@corenel/sidecar 0.8.7 → 0.9.0

package/dist/cli.js

@@ -401,7 +401,7 @@ var init_protocol = __esm({
 
 // ../tools-node/fileService.ts
 import { promises as fs3 } from "node:fs";
-import { join as join3, resolve, relative, dirname, sep, basename, isAbsolute } from "node:path";
+import { join as join4, resolve, relative, dirname as dirname2, sep, basename, isAbsolute } from "node:path";
 async function looksLikeGeneratedCoverage(absDir) {
   try {
     const names = await fs3.readdir(absDir);
@@ -484,7 +484,7 @@ var init_fileService = __esm({
             return;
           } catch (e2) {
             if (e2 instanceof Error && e2.message.includes("via symlink")) throw e2;
-            const parent = dirname(probe);
+            const parent = dirname2(probe);
             if (parent === probe) throw new Error(`cannot resolve path under the workspace root: ${a2}`);
             probe = parent;
           }
@@ -507,7 +507,7 @@ var init_fileService = __esm({
           const out = [];
           for (const e2 of entries.sort((a2, b2) => a2.name.localeCompare(b2.name))) {
             if (SKIP.has(e2.name)) continue;
-            const absChild = join3(absDir, e2.name);
+            const absChild = join4(absDir, e2.name);
             const path = normalizeFilePath(relative(this.root, absChild));
             if (e2.isDirectory() && SKIP_PATHS.has(path)) continue;
             if (e2.isDirectory() && e2.name === "coverage" && await looksLikeGeneratedCoverage(absChild)) continue;
@@ -535,19 +535,19 @@ var init_fileService = __esm({
       }
       async write(path, content) {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         await fs3.writeFile(a2, content, "utf8");
       }
       async writeBytes(path, bytes) {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         await fs3.writeFile(a2, bytes);
       }
       async create(path, content = "") {
         const a2 = this.abs(path);
-        await fs3.mkdir(dirname(a2), { recursive: true });
+        await fs3.mkdir(dirname2(a2), { recursive: true });
         await this.assertReal(a2);
         try {
           await fs3.writeFile(a2, content, { flag: "wx" });
@@ -561,7 +561,7 @@ var init_fileService = __esm({
       }
       async rename(from, to) {
         const t2 = this.abs(to);
-        await fs3.mkdir(dirname(t2), { recursive: true });
+        await fs3.mkdir(dirname2(t2), { recursive: true });
         await this.assertReal(t2);
         await fs3.rename(await this.realAbs(from), t2);
       }
@@ -594,21 +594,24 @@ var init_fileService = __esm({
 // ../tools-node/auth.ts
 import { promises as fs4 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function corenelDir2(base = homedir2()) {
-  return join4(base, stateDirName());
+  return join5(base, stateDirName());
 }
 function sidecarDir(base = homedir2()) {
-  return join4(corenelDir2(base), "sidecar");
+  return join5(corenelDir2(base), "sidecar");
+}
+function authTokenPath(base = homedir2()) {
+  return join5(corenelDir2(base), "token");
 }
 function credentialDir(stateDir) {
   return stateDir ?? corenelDir2();
 }
 function tokenFilePath(stateDir) {
-  return join4(credentialDir(stateDir), "token");
+  return join5(credentialDir(stateDir), "token");
 }
 function credentialFilePath(stateDir) {
-  return join4(credentialDir(stateDir), "auth.json");
+  return join5(credentialDir(stateDir), "auth.json");
 }
 async function writeFilePrivateAtomic(path, contents) {
   const tmp = `${path}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
@@ -636,6 +639,49 @@ async function writeAuthToken(token, stateDir) {
   } catch {
   }
 }
+async function writeLoginCredential(token, opts = {}) {
+  const cred = {
+    accessToken: token.trim(),
+    ...opts.account ? { account: opts.account } : {},
+    ...opts.apiBase ? { apiBase: opts.apiBase } : {}
+  };
+  const dir = credentialDir(opts.stateDir);
+  const credPath = credentialFilePath(opts.stateDir);
+  const tokPath = tokenFilePath(opts.stateDir);
+  await fs4.mkdir(dir, { recursive: true, mode: 448 });
+  const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  await fs4.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}
+`, { mode: 384 });
+  await fs4.writeFile(tokTmp, `${cred.accessToken}
+`, { mode: 384 });
+  try {
+    await fs4.chmod(credTmp, 384);
+  } catch {
+  }
+  try {
+    await fs4.chmod(tokTmp, 384);
+  } catch {
+  }
+  try {
+    await fs4.rename(credTmp, credPath);
+    await fs4.rename(tokTmp, tokPath);
+  } catch (e2) {
+    try {
+      await fs4.rm(credTmp, { force: true });
+    } catch {
+    }
+    try {
+      await fs4.rm(tokTmp, { force: true });
+    } catch {
+    }
+    throw e2;
+  }
+  try {
+    await fs4.chmod(dir, 448);
+  } catch {
+  }
+}
 function isMissing(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
@@ -656,6 +702,9 @@ async function clearAuthToken(stateDir) {
   } catch {
   }
 }
+async function readCredentialFile(stateDir) {
+  return (await readCredentialFileRead(stateDir)).value;
+}
 async function readCredentialFileRead(stateDir) {
   let raw;
   try {
@@ -13820,7 +13869,7 @@ var require_compiler = __commonJS({
         });
         this._emitLine("root: root\n};");
       };
-      _proto.compile = function compile(node, frame) {
+      _proto.compile = function compile2(node, frame) {
         var _compile = this["compile" + node.typename];
         if (_compile) {
           _compile.call(this, node, frame);
@@ -13834,7 +13883,7 @@ var require_compiler = __commonJS({
       return Compiler2;
     }(Obj);
     module.exports = {
-      compile: function compile(src2, asyncFilters, extensions, name, opts) {
+      compile: function compile2(src2, asyncFilters, extensions, name, opts) {
         if (opts === void 0) {
           opts = {};
         }
@@ -15249,7 +15298,7 @@ var require_environment = __commonJS({
           }
         });
       };
-      _proto3.compile = function compile() {
+      _proto3.compile = function compile2() {
         if (!this.compiled) {
           this._compile();
         }
@@ -15746,7 +15795,7 @@ var require_nunjucks = __commonJS({
       reset: function reset() {
         e2 = void 0;
       },
-      compile: function compile(src2, env, path, eagerCompile) {
+      compile: function compile2(src2, env, path, eagerCompile) {
         if (!e2) {
           configure();
         }
@@ -15914,6 +15963,43 @@ function getLanguageAliasesForExtension(ext) {
 function generateCompilationId() {
   return `compile-${++compilationCounter}-${Date.now()}`;
 }
+function normalizePosix2(p2) {
+  const isAbs = p2.startsWith("/");
+  const out = [];
+  for (const seg of p2.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (out.length && out[out.length - 1] !== "..") out.pop();
+      else if (!isAbs) out.push("..");
+    } else {
+      out.push(seg);
+    }
+  }
+  const joined = out.join("/");
+  return isAbs ? "/" + joined : joined || ".";
+}
+function joinPosix2(...segments2) {
+  const filtered = segments2.filter((s2) => s2 && s2.length > 0);
+  if (filtered.length === 0) return ".";
+  return normalizePosix2(filtered.join("/"));
+}
+function dirnamePosix2(p2) {
+  const norm2 = p2.replace(/\/+$/, "");
+  const idx = norm2.lastIndexOf("/");
+  if (idx === -1) return ".";
+  if (idx === 0) return "/";
+  return norm2.slice(0, idx);
+}
+function utf8ByteLength(s2) {
+  return new TextEncoder().encode(s2).length;
+}
+function toRelKey(filePath) {
+  let n2 = filePath.replace(/\\/g, "/");
+  if (n2.startsWith("./")) n2 = n2.substring(2);
+  if (n2.startsWith("/")) n2 = n2.substring(1);
+  if (n2.endsWith("/") && n2.length > 1) n2 = n2.substring(0, n2.length - 1);
+  return n2;
+}
 function createCoreStages() {
   return [
     new LexicalAnalysisStage(),
@@ -15923,7 +16009,7 @@ function createCoreStages() {
     new CodeGenerationStage()
   ];
 }
-var yaml, import_semver, nunjucks, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, PrompdCompiler;
+var yaml, import_semver, nunjucks, PrompdParser, PACKAGE_TYPE_DIRS, VALID_PACKAGE_TYPES, PrompdError, ParseError, ValidationError, CompilationError, SecurityError, CompilationContext, DEFAULT_SECURITY_CONFIG, PROMPD_EXTENSIONS, CompilerPipeline, LexicalAnalysisStage, DependencyResolutionStage, SemanticAnalysisStage, _SectionOverrideProcessor, SectionOverrideProcessor, EXTENSION_TO_LANGUAGE_ALIASES, globalIncludeStacks, compilationCounter, PrompdLoader, TemplateProcessingStage, MarkdownFormatter, OpenAIFormatter, AnthropicFormatter, CodeGenerationStage, MemoryFileSystem, HybridFileSystem, PrompdCompiler;
 var init_dist = __esm({
   "../../node_modules/.pnpm/@prompd+core@0.5.0-beta.10/node_modules/@prompd/core/dist/index.js"() {
     yaml = __toESM(require_dist(), 1);
@@ -17205,8 +17291,8 @@ ${yamlContent}` : yamlContent;
           processedContent = content;
         }
         if (this.verbose) {
-          const preview = processedContent.substring(0, 50).replace(/\n/g, "\\n");
-          console.log(`[include] Loaded ${ext} file: ${filePath} (${preview}...)`);
+          const preview2 = processedContent.substring(0, 50).replace(/\n/g, "\\n");
+          console.log(`[include] Loaded ${ext} file: ${filePath} (${preview2}...)`);
         }
         return {
           src: processedContent,
@@ -17828,8 +17914,8 @@ ${content}` : parentData.content;
           }
           removedCount++;
           if (verbose) {
-            const preview = blockContent.substring(0, 50).replace(/\n/g, "\\n");
-            console.log(`  - Removing \`\`\`${lang} block: "${preview}..."`);
+            const preview2 = blockContent.substring(0, 50).replace(/\n/g, "\\n");
+            console.log(`  - Removing \`\`\`${lang} block: "${preview2}..."`);
           }
           return "";
         });
@@ -18503,6 +18589,150 @@ ${firstUserMsg.content}`;
         return "Code Generation";
       }
     };
+    MemoryFileSystem = class {
+      constructor(files = {}) {
+        this.files = /* @__PURE__ */ new Map();
+        for (const [filePath, content] of Object.entries(files)) {
+          this.addFile(filePath, content);
+        }
+      }
+      /** Add or update a file in the in-memory file system. */
+      addFile(filePath, content) {
+        this.files.set(this.normalizePath(filePath), content);
+      }
+      /** Add multiple files at once. */
+      addFiles(files) {
+        for (const [filePath, content] of Object.entries(files)) {
+          this.addFile(filePath, content);
+        }
+      }
+      exists(filePath) {
+        return this.files.has(this.normalizePath(filePath));
+      }
+      readFile(filePath) {
+        const normalizedPath = this.normalizePath(filePath);
+        const content = this.files.get(normalizedPath);
+        if (content === void 0) {
+          throw new Error(`File not found: ${filePath}`);
+        }
+        return content;
+      }
+      isDirectory(filePath) {
+        const normalizedPath = this.normalizePath(filePath);
+        const dirPrefix = normalizedPath.endsWith("/") ? normalizedPath : normalizedPath + "/";
+        for (const file of this.files.keys()) {
+          if (file.startsWith(dirPrefix)) {
+            return true;
+          }
+        }
+        return false;
+      }
+      readdir(dirPath) {
+        const normalizedDir = this.normalizePath(dirPath);
+        const dirPrefix = normalizedDir.endsWith("/") ? normalizedDir : normalizedDir + "/";
+        const files = /* @__PURE__ */ new Set();
+        for (const file of this.files.keys()) {
+          if (file.startsWith(dirPrefix)) {
+            const relativePath = file.substring(dirPrefix.length);
+            const slashIndex = relativePath.indexOf("/");
+            const fileName = slashIndex === -1 ? relativePath : relativePath.substring(0, slashIndex);
+            if (fileName) {
+              files.add(fileName);
+            }
+          }
+        }
+        return Array.from(files);
+      }
+      resolve(...pathSegments) {
+        return joinPosix2("/", ...pathSegments);
+      }
+      dirname(filePath) {
+        return dirnamePosix2(filePath);
+      }
+      join(...pathSegments) {
+        return joinPosix2(...pathSegments);
+      }
+      /** Get the virtual file system path for a package. */
+      getPackagePath(packageName, version) {
+        return `/packages/${packageName}@${version}`;
+      }
+      /** Get all files under an optional base path. */
+      getAllFiles(basePath) {
+        if (!basePath) {
+          return new Map(this.files);
+        }
+        const normalizedBase = this.normalizePath(basePath);
+        const prefix = normalizedBase.endsWith("/") ? normalizedBase : normalizedBase + "/";
+        const filtered = /* @__PURE__ */ new Map();
+        for (const [filePath, content] of this.files.entries()) {
+          if (filePath.startsWith(prefix) || filePath === normalizedBase) {
+            filtered.set(filePath, content);
+          }
+        }
+        return filtered;
+      }
+      /** Calculate total size (bytes) and file count under a base path. */
+      getTotalSize(basePath) {
+        const files = this.getAllFiles(basePath);
+        let totalSize = 0;
+        for (const content of files.values()) {
+          totalSize += utf8ByteLength(content);
+        }
+        return { size: totalSize, files: files.size };
+      }
+      /** Normalize path to forward slashes, drop leading ./ and /, no trailing slash. */
+      normalizePath(filePath) {
+        return toRelKey(filePath);
+      }
+    };
+    HybridFileSystem = class {
+      constructor(files = {}, backend2) {
+        this.mem = new MemoryFileSystem(files);
+        this.backend = backend2;
+      }
+      /** Add or update an in-memory (synchronously-served) file. */
+      addFile(filePath, content) {
+        this.mem.addFile(filePath, content);
+      }
+      /** Add multiple in-memory files at once. */
+      addFiles(files) {
+        this.mem.addFiles(files);
+      }
+      exists(filePath) {
+        if (this.mem.exists(filePath)) return true;
+        return this.backend.readFile(this.normalize(filePath)).then((content) => content !== null).catch(() => false);
+      }
+      readFile(filePath) {
+        if (this.mem.exists(filePath)) return this.mem.readFile(filePath);
+        return this.backend.readFile(this.normalize(filePath)).then((content) => {
+          if (content === null) throw new Error(`File not found: ${filePath}`);
+          return content;
+        });
+      }
+      isDirectory(filePath) {
+        if (this.mem.isDirectory(filePath)) return true;
+        if (!this.backend.isDirectory) return false;
+        return this.backend.isDirectory(this.normalize(filePath)).catch(() => false);
+      }
+      readdir(dirPath) {
+        const local = this.mem.readdir(dirPath);
+        if (!this.backend.readdir) return local;
+        return this.backend.readdir(this.normalize(dirPath)).then((remote) => Array.from(/* @__PURE__ */ new Set([...local, ...remote]))).catch(() => local);
+      }
+      resolve(...pathSegments) {
+        return this.mem.resolve(...pathSegments);
+      }
+      dirname(filePath) {
+        return this.mem.dirname(filePath);
+      }
+      join(...pathSegments) {
+        return this.mem.join(...pathSegments);
+      }
+      /** Normalize to the same relative keys MemoryFileSystem uses, for backend lookups. */
+      normalize(filePath) {
+        return toRelKey(filePath);
+      }
+    };
     PrompdCompiler = class {
       constructor(options = {}) {
         this.securityConfig = options.securityConfig || DEFAULT_SECURITY_CONFIG;
@@ -18535,13 +18765,107 @@ ${firstUserMsg.content}`;
   }
 });
 
+// ../tools-node/toolGuidance.ts
+function nodeToolGuidance(toolNames) {
+  const has3 = new Set(toolNames);
+  const parts = [];
+  if (has3.has(SHELL_TOOL)) parts.push(SHELL);
+  if (PROC_TOOLS.some((t2) => has3.has(t2))) parts.push(PROCS);
+  return parts.join("\n\n");
+}
+var SHELL_TOOL, PROC_TOOLS, SHELL, PROCS;
+var init_toolGuidance = __esm({
+  "../tools-node/toolGuidance.ts"() {
+    "use strict";
+    SHELL_TOOL = "shell";
+    PROC_TOOLS = ["proc_start", "proc_stop", "proc_list"];
+    SHELL = `Running a command is often the shortest correct answer: use \`${SHELL_TOOL}\` for anything a command already does well -- listing, searching, git, package managers, build and test runners -- instead of reconstructing it from file reads. It waits for the command to finish and returns its output, so it is the wrong tool for anything that does not exit on its own.`;
+    PROCS = `A command that keeps running (a dev server, a watcher, a queue worker) belongs to \`${PROC_TOOLS[0]}\`, not \`${SHELL_TOOL}\` -- starting one with \`${SHELL_TOOL}\` hangs the turn until it is killed. Use \`${PROC_TOOLS[2]}\` to see what is already running before starting anything, and \`${PROC_TOOLS[1]}\` to stop what you started. Do not stop a process you did not start.`;
+  }
+});
+
 // ../tools-node/promptHost.ts
+function backend(svc) {
+  return {
+    async readFile(p2) {
+      try {
+        return await svc.read(normalizeFilePath(p2));
+      } catch {
+        return null;
+      }
+    },
+    async isDirectory(p2) {
+      return (await svc.stat(normalizeFilePath(p2)))?.kind === "directory";
+    },
+    async readdir(p2) {
+      return (await svc.list(normalizeFilePath(p2))).map((n2) => n2.name);
+    }
+  };
+}
+async function preload(svc) {
+  const out = {};
+  for (const f2 of flattenFiles(await svc.list())) {
+    try {
+      out[f2.path] = await svc.read(f2.path);
+    } catch {
+    }
+  }
+  return out;
+}
+async function compile(src2, values, fileSystem, mainPath) {
+  const mp = mainPath || "/main.prmd";
+  const fs17 = fileSystem || new MemoryFileSystem({ [mp]: src2 });
+  const ctx = await compiler.compileWithContext(mp, { parameters: values || {}, fileSystem: fs17, outputFormat: "markdown" });
+  const compiled = ctx.compiledResult;
+  const output = typeof compiled === "string" ? compiled : compiled ? new TextDecoder().decode(compiled) : "";
+  return { output };
+}
+function nodePromptHost(workspace, project) {
+  return {
+    workspace,
+    /* The user's PROJECT files, when the caller has them, so skills installed
+     * into `.prompd/skills/` are visible. Omitted rather than faked when there
+     * is none: a CLI invoked outside a project genuinely has no installed
+     * skills, and saying so beats inventing an empty directory. */
+    ...project ? { projectWorkspace: () => project } : {},
+    seed: async (defaults2) => {
+      for (const [p2, content] of Object.entries(defaults2)) {
+        if (!await workspace.stat(p2)) await workspace.write(p2, content);
+      }
+    },
+    parse: (source) => ({ meta: parser.parseContent(source).metadata ?? {} }),
+    compileBody: (source, values) => compile(source, values),
+    compileTemplate: async (path, liveSrc, values) => {
+      const sources = await preload(workspace);
+      const p2 = normalizeFilePath(path);
+      sources[p2] = liveSrc;
+      return compile("", values, new HybridFileSystem(sources, backend(workspace)), "/" + p2);
+    },
+    siteIndex: () => "",
+    // no site index in node (the help chat is browser-only)
+    /* Who the agent says it IS. Without this, `composeAgentSystem` falls back
+     * to its `'Prompd'` default and the `corenel` binary's agent introduced
+     * itself as "the Prompd assistant" -- the same leak already fixed for the
+     * browser help chat (composeHelpSystem) and missed here, because the node
+     * host is the one PromptHost that never implemented the hook.
+     *
+     * Constant, not a parameter: every node consumer of this host (the CLI and
+     * the sidecar) IS Corenel. A host that is not should implement its own. */
+    appName: () => "Corenel",
+    /* The product's guidance for the tools this run actually has -- the shell,
+     * long-running processes, and deferred MCP tools. Gated per tool inside
+     * nodeToolGuidance, because this same host serves the sidecar, whose shell
+     * is behind --allow-shell. */
+    toolGuidance: (names) => nodeToolGuidance(names)
+  };
+}
 var parser, compiler;
 var init_promptHost = __esm({
   "../tools-node/promptHost.ts"() {
     "use strict";
     init_dist();
     init_protocol();
+    init_toolGuidance();
     parser = new PrompdParser();
     compiler = new PrompdCompiler();
   }
@@ -18550,7 +18874,7 @@ var init_promptHost = __esm({
 // ../tools-node/migrateHome.ts
 import { promises as fs5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join5, dirname as dirname2 } from "node:path";
+import { join as join6, dirname as dirname3 } from "node:path";
 async function isDir(p2) {
   return fs5.stat(p2).then((s2) => s2.isDirectory()).catch(() => false);
 }
@@ -18566,7 +18890,7 @@ async function moveEntry(from, to, report) {
     report.skipped.push({ path: to, reason: "destination already exists" });
     return;
   }
-  await fs5.mkdir(dirname2(to), { recursive: true });
+  await fs5.mkdir(dirname3(to), { recursive: true });
   try {
     await fs5.rename(from, to);
     report.moved.push(to);
@@ -18592,8 +18916,8 @@ async function moveEntry(from, to, report) {
 async function mergeDir(from, to, report) {
   const entries = await fs5.readdir(from, { withFileTypes: true }).catch(() => []);
   for (const e2 of entries) {
-    const src2 = join5(from, e2.name);
-    const dst = join5(to, e2.name);
+    const src2 = join6(from, e2.name);
+    const dst = join6(to, e2.name);
     if (e2.isDirectory() && await isDir(dst)) await mergeDir(src2, dst, report);
     else await moveEntry(src2, dst, report);
   }
@@ -18604,16 +18928,16 @@ async function migrateHomeLayout(base = homedir3()) {
   const report = { moved: [], skipped: [] };
   const home = corenelDir2(base);
   if (!await present(home)) return report;
-  const config = join5(home, "config");
+  const config = join6(home, "config");
   if (await isDir(config)) await mergeDir(config, home, report);
   const side = sidecarDir(base);
   for (const name of SIDECAR_FILES) {
-    await moveEntry(join5(home, name), join5(side, name), report);
+    await moveEntry(join6(home, name), join6(side, name), report);
   }
   for (const name of SIDECAR_DIRS) {
-    const src2 = join5(home, name);
+    const src2 = join6(home, name);
     if (!await isDir(src2)) continue;
-    const dst = join5(side, name);
+    const dst = join6(side, name);
     if (await isDir(dst)) await mergeDir(src2, dst, report);
     else await moveEntry(src2, dst, report);
   }
@@ -18638,7 +18962,50 @@ var init_migrateHome = __esm({
   }
 });
 
+// ../tools-node/openBrowser.ts
+import { spawn } from "node:child_process";
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+var init_openBrowser = __esm({
+  "../tools-node/openBrowser.ts"() {
+    "use strict";
+  }
+});
+
 // ../tools-node/index.ts
+var tools_node_exports = {};
+__export(tools_node_exports, {
+  API_BASE_ENV: () => API_BASE_ENV,
+  NodeFileService: () => NodeFileService,
+  TOKEN_ENV: () => TOKEN_ENV,
+  authTokenPath: () => authTokenPath,
+  clearAllCredentials: () => clearAllCredentials,
+  clearAuthToken: () => clearAuthToken,
+  corenelDir: () => corenelDir2,
+  credentialDir: () => credentialDir,
+  credentialFilePath: () => credentialFilePath,
+  maskAccount: () => maskAccount,
+  maskToken: () => maskToken,
+  migrateHomeLayout: () => migrateHomeLayout,
+  nodeAuthToken: () => nodeAuthToken,
+  nodePromptHost: () => nodePromptHost,
+  openBrowser: () => openBrowser,
+  readAuthToken: () => readAuthToken,
+  readAuthTokenRead: () => readAuthTokenRead,
+  readCredentialFile: () => readCredentialFile,
+  readCredentialFileRead: () => readCredentialFileRead,
+  resolveApiBase: () => resolveApiBase,
+  resolveNodeCredential: () => resolveNodeCredential,
+  sidecarDir: () => sidecarDir,
+  tokenFilePath: () => tokenFilePath,
+  writeAuthToken: () => writeAuthToken,
+  writeLoginCredential: () => writeLoginCredential
+});
 var init_tools_node = __esm({
   "../tools-node/index.ts"() {
     "use strict";
@@ -18646,59 +19013,7 @@ var init_tools_node = __esm({
     init_auth();
     init_promptHost();
     init_migrateHome();
-  }
-});
-
-// src/auth/store.ts
-import { promises as fs6 } from "node:fs";
-function authDir(stateDir) {
-  return credentialDir(stateDir);
-}
-function credentialPath(stateDir) {
-  return credentialFilePath(stateDir);
-}
-async function readForeignAuthJson(path) {
-  let raw;
-  try {
-    raw = await fs6.readFile(path, "utf8");
-  } catch {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-    const obj = { ...parsed };
-    for (const k2 of STORED_CREDENTIAL_KEYS) delete obj[k2];
-    return obj;
-  } catch {
-    return {};
-  }
-}
-async function saveCredential(cred, stateDir) {
-  const path = credentialPath(stateDir);
-  await fs6.mkdir(authDir(stateDir), { recursive: true });
-  const foreign = await readForeignAuthJson(path);
-  const next = { ...foreign, ...cred };
-  await fs6.writeFile(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
-  try {
-    await fs6.chmod(path, 384);
-  } catch {
-  }
-  await writeAuthToken(cred.accessToken, stateDir);
-}
-async function clearCredential(stateDir) {
-  await clearAllCredentials(stateDir);
-}
-async function resolveCredential(env = process.env, stateDir, now2 = Date.now) {
-  return await resolveNodeCredential({ env, now: now2, ...stateDir ? { stateDir } : {} });
-}
-var TOKEN_ENV2, STORED_CREDENTIAL_KEYS;
-var init_store = __esm({
-  "src/auth/store.ts"() {
-    "use strict";
-    init_tools_node();
-    TOKEN_ENV2 = TOKEN_ENV;
-    STORED_CREDENTIAL_KEYS = ["accessToken", "refreshToken", "expiresAt", "account", "apiBase"];
+    init_openBrowser();
   }
 });
 
@@ -25102,270 +25417,6 @@ var init_fileFromPath = __esm({
   }
 });
 
-// src/auth/pkce.ts
-import { createHash as createHash4, randomBytes as randomBytes6 } from "node:crypto";
-function base64url2(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function createVerifier(bytes = 32) {
-  return base64url2(randomBytes6(bytes));
-}
-function challengeFor(verifier) {
-  return base64url2(createHash4("sha256").update(verifier).digest());
-}
-function createState() {
-  return base64url2(randomBytes6(16));
-}
-function createPkce() {
-  const verifier = createVerifier();
-  return { verifier, challenge: challengeFor(verifier), method: "S256", state: createState() };
-}
-function authorizeUrl(p2) {
-  const u2 = new URL("/oauth/authorize", p2.issuer);
-  u2.searchParams.set("response_type", "code");
-  u2.searchParams.set("client_id", p2.clientId);
-  u2.searchParams.set("redirect_uri", p2.redirectUri);
-  u2.searchParams.set("code_challenge", p2.pkce.challenge);
-  u2.searchParams.set("code_challenge_method", p2.pkce.method);
-  u2.searchParams.set("state", p2.pkce.state);
-  u2.searchParams.set("scope", p2.scope ?? "profile email");
-  return u2.toString();
-}
-function stateMatches(expected, got) {
-  if (!got || got.length !== expected.length) return false;
-  let diff = 0;
-  for (let i2 = 0; i2 < expected.length; i2++) diff |= expected.charCodeAt(i2) ^ got.charCodeAt(i2);
-  return diff === 0;
-}
-var init_pkce = __esm({
-  "src/auth/pkce.ts"() {
-    "use strict";
-  }
-});
-
-// src/auth/login.ts
-import { createServer as createServer2 } from "node:http";
-function awaitCallback(pkce, port, timeoutMs) {
-  let resolveUri;
-  let resolveResult;
-  let rejectResult;
-  const redirectUri = new Promise((res) => {
-    resolveUri = res;
-  });
-  const result = new Promise((res, rej) => {
-    resolveResult = res;
-    rejectResult = rej;
-  });
-  const server = createServer2((req, res) => {
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname !== "/callback") {
-      res.writeHead(404).end();
-      return;
-    }
-    const err = url.searchParams.get("error");
-    const code2 = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (!stateMatches(pkce.state, state)) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error("state mismatch \u2014 the callback did not match this sign-in request"));
-      return;
-    }
-    if (err) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error(`authorization failed: ${err}`));
-      return;
-    }
-    if (!code2) {
-      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
-      rejectResult(new Error("callback carried no authorization code"));
-      return;
-    }
-    res.writeHead(200, { "content-type": "text/html" }).end(PAGE_OK2);
-    resolveResult({ code: code2 });
-  });
-  const timer = setTimeout(() => {
-    rejectResult(new Error("timed out waiting for the browser callback"));
-  }, timeoutMs);
-  timer.unref?.();
-  const close2 = () => {
-    clearTimeout(timer);
-    server.close();
-  };
-  void result.finally(close2).catch(() => {
-  });
-  server.listen(port, "127.0.0.1", () => {
-    const addr = server.address();
-    const bound = typeof addr === "object" && addr ? addr.port : port;
-    resolveUri(`http://127.0.0.1:${bound}/callback`);
-  });
-  return { redirectUri, result, close: close2 };
-}
-async function login(deps) {
-  const log = deps.log ?? (() => void 0);
-  const now2 = deps.now ?? Date.now;
-  const pkce = createPkce();
-  const { redirectUri: uriP, result, close: close2 } = awaitCallback(
-    pkce,
-    deps.config.port ?? 0,
-    deps.timeoutMs ?? DEFAULT_TIMEOUT_MS4
-  );
-  try {
-    const redirectUri = await uriP;
-    const url = authorizeUrl({
-      issuer: deps.config.issuer,
-      clientId: deps.config.clientId,
-      redirectUri,
-      pkce,
-      ...deps.config.scope ? { scope: deps.config.scope } : {}
-    });
-    log("Opening your browser to sign in...");
-    log(url);
-    await deps.openBrowser(url);
-    const { code: code2 } = await result;
-    const tokens = await deps.exchange({
-      issuer: deps.config.issuer,
-      clientId: deps.config.clientId,
-      code: code2,
-      verifier: pkce.verifier,
-      redirectUri
-    });
-    if (!tokens.access_token) throw new Error("the token exchange returned no access token");
-    const cred = {
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
-      ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-      ...tokens.account ? { account: tokens.account } : {},
-      ...deps.apiBase ? { apiBase: deps.apiBase } : {}
-    };
-    await saveCredential(cred, deps.stateDir);
-    return {
-      ...cred.account ? { account: cred.account } : {},
-      ...cred.expiresAt ? { expiresAt: cred.expiresAt } : {}
-    };
-  } finally {
-    close2();
-  }
-}
-var DEFAULT_TIMEOUT_MS4, PAGE_OK2, PAGE_FAIL2;
-var init_login = __esm({
-  "src/auth/login.ts"() {
-    "use strict";
-    init_pkce();
-    init_store();
-    DEFAULT_TIMEOUT_MS4 = 5 * 60 * 1e3;
-    PAGE_OK2 = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
-<body style="font:16px system-ui;padding:3rem;text-align:center">
-<h1>Signed in to Corenel</h1><p>You can close this tab and return to your terminal.</p></body>`;
-    PAGE_FAIL2 = `<!doctype html><meta charset="utf-8"><title>Sign-in failed</title>
-<body style="font:16px system-ui;padding:3rem;text-align:center">
-<h1>Sign-in failed</h1><p>Return to your terminal for details.</p></body>`;
-  }
-});
-
-// src/auth/cli.ts
-var cli_exports = {};
-__export(cli_exports, {
-  exchangeCode: () => exchangeCode2,
-  oauthConfigFromEnv: () => oauthConfigFromEnv,
-  openBrowser: () => openBrowser,
-  runAuthStatus: () => runAuthStatus,
-  runLogin: () => runLogin,
-  runLogout: () => runLogout
-});
-import { spawn as spawn6 } from "node:child_process";
-function oauthConfigFromEnv(env = process.env) {
-  const issuer = env.CORENEL_OAUTH_ISSUER?.trim();
-  const clientId = env.CORENEL_OAUTH_CLIENT_ID?.trim();
-  if (!issuer || !clientId) return null;
-  return { issuer, clientId };
-}
-function openBrowser(url) {
-  const [cmd, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  const child = spawn6(cmd, args, { detached: true, stdio: "ignore" });
-  child.on("error", () => {
-  });
-  child.unref();
-}
-async function exchangeCode2(p2) {
-  const res = await fetch(new URL("/oauth/token", p2.issuer), {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: p2.clientId,
-      code: p2.code,
-      code_verifier: p2.verifier,
-      redirect_uri: p2.redirectUri
-    }).toString()
-  });
-  if (!res.ok) {
-    throw new Error(`token exchange failed (HTTP ${res.status})`);
-  }
-  return await res.json();
-}
-async function runLogin(stateDir, apiBase2) {
-  const config = oauthConfigFromEnv();
-  if (!config) {
-    console.error("Sign-in is not configured on this build.");
-    console.error("Set CORENEL_OAUTH_ISSUER and CORENEL_OAUTH_CLIENT_ID, or use " + TOKEN_ENV2 + " for headless use.");
-    return 1;
-  }
-  try {
-    const res = await login({
-      config,
-      openBrowser,
-      exchange: exchangeCode2,
-      log: (l2) => console.error(l2),
-      ...stateDir ? { stateDir } : {},
-      // Recorded so the daemon does not have to guess later which API this
-      // credential belongs to -- see LoginDeps.apiBase.
-      ...apiBase2 ? { apiBase: apiBase2 } : {}
-    });
-    console.error(`Signed in${res.account ? ` as ${res.account}` : ""}.`);
-    return 0;
-  } catch (err) {
-    console.error(`Sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
-    return 1;
-  }
-}
-async function runLogout(stateDir, env = process.env) {
-  const before = await resolveCredential(env, stateDir);
-  await clearCredential(stateDir);
-  console.error("Signed out. (Paired devices are unaffected - run `hosts forget` to unpair.)");
-  console.error(`  Cleared ${tokenFilePath(stateDir)} and ${credentialFilePath(stateDir)}`);
-  if (before.source === "none") console.error("  Nothing was stored - this machine was already signed out.");
-  if (env[TOKEN_ENV2]?.trim()) {
-    console.error(`  NOTE: ${TOKEN_ENV2} is still set in this environment, so this machine is STILL signed in.`);
-  }
-  return 0;
-}
-function sourceLabel(source) {
-  return source === "env" ? `${TOKEN_ENV2} environment variable` : source === "token-file" ? "token file" : source === "credential-file" ? "credential file (auth.json)" : "none";
-}
-async function runAuthStatus(stateDir, env = process.env) {
-  const r2 = await resolveCredential(env, stateDir);
-  if (!r2.token) {
-    console.error("Not signed in. Run `corenel login`, or set " + TOKEN_ENV2 + ".");
-    console.error(`  Looked in ${tokenFilePath(stateDir)}`);
-    console.error(`  Looked in ${credentialFilePath(stateDir)}`);
-    return 1;
-  }
-  console.error(`Signed in (${r2.source === "env" ? sourceLabel(r2.source) : r2.path}).`);
-  console.error(`  account  ${r2.account ?? "not recorded in this store - run `corenel login` to record it"}`);
-  console.error(`  token    ${maskToken(r2.token)}`);
-  console.error(`  source   ${sourceLabel(r2.source)}`);
-  console.error(`  expiry   ${r2.expired ? `EXPIRED at ${new Date(r2.expiresAt ?? 0).toISOString()} - run login again` : r2.expiresAt ? new Date(r2.expiresAt).toISOString() : "not recorded in this store"}`);
-  return r2.expired ? 1 : 0;
-}
-var init_cli = __esm({
-  "src/auth/cli.ts"() {
-    "use strict";
-    init_login();
-    init_store();
-    init_tools_node();
-  }
-});
-
 // src/cli.ts
 init_protocol();
 import { join as join21 } from "node:path";
@@ -28083,7 +28134,127 @@ function makeFileMirrorSource(deps) {
 
 // src/controlPlane.ts
 init_protocol();
-init_store();
+
+// ../config/src/daemonConfig.ts
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { dirname, join as join3 } from "node:path";
+var DAEMON_CONFIG_VERSION = 1;
+var SECRET_KEYS = ["acpAuth", "tunnelToken", "token"];
+var KNOWN_KEYS = [
+  "version",
+  "port",
+  "host",
+  "roots",
+  "addUnder",
+  "cloneUnder",
+  "allowLan",
+  "allowOrigins",
+  "tlsCert",
+  "tlsKey",
+  "selfSigned",
+  "tunnel",
+  "tunnelName",
+  "tunnelHostname",
+  "endpoint",
+  "allowShell",
+  "keepTranscripts",
+  "isolation",
+  "msbBin",
+  "guestImage",
+  "maxChainDepth",
+  "name",
+  "appUrl",
+  "defaultModel",
+  "mcpServers",
+  "mcpAllow"
+];
+function daemonConfigPath(stateDir) {
+  return join3(stateDir, "daemon.json");
+}
+async function readDaemonConfig(stateDir) {
+  const empty = (corrupt) => ({ config: { version: DAEMON_CONFIG_VERSION }, unknown: {}, corrupt });
+  let raw;
+  try {
+    raw = await readFile(daemonConfigPath(stateDir), "utf8");
+  } catch {
+    return empty(false);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return empty(true);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return empty(true);
+  const src2 = parsed;
+  const config = { version: DAEMON_CONFIG_VERSION };
+  const unknown = {};
+  for (const [k2, v2] of Object.entries(src2)) {
+    if (k2 === "version") continue;
+    if (KNOWN_KEYS.includes(k2)) {
+      config[k2] = v2;
+    } else {
+      unknown[k2] = v2;
+    }
+  }
+  return { config, unknown, corrupt: false };
+}
+async function writeDaemonConfig(stateDir, next, unknown = {}) {
+  const body2 = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
+  const path = daemonConfigPath(stateDir);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(body2, null, 2)}
+`, "utf8");
+}
+
+// ../config/src/credential.ts
+init_tools_node();
+import { promises as fs6 } from "node:fs";
+var TOKEN_ENV2 = TOKEN_ENV;
+function authDir(stateDir) {
+  return credentialDir(stateDir);
+}
+function credentialPath(stateDir) {
+  return credentialFilePath(stateDir);
+}
+var STORED_CREDENTIAL_KEYS = ["accessToken", "refreshToken", "expiresAt", "account", "apiBase"];
+async function readForeignAuthJson(path) {
+  let raw;
+  try {
+    raw = await fs6.readFile(path, "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const obj = { ...parsed };
+    for (const k2 of STORED_CREDENTIAL_KEYS) delete obj[k2];
+    return obj;
+  } catch {
+    return {};
+  }
+}
+async function saveCredential(cred, stateDir) {
+  const path = credentialPath(stateDir);
+  await fs6.mkdir(authDir(stateDir), { recursive: true });
+  const foreign = await readForeignAuthJson(path);
+  const next = { ...foreign, ...cred };
+  await fs6.writeFile(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+  try {
+    await fs6.chmod(path, 384);
+  } catch {
+  }
+  await writeAuthToken(cred.accessToken, stateDir);
+}
+async function clearCredential(stateDir) {
+  await clearAllCredentials(stateDir);
+}
+async function resolveCredential(env = process.env, stateDir, now2 = Date.now) {
+  return await resolveNodeCredential({ env, now: now2, ...stateDir ? { stateDir } : {} });
+}
+
+// src/controlPlane.ts
 function describeBackend(url, mirrors, cred, probe) {
   const detail = probe ? {
     reachable: probe.answered,
@@ -28143,8 +28314,8 @@ function makeControlPlane(deps) {
 
 // src/tools.ts
 import { promises as fs7 } from "node:fs";
-import { spawn } from "node:child_process";
-import { resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2, sep as sep2, dirname as dirname3 } from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+import { resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2, sep as sep2, dirname as dirname4 } from "node:path";
 function withinRoot(root, abs) {
   const rel = relative2(root, abs);
   return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel) && rel.split(sep2)[0] !== "..";
@@ -28172,7 +28343,7 @@ async function assertRealWithinRoot(roots, abs) {
       return;
     } catch (e2) {
       if (e2 instanceof Error && e2.message.includes("via symlink")) throw e2;
-      const parent = dirname3(probe);
+      const parent = dirname4(probe);
       if (parent === probe) throw new Error(`cannot resolve path under the sidecar roots: ${abs}`);
       probe = parent;
     }
@@ -28223,7 +28394,7 @@ function nodeFsTools(roots) {
       mutates: true,
       async run(args) {
         const abs = confine(roots, args.root, String(args.path ?? ""));
-        await fs7.mkdir(dirname3(abs), { recursive: true });
+        await fs7.mkdir(dirname4(abs), { recursive: true });
         await assertRealWithinRoot(roots, abs);
         await fs7.writeFile(abs, String(args.content ?? ""), "utf8");
         return `wrote ${args.path}`;
@@ -28274,7 +28445,7 @@ function nodeFsTools(roots) {
         if (bytes.byteLength > MAX_READ_BYTES) {
           throw new Error(`file too large to write (${bytes.byteLength} bytes; max ${MAX_READ_BYTES})`);
         }
-        await fs7.mkdir(dirname3(abs), { recursive: true });
+        await fs7.mkdir(dirname4(abs), { recursive: true });
         await assertRealWithinRoot(roots, abs);
         await fs7.writeFile(abs, bytes);
         return `wrote ${args.path} (${bytes.byteLength} bytes)`;
@@ -28389,7 +28560,7 @@ function runShell(command, cwd, timeout) {
   return new Promise((resolveOut) => {
     const isWin = process.platform === "win32";
     const [shell, shellArgs] = isWin ? ["cmd.exe", ["/d", "/s", "/c", command]] : ["/bin/sh", ["-c", command]];
-    const child = spawn(shell, shellArgs, { cwd, windowsHide: true });
+    const child = spawn2(shell, shellArgs, { cwd, windowsHide: true });
     let out = "";
     let truncated = false;
     let timedOut = false;
@@ -28424,7 +28595,7 @@ ${truncated ? "[output truncated]\n" : ""}${body2}`);
 // src/configService.ts
 init_protocol();
 import { promises as fs8 } from "node:fs";
-import { resolve as resolve3, relative as relative3, join as join6, dirname as dirname4, sep as sep3 } from "node:path";
+import { resolve as resolve3, relative as relative3, join as join7, dirname as dirname5, sep as sep3 } from "node:path";
 var MAX_LIST_DEPTH2 = 24;
 var MAX_LIST_ENTRIES2 = 2e4;
 function relUnder(root, abs) {
@@ -28459,7 +28630,7 @@ var NodeConfigService = class {
         real = await fs8.realpath(probe);
       } catch {
         if (mustExist && probe === abs) throw new Error(`no such harness config file: ${relUnder(this.stateDir, abs) ?? abs}`);
-        const parent = dirname4(probe);
+        const parent = dirname5(probe);
         if (parent === probe) throw new Error("cannot resolve a path inside the harness config");
         probe = parent;
         continue;
@@ -28495,11 +28666,11 @@ var NodeConfigService = class {
   async listRoot(levels) {
     const out = [];
     for (const name of CONFIG_DEFINITION_FILES) {
-      const st2 = await fs8.stat(join6(this.stateDir, name)).catch(() => null);
+      const st2 = await fs8.stat(join7(this.stateDir, name)).catch(() => null);
       if (st2?.isFile()) out.push({ path: name, size: st2.size, mtime: st2.mtimeMs });
     }
     for (const name of CONFIG_DEFINITION_DIRS) {
-      const abs = join6(this.stateDir, name);
+      const abs = join7(this.stateDir, name);
       const st2 = await fs8.stat(abs).catch(() => null);
       if (!st2?.isDirectory()) continue;
       out.push({ path: name, dir: true });
@@ -28514,7 +28685,7 @@ var NodeConfigService = class {
     for (const e2 of entries) {
       if (out.length >= MAX_LIST_ENTRIES2) return;
       if (e2.isSymbolicLink()) continue;
-      const child = join6(abs, e2.name);
+      const child = join7(abs, e2.name);
       if (e2.isDirectory()) {
         out.push({ path: `${prefix}${e2.name}`, dir: true });
         await this.walk(child, `${prefix}${e2.name}/`, levels - 1, out);
@@ -28533,7 +28704,7 @@ var NodeConfigService = class {
    * partially written AGENT.md is a definition that parses to nonsense. */
   async write(path, content) {
     const abs = await this.confine(path, false);
-    await fs8.mkdir(dirname4(abs), { recursive: true });
+    await fs8.mkdir(dirname5(abs), { recursive: true });
     await this.assertRealAllowed(abs, false);
     const tmp = `${abs}.${process.pid}.${Date.now()}.tmp`;
     try {
@@ -28552,7 +28723,7 @@ var NodeConfigService = class {
 };
 
 // src/procs.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 var MAX_RUNNING = 8;
 var MAX_CHUNKS = 400;
 var MAX_CHARS = 2e5;
@@ -28614,7 +28785,7 @@ function createNodeProcs(opts) {
       const isWin = process.platform === "win32";
       const shell = isWin ? "cmd.exe" : "/bin/sh";
       const shellArgs = isWin ? ["/d", "/s", "/c", line] : ["-c", line];
-      const child = spawn2(shell, shellArgs, {
+      const child = spawn3(shell, shellArgs, {
         cwd: dir,
         windowsHide: true,
         stdio: "pipe",
@@ -29153,7 +29324,11 @@ var STANDARD_POLICY = {
   name: "standard",
   description: "Read-only tools run automatically; writes ask for approval.",
   onViolation: "stop",
-  maxTurns: 8,
+  // maxTurns counts iterations WITHIN one user message (one model call plus
+  // its tool round-trip), not messages across a conversation -- 8 was
+  // exhausted inside a single tool-heavy reply. 0 means unlimited (see
+  // core/loop.ts); this default stays a finite backstop.
+  maxTurns: 40,
   permissions: {
     "prompd:propose_edit": "allow",
     // proposals are reviewed in the diff UI, not applied directly
@@ -29167,7 +29342,8 @@ var READ_ONLY_POLICY = {
   name: "read-only",
   description: "Inspection only \u2014 all writes and side effects are refused.",
   onViolation: "stop",
-  maxTurns: 8,
+  maxTurns: 40,
+  // see STANDARD_POLICY: counts iterations within one reply, not conversation turns
   tools: {
     deny: [
       "fs:write_file",
@@ -29210,7 +29386,9 @@ var AUTONOMOUS_POLICY = {
   name: "autonomous",
   description: "Everything runs automatically \u2014 no approval prompts (system config still asks).",
   onViolation: "warn",
-  maxTurns: 16,
+  // Higher than the other builtins: nobody is watching an autonomous run turn
+  // by turn, so it gets more headroom before the backstop kicks in.
+  maxTurns: 80,
   permissions: {
     "system:*": "ask"
     // even unattended, never silently reconfigure the harness
@@ -29552,6 +29730,96 @@ var todoWriteTool = {
   }
 };
 
+// ../harness/tools/project.ts
+init_protocol();
+var manifestSuffix = () => `${stateDirName()}/craft/project.json`;
+async function findProjects(ctx) {
+  const files = ctx.files;
+  if (!files) return [];
+  const suffix = manifestSuffix();
+  const nodes = await files.list().catch(() => []);
+  const out = [];
+  for (const node of flattenFiles(nodes)) {
+    const p2 = node.path;
+    const root = p2 === suffix ? "" : p2.endsWith(`/${suffix}`) ? p2.slice(0, -(suffix.length + 1)) : null;
+    if (root === null) continue;
+    try {
+      const m2 = JSON.parse(await files.read(p2));
+      if (m2 && m2.version === 1 && typeof m2.name === "string") out.push({ root, name: m2.name });
+    } catch {
+    }
+  }
+  return out;
+}
+function projectSlug(name) {
+  const s2 = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return s2 || "project";
+}
+async function freeRoot(ctx, name) {
+  const files = ctx.files;
+  const base = projectSlug(name);
+  let root = base;
+  for (let i2 = 2; files && await files.stat(root) !== null; i2++) root = `${base}-${i2}`;
+  return root;
+}
+var startProjectTool = {
+  name: "start_project",
+  /* DECLARED, like ask_user's, and for the same reason: its whole effect is to
+   * put a choice in front of someone who is already there, and the write it
+   * may then make is the thing they just chose. A permission prompt on top of
+   * the choice is two dialogs for one decision. */
+  permission: "allow",
+  noOffload: true,
+  description: "Use when the person asks for a DOCUMENT (a memo, report, deck, spreadsheet, diagram, page) and the system context says no project is open. Documents live inside a project, where they are versioned and shown beside the conversation; a file written outside one is invisible in this surface. Propose a short project name derived from what they asked for \u2014 the person confirms it, picks an existing project instead, or declines. This call WAITS for their answer and returns the folder to write into, or that they declined. Write the document inside that folder with the ordinary file tools. Do NOT use this for ordinary code or repository files, which belong where they already are.",
+  parameters: {
+    type: "object",
+    properties: {
+      name: { type: "string", description: "Proposed project name, 2-4 words, derived from the request." },
+      reason: { type: "string", description: "One short line: what is about to be written into it." }
+    },
+    required: ["name"]
+  },
+  async run(args, ctx) {
+    const files = ctx.files;
+    if (!files) return "start_project is unavailable: no file workspace is connected.";
+    if (!ctx.ask) return "start_project is unavailable in this environment (nobody can be asked).";
+    if (!files.writable) return "This workspace is read-only, so no project can be created in it.";
+    const proposed = (typeof args.name === "string" ? args.name : "").trim() || "Untitled project";
+    const existing = await findProjects(ctx);
+    const createLabel = `Create "${proposed}"`;
+    const options = [
+      { label: createLabel, description: typeof args.reason === "string" && args.reason ? args.reason : "A new project for this work." },
+      ...existing.slice(0, 3).map((p2) => ({ label: p2.name, description: `Put it in the existing project at ${p2.root || "the workspace root"}.` }))
+    ];
+    if (options.length < 2) options.push({ label: "Not now", description: "Write nothing; the document has nowhere to live yet." });
+    const canMove = !!ctx.moveSessionToProject;
+    const questions = [
+      { header: "Project", question: "Documents live in a project. Where should this one go?", options },
+      ...canMove ? [{
+        header: "This chat",
+        question: "Bring this conversation into the project too?",
+        options: [
+          { label: "Yes, move it", description: "The transcript moves with the work, and this chat carries on." },
+          { label: "Keep it loose", description: "The document goes in the project; this chat stays where it is." }
+        ]
+      }] : []
+    ];
+    const answers = await ctx.ask(questions);
+    const picked = answers ? answers.Project?.[0] : void 0;
+    const move = answers ? answers["This chat"]?.[0] === "Yes, move it" : false;
+    if (!picked) return "The person did not choose a project. Do not write the document; say what you were about to write and that it needs a project.";
+    if (picked === "Not now") return "The person declined to start a project. Do not write the document.";
+    const moved = async (root2) => move && ctx.moveSessionToProject ? ` ${await ctx.moveSessionToProject(root2)}` : "";
+    const hit = existing.find((p2) => p2.name === picked);
+    if (hit) return `Use the existing project "${hit.name}". Write the document inside ${hit.root || "the workspace root"}/.${await moved(hit.root)}`;
+    const name = picked === createLabel ? proposed : picked;
+    const root = await freeRoot(ctx, name);
+    const manifest = { name, createdAt: Date.now(), version: 1 };
+    await files.write(`${root}/${manifestSuffix()}`, JSON.stringify(manifest, null, 2));
+    return `Created the project "${name}" at ${root}/. Write the document inside ${root}/ with the ordinary file tools; it will be versioned and shown beside this conversation.${await moved(root)}`;
+  }
+};
+
 // ../harness/tools/sessions.ts
 function str3(args, key) {
   const v2 = args[key];
@@ -29853,6 +30121,10 @@ var forgetMemoryTool = {
     return `Forgot memory "${name}".`;
   }
 };
+function preview(v2, max = 200) {
+  if (v2.length <= max) return JSON.stringify(v2);
+  return `${JSON.stringify(v2.slice(0, max))}... (${v2.length} chars total)`;
+}
 var kvGetTool = {
   name: "kv_get",
   description: "Read a value you previously saved with kv_set, by key, from the local key/value store. This is a general note store \u2014 NOT a filesystem, working directory, or settings: use list_files/read_file for files.",
@@ -29872,10 +30144,42 @@ var kvSetTool = {
     required: ["key", "value"]
   },
   // Permission is gated centrally by the loop's policy/permission layer.
+  /*
+   * THE RESULT STATES WHAT WAS STORED, AND WHAT IT REPLACED.
+   *
+   * This used to return `Set ${key}.` -- nothing else. Two consequences, both
+   * observed in a real run:
+   *
+   * 1. "set bread=true" and "set bread=false" produced BYTE-IDENTICAL tool
+   *    results. An agent had no feedback that could distinguish a correct
+   *    write from a wrong one, so a mistaken value was indistinguishable from
+   *    a correct one for the rest of the conversation.
+   *
+   * 2. A LOST UPDATE was invisible. The common shape here is a list kept as
+   *    one blob under one key, updated read-modify-write: a later write
+   *    carrying a stale copy silently reverts an earlier one, and every
+   *    result still says "Set". A run marked two items done and only one
+   *    stayed done, with nothing anywhere to show the second had been undone.
+   *
+   * So: report the value, and name the value being replaced. An agent that
+   * overwrites "apples done, bread done" with "apples done, bread pending"
+   * now reads back, in the tool result it already has to process, exactly
+   * what it just destroyed. The read-back is what makes this a check rather
+   * than an echo of the argument -- a store that transformed, truncated or
+   * dropped the write is caught here instead of at the summary.
+   */
   async run(args, ctx) {
     const key = str4(args, "key");
-    await ctx.kv.set(key, str4(args, "value"));
-    return `Set ${key}.`;
+    const value = str4(args, "value");
+    const before = await ctx.kv.get(key);
+    await ctx.kv.set(key, value);
+    const after = await ctx.kv.get(key);
+    if (after !== value) {
+      return `WRITE DID NOT TAKE. "${key}" was set to ${preview(value)} but reads back as ${after == null ? "(not set)" : preview(after)}. Do not rely on this key; do not report it as saved.`;
+    }
+    if (before == null) return `Set "${key}" = ${preview(value)} (new key).`;
+    if (before === value) return `Set "${key}" = ${preview(value)} (unchanged).`;
+    return `Set "${key}" = ${preview(value)}, REPLACING ${preview(before)}. If that previous value held anything you did not mean to discard, it is gone.`;
   }
 };
 var recallResultTool = {
@@ -30133,6 +30437,7 @@ var defaultTools = [
   webSearchTool,
   todoWriteTool,
   compilePrompdTool,
+  startProjectTool,
   ...fileTools
 ];
 function allTools() {
@@ -30212,10 +30517,10 @@ Add a constraint :: Add a constraint or rule to the prompt instructions (what to
 `,
   "guards.json": '[\n  {\n    "_comment": "Declarative client-side feature guards (NON-authoritative \u2014 for defaults/UX; real enforcement is the backend entitlements API). Copy an entry and remove \\"disabled\\". rule: \\"require-auth\\" or \\"free-quota\\" (with \\"limit\\"). feature: a FeatureId like \\"llm-execution\\", or \\"*\\". action: { \\"kind\\": \\"sign-in\\" } or { \\"kind\\": \\"upgrade\\", \\"label\\": \\"...\\" }.",\n    "disabled": true,\n    "id": "example-free-quota",\n    "feature": "llm-execution",\n    "rule": "free-quota",\n    "limit": 3,\n    "reason": "Free limit reached \u2014 sign in to keep going.",\n    "action": { "kind": "sign-in" }\n  }\n]\n',
   "languages/prmd.md": '{% raw %}\n# PRMD File Format Overview\n\nPRMD files are structured in YAML format and are used to define prompts for various applications within the Prompd system. Each file contains essential metadata in the frontmatter followed by the body content, which is where the prompt logic and structure reside.\n\n## Field Descriptions\n- **id**: A unique identifier for the prompt file, usually in kebab-case.\n- **name**: A brief title for the prompt that identifies it.\n- **version**: The version number of the prompt file, following semantic versioning.\n- **description**: Optional human-readable summary.\n- **model** / **provider**: Optional default model + provider for runs.\n- **inherits**: A path to another prompt file whose body this one extends (the parent renders first, then this file\'s body). Resolved at compile time \u2014 siblings locally, registry refs on the backend.\n- **using**: Optional list of package refs imported for context/blocks; each `{ name: "@scope/pkg@1.2.0", prefix: "@alias" }`.\n- **parameters**: A list of typed input variables for the prompt (see below).\n\n## Parameter Types\nPrompd supports thirteen parameter types covering scalars, dates, structured data, and binary content.\n\n| Type     | Description                                                     |\n|----------|-----------------------------------------------------------------|\n| string   | Plain text                                                      |\n| enum     | A value restricted to a fixed set of options (see Enums below)  |\n| number   | Integer or float (generic numeric)                              |\n| integer  | Whole number only \u2014 rejects floats                              |\n| float    | Decimal number                                                  |\n| boolean  | true / false                                                    |\n| date     | Calendar date \u2192 `YYYY-MM-DD`. Resolved at compile time.         |\n| datetime | Date + time \u2192 `YYYY-MM-DDTHH:mm:ss` (local). Resolved at compile time. |\n| array    | JSON array with untyped elements                                |\n| object   | Plain key-value object (non-array)                              |\n| json     | Any JSON value \u2014 arrays of objects, nested structures, etc.     |\n| file     | File path; caller supplies the file content as a string         |\n| base64   | Base64-encoded binary (images, PDFs, blobs for multimodal LLMs) |\n\n### Enums (restricted values)\nAn `enum` parameter limits the value to a fixed set of choices. Provide the allowed values as a JSON array of strings in an `enum:` field, e.g. `["small", "medium", "large"]` (a YAML block list works too). Set `type: enum` \u2014 or omit `type`, since it\'s inferred when `enum` is present. The `default:`, if given, must be one of the options.\n\n```yaml\n- name: tone\n  type: enum\n  enum: ["detailed", "summary", "concise"]\n  default: "summary"\n```\n\n### Date & datetime defaults\n`date` and `datetime` defaults accept `now` / `today`, a relative offset `now\xB1N<unit>`, or a literal ISO date. Units: `d` (days), `w` (weeks), `mo` (months), `y` (years); `datetime` also `h` (hours), `min`, `s`. The value is resolved at compile time, so each run uses the current clock.\n\nExamples (assume today is 2026-06-11):\n\n| Default        | Type     | Resolves to            |\n|----------------|----------|------------------------|\n| `now`          | date     | `2026-06-11`           |\n| `now-8d`       | date     | `2026-06-03`           |\n| `now-2w`       | date     | `2026-05-28`           |\n| `now-1mo`      | date     | `2026-05-11`           |\n| `now+1y`       | date     | `2027-06-11`           |\n| `now`          | datetime | `2026-06-11T09:30:00`  |\n| `now-3h`       | datetime | `2026-06-11T06:30:00`  |\n| `2025-01-15`   | date     | `2025-01-15`           |\n\n## Body (Markdown + Jinja2/Nunjucks)\n- `{{ param }}` and `{{ param | filter }}` interpolation.\n- `{% if %}` / `{% elif %}` / `{% else %}` / `{% endif %}` conditionals.\n- `{% for x in list %} \u2026 {% endfor %}` loops.\n- `{% include %}` and inherited blocks resolve against the workspace + registry at compile time.\n- Only declared parameters are guaranteed to exist; treat any other variable as undefined.\n\n## Example PRMD File\n```yaml\n---\nid: report-window\nname: Report Window\nversion: 1.0.0\nparameters:\n  - name: user_name\n    type: string\n    default: "Guest"\n  - name: since\n    type: date\n    default: "now-8d"          # 8 days ago, resolved at compile time\n  - name: generated_at\n    type: datetime\n    default: "now"\n---\nHello, {{ user_name }}! Here is your report covering everything since {{ since }} (generated {{ generated_at }}).\n```\n{% endraw %}\n',
-  "modes/auto.md": "---\nid: auto\nname: Auto\ndescription: No extra steering; the agent picks its own approach and tools.\n---\nMode: AUTO \u2014 no extra steering; the assistant is free to choose its approach and tools.\n",
-  "modes/brainstorm.md": "---\nid: brainstorm\nname: Brainstorm\ndescription: Explore options; generative, makes no edits.\n---\nMode: BRAINSTORM \u2014 explore options and alternatives; be generative, do not edit the file.\n",
-  "modes/edit.md": "---\nid: edit\nname: Edit\ndescription: Focus on concrete file changes; prefers propose_edit.\n---\nMode: EDIT \u2014 focus on concrete changes to the file; prefer propose_edit.\n",
-  "modes/plan.md": "---\nid: plan\nname: Plan\ndescription: Think and outline before acting; avoids mutating tools.\n---\nMode: PLAN \u2014 think step by step and outline an approach before acting; avoid mutating tools.\n",
+  "modes/auto.md": "---\nid: auto\nname: Auto\ndescription: Act on the request, deciding what is cheap to decide and asking only what is expensive to get wrong.\n---\nMode: AUTO \u2014 act.\n\nMake the smallest set of decisions needed to start, say plainly what you assumed, and build a thin working slice before elaborating it. A broad request is not a reason to stop and interview the user.\n\nAsk only where a wrong guess is expensive to undo \u2014 the data model, anything touching security, privacy or regulated data, and where the thing runs. Keep it to two or three questions and ask them before you build, not after. Everything that is cheap to change later is an assumption to state, not a question to ask.\n",
+  "modes/brainstorm.md": "---\nid: brainstorm\nname: Brainstorm\ndescription: Generate genuinely different options with their trade-offs, and recommend one.\n---\nMode: BRAINSTORM \u2014 explore options and alternatives; be generative.\n\nGive at least two genuinely different approaches, not one approach with its dial turned. Name what each is good at and what it costs, then say which you would pick and why. Do not edit files.\n",
+  "modes/edit.md": "---\nid: edit\nname: Edit\ndescription: Make the smallest concrete change that does the job.\n---\nMode: EDIT \u2014 make the smallest concrete change that does the job, and say what you changed.\n\nWhen a file is open in the editor, prefer propose_edit with the COMPLETE new file content, so the user reviews a diff before anything is applied.\n",
+  "modes/plan.md": "---\nid: plan\nname: Plan\ndescription: Settle the shape-changing decisions first, then outline the approach without mutating anything.\n---\nMode: PLAN \u2014 decide before acting.\n\nFirst surface the decisions that change the SHAPE of the result and ask about those; an outline built on an unasked question is wasted work. Then think step by step and lay out the approach, with the trade-offs you are choosing between made explicit.\n\nAvoid mutating tools. Producing a plan the user can argue with is the deliverable here.\n",
   "crew/memory.md": '---\nid: crew-memory\nname: Crew agent \u2014 memory block\nversion: 1.0.0\ndescription: Told to every crew agent about its own memory folder. Appended after the agent\'s own role and instructions, because it is housekeeping and they are the job.\nparameters:\n  - name: dir\n    type: string\n    description: The agent\'s memory folder, with no trailing slash (e.g. crew/auditor/memory).\n    default: "memory"\n  - name: index\n    type: string\n    description: Full path of the agent\'s memory index, derived from dir (e.g. crew/auditor/memory/MEMORY.md).\n    default: "memory/MEMORY.md"\n---\n--- Memory ---\nYou keep durable notes in your own memory folder, `{{ dir }}/`, one Markdown file per note, alongside `{{ index }}`, an index you maintain for yourself.\nRead `{{ index }}` at the start of a run to recall what you already know, and call recall_memory to look up one note by name. If you can call save_memory, use it for what is worth knowing on a later run, and keep `{{ index }}` current as you do. If a file tool you have takes a `root` argument, you can pass `{{ dir }}/` as `root` to read and edit those files directly.\n',
   "crew/room.md": `---
 id: crew-room
@@ -30350,7 +30655,7 @@ You are a privacy reviewer. Determine whether the INPUT exposes personally ident
 id: system-base
 name: Operational system prompt
 version: 1.0.0
-description: The agent's system prompt \u2014 persona, mode, tool definitions and editor context composed by @prompd/core.
+description: The agent's system prompt \u2014 surface-agnostic identity, mode, tool definitions and context composed by @prompd/core. Editor and workflow specifics live in the prompts that inherit this one.
 parameters:
   - name: persona
     type: string
@@ -30376,6 +30681,18 @@ parameters:
     type: string
     description: The editor file / selection / compiled-output context block.
     default: ""
+  - name: skills
+    type: string
+    description: Instructions contributed by the skills enabled for this run.
+    default: ""
+  - name: memory
+    type: string
+    description: The index of notes saved to this run's memory plane.
+    default: ""
+  - name: run_context
+    type: string
+    description: Facts about THIS run the model cannot otherwise know \u2014 the date, and whatever the host adds (working directory, platform).
+    default: ""
   - name: app
     type: string
     description: Product name of the host application, used for the agent's own identity.
@@ -30383,11 +30700,22 @@ parameters:
 ---
 {% if persona %}{{ persona }}
 
-{% endif %}You are the {{ app }} assistant embedded in the in-browser .prmd editor. You help the user author, compile, and improve .prmd/.md prompts (YAML frontmatter + Nunjucks body with typed parameters). When the user asks about the .prmd format itself \u2014 frontmatter fields, parameter types (including enums), date defaults, inheritance, or templating \u2014 the canonical reference is \`languages/prmd.md\` in the {{ app }} config workspace; consult it rather than guessing (it is already included in context whenever a .prmd/.md file is open).
+{% endif %}You are the {{ app }} assistant. You help the user do real work: reading and changing files, composing and running prompts and workflows, and building software. Work from the context you were given below rather than assuming a particular screen.
 
-To change the file open in the editor, call propose_edit with the COMPLETE new file content \u2014 the user reviews a diff and applies it. To read or change other files in the workspace, use the file tools (writes ask the user for permission first). Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.
+Verify before you claim. Do not say something is done, fixed, passing or ready unless you checked it in this conversation and can point at what you checked. If you did not run it, say you did not run it. If a check failed, say so plainly and show what failed. A wrong claim of success costs the user far more than the check would have.
 
-## Tools available this run
+Say what you assumed and what you did not do. A request that leaves room for interpretation gets its decisions named, one line each, so the user can correct one without unpicking the rest. How much you decide for yourself versus ask about is the mode's call, below.
+
+A tool call that comes back denied, blocked or unavailable is a decision, not a failure to route around. Do not retry it, do not reach for another tool to accomplish the same thing, and never describe the change as made. Say what you wanted to do and stop.
+
+Prefer calling a tool over guessing: read the file rather than recalling it, run the command rather than predicting its output. Use the file tools to read and change files, and compile_prompd to preview rendered output. For a job with several steps, keep a visible task list with todo_write and mark each step as you finish it.
+
+Be brief. Lead with the answer, then only what the user needs to act on or check it. Use headings, lists and tables where they carry something prose would not, and prose everywhere else. Do not restate the request back, do not narrate what you are about to do, and do not end by summarizing what the user has just read.
+
+{% if run_context %}## This run
+{{ run_context }}
+
+{% endif %}## Tools available this run
 {{ tools }}
 {% if tool_guidance %}
 
@@ -30398,6 +30726,14 @@ To change the file open in the editor, call propose_edit with the COMPLETE new f
 ## Mode
 {{ mode_hint }}
 {% endif %}
+{% if skills %}
+
+{{ skills }}
+{% endif %}
+{% if memory %}
+
+{{ memory }}
+{% endif %}
 {% if file_context %}
 
 {{ file_context }}
@@ -32577,6 +32913,8 @@ function makeCrewTurnRuntime(opts) {
         policy,
         permission,
         ...deps.maxTurns !== void 0 ? { maxTurns: deps.maxTurns } : {},
+        ...deps.compression ? { compression: deps.compression } : {},
+        ...deps.compaction ? { compaction: deps.compaction } : {},
         ...deps.temperature !== void 0 ? { temperature: deps.temperature } : {},
         ...deps.describePermissionDenial ? { describePermissionDenial: deps.describePermissionDenial } : {},
         signal: mergeSignals(deps.toolCtx.signal, turnAbort.signal),
@@ -32592,7 +32930,7 @@ function makeCrewTurnRuntime(opts) {
           deps.onEvent?.(e2);
         }
       });
-      const produced = result.messages.slice(input.transcript.length);
+      const produced = result.messages.slice(result.messages.length - result.appended);
       const inputTokens = result.usage.promptTokens ?? 0;
       const outputTokens = result.usage.completionTokens ?? 0;
       const ceilingAborted = turnAbort.signal.aborted;
@@ -33465,7 +33803,7 @@ var LineSplitter = class {
 init_fileService();
 
 // src/session/msb.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 var DEFAULT_LIMITS = {
   cpus: 1,
   memory: "512M",
@@ -33512,7 +33850,7 @@ function wslHostPath(p2) {
 function makeMsbStreamer(bin, wrap) {
   return (args, onLine, opts) => {
     const { cmd, argv } = wrap ? wrap(args) : { cmd: bin, argv: args };
-    const child = spawn3(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const out = new LineSplitter();
     const err = new LineSplitter();
     let stderrText = "";
@@ -33563,7 +33901,7 @@ function wslMsb(bin) {
 function makeMsbRunner(bin, wrap) {
   return (args, opts) => new Promise((resolveRun) => {
     const { cmd, argv } = wrap ? wrap(args) : { cmd: bin, argv: args };
-    const child = spawn3(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(cmd, argv, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let settled = false;
@@ -34304,17 +34642,17 @@ function makeGuestRunner(deps) {
 }
 
 // src/session/sessionsPort.ts
-function toInfo(h2, backend) {
+function toInfo(h2, backend2) {
   return {
     id: h2.id,
     status: h2.status,
     workdir: h2.workdir,
     createdAt: h2.createdAt,
     ...h2.owner ? { owner: h2.owner } : {},
-    isolated: backend.isolation !== "none",
-    kind: backend.kind,
+    isolated: backend2.isolation !== "none",
+    kind: backend2.kind,
     // Feature-detected once, here, rather than by a client calling and failing.
-    canCapture: !!backend.commit,
+    canCapture: !!backend2.commit,
     // Read from the HANDLE, so it survives every later list() — and, on the
     // microVM backend, a daemon restart, since the sandbox carries it in its
     // own labels.
@@ -34325,9 +34663,9 @@ function toInfo(h2, backend) {
   };
 }
 function makeSessionsPort(deps) {
-  const { manager, backend } = deps;
+  const { manager, backend: backend2 } = deps;
   return {
-    list: () => manager.list().map((h2) => toInfo(h2, backend)),
+    list: () => manager.list().map((h2) => toInfo(h2, backend2)),
     async create(spec) {
       let source;
       let workdir = spec.workdir;
@@ -34361,7 +34699,7 @@ function makeSessionsPort(deps) {
         ...spec.stateDir ? { stateDir: spec.stateDir } : {},
         ...env && Object.keys(env).length ? { env } : {}
       });
-      return { ...toInfo(h2, backend), ...source ? { source } : {} };
+      return { ...toInfo(h2, backend2), ...source ? { source } : {} };
     },
     canClone: deps.git?.enabled === true && deps.approveCheckout !== void 0,
     /* Straight through to the manager, which is where admission and the
@@ -34379,9 +34717,9 @@ function makeSessionsPort(deps) {
      * client feature-detects by asking rather than by calling and failing. A
      * process-backed session genuinely cannot capture or stream, and saying so
      * up front is better than an error at the moment someone tries. */
-    ...backend.commit ? {
+    ...backend2.commit ? {
       commit: async (id, name) => {
-        const snap = await backend.commit(id, name);
+        const snap = await backend2.commit(id, name);
         return {
           name: snap.name,
           createdAt: snap.createdAt,
@@ -34389,26 +34727,26 @@ function makeSessionsPort(deps) {
         };
       }
     } : {},
-    ...backend.snapshots ? {
-      snapshots: async () => (await backend.snapshots()).map((s2) => ({
+    ...backend2.snapshots ? {
+      snapshots: async () => (await backend2.snapshots()).map((s2) => ({
         name: s2.name,
         createdAt: s2.createdAt,
         ...s2.sessionId ? { sessionId: s2.sessionId } : {},
         ...s2.sizeBytes !== void 0 ? { sizeBytes: s2.sizeBytes } : {}
       }))
     } : {},
-    ...backend.snapshotUsage ? {
-      snapshotUsage: () => backend.snapshotUsage()
+    ...backend2.snapshotUsage ? {
+      snapshotUsage: () => backend2.snapshotUsage()
     } : {},
-    ...backend.metrics ? {
+    ...backend2.metrics ? {
       watchMetrics: (id, onSample) => {
-        const st2 = backend.metrics(id, onSample);
+        const st2 = backend2.metrics(id, onSample);
         return () => st2.stop();
       }
     } : {},
-    ...backend.logs ? {
+    ...backend2.logs ? {
       watchLogs: (id, onLine) => {
-        const st2 = backend.logs(id, onLine);
+        const st2 = backend2.logs(id, onLine);
         return () => st2.stop();
       }
     } : {}
@@ -34431,16 +34769,16 @@ function portExtras(opts) {
 }
 async function wireSessions(opts) {
   if (opts.isolation === "none") {
-    const backend2 = makeProcessBackend({ roots: opts.roots, ...opts.log ? { log: opts.log } : {} });
+    const backend3 = makeProcessBackend({ roots: opts.roots, ...opts.log ? { log: opts.log } : {} });
     opts.log?.("sessions: isolation none (runs execute in the daemon process)");
     const manager2 = new SessionManager({
-      backend: backend2,
+      backend: backend3,
       runner: opts.runner,
       ...opts.recordRun ? { recordRun: opts.recordRun } : {},
       ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
       ...opts.log ? { log: opts.log } : {}
     });
-    return { manager: manager2, backend: backend2, port: makeSessionsPort({ manager: manager2, backend: backend2, guestEnv, ...portExtras(opts) }) };
+    return { manager: manager2, backend: backend3, port: makeSessionsPort({ manager: manager2, backend: backend3, guestEnv, ...portExtras(opts) }) };
   }
   const viaWsl = process.platform === "win32";
   const makeRunner = opts.makeRunner ?? ((bin) => makeMsbRunner(bin, viaWsl ? wslMsb(bin) : void 0));
@@ -34453,7 +34791,7 @@ async function wireSessions(opts) {
   On Windows msb runs inside WSL2 \u2014 there is no native build \u2014 so the daemon must run there too.`
     );
   }
-  const backend = makeMicrovmBackend({
+  const backend2 = makeMicrovmBackend({
     roots: opts.roots,
     run,
     stream: makeMsbStreamer(opts.msbBin, viaWsl ? wslMsb(opts.msbBin) : void 0),
@@ -34464,14 +34802,14 @@ async function wireSessions(opts) {
     ...opts.log ? { log: opts.log } : {}
   });
   const manager = new SessionManager({
-    backend,
+    backend: backend2,
     runner: opts.runner,
     ...opts.recordRun ? { recordRun: opts.recordRun } : {},
     ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
     // One runner per session, built on demand: the manager knows which session a
     // run belongs to, so nothing has to infer it.
     guestRunnerFor: (sessionId, guestOpts) => makeGuestRunner({
-      backend,
+      backend: backend2,
       sessionId: () => sessionId,
       allowMutations: guestOpts.allowMutations,
       ...opts.log ? { log: opts.log } : {}
@@ -34479,19 +34817,19 @@ async function wireSessions(opts) {
     ...opts.log ? { log: opts.log } : {}
   });
   opts.log?.(`sessions: isolation microvm via ${version} (image ${opts.image})`);
-  await backend.adopt?.().catch((e2) => {
+  await backend2.adopt?.().catch((e2) => {
     opts.log?.(`sessions: adoption failed (${e2 instanceof Error ? e2.message : String(e2)}) \u2014 starting with none adopted`);
   });
-  return { manager, backend, port: makeSessionsPort({ manager, backend, guestEnv, ...portExtras(opts) }) };
+  return { manager, backend: backend2, port: makeSessionsPort({ manager, backend: backend2, guestEnv, ...portExtras(opts) }) };
 }
 
 // src/runner/crewSessions.ts
 function makeCrewSessions(src2, opts) {
   if (!src2?.manager.isolated) return void 0;
-  const { manager, backend } = src2;
+  const { manager, backend: backend2 } = src2;
   return {
-    list: () => backend.list(),
-    adopt: () => backend.adopt?.() ?? Promise.resolve(void 0),
+    list: () => backend2.list(),
+    adopt: () => backend2.adopt?.() ?? Promise.resolve(void 0),
     create: async (spec) => {
       const env = await opts.guestEnv().catch(() => ({}));
       return manager.create({
@@ -34507,15 +34845,15 @@ function makeCrewSessions(src2, opts) {
 
 // src/runner/owners.ts
 init_tools_node();
-import { readdir, readFile } from "node:fs/promises";
+import { readdir, readFile as readFile2 } from "node:fs/promises";
 import { createHash as createHash2 } from "node:crypto";
-import { join as join8, resolve as resolve6 } from "node:path";
+import { join as join9, resolve as resolve6 } from "node:path";
 init_protocol();
 
 // src/hostsDir.ts
 init_tools_node();
 init_protocol();
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var HOSTS_SEG = "hosts";
 var MAX_SYNC_PATH_LEN = 400;
 var MAX_SYNC_SEGMENTS = 24;
@@ -34537,11 +34875,11 @@ function assertSyncPath(path) {
   }
 }
 function hostsRoot(stateDir) {
-  return join7(stateDir, "sidecar", HOSTS_SEG);
+  return join8(stateDir, "sidecar", HOSTS_SEG);
 }
 function hostsDirFor(stateDir, dirName2) {
   if (!DIR_NAME_RE.test(dirName2)) throw new Error(`invalid host dir name: ${dirName2}`);
-  return join7(hostsRoot(stateDir), dirName2);
+  return join8(hostsRoot(stateDir), dirName2);
 }
 var RAW = /* @__PURE__ */ new WeakMap();
 function hostFilesFor(stateDir, dirName2) {
@@ -34581,7 +34919,7 @@ var WORKSPACE_ID_RE = /^[a-z0-9_-]{1,32}$/;
 async function workspaceRootsFor(dirName2, hostDir) {
   let entries;
   try {
-    entries = await readdir(join8(hostDir, WORKSPACES_SEG), { withFileTypes: true });
+    entries = await readdir(join9(hostDir, WORKSPACES_SEG), { withFileTypes: true });
   } catch {
     return [];
   }
@@ -34589,7 +34927,7 @@ async function workspaceRootsFor(dirName2, hostDir) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (!WORKSPACE_ID_RE.test(entry.name)) continue;
-    const wsDir = join8(hostDir, WORKSPACES_SEG, entry.name);
+    const wsDir = join9(hostDir, WORKSPACES_SEG, entry.name);
     out.push({
       owner: `${dirName2}/ws/${entry.name}`,
       files: new NodeFileService(wsDir),
@@ -34602,7 +34940,7 @@ async function workspaceRootsFor(dirName2, hostDir) {
 async function readCrewOptIn(root, dotDir = stateDirName()) {
   let raw;
   try {
-    raw = await readFile(join8(root, dotDir, CREW_OPT_IN_FILE), "utf8");
+    raw = await readFile2(join9(root, dotDir, CREW_OPT_IN_FILE), "utf8");
   } catch {
     return null;
   }
@@ -34710,8 +35048,8 @@ async function listOwnerRoots(stateDir, workRoots = [], dotDir = stateDirName())
 }
 
 // src/crewDeployment.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 function splitOwner(owner) {
   if (owner === "") return void 0;
   const parts = owner.split("/");
@@ -34724,7 +35062,7 @@ async function deployedRoot(stateDir, owner, agent) {
   if (!parts) return void 0;
   let text;
   try {
-    text = await readFile2(join9(hostsDirFor(stateDir, parts.dirName), DEPLOYMENT_FILE), "utf8");
+    text = await readFile3(join10(hostsDirFor(stateDir, parts.dirName), DEPLOYMENT_FILE), "utf8");
   } catch {
     return void 0;
   }
@@ -34737,7 +35075,7 @@ init_tools_node();
 // src/cert.ts
 import { promises as fs9 } from "node:fs";
 import { networkInterfaces as networkInterfaces2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import selfsigned from "selfsigned";
 function lanIPv4s() {
   const out = [];
@@ -34748,9 +35086,9 @@ function lanIPv4s() {
   }
   return [...new Set(out)];
 }
-var certPath = () => join10(sidecarSubdir(), "sidecar.crt");
-var keyPath = () => join10(sidecarSubdir(), "sidecar.key");
-var sansPath = () => join10(sidecarSubdir(), "sidecar.sans.json");
+var certPath = () => join11(sidecarSubdir(), "sidecar.crt");
+var keyPath = () => join11(sidecarSubdir(), "sidecar.key");
+var sansPath = () => join11(sidecarSubdir(), "sidecar.sans.json");
 function selfSignedPaths() {
   return { cert: certPath(), key: keyPath() };
 }
@@ -34822,7 +35160,7 @@ function tunnelIds() {
 }
 
 // src/tunnel/zrok.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 function extractShareUrl(s2) {
   const full = s2.match(/https?:\/\/[A-Za-z0-9.-]+(?::\d+)?(?:\/[^\s"'\\]*)?/);
   if (full) return full[0];
@@ -34868,7 +35206,7 @@ function stopChild(child) {
 }
 function reserveName(bin, name) {
   return new Promise((res, rej) => {
-    const child = spawn4(bin, ["create", "name", name], { stdio: ["ignore", "ignore", "ignore"] });
+    const child = spawn5(bin, ["create", "name", name], { stdio: ["ignore", "ignore", "ignore"] });
     let settled = false;
     const done = (fn) => {
       if (settled) return;
@@ -34890,7 +35228,7 @@ function reserveName(bin, name) {
 async function startWith(bin, port, name) {
   if (name) await reserveName(bin, name);
   return new Promise((resolveHandle, reject) => {
-    const child = spawn4(bin, shareArgs(port, name), { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(bin, shareArgs(port, name), { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let settled = false;
     const finish = (fn) => {
@@ -34939,7 +35277,7 @@ var zrokProvider = {
 };
 
 // src/tunnel/cloudflared.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 function extractTunnelUrl(s2) {
   const m2 = s2.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i);
   return m2 ? m2[0] : null;
@@ -34993,7 +35331,7 @@ function stopChild2(child) {
 }
 function startWith2(bin, mode, log, onDown) {
   return new Promise((resolveHandle, reject) => {
-    const child = spawn5(bin, mode.argv, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn6(bin, mode.argv, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let settled = false;
     let tailBuf = "";
@@ -35162,7 +35500,7 @@ async function superviseTunnel(opts) {
 // src/runner/runnerService.ts
 init_protocol();
 init_tools_node();
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/runner/location.ts
 init_tools_node();
@@ -41921,7 +42259,7 @@ function nodeGatewayClient(endpoint, stateDir) {
 }
 
 // src/runner/executor.ts
-import { mkdir } from "node:fs/promises";
+import { mkdir as mkdir2 } from "node:fs/promises";
 
 // ../harness/core/recovery.ts
 var DEFAULT_RECOVERY = {
@@ -42135,6 +42473,131 @@ function formatOffloadRef(ref) {
 ${ref.preview}${ref.bytes > ref.preview.length ? "\n\u2026(truncated)" : ""}` : head;
 }
 
+// ../harness/core/contextPressure.ts
+var CONTEXT_MARKER = "[context] ";
+var PRESSURE_BANDS = [0.6, 0.8, 0.9];
+var PRESSURE_HYSTERESIS = 0.05;
+var initialPressureGate = { crossed: 0 };
+function highestBandAtOrBelow(fill, slack = 0) {
+  let best = 0;
+  for (const b2 of PRESSURE_BANDS) if (fill >= b2 - slack) best = b2;
+  return best;
+}
+function pressureDecision(fill, gate) {
+  const current2 = highestBandAtOrBelow(fill);
+  if (current2 > gate.crossed) return { band: current2, next: { crossed: current2 } };
+  const held = highestBandAtOrBelow(fill, PRESSURE_HYSTERESIS);
+  return { band: null, next: { crossed: Math.min(gate.crossed, held) } };
+}
+function pressureMessage(band, fill) {
+  const pct = Math.round(fill * 100);
+  switch (band) {
+    case 0.6:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Read files in ranges rather than whole, summarize tool output rather than quoting it back, and stop re-reading things already in this conversation.`;
+    case 0.8:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Finish the task in progress and report it; start no new exploration, and open nothing large. If the work does not fit, say what is left rather than beginning it.`;
+    case 0.9:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Stop gathering and answer now with what you already have, naming what you did not get to. Further reading will be lost.`;
+  }
+}
+function contextWindowLine(contextWindow) {
+  if (!contextWindow || contextWindow <= 0) return "";
+  return `Your context window is ${contextWindow.toLocaleString("en-US")} tokens. You will be told when it is filling up.`;
+}
+function isContextNote(m2) {
+  return m2.role === "assistant" && typeof m2.content === "string" && m2.content.startsWith(CONTEXT_MARKER);
+}
+function contextNote(band, fill) {
+  return { role: "assistant", content: pressureMessage(band, fill) };
+}
+
+// ../harness/core/compactHistory.ts
+var CHECKPOINT_MARKER = "[checkpoint] ";
+var ANCHOR_MARKER = "[anchor] ";
+var COMPACT_AT_FILL = 0.86;
+function shouldCompact(fill, messages) {
+  if (fill < COMPACT_AT_FILL) return false;
+  return messages.some((m2) => m2.role !== "system" && m2.role !== "user");
+}
+var REARM_BELOW_FILL = 0.6;
+var REARM_ON_REGROWTH = 0.1;
+function afterCompaction() {
+  return { armed: false, floor: null };
+}
+function messageChars(m2) {
+  let n2 = 0;
+  const content = m2.content;
+  if (typeof content === "string") n2 += content.length;
+  else if (Array.isArray(content)) {
+    for (const part of content) {
+      const text = part.text;
+      if (typeof text === "string") n2 += text.length;
+    }
+  }
+  const calls = m2.tool_calls;
+  if (Array.isArray(calls)) {
+    for (const c2 of calls) n2 += (c2.function?.name?.length ?? 0) + (c2.function?.arguments?.length ?? 0);
+  }
+  return n2;
+}
+function estimateFill(messages, contextWindow) {
+  if (!contextWindow || contextWindow <= 0) return 0;
+  let chars = 0;
+  for (const m2 of messages) chars += messageChars(m2);
+  return Math.min(1, chars / 4 / contextWindow);
+}
+function compactionDecision(fill, messages, gate) {
+  if (!gate.armed) {
+    const drained = fill < REARM_BELOW_FILL;
+    const regrown = gate.floor !== null && fill >= gate.floor + REARM_ON_REGROWTH;
+    return { compact: false, next: { ...gate, armed: drained || regrown } };
+  }
+  if (!shouldCompact(fill, messages)) return { compact: false, next: gate };
+  return { compact: true, next: afterCompaction() };
+}
+async function compactHistory(messages, opts) {
+  const tail3 = messages.length ? messages[messages.length - 1] : void 0;
+  const pending = tail3 && isUnansweredToolCall(tail3) ? tail3 : null;
+  const body2 = pending ? messages.slice(0, -1) : messages;
+  const system = body2.filter((m2) => m2.role === "system");
+  const collapsed = body2.filter((m2) => m2.role !== "system" && m2.role !== "user" && !isContextNote(m2));
+  const kept = [];
+  let answered = null;
+  for (const m2 of body2) {
+    if (isOwnMarker(m2) || isContextNote(m2)) continue;
+    if (m2.role === "assistant" && typeof m2.content === "string") answered = m2;
+    if (m2.role !== "user") continue;
+    if (opts.anchor) {
+      kept.push({ role: "assistant", content: `${ANCHOR_MARKER}${await opts.anchor(m2, answered)}` });
+    }
+    kept.push(await offloadIfOversized(m2, opts));
+  }
+  const summary = await opts.summarize(collapsed);
+  return {
+    messages: [
+      ...system,
+      { role: "assistant", content: `${CHECKPOINT_MARKER}${summary}` },
+      ...kept,
+      ...pending ? [pending] : []
+    ],
+    checkpoint: summary
+  };
+}
+async function offloadIfOversized(m2, opts) {
+  const limit2 = opts.offloadOverBytes;
+  if (!opts.offload || limit2 === void 0) return m2;
+  if (typeof m2.content !== "string" || m2.content.length <= limit2) return m2;
+  return { ...m2, content: await opts.offload(m2.content) };
+}
+var isCompactionMarker = isOwnMarker;
+function isOwnMarker(m2) {
+  if (m2.role !== "assistant" || typeof m2.content !== "string") return false;
+  return m2.content.startsWith(ANCHOR_MARKER) || m2.content.startsWith(CHECKPOINT_MARKER);
+}
+function isUnansweredToolCall(m2) {
+  return m2.role === "assistant" && Array.isArray(m2.tool_calls) && m2.tool_calls.length > 0;
+}
+
 // ../harness/prompts/toolsMarker.ts
 var TOOLS_MARKER = "\uE000PROMPD_TOOLS\uE000";
 function formatToolLines(tools) {
@@ -42255,8 +42718,11 @@ async function runAgent(args) {
   const ctxWindow = compression?.contextWindow;
   const compressionStrategy = compression?.strategy ?? "eager";
   let fill = 0;
+  let pressureGate = initialPressureGate;
+  let compactGate = { armed: true, floor: null };
   const deferredOffloads = [];
-  const maxTurns = policy.maxTurns ?? args.maxTurns ?? 8;
+  const maxTurns = policy.maxTurns !== void 0 ? policy.maxTurns : args.maxTurns !== void 0 ? args.maxTurns : 40;
+  const unlimitedTurns = maxTurns === 0;
   const signal = args.signal ?? new AbortController().signal;
   const emit = (e2) => args.onEvent?.(e2);
   const gstate = initialState();
@@ -42272,15 +42738,24 @@ async function runAgent(args) {
     turnAc?.abort();
   });
   const messages = [...args.messages];
+  const incoming = new Set(args.messages);
+  const appendedFromTail = () => {
+    let n2 = 0;
+    for (let i2 = messages.length - 1; i2 >= 0; i2--) {
+      const m2 = messages[i2];
+      if (incoming.has(m2) || m2.role === "system" || isCompactionMarker(m2)) break;
+      n2++;
+    }
+    return n2;
+  };
   const deferred = args.deferredTools ?? [];
   const loader = deferred.length ? createToolLoader({ deferred, loaded: args.loadedTools, onChange: (names) => emit({ type: "tools-loaded", names }) }) : null;
   const eager = loader ? [...tools, loader.searchTool] : tools;
   const capped = (list) => list.length > MAX_PROVIDER_TOOLS ? list.slice(0, MAX_PROVIDER_TOOLS) : list;
   const activeTools = () => capped(loader ? [...eager, ...loader.loaded()] : eager);
   let sent = activeTools();
-  const indexedSystem = loader ? system ? `${system}
-
-${serverIndex(deferred)}` : serverIndex(deferred) : system;
+  const systemParts = [system, loader ? serverIndex(deferred) : "", contextWindowLine(ctxWindow)].filter(Boolean);
+  const indexedSystem = systemParts.length ? systemParts.join("\n\n") : system;
   const filledSystem = indexedSystem ? fillToolsMarker(indexedSystem, sent) : indexedSystem;
   if (filledSystem && !messages.some((m2) => m2.role === "system")) {
     messages.unshift({ role: "system", content: filledSystem });
@@ -42300,7 +42775,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
   let stopReason = "stop";
   let lastToolSig = null;
   let lastStreamErr = "";
-  for (let turn = 1; turn <= maxTurns; turn++) {
+  for (let turn = 1; unlimitedTurns || turn <= maxTurns; turn++) {
     if (signal.aborted) {
       stopReason = "aborted";
       break;
@@ -42313,13 +42788,53 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
         emit({ type: "injected", content: typeof m2.content === "string" ? m2.content : "" });
       }
     }
-    gstate.turn = turn - 1;
-    const turnGate = evaluateTurnStart(policy, gstate);
-    if (!turnGate.ok) {
-      emit({ type: "policy-violation", kind: turnGate.violation.kind, message: turnGate.violation.message, action: turnGate.action, tool: turnGate.violation.tool });
-      if (turnGate.action === "stop") {
-        stopReason = "policy";
-        break;
+    const gateFill = fill || estimateFill(messages, ctxWindow);
+    const gate = compactionDecision(gateFill, messages, compactGate);
+    compactGate = gate.next;
+    if (args.compaction && gate.compact) {
+      const before = messages.length;
+      try {
+        const out = await compactHistory(messages, {
+          summarize: args.compaction.summarize,
+          anchor: args.compaction.anchor,
+          offloadOverBytes: compression && compression.mode !== "off" ? effectiveThreshold(compression.mode, gateFill) : void 0,
+          offload: toolCtx.recall ? async (content) => formatOffloadRef(await toolCtx.recall.record("user", content)) : void 0
+        });
+        messages.splice(0, messages.length, ...out.messages);
+        deferredOffloads.length = 0;
+        try {
+          await args.compaction.onCheckpoint?.(out.checkpoint);
+        } catch (e2) {
+          alog("checkpoint persist failed", e2 instanceof Error ? e2.message : String(e2));
+        }
+        emit({ type: "checkpoint", collapsed: before - messages.length, checkpoint: out.checkpoint });
+      } catch (e2) {
+        compactGate = { ...compactGate, armed: true };
+        alog("compaction failed", e2 instanceof Error ? e2.message : String(e2));
+      }
+    }
+    const pressureFill = fill || estimateFill(messages, ctxWindow);
+    const pressure = pressureDecision(pressureFill, pressureGate);
+    pressureGate = pressure.next;
+    if (pressure.band !== null && ctxWindow) {
+      messages.push(contextNote(pressure.band, pressureFill));
+      emit({
+        type: "context-pressure",
+        band: pressure.band,
+        fill: pressureFill,
+        contextWindow: ctxWindow,
+        promptTokens: Math.round(pressureFill * ctxWindow)
+      });
+    }
+    if (!unlimitedTurns) {
+      gstate.turn = turn - 1;
+      const turnGate = evaluateTurnStart(policy, gstate);
+      if (!turnGate.ok) {
+        emit({ type: "policy-violation", kind: turnGate.violation.kind, message: turnGate.violation.message, action: turnGate.action, tool: turnGate.violation.tool });
+        if (turnGate.action === "stop") {
+          stopReason = "policy";
+          break;
+        }
       }
     }
     if (loader) {
@@ -42407,6 +42922,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
     usage.completionTokens += streamed.usage.completionTokens;
     if (ctxWindow && ctxWindow > 0 && streamed.usage.promptTokens) {
       fill = Math.min(1, streamed.usage.promptTokens / ctxWindow);
+      if (!compactGate.armed && compactGate.floor === null) compactGate = { armed: false, floor: fill };
     }
     emit({ type: "usage", usage: streamed.usage });
     const assistantMsg = streamed.toolCalls.length ? {
@@ -42455,13 +42971,13 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
       }
       loader?.touch(tool.name);
       const address = toolAddress(tool);
-      const gate = evaluateToolCall(policy, gstate, { name: call.name, exists: true, address });
-      if (!gate.ok) {
-        const msg = `Blocked by policy "${policy.name}": ${gate.violation.message}`;
+      const gate2 = evaluateToolCall(policy, gstate, { name: call.name, exists: true, address });
+      if (!gate2.ok) {
+        const msg = `Blocked by policy "${policy.name}": ${gate2.violation.message}`;
         messages.push({ role: "tool", tool_call_id: call.id, content: `Error: ${msg}` });
-        emit({ type: "policy-violation", kind: gate.violation.kind, message: gate.violation.message, action: gate.action, tool: call.name });
+        emit({ type: "policy-violation", kind: gate2.violation.kind, message: gate2.violation.message, action: gate2.action, tool: call.name });
         emit({ type: "tool-result", id: call.id, name: call.name, result: msg, isError: true });
-        if (gate.action === "stop") {
+        if (gate2.action === "stop") {
           policyStop = true;
           break;
         }
@@ -42536,7 +43052,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
       stopReason = "policy";
       break;
     }
-    if (turn === maxTurns) stopReason = "max_turns";
+    if (!unlimitedTurns && turn === maxTurns) stopReason = "max_turns";
   }
   reconcileDanglingToolCalls(messages);
   for (const v2 of evaluateCompletion(policy, gstate)) {
@@ -42544,7 +43060,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
   }
   alog("done", stopReason, "tokens", usage);
   emit({ type: "done", reason: stopReason });
-  return { messages, text, usage, stopReason };
+  return { messages, text, usage, stopReason, appended: appendedFromTail() };
 }
 async function compactIncomingOffloads(messages, toolByName, compression, recall, emit) {
   const nameForCallId = /* @__PURE__ */ new Map();
@@ -42630,8 +43146,29 @@ var JsonlSessionStore = class _JsonlSessionStore {
     if (!f2) throw new Error("No file workspace is connected \u2014 sessions are unavailable.");
     return f2;
   }
+  /* Sessions that have been MOVED out from under this store's root, id -> the
+   * root they now live in.
+   *
+   * A session can move mid-run: start_project offers to bring the conversation
+   * into the project it just created, and the run that asked is still writing.
+   * Without this, the next save() would resolve the OLD path and recreate the
+   * file there from its cursor -- the same conversation in two places, neither
+   * complete. The cursor itself survives the move untouched: it is keyed by id
+   * and holds the text, not the path.
+   *
+   * In memory only, and deliberately: it describes where a session went during
+   * THIS page's life. A reload lists both roots afresh and needs no memory of
+   * the journey. */
+  movedRoots = /* @__PURE__ */ new Map();
+  /** Resolve this id somewhere other than the store's own root, from now on. */
+  setRootFor(id, root) {
+    this.movedRoots.set(id, root);
+  }
+  rootFor(id) {
+    return this.movedRoots.get(id) ?? this.root();
+  }
   path(id) {
-    return `${this.root()}/${id}/SESSION.jsonl`;
+    return `${this.rootFor(id)}/${id}/SESSION.jsonl`;
   }
   async create(title, surface) {
     const createdAt = now();
@@ -42800,10 +43337,108 @@ var JsonlSessionStore = class _JsonlSessionStore {
   }
   async delete(id) {
     this.cursors.delete(id);
-    await (await this.files()).remove(`${this.root()}/${id}`).catch(() => {
+    await (await this.files()).remove(`${this.rootFor(id)}/${id}`).catch(() => {
+    });
+  }
+};
+
+// ../harness/sessions/checkpointStore.ts
+var CHECKPOINT_FILE = "CHECKPOINT.md";
+function makeCheckpointStore(getFiles, root) {
+  return {
+    async append(sessionId, body2) {
+      const files = await getFiles();
+      if (!files) return;
+      const path = `${root}/${sessionId}/${CHECKPOINT_FILE}`;
+      const entry = `## ${(/* @__PURE__ */ new Date()).toISOString()}
+
+${body2}
+`;
+      let existing = null;
+      try {
+        existing = await files.read(path);
+      } catch {
+        existing = null;
+      }
+      if (existing === null) {
+        await files.create(path, `# Checkpoints
+
+${entry}`);
+        return;
+      }
+      await files.write(path, `${existing}
+${entry}`);
+    }
+  };
+}
+
+// ../harness/core/summarize.ts
+var TRUNCATION_NOTE = " \u2026[truncated]";
+var MIN_KEEP = 200;
+var SUMMARY_INPUT_CHARS = 6e4;
+var SYSTEM = [
+  "You are compacting an agent conversation that is about to lose its middle.",
+  "Write a dense record of what was DECIDED and what the current state is:",
+  "conclusions reached, constraints the user set, files and artifacts touched,",
+  "and anything still open. Omit narration, pleasantries and tool mechanics.",
+  "Write plain prose or short bullets. No preamble."
+].join(" ");
+function makeSummarizer(client, model, opts = {}) {
+  const maxChars = opts.maxChars ?? SUMMARY_INPUT_CHARS;
+  return async (collapsed) => {
+    const rendered = renderTail(collapsed, maxChars);
+    const res = await client.chat.completions.create({
+      model,
+      messages: [
+        { role: "system", content: SYSTEM },
+        { role: "user", content: rendered }
+      ],
+      stream: false
     });
+    return res.choices[0]?.message?.content ?? "";
+  };
+}
+function renderTail(messages, maxChars) {
+  const lines = [];
+  let used = 0;
+  for (let i2 = messages.length - 1; i2 >= 0; i2--) {
+    const m2 = messages[i2];
+    const text = typeof m2.content === "string" ? m2.content : JSON.stringify(m2.content ?? "");
+    const line = `${m2.role}: ${text}`;
+    const room = maxChars - used;
+    if (line.length > room) {
+      if (room > MIN_KEEP) lines.unshift(line.slice(0, room - TRUNCATION_NOTE.length) + TRUNCATION_NOTE);
+      break;
+    }
+    lines.unshift(line);
+    used += line.length;
   }
+  return lines.join("\n\n");
+}
+
+// ../harness/providers/contextWindow.ts
+var KNOWN_WINDOWS = {
+  "claude-sonnet-4-5": 2e5,
+  "claude-haiku-4-5": 2e5,
+  "claude-opus-4-1": 2e5,
+  "gpt-4o-mini": 128e3,
+  "gpt-4.1-mini": 1e6,
+  "gpt-5": 4e5,
+  "gpt-5-mini": 4e5,
+  "gemini-2-5-pro": 1e6,
+  "gemini-2-5-flash": 1e6
 };
+var CONSERVATIVE_FALLBACK_WINDOW = 32e3;
+function stripDateSuffix(id) {
+  return id.replace(/-\d{4}-\d{2}-\d{2}$/, "").replace(/-\d{8}$/, "");
+}
+function resolveContextWindow(modelId) {
+  const id = modelId.trim().toLowerCase();
+  if (id in KNOWN_WINDOWS) return { window: KNOWN_WINDOWS[id], source: "known" };
+  const stripped = stripDateSuffix(id);
+  if (stripped in KNOWN_WINDOWS) return { window: KNOWN_WINDOWS[stripped], source: "known" };
+  return { window: CONSERVATIVE_FALLBACK_WINDOW, source: "fallback" };
+}
 
 // src/runner/runLog.ts
 function runLogPath(crewRoot2, agent) {
@@ -42872,30 +43507,43 @@ function pricedForUsd(rates) {
   if (!rates) return false;
   return rates.inPrice > 0 || rates.outPrice > 0;
 }
-async function hydratePrices(endpoint, getToken, fetchImpl = fetch) {
-  const table = /* @__PURE__ */ new Map();
+async function fetchAvailableModels(endpoint, getToken, fetchImpl) {
   let token = null;
   try {
     token = await getToken();
   } catch {
     token = null;
   }
-  if (!token) return table;
+  if (!token) return [];
   try {
     const res = await fetchImpl(`${endpoint.replace(/\/$/, "")}/llm-providers/available`, {
       headers: { Authorization: `Bearer ${token}` }
     });
-    if (!res.ok) return table;
+    if (!res.ok) return [];
     const json = await res.json();
-    for (const p2 of json.providers ?? []) {
-      for (const m2 of p2.models ?? []) {
-        if (m2.inputPrice == null || m2.outputPrice == null) continue;
-        table.set(m2.model, { inPrice: m2.inputPrice, outPrice: m2.outputPrice });
-      }
-    }
+    const out = [];
+    for (const p2 of json.providers ?? []) out.push(...p2.models ?? []);
+    return out;
   } catch {
+    return [];
+  }
+}
+async function hydrateCatalog(endpoint, getToken, fetchImpl = fetch) {
+  const prices = /* @__PURE__ */ new Map();
+  const windows = /* @__PURE__ */ new Map();
+  const models = await fetchAvailableModels(endpoint, getToken, fetchImpl);
+  for (const m2 of models) {
+    if (m2.inputPrice != null && m2.outputPrice != null) {
+      prices.set(m2.model, { inPrice: m2.inputPrice, outPrice: m2.outputPrice });
+    }
+    if (typeof m2.contextWindow === "number" && m2.contextWindow > 0) {
+      windows.set(m2.model, m2.contextWindow);
+    }
   }
-  return table;
+  return { prices, windows };
+}
+async function hydratePrices(endpoint, getToken, fetchImpl = fetch) {
+  return (await hydrateCatalog(endpoint, getToken, fetchImpl)).prices;
 }
 
 // src/runner/permissionMessage.ts
@@ -42932,7 +43580,7 @@ async function runCrewAgentNode(def, input, ctx, deps) {
   const signal = ctx.signal ?? new AbortController().signal;
   const resolveDef = crewResolveDef(ctx.stateFiles, ctx.stateRoot);
   const kernelTools = crewToolSet(def, resolveDef)();
-  await mkdir(ctx.memoryDir, { recursive: true });
+  await mkdir2(ctx.memoryDir, { recursive: true });
   const extraTools = deps.nodeTools([...ctx.workRoots, ctx.memoryDir]);
   const tools = [...kernelTools, ...extraTools];
   const conditionalOffers = [];
@@ -43034,6 +43682,21 @@ async function runCrewAgentNode(def, input, ctx, deps) {
     // different answer. Supplied only when no prompt is wired; with one, a real
     // person really did decide, and the default wording is correct.
     ...promptImpl ? {} : { describePermissionDenial: unattendedDenialMessage },
+    /* `mode: 'off'` with a real `contextWindow` reads oddly but is exactly what
+     * is wanted here: rung-1 offload stays off (this executor supplies no
+     * `toolCtx.recall`, so there is nowhere to offload TO), while the loop still
+     * computes `fill` — which is the only thing that lets it notice a window
+     * about to overflow. Without a window, `fill` is pinned at 0 and compaction
+     * below is dead code however well it is wired. */
+    compression: { mode: "off", contextWindow: resolveContextWindow(modelId).window },
+    /* Why the daemon in particular: these runs are unattended and long, so
+     * nobody is watching to notice the wall and restart. Before this, hitting
+     * it produced a provider 400 — fatal in recovery.ts, never retried — and
+     * the run simply died mid-task. */
+    compaction: {
+      summarize: makeSummarizer(ctx.client, modelId),
+      onCheckpoint: (body2) => makeCheckpointStore(() => ctx.stateFiles, sessionsRoot2).append(session.id, body2)
+    },
     signal: runSignal,
     onEvent
   });
@@ -43681,7 +44344,7 @@ var NodeRunnerService = class {
           workFiles,
           workRoots: [workDir],
           client: this.client,
-          memoryDir: join11(stateOwnerDir, stateRoot, agent, "memory"),
+          memoryDir: join12(stateOwnerDir, stateRoot, agent, "memory"),
           onEvent: trackedOnEvent,
           sessionId,
           signal: controller.signal,
@@ -43718,7 +44381,7 @@ var NodeRunnerService = class {
 // src/runner/core.ts
 import { watch } from "node:fs";
 import { readdir as readdir2, stat } from "node:fs/promises";
-import { join as join13, relative as relative6, sep as sep4 } from "node:path";
+import { join as join14, relative as relative6, sep as sep4 } from "node:path";
 
 // src/runner/triggerConfig.ts
 function inputFor(trigger, fallback) {
@@ -44671,8 +45334,8 @@ async function resumeOpenRooms(opts) {
 }
 
 // src/runner/roomDeps.ts
-import { mkdir as mkdir2 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { mkdir as mkdir3 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 
 // src/runner/roomAgentLookup.ts
 init_tools_node();
@@ -44772,11 +45435,11 @@ async function makeDaemonRoomDeps(ctx, room, deps = {}) {
         `cannot locate the memory folder for crew agent "${def.name}": this daemon has no state root for owner "${ctx.owner}"`
       );
     }
-    return join12(stateDir, agentMemoryRoot(ctx.stateRoot, def.name));
+    return join13(stateDir, agentMemoryRoot(ctx.stateRoot, def.name));
   }
   async function buildRuntime(def, p2, state, findings) {
     const memoryDir = memoryDirFor(def);
-    await mkdir2(memoryDir, { recursive: true });
+    await mkdir3(memoryDir, { recursive: true });
     const toolCtx = {
       signal: new AbortController().signal,
       memory: makeAgentMemoryProvider(() => ctx.stateFiles, agentMemoryRoot(ctx.stateRoot, def.name)),
@@ -44826,7 +45489,19 @@ async function makeDaemonRoomDeps(ctx, room, deps = {}) {
         // person really did decide and the default wording is correct.
         ...ctx.prompt ? {} : { describePermissionDenial: unattendedDenialMessage },
         ...ctx.now ? { now: ctx.now } : {},
-        ...ceilingUsd !== void 0 ? { turnCeilingUsd: ceilingUsd } : {}
+        ...ceilingUsd !== void 0 ? { turnCeilingUsd: ceilingUsd } : {},
+        /* A room is the likeliest place in the product to meet the context
+         * wall: every participant's turn is seeded with the WHOLE transcript,
+         * tool calls included, so cost grows with participants x turns. Before
+         * this, a room that filled the window died on a provider 400 -- fatal
+         * in recovery.ts -- and took the turn with it.
+         *
+         * `mode: 'off'` with a real window is the same trade `executor.ts`
+         * makes: rung-1 offload stays off (this toolCtx supplies no `recall`,
+         * so there is nowhere to offload to) while the loop still computes
+         * `fill`, which is the only thing that lets compaction fire. */
+        compression: { mode: "off", contextWindow: resolveContextWindow(modelId).window },
+        compaction: { summarize: makeSummarizer(ctx.client, modelId) }
       }
     });
   }
@@ -45072,9 +45747,9 @@ function startDaemonCore(opts) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (isExcludedSegment(entry.name, dotDir)) continue;
-        await walkForChanges(root, join13(dir, entry.name), since);
+        await walkForChanges(root, join14(dir, entry.name), since);
       } else {
-        const abs = join13(dir, entry.name);
+        const abs = join14(dir, entry.name);
         let mtimeMs;
         try {
           mtimeMs = (await stat(abs)).mtimeMs;
@@ -45386,9 +46061,9 @@ function makeRunHub(opts = {}) {
 import { promises as fs11 } from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { hostname } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function idPath(dir = sidecarSubdir()) {
-  return join14(dir, "daemon.id");
+  return join15(dir, "daemon.id");
 }
 async function loadOrCreateSidecarId(dir = sidecarSubdir()) {
   const path = idPath(dir);
@@ -45417,7 +46092,7 @@ function sidecarName(opts) {
 // src/hosts.ts
 import { promises as fs12 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { join as join15, dirname as dirname5 } from "node:path";
+import { join as join16, dirname as dirname6 } from "node:path";
 var MAX_DIR = 32;
 var MAX_FIELD_LEN = 200;
 var MAX_HOSTS = 200;
@@ -45451,7 +46126,7 @@ function sanitizeDirName(raw) {
   return RESERVED_WINDOWS_NAMES.has(safe) ? `${safe}-host` : safe;
 }
 function hostsPath(stateDir) {
-  return join15(stateDir, "sidecar", "hosts.json");
+  return join16(stateDir, "sidecar", "hosts.json");
 }
 function emptyManifest2() {
   return /* @__PURE__ */ Object.create(null);
@@ -45491,10 +46166,10 @@ async function read(dir, fallbackLastSeen) {
   return manifest;
 }
 async function write(stateDir, manifest) {
-  const dir = dirname5(hostsPath(stateDir));
+  const dir = dirname6(hostsPath(stateDir));
   await fs12.mkdir(dir, { recursive: true });
   const target = hostsPath(stateDir);
-  const tmp = join15(dir, `.hosts.json.tmp-${randomBytes3(8).toString("hex")}`);
+  const tmp = join16(dir, `.hosts.json.tmp-${randomBytes3(8).toString("hex")}`);
   try {
     await fs12.writeFile(tmp, JSON.stringify(manifest, null, 2));
     await fs12.rename(tmp, target);
@@ -45601,7 +46276,7 @@ function makeHostsManifest(dir) {
 
 // src/hostsAdmin.ts
 import { readdir as readdir3 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // src/hostsCli.ts
 init_tools_node();
@@ -45717,16 +46392,16 @@ async function countCrew(crewDir) {
   return entries.filter((e2) => e2.isFile() && /\.(prmd|md)$/i.test(e2.name)).length;
 }
 async function countAgents(hostDir) {
-  let total = await countCrew(join16(hostDir, "crew"));
+  let total = await countCrew(join17(hostDir, "crew"));
   let workspaces;
   try {
-    workspaces = await readdir3(join16(hostDir, WORKSPACES_SEG), { withFileTypes: true });
+    workspaces = await readdir3(join17(hostDir, WORKSPACES_SEG), { withFileTypes: true });
   } catch {
     return total;
   }
   for (const entry of workspaces) {
     if (!entry.isDirectory()) continue;
-    total += await countCrew(join16(hostDir, WORKSPACES_SEG, entry.name, "crew"));
+    total += await countCrew(join17(hostDir, WORKSPACES_SEG, entry.name, "crew"));
   }
   return total;
 }
@@ -45852,11 +46527,11 @@ function startAccountWatch(opts) {
 // src/runner/pauseStore.ts
 import { promises as fs14 } from "node:fs";
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { join as join17, dirname as dirname6 } from "node:path";
+import { join as join18, dirname as dirname7 } from "node:path";
 var MAX_PAUSES = 1e3;
 var MAX_FIELD_LEN2 = 200;
 function pausesPath(stateDir) {
-  return join17(stateDir, "sidecar", "pauses.json");
+  return join18(stateDir, "sidecar", "pauses.json");
 }
 function keyOf2(owner, agent) {
   return `${owner}\0${agent}`;
@@ -45899,9 +46574,9 @@ async function read2(stateDir, fallbackPausedAt) {
 }
 async function write2(stateDir, paused) {
   const target = pausesPath(stateDir);
-  const dir = dirname6(target);
+  const dir = dirname7(target);
   await fs14.mkdir(dir, { recursive: true });
-  const tmp = join17(dir, `.pauses.json.tmp-${randomBytes4(8).toString("hex")}`);
+  const tmp = join18(dir, `.pauses.json.tmp-${randomBytes4(8).toString("hex")}`);
   const body2 = { version: 1, paused: [...paused] };
   try {
     await fs14.writeFile(tmp, JSON.stringify(body2, null, 2));
@@ -46171,10 +46846,10 @@ async function runSessionsCli(argv, deps) {
   }
   if (verb === "create") {
     const root = rootFrom(argv, process.cwd());
-    const backend = deps.backend ?? backendFor(deps, [root], run);
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    const backend2 = deps.backend ?? backendFor(deps, [root], run);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
     try {
-      const handle = await backend.create({ workdir: root, owner: process.env.USERNAME || process.env.USER || "cli" });
+      const handle = await backend2.create({ workdir: root, owner: process.env.USERNAME || process.env.USER || "cli" });
       out(`${handle.id}
 `);
       err(`created ${handle.id} on ${handle.workdir}
@@ -46203,19 +46878,19 @@ async function runSessionsCli(argv, deps) {
 `);
       return 1;
     }
-    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
-    if (!backend.exec) {
+    const backend2 = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (!backend2.exec) {
       err("corenel sessions run: this backend cannot execute inside a session\n");
       return 1;
     }
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
     try {
       const token = await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null;
       if (!token) {
         err("corenel sessions run: not signed in on this host.\n  Run `corenel login` first \u2014 the session uses the host's credential.\n");
         return 1;
       }
-      const r2 = await backend.exec(found.id, ["corenel", "run", prompt], { env: { CORENEL_TOKEN: token } });
+      const r2 = await backend2.exec(found.id, ["corenel", "run", prompt], { env: { CORENEL_TOKEN: token } });
       if (r2.stdout) out(r2.stdout.endsWith("\n") ? r2.stdout : `${r2.stdout}
 `);
       if (r2.stderr.trim()) err(r2.stderr.endsWith("\n") ? r2.stderr : `${r2.stderr}
@@ -46240,9 +46915,9 @@ async function runSessionsCli(argv, deps) {
 `);
       return 1;
     }
-    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
-    if (backend.adopt) await backend.adopt().catch(() => void 0);
-    const known = !!backend.get?.(found.id);
+    const backend2 = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (backend2.adopt) await backend2.adopt().catch(() => void 0);
+    const known = !!backend2.get?.(found.id);
     if (!known) {
       const r2 = await sandboxLifecycle(run, verb, found.sandbox);
       if (!r2.ok) {
@@ -46264,7 +46939,7 @@ async function runSessionsCli(argv, deps) {
     }
     try {
       if (verb === "pause") {
-        const r2 = await backend.pause(found.id);
+        const r2 = await backend2.pause(found.id);
         if (r2 && !r2.drained) {
           err(`paused ${found.id}, but ${r2.remaining.length} call(s) were STILL RUNNING when the drain gave up
 `);
@@ -46275,12 +46950,12 @@ async function runSessionsCli(argv, deps) {
         return 0;
       }
       if (verb === "resume") {
-        await backend.resume(found.id);
+        await backend2.resume(found.id);
         out(`resumed ${found.id}
 `);
         return 0;
       }
-      await backend.destroy(found.id);
+      await backend2.destroy(found.id);
       const still = (await listSessions(run)).find((r2) => r2.id === found.id);
       if (still) {
         err(`corenel sessions destroy: ${found.id} is still present (status ${still.status})
@@ -46704,7 +47379,7 @@ var FLAG_TO_KEY = {
   "--default-model": "defaultModel",
   "--name": "name"
 };
-var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.6";
+var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.9.0";
 function parseArgsWithProvenance(argv) {
   const explicit = /* @__PURE__ */ new Set();
   for (const a2 of argv) {
@@ -46846,78 +47521,6 @@ async function resolveEndpoint(args, env = process.env) {
   });
 }
 
-// src/config/daemonConfig.ts
-import { readFile as readFile3, writeFile, mkdir as mkdir3 } from "node:fs/promises";
-import { dirname as dirname7, join as join18 } from "node:path";
-var DAEMON_CONFIG_VERSION = 1;
-var SECRET_KEYS = ["acpAuth", "tunnelToken", "token"];
-var KNOWN_KEYS = [
-  "version",
-  "port",
-  "host",
-  "roots",
-  "addUnder",
-  "cloneUnder",
-  "allowLan",
-  "allowOrigins",
-  "tlsCert",
-  "tlsKey",
-  "selfSigned",
-  "tunnel",
-  "tunnelName",
-  "tunnelHostname",
-  "endpoint",
-  "allowShell",
-  "keepTranscripts",
-  "isolation",
-  "msbBin",
-  "guestImage",
-  "maxChainDepth",
-  "name",
-  "appUrl",
-  "defaultModel",
-  "mcpServers",
-  "mcpAllow"
-];
-function daemonConfigPath(stateDir) {
-  return join18(stateDir, "daemon.json");
-}
-async function readDaemonConfig(stateDir) {
-  const empty = (corrupt) => ({ config: { version: DAEMON_CONFIG_VERSION }, unknown: {}, corrupt });
-  let raw;
-  try {
-    raw = await readFile3(daemonConfigPath(stateDir), "utf8");
-  } catch {
-    return empty(false);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return empty(true);
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return empty(true);
-  const src2 = parsed;
-  const config = { version: DAEMON_CONFIG_VERSION };
-  const unknown = {};
-  for (const [k2, v2] of Object.entries(src2)) {
-    if (k2 === "version") continue;
-    if (KNOWN_KEYS.includes(k2)) {
-      config[k2] = v2;
-    } else {
-      unknown[k2] = v2;
-    }
-  }
-  return { config, unknown, corrupt: false };
-}
-async function writeDaemonConfig(stateDir, next, unknown = {}) {
-  const body2 = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
-  const path = daemonConfigPath(stateDir);
-  await mkdir3(dirname7(path), { recursive: true });
-  await writeFile(path, `${JSON.stringify(body2, null, 2)}
-`, "utf8");
-}
-
 // src/config/layer.ts
 var STRICT_BOOLEAN_KEYS = /* @__PURE__ */ new Set(["allowShell", "allowLan", "selfSigned", "keepTranscripts"]);
 var KEY_MAP = {
@@ -47344,7 +47947,162 @@ async function runConfig(raw, io) {
   return 2;
 }
 
-// src/mcp/config.ts
+// ../mcp/src/httpClient.ts
+var PROTOCOL_VERSION = "2025-06-18";
+var CLIENT_INFO = { name: "corenel", version: "0.2.0" };
+var SESSION_HEADER = "Mcp-Session-Id";
+var McpHttpClient = class {
+  constructor(server, auth, fetchImpl = fetch) {
+    this.server = server;
+    this.auth = auth;
+    this.fetchImpl = fetchImpl;
+  }
+  nextRequestId = 1;
+  sessionId;
+  async initialize() {
+    await this.send("initialize", {
+      protocolVersion: PROTOCOL_VERSION,
+      capabilities: {},
+      clientInfo: CLIENT_INFO
+    });
+  }
+  async listTools() {
+    const result = await this.send("tools/list", {});
+    const tools = isRecord2(result) ? result.tools : void 0;
+    if (!Array.isArray(tools)) return [];
+    return tools.filter(isMcpTool);
+  }
+  async callTool(name, args) {
+    const result = await this.send("tools/call", { name, arguments: args });
+    const record = isRecord2(result) ? result : {};
+    return { content: record.content, isError: record.isError === true };
+  }
+  /** Send one JSON-RPC request, retrying exactly once on a 401 that the
+   *  AuthProvider says it recovered from. `isRetry` prevents a second retry
+   *  loop -- a credential that fails twice is refused, not flaky. */
+  async send(method, params, isRetry = false) {
+    const headers = await this.buildHeaders();
+    const id = this.nextRequestId++;
+    const res = await this.request(headers, id, method, params);
+    if (res.status === 401) {
+      if (!isRetry && await this.auth.onUnauthorized()) {
+        return this.send(method, params, true);
+      }
+      throw new Error(
+        `MCP server "${this.server.name}" refused the credential (401) -- run: corenel mcp login ${this.server.name}`
+      );
+    }
+    const sessionId = res.headers.get(SESSION_HEADER);
+    if (sessionId) this.sessionId = sessionId;
+    if (!res.ok) {
+      throw new Error(`MCP server "${this.server.name}" returned HTTP ${res.status}`);
+    }
+    const contentType = res.headers.get("content-type") ?? "";
+    let body2;
+    if (contentType.includes("text/event-stream")) {
+      body2 = await this.readSseResponse(res, id);
+    } else if (contentType.includes("application/json")) {
+      body2 = await res.json();
+    } else {
+      throw new Error(
+        `MCP server "${this.server.name}" answered with an unexpected content-type: "${contentType || "(none)"}"`
+      );
+    }
+    if (body2.error) {
+      throw new Error(`MCP server "${this.server.name}" returned error ${body2.error.code}: ${body2.error.message}`);
+    }
+    return body2.result;
+  }
+  /** Read an SSE body until the JSON-RPC response for `id` arrives.
+   *
+   *  Events are separated by a blank line; an event's `data:` lines are joined
+   *  with newlines, per the SSE spec, and parsed as one JSON-RPC message.
+   *  Notifications (no `id`) and responses to other ids are skipped. The reader
+   *  is cancelled once the answer is in, so a server that keeps the stream open
+   *  after replying cannot hold this call open with it. */
+  async readSseResponse(res, id) {
+    if (!res.body) {
+      throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (value) buffer += decoder.decode(value, { stream: true });
+        buffer = buffer.replace(/\r\n/g, "\n");
+        let boundary = buffer.indexOf("\n\n");
+        while (boundary !== -1) {
+          const event = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          const match = this.matchSseEvent(event, id);
+          if (match) return match;
+          boundary = buffer.indexOf("\n\n");
+        }
+        if (done) {
+          const tail3 = buffer.trim() ? this.matchSseEvent(buffer, id) : null;
+          if (tail3) return tail3;
+          throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
+        }
+      }
+    } finally {
+      reader.cancel().catch(() => {
+      });
+    }
+  }
+  /** The JSON-RPC response in one SSE event, if it answers `id`; else null. */
+  matchSseEvent(event, id) {
+    const data = event.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n");
+    if (!data) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(data);
+    } catch {
+      return null;
+    }
+    if (!isRecord2(parsed) || parsed.id !== id) return null;
+    if (!("result" in parsed) && !("error" in parsed)) return null;
+    return parsed;
+  }
+  /** The bare `fetch()` call, wrapped -- every OTHER throw in `send` already
+   *  names the server; this is the one call whose own failures (DNS miss,
+   *  connection refused, TLS failure) never reach `send`'s response-handling
+   *  at all. Left unguarded, node's bare `fetch failed` -- naming neither the
+   *  URL nor the actual cause -- propagates straight out of `send`, into
+   *  `registry.ts`'s `status().error`, and out of `doctor`, the one command
+   *  whose entire job is diagnosis. `err.cause` carries the real reason
+   *  (ECONNREFUSED, ENOTFOUND, a TLS alert); undici puts it there rather than
+   *  in `err.message`. */
+  async request(headers, id, method, params) {
+    try {
+      return await this.fetchImpl(this.server.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
+      });
+    } catch (err) {
+      const cause = err instanceof Error && err.cause instanceof Error ? err.cause.message : err instanceof Error ? err.message : String(err);
+      throw new Error(`MCP server "${this.server.name}" (${this.server.url}) is unreachable: ${cause}`);
+    }
+  }
+  async buildHeaders() {
+    const headers = new Headers();
+    headers.set("Content-Type", "application/json");
+    headers.set("Accept", "application/json, text/event-stream");
+    for (const h2 of await this.auth.headers()) headers.set(h2.name, h2.value);
+    if (this.sessionId) headers.set(SESSION_HEADER, this.sessionId);
+    return headers;
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function isMcpTool(value) {
+  return isRecord2(value) && typeof value.name === "string" && "inputSchema" in value;
+}
+
+// ../mcp/src/config.ts
 init_tools_node();
 import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir4, chmod } from "node:fs/promises";
 function isUsableServer(v2) {
@@ -47463,7 +48221,7 @@ async function writeMcpCredential(stateDir, server, cred) {
   }
 }
 
-// src/mcp/oauth/discovery.ts
+// ../mcp/src/oauth/discovery.ts
 var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
 var AUTH_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
 async function tryFetchJson(url, fetchImpl) {
@@ -47561,7 +48319,423 @@ async function discoverAuthMetadata(authServer, fetchImpl = fetch) {
   return { authorizationEndpoint, tokenEndpoint, registrationEndpoint, scopesSupported };
 }
 
-// src/mcp/oauth/register.ts
+// ../mcp/src/oauth/tokens.ts
+function parseTokenResponse(body2) {
+  if (typeof body2 !== "object" || body2 === null || Array.isArray(body2)) {
+    throw new Error("token endpoint returned a malformed response");
+  }
+  const r2 = body2;
+  if (typeof r2.access_token !== "string" || r2.access_token.length === 0) {
+    throw new Error("token endpoint response did not include an access_token");
+  }
+  return {
+    access_token: r2.access_token,
+    ...typeof r2.refresh_token === "string" ? { refresh_token: r2.refresh_token } : {},
+    ...typeof r2.expires_in === "number" ? { expires_in: r2.expires_in } : {},
+    ...typeof r2.scope === "string" ? { scope: r2.scope } : {}
+  };
+}
+async function postToken(endpoint, body2, fetchImpl) {
+  const res = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body2.toString()
+  });
+  if (!res.ok) {
+    throw new Error(`token request failed at ${endpoint} (HTTP ${res.status})`);
+  }
+  return parseTokenResponse(await res.json());
+}
+async function exchangeCode(meta, opts, fetchImpl = fetch, now2 = Date.now) {
+  const body2 = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: opts.clientId,
+    code: opts.code,
+    code_verifier: opts.verifier,
+    redirect_uri: opts.redirectUri,
+    resource: opts.resource
+  });
+  if (opts.clientSecret) body2.set("client_secret", opts.clientSecret);
+  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
+  return {
+    kind: "oauth",
+    accessToken: tokens.access_token,
+    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+    clientId: opts.clientId,
+    ...opts.clientSecret ? { clientSecret: opts.clientSecret } : {},
+    authServer: opts.authServer,
+    ...tokens.scope ? { scope: tokens.scope } : {}
+  };
+}
+async function refresh(meta, cred, fetchImpl = fetch, now2 = Date.now) {
+  if (!cred.refreshToken) {
+    throw new Error("credential has no refresh token to refresh with -- sign in again");
+  }
+  const body2 = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: cred.refreshToken,
+    client_id: cred.clientId
+  });
+  if (cred.clientSecret) body2.set("client_secret", cred.clientSecret);
+  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
+  return {
+    kind: "oauth",
+    accessToken: tokens.access_token,
+    // Keep the old refresh token when the server did not send a new one.
+    refreshToken: tokens.refresh_token ?? cred.refreshToken,
+    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+    clientId: cred.clientId,
+    ...cred.clientSecret ? { clientSecret: cred.clientSecret } : {},
+    authServer: cred.authServer,
+    scope: tokens.scope ?? cred.scope
+  };
+}
+var EXPIRY_SKEW_MS = 6e4;
+function isExpired(cred, nowMs) {
+  if (cred.expiresAt === void 0) return false;
+  return cred.expiresAt - nowMs <= EXPIRY_SKEW_MS;
+}
+
+// ../mcp/src/auth.ts
+function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null) {
+  async function doRefresh(cred) {
+    if (!cred.refreshToken) {
+      throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
+    }
+    const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
+    const refreshed = await refresh(meta, cred, fetchImpl);
+    await writeMcpCredential(stateDir, server.name, refreshed);
+    return refreshed;
+  }
+  return {
+    async headers() {
+      const cred = await readMcpCredential(stateDir, server.name);
+      if (!cred && !server.hosted) {
+        throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
+      }
+      const mcpHeaders = !cred ? [] : cred.kind === "headers" ? cred.headers : [{ name: "Authorization", value: `Bearer ${(isExpired(cred, Date.now()) ? await doRefresh(cred) : cred).accessToken}` }];
+      if (!server.hosted) return mcpHeaders;
+      const moved = mcpHeaders.map((h2) => h2.name.toLowerCase() === "authorization" ? { name: "X-MCP-Authorization", value: h2.value } : h2);
+      const account = await accountToken();
+      return account ? [...moved, { name: "Authorization", value: `Bearer ${account}` }] : moved;
+    },
+    async onUnauthorized() {
+      const cred = await readMcpCredential(stateDir, server.name);
+      if (!cred || cred.kind !== "oauth") return false;
+      try {
+        await doRefresh(cred);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+
+// ../mcp/src/timedFetch.ts
+var AUTH_REQUEST_TIMEOUT_MS = 15e3;
+function timedFetch(ms, inner = fetch) {
+  return async (input, init2 = {}) => {
+    const deadline = AbortSignal.timeout(ms);
+    const signal = init2.signal ? AbortSignal.any([init2.signal, deadline]) : deadline;
+    try {
+      return await inner(input, { ...init2, signal });
+    } catch (err) {
+      if (deadline.aborted && !init2.signal?.aborted) {
+        throw new Error(`no answer within ${ms / 1e3}s`, { cause: err });
+      }
+      throw err;
+    }
+  };
+}
+
+// ../mcp/src/registry.ts
+async function accountTokenFor(stateDir) {
+  try {
+    const cred = await resolveCredential(process.env, stateDir);
+    return cred.token ?? null;
+  } catch {
+    return null;
+  }
+}
+function defaultClientFactory(stateDir, server) {
+  return new McpHttpClient(
+    server,
+    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir))
+  );
+}
+var SERVER_CONNECT_TIMEOUT_MS = 3e4;
+var McpRegistry = class {
+  constructor(stateDir, clientFactory = defaultClientFactory) {
+    this.stateDir = stateDir;
+    this.clientFactory = clientFactory;
+  }
+  connected = /* @__PURE__ */ new Map();
+  statuses = /* @__PURE__ */ new Map();
+  // The order the operator wrote servers in daemon.json, captured once per
+  // connectAll() -- `tools()` walks THIS, never `connected`'s Map iteration
+  // order. `connectOne` runs concurrently for every server (Promise.all), so
+  // Map insertion order is race order: whichever server's initialize+list
+  // happened to resolve first. That is fine for `connected` (a lookup table,
+  // order never read) but `tools()` is a list a model/doctor/policy consumes
+  // in order, and race order means a different tool ordering on every daemon
+  // boot -- exactly the kind of bug that surfaces far from here and is never
+  // traced back. Configured order is also information the operator supplied
+  // deliberately; sorting alphabetically would discard it.
+  serverOrder = [];
+  // Tool lists seeded from the on-disk cache, with no socket ever opened.
+  // Deliberately a THIRD piece of state, not folded into `connected`: a
+  // primed server can answer `tools()` but must still go through
+  // `ensureConnected` before `call()` will dispatch to it. `connectAll`
+  // does not touch this map -- see the comment at its first line for why.
+  primed = /* @__PURE__ */ new Map();
+  // One in-flight ensureConnected() attempt per server, so three tool calls
+  // that land on the same cold server in the same turn share one connection
+  // instead of racing three.
+  connecting = /* @__PURE__ */ new Map();
+  /**
+   * Connect to every configured server and cache its tools. Never throws --
+   * a server that fails to initialize, or fails listing tools, is recorded
+   * in `status()` with zero tools and the daemon keeps starting.
+   */
+  async connectAll(opts = {}) {
+    this.connected.clear();
+    this.statuses.clear();
+    this.primed.clear();
+    const servers = await readMcpServers(this.stateDir);
+    this.serverOrder = servers.map((s2) => s2.name);
+    const timeoutMs = opts.timeoutMs ?? SERVER_CONNECT_TIMEOUT_MS;
+    await Promise.all(servers.map((server) => this.connectOne(server, timeoutMs, opts.onServer)));
+  }
+  /* BOUNDED, AND SETTLED EXACTLY ONCE.
+   *
+   * Every server connects under one Promise.all, and daemon startup awaits it.
+   * With no bound, one stalled server -- measured: an expired Microsoft 365
+   * token refreshing against a cold service, still waiting at 60 seconds --
+   * left the terminal silent after `mirrors sessions`, indistinguishable from a
+   * crash.
+   *
+   * The deadline covers the whole connect (any credential refresh, initialize,
+   * tools/list), not each request, because several individually bounded steps
+   * in a row can still add up to a hang. The attempt that loses the race keeps
+   * running; its late result is deliberately ignored, so a server reported as
+   * timed out cannot quietly become connected afterwards -- status would then
+   * tell doctor one thing and the registered tools another. */
+  async connectOne(server, timeoutMs, onServer) {
+    let timer;
+    const deadline = new Promise((resolve14) => {
+      timer = setTimeout(() => resolve14("timeout"), timeoutMs);
+    });
+    const attempt = (async () => {
+      const client = this.clientFactory(this.stateDir, server);
+      await client.initialize();
+      const tools = await client.listTools();
+      return { client, tools };
+    })();
+    attempt.catch(() => {
+    });
+    try {
+      const outcome = await Promise.race([attempt, deadline]);
+      if (outcome === "timeout") {
+        this.statuses.set(server.name, { connected: false, toolCount: 0, error: `timed out after ${timeoutMs / 1e3}s` });
+      } else {
+        this.connected.set(server.name, outcome);
+        this.statuses.set(server.name, { connected: true, toolCount: outcome.tools.length });
+      }
+    } catch (err) {
+      this.statuses.set(server.name, {
+        connected: false,
+        toolCount: 0,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    const settled = this.statuses.get(server.name);
+    if (settled) onServer?.({ server: server.name, ...settled });
+  }
+  /** Every tool from every connected OR primed server, paired with the server
+   *  it came from, in CONFIGURED order (`serverOrder`) -- not the order
+   *  servers happened to finish connecting in, and not insertion order into
+   *  `primed` either. Within a server, tools stay in the order that server
+   *  returned them. A live connection wins over a primed (cached) entry for
+   *  the same server, since it is the fresher truth. A server with neither
+   *  either failed to connect or reported zero tools -- `status()` tells the
+   *  two apart. */
+  tools() {
+    const out = [];
+    for (const server of this.serverOrder) {
+      const entry = this.connected.get(server);
+      const list = entry ? entry.tools : this.primed.get(server);
+      if (!list) continue;
+      for (const tool of list) out.push({ server, tool });
+    }
+    return out;
+  }
+  /** Seed tool lists from the on-disk cache. NO I/O, no sockets -- this is
+   *  what a terminal calls at startup so that `tools()` can answer
+   *  immediately, before any server has actually been reached. A primed
+   *  server is deliberately NOT `connected`: it can answer what tools exist,
+   *  and cannot call one until `ensureConnected()` has run. */
+  primeFromCache(cache) {
+    for (const [name, entry] of Object.entries(cache)) {
+      this.statuses.set(name, { connected: false, toolCount: entry.tools.length });
+      this.primed.set(name, entry.tools);
+      if (!this.serverOrder.includes(name)) this.serverOrder.push(name);
+    }
+  }
+  isConnected(server) {
+    return this.connected.has(server);
+  }
+  connectedServers() {
+    return this.serverOrder.filter((s2) => this.connected.has(s2));
+  }
+  /** Connect ONE server, on demand. Never throws, for the same reason
+   *  connectAll never throws: a server that is down must not take the
+   *  process with it. Concurrent callers for the same server share one
+   *  attempt rather than opening a second socket. */
+  async ensureConnected(server) {
+    if (this.connected.has(server)) return;
+    const inflight = this.connecting.get(server);
+    if (inflight) return inflight;
+    const attempt = (async () => {
+      const servers = await readMcpServers(this.stateDir);
+      const def = servers.find((s2) => s2.name === server);
+      if (!def) return;
+      if (!this.serverOrder.includes(server)) this.serverOrder.push(server);
+      await this.connectOne(def, SERVER_CONNECT_TIMEOUT_MS);
+    })().finally(() => this.connecting.delete(server));
+    this.connecting.set(server, attempt);
+    return attempt;
+  }
+  /**
+   * Call one tool on one server. Fails immediately, naming the server, when
+   * that server never connected -- there is nothing to route the call
+   * through, and pretending otherwise would either stall waiting on a
+   * connection that will never appear or return an empty result the caller
+   * could mistake for a genuine (if empty) tool response.
+   */
+  async call(server, tool, args) {
+    await this.ensureConnected(server);
+    const entry = this.connected.get(server);
+    if (!entry) {
+      throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
+    }
+    return entry.client.callTool(tool, args);
+  }
+  /** Per-server connection state, for `doctor` (Task 10) to print. A server
+   *  with `connected: false` always carries `error` -- there is no code path
+   *  that records a failure without a reason, because "no tools" alone tells
+   *  the reader nothing about what to fix. */
+  status() {
+    const out = [];
+    for (const server of this.serverOrder) {
+      const s2 = this.statuses.get(server);
+      if (s2) out.push({ server, ...s2 });
+    }
+    return out;
+  }
+};
+
+// ../mcp/src/policy.ts
+function mcpCallAllowed(address, policy) {
+  const allow = policy.tools?.allow ?? [];
+  if (!matchesAnyGlob(address, allow)) {
+    return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
+  }
+  const service = new PermissionService({
+    policy,
+    defaultForReadOnly: "allow",
+    defaultForMutating: "allow"
+  });
+  const level = service.resolveLevel({ name: address, address, mutates: true });
+  if (level !== "allow") {
+    return {
+      ok: false,
+      reason: `${address} resolves to permission "${level}" - MCP tools never prompt; set it to "allow" or remove the rule`
+    };
+  }
+  return { ok: true };
+}
+
+// ../mcp/src/toolNames.ts
+init_protocol();
+
+// ../mcp/src/asAgentTools.ts
+function isPlainObject3(v2) {
+  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+}
+function toParameters(inputSchema) {
+  if (isPlainObject3(inputSchema)) return inputSchema;
+  return { type: "object", properties: {} };
+}
+function formatContent(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    const parts = content.map((block) => {
+      if (isPlainObject3(block) && typeof block.text === "string") return block.text;
+      return JSON.stringify(block);
+    });
+    return parts.join("\n");
+  }
+  if (content == null) return "";
+  return JSON.stringify(content);
+}
+function asAgentTools(registry2) {
+  const out = [];
+  for (const { server, tool } of registry2.tools()) {
+    if (!canEncodeMcpWireName(server, tool.name)) {
+      console.error(
+        `MCP tool refused: server "${server}" tool "${tool.name}" cannot be encoded as a wire name (unsupported characters or too long) -- this tool is not available to the model`
+      );
+      continue;
+    }
+    out.push(toAgentTool(registry2, server, tool));
+  }
+  return out;
+}
+function toAgentTool(registry2, server, tool) {
+  const name = mcpWireName(server, tool.name);
+  const address = mcpToolAddress(server, tool.name);
+  return {
+    name,
+    namespace: "mcp",
+    description: tool.description?.trim() || `MCP tool "${tool.name}" on server "${server}" (${address}).`,
+    parameters: toParameters(tool.inputSchema),
+    mutates: true,
+    async run(args) {
+      const result = await registry2.call(server, tool.name, args);
+      const text = formatContent(result.content);
+      return result.isError ? `Error: ${text}` : text;
+    }
+  };
+}
+
+// ../mcp/src/gatedAgentTools.ts
+function gatedAgentTools(registry2, policy) {
+  const base = asAgentTools(registry2);
+  const byWireName = new Map(base.map((t2) => [t2.name, t2]));
+  const wrapped = [];
+  for (const { server, tool } of registry2.tools()) {
+    if (!canEncodeMcpWireName(server, tool.name)) continue;
+    const name = mcpWireName(server, tool.name);
+    const original = byWireName.get(name);
+    if (!original) continue;
+    const address = mcpToolAddress(server, tool.name);
+    wrapped.push({
+      ...original,
+      async run(args, ctx) {
+        const decision = mcpCallAllowed(address, policy);
+        if (!decision.ok) return `Error: ${decision.reason}`;
+        return original.run(args, ctx);
+      }
+    });
+  }
+  return wrapped;
+}
+
+// ../mcp/src/oauth/register.ts
 async function registerClient(meta, redirectUri, fetchImpl) {
   if (!meta.registrationEndpoint) return null;
   const res = await fetchImpl(meta.registrationEndpoint, {
@@ -47591,7 +48765,7 @@ async function registerClient(meta, redirectUri, fetchImpl) {
   return { clientId, clientSecret };
 }
 
-// src/mcp/oauth/pkce.ts
+// ../mcp/src/oauth/pkce.ts
 import { randomBytes as randomBytes5, createHash as createHash3 } from "node:crypto";
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -47619,7 +48793,7 @@ function authorizationUrl(meta, opts) {
   return url.toString();
 }
 
-// src/mcp/oauth/loopback.ts
+// ../mcp/src/oauth/loopback.ts
 import { createServer } from "node:http";
 var PAGE_OK = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
 <body style="font:16px system-ui;padding:3rem;text-align:center">
@@ -47672,6 +48846,17 @@ function awaitRedirect(port, expectedState, opts = {}) {
     server.once("error", (e2) => {
       finish(() => reject(e2 instanceof Error ? e2 : new Error(String(e2))));
     });
+    if (opts.signal) {
+      if (opts.signal.aborted) {
+        finish(() => reject(new Error("sign-in cancelled")));
+      } else {
+        opts.signal.addEventListener(
+          "abort",
+          () => finish(() => reject(new Error("sign-in cancelled"))),
+          { once: true }
+        );
+      }
+    }
     v6.on("error", () => {
     });
     try {
@@ -47684,6 +48869,15 @@ function awaitRedirect(port, expectedState, opts = {}) {
     });
   });
 }
+function portFree(port) {
+  return new Promise((resolve14) => {
+    const probe = createServer();
+    probe.once("error", () => resolve14(false));
+    probe.listen(port, "127.0.0.1", () => {
+      probe.close(() => resolve14(true));
+    });
+  });
+}
 function getFreePort() {
   return new Promise((resolve14, reject) => {
     const probe = createServer();
@@ -47695,93 +48889,16 @@ function getFreePort() {
   });
 }
 
-// src/mcp/oauth/tokens.ts
-function parseTokenResponse(body2) {
-  if (typeof body2 !== "object" || body2 === null || Array.isArray(body2)) {
-    throw new Error("token endpoint returned a malformed response");
-  }
-  const r2 = body2;
-  if (typeof r2.access_token !== "string" || r2.access_token.length === 0) {
-    throw new Error("token endpoint response did not include an access_token");
-  }
-  return {
-    access_token: r2.access_token,
-    ...typeof r2.refresh_token === "string" ? { refresh_token: r2.refresh_token } : {},
-    ...typeof r2.expires_in === "number" ? { expires_in: r2.expires_in } : {},
-    ...typeof r2.scope === "string" ? { scope: r2.scope } : {}
-  };
-}
-async function postToken(endpoint, body2, fetchImpl) {
-  const res = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: body2.toString()
-  });
-  if (!res.ok) {
-    throw new Error(`token request failed at ${endpoint} (HTTP ${res.status})`);
-  }
-  return parseTokenResponse(await res.json());
-}
-async function exchangeCode(meta, opts, fetchImpl = fetch, now2 = Date.now) {
-  const body2 = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: opts.clientId,
-    code: opts.code,
-    code_verifier: opts.verifier,
-    redirect_uri: opts.redirectUri,
-    resource: opts.resource
-  });
-  if (opts.clientSecret) body2.set("client_secret", opts.clientSecret);
-  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
-  return {
-    kind: "oauth",
-    accessToken: tokens.access_token,
-    ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
-    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-    clientId: opts.clientId,
-    ...opts.clientSecret ? { clientSecret: opts.clientSecret } : {},
-    authServer: opts.authServer,
-    ...tokens.scope ? { scope: tokens.scope } : {}
-  };
-}
-async function refresh(meta, cred, fetchImpl = fetch, now2 = Date.now) {
-  if (!cred.refreshToken) {
-    throw new Error("credential has no refresh token to refresh with -- sign in again");
-  }
-  const body2 = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: cred.refreshToken,
-    client_id: cred.clientId
-  });
-  if (cred.clientSecret) body2.set("client_secret", cred.clientSecret);
-  const tokens = await postToken(meta.tokenEndpoint, body2, fetchImpl);
-  return {
-    kind: "oauth",
-    accessToken: tokens.access_token,
-    // Keep the old refresh token when the server did not send a new one.
-    refreshToken: tokens.refresh_token ?? cred.refreshToken,
-    ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
-    clientId: cred.clientId,
-    ...cred.clientSecret ? { clientSecret: cred.clientSecret } : {},
-    authServer: cred.authServer,
-    scope: tokens.scope ?? cred.scope
-  };
-}
-var EXPIRY_SKEW_MS = 6e4;
-function isExpired(cred, nowMs) {
-  if (cred.expiresAt === void 0) return false;
-  return cred.expiresAt - nowMs <= EXPIRY_SKEW_MS;
-}
-
-// src/mcp/oauth/login.ts
+// ../mcp/src/oauth/login.ts
 var defaultOpenBrowser = async (url) => {
-  const { openBrowser: openBrowser3 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+  const { openBrowser: openBrowser3 } = await Promise.resolve().then(() => (init_tools_node(), tools_node_exports));
   await openBrowser3(url);
 };
 async function loginToMcpServer(stateDir, server, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const openBrowserFn = deps.openBrowser ?? defaultOpenBrowser;
   const now2 = deps.now ?? Date.now;
+  const redirectAbort = new AbortController();
   const signInUrl = server.authUrl ?? server.url;
   try {
     const discovered = await discoverAuthServer(
@@ -47802,6 +48919,13 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
     const meta = discovered.scopes ? { ...asMeta, scopesSupported: discovered.scopes } : asMeta;
     const cached = await readMcpClient(stateDir, server.name);
     const port = cached?.redirectPort ?? await getFreePort();
+    if (cached?.redirectPort !== void 0 && !await portFree(cached.redirectPort)) {
+      return {
+        ok: false,
+        reason: "failed",
+        message: `the redirect port ${cached.redirectPort} is in use, and "${server.name}" is registered against exactly that port -- free it and sign in again`
+      };
+    }
     const redirectUri = `http://localhost:${port}/callback`;
     const registered2 = cached && cached.authServer === discovered.authServer ? { clientId: cached.clientId, ...cached.clientSecret ? { clientSecret: cached.clientSecret } : {} } : await registerClient(
       meta,
@@ -47812,7 +48936,25 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
       await writeMcpClient(stateDir, server.name, {
         clientId: registered2.clientId,
         ...registered2.clientSecret ? { clientSecret: registered2.clientSecret } : {},
-        authServer: discovered.authServer
+        authServer: discovered.authServer,
+        /* PIN THE PORT WE JUST REGISTERED WITH.
+         *
+         * RFC 8252 s7.3 obliges an authorization server to accept any port on a
+         * loopback redirect, and most do -- but not all, and the ones that do
+         * not fail in the worst possible way. Atlassian's `auth.atlassian.com`
+         * (Trello's authorization server, distinct from `mcp.atlassian.com`)
+         * matches the redirect URI exactly. Registering with one ephemeral port
+         * and then authorizing with a fresh one on the next sign-in produced
+         * "The app's callback URL is invalid", from the vendor's own page,
+         * BEFORE any token exchange -- so nothing came back for the
+         * invalid_client recovery below to catch, and the flow simply timed out
+         * waiting for a redirect that was never going to arrive.
+         *
+         * Persisting it costs nothing where the port is ignored, and is the
+         * whole difference where it is not. The field already existed for
+         * operator-set ports (`corenel mcp set-client --redirect-port`); it was
+         * read here and never written by this path. */
+        redirectPort: port
       });
     }
     if (!registered2) {
@@ -47833,7 +48975,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
       resource: discovered.resource
     });
     deps.onAuthUrl?.(authUrl);
-    const redirectP = awaitRedirect(port, state);
+    const redirectP = awaitRedirect(port, state, { signal: redirectAbort.signal });
     redirectP.catch(() => {
     });
     await openBrowserFn(authUrl);
@@ -47855,6 +48997,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
     await writeMcpCredential(stateDir, server.name, cred);
     return { ok: true };
   } catch (e2) {
+    redirectAbort.abort();
     const message = e2 instanceof Error ? e2.message : String(e2);
     if (/invalid_client|unauthorized_client|client.{0,20}not.{0,10}found/i.test(message)) {
       await clearMcpClient(stateDir, server.name).catch(() => {
@@ -48351,7 +49494,7 @@ function persistAddedRoots(controller, stateDir, log) {
 import { spawn as spawn7 } from "node:child_process";
 import { promises as fs16 } from "node:fs";
 import { join as join20, resolve as resolve13 } from "node:path";
-var DEFAULT_TIMEOUT_MS5 = 10 * 6e4;
+var DEFAULT_TIMEOUT_MS4 = 10 * 6e4;
 var ALLOWED_SCHEMES = ["https://", "ssh://", "git+ssh://"];
 var SCP_LIKE = /^[A-Za-z0-9_.-]+@[A-Za-z0-9_.-]+:[A-Za-z0-9_./~-]+$/;
 function assertCloneUrl(url) {
@@ -48415,8 +49558,8 @@ function makeGitRunner(bin = "git") {
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
       settle({ code: -1, stdout, stderr: `${stderr}
-git timed out after ${opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS5}ms` });
-    }, opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS5);
+git timed out after ${opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS4}ms` });
+    }, opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS4);
     timer.unref?.();
     child.on("error", (e2) => {
       clearTimeout(timer);
@@ -48525,7 +49668,7 @@ var RpcError = class extends Error {
     if (shape.data !== void 0) this.data = shape.data;
   }
 };
-function isRecord2(v2) {
+function isRecord3(v2) {
   return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
 }
 var JsonRpcPeer = class {
@@ -48563,7 +49706,7 @@ var JsonRpcPeer = class {
       this.log(`acp: dropped unparseable frame (${line.length} bytes)`);
       return;
     }
-    if (!isRecord2(msg)) {
+    if (!isRecord3(msg)) {
       this.log("acp: dropped non-object frame");
       return;
     }
@@ -48585,7 +49728,7 @@ var JsonRpcPeer = class {
       return;
     }
     this.pending.delete(id);
-    if ("error" in msg && isRecord2(msg.error)) {
+    if ("error" in msg && isRecord3(msg.error)) {
       const e2 = msg.error;
       p2.reject(new RpcError({
         code: typeof e2.code === "number" ? e2.code : RPC_INTERNAL_ERROR,
@@ -49477,7 +50620,6 @@ function textOf(prompt) {
 }
 
 // src/acp/agentCli.ts
-init_store();
 function elog(line) {
   process.stderr.write(`${line}
 `);
@@ -49525,434 +50667,239 @@ async function runAcpAgent(argv) {
   });
 }
 
-// src/cli.ts
-init_cli();
-init_store();
-init_fileService();
-import { relative as relative7, resolve as resolvePath } from "node:path";
+// src/auth/login.ts
+import { createServer as createServer2 } from "node:http";
 
-// src/mcp/httpClient.ts
-var PROTOCOL_VERSION = "2025-06-18";
-var CLIENT_INFO = { name: "corenel", version: "0.2.0" };
-var SESSION_HEADER = "Mcp-Session-Id";
-var McpHttpClient = class {
-  constructor(server, auth, fetchImpl = fetch) {
-    this.server = server;
-    this.auth = auth;
-    this.fetchImpl = fetchImpl;
-  }
-  nextRequestId = 1;
-  sessionId;
-  async initialize() {
-    await this.send("initialize", {
-      protocolVersion: PROTOCOL_VERSION,
-      capabilities: {},
-      clientInfo: CLIENT_INFO
-    });
-  }
-  async listTools() {
-    const result = await this.send("tools/list", {});
-    const tools = isRecord3(result) ? result.tools : void 0;
-    if (!Array.isArray(tools)) return [];
-    return tools.filter(isMcpTool);
-  }
-  async callTool(name, args) {
-    const result = await this.send("tools/call", { name, arguments: args });
-    const record = isRecord3(result) ? result : {};
-    return { content: record.content, isError: record.isError === true };
-  }
-  /** Send one JSON-RPC request, retrying exactly once on a 401 that the
-   *  AuthProvider says it recovered from. `isRetry` prevents a second retry
-   *  loop -- a credential that fails twice is refused, not flaky. */
-  async send(method, params, isRetry = false) {
-    const headers = await this.buildHeaders();
-    const id = this.nextRequestId++;
-    const res = await this.request(headers, id, method, params);
-    if (res.status === 401) {
-      if (!isRetry && await this.auth.onUnauthorized()) {
-        return this.send(method, params, true);
-      }
-      throw new Error(
-        `MCP server "${this.server.name}" refused the credential (401) -- run: corenel mcp login ${this.server.name}`
-      );
-    }
-    const sessionId = res.headers.get(SESSION_HEADER);
-    if (sessionId) this.sessionId = sessionId;
-    if (!res.ok) {
-      throw new Error(`MCP server "${this.server.name}" returned HTTP ${res.status}`);
-    }
-    const contentType = res.headers.get("content-type") ?? "";
-    let body2;
-    if (contentType.includes("text/event-stream")) {
-      body2 = await this.readSseResponse(res, id);
-    } else if (contentType.includes("application/json")) {
-      body2 = await res.json();
-    } else {
-      throw new Error(
-        `MCP server "${this.server.name}" answered with an unexpected content-type: "${contentType || "(none)"}"`
-      );
-    }
-    if (body2.error) {
-      throw new Error(`MCP server "${this.server.name}" returned error ${body2.error.code}: ${body2.error.message}`);
-    }
-    return body2.result;
-  }
-  /** Read an SSE body until the JSON-RPC response for `id` arrives.
-   *
-   *  Events are separated by a blank line; an event's `data:` lines are joined
-   *  with newlines, per the SSE spec, and parsed as one JSON-RPC message.
-   *  Notifications (no `id`) and responses to other ids are skipped. The reader
-   *  is cancelled once the answer is in, so a server that keeps the stream open
-   *  after replying cannot hold this call open with it. */
-  async readSseResponse(res, id) {
-    if (!res.body) {
-      throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
-    }
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
-    try {
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (value) buffer += decoder.decode(value, { stream: true });
-        buffer = buffer.replace(/\r\n/g, "\n");
-        let boundary = buffer.indexOf("\n\n");
-        while (boundary !== -1) {
-          const event = buffer.slice(0, boundary);
-          buffer = buffer.slice(boundary + 2);
-          const match = this.matchSseEvent(event, id);
-          if (match) return match;
-          boundary = buffer.indexOf("\n\n");
-        }
-        if (done) {
-          const tail3 = buffer.trim() ? this.matchSseEvent(buffer, id) : null;
-          if (tail3) return tail3;
-          throw new Error(`MCP server "${this.server.name}" closed the stream without a response`);
-        }
-      }
-    } finally {
-      reader.cancel().catch(() => {
-      });
-    }
-  }
-  /** The JSON-RPC response in one SSE event, if it answers `id`; else null. */
-  matchSseEvent(event, id) {
-    const data = event.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n");
-    if (!data) return null;
-    let parsed;
-    try {
-      parsed = JSON.parse(data);
-    } catch {
-      return null;
-    }
-    if (!isRecord3(parsed) || parsed.id !== id) return null;
-    if (!("result" in parsed) && !("error" in parsed)) return null;
-    return parsed;
-  }
-  /** The bare `fetch()` call, wrapped -- every OTHER throw in `send` already
-   *  names the server; this is the one call whose own failures (DNS miss,
-   *  connection refused, TLS failure) never reach `send`'s response-handling
-   *  at all. Left unguarded, node's bare `fetch failed` -- naming neither the
-   *  URL nor the actual cause -- propagates straight out of `send`, into
-   *  `registry.ts`'s `status().error`, and out of `doctor`, the one command
-   *  whose entire job is diagnosis. `err.cause` carries the real reason
-   *  (ECONNREFUSED, ENOTFOUND, a TLS alert); undici puts it there rather than
-   *  in `err.message`. */
-  async request(headers, id, method, params) {
-    try {
-      return await this.fetchImpl(this.server.url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
-      });
-    } catch (err) {
-      const cause = err instanceof Error && err.cause instanceof Error ? err.cause.message : err instanceof Error ? err.message : String(err);
-      throw new Error(`MCP server "${this.server.name}" (${this.server.url}) is unreachable: ${cause}`);
-    }
-  }
-  async buildHeaders() {
-    const headers = new Headers();
-    headers.set("Content-Type", "application/json");
-    headers.set("Accept", "application/json, text/event-stream");
-    for (const h2 of await this.auth.headers()) headers.set(h2.name, h2.value);
-    if (this.sessionId) headers.set(SESSION_HEADER, this.sessionId);
-    return headers;
-  }
-};
-function isRecord3(value) {
-  return typeof value === "object" && value !== null;
+// src/auth/pkce.ts
+import { createHash as createHash4, randomBytes as randomBytes6 } from "node:crypto";
+function base64url2(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function isMcpTool(value) {
-  return isRecord3(value) && typeof value.name === "string" && "inputSchema" in value;
+function createVerifier(bytes = 32) {
+  return base64url2(randomBytes6(bytes));
+}
+function challengeFor(verifier) {
+  return base64url2(createHash4("sha256").update(verifier).digest());
+}
+function createState() {
+  return base64url2(randomBytes6(16));
+}
+function createPkce() {
+  const verifier = createVerifier();
+  return { verifier, challenge: challengeFor(verifier), method: "S256", state: createState() };
+}
+function authorizeUrl(p2) {
+  const u2 = new URL("/oauth/authorize", p2.issuer);
+  u2.searchParams.set("response_type", "code");
+  u2.searchParams.set("client_id", p2.clientId);
+  u2.searchParams.set("redirect_uri", p2.redirectUri);
+  u2.searchParams.set("code_challenge", p2.pkce.challenge);
+  u2.searchParams.set("code_challenge_method", p2.pkce.method);
+  u2.searchParams.set("state", p2.pkce.state);
+  u2.searchParams.set("scope", p2.scope ?? "profile email");
+  return u2.toString();
+}
+function stateMatches(expected, got) {
+  if (!got || got.length !== expected.length) return false;
+  let diff = 0;
+  for (let i2 = 0; i2 < expected.length; i2++) diff |= expected.charCodeAt(i2) ^ got.charCodeAt(i2);
+  return diff === 0;
 }
 
-// src/mcp/auth.ts
-function authProviderFor(stateDir, server, fetchImpl = fetch, accountToken = async () => null) {
-  async function doRefresh(cred) {
-    if (!cred.refreshToken) {
-      throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
+// src/auth/login.ts
+var DEFAULT_TIMEOUT_MS5 = 5 * 60 * 1e3;
+var PAGE_OK2 = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
+<body style="font:16px system-ui;padding:3rem;text-align:center">
+<h1>Signed in to Corenel</h1><p>You can close this tab and return to your terminal.</p></body>`;
+var PAGE_FAIL2 = `<!doctype html><meta charset="utf-8"><title>Sign-in failed</title>
+<body style="font:16px system-ui;padding:3rem;text-align:center">
+<h1>Sign-in failed</h1><p>Return to your terminal for details.</p></body>`;
+function awaitCallback(pkce, port, timeoutMs) {
+  let resolveUri;
+  let resolveResult;
+  let rejectResult;
+  const redirectUri = new Promise((res) => {
+    resolveUri = res;
+  });
+  const result = new Promise((res, rej) => {
+    resolveResult = res;
+    rejectResult = rej;
+  });
+  const server = createServer2((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
     }
-    const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
-    const refreshed = await refresh(meta, cred, fetchImpl);
-    await writeMcpCredential(stateDir, server.name, refreshed);
-    return refreshed;
-  }
-  return {
-    async headers() {
-      const cred = await readMcpCredential(stateDir, server.name);
-      if (!cred && !server.hosted) {
-        throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
-      }
-      const mcpHeaders = !cred ? [] : cred.kind === "headers" ? cred.headers : [{ name: "Authorization", value: `Bearer ${(isExpired(cred, Date.now()) ? await doRefresh(cred) : cred).accessToken}` }];
-      if (!server.hosted) return mcpHeaders;
-      const moved = mcpHeaders.map((h2) => h2.name.toLowerCase() === "authorization" ? { name: "X-MCP-Authorization", value: h2.value } : h2);
-      const account = await accountToken();
-      return account ? [...moved, { name: "Authorization", value: `Bearer ${account}` }] : moved;
-    },
-    async onUnauthorized() {
-      const cred = await readMcpCredential(stateDir, server.name);
-      if (!cred || cred.kind !== "oauth") return false;
-      try {
-        await doRefresh(cred);
-        return true;
-      } catch {
-        return false;
-      }
+    const err = url.searchParams.get("error");
+    const code2 = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (!stateMatches(pkce.state, state)) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error("state mismatch \u2014 the callback did not match this sign-in request"));
+      return;
     }
-  };
-}
-
-// src/mcp/registry.ts
-init_store();
-
-// src/mcp/timedFetch.ts
-var AUTH_REQUEST_TIMEOUT_MS = 15e3;
-function timedFetch(ms, inner = fetch) {
-  return async (input, init2 = {}) => {
-    const deadline = AbortSignal.timeout(ms);
-    const signal = init2.signal ? AbortSignal.any([init2.signal, deadline]) : deadline;
-    try {
-      return await inner(input, { ...init2, signal });
-    } catch (err) {
-      if (deadline.aborted && !init2.signal?.aborted) {
-        throw new Error(`no answer within ${ms / 1e3}s`, { cause: err });
-      }
-      throw err;
+    if (err) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error(`authorization failed: ${err}`));
+      return;
     }
+    if (!code2) {
+      res.writeHead(400, { "content-type": "text/html" }).end(PAGE_FAIL2);
+      rejectResult(new Error("callback carried no authorization code"));
+      return;
+    }
+    res.writeHead(200, { "content-type": "text/html" }).end(PAGE_OK2);
+    resolveResult({ code: code2 });
+  });
+  const timer = setTimeout(() => {
+    rejectResult(new Error("timed out waiting for the browser callback"));
+  }, timeoutMs);
+  timer.unref?.();
+  const close2 = () => {
+    clearTimeout(timer);
+    server.close();
   };
+  void result.finally(close2).catch(() => {
+  });
+  server.listen(port, "127.0.0.1", () => {
+    const addr = server.address();
+    const bound = typeof addr === "object" && addr ? addr.port : port;
+    resolveUri(`http://127.0.0.1:${bound}/callback`);
+  });
+  return { redirectUri, result, close: close2 };
 }
-
-// src/mcp/registry.ts
-async function accountTokenFor(stateDir) {
-  try {
-    const cred = await resolveCredential(process.env, stateDir);
-    return cred.token ?? null;
-  } catch {
-    return null;
-  }
-}
-function defaultClientFactory(stateDir, server) {
-  return new McpHttpClient(
-    server,
-    authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir))
+async function login(deps) {
+  const log = deps.log ?? (() => void 0);
+  const now2 = deps.now ?? Date.now;
+  const pkce = createPkce();
+  const { redirectUri: uriP, result, close: close2 } = awaitCallback(
+    pkce,
+    deps.config.port ?? 0,
+    deps.timeoutMs ?? DEFAULT_TIMEOUT_MS5
   );
-}
-var SERVER_CONNECT_TIMEOUT_MS = 3e4;
-var McpRegistry = class {
-  constructor(stateDir, clientFactory = defaultClientFactory) {
-    this.stateDir = stateDir;
-    this.clientFactory = clientFactory;
-  }
-  connected = /* @__PURE__ */ new Map();
-  statuses = /* @__PURE__ */ new Map();
-  // The order the operator wrote servers in daemon.json, captured once per
-  // connectAll() -- `tools()` walks THIS, never `connected`'s Map iteration
-  // order. `connectOne` runs concurrently for every server (Promise.all), so
-  // Map insertion order is race order: whichever server's initialize+list
-  // happened to resolve first. That is fine for `connected` (a lookup table,
-  // order never read) but `tools()` is a list a model/doctor/policy consumes
-  // in order, and race order means a different tool ordering on every daemon
-  // boot -- exactly the kind of bug that surfaces far from here and is never
-  // traced back. Configured order is also information the operator supplied
-  // deliberately; sorting alphabetically would discard it.
-  serverOrder = [];
-  /**
-   * Connect to every configured server and cache its tools. Never throws --
-   * a server that fails to initialize, or fails listing tools, is recorded
-   * in `status()` with zero tools and the daemon keeps starting.
-   */
-  async connectAll(opts = {}) {
-    this.connected.clear();
-    this.statuses.clear();
-    const servers = await readMcpServers(this.stateDir);
-    this.serverOrder = servers.map((s2) => s2.name);
-    const timeoutMs = opts.timeoutMs ?? SERVER_CONNECT_TIMEOUT_MS;
-    await Promise.all(servers.map((server) => this.connectOne(server, timeoutMs, opts.onServer)));
-  }
-  /* BOUNDED, AND SETTLED EXACTLY ONCE.
-   *
-   * Every server connects under one Promise.all, and daemon startup awaits it.
-   * With no bound, one stalled server -- measured: an expired Microsoft 365
-   * token refreshing against a cold service, still waiting at 60 seconds --
-   * left the terminal silent after `mirrors sessions`, indistinguishable from a
-   * crash.
-   *
-   * The deadline covers the whole connect (any credential refresh, initialize,
-   * tools/list), not each request, because several individually bounded steps
-   * in a row can still add up to a hang. The attempt that loses the race keeps
-   * running; its late result is deliberately ignored, so a server reported as
-   * timed out cannot quietly become connected afterwards -- status would then
-   * tell doctor one thing and the registered tools another. */
-  async connectOne(server, timeoutMs, onServer) {
-    let timer;
-    const deadline = new Promise((resolve14) => {
-      timer = setTimeout(() => resolve14("timeout"), timeoutMs);
+  try {
+    const redirectUri = await uriP;
+    const url = authorizeUrl({
+      issuer: deps.config.issuer,
+      clientId: deps.config.clientId,
+      redirectUri,
+      pkce,
+      ...deps.config.scope ? { scope: deps.config.scope } : {}
     });
-    const attempt = (async () => {
-      const client = this.clientFactory(this.stateDir, server);
-      await client.initialize();
-      const tools = await client.listTools();
-      return { client, tools };
-    })();
-    attempt.catch(() => {
+    log("Opening your browser to sign in...");
+    log(url);
+    await deps.openBrowser(url);
+    const { code: code2 } = await result;
+    const tokens = await deps.exchange({
+      issuer: deps.config.issuer,
+      clientId: deps.config.clientId,
+      code: code2,
+      verifier: pkce.verifier,
+      redirectUri
     });
-    try {
-      const outcome = await Promise.race([attempt, deadline]);
-      if (outcome === "timeout") {
-        this.statuses.set(server.name, { connected: false, toolCount: 0, error: `timed out after ${timeoutMs / 1e3}s` });
-      } else {
-        this.connected.set(server.name, outcome);
-        this.statuses.set(server.name, { connected: true, toolCount: outcome.tools.length });
-      }
-    } catch (err) {
-      this.statuses.set(server.name, {
-        connected: false,
-        toolCount: 0,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-    const settled = this.statuses.get(server.name);
-    if (settled) onServer?.({ server: server.name, ...settled });
-  }
-  /** Every tool from every connected server, paired with the server it came
-   *  from, in CONFIGURED order (`serverOrder`) -- not the order servers
-   *  happened to finish connecting in. Within a server, tools stay in the
-   *  order that server returned them. A server with no entry in `connected`
-   *  either failed to connect or reported zero tools -- `status()` tells the
-   *  two apart. */
-  tools() {
-    const out = [];
-    for (const server of this.serverOrder) {
-      const entry = this.connected.get(server);
-      if (!entry) continue;
-      for (const tool of entry.tools) out.push({ server, tool });
-    }
-    return out;
-  }
-  /**
-   * Call one tool on one server. Fails immediately, naming the server, when
-   * that server never connected -- there is nothing to route the call
-   * through, and pretending otherwise would either stall waiting on a
-   * connection that will never appear or return an empty result the caller
-   * could mistake for a genuine (if empty) tool response.
-   */
-  async call(server, tool, args) {
-    const entry = this.connected.get(server);
-    if (!entry) {
-      throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
-    }
-    return entry.client.callTool(tool, args);
-  }
-  /** Per-server connection state, for `doctor` (Task 10) to print. A server
-   *  with `connected: false` always carries `error` -- there is no code path
-   *  that records a failure without a reason, because "no tools" alone tells
-   *  the reader nothing about what to fix. */
-  status() {
-    const out = [];
-    for (const server of this.serverOrder) {
-      const s2 = this.statuses.get(server);
-      if (s2) out.push({ server, ...s2 });
-    }
-    return out;
+    if (!tokens.access_token) throw new Error("the token exchange returned no access token");
+    const cred = {
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+      ...typeof tokens.expires_in === "number" ? { expiresAt: now2() + tokens.expires_in * 1e3 } : {},
+      ...tokens.account ? { account: tokens.account } : {},
+      ...deps.apiBase ? { apiBase: deps.apiBase } : {}
+    };
+    await saveCredential(cred, deps.stateDir);
+    return {
+      ...cred.account ? { account: cred.account } : {},
+      ...cred.expiresAt ? { expiresAt: cred.expiresAt } : {}
+    };
+  } finally {
+    close2();
   }
-};
-
-// src/mcp/toolNames.ts
-init_protocol();
+}
 
-// src/mcp/asAgentTools.ts
-function isPlainObject3(v2) {
-  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+// src/auth/cli.ts
+init_tools_node();
+function oauthConfigFromEnv(env = process.env) {
+  const issuer = env.CORENEL_OAUTH_ISSUER?.trim();
+  const clientId = env.CORENEL_OAUTH_CLIENT_ID?.trim();
+  if (!issuer || !clientId) return null;
+  return { issuer, clientId };
 }
-function toParameters(inputSchema) {
-  if (isPlainObject3(inputSchema)) return inputSchema;
-  return { type: "object", properties: {} };
+async function exchangeCode2(p2) {
+  const res = await fetch(new URL("/oauth/token", p2.issuer), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: p2.clientId,
+      code: p2.code,
+      code_verifier: p2.verifier,
+      redirect_uri: p2.redirectUri
+    }).toString()
+  });
+  if (!res.ok) {
+    throw new Error(`token exchange failed (HTTP ${res.status})`);
+  }
+  return await res.json();
 }
-function formatContent(content) {
-  if (typeof content === "string") return content;
-  if (Array.isArray(content)) {
-    const parts = content.map((block) => {
-      if (isPlainObject3(block) && typeof block.text === "string") return block.text;
-      return JSON.stringify(block);
+async function runLogin(stateDir, apiBase2) {
+  const config = oauthConfigFromEnv();
+  if (!config) {
+    console.error("Sign-in is not configured on this build.");
+    console.error("Set CORENEL_OAUTH_ISSUER and CORENEL_OAUTH_CLIENT_ID, or use " + TOKEN_ENV2 + " for headless use.");
+    return 1;
+  }
+  try {
+    const res = await login({
+      config,
+      openBrowser,
+      exchange: exchangeCode2,
+      log: (l2) => console.error(l2),
+      ...stateDir ? { stateDir } : {},
+      // Recorded so the daemon does not have to guess later which API this
+      // credential belongs to -- see LoginDeps.apiBase.
+      ...apiBase2 ? { apiBase: apiBase2 } : {}
     });
-    return parts.join("\n");
+    console.error(`Signed in${res.account ? ` as ${res.account}` : ""}.`);
+    return 0;
+  } catch (err) {
+    console.error(`Sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
   }
-  if (content == null) return "";
-  return JSON.stringify(content);
 }
-function asAgentTools(registry2) {
-  const out = [];
-  for (const { server, tool } of registry2.tools()) {
-    if (!canEncodeMcpWireName(server, tool.name)) {
-      console.error(
-        `MCP tool refused: server "${server}" tool "${tool.name}" cannot be encoded as a wire name (unsupported characters or too long) -- this tool is not available to the model`
-      );
-      continue;
-    }
-    out.push(toAgentTool(registry2, server, tool));
+async function runLogout(stateDir, env = process.env) {
+  const before = await resolveCredential(env, stateDir);
+  await clearCredential(stateDir);
+  console.error("Signed out. (Paired devices are unaffected - run `hosts forget` to unpair.)");
+  console.error(`  Cleared ${tokenFilePath(stateDir)} and ${credentialFilePath(stateDir)}`);
+  if (before.source === "none") console.error("  Nothing was stored - this machine was already signed out.");
+  if (env[TOKEN_ENV2]?.trim()) {
+    console.error(`  NOTE: ${TOKEN_ENV2} is still set in this environment, so this machine is STILL signed in.`);
   }
-  return out;
+  return 0;
 }
-function toAgentTool(registry2, server, tool) {
-  const name = mcpWireName(server, tool.name);
-  const address = mcpToolAddress(server, tool.name);
-  return {
-    name,
-    namespace: "mcp",
-    description: tool.description?.trim() || `MCP tool "${tool.name}" on server "${server}" (${address}).`,
-    parameters: toParameters(tool.inputSchema),
-    mutates: true,
-    async run(args) {
-      const result = await registry2.call(server, tool.name, args);
-      const text = formatContent(result.content);
-      return result.isError ? `Error: ${text}` : text;
-    }
-  };
+function sourceLabel(source) {
+  return source === "env" ? `${TOKEN_ENV2} environment variable` : source === "token-file" ? "token file" : source === "credential-file" ? "credential file (auth.json)" : "none";
 }
-
-// src/mcp/policy.ts
-function mcpCallAllowed(address, policy) {
-  const allow = policy.tools?.allow ?? [];
-  if (!matchesAnyGlob(address, allow)) {
-    return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
-  }
-  const service = new PermissionService({
-    policy,
-    defaultForReadOnly: "allow",
-    defaultForMutating: "allow"
-  });
-  const level = service.resolveLevel({ name: address, address, mutates: true });
-  if (level !== "allow") {
-    return {
-      ok: false,
-      reason: `${address} resolves to permission "${level}" - MCP tools never prompt; set it to "allow" or remove the rule`
-    };
+async function runAuthStatus(stateDir, env = process.env) {
+  const r2 = await resolveCredential(env, stateDir);
+  if (!r2.token) {
+    console.error("Not signed in. Run `corenel login`, or set " + TOKEN_ENV2 + ".");
+    console.error(`  Looked in ${tokenFilePath(stateDir)}`);
+    console.error(`  Looked in ${credentialFilePath(stateDir)}`);
+    return 1;
   }
-  return { ok: true };
+  console.error(`Signed in (${r2.source === "env" ? sourceLabel(r2.source) : r2.path}).`);
+  console.error(`  account  ${r2.account ?? "not recorded in this store - run `corenel login` to record it"}`);
+  console.error(`  token    ${maskToken(r2.token)}`);
+  console.error(`  source   ${sourceLabel(r2.source)}`);
+  console.error(`  expiry   ${r2.expired ? `EXPIRED at ${new Date(r2.expiresAt ?? 0).toISOString()} - run login again` : r2.expiresAt ? new Date(r2.expiresAt).toISOString() : "not recorded in this store"}`);
+  return r2.expired ? 1 : 0;
 }
 
+// src/cli.ts
+init_fileService();
+import { relative as relative7, resolve as resolvePath } from "node:path";
+
 // src/mcp/daemonTools.ts
 function buildMcpPolicy(fileConfig) {
   return {
@@ -49964,24 +50911,7 @@ function buildMcpPolicy(fileConfig) {
   };
 }
 function registerMcpTools(registry2, policy) {
-  const base = asAgentTools(registry2);
-  const byWireName = new Map(base.map((t2) => [t2.name, t2]));
-  const wrapped = [];
-  for (const { server, tool } of registry2.tools()) {
-    if (!canEncodeMcpWireName(server, tool.name)) continue;
-    const name = mcpWireName(server, tool.name);
-    const original = byWireName.get(name);
-    if (!original) continue;
-    const address = mcpToolAddress(server, tool.name);
-    wrapped.push({
-      ...original,
-      async run(args, ctx) {
-        const decision = mcpCallAllowed(address, policy);
-        if (!decision.ok) return `Error: ${decision.reason}`;
-        return original.run(args, ctx);
-      }
-    });
-  }
+  const wrapped = gatedAgentTools(registry2, policy);
   for (const tool of wrapped) registerTool(tool);
   return () => {
     for (const tool of wrapped) unregisterTool(tool.name);