@corenel/sidecar 0.8.6 → 0.8.8

package/dist/cli.js

@@ -401,7 +401,7 @@ var init_protocol = __esm({
 
 // ../tools-node/fileService.ts
 import { promises as fs3 } from "node:fs";
-import { join as join3, resolve, relative, dirname, sep, basename, isAbsolute } from "node:path";
+import { join as join4, resolve, relative, dirname as dirname2, sep, basename, isAbsolute } from "node:path";
 async function looksLikeGeneratedCoverage(absDir) {
   try {
     const names = await fs3.readdir(absDir);
@@ -484,7 +484,7 @@ var init_fileService = __esm({
             return;
           } catch (e2) {
             if (e2 instanceof Error && e2.message.includes("via symlink")) throw e2;
-            const parent = dirname(probe);
+            const parent = dirname2(probe);
             if (parent === probe) throw new Error(`cannot resolve path under the workspace root: ${a2}`);
             probe = parent;
           }
@@ -507,7 +507,7 @@ var init_fileService = __esm({
           const out = [];
           for (const e2 of entries.sort((a2, b2) => a2.name.localeCompare(b2.name))) {
             if (SKIP.has(e2.name)) continue;
-            const absChild = join3(absDir, e2.name);
+            const absChild = join4(absDir, e2.name);
             const path = normalizeFilePath(relative(this.root, absChild));
             if (e2.isDirectory() && SKIP_PATHS.has(path)) continue;
             if (e2.isDirectory() && e2.name === "coverage" && await looksLikeGeneratedCoverage(absChild)) continue;
@@ -535,19 +535,19 @@ var init_fileService = __esm({
       }
       async write(path, content) {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         await fs3.writeFile(a2, content, "utf8");
       }
       async writeBytes(path, bytes) {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         await fs3.writeFile(a2, bytes);
       }
       async create(path, content = "") {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         try {
           await fs3.writeFile(a2, content, { flag: "wx" });
@@ -561,7 +561,7 @@ var init_fileService = __esm({
       }
       async rename(from, to) {
         const t2 = this.abs(to);
-        await fs3.mkdir(dirname(t2), { recursive: true });
+        await fs3.mkdir(dirname2(t2), { recursive: true });
         await this.assertReal(t2);
         await fs3.rename(await this.realAbs(from), t2);
       }
@@ -594,21 +594,24 @@ var init_fileService = __esm({
 // ../tools-node/auth.ts
 import { promises as fs4 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function corenelDir2(base = homedir2()) {
-  return join4(base, stateDirName());
+  return join5(base, stateDirName());
 }
 function sidecarDir(base = homedir2()) {
-  return join4(corenelDir2(base), "sidecar");
+  return join5(corenelDir2(base), "sidecar");
+}
+function authTokenPath(base = homedir2()) {
+  return join5(corenelDir2(base), "token");
 }
 function credentialDir(stateDir) {
   return stateDir ?? corenelDir2();
 }
 function tokenFilePath(stateDir) {
-  return join4(credentialDir(stateDir), "token");
+  return join5(credentialDir(stateDir), "token");
 }
 function credentialFilePath(stateDir) {
-  return join4(credentialDir(stateDir), "auth.json");
+  return join5(credentialDir(stateDir), "auth.json");
 }
 async function writeFilePrivateAtomic(path, contents) {
   const tmp = `${path}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
@@ -636,6 +639,49 @@ async function writeAuthToken(token, stateDir) {
   } catch {
   }
 }
+async function writeLoginCredential(token, opts = {}) {
+  const cred = {
+    accessToken: token.trim(),
+    ...opts.account ? { account: opts.account } : {},
+    ...opts.apiBase ? { apiBase: opts.apiBase } : {}
+  };
+  const dir = credentialDir(opts.stateDir);
+  const credPath = credentialFilePath(opts.stateDir);
+  const tokPath = tokenFilePath(opts.stateDir);
+  await fs4.mkdir(dir, { recursive: true, mode: 448 });
+  const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  await fs4.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}
+`, { mode: 384 });
+  await fs4.writeFile(tokTmp, `${cred.accessToken}
+`, { mode: 384 });
+  try {
+    await fs4.chmod(credTmp, 384);
+  } catch {
+  }
+  try {
+    await fs4.chmod(tokTmp, 384);
+  } catch {
+  }
+  try {
+    await fs4.rename(credTmp, credPath);
+    await fs4.rename(tokTmp, tokPath);
+  } catch (e2) {
+    try {
+      await fs4.rm(credTmp, { force: true });
+    } catch {
+    }
+    try {
+      await fs4.rm(tokTmp, { force: true });
+    } catch {
+    }
+    throw e2;
+  }
+  try {
+    await fs4.chmod(dir, 448);
+  } catch {
+  }
+}
 function isMissing(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
@@ -656,6 +702,9 @@ async function clearAuthToken(stateDir) {
   } catch {
   }
 }
+async function readCredentialFile(stateDir) {
+  return (await readCredentialFileRead(stateDir)).value;
+}
 async function readCredentialFileRead(stateDir) {
   let raw;
   try {
@@ -13820,7 +13869,7 @@ var require_compiler = __commonJS({
         });
         this._emitLine("root: root\n};");
       };
-      _proto.compile = function compile(node, frame) {
+      _proto.compile = function compile2(node, frame) {
         var _compile = this["compile" + node.typename];
         if (_compile) {
           _compile.call(this, node, frame);
@@ -13834,7 +13883,7 @@ var require_compiler = __commonJS({
       return Compiler2;
     }(Obj);
     module.exports = {
-      compile: function compile(src2, asyncFilters, extensions, name, opts) {
+      compile: function compile2(src2, asyncFilters, extensions, name, opts) {
         if (opts === void 0) {
           opts = {};
         }
@@ -15249,7 +15298,7 @@ var require_environment = __commonJS({
           }
         });
       };
-      _proto3.compile = function compile() {
+      _proto3.compile = function compile2() {
         if (!this.compiled) {
           this._compile();
         }
@@ -15746,7 +15795,7 @@ var require_nunjucks = __commonJS({
       reset: function reset() {
         e2 = void 0;
       },
-      compile: function compile(src2, env, path, eagerCompile) {
+      compile: function compile2(src2, env, path, eagerCompile) {
         if (!e2) {
           configure();
         }
@@ -15914,6 +15963,43 @@ function getLanguageAliasesForExtension(ext) {
 function generateCompilationId() {
   return `compile-${++compilationCounter}-${Date.now()}`;
 }
+function normalizePosix2(p2) {
+  const isAbs = p2.startsWith("/");
+  const out = [];
+  for (const seg of p2.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (out.length && out[out.length - 1] !== "..") out.pop();
+      else if (!isAbs) out.push("..");
+    } else {
+      out.push(seg);
+    }
+  }
+  const joined = out.join("/");
+  return isAbs ? "/" + joined : joined || ".";
+}
+function joinPosix2(...segments2) {
+  const filtered = segments2.filter((s2) => s2 && s2.length > 0);
+  if (filtered.length === 0) return ".";
+  return normalizePosix2(filtered.join("/"));
+}
+function dirnamePosix2(p2) {
+  const norm2 = p2.replace(/\/+$/, "");
+  const idx = norm2.lastIndexOf("/");
+  if (idx === -1) return ".";
+  if (idx === 0) return "/";
+  return norm2.slice(0, idx);
+}
+function utf8ByteLength(s2) {
+  return new TextEncoder().encode(s2).length;
+}
+function toRelKey(filePath) {
+  let n2 = filePath.replace(/\\/g, "/");
+  if (n2.startsWith("./")) n2 = n2.substring(2);
+  if (n2.startsWith("/")) n2 = n2.substring(1);
+  if (n2.endsWith("/") && n2.length > 1) n2 = n2.substring(0, n2.length - 1);
+  return n2;
+}
 function createCoreStages() {
   return [
     new LexicalAnalysisStage(),
@@ -15923,7 +16009,7 @@ function createCoreStages() {
     new CodeGenerationStage()
   ];
 }
-var yaml, import_semver, nunjucks, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, PrompdCompiler;
+var yaml, import_semver, nunjucks, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, MemoryFileSystem, HybridFileSystem, PrompdCompiler;
 var init_dist = __esm({
   "../../node_modules/.pnpm/@prompd+core@0.5.0-beta.10/node_modules/@prompd/core/dist/index.js"() {
     yaml = __toESM(require_dist(), 1);
@@ -18503,6 +18589,150 @@ ${firstUserMsg.content}`;
         return "Code Generation";
       }
     };
+    MemoryFileSystem = class {
+      constructor(files = {}) {
+        this.files = /* @__PURE__ */ new Map();
+        for (const [filePath, content] of Object.entries(files)) {
+          this.addFile(filePath, content);
+        }
+      }
+      /** Add or update a file in the in-memory file system. */
+      addFile(filePath, content) {
+        this.files.set(this.normalizePath(filePath), content);
+      }
+      /** Add multiple files at once. */
+      addFiles(files) {
+        for (const [filePath, content] of Object.entries(files)) {
+          this.addFile(filePath, content);
+        }
+      }
+      exists(filePath) {
+        return this.files.has(this.normalizePath(filePath));
+      }
+      readFile(filePath) {
+        const normalizedPath = this.normalizePath(filePath);
+        const content = this.files.get(normalizedPath);
+        if (content === void 0) {
+          throw new Error(`File not found: ${filePath}`);
+        }
+        return content;
+      }
+      isDirectory(filePath) {
+        const normalizedPath = this.normalizePath(filePath);
+        const dirPrefix = normalizedPath.endsWith("/") ? normalizedPath : normalizedPath + "/";
+        for (const file of this.files.keys()) {
+          if (file.startsWith(dirPrefix)) {
+            return true;
+          }
+        }
+        return false;
+      }
+      readdir(dirPath) {
+        const normalizedDir = this.normalizePath(dirPath);
+        const dirPrefix = normalizedDir.endsWith("/") ? normalizedDir : normalizedDir + "/";
+        const files = /* @__PURE__ */ new Set();
+        for (const file of this.files.keys()) {
+          if (file.startsWith(dirPrefix)) {
+            const relativePath = file.substring(dirPrefix.length);
+            const slashIndex = relativePath.indexOf("/");
+            const fileName = slashIndex === -1 ? relativePath : relativePath.substring(0, slashIndex);
+            if (fileName) {
+              files.add(fileName);
+            }
+          }
+        }
+        return Array.from(files);
+      }
+      resolve(...pathSegments) {
+        return joinPosix2("/", ...pathSegments);
+      }
+      dirname(filePath) {
+        return dirnamePosix2(filePath);
+      }
+      join(...pathSegments) {
+        return joinPosix2(...pathSegments);
+      }
+      /** Get the virtual file system path for a package. */
+      getPackagePath(packageName, version) {
+        return `/packages/${packageName}@${version}`;
+      }
+      /** Get all files under an optional base path. */
+      getAllFiles(basePath) {
+        if (!basePath) {
+          return new Map(this.files);
+        }
+        const normalizedBase = this.normalizePath(basePath);
+        const prefix = normalizedBase.endsWith("/") ? normalizedBase : normalizedBase + "/";
+        const filtered = /* @__PURE__ */ new Map();
+        for (const [filePath, content] of this.files.entries()) {
+          if (filePath.startsWith(prefix) || filePath === normalizedBase) {
+            filtered.set(filePath, content);
+          }
+        }
+        return filtered;
+      }
+      /** Calculate total size (bytes) and file count under a base path. */
+      getTotalSize(basePath) {
+        const files = this.getAllFiles(basePath);
+        let totalSize = 0;
+        for (const content of files.values()) {
+          totalSize += utf8ByteLength(content);
+        }
+        return { size: totalSize, files: files.size };
+      }
+      /** Normalize path to forward slashes, drop leading ./ and /, no trailing slash. */
+      normalizePath(filePath) {
+        return toRelKey(filePath);
+      }
+    };
+    HybridFileSystem = class {
+      constructor(files = {}, backend2) {
+        this.mem = new MemoryFileSystem(files);
+        this.backend = backend2;
+      }
+      /** Add or update an in-memory (synchronously-served) file. */
+      addFile(filePath, content) {
+        this.mem.addFile(filePath, content);
+      }
+      /** Add multiple in-memory files at once. */
+      addFiles(files) {
+        this.mem.addFiles(files);
+      }
+      exists(filePath) {
+        if (this.mem.exists(filePath)) return true;
+        return this.backend.readFile(this.normalize(filePath)).then((content) => content !== null).catch(() => false);
+      }
+      readFile(filePath) {
+        if (this.mem.exists(filePath)) return this.mem.readFile(filePath);
+        return this.backend.readFile(this.normalize(filePath)).then((content) => {
+          if (content === null) throw new Error(`File not found: ${filePath}`);
+          return content;
+        });
+      }
+      isDirectory(filePath) {
+        if (this.mem.isDirectory(filePath)) return true;
+        if (!this.backend.isDirectory) return false;
+        return this.backend.isDirectory(this.normalize(filePath)).catch(() => false);
+      }
+      readdir(dirPath) {
+        const local = this.mem.readdir(dirPath);
+        if (!this.backend.readdir) return local;
+        return this.backend.readdir(this.normalize(dirPath)).then((remote) => Array.from(/* @__PURE__ */ new Set([...local, ...remote]))).catch(() => local);
+      }
+      resolve(...pathSegments) {
+        return this.mem.resolve(...pathSegments);
+      }
+      dirname(filePath) {
+        return this.mem.dirname(filePath);
+      }
+      join(...pathSegments) {
+        return this.mem.join(...pathSegments);
+      }
+      /** Normalize to the same relative keys MemoryFileSystem uses, for backend lookups. */
+      normalize(filePath) {
+        return toRelKey(filePath);
+      }
+    };
     PrompdCompiler = class {
       constructor(options = {}) {
         this.securityConfig = options.securityConfig || DEFAULT_SECURITY_CONFIG;
@@ -18536,6 +18766,66 @@ ${firstUserMsg.content}`;
 });
 
 // ../tools-node/promptHost.ts
+function backend(svc) {
+  return {
+    async readFile(p2) {
+      try {
+        return await svc.read(normalizeFilePath(p2));
+      } catch {
+        return null;
+      }
+    },
+    async isDirectory(p2) {
+      return (await svc.stat(normalizeFilePath(p2)))?.kind === "directory";
+    },
+    async readdir(p2) {
+      return (await svc.list(normalizeFilePath(p2))).map((n2) => n2.name);
+    }
+  };
+}
+async function preload(svc) {
+  const out = {};
+  for (const f2 of flattenFiles(await svc.list())) {
+    try {
+      out[f2.path] = await svc.read(f2.path);
+    } catch {
+    }
+  }
+  return out;
+}
+async function compile(src2, values, fileSystem, mainPath) {
+  const mp = mainPath || "/main.prmd";
+  const fs17 = fileSystem || new MemoryFileSystem({ [mp]: src2 });
+  const ctx = await compiler.compileWithContext(mp, { parameters: values || {}, fileSystem: fs17, outputFormat: "markdown" });
+  const compiled = ctx.compiledResult;
+  const output = typeof compiled === "string" ? compiled : compiled ? new TextDecoder().decode(compiled) : "";
+  return { output };
+}
+function nodePromptHost(workspace, project) {
+  return {
+    workspace,
+    /* The user's PROJECT files, when the caller has them, so skills installed
+     * into `.prompd/skills/` are visible. Omitted rather than faked when there
+     * is none: a CLI invoked outside a project genuinely has no installed
+     * skills, and saying so beats inventing an empty directory. */
+    ...project ? { projectWorkspace: () => project } : {},
+    seed: async (defaults2) => {
+      for (const [p2, content] of Object.entries(defaults2)) {
+        if (!await workspace.stat(p2)) await workspace.write(p2, content);
+      }
+    },
+    parse: (source) => ({ meta: parser.parseContent(source).metadata ?? {} }),
+    compileBody: (source, values) => compile(source, values),
+    compileTemplate: async (path, liveSrc, values) => {
+      const sources = await preload(workspace);
+      const p2 = normalizeFilePath(path);
+      sources[p2] = liveSrc;
+      return compile("", values, new HybridFileSystem(sources, backend(workspace)), "/" + p2);
+    },
+    siteIndex: () => ""
+    // no site index in node (the help chat is browser-only)
+  };
+}
 var parser, compiler;
 var init_promptHost = __esm({
   "../tools-node/promptHost.ts"() {
@@ -18550,7 +18840,7 @@ var init_promptHost = __esm({
 // ../tools-node/migrateHome.ts
 import { promises as fs5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join5, dirname as dirname2 } from "node:path";
+import { join as join6, dirname as dirname3 } from "node:path";
 async function isDir(p2) {
   return fs5.stat(p2).then((s2) => s2.isDirectory()).catch(() => false);
 }
@@ -18566,7 +18856,7 @@ async function moveEntry(from, to, report) {
     report.skipped.push({ path: to, reason: "destination already exists" });
     return;
   }
-  await fs5.mkdir(dirname2(to), { recursive: true });
+  await fs5.mkdir(dirname3(to), { recursive: true });
   try {
     await fs5.rename(from, to);
     report.moved.push(to);
@@ -18592,8 +18882,8 @@ async function moveEntry(from, to, report) {
 async function mergeDir(from, to, report) {
   const entries = await fs5.readdir(from, { withFileTypes: true }).catch(() => []);
   for (const e2 of entries) {
-    const src2 = join5(from, e2.name);
-    const dst = join5(to, e2.name);
+    const src2 = join6(from, e2.name);
+    const dst = join6(to, e2.name);
     if (e2.isDirectory() && await isDir(dst)) await mergeDir(src2, dst, report);
     else await moveEntry(src2, dst, report);
   }
@@ -18604,16 +18894,16 @@ async function migrateHomeLayout(base = homedir3()) {
   const report = { moved: [], skipped: [] };
   const home = corenelDir2(base);
   if (!await present(home)) return report;
-  const config = join5(home, "config");
+  const config = join6(home, "config");
   if (await isDir(config)) await mergeDir(config, home, report);
   const side = sidecarDir(base);
   for (const name of SIDECAR_FILES) {
-    await moveEntry(join5(home, name), join5(side, name), report);
+    await moveEntry(join6(home, name), join6(side, name), report);
   }
   for (const name of SIDECAR_DIRS) {
-    const src2 = join5(home, name);
+    const src2 = join6(home, name);
     if (!await isDir(src2)) continue;
-    const dst = join5(side, name);
+    const dst = join6(side, name);
     if (await isDir(dst)) await mergeDir(src2, dst, report);
     else await moveEntry(src2, dst, report);
   }
@@ -18638,7 +18928,50 @@ var init_migrateHome = __esm({
   }
 });
 
+// ../tools-node/openBrowser.ts
+import { spawn } from "node:child_process";
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+var init_openBrowser = __esm({
+  "../tools-node/openBrowser.ts"() {
+    "use strict";
+  }
+});
+
 // ../tools-node/index.ts
+var tools_node_exports = {};
+__export(tools_node_exports, {
+  API_BASE_ENV: () => API_BASE_ENV,
+  NodeFileService: () => NodeFileService,
+  TOKEN_ENV: () => TOKEN_ENV,
+  authTokenPath: () => authTokenPath,
+  clearAllCredentials: () => clearAllCredentials,
+  clearAuthToken: () => clearAuthToken,
+  corenelDir: () => corenelDir2,
+  credentialDir: () => credentialDir,
+  credentialFilePath: () => credentialFilePath,
+  maskAccount: () => maskAccount,
+  maskToken: () => maskToken,
+  migrateHomeLayout: () => migrateHomeLayout,
+  nodeAuthToken: () => nodeAuthToken,
+  nodePromptHost: () => nodePromptHost,
+  openBrowser: () => openBrowser,
+  readAuthToken: () => readAuthToken,
+  readAuthTokenRead: () => readAuthTokenRead,
+  readCredentialFile: () => readCredentialFile,
+  readCredentialFileRead: () => readCredentialFileRead,
+  resolveApiBase: () => resolveApiBase,
+  resolveNodeCredential: () => resolveNodeCredential,
+  sidecarDir: () => sidecarDir,
+  tokenFilePath: () => tokenFilePath,
+  writeAuthToken: () => writeAuthToken,
+  writeLoginCredential: () => writeLoginCredential
+});
 var init_tools_node = __esm({
   "../tools-node/index.ts"() {
     "use strict";
@@ -18646,59 +18979,7 @@ var init_tools_node = __esm({
     init_auth();
     init_promptHost();
     init_migrateHome();
-  }
-});
-
-// src/auth/store.ts
-import { promises as fs6 } from "node:fs";
-function authDir(stateDir) {
-  return credentialDir(stateDir);
-}
-function credentialPath(stateDir) {
-  return credentialFilePath(stateDir);
-}
-async function readForeignAuthJson(path) {
-  let raw;
-  try {
-    raw = await fs6.readFile(path, "utf8");
-  } catch {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-    const obj = { ...parsed };
-    for (const k2 of STORED_CREDENTIAL_KEYS) delete obj[k2];
-    return obj;
-  } catch {
-    return {};
-  }
-}
-async function saveCredential(cred, stateDir) {
-  const path = credentialPath(stateDir);
-  await fs6.mkdir(authDir(stateDir), { recursive: true });
-  const foreign = await readForeignAuthJson(path);
-  const next = { ...foreign, ...cred };
-  await fs6.writeFile(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
-  try {
-    await fs6.chmod(path, 384);
-  } catch {
-  }
-  await writeAuthToken(cred.accessToken, stateDir);
-}
-async function clearCredential(stateDir) {
-  await clearAllCredentials(stateDir);
-}
-async function resolveCredential(env = process.env, stateDir, now2 = Date.now) {
-  return await resolveNodeCredential({ env, now: now2, ...stateDir ? { stateDir } : {} });
-}
-var TOKEN_ENV2, STORED_CREDENTIAL_KEYS;
-var init_store = __esm({
-  "src/auth/store.ts"() {
-    "use strict";
-    init_tools_node();
-    TOKEN_ENV2 = TOKEN_ENV;
-    STORED_CREDENTIAL_KEYS = ["accessToken", "refreshToken", "expiresAt", "account", "apiBase"];
+    init_openBrowser();
   }
 });
 
@@ -25102,270 +25383,6 @@ var init_fileFromPath = __esm({
   }
 });
 
-// src/auth/pkce.ts
-import { createHash as createHash4, randomBytes as randomBytes6 } from "node:crypto";
-function base64url2(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function createVerifier(bytes = 32) {
-  return base64url2(randomBytes6(bytes));
-}
-function challengeFor(verifier) {
-  return base64url2(createHash4("sha256").update(verifier).digest());
-}
-function createState() {
-  return base64url2(randomBytes6(16));
-}
-function createPkce() {
-  const verifier = createVerifier();
-  return { verifier, challenge: challengeFor(verifier), method: "S256", state: createState() };
-}
-function authorizeUrl(p2) {
-  const u2 = new URL("/oauth/authorize", p2.issuer);
-  u2.searchParams.set("response_type", "code");
-  u2.searchParams.set("client_id", p2.clientId);
-  u2.searchParams.set("redirect_uri", p2.redirectUri);
-  u2.searchParams.set("code_challenge", p2.pkce.challenge);
-  u2.searchParams.set("code_challenge_method", p2.pkce.method);
-  u2.searchParams.set("state", p2.pkce.state);
-  u2.searchParams.set("scope", p2.scope ?? "profile email");
-  return u2.toString();
-}
-function stateMatches(expected, got) {
-  if (!got || got.length !== expected.length) return false;
-  let diff = 0;
-  for (let i2 = 0; i2 < expected.length; i2++) diff |= expected.charCodeAt(i2) ^ got.charCodeAt(i2);
-  return diff === 0;
-}
-var init_pkce = __esm({
-  "src/auth/pkce.ts"() {
-    "use strict";
-  }
-});
-
-// src/auth/login.ts
-import { createServer as createServer2 } from "node:http";
-function awaitCallback(pkce, port, timeoutMs) {
-  let resolveUri;
-  let resolveResult;
-  let rejectResult;
-  const redirectUri = new Promise((res) => {
-    resolveUri = res;
-  });
-  const result = new Promise((res, rej) => {
-    resolveResult = res;
-    rejectResult = rej;
-  });
-  const server = createServer2((req, res) => {
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname !== "/callback") {
-      res.writeHead(404).end();
-      return;
-    }
-    const err = url.searchParams.get("error");
-    const code2 = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (!stateMatches(pkce.state, state)) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error("state mismatch \u2014 the callback did not match this sign-in request"));
-      return;
-    }
-    if (err) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error(`authorization failed: ${err}`));
-      return;
-    }
-    if (!code2) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error("callback carried no authorization code"));
-      return;
-    }
-    res.writeHead(200, { "content-type": "text/html" }).end(PAGE_OK2);
-    resolveResult({ code: code2 });
-  });
-  const timer = setTimeout(() => {
-    rejectResult(new Error("timed out waiting for the browser callback"));
-  }, timeoutMs);
-  timer.unref?.();
-  const close2 = () => {
-    clearTimeout(timer);
-    server.close();
-  };
-  void result.finally(close2).catch(() => {
-  });
-  server.listen(port, "127.0.0.1", () => {
-    const addr = server.address();
-    const bound = typeof addr === "object" && addr ? addr.port : port;
-    resolveUri(`http://127.0.0.1:${bound}/callback`);
-  });
-  return { redirectUri, result, close: close2 };
-}
-async function login(deps) {
-  const log = deps.log ?? (() => void 0);
-  const now2 = deps.now ?? Date.now;
-  const pkce = createPkce();
-  const { redirectUri: uriP, result, close: close2 } = awaitCallback(
-    pkce,
-    deps.config.port ?? 0,
-    deps.timeoutMs ?? DEFAULT_TIMEOUT_MS4
-  );
-  try {
-    const redirectUri = await uriP;
-    const url = authorizeUrl({
-      issuer: deps.config.issuer,
-      clientId: deps.config.clientId,
-      redirectUri,
-      pkce,
-      ...deps.config.scope ? { scope: deps.config.scope } : {}
-    });
-    log("Opening your browser to sign in...");
-    log(url);
-    await deps.openBrowser(url);
-    const { code: code2 } = await result;
-    const tokens = await deps.exchange({
-      issuer: deps.config.issuer,
-      clientId: deps.config.clientId,
-      code: code2,
-      verifier: pkce.verifier,
-      redirectUri
-    });
-    if (!tokens.access_token) throw new Error("the token exchange returned no access token");
-    const cred = {
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
-      ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-      ...tokens.account ? { account: tokens.account } : {},
-      ...deps.apiBase ? { apiBase: deps.apiBase } : {}
-    };
-    await saveCredential(cred, deps.stateDir);
-    return {
-      ...cred.account ? { account: cred.account } : {},
-      ...cred.expiresAt ? { expiresAt: cred.expiresAt } : {}
-    };
-  } finally {
-    close2();
-  }
-}
-var DEFAULT_TIMEOUT_MS4, PAGE_OK2, PAGE_FAIL2;
-var init_login = __esm({
-  "src/auth/login.ts"() {
-    "use strict";
-    init_pkce();
-    init_store();
-    DEFAULT_TIMEOUT_MS4 = 5 * 60 * 1e3;
-    PAGE_OK2 = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
-<body style="font:16px system-ui;padding:3rem;text-align:center">
-<h1>Signed in to Corenel</h1><p>You can close this tab and return to your terminal.</p></body>`;
-    PAGE_FAIL2 = `<!doctype html><meta charset="utf-8"><title>Sign-in failed</title>
-<body style="font:16px system-ui;padding:3rem;text-align:center">
-<h1>Sign-in failed</h1><p>Return to your terminal for details.</p></body>`;
-  }
-});
-
-// src/auth/cli.ts
-var cli_exports = {};
-__export(cli_exports, {
-  exchangeCode: () => exchangeCode2,
-  oauthConfigFromEnv: () => oauthConfigFromEnv,
-  openBrowser: () => openBrowser,
-  runAuthStatus: () => runAuthStatus,
-  runLogin: () => runLogin,
-  runLogout: () => runLogout
-});
-import { spawn as spawn6 } from "node:child_process";
-function oauthConfigFromEnv(env = process.env) {
-  const issuer = env.CORENEL_OAUTH_ISSUER?.trim();
-  const clientId = env.CORENEL_OAUTH_CLIENT_ID?.trim();
-  if (!issuer || !clientId) return null;
-  return { issuer, clientId };
-}
-function openBrowser(url) {
-  const [cmd, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  const child = spawn6(cmd, args, { detached: true, stdio: "ignore" });
-  child.on("error", () => {
-  });
-  child.unref();
-}
-async function exchangeCode2(p2) {
-  const res = await fetch(new URL("/oauth/token", p2.issuer), {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: p2.clientId,
-      code: p2.code,
-      code_verifier: p2.verifier,
-      redirect_uri: p2.redirectUri
-    }).toString()
-  });
-  if (!res.ok) {
-    throw new Error(`token exchange failed (HTTP ${res.status})`);
-  }
-  return await res.json();
-}
-async function runLogin(stateDir, apiBase2) {
-  const config = oauthConfigFromEnv();
-  if (!config) {
-    console.error("Sign-in is not configured on this build.");
-    console.error("Set CORENEL_OAUTH_ISSUER and CORENEL_OAUTH_CLIENT_ID, or use " + TOKEN_ENV2 + " for headless use.");
-    return 1;
-  }
-  try {
-    const res = await login({
-      config,
-      openBrowser,
-      exchange: exchangeCode2,
-      log: (l2) => console.error(l2),
-      ...stateDir ? { stateDir } : {},
-      // Recorded so the daemon does not have to guess later which API this
-      // credential belongs to -- see LoginDeps.apiBase.
-      ...apiBase2 ? { apiBase: apiBase2 } : {}
-    });
-    console.error(`Signed in${res.account ? ` as ${res.account}` : ""}.`);
-    return 0;
-  } catch (err) {
-    console.error(`Sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
-    return 1;
-  }
-}
-async function runLogout(stateDir, env = process.env) {
-  const before = await resolveCredential(env, stateDir);
-  await clearCredential(stateDir);
-  console.error("Signed out. (Paired devices are unaffected - run `hosts forget` to unpair.)");
-  console.error(`  Cleared ${tokenFilePath(stateDir)} and ${credentialFilePath(stateDir)}`);
-  if (before.source === "none") console.error("  Nothing was stored - this machine was already signed out.");
-  if (env[TOKEN_ENV2]?.trim()) {
-    console.error(`  NOTE: ${TOKEN_ENV2} is still set in this environment, so this machine is STILL signed in.`);
-  }
-  return 0;
-}
-function sourceLabel(source) {
-  return source === "env" ? `${TOKEN_ENV2} environment variable` : source === "token-file" ? "token file" : source === "credential-file" ? "credential file (auth.json)" : "none";
-}
-async function runAuthStatus(stateDir, env = process.env) {
-  const r2 = await resolveCredential(env, stateDir);
-  if (!r2.token) {
-    console.error("Not signed in. Run `corenel login`, or set " + TOKEN_ENV2 + ".");
-    console.error(`  Looked in ${tokenFilePath(stateDir)}`);
-    console.error(`  Looked in ${credentialFilePath(stateDir)}`);
-    return 1;
-  }
-  console.error(`Signed in (${r2.source === "env" ? sourceLabel(r2.source) : r2.path}).`);
-  console.error(`  account  ${r2.account ?? "not recorded in this store - run `corenel login` to record it"}`);
-  console.error(`  token    ${maskToken(r2.token)}`);
-  console.error(`  source   ${sourceLabel(r2.source)}`);
-  console.error(`  expiry   ${r2.expired ? `EXPIRED at ${new Date(r2.expiresAt ?? 0).toISOString()} - run login again` : r2.expiresAt ? new Date(r2.expiresAt).toISOString() : "not recorded in this store"}`);
-  return r2.expired ? 1 : 0;
-}
-var init_cli = __esm({
-  "src/auth/cli.ts"() {
-    "use strict";
-    init_login();
-    init_store();
-    init_tools_node();
-  }
-});
-
 // src/cli.ts
 init_protocol();
 import { join as join21 } from "node:path";
@@ -28083,7 +28100,127 @@ function makeFileMirrorSource(deps) {
 
 // src/controlPlane.ts
 init_protocol();
-init_store();
+
+// ../config/src/daemonConfig.ts
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { dirname, join as join3 } from "node:path";
+var DAEMON_CONFIG_VERSION = 1;
+var SECRET_KEYS = ["acpAuth", "tunnelToken", "token"];
+var KNOWN_KEYS = [
+  "version",
+  "port",
+  "host",
+  "roots",
+  "addUnder",
+  "cloneUnder",
+  "allowLan",
+  "allowOrigins",
+  "tlsCert",
+  "tlsKey",
+  "selfSigned",
+  "tunnel",
+  "tunnelName",
+  "tunnelHostname",
+  "endpoint",
+  "allowShell",
+  "keepTranscripts",
+  "isolation",
+  "msbBin",
+  "guestImage",
+  "maxChainDepth",
+  "name",
+  "appUrl",
+  "defaultModel",
+  "mcpServers",
+  "mcpAllow"
+];
+function daemonConfigPath(stateDir) {
+  return join3(stateDir, "daemon.json");
+}
+async function readDaemonConfig(stateDir) {
+  const empty = (corrupt) => ({ config: { version: DAEMON_CONFIG_VERSION }, unknown: {}, corrupt });
+  let raw;
+  try {
+    raw = await readFile(daemonConfigPath(stateDir), "utf8");
+  } catch {
+    return empty(false);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return empty(true);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return empty(true);
+  const src2 = parsed;
+  const config = { version: DAEMON_CONFIG_VERSION };
+  const unknown = {};
+  for (const [k2, v2] of Object.entries(src2)) {
+    if (k2 === "version") continue;
+    if (KNOWN_KEYS.includes(k2)) {
+      config[k2] = v2;
+    } else {
+      unknown[k2] = v2;
+    }
+  }
+  return { config, unknown, corrupt: false };
+}
+async function writeDaemonConfig(stateDir, next, unknown = {}) {
+  const body2 = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
+  const path = daemonConfigPath(stateDir);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(body2, null, 2)}
+`, "utf8");
+}
+
+// ../config/src/credential.ts
+init_tools_node();
+import { promises as fs6 } from "node:fs";
+var TOKEN_ENV2 = TOKEN_ENV;
+function authDir(stateDir) {
+  return credentialDir(stateDir);
+}
+function credentialPath(stateDir) {
+  return credentialFilePath(stateDir);
+}
+var STORED_CREDENTIAL_KEYS = ["accessToken", "refreshToken", "expiresAt", "account", "apiBase"];
+async function readForeignAuthJson(path) {
+  let raw;
+  try {
+    raw = await fs6.readFile(path, "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const obj = { ...parsed };
+    for (const k2 of STORED_CREDENTIAL_KEYS) delete obj[k2];
+    return obj;
+  } catch {
+    return {};
+  }
+}
+async function saveCredential(cred, stateDir) {
+  const path = credentialPath(stateDir);
+  await fs6.mkdir(authDir(stateDir), { recursive: true });
+  const foreign = await readForeignAuthJson(path);
+  const next = { ...foreign, ...cred };
+  await fs6.writeFile(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+  try {
+    await fs6.chmod(path, 384);
+  } catch {
+  }
+  await writeAuthToken(cred.accessToken, stateDir);
+}
+async function clearCredential(stateDir) {
+  await clearAllCredentials(stateDir);
+}
+async function resolveCredential(env = process.env, stateDir, now2 = Date.now) {
+  return await resolveNodeCredential({ env, now: now2, ...stateDir ? { stateDir } : {} });
+}
+
+// src/controlPlane.ts
 function describeBackend(url, mirrors, cred, probe) {
   const detail = probe ? {
     reachable: probe.answered,
@@ -28143,8 +28280,8 @@ function makeControlPlane(deps) {
 
 // src/tools.ts
 import { promises as fs7 } from "node:fs";
-import { spawn } from "node:child_process";
-import { resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2, sep as sep2, dirname as dirname3 } from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+import { resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2, sep as sep2, dirname as dirname4 } from "node:path";
 function withinRoot(root, abs) {
   const rel = relative2(root, abs);
   return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel) && rel.split(sep2)[0] !== "..";
@@ -28172,7 +28309,7 @@ async function assertRealWithinRoot(roots, abs) {
       return;
     } catch (e2) {
       if (e2 instanceof Error && e2.message.includes("via symlink")) throw e2;
-      const parent = dirname3(probe);
+      const parent = dirname4(probe);
       if (parent === probe) throw new Error(`cannot resolve path under the sidecar roots: ${abs}`);
       probe = parent;
     }
@@ -28223,7 +28360,7 @@ function nodeFsTools(roots) {
       mutates: true,
       async run(args) {
         const abs = confine(roots, args.root, String(args.path ?? ""));
-        await fs7.mkdir(dirname3(abs), { recursive: true });
+        await fs7.mkdir(dirname4(abs), { recursive: true });
         await assertRealWithinRoot(roots, abs);
         await fs7.writeFile(abs, String(args.content ?? ""), "utf8");
         return `wrote ${args.path}`;
@@ -28274,7 +28411,7 @@ function nodeFsTools(roots) {
         if (bytes.byteLength > MAX_READ_BYTES) {
           throw new Error(`file too large to write (${bytes.byteLength} bytes; max ${MAX_READ_BYTES})`);
         }
-        await fs7.mkdir(dirname3(abs), { recursive: true });
+        await fs7.mkdir(dirname4(abs), { recursive: true });
         await assertRealWithinRoot(roots, abs);
         await fs7.writeFile(abs, bytes);
         return `wrote ${args.path} (${bytes.byteLength} bytes)`;
@@ -28389,7 +28526,7 @@ function runShell(command, cwd, timeout) {
   return new Promise((resolveOut) => {
     const isWin = process.platform === "win32";
     const [shell, shellArgs] = isWin ? ["cmd.exe", ["/d", "/s", "/c", command]] : ["/bin/sh", ["-c", command]];
-    const child = spawn(shell, shellArgs, { cwd, windowsHide: true });
+    const child = spawn2(shell, shellArgs, { cwd, windowsHide: true });
     let out = "";
     let truncated = false;
     let timedOut = false;
@@ -28424,7 +28561,7 @@ ${truncated ? "[output truncated]\n" : ""}${body2}`);
 // src/configService.ts
 init_protocol();
 import { promises as fs8 } from "node:fs";
-import { resolve as resolve3, relative as relative3, join as join6, dirname as dirname4, sep as sep3 } from "node:path";
+import { resolve as resolve3, relative as relative3, join as join7, dirname as dirname5, sep as sep3 } from "node:path";
 var MAX_LIST_DEPTH2 = 24;
 var MAX_LIST_ENTRIES2 = 2e4;
 function relUnder(root, abs) {
@@ -28459,7 +28596,7 @@ var NodeConfigService = class {
         real = await fs8.realpath(probe);
       } catch {
         if (mustExist && probe === abs) throw new Error(`no such harness config file: ${relUnder(this.stateDir, abs) ?? abs}`);
-        const parent = dirname4(probe);
+        const parent = dirname5(probe);
         if (parent === probe) throw new Error("cannot resolve a path inside the harness config");
         probe = parent;
         continue;
@@ -28495,11 +28632,11 @@ var NodeConfigService = class {
   async listRoot(levels) {
     const out = [];
     for (const name of CONFIG_DEFINITION_FILES) {
-      const st2 = await fs8.stat(join6(this.stateDir, name)).catch(() => null);
+      const st2 = await fs8.stat(join7(this.stateDir, name)).catch(() => null);
       if (st2?.isFile()) out.push({ path: name, size: st2.size, mtime: st2.mtimeMs });
     }
     for (const name of CONFIG_DEFINITION_DIRS) {
-      const abs = join6(this.stateDir, name);
+      const abs = join7(this.stateDir, name);
       const st2 = await fs8.stat(abs).catch(() => null);
       if (!st2?.isDirectory()) continue;
       out.push({ path: name, dir: true });
@@ -28514,7 +28651,7 @@ var NodeConfigService = class {
     for (const e2 of entries) {
       if (out.length >= MAX_LIST_ENTRIES2) return;
       if (e2.isSymbolicLink()) continue;
-      const child = join6(abs, e2.name);
+      const child = join7(abs, e2.name);
       if (e2.isDirectory()) {
         out.push({ path: `${prefix}${e2.name}`, dir: true });
         await this.walk(child, `${prefix}${e2.name}/`, levels - 1, out);
@@ -28533,7 +28670,7 @@ var NodeConfigService = class {
    * partially written AGENT.md is a definition that parses to nonsense. */
   async write(path, content) {
     const abs = await this.confine(path, false);
-    await fs8.mkdir(dirname4(abs), { recursive: true });
+    await fs8.mkdir(dirname5(abs), { recursive: true });
     await this.assertRealAllowed(abs, false);
     const tmp = `${abs}.${process.pid}.${Date.now()}.tmp`;
     try {
@@ -28552,7 +28689,7 @@ var NodeConfigService = class {
 };
 
 // src/procs.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 var MAX_RUNNING = 8;
 var MAX_CHUNKS = 400;
 var MAX_CHARS = 2e5;
@@ -28614,7 +28751,7 @@ function createNodeProcs(opts) {
       const isWin = process.platform === "win32";
       const shell = isWin ? "cmd.exe" : "/bin/sh";
       const shellArgs = isWin ? ["/d", "/s", "/c", line] : ["-c", line];
-      const child = spawn2(shell, shellArgs, {
+      const child = spawn3(shell, shellArgs, {
         cwd: dir,
         windowsHide: true,
         stdio: "pipe",
@@ -29552,6 +29689,96 @@ var todoWriteTool = {
   }
 };
 
+// ../harness/tools/project.ts
+init_protocol();
+var manifestSuffix = () => `${stateDirName()}/craft/project.json`;
+async function findProjects(ctx) {
+  const files = ctx.files;
+  if (!files) return [];
+  const suffix = manifestSuffix();
+  const nodes = await files.list().catch(() => []);
+  const out = [];
+  for (const node of flattenFiles(nodes)) {
+    const p2 = node.path;
+    const root = p2 === suffix ? "" : p2.endsWith(`/${suffix}`) ? p2.slice(0, -(suffix.length + 1)) : null;
+    if (root === null) continue;
+    try {
+      const m2 = JSON.parse(await files.read(p2));
+      if (m2 && m2.version === 1 && typeof m2.name === "string") out.push({ root, name: m2.name });
+    } catch {
+    }
+  }
+  return out;
+}
+function projectSlug(name) {
+  const s2 = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return s2 || "project";
+}
+async function freeRoot(ctx, name) {
+  const files = ctx.files;
+  const base = projectSlug(name);
+  let root = base;
+  for (let i2 = 2; files && await files.stat(root) !== null; i2++) root = `${base}-${i2}`;
+  return root;
+}
+var startProjectTool = {
+  name: "start_project",
+  /* DECLARED, like ask_user's, and for the same reason: its whole effect is to
+   * put a choice in front of someone who is already there, and the write it
+   * may then make is the thing they just chose. A permission prompt on top of
+   * the choice is two dialogs for one decision. */
+  permission: "allow",
+  noOffload: true,
+  description: "Use when the person asks for a DOCUMENT (a memo, report, deck, spreadsheet, diagram, page) and the system context says no project is open. Documents live inside a project, where they are versioned and shown beside the conversation; a file written outside one is invisible in this surface. Propose a short project name derived from what they asked for \u2014 the person confirms it, picks an existing project instead, or declines. This call WAITS for their answer and returns the folder to write into, or that they declined. Write the document inside that folder with the ordinary file tools. Do NOT use this for ordinary code or repository files, which belong where they already are.",
+  parameters: {
+    type: "object",
+    properties: {
+      name: { type: "string", description: "Proposed project name, 2-4 words, derived from the request." },
+      reason: { type: "string", description: "One short line: what is about to be written into it." }
+    },
+    required: ["name"]
+  },
+  async run(args, ctx) {
+    const files = ctx.files;
+    if (!files) return "start_project is unavailable: no file workspace is connected.";
+    if (!ctx.ask) return "start_project is unavailable in this environment (nobody can be asked).";
+    if (!files.writable) return "This workspace is read-only, so no project can be created in it.";
+    const proposed = (typeof args.name === "string" ? args.name : "").trim() || "Untitled project";
+    const existing = await findProjects(ctx);
+    const createLabel = `Create "${proposed}"`;
+    const options = [
+      { label: createLabel, description: typeof args.reason === "string" && args.reason ? args.reason : "A new project for this work." },
+      ...existing.slice(0, 3).map((p2) => ({ label: p2.name, description: `Put it in the existing project at ${p2.root || "the workspace root"}.` }))
+    ];
+    if (options.length < 2) options.push({ label: "Not now", description: "Write nothing; the document has nowhere to live yet." });
+    const canMove = !!ctx.moveSessionToProject;
+    const questions = [
+      { header: "Project", question: "Documents live in a project. Where should this one go?", options },
+      ...canMove ? [{
+        header: "This chat",
+        question: "Bring this conversation into the project too?",
+        options: [
+          { label: "Yes, move it", description: "The transcript moves with the work, and this chat carries on." },
+          { label: "Keep it loose", description: "The document goes in the project; this chat stays where it is." }
+        ]
+      }] : []
+    ];
+    const answers = await ctx.ask(questions);
+    const picked = answers ? answers.Project?.[0] : void 0;
+    const move = answers ? answers["This chat"]?.[0] === "Yes, move it" : false;
+    if (!picked) return "The person did not choose a project. Do not write the document; say what you were about to write and that it needs a project.";
+    if (picked === "Not now") return "The person declined to start a project. Do not write the document.";
+    const moved = async (root2) => move && ctx.moveSessionToProject ? ` ${await ctx.moveSessionToProject(root2)}` : "";
+    const hit = existing.find((p2) => p2.name === picked);
+    if (hit) return `Use the existing project "${hit.name}". Write the document inside ${hit.root || "the workspace root"}/.${await moved(hit.root)}`;
+    const name = picked === createLabel ? proposed : picked;
+    const root = await freeRoot(ctx, name);
+    const manifest = { name, createdAt: Date.now(), version: 1 };
+    await files.write(`${root}/${manifestSuffix()}`, JSON.stringify(manifest, null, 2));
+    return `Created the project "${name}" at ${root}/. Write the document inside ${root}/ with the ordinary file tools; it will be versioned and shown beside this conversation.${await moved(root)}`;
+  }
+};
+
 // ../harness/tools/sessions.ts
 function str3(args, key) {
   const v2 = args[key];
@@ -30133,6 +30360,7 @@ var defaultTools = [
   webSearchTool,
   todoWriteTool,
   compilePrompdTool,
+  startProjectTool,
   ...fileTools
 ];
 function allTools() {
@@ -30212,10 +30440,10 @@ Add a constraint :: Add a constraint or rule to the prompt instructions (what to
 `,
   "guards.json": '[\n  {\n    "_comment": "Declarative client-side feature guards (NON-authoritative \u2014 for defaults/UX; real enforcement is the backend entitlements API). Copy an entry and remove \\"disabled\\". rule: \\"require-auth\\" or \\"free-quota\\" (with \\"limit\\"). feature: a FeatureId like \\"llm-execution\\", or \\"*\\". action: { \\"kind\\": \\"sign-in\\" } or { \\"kind\\": \\"upgrade\\", \\"label\\": \\"...\\" }.",\n    "disabled": true,\n    "id": "example-free-quota",\n    "feature": "llm-execution",\n    "rule": "free-quota",\n    "limit": 3,\n    "reason": "Free limit reached \u2014 sign in to keep going.",\n    "action": { "kind": "sign-in" }\n  }\n]\n',
   "languages/prmd.md": '{% raw %}\n# PRMD File Format Overview\n\nPRMD files are structured in YAML format and are used to define prompts for various applications within the Prompd system. Each file contains essential metadata in the frontmatter followed by the body content, which is where the prompt logic and structure reside.\n\n## Field Descriptions\n- **id**: A unique identifier for the prompt file, usually in kebab-case.\n- **name**: A brief title for the prompt that identifies it.\n- **version**: The version number of the prompt file, following semantic versioning.\n- **description**: Optional human-readable summary.\n- **model** / **provider**: Optional default model + provider for runs.\n- **inherits**: A path to another prompt file whose body this one extends (the parent renders first, then this file\'s body). Resolved at compile time \u2014 siblings locally, registry refs on the backend.\n- **using**: Optional list of package refs imported for context/blocks; each `{ name: "@scope/pkg@1.2.0", prefix: "@alias" }`.\n- **parameters**: A list of typed input variables for the prompt (see below).\n\n## Parameter Types\nPrompd supports thirteen parameter types covering scalars, dates, structured data, and binary content.\n\n| Type     | Description                                                     |\n|----------|-----------------------------------------------------------------|\n| string   | Plain text                                                      |\n| enum     | A value restricted to a fixed set of options (see Enums below)  |\n| number   | Integer or float (generic numeric)                              |\n| integer  | Whole number only \u2014 rejects floats                              |\n| float    | Decimal number                                                  |\n| boolean  | true / false                                                    |\n| date     | Calendar date \u2192 `YYYY-MM-DD`. Resolved at compile time.         |\n| datetime | Date + time \u2192 `YYYY-MM-DDTHH:mm:ss` (local). Resolved at compile time. |\n| array    | JSON array with untyped elements                                |\n| object   | Plain key-value object (non-array)                              |\n| json     | Any JSON value \u2014 arrays of objects, nested structures, etc.     |\n| file     | File path; caller supplies the file content as a string         |\n| base64   | Base64-encoded binary (images, PDFs, blobs for multimodal LLMs) |\n\n### Enums (restricted values)\nAn `enum` parameter limits the value to a fixed set of choices. Provide the allowed values as a JSON array of strings in an `enum:` field, e.g. `["small", "medium", "large"]` (a YAML block list works too). Set `type: enum` \u2014 or omit `type`, since it\'s inferred when `enum` is present. The `default:`, if given, must be one of the options.\n\n```yaml\n- name: tone\n  type: enum\n  enum: ["detailed", "summary", "concise"]\n  default: "summary"\n```\n\n### Date & datetime defaults\n`date` and `datetime` defaults accept `now` / `today`, a relative offset `now\xB1N<unit>`, or a literal ISO date. Units: `d` (days), `w` (weeks), `mo` (months), `y` (years); `datetime` also `h` (hours), `min`, `s`. The value is resolved at compile time, so each run uses the current clock.\n\nExamples (assume today is 2026-06-11):\n\n| Default        | Type     | Resolves to            |\n|----------------|----------|------------------------|\n| `now`          | date     | `2026-06-11`           |\n| `now-8d`       | date     | `2026-06-03`           |\n| `now-2w`       | date     | `2026-05-28`           |\n| `now-1mo`      | date     | `2026-05-11`           |\n| `now+1y`       | date     | `2027-06-11`           |\n| `now`          | datetime | `2026-06-11T09:30:00`  |\n| `now-3h`       | datetime | `2026-06-11T06:30:00`  |\n| `2025-01-15`   | date     | `2025-01-15`           |\n\n## Body (Markdown + Jinja2/Nunjucks)\n- `{{ param }}` and `{{ param | filter }}` interpolation.\n- `{% if %}` / `{% elif %}` / `{% else %}` / `{% endif %}` conditionals.\n- `{% for x in list %} \u2026 {% endfor %}` loops.\n- `{% include %}` and inherited blocks resolve against the workspace + registry at compile time.\n- Only declared parameters are guaranteed to exist; treat any other variable as undefined.\n\n## Example PRMD File\n```yaml\n---\nid: report-window\nname: Report Window\nversion: 1.0.0\nparameters:\n  - name: user_name\n    type: string\n    default: "Guest"\n  - name: since\n    type: date\n    default: "now-8d"          # 8 days ago, resolved at compile time\n  - name: generated_at\n    type: datetime\n    default: "now"\n---\nHello, {{ user_name }}! Here is your report covering everything since {{ since }} (generated {{ generated_at }}).\n```\n{% endraw %}\n',
-  "modes/auto.md": "---\nid: auto\nname: Auto\ndescription: No extra steering; the agent picks its own approach and tools.\n---\nMode: AUTO \u2014 no extra steering; the assistant is free to choose its approach and tools.\n",
-  "modes/brainstorm.md": "---\nid: brainstorm\nname: Brainstorm\ndescription: Explore options; generative, makes no edits.\n---\nMode: BRAINSTORM \u2014 explore options and alternatives; be generative, do not edit the file.\n",
-  "modes/edit.md": "---\nid: edit\nname: Edit\ndescription: Focus on concrete file changes; prefers propose_edit.\n---\nMode: EDIT \u2014 focus on concrete changes to the file; prefer propose_edit.\n",
-  "modes/plan.md": "---\nid: plan\nname: Plan\ndescription: Think and outline before acting; avoids mutating tools.\n---\nMode: PLAN \u2014 think step by step and outline an approach before acting; avoid mutating tools.\n",
+  "modes/auto.md": "---\nid: auto\nname: Auto\ndescription: Act on the request, deciding what is cheap to decide and asking only what is expensive to get wrong.\n---\nMode: AUTO \u2014 act.\n\nMake the smallest set of decisions needed to start, say plainly what you assumed, and build a thin working slice before elaborating it. A broad request is not a reason to stop and interview the user.\n\nAsk only where a wrong guess is expensive to undo \u2014 the data model, anything touching security, privacy or regulated data, and where the thing runs. Keep it to two or three questions and ask them before you build, not after. Everything that is cheap to change later is an assumption to state, not a question to ask.\n",
+  "modes/brainstorm.md": "---\nid: brainstorm\nname: Brainstorm\ndescription: Generate genuinely different options with their trade-offs, and recommend one.\n---\nMode: BRAINSTORM \u2014 explore options and alternatives; be generative.\n\nGive at least two genuinely different approaches, not one approach with its dial turned. Name what each is good at and what it costs, then say which you would pick and why. Do not edit files.\n",
+  "modes/edit.md": "---\nid: edit\nname: Edit\ndescription: Make the smallest concrete change that does the job.\n---\nMode: EDIT \u2014 make the smallest concrete change that does the job, and say what you changed.\n\nWhen a file is open in the editor, prefer propose_edit with the COMPLETE new file content, so the user reviews a diff before anything is applied.\n",
+  "modes/plan.md": "---\nid: plan\nname: Plan\ndescription: Settle the shape-changing decisions first, then outline the approach without mutating anything.\n---\nMode: PLAN \u2014 decide before acting.\n\nFirst surface the decisions that change the SHAPE of the result and ask about those; an outline built on an unasked question is wasted work. Then think step by step and lay out the approach, with the trade-offs you are choosing between made explicit.\n\nAvoid mutating tools. Producing a plan the user can argue with is the deliverable here.\n",
   "crew/memory.md": '---\nid: crew-memory\nname: Crew agent \u2014 memory block\nversion: 1.0.0\ndescription: Told to every crew agent about its own memory folder. Appended after the agent\'s own role and instructions, because it is housekeeping and they are the job.\nparameters:\n  - name: dir\n    type: string\n    description: The agent\'s memory folder, with no trailing slash (e.g. crew/auditor/memory).\n    default: "memory"\n  - name: index\n    type: string\n    description: Full path of the agent\'s memory index, derived from dir (e.g. crew/auditor/memory/MEMORY.md).\n    default: "memory/MEMORY.md"\n---\n--- Memory ---\nYou keep durable notes in your own memory folder, `{{ dir }}/`, one Markdown file per note, alongside `{{ index }}`, an index you maintain for yourself.\nRead `{{ index }}` at the start of a run to recall what you already know, and call recall_memory to look up one note by name. If you can call save_memory, use it for what is worth knowing on a later run, and keep `{{ index }}` current as you do. If a file tool you have takes a `root` argument, you can pass `{{ dir }}/` as `root` to read and edit those files directly.\n',
   "crew/room.md": `---
 id: crew-room
@@ -30350,7 +30578,7 @@ You are a privacy reviewer. Determine whether the INPUT exposes personally ident
 id: system-base
 name: Operational system prompt
 version: 1.0.0
-description: The agent's system prompt \u2014 persona, mode, tool definitions and editor context composed by @prompd/core.
+description: The agent's system prompt \u2014 surface-agnostic identity, mode, tool definitions and context composed by @prompd/core. Editor and workflow specifics live in the prompts that inherit this one.
 parameters:
   - name: persona
     type: string
@@ -30383,9 +30611,11 @@ parameters:
 ---
 {% if persona %}{{ persona }}
 
-{% endif %}You are the {{ app }} assistant embedded in the in-browser .prmd editor. You help the user author, compile, and improve .prmd/.md prompts (YAML frontmatter + Nunjucks body with typed parameters). When the user asks about the .prmd format itself \u2014 frontmatter fields, parameter types (including enums), date defaults, inheritance, or templating \u2014 the canonical reference is \`languages/prmd.md\` in the {{ app }} config workspace; consult it rather than guessing (it is already included in context whenever a .prmd/.md file is open).
+{% endif %}You are the {{ app }} assistant. You help the user do real work in {{ app }}: reading and changing files, composing and running prompts and workflows, and building software. What is in front of you differs by surface \u2014 an open file, a workflow canvas, a workspace, or nothing but this conversation \u2014 so work from the context you were actually given rather than assuming a particular screen.
 
-To change the file open in the editor, call propose_edit with the COMPLETE new file content \u2014 the user reviews a diff and applies it. To read or change other files in the workspace, use the file tools (writes ask the user for permission first). Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.
+To read or change files in the workspace, use the file tools; writes ask the user for permission first. Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.
+
+Say what you assumed and what you did not do. A request that leaves room for interpretation gets its decisions named, one line each, so the user can correct one without unpicking the rest. How much you decide for yourself versus ask about is the mode's call, below.
 
 ## Tools available this run
 {{ tools }}
@@ -30461,7 +30691,7 @@ what you will do before you do it unattended.
   "systems/system-prmd-md.md": '---\nid: system-prmd-md\nname: Prompt file system prompt (.prmd / .md)\nversion: 1.0.0\ninherits: ./system-base.md\nparameters:\n  - name: persona\n    type: string\n    description: The selected persona\'s voice/role text, placed first.\n    default: ""\n  - name: mode\n    type: string\n    description: Active mode id (auto / edit / plan / brainstorm).\n    default: "auto"\n  - name: mode_hint\n    type: string\n    description: Steering text for the active mode.\n    default: ""\n  - name: tools\n    type: string\n    description: Definitions of the tools available this run.\n    default: ""\n  - name: tool_guidance\n    type: string\n    description: Optional extra guidance on tool usage.\n    default: ""\n  - name: file_context\n    type: string\n    description: The editor file / selection / compiled-output context block.\n    default: ""\n---\n\n{% include "../languages/prmd.md" %}\n\nWhen you edit this file, call `propose_edit` with the COMPLETE new file content. Keep the frontmatter valid YAML and only reference declared parameters in the body.\n',
   "templates/index.json": '[\n  {\n    "_comment": "EXAMPLE of a data-driven New File type. Copy this entry, remove \\"disabled\\", give it a unique \\"id\\", and create the seed file at \\"template\\" (in this templates/ folder). Tokens __ID__ / __NAME__ are substituted on create. Icon is a ui-kit name (e.g. IcFileCode, IcUser, IcFlow) or \\"svg:<markup>\\". See docs/file-types.md.",\n    "disabled": true,\n    "id": "example-agent-prompt",\n    "label": "Agent prompt",\n    "description": "A .prmd tuned for tool-using agents.",\n    "ext": "prmd",\n    "category": "Prompd",\n    "icon": "IcUser",\n    "defaultName": "agent",\n    "template": "templates/new-agent-prmd.prmd",\n    "accent": true\n  }\n]\n',
   "templates/new-blank-prmd-md.prmd": "---\nid: __ID__\nname: __NAME__\nversion: 1.0.0\n---\n\n",
-  "templates/new-default-pdflow.pdflow": '{\n  "version": "1.0.0",\n  "metadata": {\n    "id": "__ID__",\n    "name": "__NAME__"\n  },\n  "nodes": [],\n  "connections": []\n}\n',
+  "templates/new-default-pdflow.pdflow": '{\n  "version": "1.0.0",\n  "metadata": {\n    "id": "__ID__",\n    "name": "__NAME__"\n  },\n  "nodes": [],\n  "edges": []\n}\n',
   "templates/new-default-prmd-md.prmd": '---\nid: __ID__\nname: __NAME__\nversion: 1.0.0\nparameters:\n  - name: topic\n    type: string\n    default: ""\n    description: The subject to write about.\n---\n\nWrite a short, clear answer about {{ topic }}.\n',
   "templates/new-default-test-prmd.prmd": `---
 id: __ID__
@@ -30603,7 +30833,147 @@ the goal's stakes and vagueness:
   "roles/senior-software-engineer/ROLE.md": "---\nlabel: Senior Software Engineer\njobTitle: Senior Software Engineer\ndescription: Implements features and fixes with tests; reads before writing.\nsuggestedSkills: []\n---\nImplement changes test-first. Read the surrounding code and match its conventions. Keep changes minimal and focused; explain non-obvious decisions.\n",
   "roles/senior-test-engineer/PERSONA.md": "Meticulous, adversarial about correctness. Thinks in failure modes and boundary conditions.\n",
   "roles/senior-test-engineer/POLICY.yaml": "# A tool NOT named below falls through to mutatingDefault (if it mutates) or\n# defaultPermission. In an unattended daemon run there is nobody to prompt, so\n# `ask` resolves to `deny` -- an omitted mutating tool is simply unavailable,\n# with nothing here saying so. Name what the agent needs.\nversion: 1\nname: role:senior-test-engineer\ndefaultPermission: ask\nmutatingDefault: deny\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  # The agent's own state: it is told to keep durable notes and, when\n  # self-directed, to schedule its own next wake. Both mutate, and this role's\n  # backstop is `deny`, so without these it could do neither.\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\n  schedule_self: allow\n  # Room participation. Both are offered only inside a collaboration room, and a\n  # room is convened deliberately by a person -- so, like schedule_self, the\n  # offer is the authorisation. Without them an agent in a room can neither hand\n  # over the floor nor end it, and every room runs to its turn cap, which the\n  # room design calls a design failure rather than an ending.\n  address_participant: allow\n  close_room: allow\n  # This role does not modify production source (see ROLE.md), so writes stay\n  # on the deny backstop. Named here only where the level would otherwise be\n  # guessed at.\n  call_agent: deny\n",
-  "roles/senior-test-engineer/ROLE.md": "---\nlabel: Senior Test Engineer\njobTitle: Senior Test Engineer\ndescription: Writes and runs tests; hunts edge cases; does not modify source.\nsuggestedSkills: []\n---\nFocus on coverage and edge cases. Write tests that fail before a fix and pass after. Do not modify production source; report gaps you find.\n"
+  "roles/senior-test-engineer/ROLE.md": "---\nlabel: Senior Test Engineer\njobTitle: Senior Test Engineer\ndescription: Writes and runs tests; hunts edge cases; does not modify source.\nsuggestedSkills: []\n---\nFocus on coverage and edge cases. Write tests that fail before a fix and pass after. Do not modify production source; report gaps you find.\n",
+  "crew/data-analyst/AGENT.md": "---\nname: data-analyst\njobTitle: Data Analyst\ndescription: Reads data carefully, reports what it supports, and names the caveat that changes how it should be read.\ntriggers:\n  - type: manual\n---\nUnderstand the data before analysing it. What is one row? Over what period? What is\nmissing, and is it missing at random? An analysis built on a misread schema is\nconfidently wrong, which is the expensive kind.\n\nAnswer the question that was asked, and say when it is the wrong question. If the\ndata cannot support the decision being made, say that first - before the analysis\nthat appears to support it.\n\nQuantify plainly. Give the number, the denominator and the period together. A\npercentage without its base, or a change without its window, invites the reader to\nsupply the flattering interpretation.\n\nState the caveat that would change the conclusion. Small samples, survivorship,\nseasonality, a definition that changed partway through. One honest caveat is worth\nmore than a page of hedging.\n\nDo not infer cause from a comparison. Say what the data shows and what would be\nneeded to establish why. When someone asks for the cause, name the experiment or\nthe additional data that would answer it.\n",
+  "crew/data-analyst/PERSONA.md": "Numerate and concrete. States the number, then what it does and does not mean.\n",
+  "crew/data-analyst/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/data-analyst/SOUL.md": "Careful and unexcitable. Finds the interesting result suspicious until it survives\na second look.\n",
+  "crew/document-writer/AGENT.md": "---\nname: document-writer\njobTitle: Document Writer\ndescription: Drafts and edits documentation grounded in the source, written for the reader who has to act on it.\ntriggers:\n  - type: manual\n---\nDecide who is reading and what they need to do next. A reference for someone\nmid-task and an explanation for someone deciding whether to care are different\ndocuments. Writing one document for both readers serves neither.\n\nGround every claim in the source. Read the code, the config, the actual behaviour -\nthen describe it. Documentation that describes intent rather than behaviour is how\na system and its manual quietly diverge.\n\nLead with the thing the reader came for. Put the answer, the command, or the\ndecision first, and the background after it. Most readers stop early; let them\nstop having got what they needed.\n\nPrefer the concrete. One real example beats three sentences of description. Show\nthe actual command, the actual output, the actual file path.\n\nFlag what you could not verify. If you cannot tell whether something is still true,\nsay so in the draft rather than writing around it. A marked uncertainty gets\nchecked; a smoothed-over one ships.\n",
+  "crew/document-writer/PERSONA.md": "Plain and unhurried. Short sentences, concrete nouns, no throat-clearing.\n",
+  "crew/document-writer/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/document-writer/SOUL.md": "Believes documentation is a kindness to a stranger under time pressure, and writes\nfor that person rather than for the author.\n",
+  "crew/marketing-strategist/AGENT.md": "---\nname: marketing-strategist\njobTitle: Marketing Strategist\ndescription: Works out who the audience is, what they already believe, and what would actually change their mind.\ntriggers:\n  - type: manual\n---\nStart with the audience, not the product. Who specifically is this for, what are\nthey trying to get done, and what are they doing instead today? A message written\nbefore that is answered is decoration.\n\nName what the audience already believes. Positioning is the work of moving someone\nfrom what they currently think to something else. You cannot plan that move\nwithout stating the starting point.\n\nSay what the thing is not for. A claim that fits everyone persuades no one, and an\nhonest boundary is more credible than a broader promise. Name who should keep doing\nwhat they are doing.\n\nMake claims a sceptic could check. Prefer a specific, verifiable statement to a\nsuperlative. Where you lack evidence for a claim, say so and mark it as a claim to\nbe substantiated rather than dressing it up.\n\nGive the reasoning, not only the recommendation. Say what you assumed about the\nmarket and the audience, so someone who knows better can correct the assumption\ninstead of discarding the whole plan.\n",
+  "crew/marketing-strategist/PERSONA.md": "Direct and commercially minded. Argues from the audience's position rather than the\nseller's.\n",
+  "crew/marketing-strategist/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/marketing-strategist/SOUL.md": "Allergic to language that sounds impressive and says nothing. Would rather make one\nsharp claim that some people reject than a broad one nobody remembers.\n",
+  "crew/research-analyst/AGENT.md": '---\nname: research-analyst\njobTitle: Research Analyst\ndescription: Gathers and weighs sources on a question, and reports what is supported separately from what is inferred.\ntriggers:\n  - type: manual\n---\nPin down the question first. Vague questions produce confident, useless answers.\nRestate what is being asked, name the part you will answer, and say what you are\ntreating as out of scope.\n\nSearch before you answer, and search more than once. One query returns one\nneighbourhood of an argument. Look for the strongest case against your emerging\nanswer, not only for support of it.\n\nAttribute every claim. Say where each load-bearing fact came from and when it was\npublished. Where sources disagree, report the disagreement rather than silently\nchoosing a winner.\n\nSeparate what is supported from what you inferred. Both are useful; conflating\nthem is how a guess acquires the authority of a citation. Mark the inferences.\n\nSay how confident you are and what would change your mind. When the evidence is\nthin, say it is thin. "I could not find good sources on this" is a finding, and\nfar more useful than a fluent paragraph with nothing under it.\n',
+  "crew/research-analyst/PERSONA.md": 'Measured and precise about certainty. Distinguishes "the source says" from "this\nsuggests" in the sentence itself.\n',
+  "crew/research-analyst/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/research-analyst/SOUL.md": "Curious and hard to satisfy. Would rather report an honest gap than a tidy answer\nthat does not hold.\n",
+  "crew/senior-software-engineer/AGENT.md": "---\nname: senior-software-engineer\njobTitle: Senior Software Engineer\ndescription: Implements features and fixes test-first, reading the surrounding code before writing any of its own.\ntriggers:\n  - type: manual\n---\nRead before you write. Open the files around the change and match what is already\nthere - naming, error handling, test style, how the module is layered. Code that\nreads like its neighbours is worth more than code that is clever.\n\nWork test-first when there is a way to test the thing. Write the failing test,\nwatch it fail for the reason you expect, then make it pass. A test that has never\nfailed has not been shown to test anything.\n\nMake the smallest change that fully solves the problem. Resist the tidy-up that\nwas not asked for; note it instead. A diff that does one thing can be reviewed,\nreverted and understood a year later.\n\nSay plainly what you did not do. Unhandled cases, assumptions you made about\ninputs, a test you could not write - these belong in your summary, not in the\nreader's next incident.\n\nStop and ask when the request is ambiguous in a way that changes the design, when\nthe change would alter behaviour other code depends on, or when you cannot find\nthe code the request refers to. Guessing at any of those costs more than asking.\n",
+  "crew/senior-software-engineer/PERSONA.md": "Pragmatic and terse. Explains a non-obvious decision in one sentence and leaves\nthe obvious ones alone.\n",
+  "crew/senior-software-engineer/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/senior-software-engineer/SOUL.md": "Correctness first, then clarity, then brevity. Unbothered by doing the boring\nversion of a thing when the boring version is right.\n",
+  "crew/senior-test-engineer/AGENT.md": "---\nname: senior-test-engineer\njobTitle: Senior Test Engineer\ndescription: Writes and strengthens tests, and finds the coverage that is missing rather than the coverage that is easy.\ntriggers:\n  - type: manual\n---\nFind what is untested, not what is uncovered. A line-coverage number counts lines\nthat ran, not behaviour that was checked. Ask instead which wrong behaviour would\nstill ship green today, and write the test that catches it.\n\nProve every test can fail. After a test passes, change the code it covers and\nconfirm it goes red. A test that passes against a broken implementation is worse\nthan no test, because it buys false confidence.\n\nTest behaviour through the interface a caller uses. Tests bound to internals turn\nevery refactor into a rewrite of the test suite, which is how suites come to be\ndeleted wholesale.\n\nPrefer one clear case over five near-duplicates. Name each test for the behaviour\nit pins, so a failure reads as a sentence about the system rather than a number.\n\nFlag, do not paper over. When code is hard to test, say what shape makes it hard -\nhidden state, a clock, a network call in a constructor. Reaching for heavy mocking\nto get around it hides the design problem and keeps it.\n",
+  "crew/senior-test-engineer/PERSONA.md": "Direct and specific. Names the failure a test prevents rather than describing the\ntest.\n",
+  "crew/senior-test-engineer/POLICY.yaml": "onViolation: stop\ndefaultPermission: ask\nmutatingDefault: ask\npermissions:\n  read_file: allow\n  list_files: allow\n  search_files: allow\n  stat_file: allow\n  compile_prompd: allow\n  web_search: allow\n  save_memory: allow\n  recall_memory: allow\n  kv_get: allow\n  kv_set: allow\nunattended: deny\n",
+  "crew/senior-test-engineer/SOUL.md": 'Sceptical in the useful way. Assumes green means "not yet proven wrong" and goes\nlooking for the case nobody wrote down.\n',
+  "workflows/competitor-teardown/workflow.pdflow": `{
+  "version": "1.0",
+  "metadata": {
+    "id": "competitor-teardown",
+    "name": "Competitor Teardown",
+    "description": "Researches each competitor into the same shape, then names where you are differentiated and where you are exposed."
+  },
+  "parameters": [
+    { "name": "ours", "type": "string", "required": true, "multiline": true, "description": "In a few sentences: what do you sell, to whom, and what do you claim makes it different?" },
+    { "name": "rivals", "type": "string", "required": true, "multiline": true, "description": "List the competitors to tear down - one name per line." }
+  ],
+  "nodes": [
+    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": { "label": "Start", "triggerType": "manual" } },
+    { "id": "each", "type": "loop", "position": { "x": 0, "y": 300 }, "data": { "label": "Profile each competitor", "loopType": "for-each", "items": "{{ rivals }}", "arraySource": "{{ rivals }}", "itemVariable": "rival", "body": ["profile"], "onComplete": "gather", "maxIterations": 12 } },
+    { "id": "profile", "type": "agent", "parentId": "each", "position": { "x": 260, "y": 300 }, "data": { "label": "Profile one competitor", "systemPrompt": "You profile one competitor at a time into a fixed shape so the profiles can be compared. Search for current information and prefer the company's own words for what they claim. Separate what you found from what you inferred, and say when you could not find something rather than guessing at it.", "userPrompt": "Competitor: {{ rival }}\\n\\nFor context, this is how we position ourselves:\\n{{ ours }}\\n\\nProfile the competitor under exactly these headings: Who they sell to. What they claim. What they actually appear to do well. Where they are weak. How they price, if findable. Keep it under 250 words and mark anything you inferred.", "maxIterations": 8, "outputMode": "final-response" } },
+    { "id": "profile_tools", "type": "tool", "position": { "x": 520, "y": 300 }, "data": { "label": "Search", "attachedTo": "profile", "tools": ["web_search"] } },
+    { "id": "gather", "type": "transformer", "position": { "x": 0, "y": 420 }, "data": { "label": "Gather profiles", "mode": "template", "template": "OUR POSITIONING\\n{{ ours }}\\n\\nCOMPETITOR PROFILES\\n{{ each }}" } },
+    { "id": "gaps", "type": "prompt", "position": { "x": 0, "y": 520 }, "data": { "label": "Differentiation and exposure", "sourceType": "raw", "source": "", "rawPrompt": "Compare the profiles below against our own positioning.\\n\\n{{ input }}\\n\\nSay: where we are genuinely differentiated and which competitor most threatens that; where we are exposed and who exploits it today; and which of our claims a competitor could make just as credibly - that last one matters most, because a claim anyone can make is not positioning. Be blunt. Mark anything resting on an inference rather than a found fact." } },
+    { "id": "out", "type": "output", "position": { "x": 0, "y": 620 }, "data": { "label": "Teardown" } }
+  ],
+  "edges": [
+    { "id": "e3", "source": "start", "target": "each" },
+    { "id": "e4", "source": "gather", "target": "gaps" },
+    { "id": "e5", "source": "gaps", "target": "out" }
+  ]
+}
+`,
+  "workflows/feedback-to-roadmap-themes/workflow.pdflow": `{
+  "version": "1.0",
+  "metadata": {
+    "id": "feedback-to-roadmap-themes",
+    "name": "Feedback to Roadmap Themes",
+    "description": "Turns a pile of customer feedback into ranked themes, one item at a time, so nothing is lost to a single oversized summary."
+  },
+  "parameters": [
+    { "name": "feedback", "type": "string", "required": true, "multiline": true, "description": "Paste the feedback - one item per line (a ticket, review, or survey comment each)." }
+  ],
+  "nodes": [
+    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": { "label": "Start", "triggerType": "manual" } },
+    { "id": "each", "type": "loop", "position": { "x": 0, "y": 200 }, "data": { "label": "Classify each item", "loopType": "for-each", "items": "{{ feedback }}", "arraySource": "{{ feedback }}", "itemVariable": "entry", "body": ["classify"], "onComplete": "gather", "maxIterations": 60 } },
+    { "id": "classify", "type": "prompt", "parentId": "each", "position": { "x": 260, "y": 200 }, "data": { "label": "Classify one item", "sourceType": "raw", "source": "", "rawPrompt": "Classify this single piece of customer feedback.\\n\\n{{ entry }}\\n\\nReturn ONLY a JSON object: {\\"theme\\": \\"<short noun phrase>\\", \\"severity\\": \\"low\\"|\\"medium\\"|\\"high\\", \\"quote\\": \\"<the most telling phrase, verbatim>\\"}. Use the customer's own framing for the theme. If the item says nothing actionable, use the theme \\"none\\"." } },
+    { "id": "gather", "type": "transformer", "position": { "x": 0, "y": 320 }, "data": { "label": "Gather classifications", "mode": "template", "template": "CLASSIFIED FEEDBACK\\n\\n{{ each }}" } },
+    { "id": "cluster", "type": "prompt", "position": { "x": 0, "y": 420 }, "data": { "label": "Cluster and rank", "sourceType": "raw", "source": "", "rawPrompt": "Merge the classifications below into themes and rank them.\\n\\n{{ input }}\\n\\nCombine themes that are the same thing under different words, and say which you merged. Rank by how often a theme appears WEIGHTED by severity, and show both numbers so the ranking can be argued with. Drop \\"none\\". For each theme give one verbatim customer quote.\\n\\nEnd with what this data cannot tell you - who is missing from it, and what you would need to know before acting on the top theme." } },
+    { "id": "out", "type": "output", "position": { "x": 0, "y": 520 }, "data": { "label": "Themes" } }
+  ],
+  "edges": [
+    { "id": "e2", "source": "start", "target": "each" },
+    { "id": "e3", "source": "gather", "target": "cluster" },
+    { "id": "e4", "source": "cluster", "target": "out" }
+  ]
+}
+`,
+  "workflows/marketing-strategy-pipeline/workflow.pdflow": `{
+  "version": "1.0",
+  "metadata": {
+    "id": "marketing-strategy-pipeline",
+    "name": "Marketing Strategy Pipeline",
+    "description": "Researches audience, messaging and channel for a product brief in parallel, then turns the three passes into one strategy."
+  },
+  "parameters": [
+    { "name": "brief", "type": "string", "required": true, "multiline": true, "description": "The product or service this strategy is for - yours or a competitor's - and who you think it is for. The more concrete this is, the less the research has to guess at." }
+  ],
+  "nodes": [
+    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": { "label": "Start", "triggerType": "manual" } },
+    { "id": "angles", "type": "parallel", "position": { "x": 220, "y": 0 }, "data": { "label": "Research the three angles", "mode": "fork", "branches": [ { "id": "angles-b1", "label": "Audience", "nodes": ["audience_pass"] }, { "id": "angles-b2", "label": "Messaging", "nodes": ["messaging_pass"] }, { "id": "angles-b3", "label": "Channel", "nodes": ["channel_pass"] } ], "forkCount": 3, "forkLabels": ["Audience", "Messaging", "Channel"], "waitFor": "all", "mergeStrategy": "object", "maxConcurrency": 3 } },
+    { "id": "collect", "type": "transformer", "position": { "x": 440, "y": 0 }, "data": { "label": "Gather the passes", "mode": "template", "template": "AUDIENCE\\n\\n{{ audience_pass }}\\n\\nMESSAGING\\n\\n{{ messaging_pass }}\\n\\nCHANNEL\\n\\n{{ channel_pass }}\\n\\nORIGINAL BRIEF\\n\\n{{ brief }}" } },
+    { "id": "strategy", "type": "prompt", "position": { "x": 660, "y": 0 }, "data": { "label": "Write the strategy", "sourceType": "raw", "source": "", "rawPrompt": "Turn the research below into a marketing strategy.\\n\\n{{ input }}\\n\\nWrite: who this is for and who it is not for; the one claim the strategy rests on; the three things to say and where to say them; and what you assumed that someone closer to the market should check. Do not pad. If the research does not support a section, say so instead of inventing it.\\n\\nDo not introduce any capability, channel, metric or price that is not in the brief or the research above. Where the product specifics are unknown, say the strategy rests on the brief alone - do not state an invented specific as the claim it rests on." } },
+    { "id": "out", "type": "output", "position": { "x": 880, "y": 0 }, "data": { "label": "Strategy" } },
+    { "id": "audience_pass", "type": "prompt", "position": { "x": 280, "y": -90 }, "data": { "label": "Audience research", "sourceType": "raw", "source": "", "rawPrompt": "You are researching the AUDIENCE angle of a marketing strategy.\\n\\nProduct brief:\\n{{ brief }}\\n\\nWho specifically is this for, what are they trying to get done, and what are they doing instead today?\\n\\nSearch for whatever helps, including the product itself - researching a competitor or a named product is a normal use of this. Finding little about it is also a normal result: say so and work from the brief alone.\\n\\nEvery capability, channel, metric or price you state must come from the brief or from a source you found. If you have neither, say that plainly. Never fill the gap by inferring what a product like this usually does - a plausible category is not evidence.\\n\\nMark anything you inferred rather than found. Be concrete and brief - at most 250 words." } },
+    { "id": "messaging_pass", "type": "prompt", "position": { "x": 280, "y": 0 }, "data": { "label": "Messaging research", "sourceType": "raw", "source": "", "rawPrompt": "You are researching the MESSAGING angle of a marketing strategy.\\n\\nProduct brief:\\n{{ brief }}\\n\\nWhat do these people already believe, and what specific claim would move them? Say what the product is NOT for.\\n\\nSearch for whatever helps, including the product itself - researching a competitor or a named product is a normal use of this. Finding little about it is also a normal result: say so and work from the brief alone.\\n\\nEvery capability, channel, metric or price you state must come from the brief or from a source you found. If you have neither, say that plainly. Never fill the gap by inferring what a product like this usually does - a plausible category is not evidence.\\n\\nMark anything you inferred rather than found. Be concrete and brief - at most 250 words." } },
+    { "id": "channel_pass", "type": "prompt", "position": { "x": 280, "y": 90 }, "data": { "label": "Channel research", "sourceType": "raw", "source": "", "rawPrompt": "You are researching the CHANNEL angle of a marketing strategy.\\n\\nProduct brief:\\n{{ brief }}\\n\\nWhere does this audience already look for answers, and what format earns their attention there?\\n\\nSearch for whatever helps, including the product itself - researching a competitor or a named product is a normal use of this. Finding little about it is also a normal result: say so and work from the brief alone.\\n\\nEvery capability, channel, metric or price you state must come from the brief or from a source you found. If you have neither, say that plainly. Never fill the gap by inferring what a product like this usually does - a plausible category is not evidence.\\n\\nMark anything you inferred rather than found. Be concrete and brief - at most 250 words." } }
+  ],
+  "edges": [
+    { "id": "e-start-angles", "source": "start", "target": "angles" },
+    { "id": "e-angles-audience_pass-f0", "source": "angles", "target": "audience_pass", "sourceHandle": "fork-0", "label": "Audience" },
+    { "id": "e-audience_pass-collect-f0", "source": "audience_pass", "target": "collect", "targetHandle": "input-0" },
+    { "id": "e-angles-messaging_pass-f1", "source": "angles", "target": "messaging_pass", "sourceHandle": "fork-1", "label": "Messaging" },
+    { "id": "e-messaging_pass-collect-f1", "source": "messaging_pass", "target": "collect", "targetHandle": "input-1" },
+    { "id": "e-angles-channel_pass-f2", "source": "angles", "target": "channel_pass", "sourceHandle": "fork-2", "label": "Channel" },
+    { "id": "e-channel_pass-collect-f2", "source": "channel_pass", "target": "collect", "targetHandle": "input-2" },
+    { "id": "e-collect-strategy", "source": "collect", "target": "strategy" },
+    { "id": "e-strategy-out", "source": "strategy", "target": "out" }
+  ]
+}
+`,
+  "workflows/research-pipeline/workflow.pdflow": '{\n  "version": "1.0",\n  "metadata": {\n    "id": "research-pipeline",\n    "name": "Research Pipeline",\n    "description": "Breaks a question into sub-questions, researches each one, then synthesizes an answer that must cite its sources."\n  },\n  "parameters": [\n    { "name": "question", "type": "string", "required": true, "multiline": true, "description": "What do you want researched? One question, as specific as you can make it." }\n  ],\n  "nodes": [\n    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": { "label": "Start", "triggerType": "manual" } },\n    { "id": "decompose", "type": "prompt", "position": { "x": 0, "y": 200 }, "data": { "label": "Break it down", "sourceType": "raw", "source": "", "rawPrompt": "Break this research question into between three and six sub-questions that together answer it. Each must be answerable on its own and worth answering separately.\\n\\nQuestion: {{ question }}\\n\\nReturn ONLY a JSON array of strings. No commentary, no code fence." } },\n    { "id": "each", "type": "loop", "position": { "x": 0, "y": 300 }, "data": { "label": "Research each sub-question", "loopType": "for-each", "items": "{{ decompose }}", "arraySource": "{{ decompose }}", "itemVariable": "subq", "body": ["sub_pass"], "onComplete": "gather", "maxIterations": 6 } },\n    { "id": "sub_pass", "type": "agent", "parentId": "each", "position": { "x": 260, "y": 300 }, "data": { "label": "Answer one sub-question", "systemPrompt": "You research one narrow question at a time. Search before answering, and search more than once - one query returns one neighbourhood of an argument. Attribute every load-bearing claim to a source with its date. Separate what the sources support from what you inferred. If the evidence is thin, say so; that is a finding.", "userPrompt": "Sub-question: {{ subq }}\\n\\nContext - the overall question being researched: {{ question }}\\n\\nAnswer in at most 250 words, with sources.", "maxIterations": 6, "outputMode": "final-response" } },\n    { "id": "sub_tools", "type": "tool", "position": { "x": 520, "y": 300 }, "data": { "label": "Search", "attachedTo": "sub_pass", "tools": ["web_search"] } },\n    { "id": "gather", "type": "transformer", "position": { "x": 0, "y": 420 }, "data": { "label": "Gather findings", "mode": "template", "template": "ORIGINAL QUESTION\\n{{ question }}\\n\\nSUB-QUESTIONS\\n{{ decompose }}\\n\\nFINDINGS\\n{{ each }}" } },\n    { "id": "synthesize", "type": "prompt", "position": { "x": 0, "y": 520 }, "data": { "label": "Synthesize", "sourceType": "raw", "source": "", "rawPrompt": "Write the answer to the original question from the findings below.\\n\\n{{ input }}\\n\\nLead with the answer. Attribute every load-bearing claim to its source. Where findings disagree, report the disagreement rather than picking a winner silently. Mark inferences as inferences. End with how confident you are and what would change your mind." } },\n    { "id": "sourced", "type": "guardrail", "position": { "x": 0, "y": 620 }, "data": { "label": "Sources present", "systemPrompt": "You are checking one thing: does the text below attribute its load-bearing factual claims to named sources? A synthesis that reads as confident but cites nothing FAILS. Inferences that are explicitly marked as inferences are acceptable and do not need a source.\\n\\nReply with JSON only: {\\"pass\\": true} or {\\"pass\\": false, \\"reason\\": \\"<one sentence>\\"}.", "passExpression": "{{ pass }}" } },\n    { "id": "out", "type": "output", "position": { "x": 0, "y": 720 }, "data": { "label": "Answer" } }\n  ],\n  "edges": [\n    { "id": "e2", "source": "start", "target": "decompose" },\n    { "id": "e3", "source": "decompose", "target": "each" },\n    { "id": "e4", "source": "gather", "target": "synthesize" },\n    { "id": "e5", "source": "synthesize", "target": "sourced" },\n    { "id": "e6", "source": "sourced", "target": "out" }\n  ]\n}\n',
+  "workflows/rfp-questionnaire-response/workflow.pdflow": `{
+  "version": "1.0",
+  "metadata": {
+    "id": "rfp-questionnaire-response",
+    "name": "RFP / Questionnaire Response",
+    "description": "Extracts every question from an RFP or vendor questionnaire, drafts each answer from your own documents, and refuses to claim anything the documents do not support."
+  },
+  "parameters": [
+    { "name": "doc", "type": "string", "required": true, "multiline": true, "description": "Paste the RFP or questionnaire text." }
+  ],
+  "nodes": [
+    { "id": "start", "type": "trigger", "position": { "x": 0, "y": 0 }, "data": { "label": "Start", "triggerType": "manual" } },
+    { "id": "extract", "type": "prompt", "position": { "x": 0, "y": 200 }, "data": { "label": "Extract the questions", "sourceType": "raw", "source": "", "rawPrompt": "Extract every question that requires an answer from the document below. Keep each question's original wording. Do not merge, reorder or invent questions.\\n\\n{{ doc }}\\n\\nReturn ONLY a JSON array of strings. No commentary, no code fence." } },
+    { "id": "each", "type": "loop", "position": { "x": 0, "y": 300 }, "data": { "label": "Answer each question", "loopType": "for-each", "items": "{{ extract }}", "arraySource": "{{ extract }}", "itemVariable": "q", "body": ["answer"], "onComplete": "assemble", "maxIterations": 40 } },
+    { "id": "answer", "type": "agent", "parentId": "each", "position": { "x": 260, "y": 300 }, "data": { "label": "Draft one answer", "systemPrompt": "You draft answers to procurement and security questionnaires, grounded ONLY in the documents available to you in this workspace. Search the workspace before answering. Quote or reference the document that supports each claim. If you cannot find support for a capability, say plainly that it is not evidenced here and describe what would be needed to answer - never write a plausible answer to fill the gap. An unanswered question is recoverable; a false claim in a binding document is not.", "userPrompt": "Question: {{ q }}\\n\\nDraft the answer, then on a final line state either SUPPORTED (with the document you relied on) or UNSUPPORTED.", "maxIterations": 8, "outputMode": "final-response" } },
+    { "id": "answer_tools", "type": "tool", "position": { "x": 520, "y": 300 }, "data": { "label": "Read the workspace", "attachedTo": "answer", "tools": ["read_file", "list_files", "search_files", "stat_file"] } },
+    { "id": "assemble", "type": "transformer", "position": { "x": 0, "y": 420 }, "data": { "label": "Assemble", "mode": "template", "template": "DRAFT RESPONSE\\n\\n{{ each }}" } },
+    { "id": "no_overclaim", "type": "guardrail", "position": { "x": 0, "y": 520 }, "data": { "label": "No unsupported claims", "systemPrompt": "You are checking a draft questionnaire response for claims that its own evidence does not support. An answer marked UNSUPPORTED that honestly says so is FINE and must pass. An answer that asserts a capability, certification or control while showing no supporting document FAILS.\\n\\nReply with JSON only: {\\"pass\\": true} or {\\"pass\\": false, \\"reason\\": \\"<which answer and why>\\"}.", "passExpression": "{{ pass }}" } },
+    { "id": "final", "type": "prompt", "position": { "x": 0, "y": 620 }, "data": { "label": "Response and gap list", "sourceType": "raw", "source": "", "rawPrompt": "Produce two sections from the draft below.\\n\\n{{ input }}\\n\\nFirst: the response, question by question, using only the supported answers.\\nSecond: a gap list of every question marked UNSUPPORTED, each with what evidence would be needed to answer it. Do not soften the gap list - it is the part a human must act on." } },
+    { "id": "out", "type": "output", "position": { "x": 0, "y": 720 }, "data": { "label": "Response" } }
+  ],
+  "edges": [
+    { "id": "e2", "source": "start", "target": "extract" },
+    { "id": "e3", "source": "extract", "target": "each" },
+    { "id": "e4", "source": "assemble", "target": "no_overclaim" },
+    { "id": "e5", "source": "no_overclaim", "target": "final" },
+    { "id": "e6", "source": "final", "target": "out" }
+  ]
+}
+`
 };
 
 // ../harness/prompts/library/index.ts
@@ -32437,6 +32807,8 @@ function makeCrewTurnRuntime(opts) {
         policy,
         permission,
         ...deps.maxTurns !== void 0 ? { maxTurns: deps.maxTurns } : {},
+        ...deps.compression ? { compression: deps.compression } : {},
+        ...deps.compaction ? { compaction: deps.compaction } : {},
         ...deps.temperature !== void 0 ? { temperature: deps.temperature } : {},
         ...deps.describePermissionDenial ? { describePermissionDenial: deps.describePermissionDenial } : {},
         signal: mergeSignals(deps.toolCtx.signal, turnAbort.signal),
@@ -32452,7 +32824,7 @@ function makeCrewTurnRuntime(opts) {
           deps.onEvent?.(e2);
         }
       });
-      const produced = result.messages.slice(input.transcript.length);
+      const produced = result.messages.slice(result.messages.length - result.appended);
       const inputTokens = result.usage.promptTokens ?? 0;
       const outputTokens = result.usage.completionTokens ?? 0;
       const ceilingAborted = turnAbort.signal.aborted;
@@ -33325,7 +33697,7 @@ var LineSplitter = class {
 init_fileService();
 
 // src/session/msb.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 var DEFAULT_LIMITS = {
   cpus: 1,
   memory: "512M",
@@ -33372,7 +33744,7 @@ function wslHostPath(p2) {
 function makeMsbStreamer(bin, wrap) {
   return (args, onLine, opts) => {
     const { cmd, argv } = wrap ? wrap(args) : { cmd: bin, argv: args };
-    const child = spawn3(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const out = new LineSplitter();
     const err = new LineSplitter();
     let stderrText = "";
@@ -33423,7 +33795,7 @@ function wslMsb(bin) {
 function makeMsbRunner(bin, wrap) {
   return (args, opts) => new Promise((resolveRun) => {
     const { cmd, argv } = wrap ? wrap(args) : { cmd: bin, argv: args };
-    const child = spawn3(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let settled = false;
@@ -34164,17 +34536,17 @@ function makeGuestRunner(deps) {
 }
 
 // src/session/sessionsPort.ts
-function toInfo(h2, backend) {
+function toInfo(h2, backend2) {
   return {
     id: h2.id,
     status: h2.status,
     workdir: h2.workdir,
     createdAt: h2.createdAt,
     ...h2.owner ? { owner: h2.owner } : {},
-    isolated: backend.isolation !== "none",
-    kind: backend.kind,
+    isolated: backend2.isolation !== "none",
+    kind: backend2.kind,
     // Feature-detected once, here, rather than by a client calling and failing.
-    canCapture: !!backend.commit,
+    canCapture: !!backend2.commit,
     // Read from the HANDLE, so it survives every later list() — and, on the
     // microVM backend, a daemon restart, since the sandbox carries it in its
     // own labels.
@@ -34185,9 +34557,9 @@ function toInfo(h2, backend) {
   };
 }
 function makeSessionsPort(deps) {
-  const { manager, backend } = deps;
+  const { manager, backend: backend2 } = deps;
   return {
-    list: () => manager.list().map((h2) => toInfo(h2, backend)),
+    list: () => manager.list().map((h2) => toInfo(h2, backend2)),
     async create(spec) {
       let source;
       let workdir = spec.workdir;
@@ -34221,7 +34593,7 @@ function makeSessionsPort(deps) {
         ...spec.stateDir ? { stateDir: spec.stateDir } : {},
         ...env && Object.keys(env).length ? { env } : {}
       });
-      return { ...toInfo(h2, backend), ...source ? { source } : {} };
+      return { ...toInfo(h2, backend2), ...source ? { source } : {} };
     },
     canClone: deps.git?.enabled === true && deps.approveCheckout !== void 0,
     /* Straight through to the manager, which is where admission and the
@@ -34239,9 +34611,9 @@ function makeSessionsPort(deps) {
      * client feature-detects by asking rather than by calling and failing. A
      * process-backed session genuinely cannot capture or stream, and saying so
      * up front is better than an error at the moment someone tries. */
-    ...backend.commit ? {
+    ...backend2.commit ? {
       commit: async (id, name) => {
-        const snap = await backend.commit(id, name);
+        const snap = await backend2.commit(id, name);
         return {
           name: snap.name,
           createdAt: snap.createdAt,
@@ -34249,26 +34621,26 @@ function makeSessionsPort(deps) {
         };
       }
     } : {},
-    ...backend.snapshots ? {
-      snapshots: async () => (await backend.snapshots()).map((s2) => ({
+    ...backend2.snapshots ? {
+      snapshots: async () => (await backend2.snapshots()).map((s2) => ({
         name: s2.name,
         createdAt: s2.createdAt,
         ...s2.sessionId ? { sessionId: s2.sessionId } : {},
         ...s2.sizeBytes !== void 0 ? { sizeBytes: s2.sizeBytes } : {}
       }))
     } : {},
-    ...backend.snapshotUsage ? {
-      snapshotUsage: () => backend.snapshotUsage()
+    ...backend2.snapshotUsage ? {
+      snapshotUsage: () => backend2.snapshotUsage()
     } : {},
-    ...backend.metrics ? {
+    ...backend2.metrics ? {
       watchMetrics: (id, onSample) => {
-        const st2 = backend.metrics(id, onSample);
+        const st2 = backend2.metrics(id, onSample);
         return () => st2.stop();
       }
     } : {},
-    ...backend.logs ? {
+    ...backend2.logs ? {
       watchLogs: (id, onLine) => {
-        const st2 = backend.logs(id, onLine);
+        const st2 = backend2.logs(id, onLine);
         return () => st2.stop();
       }
     } : {}
@@ -34291,16 +34663,16 @@ function portExtras(opts) {
 }
 async function wireSessions(opts) {
   if (opts.isolation === "none") {
-    const backend2 = makeProcessBackend({ roots: opts.roots, ...opts.log ? { log: opts.log } : {} });
+    const backend3 = makeProcessBackend({ roots: opts.roots, ...opts.log ? { log: opts.log } : {} });
     opts.log?.("sessions: isolation none (runs execute in the daemon process)");
     const manager2 = new SessionManager({
-      backend: backend2,
+      backend: backend3,
       runner: opts.runner,
       ...opts.recordRun ? { recordRun: opts.recordRun } : {},
       ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
       ...opts.log ? { log: opts.log } : {}
     });
-    return { manager: manager2, backend: backend2, port: makeSessionsPort({ manager: manager2, backend: backend2, guestEnv, ...portExtras(opts) }) };
+    return { manager: manager2, backend: backend3, port: makeSessionsPort({ manager: manager2, backend: backend3, guestEnv, ...portExtras(opts) }) };
   }
   const viaWsl = process.platform === "win32";
   const makeRunner = opts.makeRunner ?? ((bin) => makeMsbRunner(bin, viaWsl ? wslMsb(bin) : void 0));
@@ -34313,7 +34685,7 @@ async function wireSessions(opts) {
   On Windows msb runs inside WSL2 \u2014 there is no native build \u2014 so the daemon must run there too.`
     );
   }
-  const backend = makeMicrovmBackend({
+  const backend2 = makeMicrovmBackend({
     roots: opts.roots,
     run,
     stream: makeMsbStreamer(opts.msbBin, viaWsl ? wslMsb(opts.msbBin) : void 0),
@@ -34324,14 +34696,14 @@ async function wireSessions(opts) {
     ...opts.log ? { log: opts.log } : {}
   });
   const manager = new SessionManager({
-    backend,
+    backend: backend2,
     runner: opts.runner,
     ...opts.recordRun ? { recordRun: opts.recordRun } : {},
     ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
     // One runner per session, built on demand: the manager knows which session a
     // run belongs to, so nothing has to infer it.
     guestRunnerFor: (sessionId, guestOpts) => makeGuestRunner({
-      backend,
+      backend: backend2,
       sessionId: () => sessionId,
       allowMutations: guestOpts.allowMutations,
       ...opts.log ? { log: opts.log } : {}
@@ -34339,19 +34711,19 @@ async function wireSessions(opts) {
     ...opts.log ? { log: opts.log } : {}
   });
   opts.log?.(`sessions: isolation microvm via ${version} (image ${opts.image})`);
-  await backend.adopt?.().catch((e2) => {
+  await backend2.adopt?.().catch((e2) => {
     opts.log?.(`sessions: adoption failed (${e2 instanceof Error ? e2.message : String(e2)}) \u2014 starting with none adopted`);
   });
-  return { manager, backend, port: makeSessionsPort({ manager, backend, guestEnv, ...portExtras(opts) }) };
+  return { manager, backend: backend2, port: makeSessionsPort({ manager, backend: backend2, guestEnv, ...portExtras(opts) }) };
 }
 
 // src/runner/crewSessions.ts
 function makeCrewSessions(src2, opts) {
   if (!src2?.manager.isolated) return void 0;
-  const { manager, backend } = src2;
+  const { manager, backend: backend2 } = src2;
   return {
-    list: () => backend.list(),
-    adopt: () => backend.adopt?.() ?? Promise.resolve(void 0),
+    list: () => backend2.list(),
+    adopt: () => backend2.adopt?.() ?? Promise.resolve(void 0),
     create: async (spec) => {
       const env = await opts.guestEnv().catch(() => ({}));
       return manager.create({
@@ -34367,15 +34739,15 @@ function makeCrewSessions(src2, opts) {
 
 // src/runner/owners.ts
 init_tools_node();
-import { readdir, readFile } from "node:fs/promises";
+import { readdir, readFile as readFile2 } from "node:fs/promises";
 import { createHash as createHash2 } from "node:crypto";
-import { join as join8, resolve as resolve6 } from "node:path";
+import { join as join9, resolve as resolve6 } from "node:path";
 init_protocol();
 
 // src/hostsDir.ts
 init_tools_node();
 init_protocol();
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var HOSTS_SEG = "hosts";
 var MAX_SYNC_PATH_LEN = 400;
 var MAX_SYNC_SEGMENTS = 24;
@@ -34397,11 +34769,11 @@ function assertSyncPath(path) {
   }
 }
 function hostsRoot(stateDir) {
-  return join7(stateDir, "sidecar", HOSTS_SEG);
+  return join8(stateDir, "sidecar", HOSTS_SEG);
 }
 function hostsDirFor(stateDir, dirName2) {
   if (!DIR_NAME_RE.test(dirName2)) throw new Error(`invalid host dir name: ${dirName2}`);
-  return join7(hostsRoot(stateDir), dirName2);
+  return join8(hostsRoot(stateDir), dirName2);
 }
 var RAW = /* @__PURE__ */ new WeakMap();
 function hostFilesFor(stateDir, dirName2) {
@@ -34441,7 +34813,7 @@ var WORKSPACE_ID_RE = /^[a-z0-9_-]{1,32}$/;
 async function workspaceRootsFor(dirName2, hostDir) {
   let entries;
   try {
-    entries = await readdir(join8(hostDir, WORKSPACES_SEG), { withFileTypes: true });
+    entries = await readdir(join9(hostDir, WORKSPACES_SEG), { withFileTypes: true });
   } catch {
     return [];
   }
@@ -34449,7 +34821,7 @@ async function workspaceRootsFor(dirName2, hostDir) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (!WORKSPACE_ID_RE.test(entry.name)) continue;
-    const wsDir = join8(hostDir, WORKSPACES_SEG, entry.name);
+    const wsDir = join9(hostDir, WORKSPACES_SEG, entry.name);
     out.push({
       owner: `${dirName2}/ws/${entry.name}`,
       files: new NodeFileService(wsDir),
@@ -34462,7 +34834,7 @@ async function workspaceRootsFor(dirName2, hostDir) {
 async function readCrewOptIn(root, dotDir = stateDirName()) {
   let raw;
   try {
-    raw = await readFile(join8(root, dotDir, CREW_OPT_IN_FILE), "utf8");
+    raw = await readFile2(join9(root, dotDir, CREW_OPT_IN_FILE), "utf8");
   } catch {
     return null;
   }
@@ -34570,8 +34942,8 @@ async function listOwnerRoots(stateDir, workRoots = [], dotDir = stateDirName())
 }
 
 // src/crewDeployment.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 function splitOwner(owner) {
   if (owner === "") return void 0;
   const parts = owner.split("/");
@@ -34584,7 +34956,7 @@ async function deployedRoot(stateDir, owner, agent) {
   if (!parts) return void 0;
   let text;
   try {
-    text = await readFile2(join9(hostsDirFor(stateDir, parts.dirName), DEPLOYMENT_FILE), "utf8");
+    text = await readFile3(join10(hostsDirFor(stateDir, parts.dirName), DEPLOYMENT_FILE), "utf8");
   } catch {
     return void 0;
   }
@@ -34597,7 +34969,7 @@ init_tools_node();
 // src/cert.ts
 import { promises as fs9 } from "node:fs";
 import { networkInterfaces as networkInterfaces2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import selfsigned from "selfsigned";
 function lanIPv4s() {
   const out = [];
@@ -34608,9 +34980,9 @@ function lanIPv4s() {
   }
   return [...new Set(out)];
 }
-var certPath = () => join10(sidecarSubdir(), "sidecar.crt");
-var keyPath = () => join10(sidecarSubdir(), "sidecar.key");
-var sansPath = () => join10(sidecarSubdir(), "sidecar.sans.json");
+var certPath = () => join11(sidecarSubdir(), "sidecar.crt");
+var keyPath = () => join11(sidecarSubdir(), "sidecar.key");
+var sansPath = () => join11(sidecarSubdir(), "sidecar.sans.json");
 function selfSignedPaths() {
   return { cert: certPath(), key: keyPath() };
 }
@@ -34682,7 +35054,7 @@ function tunnelIds() {
 }
 
 // src/tunnel/zrok.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 function extractShareUrl(s2) {
   const full = s2.match(/https?:\/\/[A-Za-z0-9.-]+(?::\d+)?(?:\/[^\s"'\\]*)?/);
   if (full) return full[0];
@@ -34728,7 +35100,7 @@ function stopChild(child) {
 }
 function reserveName(bin, name) {
   return new Promise((res, rej) => {
-    const child = spawn4(bin, ["create", "name", name], { stdio: ["ignore", "ignore", "ignore"] });
+    const child = spawn5(bin, ["create", "name", name], { stdio: ["ignore", "ignore", "ignore"] });
     let settled = false;
     const done = (fn) => {
       if (settled) return;
@@ -34750,7 +35122,7 @@ function reserveName(bin, name) {
 async function startWith(bin, port, name) {
   if (name) await reserveName(bin, name);
   return new Promise((resolveHandle, reject) => {
-    const child = spawn4(bin, shareArgs(port, name), { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(bin, shareArgs(port, name), { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let settled = false;
     const finish = (fn) => {
@@ -34799,7 +35171,7 @@ var zrokProvider = {
 };
 
 // src/tunnel/cloudflared.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 function extractTunnelUrl(s2) {
   const m2 = s2.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i);
   return m2 ? m2[0] : null;
@@ -34853,7 +35225,7 @@ function stopChild2(child) {
 }
 function startWith2(bin, mode, log, onDown) {
   return new Promise((resolveHandle, reject) => {
-    const child = spawn5(bin, mode.argv, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn6(bin, mode.argv, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let settled = false;
     let tailBuf = "";
@@ -35022,7 +35394,7 @@ async function superviseTunnel(opts) {
 // src/runner/runnerService.ts
 init_protocol();
 init_tools_node();
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/runner/location.ts
 init_tools_node();
@@ -41781,7 +42153,7 @@ function nodeGatewayClient(endpoint, stateDir) {
 }
 
 // src/runner/executor.ts
-import { mkdir } from "node:fs/promises";
+import { mkdir as mkdir2 } from "node:fs/promises";
 
 // ../harness/core/recovery.ts
 var DEFAULT_RECOVERY = {
@@ -41995,6 +42367,93 @@ function formatOffloadRef(ref) {
 ${ref.preview}${ref.bytes > ref.preview.length ? "\n\u2026(truncated)" : ""}` : head;
 }
 
+// ../harness/core/compactHistory.ts
+var CHECKPOINT_MARKER = "[checkpoint] ";
+var ANCHOR_MARKER = "[anchor] ";
+var COMPACT_AT_FILL = 0.86;
+function shouldCompact(fill, messages) {
+  if (fill < COMPACT_AT_FILL) return false;
+  return messages.some((m2) => m2.role !== "system" && m2.role !== "user");
+}
+var REARM_BELOW_FILL = 0.6;
+var REARM_ON_REGROWTH = 0.1;
+function afterCompaction() {
+  return { armed: false, floor: null };
+}
+function messageChars(m2) {
+  let n2 = 0;
+  const content = m2.content;
+  if (typeof content === "string") n2 += content.length;
+  else if (Array.isArray(content)) {
+    for (const part of content) {
+      const text = part.text;
+      if (typeof text === "string") n2 += text.length;
+    }
+  }
+  const calls = m2.tool_calls;
+  if (Array.isArray(calls)) {
+    for (const c2 of calls) n2 += (c2.function?.name?.length ?? 0) + (c2.function?.arguments?.length ?? 0);
+  }
+  return n2;
+}
+function estimateFill(messages, contextWindow) {
+  if (!contextWindow || contextWindow <= 0) return 0;
+  let chars = 0;
+  for (const m2 of messages) chars += messageChars(m2);
+  return Math.min(1, chars / 4 / contextWindow);
+}
+function compactionDecision(fill, messages, gate) {
+  if (!gate.armed) {
+    const drained = fill < REARM_BELOW_FILL;
+    const regrown = gate.floor !== null && fill >= gate.floor + REARM_ON_REGROWTH;
+    return { compact: false, next: { ...gate, armed: drained || regrown } };
+  }
+  if (!shouldCompact(fill, messages)) return { compact: false, next: gate };
+  return { compact: true, next: afterCompaction() };
+}
+async function compactHistory(messages, opts) {
+  const tail3 = messages.length ? messages[messages.length - 1] : void 0;
+  const pending = tail3 && isUnansweredToolCall(tail3) ? tail3 : null;
+  const body2 = pending ? messages.slice(0, -1) : messages;
+  const system = body2.filter((m2) => m2.role === "system");
+  const collapsed = body2.filter((m2) => m2.role !== "system" && m2.role !== "user");
+  const kept = [];
+  let answered = null;
+  for (const m2 of body2) {
+    if (isOwnMarker(m2)) continue;
+    if (m2.role === "assistant" && typeof m2.content === "string") answered = m2;
+    if (m2.role !== "user") continue;
+    if (opts.anchor) {
+      kept.push({ role: "assistant", content: `${ANCHOR_MARKER}${await opts.anchor(m2, answered)}` });
+    }
+    kept.push(await offloadIfOversized(m2, opts));
+  }
+  const summary = await opts.summarize(collapsed);
+  return {
+    messages: [
+      ...system,
+      { role: "assistant", content: `${CHECKPOINT_MARKER}${summary}` },
+      ...kept,
+      ...pending ? [pending] : []
+    ],
+    checkpoint: summary
+  };
+}
+async function offloadIfOversized(m2, opts) {
+  const limit2 = opts.offloadOverBytes;
+  if (!opts.offload || limit2 === void 0) return m2;
+  if (typeof m2.content !== "string" || m2.content.length <= limit2) return m2;
+  return { ...m2, content: await opts.offload(m2.content) };
+}
+var isCompactionMarker = isOwnMarker;
+function isOwnMarker(m2) {
+  if (m2.role !== "assistant" || typeof m2.content !== "string") return false;
+  return m2.content.startsWith(ANCHOR_MARKER) || m2.content.startsWith(CHECKPOINT_MARKER);
+}
+function isUnansweredToolCall(m2) {
+  return m2.role === "assistant" && Array.isArray(m2.tool_calls) && m2.tool_calls.length > 0;
+}
+
 // ../harness/prompts/toolsMarker.ts
 var TOOLS_MARKER = "\uE000PROMPD_TOOLS\uE000";
 function formatToolLines(tools) {
@@ -42115,6 +42574,7 @@ async function runAgent(args) {
   const ctxWindow = compression?.contextWindow;
   const compressionStrategy = compression?.strategy ?? "eager";
   let fill = 0;
+  let compactGate = { armed: true, floor: null };
   const deferredOffloads = [];
   const maxTurns = policy.maxTurns ?? args.maxTurns ?? 8;
   const signal = args.signal ?? new AbortController().signal;
@@ -42132,6 +42592,16 @@ async function runAgent(args) {
     turnAc?.abort();
   });
   const messages = [...args.messages];
+  const incoming = new Set(args.messages);
+  const appendedFromTail = () => {
+    let n2 = 0;
+    for (let i2 = messages.length - 1; i2 >= 0; i2--) {
+      const m2 = messages[i2];
+      if (incoming.has(m2) || m2.role === "system" || isCompactionMarker(m2)) break;
+      n2++;
+    }
+    return n2;
+  };
   const deferred = args.deferredTools ?? [];
   const loader = deferred.length ? createToolLoader({ deferred, loaded: args.loadedTools, onChange: (names) => emit({ type: "tools-loaded", names }) }) : null;
   const eager = loader ? [...tools, loader.searchTool] : tools;
@@ -42173,6 +42643,31 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
         emit({ type: "injected", content: typeof m2.content === "string" ? m2.content : "" });
       }
     }
+    const gateFill = fill || estimateFill(messages, ctxWindow);
+    const gate = compactionDecision(gateFill, messages, compactGate);
+    compactGate = gate.next;
+    if (args.compaction && gate.compact) {
+      const before = messages.length;
+      try {
+        const out = await compactHistory(messages, {
+          summarize: args.compaction.summarize,
+          anchor: args.compaction.anchor,
+          offloadOverBytes: compression && compression.mode !== "off" ? effectiveThreshold(compression.mode, gateFill) : void 0,
+          offload: toolCtx.recall ? async (content) => formatOffloadRef(await toolCtx.recall.record("user", content)) : void 0
+        });
+        messages.splice(0, messages.length, ...out.messages);
+        deferredOffloads.length = 0;
+        try {
+          await args.compaction.onCheckpoint?.(out.checkpoint);
+        } catch (e2) {
+          alog("checkpoint persist failed", e2 instanceof Error ? e2.message : String(e2));
+        }
+        emit({ type: "checkpoint", collapsed: before - messages.length, checkpoint: out.checkpoint });
+      } catch (e2) {
+        compactGate = { ...compactGate, armed: true };
+        alog("compaction failed", e2 instanceof Error ? e2.message : String(e2));
+      }
+    }
     gstate.turn = turn - 1;
     const turnGate = evaluateTurnStart(policy, gstate);
     if (!turnGate.ok) {
@@ -42267,6 +42762,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
     usage.completionTokens += streamed.usage.completionTokens;
     if (ctxWindow && ctxWindow > 0 && streamed.usage.promptTokens) {
       fill = Math.min(1, streamed.usage.promptTokens / ctxWindow);
+      if (!compactGate.armed && compactGate.floor === null) compactGate = { armed: false, floor: fill };
     }
     emit({ type: "usage", usage: streamed.usage });
     const assistantMsg = streamed.toolCalls.length ? {
@@ -42315,13 +42811,13 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
       }
       loader?.touch(tool.name);
       const address = toolAddress(tool);
-      const gate = evaluateToolCall(policy, gstate, { name: call.name, exists: true, address });
-      if (!gate.ok) {
-        const msg = `Blocked by policy "${policy.name}": ${gate.violation.message}`;
+      const gate2 = evaluateToolCall(policy, gstate, { name: call.name, exists: true, address });
+      if (!gate2.ok) {
+        const msg = `Blocked by policy "${policy.name}": ${gate2.violation.message}`;
         messages.push({ role: "tool", tool_call_id: call.id, content: `Error: ${msg}` });
-        emit({ type: "policy-violation", kind: gate.violation.kind, message: gate.violation.message, action: gate.action, tool: call.name });
+        emit({ type: "policy-violation", kind: gate2.violation.kind, message: gate2.violation.message, action: gate2.action, tool: call.name });
         emit({ type: "tool-result", id: call.id, name: call.name, result: msg, isError: true });
-        if (gate.action === "stop") {
+        if (gate2.action === "stop") {
           policyStop = true;
           break;
         }
@@ -42404,7 +42900,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
   }
   alog("done", stopReason, "tokens", usage);
   emit({ type: "done", reason: stopReason });
-  return { messages, text, usage, stopReason };
+  return { messages, text, usage, stopReason, appended: appendedFromTail() };
 }
 async function compactIncomingOffloads(messages, toolByName, compression, recall, emit) {
   const nameForCallId = /* @__PURE__ */ new Map();
@@ -42490,8 +42986,29 @@ var JsonlSessionStore = class _JsonlSessionStore {
     if (!f2) throw new Error("No file workspace is connected \u2014 sessions are unavailable.");
     return f2;
   }
+  /* Sessions that have been MOVED out from under this store's root, id -> the
+   * root they now live in.
+   *
+   * A session can move mid-run: start_project offers to bring the conversation
+   * into the project it just created, and the run that asked is still writing.
+   * Without this, the next save() would resolve the OLD path and recreate the
+   * file there from its cursor -- the same conversation in two places, neither
+   * complete. The cursor itself survives the move untouched: it is keyed by id
+   * and holds the text, not the path.
+   *
+   * In memory only, and deliberately: it describes where a session went during
+   * THIS page's life. A reload lists both roots afresh and needs no memory of
+   * the journey. */
+  movedRoots = /* @__PURE__ */ new Map();
+  /** Resolve this id somewhere other than the store's own root, from now on. */
+  setRootFor(id, root) {
+    this.movedRoots.set(id, root);
+  }
+  rootFor(id) {
+    return this.movedRoots.get(id) ?? this.root();
+  }
   path(id) {
-    return `${this.root()}/${id}/SESSION.jsonl`;
+    return `${this.rootFor(id)}/${id}/SESSION.jsonl`;
   }
   async create(title, surface) {
     const createdAt = now();
@@ -42660,10 +43177,108 @@ var JsonlSessionStore = class _JsonlSessionStore {
   }
   async delete(id) {
     this.cursors.delete(id);
-    await (await this.files()).remove(`${this.root()}/${id}`).catch(() => {
+    await (await this.files()).remove(`${this.rootFor(id)}/${id}`).catch(() => {
+    });
+  }
+};
+
+// ../harness/sessions/checkpointStore.ts
+var CHECKPOINT_FILE = "CHECKPOINT.md";
+function makeCheckpointStore(getFiles, root) {
+  return {
+    async append(sessionId, body2) {
+      const files = await getFiles();
+      if (!files) return;
+      const path = `${root}/${sessionId}/${CHECKPOINT_FILE}`;
+      const entry = `## ${(/* @__PURE__ */ new Date()).toISOString()}
+
+${body2}
+`;
+      let existing = null;
+      try {
+        existing = await files.read(path);
+      } catch {
+        existing = null;
+      }
+      if (existing === null) {
+        await files.create(path, `# Checkpoints
+
+${entry}`);
+        return;
+      }
+      await files.write(path, `${existing}
+${entry}`);
+    }
+  };
+}
+
+// ../harness/core/summarize.ts
+var TRUNCATION_NOTE = " \u2026[truncated]";
+var MIN_KEEP = 200;
+var SUMMARY_INPUT_CHARS = 6e4;
+var SYSTEM = [
+  "You are compacting an agent conversation that is about to lose its middle.",
+  "Write a dense record of what was DECIDED and what the current state is:",
+  "conclusions reached, constraints the user set, files and artifacts touched,",
+  "and anything still open. Omit narration, pleasantries and tool mechanics.",
+  "Write plain prose or short bullets. No preamble."
+].join(" ");
+function makeSummarizer(client, model, opts = {}) {
+  const maxChars = opts.maxChars ?? SUMMARY_INPUT_CHARS;
+  return async (collapsed) => {
+    const rendered = renderTail(collapsed, maxChars);
+    const res = await client.chat.completions.create({
+      model,
+      messages: [
+        { role: "system", content: SYSTEM },
+        { role: "user", content: rendered }
+      ],
+      stream: false
     });
+    return res.choices[0]?.message?.content ?? "";
+  };
+}
+function renderTail(messages, maxChars) {
+  const lines = [];
+  let used = 0;
+  for (let i2 = messages.length - 1; i2 >= 0; i2--) {
+    const m2 = messages[i2];
+    const text = typeof m2.content === "string" ? m2.content : JSON.stringify(m2.content ?? "");
+    const line = `${m2.role}: ${text}`;
+    const room = maxChars - used;
+    if (line.length > room) {
+      if (room > MIN_KEEP) lines.unshift(line.slice(0, room - TRUNCATION_NOTE.length) + TRUNCATION_NOTE);
+      break;
+    }
+    lines.unshift(line);
+    used += line.length;
   }
+  return lines.join("\n\n");
+}
+
+// ../harness/providers/contextWindow.ts
+var KNOWN_WINDOWS = {
+  "claude-sonnet-4-5": 2e5,
+  "claude-haiku-4-5": 2e5,
+  "claude-opus-4-1": 2e5,
+  "gpt-4o-mini": 128e3,
+  "gpt-4.1-mini": 1e6,
+  "gpt-5": 4e5,
+  "gpt-5-mini": 4e5,
+  "gemini-2-5-pro": 1e6,
+  "gemini-2-5-flash": 1e6
 };
+var CONSERVATIVE_FALLBACK_WINDOW = 32e3;
+function stripDateSuffix(id) {
+  return id.replace(/-\d{4}-\d{2}-\d{2}$/, "").replace(/-\d{8}$/, "");
+}
+function resolveContextWindow(modelId) {
+  const id = modelId.trim().toLowerCase();
+  if (id in KNOWN_WINDOWS) return { window: KNOWN_WINDOWS[id], source: "known" };
+  const stripped = stripDateSuffix(id);
+  if (stripped in KNOWN_WINDOWS) return { window: KNOWN_WINDOWS[stripped], source: "known" };
+  return { window: CONSERVATIVE_FALLBACK_WINDOW, source: "fallback" };
+}
 
 // src/runner/runLog.ts
 function runLogPath(crewRoot2, agent) {
@@ -42792,7 +43407,7 @@ async function runCrewAgentNode(def, input, ctx, deps) {
   const signal = ctx.signal ?? new AbortController().signal;
   const resolveDef = crewResolveDef(ctx.stateFiles, ctx.stateRoot);
   const kernelTools = crewToolSet(def, resolveDef)();
-  await mkdir(ctx.memoryDir, { recursive: true });
+  await mkdir2(ctx.memoryDir, { recursive: true });
   const extraTools = deps.nodeTools([...ctx.workRoots, ctx.memoryDir]);
   const tools = [...kernelTools, ...extraTools];
   const conditionalOffers = [];
@@ -42894,6 +43509,21 @@ async function runCrewAgentNode(def, input, ctx, deps) {
     // different answer. Supplied only when no prompt is wired; with one, a real
     // person really did decide, and the default wording is correct.
     ...promptImpl ? {} : { describePermissionDenial: unattendedDenialMessage },
+    /* `mode: 'off'` with a real `contextWindow` reads oddly but is exactly what
+     * is wanted here: rung-1 offload stays off (this executor supplies no
+     * `toolCtx.recall`, so there is nowhere to offload TO), while the loop still
+     * computes `fill` — which is the only thing that lets it notice a window
+     * about to overflow. Without a window, `fill` is pinned at 0 and compaction
+     * below is dead code however well it is wired. */
+    compression: { mode: "off", contextWindow: resolveContextWindow(modelId).window },
+    /* Why the daemon in particular: these runs are unattended and long, so
+     * nobody is watching to notice the wall and restart. Before this, hitting
+     * it produced a provider 400 — fatal in recovery.ts, never retried — and
+     * the run simply died mid-task. */
+    compaction: {
+      summarize: makeSummarizer(ctx.client, modelId),
+      onCheckpoint: (body2) => makeCheckpointStore(() => ctx.stateFiles, sessionsRoot2).append(session.id, body2)
+    },
     signal: runSignal,
     onEvent
   });
@@ -43541,7 +44171,7 @@ var NodeRunnerService = class {
           workFiles,
           workRoots: [workDir],
           client: this.client,
-          memoryDir: join11(stateOwnerDir, stateRoot, agent, "memory"),
+          memoryDir: join12(stateOwnerDir, stateRoot, agent, "memory"),
           onEvent: trackedOnEvent,
           sessionId,
           signal: controller.signal,
@@ -43578,7 +44208,7 @@ var NodeRunnerService = class {
 // src/runner/core.ts
 import { watch } from "node:fs";
 import { readdir as readdir2, stat } from "node:fs/promises";
-import { join as join13, relative as relative6, sep as sep4 } from "node:path";
+import { join as join14, relative as relative6, sep as sep4 } from "node:path";
 
 // src/runner/triggerConfig.ts
 function inputFor(trigger, fallback) {
@@ -44531,8 +45161,8 @@ async function resumeOpenRooms(opts) {
 }
 
 // src/runner/roomDeps.ts
-import { mkdir as mkdir2 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { mkdir as mkdir3 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 
 // src/runner/roomAgentLookup.ts
 init_tools_node();
@@ -44632,11 +45262,11 @@ async function makeDaemonRoomDeps(ctx, room, deps = {}) {
         `cannot locate the memory folder for crew agent "${def.name}": this daemon has no state root for owner "${ctx.owner}"`
       );
     }
-    return join12(stateDir, agentMemoryRoot(ctx.stateRoot, def.name));
+    return join13(stateDir, agentMemoryRoot(ctx.stateRoot, def.name));
   }
   async function buildRuntime(def, p2, state, findings) {
     const memoryDir = memoryDirFor(def);
-    await mkdir2(memoryDir, { recursive: true });
+    await mkdir3(memoryDir, { recursive: true });
     const toolCtx = {
       signal: new AbortController().signal,
       memory: makeAgentMemoryProvider(() => ctx.stateFiles, agentMemoryRoot(ctx.stateRoot, def.name)),
@@ -44686,7 +45316,19 @@ async function makeDaemonRoomDeps(ctx, room, deps = {}) {
         // person really did decide and the default wording is correct.
         ...ctx.prompt ? {} : { describePermissionDenial: unattendedDenialMessage },
         ...ctx.now ? { now: ctx.now } : {},
-        ...ceilingUsd !== void 0 ? { turnCeilingUsd: ceilingUsd } : {}
+        ...ceilingUsd !== void 0 ? { turnCeilingUsd: ceilingUsd } : {},
+        /* A room is the likeliest place in the product to meet the context
+         * wall: every participant's turn is seeded with the WHOLE transcript,
+         * tool calls included, so cost grows with participants x turns. Before
+         * this, a room that filled the window died on a provider 400 -- fatal
+         * in recovery.ts -- and took the turn with it.
+         *
+         * `mode: 'off'` with a real window is the same trade `executor.ts`
+         * makes: rung-1 offload stays off (this toolCtx supplies no `recall`,
+         * so there is nowhere to offload to) while the loop still computes
+         * `fill`, which is the only thing that lets compaction fire. */
+        compression: { mode: "off", contextWindow: resolveContextWindow(modelId).window },
+        compaction: { summarize: makeSummarizer(ctx.client, modelId) }
       }
     });
   }
@@ -44932,9 +45574,9 @@ function startDaemonCore(opts) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (isExcludedSegment(entry.name, dotDir)) continue;
-        await walkForChanges(root, join13(dir, entry.name), since);
+        await walkForChanges(root, join14(dir, entry.name), since);
       } else {
-        const abs = join13(dir, entry.name);
+        const abs = join14(dir, entry.name);
         let mtimeMs;
         try {
           mtimeMs = (await stat(abs)).mtimeMs;
@@ -45246,9 +45888,9 @@ function makeRunHub(opts = {}) {
 import { promises as fs11 } from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { hostname } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function idPath(dir = sidecarSubdir()) {
-  return join14(dir, "daemon.id");
+  return join15(dir, "daemon.id");
 }
 async function loadOrCreateSidecarId(dir = sidecarSubdir()) {
   const path = idPath(dir);
@@ -45277,7 +45919,7 @@ function sidecarName(opts) {
 // src/hosts.ts
 import { promises as fs12 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { join as join15, dirname as dirname5 } from "node:path";
+import { join as join16, dirname as dirname6 } from "node:path";
 var MAX_DIR = 32;
 var MAX_FIELD_LEN = 200;
 var MAX_HOSTS = 200;
@@ -45311,7 +45953,7 @@ function sanitizeDirName(raw) {
   return RESERVED_WINDOWS_NAMES.has(safe) ? `${safe}-host` : safe;
 }
 function hostsPath(stateDir) {
-  return join15(stateDir, "sidecar", "hosts.json");
+  return join16(stateDir, "sidecar", "hosts.json");
 }
 function emptyManifest2() {
   return /* @__PURE__ */ Object.create(null);
@@ -45351,10 +45993,10 @@ async function read(dir, fallbackLastSeen) {
   return manifest;
 }
 async function write(stateDir, manifest) {
-  const dir = dirname5(hostsPath(stateDir));
+  const dir = dirname6(hostsPath(stateDir));
   await fs12.mkdir(dir, { recursive: true });
   const target = hostsPath(stateDir);
-  const tmp = join15(dir, `.hosts.json.tmp-${randomBytes3(8).toString("hex")}`);
+  const tmp = join16(dir, `.hosts.json.tmp-${randomBytes3(8).toString("hex")}`);
   try {
     await fs12.writeFile(tmp, JSON.stringify(manifest, null, 2));
     await fs12.rename(tmp, target);
@@ -45461,7 +46103,7 @@ function makeHostsManifest(dir) {
 
 // src/hostsAdmin.ts
 import { readdir as readdir3 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // src/hostsCli.ts
 init_tools_node();
@@ -45577,16 +46219,16 @@ async function countCrew(crewDir) {
   return entries.filter((e2) => e2.isFile() && /\.(prmd|md)$/i.test(e2.name)).length;
 }
 async function countAgents(hostDir) {
-  let total = await countCrew(join16(hostDir, "crew"));
+  let total = await countCrew(join17(hostDir, "crew"));
   let workspaces;
   try {
-    workspaces = await readdir3(join16(hostDir, WORKSPACES_SEG), { withFileTypes: true });
+    workspaces = await readdir3(join17(hostDir, WORKSPACES_SEG), { withFileTypes: true });
   } catch {
     return total;
   }
   for (const entry of workspaces) {
     if (!entry.isDirectory()) continue;
-    total += await countCrew(join16(hostDir, WORKSPACES_SEG, entry.name, "crew"));
+    total += await countCrew(join17(hostDir, WORKSPACES_SEG, entry.name, "crew"));
   }
   return total;
 }
@@ -45712,11 +46354,11 @@ function startAccountWatch(opts) {
 // src/runner/pauseStore.ts
 import { promises as fs14 } from "node:fs";
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { join as join17, dirname as dirname6 } from "node:path";
+import { join as join18, dirname as dirname7 } from "node:path";
 var MAX_PAUSES = 1e3;
 var MAX_FIELD_LEN2 = 200;
 function pausesPath(stateDir) {
-  return join17(stateDir, "sidecar", "pauses.json");
+  return join18(stateDir, "sidecar", "pauses.json");
 }
 function keyOf2(owner, agent) {
   return `${owner}\0${agent}`;
@@ -45759,9 +46401,9 @@ async function read2(stateDir, fallbackPausedAt) {
 }
 async function write2(stateDir, paused) {
   const target = pausesPath(stateDir);
-  const dir = dirname6(target);
+  const dir = dirname7(target);
   await fs14.mkdir(dir, { recursive: true });
-  const tmp = join17(dir, `.pauses.json.tmp-${randomBytes4(8).toString("hex")}`);
+  const tmp = join18(dir, `.pauses.json.tmp-${randomBytes4(8).toString("hex")}`);
   const body2 = { version: 1, paused: [...paused] };
   try {
     await fs14.writeFile(tmp, JSON.stringify(body2, null, 2));
@@ -46031,10 +46673,10 @@ async function runSessionsCli(argv, deps) {
   }
   if (verb === "create") {
     const root = rootFrom(argv, process.cwd());
-    const backend = deps.backend ?? backendFor(deps, [root], run);
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    const backend2 = deps.backend ?? backendFor(deps, [root], run);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
     try {
-      const handle = await backend.create({ workdir: root, owner: process.env.USERNAME || process.env.USER || "cli" });
+      const handle = await backend2.create({ workdir: root, owner: process.env.USERNAME || process.env.USER || "cli" });
       out(`${handle.id}
 `);
       err(`created ${handle.id} on ${handle.workdir}
@@ -46063,19 +46705,19 @@ async function runSessionsCli(argv, deps) {
 `);
       return 1;
     }
-    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
-    if (!backend.exec) {
+    const backend2 = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (!backend2.exec) {
       err("corenel sessions run: this backend cannot execute inside a session\n");
       return 1;
     }
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
     try {
       const token = await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null;
       if (!token) {
         err("corenel sessions run: not signed in on this host.\n  Run `corenel login` first \u2014 the session uses the host's credential.\n");
         return 1;
       }
-      const r2 = await backend.exec(found.id, ["corenel", "run", prompt], { env: { CORENEL_TOKEN: token } });
+      const r2 = await backend2.exec(found.id, ["corenel", "run", prompt], { env: { CORENEL_TOKEN: token } });
       if (r2.stdout) out(r2.stdout.endsWith("\n") ? r2.stdout : `${r2.stdout}
 `);
       if (r2.stderr.trim()) err(r2.stderr.endsWith("\n") ? r2.stderr : `${r2.stderr}
@@ -46100,9 +46742,9 @@ async function runSessionsCli(argv, deps) {
 `);
       return 1;
     }
-    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
-    const known = !!backend.get?.(found.id);
+    const backend2 = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
+    const known = !!backend2.get?.(found.id);
     if (!known) {
       const r2 = await sandboxLifecycle(run, verb, found.sandbox);
       if (!r2.ok) {
@@ -46124,7 +46766,7 @@ async function runSessionsCli(argv, deps) {
     }
     try {
       if (verb === "pause") {
-        const r2 = await backend.pause(found.id);
+        const r2 = await backend2.pause(found.id);
         if (r2 && !r2.drained) {
           err(`paused ${found.id}, but ${r2.remaining.length} call(s) were STILL RUNNING when the drain gave up
 `);
@@ -46135,12 +46777,12 @@ async function runSessionsCli(argv, deps) {
         return 0;
       }
       if (verb === "resume") {
-        await backend.resume(found.id);
+        await backend2.resume(found.id);
         out(`resumed ${found.id}
 `);
         return 0;
       }
-      await backend.destroy(found.id);
+      await backend2.destroy(found.id);
       const still = (await listSessions(run)).find((r2) => r2.id === found.id);
       if (still) {
         err(`corenel sessions destroy: ${found.id} is still present (status ${still.status})
@@ -46564,7 +47206,7 @@ var FLAG_TO_KEY = {
   "--default-model": "defaultModel",
   "--name": "name"
 };
-var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.6";
+var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.8";
 function parseArgsWithProvenance(argv) {
   const explicit = /* @__PURE__ */ new Set();
   for (const a2 of argv) {
@@ -46706,78 +47348,6 @@ async function resolveEndpoint(args, env = process.env) {
   });
 }
 
-// src/config/daemonConfig.ts
-import { readFile as readFile3, writeFile, mkdir as mkdir3 } from "node:fs/promises";
-import { dirname as dirname7, join as join18 } from "node:path";
-var DAEMON_CONFIG_VERSION = 1;
-var SECRET_KEYS = ["acpAuth", "tunnelToken", "token"];
-var KNOWN_KEYS = [
-  "version",
-  "port",
-  "host",
-  "roots",
-  "addUnder",
-  "cloneUnder",
-  "allowLan",
-  "allowOrigins",
-  "tlsCert",
-  "tlsKey",
-  "selfSigned",
-  "tunnel",
-  "tunnelName",
-  "tunnelHostname",
-  "endpoint",
-  "allowShell",
-  "keepTranscripts",
-  "isolation",
-  "msbBin",
-  "guestImage",
-  "maxChainDepth",
-  "name",
-  "appUrl",
-  "defaultModel",
-  "mcpServers",
-  "mcpAllow"
-];
-function daemonConfigPath(stateDir) {
-  return join18(stateDir, "daemon.json");
-}
-async function readDaemonConfig(stateDir) {
-  const empty = (corrupt) => ({ config: { version: DAEMON_CONFIG_VERSION }, unknown: {}, corrupt });
-  let raw;
-  try {
-    raw = await readFile3(daemonConfigPath(stateDir), "utf8");
-  } catch {
-    return empty(false);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return empty(true);
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return empty(true);
-  const src2 = parsed;
-  const config = { version: DAEMON_CONFIG_VERSION };
-  const unknown = {};
-  for (const [k2, v2] of Object.entries(src2)) {
-    if (k2 === "version") continue;
-    if (KNOWN_KEYS.includes(k2)) {
-      config[k2] = v2;
-    } else {
-      unknown[k2] = v2;
-    }
-  }
-  return { config, unknown, corrupt: false };
-}
-async function writeDaemonConfig(stateDir, next, unknown = {}) {
-  const body2 = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
-  const path = daemonConfigPath(stateDir);
-  await mkdir3(dirname7(path), { recursive: true });
-  await writeFile(path, `${JSON.stringify(body2, null, 2)}
-`, "utf8");
-}
-
 // src/config/layer.ts
 var STRICT_BOOLEAN_KEYS = /* @__PURE__ */ new Set(["allowShell", "allowLan", "selfSigned", "keepTranscripts"]);
 var KEY_MAP = {
@@ -47204,7 +47774,162 @@ async function runConfig(raw, io) {
   return 2;
 }
 
-// src/mcp/config.ts
+// ../mcp/src/httpClient.ts
+var PROTOCOL_VERSION = "2025-06-18";
+var CLIENT_INFO = { name: "corenel", version: "0.2.0" };
+var SESSION_HEADER = "Mcp-Session-Id";
+var McpHttpClient = class {
+  constructor(server, auth, fetchImpl = fetch) {
+    this.server = server;
+    this.auth = auth;
+    this.fetchImpl = fetchImpl;
+  }
+  nextRequestId = 1;
+  sessionId;
+  async initialize() {
+    await this.send("initialize", {
+      protocolVersion: PROTOCOL_VERSION,
+      capabilities: {},
+      clientInfo: CLIENT_INFO
+    });
+  }
+  async listTools() {
+    const result = await this.send("tools/list", {});
+    const tools = isRecord2(result) ? result.tools : void 0;
+    if (!Array.isArray(tools)) return [];
+    return tools.filter(isMcpTool);
+  }
+  async callTool(name, args) {
+    const result = await this.send("tools/call", { name, arguments: args });
+    const record = isRecord2(result) ? result : {};
+    return { content: record.content, isError: record.isError === true };
+  }
+  /** Send one JSON-RPC request, retrying exactly once on a 401 that the
+   *  AuthProvider says it recovered from. `isRetry` prevents a second retry
+   *  loop -- a credential that fails twice is refused, not flaky. */
+  async send(method, params, isRetry = false) {
+    const headers = await this.buildHeaders();
+    const id = this.nextRequestId++;
+    const res = await this.request(headers, id, method, params);
+    if (res.status === 401) {
+      if (!isRetry && await this.auth.onUnauthorized()) {
+        return this.send(method, params, true);
+      }
+      throw new Error(
+        `MCP server "${this.server.name}" refused the credential (401) -- run: corenel mcp login ${this.server.name}`
+      );
+    }
+    const sessionId = res.headers.get(SESSION_HEADER);
+    if (sessionId) this.sessionId = sessionId;
+    if (!res.ok) {
+      throw new Error(`MCP server "${this.server.name}" returned HTTP ${res.status}`);
+    }
+    const contentType = res.headers.get("content-type") ?? "";
+    let body2;
+    if (contentType.includes("text/event-stream")) {
+      body2 = await this.readSseResponse(res, id);
+    } else if (contentType.includes("application/json")) {
+      body2 = await res.json();
+    } else {
+      throw new Error(
+        `MCP server "${this.server.name}" answered with an unexpected content-type: "${contentType || "(none)"}"`
+      );
+    }
+    if (body2.error) {
+      throw new Error(`MCP server "${this.server.name}" returned error ${body2.error.code}: ${body2.error.message}`);
+    }
+    return body2.result;
+  }
+  /** Read an SSE body until the JSON-RPC response for `id` arrives.
+   *
+   *  Events are separated by a blank line; an event's `data:` lines are joined
+   *  with newlines, per the SSE spec, and parsed as one JSON-RPC message.
+   *  Notifications (no `id`) and responses to other ids are skipped. The reader
+   *  is cancelled once the answer is in, so a server that keeps the stream open
+   *  after replying cannot hold this call open with it. */
+  async readSseResponse(res, id) {
+    if (!res.body) {
+      throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (value) buffer += decoder.decode(value, { stream: true });
+        buffer = buffer.replace(/\r\n/g, "\n");
+        let boundary = buffer.indexOf("\n\n");
+        while (boundary !== -1) {
+          const event = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          const match = this.matchSseEvent(event, id);
+          if (match) return match;
+          boundary = buffer.indexOf("\n\n");
+        }
+        if (done) {
+          const tail3 = buffer.trim() ? this.matchSseEvent(buffer, id) : null;
+          if (tail3) return tail3;
+          throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
+        }
+      }
+    } finally {
+      reader.cancel().catch(() => {
+      });
+    }
+  }
+  /** The JSON-RPC response in one SSE event, if it answers `id`; else null. */
+  matchSseEvent(event, id) {
+    const data = event.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n");
+    if (!data) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(data);
+    } catch {
+      return null;
+    }
+    if (!isRecord2(parsed) || parsed.id !== id) return null;
+    if (!("result" in parsed) && !("error" in parsed)) return null;
+    return parsed;
+  }
+  /** The bare `fetch()` call, wrapped -- every OTHER throw in `send` already
+   *  names the server; this is the one call whose own failures (DNS miss,
+   *  connection refused, TLS failure) never reach `send`'s response-handling
+   *  at all. Left unguarded, node's bare `fetch failed` -- naming neither the
+   *  URL nor the actual cause -- propagates straight out of `send`, into
+   *  `registry.ts`'s `status().error`, and out of `doctor`, the one command
+   *  whose entire job is diagnosis. `err.cause` carries the real reason
+   *  (ECONNREFUSED, ENOTFOUND, a TLS alert); undici puts it there rather than
+   *  in `err.message`. */
+  async request(headers, id, method, params) {
+    try {
+      return await this.fetchImpl(this.server.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
+      });
+    } catch (err) {
+      const cause = err instanceof Error && err.cause instanceof Error ? err.cause.message : err instanceof Error ? err.message : String(err);
+      throw new Error(`MCP server "${this.server.name}" (${this.server.url}) is unreachable: ${cause}`);
+    }
+  }
+  async buildHeaders() {
+    const headers = new Headers();
+    headers.set("Content-Type", "application/json");
+    headers.set("Accept", "application/json, text/event-stream");
+    for (const h2 of await this.auth.headers()) headers.set(h2.name, h2.value);
+    if (this.sessionId) headers.set(SESSION_HEADER, this.sessionId);
+    return headers;
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function isMcpTool(value) {
+  return isRecord2(value) && typeof value.name === "string" && "inputSchema" in value;
+}
+
+// ../mcp/src/config.ts
 init_tools_node();
 import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir4, chmod } from "node:fs/promises";
 function isUsableServer(v2) {
@@ -47323,7 +48048,7 @@ async function writeMcpCredential(stateDir, server, cred) {
   }
 }
 
-// src/mcp/oauth/discovery.ts
+// ../mcp/src/oauth/discovery.ts
 var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
 var AUTH_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
 async function tryFetchJson(url, fetchImpl) {
@@ -47421,7 +48146,423 @@ async function discoverAuthMetadata(authServer, fetchImpl = fetch) {
   return { authorizationEndpoint, tokenEndpoint, registrationEndpoint, scopesSupported };
 }
 
-// src/mcp/oauth/register.ts
+// ../mcp/src/oauth/tokens.ts
+function parseTokenResponse(body2) {
+  if (typeof body2 !== "object" || body2 === null || Array.isArray(body2)) {
+    throw new Error("token endpoint returned a malformed response");
+  }
+  const r2 = body2;
+  if (typeof r2.access_token !== "string" || r2.access_token.length === 0) {
+    throw new Error("token endpoint response did not include an access_token");
+  }
+  return {
+    access_token: r2.access_token,
+    ...typeof r2.refresh_token === "string" ? { refresh_token: r2.refresh_token } : {},
+    ...typeof r2.expires_in === "number" ? { expires_in: r2.expires_in } : {},
+    ...typeof r2.scope === "string" ? { scope: r2.scope } : {}
+  };
+}
+async function postToken(endpoint, body2, fetchImpl) {
+  const res = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body2.toString()
+  });
+  if (!res.ok) {
+    throw new Error(`token request failed at ${endpoint} (HTTP ${res.status})`);
+  }
+  return parseTokenResponse(await res.json());
+}
+async function exchangeCode(meta, opts, fetchImpl = fetch, now2 = Date.now) {
+  const body2 = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: opts.clientId,
+    code: opts.code,
+    code_verifier: opts.verifier,
+    redirect_uri: opts.redirectUri,
+    resource: opts.resource
+  });
+  if (opts.clientSecret) body2.set("client_secret", opts.clientSecret);
+  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
+  return {
+    kind: "oauth",
+    accessToken: tokens.access_token,
+    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+    clientId: opts.clientId,
+    ...opts.clientSecret ? { clientSecret: opts.clientSecret } : {},
+    authServer: opts.authServer,
+    ...tokens.scope ? { scope: tokens.scope } : {}
+  };
+}
+async function refresh(meta, cred, fetchImpl = fetch, now2 = Date.now) {
+  if (!cred.refreshToken) {
+    throw new Error("credential has no refresh token to refresh with -- sign in again");
+  }
+  const body2 = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: cred.refreshToken,
+    client_id: cred.clientId
+  });
+  if (cred.clientSecret) body2.set("client_secret", cred.clientSecret);
+  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
+  return {
+    kind: "oauth",
+    accessToken: tokens.access_token,
+    // Keep the old refresh token when the server did not send a new one.
+    refreshToken: tokens.refresh_token ?? cred.refreshToken,
+    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+    clientId: cred.clientId,
+    ...cred.clientSecret ? { clientSecret: cred.clientSecret } : {},
+    authServer: cred.authServer,
+    scope: tokens.scope ?? cred.scope
+  };
+}
+var EXPIRY_SKEW_MS = 6e4;
+function isExpired(cred, nowMs) {
+  if (cred.expiresAt === void 0) return false;
+  return cred.expiresAt - nowMs <= EXPIRY_SKEW_MS;
+}
+
+// ../mcp/src/auth.ts
+function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null) {
+  async function doRefresh(cred) {
+    if (!cred.refreshToken) {
+      throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
+    }
+    const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
+    const refreshed = await refresh(meta, cred, fetchImpl);
+    await writeMcpCredential(stateDir, server.name, refreshed);
+    return refreshed;
+  }
+  return {
+    async headers() {
+      const cred = await readMcpCredential(stateDir, server.name);
+      if (!cred && !server.hosted) {
+        throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
+      }
+      const mcpHeaders = !cred ? [] : cred.kind === "headers" ? cred.headers : [{ name: "Authorization", value: `Bearer ${(isExpired(cred, Date.now()) ? await doRefresh(cred) : cred).accessToken}` }];
+      if (!server.hosted) return mcpHeaders;
+      const moved = mcpHeaders.map((h2) => h2.name.toLowerCase() === "authorization" ? { name: "X-MCP-Authorization", value: h2.value } : h2);
+      const account = await accountToken();
+      return account ? [...moved, { name: "Authorization", value: `Bearer ${account}` }] : moved;
+    },
+    async onUnauthorized() {
+      const cred = await readMcpCredential(stateDir, server.name);
+      if (!cred || cred.kind !== "oauth") return false;
+      try {
+        await doRefresh(cred);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+
+// ../mcp/src/timedFetch.ts
+var AUTH_REQUEST_TIMEOUT_MS = 15e3;
+function timedFetch(ms, inner = fetch) {
+  return async (input, init2 = {}) => {
+    const deadline = AbortSignal.timeout(ms);
+    const signal = init2.signal ? AbortSignal.any([init2.signal, deadline]) : deadline;
+    try {
+      return await inner(input, { ...init2, signal });
+    } catch (err) {
+      if (deadline.aborted && !init2.signal?.aborted) {
+        throw new Error(`no answer within ${ms / 1e3}s`, { cause: err });
+      }
+      throw err;
+    }
+  };
+}
+
+// ../mcp/src/registry.ts
+async function accountTokenFor(stateDir) {
+  try {
+    const cred = await resolveCredential(process.env, stateDir);
+    return cred.token ?? null;
+  } catch {
+    return null;
+  }
+}
+function defaultClientFactory(stateDir, server) {
+  return new McpHttpClient(
+    server,
+    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir))
+  );
+}
+var SERVER_CONNECT_TIMEOUT_MS = 3e4;
+var McpRegistry = class {
+  constructor(stateDir, clientFactory = defaultClientFactory) {
+    this.stateDir = stateDir;
+    this.clientFactory = clientFactory;
+  }
+  connected = /* @__PURE__ */ new Map();
+  statuses = /* @__PURE__ */ new Map();
+  // The order the operator wrote servers in daemon.json, captured once per
+  // connectAll() -- `tools()` walks THIS, never `connected`'s Map iteration
+  // order. `connectOne` runs concurrently for every server (Promise.all), so
+  // Map insertion order is race order: whichever server's initialize+list
+  // happened to resolve first. That is fine for `connected` (a lookup table,
+  // order never read) but `tools()` is a list a model/doctor/policy consumes
+  // in order, and race order means a different tool ordering on every daemon
+  // boot -- exactly the kind of bug that surfaces far from here and is never
+  // traced back. Configured order is also information the operator supplied
+  // deliberately; sorting alphabetically would discard it.
+  serverOrder = [];
+  // Tool lists seeded from the on-disk cache, with no socket ever opened.
+  // Deliberately a THIRD piece of state, not folded into `connected`: a
+  // primed server can answer `tools()` but must still go through
+  // `ensureConnected` before `call()` will dispatch to it. `connectAll`
+  // does not touch this map -- see the comment at its first line for why.
+  primed = /* @__PURE__ */ new Map();
+  // One in-flight ensureConnected() attempt per server, so three tool calls
+  // that land on the same cold server in the same turn share one connection
+  // instead of racing three.
+  connecting = /* @__PURE__ */ new Map();
+  /**
+   * Connect to every configured server and cache its tools. Never throws --
+   * a server that fails to initialize, or fails listing tools, is recorded
+   * in `status()` with zero tools and the daemon keeps starting.
+   */
+  async connectAll(opts = {}) {
+    this.connected.clear();
+    this.statuses.clear();
+    this.primed.clear();
+    const servers = await readMcpServers(this.stateDir);
+    this.serverOrder = servers.map((s2) => s2.name);
+    const timeoutMs = opts.timeoutMs ?? SERVER_CONNECT_TIMEOUT_MS;
+    await Promise.all(servers.map((server) => this.connectOne(server, timeoutMs, opts.onServer)));
+  }
+  /* BOUNDED, AND SETTLED EXACTLY ONCE.
+   *
+   * Every server connects under one Promise.all, and daemon startup awaits it.
+   * With no bound, one stalled server -- measured: an expired Microsoft 365
+   * token refreshing against a cold service, still waiting at 60 seconds --
+   * left the terminal silent after `mirrors sessions`, indistinguishable from a
+   * crash.
+   *
+   * The deadline covers the whole connect (any credential refresh, initialize,
+   * tools/list), not each request, because several individually bounded steps
+   * in a row can still add up to a hang. The attempt that loses the race keeps
+   * running; its late result is deliberately ignored, so a server reported as
+   * timed out cannot quietly become connected afterwards -- status would then
+   * tell doctor one thing and the registered tools another. */
+  async connectOne(server, timeoutMs, onServer) {
+    let timer;
+    const deadline = new Promise((resolve14) => {
+      timer = setTimeout(() => resolve14("timeout"), timeoutMs);
+    });
+    const attempt = (async () => {
+      const client = this.clientFactory(this.stateDir, server);
+      await client.initialize();
+      const tools = await client.listTools();
+      return { client, tools };
+    })();
+    attempt.catch(() => {
+    });
+    try {
+      const outcome = await Promise.race([attempt, deadline]);
+      if (outcome === "timeout") {
+        this.statuses.set(server.name, { connected: false, toolCount: 0, error: `timed out after ${timeoutMs / 1e3}s` });
+      } else {
+        this.connected.set(server.name, outcome);
+        this.statuses.set(server.name, { connected: true, toolCount: outcome.tools.length });
+      }
+    } catch (err) {
+      this.statuses.set(server.name, {
+        connected: false,
+        toolCount: 0,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    const settled = this.statuses.get(server.name);
+    if (settled) onServer?.({ server: server.name, ...settled });
+  }
+  /** Every tool from every connected OR primed server, paired with the server
+   *  it came from, in CONFIGURED order (`serverOrder`) -- not the order
+   *  servers happened to finish connecting in, and not insertion order into
+   *  `primed` either. Within a server, tools stay in the order that server
+   *  returned them. A live connection wins over a primed (cached) entry for
+   *  the same server, since it is the fresher truth. A server with neither
+   *  either failed to connect or reported zero tools -- `status()` tells the
+   *  two apart. */
+  tools() {
+    const out = [];
+    for (const server of this.serverOrder) {
+      const entry = this.connected.get(server);
+      const list = entry ? entry.tools : this.primed.get(server);
+      if (!list) continue;
+      for (const tool of list) out.push({ server, tool });
+    }
+    return out;
+  }
+  /** Seed tool lists from the on-disk cache. NO I/O, no sockets -- this is
+   *  what a terminal calls at startup so that `tools()` can answer
+   *  immediately, before any server has actually been reached. A primed
+   *  server is deliberately NOT `connected`: it can answer what tools exist,
+   *  and cannot call one until `ensureConnected()` has run. */
+  primeFromCache(cache) {
+    for (const [name, entry] of Object.entries(cache)) {
+      this.statuses.set(name, { connected: false, toolCount: entry.tools.length });
+      this.primed.set(name, entry.tools);
+      if (!this.serverOrder.includes(name)) this.serverOrder.push(name);
+    }
+  }
+  isConnected(server) {
+    return this.connected.has(server);
+  }
+  connectedServers() {
+    return this.serverOrder.filter((s2) => this.connected.has(s2));
+  }
+  /** Connect ONE server, on demand. Never throws, for the same reason
+   *  connectAll never throws: a server that is down must not take the
+   *  process with it. Concurrent callers for the same server share one
+   *  attempt rather than opening a second socket. */
+  async ensureConnected(server) {
+    if (this.connected.has(server)) return;
+    const inflight = this.connecting.get(server);
+    if (inflight) return inflight;
+    const attempt = (async () => {
+      const servers = await readMcpServers(this.stateDir);
+      const def = servers.find((s2) => s2.name === server);
+      if (!def) return;
+      if (!this.serverOrder.includes(server)) this.serverOrder.push(server);
+      await this.connectOne(def, SERVER_CONNECT_TIMEOUT_MS);
+    })().finally(() => this.connecting.delete(server));
+    this.connecting.set(server, attempt);
+    return attempt;
+  }
+  /**
+   * Call one tool on one server. Fails immediately, naming the server, when
+   * that server never connected -- there is nothing to route the call
+   * through, and pretending otherwise would either stall waiting on a
+   * connection that will never appear or return an empty result the caller
+   * could mistake for a genuine (if empty) tool response.
+   */
+  async call(server, tool, args) {
+    await this.ensureConnected(server);
+    const entry = this.connected.get(server);
+    if (!entry) {
+      throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
+    }
+    return entry.client.callTool(tool, args);
+  }
+  /** Per-server connection state, for `doctor` (Task 10) to print. A server
+   *  with `connected: false` always carries `error` -- there is no code path
+   *  that records a failure without a reason, because "no tools" alone tells
+   *  the reader nothing about what to fix. */
+  status() {
+    const out = [];
+    for (const server of this.serverOrder) {
+      const s2 = this.statuses.get(server);
+      if (s2) out.push({ server, ...s2 });
+    }
+    return out;
+  }
+};
+
+// ../mcp/src/policy.ts
+function mcpCallAllowed(address, policy) {
+  const allow = policy.tools?.allow ?? [];
+  if (!matchesAnyGlob(address, allow)) {
+    return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
+  }
+  const service = new PermissionService({
+    policy,
+    defaultForReadOnly: "allow",
+    defaultForMutating: "allow"
+  });
+  const level = service.resolveLevel({ name: address, address, mutates: true });
+  if (level !== "allow") {
+    return {
+      ok: false,
+      reason: `${address} resolves to permission "${level}" - MCP tools never prompt; set it to "allow" or remove the rule`
+    };
+  }
+  return { ok: true };
+}
+
+// ../mcp/src/toolNames.ts
+init_protocol();
+
+// ../mcp/src/asAgentTools.ts
+function isPlainObject3(v2) {
+  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+}
+function toParameters(inputSchema) {
+  if (isPlainObject3(inputSchema)) return inputSchema;
+  return { type: "object", properties: {} };
+}
+function formatContent(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    const parts = content.map((block) => {
+      if (isPlainObject3(block) && typeof block.text === "string") return block.text;
+      return JSON.stringify(block);
+    });
+    return parts.join("\n");
+  }
+  if (content == null) return "";
+  return JSON.stringify(content);
+}
+function asAgentTools(registry2) {
+  const out = [];
+  for (const { server, tool } of registry2.tools()) {
+    if (!canEncodeMcpWireName(server, tool.name)) {
+      console.error(
+        `MCP tool refused: server "${server}" tool "${tool.name}" cannot be encoded as a wire name (unsupported characters or too long) -- this tool is not available to the model`
+      );
+      continue;
+    }
+    out.push(toAgentTool(registry2, server, tool));
+  }
+  return out;
+}
+function toAgentTool(registry2, server, tool) {
+  const name = mcpWireName(server, tool.name);
+  const address = mcpToolAddress(server, tool.name);
+  return {
+    name,
+    namespace: "mcp",
+    description: tool.description?.trim() || `MCP tool "${tool.name}" on server "${server}" (${address}).`,
+    parameters: toParameters(tool.inputSchema),
+    mutates: true,
+    async run(args) {
+      const result = await registry2.call(server, tool.name, args);
+      const text = formatContent(result.content);
+      return result.isError ? `Error: ${text}` : text;
+    }
+  };
+}
+
+// ../mcp/src/gatedAgentTools.ts
+function gatedAgentTools(registry2, policy) {
+  const base = asAgentTools(registry2);
+  const byWireName = new Map(base.map((t2) => [t2.name, t2]));
+  const wrapped = [];
+  for (const { server, tool } of registry2.tools()) {
+    if (!canEncodeMcpWireName(server, tool.name)) continue;
+    const name = mcpWireName(server, tool.name);
+    const original = byWireName.get(name);
+    if (!original) continue;
+    const address = mcpToolAddress(server, tool.name);
+    wrapped.push({
+      ...original,
+      async run(args, ctx) {
+        const decision = mcpCallAllowed(address, policy);
+        if (!decision.ok) return `Error: ${decision.reason}`;
+        return original.run(args, ctx);
+      }
+    });
+  }
+  return wrapped;
+}
+
+// ../mcp/src/oauth/register.ts
 async function registerClient(meta, redirectUri, fetchImpl) {
   if (!meta.registrationEndpoint) return null;
   const res = await fetchImpl(meta.registrationEndpoint, {
@@ -47451,7 +48592,7 @@ async function registerClient(meta, redirectUri, fetchImpl) {
   return { clientId, clientSecret };
 }
 
-// src/mcp/oauth/pkce.ts
+// ../mcp/src/oauth/pkce.ts
 import { randomBytes as randomBytes5, createHash as createHash3 } from "node:crypto";
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -47479,7 +48620,7 @@ function authorizationUrl(meta, opts) {
   return url.toString();
 }
 
-// src/mcp/oauth/loopback.ts
+// ../mcp/src/oauth/loopback.ts
 import { createServer } from "node:http";
 var PAGE_OK = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
 <body style="font:16px system-ui;padding:3rem;text-align:center">
@@ -47532,6 +48673,17 @@ function awaitRedirect(port, expectedState, opts = {}) {
     server.once("error", (e2) => {
       finish(() => reject(e2 instanceof Error ? e2 : new Error(String(e2))));
     });
+    if (opts.signal) {
+      if (opts.signal.aborted) {
+        finish(() => reject(new Error("sign-in cancelled")));
+      } else {
+        opts.signal.addEventListener(
+          "abort",
+          () => finish(() => reject(new Error("sign-in cancelled"))),
+          { once: true }
+        );
+      }
+    }
     v6.on("error", () => {
     });
     try {
@@ -47544,6 +48696,15 @@ function awaitRedirect(port, expectedState, opts = {}) {
     });
   });
 }
+function portFree(port) {
+  return new Promise((resolve14) => {
+    const probe = createServer();
+    probe.once("error", () => resolve14(false));
+    probe.listen(port, "127.0.0.1", () => {
+      probe.close(() => resolve14(true));
+    });
+  });
+}
 function getFreePort() {
   return new Promise((resolve14, reject) => {
     const probe = createServer();
@@ -47555,93 +48716,16 @@ function getFreePort() {
   });
 }
 
-// src/mcp/oauth/tokens.ts
-function parseTokenResponse(body2) {
-  if (typeof body2 !== "object" || body2 === null || Array.isArray(body2)) {
-    throw new Error("token endpoint returned a malformed response");
-  }
-  const r2 = body2;
-  if (typeof r2.access_token !== "string" || r2.access_token.length === 0) {
-    throw new Error("token endpoint response did not include an access_token");
-  }
-  return {
-    access_token: r2.access_token,
-    ...typeof r2.refresh_token === "string" ? { refresh_token: r2.refresh_token } : {},
-    ...typeof r2.expires_in === "number" ? { expires_in: r2.expires_in } : {},
-    ...typeof r2.scope === "string" ? { scope: r2.scope } : {}
-  };
-}
-async function postToken(endpoint, body2, fetchImpl) {
-  const res = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: body2.toString()
-  });
-  if (!res.ok) {
-    throw new Error(`token request failed at ${endpoint} (HTTP ${res.status})`);
-  }
-  return parseTokenResponse(await res.json());
-}
-async function exchangeCode(meta, opts, fetchImpl = fetch, now2 = Date.now) {
-  const body2 = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: opts.clientId,
-    code: opts.code,
-    code_verifier: opts.verifier,
-    redirect_uri: opts.redirectUri,
-    resource: opts.resource
-  });
-  if (opts.clientSecret) body2.set("client_secret", opts.clientSecret);
-  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
-  return {
-    kind: "oauth",
-    accessToken: tokens.access_token,
-    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
-    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-    clientId: opts.clientId,
-    ...opts.clientSecret ? { clientSecret: opts.clientSecret } : {},
-    authServer: opts.authServer,
-    ...tokens.scope ? { scope: tokens.scope } : {}
-  };
-}
-async function refresh(meta, cred, fetchImpl = fetch, now2 = Date.now) {
-  if (!cred.refreshToken) {
-    throw new Error("credential has no refresh token to refresh with -- sign in again");
-  }
-  const body2 = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: cred.refreshToken,
-    client_id: cred.clientId
-  });
-  if (cred.clientSecret) body2.set("client_secret", cred.clientSecret);
-  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
-  return {
-    kind: "oauth",
-    accessToken: tokens.access_token,
-    // Keep the old refresh token when the server did not send a new one.
-    refreshToken: tokens.refresh_token ?? cred.refreshToken,
-    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-    clientId: cred.clientId,
-    ...cred.clientSecret ? { clientSecret: cred.clientSecret } : {},
-    authServer: cred.authServer,
-    scope: tokens.scope ?? cred.scope
-  };
-}
-var EXPIRY_SKEW_MS = 6e4;
-function isExpired(cred, nowMs) {
-  if (cred.expiresAt === void 0) return false;
-  return cred.expiresAt - nowMs <= EXPIRY_SKEW_MS;
-}
-
-// src/mcp/oauth/login.ts
+// ../mcp/src/oauth/login.ts
 var defaultOpenBrowser = async (url) => {
-  const { openBrowser: openBrowser3 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+  const { openBrowser: openBrowser3 } = await Promise.resolve().then(() => (init_tools_node(), tools_node_exports));
   await openBrowser3(url);
 };
 async function loginToMcpServer(stateDir, server, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const openBrowserFn = deps.openBrowser ?? defaultOpenBrowser;
   const now2 = deps.now ?? Date.now;
+  const redirectAbort = new AbortController();
   const signInUrl = server.authUrl ?? server.url;
   try {
     const discovered = await discoverAuthServer(
@@ -47662,6 +48746,13 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
     const meta = discovered.scopes ? { ...asMeta, scopesSupported: discovered.scopes } : asMeta;
     const cached = await readMcpClient(stateDir, server.name);
     const port = cached?.redirectPort ?? await getFreePort();
+    if (cached?.redirectPort !== void 0 && !await portFree(cached.redirectPort)) {
+      return {
+        ok: false,
+        reason: "failed",
+        message: `the redirect port ${cached.redirectPort} is in use, and "${server.name}" is registered against exactly that port -- free it and sign in again`
+      };
+    }
     const redirectUri = `http://localhost:${port}/callback`;
     const registered2 = cached && cached.authServer === discovered.authServer ? { clientId: cached.clientId, ...cached.clientSecret ? { clientSecret: cached.clientSecret } : {} } : await registerClient(
       meta,
@@ -47672,7 +48763,25 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
       await writeMcpClient(stateDir, server.name, {
         clientId: registered2.clientId,
         ...registered2.clientSecret ? { clientSecret: registered2.clientSecret } : {},
-        authServer: discovered.authServer
+        authServer: discovered.authServer,
+        /* PIN THE PORT WE JUST REGISTERED WITH.
+         *
+         * RFC 8252 s7.3 obliges an authorization server to accept any port on a
+         * loopback redirect, and most do -- but not all, and the ones that do
+         * not fail in the worst possible way. Atlassian's `auth.atlassian.com`
+         * (Trello's authorization server, distinct from `mcp.atlassian.com`)
+         * matches the redirect URI exactly. Registering with one ephemeral port
+         * and then authorizing with a fresh one on the next sign-in produced
+         * "The app's callback URL is invalid", from the vendor's own page,
+         * BEFORE any token exchange -- so nothing came back for the
+         * invalid_client recovery below to catch, and the flow simply timed out
+         * waiting for a redirect that was never going to arrive.
+         *
+         * Persisting it costs nothing where the port is ignored, and is the
+         * whole difference where it is not. The field already existed for
+         * operator-set ports (`corenel mcp set-client --redirect-port`); it was
+         * read here and never written by this path. */
+        redirectPort: port
       });
     }
     if (!registered2) {
@@ -47693,7 +48802,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
       resource: discovered.resource
     });
     deps.onAuthUrl?.(authUrl);
-    const redirectP = awaitRedirect(port, state);
+    const redirectP = awaitRedirect(port, state, { signal: redirectAbort.signal });
     redirectP.catch(() => {
     });
     await openBrowserFn(authUrl);
@@ -47715,6 +48824,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
     await writeMcpCredential(stateDir, server.name, cred);
     return { ok: true };
   } catch (e2) {
+    redirectAbort.abort();
     const message = e2 instanceof Error ? e2.message : String(e2);
     if (/invalid_client|unauthorized_client|client.{0,20}not.{0,10}found/i.test(message)) {
       await clearMcpClient(stateDir, server.name).catch(() => {
@@ -48211,7 +49321,7 @@ function persistAddedRoots(controller, stateDir, log) {
 import { spawn as spawn7 } from "node:child_process";
 import { promises as fs16 } from "node:fs";
 import { join as join20, resolve as resolve13 } from "node:path";
-var DEFAULT_TIMEOUT_MS5 = 10 * 6e4;
+var DEFAULT_TIMEOUT_MS4 = 10 * 6e4;
 var ALLOWED_SCHEMES = ["https://", "ssh://", "git+ssh://"];
 var SCP_LIKE = /^[A-Za-z0-9_.-]+@[A-Za-z0-9_.-]+:[A-Za-z0-9_./~-]+$/;
 function assertCloneUrl(url) {
@@ -48275,8 +49385,8 @@ function makeGitRunner(bin = "git") {
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
       settle({ code: -1, stdout, stderr: `${stderr}
-git timed out after ${opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS5}ms` });
-    }, opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS5);
+git timed out after ${opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS4}ms` });
+    }, opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS4);
     timer.unref?.();
     child.on("error", (e2) => {
       clearTimeout(timer);
@@ -48385,7 +49495,7 @@ var RpcError = class extends Error {
     if (shape.data !== void 0) this.data = shape.data;
   }
 };
-function isRecord2(v2) {
+function isRecord3(v2) {
   return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
 }
 var JsonRpcPeer = class {
@@ -48423,7 +49533,7 @@ var JsonRpcPeer = class {
       this.log(`acp: dropped unparseable frame (${line.length} bytes)`);
       return;
     }
-    if (!isRecord2(msg)) {
+    if (!isRecord3(msg)) {
       this.log("acp: dropped non-object frame");
       return;
     }
@@ -48445,7 +49555,7 @@ var JsonRpcPeer = class {
       return;
     }
     this.pending.delete(id);
-    if ("error" in msg && isRecord2(msg.error)) {
+    if ("error" in msg && isRecord3(msg.error)) {
       const e2 = msg.error;
       p2.reject(new RpcError({
         code: typeof e2.code === "number" ? e2.code : RPC_INTERNAL_ERROR,
@@ -49337,7 +50447,6 @@ function textOf(prompt) {
 }
 
 // src/acp/agentCli.ts
-init_store();
 function elog(line) {
   process.stderr.write(`${line}
 `);
@@ -49385,434 +50494,239 @@ async function runAcpAgent(argv) {
   });
 }
 
-// src/cli.ts
-init_cli();
-init_store();
-init_fileService();
-import { relative as relative7, resolve as resolvePath } from "node:path";
+// src/auth/login.ts
+import { createServer as createServer2 } from "node:http";
 
-// src/mcp/httpClient.ts
-var PROTOCOL_VERSION = "2025-06-18";
-var CLIENT_INFO = { name: "corenel", version: "0.2.0" };
-var SESSION_HEADER = "Mcp-Session-Id";
-var McpHttpClient = class {
-  constructor(server, auth, fetchImpl = fetch) {
-    this.server = server;
-    this.auth = auth;
-    this.fetchImpl = fetchImpl;
-  }
-  nextRequestId = 1;
-  sessionId;
-  async initialize() {
-    await this.send("initialize", {
-      protocolVersion: PROTOCOL_VERSION,
-      capabilities: {},
-      clientInfo: CLIENT_INFO
-    });
-  }
-  async listTools() {
-    const result = await this.send("tools/list", {});
-    const tools = isRecord3(result) ? result.tools : void 0;
-    if (!Array.isArray(tools)) return [];
-    return tools.filter(isMcpTool);
-  }
-  async callTool(name, args) {
-    const result = await this.send("tools/call", { name, arguments: args });
-    const record = isRecord3(result) ? result : {};
-    return { content: record.content, isError: record.isError === true };
-  }
-  /** Send one JSON-RPC request, retrying exactly once on a 401 that the
-   *  AuthProvider says it recovered from. `isRetry` prevents a second retry
-   *  loop -- a credential that fails twice is refused, not flaky. */
-  async send(method, params, isRetry = false) {
-    const headers = await this.buildHeaders();
-    const id = this.nextRequestId++;
-    const res = await this.request(headers, id, method, params);
-    if (res.status === 401) {
-      if (!isRetry && await this.auth.onUnauthorized()) {
-        return this.send(method, params, true);
-      }
-      throw new Error(
-        `MCP server "${this.server.name}" refused the credential (401) -- run: corenel mcp login ${this.server.name}`
-      );
-    }
-    const sessionId = res.headers.get(SESSION_HEADER);
-    if (sessionId) this.sessionId = sessionId;
-    if (!res.ok) {
-      throw new Error(`MCP server "${this.server.name}" returned HTTP ${res.status}`);
-    }
-    const contentType = res.headers.get("content-type") ?? "";
-    let body2;
-    if (contentType.includes("text/event-stream")) {
-      body2 = await this.readSseResponse(res, id);
-    } else if (contentType.includes("application/json")) {
-      body2 = await res.json();
-    } else {
-      throw new Error(
-        `MCP server "${this.server.name}" answered with an unexpected content-type: "${contentType || "(none)"}"`
-      );
-    }
-    if (body2.error) {
-      throw new Error(`MCP server "${this.server.name}" returned error ${body2.error.code}: ${body2.error.message}`);
-    }
-    return body2.result;
-  }
-  /** Read an SSE body until the JSON-RPC response for `id` arrives.
-   *
-   *  Events are separated by a blank line; an event's `data:` lines are joined
-   *  with newlines, per the SSE spec, and parsed as one JSON-RPC message.
-   *  Notifications (no `id`) and responses to other ids are skipped. The reader
-   *  is cancelled once the answer is in, so a server that keeps the stream open
-   *  after replying cannot hold this call open with it. */
-  async readSseResponse(res, id) {
-    if (!res.body) {
-      throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
-    }
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
-    try {
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (value) buffer += decoder.decode(value, { stream: true });
-        buffer = buffer.replace(/\r\n/g, "\n");
-        let boundary = buffer.indexOf("\n\n");
-        while (boundary !== -1) {
-          const event = buffer.slice(0, boundary);
-          buffer = buffer.slice(boundary + 2);
-          const match = this.matchSseEvent(event, id);
-          if (match) return match;
-          boundary = buffer.indexOf("\n\n");
-        }
-        if (done) {
-          const tail3 = buffer.trim() ? this.matchSseEvent(buffer, id) : null;
-          if (tail3) return tail3;
-          throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
-        }
-      }
-    } finally {
-      reader.cancel().catch(() => {
-      });
-    }
-  }
-  /** The JSON-RPC response in one SSE event, if it answers `id`; else null. */
-  matchSseEvent(event, id) {
-    const data = event.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n");
-    if (!data) return null;
-    let parsed;
-    try {
-      parsed = JSON.parse(data);
-    } catch {
-      return null;
-    }
-    if (!isRecord3(parsed) || parsed.id !== id) return null;
-    if (!("result" in parsed) && !("error" in parsed)) return null;
-    return parsed;
-  }
-  /** The bare `fetch()` call, wrapped -- every OTHER throw in `send` already
-   *  names the server; this is the one call whose own failures (DNS miss,
-   *  connection refused, TLS failure) never reach `send`'s response-handling
-   *  at all. Left unguarded, node's bare `fetch failed` -- naming neither the
-   *  URL nor the actual cause -- propagates straight out of `send`, into
-   *  `registry.ts`'s `status().error`, and out of `doctor`, the one command
-   *  whose entire job is diagnosis. `err.cause` carries the real reason
-   *  (ECONNREFUSED, ENOTFOUND, a TLS alert); undici puts it there rather than
-   *  in `err.message`. */
-  async request(headers, id, method, params) {
-    try {
-      return await this.fetchImpl(this.server.url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
-      });
-    } catch (err) {
-      const cause = err instanceof Error && err.cause instanceof Error ? err.cause.message : err instanceof Error ? err.message : String(err);
-      throw new Error(`MCP server "${this.server.name}" (${this.server.url}) is unreachable: ${cause}`);
-    }
-  }
-  async buildHeaders() {
-    const headers = new Headers();
-    headers.set("Content-Type", "application/json");
-    headers.set("Accept", "application/json, text/event-stream");
-    for (const h2 of await this.auth.headers()) headers.set(h2.name, h2.value);
-    if (this.sessionId) headers.set(SESSION_HEADER, this.sessionId);
-    return headers;
-  }
-};
-function isRecord3(value) {
-  return typeof value === "object" && value !== null;
+// src/auth/pkce.ts
+import { createHash as createHash4, randomBytes as randomBytes6 } from "node:crypto";
+function base64url2(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function isMcpTool(value) {
-  return isRecord3(value) && typeof value.name === "string" && "inputSchema" in value;
+function createVerifier(bytes = 32) {
+  return base64url2(randomBytes6(bytes));
+}
+function challengeFor(verifier) {
+  return base64url2(createHash4("sha256").update(verifier).digest());
+}
+function createState() {
+  return base64url2(randomBytes6(16));
+}
+function createPkce() {
+  const verifier = createVerifier();
+  return { verifier, challenge: challengeFor(verifier), method: "S256", state: createState() };
+}
+function authorizeUrl(p2) {
+  const u2 = new URL("/oauth/authorize", p2.issuer);
+  u2.searchParams.set("response_type", "code");
+  u2.searchParams.set("client_id", p2.clientId);
+  u2.searchParams.set("redirect_uri", p2.redirectUri);
+  u2.searchParams.set("code_challenge", p2.pkce.challenge);
+  u2.searchParams.set("code_challenge_method", p2.pkce.method);
+  u2.searchParams.set("state", p2.pkce.state);
+  u2.searchParams.set("scope", p2.scope ?? "profile email");
+  return u2.toString();
+}
+function stateMatches(expected, got) {
+  if (!got || got.length !== expected.length) return false;
+  let diff = 0;
+  for (let i2 = 0; i2 < expected.length; i2++) diff |= expected.charCodeAt(i2) ^ got.charCodeAt(i2);
+  return diff === 0;
 }
 
-// src/mcp/auth.ts
-function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null) {
-  async function doRefresh(cred) {
-    if (!cred.refreshToken) {
-      throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
+// src/auth/login.ts
+var DEFAULT_TIMEOUT_MS5 = 5 * 60 * 1e3;
+var PAGE_OK2 = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
+<body style="font:16px system-ui;padding:3rem;text-align:center">
+<h1>Signed in to Corenel</h1><p>You can close this tab and return to your terminal.</p></body>`;
+var PAGE_FAIL2 = `<!doctype html><meta charset="utf-8"><title>Sign-in failed</title>
+<body style="font:16px system-ui;padding:3rem;text-align:center">
+<h1>Sign-in failed</h1><p>Return to your terminal for details.</p></body>`;
+function awaitCallback(pkce, port, timeoutMs) {
+  let resolveUri;
+  let resolveResult;
+  let rejectResult;
+  const redirectUri = new Promise((res) => {
+    resolveUri = res;
+  });
+  const result = new Promise((res, rej) => {
+    resolveResult = res;
+    rejectResult = rej;
+  });
+  const server = createServer2((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
     }
-    const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
-    const refreshed = await refresh(meta, cred, fetchImpl);
-    await writeMcpCredential(stateDir, server.name, refreshed);
-    return refreshed;
-  }
-  return {
-    async headers() {
-      const cred = await readMcpCredential(stateDir, server.name);
-      if (!cred && !server.hosted) {
-        throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
-      }
-      const mcpHeaders = !cred ? [] : cred.kind === "headers" ? cred.headers : [{ name: "Authorization", value: `Bearer ${(isExpired(cred, Date.now()) ? await doRefresh(cred) : cred).accessToken}` }];
-      if (!server.hosted) return mcpHeaders;
-      const moved = mcpHeaders.map((h2) => h2.name.toLowerCase() === "authorization" ? { name: "X-MCP-Authorization", value: h2.value } : h2);
-      const account = await accountToken();
-      return account ? [...moved, { name: "Authorization", value: `Bearer ${account}` }] : moved;
-    },
-    async onUnauthorized() {
-      const cred = await readMcpCredential(stateDir, server.name);
-      if (!cred || cred.kind !== "oauth") return false;
-      try {
-        await doRefresh(cred);
-        return true;
-      } catch {
-        return false;
-      }
+    const err = url.searchParams.get("error");
+    const code2 = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (!stateMatches(pkce.state, state)) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error("state mismatch \u2014 the callback did not match this sign-in request"));
+      return;
     }
-  };
-}
-
-// src/mcp/registry.ts
-init_store();
-
-// src/mcp/timedFetch.ts
-var AUTH_REQUEST_TIMEOUT_MS = 15e3;
-function timedFetch(ms, inner = fetch) {
-  return async (input, init2 = {}) => {
-    const deadline = AbortSignal.timeout(ms);
-    const signal = init2.signal ? AbortSignal.any([init2.signal, deadline]) : deadline;
-    try {
-      return await inner(input, { ...init2, signal });
-    } catch (err) {
-      if (deadline.aborted && !init2.signal?.aborted) {
-        throw new Error(`no answer within ${ms / 1e3}s`, { cause: err });
-      }
-      throw err;
+    if (err) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error(`authorization failed: ${err}`));
+      return;
     }
+    if (!code2) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error("callback carried no authorization code"));
+      return;
+    }
+    res.writeHead(200, { "content-type": "text/html" }).end(PAGE_OK2);
+    resolveResult({ code: code2 });
+  });
+  const timer = setTimeout(() => {
+    rejectResult(new Error("timed out waiting for the browser callback"));
+  }, timeoutMs);
+  timer.unref?.();
+  const close2 = () => {
+    clearTimeout(timer);
+    server.close();
   };
+  void result.finally(close2).catch(() => {
+  });
+  server.listen(port, "127.0.0.1", () => {
+    const addr = server.address();
+    const bound = typeof addr === "object" && addr ? addr.port : port;
+    resolveUri(`http://127.0.0.1:${bound}/callback`);
+  });
+  return { redirectUri, result, close: close2 };
 }
-
-// src/mcp/registry.ts
-async function accountTokenFor(stateDir) {
-  try {
-    const cred = await resolveCredential(process.env, stateDir);
-    return cred.token ?? null;
-  } catch {
-    return null;
-  }
-}
-function defaultClientFactory(stateDir, server) {
-  return new McpHttpClient(
-    server,
-    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir))
+async function login(deps) {
+  const log = deps.log ?? (() => void 0);
+  const now2 = deps.now ?? Date.now;
+  const pkce = createPkce();
+  const { redirectUri: uriP, result, close: close2 } = awaitCallback(
+    pkce,
+    deps.config.port ?? 0,
+    deps.timeoutMs ?? DEFAULT_TIMEOUT_MS5
   );
-}
-var SERVER_CONNECT_TIMEOUT_MS = 3e4;
-var McpRegistry = class {
-  constructor(stateDir, clientFactory = defaultClientFactory) {
-    this.stateDir = stateDir;
-    this.clientFactory = clientFactory;
-  }
-  connected = /* @__PURE__ */ new Map();
-  statuses = /* @__PURE__ */ new Map();
-  // The order the operator wrote servers in daemon.json, captured once per
-  // connectAll() -- `tools()` walks THIS, never `connected`'s Map iteration
-  // order. `connectOne` runs concurrently for every server (Promise.all), so
-  // Map insertion order is race order: whichever server's initialize+list
-  // happened to resolve first. That is fine for `connected` (a lookup table,
-  // order never read) but `tools()` is a list a model/doctor/policy consumes
-  // in order, and race order means a different tool ordering on every daemon
-  // boot -- exactly the kind of bug that surfaces far from here and is never
-  // traced back. Configured order is also information the operator supplied
-  // deliberately; sorting alphabetically would discard it.
-  serverOrder = [];
-  /**
-   * Connect to every configured server and cache its tools. Never throws --
-   * a server that fails to initialize, or fails listing tools, is recorded
-   * in `status()` with zero tools and the daemon keeps starting.
-   */
-  async connectAll(opts = {}) {
-    this.connected.clear();
-    this.statuses.clear();
-    const servers = await readMcpServers(this.stateDir);
-    this.serverOrder = servers.map((s2) => s2.name);
-    const timeoutMs = opts.timeoutMs ?? SERVER_CONNECT_TIMEOUT_MS;
-    await Promise.all(servers.map((server) => this.connectOne(server, timeoutMs, opts.onServer)));
-  }
-  /* BOUNDED, AND SETTLED EXACTLY ONCE.
-   *
-   * Every server connects under one Promise.all, and daemon startup awaits it.
-   * With no bound, one stalled server -- measured: an expired Microsoft 365
-   * token refreshing against a cold service, still waiting at 60 seconds --
-   * left the terminal silent after `mirrors sessions`, indistinguishable from a
-   * crash.
-   *
-   * The deadline covers the whole connect (any credential refresh, initialize,
-   * tools/list), not each request, because several individually bounded steps
-   * in a row can still add up to a hang. The attempt that loses the race keeps
-   * running; its late result is deliberately ignored, so a server reported as
-   * timed out cannot quietly become connected afterwards -- status would then
-   * tell doctor one thing and the registered tools another. */
-  async connectOne(server, timeoutMs, onServer) {
-    let timer;
-    const deadline = new Promise((resolve14) => {
-      timer = setTimeout(() => resolve14("timeout"), timeoutMs);
+  try {
+    const redirectUri = await uriP;
+    const url = authorizeUrl({
+      issuer: deps.config.issuer,
+      clientId: deps.config.clientId,
+      redirectUri,
+      pkce,
+      ...deps.config.scope ? { scope: deps.config.scope } : {}
     });
-    const attempt = (async () => {
-      const client = this.clientFactory(this.stateDir, server);
-      await client.initialize();
-      const tools = await client.listTools();
-      return { client, tools };
-    })();
-    attempt.catch(() => {
+    log("Opening your browser to sign in...");
+    log(url);
+    await deps.openBrowser(url);
+    const { code: code2 } = await result;
+    const tokens = await deps.exchange({
+      issuer: deps.config.issuer,
+      clientId: deps.config.clientId,
+      code: code2,
+      verifier: pkce.verifier,
+      redirectUri
     });
-    try {
-      const outcome = await Promise.race([attempt, deadline]);
-      if (outcome === "timeout") {
-        this.statuses.set(server.name, { connected: false, toolCount: 0, error: `timed out after ${timeoutMs / 1e3}s` });
-      } else {
-        this.connected.set(server.name, outcome);
-        this.statuses.set(server.name, { connected: true, toolCount: outcome.tools.length });
-      }
-    } catch (err) {
-      this.statuses.set(server.name, {
-        connected: false,
-        toolCount: 0,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-    const settled = this.statuses.get(server.name);
-    if (settled) onServer?.({ server: server.name, ...settled });
-  }
-  /** Every tool from every connected server, paired with the server it came
-   *  from, in CONFIGURED order (`serverOrder`) -- not the order servers
-   *  happened to finish connecting in. Within a server, tools stay in the
-   *  order that server returned them. A server with no entry in `connected`
-   *  either failed to connect or reported zero tools -- `status()` tells the
-   *  two apart. */
-  tools() {
-    const out = [];
-    for (const server of this.serverOrder) {
-      const entry = this.connected.get(server);
-      if (!entry) continue;
-      for (const tool of entry.tools) out.push({ server, tool });
-    }
-    return out;
-  }
-  /**
-   * Call one tool on one server. Fails immediately, naming the server, when
-   * that server never connected -- there is nothing to route the call
-   * through, and pretending otherwise would either stall waiting on a
-   * connection that will never appear or return an empty result the caller
-   * could mistake for a genuine (if empty) tool response.
-   */
-  async call(server, tool, args) {
-    const entry = this.connected.get(server);
-    if (!entry) {
-      throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
-    }
-    return entry.client.callTool(tool, args);
-  }
-  /** Per-server connection state, for `doctor` (Task 10) to print. A server
-   *  with `connected: false` always carries `error` -- there is no code path
-   *  that records a failure without a reason, because "no tools" alone tells
-   *  the reader nothing about what to fix. */
-  status() {
-    const out = [];
-    for (const server of this.serverOrder) {
-      const s2 = this.statuses.get(server);
-      if (s2) out.push({ server, ...s2 });
-    }
-    return out;
+    if (!tokens.access_token) throw new Error("the token exchange returned no access token");
+    const cred = {
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+      ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+      ...tokens.account ? { account: tokens.account } : {},
+      ...deps.apiBase ? { apiBase: deps.apiBase } : {}
+    };
+    await saveCredential(cred, deps.stateDir);
+    return {
+      ...cred.account ? { account: cred.account } : {},
+      ...cred.expiresAt ? { expiresAt: cred.expiresAt } : {}
+    };
+  } finally {
+    close2();
   }
-};
-
-// src/mcp/toolNames.ts
-init_protocol();
+}
 
-// src/mcp/asAgentTools.ts
-function isPlainObject3(v2) {
-  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+// src/auth/cli.ts
+init_tools_node();
+function oauthConfigFromEnv(env = process.env) {
+  const issuer = env.CORENEL_OAUTH_ISSUER?.trim();
+  const clientId = env.CORENEL_OAUTH_CLIENT_ID?.trim();
+  if (!issuer || !clientId) return null;
+  return { issuer, clientId };
 }
-function toParameters(inputSchema) {
-  if (isPlainObject3(inputSchema)) return inputSchema;
-  return { type: "object", properties: {} };
+async function exchangeCode2(p2) {
+  const res = await fetch(new URL("/oauth/token", p2.issuer), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: p2.clientId,
+      code: p2.code,
+      code_verifier: p2.verifier,
+      redirect_uri: p2.redirectUri
+    }).toString()
+  });
+  if (!res.ok) {
+    throw new Error(`token exchange failed (HTTP ${res.status})`);
+  }
+  return await res.json();
 }
-function formatContent(content) {
-  if (typeof content === "string") return content;
-  if (Array.isArray(content)) {
-    const parts = content.map((block) => {
-      if (isPlainObject3(block) && typeof block.text === "string") return block.text;
-      return JSON.stringify(block);
+async function runLogin(stateDir, apiBase2) {
+  const config = oauthConfigFromEnv();
+  if (!config) {
+    console.error("Sign-in is not configured on this build.");
+    console.error("Set CORENEL_OAUTH_ISSUER and CORENEL_OAUTH_CLIENT_ID, or use " + TOKEN_ENV2 + " for headless use.");
+    return 1;
+  }
+  try {
+    const res = await login({
+      config,
+      openBrowser,
+      exchange: exchangeCode2,
+      log: (l2) => console.error(l2),
+      ...stateDir ? { stateDir } : {},
+      // Recorded so the daemon does not have to guess later which API this
+      // credential belongs to -- see LoginDeps.apiBase.
+      ...apiBase2 ? { apiBase: apiBase2 } : {}
     });
-    return parts.join("\n");
+    console.error(`Signed in${res.account ? ` as ${res.account}` : ""}.`);
+    return 0;
+  } catch (err) {
+    console.error(`Sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
   }
-  if (content == null) return "";
-  return JSON.stringify(content);
 }
-function asAgentTools(registry2) {
-  const out = [];
-  for (const { server, tool } of registry2.tools()) {
-    if (!canEncodeMcpWireName(server, tool.name)) {
-      console.error(
-        `MCP tool refused: server "${server}" tool "${tool.name}" cannot be encoded as a wire name (unsupported characters or too long) -- this tool is not available to the model`
-      );
-      continue;
-    }
-    out.push(toAgentTool(registry2, server, tool));
+async function runLogout(stateDir, env = process.env) {
+  const before = await resolveCredential(env, stateDir);
+  await clearCredential(stateDir);
+  console.error("Signed out. (Paired devices are unaffected - run `hosts forget` to unpair.)");
+  console.error(`  Cleared ${tokenFilePath(stateDir)} and ${credentialFilePath(stateDir)}`);
+  if (before.source === "none") console.error("  Nothing was stored - this machine was already signed out.");
+  if (env[TOKEN_ENV2]?.trim()) {
+    console.error(`  NOTE: ${TOKEN_ENV2} is still set in this environment, so this machine is STILL signed in.`);
   }
-  return out;
+  return 0;
 }
-function toAgentTool(registry2, server, tool) {
-  const name = mcpWireName(server, tool.name);
-  const address = mcpToolAddress(server, tool.name);
-  return {
-    name,
-    namespace: "mcp",
-    description: tool.description?.trim() || `MCP tool "${tool.name}" on server "${server}" (${address}).`,
-    parameters: toParameters(tool.inputSchema),
-    mutates: true,
-    async run(args) {
-      const result = await registry2.call(server, tool.name, args);
-      const text = formatContent(result.content);
-      return result.isError ? `Error: ${text}` : text;
-    }
-  };
+function sourceLabel(source) {
+  return source === "env" ? `${TOKEN_ENV2} environment variable` : source === "token-file" ? "token file" : source === "credential-file" ? "credential file (auth.json)" : "none";
 }
-
-// src/mcp/policy.ts
-function mcpCallAllowed(address, policy) {
-  const allow = policy.tools?.allow ?? [];
-  if (!matchesAnyGlob(address, allow)) {
-    return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
-  }
-  const service = new PermissionService({
-    policy,
-    defaultForReadOnly: "allow",
-    defaultForMutating: "allow"
-  });
-  const level = service.resolveLevel({ name: address, address, mutates: true });
-  if (level !== "allow") {
-    return {
-      ok: false,
-      reason: `${address} resolves to permission "${level}" - MCP tools never prompt; set it to "allow" or remove the rule`
-    };
+async function runAuthStatus(stateDir, env = process.env) {
+  const r2 = await resolveCredential(env, stateDir);
+  if (!r2.token) {
+    console.error("Not signed in. Run `corenel login`, or set " + TOKEN_ENV2 + ".");
+    console.error(`  Looked in ${tokenFilePath(stateDir)}`);
+    console.error(`  Looked in ${credentialFilePath(stateDir)}`);
+    return 1;
   }
-  return { ok: true };
+  console.error(`Signed in (${r2.source === "env" ? sourceLabel(r2.source) : r2.path}).`);
+  console.error(`  account  ${r2.account ?? "not recorded in this store - run `corenel login` to record it"}`);
+  console.error(`  token    ${maskToken(r2.token)}`);
+  console.error(`  source   ${sourceLabel(r2.source)}`);
+  console.error(`  expiry   ${r2.expired ? `EXPIRED at ${new Date(r2.expiresAt ?? 0).toISOString()} - run login again` : r2.expiresAt ? new Date(r2.expiresAt).toISOString() : "not recorded in this store"}`);
+  return r2.expired ? 1 : 0;
 }
 
+// src/cli.ts
+init_fileService();
+import { relative as relative7, resolve as resolvePath } from "node:path";
+
 // src/mcp/daemonTools.ts
 function buildMcpPolicy(fileConfig) {
   return {
@@ -49824,24 +50738,7 @@ function buildMcpPolicy(fileConfig) {
   };
 }
 function registerMcpTools(registry2, policy) {
-  const base = asAgentTools(registry2);
-  const byWireName = new Map(base.map((t2) => [t2.name, t2]));
-  const wrapped = [];
-  for (const { server, tool } of registry2.tools()) {
-    if (!canEncodeMcpWireName(server, tool.name)) continue;
-    const name = mcpWireName(server, tool.name);
-    const original = byWireName.get(name);
-    if (!original) continue;
-    const address = mcpToolAddress(server, tool.name);
-    wrapped.push({
-      ...original,
-      async run(args, ctx) {
-        const decision = mcpCallAllowed(address, policy);
-        if (!decision.ok) return `Error: ${decision.reason}`;
-        return original.run(args, ctx);
-      }
-    });
-  }
+  const wrapped = gatedAgentTools(registry2, policy);
   for (const tool of wrapped) registerTool(tool);
   return () => {
     for (const tool of wrapped) unregisterTool(tool.name);