change." },
-      new_content: { type: "string", description: "The full proposed file content." }
+      new_content: { type: "string", description: "The full proposed file content." },
+      path: { type: "string", description: "The file being replaced. Must be the file currently open in the editor." }
     },
-    required: ["explanation", "new_content"]
+    required: ["explanation", "new_content", "path"]
   },
   async run(args, ctx) {
     const explanation = str4(args, "explanation") || "Proposed an edit";
+    if (!ctx.editorFile) {
+      return "Cannot propose an edit: no file is open in the editor, and propose_edit only replaces the open file. To create a new file use create_file, and to overwrite an existing one use write_file \u2014 both take an explicit path.";
+    }
+    const target = str4(args, "path");
+    if (!target) {
+      return `Cannot propose an edit: propose_edit needs a path, and it must be the open file (${ctx.editorFile}). To create a new file use create_file, or to overwrite a different one use write_file.`;
+    }
+    const norm = (p) => p.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (norm(target) !== norm(ctx.editorFile)) {
+      return `Cannot propose an edit: the open file is ${ctx.editorFile}, but this proposal targets ${target}. propose_edit can only replace the open file. Use create_file for a new file, or write_file to overwrite a different one.`;
+    }
     if (!ctx.reviewEdit || !ctx.callId) {
       return `Proposed an edit: ${explanation}. Awaiting the user's review (apply/reject).`;
     }
@@ -16147,21 +16223,23 @@ Respect the rejection \u2014 do not re-propose those changes unless the user ask
 var saveMemoryTool = {
   name: "save_memory",
   mutates: true,
-  description: "Persist a durable note to memory for later recall (facts, user preferences, decisions).",
+  description: 'Persist a durable note to memory for later recall (facts, user preferences, decisions). Choose scope: "workspace" for facts specific to the current project, "global" for facts about the user or their preferences that apply everywhere.',
   parameters: {
     type: "object",
     properties: {
       text: { type: "string", description: "The note to remember." },
+      scope: { type: "string", enum: ["workspace", "global"], description: "Where to store it: workspace (this project) or global (everywhere)." },
       tags: { type: "array", items: { type: "string" }, description: "Optional tags." }
     },
-    required: ["text"]
+    required: ["text", "scope"]
   },
   // Permission is gated centrally by the loop's policy/permission layer (this
   // tool is `mutates`), so no confirm call here.
   async run(args, ctx) {
     const text = str4(args, "text");
     const tags = Array.isArray(args.tags) ? args.tags.map(String) : [];
-    const item = await ctx.memory.save(text, tags);
+    const scope = args.scope === "global" ? "global" : "workspace";
+    const item = await ctx.memory.save(text, tags, scope);
     return `Saved memory ${item.id}.`;
   }
 };
@@ -16208,6 +16286,19 @@ var recallResultTool = {
   name: "recall_result",
   noOffload: true,
   // recalling a large result must never re-offload itself
+  /* DECLARED, like todo_write's and ask_user's. This one grants no new access at
+   * all: it reads back a tool result THIS SESSION ALREADY PRODUCED, which means
+   * the original call already passed the policy check that produced it. The
+   * store is session-scoped (`<root>/<sessionId>/blobs/<id>.json`) and the id
+   * shape is validated, so it cannot reach another session's data or escape the
+   * directory.
+   *
+   * The deciding argument is that offloading is a CONTEXT-MANAGEMENT detail,
+   * triggered by size. Gating recall means the same information costs an
+   * approval prompt depending on how large it happened to be - a performance
+   * heuristic leaking into governance, and an approval the user cannot act on
+   * meaningfully because they already approved the thing that produced it. */
+  permission: "allow",
   description: 'Fetch the full content of a tool result that was offloaded to save context. You saw an "[offloaded tool result \u2026 recall_result({ id })]" reference \u2014 pass that id.',
   parameters: {
     type: "object",
@@ -16223,6 +16314,21 @@ var recallResultTool = {
 var askUserTool = {
   name: "ask_user",
   noOffload: true,
+  /* DECLARED, like todo_write's. Gating this behind an approval prompt is asking
+   * the user for permission to ask the user a question — two dialogs for one
+   * decision, the first of which carries no information.
+   *
+   * It changes nothing outside the run: no file, no network, no state. Its whole
+   * effect is to put a question in front of a person who is already there.
+   *
+   * Nothing depended on its previous `ask` tier. The case that looks like it
+   * might — an unattended run parking forever on a question nobody will answer —
+   * is handled by EXCLUSION rather than by permission: CREW_EXCLUDED_TOOLS drops
+   * ask_user from every crew agent (see @corenel/crew's capabilities.ts), and the
+   * daemon's executor honours the same set. On a surface where it IS offered,
+   * someone is by definition attending. And with no `ask` handler wired, `run`
+   * already returns "unavailable in this environment" rather than hanging. */
+  permission: "allow",
   description: "Ask the user one or more questions when you need a decision you cannot make from context \u2014 to choose between approaches, get a missing requirement, or confirm direction. Prefer this over guessing. Give each question a short `header` (a chip label), the `question` text, and 2\u20134 distinct `options` (each with a label and an optional one-line description of the trade-off). Set `multiSelect: true` when more than one option may apply. The user can also type a custom answer. Returns the chosen answers per question.",
   parameters: {
     type: "object",
@@ -16349,6 +16455,24 @@ Error: ${String(e?.message || e)}`;
     return results.join("\n\n");
   }
 };
+var listToolsTool = {
+  name: "list_tools",
+  noOffload: true,
+  description: "List the tools available to you this run \u2014 their names, one-line descriptions, and top-level parameters. Use this to discover what you can call (including any MCP or connected-host tools) before deciding how to act.",
+  parameters: { type: "object", properties: {} },
+  async run(_args, ctx) {
+    if (!ctx.listTools) return "Tool discovery is not available here.";
+    const tools = ctx.listTools();
+    if (!tools.length) return "No tools are available this run.";
+    const lines = tools.map((t) => {
+      const props = t.parameters && typeof t.parameters === "object" ? Object.keys(t.parameters.properties ?? {}) : [];
+      const params = props.length ? ` \u2014 params: ${props.join(", ")}` : "";
+      return `- \`${t.name}\`: ${t.description}${params}`;
+    });
+    return `Available tools this run (${tools.length}):
+${lines.join("\n")}`;
+  }
+};
 var compilePrompdTool = {
   name: "compile_prompd",
   noOffload: true,
@@ -16383,6 +16507,7 @@ var defaultTools = [
   askUserTool,
   spawnAgentTool,
   spawnAgentsTool,
+  listToolsTool,
   proposeEditTool,
   saveMemoryTool,
   recallMemoryTool,
@@ -16414,7 +16539,7 @@ function configWorkspace() {
 
 // ../harness/prompts/library/defaults.generated.ts
 var RAW_DEFAULTS = {
-  "prompts/help-system.md": '---\nid: help-system\nname: Help assistant\nversion: 1.0.0\ndescription: System prompt for the isolated in-app help chat. Compiled with the site index injected.\nparameters:\n  - name: app_index\n    type: string\n    description: The compiled site index describing the app\'s structure.\n    default: ""\n  - name: recent_summary\n    type: string\n    description: A summary of the earlier conversation when a new session was started.\n    default: ""\n---\nYou are the **Prompd Help** assistant \u2014 a friendly in-app guide embedded in the Prompd web editor. Your only job is to help the user understand and navigate THIS app. You are not a general chatbot and you do not write or edit their prompts (the editor\'s Assistant does that).\n\nHow to help:\n- Answer from the SITE INDEX below. Tell the user exactly where a thing is and how to get to it ("Settings \u2192 Appearance", "the Build button in the Editor panel header", "the layout presets in the top bar").\n- When pointing at a route, link it in markdown so it\'s clickable: `[Editor](/editor)`, `[Workflows](/workflows)`. For buttons/panels that aren\'t routes, name their location precisely instead of inventing a link.\n- You can DO things, not just describe them. For any action in the "Actions you can trigger" list, write a link as `[label](prompd:<id>)` (e.g. `[create a new file](prompd:new-file)`, `[switch to Chat layout](prompd:layout-chat)`). Clicking it performs the action in the app. Offer an action link whenever the user wants to *do* the thing.\n- For multi-step tasks, follow the matching "How-to flow": give the numbered steps, and turn each step that has an action into a `prompd:<id>` link so the user can jump straight there. Lead with the action link, then the remaining steps.\n- Only use action ids and route paths that appear in the index \u2014 never invent a `prompd:` id.\n- Be concise and concrete. Lead with the answer. Use short steps or a tight list when there are multiple actions.\n- If something isn\'t in the index, say you\'re not sure rather than inventing UI that may not exist.\n- Keep a warm, plain tone. No filler, no preamble.\n\n{% if recent_summary %}\nEarlier in this conversation (summarized, because a new session was started):\n{{ recent_summary }}\n{% endif %}\n\n--- SITE INDEX ---\n{{ app_index }}\n',
+  "systems/help-system.md": '---\nid: help-system\nname: Help assistant\nversion: 1.0.0\ndescription: System prompt for the isolated in-app help chat. Compiled with the site index injected.\nparameters:\n  - name: app_index\n    type: string\n    description: The compiled site index describing the app\'s structure.\n    default: ""\n  - name: recent_summary\n    type: string\n    description: A summary of the earlier conversation when a new session was started.\n    default: ""\n---\nYou are the **Prompd Help** assistant \u2014 a friendly in-app guide embedded in the Prompd web editor. Your only job is to help the user understand and navigate THIS app. You are not a general chatbot and you do not write or edit their prompts (the editor\'s Assistant does that).\n\nHow to help:\n- Answer from the SITE INDEX below. Tell the user exactly where a thing is and how to get to it ("Settings \u2192 Appearance", "the Build button in the Editor panel header", "the layout presets in the top bar").\n- When pointing at a route, link it in markdown so it\'s clickable: `[Editor](/editor)`, `[Workflows](/workflows)`. For buttons/panels that aren\'t routes, name their location precisely instead of inventing a link.\n- You can DO things, not just describe them. For any action in the "Actions you can trigger" list, write a link as `[label](prompd:<id>)` (e.g. `[create a new file](prompd:new-file)`, `[switch to Chat layout](prompd:layout-chat)`). Clicking it performs the action in the app. Offer an action link whenever the user wants to *do* the thing.\n- For multi-step tasks, follow the matching "How-to flow": give the numbered steps, and turn each step that has an action into a `prompd:<id>` link so the user can jump straight there. Lead with the action link, then the remaining steps.\n- Only use action ids and route paths that appear in the index \u2014 never invent a `prompd:` id.\n- Be concise and concrete. Lead with the answer. Use short steps or a tight list when there are multiple actions.\n- If something isn\'t in the index, say you\'re not sure rather than inventing UI that may not exist.\n- Keep a warm, plain tone. No filler, no preamble.\n\n{% if recent_summary %}\nEarlier in this conversation (summarized, because a new session was started):\n{{ recent_summary }}\n{% endif %}\n\n--- SITE INDEX ---\n{{ app_index }}\n',
   "tools/guidance.md": '<!--\nTool Guidance \u2014 use this to steer tool usage, e.g. "Prefer searching the registry\nfor relevant packages over guessing which tools to use." Anything outside this\ncomment is added to the system prompt; the comment itself is stripped.\n-->\n',
   "editor/inline-assist.prmd": `---
 id: inline-assist
@@ -16496,7 +16621,64 @@ Add a constraint :: Add a constraint or rule to the prompt instructions (what to
   "personas/senior-architect.md": "---\nid: senior-architect\nname: Senior architect\ndescription: Shapes systems and tradeoffs.\n---\nYou are a senior software architect. You shape systems before code is written and keep them coherent as they grow.\n- Understand before designing. Map the existing architecture, data flow, and constraints; reuse and extend established patterns before introducing new ones.\n- Design for the real requirement, not an imagined one. Prefer the simplest structure that meets today's need with a clear seam for tomorrow's. Avoid speculative abstraction (YAGNI).\n- Make boundaries explicit. Define interfaces, contracts, and ownership; keep coupling low and cohesion high; isolate the decisions most likely to change behind stable seams.\n- Name the tradeoffs. For any consequential choice, lay out the options, what each costs, and why you'd pick one. Surface assumptions and risks plainly.\n- Sequence the work into safe, shippable steps with reversible checkpoints; call out what must land first.\n- Stay grounded in the actual codebase and conventions. When uncertain, say so and propose how to de-risk it.\n",
   "personas/senior-dev.md": "---\nid: senior-dev\nname: Senior engineer\ndescription: Senior software engineer.\n---\nYou are a senior software engineer. Bring that craft to every change:\n- Fit the codebase. Study neighboring code and follow its conventions before writing. Don't assume a library is available \u2014 confirm it's already used in the project before depending on it.\n- Write the minimum that solves the task. No speculative abstractions, options, or features for hypothetical futures; three similar lines beat a premature abstraction. No half-finished or stubbed implementations.\n- Don't add error handling, validation, or fallbacks for cases that can't happen. Trust internal guarantees; validate only at real boundaries (user input, external systems). No backwards-compat shims unless asked.\n- Comments are for the non-obvious WHY \u2014 a constraint, an invariant, a workaround. Don't narrate what the code already says; default to none.\n- Verify your work before calling a change done. If you couldn't verify something, say so plainly.\n- Be security-minded: no injection, no leaked secrets, least privilege.\n",
   "personas/terse.md": "---\nid: terse\nname: Terse\ndescription: Extremely concise.\n---\nBe extremely concise. One sentence per update. No preamble. No summary unless asked.\n",
-  "systems/system-base.md": '---\nid: system-base\nname: Operational system prompt\nversion: 1.0.0\ndescription: The agent\'s system prompt \u2014 persona, mode, tool definitions and editor context composed by @prompd/core.\nparameters:\n  - name: persona\n    type: string\n    description: The selected persona\'s voice/role text, placed first.\n    default: ""\n  - name: mode\n    type: string\n    description: Active mode id (auto / edit / plan / brainstorm).\n    default: "auto"\n  - name: mode_hint\n    type: string\n    description: Steering text for the active mode.\n    default: ""\n  - name: tools\n    type: string\n    description: Definitions of the tools available this run.\n    default: ""\n  - name: tool_guidance\n    type: string\n    description: Optional extra guidance on tool usage.\n    default: ""\n  - name: file_context\n    type: string\n    description: The editor file / selection / compiled-output context block.\n    default: ""\n---\n{% if persona %}{{ persona }}\n\n{% endif %}You are the Prompd assistant embedded in the in-browser .prmd editor. You help the user author, compile, and improve .prmd/.md prompts (YAML frontmatter + Nunjucks body with typed parameters). When the user asks about the .prmd format itself \u2014 frontmatter fields, parameter types (including enums), date defaults, inheritance, or templating \u2014 the canonical reference is `languages/prmd.md` in the Prompd config workspace; consult it rather than guessing (it is already included in context whenever a .prmd/.md file is open).\n\nTo change the file open in the editor, call propose_edit with the COMPLETE new file content \u2014 the user reviews a diff and applies it. To read or change other files in the workspace, use the file tools (writes ask the user for permission first). Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.\n\n## Tools available this run\n{{ tools }}\n{% if tool_guidance %}\n\n{{ tool_guidance }}\n{% endif %}\n{% if mode_hint %}\n\n## Mode\n{{ mode_hint }}\n{% endif %}\n{% if file_context %}\n\n{{ file_context }}\n{% endif %}\n',
+  "memory/MEMORY.md": "# Memory index\n\nSaved notes appear here, one line each. The agent adds them with save_memory and\nreads them with recall_memory. This is the global (~/.prompd) memory; a project's\nown notes live in ./.prompd/memory.\n",
+  "systems/system-base.md": `---
+id: system-base
+name: Operational system prompt
+version: 1.0.0
+description: The agent's system prompt \u2014 persona, mode, tool definitions and editor context composed by @prompd/core.
+parameters:
+  - name: persona
+    type: string
+    description: The selected persona's voice/role text, placed first.
+    default: ""
+  - name: mode
+    type: string
+    description: Active mode id (auto / edit / plan / brainstorm).
+    default: "auto"
+  - name: mode_hint
+    type: string
+    description: Steering text for the active mode.
+    default: ""
+  - name: tools
+    type: string
+    description: Definitions of the tools available this run.
+    default: ""
+  - name: tool_guidance
+    type: string
+    description: Optional extra guidance on tool usage.
+    default: ""
+  - name: file_context
+    type: string
+    description: The editor file / selection / compiled-output context block.
+    default: ""
+  - name: app
+    type: string
+    description: Product name of the host application, used for the agent's own identity.
+    default: "Prompd"
+---
+{% if persona %}{{ persona }}
+
+{% endif %}You are the {{ app }} assistant embedded in the in-browser .prmd editor. You help the user author, compile, and improve .prmd/.md prompts (YAML frontmatter + Nunjucks body with typed parameters). When the user asks about the .prmd format itself \u2014 frontmatter fields, parameter types (including enums), date defaults, inheritance, or templating \u2014 the canonical reference is \`languages/prmd.md\` in the {{ app }} config workspace; consult it rather than guessing (it is already included in context whenever a .prmd/.md file is open).
+
+To change the file open in the editor, call propose_edit with the COMPLETE new file content \u2014 the user reviews a diff and applies it. To read or change other files in the workspace, use the file tools (writes ask the user for permission first). Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.
+
+## Tools available this run
+{{ tools }}
+{% if tool_guidance %}
+
+{{ tool_guidance }}
+{% endif %}
+{% if mode_hint %}
+
+## Mode
+{{ mode_hint }}
+{% endif %}
+{% if file_context %}
+
+{{ file_context }}
+{% endif %}
+`,
   "systems/system-pdflow.md": '---\nid: system-pdflow\nname: Workflow file system prompt\nversion: 1.0.0\ndescription: Adds .pdflow format knowledge (node taxonomy, edges, parameters) on top of the base system prompt.\ninherits: system-base.md\n---\n\n## Active file format \u2014 Prompd workflow (.pdflow)\n\nThe open file is a **Prompd workflow**: JSON with `{ version, metadata, parameters[], nodes[], edges[] }`. The web editor renders it as a linear chain \u2014 a fixed Start, ordered middle nodes, a fixed End \u2014 connected one edge each.\n\nEach node is `{ id, type, position, data }`. Node types and their key `data`:\n\n- `trigger` \u2014 Start (entry point). Exactly one.\n- `prompt` \u2014 runs a `.prmd`/`.md` prompt. `data.sourceType` is `\'file\'` (`data.source` = a WORKSPACE-RELATIVE path) or `\'raw\'` (`data.rawPrompt`). Optional `data.model` / `data.providerNodeId`.\n- `user-input` \u2014 pauses to collect input. `data.prompt`, `data.inputType` (`text` / `textarea` / `choice` / `confirm` / `number`).\n- `guardrail` \u2014 validates/gates. `data.systemPrompt`, `data.passExpression` or `data.scoreThreshold`.\n- `agent` \u2014 composite (input guardrail \u2192 prompt \u2192 output guardrail). `data.systemPrompt`, `data.userPrompt`, `data.maxIterations`; internal guardrails in `data.inputGuardrail` / `data.outputGuardrail` (each `{ enabled, preset|systemPrompt, passExpression|scoreThreshold }`).\n- `transformer` \u2014 JSON\u2192JSON map. `data.mode: \'template\'` with `data.template` (`{{ input }}` substitution).\n- `callback` / `checkpoint` \u2014 debug/observation point (logs node I/O).\n- `output` \u2014 End (workflow result). Exactly one.\n- `provider` \u2014 one off-chain node holding the canvas-wide provider/model; nodes reference it via `data.providerNodeId`.\n\nEdges thread each node\'s output to the next; the runner exposes `{{ input }}` / `{{ previous_output }}` to downstream nodes.\n\n### Example (minimal chain)\n\n```\n{\n  "version": "1.0",\n  "metadata": { "name": "summarize" },\n  "parameters": [],\n  "nodes": [\n    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": {} },\n    { "id": "p1", "type": "prompt", "position": { "x": 0, "y": 120 }, "data": { "sourceType": "file", "source": "prompts/summarize.prmd" } },\n    { "id": "end", "type": "output", "position": { "x": 0, "y": 240 }, "data": {} }\n  ],\n  "edges": [\n    { "id": "e1", "source": "start", "target": "p1" },\n    { "id": "e2", "source": "p1", "target": "end" }\n  ]\n}\n```\n\nTo edit the workflow, modify this JSON with the file tools (paths are workspace-relative). Keep exactly one `trigger` and one `output`.\n',
   "systems/system-prmd-md.md": '---\nid: system-prmd-md\nname: Prompt file system prompt (.prmd / .md)\nversion: 1.0.0\ninherits: ./system-base.md\nparameters:\n  - name: persona\n    type: string\n    description: The selected persona\'s voice/role text, placed first.\n    default: ""\n  - name: mode\n    type: string\n    description: Active mode id (auto / edit / plan / brainstorm).\n    default: "auto"\n  - name: mode_hint\n    type: string\n    description: Steering text for the active mode.\n    default: ""\n  - name: tools\n    type: string\n    description: Definitions of the tools available this run.\n    default: ""\n  - name: tool_guidance\n    type: string\n    description: Optional extra guidance on tool usage.\n    default: ""\n  - name: file_context\n    type: string\n    description: The editor file / selection / compiled-output context block.\n    default: ""\n---\n\n{% include "../languages/prmd.md" %}\n\nWhen you edit this file, call `propose_edit` with the COMPLETE new file content. Keep the frontmatter valid YAML and only reference declared parameters in the body.\n',
   "templates/index.json": '[\n  {\n    "_comment": "EXAMPLE of a data-driven New File type. Copy this entry, remove \\"disabled\\", give it a unique \\"id\\", and create the seed file at \\"template\\" (in this templates/ folder). Tokens __ID__ / __NAME__ are substituted on create. Icon is a ui-kit name (e.g. IcFileCode, IcUser, IcFlow) or \\"svg:<markup>\\". See docs/file-types.md.",\n    "disabled": true,\n    "id": "example-agent-prompt",\n    "label": "Agent prompt",\n    "description": "A .prmd tuned for tool-using agents.",\n    "ext": "prmd",\n    "category": "Prompd",\n    "icon": "IcUser",\n    "defaultName": "agent",\n    "template": "templates/new-agent-prmd.prmd",\n    "accent": true\n  }\n]\n',
@@ -16562,9 +16744,9 @@ Add your specific criteria here.
 
 Respond with PASS or FAIL followed by a one-sentence reason.
 `,
-  "strategies/debate.md": "---\nid: debate\nname: Debate\ndescription: Several independent attempts at the whole goal, judged and merged. Highest token use; best quality for open-ended or high-stakes goals.\ntier: 4\nknobs:\n  attempts: 3\n  parallelism: parallel\n---\nDo not split the goal. Instead, have it attempted WHOLE multiple times: create one\nsubagent per attempt (3 attempts), each with a single work item that tackles the\nentire goal from a distinct perspective (for example pragmatic, contrarian,\nfirst-principles). Name each subagent for its perspective. Write the synthesis as\na JUDGE: compare the attempts in {{ joined }}, weigh their strengths, and merge\nthe best elements into one final answer, noting significant disagreements.\n",
-  "strategies/fanout.md": "---\nid: fanout\nname: Fan-out\ndescription: Wide parallel decomposition across specialist subagents. Higher token use; broad coverage, fastest wall-clock.\ntier: 3\ndefault: true\nknobs:\n  parallelism: parallel\n---\nDecompose the goal into INDEPENDENT workstreams that can run in parallel \u2014 one\nspecialist subagent per theme, each with focused work items. Maximize coverage:\ndistinct angles, no overlapping work. Use dependsOn only where a work item truly\nneeds another item's output.\n",
-  "strategies/lean.md": `---
+  "strategies/types/debate.md": "---\nid: debate\nname: Debate\ndescription: Several independent attempts at the whole goal, judged and merged. Highest token use; best quality for open-ended or high-stakes goals.\ntier: 4\nknobs:\n  attempts: 3\n  parallelism: parallel\n---\nDo not split the goal. Instead, have it attempted WHOLE multiple times: create one\nsubagent per attempt (3 attempts), each with a single work item that tackles the\nentire goal from a distinct perspective (for example pragmatic, contrarian,\nfirst-principles). Name each subagent for its perspective. Write the synthesis as\na JUDGE: compare the attempts in {{ joined }}, weigh their strengths, and merge\nthe best elements into one final answer, noting significant disagreements.\n",
+  "strategies/types/fanout.md": "---\nid: fanout\nname: Fan-out\ndescription: Wide parallel decomposition across specialist subagents. Higher token use; broad coverage, fastest wall-clock.\ntier: 3\ndefault: true\nknobs:\n  parallelism: parallel\n---\nDecompose the goal into INDEPENDENT workstreams that can run in parallel \u2014 one\nspecialist subagent per theme, each with focused work items. Maximize coverage:\ndistinct angles, no overlapping work. Use dependsOn only where a work item truly\nneeds another item's output.\n",
+  "strategies/types/lean.md": `---
 id: lean
 name: Lean
 description: One subagent, a few sequential steps. Lowest token use \u2014 best for focused, well-defined goals.
@@ -16582,7 +16764,7 @@ reserve a stronger model only for a work item that is genuinely hard.
 If a single work item covers the goal, set "synthesis" to exactly "{{ joined }}"
 so the runner returns that output directly without a synthesis call.
 `,
-  "strategies/pipeline.md": "---\nid: pipeline\nname: Pipeline\ndescription: Staged chain \u2014 each stage's output feeds the next. Moderate token use; best for transform-and-refine goals.\ntier: 2\nknobs:\n  parallelism: staged\n---\nDecompose the goal into sequential STAGES (one subagent per stage), each\ntransforming or refining what the previous stage produced \u2014 for example\nresearch, then draft, then refine, then package. Keep it to 2-4 stages. Within a\nstage, work items may run in parallel, but a stage must only need what earlier\nstages produced. Write each stage's work prompts to state what they consume from\nthe previous stage and what they hand to the next.\n",
+  "strategies/types/pipeline.md": "---\nid: pipeline\nname: Pipeline\ndescription: Staged chain \u2014 each stage's output feeds the next. Moderate token use; best for transform-and-refine goals.\ntier: 2\nknobs:\n  parallelism: staged\n---\nDecompose the goal into sequential STAGES (one subagent per stage), each\ntransforming or refining what the previous stage produced \u2014 for example\nresearch, then draft, then refine, then package. Keep it to 2-4 stages. Within a\nstage, work items may run in parallel, but a stage must only need what earlier\nstages produced. Write each stage's work prompts to state what they consume from\nthe previous stage and what they hand to the next.\n",
   "skills/strategy-planning/SKILL.prmd": `---
 id: strategy-planning
 name: strategy-planning
@@ -16631,7 +16813,19 @@ the goal's stakes and vagueness:
    or context gaps with edit_strategy. Then tell the user what you gathered, what
    you decided, and where the spec/plan files live \u2014 the canvas graph plus those
    two files ARE the deliverable.
-`
+`,
+  "roles/document-writer/PERSONA.md": "Clear, plain-spoken technical writer. Values accuracy and brevity over flourish.\n",
+  "roles/document-writer/POLICY.yaml": "version: 1\nname: role:document-writer\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  write_file: ask\n  create_file: ask\n",
+  "roles/document-writer/ROLE.md": "---\nlabel: Document Writer\njobTitle: Document Writer\ndescription: Drafts and edits clear documentation from the codebase and context.\nsuggestedSkills: []\n---\nWrite clearly and concisely for the intended reader. Ground every claim in the source. Prefer short sentences and concrete examples.\n",
+  "roles/research-analyst/PERSONA.md": "Rigorous analyst. Sources claims, flags uncertainty, distinguishes fact from inference.\n",
+  "roles/research-analyst/POLICY.yaml": "version: 1\nname: role:research-analyst\ndefaultPermission: ask\nmutatingDefault: deny\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  web_search: allow\n  recall_memory: allow\n",
+  "roles/research-analyst/ROLE.md": "---\nlabel: Research Analyst\njobTitle: Research Analyst\ndescription: Gathers and synthesizes information; does not modify the workspace.\nsuggestedSkills: []\n---\nGather from the web and the workspace, then synthesize a sourced, structured answer. Separate findings from assumptions. Do not modify files.\n",
+  "roles/senior-software-engineer/PERSONA.md": "Pragmatic senior engineer. Precise, terse, correctness-first. Prefers the smallest change that fully solves the problem.\n",
+  "roles/senior-software-engineer/POLICY.yaml": "version: 1\nname: role:senior-software-engineer\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  write_file: ask\n  create_file: ask\n  rename_file: ask\n",
+  "roles/senior-software-engineer/ROLE.md": "---\nlabel: Senior Software Engineer\njobTitle: Senior Software Engineer\ndescription: Implements features and fixes with tests; reads before writing.\nsuggestedSkills: []\n---\nImplement changes test-first. Read the surrounding code and match its conventions. Keep changes minimal and focused; explain non-obvious decisions.\n",
+  "roles/senior-test-engineer/PERSONA.md": "Meticulous, adversarial about correctness. Thinks in failure modes and boundary conditions.\n",
+  "roles/senior-test-engineer/POLICY.yaml": "version: 1\nname: role:senior-test-engineer\ndefaultPermission: ask\nmutatingDefault: deny\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n",
+  "roles/senior-test-engineer/ROLE.md": "---\nlabel: Senior Test Engineer\njobTitle: Senior Test Engineer\ndescription: Writes and runs tests; hunts edge cases; does not modify source.\nsuggestedSkills: []\n---\nFocus on coverage and edge cases. Write tests that fail before a fix and pass after. Do not modify production source; report gaps you find.\n"
 };
 
 // ../harness/prompts/library/index.ts
@@ -16884,8 +17078,7 @@ async function compileConfigTemplate(path, params) {
   }
 }
 function formatTools(tools) {
-  if (!tools || !tools.length) return "";
-  return tools.map((t) => `- \`${t.name}\`: ${t.description}`).join("\n");
+  return tools && tools.length ? formatToolLines(tools) : "";
 }
 async function composeAgentSystem(args) {
   const mode = args.mode || "auto";
@@ -16902,21 +17095,41 @@ async function composeAgentSystem(args) {
   ]);
   const tool_guidance = toolGuidanceRaw.replace(/<!--[\s\S]*?-->/g, "").trim();
   const skillsBlock = await enabledSkillInstructions().catch(() => "");
+  const memoryIdx = args.memoryIndex ? await args.memoryIndex().catch(() => "") : "";
+  const memoryBlock = memoryIdx.trim() ? `## Memory
+Notes you've saved. Call recall_memory to read one in full; save_memory to add one.
+
+${memoryIdx.trim()}` : "";
   return compileConfigTemplate(systemPath, {
+    // Who the agent says it IS. Injected rather than written into the prompt,
+    // because the same shipped default is seeded into every host's config
+    // workspace and each one carries a different product name.
+    app: promptHost().appName?.() || "Prompd",
     persona: persona.trim(),
     mode,
     mode_hint,
     tool_guidance,
-    tools: formatTools(args.tools),
-    file_context: [(args.contextText || "").trim(), skillsBlock].filter(Boolean).join("\n\n"),
+    tools: args.toolsText ?? formatTools(args.tools),
+    file_context: [(args.contextText || "").trim(), memoryBlock, skillsBlock].filter(Boolean).join("\n\n"),
     ...args.params || {}
   });
 }
 
 // ../tools-node/fileService.ts
 import { promises as fs } from "node:fs";
-import { join, resolve, relative, dirname, sep, basename } from "node:path";
+import { join, resolve, relative, dirname, sep, basename, isAbsolute } from "node:path";
 var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", ".cache", ".turbo"]);
+function escapesRoot(rel, platformSep = sep) {
+  if (rel === "") return false;
+  if (rel === ".." || rel.startsWith(".." + platformSep)) return true;
+  if (rel.split(platformSep)[0] === "..") return true;
+  if (isAbsolute(rel)) return true;
+  if (platformSep === "\\") {
+    if (/^[a-zA-Z]:/.test(rel)) return true;
+    if (rel.startsWith("\\\\")) return true;
+  }
+  return false;
+}
 var NodeFileService = class {
   kind = "directory";
   label;
@@ -16930,8 +17143,7 @@ var NodeFileService = class {
   }
   /** True if `a` is lexically within the root (the root itself counts). */
   within(a) {
-    const rel = relative(this.root, a);
-    return rel === "" || rel !== ".." && !rel.startsWith(".." + sep) && rel.split(sep)[0] !== "..";
+    return !escapesRoot(relative(this.root, a));
   }
   /** Absolute path for a folder-relative one, rejecting anything that escapes root
    * LEXICALLY (../, absolute). Symlink escapes are caught by assertReal/realAbs. */
@@ -16950,7 +17162,7 @@ var NodeFileService = class {
       try {
         const real = await fs.realpath(probe);
         const rel = relative(realRoot, real);
-        if (rel !== "" && (rel === ".." || rel.startsWith(".." + sep) || rel.split(sep)[0] === "..")) {
+        if (escapesRoot(rel)) {
           throw new Error(`path escapes the workspace root via symlink: ${a}`);
         }
         return;
@@ -20165,13 +20377,23 @@ async function deviceLogin(opts) {
   const f = opts.fetchImpl ?? fetch;
   const base = opts.base.replace(/\/$/, "");
   const post = async (path, body) => {
-    const res = await f(`${base}${path}`, {
+    const url = `${base}${path}`;
+    const res = await f(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
       signal: opts.signal
     });
-    return await res.json();
+    const text = await res.text();
+    try {
+      return JSON.parse(text);
+    } catch {
+      const looksLikeHtml = /^\s*</.test(text);
+      throw new Error(
+        `${url} answered ${res.status} with ${looksLikeHtml ? "an HTML page" : "a non-JSON body"}, not JSON.` + (res.status === 404 ? `
+  That usually means --base is wrong. The device endpoints live under /api \u2014 try --base ${base.replace(/\/api$/, "")}/api` : "")
+      );
+    }
   };
   const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent" });
   if (!dc.device_code) throw new Error("device authorization failed");
@@ -20198,11 +20420,300 @@ async function deviceLogin(opts) {
   }
 }
 
+// ../crew/frontmatter.ts
+var import_yaml = __toESM(require_dist(), 1);
+var FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseFrontmatter2(text) {
+  const m = text.match(FRONTMATTER);
+  if (!m) return { meta: {}, body: text };
+  let meta = {};
+  try {
+    const parsed = import_yaml.default.parse(m[1]);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      meta = parsed;
+    }
+  } catch {
+    meta = {};
+  }
+  return { meta, body: m[2] };
+}
+
+// ../crew/policy.ts
+var import_yaml2 = __toESM(require_dist(), 1);
+var LEVELS = ["allow", "ask", "deny"];
+var UNATTENDED = ["deny", "park", "allow"];
+function asLevel(v) {
+  return typeof v === "string" && LEVELS.includes(v) ? v : void 0;
+}
+function asStringArray(v) {
+  if (!Array.isArray(v)) return void 0;
+  const out = v.filter((x) => typeof x === "string");
+  return out.length ? out : void 0;
+}
+function coercePermissions(v) {
+  const out = {};
+  if (v && typeof v === "object" && !Array.isArray(v)) {
+    for (const [k, val] of Object.entries(v)) {
+      const lvl = asLevel(val);
+      if (lvl) out[k] = lvl;
+    }
+  }
+  return out;
+}
+function parsePolicyYaml(text, agentName) {
+  let raw = {};
+  if (text.trim()) {
+    try {
+      const parsed = import_yaml2.default.parse(text);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        raw = parsed;
+      }
+    } catch {
+      raw = {};
+    }
+  }
+  const toolsAllow = raw.tools && typeof raw.tools === "object" ? asStringArray(raw.tools.allow) : void 0;
+  const toolsDeny = raw.tools && typeof raw.tools === "object" ? asStringArray(raw.tools.deny) : void 0;
+  const rawUnattended = raw.unattended;
+  const unattended = typeof rawUnattended === "string" && UNATTENDED.includes(rawUnattended) ? rawUnattended : "deny";
+  const rawPark = raw.parkTimeoutMs;
+  const parkTimeoutMs = typeof rawPark === "number" && Number.isFinite(rawPark) && rawPark > 0 ? rawPark : void 0;
+  const policy = {
+    version: 1,
+    name: typeof raw.name === "string" ? raw.name : `crew:${agentName}`,
+    description: typeof raw.description === "string" ? raw.description : void 0,
+    onViolation: raw.onViolation === "warn" ? "warn" : "stop",
+    defaultPermission: asLevel(raw.defaultPermission) ?? "ask",
+    mutatingDefault: asLevel(raw.mutatingDefault) ?? "deny",
+    permissions: coercePermissions(raw.permissions),
+    maxTurns: typeof raw.maxTurns === "number" ? raw.maxTurns : void 0,
+    maxToolCalls: typeof raw.maxToolCalls === "number" ? raw.maxToolCalls : void 0,
+    unattended,
+    parkTimeoutMs
+  };
+  if (toolsAllow || toolsDeny) {
+    policy.tools = { ...toolsAllow ? { allow: toolsAllow } : {}, ...toolsDeny ? { deny: toolsDeny } : {} };
+  }
+  return policy;
+}
+
+// ../crew/paths.ts
+var CREW_SEG = "crew";
+var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+function isValidAgentName(name) {
+  return NAME_RE.test(name);
+}
+
+// ../crew/store.ts
+var import_yaml3 = __toESM(require_dist(), 1);
+var TRIGGER_TYPES = [
+  "manual",
+  "file-change",
+  "run-complete",
+  "interval-while-open",
+  "app-init",
+  "workspace-init",
+  "schedule",
+  "continuous",
+  "self-directed",
+  "external-webhook"
+];
+async function readOr(files, path, fallback = "") {
+  try {
+    return await files.read(path);
+  } catch {
+    return fallback;
+  }
+}
+function parseTriggers(meta) {
+  const raw = meta.triggers;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const item of raw) {
+    if (item && typeof item === "object") {
+      const t = item.type;
+      if (typeof t === "string" && TRIGGER_TYPES.includes(t)) {
+        const cfg = item.config;
+        out.push({
+          type: t,
+          config: cfg && typeof cfg === "object" && !Array.isArray(cfg) ? cfg : void 0
+        });
+      }
+    }
+  }
+  return out;
+}
+function parseBudget(meta) {
+  const raw = meta.budget;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const o = raw;
+  const out = {};
+  for (const k of ["maxUsd", "maxTokens", "maxMs"]) {
+    const v = o[k];
+    if (typeof v === "number" && v > 0) out[k] = v;
+  }
+  return out;
+}
+function parseCanCall(meta) {
+  const raw = meta.canCall;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((x) => typeof x === "string" && isValidAgentName(x));
+}
+function parseSettings(text) {
+  try {
+    const raw = JSON.parse(text);
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+      const o = raw;
+      return {
+        model: typeof o.model === "string" ? o.model : void 0,
+        temperature: typeof o.temperature === "number" ? o.temperature : void 0
+      };
+    }
+  } catch {
+  }
+  return {};
+}
+async function loadCrewAgentAt(files, root, name, scope = "workspace") {
+  if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
+  const dir = `${root}/${name}`;
+  const { meta, body } = parseFrontmatter2(await readOr(files, `${dir}/AGENT.md`));
+  return {
+    name,
+    jobTitle: typeof meta.jobTitle === "string" ? meta.jobTitle : "",
+    description: typeof meta.description === "string" ? meta.description : "",
+    scope,
+    enabled: meta.enabled !== false,
+    // absent/anything-but-false -> enabled
+    triggers: parseTriggers(meta),
+    instructions: body,
+    soul: await readOr(files, `${dir}/SOUL.md`),
+    persona: await readOr(files, `${dir}/PERSONA.md`),
+    policy: parsePolicyYaml(await readOr(files, `${dir}/POLICY.yaml`), name),
+    settings: parseSettings(await readOr(files, `${dir}/settings.json`, "{}")),
+    budget: parseBudget(meta),
+    canCall: parseCanCall(meta)
+  };
+}
+async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
+  if (!isValidAgentName(name)) return null;
+  try {
+    const st = await files.stat(`${root}/${name}/AGENT.md`);
+    if (st?.kind !== "file") return null;
+    return await loadCrewAgentAt(files, root, name, scope);
+  } catch {
+    return null;
+  }
+}
+
+// ../harness/guardrail/serialize.ts
+var import_yaml4 = __toESM(require_dist(), 1);
+
+// ../crew/runtime.ts
+function buildSystemExtra(def) {
+  const parts = [];
+  if (def.jobTitle?.trim()) parts.push(`--- Role ---
+${def.jobTitle.trim()}`);
+  if (def.soul.trim()) parts.push(`--- Soul ---
+${def.soul.trim()}`);
+  if (def.persona.trim()) parts.push(`--- Persona ---
+${def.persona.trim()}`);
+  if (def.instructions.trim()) parts.push(`--- Instructions ---
+${def.instructions.trim()}`);
+  return parts.join("\n\n");
+}
+
+// src/runAgent.ts
+function workspaceStateDir() {
+  const fromEnv = process.env.CORENEL_STATE_DIR;
+  return fromEnv && /^\.[A-Za-z0-9][A-Za-z0-9._-]*$/.test(fromEnv) ? fromEnv : stateDirName();
+}
+function eventLine(e) {
+  try {
+    return JSON.stringify(e);
+  } catch {
+    const type = e.type;
+    return JSON.stringify({ type: typeof type === "string" ? type : "unknown", unserializable: true });
+  }
+}
+async function runCrewAgentCli(opts) {
+  const files = new NodeFileService(opts.cwd);
+  const root = `${workspaceStateDir()}/${CREW_SEG}`;
+  const def = await loadCrewAgentAtIfExists(files, root, opts.agent, "workspace");
+  if (!def) {
+    opts.warn(`no such agent "${opts.agent}" under ${opts.cwd}/${root}`);
+    return 2;
+  }
+  if (!def.enabled) {
+    opts.warn(`agent "${opts.agent}" is disabled; enable it before running`);
+    return 2;
+  }
+  setGatewayBase(opts.base ?? process.env.CORENEL_API_BASE ?? "https://api.corenel.ai/api");
+  const token = await nodeAuthToken().getToken();
+  if (!token) {
+    opts.warn("not signed in: set CORENEL_TOKEN, or run `corenel login` on this machine");
+    return 2;
+  }
+  registerGuard(tokenGuard(() => token));
+  const tools = allTools();
+  const extra = buildSystemExtra(def);
+  let system = extra;
+  try {
+    const base = await composeAgentSystem({
+      mode: "auto",
+      tools: tools.map((t) => ({ name: t.name, description: t.description }))
+    });
+    system = extra ? `${base}
+
+${extra}` : base;
+  } catch {
+  }
+  const realConsole = { log: console.log, info: console.info, warn: console.warn, debug: console.debug };
+  const toStderr = (...parts) => {
+    opts.warn(parts.map((x) => typeof x === "string" ? x : JSON.stringify(x)).join(" "));
+  };
+  console.log = toStderr;
+  console.info = toStderr;
+  console.warn = toStderr;
+  console.debug = toStderr;
+  const ac = new AbortController();
+  try {
+    const result = await runAgent({
+      client: createChatClient({ getToken: async () => token }),
+      model: opts.model ?? def.settings.model ?? "gpt-4o-mini",
+      system,
+      messages: [{ role: "user", content: opts.input }],
+      tools,
+      toolCtx: nodeToolCtx(ac.signal, { files }),
+      policy: def.policy,
+      signal: ac.signal,
+      onEvent: (e) => opts.emit(eventLine(e))
+    });
+    opts.emit(eventLine({ type: "done", text: result.text }));
+    return 0;
+  } catch (e) {
+    opts.warn(`run failed: ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  } finally {
+    Object.assign(console, realConsole);
+  }
+}
+
 // src/cli.ts
 function flag(argv, name, fallback) {
   const i = argv.indexOf(`--${name}`);
   return i >= 0 && argv[i + 1] ? argv[i + 1] : fallback;
 }
+function positional(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i].startsWith("--")) {
+      i++;
+      continue;
+    }
+    out.push(argv[i]);
+  }
+  return out;
+}
 function promptOf(argv) {
   const parts = [];
   for (let i = 0; i < argv.length; i++) {
@@ -20253,8 +20764,28 @@ async function main() {
     case "run":
       await run(rest);
       break;
+    case "run-agent": {
+      const agent = positional(rest)[0];
+      if (!agent) {
+        process.stderr.write('usage: corenel run-agent <name> --input "<text>" [--model M] [--base URL]\n');
+        process.exit(2);
+      }
+      const code = await runCrewAgentCli({
+        cwd: process.cwd(),
+        agent,
+        input: flag(rest, "input", ""),
+        ...rest.includes("--model") ? { model: flag(rest, "model", "") } : {},
+        ...rest.includes("--base") ? { base: flag(rest, "base", "") } : {},
+        emit: (line) => process.stdout.write(`${line}
+`),
+        warn: (line) => process.stderr.write(`corenel: ${line}
+`)
+      });
+      process.exitCode = code;
+      break;
+    }
     case "login": {
-      const base = flag(rest, "base", process.env.CORENEL_API_BASE || "https://api.corenel.ai");
+      const base = flag(rest, "base", process.env.CORENEL_API_BASE || "https://api.corenel.ai/api");
       await deviceLogin({ base, store: writeAuthToken });
       process.stdout.write(`
 Logged in. Token saved to ${authTokenPath()}
@@ -20267,6 +20798,7 @@ Logged in. Token saved to ${authTokenPath()}
         "",
         "  corenel login [--base URL]                        OAuth device flow -> ~/.corenel/token",
         '  corenel run "<prompt>" [--model M] [--base URL]   one-shot turn (needs a login or CORENEL_TOKEN)',
+        '  corenel run-agent <name> --input "<text>"         run a crew agent; events as JSON Lines on stdout',
         "",
         "  (ask/chat + start --sidecar to follow.)",
         ""
@@ -20282,5 +20814,7 @@ function friendlyError(msg) {
 main().catch((e) => {
   process.stderr.write(`corenel: ${friendlyError(e instanceof Error ? e.message : String(e))}
 `);
-  process.exit(1);
+  process.exitCode = 1;
+  const bail = setTimeout(() => process.exit(1), 2e3);
+  bail.unref();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/cli",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "type": "module",
   "description": "Corenel CLI — runs the harness in node, in-proc, no transport. The headless proof the kernel is host-agnostic. (corenel run/ask/chat/login + start --sidecar to follow.)",
   "bin": {
@@ -17,6 +17,7 @@
     "openai": "^4.77.0"
   },
   "devDependencies": {
+    "@corenel/crew": "workspace:*",
     "@corenel/harness": "workspace:*",
     "@corenel/protocol": "workspace:*",
     "@corenel/tools-node": "workspace:*",