@corenel/cli 0.9.5 → 0.11.0

package/dist/main.js

@@ -52,7 +52,7 @@ function diskFullError(shownPath, e) {
   if (!code3 || !DISK_FULL_CODES.has(code3)) return null;
   return Object.assign(new Error(`Disk full: could not write ${shownPath}`), { code: code3, cause: e });
 }
-async function resolveTarget(abs, shown) {
+async function resolveTarget(abs, shown2) {
   let target;
   try {
     target = await fs.realpath(abs);
@@ -62,7 +62,7 @@ async function resolveTarget(abs, shown) {
       if (codeOf(le) === "ENOENT") return null;
       throw le;
     });
-    if (link?.isSymbolicLink()) throw new Error(`refusing to write through a dangling symlink: ${shown}`);
+    if (link?.isSymbolicLink()) throw new Error(`refusing to write through a dangling symlink: ${shown2}`);
     return { target: abs, st: null };
   }
   try {
@@ -85,9 +85,9 @@ async function renameWithRetry(from, to) {
   }
 }
 async function writeFileAtomic(abs, data, opts = {}) {
-  const shown = opts.shownPath ?? abs;
-  const fail = (e) => diskFullError(shown, e) ?? (e instanceof Error ? e : new Error(String(e)));
-  const { target, st } = await resolveTarget(abs, shown);
+  const shown2 = opts.shownPath ?? abs;
+  const fail = (e) => diskFullError(shown2, e) ?? (e instanceof Error ? e : new Error(String(e)));
+  const { target, st } = await resolveTarget(abs, shown2);
   if (st && !st.isFile()) {
     try {
       await fs.writeFile(target, data);
@@ -178,8 +178,8 @@ function touchesGitDir(rel, platformSep = sep) {
     return seg === ".git";
   });
 }
-async function assertNotGitDir(root, abs, shown) {
-  const refuse = () => new Error(`refusing to write inside a .git directory: ${shown}`);
+async function assertNotGitDir(root, abs, shown2) {
+  const refuse = () => new Error(`refusing to write inside a .git directory: ${shown2}`);
   if (touchesGitDir(relative(root, abs))) throw refuse();
   let realRoot;
   try {
@@ -240,6 +240,11 @@ var init_fileService = __esm({
       /** An OUTER bound: the approved root this folder sits inside (a project
        * inside an operator's --root). See the constructor. */
       confineTo;
+      /** The absolute folder this service is rooted at (read-only), so a host can
+       * tell which folder a definition was loaded from. */
+      get rootDir() {
+        return this.root;
+      }
       /** `confineTo`: when `root` is a folder INSIDE an approved root, name that
        * approved root here. Every per-operation symlink check recomputes
        * realpath(root), so without it, swapping `root` itself for a link after
@@ -361,6 +366,10 @@ var init_fileService = __esm({
       async read(path) {
         return fs2.readFile(await this.realAbs(path), "utf8");
       }
+      /** Raw bytes, confined exactly as `read` is (lexical bound + symlink check). */
+      async readBytes(path) {
+        return new Uint8Array(await fs2.readFile(await this.realAbs(path)));
+      }
       async stat(path) {
         let a;
         try {
@@ -594,10 +603,10 @@ async function writeLoginCredential(token, opts = {}) {
   }
 }
 async function publishSignIn(credPath, tokPath, cred, notify) {
-  const record = { ...await readForeignAuthSections(credPath, notify), ...cred };
+  const record2 = { ...await readForeignAuthSections(credPath, notify), ...cred };
   const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
   const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-  await fs3.writeFile(credTmp, `${JSON.stringify(record, null, 2)}
+  await fs3.writeFile(credTmp, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await fs3.writeFile(tokTmp, `${cred.accessToken}
 `, { mode: 384 });
@@ -727,9 +736,9 @@ async function resolveNodeCredential(opts = {}) {
   const fileToken = tokenRead.value;
   const unreadable = credRead.unreadable || tokenRead.unreadable ? { unreadable: true } : {};
   if (fileToken) {
-    const same = cred && cred.accessToken === fileToken ? cred : null;
+    const same2 = cred && cred.accessToken === fileToken ? cred : null;
     return {
-      ...withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same, now),
+      ...withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same2, now),
       ...unreadable
     };
   }
@@ -1766,14 +1775,14 @@ var require_foldFlowLines = __commonJS({
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
     var FOLD_QUOTED = "quoted";
-    function foldFlowLines(text, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+    function foldFlowLines(text2, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
       if (!lineWidth || lineWidth < 0)
-        return text;
+        return text2;
       if (lineWidth < minContentWidth)
         minContentWidth = 0;
       const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-      if (text.length <= endStep)
-        return text;
+      if (text2.length <= endStep)
+        return text2;
       const folds = [];
       const escapedFolds = {};
       let end = lineWidth - indent.length;
@@ -1790,14 +1799,14 @@ var require_foldFlowLines = __commonJS({
       let escStart = -1;
       let escEnd = -1;
       if (mode === FOLD_BLOCK) {
-        i = consumeMoreIndentedLines(text, i, indent.length);
+        i = consumeMoreIndentedLines(text2, i, indent.length);
         if (i !== -1)
           end = i + endStep;
       }
-      for (let ch; ch = text[i += 1]; ) {
+      for (let ch; ch = text2[i += 1]; ) {
         if (mode === FOLD_QUOTED && ch === "\\") {
           escStart = i;
-          switch (text[i + 1]) {
+          switch (text2[i + 1]) {
             case "x":
               i += 3;
               break;
@@ -1814,12 +1823,12 @@ var require_foldFlowLines = __commonJS({
         }
         if (ch === "\n") {
           if (mode === FOLD_BLOCK)
-            i = consumeMoreIndentedLines(text, i, indent.length);
+            i = consumeMoreIndentedLines(text2, i, indent.length);
           end = i + indent.length + endStep;
           split = void 0;
         } else {
           if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-            const next = text[i + 1];
+            const next = text2[i + 1];
             if (next && next !== " " && next !== "\n" && next !== "	")
               split = i;
           }
@@ -1831,12 +1840,12 @@ var require_foldFlowLines = __commonJS({
             } else if (mode === FOLD_QUOTED) {
               while (prev === " " || prev === "	") {
                 prev = ch;
-                ch = text[i += 1];
+                ch = text2[i += 1];
                 overflow = true;
               }
               const j = i > escEnd + 1 ? i - 2 : escStart - 1;
               if (escapedFolds[j])
-                return text;
+                return text2;
               folds.push(j);
               escapedFolds[j] = true;
               end = j + endStep;
@@ -1851,39 +1860,39 @@ var require_foldFlowLines = __commonJS({
       if (overflow && onOverflow)
         onOverflow();
       if (folds.length === 0)
-        return text;
+        return text2;
       if (onFold)
         onFold();
-      let res = text.slice(0, folds[0]);
+      let res = text2.slice(0, folds[0]);
       for (let i2 = 0; i2 < folds.length; ++i2) {
         const fold = folds[i2];
-        const end2 = folds[i2 + 1] || text.length;
+        const end2 = folds[i2 + 1] || text2.length;
         if (fold === 0)
           res = `
-${indent}${text.slice(0, end2)}`;
+${indent}${text2.slice(0, end2)}`;
         else {
           if (mode === FOLD_QUOTED && escapedFolds[fold])
-            res += `${text[fold]}\\`;
+            res += `${text2[fold]}\\`;
           res += `
-${indent}${text.slice(fold + 1, end2)}`;
+${indent}${text2.slice(fold + 1, end2)}`;
         }
       }
       return res;
     }
-    function consumeMoreIndentedLines(text, i, indent) {
+    function consumeMoreIndentedLines(text2, i, indent) {
       let end = i;
       let start = i + 1;
-      let ch = text[start];
+      let ch = text2[start];
       while (ch === " " || ch === "	") {
         if (i < start + indent) {
-          ch = text[++i];
+          ch = text2[++i];
         } else {
           do {
-            ch = text[++i];
+            ch = text2[++i];
           } while (ch && ch !== "\n");
           end = i;
           start = i + 1;
-          ch = text[start];
+          ch = text2[start];
         }
       }
       return end;
@@ -8014,7 +8023,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse3(src, reviver, options) {
+    function parse4(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -8055,7 +8064,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse3;
+    exports.parse = parse4;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument;
     exports.stringify = stringify2;
@@ -8581,7 +8590,7 @@ var require_parse = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/parse.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = (version2, options, throwErrors = false) => {
+    var parse4 = (version2, options, throwErrors = false) => {
       if (version2 instanceof SemVer) {
         return version2;
       }
@@ -8594,7 +8603,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module.exports = parse3;
+    module.exports = parse4;
   }
 });
 
@@ -8602,9 +8611,9 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/valid.js"(exports, module) {
     "use strict";
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var valid = (version2, options) => {
-      const v = parse3(version2, options);
+      const v = parse4(version2, options);
       return v ? v.version : null;
     };
     module.exports = valid;
@@ -8615,9 +8624,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var clean = (version2, options) => {
-      const s = parse3(version2.trim().replace(/^[=v]+/, ""), options);
+      const s = parse4(version2.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module.exports = clean;
@@ -8652,10 +8661,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/diff.js"(exports, module) {
     "use strict";
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var diff = (version1, version2) => {
-      const v1 = parse3(version1, null, true);
-      const v2 = parse3(version2, null, true);
+      const v1 = parse4(version1, null, true);
+      const v2 = parse4(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -8726,9 +8735,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/prerelease.js"(exports, module) {
     "use strict";
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var prerelease = (version2, options) => {
-      const parsed = parse3(version2, options);
+      const parsed = parse4(version2, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module.exports = prerelease;
@@ -8914,7 +8923,7 @@ var require_coerce = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/coerce.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var { safeRe: re, t } = require_re();
     var coerce = (version2, options) => {
       if (version2 instanceof SemVer) {
@@ -8949,7 +8958,7 @@ var require_coerce = __commonJS({
       const patch = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse3(`${major}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse4(`${major}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module.exports = coerce;
   }
@@ -8959,7 +8968,7 @@ var require_coerce = __commonJS({
 var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var constants2 = require_constants();
     var SemVer = require_semver();
     var truncate2 = (version2, truncation, options) => {
@@ -8971,7 +8980,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version2, options) => {
       const versionStringToParse = version2 instanceof SemVer ? version2.version : version2;
-      return parse3(versionStringToParse, options);
+      return parse4(versionStringToParse, options);
     };
     var doTruncation = (version2, truncation) => {
       if (isPrerelease(truncation)) {
@@ -9932,7 +9941,7 @@ var require_subset = __commonJS({
         }
         return true;
       }
-      let higher, lower;
+      let higher, lower2;
       let hasDomLT, hasDomGT;
       let needDomLTPre = lt && !options.includePrerelease && lt.semver.prerelease.length ? lt.semver : false;
       let needDomGTPre = gt && !options.includePrerelease && gt.semver.prerelease.length ? gt.semver : false;
@@ -9964,8 +9973,8 @@ var require_subset = __commonJS({
             }
           }
           if (c.operator === "<" || c.operator === "<=") {
-            lower = lowerLT(lt, c, options);
-            if (lower === c && lower !== lt) {
+            lower2 = lowerLT(lt, c, options);
+            if (lower2 === c && lower2 !== lt) {
               return false;
             }
           } else if (lt.operator === "<=" && !c.test(lt.semver)) {
@@ -10013,7 +10022,7 @@ var require_semver2 = __commonJS({
     var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -10052,7 +10061,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module.exports = {
-      parse: parse3,
+      parse: parse4,
       valid,
       clean,
       inc,
@@ -10955,7 +10964,7 @@ var require_lexer2 = __commonJS({
           this.colno--;
         }
       };
-      _proto.current = function current() {
+      _proto.current = function current2() {
         if (!this.isFinished()) {
           return this.str.charAt(this.index);
         }
@@ -12439,7 +12448,7 @@ var require_parser2 = __commonJS({
         }
         return buf;
       };
-      _proto.parse = function parse3() {
+      _proto.parse = function parse4() {
         return new nodes.NodeList(0, 0, this.parseNodes());
       };
       _proto.parseAsRoot = function parseAsRoot() {
@@ -12448,7 +12457,7 @@ var require_parser2 = __commonJS({
       return Parser2;
     }(Obj);
     module.exports = {
-      parse: function parse3(src, extensions, opts) {
+      parse: function parse4(src, extensions, opts) {
         var p = new Parser(lexer.lex(src, opts));
         if (extensions !== void 0) {
           p.extensions = extensions;
@@ -14076,11 +14085,11 @@ var require_filters = __commonJS({
       }
     }
     _exports.list = list;
-    function lower(str) {
+    function lower2(str) {
       str = normalize(str, "");
       return str.toLowerCase();
     }
-    _exports.lower = lower;
+    _exports.lower = lower2;
     function nl2br(str) {
       if (str === null || str === void 0) {
         return "";
@@ -14663,10 +14672,10 @@ var require_tests = __commonJS({
     }
     exports.lessthan = lessthan;
     exports.lt = exports.lessthan;
-    function lower(value) {
+    function lower2(value) {
       return value.toLowerCase() === value;
     }
-    exports.lower = lower;
+    exports.lower = lower2;
     function ne(one, two) {
       return one !== two;
     }
@@ -16267,11 +16276,11 @@ var require_stream_writable = __commonJS({
       this.corkedRequestsFree = new CorkedRequest(this);
     }
     WritableState.prototype.getBuffer = function getBuffer() {
-      var current = this.bufferedRequest;
+      var current2 = this.bufferedRequest;
       var out = [];
-      while (current) {
-        out.push(current);
-        current = current.next;
+      while (current2) {
+        out.push(current2);
+        current2 = current2.next;
       }
       return out;
     };
@@ -21796,7 +21805,7 @@ var require_deflate2 = __commonJS({
     "use strict";
     var zlib_deflate = require_deflate();
     var utils = require_common();
-    var strings = require_strings();
+    var strings2 = require_strings();
     var msg = require_messages();
     var ZStream = require_zstream();
     var toString = Object.prototype.toString;
@@ -21848,7 +21857,7 @@ var require_deflate2 = __commonJS({
       if (opt.dictionary) {
         var dict;
         if (typeof opt.dictionary === "string") {
-          dict = strings.string2buf(opt.dictionary);
+          dict = strings2.string2buf(opt.dictionary);
         } else if (toString.call(opt.dictionary) === "[object ArrayBuffer]") {
           dict = new Uint8Array(opt.dictionary);
         } else {
@@ -21870,7 +21879,7 @@ var require_deflate2 = __commonJS({
       }
       _mode = mode === ~~mode ? mode : mode === true ? Z_FINISH : Z_NO_FLUSH;
       if (typeof data === "string") {
-        strm.input = strings.string2buf(data);
+        strm.input = strings2.string2buf(data);
       } else if (toString.call(data) === "[object ArrayBuffer]") {
         strm.input = new Uint8Array(data);
       } else {
@@ -21892,7 +21901,7 @@ var require_deflate2 = __commonJS({
         }
         if (strm.avail_out === 0 || strm.avail_in === 0 && (_mode === Z_FINISH || _mode === Z_SYNC_FLUSH)) {
           if (this.options.to === "string") {
-            this.onData(strings.buf2binstring(utils.shrinkBuf(strm.output, strm.next_out)));
+            this.onData(strings2.buf2binstring(utils.shrinkBuf(strm.output, strm.next_out)));
           } else {
             this.onData(utils.shrinkBuf(strm.output, strm.next_out));
           }
@@ -23785,7 +23794,7 @@ var require_inflate2 = __commonJS({
     "use strict";
     var zlib_inflate = require_inflate();
     var utils = require_common();
-    var strings = require_strings();
+    var strings2 = require_strings();
     var c = require_constants2();
     var msg = require_messages();
     var ZStream = require_zstream();
@@ -23830,7 +23839,7 @@ var require_inflate2 = __commonJS({
       zlib_inflate.inflateGetHeader(this.strm, this.header);
       if (opt.dictionary) {
         if (typeof opt.dictionary === "string") {
-          opt.dictionary = strings.string2buf(opt.dictionary);
+          opt.dictionary = strings2.string2buf(opt.dictionary);
         } else if (toString.call(opt.dictionary) === "[object ArrayBuffer]") {
           opt.dictionary = new Uint8Array(opt.dictionary);
         }
@@ -23854,7 +23863,7 @@ var require_inflate2 = __commonJS({
       }
       _mode = mode === ~~mode ? mode : mode === true ? c.Z_FINISH : c.Z_NO_FLUSH;
       if (typeof data === "string") {
-        strm.input = strings.binstring2buf(data);
+        strm.input = strings2.binstring2buf(data);
       } else if (toString.call(data) === "[object ArrayBuffer]") {
         strm.input = new Uint8Array(data);
       } else {
@@ -23884,9 +23893,9 @@ var require_inflate2 = __commonJS({
         if (strm.next_out) {
           if (strm.avail_out === 0 || status === c.Z_STREAM_END || strm.avail_in === 0 && (_mode === c.Z_FINISH || _mode === c.Z_SYNC_FLUSH)) {
             if (this.options.to === "string") {
-              next_out_utf8 = strings.utf8border(strm.output, strm.next_out);
+              next_out_utf8 = strings2.utf8border(strm.output, strm.next_out);
               tail = strm.next_out - next_out_utf8;
-              utf8str = strings.buf2string(strm.output, next_out_utf8);
+              utf8str = strings2.buf2string(strm.output, next_out_utf8);
               strm.next_out = tail;
               strm.avail_out = chunkSize - tail;
               if (tail) {
@@ -24231,9 +24240,9 @@ var require_ZipFileWorker = __commonJS({
       this.currentFile = streamInfo["file"].name;
       var streamedContent = this.streamFiles && !streamInfo["file"].dir;
       if (streamedContent) {
-        var record = generateZipParts(streamInfo, streamedContent, false, this.currentSourceOffset, this.zipPlatform, this.encodeFileName);
+        var record2 = generateZipParts(streamInfo, streamedContent, false, this.currentSourceOffset, this.zipPlatform, this.encodeFileName);
         this.push({
-          data: record.fileRecord,
+          data: record2.fileRecord,
           meta: { percent: 0 }
         });
       } else {
@@ -24243,8 +24252,8 @@ var require_ZipFileWorker = __commonJS({
     ZipFileWorker.prototype.closedSource = function(streamInfo) {
       this.accumulate = false;
       var streamedContent = this.streamFiles && !streamInfo["file"].dir;
-      var record = generateZipParts(streamInfo, streamedContent, true, this.currentSourceOffset, this.zipPlatform, this.encodeFileName);
-      this.dirRecords.push(record.dirRecord);
+      var record2 = generateZipParts(streamInfo, streamedContent, true, this.currentSourceOffset, this.zipPlatform, this.encodeFileName);
+      this.dirRecords.push(record2.dirRecord);
       if (streamedContent) {
         this.push({
           data: generateDataDescriptors(streamInfo),
@@ -24252,7 +24261,7 @@ var require_ZipFileWorker = __commonJS({
         });
       } else {
         this.push({
-          data: record.fileRecord,
+          data: record2.fileRecord,
           meta: { percent: 0 }
         });
         while (this.contentBuffer.length) {
@@ -25510,7 +25519,10 @@ var require_lib4 = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@prompd+core@0.6.0/node_modules/@prompd/core/dist/index.js
+// ../../node_modules/.pnpm/@prompd+core@0.7.0/node_modules/@prompd/core/dist/index.js
+function isValidPackageType(type) {
+  return VALID_PACKAGE_TYPES.includes(type);
+}
 function posixNormalize(p) {
   const isAbs = p.startsWith("/");
   const out = [];
@@ -25603,15 +25615,15 @@ function extname(p) {
   return dot <= 0 ? "" : base.slice(dot);
 }
 function isPrompdFile(p) {
-  const lower = p.toLowerCase();
-  return lower.endsWith(".prmd") || lower.endsWith(".md");
+  const lower2 = p.toLowerCase();
+  return lower2.endsWith(".prmd") || lower2.endsWith(".md");
 }
 function parseDateExpr(input) {
   const v = (input ?? "").trim();
   if (!v) return null;
-  const lower = v.toLowerCase();
-  if (lower === "now" || lower === "today") return /* @__PURE__ */ new Date();
-  const rel = lower.match(/^(?:now|today)\s*([+-])\s*(\d+)\s*([a-z]+)$/);
+  const lower2 = v.toLowerCase();
+  if (lower2 === "now" || lower2 === "today") return /* @__PURE__ */ new Date();
+  const rel = lower2.match(/^(?:now|today)\s*([+-])\s*(\d+)\s*([a-z]+)$/);
   if (rel) {
     const n = (rel[1] === "-" ? -1 : 1) * parseInt(rel[2], 10);
     const u = rel[3];
@@ -25654,37 +25666,483 @@ function getLanguageAliasesForExtension(ext) {
 function generateCompilationId() {
   return `compile-${++compilationCounter}-${Date.now()}`;
 }
-function isBinaryAsset(name) {
-  const dot = name.lastIndexOf(".");
-  return dot >= 0 && BINARY_ASSET_EXT.has(name.slice(dot + 1).toLowerCase());
+function isPackageVerificationError(e) {
+  if (!(e instanceof Error)) return false;
+  const code3 = e.code;
+  return e.name === "PackageVerificationError" && typeof code3 === "string";
+}
+function hasControl(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c >= 127 && c <= 159) return true;
+  }
+  return false;
 }
-function isSymlinkEntry(perms) {
-  return typeof perms === "number" && (perms & 61440) === 40960;
+function shown(name) {
+  if (hasControl(name) || BIDI_RE.test(name)) return "a file name in the package";
+  return name.length > ARCHIVE_LIMITS.maxNameLength ? `${name.slice(0, ARCHIVE_LIMITS.maxNameLength)}...` : name;
+}
+function entryNameProblem(name) {
+  if (hasControl(name)) return "a file name in the package holds a control character";
+  if (!name) return "a file in the package has no name";
+  if (BIDI_RE.test(name)) return "a file name in the package holds a text-direction character";
+  if (name.length > ARCHIVE_LIMITS.maxNameLength) return `a file name in the package is too long (over ${ARCHIVE_LIMITS.maxNameLength} characters)`;
+  if (name.includes("\\")) return `${name} uses a backslash; package paths use forward slashes`;
+  if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) return `${name} is an absolute path`;
+  const segs = name.split("/");
+  if (segs.some((s) => s === ".." || s === "." || s === "")) return `${name} has an empty, "." or ".." segment`;
+  if (name.includes(":")) return `${name} holds a colon`;
+  if (segs.length > ARCHIVE_LIMITS.maxSegments) return `${name} is nested too deeply`;
+  for (const s of segs) {
+    if (s.endsWith(".") || s.endsWith(" ")) return `${name} has a part that ends with a dot or a space`;
+    const stem = s.split(".")[0]?.replace(/ +$/, "") ?? "";
+    if (WINDOWS_DEVICE_RE.test(stem)) return `${name} uses a device name Windows has reserved`;
+  }
+  if (name !== name.normalize("NFC")) return `${name} is not in normalized (NFC) form`;
+  return null;
 }
-async function extractPdpkg(buffer) {
-  const zip = await import_jszip.default.loadAsync(buffer);
-  const out = /* @__PURE__ */ new Map();
+function u16(b, at) {
+  return (b[at] ?? 0) | (b[at + 1] ?? 0) << 8;
+}
+function u32(b, at) {
+  return u16(b, at) + u16(b, at + 2) * 65536;
+}
+function refuseUnicodePathField(raw, start, end, name) {
+  let at = start;
+  while (at < end) {
+    if (at + 4 > end) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+    const id = u16(raw, at);
+    const len = u16(raw, at + 2);
+    if (at + 4 + len > end) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+    if (id === UNICODE_PATH_FIELD) throw new PackageVerificationError("UNSAFE_PATH", `${shown(name)} carries an alternate path field`, name);
+    at += 4 + len;
+  }
+}
+function checkLocalHeader(raw, centralName, name, localAt, centralStart) {
+  if (localAt + LOCAL_LEN > centralStart || u32(raw, localAt) !== LOCAL_SIG) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP, name);
+  const nameLen = u16(raw, localAt + 26);
+  const extraLen = u16(raw, localAt + 28);
+  const nameEnd = localAt + LOCAL_LEN + nameLen;
+  if (nameEnd + extraLen > centralStart) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP, name);
+  const localName = raw.subarray(localAt + LOCAL_LEN, nameEnd);
+  if (localName.length !== centralName.length || !localName.every((b, i) => b === centralName[i])) {
+    throw new PackageVerificationError("ARCHIVE_INVALID", `${shown(name)} is named differently in its local header`, name);
+  }
+  refuseUnicodePathField(raw, nameEnd, nameEnd + extraLen, name);
+}
+function scanCentralDirectory(raw) {
+  const lowest = Math.max(0, raw.length - EOCD_LEN - 65535);
+  let eocd = -1;
+  for (let i = raw.length - EOCD_LEN; i >= lowest; i--) {
+    if (u32(raw, i) === EOCD_SIG) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  if (eocd + EOCD_LEN + u16(raw, eocd + 20) !== raw.length) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  const count = u16(raw, eocd + 10);
+  const size = u32(raw, eocd + 12);
+  const offset = u32(raw, eocd + 16);
+  if (count === 65535 || size === 4294967295 || offset === 4294967295) {
+    throw new PackageVerificationError("ARCHIVE_INVALID", "the package is a zip64 archive, which a package never needs");
+  }
+  if (u16(raw, eocd + 4) !== 0 || u16(raw, eocd + 6) !== 0 || u16(raw, eocd + 8) !== count) {
+    throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  }
+  if (count > ARCHIVE_LIMITS.maxEntries) {
+    throw new PackageVerificationError("TOO_LARGE", `the package holds too many files (over ${ARCHIVE_LIMITS.maxEntries})`);
+  }
+  if (offset + size !== eocd) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  const out = [];
   let total = 0;
-  for (const entry of Object.values(zip.files)) {
-    if (entry.name.includes("\0")) {
-      throw new Error(`Security violation: null byte in entry name: ${entry.name}`);
+  let at = offset;
+  for (let i = 0; i < count; i++) {
+    if (at + CENTRAL_LEN > eocd || u32(raw, at) !== CENTRAL_SIG) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+    const compressed = u32(raw, at + 20);
+    const uncompressed = u32(raw, at + 24);
+    const nameLen = u16(raw, at + 28);
+    const next = at + CENTRAL_LEN + nameLen + u16(raw, at + 30) + u16(raw, at + 32);
+    if (next > eocd) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+    let name;
+    try {
+      name = nameDecoder.decode(raw.subarray(at + CENTRAL_LEN, at + CENTRAL_LEN + nameLen));
+    } catch {
+      throw new PackageVerificationError("ARCHIVE_INVALID", "a file name in the package is not UTF-8");
+    }
+    const centralName = raw.subarray(at + CENTRAL_LEN, at + CENTRAL_LEN + nameLen);
+    const extraStart = at + CENTRAL_LEN + nameLen;
+    refuseUnicodePathField(raw, extraStart, extraStart + u16(raw, at + 30), name);
+    checkLocalHeader(raw, centralName, name, u32(raw, at + 42), offset);
+    const external = u32(raw, at + 38);
+    if ((Math.floor(external / 65536) & 61440) === 40960) {
+      throw new PackageVerificationError("UNSAFE_PATH", `${shown(name)} is a link`, name);
+    }
+    const folder = (external & 16) !== 0 || name.endsWith("/");
+    if (folder && uncompressed !== 0) throw new PackageVerificationError("ARCHIVE_INVALID", `${shown(name)} is marked as a folder but holds data`, name);
+    if (!folder) {
+      if (uncompressed > ARCHIVE_LIMITS.maxFileBytes) throw new PackageVerificationError("TOO_LARGE", `${shown(name)} is over ${ARCHIVE_LIMITS.maxFileBytes} bytes`, name);
+      if (uncompressed > 0 && compressed === 0) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP, name);
+      if (compressed > 0 && uncompressed / compressed > ARCHIVE_LIMITS.maxRatio) {
+        throw new PackageVerificationError("TOO_LARGE", `${shown(name)} compresses more than ${ARCHIVE_LIMITS.maxRatio}:1`, name);
+      }
+      total += uncompressed;
+      if (total > ARCHIVE_LIMITS.maxTotalBytes) throw new PackageVerificationError("TOO_LARGE", `the package is over ${ARCHIVE_LIMITS.maxTotalBytes} bytes unpacked`);
+    }
+    out.push({ name, compressed, uncompressed, folder });
+    at = next;
+  }
+  if (at !== offset + size) throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  return out;
+}
+function checkNames(records) {
+  const keys = /* @__PURE__ */ new Set();
+  const files = records.filter((r) => !r.folder);
+  for (const r of files) {
+    const problem = entryNameProblem(r.name);
+    if (problem) throw new PackageVerificationError("UNSAFE_PATH", problem, r.name);
+    const key = r.name.toLowerCase();
+    if (keys.has(key)) throw new PackageVerificationError("UNSAFE_PATH", `the package holds two entries with the same name (${r.name})`, r.name);
+    keys.add(key);
+  }
+  for (const r of files) {
+    const segs = r.name.toLowerCase().split("/");
+    for (let i = 1; i < segs.length; i++) {
+      const parent = segs.slice(0, i).join("/");
+      if (keys.has(parent)) throw new PackageVerificationError("UNSAFE_PATH", `${r.name} uses ${parent} as a folder, but it is a file`, r.name);
+    }
+  }
+}
+function inflateOne(entry, limit, state) {
+  return new Promise((resolveBytes, reject) => {
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    const stream = entry.internalStream("uint8array");
+    const fail = (e) => {
+      if (!settled) {
+        settled = true;
+        stream.pause();
+        reject(e);
+      }
+    };
+    stream.on("data", (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      state.total += chunk.length;
+      if (size > limit || size > ARCHIVE_LIMITS.maxFileBytes) {
+        fail(new PackageVerificationError("TOO_LARGE", `${shown(entry.name)} is larger than its header says`, entry.name));
+        return;
+      }
+      if (state.total > ARCHIVE_LIMITS.maxTotalBytes) {
+        fail(new PackageVerificationError("TOO_LARGE", `the package is over ${ARCHIVE_LIMITS.maxTotalBytes} bytes unpacked`));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    stream.on("error", (e) => fail(new PackageVerificationError("ARCHIVE_INVALID", `${shown(entry.name)} could not be unpacked: ${e.message}`, entry.name)));
+    stream.on("end", () => {
+      if (settled) return;
+      settled = true;
+      const out = new Uint8Array(size);
+      let at = 0;
+      for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+      }
+      resolveBytes(out);
+    });
+    stream.resume();
+  });
+}
+async function readArchive(raw) {
+  const records = scanCentralDirectory(raw);
+  checkNames(records);
+  let zip;
+  try {
+    zip = await import_jszip.default.loadAsync(raw, { createFolders: false });
+  } catch {
+    throw new PackageVerificationError("ARCHIVE_INVALID", NOT_A_ZIP);
+  }
+  const all = Object.values(zip.files);
+  if (all.length !== records.length) throw new PackageVerificationError("ARCHIVE_INVALID", "the package holds two entries with the same name");
+  const declared = new Map(records.map((r) => [r.name, r.uncompressed]));
+  const out = /* @__PURE__ */ new Map();
+  const state = { total: 0 };
+  for (const [i, entry] of all.entries()) {
+    if (entry.name !== records[i]?.name) {
+      throw new PackageVerificationError("ARCHIVE_INVALID", `${shown(entry.name)} does not match the package's central directory`, entry.name);
+    }
+    const original = entry.unsafeOriginalName ?? entry.name;
+    if (original !== entry.name || !declared.has(original)) {
+      throw new PackageVerificationError("UNSAFE_PATH", `${shown(original)} is not a plain path inside the package`, original);
+    }
+    if (entry.dir) continue;
+    out.set(entry.name, await inflateOne(entry, declared.get(entry.name) ?? 0, state));
+  }
+  return out;
+}
+function subtle() {
+  const c = globalThis.crypto;
+  if (!c?.subtle) throw new Error("WebCrypto (crypto.subtle) is not available in this runtime; Node 20 or later is required.");
+  return c.subtle;
+}
+async function sha256Hex(bytes) {
+  const buf = await subtle().digest("SHA-256", bytes);
+  const out = new Uint8Array(buf);
+  let hex = "";
+  for (let i = 0; i < out.length; i++) hex += out[i].toString(16).padStart(2, "0");
+  return hex;
+}
+async function archiveDigest(bytes) {
+  return `sha256:${await sha256Hex(bytes)}`;
+}
+function invalid(message) {
+  return new PackageVerificationError("MANIFEST_INVALID", message, "prompd.json");
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function stringList(v, field) {
+  if (v === void 0) return void 0;
+  if (!Array.isArray(v) || v.some((s) => typeof s !== "string" || !s)) throw invalid(`${field} must be a list of names`);
+  return v;
+}
+function unscopedName(name) {
+  const slash = name.indexOf("/");
+  return name.startsWith("@") && slash > 0 ? name.slice(slash + 1) : name;
+}
+function parseManifest(bytes) {
+  let text2;
+  try {
+    text2 = decoder.decode(bytes);
+  } catch {
+    throw invalid("prompd.json is not UTF-8 text");
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text2, (k, v) => PROTO_KEYS.has(k) ? void 0 : v);
+  } catch {
+    throw invalid("prompd.json is not valid JSON");
+  }
+  if (!isRecord(raw)) throw invalid("prompd.json is not a JSON object");
+  const { name, version: version2, type, dependencies, requires } = raw;
+  if (typeof name !== "string" || !PACKAGE_NAME_RE.test(name)) throw invalid('prompd.json "name" must be a scoped package name like @scope/name');
+  if (typeof version2 !== "string" || import_semver.default.valid(version2) !== version2) throw invalid('prompd.json "version" must be an exact semver version');
+  let resolvedType = "package";
+  if (type !== void 0) {
+    if (typeof type !== "string" || !isValidPackageType(type)) {
+      throw new PackageVerificationError("TYPE_INVALID", `package type "${String(type)}" is not one of package, workflow, skill, agent`, "prompd.json");
+    }
+    resolvedType = type;
+  }
+  let deps;
+  if (dependencies !== void 0) {
+    if (!isRecord(dependencies)) throw invalid('prompd.json "dependencies" must be an object');
+    deps = {};
+    for (const [dep, range] of Object.entries(dependencies)) {
+      if (!PACKAGE_NAME_RE.test(dep)) throw invalid(`dependency "${dep}" is not a scoped package name`);
+      if (typeof range !== "string" || import_semver.default.validRange(range) === null) throw invalid(`dependency "${dep}" has an invalid version range`);
+      deps[dep] = range;
+    }
+  }
+  let req;
+  if (requires !== void 0) {
+    if (!isRecord(requires)) throw invalid('prompd.json "requires" must be an object');
+    const mcp = stringList(requires.mcp, "requires.mcp");
+    const skills = stringList(requires.skills, "requires.skills");
+    req = { ...mcp ? { mcp } : {}, ...skills ? { skills } : {} };
+  }
+  return {
+    ...raw,
+    name,
+    version: version2,
+    type: resolvedType,
+    ...deps ? { dependencies: deps } : {},
+    ...req ? { requires: req } : {}
+  };
+}
+function invalid2(message, path) {
+  return new PackageVerificationError("MANIFEST_INVALID", message, path);
+}
+function text(files, name) {
+  const b = files.get(name);
+  if (!b) throw invalid2(`an agent package must contain ${name}`, name);
+  try {
+    return decoder2.decode(b);
+  } catch {
+    throw invalid2(`${name} is not UTF-8 text`, name);
+  }
+}
+function record(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+}
+function strings(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter((s) => typeof s === "string").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function yamlOf(src, path) {
+  try {
+    return (0, import_yaml.parse)(src);
+  } catch {
+    throw invalid2(`${path} is not valid YAML`, path);
+  }
+}
+function frontmatter(src) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(src);
+  return m ? record(yamlOf(m[1], "AGENT.md")) : {};
+}
+function unique(xs) {
+  return [...new Set(xs)];
+}
+function unnamedMcp(addr) {
+  return invalid2(`POLICY.yaml allows "${addr}", which can reach MCP servers it does not name; MCP access in a package must name each server (mcp:<server>/<tool> or mcp:<server>/*)`, "POLICY.yaml");
+}
+function mcpWireName(addr) {
+  return invalid2(`POLICY.yaml allows "${addr}", an MCP wire name; in a package, allow MCP tools as mcp:<server>/<tool> or mcp:<server>/*`, "POLICY.yaml");
+}
+function mcpServerOf(addr) {
+  if (addr.startsWith(MCP_WIRE_PREFIX)) throw mcpWireName(addr);
+  const glob = addr.search(GLOB_RE);
+  if (glob >= 0) {
+    const literal = addr.slice(0, glob);
+    if (MCP_PREFIX.startsWith(literal)) throw unnamedMcp(addr);
+    if (MCP_WIRE_PREFIX.startsWith(literal)) throw mcpWireName(addr);
+    if (literal.startsWith(MCP_PREFIX)) {
+      const slash2 = addr.indexOf("/", MCP_PREFIX.length);
+      const server = addr.slice(MCP_PREFIX.length, slash2 < 0 ? void 0 : slash2);
+      if (GLOB_RE.test(server)) throw unnamedMcp(addr);
+    }
+  }
+  if (!addr.startsWith(MCP_PREFIX)) return null;
+  const slash = addr.indexOf("/", MCP_PREFIX.length);
+  if (addr.slice(MCP_PREFIX.length, slash < 0 ? void 0 : slash).includes("\\")) {
+    throw invalid2(`POLICY.yaml allows "${addr}"; MCP server names with escaped characters cannot be used in a package`, "POLICY.yaml");
+  }
+  const m = NAMED_MCP_RE.exec(addr);
+  if (!m) throw unnamedMcp(addr);
+  return m[1];
+}
+function checkAgentPackage(manifest, files) {
+  const allowed = new Set(AGENT_PACKAGE_FILES);
+  for (const name of files.keys()) {
+    if (!allowed.has(name)) throw invalid2(`an agent package may hold only ${AGENT_PACKAGE_FILES.join(", ")}; found ${name}`, name);
+  }
+  for (const name of AGENT_PACKAGE_FILES) {
+    if (!files.has(name)) throw invalid2(`an agent package must contain ${name}`, name);
+  }
+  const fm = frontmatter(text(files, "AGENT.md"));
+  const policy = record(yamlOf(text(files, "POLICY.yaml"), "POLICY.yaml"));
+  const deps = new Set(Object.keys(manifest.dependencies ?? {}).map(unscopedName));
+  const reqSkills = new Set(manifest.requires?.skills ?? []);
+  const reqMcp = new Set(manifest.requires?.mcp ?? []);
+  if (fm.canCallAll === true) throw invalid2("canCallAll cannot be used in a package; list the agents in canCall and declare them as dependencies", "AGENT.md");
+  const skills = unique(strings(policy.skills));
+  for (const s of skills) {
+    if (!deps.has(s) && !reqSkills.has(s)) throw invalid2(`POLICY.yaml grants skill "${s}", which is neither a dependency nor listed in requires.skills`, "POLICY.yaml");
+  }
+  const after = [];
+  for (const trig of Array.isArray(fm.triggers) ? fm.triggers : []) {
+    const t = record(trig);
+    if (t.type === "run-complete") after.push(...strings(record(t.config).after));
+  }
+  const agents = unique([...strings(fm.canCall), ...after]);
+  for (const a of agents) {
+    if (!deps.has(a)) throw invalid2(`AGENT.md calls agent "${a}", which is not a dependency`, "AGENT.md");
+  }
+  const mcp = [];
+  for (const addr of strings(record(policy.tools).allow)) {
+    const server = mcpServerOf(addr);
+    if (server !== null) mcp.push(server);
+  }
+  const servers = unique(mcp);
+  for (const s of servers) {
+    if (!reqMcp.has(s)) throw invalid2(`POLICY.yaml allows MCP server "${s}", which is not listed in requires.mcp`, "POLICY.yaml");
+  }
+  return { skills: skills.filter((s) => deps.has(s)), agents, mcp: servers };
+}
+function integrityOf(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new PackageVerificationError("INTEGRITY_MISSING", 'the package has no integrity block; republish it with "prompd package create"', MANIFEST_FILE);
+  }
+  const r = raw;
+  if (r.algorithm !== "sha256") {
+    throw new PackageVerificationError("UNSUPPORTED_ALGORITHM", `integrity algorithm "${String(r.algorithm)}" is not supported (sha256 only)`, MANIFEST_FILE);
+  }
+  const files = r.files;
+  if (typeof files !== "object" || files === null || Array.isArray(files)) {
+    throw new PackageVerificationError("INTEGRITY_MISSING", "the integrity block lists no files", MANIFEST_FILE);
+  }
+  const out = {};
+  for (const [p, h] of Object.entries(files)) {
+    if (typeof h !== "string" || !HEX_RE.test(h)) throw new PackageVerificationError("MANIFEST_INVALID", `the recorded hash for ${p} is not a sha256 hex digest`, MANIFEST_FILE);
+    out[p] = h;
+  }
+  return { algorithm: "sha256", files: out };
+}
+async function openPdpkg(input, expect = {}) {
+  if (input.length > MAX_PACKAGE_BYTES) {
+    throw new PackageVerificationError("TOO_LARGE", `the package is ${input.length} bytes (max ${MAX_PACKAGE_BYTES})`);
+  }
+  const bytes = new Uint8Array(input);
+  const digest = await archiveDigest(bytes);
+  if (expect.digest !== void 0 && expect.digest !== digest) {
+    throw new PackageVerificationError("DIGEST_MISMATCH", `the package is ${digest}, expected ${expect.digest}`);
+  }
+  const entries = await readArchive(bytes);
+  for (const name of entries.keys()) {
+    const folded = name.toLowerCase();
+    if (folded === RESERVED_MANIFEST || folded === MANIFEST_FILE && name !== MANIFEST_FILE) {
+      throw new PackageVerificationError("MANIFEST_RESERVED", `the package holds a root ${name}; the manifest is prompd.json only`, name);
     }
-    if (entry.name.startsWith("/") || /(^|\/)\.\.(\/|$)/.test(entry.name)) {
-      throw new Error(`Security violation: path traversal in entry: ${entry.name}`);
+    if (RESERVED_LAYOUT.has(folded)) {
+      throw new PackageVerificationError("MANIFEST_RESERVED", `the package holds a root ${name}, a name the install writes itself`, name);
     }
-    if (isSymlinkEntry(entry.unixPermissions)) {
-      throw new Error(`Security violation: symlink entry in archive: ${entry.name}`);
+  }
+  const manifestBytes = entries.get(MANIFEST_FILE);
+  if (!manifestBytes) throw new PackageVerificationError("MANIFEST_MISSING", "the package has no prompd.json", MANIFEST_FILE);
+  const parsed = parseManifest(manifestBytes);
+  const integrity = integrityOf(parsed.integrity);
+  const files = /* @__PURE__ */ new Map();
+  for (const [p, b] of entries) if (p !== MANIFEST_FILE) files.set(p, b);
+  for (const p of files.keys()) {
+    if (!Object.prototype.hasOwnProperty.call(integrity.files, p)) {
+      throw new PackageVerificationError("FILE_UNLISTED", `${p} is not listed in the integrity block`, p);
     }
-    if (entry.dir || isBinaryAsset(entry.name)) continue;
-    const bytes = await entry.async("uint8array");
-    if (bytes.length > MAX_FILE_SIZE_IN_ZIP) {
-      throw new Error(`File too large in package: ${entry.name} (${bytes.length} bytes, max ${MAX_FILE_SIZE_IN_ZIP})`);
+  }
+  for (const p of Object.keys(integrity.files)) {
+    if (!files.has(p)) throw new PackageVerificationError("FILE_MISSING", `${p} is listed in the integrity block but not in the package`, p);
+  }
+  for (const [p, b] of files) {
+    if (await sha256Hex(b) !== integrity.files[p]) {
+      throw new PackageVerificationError("HASH_MISMATCH", `${p} does not match its recorded hash`, p);
     }
-    total += bytes.length;
-    if (total > MAX_TOTAL_EXTRACTED_SIZE) {
-      throw new Error(`Package total decompressed size exceeds limit (${MAX_TOTAL_EXTRACTED_SIZE} bytes). Possible decompression bomb.`);
+  }
+  const manifest = { ...parsed, integrity };
+  const agentRefs = manifest.type === "agent" ? checkAgentPackage(manifest, files) : void 0;
+  if (expect.name !== void 0 && manifest.name !== expect.name) {
+    throw new PackageVerificationError("NAME_MISMATCH", `asked for ${expect.name}, the package is ${manifest.name}`);
+  }
+  if (expect.range !== void 0 && !import_semver.default.satisfies(manifest.version, expect.range)) {
+    throw new PackageVerificationError("VERSION_MISMATCH", `asked for ${expect.range}, the package is ${manifest.version}`);
+  }
+  return { manifest, manifestBytes, files, digest, ...agentRefs ? { agentRefs } : {} };
+}
+function isBinaryAsset(name) {
+  const dot = name.lastIndexOf(".");
+  return dot >= 0 && BINARY_ASSET_EXT.has(name.slice(dot + 1).toLowerCase());
+}
+async function extractPdpkg(buffer, expect = {}) {
+  const pkg = await openPdpkg(buffer, expect);
+  const out = /* @__PURE__ */ new Map();
+  out.set("prompd.json", textDecoder.decode(pkg.manifestBytes));
+  for (const [p, b] of pkg.files) {
+    if (isBinaryAsset(p)) continue;
+    try {
+      out.set(p, textDecoder.decode(b));
+    } catch {
+      throw new Error(`${p} in ${pkg.manifest.name}@${pkg.manifest.version} is not UTF-8 text`);
     }
-    out.set(entry.name, pdpkgDecoder.decode(bytes));
   }
   return out;
 }
@@ -25734,10 +26192,29 @@ function createCoreStages() {
     new CodeGenerationStage()
   ];
 }
-var yaml, import_semver, nunjucks, import_jszip, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, BINARY_ASSET_EXT, MAX_FILE_SIZE_IN_ZIP, MAX_TOTAL_EXTRACTED_SIZE, pdpkgDecoder, _MemoryFileSystem, MemoryFileSystem, HybridFileSystem, MAX_PACKAGE_SIZE, PrompdCompiler, ASSIGNMENT_OPS, OP_CONSTRUCTS, OPS;
+function same(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+async function verifyInstalled(read, expectedDigest, expect = {}) {
+  const archive = await read(ARCHIVE_COPY);
+  if (!archive) {
+    throw new PackageVerificationError("FILE_MISSING", `${ARCHIVE_COPY} is missing, so this install cannot be verified; reinstall the package`, ARCHIVE_COPY);
+  }
+  const pkg = await openPdpkg(archive, { ...expect, digest: expectedDigest });
+  for (const [p, b] of pkg.files) {
+    const onDisk = await read(p);
+    if (!onDisk) throw new PackageVerificationError("FILE_MISSING", `${p} is missing from the installed package`, p);
+    if (!same(onDisk, b)) throw new PackageVerificationError("HASH_MISMATCH", `${p} does not match its recorded hash`, p);
+  }
+  return pkg;
+}
+var yaml, import_yaml, import_semver, nunjucks, import_jszip, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, PackageVerificationError, ARCHIVE_LIMITS, EOCD_SIG, CENTRAL_SIG, EOCD_LEN, CENTRAL_LEN, LOCAL_SIG, LOCAL_LEN, UNICODE_PATH_FIELD, WINDOWS_DEVICE_RE, NOT_A_ZIP, BIDI_RE, nameDecoder, PACKAGE_NAME_RE, decoder, PROTO_KEYS, AGENT_PACKAGE_FILES, decoder2, MCP_PREFIX, MCP_WIRE_PREFIX, GLOB_RE, NAMED_MCP_RE, ARCHIVE_COPY, META_FILE, MAX_PACKAGE_BYTES, MANIFEST_FILE, RESERVED_MANIFEST, RESERVED_LAYOUT, HEX_RE, BINARY_ASSET_EXT, textDecoder, MemoryFileSystem, HybridFileSystem, INSTALL_LIMITS, textDecoder2, PrompdCompiler, ASSIGNMENT_OPS, OP_CONSTRUCTS, OPS, RESERVED_LAYOUT2, encoder;
 var init_dist = __esm({
-  "../../node_modules/.pnpm/@prompd+core@0.6.0/node_modules/@prompd/core/dist/index.js"() {
+  "../../node_modules/.pnpm/@prompd+core@0.7.0/node_modules/@prompd/core/dist/index.js"() {
     yaml = __toESM(require_dist(), 1);
+    import_yaml = __toESM(require_dist(), 1);
     import_semver = __toESM(require_semver2(), 1);
     nunjucks = __toESM(require_nunjucks(), 1);
     import_jszip = __toESM(require_lib4(), 1);
@@ -25874,7 +26351,7 @@ var init_dist = __esm({
       "package": "packages",
       "workflow": "workflows",
       "skill": "skills",
-      "node-template": "templates"
+      "agent": "agents"
     };
     VALID_PACKAGE_TYPES = Object.keys(PACKAGE_TYPE_DIRS);
     PrompdError = class _PrompdError extends Error {
@@ -27257,13 +27734,13 @@ ${yamlContent}` : yamlContent;
           const line = lines[i].trim();
           if (!line) continue;
           const values = this.parseCsvLine(line);
-          const record = {};
+          const record3 = {};
           for (let j = 0; j < headers.length; j++) {
             const header = headers[j].trim();
             const value = values[j]?.trim() ?? "";
-            record[header] = value;
+            record3[header] = value;
           }
-          records.push(record);
+          records.push(record3);
         }
         return records;
       }
@@ -27272,25 +27749,25 @@ ${yamlContent}` : yamlContent;
        */
       parseCsvLine(line) {
         const result = [];
-        let current = "";
+        let current2 = "";
         let inQuotes = false;
         for (let i = 0; i < line.length; i++) {
           const char = line[i];
           if (char === '"') {
             if (inQuotes && line[i + 1] === '"') {
-              current += '"';
+              current2 += '"';
               i++;
             } else {
               inQuotes = !inQuotes;
             }
           } else if (char === "," && !inQuotes) {
-            result.push(current);
-            current = "";
+            result.push(current2);
+            current2 = "";
           } else {
-            current += char;
+            current2 += char;
           }
         }
-        result.push(current);
+        result.push(current2);
         return result;
       }
       async process(context) {
@@ -27418,8 +27895,8 @@ ${yamlContent}` : yamlContent;
             return content;
           }
           if (parentData.content) {
-            const parentDir = fs6.dirname(parentFile);
-            parentData.content = this.resolveIncludePaths(parentData.content, parentDir);
+            const parentDir2 = fs6.dirname(parentFile);
+            parentData.content = this.resolveIncludePaths(parentData.content, parentDir2);
           }
           const overrides = context.metadata?.override || {};
           if (parentData.content || content) {
@@ -27972,7 +28449,7 @@ ${content}` : parentData.content;
       async validateParentFileReferences(context, metadata, fs6, parentFile) {
         if (!metadata) return;
         const metadataAsRecord = metadata;
-        const parentDir = fs6.dirname(parentFile);
+        const parentDir2 = fs6.dirname(parentFile);
         const fileFields = ["system", "task", "user", "assistant", "response", "output", "context"];
         for (const field of fileFields) {
           const fieldValue = metadataAsRecord[field];
@@ -27980,7 +28457,7 @@ ${content}` : parentData.content;
           const refs = Array.isArray(fieldValue) ? fieldValue.filter((v) => typeof v === "string") : typeof fieldValue === "string" ? [fieldValue] : [];
           for (const ref of refs) {
             if (!ref.startsWith("./") && !ref.startsWith("../")) continue;
-            const resolvedPath = fs6.resolve(parentDir, ref);
+            const resolvedPath = fs6.resolve(parentDir2, ref);
             const exists = await Promise.resolve(fs6.exists(resolvedPath));
             if (!exists) {
               const location = context.findLocation(/inherits:/);
@@ -28315,6 +28792,49 @@ ${firstUserMsg.content}`;
         return "Code Generation";
       }
     };
+    PackageVerificationError = class extends Error {
+      constructor(code3, message, path) {
+        super(message);
+        this.name = "PackageVerificationError";
+        this.code = code3;
+        if (path !== void 0) this.path = path;
+      }
+    };
+    ARCHIVE_LIMITS = {
+      maxEntries: 2e3,
+      maxFileBytes: 10 * 1024 * 1024,
+      maxTotalBytes: 500 * 1024 * 1024,
+      maxRatio: 100,
+      maxNameLength: 512,
+      maxSegments: 24
+    };
+    EOCD_SIG = 101010256;
+    CENTRAL_SIG = 33639248;
+    EOCD_LEN = 22;
+    CENTRAL_LEN = 46;
+    LOCAL_SIG = 67324752;
+    LOCAL_LEN = 30;
+    UNICODE_PATH_FIELD = 28789;
+    WINDOWS_DEVICE_RE = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3])$/i;
+    NOT_A_ZIP = "the package is not a readable zip";
+    BIDI_RE = /[\u200e\u200f\u202a-\u202e\u2066-\u2069]/;
+    nameDecoder = new TextDecoder("utf-8", { fatal: true });
+    PACKAGE_NAME_RE = /^@(?!\.+\/)[a-z0-9._-]+\/(?!\.+$)[a-z0-9._-]+$/;
+    decoder = new TextDecoder("utf-8", { fatal: true });
+    PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+    AGENT_PACKAGE_FILES = ["AGENT.md", "SOUL.md", "PERSONA.md", "POLICY.yaml"];
+    decoder2 = new TextDecoder("utf-8", { fatal: true });
+    MCP_PREFIX = "mcp:";
+    MCP_WIRE_PREFIX = "mcp_";
+    GLOB_RE = /[*?]/;
+    NAMED_MCP_RE = /^mcp:([^*?/]+)\//;
+    ARCHIVE_COPY = ".package.pdpkg";
+    META_FILE = ".prmdmeta";
+    MAX_PACKAGE_BYTES = 50 * 1024 * 1024;
+    MANIFEST_FILE = "prompd.json";
+    RESERVED_MANIFEST = "manifest.json";
+    RESERVED_LAYOUT = new Set([ARCHIVE_COPY, META_FILE].map((n) => n.toLowerCase()));
+    HEX_RE = /^[0-9a-f]{64}$/;
     BINARY_ASSET_EXT = /* @__PURE__ */ new Set([
       "png",
       "jpg",
@@ -28350,10 +28870,8 @@ ${firstUserMsg.content}`;
       "mov",
       "avi"
     ]);
-    MAX_FILE_SIZE_IN_ZIP = 10 * 1024 * 1024;
-    MAX_TOTAL_EXTRACTED_SIZE = 500 * 1024 * 1024;
-    pdpkgDecoder = new TextDecoder();
-    _MemoryFileSystem = class _MemoryFileSystem2 {
+    textDecoder = new TextDecoder("utf-8", { fatal: true });
+    MemoryFileSystem = class {
       constructor(files = {}) {
         this.files = /* @__PURE__ */ new Map();
         for (const [filePath, content] of Object.entries(files)) {
@@ -28423,18 +28941,19 @@ ${firstUserMsg.content}`;
       /**
        * Extract a `.pdpkg` (ZIP) buffer into memory under getPackagePath(name, ver).
        *
-       * Uses JSZip — isomorphic (browser + Node) — so this is the SINGLE package-ingest
-       * path for every host (replacing the CLI's Node-only adm-zip subclass and the
-       * skill installer's ad-hoc unzip). Text files only: binary assets aren't
+       * Verifies the archive through openPdpkg (isomorphic, browser + Node), so this is
+       * the SINGLE package-ingest path for every host (replacing the CLI's Node-only
+       * adm-zip subclass and the skill installer's ad-hoc unzip). Text files only: binary assets aren't
        * representable in the string-backed FS, so they're skipped (a `using:` package's
        * .prmd/.md/.json/.yaml is what matters for compilation). Validates entry paths
        * can't escape the package directory.
        */
-      async addPackage(packageName, version2, packageBuffer) {
-        if (packageBuffer.length > _MemoryFileSystem2.MAX_PACKAGE_SIZE) {
-          throw new Error(`Package too large: ${packageBuffer.length} bytes (max ${_MemoryFileSystem2.MAX_PACKAGE_SIZE})`);
-        }
-        const files = await extractPdpkg(packageBuffer);
+      async addPackage(packageName, version2, packageBuffer, expect = {}) {
+        const files = await extractPdpkg(packageBuffer, {
+          name: packageName,
+          ...import_semver.default.validRange(version2) !== null ? { range: version2 } : {},
+          ...expect
+        });
         const packagePath = this.getPackagePath(packageName, version2);
         const packagePrefix = this.normalizePath(packagePath.endsWith("/") ? packagePath : packagePath + "/");
         const packageRoot = this.normalizePath(packagePath);
@@ -28476,8 +28995,6 @@ ${firstUserMsg.content}`;
         return toRelKey(filePath);
       }
     };
-    _MemoryFileSystem.MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
-    MemoryFileSystem = _MemoryFileSystem;
     HybridFileSystem = class {
       constructor(files = {}, backend) {
         this.mem = new MemoryFileSystem(files);
@@ -28497,8 +29014,8 @@ ${firstUserMsg.content}`;
       }
       /** Ingest a `.pdpkg` (ZIP) buffer into the in-memory layer, so package files are
        * served synchronously alongside the workspace sources. */
-      addPackage(packageName, version2, packageBuffer) {
-        return this.mem.addPackage(packageName, version2, packageBuffer);
+      addPackage(packageName, version2, packageBuffer, expect = {}) {
+        return this.mem.addPackage(packageName, version2, packageBuffer, expect);
       }
       exists(filePath) {
         if (this.mem.exists(filePath)) return true;
@@ -28535,7 +29052,15 @@ ${firstUserMsg.content}`;
         return toRelKey(filePath);
       }
     };
-    MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
+    INSTALL_LIMITS = {
+      /** Dependencies one manifest may declare. */
+      maxDependencies: 100,
+      /** Packages in one install tree, the requested package included. */
+      maxPackages: 500,
+      /** Unpacked bytes across the whole tree (1 GiB). */
+      maxTotalBytes: 1024 * 1024 * 1024
+    };
+    textDecoder2 = new TextDecoder("utf-8", { fatal: true });
     PrompdCompiler = class {
       constructor(options = {}) {
         this.securityConfig = options.securityConfig || DEFAULT_SECURITY_CONFIG;
@@ -28627,6 +29152,8 @@ ${firstUserMsg.content}`;
       "~",
       ";"
     ].sort((a, b) => b.length - a.length);
+    RESERVED_LAYOUT2 = new Set([ARCHIVE_COPY, META_FILE].map((n) => n.toLowerCase()));
+    encoder = new TextEncoder();
   }
 });
 
@@ -28870,11 +29397,11 @@ async function ensurePrivateDir(dir) {
   } catch {
   }
 }
-async function writePrivate(abs, text) {
+async function writePrivate(abs, text2) {
   await fs5.mkdir(dirname4(abs), { recursive: true, mode: 448 });
   const tmp = join5(dirname4(abs), `.${basename3(abs)}.tmp-${randomBytes2(8).toString("hex")}`);
   try {
-    await fs5.writeFile(tmp, text, { encoding: "utf8", mode: 384 });
+    await fs5.writeFile(tmp, text2, { encoding: "utf8", mode: 384 });
     try {
       await fs5.chmod(tmp, 384);
     } catch {
@@ -28895,8 +29422,8 @@ function fileTextStore(abs) {
         throw e;
       }
     },
-    write: (text) => writePrivate(abs, text),
-    preserve: (text) => writePrivate(`${abs}.bad`, text)
+    write: (text2) => writePrivate(abs, text2),
+    preserve: (text2) => writePrivate(`${abs}.bad`, text2)
   };
 }
 async function realOrAncestor(abs) {
@@ -28983,6 +29510,14 @@ var init_approvalsStore = __esm({
 });
 
 // ../tools-node/deviceLogin.ts
+function verificationLink(dc) {
+  const base = dc.verification_uri;
+  const complete = dc.verification_uri_complete;
+  if (typeof complete === "string" && complete.startsWith(base) && (complete[base.length] === "?" || complete[base.length] === "&")) {
+    return complete;
+  }
+  return `${base}${base.includes("?") ? "&" : "?"}code=${encodeURIComponent(dc.user_code)}`;
+}
 function deadlineSignal(ms, outer) {
   const ac = new AbortController();
   const onOuter = () => ac.abort();
@@ -29037,11 +29572,11 @@ async function deviceLogin(opts) {
       body: JSON.stringify(body),
       signal: opts.signal
     });
-    const text = await res.text();
+    const text2 = await res.text();
     try {
-      return JSON.parse(text);
+      return JSON.parse(text2);
     } catch {
-      const looksLikeHtml = /^\s*</.test(text);
+      const looksLikeHtml = /^\s*</.test(text2);
       throw new Error(
         `${url} answered ${res.status} with ${looksLikeHtml ? "an HTML page" : "a non-JSON body"}, not JSON.` + (res.status === 404 ? `
   That usually means --base is wrong. The device endpoints live under /api \u2014 try --base ${base.replace(/\/api$/, "")}/api` : "")
@@ -29050,7 +29585,7 @@ async function deviceLogin(opts) {
   };
   const dc = await post("/oauth/device/code", { client_id: "corenel-cli", scope: "agent pair" });
   if (!dc.device_code) throw new Error("device authorization failed");
-  (opts.open ?? defaultOpen)(dc.verification_uri, dc.user_code);
+  (opts.open ?? defaultOpen)(verificationLink(dc), dc.user_code);
   let interval = opts.pollMs ?? Math.max(MIN_POLL_MS, (dc.interval ?? 5) * 1e3);
   const lifetimeMs = (typeof dc.expires_in === "number" && dc.expires_in > 0 ? dc.expires_in : DEFAULT_LIFETIME_S) * 1e3;
   const deadline = Date.now() + lifetimeMs;
@@ -31239,7 +31774,7 @@ var require_extension = __commonJS({
       if (dest[name] === void 0) dest[name] = [elem];
       else dest[name].push(elem);
     }
-    function parse3(header) {
+    function parse4(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -31379,7 +31914,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse: parse3 };
+    module.exports = { format, parse: parse4 };
   }
 });
 
@@ -31413,7 +31948,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format, parse: parse3 } = require_extension();
+    var { format, parse: parse4 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -32090,7 +32625,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse3(secWebSocketExtensions);
+            extensions = parse4(secWebSocketExtensions);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
@@ -32382,7 +32917,7 @@ var require_subprotocol = __commonJS({
   "../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function parse3(header) {
+    function parse4(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -32418,7 +32953,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module.exports = { parse: parse3 };
+    module.exports = { parse: parse4 };
   }
 });
 
@@ -32846,7 +33381,7 @@ function configWorkspaceRoot(base) {
 import { FileRecallStore, UNATTACHED_SESSION } from "@corenel/harness/sessions/fileRecallStore";
 import { makeSessionFoldStorage } from "@corenel/harness/sessions/foldStorage";
 import { makeSummarizer } from "@corenel/harness/core/summarize";
-import { stateDirName as stateDirName7, sessionsRoot, isSourceRun } from "@corenel/protocol";
+import { stateDirName as stateDirName6, sessionsRoot, isSourceRun } from "@corenel/protocol";
 import { PermissionService as PermissionService6 } from "@corenel/harness/guardrail/permission-service";
 
 // src/nodeContext.ts
@@ -32948,6 +33483,8 @@ var crew_exports = {};
 __export(crew_exports, {
   AUTONOMY_TOOLS: () => AUTONOMY_TOOLS,
   CHECK_IN_BLOCK: () => CHECK_IN_BLOCK,
+  COMMAND_CAPABILITIES: () => COMMAND_CAPABILITIES,
+  CREW_DEFINITION_MARKERS: () => CREW_DEFINITION_MARKERS,
   CREW_EXCLUDED_TOOLS: () => CREW_EXCLUDED_TOOLS,
   CREW_SEG: () => CREW_SEG,
   DEPLOYMENT_FILE: () => DEPLOYMENT_FILE,
@@ -32957,16 +33494,23 @@ __export(crew_exports, {
   DONT_BLANK: () => DONT_BLANK,
   DONT_CONTROL: () => DONT_CONTROL,
   DONT_TOO_LONG: () => DONT_TOO_LONG,
+  MANAGED_IN_SESSION_REFUSED: () => MANAGED_IN_SESSION_REFUSED,
+  MANAGED_LOCKED: () => MANAGED_LOCKED,
+  MANAGED_UNREADABLE: () => MANAGED_UNREADABLE,
+  MANAGED_UNTRUSTED: () => MANAGED_UNTRUSTED,
   MAX_ROOM_BRIEF: () => MAX_ROOM_BRIEF,
+  MCP_DENY_ALL: () => MCP_DENY_ALL,
   MEMORY_USERS_DIR: () => MEMORY_USERS_DIR,
   NOT_IN_YOUR_MEMORY: () => NOT_IN_YOUR_MEMORY,
   NO_ASKER_MEMORY_READ_ONLY: () => NO_ASKER_MEMORY_READ_ONLY,
+  NO_TOOL_SENTINEL: () => NO_TOOL_SENTINEL,
   PROJECT_MARKER_FILE: () => PROJECT_MARKER_FILE,
   ROOM_KIND: () => ROOM_KIND,
   ROOM_MEMORY_READ_ONLY: () => ROOM_MEMORY_READ_ONLY,
   RUN_STATUS_VALUES: () => RUN_STATUS_VALUES,
   RoomReadError: () => RoomReadError,
   RoomStore: () => RoomStore,
+  accessAllows: () => accessAllows,
   advance: () => advance,
   agentMemoryRoot: () => agentMemoryRoot,
   allowedAutonomy: () => allowedAutonomy,
@@ -32979,7 +33523,9 @@ __export(crew_exports, {
   callCandidates: () => callCandidates,
   callReach: () => callReach,
   closeRoomByHuman: () => closeRoomByHuman,
+  copyCrewAgentAt: () => copyCrewAgentAt,
   crewAgentDir: () => crewAgentDir,
+  crewAgentPresent: () => crewAgentPresent,
   crewAgentSessionsRoot: () => crewAgentSessionsRoot,
   crewBudgetConstraints: () => crewBudgetConstraints,
   crewListEntry: () => crewListEntry,
@@ -32994,16 +33540,22 @@ __export(crew_exports, {
   deploymentRootFor: () => deploymentRootFor,
   dontsProblems: () => dontsProblems,
   editFindingByHuman: () => editFindingByHuman,
+  egressIsEmpty: () => egressIsEmpty,
   emptyDeployment: () => emptyDeployment,
   encodeRoomLine: () => encodeRoomLine,
   enforcedLevel: () => enforcedLevel,
+  filterDefinition: () => filterDefinition,
   findingsPath: () => findingsPath,
   finishTurn: () => finishTurn,
   foldRoom: () => foldRoom,
   globMatch: () => globMatch,
   grantOfferedTools: () => grantOfferedTools,
+  grantsCommandTools: () => grantsCommandTools,
   interjectHuman: () => interjectHuman,
+  intersectAllowList: () => intersectAllowList,
   isAutonomyPreset: () => isAutonomyPreset,
+  isManaged: () => isManaged,
+  isManagedOnDisk: () => isManagedOnDisk,
   isOrchestrator: () => isOrchestrator,
   isRoomSafeTool: () => isRoomSafeTool,
   isSafeProjectPath: () => isSafeProjectPath,
@@ -33014,18 +33566,26 @@ __export(crew_exports, {
   listCrewSummariesAt: () => listCrewSummariesAt,
   loadCrewAgentAt: () => loadCrewAgentAt,
   loadCrewAgentAtIfExists: () => loadCrewAgentAtIfExists,
+  loadCrewAgentAtIfPresent: () => loadCrewAgentAtIfPresent,
   loadCrewSummaryAt: () => loadCrewSummaryAt,
   makeAgentMemoryProvider: () => makeAgentMemoryProvider,
   makeCrewTurnRuntime: () => makeCrewTurnRuntime,
   makePartitionedMemoryProvider: () => makePartitionedMemoryProvider,
   makeReadOnlyMemoryProvider: () => makeReadOnlyMemoryProvider,
+  managedCap: () => managedCap,
+  managedClaimOf: () => managedClaimOf,
+  managedLockReason: () => managedLockReason,
+  managedTrusted: () => managedTrusted,
   matchFileChange: () => matchFileChange,
   matchRunComplete: () => matchRunComplete,
+  narrowDefinition: () => narrowDefinition,
   newCrewDraft: () => newCrewDraft,
   nextCronAfter: () => nextCronAfter,
   normalizeRunStatus: () => normalizeRunStatus,
+  offersCommandTools: () => offersCommandTools,
   openLineOf: () => openLineOf,
   openRoom: () => openRoom,
+  packagePolicyModels: () => packagePolicyModels,
   parseCron: () => parseCron,
   parseDeployment: () => parseDeployment,
   parseFrontmatter: () => parseFrontmatter,
@@ -33037,6 +33597,8 @@ __export(crew_exports, {
   projectMarkerPath: () => projectMarkerPath,
   readAutonomy: () => readAutonomy,
   readCrewListing: () => readCrewListing,
+  readManagedEntry: () => readManagedEntry,
+  readManagedRef: () => readManagedRef,
   registerCrewPolicy: () => registerCrewPolicy,
   resolveCallSet: () => resolveCallSet,
   resolveCrewModel: () => resolveCrewModel,
@@ -33051,26 +33613,29 @@ __export(crew_exports, {
   runRoom: () => runRoom,
   runTurnRuntime: () => runTurnRuntime,
   serializeDeployment: () => serializeDeployment,
+  setDefinitionFilter: () => setDefinitionFilter,
+  setManagedTrust: () => setManagedTrust,
   splitRunStatus: () => splitRunStatus,
   stampAuthor: () => stampAuthor,
   stringArray: () => stringArray,
   takeTurn: () => takeTurn,
   tightenAutonomy: () => tightenAutonomy,
   turnCosts: () => turnCosts,
+  unsandboxedCommandsFact: () => unsandboxedCommandsFact,
   userMemoryRoot: () => userMemoryRoot,
   validateRoomRequest: () => validateRoomRequest,
   writeCrewAgentAt: () => writeCrewAgentAt
 });
 
 // ../crew/frontmatter.ts
-var import_yaml = __toESM(require_dist(), 1);
+var import_yaml2 = __toESM(require_dist(), 1);
 var FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
-function parseFrontmatter(text) {
-  const m = text.match(FRONTMATTER);
-  if (!m) return { meta: {}, body: text };
+function parseFrontmatter(text2) {
+  const m = text2.match(FRONTMATTER);
+  if (!m) return { meta: {}, body: text2 };
   let meta = {};
   try {
-    const parsed = import_yaml.default.parse(m[1]);
+    const parsed = import_yaml2.default.parse(m[1]);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       meta = parsed;
     }
@@ -33081,7 +33646,7 @@ function parseFrontmatter(text) {
 }
 
 // ../crew/policy.ts
-var import_yaml2 = __toESM(require_dist(), 1);
+var import_yaml3 = __toESM(require_dist(), 1);
 var LEVELS = ["allow", "ask", "owner", "deny"];
 var UNATTENDED = ["deny", "park", "allow"];
 function asLevel(v) {
@@ -33111,11 +33676,11 @@ function coercePermissions(v) {
   }
   return out;
 }
-function parsePolicyYaml(text, agentName) {
+function parsePolicyYaml(text2, agentName) {
   let raw = {};
-  if (text.trim()) {
+  if (text2.trim()) {
     try {
-      const parsed = import_yaml2.default.parse(text);
+      const parsed = import_yaml3.default.parse(text2);
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         raw = parsed;
       }
@@ -33171,6 +33736,23 @@ function parsePolicyYaml(text, agentName) {
   return policy;
 }
 
+// ../crew/packagePolicy.ts
+var import_yaml4 = __toESM(require_dist(), 1);
+import { validateModelEgress } from "@corenel/protocol";
+function packagePolicyModels(text2) {
+  let raw;
+  try {
+    raw = text2.trim() ? import_yaml4.default.parse(text2) : null;
+  } catch {
+    return { ok: false, error: "POLICY.yaml is not valid YAML" };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { ok: true, value: null };
+  const models = raw.models;
+  if (models === void 0) return { ok: true, value: null };
+  const checked = validateModelEgress(models);
+  return checked.ok ? { ok: true, value: checked.value } : { ok: false, error: checked.error };
+}
+
 // ../crew/donts.ts
 import { DONTS_MAX, DONT_MAX_CHARS, hasControlChars } from "@corenel/protocol";
 var DONT_BLANK = "A don't cannot be blank.";
@@ -33250,6 +33832,24 @@ function enforcedLevel(policy, cap) {
   });
 }
 
+// ../crew/commandTools.ts
+var COMMAND_CAPABILITIES = [
+  { tool: "sidecar_shell_exec", label: "Run shell commands", mutating: true, address: "sidecar:shell_exec", permission: "ask" },
+  { tool: "sidecar_run_check", label: "Run confirmed checks", mutating: true, address: "sidecar:run_check", permission: "ask" },
+  { tool: "proc_start", label: "Start long-running processes", mutating: true, address: "shell:spawn", permission: "ask" }
+];
+function offersCommandTools(toolNames) {
+  const names = new Set(toolNames);
+  return COMMAND_CAPABILITIES.some((c) => names.has(c.tool));
+}
+function grantsCommandTools(policy) {
+  return COMMAND_CAPABILITIES.some((c) => enforcedLevel(policy, c) !== "deny");
+}
+function unsandboxedCommandsFact(policy, offeredToolNames) {
+  const offered = new Set(offeredToolNames);
+  return COMMAND_CAPABILITIES.some((c) => offered.has(c.tool) && enforcedLevel(policy, c) !== "deny") ? { unsandboxedCommands: true } : {};
+}
+
 // ../crew/autonomy.ts
 import { SIDECAR_GIT_PUSH, SIDECAR_OPEN_PR } from "@corenel/protocol";
 import { toolAddress, resolveNamespace } from "@corenel/harness/tools/namespaces";
@@ -33308,8 +33908,8 @@ function allowedAutonomy(def) {
 function tightenAutonomy(def, requested) {
   if (!isAutonomyPreset(requested)) return { ok: false, reason: "Unknown autonomy level." };
   if (!fits(def, requested)) {
-    const current = readAutonomy(def);
-    const name = current === "custom" ? "a custom policy" : LABEL[current];
+    const current2 = readAutonomy(def);
+    const name = current2 === "custom" ? "a custom policy" : LABEL[current2];
     return { ok: false, reason: `This orchestrator is set to ${name}; a task cannot run as ${LABEL[requested]}. Change it on the agent.` };
   }
   const want = PRESET_LEVEL[requested];
@@ -33326,8 +33926,90 @@ function tightenAutonomy(def, requested) {
 }
 
 // ../crew/store.ts
-var import_yaml3 = __toESM(require_dist(), 1);
-import { flattenFiles as flattenFiles3 } from "@corenel/protocol";
+var import_yaml5 = __toESM(require_dist(), 1);
+init_dist();
+import {
+  flattenFiles as flattenFiles3,
+  PACKAGE_REF_FILE as PACKAGE_REF_FILE2,
+  packageInstallDir,
+  parentDir,
+  parsePackageRef as parsePackageRef2
+} from "@corenel/protocol";
+
+// ../crew/notFound.ts
+function isNotFound(e) {
+  if (!e || typeof e !== "object") return false;
+  const o = e;
+  if (o.code === "ENOENT" || o.code === "ENOTDIR" || o.name === "NotFoundError") return true;
+  return typeof o.message === "string" && /^(not found|no such file( or directory)?)(:|$)/i.test(o.message);
+}
+
+// ../crew/managed.ts
+import { PACKAGE_REF_FILE, parsePackageRef } from "@corenel/protocol";
+var MANAGED_UNTRUSTED = "managed by a deployment this node does not hold";
+var MANAGED_LOCKED = "is managed by the fleet; its definition and settings cannot be changed, copied or deleted on this machine";
+var MANAGED_UNREADABLE = "has a PACKAGE.json that cannot be read, so it is treated as managed by the fleet: it cannot be changed, copied or deleted on this machine";
+var trust = null;
+function setManagedTrust(check) {
+  trust = check;
+}
+function managedTrusted(name, managed) {
+  if (!trust) return false;
+  try {
+    return trust(name, managed) === true;
+  } catch {
+    return false;
+  }
+}
+function isManaged(x) {
+  return x.source?.managed !== void 0;
+}
+async function readManagedRef(files, root, name) {
+  const path = `${root}/${name}/${PACKAGE_REF_FILE}`;
+  try {
+    const st = await files.stat(path);
+    if (st === null) return null;
+  } catch (e) {
+    return isNotFound(e) ? null : "unknown";
+  }
+  let text2;
+  try {
+    text2 = await files.read(path);
+  } catch {
+    return "unknown";
+  }
+  return managedClaimOf(text2);
+}
+function managedClaimOf(text2) {
+  let ref;
+  try {
+    ref = parsePackageRef(text2);
+  } catch {
+    return "unknown";
+  }
+  return ref.managed ? { ...ref, managed: ref.managed } : null;
+}
+async function readManagedEntry(files, root, name) {
+  const ref = await readManagedRef(files, root, name);
+  return ref === null || ref === "unknown" ? ref : ref.managed;
+}
+async function managedLockReason(files, root, name) {
+  const m = await readManagedEntry(files, root, name);
+  if (m === null) return null;
+  return m === "unknown" ? MANAGED_UNREADABLE : MANAGED_LOCKED;
+}
+async function isManagedOnDisk(files, root, name) {
+  return await readManagedEntry(files, root, name) !== null;
+}
+
+// ../crew/definitionFilter.ts
+var current = null;
+function setDefinitionFilter(f) {
+  current = f;
+}
+function filterDefinition(def, at) {
+  return current ? current(def, at) : def;
+}
 
 // ../crew/sessionBinding.ts
 var SESSION_NAME_RE = /^[a-z0-9_-]{1,32}$/;
@@ -33384,6 +34066,73 @@ async function readOr(files, path, fallback = "") {
     return fallback;
   }
 }
+var DEFINITION_FILES = ["AGENT.md", "SOUL.md", "PERSONA.md", "POLICY.yaml"];
+var textDecoder3 = new TextDecoder();
+async function isFile(files, path) {
+  try {
+    return (await files.stat(path))?.kind === "file";
+  } catch (e) {
+    if (isNotFound(e)) return false;
+    throw e;
+  }
+}
+var CREW_DEFINITION_MARKERS = ["AGENT.md", PACKAGE_REF_FILE2];
+async function crewAgentPresent(files, root, name) {
+  if (!isValidAgentName(name)) return false;
+  for (const f of CREW_DEFINITION_MARKERS) {
+    if (await isFile(files, `${root}/${name}/${f}`)) return true;
+  }
+  return false;
+}
+async function definitionSource(files, root, name) {
+  const dir = `${root}/${name}`;
+  if (!await isFile(files, `${dir}/${PACKAGE_REF_FILE2}`)) {
+    return { read: (f) => readOr(files, `${dir}/${f}`) };
+  }
+  for (const f of DEFINITION_FILES) {
+    if (await isFile(files, `${dir}/${f}`)) {
+      throw new Error(`crew agent ${name}: the folder holds both ${PACKAGE_REF_FILE2} and definition files (${f}); remove one`);
+    }
+  }
+  let ref;
+  try {
+    ref = parsePackageRef2(await files.read(`${dir}/${PACKAGE_REF_FILE2}`));
+  } catch (e) {
+    throw new Error(`crew agent ${name}: ${e.message}`);
+  }
+  if (ref.managed && !managedTrusted(name, ref.managed)) {
+    throw new Error(`crew agent ${name}: ${MANAGED_UNTRUSTED}`);
+  }
+  const label = `${ref.package}@${ref.version} (${ref.digest})`;
+  const readBytes = files.readBytes?.bind(files);
+  if (!readBytes) {
+    throw new Error(`crew agent ${name}: package ${label} cannot be loaded: cannot read package archives on this host (its file service has no binary reads)`);
+  }
+  const installDir = packageInstallDir(parentDir(root), "agent", ref);
+  let pkg;
+  try {
+    pkg = await verifyInstalled(async (rel) => {
+      try {
+        return await readBytes(`${installDir}/${rel}`);
+      } catch {
+        return null;
+      }
+    }, ref.digest, { name: ref.package, range: ref.version });
+  } catch (e) {
+    if (isPackageVerificationError(e) && e.code === "FILE_MISSING" && e.path === ARCHIVE_COPY) {
+      throw new Error(`crew agent ${name}: package ${label} is not installed`);
+    }
+    throw new Error(`crew agent ${name}: package ${ref.package}@${ref.version} failed verification: ${e.message}`);
+  }
+  const source = { kind: "package", package: ref.package, version: ref.version, digest: ref.digest, ...ref.managed ? { managed: ref.managed } : {} };
+  return {
+    read: async (f) => {
+      const b = pkg.files.get(f);
+      return b ? textDecoder3.decode(b) : "";
+    },
+    source
+  };
+}
 function parseTriggers(meta) {
   const raw = meta.triggers;
   if (!Array.isArray(raw)) return [];
@@ -33450,13 +34199,16 @@ function parseWorkRoots(raw) {
   }
   return Object.keys(out).length ? out : void 0;
 }
-function parseSettings(text) {
+function parseSettings(text2) {
   try {
-    const raw = JSON.parse(text);
+    const raw = JSON.parse(text2);
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
       const o = raw;
       return {
         model: typeof o.model === "string" ? o.model : void 0,
+        /* Meaningful only for a package agent (its AGENT.md is immutable); a
+         * local agent's switch lives in AGENT.md and this is ignored for it. */
+        enabled: typeof o.enabled === "boolean" ? o.enabled : void 0,
         temperature: typeof o.temperature === "number" ? o.temperature : void 0,
         /* Carried through as-is. Validation belongs to the daemon, which is the
          * only side that knows its own approved roots -- checking here would be
@@ -33470,45 +34222,60 @@ function parseSettings(text) {
   }
   return {};
 }
+function packageModelsOf(policyText) {
+  const m = packagePolicyModels(policyText);
+  if (!m.ok) return { packageModels: { allow: [] } };
+  return m.value === null ? {} : { packageModels: m.value };
+}
 async function loadCrewAgentAt(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
   const dir = `${root}/${name}`;
-  const { meta, body } = parseFrontmatter(await readOr(files, `${dir}/AGENT.md`));
+  const src = await definitionSource(files, root, name);
+  const { meta, body } = parseFrontmatter(await src.read("AGENT.md"));
+  const settings = parseSettings(await readOr(files, `${dir}/settings.json`, "{}"));
+  if (!src.source) delete settings.enabled;
   const session = parseSessionBinding(meta);
   const orchestration = parseOrchestration(meta);
   const tags = (0, tags_exports.parseTags)(meta);
-  return {
+  const policyText = await src.read("POLICY.yaml");
+  return filterDefinition({
     name,
     jobTitle: typeof meta.jobTitle === "string" ? meta.jobTitle : "",
     description: typeof meta.description === "string" ? meta.description : "",
     ...tags ? { tags } : {},
     scope,
-    enabled: meta.enabled !== false,
-    // absent/anything-but-false -> enabled
+    // absent/anything-but-false -> enabled; a package agent's switch is in settings.json
+    enabled: src.source ? settings.enabled !== false : meta.enabled !== false,
     triggers: parseTriggers(meta),
     instructions: body,
-    soul: await readOr(files, `${dir}/SOUL.md`),
-    persona: await readOr(files, `${dir}/PERSONA.md`),
-    policy: parsePolicyYaml(await readOr(files, `${dir}/POLICY.yaml`), name),
-    settings: parseSettings(await readOr(files, `${dir}/settings.json`, "{}")),
+    soul: await src.read("SOUL.md"),
+    persona: await src.read("PERSONA.md"),
+    policy: parsePolicyYaml(policyText, name),
+    settings,
     budget: parseBudget(meta),
     canCall: parseCanCall(meta),
     canCallAll: meta.canCallAll === true,
     ...orchestration !== void 0 ? { orchestration } : {},
     ...session.kind === "binding" ? { session: session.binding } : {},
-    ...session.kind === "malformed" ? { sessionError: session.reason } : {}
-  };
+    ...session.kind === "malformed" ? { sessionError: session.reason } : {},
+    ...src.source ? { source: src.source } : {},
+    ...src.source ? packageModelsOf(policyText) : {}
+  }, { files, root });
 }
 async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) return null;
   try {
-    const st = await files.stat(`${root}/${name}/AGENT.md`);
-    if (st?.kind !== "file") return null;
+    if (!await crewAgentPresent(files, root, name)) return null;
     return await loadCrewAgentAt(files, root, name, scope);
   } catch {
     return null;
   }
 }
+async function loadCrewAgentAtIfPresent(files, root, name, scope = "workspace") {
+  if (!isValidAgentName(name)) return null;
+  if (!await crewAgentPresent(files, root, name)) return null;
+  return loadCrewAgentAt(files, root, name, scope);
+}
 async function listCrewAgentsAt(files, root, opts = {}) {
   let nodes;
   try {
@@ -33545,7 +34312,7 @@ function serializePolicy(policy) {
   if (policy.unattended) ordered.unattended = policy.unattended;
   if (typeof policy.parkTimeoutMs === "number") ordered.parkTimeoutMs = policy.parkTimeoutMs;
   if (typeof policy.pushWaitMs === "number") ordered.pushWaitMs = policy.pushWaitMs;
-  return import_yaml3.default.stringify(ordered, { lineWidth: 0 });
+  return import_yaml5.default.stringify(ordered, { lineWidth: 0 });
 }
 function serializeAgentMd(def) {
   const meta = { name: def.name };
@@ -33571,13 +34338,15 @@ function serializeAgentMd(def) {
     meta.session = def.session.createIfMissing ? { name: def.session.name } : { name: def.session.name, createIfMissing: false };
   }
   return `---
-${import_yaml3.default.stringify(meta, { lineWidth: 0 })}---
+${import_yaml5.default.stringify(meta, { lineWidth: 0 })}---
 ${def.instructions.replace(/\n+$/, "")}
 `;
 }
 async function loadCrewSummaryAt(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
-  const { meta } = parseFrontmatter(await readOr(files, `${root}/${name}/AGENT.md`));
+  const src = await definitionSource(files, root, name);
+  const { meta } = parseFrontmatter(await src.read("AGENT.md"));
+  const enabled = src.source ? parseSettings(await readOr(files, `${root}/${name}/settings.json`, "{}")).enabled !== false : meta.enabled !== false;
   const tags = (0, tags_exports.parseTags)(meta);
   return {
     name,
@@ -33585,20 +34354,30 @@ async function loadCrewSummaryAt(files, root, name, scope = "workspace") {
     description: typeof meta.description === "string" ? meta.description : "",
     ...tags ? { tags } : {},
     triggers: parseTriggers(meta).map((t) => t.type),
-    enabled: meta.enabled !== false,
+    enabled,
     scope,
     delegates: Array.isArray(meta.canCall) && meta.canCall.length > 0 || meta.canCallAll === true,
-    orchestrator: orchestrationBlock(meta) !== void 0
+    orchestrator: orchestrationBlock(meta) !== void 0,
+    ...src.source ? { source: src.source } : {}
   };
 }
+async function referencedSource(files, dir) {
+  try {
+    const ref = parsePackageRef2(await files.read(`${dir}/${PACKAGE_REF_FILE2}`));
+    return { kind: "package", package: ref.package, version: ref.version, digest: ref.digest, ...ref.managed ? { managed: ref.managed } : {} };
+  } catch {
+    return void 0;
+  }
+}
 async function listCrewSummariesAt(files, root, scope = "workspace", opts = {}) {
   const names = await listCrewAgentsAt(files, root, opts);
   const out = [];
   for (const name of names.sort()) {
     try {
       out.push(await loadCrewSummaryAt(files, root, name, scope));
-    } catch {
-      out.push({ name, description: "", enabled: true, scope, delegates: false, orchestrator: false });
+    } catch (e) {
+      const source = await referencedSource(files, `${root}/${name}`);
+      out.push({ name, description: "", enabled: false, scope, delegates: false, orchestrator: false, ...source ? { source } : {}, loadError: e.message });
     }
   }
   return out;
@@ -33612,22 +34391,37 @@ async function put(files, path, content) {
 }
 function stripWorkRoots(settings) {
   const { workRoots: _workRoots, ...rest } = settings;
+  for (const k of Object.keys(rest)) {
+    if (rest[k] === void 0) delete rest[k];
+  }
   return rest;
 }
 async function dontsUnchanged(files, dir, def) {
-  let text;
+  let text2;
   try {
-    text = await files.read(`${dir}/POLICY.yaml`);
+    text2 = await files.read(`${dir}/POLICY.yaml`);
   } catch {
     return false;
   }
-  const stored = parsePolicyYaml(text, def.name).donts ?? [];
+  const stored = parsePolicyYaml(text2, def.name).donts ?? [];
   const next = (def.policy.donts ?? []).map((d) => d.trim());
   return stored.length === next.length && stored.every((d, i) => d === next[i]);
 }
 async function writeCrewAgentAt(files, root, def) {
   if (!isValidAgentName(def.name)) throw new Error(`invalid crew agent name: ${def.name}`);
   const dir = `${root}/${def.name}`;
+  if (await isFile(files, `${dir}/${PACKAGE_REF_FILE2}`)) {
+    const locked2 = await managedLockReason(files, root, def.name);
+    if (locked2) throw new Error(`crew agent ${def.name} ${locked2}`);
+    await put(files, `${dir}/settings.json`, `${JSON.stringify(stripWorkRoots({ ...def.settings, enabled: def.enabled }), null, 2)}
+`);
+    return;
+  }
+  if (def.source) {
+    throw new Error(`crew agent ${def.name} is package ${def.source.package}@${def.source.version} but its folder has no ${PACKAGE_REF_FILE2}; copy it to make a local agent`);
+  }
+  const localSettings = { ...def.settings };
+  delete localSettings.enabled;
   if (!await dontsUnchanged(files, dir, def)) {
     const problems = dontsProblems(def.policy);
     if (problems.length) throw new Error(problems.join(" "));
@@ -33636,11 +34430,25 @@ async function writeCrewAgentAt(files, root, def) {
   await put(files, `${dir}/SOUL.md`, def.soul);
   await put(files, `${dir}/PERSONA.md`, def.persona);
   await put(files, `${dir}/POLICY.yaml`, serializePolicy(def.policy));
-  await put(files, `${dir}/settings.json`, `${JSON.stringify(stripWorkRoots(def.settings), null, 2)}
+  await put(files, `${dir}/settings.json`, `${JSON.stringify(stripWorkRoots(localSettings), null, 2)}
 `);
 }
+async function copyCrewAgentAt(files, root, from, to) {
+  if (!isValidAgentName(to)) throw new Error(`invalid crew agent name: ${to}`);
+  if (await crewAgentPresent(files, root, to)) throw new Error(`crew agent ${to} already exists`);
+  const def = await loadCrewAgentAt(files, root, from);
+  const locked2 = isManaged(def) ? MANAGED_LOCKED : await managedLockReason(files, root, from);
+  if (locked2) throw new Error(`crew agent ${from} ${locked2}`);
+  const copy = { ...def, name: to, settings: { ...def.settings } };
+  delete copy.source;
+  delete copy.settings.enabled;
+  await writeCrewAgentAt(files, root, copy);
+  return copy;
+}
 async function deleteCrewAgentAt(files, root, name) {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
+  const locked2 = await managedLockReason(files, root, name);
+  if (locked2) throw new Error(`crew agent ${name} ${locked2}`);
   await files.remove(`${root}/${name}`);
 }
 
@@ -33918,10 +34726,10 @@ function normalizeRunStatus(raw) {
   return RUN_STATUS_BY_RAW.get((raw ?? "").trim()) ?? "error";
 }
 function splitRunStatus(raw) {
-  const text = (raw ?? "").trim();
-  const stopReason = normalizeRunStatus(text);
-  if (stopReason !== "error" || text === "error" || !text) return { stopReason };
-  return { stopReason, message: text };
+  const text2 = (raw ?? "").trim();
+  const stopReason = normalizeRunStatus(text2);
+  if (stopReason !== "error" || text2 === "error" || !text2) return { stopReason };
+  return { stopReason, message: text2 };
 }
 function matchRunComplete(config, completion) {
   const after = stringArray(config.after);
@@ -33955,11 +34763,11 @@ function emptyDeployment() {
 function deploymentKey(name, wsId) {
   return wsId ? `workspaces/${wsId}/crew/${name}` : `crew/${name}`;
 }
-function parseDeployment(text) {
+function parseDeployment(text2) {
   const out = emptyDeployment();
   let raw;
   try {
-    raw = JSON.parse(text);
+    raw = JSON.parse(text2);
   } catch {
     return out;
   }
@@ -34110,11 +34918,12 @@ function nextCronAfter(f, from) {
 }
 
 // ../crew/offerGrants.ts
-import { policyNamesTool, toolGateCovers } from "@corenel/harness/guardrail";
+import { matchesAnyGlob as matchesAnyGlob2, policyNamesTool, toolGateCovers } from "@corenel/harness/guardrail";
 import { toolAddress as toolAddress2 } from "@corenel/harness/tools/namespaces";
-function grantOfferedTools(policy, offered) {
+function grantOfferedTools(policy, offered, cap = null) {
   const missing = offered.filter((name) => {
     const subject = { name, address: toolAddress2({ name }) };
+    if (cap !== null && !matchesAnyGlob2(subject.name, cap) && !matchesAnyGlob2(subject.address, cap)) return false;
     return !policyNamesTool(policy, subject) && !toolGateCovers(policy, subject);
   });
   if (!missing.length) return policy;
@@ -34122,6 +34931,93 @@ function grantOfferedTools(policy, offered) {
   for (const name of missing) permissions[name] = "allow";
   return { ...policy, permissions };
 }
+function managedCap(def) {
+  if (!def.source?.managed) return null;
+  const allow = def.policy.tools?.allow ?? [];
+  return allow.length ? [...allow] : null;
+}
+
+// ../crew/acl.ts
+import {
+  intersectModelEgress,
+  toolsWider
+} from "@corenel/protocol";
+var NO_TOOL_SENTINEL = "__none__";
+var MCP_DENY_ALL = "mcp:**";
+var MANAGED_IN_SESSION_REFUSED = "managed agents run only on this machine's daemon, never in a session";
+function uniq(xs) {
+  return [...new Set(xs)];
+}
+function intersectAllowList(pkg, acl) {
+  const p = pkg ?? [];
+  const entries = uniq(acl);
+  const widened = toolsWider(entries, p);
+  return { allow: entries.filter((e) => !widened.includes(e)), widened };
+}
+function egressIsEmpty(e) {
+  if (e === "any") return false;
+  return e.allow.every((ep) => ep.models !== "*" && ep.models.length === 0);
+}
+function accessAllows(level, userId, adminId) {
+  if (level === void 0 || level === "members") return true;
+  return !!userId && !!adminId && userId === adminId;
+}
+function lower(a, b) {
+  if (a === void 0) return b;
+  if (b === void 0) return a;
+  return Math.min(a, b);
+}
+function narrowDefinition(def, acl, nodePolicy) {
+  let refused;
+  const refuse = (why) => {
+    if (refused === void 0) refused = why;
+  };
+  if (def.session !== void 0 || def.sessionError !== void 0) refuse(MANAGED_IN_SESSION_REFUSED);
+  const pkgAllow = def.policy.tools?.allow ?? [];
+  let allow = [...pkgAllow];
+  if (acl.tools) {
+    const r = intersectAllowList(pkgAllow, acl.tools.allow);
+    if (r.widened.length) refuse(`tools would widen the package: ${r.widened.join(", ")}`);
+    allow = r.allow.length ? r.allow : [NO_TOOL_SENTINEL];
+  }
+  const deny = [...def.policy.tools?.deny ?? []];
+  if (allow.length === 0 && !deny.includes(MCP_DENY_ALL)) deny.push(MCP_DENY_ALL);
+  const tools = allow.length || deny.length ? { ...allow.length ? { allow } : {}, ...deny.length ? { deny } : {} } : void 0;
+  let skills = def.policy.skills;
+  const aclSkills = acl.tools?.skills;
+  if (aclSkills) {
+    const pkgSkills = def.policy.skills ?? [];
+    const kept = pkgSkills.filter((s) => aclSkills.includes(s));
+    const widened = aclSkills.filter((s) => !pkgSkills.includes(s));
+    if (widened.length) refuse(`skills would widen the package: ${widened.join(", ")}`);
+    skills = kept.length ? kept : [NO_TOOL_SENTINEL];
+  }
+  const { tools: _tools, skills: _skills, ...policyRest } = def.policy;
+  const policy = { ...policyRest, ...tools ? { tools } : {}, ...skills ? { skills } : {} };
+  const allowedTriggers = acl.triggers?.allow;
+  const triggers = allowedTriggers ? def.triggers.filter((t) => allowedTriggers.includes(t.type)) : [...def.triggers];
+  const budget = { ...def.budget ?? {} };
+  if (acl.budget) {
+    const usd = lower(budget.maxUsd, acl.budget.perRunUsd);
+    const tok = lower(budget.maxTokens, acl.budget.perRunTokens);
+    if (usd !== void 0) budget.maxUsd = usd;
+    if (tok !== void 0) budget.maxTokens = tok;
+  }
+  const effectiveModels = intersectModelEgress(
+    intersectModelEgress(nodePolicy.models, def.packageModels ?? "any"),
+    acl.models ?? "any"
+  );
+  if (egressIsEmpty(effectiveModels)) refuse("no allowed model");
+  const out = {
+    ...def,
+    policy,
+    triggers,
+    budget,
+    egress: effectiveModels,
+    ...acl.access ? { aclAccess: { run: acl.access.run } } : {}
+  };
+  return refused === void 0 ? { def: out, effectiveModels } : { def: out, effectiveModels, refused };
+}
 
 // ../crew/memory.ts
 import { MEMORY_USERS_DIR } from "@corenel/protocol";
@@ -34274,9 +35170,9 @@ var ROOM_KIND = "room";
 function encodeRoomLine(line) {
   return JSON.stringify(line) + "\n";
 }
-function roomLines(text) {
+function roomLines(text2) {
   const out = [];
-  for (const raw of text.split("\n")) {
+  for (const raw of text2.split("\n")) {
     const s = raw.trim();
     if (!s) continue;
     let line;
@@ -34289,14 +35185,14 @@ function roomLines(text) {
   }
   return out;
 }
-function openLineOf(text) {
-  for (const line of roomLines(text)) if (line.op === "open") return line;
+function openLineOf(text2) {
+  for (const line of roomLines(text2)) if (line.op === "open") return line;
   return null;
 }
-function foldRoom(text) {
+function foldRoom(text2) {
   let state = null;
   let lastAt;
-  for (const line of roomLines(text)) {
+  for (const line of roomLines(text2)) {
     if (typeof line.at === "number" && (lastAt === void 0 || line.at > lastAt)) lastAt = line.at;
     if (line.op === "open") {
       if (state) continue;
@@ -34346,9 +35242,9 @@ function foldRoom(text) {
   if (state && lastAt !== void 0) state = { ...state, lastAt };
   return state;
 }
-function pendingParticipant(text) {
+function pendingParticipant(text2) {
   let pending = null;
-  for (const line of roomLines(text)) {
+  for (const line of roomLines(text2)) {
     if (line.op === "pending") {
       if (typeof line.participant === "string") pending = line.participant;
     } else if (line.op === "floor" || line.op === "close") {
@@ -34357,9 +35253,9 @@ function pendingParticipant(text) {
   }
   return pending;
 }
-function pendingReason(text) {
+function pendingReason(text2) {
   let reason = null;
-  for (const line of roomLines(text)) {
+  for (const line of roomLines(text2)) {
     if (line.op === "pending") {
       reason = typeof line.reason === "string" ? line.reason : null;
     } else if (line.op === "floor" || line.op === "close") {
@@ -34368,10 +35264,10 @@ function pendingReason(text) {
   }
   return reason;
 }
-function turnCosts(text) {
+function turnCosts(text2) {
   const out = [];
   let opened = false;
-  for (const line of roomLines(text)) {
+  for (const line of roomLines(text2)) {
     if (line.op === "open") {
       if (typeof line.roomId === "string" && Array.isArray(line.participants) && typeof line.maxTurns === "number") opened = true;
       continue;
@@ -34470,8 +35366,8 @@ var RoomStore = class {
    * reader wants a document either way. A file that exists but cannot be read
    * throws (see `textAt`). */
   async readFindings(roomId) {
-    const text = await this.textAt(findingsPath(this.getRoot(), roomId));
-    return text == null ? [] : foldFindings(text);
+    const text2 = await this.textAt(findingsPath(this.getRoot(), roomId));
+    return text2 == null ? [] : foldFindings(text2);
   }
   /** Append one finding op. A genuine read-then-concat append, exactly as
    * `append` does for the room fold, because the engine and a human's edit both
@@ -34483,8 +35379,8 @@ var RoomStore = class {
     await files.write(path, prior + encodeFindingLine(line));
   }
   async read(roomId) {
-    const text = await this.text(roomId);
-    return text == null ? null : foldRoom(text);
+    const text2 = await this.text(roomId);
+    return text2 == null ? null : foldRoom(text2);
   }
   /** Every room this store can find on disk, folded to its current state.
    * Mirrors `JsonlSessionStore.list()` (packages/harness/sessions/
@@ -34500,38 +35396,38 @@ var RoomStore = class {
     const roomFiles = flattenFiles4(nodes).filter((f) => f.name === "SESSION.jsonl" && f.path.startsWith(`${root}/`));
     const out = [];
     for (const f of roomFiles) {
-      const text = await files.read(f.path).catch(() => null);
-      const state = text != null ? foldRoom(text) : null;
+      const text2 = await files.read(f.path).catch(() => null);
+      const state = text2 != null ? foldRoom(text2) : null;
       if (state) out.push(state);
     }
     return out;
   }
   async readSession(roomId) {
-    const text = await this.text(roomId);
-    return text == null ? null : foldSession(text);
+    const text2 = await this.text(roomId);
+    return text2 == null ? null : foldSession(text2);
   }
   /** The participant the room is currently parked on, or null. Lets a caller
    * that re-polls a parked room (`runRoom`) tell "still parked on the same
    * person" from "needs a fresh `{op:'pending'}` line" without appending one
    * just to find out. */
   async pendingParticipant(roomId) {
-    const text = await this.text(roomId);
-    return text == null ? null : pendingParticipant(text);
+    const text2 = await this.text(roomId);
+    return text2 == null ? null : pendingParticipant(text2);
   }
   /** Why the room is parked, when the park was not simply someone's turn (see
    * `pendingReason` in lines.ts). Null for an ordinary human turn, and for a
    * room that is not parked. */
   async pendingReason(roomId) {
-    const text = await this.text(roomId);
-    return text == null ? null : pendingReason(text);
+    const text2 = await this.text(roomId);
+    return text2 == null ? null : pendingReason(text2);
   }
   /** What each of this room's turns cost, in order (see `turnCosts` in
    * lines.ts). Empty for a room that has taken no turn, and for a room that
    * does not exist -- a reader of a transcript wants an array it can index by
    * turn, and "no room" and "no turns yet" annotate that transcript alike. */
   async turnCosts(roomId) {
-    const text = await this.text(roomId);
-    return text == null ? [] : turnCosts(text);
+    const text2 = await this.text(roomId);
+    return text2 == null ? [] : turnCosts(text2);
   }
 };
 
@@ -34740,7 +35636,7 @@ function makeCrewTurnRuntime(opts) {
   const { def, participants, meId, deps } = opts;
   const findings = opts.findings ?? [];
   const refs = participants.map((p) => ({ id: p.id, name: p.name }));
-  const policy = grantOfferedTools(def.policy, [...ROOM_TOOL_NAMES]);
+  const policy = grantOfferedTools(def.policy, [...ROOM_TOOL_NAMES], managedCap(def));
   const permission = new PermissionService2({
     policy,
     ...deps.prompt ? { prompt: deps.prompt } : {},
@@ -34962,7 +35858,7 @@ async function runRoom(roomId, deps) {
     }
   }
 }
-async function answerHumanTurn(roomId, participantId, text, deps, addressed) {
+async function answerHumanTurn(roomId, participantId, text2, deps, addressed) {
   const state = await deps.store.read(roomId);
   if (!state) throw new Error(`No room "${roomId}".`);
   if (state.closed) {
@@ -34999,7 +35895,7 @@ async function answerHumanTurn(roomId, participantId, text, deps, addressed) {
     }
     target = res.id;
   }
-  const message = stampAuthor({ role: "user", content: text }, participantId);
+  const message = stampAuthor({ role: "user", content: text2 }, participantId);
   await appendMessages(deps.store, roomId, [message], deps.now());
   let next = advance(state, target);
   if (next.closed) {
@@ -35030,14 +35926,14 @@ function requireHuman(roomId, state, participantId) {
   }
   return found;
 }
-async function interjectHuman(roomId, participantId, text, deps) {
+async function interjectHuman(roomId, participantId, text2, deps) {
   const state = await deps.store.read(roomId);
   if (!state) throw new Error(`No room "${roomId}".`);
   if (state.closed) {
     throw new Error(`Room "${roomId}" is closed (${state.closed.reason}), so nothing further can be said in it.`);
   }
   const speaker = requireHuman(roomId, state, participantId);
-  const body = text.trim();
+  const body = text2.trim();
   if (!body) {
     throw new Error(`${speaker.name} said nothing: an empty interjection is not appended.`);
   }
@@ -35106,7 +36002,7 @@ import { createChatClient, setGatewayBase } from "@corenel/harness/providers/gat
 // src/apiBase.ts
 init_tools_node();
 import { DEFAULT_API_BASE as DEFAULT_API_BASE2 } from "@corenel/protocol";
-import { DEV_PROFILE } from "@corenel/protocol";
+import { DEV_PROFILE, SANDBOX_GATEWAY_BASE_ENV } from "@corenel/protocol";
 var InvalidApiBaseError = class extends Error {
   constructor(value, why) {
     super(`invalid API base ${JSON.stringify(value)} -- ${why}`);
@@ -35160,7 +36056,10 @@ async function resolveCliApiBase(explicit, opts = {}) {
   if (url.protocol !== "https:" && url.protocol !== "http:") {
     throw new InvalidApiBaseError(value, `the scheme must be https or http, not ${url.protocol.replace(/:$/, "")}`);
   }
-  if (url.protocol === "http:" && !isLoopback(url.hostname) && !warnedCleartext) {
+  const trim2 = (s) => s.trim().replace(/\/+$/, "");
+  const marker = env[SANDBOX_GATEWAY_BASE_ENV];
+  const sanctioned = typeof marker === "string" && marker.trim() !== "" && trim2(marker) === trim2(value);
+  if (url.protocol === "http:" && !isLoopback(url.hostname) && !sanctioned && !warnedCleartext) {
     warnedCleartext = true;
     process.stderr.write(
       `corenel: warning: ${url.host} is plain http, so your access token is sent in cleartext. Use https unless this host is on a private network you trust.
@@ -35341,16 +36240,25 @@ var EXTENSIONS = [
     }
   },
   {
-    command: "sessions",
+    command: "sandboxes",
     ...SIDECAR,
-    summary: "list and inspect local sandbox sessions",
-    argv: (rest) => ["sessions", ...rest]
+    summary: "create, list and run in local sandboxes",
+    argv: (rest) => ["sandboxes", ...rest]
   },
   {
     command: "crew",
     ...SIDECAR,
     summary: "deploy, undeploy, pause and resume crew agents on this machine",
     argv: (rest) => ["crew", ...rest]
+  },
+  {
+    command: "fleet",
+    pkg: "@corenel/fleet",
+    entry: "dist/server/main.js",
+    summary: "run a fleet control plane (enroll, lease and revoke sidecars)",
+    monorepoOnly: true,
+    // 'corenel fleet start --data d' reads naturally; the server takes flags directly.
+    argv: (rest) => rest[0] === "start" ? rest.slice(1) : rest
   }
 ];
 function findExtension(command) {
@@ -35358,6 +36266,13 @@ function findExtension(command) {
 }
 var EXTENSION_COMMANDS = EXTENSIONS.map((e) => e.command);
 function missingMessage(e) {
+  if (e.monorepoOnly) {
+    return [
+      `${e.command} needs ${e.pkg}, which is not published yet and only runs from a checkout of the monorepo.`,
+      "",
+      "  pnpm fleet:start"
+    ].join("\n");
+  }
   return [
     `${e.command} needs ${e.pkg}, which is not installed.`,
     "",
@@ -35448,15 +36363,15 @@ async function runExtension(ext, rest, look = {}) {
 }
 
 // src/commands.ts
-import { stateDirName as stateDirName4 } from "@corenel/protocol";
 var COMMANDS = [
   { name: "", args: "", summary: "with no command: an interactive agent in this directory" },
-  { name: "run", args: '"<prompt>" [--allow-mutations] | --session ID "<prompt>"', summary: "one-shot turn, then exit -- refuses writes/shell unless --allow-mutations; --session runs the bare prompt in a sandbox instead and ignores every other flag" },
+  { name: "run", args: '"<prompt>" [--allow-mutations] | --sandbox ID "<prompt>"', summary: "one-shot turn, then exit -- refuses writes/shell unless --allow-mutations; --sandbox runs the bare prompt in a sandbox instead and ignores every other flag" },
   { name: "run-agent", args: '<name> --input "<text>" [--allow-mutations]', summary: "run a crew agent (same refuse-by-default gate as run); events as JSON Lines on stdout" },
   { name: "sidecar", args: "[start] [flags]", summary: "run the sidecar on this machine" },
   { name: "acp", args: "<agent> [flags]", summary: "proxy an external coding agent under Corenel policy" },
-  { name: "sessions", args: "[list|show|create|run]", summary: "create, list and run in local sandbox sessions" },
+  { name: "sandboxes", args: "[list|show|create|run|pause|resume|destroy]", summary: "create, list and run in local sandboxes" },
   { name: "crew", args: "deployments | deploy|undeploy|resume <agent> | pause <agent> --reason R", summary: "deploy, undeploy, pause and resume crew agents on this machine" },
+  { name: "fleet", args: "[start] --data <dir> [flags] | keys new", summary: "run a fleet control plane (enroll, lease and revoke sidecars)" },
   { name: "login", args: "[--base URL]", summary: "sign in through your browser (device flow)" },
   { name: "auth", summary: "show whether you are signed in, and as what" },
   { name: "logout", summary: "forget the stored token" },
@@ -35474,16 +36389,16 @@ function isVersionFlag(a) {
   return a === "--version" || a === "-v" || a === "version";
 }
 function helpText(version2) {
-  const shown = COMMANDS.filter((c) => c.name);
+  const shown2 = COMMANDS.filter((c) => c.name);
   const left = (c) => `corenel ${c.name}${c.args ? ` ${c.args}` : ""}`;
-  const width = Math.max(...shown.map((c) => left(c).length));
+  const width = Math.max(...shown2.map((c) => left(c).length));
   const bare = COMMANDS.find((c) => !c.name);
   return [
     `corenel ${version2} \u2014 the harness, in node.`,
     "",
     "Usage:",
     `  corenel${" ".repeat(Math.max(1, width - 7))}  ${bare ? bare.summary : ""}`,
-    ...shown.map((c) => `  ${left(c).padEnd(width)}  ${c.summary}`),
+    ...shown2.map((c) => `  ${left(c).padEnd(width)}  ${c.summary}`),
     "",
     "Common flags:",
     "  --model <id>       model for this turn (default gpt-4o-mini)",
@@ -35508,13 +36423,9 @@ function helpText(version2) {
     "  --version, -v      print the version",
     "  --help, -h         print this",
     "",
-    "--resume reopens a CONVERSATION (this face's own chat log, saved under",
-    `${stateDirName4()}/sessions/) -- not the same thing as \`run --session ID\` or the`,
-    "`sessions` command below, which forward into a sandbox on the sidecar.",
-    "Same word, two different nouns.",
-    "",
-    "sidecar, acp, sessions and crew are provided by @corenel/sidecar, installed separately.",
+    "sidecar, acp, sandboxes and crew are provided by @corenel/sidecar, installed separately.",
     "Each takes its own flags: `corenel sidecar --help`.",
+    "fleet is provided by @corenel/fleet, installed separately: `corenel fleet --help`.",
     "",
     "Exit codes (corenel run, corenel run-agent):",
     "  0  the turn completed with an answer",
@@ -35694,7 +36605,9 @@ var KNOWN_KEYS = [
   "speech",
   "speechModel",
   "peerCallTimeoutMs",
-  "peers"
+  "peers",
+  "models",
+  "providers"
 ];
 function daemonConfigPath(stateDir) {
   return join8(stateDir, "daemon.json");
@@ -36039,8 +36952,8 @@ function isQuit(line) {
   const t = line.trim().toLowerCase();
   return t === "/exit" || t === "/quit" || t === "exit" || t === "quit";
 }
-function nextShownCursor(itemsLength, shown) {
-  return itemsLength < shown ? 0 : shown;
+function nextShownCursor(itemsLength, shown2) {
+  return itemsLength < shown2 ? 0 : shown2;
 }
 function formatWriteDiff(diff) {
   if (diff.noop) return "  (no change -- new content is identical to what's on disk)\n";
@@ -36175,12 +37088,12 @@ async function runRepl(deps) {
     ...deps.policy ? { policy: deps.policy } : {},
     ...deps.policySource ? { policySource: deps.policySource } : {}
   });
-  let shown = 0;
+  let shown2 = 0;
   session.subscribe(() => {
     const items = session.getSnapshot().committed;
-    shown = nextShownCursor(items.length, shown);
-    for (; shown < items.length; shown++) {
-      const it = items[shown];
+    shown2 = nextShownCursor(items.length, shown2);
+    for (; shown2 < items.length; shown2++) {
+      const it = items[shown2];
       if (it.kind !== "note") continue;
       writeLine(`  ${it.level === "info" ? "" : "! "}${it.text}
 `);
@@ -36292,11 +37205,11 @@ async function runRepl(deps) {
   for (; ; ) {
     const line = await ask("\u203A ");
     if (line === null) break;
-    const text = line.trim();
-    if (!text) continue;
-    if (isQuit(text)) break;
+    const text2 = line.trim();
+    if (!text2) continue;
+    if (isQuit(text2)) break;
     turnActive = true;
-    await session.submit(text);
+    await session.submit(text2);
     turnActive = false;
     await askSuggestions();
     if (session.wantsExit) break;
@@ -36448,9 +37361,9 @@ ${rules(r.workspace)}`);
     return 0;
   }
   if (sub === "set") {
-    let current;
+    let current2;
     try {
-      current = await svc.settingsStrict();
+      current2 = await svc.settingsStrict();
     } catch (e) {
       deps.err(`could not read settings: ${e instanceof Error ? e.message : String(e)}
 `);
@@ -36458,13 +37371,13 @@ ${rules(r.workspace)}`);
     }
     if (arg === "threshold") {
       const threshold = Number(value);
-      await svc.saveSettings({ ...current, threshold });
+      await svc.saveSettings({ ...current2, threshold });
       deps.out(threshold === 0 ? "suggestions off\n" : `suggest after ${threshold} approvals
 `);
       return 0;
     }
     const raw = value.toLowerCase();
-    await svc.saveSettings({ ...current, captureRawArgs: raw === "on" });
+    await svc.saveSettings({ ...current2, captureRawArgs: raw === "on" });
     deps.out(`raw argument capture ${raw}
 `);
     return 0;
@@ -36626,8 +37539,8 @@ function shellTool(cwd) {
 import { procTools } from "@corenel/harness/tools/procs";
 
 // src/sidecarConnect.ts
-import { stateDirName as stateDirName5 } from "@corenel/protocol";
-import { SidecarHost, isSidecarKeyMismatch, isSidecarAccountRefusal } from "@corenel/harness/sidecar/host";
+import { stateDirName as stateDirName4 } from "@corenel/protocol";
+import { SidecarHost, isSidecarKeyMismatch, isSidecarAccountRefusal, isFleetLoginsRefusal } from "@corenel/harness/sidecar/host";
 
 // ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream2(), 1);
@@ -36769,8 +37682,8 @@ function hostBackedProcs(host, seed = []) {
       if (!e) return { chunks: [], truncated: false };
       return { chunks: e.chunks.filter((c) => c.seq > sinceSeq), truncated: e.truncated };
     },
-    write: (procId, text) => {
-      void host.procInput(procId, text).catch(() => {
+    write: (procId, text2) => {
+      void host.procInput(procId, text2).catch(() => {
       });
     },
     kill: (procId) => {
@@ -36805,10 +37718,10 @@ function isCliDevice(v) {
   const k = r.privateJwk;
   return typeof r.id === "string" && B64.test(r.id) && typeof r.sidecarJkt === "string" && B43.test(r.sidecarJkt) && typeof k === "object" && k !== null && !!asEcPublicJwk({ kty: k.kty, crv: k.crv, x: k.x, y: k.y }) && typeof k.d === "string" && B43.test(k.d);
 }
-function parse2(text) {
+function parse3(text2) {
   let raw;
   try {
-    raw = JSON.parse(text);
+    raw = JSON.parse(text2);
   } catch {
     return null;
   }
@@ -36827,8 +37740,8 @@ function cliDeviceStore(path = cliDevicesPath()) {
   const file = fileTextStore(path);
   const dir = join10(path, "..");
   const load = async () => {
-    const text = await file.read();
-    return text === null ? { version: 1, devices: /* @__PURE__ */ Object.create(null) } : parse2(text);
+    const text2 = await file.read();
+    return text2 === null ? { version: 1, devices: /* @__PURE__ */ Object.create(null) } : parse3(text2);
   };
   const change = async (edit) => {
     const f = await load();
@@ -36967,6 +37880,11 @@ async function reportHandshakeFailure(e, url, usedDevice, store, identity2, fall
     return;
   }
   if (isSidecarAccountRefusal(e)) {
+    if (isFleetLoginsRefusal(e)) {
+      process.stderr.write(`corenel: the sidecar at ${url} did not accept this CLI: sign-in to it is limited by its fleet policy. A fleet admin can change that. -- ${fallback}
+`);
+      return;
+    }
     const problem = identity2.problem() ?? "the sidecar verified this account and did not admit it (not its owner, or not a member of its organization, or a device another member paired).";
     process.stderr.write(`corenel: the sidecar at ${url} did not accept this CLI: ${problem} -- ${fallback}
 `);
@@ -37018,7 +37936,7 @@ async function connectSidecarProcs(env = process.env, store = cliDeviceStore(),
   const host = new SidecarHost({
     channel,
     ...credential,
-    stateDir: stateDirName5(),
+    stateDir: stateDirName4(),
     clientId: `corenel-cli-${process.pid}`,
     clientName: cliDeviceName(),
     onIdentityChallenge: identity2.answer,
@@ -37063,7 +37981,7 @@ async function connectMcpAdmin(env = process.env, store = cliDeviceStore(), iden
   const host = new SidecarHost({
     channel,
     ...credential,
-    stateDir: stateDirName5(),
+    stateDir: stateDirName4(),
     clientId: `corenel-cli-${process.pid}`,
     clientName: cliDeviceName(),
     onIdentityChallenge: identity2.answer,
@@ -37226,8 +38144,7 @@ function isFailedTurn(outcome) {
 import { stateReadDirs } from "@corenel/protocol";
 import { loadModes, loadPersonas } from "@corenel/harness/prompts/config";
 import { composeAgentSystem as composeAgentSystem2 } from "@corenel/harness/prompts";
-import { listSkills, stripFrontmatter } from "@corenel/harness/skills";
-import { configWorkspace } from "@corenel/harness/prompts/host";
+import { listSkills, readSkillInstructions, stripFrontmatter } from "@corenel/harness/skills";
 function createIdentityState() {
   return { mode: "auto", persona: "" };
 }
@@ -37261,7 +38178,8 @@ async function armSkillById(id) {
   const found = skills.find((s) => s.name === id && s.instructions !== null);
   if (!found || !found.instructions) return null;
   try {
-    const raw = await configWorkspace().read(found.instructions);
+    const raw = await readSkillInstructions(found.name);
+    if (raw === null) return null;
     return { id: found.name, label: found.name, instructions: stripFrontmatter(raw) };
   } catch {
     return null;
@@ -37331,7 +38249,7 @@ async function resolveStrategyPrompt(files, id) {
 init_tools_node();
 import { readFile as readFile2, stat } from "node:fs/promises";
 import { join as join11 } from "node:path";
-import { stateDirName as stateDirName6 } from "@corenel/protocol";
+import { stateDirName as stateDirName5 } from "@corenel/protocol";
 import { BUILTIN_POLICIES, STANDARD_POLICY as STANDARD_POLICY3, policyFromYaml } from "@corenel/harness/guardrail";
 var PolicyResolutionError = class extends Error {
   detail;
@@ -37346,9 +38264,9 @@ function isErrnoException(e) {
   return e instanceof Error && "code" in e;
 }
 async function loadRequiredPolicyFile(path, notFoundMessage) {
-  let text;
+  let text2;
   try {
-    text = await readFile2(path, "utf8");
+    text2 = await readFile2(path, "utf8");
   } catch (e) {
     if (isErrnoException(e) && e.code === "ENOENT") {
       throw new PolicyResolutionError(notFoundMessage);
@@ -37357,22 +38275,22 @@ async function loadRequiredPolicyFile(path, notFoundMessage) {
       `corenel: could not read policy file "${path}": ${e instanceof Error ? e.message : String(e)}`
     );
   }
-  return validateOrThrow(text, path);
+  return validateOrThrow(text2, path);
 }
 async function loadDiscoveredPolicyFile(path) {
-  let text;
+  let text2;
   try {
-    text = await readFile2(path, "utf8");
+    text2 = await readFile2(path, "utf8");
   } catch (e) {
     if (isErrnoException(e) && e.code === "ENOENT") return void 0;
     throw new PolicyResolutionError(
       `corenel: could not read policy file "${path}": ${e instanceof Error ? e.message : String(e)}`
     );
   }
-  return validateOrThrow(text, path);
+  return validateOrThrow(text2, path);
 }
-function validateOrThrow(text, path) {
-  const result = policyFromYaml(text);
+function validateOrThrow(text2, path) {
+  const result = policyFromYaml(text2);
   if (!result.ok || !result.policy) {
     throw new PolicyResolutionError(`corenel: policy file "${path}" is not a valid policy document.`, result.errors);
   }
@@ -37416,7 +38334,7 @@ async function resolvePolicy(opts) {
     }
     return { policy: STANDARD_POLICY3, source: { kind: "default" }, warnings };
   }
-  const workspacePath = join11(cwd, stateDirName6(), "policy.yaml");
+  const workspacePath = join11(cwd, stateDirName5(), "policy.yaml");
   if (await fileExists(workspacePath)) {
     warnings.push(
       `corenel: ${workspacePath} ignored -- a policy inside the workspace can be written by the agent or arrive in a cloned repo. To use it for this folder, move it to ${projectPath}, or pass --policy ${workspacePath} explicitly.`
@@ -37450,14 +38368,14 @@ var McpHttpClient = class {
   }
   async listTools() {
     const result = await this.send("tools/list", {});
-    const tools = isRecord(result) ? result.tools : void 0;
+    const tools = isRecord2(result) ? result.tools : void 0;
     if (!Array.isArray(tools)) return [];
     return tools.filter(isMcpTool);
   }
   async callTool(name, args) {
     const result = await this.send("tools/call", { name, arguments: args });
-    const record = isRecord(result) ? result : {};
-    return { content: record.content, isError: record.isError === true };
+    const record2 = isRecord2(result) ? result : {};
+    return { content: record2.content, isError: record2.isError === true };
   }
   /** Send one JSON-RPC request, retrying exactly once on a 401 that the
    *  AuthProvider says it recovered from. `isRetry` prevents a second retry
@@ -37507,12 +38425,12 @@ var McpHttpClient = class {
       throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
     }
     const reader = res.body.getReader();
-    const decoder = new TextDecoder();
+    const decoder3 = new TextDecoder();
     let buffer = "";
     try {
       for (; ; ) {
         const { done, value } = await reader.read();
-        if (value) buffer += decoder.decode(value, { stream: true });
+        if (value) buffer += decoder3.decode(value, { stream: true });
         buffer = buffer.replace(/\r\n/g, "\n");
         let boundary = buffer.indexOf("\n\n");
         while (boundary !== -1) {
@@ -37543,7 +38461,7 @@ var McpHttpClient = class {
     } catch {
       return null;
     }
-    if (!isRecord(parsed) || parsed.id !== id) return null;
+    if (!isRecord2(parsed) || parsed.id !== id) return null;
     if (!("result" in parsed) && !("error" in parsed)) return null;
     return parsed;
   }
@@ -37577,11 +38495,11 @@ var McpHttpClient = class {
     return headers;
   }
 };
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null;
 }
 function isMcpTool(value) {
-  return isRecord(value) && typeof value.name === "string" && "inputSchema" in value;
+  return isRecord2(value) && typeof value.name === "string" && "inputSchema" in value;
 }
 
 // ../mcp/src/config.ts
@@ -38345,7 +39263,7 @@ var McpRegistry = class {
     const inflight = this.slotConnecting.get(key);
     if (inflight) return inflight;
     const self2 = {};
-    const current = () => self2.attempt !== void 0 && this.slotConnecting.get(key) === self2.attempt;
+    const current2 = () => self2.attempt !== void 0 && this.slotConnecting.get(key) === self2.attempt;
     const attempt = (async () => {
       const def = (await readMcpServers(this.stateDir, this.configEnv)).find((s) => s.name === server);
       if (!def) throw new Error(`MCP server "${server}" is not configured on this daemon`);
@@ -38354,10 +39272,10 @@ var McpRegistry = class {
         await client.initialize();
         return { client, tools: await client.listTools() };
       })(), SERVER_CONNECT_TIMEOUT_MS, `MCP server "${server}" timed out after ${SERVER_CONNECT_TIMEOUT_MS / 1e3}s`);
-      if (current()) this.slotted.set(key, entry);
+      if (current2()) this.slotted.set(key, entry);
       return entry;
     })().finally(() => {
-      if (current()) this.slotConnecting.delete(key);
+      if (current2()) this.slotConnecting.delete(key);
     });
     self2.attempt = attempt;
     this.slotConnecting.set(key, attempt);
@@ -38378,10 +39296,10 @@ var McpRegistry = class {
 };
 
 // ../mcp/src/policy.ts
-import { PermissionService as PermissionService5, matchesAnyGlob as matchesAnyGlob2 } from "@corenel/harness/guardrail";
+import { PermissionService as PermissionService5, matchesAnyGlob as matchesAnyGlob3 } from "@corenel/harness/guardrail";
 function mcpCallAllowed(address, policy) {
   const allow = policy.tools?.allow ?? [];
-  if (!matchesAnyGlob2(address, allow)) {
+  if (!matchesAnyGlob3(address, allow)) {
     return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
   }
   const service = new PermissionService5({
@@ -38403,7 +39321,7 @@ function mcpCallAllowed(address, policy) {
 import {
   mcpToolAddress,
   parseMcpToolAddress,
-  mcpWireName,
+  mcpWireName as mcpWireName2,
   parseMcpWireName,
   canEncodeMcpWireName,
   looksLikeMcpWireName
@@ -38443,7 +39361,7 @@ function asAgentTools(registry) {
   return out;
 }
 function toAgentTool(registry, server, tool) {
-  const name = mcpWireName(server, tool.name);
+  const name = mcpWireName2(server, tool.name);
   const address = mcpToolAddress(server, tool.name);
   return {
     name,
@@ -38453,14 +39371,14 @@ function toAgentTool(registry, server, tool) {
     mutates: true,
     async run(args) {
       const result = await registry.call(server, tool.name, args);
-      const text = formatContent(result.content);
-      return result.isError ? `Error: ${text}` : text;
+      const text2 = formatContent(result.content);
+      return result.isError ? `Error: ${text2}` : text2;
     }
   };
 }
 
 // ../mcp/src/portTools.ts
-import { MCP_CALL_FAILED, canEncodeMcpWireName as canEncodeMcpWireName2, mcpWireName as mcpWireName2, parseMcpToolAddress as parseMcpToolAddress2 } from "@corenel/protocol";
+import { MCP_CALL_FAILED, canEncodeMcpWireName as canEncodeMcpWireName2, mcpWireName as mcpWireName3, parseMcpToolAddress as parseMcpToolAddress2 } from "@corenel/protocol";
 var CALL_FAILED_TEXT = `Error: ${MCP_CALL_FAILED}: the MCP call failed before a result came back; it may or may not have run, so do not repeat it without checking.`;
 
 // ../mcp/src/gatedAgentTools.ts
@@ -38470,7 +39388,7 @@ function gatedAgentTools(registry, policy) {
   const wrapped = [];
   for (const { server, tool } of registry.tools()) {
     if (!canEncodeMcpWireName(server, tool.name)) continue;
-    const name = mcpWireName(server, tool.name);
+    const name = mcpWireName2(server, tool.name);
     const original = byWireName.get(name);
     if (!original) continue;
     const address = mcpToolAddress(server, tool.name);
@@ -38613,12 +39531,12 @@ async function registerClient(meta, redirectUri, fetchImpl) {
   if (typeof body !== "object" || body === null || Array.isArray(body)) {
     throw new Error(`Client registration at ${meta.registrationEndpoint} returned a malformed response`);
   }
-  const record = body;
-  const clientId = record.client_id;
+  const record2 = body;
+  const clientId = record2.client_id;
   if (typeof clientId !== "string" || clientId.length === 0) {
     throw new Error(`Client registration at ${meta.registrationEndpoint} did not return a client_id`);
   }
-  const clientSecret = typeof record.client_secret === "string" ? record.client_secret : void 0;
+  const clientSecret = typeof record2.client_secret === "string" ? record2.client_secret : void 0;
   return { clientId, clientSecret };
 }
 
@@ -38958,7 +39876,7 @@ async function agentSetup(argv, chosenModel) {
   try {
     const migrated = await migrateHomeLayout();
     if (migrated.moved.length) {
-      console.error(`layout: moved ${migrated.moved.length} item(s) into the current ~/${stateDirName7()} layout`);
+      console.error(`layout: moved ${migrated.moved.length} item(s) into the current ~/${stateDirName6()} layout`);
     }
     for (const left of migrated.skipped) console.error(`layout: left ${left.path} alone (${left.reason})`);
   } catch (e) {
@@ -39026,19 +39944,23 @@ async function buildRunPermission(opts) {
   }) };
 }
 async function run(argv) {
+  if (hasValueFlag(argv, "session")) {
+    process.stderr.write("corenel: --session is not a flag of `run`. To run inside a sandbox use --sandbox ID.\n");
+    process.exit(2);
+  }
   const prompt = promptOf(argv);
   if (!prompt) {
-    process.stderr.write('usage: corenel run "<prompt>" [--model M] [--base URL] [--session ID] [--allow-mutations]\n                  [--max-usd N] [--max-tokens N] [--max-ms N] [--on-budget stop|warn]\n');
+    process.stderr.write('usage: corenel run "<prompt>" [--model M] [--base URL] [--sandbox ID] [--allow-mutations]\n                  [--max-usd N] [--max-tokens N] [--max-ms N] [--on-budget stop|warn]\n');
     process.exit(2);
   }
   const budget = budgetConstraintsFrom(argv);
-  const session = flag(argv, "session", "");
-  if (session) {
+  const sandbox = flag(argv, "sandbox", "");
+  if (sandbox) {
     if (hasAllowMutationsFlag(argv) || hasValueFlag(argv, "model") || hasValueFlag(argv, "base") || budget) {
-      process.stderr.write("corenel: note: --session ignores every other flag on this line -- the sandboxed run uses its own defaults.\n");
+      process.stderr.write("corenel: note: --sandbox ignores every other flag on this line -- the sandboxed run uses its own defaults.\n");
     }
-    const ext = findExtension("sessions");
-    process.exitCode = ext ? await runExtension(ext, ["run", session, prompt]) : 2;
+    const ext = findExtension("sandboxes");
+    process.exitCode = ext ? await runExtension(ext, ["run", sandbox, prompt]) : 2;
     return;
   }
   const { client, model, system, tools, policy, memory, disconnect } = await agentSetup(argv);
@@ -39395,8 +40317,9 @@ async function main() {
       }
       case "sidecar":
       case "acp":
-      case "sessions":
-      case "crew": {
+      case "sandboxes":
+      case "crew":
+      case "fleet": {
         const ext = findExtension(cmd);
         process.exitCode = ext ? await runExtension(ext, rest) : 2;
         break;