@corenel/cli 0.9.0 → 0.9.2

package/dist/main.js

@@ -454,7 +454,7 @@ var init_fileService = __esm({
 // ../tools-node/auth.ts
 import { promises as fs3 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join3, resolve as resolve2 } from "node:path";
 import { stateDirName, DEFAULT_API_BASE } from "@corenel/protocol";
 function corenelDir(base = homedir()) {
   return join3(base, stateDirName());
@@ -500,6 +500,83 @@ async function writeAuthToken(token, stateDir) {
   } catch {
   }
 }
+function authObjectOf(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+  return parsed;
+}
+function withoutSignIn(doc) {
+  const rest = { ...doc };
+  for (const k of SIGN_IN_KEYS) delete rest[k];
+  return rest;
+}
+function codeOf2(err) {
+  const code3 = typeof err === "object" && err !== null ? err.code : void 0;
+  return typeof code3 === "string" && code3 ? code3 : "unknown error";
+}
+function authDocLocks() {
+  const host = globalThis;
+  let m = host[AUTH_DOC_LOCKS];
+  if (!m) {
+    m = /* @__PURE__ */ new Map();
+    host[AUTH_DOC_LOCKS] = m;
+  }
+  return m;
+}
+async function withAuthDocLock(path, fn) {
+  const abs = resolve2(path);
+  const key = process.platform === "win32" ? abs.toLowerCase() : abs;
+  const locks = authDocLocks();
+  const prev = locks.get(key) ?? Promise.resolve();
+  let release = () => {
+  };
+  const mine = new Promise((r) => {
+    release = r;
+  });
+  const tail = prev.then(() => mine);
+  locks.set(key, tail);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (locks.get(key) === tail) locks.delete(key);
+  }
+}
+async function readAuthDocForWrite(path, writer) {
+  let bytes;
+  try {
+    bytes = await fs3.readFile(path);
+  } catch (err) {
+    if (isMissing(err)) return { kind: "missing" };
+    const code3 = codeOf2(err);
+    const what = writer === "sign-in" ? "sign-in aborted so the MCP and agent credentials in it are not lost" : "not saved so the credentials in it are not lost";
+    throw Object.assign(new Error(`Could not read ${path} (${code3}); ${what}. Close whatever holds it and retry.`), { code: code3 });
+  }
+  const doc = authObjectOf(bytes.toString("utf8"));
+  return doc ? { kind: "doc", doc } : { kind: "corrupt", bytes };
+}
+async function backupCorruptAuthDoc(path, bytes, notify = toStderr) {
+  const backup = `${path}.bad-${Date.now()}`;
+  await fs3.writeFile(backup, bytes, { mode: 384, flag: "wx" });
+  try {
+    await fs3.chmod(backup, 384);
+  } catch {
+  }
+  notify(`${path} was not valid JSON; a copy was kept at ${backup} and it was replaced.`);
+  return backup;
+}
+async function readForeignAuthSections(path, notify) {
+  const read = await readAuthDocForWrite(path, "sign-in");
+  if (read.kind === "doc") return withoutSignIn(read.doc);
+  if (read.kind === "corrupt") await backupCorruptAuthDoc(path, read.bytes, notify);
+  return {};
+}
 async function writeLoginCredential(token, opts = {}) {
   const cred = {
     accessToken: token.trim(),
@@ -510,9 +587,17 @@ async function writeLoginCredential(token, opts = {}) {
   const credPath = credentialFilePath(opts.stateDir);
   const tokPath = tokenFilePath(opts.stateDir);
   await fs3.mkdir(dir, { recursive: true, mode: 448 });
+  await withAuthDocLock(credPath, () => publishSignIn(credPath, tokPath, cred, opts.notify ?? toStderr));
+  try {
+    await fs3.chmod(dir, 448);
+  } catch {
+  }
+}
+async function publishSignIn(credPath, tokPath, cred, notify) {
+  const record = { ...await readForeignAuthSections(credPath, notify), ...cred };
   const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
   const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-  await fs3.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}
+  await fs3.writeFile(credTmp, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
   await fs3.writeFile(tokTmp, `${cred.accessToken}
 `, { mode: 384 });
@@ -538,10 +623,6 @@ async function writeLoginCredential(token, opts = {}) {
     }
     throw e;
   }
-  try {
-    await fs3.chmod(dir, 448);
-  } catch {
-  }
 }
 function isMissing(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
@@ -591,12 +672,48 @@ async function readCredentialFileRead(stateDir) {
     return { value: null, unreadable: false };
   }
 }
-async function clearAllCredentials(stateDir) {
-  await clearAuthToken(stateDir);
+async function clearAllCredentials(stateDir, opts = {}) {
+  const failures = [];
+  const tokPath = tokenFilePath(stateDir);
   try {
-    await fs3.rm(credentialFilePath(stateDir), { force: true });
-  } catch {
+    await fs3.rm(tokPath, { force: true });
+  } catch (err) {
+    failures.push(`${tokPath} (${codeOf2(err)})`);
+  }
+  const credPath = credentialFilePath(stateDir);
+  try {
+    await withAuthDocLock(credPath, () => clearSignInRecord(credPath, opts.notify ?? toStderr));
+  } catch (err) {
+    failures.push(`${credPath} (${codeOf2(err)})`);
+  }
+  if (failures.length) {
+    throw new Error(`Could not remove the sign-in from ${failures.join(" and ")}; it is still on disk.`);
+  }
+}
+async function clearSignInRecord(path, notify) {
+  let raw;
+  try {
+    raw = await fs3.readFile(path, "utf8");
+  } catch (err) {
+    if (isMissing(err)) return;
+    await fs3.rm(path, { force: true });
+    notify("auth.json could not be read and was removed; MCP and agent credentials in it are gone");
+    return;
+  }
+  const doc = authObjectOf(raw);
+  const rest = doc ? withoutSignIn(doc) : {};
+  if (Object.keys(rest).length > 0) {
+    try {
+      await writeFilePrivateAtomic(path, `${JSON.stringify(rest, null, 2)}
+`);
+      return;
+    } catch {
+      await fs3.rm(path, { force: true });
+      notify("auth.json could not be rewritten and was removed; MCP and agent credentials in it are gone");
+      return;
+    }
   }
+  await fs3.rm(path, { force: true });
 }
 async function resolveNodeCredential(opts = {}) {
   const env = opts.env ?? process.env;
@@ -644,6 +761,7 @@ async function resolveApiBase(opts = {}) {
   if (explicit) return { base: explicit, source: "explicit" };
   const fromEnv = (opts.env ?? process.env)[API_BASE_ENV]?.trim();
   if (fromEnv) return { base: fromEnv, source: "env" };
+  if (opts.ignoreCredential) return { base: DEFAULT_API_BASE, source: "default" };
   const cred = await resolveNodeCredential({
     env: {},
     ...opts.stateDir ? { stateDir: opts.stateDir } : {}
@@ -669,12 +787,17 @@ function maskAccount(account) {
 function nodeAuthToken(stateDir) {
   return { getToken: async () => (await resolveNodeCredential(stateDir ? { stateDir } : {})).token };
 }
-var TOKEN_ENV, API_BASE_ENV;
+var TOKEN_ENV, API_BASE_ENV, SIGN_IN_KEYS, toStderr, AUTH_DOC_LOCKS;
 var init_auth = __esm({
   "../tools-node/auth.ts"() {
     "use strict";
     TOKEN_ENV = "CORENEL_TOKEN";
     API_BASE_ENV = "CORENEL_API_BASE";
+    SIGN_IN_KEYS = ["accessToken", "refreshToken", "expiresAt", "account", "apiBase"];
+    toStderr = (line) => {
+      console.error(line);
+    };
+    AUTH_DOC_LOCKS = Symbol.for("corenel.tools-node.authDocLocks");
   }
 });
 
@@ -12547,7 +12670,7 @@ var require_runtime = __commonJS({
         }
         return p && p.lookup(name);
       };
-      _proto.resolve = function resolve4(name, forWrite) {
+      _proto.resolve = function resolve5(name, forWrite) {
         var p = forWrite && this.isolateWrites ? void 0 : this.parent;
         var val = this.variables[name];
         if (val !== void 0) {
@@ -14277,7 +14400,7 @@ var require_loader = __commonJS({
         return _EmitterObj.apply(this, arguments) || this;
       }
       var _proto = Loader2.prototype;
-      _proto.resolve = function resolve4(from, to) {
+      _proto.resolve = function resolve5(from, to) {
         return path.resolve(path.dirname(from), to);
       };
       _proto.isRelative = function isRelative(filename) {
@@ -17813,10 +17936,10 @@ ${content}` : parentData.content;
           });
           this.registerFiltersOnEnv(env);
           const renderTimeout = 5e3;
-          const renderPromise = new Promise((resolve4, reject) => {
+          const renderPromise = new Promise((resolve5, reject) => {
             try {
               const result = env.renderString(content, context.parameters);
-              resolve4(result);
+              resolve5(result);
             } catch (error) {
               reject(error);
             }
@@ -18839,7 +18962,7 @@ var init_openBrowser = __esm({
 // ../tools-node/approvalsStore.ts
 import { promises as fs5, realpath } from "node:fs";
 import { createHash, randomBytes as randomBytes2 } from "node:crypto";
-import { basename as basename3, dirname as dirname4, join as join5, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join5, relative as relative2, resolve as resolve3 } from "node:path";
 function approvalsHomeDir(base) {
   return join5(corenelDir(base), "approvals");
 }
@@ -18907,7 +19030,7 @@ async function realOrAncestor(abs) {
   }
 }
 async function workspaceApprovalsId(dir) {
-  const real = await realOrAncestor(resolve2(dir));
+  const real = await realOrAncestor(resolve3(dir));
   const norm = process.platform === "win32" ? real.toLowerCase() : real;
   return createHash("sha256").update(norm).digest("hex").slice(0, 32);
 }
@@ -18926,7 +19049,7 @@ function sameIdentity(a, b) {
   return a !== null && b !== null && a.dev === b.dev && a.ino === b.ino;
 }
 async function existingAncestor(abs) {
-  let cur = resolve2(abs);
+  let cur = resolve3(abs);
   const rest = [];
   for (; ; ) {
     if (await identity(cur) !== null) return { dir: cur, rest };
@@ -18937,12 +19060,12 @@ async function existingAncestor(abs) {
   }
 }
 async function insideAnyRoot(roots, dir) {
-  const target = resolve2(dir);
+  const target = resolve3(dir);
   const realTarget = await realOrAncestor(target);
   const targetAnc = await existingAncestor(realTarget);
   const targetAncId = await identity(targetAnc.dir);
   for (const r of roots) {
-    const root = resolve2(r);
+    const root = resolve3(r);
     if (contains(root, target)) return r;
     const realRoot = await realOrAncestor(root);
     if (contains(realRoot, realTarget)) return r;
@@ -18975,19 +19098,130 @@ var init_approvalsStore = __esm({
   }
 });
 
+// ../tools-node/deviceLogin.ts
+function deadlineSignal(ms, outer) {
+  const ac = new AbortController();
+  const onOuter = () => ac.abort();
+  const timer = setTimeout(() => ac.abort(), ms);
+  if (outer) {
+    if (outer.aborted) ac.abort();
+    else outer.addEventListener("abort", onOuter, { once: true });
+  }
+  return {
+    signal: ac.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      outer?.removeEventListener("abort", onOuter);
+    }
+  };
+}
+async function whoIsThis(base, token, f, outer, deadlineMs = ACCOUNT_LOOKUP_MS) {
+  const { signal, dispose } = deadlineSignal(deadlineMs, outer);
+  try {
+    const res = await f(`${base}/auth/me`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal
+    });
+    if (!res.ok) return void 0;
+    const body = JSON.parse(await res.text());
+    const email = body?.user?.email;
+    if (typeof email !== "string") return void 0;
+    const trimmed = email.trim();
+    return trimmed ? trimmed : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    dispose();
+  }
+}
+function defaultOpen(uri, code3) {
+  process.stdout.write(`
+  To authorize, open:  ${uri}
+  and enter the code:  ${code3}
+
+  Waiting for authorization\u2026
+`);
+}
+async function deviceLogin(opts) {
+  const f = opts.fetchImpl ?? fetch;
+  const base = opts.base.replace(/\/$/, "");
+  const post = async (path, body) => {
+    const url = `${base}${path}`;
+    const res = await f(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: opts.signal
+    });
+    const text = await res.text();
+    try {
+      return JSON.parse(text);
+    } catch {
+      const looksLikeHtml = /^\s*</.test(text);
+      throw new Error(
+        `${url} answered ${res.status} with ${looksLikeHtml ? "an HTML page" : "a non-JSON body"}, not JSON.` + (res.status === 404 ? `
+  That usually means --base is wrong. The device endpoints live under /api \u2014 try --base ${base.replace(/\/api$/, "")}/api` : "")
+      );
+    }
+  };
+  const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent pair" });
+  if (!dc.device_code) throw new Error("device authorization failed");
+  (opts.open ?? defaultOpen)(dc.verification_uri, dc.user_code);
+  let interval = opts.pollMs ?? Math.max(MIN_POLL_MS, (dc.interval ?? 5) * 1e3);
+  const lifetimeMs = (typeof dc.expires_in === "number" && dc.expires_in > 0 ? dc.expires_in : DEFAULT_LIFETIME_S) * 1e3;
+  const deadline = Date.now() + lifetimeMs;
+  for (; ; ) {
+    if (opts.signal?.aborted) throw new Error("login cancelled");
+    if (Date.now() >= deadline) {
+      throw new Error(`the code ${dc.user_code} expired before it was authorized -- run \`corenel login\` again`);
+    }
+    await sleep2(interval);
+    const tok = await post("/oauth/token", {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: dc.device_code,
+      client_id: "corenel-cli"
+    });
+    if (tok.access_token) {
+      const claimed = typeof tok.account === "string" ? tok.account.trim() : "";
+      const account = claimed || await whoIsThis(base, tok.access_token, f, opts.signal, opts.accountLookupMs);
+      await opts.store(tok.access_token, account || void 0);
+      return tok.access_token;
+    }
+    if (tok.error === "authorization_pending") continue;
+    if (tok.error === "slow_down") {
+      interval += 5e3;
+      continue;
+    }
+    throw new Error(tok.error_description || tok.error || "login failed");
+  }
+}
+var sleep2, MIN_POLL_MS, DEFAULT_LIFETIME_S, ACCOUNT_LOOKUP_MS;
+var init_deviceLogin = __esm({
+  "../tools-node/deviceLogin.ts"() {
+    "use strict";
+    sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+    MIN_POLL_MS = 1e3;
+    DEFAULT_LIFETIME_S = 900;
+    ACCOUNT_LOOKUP_MS = 5e3;
+  }
+});
+
 // ../tools-node/index.ts
 var tools_node_exports = {};
 __export(tools_node_exports, {
   API_BASE_ENV: () => API_BASE_ENV,
   NodeFileService: () => NodeFileService,
+  SIGN_IN_KEYS: () => SIGN_IN_KEYS,
   TOKEN_ENV: () => TOKEN_ENV,
   approvalsHomeDir: () => approvalsHomeDir,
   authTokenPath: () => authTokenPath,
+  backupCorruptAuthDoc: () => backupCorruptAuthDoc,
   clearAllCredentials: () => clearAllCredentials,
   clearAuthToken: () => clearAuthToken,
   corenelDir: () => corenelDir,
   credentialDir: () => credentialDir,
   credentialFilePath: () => credentialFilePath,
+  deviceLogin: () => deviceLogin,
   ensurePrivateDir: () => ensurePrivateDir,
   fileTextStore: () => fileTextStore,
   insideAnyRoot: () => insideAnyRoot,
@@ -18997,6 +19231,7 @@ __export(tools_node_exports, {
   nodeAuthToken: () => nodeAuthToken,
   nodePromptHost: () => nodePromptHost,
   openBrowser: () => openBrowser,
+  readAuthDocForWrite: () => readAuthDocForWrite,
   readAuthToken: () => readAuthToken,
   readAuthTokenRead: () => readAuthTokenRead,
   readCredentialFile: () => readCredentialFile,
@@ -19005,8 +19240,11 @@ __export(tools_node_exports, {
   resolveNodeCredential: () => resolveNodeCredential,
   sidecarDir: () => sidecarDir,
   tokenFilePath: () => tokenFilePath,
+  whoIsThis: () => whoIsThis,
+  withAuthDocLock: () => withAuthDocLock,
   workspaceApprovalsId: () => workspaceApprovalsId,
   writeAuthToken: () => writeAuthToken,
+  writeFilePrivateAtomic: () => writeFilePrivateAtomic,
   writeLoginCredential: () => writeLoginCredential
 });
 var init_tools_node = __esm({
@@ -19018,6 +19256,7 @@ var init_tools_node = __esm({
     init_migrateHome();
     init_openBrowser();
     init_approvalsStore();
+    init_deviceLogin();
   }
 });
 
@@ -22828,9 +23067,19 @@ __export(crew_exports, {
   CREW_EXCLUDED_TOOLS: () => CREW_EXCLUDED_TOOLS,
   CREW_SEG: () => CREW_SEG,
   DEPLOYMENT_FILE: () => DEPLOYMENT_FILE,
+  DONTS_DUPLICATE: () => DONTS_DUPLICATE,
+  DONTS_MODEL_INVALID: () => DONTS_MODEL_INVALID,
+  DONTS_TOO_MANY: () => DONTS_TOO_MANY,
+  DONT_BLANK: () => DONT_BLANK,
+  DONT_CONTROL: () => DONT_CONTROL,
+  DONT_TOO_LONG: () => DONT_TOO_LONG,
   MAX_ROOM_BRIEF: () => MAX_ROOM_BRIEF,
+  MEMORY_USERS_DIR: () => MEMORY_USERS_DIR,
+  NOT_IN_YOUR_MEMORY: () => NOT_IN_YOUR_MEMORY,
+  NO_ASKER_MEMORY_READ_ONLY: () => NO_ASKER_MEMORY_READ_ONLY,
   PROJECT_MARKER_FILE: () => PROJECT_MARKER_FILE,
   ROOM_KIND: () => ROOM_KIND,
+  ROOM_MEMORY_READ_ONLY: () => ROOM_MEMORY_READ_ONLY,
   RUN_STATUS_VALUES: () => RUN_STATUS_VALUES,
   RoomReadError: () => RoomReadError,
   RoomStore: () => RoomStore,
@@ -22859,6 +23108,7 @@ __export(crew_exports, {
   deploymentKey: () => deploymentKey,
   deploymentProjectFor: () => deploymentProjectFor,
   deploymentRootFor: () => deploymentRootFor,
+  dontsProblems: () => dontsProblems,
   editFindingByHuman: () => editFindingByHuman,
   emptyDeployment: () => emptyDeployment,
   encodeRoomLine: () => encodeRoomLine,
@@ -22883,6 +23133,8 @@ __export(crew_exports, {
   loadCrewSummaryAt: () => loadCrewSummaryAt,
   makeAgentMemoryProvider: () => makeAgentMemoryProvider,
   makeCrewTurnRuntime: () => makeCrewTurnRuntime,
+  makePartitionedMemoryProvider: () => makePartitionedMemoryProvider,
+  makeReadOnlyMemoryProvider: () => makeReadOnlyMemoryProvider,
   matchFileChange: () => matchFileChange,
   matchRunComplete: () => matchRunComplete,
   newCrewDraft: () => newCrewDraft,
@@ -22921,6 +23173,7 @@ __export(crew_exports, {
   takeTurn: () => takeTurn,
   tightenAutonomy: () => tightenAutonomy,
   turnCosts: () => turnCosts,
+  userMemoryRoot: () => userMemoryRoot,
   validateRoomRequest: () => validateRoomRequest,
   writeCrewAgentAt: () => writeCrewAgentAt
 });
@@ -22945,16 +23198,25 @@ function parseFrontmatter(text) {
 
 // ../crew/policy.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-var LEVELS = ["allow", "ask", "deny"];
+var LEVELS = ["allow", "ask", "owner", "deny"];
 var UNATTENDED = ["deny", "park", "allow"];
 function asLevel(v) {
   return typeof v === "string" && LEVELS.includes(v) ? v : void 0;
 }
+function asDefaultLevel(v) {
+  const l = asLevel(v);
+  return l === "owner" ? void 0 : l;
+}
 function asStringArray(v) {
   if (!Array.isArray(v)) return void 0;
   const out = v.filter((x) => typeof x === "string");
   return out.length ? out : void 0;
 }
+function asDonts(v) {
+  if (!Array.isArray(v)) return void 0;
+  const out = v.filter((x) => typeof x === "string" || typeof x === "number" || typeof x === "boolean").map((x) => String(x).trim()).filter((s) => s !== "");
+  return out.length ? out : void 0;
+}
 function coercePermissions(v) {
   const out = {};
   if (v && typeof v === "object" && !Array.isArray(v)) {
@@ -22986,6 +23248,8 @@ function parsePolicyYaml(text, agentName) {
   const rawPush = raw.pushWaitMs;
   const pushWaitMs = typeof rawPush === "number" && Number.isFinite(rawPush) && rawPush > 0 ? rawPush : void 0;
   const skills = Array.isArray(raw.skills) ? raw.skills.filter((s) => typeof s === "string" && s.trim() !== "").map((s) => s.trim()) : void 0;
+  const donts = asDonts(raw.donts);
+  const dontsModel = typeof raw.donts_model === "string" && raw.donts_model.trim() ? raw.donts_model.trim() : void 0;
   const policy = {
     version: 1,
     name: typeof raw.name === "string" ? raw.name : `crew:${agentName}`,
@@ -23005,15 +23269,17 @@ function parsePolicyYaml(text, agentName) {
      * sub-agents and make outbound search calls without being asked. Say it
      * here rather than let the word "reads" imply a narrower grant than the
      * code makes. */
-    defaultPermission: asLevel(raw.defaultPermission),
-    mutatingDefault: asLevel(raw.mutatingDefault) ?? "deny",
+    defaultPermission: asDefaultLevel(raw.defaultPermission),
+    mutatingDefault: asDefaultLevel(raw.mutatingDefault) ?? "deny",
     permissions: coercePermissions(raw.permissions),
     maxTurns: typeof raw.maxTurns === "number" ? raw.maxTurns : void 0,
     maxToolCalls: typeof raw.maxToolCalls === "number" ? raw.maxToolCalls : void 0,
     unattended,
     parkTimeoutMs,
     ...pushWaitMs !== void 0 ? { pushWaitMs } : {},
-    ...skills && skills.length ? { skills } : {}
+    ...skills && skills.length ? { skills } : {},
+    ...donts ? { donts } : {},
+    ...dontsModel ? { donts_model: dontsModel } : {}
   };
   if (toolsAllow || toolsDeny) {
     policy.tools = { ...toolsAllow ? { allow: toolsAllow } : {}, ...toolsDeny ? { deny: toolsDeny } : {} };
@@ -23021,6 +23287,47 @@ function parsePolicyYaml(text, agentName) {
   return policy;
 }
 
+// ../crew/donts.ts
+import { DONTS_MAX, DONT_MAX_CHARS, hasControlChars } from "@corenel/protocol";
+var DONT_BLANK = "A don't cannot be blank.";
+var DONT_TOO_LONG = `A don't can be at most ${DONT_MAX_CHARS} characters.`;
+var DONTS_TOO_MANY = `An agent can have at most ${DONTS_MAX} don'ts.`;
+var DONTS_DUPLICATE = "Each don't must be different from the others.";
+var DONT_CONTROL = "A don't cannot contain control characters.";
+var DONTS_MODEL_INVALID = "The model for checking don'ts must be a model id.";
+function dontsProblems(policy) {
+  const out = /* @__PURE__ */ new Set();
+  const list = policy.donts ?? [];
+  if (list.length > DONTS_MAX) out.add(DONTS_TOO_MANY);
+  const seen = /* @__PURE__ */ new Set();
+  let blank = false;
+  let long = false;
+  let dup = false;
+  let control = false;
+  for (const raw of list) {
+    const t = raw.trim();
+    if (t === "") {
+      blank = true;
+      continue;
+    }
+    if (t.length > DONT_MAX_CHARS) long = true;
+    if (hasControlChars(t)) control = true;
+    const key = t.toLowerCase();
+    if (seen.has(key)) dup = true;
+    seen.add(key);
+  }
+  if (blank) out.add(DONT_BLANK);
+  if (long) out.add(DONT_TOO_LONG);
+  if (dup) out.add(DONTS_DUPLICATE);
+  if (control) out.add(DONT_CONTROL);
+  if (policy.donts_model !== void 0) {
+    const m = policy.donts_model.trim();
+    if (m === "" || hasControlChars(m)) out.add(DONTS_MODEL_INVALID);
+  }
+  const order = [DONTS_TOO_MANY, DONT_BLANK, DONT_TOO_LONG, DONTS_DUPLICATE, DONT_CONTROL, DONTS_MODEL_INVALID];
+  return order.filter((s) => out.has(s));
+}
+
 // ../crew/paths.ts
 import { stateDirName as stateDirName2 } from "@corenel/protocol";
 var CREW_SEG = "crew";
@@ -23098,7 +23405,7 @@ function applyAutonomy(def, preset) {
   const orchestration = preset === "interactive" ? { ...rest, checkIn: true } : rest;
   return { policy: { ...def.policy, permissions }, orchestration };
 }
-var ORDER = { deny: 0, ask: 1, allow: 2 };
+var ORDER = { deny: 0, owner: 1, ask: 2, allow: 3 };
 var LABEL = { interactive: "Interactive", hitl: "HITL", autonomous: "Autonomous" };
 var PRESETS = ["interactive", "hitl", "autonomous"];
 function isAutonomyPreset(v) {
@@ -23346,6 +23653,8 @@ function serializePolicy(policy) {
   if (policy.mutatingDefault) ordered.mutatingDefault = policy.mutatingDefault;
   if (policy.permissions && Object.keys(policy.permissions).length) ordered.permissions = policy.permissions;
   if (policy.skills && policy.skills.length) ordered.skills = policy.skills;
+  if (policy.donts && policy.donts.length) ordered.donts = policy.donts;
+  if (policy.donts_model) ordered.donts_model = policy.donts_model;
   if (policy.tools) ordered.tools = policy.tools;
   if (typeof policy.maxTurns === "number") ordered.maxTurns = policy.maxTurns;
   if (typeof policy.maxToolCalls === "number") ordered.maxToolCalls = policy.maxToolCalls;
@@ -23421,9 +23730,24 @@ function stripWorkRoots(settings) {
   const { workRoots: _workRoots, ...rest } = settings;
   return rest;
 }
+async function dontsUnchanged(files, dir, def) {
+  let text;
+  try {
+    text = await files.read(`${dir}/POLICY.yaml`);
+  } catch {
+    return false;
+  }
+  const stored = parsePolicyYaml(text, def.name).donts ?? [];
+  const next = (def.policy.donts ?? []).map((d) => d.trim());
+  return stored.length === next.length && stored.every((d, i) => d === next[i]);
+}
 async function writeCrewAgentAt(files, root, def) {
   if (!isValidAgentName(def.name)) throw new Error(`invalid crew agent name: ${def.name}`);
   const dir = `${root}/${def.name}`;
+  if (!await dontsUnchanged(files, dir, def)) {
+    const problems = dontsProblems(def.policy);
+    if (problems.length) throw new Error(problems.join(" "));
+  }
   await put(files, `${dir}/AGENT.md`, serializeAgentMd(def));
   await put(files, `${dir}/SOUL.md`, def.soul);
   await put(files, `${dir}/PERSONA.md`, def.persona);
@@ -23553,6 +23877,7 @@ function crewBudgetConstraints(def) {
   };
 }
 var MEMORY_BLOCK = registerSyncConfig("crew/memory.md");
+var MEMORY_TOOLS_ONLY_BLOCK = registerSyncConfig("crew/memory-tools-only.md");
 var SELF_DIRECTION_BLOCK = registerSyncConfig("crew/self-direction.md");
 var CHECK_IN_BLOCK = "--- Check-ins ---\nYou are in interactive mode. After each step of the approved plan (each call_agent result, each sidecar_run_check, each git step), write the user a short check-in: what just happened, what is next, and anything that changes the plan. Then continue; do not end your turn to wait. The user can stop the run at any time, and submit_plan, sidecar_git_push and sidecar_open_pr still ask for approval.";
 function identityBlock() {
@@ -23574,10 +23899,17 @@ ${def.soul.trim()}`);
 ${def.persona.trim()}`);
   if (def.instructions.trim()) parts.push(`--- Instructions ---
 ${def.instructions.trim()}`);
+  if (memoryLocation === null) {
+    parts.push(readConfigSyncRendered(MEMORY_TOOLS_ONLY_BLOCK));
+    return withTail(def, parts);
+  }
   const location = memoryLocation ?? "memory/";
   const dir = location.replace(/\/+$/, "");
   const index = `${dir}/MEMORY.md`;
   parts.push(readConfigSyncRendered(MEMORY_BLOCK, { dir, index }));
+  return withTail(def, parts);
+}
+function withTail(def, parts) {
   const selfDirection = selfDirectionBlock(def);
   if (selfDirection) parts.push(selfDirection);
   if (def.orchestration?.checkIn === true) parts.push(CHECK_IN_BLOCK);
@@ -23689,6 +24021,9 @@ var RUN_STATUS_ALIASES = [
   ["max_tokens", "stuck"],
   ["refusal", "policy"],
   ["content_filter", "policy"],
+  // Team don'ts (spec 2026-10-07 Part F): the agent's own rules stopped the
+  // run. A guard refusing to let it finish, the same fact `policy` names.
+  ["donts", "policy"],
   ["interrupted", "aborted"]
 ];
 var RUN_STATUS_BY_RAW = new Map([
@@ -23905,21 +24240,27 @@ function grantOfferedTools(policy, offered) {
 }
 
 // ../crew/memory.ts
+import { MEMORY_USERS_DIR } from "@corenel/protocol";
 import { makeFactStore } from "@corenel/harness/memory/store";
 function agentMemoryRoot(crewRoot2, agentName) {
   return `${crewRoot2}/${agentName}/memory`;
 }
+var USER_KEY = /^[0-9a-f]{64}$/;
+function userMemoryRoot(sharedRoot, userKey) {
+  if (!USER_KEY.test(userKey)) throw new Error("invalid memory partition key");
+  return `${sharedRoot}/${MEMORY_USERS_DIR}/${userKey}`;
+}
+var toItem = (f) => ({
+  id: f.name,
+  name: f.name,
+  type: f.type,
+  description: f.description,
+  text: f.body,
+  tags: [],
+  createdAt: f.created
+});
 function makeAgentMemoryProvider(getFiles, memoryRoot) {
   const store = makeFactStore(getFiles, memoryRoot);
-  const toItem = (f) => ({
-    id: f.name,
-    name: f.name,
-    type: f.type,
-    description: f.description,
-    text: f.body,
-    tags: [],
-    createdAt: f.created
-  });
   return {
     async save(input) {
       return toItem(await store.save(input));
@@ -23943,6 +24284,68 @@ function makeAgentMemoryProvider(getFiles, memoryRoot) {
     }
   };
 }
+var NOT_IN_YOUR_MEMORY = "not in your memory: that name is shared memory, which this run cannot change";
+var ROOM_MEMORY_READ_ONLY = "in a room, memory is read only: a room has no single asker";
+var NO_ASKER_MEMORY_READ_ONLY = "memory is read only for this run: it has no verified asker";
+function makeReadOnlyMemoryProvider(getFiles, memoryRoot, refusal) {
+  const inner = makeAgentMemoryProvider(getFiles, memoryRoot);
+  return {
+    async save() {
+      throw new Error(refusal);
+    },
+    read: (name) => inner.read(name),
+    recall: (query, limit) => inner.recall(query, limit),
+    list: (limit) => inner.list(limit),
+    async forget() {
+      throw new Error(refusal);
+    },
+    core: () => inner.core ? inner.core() : Promise.resolve({ items: [], archivedCount: 0 })
+  };
+}
+function makePartitionedMemoryProvider(getFiles, sharedRoot, userKey) {
+  const shared = makeFactStore(getFiles, sharedRoot);
+  const mine = makeFactStore(getFiles, userMemoryRoot(sharedRoot, userKey));
+  const ownNames = async () => new Set(await mine.names());
+  return {
+    async save(input) {
+      return toItem(await mine.save(input));
+    },
+    async read(name) {
+      const hit = await mine.read(name) ?? await shared.read(name);
+      return hit ? toItem(hit) : null;
+    },
+    async recall(query, limit = 5) {
+      const [m, s, own] = await Promise.all([mine.rankCandidates(query, limit), shared.rankCandidates(query, limit), ownNames()]);
+      const merged = [
+        ...m.map((c) => ({ ...c, from: "mine" })),
+        ...s.filter((c) => !own.has(c.name)).map((c) => ({ ...c, from: "shared" }))
+      ].sort((a, b) => b.score - a.score).slice(0, limit);
+      const [mh, sh] = await Promise.all([
+        mine.hydrateRecalled(merged.filter((c) => c.from === "mine").map((c) => c.name)),
+        shared.hydrateRecalled(merged.filter((c) => c.from === "shared").map((c) => c.name))
+      ]);
+      const byName = /* @__PURE__ */ new Map();
+      for (const f of sh) byName.set(f.name, f);
+      for (const f of mh) byName.set(f.name, f);
+      return merged.map((c) => byName.get(c.name)).filter((f) => f !== void 0).map(toItem);
+    },
+    async list(limit) {
+      const [m, s, own] = await Promise.all([mine.list(limit), shared.list(limit), ownNames()]);
+      return [...m, ...s.filter((f) => !own.has(f.name))].sort((a, b) => b.updated - a.updated).slice(0, limit ?? 50).map(toItem);
+    },
+    async forget(name) {
+      if (!(await ownNames()).has(name) && (await shared.names()).includes(name)) throw new Error(NOT_IN_YOUR_MEMORY);
+      return mine.forget(name);
+    },
+    async core() {
+      const [m, s, own] = await Promise.all([mine.core(), shared.core(), ownNames()]);
+      return {
+        items: [...m.facts, ...s.facts.filter((f) => !own.has(f.name))].map(toItem),
+        archivedCount: m.archivedCount + s.archivedCount
+      };
+    }
+  };
+}
 
 // ../crew/room/types.ts
 function roleOf(p) {
@@ -24808,107 +25211,8 @@ function tokenGuard(getToken) {
   };
 }
 
-// src/login.ts
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
-var MIN_POLL_MS = 1e3;
-var DEFAULT_LIFETIME_S = 900;
-var ACCOUNT_LOOKUP_MS = 5e3;
-function deadlineSignal(ms, outer) {
-  const ac = new AbortController();
-  const onOuter = () => ac.abort();
-  const timer = setTimeout(() => ac.abort(), ms);
-  if (outer) {
-    if (outer.aborted) ac.abort();
-    else outer.addEventListener("abort", onOuter, { once: true });
-  }
-  return {
-    signal: ac.signal,
-    dispose: () => {
-      clearTimeout(timer);
-      outer?.removeEventListener("abort", onOuter);
-    }
-  };
-}
-async function whoIsThis(base, token, f, outer, deadlineMs = ACCOUNT_LOOKUP_MS) {
-  const { signal, dispose } = deadlineSignal(deadlineMs, outer);
-  try {
-    const res = await f(`${base}/auth/me`, {
-      headers: { Authorization: `Bearer ${token}` },
-      signal
-    });
-    if (!res.ok) return void 0;
-    const body = JSON.parse(await res.text());
-    const email = body?.user?.email;
-    if (typeof email !== "string") return void 0;
-    const trimmed = email.trim();
-    return trimmed ? trimmed : void 0;
-  } catch {
-    return void 0;
-  } finally {
-    dispose();
-  }
-}
-function defaultOpen(uri, code3) {
-  process.stdout.write(`
-  To authorize, open:  ${uri}
-  and enter the code:  ${code3}
-
-  Waiting for authorization\u2026
-`);
-}
-async function deviceLogin(opts) {
-  const f = opts.fetchImpl ?? fetch;
-  const base = opts.base.replace(/\/$/, "");
-  const post = async (path, body) => {
-    const url = `${base}${path}`;
-    const res = await f(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-      signal: opts.signal
-    });
-    const text = await res.text();
-    try {
-      return JSON.parse(text);
-    } catch {
-      const looksLikeHtml = /^\s*</.test(text);
-      throw new Error(
-        `${url} answered ${res.status} with ${looksLikeHtml ? "an HTML page" : "a non-JSON body"}, not JSON.` + (res.status === 404 ? `
-  That usually means --base is wrong. The device endpoints live under /api \u2014 try --base ${base.replace(/\/api$/, "")}/api` : "")
-      );
-    }
-  };
-  const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent pair" });
-  if (!dc.device_code) throw new Error("device authorization failed");
-  (opts.open ?? defaultOpen)(dc.verification_uri, dc.user_code);
-  let interval = opts.pollMs ?? Math.max(MIN_POLL_MS, (dc.interval ?? 5) * 1e3);
-  const lifetimeMs = (typeof dc.expires_in === "number" && dc.expires_in > 0 ? dc.expires_in : DEFAULT_LIFETIME_S) * 1e3;
-  const deadline = Date.now() + lifetimeMs;
-  for (; ; ) {
-    if (opts.signal?.aborted) throw new Error("login cancelled");
-    if (Date.now() >= deadline) {
-      throw new Error(`the code ${dc.user_code} expired before it was authorized -- run \`corenel login\` again`);
-    }
-    await sleep2(interval);
-    const tok = await post("/oauth/token", {
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      device_code: dc.device_code,
-      client_id: "corenel-cli"
-    });
-    if (tok.access_token) {
-      const claimed = typeof tok.account === "string" ? tok.account.trim() : "";
-      const account = claimed || await whoIsThis(base, tok.access_token, f, opts.signal, opts.accountLookupMs);
-      await opts.store(tok.access_token, account || void 0);
-      return tok.access_token;
-    }
-    if (tok.error === "authorization_pending") continue;
-    if (tok.error === "slow_down") {
-      interval += 5e3;
-      continue;
-    }
-    throw new Error(tok.error_description || tok.error || "login failed");
-  }
-}
+// src/cli.ts
+init_tools_node();
 
 // src/runAgent.ts
 import { runAgent } from "@corenel/harness/core/loop";
@@ -24952,11 +25256,13 @@ async function apiBase(explicit, opts = {}) {
   return (await resolveCliApiBase(explicit, opts)).base;
 }
 async function resolveCliApiBase(explicit, opts = {}) {
+  const env = opts.env ?? process.env;
   const resolved = applySourceRunDevBase(
     await resolveApiBase({
       explicit,
-      env: opts.env ?? process.env,
-      ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+      env,
+      ...opts.stateDir ? { stateDir: opts.stateDir } : {},
+      ...opts.ignoreCredential ? { ignoreCredential: true } : {}
     }),
     opts.sourceRun ?? sourceRunDefault
   );
@@ -25011,6 +25317,13 @@ function guestCrewRoot() {
 function guestAgentMemoryRoot(agent) {
   return agentMemoryRoot(guestCrewRoot(), agent);
 }
+function guestMemoryFor(files, agent, mode) {
+  const root = guestAgentMemoryRoot(agent);
+  if (mode?.kind === "read-only") {
+    return { provider: makeReadOnlyMemoryProvider(() => files, root, NO_ASKER_MEMORY_READ_ONLY), promptRoot: null };
+  }
+  return { provider: makeAgentMemoryProvider(() => files, root), promptRoot: root };
+}
 function mutatingCeiling(tools, defaultLevel = "deny") {
   const overrides = {};
   for (const t of tools) if (!t.mutates || t.roomSafe) overrides[toolAddress3(t)] = "allow";
@@ -25027,8 +25340,7 @@ function eventLine(e) {
 async function runCrewAgentCli(opts) {
   const files = new NodeFileService(opts.cwd);
   const root = guestCrewRoot();
-  const memoryRoot = guestAgentMemoryRoot(opts.agent);
-  const memory = makeAgentMemoryProvider(() => files, memoryRoot);
+  const { provider: memory, promptRoot: memoryRoot } = guestMemoryFor(files, opts.agent, opts.memory);
   const def = await loadCrewAgentAtIfExists(files, root, opts.agent, "workspace");
   if (!def) {
     opts.warn(`no such agent "${opts.agent}" under ${opts.cwd}/${root}`);
@@ -25059,13 +25371,13 @@ ${extra}` : base;
   } catch {
   }
   const realConsole = { log: console.log, info: console.info, warn: console.warn, debug: console.debug };
-  const toStderr = (...parts) => {
+  const toStderr2 = (...parts) => {
     opts.warn(parts.map((x) => typeof x === "string" ? x : JSON.stringify(x)).join(" "));
   };
-  console.log = toStderr;
-  console.info = toStderr;
-  console.warn = toStderr;
-  console.debug = toStderr;
+  console.log = toStderr2;
+  console.info = toStderr2;
+  console.warn = toStderr2;
+  console.debug = toStderr2;
   const ac = new AbortController();
   const effectivePolicy = opts.policy ?? def.policy ?? STANDARD_POLICY;
   const operatorUnattended = opts.policy?.unattended;
@@ -25239,10 +25551,10 @@ async function runExtension(ext, rest, look = {}) {
   process.on("SIGINT", onInt);
   process.on("SIGTERM", onTerm);
   try {
-    return await new Promise((resolve4, reject) => {
+    return await new Promise((resolve5, reject) => {
       child.on("error", reject);
       child.on("exit", (code3, signal) => {
-        resolve4(code3 ?? (signal === "SIGINT" ? 130 : signal ? 143 : 1));
+        resolve5(code3 ?? (signal === "SIGINT" ? 130 : signal ? 143 : 1));
       });
     });
   } finally {
@@ -25374,8 +25686,8 @@ init_tools_node();
 function hintOf(token) {
   return maskToken(token);
 }
-async function authState(resolve4 = (env2) => resolveNodeCredential({ env: env2 }), env = process.env) {
-  const r = await resolve4(env);
+async function authState(resolve5 = (env2) => resolveNodeCredential({ env: env2 }), env = process.env) {
+  const r = await resolve5(env);
   if (!r.token) return { source: "none", path: authTokenPath() };
   const source = r.source === "env" ? "env" : "file";
   return { source, path: r.path ?? authTokenPath(), hint: hintOf(r.token) };
@@ -25405,13 +25717,21 @@ async function runAuth(out = (s) => process.stdout.write(s)) {
 }
 async function runLogout(out = (s) => process.stdout.write(s)) {
   const before = await authState();
-  await clearAllCredentials();
+  try {
+    await clearAllCredentials();
+  } catch (err) {
+    out(`Sign-out did not complete: ${err instanceof Error ? err.message : String(err)}
+`);
+    out("  This machine is still signed in. Close whatever holds the file and run `corenel logout` again.\n");
+    return 1;
+  }
   if (before.source === "file") out(`Signed out. Removed ${before.path}
 `);
   else out("Nothing to forget \u2014 no stored token.\n");
   if (process.env.CORENEL_TOKEN) {
     out("  NOTE: CORENEL_TOKEN is still set in this environment, so you are still authenticated.\n");
   }
+  return 0;
 }
 
 // src/doctor.ts
@@ -25486,7 +25806,11 @@ var KNOWN_KEYS = [
   "audit",
   "sendTelemetry",
   "approvalsThreshold",
-  "approvalsCaptureRawArgs"
+  "approvalsCaptureRawArgs",
+  "speech",
+  "speechModel",
+  "peerCallTimeoutMs",
+  "peers"
 ];
 function daemonConfigPath(stateDir) {
   return join8(stateDir, "daemon.json");
@@ -25619,12 +25943,19 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "allow-shell",
   "allow-mutations",
   // see hasAllowMutationsFlag() below
+  "memory-read-only",
+  // corenel run-agent: the daemon's read-only memory mode
   "global"
   // corenel approvals revoke/clear-log --global
 ]);
 function isBooleanFlag(name) {
   return BOOLEAN_FLAGS.has(name);
 }
+function consumesNext(parsed, next) {
+  if (parsed.value !== void 0 || isBooleanFlag(parsed.name)) return false;
+  if (parsed.name === "resume") return next !== void 0 && !next.startsWith("--");
+  return true;
+}
 function classifyToken(tok) {
   if (tok === "=") throw new MalformedFlagError(tok);
   if (!tok.startsWith("--")) return null;
@@ -25638,7 +25969,11 @@ function classifyToken(tok) {
 function flag(argv, name, fallback) {
   for (let i = 0; i < argv.length; i++) {
     const parsed = classifyToken(argv[i]);
-    if (!parsed || parsed.name !== name) continue;
+    if (!parsed) continue;
+    if (parsed.name !== name) {
+      if (consumesNext(parsed, argv[i + 1])) i++;
+      continue;
+    }
     if (parsed.value !== void 0) return parsed.value;
     if (!argv[i + 1]) throw new MalformedFlagError(argv[i]);
     return argv[i + 1];
@@ -25650,7 +25985,7 @@ function forEachPositional(argv, visit) {
     const tok = argv[i];
     const parsed = classifyToken(tok);
     if (parsed) {
-      if (parsed.value === void 0 && !isBooleanFlag(parsed.name)) i++;
+      if (consumesNext(parsed, argv[i + 1])) i++;
       continue;
     }
     visit(tok);
@@ -25674,11 +26009,10 @@ function hasBooleanFlag(argv, name) {
   for (let i = 0; i < argv.length; i++) {
     const parsed = classifyToken(argv[i]);
     if (!parsed) continue;
-    if (parsed.value === void 0 && !isBooleanFlag(parsed.name)) {
-      i++;
+    if (parsed.name !== name) {
+      if (consumesNext(parsed, argv[i + 1])) i++;
       continue;
     }
-    if (parsed.name !== name) continue;
     if (isOnValue(parsed.value)) return true;
   }
   return false;
@@ -25697,10 +26031,13 @@ function resumeFlag(argv) {
   return void 0;
 }
 function hasValueFlag(argv, name) {
-  return argv.some((tok) => {
-    const parsed = classifyToken(tok);
-    return parsed !== null && parsed.name === name;
-  });
+  for (let i = 0; i < argv.length; i++) {
+    const parsed = classifyToken(argv[i]);
+    if (!parsed) continue;
+    if (parsed.name === name) return true;
+    if (consumesNext(parsed, argv[i + 1])) i++;
+  }
+  return false;
 }
 
 // src/doctor.ts
@@ -25980,12 +26317,12 @@ async function runRepl(deps) {
   rl.on("close", () => {
     closed = true;
   });
-  const ask = (q) => closed ? Promise.resolve(null) : new Promise((resolve4) => {
-    const onClose = () => resolve4(null);
+  const ask = (q) => closed ? Promise.resolve(null) : new Promise((resolve5) => {
+    const onClose = () => resolve5(null);
     rl.once("close", onClose);
     rl.question(q, (answer) => {
       rl.off("close", onClose);
-      resolve4(answer);
+      resolve5(answer);
     });
   });
   const askSuggestions = async () => {
@@ -26089,7 +26426,7 @@ async function runRepl(deps) {
 
 // src/approvals.ts
 init_tools_node();
-import { join as join9, resolve as resolve3 } from "node:path";
+import { join as join9, resolve as resolve4 } from "node:path";
 import { approvalsRoot } from "@corenel/protocol";
 import { createApprovals } from "@corenel/harness/approvals";
 function guardStanding(inner, reason) {
@@ -26106,7 +26443,7 @@ function guardStanding(inner, reason) {
   };
 }
 async function openCliApprovals(opts) {
-  const cwd = resolve3(opts.cwd);
+  const cwd = resolve4(opts.cwd);
   const home = approvalsHomeDir(opts.homeBase);
   await ensurePrivateDir(home);
   const hit = await insideAnyRoot([cwd], home);
@@ -26334,7 +26671,7 @@ function killTree(child) {
   }
 }
 function execute(command, opts) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const child = spawn3(command, {
       cwd: opts.cwd,
       shell: true,
@@ -26366,7 +26703,7 @@ function execute(command, opts) {
     const finish = (code3) => {
       clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
-      resolve4({ code: code3, stdout, stderr, timedOut });
+      resolve5({ code: code3, stdout, stderr, timedOut });
     };
     child.on("error", (e) => {
       stderr += String(e);
@@ -26423,7 +26760,7 @@ import { errMessage } from "@corenel/protocol";
 import { wsChannel } from "@corenel/harness/sidecar/wsChannel";
 function nodeSidecarChannel(opts) {
   const { url, signal } = opts;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
       reject(new Error("sidecar connection aborted"));
       return;
@@ -26441,7 +26778,7 @@ function nodeSidecarChannel(opts) {
       if (settled) return;
       settled = true;
       cleanup();
-      resolve4(wsChannel(ws));
+      resolve5(wsChannel(ws));
     };
     const settleReject = (err) => {
       if (settled) return;
@@ -26647,15 +26984,20 @@ async function sidecarCredential(url, env, store) {
   };
 }
 
-// src/sidecarIdentity.ts
+// ../tools-node/pairingAssertion.ts
 function cliIdentity(o) {
+  const who = o.who ?? "this CLI";
+  const signIn = o.signIn ?? "corenel login";
   const fetchImpl = o.fetchImpl ?? fetch;
   const timeoutMs = o.timeoutMs ?? 8e3;
   let last = null;
+  let lastDetail = null;
   return {
     problem: () => last,
+    detail: () => lastDetail ?? last,
     answer: async ({ nonce, sidecarId, jkt, orgId }) => {
       last = null;
+      lastDetail = null;
       let token;
       try {
         token = await o.token();
@@ -26663,7 +27005,7 @@ function cliIdentity(o) {
         token = null;
       }
       if (!token) {
-        last = "this CLI is not signed in, and the sidecar only admits a verified account. Run `corenel login` (or set CORENEL_TOKEN), then try again.";
+        last = `${who} is not signed in, and the sidecar only admits a verified account. Run \`${signIn}\` (or set CORENEL_TOKEN), then try again.`;
         return null;
       }
       try {
@@ -26682,7 +27024,7 @@ function cliIdentity(o) {
             code3 = void 0;
           }
           if (code3 === "CLI_SCOPE") {
-            last = "this CLI sign-in is not allowed to connect to sidecars. Run `corenel login` again and allow sidecar access when you approve it.";
+            last = `${who}'s sign-in is not allowed to connect to sidecars. Run \`${signIn}\` again and allow sidecar access when you approve it.`;
             return null;
           }
           if (orgId) {
@@ -26691,7 +27033,7 @@ function cliIdentity(o) {
           }
         }
         if (res.status === 401) {
-          last = "the API refused this CLI sign-in. Run `corenel login` again, then try again.";
+          last = `the API refused ${who}'s sign-in. Run \`${signIn}\` again, then try again.`;
           return null;
         }
         if (!res.ok) {
@@ -26706,7 +27048,9 @@ function cliIdentity(o) {
         }
         return assertion;
       } catch (e) {
-        last = `could not reach the API for a pairing assertion (${e instanceof Error ? e.message : String(e)}).`;
+        const reason = `could not reach the API for a pairing assertion (${e instanceof Error ? e.message : String(e)}).`;
+        last = o.unreachable ?? reason;
+        lastDetail = reason;
         return null;
       }
     }
@@ -27358,7 +27702,7 @@ function isMcpTool(value) {
 
 // ../mcp/src/config.ts
 init_tools_node();
-import { readFile as readFile3, writeFile as writeFile2, mkdir as mkdir2, chmod } from "node:fs/promises";
+import { readFile as readFile3, mkdir as mkdir2 } from "node:fs/promises";
 function isUsableServer(v) {
   if (typeof v !== "object" || v === null) return false;
   const r = v;
@@ -27394,6 +27738,20 @@ async function readAuthJson(stateDir) {
     return {};
   }
 }
+function locked(stateDir, fn) {
+  return withAuthDocLock(credentialFilePath(stateDir), fn);
+}
+async function docForWrite(stateDir) {
+  const path = credentialFilePath(stateDir);
+  const read = await readAuthDocForWrite(path, "save");
+  if (read.kind === "doc") return read.doc;
+  if (read.kind === "corrupt") await backupCorruptAuthDoc(path, read.bytes);
+  return {};
+}
+async function docForClear(stateDir) {
+  const read = await readAuthDocForWrite(credentialFilePath(stateDir), "save");
+  return read.kind === "doc" ? read.doc : null;
+}
 function isMcpAuthSection(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -27430,68 +27788,165 @@ async function readMcpClient(stateDir, server) {
   return isUsableClient(rec) ? rec : null;
 }
 async function writeMcpClient(stateDir, server, client) {
-  const doc = await readAuthJson(stateDir);
-  const prev = doc.mcpClients;
-  const section = typeof prev === "object" && prev !== null && !Array.isArray(prev) ? { ...prev } : {};
-  section[server] = client;
-  const next = { ...doc, mcpClients: section };
-  const path = credentialFilePath(stateDir);
-  await mkdir2(credentialDir(stateDir), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(next, null, 2)}
-`, { mode: 384 });
-  try {
-    await chmod(path, 384);
-  } catch {
-  }
+  assertServerName(server);
+  await locked(stateDir, async () => {
+    const doc = await docForWrite(stateDir);
+    const prev = doc.mcpClients;
+    const section = typeof prev === "object" && prev !== null && !Array.isArray(prev) ? { ...prev } : {};
+    section[server] = client;
+    await writeAuthJson(stateDir, { ...doc, mcpClients: section });
+  });
 }
 async function clearMcpClient(stateDir, server) {
-  const doc = await readAuthJson(stateDir);
-  const prev = doc.mcpClients;
-  if (typeof prev !== "object" || prev === null || Array.isArray(prev)) return;
-  const section = { ...prev };
-  if (!(server in section)) return;
-  delete section[server];
-  const path = credentialFilePath(stateDir);
-  await mkdir2(credentialDir(stateDir), { recursive: true });
-  await writeFile2(path, `${JSON.stringify({ ...doc, mcpClients: section }, null, 2)}
-`, { mode: 384 });
-  try {
-    await chmod(path, 384);
-  } catch {
-  }
+  await locked(stateDir, async () => {
+    const doc = await docForClear(stateDir);
+    if (!doc) return;
+    const prev = doc.mcpClients;
+    if (typeof prev !== "object" || prev === null || Array.isArray(prev)) return;
+    const section = { ...prev };
+    if (!(server in section)) return;
+    delete section[server];
+    await writeAuthJson(stateDir, { ...doc, mcpClients: section });
+  });
 }
 async function clearMcpCredential(stateDir, server) {
-  const doc = await readAuthJson(stateDir);
-  if (!isMcpAuthSection(doc.mcp)) return;
-  const section = { ...doc.mcp };
-  if (!(server in section)) return;
-  delete section[server];
-  const path = credentialFilePath(stateDir);
-  await mkdir2(credentialDir(stateDir), { recursive: true });
-  await writeFile2(path, `${JSON.stringify({ ...doc, mcp: section }, null, 2)}
-`, { mode: 384 });
-  try {
-    await chmod(path, 384);
-  } catch {
-  }
+  await locked(stateDir, async () => {
+    const doc = await docForClear(stateDir);
+    if (!doc) return;
+    if (!isMcpAuthSection(doc.mcp)) return;
+    const section = { ...doc.mcp };
+    if (!(server in section)) return;
+    delete section[server];
+    await writeAuthJson(stateDir, { ...doc, mcp: section });
+  });
 }
 async function forgetMcpServerSecrets(stateDir, server) {
   await clearMcpCredential(stateDir, server);
   await clearMcpClient(stateDir, server);
+  await clearServerFromAllAgents(stateDir, server);
 }
 async function writeMcpCredential(stateDir, server, cred) {
-  const doc = await readAuthJson(stateDir);
-  const section = isMcpAuthSection(doc.mcp) ? { ...doc.mcp } : {};
-  section[server] = cred;
-  const next = { ...doc, mcp: section };
-  const path = credentialFilePath(stateDir);
+  assertServerName(server);
+  await locked(stateDir, async () => {
+    const doc = await docForWrite(stateDir);
+    const section = isMcpAuthSection(doc.mcp) ? { ...doc.mcp } : {};
+    section[server] = cred;
+    await writeAuthJson(stateDir, { ...doc, mcp: section });
+  });
+}
+var SERVER_SLOT = { kind: "server" };
+var MAX_ACCESS_KEY_LEN = 512;
+var FORBIDDEN_KEY = "__proto__";
+function assertAccessKey(accessKey) {
+  if (typeof accessKey !== "string" || !accessKey || accessKey.length > MAX_ACCESS_KEY_LEN || accessKey === FORBIDDEN_KEY) {
+    throw new Error("invalid agent access key");
+  }
+}
+function assertServerName(server) {
+  if (typeof server !== "string" || !server || server === FORBIDDEN_KEY) {
+    throw new Error("invalid MCP server name");
+  }
+}
+function agentsOf(doc) {
+  const s = doc.agents;
+  return typeof s === "object" && s !== null && !Array.isArray(s) ? { ...s } : {};
+}
+async function writeAuthJson(stateDir, next) {
   await mkdir2(credentialDir(stateDir), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(next, null, 2)}
-`, { mode: 384 });
   try {
-    await chmod(path, 384);
-  } catch {
+    await writeFilePrivateAtomic(credentialFilePath(stateDir), `${JSON.stringify(next, null, 2)}
+`);
+  } catch (err) {
+    const code3 = typeof err === "object" && err !== null ? err.code : void 0;
+    if (code3 === "EPERM" || code3 === "EBUSY") {
+      throw Object.assign(new Error(`auth.json is in use; retry (${code3})`), { code: code3 });
+    }
+    throw err;
+  }
+}
+async function readMcpCredentialFor(stateDir, server, slot) {
+  if (slot.kind === "server") return readMcpCredential(stateDir, server);
+  assertAccessKey(slot.accessKey);
+  assertServerName(server);
+  const agents = agentsOf(await readAuthJson(stateDir));
+  if (!Object.prototype.hasOwnProperty.call(agents, slot.accessKey)) return null;
+  const perAgent = agents[slot.accessKey];
+  if (!isMcpAuthSection(perAgent)) return null;
+  if (!Object.prototype.hasOwnProperty.call(perAgent, server)) return null;
+  const cred = perAgent[server];
+  return isUsableCredential(cred) ? cred : null;
+}
+async function writeMcpCredentialFor(stateDir, server, slot, cred) {
+  if (slot.kind === "server") return writeMcpCredential(stateDir, server, cred);
+  assertAccessKey(slot.accessKey);
+  assertServerName(server);
+  const key = slot.accessKey;
+  await locked(stateDir, async () => {
+    const doc = await docForWrite(stateDir);
+    const agents = agentsOf(doc);
+    const prev = agents[key];
+    const perAgent = isMcpAuthSection(prev) ? { ...prev } : {};
+    perAgent[server] = cred;
+    agents[key] = perAgent;
+    await writeAuthJson(stateDir, { ...doc, agents });
+  });
+}
+function sameCredential(stored, expected) {
+  if (stored.kind === "oauth" && expected.kind === "oauth") {
+    return expected.refreshToken !== void 0 ? stored.refreshToken === expected.refreshToken : stored.refreshToken === void 0 && stored.accessToken === expected.accessToken;
+  }
+  if (stored.kind === "headers" && expected.kind === "headers") {
+    return JSON.stringify(stored.headers) === JSON.stringify(expected.headers);
+  }
+  return false;
+}
+async function replaceMcpCredentialIfUnchanged(stateDir, server, slot, expected, next) {
+  assertServerName(server);
+  if (slot.kind === "agent") assertAccessKey(slot.accessKey);
+  return locked(stateDir, () => replaceIfUnchangedLocked(stateDir, server, slot, expected, next));
+}
+async function replaceIfUnchangedLocked(stateDir, server, slot, expected, next) {
+  const doc = await docForClear(stateDir);
+  if (!doc) return false;
+  if (slot.kind === "server") {
+    if (!isMcpAuthSection(doc.mcp)) return false;
+    const section = { ...doc.mcp };
+    if (!Object.prototype.hasOwnProperty.call(section, server)) return false;
+    const stored2 = section[server];
+    if (!isUsableCredential(stored2) || !sameCredential(stored2, expected)) return false;
+    section[server] = next;
+    await writeAuthJson(stateDir, { ...doc, mcp: section });
+    return true;
+  }
+  const agents = agentsOf(doc);
+  if (!Object.prototype.hasOwnProperty.call(agents, slot.accessKey)) return false;
+  const prev = agents[slot.accessKey];
+  if (!isMcpAuthSection(prev) || !Object.prototype.hasOwnProperty.call(prev, server)) return false;
+  const perAgent = { ...prev };
+  const stored = perAgent[server];
+  if (!isUsableCredential(stored) || !sameCredential(stored, expected)) return false;
+  perAgent[server] = next;
+  agents[slot.accessKey] = perAgent;
+  await writeAuthJson(stateDir, { ...doc, agents });
+  return true;
+}
+async function clearServerFromAllAgents(stateDir, server) {
+  await locked(stateDir, () => clearServerFromAllAgentsLocked(stateDir, server));
+}
+async function clearServerFromAllAgentsLocked(stateDir, server) {
+  const doc = await docForClear(stateDir);
+  if (!doc) return;
+  const agents = agentsOf(doc);
+  let changed = false;
+  for (const [key, prev] of Object.entries(agents)) {
+    if (!isMcpAuthSection(prev) || !Object.prototype.hasOwnProperty.call(prev, server)) continue;
+    const perAgent = { ...prev };
+    delete perAgent[server];
+    if (Object.keys(perAgent).length) agents[key] = perAgent;
+    else delete agents[key];
+    changed = true;
   }
+  if (changed) await writeAuthJson(stateDir, { ...doc, agents });
 }
 
 // ../mcp/src/oauth/discovery.ts
@@ -27671,7 +28126,7 @@ function isExpired(cred, nowMs) {
 }
 
 // ../mcp/src/auth.ts
-import { DEFAULT_API_BASE as DEFAULT_API_BASE4 } from "@corenel/protocol";
+import { DEFAULT_API_BASE as DEFAULT_API_BASE4, AGENT_CREDENTIAL_MISSING } from "@corenel/protocol";
 function safeOrigin(url) {
   try {
     return new URL(url).origin;
@@ -27702,22 +28157,30 @@ function isLoopbackHost(hostname2) {
   const h = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
   return h === "localhost" || h === "127.0.0.1" || h === "::1";
 }
-function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null, relayBases = async () => [], devApiBases = []) {
+function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null, relayBases = async () => [], devApiBases = [], slot = SERVER_SLOT) {
   async function doRefresh(cred) {
     if (!cred.refreshToken) {
+      if (slot.kind === "agent") {
+        throw new Error(`${AGENT_CREDENTIAL_MISSING}: the agent credential for MCP server "${server.name}" has expired and has no refresh token; the agent's owner must sign the agent in again.`);
+      }
       throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
     }
     const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
     const refreshed = await refresh(meta, cred, fetchImpl);
-    await writeMcpCredential(stateDir, server.name, refreshed);
+    if (!await replaceMcpCredentialIfUnchanged(stateDir, server.name, slot, cred, refreshed)) {
+      throw new Error(`The credential for MCP server "${server.name}" changed while it was being refreshed; retry the call.`);
+    }
     return refreshed;
   }
   return {
     async headers() {
-      const cred = await readMcpCredential(stateDir, server.name);
+      const cred = await readMcpCredentialFor(stateDir, server.name, slot);
       if (server.hosted && !isCorenelRelayUrl(server.url, [DEFAULT_API_BASE4, ...await relayBases()], devApiBases)) {
         throw new Error(`"${server.name}" is marked hosted but ${safeOrigin(server.url)} is not a Corenel relay; refusing to send the account token there.`);
       }
+      if (!cred && slot.kind === "agent") {
+        throw new Error(`${AGENT_CREDENTIAL_MISSING}: no agent credential is set for MCP server "${server.name}"`);
+      }
       if (!cred && !server.hosted) {
         throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
       }
@@ -27728,7 +28191,7 @@ function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = asy
       return account ? [...moved, { name: "Authorization", value: `Bearer ${account}` }] : moved;
     },
     async onUnauthorized() {
-      const cred = await readMcpCredential(stateDir, server.name);
+      const cred = await readMcpCredentialFor(stateDir, server.name, slot);
       if (!cred || cred.kind !== "oauth") return false;
       try {
         await doRefresh(cred);
@@ -27768,15 +28231,15 @@ async function accountTokenFor(stateDir) {
 }
 function mcpClientFactory(opts = {}) {
   const devApiBases = [...opts.devApiBases ?? []];
-  return (stateDir, server) => buildClient(stateDir, server, devApiBases);
+  return (stateDir, server, slot = SERVER_SLOT) => buildClient(stateDir, server, devApiBases, slot);
 }
-function defaultClientFactory(stateDir, server) {
-  return buildClient(stateDir, server, []);
+function defaultClientFactory(stateDir, server, slot = SERVER_SLOT) {
+  return buildClient(stateDir, server, [], slot);
 }
-function buildClient(stateDir, server, devApiBases) {
+function buildClient(stateDir, server, devApiBases, slot) {
   return new McpHttpClient(
     server,
-    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir), () => relayBasesFor(stateDir), devApiBases)
+    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir), () => relayBasesFor(stateDir), devApiBases, slot)
   );
 }
 async function relayBasesFor(stateDir) {
@@ -27788,6 +28251,21 @@ async function relayBasesFor(stateDir) {
   }
 }
 var SERVER_CONNECT_TIMEOUT_MS = 3e4;
+function mcpClientKey(server, slot) {
+  return JSON.stringify(slot.kind === "server" ? [server] : [server, slot.accessKey]);
+}
+function accessKeyOf(key) {
+  const parts = JSON.parse(key);
+  return Array.isArray(parts) && parts.length === 2 && typeof parts[1] === "string" ? parts[1] : void 0;
+}
+function withDeadline(p, ms, message) {
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(message)), ms);
+  });
+  p.catch(() => void 0);
+  return Promise.race([p, deadline]).finally(() => clearTimeout(timer));
+}
 var McpRegistry = class {
   constructor(stateDir, clientFactory = defaultClientFactory, configEnv) {
     this.stateDir = stateDir;
@@ -27817,6 +28295,11 @@ var McpRegistry = class {
   // that land on the same cold server in the same turn share one connection
   // instead of racing three.
   connecting = /* @__PURE__ */ new Map();
+  // Agent-slot clients (spec 2026-10-01 Part D), keyed by mcpClientKey. Kept
+  // apart from `connected`: those are the daemon's own credential, and the
+  // two must never be confused for each other.
+  slotted = /* @__PURE__ */ new Map();
+  slotConnecting = /* @__PURE__ */ new Map();
   /**
    * Connect to every configured server and cache its tools. Never throws --
    * a server that fails to initialize, or fails listing tools, is recorded
@@ -27847,8 +28330,8 @@ var McpRegistry = class {
    * tell doctor one thing and the registered tools another. */
   async connectOne(server, timeoutMs, onServer) {
     let timer;
-    const deadline = new Promise((resolve4) => {
-      timer = setTimeout(() => resolve4("timeout"), timeoutMs);
+    const deadline = new Promise((resolve5) => {
+      timer = setTimeout(() => resolve5("timeout"), timeoutMs);
     });
     const attempt = (async () => {
       const client = this.clientFactory(this.stateDir, server);
@@ -27947,6 +28430,55 @@ var McpRegistry = class {
     }
     return entry.client.callTool(tool, args);
   }
+  /** `server`'s tools as `slot`'s credential sees them. Throws when the
+   *  server is not configured or cannot be reached with that credential. */
+  async listAs(server, slot) {
+    return (await this.connectedAs(server, slot)).tools;
+  }
+  /** Call one tool with `slot`'s credential. The server slot is exactly
+   *  `call()`; an agent slot never touches the server's own client. */
+  async callAs(server, tool, args, slot) {
+    if (slot.kind === "server") return this.call(server, tool, args);
+    return (await this.connectedAs(server, slot)).client.callTool(tool, args);
+  }
+  /** Drop every agent-slot client of `accessKey` (credentials changed, or the
+   *  agent was deleted); the next call connects afresh. In-flight connects are
+   *  dropped too: one that settles after this is never cached. */
+  forgetAgentClients(accessKey) {
+    for (const key of [...this.slotted.keys()]) if (accessKeyOf(key) === accessKey) this.slotted.delete(key);
+    for (const key of [...this.slotConnecting.keys()]) if (accessKeyOf(key) === accessKey) this.slotConnecting.delete(key);
+  }
+  async connectedAs(server, slot) {
+    if (slot.kind === "server") {
+      await this.ensureConnected(server);
+      const entry = this.connected.get(server);
+      if (!entry) throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
+      return entry;
+    }
+    const key = mcpClientKey(server, slot);
+    const hit = this.slotted.get(key);
+    if (hit) return hit;
+    const inflight = this.slotConnecting.get(key);
+    if (inflight) return inflight;
+    const self = {};
+    const current = () => self.attempt !== void 0 && this.slotConnecting.get(key) === self.attempt;
+    const attempt = (async () => {
+      const def = (await readMcpServers(this.stateDir, this.configEnv)).find((s) => s.name === server);
+      if (!def) throw new Error(`MCP server "${server}" is not configured on this daemon`);
+      const client = this.clientFactory(this.stateDir, def, slot);
+      const entry = await withDeadline((async () => {
+        await client.initialize();
+        return { client, tools: await client.listTools() };
+      })(), SERVER_CONNECT_TIMEOUT_MS, `MCP server "${server}" timed out after ${SERVER_CONNECT_TIMEOUT_MS / 1e3}s`);
+      if (current()) this.slotted.set(key, entry);
+      return entry;
+    })().finally(() => {
+      if (current()) this.slotConnecting.delete(key);
+    });
+    self.attempt = attempt;
+    this.slotConnecting.set(key, attempt);
+    return attempt;
+  }
   /** Per-server connection state, for `doctor` (Task 10) to print. A server
    *  with `connected: false` always carries `error` -- there is no code path
    *  that records a failure without a reason, because "no tools" alone tells
@@ -28043,6 +28575,10 @@ function toAgentTool(registry, server, tool) {
   };
 }
 
+// ../mcp/src/portTools.ts
+import { MCP_CALL_FAILED, canEncodeMcpWireName as canEncodeMcpWireName2, mcpWireName as mcpWireName2, parseMcpToolAddress as parseMcpToolAddress2 } from "@corenel/protocol";
+var CALL_FAILED_TEXT = `Error: ${MCP_CALL_FAILED}: the MCP call failed before a result came back; it may or may not have run, so do not repeat it without checking.`;
+
 // ../mcp/src/gatedAgentTools.ts
 function gatedAgentTools(registry, policy) {
   const base = asAgentTools(registry);
@@ -28068,7 +28604,7 @@ function gatedAgentTools(registry, policy) {
 
 // ../mcp/src/cache.ts
 import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, rename as rename2 } from "node:fs/promises";
+import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir3, rename as rename2 } from "node:fs/promises";
 import { dirname as dirname8, join as join12 } from "node:path";
 function toolCachePath(stateDir) {
   return join12(stateDir, "mcp-tools.json");
@@ -28101,7 +28637,7 @@ async function writeToolCache(stateDir, cache) {
   const path = toolCachePath(stateDir);
   await mkdir3(dirname8(path), { recursive: true });
   const tmp = `${path}.${process.pid}.tmp`;
-  await writeFile3(tmp, `${JSON.stringify(cache, null, 2)}
+  await writeFile2(tmp, `${JSON.stringify(cache, null, 2)}
 `, "utf8");
   await rename2(tmp, path);
 }
@@ -28241,7 +28777,7 @@ var PAGE_FAIL = `<!doctype html><meta charset="utf-8"><title>Sign-in failed</tit
 var DEFAULT_TIMEOUT_MS2 = 5 * 60 * 1e3;
 function awaitRedirect(port, expectedState, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let settled = false;
     const v6 = createServer((req, res) => onRequest(req, res));
     const finish = (fn) => {
@@ -28273,7 +28809,7 @@ function awaitRedirect(port, expectedState, opts = {}) {
         return;
       }
       res.writeHead(200, { "content-type": "text/html" }).end(PAGE_OK);
-      finish(() => resolve4({ code: code3 }));
+      finish(() => resolve5({ code: code3 }));
     };
     const server = createServer(onRequest);
     const timer = setTimeout(() => {
@@ -28307,21 +28843,21 @@ function awaitRedirect(port, expectedState, opts = {}) {
   });
 }
 function portFree(port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const probe = createServer();
-    probe.once("error", () => resolve4(false));
+    probe.once("error", () => resolve5(false));
     probe.listen(port, "127.0.0.1", () => {
-      probe.close(() => resolve4(true));
+      probe.close(() => resolve5(true));
     });
   });
 }
 function getFreePort() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const probe = createServer();
     probe.once("error", reject);
     probe.listen(0, "127.0.0.1", () => {
       const addr = probe.address();
-      probe.close(() => resolve4(addr.port));
+      probe.close(() => resolve5(addr.port));
     });
   });
 }
@@ -28431,7 +28967,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
       fetchImpl,
       now
     );
-    await writeMcpCredential(stateDir, server.name, cred);
+    await writeMcpCredentialFor(stateDir, server.name, deps.slot ?? SERVER_SLOT, cred);
     return { ok: true };
   } catch (e) {
     redirectAbort.abort();
@@ -28511,6 +29047,9 @@ import { lookup as dnsLookup } from "node:dns/promises";
 import { setOutboundResolver } from "@corenel/harness/tools/urlGuard";
 var EXIT_POLICY_PARK_REFUSED = 3;
 var EXIT_BUDGET_EXCEEDED = 4;
+function loginApiBase(rest, opts = {}) {
+  return apiBase(flag(rest, "base", ""), { ...opts, ignoreCredential: true });
+}
 function replSessionId(id) {
   return id === UNATTACHED_SESSION ? null : id;
 }
@@ -28941,10 +29480,15 @@ async function main() {
       case "run-agent": {
         const agent = positional(rest)[0];
         if (!agent) {
-          process.stderr.write('usage: corenel run-agent <name> --input "<text>" [--model M] [--base URL] [--allow-mutations]\n');
+          process.stderr.write('usage: corenel run-agent <name> --input "<text>" [--model M] [--base URL] [--allow-mutations] [--memory-read-only]\n');
           process.exit(2);
         }
         const policyOverride = hasValueFlag(rest, "policy") ? (await resolvePolicy({ flag: flag(rest, "policy", ""), cwd: process.cwd() })).policy : void 0;
+        if (hasValueFlag(rest, "memory-partition")) {
+          process.stderr.write("corenel: --memory-partition is not supported: a guest run has no per-user memory\n");
+          process.exit(2);
+        }
+        const guestMemory = hasBooleanFlag(rest, "memory-read-only") ? { kind: "read-only" } : void 0;
         const code3 = await runCrewAgentCli({
           cwd: process.cwd(),
           agent,
@@ -28955,6 +29499,7 @@ async function main() {
           ...hasValueFlag(rest, "model") ? { model: flag(rest, "model", "") } : {},
           ...hasValueFlag(rest, "base") ? { base: flag(rest, "base", "") } : {},
           ...hasAllowMutationsFlag(rest) ? { allowMutations: true } : {},
+          ...guestMemory ? { memory: guestMemory } : {},
           ...policyOverride ? { policy: policyOverride } : {},
           emit: (line) => process.stdout.write(`${line}
 `),
@@ -28973,7 +29518,7 @@ async function main() {
         break;
       }
       case "login": {
-        const base = await apiBase(flag(rest, "base", ""));
+        const base = await loginApiBase(rest);
         await deviceLogin({
           base,
           store: (token, account) => writeLoginCredential(token, { apiBase: base, ...account ? { account } : {} })
@@ -28988,7 +29533,7 @@ Logged in. Token saved to ${authTokenPath()}
         await runAuth();
         break;
       case "logout":
-        await runLogout();
+        process.exitCode = await runLogout();
         break;
       case "doctor": {
         process.exitCode = await runDoctor(void 0, void 0, flag(rest, "model", DEFAULT_MODEL2), resolveDoctorEnv(rest));
@@ -29065,6 +29610,7 @@ export {
   EXIT_BUDGET_EXCEEDED,
   EXIT_POLICY_PARK_REFUSED,
   buildRunPermission,
+  loginApiBase,
   replCompaction,
   replSessionId
 };