@coreplane/switchboard 1.213.0 → 1.214.0

package/dist/cli.js

@@ -1404,19 +1404,19 @@ function clampBashTimeout(requested) {
   return Math.min(Math.max(Math.trunc(requested), BASH_TIMEOUT_MIN_MS), BASH_TIMEOUT_MAX_MS);
 }
 function bashBudgetWithinRun(wantedMs, remainingMs) {
-  const secs = (ms) => Math.max(0, Math.round(ms / 1e3));
+  const secs2 = (ms) => Math.max(0, Math.round(ms / 1e3));
   const cap = Math.trunc(remainingMs - RUN_DEADLINE_RESERVE_MS);
   if (cap < BASH_TIMEOUT_MIN_MS) {
     return {
       kind: "exhausted",
-      note: `run budget exhausted \u2014 ${secs(remainingMs)}s of wall clock left, inside the ${secs(RUN_DEADLINE_RESERVE_MS)}s write-up reserve, so the command was not run; write up what you have now`
+      note: `run budget exhausted \u2014 ${secs2(remainingMs)}s of wall clock left, inside the ${secs2(RUN_DEADLINE_RESERVE_MS)}s write-up reserve, so the command was not run; write up what you have now`
     };
   }
   if (cap >= wantedMs) return { kind: "unchanged" };
   return {
     kind: "clipped",
     timeoutMs: cap,
-    note: `[timeout clipped to ${secs(cap)}s \u2014 the run's wall clock ends in ${secs(remainingMs)}s]`
+    note: `[timeout clipped to ${secs2(cap)}s \u2014 the run's wall clock ends in ${secs2(remainingMs)}s]`
   };
 }
 function bashTimeoutNote(timeoutMs) {
@@ -1758,6 +1758,31 @@ function runawayTurnCap(maxMinutes) {
 function loopBudget(maxMinutes) {
   return { maxMinutes, maxTurns: runawayTurnCap(maxMinutes) };
 }
+function conductorSystem(siblings) {
+  const readers = siblings.filter((a) => a.identity !== "write");
+  const writers = siblings.filter((a) => a.identity === "write");
+  const rows = readers.map(
+    (a) => `- \`${a.name}\`${machineNeedsRepo(a.machine) ? " (needs the repository)" : ""}: ${a.description}`
+  );
+  return `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
+
+You have no workspace and no shell. Your tools: \`spawn_run\` (start a child run), \`send_to_run\` (steer a live child: your text reaches it as a follow-up at its next step), \`await_runs\` (wait for your children to end and get each end \u2014 its status and final reply \u2014 back as data), \`list_runs\` (the runs you may see \u2014 your own children by default), \`get_run_status\` (one run: whether it is running, what it is doing, and its final reply once it finished), the GitHub reads \u2014 \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repositories), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` \u2014 \`web_fetch\` (read a public URL), and \`update_status\`.
+
+WHAT A CHILD IS. A child is an ordinary Switchboard run started as the person who asked you \u2014 exactly the run they could start by hand with \`agent:<preset>\` \u2014 in a thread of its own in this channel, visible to everyone there, with its own status card and run page, and under their permissions: a preset they may not run, a repository they may not use, or a profile a boundary caps is refused in the child's thread, and the refusal comes back to you as the tool result naming the gate. Children cannot spawn children. You may have a few live at once (the deployment's \`spawn.maxChildren\`, three by default); a spawn past the cap is refused until one finishes. A child's wall clock is capped by what is left of yours.
+
+THE PRESETS a child can run \u2014 a child reads, so only a preset whose identity is \`none\` or \`read\`:
+${rows.join("\n")}
+
+A preset that writes \u2014 ${writers.map((a) => `\`${a.name}\``).join(", ")} \u2014 is refused by name (\`spawn_identity\`): a spawned child never holds a write credential, so pushing a branch or opening a pull request is the requester's to start by hand with \`agent:<preset>\`; say so in your answer instead of spawning it.
+
+ROUTED COMPOUNDS. A request may arrive already split: the router found independent parts, and the message ends with the line "Routed as a compound request: N independent parts" followed by a numbered list, one part per line as \`<preset>\`: <text>. Spawn exactly those children \u2014 one \`spawn_run\` per line, the preset as listed, the line's text as the child's prompt (it already stands alone; add the repository where the preset needs one) \u2014 then \`await_runs\` them all and compile. Never merge, drop or add a part; a part whose spawn is refused is reported as refused, by the gate's name.
+
+HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a prompt that says what it should do, and the repository where the preset needs one: a child starts from this conversation's text so far \u2014 every user and assistant turn before your call, never your tool calls, their results or your thinking \u2014 and your prompt is its one new turn, so tell it what to do rather than repeat what was said. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier \u2014 at the edge of your own budget, at a stop, or when a follow-up lands in this thread \u2014 and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended \u2014 finished, failed, interrupted by a restart \u2014 is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
+
+Maintain the user-facing status card with the update_status tool: one item per child (\u25CB pending, \u2731 running, \u2713 finished \u2014 only once await_runs or get_run_status said so).
+
+Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack: lead with the outcome, then one line per child \u2014 its preset, its thread, its status and its result in a sentence \u2014 and what is still running, if anything.`;
+}
 function presetDoor(def) {
   if (def.routable !== false) return "routed";
   return def.name === COMPOUND_PRESET ? "compound" : "directive";
@@ -1769,7 +1794,7 @@ function getAgent(name) {
   }
   return a;
 }
-var MACHINE_CLASSES, IDENTITIES, HARNESSES, RUNAWAY_TURNS_PER_MINUTE, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, SHOW_FILES, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, CONDUCTOR_SYSTEM, COMPOUND_PRESET, AGENTS;
+var MACHINE_CLASSES, IDENTITIES, HARNESSES, RUNAWAY_TURNS_PER_MINUTE, PR_DESCRIPTION_TEMPLATE, NEVER_MERGE, CONTRACT_HEADINGS_LIST, UNIT_CONTRACT, UNIT_HANDOFF, IMAGE_TOOLCHAIN, SANDBOX_TOOLCHAIN, RESIDENT_TOOLCHAIN, SHOW_FILES, CODING_SYSTEM, CODING_SYSTEM_RESIDENT, REVIEW_VERDICT_INSTRUCTION, REVIEW_SPEC_CHECK, REVIEW_UNIT_CONTRACT, REVIEW_WHOLE_CHANGE, REVIEW_SYSTEM, REVIEW_SYSTEM_RESIDENT, RESEARCH_SYSTEM, GENERAL_SYSTEM, EXPLORE_SYSTEM, COMPOUND_PRESET, WORK_PRESETS, AGENTS;
 var init_registry = __esm({
   "../../src/agents/registry.ts"() {
     "use strict";
@@ -1797,6 +1822,8 @@ EVERY PR includes one that already exists when you push \u2014 opened by a perso
     RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun \u2014 and no Docker.`;
     SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording \u2014 it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
 SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request \u2014 commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too \u2014 unless the request names one destination. Never attach a subset and link the rest.
+Whole files: up to 1 GiB where the artifact store is configured (a recording, a large PDF), 10 MiB otherwise \u2014 the tool's result says which applies; over the limit, link to the file.
+Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there \u2014 never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;
     CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
@@ -1953,26 +1980,11 @@ READ-ONLY: NEVER open a pull request, and never commit or push \u2014 no branch,
 Maintain the user-facing status card with the update_status tool: post your plan as a checklist (\u25CB pending) once you have it, and update items as they start (\u2731) and finish (\u2713 \u2014 only after they actually happened). Items are short outcomes ("Clone and install", "Time the full suite"), never commands.
 
 Report outcomes faithfully: a check you could not run is "could not check", never a guess. Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks \u2014 render the claim table as aligned rows inside a code block). Your final message is posted to Slack: lead with the overall verdict in one line, then the claim table, then what a follow-up should do.`;
-    CONDUCTOR_SYSTEM = `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
-
-You have no workspace and no shell. Your tools: \`spawn_run\` (start a child run), \`send_to_run\` (steer a live child: your text reaches it as a follow-up at its next step), \`await_runs\` (wait for your children to end and get each end \u2014 its status and final reply \u2014 back as data), \`list_runs\` (the runs you may see \u2014 your own children by default), \`get_run_status\` (one run: whether it is running, what it is doing, and its final reply once it finished), the GitHub reads \u2014 \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repositories), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` \u2014 \`web_fetch\` (read a public URL), and \`update_status\`.
-
-WHAT A CHILD IS. A child is an ordinary Switchboard run started as the person who asked you \u2014 exactly the run they could start by hand with \`agent:<preset>\` \u2014 in a thread of its own in this channel, visible to everyone there, with its own status card and run page, and under their permissions: a preset they may not run, a repository they may not use, or a profile a boundary caps is refused in the child's thread, and the refusal comes back to you as the tool result naming the gate. Children cannot spawn children. You may have a few live at once (the deployment's \`spawn.maxChildren\`, three by default); a spawn past the cap is refused until one finishes. A child's wall clock is capped by what is left of yours.
-
-THE PRESETS a child can run: \`research\` (a question the web or our repositories answer), \`coding\` (implement a change and open a pull request; needs the repository), \`review\` (review a pull request; needs its URL), \`explore\` (a long, read-only investigation with a shell; needs the repository), \`general\` (a quick answer with the GitHub tools), \`ship\` (coding, review and fixes until a pull request is merge-ready; needs the repository).
-
-ROUTED COMPOUNDS. A request may arrive already split: the router found independent parts, and the message ends with the line "Routed as a compound request: N independent parts" followed by a numbered list, one part per line as \`<preset>\`: <text>. Spawn exactly those children \u2014 one \`spawn_run\` per line, the preset as listed, the line's text as the child's prompt (it already stands alone; add the repository where the preset needs one) \u2014 then \`await_runs\` them all and compile. Never merge, drop or add a part; a part whose spawn is refused is reported as refused, by the gate's name.
-
-HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a self-contained prompt \u2014 everything it needs, since it sees none of this thread \u2014 and the repository where the preset needs one. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier \u2014 at the edge of your own budget, at a stop, or when a follow-up lands in this thread \u2014 and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended \u2014 finished, failed, interrupted by a restart \u2014 is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
-
-Maintain the user-facing status card with the update_status tool: one item per child (\u25CB pending, \u2731 running, \u2713 finished \u2014 only once await_runs or get_run_status said so).
-
-Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack: lead with the outcome, then one line per child \u2014 its preset, its thread, its status and its result in a sentence \u2014 and what is still running, if anything.`;
     COMPOUND_PRESET = "conductor";
-    AGENTS = {
+    WORK_PRESETS = {
       general: {
         name: "general",
-        description: "Default assistant on the configured model: answers directly, reads the org's repos and manages their issues over GitHub, reads URLs. No workspace or shell.",
+        description: "Default assistant: answers directly, reads URLs, manages issues; the preset for any question the org's GitHub answers. No workspace or shell.",
         system: GENERAL_SYSTEM,
         toolset: "assistant",
         // The GitHub tools are REST in the bot process, so a general ask never
@@ -2047,7 +2059,7 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
       },
       research: {
         name: "research",
-        description: "Answers questions with web search, URL reading, and read access to the org's repos and issues over GitHub. No workspace.",
+        description: "Answers questions that need the web (search, URL reading); GitHub for context, not for a question GitHub alone answers. No workspace.",
         system: RESEARCH_SYSTEM,
         toolset: "web",
         machine: "none",
@@ -2073,11 +2085,14 @@ Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks
         // would expire between them, so the 2× write buys reads for the whole run.
         cacheTtl: "1h"
         // No built-in effort: the deployment decides, as for coding.
-      },
+      }
+    };
+    AGENTS = {
+      ...WORK_PRESETS,
       conductor: {
         name: "conductor",
         description: "Coordinates other runs: spawns child runs as the requester \u2014 each in a thread of its own, under their permissions \u2014 follows them, and reports. No workspace or shell.",
-        system: CONDUCTOR_SYSTEM,
+        system: conductorSystem(Object.values(WORK_PRESETS)),
         toolset: "conductor",
         // Nothing is provisioned and no credential minted: the run tools call the
         // dispatcher, the GitHub reads are REST in the bot process.
@@ -2821,6 +2836,8 @@ function validateRouting(routing, providers) {
     throw new Error(`config.yaml: routing.${key} is not a known key`);
   if (routing.auto !== void 0 && typeof routing.auto !== "boolean")
     throw new Error("config.yaml: routing.auto must be true or false");
+  if (routing.answer !== void 0 && !ROUTE_ANSWER_MODES.includes(routing.answer))
+    throw new Error(`config.yaml: routing.answer must be ${ROUTE_ANSWER_MODES.join(" or ")}`);
   if (routing.model !== void 0) {
     if (typeof routing.model !== "string" || !routing.model.includes("/"))
       throw new Error("config.yaml: routing.model must be a <provider>/<model> ref");
@@ -2917,7 +2934,7 @@ function validateRuntimeOverrides(ro) {
     }
   }
 }
-var MAX_INSTRUCTIONS_LENGTH, CONFIG_KEYS, SELF_IMPROVEMENT_KEYS, BOUNDARY_KEYS, MIN_BOUNDARY_MINUTES, ROUTING_KEYS, SHIP_KEYS, SPAWN_KEYS;
+var MAX_INSTRUCTIONS_LENGTH, CONFIG_KEYS, SELF_IMPROVEMENT_KEYS, BOUNDARY_KEYS, MIN_BOUNDARY_MINUTES, ROUTE_ANSWER_MODES, ROUTING_KEYS, SHIP_KEYS, SPAWN_KEYS;
 var init_validate = __esm({
   "../../src/config/validate.ts"() {
     "use strict";
@@ -2966,7 +2983,8 @@ var init_validate = __esm({
     };
     BOUNDARY_KEYS = { maxMinutes: true, maxIdentity: true, machines: true };
     MIN_BOUNDARY_MINUTES = 2;
-    ROUTING_KEYS = { auto: true, model: true };
+    ROUTE_ANSWER_MODES = ["tool", "text"];
+    ROUTING_KEYS = { auto: true, model: true, answer: true };
     SHIP_KEYS = { maxRounds: true, maxMinutes: true };
     SPAWN_KEYS = { maxChildren: true };
   }
@@ -2987,7 +3005,7 @@ function identityWithin(identity2, cap) {
   return IDENTITY_ORDER[identity2] <= IDENTITY_ORDER[cap];
 }
 function budgetedAgent(agent, profile) {
-  return { ...agent, maxMinutes: profile.minutes };
+  return { ...agent, maxMinutes: profile.minutes, maxTurns: runawayTurnCap(profile.minutes) };
 }
 function intersectBoundaries(layers) {
   const out = {};
@@ -3058,6 +3076,7 @@ var IDENTITY_ORDER, MACHINE_ORDER;
 var init_profile = __esm({
   "../../src/config/profile.ts"() {
     "use strict";
+    init_registry();
     IDENTITY_ORDER = { none: 0, read: 1, write: 2 };
     MACHINE_ORDER = { none: 0, blank: 1, "repo-cold": 2, "repo-resident": 3 };
   }
@@ -4833,7 +4852,14 @@ var init_profile2 = __esm({
       images: z2.enum(IMAGE_MODES).default("build"),
       /** The Cloudflare Access application in front of the bot's dashboards, when
        *  there is one: the team domain the JWT is issued by and the app's AUD. */
-      access: z2.object({ teamDomain: hostname, aud: z2.string().regex(/^[0-9a-f]{64}$/) }).optional()
+      access: z2.object({ teamDomain: hostname, aud: z2.string().regex(/^[0-9a-f]{64}$/) }).optional(),
+      /** The artifact store's bucket (docs/reference/specs/execution.md item 20), when the installation
+       *  has one: the bot Worker's template binds it as `ARTIFACTS` and `deploy` creates it before the
+       *  upload. The bot's runtime config (`artifacts.r2.bucket`) must name the same bucket — the two
+       *  are held equal by `artifacts check`, not by the profile. R2's own bucket-name rules. */
+      artifacts: z2.object({
+        bucket: z2.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "an R2 bucket name: 3\u201363 lowercase letters, digits and hyphens")
+      }).optional()
     });
     EXAMPLE_ACCOUNT = "00000000000000000000000000000000";
   }
@@ -4906,7 +4932,11 @@ function planDeploy(opts, host, loaded, images) {
     setEnv: w.preflight ? { [w.preflight.baseUrlEnv]: w.baseUrl, ...opts.force ? { [w.preflight.forceEnv]: "1" } : {} } : {},
     ...opts.force && w.preflight ? { forcedBy: w.preflight.forceEnv } : {},
     requiredEnv: w.requiredEnv ?? [],
-    capabilities: w.capabilities ?? [],
+    // The bot's `npm run deploy` creates the artifacts bucket before the upload
+    // (deploy/cloudflare/ensure-bucket.mjs) when the profile names one — that
+    // needs R2 on the credential, checked up front like every capability; an
+    // installation without artifacts asks nothing extra of its token.
+    capabilities: [...w.capabilities ?? [], ...w.name === "bot" && profile.artifacts ? [R2_CAPABILITY] : []],
     retryOnPreflightRefusal: !!w.preflight && !opts.force,
     ...w.waitMaxMs !== void 0 ? { waitMaxMs: w.waitMaxMs } : {},
     ...w.preflight?.healthUrl ? { healthUrl: w.preflight.healthUrl } : {},
@@ -5039,7 +5069,7 @@ function classifyDeployOutput(exitCode, output) {
   const firstError = lines.find((l) => isErrorish(l) && !/^npm ERR!/i.test(l)) ?? lines.find(isErrorish);
   return { kind: "failed", reason: firstError ?? `exit ${exitCode}` };
 }
-var UNSET_ENV, SANDBOX_CONTAINER_CLASS, SANDBOX_BEARER_ENV, RESIDENT_BEARER_ENVS, RESIDENT_WAIT_MAX_MS, CONTAINERS_CAPABILITY, WORKER_DIRS, WORKER_SPECS, DEPLOY_ORDER, CONFIG_DOCUMENT_KEY, hasImage, ANSI_SEQUENCE;
+var UNSET_ENV, SANDBOX_CONTAINER_CLASS, SANDBOX_BEARER_ENV, R2_CAPABILITY, RESIDENT_BEARER_ENVS, RESIDENT_WAIT_MAX_MS, CONTAINERS_CAPABILITY, WORKER_DIRS, WORKER_SPECS, DEPLOY_ORDER, CONFIG_DOCUMENT_KEY, hasImage, ANSI_SEQUENCE;
 var init_plan = __esm({
   "../../src/deploy/plan.ts"() {
     "use strict";
@@ -5051,6 +5081,10 @@ var init_plan = __esm({
     UNSET_ENV = ["CLOUDFLARE_ACCOUNT_ID"];
     SANDBOX_CONTAINER_CLASS = "SwitchboardSandbox";
     SANDBOX_BEARER_ENV = "SANDBOX_TOKEN";
+    R2_CAPABILITY = {
+      command: ["wrangler", "r2", "bucket", "list"],
+      needs: "Workers R2 Storage: Edit"
+    };
     RESIDENT_BEARER_ENVS = ["RESIDENT_ADMIN_TOKEN", "RESIDENT_OPERATOR_TOKEN", "RESIDENT_READ_TOKEN"];
     RESIDENT_WAIT_MAX_MS = 30 * 6e4;
     CONTAINERS_CAPABILITY = {
@@ -5123,10 +5157,7 @@ var init_plan = __esm({
         // A container image like the bot's — checked here too, since an --affected
         // release can select the resident without the bot — plus the BACKUP_BUCKET
         // R2 binding wrangler validates on deploy.
-        capabilities: [
-          CONTAINERS_CAPABILITY,
-          { command: ["wrangler", "r2", "bucket", "list"], needs: "Workers R2 Storage: Edit" }
-        ],
+        capabilities: [CONTAINERS_CAPABILITY, R2_CAPABILITY],
         waitMaxMs: RESIDENT_WAIT_MAX_MS,
         why: "per-repo DOs \u2014 preflight refuses while a resident has a run in flight or is provisioning (a refresh or restore mid-cycle only warns: it resumes after the swap)"
       },
@@ -5680,6 +5711,7 @@ function templateView(profile, kind, published) {
     ...hasImage2(kind) ? { image: containerImage(kind, profile, published) } : {},
     urls: { publicBaseUrl: urls.publicBaseUrl, stateWorkerUrl: urls.stateWorkerUrl },
     access: profile.access,
+    artifacts: profile.artifacts,
     bot: { script: profile.workers.bot.script }
   };
 }
@@ -7811,7 +7843,8 @@ var init_runEvents = __esm({
       "review_not_posted",
       "compacted",
       "harness_error",
-      "tool_refused"
+      "tool_refused",
+      "stuck_loop"
     ];
     ACTOR_ID_CHARS = "A-Za-z0-9:@._-";
     ACTOR_ID_MAX = 128;
@@ -8108,6 +8141,13 @@ var init_host3 = __esm({
 });
 
 // ../../src/execution/binaryRead.ts
+function statCommandFor(resolvedPath) {
+  return `stat -c %s -- ${resolvedPath}`;
+}
+function parseByteSize(stdout) {
+  const m = /^\s*(\d{1,15})\s*$/.exec(stdout);
+  return m ? Number(m[1]) : null;
+}
 function tooLargeMessage(path, bytes) {
   const size = bytes === void 0 ? "" : ` (${bytes} bytes)`;
   return `${path}${size} is over the ${MAX_READ_BYTES}-byte cap of a binary read`;
@@ -8731,9 +8771,9 @@ function sendDeadlineMs(budgetMs) {
   return budgetMs + EXEC_CALL_MARGIN_MS;
 }
 function noAnswerMessage(route3, budgetMs) {
-  const secs = (ms) => Math.round(ms / 1e3);
+  const secs2 = (ms) => Math.round(ms / 1e3);
   const exec = route3 === "/exec";
-  return `sandbox worker ${route3} gave no answer within ${secs(sendDeadlineMs(budgetMs))}s (${exec ? "command budget" : "budget"} ${secs(budgetMs)}s + ${secs(EXEC_CALL_MARGIN_MS)}s margin) \u2014 the sandbox may be gone; ${exec ? "the command may still be running in it" : "the operation may still have run in it"}`;
+  return `sandbox worker ${route3} gave no answer within ${secs2(sendDeadlineMs(budgetMs))}s (${exec ? "command budget" : "budget"} ${secs2(budgetMs)}s + ${secs2(EXEC_CALL_MARGIN_MS)}s margin) \u2014 the sandbox may be gone; ${exec ? "the command may still be running in it" : "the operation may still have run in it"}`;
 }
 function waitForSlot(ms, waitedMs, signal) {
   return new Promise((resolve12, reject) => {
@@ -8896,6 +8936,9 @@ ${parts}`);
 function residentText(text) {
   return redactAndCap(stripAnsi(text), RESIDENT_TEXT_CAP);
 }
+function residentErrorText(text) {
+  return redactAndCap(stripAnsi(text), RESIDENT_ERROR_CAP);
+}
 function sanitizeResidentBody(data) {
   return walk(data, SANITIZE_DEPTH);
 }
@@ -8905,7 +8948,7 @@ function walk(value, depth) {
   const src = value;
   const out = {};
   for (const [key, v] of Object.entries(src)) {
-    out[key] = SANITIZED_FIELDS.includes(key) && typeof v === "string" ? residentText(v) : walk(v, depth - 1);
+    out[key] = SANITIZED_FIELDS.includes(key) && typeof v === "string" ? key === "error" ? residentErrorText(v) : residentText(v) : walk(v, depth - 1);
   }
   if (typeof src.stderr === "string" && src.stderr === src.error && typeof out.error === "string") {
     out.stderr = out.error;
@@ -8915,12 +8958,13 @@ function walk(value, depth) {
 function residentState(value) {
   return typeof value === "string" && PROBE_STATES.has(value) ? value : "unknown";
 }
-var RESIDENT_TEXT_CAP, SANITIZED_FIELDS, SANITIZE_DEPTH, PROBE_STATES;
+var RESIDENT_TEXT_CAP, RESIDENT_ERROR_CAP, SANITIZED_FIELDS, SANITIZE_DEPTH, PROBE_STATES;
 var init_residentText = __esm({
   "../../src/execution/residentText.ts"() {
     "use strict";
     init_redact();
     RESIDENT_TEXT_CAP = 300;
+    RESIDENT_ERROR_CAP = 1e3;
     SANITIZED_FIELDS = ["error", "reason", "summary"];
     SANITIZE_DEPTH = 4;
     PROBE_STATES = /* @__PURE__ */ new Set([
@@ -10928,7 +10972,8 @@ function buildAnthropicParams(req) {
     ...req.system ? { system: [{ type: "text", text: req.system, cache_control: cache2 }] } : {},
     messages,
     ...effort2 ? { output_config: { effort: effort2 } } : {},
-    ...tools.length > 0 ? { tools } : {}
+    ...tools.length > 0 ? { tools } : {},
+    ...req.toolChoice ? { tool_choice: { type: "tool", name: req.toolChoice.name } } : {}
   };
 }
 function effortFor(model, effort2) {
@@ -13288,7 +13333,7 @@ function analyzeRunFriction(events, opts = {}) {
     }
     if (ev.type === "tool_call") {
       toolCalls++;
-      if (failedCalls.has(`${ev.tool} ${ev.summary}`)) {
+      if (failedCalls.has(callSignature(ev.tool, ev.summary))) {
         findings.push({
           category: "retry",
           severity: "low",
@@ -13310,7 +13355,7 @@ function analyzeRunFriction(events, opts = {}) {
       const durationMs = span ? durationOfSpan(span) : void 0;
       const timed = (f) => durationMs !== void 0 ? { ...f, durationMs } : f;
       const interval = span && durationMs !== void 0 ? { interval: { start: span.startedAt, end: span.startedAt + durationMs } } : {};
-      if (!ev.ok) failedCalls.add(`${ev.tool} ${callSummary}`);
+      if (!ev.ok) failedCalls.add(callSignature(ev.tool, callSummary));
       if (ev.infra) {
         findings.push(
           timed({
@@ -13503,7 +13548,7 @@ function formatFrictionReport(d) {
   }
   return lines.join("\n");
 }
-var FRICTION_CATEGORIES, CATEGORY_LABEL, DENOMINATOR_OF, DEFAULT_SLOW_TOOL_MS, DEFAULT_SLOW_MODEL_TURN_MS, INSTALL_SEGMENT, QUOTED;
+var FRICTION_CATEGORIES, CATEGORY_LABEL, DENOMINATOR_OF, DEFAULT_SLOW_TOOL_MS, DEFAULT_SLOW_MODEL_TURN_MS, INSTALL_SEGMENT, QUOTED, callSignature;
 var init_runFriction = __esm({
   "../../src/core/runFriction.ts"() {
     "use strict";
@@ -13546,6 +13591,7 @@ var init_runFriction = __esm({
     DEFAULT_SLOW_MODEL_TURN_MS = 6e4;
     INSTALL_SEGMENT = /(?:^|&&|;|\|\|?)\s*(?:sudo\s+)?(?:corepack\s+)?(?:(?:npm|pnpm|bun)\s+(?:install|i|ci|add)(?=\s|$)|yarn(?:\s+(?:install|add)(?=\s|$)|\s*$)|npx\s+playwright\s+install(?=\s|$)|(?:python3?\s+-m\s+)?pip3?\s+install(?=\s|$)|poetry\s+install(?=\s|$)|uv\s+(?:sync|pip\s+install)(?=\s|$)|apt(?:-get)?\s+install(?=\s|$)|apk\s+add(?=\s|$)|brew\s+install(?=\s|$)|bundle\s+install(?=\s|$)|gem\s+install(?=\s|$)|cargo\s+(?:fetch|build)(?=\s|$)|go\s+mod\s+download(?=\s|$)|git\s+clone(?=\s|$)|make\s+(?:deps|install|setup)(?=\s|$))/;
     QUOTED = /"(?:[^"\\]|\\.)*"|'[^']*'/g;
+    callSignature = (tool, summary) => `${tool} ${summary}`;
   }
 });
 
@@ -13694,6 +13740,7 @@ function isRunRecord(v) {
   if (r.profile !== void 0 && !isRunProfileRecord(r.profile)) return false;
   if (r.parentRunId !== void 0 && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;
+  if (r.seed !== void 0 && !RUN_SEEDS.includes(r.seed)) return false;
   if (r.parentInstanceId === void 0 !== (r.idempotencyKey === void 0)) return false;
   if (r.parentInstanceId !== void 0 && (typeof r.parentInstanceId !== "string" || !INSTANCE_ID_PATTERN.test(r.parentInstanceId)))
     return false;
@@ -13825,7 +13872,7 @@ function dropSpanPairsFromTheMiddle(events, eventBudget) {
   }
   return events.filter((_, k) => !dropped.has(k));
 }
-var RUN_STATUSES, RUN_ID_PATTERN, REVIEW_HEAD_PATTERN, MACHINE_CLASSES_IN_RECORD, IDENTITIES_IN_RECORD, BOUNDARY_SCOPES_IN_RECORD, RUN_LIST_DEFAULT_LIMIT, RUN_LIST_MAX_LIMIT, RUN_EVENTS_DEFAULT_PAGE, RUN_EVENTS_MAX_PAGE, CHANNEL_VISIBILITIES2, KIB, MIB, GIB2, DEFAULT_RETENTION_POLICY, RETENTION_BOUNDS, MAX_RECORD_BYTES, MAX_EVENT_BYTES, ELLIPSIS, encoder;
+var RUN_STATUSES, RUN_ID_PATTERN, REVIEW_HEAD_PATTERN, RUN_SEEDS, MACHINE_CLASSES_IN_RECORD, IDENTITIES_IN_RECORD, BOUNDARY_SCOPES_IN_RECORD, RUN_LIST_DEFAULT_LIMIT, RUN_LIST_MAX_LIMIT, RUN_EVENTS_DEFAULT_PAGE, RUN_EVENTS_MAX_PAGE, CHANNEL_VISIBILITIES2, KIB, MIB, GIB2, DEFAULT_RETENTION_POLICY, RETENTION_BOUNDS, MAX_RECORD_BYTES, MAX_EVENT_BYTES, ELLIPSIS, encoder;
 var init_runRecord = __esm({
   "../../src/core/runRecord.ts"() {
     "use strict";
@@ -13837,6 +13884,7 @@ var init_runRecord = __esm({
     RUN_STATUSES = ["completed", "stopped_soft", "stopped_hard", "failed", "interrupted"];
     RUN_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
     REVIEW_HEAD_PATTERN = /^[0-9a-f]{7,40}$/;
+    RUN_SEEDS = ["channel", "parent"];
     MACHINE_CLASSES_IN_RECORD = {
       none: true,
       blank: true,
@@ -19896,7 +19944,7 @@ function createRunsService(deps) {
   const analyze = deps.analyze ?? ((events, opts) => analyzeRunFriction(events, opts));
   const clock3 = deps.clock ?? systemClock;
   const warn = deps.warn ?? ((m) => console.warn(m));
-  const describe9 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+  const describe11 = (err2) => err2 instanceof Error ? err2.message : String(err2);
   let listing;
   const liveRows = () => {
     if (!ledger) return null;
@@ -19916,7 +19964,7 @@ function createRunsService(deps) {
     try {
       rows = await pending2;
     } catch (err2) {
-      warn(`[runs] run ledger list failed \u2014 showing this process's runs only: ${describe9(err2)}`);
+      warn(`[runs] run ledger list failed \u2014 showing this process's runs only: ${describe11(err2)}`);
       return [];
     }
     const foreign = rows.filter((row) => !registry.getById(row.runId));
@@ -19926,7 +19974,7 @@ function createRunsService(deps) {
         try {
           events = await ledger.readEvents(row.runId);
         } catch (err2) {
-          warn(`[runs] run ledger events read failed for ${row.runId}: ${describe9(err2)}`);
+          warn(`[runs] run ledger events read failed for ${row.runId}: ${describe11(err2)}`);
         }
         return ledgerView(row, events);
       })
@@ -19940,7 +19988,7 @@ function createRunsService(deps) {
       if (!row) return null;
       return { row, events: await ledger.readEvents(id) };
     } catch (err2) {
-      warn(`[runs] run ledger read failed for ${id}: ${describe9(err2)}`);
+      warn(`[runs] run ledger read failed for ${id}: ${describe11(err2)}`);
       return null;
     }
   };
@@ -19958,7 +20006,7 @@ function createRunsService(deps) {
       row = await storeSummary(id);
     } catch (err2) {
       warn(
-        `[runs] history store read failed for ${id} \u2014 serving the registry row without its record: ${describe9(err2)}`
+        `[runs] history store read failed for ${id} \u2014 serving the registry row without its record: ${describe11(err2)}`
       );
       return {};
     }
@@ -20127,7 +20175,7 @@ function createRunsService(deps) {
           const r = await ledger.requestStop(id, mode);
           if (r.ok) return { ok: true, value: { id, mode, state: "stopping" } };
         } catch (err2) {
-          warn(`[runs] run ledger stop failed for ${id}: ${describe9(err2)}`);
+          warn(`[runs] run ledger stop failed for ${id}: ${describe11(err2)}`);
         }
       }
       return await storeSummary(id) ? conflict : notFound;
@@ -21502,6 +21550,11 @@ function liveViewLink(id, token2) {
   if (!base) return void 0;
   return `${base.replace(/\/+$/, "")}/runs/${encodeURIComponent(id)}?t=${encodeURIComponent(token2)}`;
 }
+function runPageLink(id) {
+  const base = process.env.PUBLIC_BASE_URL?.trim();
+  if (!base) return void 0;
+  return `${base.replace(/\/+$/, "")}/runs/${encodeURIComponent(id)}`;
+}
 function stripPlatformPrefix(id) {
   const i = id.indexOf(":");
   return i === -1 ? id : id.slice(i + 1);
@@ -21748,7 +21801,11 @@ function durableInboxMessage(msg, text, at, from) {
     ...msg.userName !== void 0 ? { userName: msg.userName } : {},
     ...msg.sourceUrl !== void 0 ? { sourceUrl: msg.sourceUrl } : {},
     ...msg.channelName !== void 0 ? { channelName: msg.channelName } : {},
-    ...from !== void 0 ? { fromRunId: from.runId } : {}
+    ...from !== void 0 ? { fromRunId: from.runId } : {},
+    // Staged references are metadata (record 0033) — a few hundred bytes each —
+    // so they ride the base row and survive the restart whatever the
+    // attachments below do.
+    ...msg.staged && msg.staged.length > 0 ? { staged: msg.staged.map(stagedRow) } : {}
   };
   const images = msg.images ?? [];
   const documents = msg.documents ?? [];
@@ -21761,6 +21818,17 @@ function durableInboxMessage(msg, text, at, from) {
   if (Buffer.byteLength(JSON.stringify(withAttachments), "utf8") <= DURABLE_INBOX_MAX_BYTES) return withAttachments;
   return { ...base, attachmentsDropped: { images: images.length, documents: documents.length } };
 }
+function stagedFromInbox(v) {
+  if (!Array.isArray(v)) return void 0;
+  const out = v.flatMap((e) => {
+    if (typeof e !== "object" || e === null) return [];
+    const r = e;
+    if (typeof r.name !== "string" || typeof r.size !== "number" || typeof r.type !== "string" || typeof r.url !== "string" || typeof r.messageId !== "string")
+      return [];
+    return [{ name: r.name, size: r.size, type: r.type, url: r.url, messageId: r.messageId }];
+  });
+  return out.length > 0 ? out : void 0;
+}
 function messageFromInbox(stored, fallbackAt) {
   const m = stored;
   const str7 = (k) => typeof m[k] === "string" ? m[k] : void 0;
@@ -21777,6 +21845,7 @@ function messageFromInbox(stored, fallbackAt) {
   const at = typeof m.at === "number" && Number.isFinite(m.at) ? m.at : fallbackAt;
   const images = attachmentsFromInbox(m.images);
   const documents = attachmentsFromInbox(m.documents);
+  const staged = stagedFromInbox(m.staged);
   const note = droppedNote(m.attachmentsDropped);
   const msg = {
     channelId,
@@ -21789,7 +21858,8 @@ ${note}` : text,
     ...sourceUrl !== void 0 ? { sourceUrl } : {},
     ...channelName !== void 0 ? { channelName } : {},
     ...images ? { images } : {},
-    ...documents ? { documents } : {}
+    ...documents ? { documents } : {},
+    ...staged ? { staged } : {}
   };
   return { msg, at, ...fromRunId !== void 0 ? { from: { runId: fromRunId } } : {} };
 }
@@ -21810,7 +21880,7 @@ function droppedNote(dropped) {
   if (n2 <= 0) return void 0;
   return `(${n2} attachment${n2 === 1 ? "" : "s"} from this reply could not be carried across the bot's restart and ${n2 === 1 ? "is" : "are"} not attached.)`;
 }
-var DURABLE_INBOX_MAX_BYTES, attachmentRow;
+var DURABLE_INBOX_MAX_BYTES, attachmentRow, stagedRow;
 var init_inboxMessage = __esm({
   "../../src/core/runLedger/inboxMessage.ts"() {
     "use strict";
@@ -21820,6 +21890,7 @@ var init_inboxMessage = __esm({
       data: a.data,
       ...a.name !== void 0 ? { name: a.name } : {}
     });
+    stagedRow = (s) => ({ name: s.name, size: s.size, type: s.type, url: s.url, messageId: s.messageId });
   }
 });
 
@@ -21851,13 +21922,15 @@ function mergeFollowUps(inputs) {
   const last = inputs[inputs.length - 1];
   const images = inputs.flatMap((i) => i.images ?? []);
   const documents = inputs.flatMap((i) => i.documents ?? []);
+  const staged = inputs.flatMap((i) => i.staged ?? []);
   return {
     text: inputs.map((i) => i.text).join("\n\n"),
     userId: last.userId,
     ...last.userName !== void 0 ? { userName: last.userName } : {},
     ...last.sourceUrl !== void 0 ? { sourceUrl: last.sourceUrl } : {},
     ...images.length > 0 ? { images } : {},
-    ...documents.length > 0 ? { documents } : {}
+    ...documents.length > 0 ? { documents } : {},
+    ...staged.length > 0 ? { staged } : {}
   };
 }
 var FollowUpInbox, ThreadAdmission, elapsed, linkSuffix, followUpHeader, supersededHeader;
@@ -21969,6 +22042,7 @@ function interruptedRunRecord(summary, snap, finishedAt) {
     channelVisibility: summary.channelVisibility ?? "unknown",
     repo: summary.repo,
     ...summary.parentRunId !== void 0 ? { parentRunId: summary.parentRunId } : {},
+    ...summary.seed !== void 0 ? { seed: summary.seed } : {},
     ...summary.parentInstanceId !== void 0 && summary.idempotencyKey !== void 0 ? { coordinator: { parentInstanceId: summary.parentInstanceId, idempotencyKey: summary.idempotencyKey } } : {},
     finishedAt,
     status: "interrupted",
@@ -22004,6 +22078,7 @@ function reclaimedRunRecord(input) {
     // included); a row from before profiles existed leaves the record without one.
     ...row.meta.profile && row.meta.agent ? { profile: { preset: row.meta.agent, ...row.meta.profile } } : {},
     ...row.meta.parentRunId !== void 0 ? { parentRunId: row.meta.parentRunId } : {},
+    ...row.meta.seed !== void 0 ? { seed: row.meta.seed } : {},
     // A coordinator's child keeps its instance and key on the close (item 48),
     // so the state Worker's finish still sends the parent its event.
     ...row.meta.parentInstanceId !== void 0 && row.meta.idempotencyKey !== void 0 ? { coordinator: { parentInstanceId: row.meta.parentInstanceId, idempotencyKey: row.meta.idempotencyKey } } : {},
@@ -22072,7 +22147,8 @@ function assembleRunRecord(input) {
     ...input.reviewPost !== void 0 ? { reviewPost: redactReviewPost(input.reviewPost) } : {},
     ...input.profile !== void 0 ? { profile: input.profile } : {},
     ...input.parentRunId !== void 0 ? { parentRunId: input.parentRunId } : {},
-    ...coordinatorFields(input.coordinator)
+    ...coordinatorFields(input.coordinator),
+    ...input.seed !== void 0 ? { seed: input.seed } : {}
   });
   return fitted.eventCount !== fitted.storedEventCount ? { ...fitted, truncated: true } : fitted;
 }
@@ -22080,7 +22156,20 @@ function profileRecordOf(agent, profile) {
   return { preset: agent.name, ...profile };
 }
 function writeTombstone(deps, ctx) {
-  const { msg, agent, profile, resolved, repoCtx, channelVisibility, run: run2, registry, resume, parentRunId, coordinator } = ctx;
+  const {
+    msg,
+    agent,
+    profile,
+    resolved,
+    repoCtx,
+    channelVisibility,
+    run: run2,
+    registry,
+    resume,
+    parentRunId,
+    coordinator,
+    seed
+  } = ctx;
   if (!resume) {
     const startSnap = registry.snapshot(run2.id, run2.token);
     if (startSnap) {
@@ -22096,6 +22185,7 @@ function writeTombstone(deps, ctx) {
           profile: profileRecordOf(agent, profile),
           ...parentRunId !== void 0 ? { parentRunId } : {},
           ...coordinator !== void 0 ? { coordinator } : {},
+          ...seed !== void 0 ? { seed } : {},
           finishedAt: startSnap.startedAt,
           status: "interrupted",
           diagnosis: analyzeRunFriction(startSnap.events, {
@@ -22130,7 +22220,8 @@ function registerFinishRecord(deps, ctx) {
     dispositions,
     reviewPost,
     parentRunId,
-    coordinator
+    coordinator,
+    seed
   } = ctx;
   ending.register({
     runId: run2.id,
@@ -22155,7 +22246,8 @@ function registerFinishRecord(deps, ctx) {
         ...dispositions !== void 0 ? { dispositions } : {},
         ...reviewPost !== void 0 ? { reviewPost } : {},
         ...parentRunId !== void 0 ? { parentRunId } : {},
-        ...coordinator !== void 0 ? { coordinator } : {}
+        ...coordinator !== void 0 ? { coordinator } : {},
+        ...seed !== void 0 ? { seed } : {}
       }),
       { span: root, ...ledgerRun ? { via: ledgerRun.sink } : {} }
     )
@@ -22188,6 +22280,7 @@ function followUpOf(msg, text, at, opts) {
     ...msg.sourceUrl !== void 0 ? { sourceUrl: msg.sourceUrl } : {},
     ...msg.images !== void 0 ? { images: msg.images } : {},
     ...msg.documents !== void 0 ? { documents: msg.documents } : {},
+    ...msg.staged !== void 0 ? { staged: msg.staged } : {},
     at,
     ...opts.ledgerSeq !== void 0 ? { ledgerSeq: opts.ledgerSeq } : {},
     ...opts.from !== void 0 ? { from: opts.from } : {},
@@ -23353,6 +23446,7 @@ function summaryOf(run2) {
     ...m?.parentRunId !== void 0 ? { parentRunId: m.parentRunId } : {},
     ...m?.parentInstanceId !== void 0 ? { parentInstanceId: m.parentInstanceId } : {},
     ...m?.idempotencyKey !== void 0 ? { idempotencyKey: m.idempotencyKey } : {},
+    ...m?.seed !== void 0 ? { seed: m.seed } : {},
     finished: run2.finished,
     startedAt: run2.startedAt,
     ...run2.finishedAt !== void 0 ? { finishedAt: run2.finishedAt } : {},
@@ -24254,6 +24348,21 @@ var init_awaitChildren = __esm({
   }
 });
 
+// ../../src/core/dispatch/textTurns.ts
+function textTurnsOf(messages) {
+  const turns = [];
+  for (const m of messages) {
+    const text = m.content.filter((p) => p.type === "text").map((p) => p.text).join("\n\n");
+    if (text.length > 0) turns.push({ role: m.role, text });
+  }
+  return turns;
+}
+var init_textTurns = __esm({
+  "../../src/core/dispatch/textTurns.ts"() {
+    "use strict";
+  }
+});
+
 // ../../src/core/dispatch/spawn.ts
 function maxChildrenOf(cfg) {
   return cfg?.maxChildren ?? DEFAULT_MAX_CHILDREN;
@@ -24290,6 +24399,7 @@ function watchedChild(io, on) {
   };
   if (io.attach) watched2.attach = (file) => io.attach(file);
   if (io.attachFile) watched2.attachFile = (file) => io.attachFile(file);
+  if (io.uploadTicket) watched2.uploadTicket = (file) => io.uploadTicket(file);
   if (io.runFinished) watched2.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) watched2.openThread = (lead) => io.openThread(lead);
   return watched2;
@@ -24302,6 +24412,12 @@ async function spawnChild(deps, parent, request) {
       `a child run cannot spawn: this run is itself a child, and a tree is ${MAX_SPAWN_DEPTH} level deep \u2014 the run that started it is the one to ask`
     );
   }
+  if (AGENTS[request.preset]?.identity === "write") {
+    return refused5(
+      "spawn_identity",
+      `\`${request.preset}\` runs as a \`write\` identity \u2014 it pushes branches and opens pull requests \u2014 and a spawned child never writes: it reads this conversation and reports; the person who asked starts that work by hand with \`agent:${request.preset}\``
+    );
+  }
   const minutesLeft = Math.floor(parent.remainingMs / 6e4);
   if (minutesLeft < MIN_BOUNDARY_MINUTES) {
     return refused5(
@@ -24354,8 +24470,10 @@ async function spawnChild(deps, parent, request) {
       lastReply = text;
     }
   });
+  const seed = parent.conversation ? textTurnsOf(parent.conversation) : void 0;
   const settled = deps.dispatch(deps.core, child, io, {
-    parent: { runId: parent.runId, depth: parent.depth + 1, remainingMs: parent.remainingMs }
+    parent: { runId: parent.runId, depth: parent.depth + 1, remainingMs: parent.remainingMs },
+    ...seed ? { seed } : {}
   }).then(
     (outcome) => ({ kind: "ended", outcome }),
     (err2) => ({ kind: "threw", err: err2 })
@@ -24396,8 +24514,8 @@ function spawnCapabilityFor(deps, parent) {
   };
   let previous = Promise.resolve();
   return {
-    spawn: (request, remainingMs) => {
-      const turn = previous.then(() => spawnChild(withHook, { ...parent, remainingMs }, request));
+    spawn: (request, at) => {
+      const turn = previous.then(() => spawnChild(withHook, { ...parent, ...at }, request));
       previous = turn.catch(() => {
       });
       return turn;
@@ -24441,11 +24559,13 @@ var DEFAULT_MAX_CHILDREN, MAX_SPAWN_DEPTH, describe2, nullSpawnCapability;
 var init_spawn = __esm({
   "../../src/core/dispatch/spawn.ts"() {
     "use strict";
+    init_registry();
     init_validate();
     init_actor();
     init_runsService();
     init_admission();
     init_awaitChildren();
+    init_textTurns();
     DEFAULT_MAX_CHILDREN = 3;
     MAX_SPAWN_DEPTH = 1;
     describe2 = (err2) => err2 instanceof Error ? err2.message : String(err2);
@@ -24476,6 +24596,46 @@ function renderPresetTable(presets) {
   );
   return ["| name | what it does | machine | credential | budget |", "|---|---|---|---|---|", ...rows].join("\n");
 }
+function routeMaxOutputTokens(compound) {
+  const PART_JSON_OVERHEAD = 40;
+  const ANSWER_JSON_OVERHEAD = 80;
+  const chars = ANSWER_JSON_OVERHEAD + ROUTE_REASON_CAP + (compound ? compound.maxParts * (ROUTE_PART_TEXT_CAP + PART_JSON_OVERHEAD) : 0);
+  return Math.max(ROUTE_MIN_OUTPUT_TOKENS, Math.ceil(chars / 3));
+}
+function routeTool(presets, compound) {
+  const names = presets.map((p) => p.name);
+  const table = presets.map((p) => `${p.name}: ${oneLine(p.description)}`).join("; ");
+  const properties = {
+    preset: {
+      type: "string",
+      enum: compound ? [...names, COMPOUND_PRESET] : names,
+      description: `the least capable preset whose description covers the request \u2014 ${table}${compound ? `; ${COMPOUND_PRESET}: only for a compound request, with parts` : ""}`
+    },
+    reason: { type: "string", description: "one line, under 100 characters: why this preset" },
+    ...compound ? {
+      parts: {
+        type: "array",
+        description: `only when the request has two or more INDEPENDENT asks on different subjects, each rewritten so it stands alone, with preset "${COMPOUND_PRESET}". A single ask with several steps is one request on one preset: omit parts and name that preset. When one ask is in doubt, omit parts.`,
+        minItems: 2,
+        maxItems: compound.maxParts,
+        items: {
+          type: "object",
+          additionalProperties: false,
+          required: ["preset", "text"],
+          properties: {
+            preset: { type: "string", enum: names, description: "the preset this part runs on" },
+            text: { type: "string", description: "the part as a request of its own" }
+          }
+        }
+      }
+    } : {}
+  };
+  return {
+    name: ROUTE_TOOL_NAME,
+    description: "Route the request: name the preset it runs on and why.",
+    inputSchema: { type: "object", additionalProperties: false, required: ["preset", "reason"], properties }
+  };
+}
 function quoteRequest(text) {
   const bent = text.replace(/<(\/?)request>/gi, "\u2039$1request\u203A");
   if (bent.length <= ROUTE_TEXT_CAP) return bent;
@@ -24509,7 +24669,7 @@ function buildRoutePrompt(input) {
     quoteRequest(input.text),
     "</request>"
   ].join("\n");
-  return { system, user };
+  return { system, user, tool: routeTool(input.presets, input.compound) };
 }
 function compoundRules(offer) {
   return [
@@ -24520,7 +24680,7 @@ function compoundRules(offer) {
 }
 function imperativeRule(writers) {
   const names = writers.map((w) => `\`${w}\``).join(" or ");
-  return `Short imperatives: one terse order to change something or to make a failure go away \u2014 "fix it", "make it pass", "make the tests green", "add X", "rename Y", "bump Z" \u2014 is a request to change code even when it names no file, repository or cause: the channel or thread it arrives in is bound to a repository, and the preset that implements changes finds the failure itself. For it, answer ${names}. A question or a read-only ask about the same failure \u2014 "why did ci fail?", "check whether ci is red", "tell me why the build failed", "list the failing tests" \u2014 changes nothing: answer a read-only preset that covers it, never ${names}. An ask to look at, check or judge a pull request is a review, not an order to change it.`;
+  return `Short imperatives: one terse order to change something or to make a failure go away \u2014 "fix it", "make it pass", "make the tests green", "add X", "rename Y", "bump Z" \u2014 is a request to change code even when it names no file, repository or cause: the channel or thread it arrives in is bound to a repository, and the preset that implements changes finds the failure itself. For it, answer ${names}. A question or a read-only ask about the same failure \u2014 "why did ci fail?", "check whether ci is red", "tell me why the build failed", "list the failing tests" \u2014 changes nothing: answer a read-only preset that covers it, never ${names}. An ask to look at, check or judge a pull request \u2014 named by a link or a number, or the thread's own ("this PR") \u2014 is a review, not an order to change it; a question about a failure with no pull request in view is not a review.`;
 }
 function tidyReason(reason) {
   const line3 = oneLine(redactAndCap(reason, ROUTE_REASON_CAP));
@@ -24537,8 +24697,10 @@ function parseRouteAnswer(raw, allowed2, compound) {
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
     return { preset: void 0, reason: `not a single JSON object: ${tidyReason(trimmed)}` };
   const { preset, reason, parts } = parsed;
-  if (typeof preset !== "string") return { preset: void 0, reason: "missing preset in the router's answer" };
-  if (typeof reason !== "string") return { preset: void 0, reason: "missing reason in the router's answer" };
+  if (typeof preset !== "string")
+    return { preset: void 0, reason: `missing preset in the router's answer: ${tidyReason(trimmed)}` };
+  if (typeof reason !== "string")
+    return { preset: void 0, reason: `missing reason in the router's answer: ${tidyReason(trimmed)}` };
   if (preset === COMPOUND_PRESET) return parseCompound(parts, tidyReason(reason), allowed2, compound);
   if (!allowed2.includes(preset))
     return { preset: void 0, reason: `router said "${tidyReason(preset)}", not a preset the requester may run` };
@@ -24576,7 +24738,7 @@ async function route(input, model, opts = {}) {
   let raw;
   try {
     raw = await model(prompt, {
-      maxTokens: ROUTE_MAX_OUTPUT_TOKENS,
+      maxTokens: routeMaxOutputTokens(input.compound),
       signal: AbortSignal.timeout(opts.timeoutMs ?? ROUTE_TIMEOUT_MS)
     });
   } catch (err2) {
@@ -24591,15 +24753,22 @@ async function route(input, model, opts = {}) {
     input.compound
   );
 }
-function providerRouteModel(provider, model) {
-  return async (prompt, opts) => {
+function providerRouteModel(provider, model, opts = {}) {
+  const forced = (opts.answer ?? "tool") === "tool";
+  return async (prompt, call2) => {
     const result = await provider.complete({
       model,
       system: prompt.system,
       messages: [{ role: "user", content: [{ type: "text", text: prompt.user }] }],
-      maxTokens: opts.maxTokens,
-      signal: opts.signal
+      maxTokens: call2.maxTokens,
+      signal: call2.signal,
+      ...forced ? { tools: [prompt.tool], toolChoice: { type: "tool", name: prompt.tool.name } } : {}
     });
+    if (result.stopReason === "max_tokens") throw new Error(`answer cut at the output cap (${call2.maxTokens} tokens)`);
+    const answer = result.content.find(
+      (p) => p.type === "tool_use" && p.name === prompt.tool.name
+    );
+    if (answer) return JSON.stringify(answer.input);
     return result.content.filter((p) => p.type === "text").map((p) => p.text).join("");
   };
 }
@@ -24617,7 +24786,9 @@ async function routeRequest(deps, ctx) {
     if (deps.routeModel) model = deps.routeModel;
     else {
       const ref = parseModelRef(modelRef2);
-      model = providerRouteModel(deps.providers.get(ref.provider), ref.model);
+      model = providerRouteModel(deps.providers.get(ref.provider), ref.model, {
+        ...cfg.routing?.answer ? { answer: cfg.routing.answer } : {}
+      });
     }
   } catch (err2) {
     console.log(`[route] ${msg.threadKey} not routed: ${err2 instanceof Error ? err2.message : String(err2)}`);
@@ -24680,7 +24851,7 @@ function compoundBrief(text, parts) {
     ...parts.map((p, i) => `${i + 1}. \`${p.preset}\`: ${p.text}`)
   ].join("\n");
 }
-var ROUTE_TEXT_CAP, ROUTE_REASON_CAP, ROUTE_MAX_OUTPUT_TOKENS, ROUTE_TIMEOUT_MS, ROUTE_PART_TEXT_CAP, ROUTE_PART_LINE_CAP, COMPOUND_BRIEF_HEADING, ROUTED_CARD_FOOTER;
+var ROUTE_TEXT_CAP, ROUTE_REASON_CAP, ROUTE_MIN_OUTPUT_TOKENS, ROUTE_TOOL_NAME, ROUTE_TIMEOUT_MS, ROUTE_PART_TEXT_CAP, ROUTE_PART_LINE_CAP, COMPOUND_BRIEF_HEADING, ROUTED_CARD_FOOTER;
 var init_route = __esm({
   "../../src/core/dispatch/route.ts"() {
     "use strict";
@@ -24691,7 +24862,8 @@ var init_route = __esm({
     init_spawn();
     ROUTE_TEXT_CAP = 2e3;
     ROUTE_REASON_CAP = 120;
-    ROUTE_MAX_OUTPUT_TOKENS = 200;
+    ROUTE_MIN_OUTPUT_TOKENS = 200;
+    ROUTE_TOOL_NAME = "route";
     ROUTE_TIMEOUT_MS = 8e3;
     ROUTE_PART_TEXT_CAP = 1e3;
     ROUTE_PART_LINE_CAP = 100;
@@ -25723,19 +25895,162 @@ ${skill.body}${footer}`;
   }
 });
 
+// ../../src/artifacts/contentType.ts
+function contentTypeFor(name) {
+  const dot = name.lastIndexOf(".");
+  if (dot < 0 || dot === name.length - 1) return OCTET_STREAM;
+  return BY_EXTENSION[name.slice(dot + 1).toLowerCase()] ?? OCTET_STREAM;
+}
+var BY_EXTENSION, OCTET_STREAM, INLINE_IMAGE_TYPES;
+var init_contentType = __esm({
+  "../../src/artifacts/contentType.ts"() {
+    "use strict";
+    BY_EXTENSION = {
+      png: "image/png",
+      jpg: "image/jpeg",
+      jpeg: "image/jpeg",
+      gif: "image/gif",
+      webp: "image/webp",
+      svg: "image/svg+xml",
+      pdf: "application/pdf",
+      mp4: "video/mp4",
+      webm: "video/webm",
+      mov: "video/quicktime",
+      mp3: "audio/mpeg",
+      wav: "audio/wav",
+      txt: "text/plain",
+      md: "text/markdown",
+      csv: "text/csv",
+      json: "application/json",
+      html: "text/html",
+      zip: "application/zip",
+      gz: "application/gzip",
+      tar: "application/x-tar"
+    };
+    OCTET_STREAM = "application/octet-stream";
+    INLINE_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+  }
+});
+
+// ../../src/artifacts/keys.ts
+function safeBasename(name) {
+  const segments2 = name.split(/[\\/]+/).filter((s) => s.length > 0);
+  const last = segments2[segments2.length - 1] ?? "";
+  const reduced = last.replace(SAFE, "_").replace(/\.{2,}/g, "_").replace(/_+/g, "_");
+  if (reduced === "" || /^[._-]+$/.test(reduced)) return "file";
+  return reduced;
+}
+function threadKeySafe(threadKey) {
+  return threadKey.replace(/:/g, "-").replace(SAFE, "_");
+}
+function outboundKey(runId3, seq, name) {
+  return `runs/${runId3}/out/${seq}-${safeBasename(name)}`;
+}
+function inboundKey(threadKey, messageTs, index, name) {
+  return `threads/${threadKeySafe(threadKey)}/in/${messageTs}/${index}-${safeBasename(name)}`;
+}
+var SAFE;
+var init_keys = __esm({
+  "../../src/artifacts/keys.ts"() {
+    "use strict";
+    SAFE = /[^A-Za-z0-9._-]+/g;
+  }
+});
+
 // ../../src/tools/attach.ts
+function transferBudgetMs(size) {
+  return Math.ceil(size / TRANSFER_FLOOR_BYTES_PER_MS) + TRANSFER_SETUP_MS;
+}
 function fileNameOf2(path) {
   const segments2 = path.split("/").filter(Boolean);
   return segments2[segments2.length - 1] ?? path;
 }
-var attachFileTool;
+function putCommandFor(path, contentType, url) {
+  return `curl -fsS -T ${shellQuote(path)} -H ${shellQuote(`Content-Type: ${contentType}`)} ${shellQuote(url)}`;
+}
+function postCommandFor(path, url) {
+  return `curl -fsS --data-binary @${shellQuote(path)} ${shellQuote(url)}`;
+}
+async function attachThroughStore(path, name, lead, artifacts, ctx) {
+  const exec = (command2, timeoutMs2) => {
+    const opts = { timeoutMs: timeoutMs2, ...ctx.signal ? { signal: ctx.signal } : {} };
+    return ctx.executor.exec(command2, opts);
+  };
+  const statOut = await exec(statCommandFor(shellQuote(path)), STAT_TIMEOUT_MS);
+  if (parseExitPrefix(statOut).failed) return `error: could not read ${path}: ${statOut.trim()}`;
+  const size = parseByteSize(statOut);
+  if (size === null) return `error: could not measure ${path}: ${statOut.trim()}`;
+  if (size === 0) return `error: ${path} is empty \u2014 nothing to attach`;
+  if (size > MAX_ARTIFACT_BYTES) {
+    return `error: ${path} is ${size} bytes; attach_file takes files up to ${MAX_ARTIFACT_BYTES} bytes (1 GiB) \u2014 link to the file instead`;
+  }
+  let timeoutMs = BASH_TIMEOUT_MAX_MS;
+  if (ctx.remainingMs) {
+    const budget = bashBudgetWithinRun(BASH_TIMEOUT_MAX_MS, ctx.remainingMs());
+    if (budget.kind === "exhausted") return `error: ${budget.note}`;
+    if (budget.kind === "clipped") timeoutMs = budget.timeoutMs;
+  }
+  const needed = transferBudgetMs(size);
+  if (needed > timeoutMs) {
+    return `error: ${name} is ${size} bytes and needs about ${secs(needed)}s to move at ${TRANSFER_FLOOR_BYTES_PER_MS} KB/s; the run has ${secs(timeoutMs)}s of command budget left \u2014 write up what you have and link to the file instead`;
+  }
+  const contentType = contentTypeFor(name);
+  const key = outboundKey(artifacts.runId, artifacts.nextSeq(), name);
+  const putUrl = await artifacts.store.presignPut(key, contentType);
+  const putOut = await exec(putCommandFor(path, contentType, putUrl), timeoutMs);
+  if (parseExitPrefix(putOut).failed) {
+    return `error: the upload of ${name} to the artifact store failed: ${putOut.trim()}`;
+  }
+  const head = await artifacts.store.head(key);
+  if (!head)
+    return `error: the artifact store holds nothing under ${key} after the upload of ${name} \u2014 nothing was posted`;
+  if (head.size !== size) {
+    return `error: the artifact store holds ${head.size} bytes for ${name}, not the ${size} measured \u2014 nothing was posted`;
+  }
+  ctx.publish?.({ type: "artifact", direction: "out", key, name, size, contentType });
+  if (!ctx.uploadTicket) {
+    const where = artifacts.runUrl ? ` \u2014 ${artifacts.runUrl}` : "";
+    await artifacts.reply(`${lead}
+\u{1F4CE} ${name} (${size} bytes) is on the run page${where}`);
+    return `attached ${name} (${size} bytes) to the run page; this conversation's channel takes no file uploads, so the lead and the page's link were posted instead`;
+  }
+  const kept = "the file is kept on the run page";
+  let ticket;
+  try {
+    ticket = await ctx.uploadTicket({ name, size });
+  } catch (err2) {
+    return `error: the channel refused an upload ticket for ${name}: ${describe3(err2)}; ${kept}`;
+  }
+  const postOut = await exec(postCommandFor(path, ticket.url), timeoutMs);
+  if (parseExitPrefix(postOut).failed) {
+    return `error: the upload of ${name} to the channel failed: ${postOut.trim()}; ${kept}`;
+  }
+  try {
+    await ticket.complete(lead);
+  } catch (err2) {
+    return `error: the channel refused to complete the upload of ${name}: ${describe3(err2)}; ${kept}`;
+  }
+  return `attached ${name} (${size} bytes) to the conversation and the run page`;
+}
+var MAX_ARTIFACT_BYTES, TRANSFER_FLOOR_BYTES_PER_MS, TRANSFER_SETUP_MS, STAT_TIMEOUT_MS, describe3, secs, attachFileTool;
 var init_attach = __esm({
   "../../src/tools/attach.ts"() {
     "use strict";
+    init_contentType();
+    init_keys();
+    init_runEvents();
+    init_bashTimeout();
     init_binaryRead();
+    init_shellQuote();
+    MAX_ARTIFACT_BYTES = 1073741824;
+    TRANSFER_FLOOR_BYTES_PER_MS = 1024;
+    TRANSFER_SETUP_MS = 1e4;
+    STAT_TIMEOUT_MS = 3e4;
+    describe3 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+    secs = (ms) => Math.max(0, Math.round(ms / 1e3));
     attachFileTool = {
       name: "attach_file",
-      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only, up to ${MAX_READ_BYTES} bytes.`,
+      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only: up to ${MAX_ARTIFACT_BYTES} bytes (1 GiB) where the artifact store is configured, ${MAX_READ_BYTES} bytes otherwise \u2014 the result says which.`,
       inputSchema: {
         type: "object",
         properties: {
@@ -25752,6 +26067,7 @@ var init_attach = __esm({
         if (!path) return "error: path is required";
         const name = fileNameOf2(path);
         const lead = typeof input.comment === "string" && input.comment.trim() ? input.comment.trim() : name;
+        if (ctx.artifacts) return attachThroughStore(path, name, lead, ctx.artifacts, ctx);
         if (!ctx.attach) {
           return "attach_file is not available here: this conversation's channel takes no file uploads \u2014 link to the file instead";
         }
@@ -25763,13 +26079,13 @@ var init_attach = __esm({
         try {
           bytes = await readBytes(path);
         } catch (err2) {
-          return `error: could not read ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+          return `error: could not read ${path}: ${describe3(err2)}`;
         }
         if (bytes.byteLength === 0) return `error: ${path} is empty \u2014 nothing to attach`;
         try {
           await ctx.attach({ name, bytes, lead });
         } catch (err2) {
-          return `error: the channel refused the upload of ${name}: ${err2 instanceof Error ? err2.message : String(err2)}`;
+          return `error: the channel refused the upload of ${name}: ${describe3(err2)}`;
         }
         return `attached ${name} (${bytes.byteLength} bytes) to the conversation`;
       }
@@ -25902,7 +26218,7 @@ async function nextTick(wait, ids, ms, signal) {
     signal?.removeEventListener("abort", end);
   }
 }
-var UNAVAILABLE2, NOT_FOUND, PRESETS, CHILDREN_PAGES_MAX, spawnRunTool, sendToRunTool, AWAIT_IDS_MAX, awaitRunsTool, listRunsTool, getRunStatusTool, RUN_TOOLS;
+var UNAVAILABLE2, NOT_FOUND, CHILD_PRESETS, WRITE_PRESETS, REPO_PRESETS, CHILDREN_PAGES_MAX, spawnRunTool, sendToRunTool, AWAIT_IDS_MAX, awaitRunsTool, listRunsTool, getRunStatusTool, RUN_TOOLS;
 var init_runs2 = __esm({
   "../../src/tools/runs.ts"() {
     "use strict";
@@ -25917,16 +26233,24 @@ var init_runs2 = __esm({
     init_runsService();
     UNAVAILABLE2 = "run tools are not available in this context.";
     NOT_FOUND = "not_found";
-    PRESETS = () => Object.keys(AGENTS);
+    CHILD_PRESETS = () => Object.values(AGENTS).filter((a) => a.name !== "conductor" && a.identity !== "write").map((a) => a.name);
+    WRITE_PRESETS = () => Object.values(AGENTS).filter((a) => a.identity === "write").map((a) => a.name);
+    REPO_PRESETS = () => Object.values(AGENTS).filter((a) => machineNeedsRepo(a.machine)).map((a) => a.name);
     CHILDREN_PAGES_MAX = 25;
     spawnRunTool = {
       name: "spawn_run",
-      description: "Start a child run as the person who asked you: an ordinary Switchboard run of the named preset, in a thread of its own in this channel, under their permissions \u2014 what they could start by hand with `agent:<preset>`. `prompt` is everything the child needs (it sees none of this thread); `repo` (owner/name) for a preset that works in a repository (coding, review, explore, ship); `budget` narrows the child's wall clock in whole minutes (at least 2; it is also capped by what is left of yours). Returns the child's run id, its thread and a link, or a refusal by name: a preset or repository the requester may not use, a boundary the child's profile exceeds, the fan-out cap, or a channel that cannot open a thread. A child cannot spawn children.",
+      description: `Start a child run as the person who asked you: an ordinary Switchboard run of the named preset, in a thread of its own in this channel, under their permissions \u2014 what they could start by hand with \`agent:<preset>\`. The child is a reader of this conversation: it starts from this conversation's text so far (every user and assistant turn, never your tool calls or their results) plus \`prompt\`, its one new turn \u2014 so say what it should do. Presets a child can run: ${CHILD_PRESETS().join(", ")}; a preset that writes (${WRITE_PRESETS().join(", ")}) is refused \`spawn_identity\`. \`repo\` (owner/name) for a preset that works in a repository (${REPO_PRESETS().join(", ")}); \`budget\` narrows the child's wall clock in whole minutes (at least 2; it is also capped by what is left of yours). Returns the child's run id, its thread and a link, or a refusal by name: a preset or repository the requester may not use, a boundary the child's profile exceeds, the fan-out cap, or a channel that cannot open a thread. A child cannot spawn children.`,
       inputSchema: {
         type: "object",
         properties: {
-          preset: { type: "string", description: `The preset the child runs: one of ${PRESETS().join(", ")}` },
-          prompt: { type: "string", description: "The child's whole request, self-contained" },
+          preset: {
+            type: "string",
+            description: `The preset the child runs: one of ${CHILD_PRESETS().join(", ")} (a preset that writes \u2014 ${WRITE_PRESETS().join(", ")} \u2014 is refused spawn_identity)`
+          },
+          prompt: {
+            type: "string",
+            description: "What the child should do \u2014 its one new turn after this conversation's text"
+          },
           repo: { type: "string", description: "owner/name of the repository the child works in, for a repository preset" },
           budget: { type: "integer", description: "The child's wall clock in whole minutes, at least 2 (optional)" }
         },
@@ -25934,9 +26258,10 @@ var init_runs2 = __esm({
       },
       async run(input, ctx) {
         const preset = String(input.preset ?? "");
-        if (!Object.hasOwn(AGENTS, preset)) return `error: unknown preset "${preset}" \u2014 one of ${PRESETS().join(", ")}`;
+        if (!Object.hasOwn(AGENTS, preset))
+          return `error: unknown preset "${preset}" \u2014 one of ${CHILD_PRESETS().join(", ")}`;
         const prompt = String(input.prompt ?? "").trim();
-        if (!prompt) return "error: prompt is required \u2014 the child's whole request, since it sees none of this thread";
+        if (!prompt) return "error: prompt is required \u2014 what the child should do, after this conversation's text";
         const request = { preset, prompt };
         if (input.repo !== void 0 && String(input.repo).trim()) request.repo = String(input.repo).trim();
         if (input.budget !== void 0) {
@@ -25946,7 +26271,10 @@ var init_runs2 = __esm({
           request.budget = budget;
         }
         const spawn7 = ctx.spawn ?? nullSpawnCapability;
-        const out = await spawn7.spawn(request, ctx.remainingMs?.() ?? Number.POSITIVE_INFINITY);
+        const out = await spawn7.spawn(request, {
+          remainingMs: ctx.remainingMs?.() ?? Number.POSITIVE_INFINITY,
+          ...ctx.conversation ? { conversation: ctx.conversation() } : {}
+        });
         if (out.kind === "refused") return `spawn refused (${out.reason}): ${out.message}`;
         return `spawned a ${preset} run: ${out.runId} in thread ${out.threadKey}${out.url ? ` (${out.url})` : ""} \u2014 it runs on its own; await_runs waits for it and returns its reply; get_run_status ${out.runId} answers its progress meanwhile.`;
       }
@@ -26673,14 +27001,34 @@ async function runLoop(opts, now, note, emit, agentSpan) {
   const deadline = now() + (opts.resume ? opts.resume.remainingMs : opts.agent.maxMinutes * 6e4);
   const warnAt = deadline - Math.min(3 * 6e4, opts.agent.maxMinutes * 15e3);
   toolContext.remainingMs = () => deadline - now();
+  toolContext.conversation = () => messages;
   let warned = false;
   let sandboxDead = false;
+  let stuckLoop = false;
+  let stuckSig;
+  let stuckStreak = 0;
+  let stuckNudged = false;
+  const trackStuck = (tu, ok2) => {
+    const sig = callSignature(tu.name, redactAndCap(describeToolCall(tu)));
+    if (ok2) {
+      if (sig === stuckSig) {
+        stuckSig = void 0;
+        stuckStreak = 0;
+        stuckNudged = false;
+      }
+      return;
+    }
+    if (sig !== stuckSig) stuckNudged = false;
+    stuckStreak = sig === stuckSig ? stuckStreak + 1 : 1;
+    stuckSig = sig;
+  };
   let turn = 0;
   const wouldStep = (turns, iteration) => turns < opts.agent.maxTurns && iteration < opts.agent.maxTurns * 2 && now() < deadline && !control?.requested;
   const pendingFollowUps = () => (opts.inbox?.size ?? 0) > 0;
   let inboxConsumedSeq = opts.resume?.inboxConsumedSeq ?? 0;
-  const drainFollowUps = (superseded = false) => {
+  const drainFollowUps = async (superseded = false) => {
     const inputs = opts.inbox?.drain() ?? [];
+    const stagedLine = opts.stageFollowUps ? await opts.stageFollowUps(inputs) : "";
     for (const input of inputs) {
       if (input.ledgerSeq !== void 0 && input.ledgerSeq > inboxConsumedSeq) inboxConsumedSeq = input.ledgerSeq;
       const source2 = {
@@ -26691,7 +27039,10 @@ async function runLoop(opts, now, note, emit, agentSpan) {
       emit({ type: "input", text: redactSecrets(input.text), ...Object.keys(source2).length > 0 ? { source: source2 } : {} });
       note("follow_up", `follow-up folded in: ${redactSecrets(followUpSnippet(input))}`);
     }
-    const parts = [{ type: "text", text: followUpPrompt(inputs, { superseded }) }];
+    const prompt = followUpPrompt(inputs, { superseded });
+    const parts = [{ type: "text", text: stagedLine ? `${prompt}
+
+${stagedLine}` : prompt }];
     for (const input of inputs) {
       for (const img of input.images ?? []) parts.push({ type: "image", mediaType: img.mediaType, data: img.data });
       for (const doc of input.documents ?? [])
@@ -26708,12 +27059,15 @@ async function runLoop(opts, now, note, emit, agentSpan) {
     const body = async (callSpan) => {
       if (announceIt) announce(tu, callSpan?.id);
       const spanId = callSpan ? { spanId: callSpan.id } : {};
-      const settle2 = (ok2, extra = {}) => callSpan?.end(ok2 ? "ok" : "error", {
-        callId: tu.id,
-        ok: ok2,
-        ...extra.exitCode !== void 0 ? { exitCode: extra.exitCode } : {},
-        ...extra.infra ? { infra: true } : {}
-      });
+      const settle2 = (ok2, extra = {}) => {
+        trackStuck(tu, ok2);
+        callSpan?.end(ok2 ? "ok" : "error", {
+          callId: tu.id,
+          ok: ok2,
+          ...extra.exitCode !== void 0 ? { exitCode: extra.exitCode } : {},
+          ...extra.infra ? { infra: true } : {}
+        });
+      };
       const tool = toolsByName.get(tu.name);
       if (!tool) {
         emit({
@@ -26897,7 +27251,7 @@ async function runLoop(opts, now, note, emit, agentSpan) {
         turn++;
         if (text2) emit({ type: "assistant", text: redactSecrets(text2) });
         messages.push({ role: "assistant", content: result.content });
-        messages.push({ role: "user", content: drainFollowUps(true) });
+        messages.push({ role: "user", content: await drainFollowUps(true) });
         continue;
       }
       return text2 || "_(no response)_";
@@ -26922,6 +27276,10 @@ async function runLoop(opts, now, note, emit, agentSpan) {
       reportedUpTo = messages.length;
     }
     const results = await dispatchToolUses(toolUses);
+    if (!stuckNudged && stuckStreak >= STUCK_NUDGE_AT) {
+      stuckNudged = true;
+      results.push({ type: "text", text: stuckLoopNudge() });
+    }
     if (!warned && now() >= warnAt) {
       warned = true;
       const minutesLeft = Math.max(1, Math.round((deadline - now()) / 6e4));
@@ -26929,12 +27287,16 @@ async function runLoop(opts, now, note, emit, agentSpan) {
       results.push({ type: "text", text: wrapUpInstruction(minutesLeft) });
     }
     const dead = execTracker.consecutiveInfraFailures >= MAX_CONSECUTIVE_INFRA_FAILURES;
-    if (pendingFollowUps() && !dead && wouldStep(turn, iteration + 1)) results.push(...drainFollowUps());
+    if (pendingFollowUps() && !dead && wouldStep(turn, iteration + 1)) results.push(...await drainFollowUps());
     messages.push({ role: "user", content: results });
     if (dead) {
       sandboxDead = true;
       break;
     }
+    if (stuckStreak >= STUCK_WRITE_UP_AT) {
+      stuckLoop = true;
+      break;
+    }
   }
   narrateHeld();
   if (control?.requested === "soft") {
@@ -26946,6 +27308,11 @@ async function runLoop(opts, now, note, emit, agentSpan) {
     note("sandbox_dead", `${diagnosis} \u2014 aborting instead of retrying into a dead sandbox`);
     return await finishSandboxDead(complete2, opts, messages, system, diagnosis);
   }
+  if (stuckLoop) {
+    note("stuck_loop", stuckLoopNote());
+    const text2 = await runFinale(complete2, opts, messages, system, stuckLoopInstruction());
+    return stuckLoopAnswer(text2);
+  }
   const wasTimeout = now() >= deadline;
   const elapsedMs = opts.agent.maxMinutes * 6e4 - (deadline - now());
   const pace = turnGuardPace(turn, elapsedMs);
@@ -27047,7 +27414,7 @@ function withSpanId(e, spanId) {
       return e;
   }
 }
-var MAX_CONSECUTIVE_INFRA_FAILURES, HardStopError, HARD_STOP_MESSAGE, wrapUpNote, wrapUpInstruction, WRITE_UP_REQUEST, timeBudgetInstruction, turnGuardInstruction, SOFT_STOP_INSTRUCTION, turnGuardPace, timeBudgetNote, turnGuardNote, softStopNote, hardStopNote, timeBudgetAnswer, turnGuardAnswer, softStopAnswer, FinaleTimeoutError, FINALE_TIMEOUT_MS;
+var MAX_CONSECUTIVE_INFRA_FAILURES, HardStopError, HARD_STOP_MESSAGE, wrapUpNote, wrapUpInstruction, WRITE_UP_REQUEST, timeBudgetInstruction, turnGuardInstruction, SOFT_STOP_INSTRUCTION, turnGuardPace, timeBudgetNote, turnGuardNote, softStopNote, hardStopNote, timeBudgetAnswer, turnGuardAnswer, STUCK_NUDGE_AT, STUCK_WRITE_UP_AT, stuckLoopNudge, stuckLoopNote, stuckLoopInstruction, stuckLoopAnswer, softStopAnswer, FinaleTimeoutError, FINALE_TIMEOUT_MS;
 var init_runner = __esm({
   "../../src/runner.ts"() {
     "use strict";
@@ -27058,6 +27425,7 @@ var init_runner = __esm({
     init_tracingExecutor();
     init_workspace();
     init_formatDuration();
+    init_runFriction();
     MAX_CONSECUTIVE_INFRA_FAILURES = 2;
     HardStopError = class extends Error {
       constructor() {
@@ -27083,6 +27451,14 @@ ${text}` : `Stopped at the ${maxMinutes}-minute budget without finishing. Partia
     turnGuardAnswer = (text, pace) => text ? `\u26A0\uFE0F _Stopped after ${pace} \u2014 that pace looks like a loop; findings so far:_
 
 ${text}` : `Stopped after ${pace} \u2014 that pace looks like a loop \u2014 without finishing. Partial work may exist in the workspace \u2014 look for a retry loop in the run's events before trying again.`;
+    STUCK_NUDGE_AT = 3;
+    STUCK_WRITE_UP_AT = 6;
+    stuckLoopNudge = () => `\u26A0\uFE0F That exact tool call has now failed ${STUCK_NUDGE_AT} times identically. Change approach \u2014 different arguments, a different tool, a smaller step \u2014 or write up what you have.`;
+    stuckLoopNote = () => `stuck loop: the same call failed ${STUCK_WRITE_UP_AT} times identically \u2014 writing up findings so far`;
+    stuckLoopInstruction = () => `The same tool call has failed ${STUCK_WRITE_UP_AT} times identically; the run is stuck and can make no more tool calls. ${WRITE_UP_REQUEST}`;
+    stuckLoopAnswer = (text) => text ? `\u26A0\uFE0F _Stopped after the same call failed ${STUCK_WRITE_UP_AT} times identically \u2014 findings so far:_
+
+${text}` : `Stopped after the same call failed ${STUCK_WRITE_UP_AT} times identically, without finishing. Partial work may exist in the workspace \u2014 look at the failing call in the run's events before trying again.`;
     softStopAnswer = (text) => text ? `\u23F9 _Stopped early by an operator (soft stop) \u2014 findings so far:_
 
 ${text}` : "\u23F9 Stopped early by an operator (soft stop) before any findings were written. Partial work may exist in the workspace.";
@@ -27925,11 +28301,107 @@ var init_messages = __esm({
     init_runEvents();
     init_runRecord();
     init_reply();
+    init_textTurns();
     CONTEXT_MAX_ITEMS = 20;
     CONTEXT_MAX_BYTES = 256 * 1024;
   }
 });
 
+// ../../src/core/dispatch/staging.ts
+function stagedBasename(index, name) {
+  return `${index}-${safeBasename(name)}`;
+}
+function pullCommandFor(url, basename4) {
+  return `mkdir -p ${ATTACHMENTS_DIR} && curl -fsS -o ${shellQuote(`${ATTACHMENTS_DIR}/${basename4}`)} ${shellQuote(url)}`;
+}
+function excludeCommand() {
+  const entry = shellQuote(`${ATTACHMENTS_DIR}/`);
+  return `mkdir -p .git/info && { grep -qxF ${entry} .git/info/exclude 2>/dev/null || echo ${entry} >> .git/info/exclude; }`;
+}
+function formatSize(bytes) {
+  if (bytes >= 1e9) return `${(bytes / 1e9).toFixed(1)} GB`;
+  if (bytes >= 1e6) return `${Math.round(bytes / 1e6)} MB`;
+  if (bytes >= 1e3) return `${Math.round(bytes / 1e3)} KB`;
+  return `${bytes} B`;
+}
+function attachmentsLine(outcomes) {
+  const landed = outcomes.filter((o) => o.error === void 0);
+  const failed = outcomes.filter((o) => o.error !== void 0);
+  const parts = [];
+  if (landed.length > 0) {
+    parts.push(
+      `Attached files are in ./${ATTACHMENTS_DIR}/: ${landed.map((o) => `${o.basename} (${formatSize(o.file.size)}, ${o.file.type})`).join(", ")}`
+    );
+  }
+  for (const o of failed) parts.push(`${o.file.name} could not be staged: ${o.error}`);
+  return parts.join(". ");
+}
+function noWorkspaceLine(files) {
+  return files.map(
+    (f) => `this agent has no workspace for ${f.name} (${formatSize(f.size)}, ${f.type}); ask \`agent:coding\` to work with it`
+  ).join(". ");
+}
+function stagingIndex() {
+  let n2 = 0;
+  return () => ++n2;
+}
+async function copyStaged(files, deps) {
+  return Promise.all(
+    files.map(async (file) => {
+      const index = deps.nextIndex();
+      const basename4 = stagedBasename(index, file.name);
+      const key = inboundKey(deps.threadKey, file.messageId, index, file.name);
+      try {
+        await deps.store.copyFromUrl({ url: file.url, size: file.size, key });
+        deps.publish?.({
+          type: "artifact",
+          direction: "in",
+          key,
+          name: file.name,
+          size: file.size,
+          contentType: file.type
+        });
+        return { file, basename: basename4, key };
+      } catch (err2) {
+        return { file, basename: basename4, key, error: `the copy into the store failed: ${describe4(err2)}` };
+      }
+    })
+  );
+}
+async function pullStaged(outcomes, deps) {
+  const landed = outcomes.filter((o) => o.error === void 0);
+  if (landed.length === 0) return [...outcomes];
+  const timeoutMs = deps.timeoutMs ?? BASH_TIMEOUT_MAX_MS;
+  const opts = { timeoutMs, ...deps.signal ? { signal: deps.signal } : {} };
+  if (deps.resident) await deps.executor.exec(excludeCommand(), opts);
+  const pulled = /* @__PURE__ */ new Map();
+  for (const o of landed) {
+    const url = await deps.store.presignGet(o.key);
+    const out = await deps.executor.exec(pullCommandFor(url, o.basename), opts);
+    pulled.set(o.key, parseExitPrefix(out).failed ? `the pull into the workspace failed: ${out.trim()}` : void 0);
+  }
+  return outcomes.map((o) => {
+    const error = o.error ?? pulled.get(o.key);
+    return error === void 0 ? { file: o.file, basename: o.basename, key: o.key } : { ...o, error };
+  });
+}
+async function stageIntoWorkspace(files, deps) {
+  const outcomes = await pullStaged(await copyStaged(files, deps), deps);
+  return { line: attachmentsLine(outcomes), outcomes };
+}
+var ATTACHMENTS_DIR, describe4;
+var init_staging = __esm({
+  "../../src/core/dispatch/staging.ts"() {
+    "use strict";
+    init_keys();
+    init_bashTimeout();
+    init_shellQuote();
+    init_runEvents();
+    ATTACHMENTS_DIR = "attachments";
+    describe4 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+  }
+});
+
 // ../../src/core/modelProxy/runBearers.ts
 import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function token(runId3, secret2) {
@@ -28525,6 +28997,8 @@ async function registerRun(deps, ctx) {
     admitted,
     parentRunId,
     coordinator,
+    seed,
+    seedTurns,
     agentSource,
     route: route3
   } = ctx;
@@ -28557,7 +29031,8 @@ async function registerRun(deps, ctx) {
       ...msg.sourceUrl !== void 0 ? { sourceUrl: msg.sourceUrl } : {},
       ...msg.userName !== void 0 ? { userName: msg.userName } : {},
       ...parentRunId !== void 0 ? { parentRunId } : {},
-      ...coordinatorFields(coordinator)
+      ...coordinatorFields(coordinator),
+      ...seed !== void 0 ? { seed } : {}
     },
     // Under the run's id, at the card's start (the reservation's, or the
     // carried row's) — a resume replays its events, a restart starts them
@@ -28606,7 +29081,7 @@ async function registerRun(deps, ctx) {
   if (!resume) publishMeta(repoCtx);
   if (!resume && route3) registry.publish(run2.id, { type: "route", ...route3, at: clock3() });
   if (!resume && deps.config.config.runHistory?.includeContext !== false) {
-    for (const text of contextMessageTexts(history, humanize)) publishText("context", text);
+    for (const text of contextMessageTexts(seedTurns ?? history, humanize)) publishText("context", text);
   }
   return { run: run2, runId: runId3, channelVisibility, liveUrl, publishText, publishMeta };
 }
@@ -28628,7 +29103,8 @@ async function reserveRun(deps, ctx) {
     admitted,
     root,
     parentRunId,
-    coordinator
+    coordinator,
+    seed
   } = ctx;
   if (!resume && !restart) {
     const requestRow = durableInboxMessage(msg, msg.text, receivedAt);
@@ -28656,6 +29132,7 @@ async function reserveRun(deps, ctx) {
           profile,
           ...parentRunId !== void 0 ? { parentRunId } : {},
           ...coordinatorFields(coordinator),
+          ...seed !== void 0 ? { seed } : {},
           request: requestRow
         },
         card: card.handle ?? null,
@@ -28885,7 +29362,8 @@ async function claimRun(deps, ctx) {
     clock: clock3,
     root,
     parentRunId,
-    coordinator
+    coordinator,
+    seed
   } = ctx;
   const { resident, binding } = selection;
   let ledgerRun = ctx.ledgerRun;
@@ -28915,6 +29393,7 @@ async function claimRun(deps, ctx) {
           profile,
           ...parentRunId !== void 0 ? { parentRunId } : {},
           ...coordinatorFields(coordinator),
+          ...seed !== void 0 ? { seed } : {},
           selection: resident === true ? "resident" : "sandbox",
           ...binding?.workspace !== void 0 ? { workspace: binding.workspace } : {},
           ...requestRow !== void 0 ? { request: requestRow } : {}
@@ -29113,6 +29592,157 @@ var init_container = __esm({
   }
 });
 
+// ../../src/core/harness/pi/extensionSource.ts
+var BLOCKED_AT_DOOR_PREFIX, BLOCKED_UNAVAILABLE_PREFIX, PI_EXTENSION_SOURCE;
+var init_extensionSource = __esm({
+  "../../src/core/harness/pi/extensionSource.ts"() {
+    "use strict";
+    BLOCKED_AT_DOOR_PREFIX = "authorization refused at the door: ";
+    BLOCKED_UNAVAILABLE_PREFIX = "authorization unavailable: ";
+    PI_EXTENSION_SOURCE = `// Switchboard's pi harness extension. Written into the run's directory by the
+// bot before pi starts; loaded with \`-e\`. Imports nothing.
+
+const BEARER_ENV = "SWITCHBOARD_RUN_BEARER";
+const URL_ENV = "SWITCHBOARD_HARNESS_URL";
+/** How long the tool_call hook keeps asking an unreachable bot before it blocks. */
+const AUTHORIZE_WAIT_MS = 90_000;
+const AUTHORIZE_RETRY_MS = 2_000;
+
+function settings() {
+  const url = process.env[URL_ENV];
+  const bearer = process.env[BEARER_ENV];
+  if (!url || !bearer) throw new Error("switchboard harness: " + URL_ENV + " and " + BEARER_ENV + " must be set");
+  return { base: url.replace(/\\/$/, ""), bearer };
+}
+
+/** The bot answered, and said no: the status rides along so a caller can tell
+ *  a verdict from a bot it could not reach. */
+class HarnessAnswerError extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+}
+
+async function call(method, path, body, signal) {
+  const { base, bearer } = settings();
+  const res = await fetch(base + path, {
+    method,
+    headers: { authorization: "Bearer " + bearer, "content-type": "application/json", accept: "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal,
+  });
+  const text = await res.text();
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error("switchboard harness: " + method + " " + path + " answered " + res.status + " with a body that is not JSON");
+  }
+  if (!res.ok) {
+    throw new HarnessAnswerError(
+      "switchboard harness: " + method + " " + path + " answered " + res.status + ": " + (json.error || text),
+      res.status,
+    );
+  }
+  return json;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** The bot's verdict on one tool call. A verdict answers at once, and so does
+ *  a refusal at the door \u2014 a 4xx: the bearer wrong, expired or revoked, the
+ *  run not on the harness \u2014 since nothing later changes it. A bot that cannot
+ *  be reached or is failing (a network error, a 5xx, a body that is not JSON)
+ *  is asked again every two seconds until the wait is up, then the call is
+ *  blocked naming why. */
+async function authorize(event) {
+  const started = Date.now();
+  let lastError = "";
+  for (;;) {
+    try {
+      return await call("POST", "/harness/authorize", {
+        toolCallId: event.toolCallId,
+        tool: event.toolName,
+        input: event.input,
+      });
+    } catch (err) {
+      lastError = err instanceof Error ? err.message : String(err);
+      const status = err instanceof HarnessAnswerError ? err.status : undefined;
+      if (status !== undefined && status >= 400 && status < 500) {
+        return { allow: false, reason: "${BLOCKED_AT_DOOR_PREFIX}" + lastError };
+      }
+      if (Date.now() - started >= AUTHORIZE_WAIT_MS) {
+        return { allow: false, reason: "${BLOCKED_UNAVAILABLE_PREFIX}the bot did not answer for 90 s (" + lastError + ")" };
+      }
+      await sleep(AUTHORIZE_RETRY_MS);
+    }
+  }
+}
+
+function relayTool(def) {
+  return {
+    name: def.name,
+    label: def.name,
+    description: def.description,
+    parameters: def.inputSchema,
+    async execute(toolCallId, params, signal) {
+      const answer = await call("POST", "/harness/tool", { toolCallId, tool: def.name, input: params }, signal);
+      if (answer.isError) throw new Error(answer.content.map((c) => (c.type === "text" ? c.text : "")).join("\\n"));
+      return { content: answer.content, details: {} };
+    },
+  };
+}
+
+export default async function switchboardHarness(pi) {
+  const { tools } = await call("GET", "/harness/tools");
+  for (const def of tools) pi.registerTool(relayTool(def));
+  pi.on("tool_call", async (event) => {
+    const verdict = await authorize(event);
+    if (!verdict.allow) return { block: true, reason: verdict.reason };
+    return undefined;
+  });
+}
+`;
+  }
+});
+
+// ../../src/core/harness/pi/protocol.ts
+function parsePiLine(line3) {
+  try {
+    const value = JSON.parse(line3);
+    if (typeof value === "object" && value !== null && typeof value.type === "string") {
+      return value;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function piAnsweredWithoutRunning(event) {
+  if (event.type !== "tool_execution_end" || event.isError !== true) return void 0;
+  const tool = typeof event.toolName === "string" ? event.toolName : "";
+  const result = event.result;
+  const content = Array.isArray(result?.content) ? result.content : [];
+  const text = content.filter(
+    (p) => typeof p === "object" && p !== null && p.type === "text" && typeof p.text === "string"
+  ).map((p) => p.text).join("\n");
+  const validation = `Validation failed for tool "${tool}":
+`;
+  if (text.startsWith(validation)) {
+    const problems = text.slice(validation.length).split("\n\n")[0].split("\n").map((line3) => line3.replace(/^\s*-\s*/, "").trim()).filter((line3) => line3.length > 0);
+    return `its arguments failed pi's validation (${problems.join("; ")})`;
+  }
+  if (text.startsWith(`Tool call "${tool}" was not executed: the response hit the output token limit`))
+    return "its arguments were cut by the output token limit";
+  if (text === `Tool ${tool} not found`) return "the tool is not on pi's list";
+  return void 0;
+}
+var init_protocol = __esm({
+  "../../src/core/harness/pi/protocol.ts"() {
+    "use strict";
+  }
+});
+
 // ../../src/core/harness/pi/bridge.ts
 function describePiToolCall(tool, args) {
   const input = isRecord3(args) ? args : void 0;
@@ -29140,6 +29770,8 @@ var init_bridge2 = __esm({
     "use strict";
     init_formatDuration();
     init_runEvents();
+    init_extensionSource();
+    init_protocol();
     PI_EVENT_DISPOSITION = {
       response: "structure",
       agent_start: "structure",
@@ -29182,8 +29814,23 @@ var init_bridge2 = __esm({
       /** Text beside a bookkeeping-only call, held until the next message decides (run-loop item 15). */
       heldAnswer;
       assistantStartedAt;
+      /** The calls under way: their span, their tool, and whether their end is
+       *  judged against the gate (harness-pi item 7). */
       openTools = /* @__PURE__ */ new Map();
+      /** The calls the gate saw — the extension asked `/harness/authorize` for
+       *  them (`gateSaw`) — not yet ended. */
+      vetted = /* @__PURE__ */ new Set();
+      /** Whether a call starting now is judged against the gate when it ends.
+       *  The harness turns it off while catching up on a re-attach: those calls
+       *  were vetted by the bot generation that died, and this one never heard. */
+      judgeGate = true;
       summarizationRetries = 0;
+      /** The gate saw this call: the extension's `tool_call` hook asked the bot
+       *  for it, whatever the answer. Called from the authorize route, before pi
+       *  runs the tool — so it always precedes the call's `tool_execution_end`. */
+      gateSaw(callId) {
+        this.vetted.add(callId);
+      }
       /** The run's answer as it stands: the last text-only assistant message, else a held bookkeeping text. */
       answer() {
         return this.answerText ?? this.heldAnswer;
@@ -29222,7 +29869,7 @@ var init_bridge2 = __esm({
             this.onToolStart(event);
             break;
           case "tool_execution_end":
-            this.onToolEnd(event);
+            this.onToolEnd(event, out);
             break;
           case "compaction_end":
             this.onCompactionEnd(event);
@@ -29285,7 +29932,7 @@ var init_bridge2 = __esm({
         const tool = str5(event.toolName);
         const callId = str5(event.toolCallId);
         const span = this.deps.agentSpan?.start(`tool.${tool}`);
-        this.openTools.set(callId, { span, tool });
+        this.openTools.set(callId, { span, tool, judged: this.judgeGate });
         this.toolCalls++;
         const input = isRecord3(event.args) ? event.args : void 0;
         const command2 = tool === "bash" && typeof input?.command === "string" ? { command: redactAndCap(input.command, COMMAND_CAP) } : {};
@@ -29298,7 +29945,7 @@ var init_bridge2 = __esm({
           ...span ? { spanId: span.id } : {}
         });
       }
-      onToolEnd(event) {
+      onToolEnd(event, out) {
         const callId = str5(event.toolCallId);
         const open = this.openTools.get(callId);
         this.openTools.delete(callId);
@@ -29321,6 +29968,23 @@ var init_bridge2 = __esm({
           ok: ok2,
           ...exit.exitCode !== void 0 ? { exitCode: exit.exitCode } : {}
         });
+        const seen = this.vetted.delete(callId);
+        if (!seen && open?.judged) {
+          const rejection = piAnsweredWithoutRunning(event);
+          if (rejection !== void 0) {
+            this.note(
+              "harness_error",
+              `pi answered the ${tool} call ${callId} itself, before the gate: ${redactAndCap(rejection, 300)}; nothing ran`
+            );
+          } else if (isError && (text.startsWith(BLOCKED_AT_DOOR_PREFIX) || text.startsWith(BLOCKED_UNAVAILABLE_PREFIX))) {
+            this.note(
+              "harness_error",
+              `the extension blocked the ${tool} call ${callId} without the gate's verdict: ${redactAndCap(text, 300)}; nothing ran`
+            );
+          } else {
+            out.gateBypassed = { callId, tool };
+          }
+        }
       }
       onCompactionEnd(event) {
         const result = isRecord3(event.result) ? event.result : void 0;
@@ -29360,6 +30024,7 @@ var init_bridge2 = __esm({
           this.emit({ type: "tool_result", tool: open.tool, ok: false, callId, summary: redactAndCap(reason) });
         }
         this.openTools.clear();
+        this.vetted.clear();
       }
     };
   }
@@ -29536,120 +30201,10 @@ var init_mirror = __esm({
   }
 });
 
-// ../../src/core/harness/pi/extensionSource.ts
-var PI_EXTENSION_SOURCE;
-var init_extensionSource = __esm({
-  "../../src/core/harness/pi/extensionSource.ts"() {
-    "use strict";
-    PI_EXTENSION_SOURCE = `// Switchboard's pi harness extension. Written into the run's directory by the
-// bot before pi starts; loaded with \`-e\`. Imports nothing.
-
-const BEARER_ENV = "SWITCHBOARD_RUN_BEARER";
-const URL_ENV = "SWITCHBOARD_HARNESS_URL";
-/** How long the tool_call hook keeps asking an unreachable bot before it blocks. */
-const AUTHORIZE_WAIT_MS = 90_000;
-const AUTHORIZE_RETRY_MS = 2_000;
-
-function settings() {
-  const url = process.env[URL_ENV];
-  const bearer = process.env[BEARER_ENV];
-  if (!url || !bearer) throw new Error("switchboard harness: " + URL_ENV + " and " + BEARER_ENV + " must be set");
-  return { base: url.replace(/\\/$/, ""), bearer };
-}
-
-/** The bot answered, and said no: the status rides along so a caller can tell
- *  a verdict from a bot it could not reach. */
-class HarnessAnswerError extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-  }
-}
-
-async function call(method, path, body, signal) {
-  const { base, bearer } = settings();
-  const res = await fetch(base + path, {
-    method,
-    headers: { authorization: "Bearer " + bearer, "content-type": "application/json", accept: "application/json" },
-    body: body === undefined ? undefined : JSON.stringify(body),
-    signal,
-  });
-  const text = await res.text();
-  let json;
-  try {
-    json = JSON.parse(text);
-  } catch {
-    throw new Error("switchboard harness: " + method + " " + path + " answered " + res.status + " with a body that is not JSON");
-  }
-  if (!res.ok) {
-    throw new HarnessAnswerError(
-      "switchboard harness: " + method + " " + path + " answered " + res.status + ": " + (json.error || text),
-      res.status,
-    );
-  }
-  return json;
-}
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-/** The bot's verdict on one tool call. A verdict answers at once, and so does
- *  a refusal at the door \u2014 a 4xx: the bearer wrong, expired or revoked, the
- *  run not on the harness \u2014 since nothing later changes it. A bot that cannot
- *  be reached or is failing (a network error, a 5xx, a body that is not JSON)
- *  is asked again every two seconds until the wait is up, then the call is
- *  blocked naming why. */
-async function authorize(event) {
-  const started = Date.now();
-  let lastError = "";
-  for (;;) {
-    try {
-      return await call("POST", "/harness/authorize", {
-        toolCallId: event.toolCallId,
-        tool: event.toolName,
-        input: event.input,
-      });
-    } catch (err) {
-      lastError = err instanceof Error ? err.message : String(err);
-      const status = err instanceof HarnessAnswerError ? err.status : undefined;
-      if (status !== undefined && status >= 400 && status < 500) {
-        return { allow: false, reason: "authorization refused at the door: " + lastError };
-      }
-      if (Date.now() - started >= AUTHORIZE_WAIT_MS) {
-        return { allow: false, reason: "authorization unavailable: the bot did not answer for 90 s (" + lastError + ")" };
-      }
-      await sleep(AUTHORIZE_RETRY_MS);
-    }
-  }
-}
-
-function relayTool(def) {
-  return {
-    name: def.name,
-    label: def.name,
-    description: def.description,
-    parameters: def.inputSchema,
-    async execute(toolCallId, params, signal) {
-      const answer = await call("POST", "/harness/tool", { toolCallId, tool: def.name, input: params }, signal);
-      if (answer.isError) throw new Error(answer.content.map((c) => (c.type === "text" ? c.text : "")).join("\\n"));
-      return { content: answer.content, details: {} };
-    },
-  };
-}
-
-export default async function switchboardHarness(pi) {
-  const { tools } = await call("GET", "/harness/tools");
-  for (const def of tools) pi.registerTool(relayTool(def));
-  pi.on("tool_call", async (event) => {
-    const verdict = await authorize(event);
-    if (!verdict.allow) return { block: true, reason: verdict.reason };
-    return undefined;
-  });
-}
-`;
-  }
-});
-
 // ../../src/core/harness/pi/process.ts
+function piBuiltinToolsFor(identity2) {
+  return identity2 === "write" ? PI_BUILTIN_TOOLS : PI_READ_TOOLS;
+}
 function piThinkingLevel(effort2) {
   return effort2;
 }
@@ -29679,7 +30234,7 @@ function piLaunchArgs(spec) {
     "-e",
     spec.paths.extension,
     "--tools",
-    [...PI_BUILTIN_TOOLS, ...spec.relayTools].join(","),
+    [...piBuiltinToolsFor(spec.identity), ...spec.relayTools].join(","),
     "--provider",
     PROXY_PROVIDER,
     "--model",
@@ -29698,6 +30253,13 @@ function piLaunchEnv(spec, bearer) {
     PI_TELEMETRY: "0"
   };
 }
+function takesAdaptiveThinking(modelId) {
+  const version2 = /(?:^|-)(\d{1,2})(?:-(\d{1,2}))?(?=-|$)/.exec(modelId);
+  if (!version2) return true;
+  const major = Number(version2[1]);
+  const minor = version2[2] === void 0 ? 0 : Number(version2[2]);
+  return major > 4 || major === 4 && minor >= 6;
+}
 function piModelsJson(spec) {
   const anthropic = spec.model.providerType === "anthropic";
   const base = spec.harnessUrl.replace(/\/$/, "");
@@ -29713,6 +30275,7 @@ function piModelsJson(spec) {
               id: spec.model.id,
               name: spec.model.id,
               reasoning: true,
+              ...anthropic ? { compat: { forceAdaptiveThinking: takesAdaptiveThinking(spec.model.id) } } : {},
               input: ["text", "image"],
               contextWindow: 2e5,
               maxTokens: spec.model.maxTokens,
@@ -29726,17 +30289,18 @@ function piModelsJson(spec) {
     2
   ) + "\n";
 }
-function harnessPromptNote(relayTools) {
+function harnessPromptNote(relayTools, identity2) {
+  const write = identity2 === "write";
   return [
-    "HARNESS NOTE: this run's workspace tools are pi's own \u2014 `read`, `bash`, `edit`, `write`, `grep`, `find` and `ls`, all running in the worktree.",
-    "Where these instructions say `read_file` use `read`; where they say `write_file` use `write` (a whole file) or `edit` (a targeted change).",
+    write ? "HARNESS NOTE: this run's workspace tools are pi's own \u2014 `read`, `bash`, `edit`, `write`, `grep`, `find` and `ls`, all running in the worktree." : "HARNESS NOTE: this run's workspace tools are pi's own \u2014 `read`, `bash`, `grep`, `find` and `ls`, all running in the worktree; it has no `edit` and no `write`: the run is read-only, and a call to either is refused.",
+    write ? "Where these instructions say `read_file` use `read`; where they say `write_file` use `write` (a whole file) or `edit` (a targeted change)." : "Where these instructions say `read_file` use `read`.",
     relayTools.length > 0 ? `Every other tool named above is available under its own name: ${relayTools.map((t) => `\`${t}\``).join(", ")}.` : "No other tools are available in this run."
   ].join(" ");
 }
 function piSystemPrompt(spec) {
   return `${spec.system.trimEnd()}
 
-${harnessPromptNote(spec.relayTools)}
+${harnessPromptNote(spec.relayTools, spec.identity)}
 `;
 }
 function piSettingsJson() {
@@ -29750,7 +30314,7 @@ function piLaunchFiles(spec) {
     { path: spec.paths.extension, content: PI_EXTENSION_SOURCE }
   ];
 }
-var RUN_BEARER_ENV, HARNESS_URL_ENV, PROXY_PROVIDER, PI_BUILTIN_TOOLS;
+var RUN_BEARER_ENV, HARNESS_URL_ENV, PROXY_PROVIDER, PI_BUILTIN_TOOLS, PI_READ_TOOLS;
 var init_process = __esm({
   "../../src/core/harness/pi/process.ts"() {
     "use strict";
@@ -29759,23 +30323,7 @@ var init_process = __esm({
     HARNESS_URL_ENV = "SWITCHBOARD_HARNESS_URL";
     PROXY_PROVIDER = "switchboard";
     PI_BUILTIN_TOOLS = ["read", "bash", "edit", "write", "grep", "find", "ls"];
-  }
-});
-
-// ../../src/core/harness/pi/protocol.ts
-function parsePiLine(line3) {
-  try {
-    const value = JSON.parse(line3);
-    if (typeof value === "object" && value !== null && typeof value.type === "string") {
-      return value;
-    }
-  } catch {
-  }
-  return void 0;
-}
-var init_protocol = __esm({
-  "../../src/core/harness/pi/protocol.ts"() {
-    "use strict";
+    PI_READ_TOOLS = ["read", "bash", "grep", "find", "ls"];
   }
 });
 
@@ -29923,6 +30471,7 @@ async function runPiHarness(deps, run2) {
   let writeUp;
   let writeUpAt;
   let hardStopped = false;
+  let bypass;
   const toolsBlocked = () => {
     if (!writeUp) return void 0;
     if (writeUp.kind === "time")
@@ -29931,14 +30480,16 @@ async function runPiHarness(deps, run2) {
       return "the run has hit its turn guard: no more tool calls \u2014 write your final answer now";
     return "an operator asked this run to stop: no more tool calls \u2014 write your final answer now";
   };
+  const rules = { ...run2.rules, identity: run2.agent.identity };
   const live = {
     runId: run2.runId,
     tools: run2.tools,
     toolContext: run2.toolContext,
     ...run2.backend ? { backend: run2.backend } : {},
-    rules: run2.rules,
+    rules,
     emit,
     toolSpan: (callId) => bridge.openSpan(callId),
+    gateSaw: (callId) => bridge.gateSaw(callId),
     toolsBlocked
   };
   const forget = deps.registry.register(live);
@@ -29948,6 +30499,7 @@ async function runPiHarness(deps, run2) {
     model: { id: run2.model.id, providerType: run2.model.providerType, maxTokens: run2.agent.maxTokens },
     harnessUrl: deps.harnessUrl,
     ...run2.effort ? { effort: run2.effort } : {},
+    identity: run2.agent.identity,
     system: run2.system,
     relayTools: run2.tools.map((t) => t.name)
   };
@@ -30108,8 +30660,15 @@ async function runPiHarness(deps, run2) {
       if (next.done) break;
       const event = parsePiLine(next.value);
       if (!event) continue;
+      bridge.judgeGate = !catchingUp;
       const obs = bridge.observe(event);
       for (const reply of obs.replies) transport.send(reply);
+      if (obs.gateBypassed) {
+        bypass = new GateBypassed(obs.gateBypassed.tool, obs.gateBypassed.callId);
+        note("harness_error", `${bypass.message} \u2014 the run is stopped`);
+        transport.send({ type: "abort" });
+        break;
+      }
       if (obs.response) {
         const r = obs.response;
         if (r.id === "state" && r.success === true && typeof r.data?.sessionFile === "string") {
@@ -30140,6 +30699,7 @@ async function runPiHarness(deps, run2) {
       note("stopped", hardStopNote(), "hard");
       return HARD_STOP_MESSAGE;
     }
+    if (bypass) throw bypass;
     if (!settled) {
       const tail = await container.tail(paths.errLog, 2e3);
       throw new Error(`pi exited before the run settled${tail.trim() ? `: ${redactAndCap(tail.trim(), 400)}` : ""}`);
@@ -30152,15 +30712,17 @@ async function runPiHarness(deps, run2) {
     return text || "_(no response)_";
   } finally {
     transport?.close();
-    bridge.closeOpenSpans(hardStopped ? "the run was hard-stopped" : "the run ended");
+    bridge.closeOpenSpans(
+      hardStopped ? "the run was hard-stopped" : bypass ? "the run was stopped: a tool call bypassed the gate" : "the run ended"
+    );
     save();
     forget();
     if (pid !== void 0) await container.kill(pid).catch(() => {
     });
-    agentSpan?.end(hardStopped ? "error" : "ok");
+    agentSpan?.end(hardStopped || bypass ? "error" : "ok");
   }
 }
-var NATIVE_WORKSPACE_TOOLS, FINALE_TIMEOUT_MS2, CONTINUE_PROMPT, PromptRefused;
+var NATIVE_WORKSPACE_TOOLS, FINALE_TIMEOUT_MS2, CONTINUE_PROMPT, PromptRefused, GateBypassed;
 var init_harness = __esm({
   "../../src/core/harness/pi/harness.ts"() {
     "use strict";
@@ -30181,6 +30743,12 @@ var init_harness = __esm({
         this.name = "PromptRefused";
       }
     };
+    GateBypassed = class extends Error {
+      constructor(tool, callId) {
+        super(`the gate was bypassed: pi ran ${tool} (call ${callId}) without asking the bot`);
+        this.name = "GateBypassed";
+      }
+    };
   }
 });
 
@@ -30648,8 +31216,8 @@ var init_descriptionTurn = __esm({
 // ../../src/core/statusCardLabel.ts
 function quietSuffix(quietMs, inFlightTool) {
   if (quietMs <= QUIET_SUFFIX_AFTER_MS) return "";
-  const secs = Math.round(quietMs / 1e3);
-  return inFlightTool ? ` \u2014 running ${inFlightTool} (${secs}s)` : ` \u2014 thinking (${secs}s since last tool)`;
+  const secs2 = Math.round(quietMs / 1e3);
+  return inFlightTool ? ` \u2014 running ${inFlightTool} (${secs2}s)` : ` \u2014 thinking (${secs2}s since last tool)`;
 }
 function inFlightToolAfter(current, e) {
   if (e.type === "tool_call") return e.tool;
@@ -30701,6 +31269,7 @@ async function runLoop2(deps, ctx) {
     wait,
     parentRunId,
     coordinator,
+    seed,
     fixRound
   } = ctx;
   const agent = budgetedAgent(ctx.agent, profile);
@@ -30822,10 +31391,23 @@ async function runLoop2(deps, ctx) {
   let runDiagnosis;
   const releaseWorkspace = (span) => round2.release({ hardStopped: run2.control.requested === "hard", ...span ? { span } : {} });
   const attachFile = io.attachFile?.bind(io);
+  const uploadTicket = io.uploadTicket?.bind(io);
+  const nextStagedIndex = ctx.stagingIndex ?? stagingIndex();
+  let artifactSeq = 0;
+  const runUrl = runPageLink(run2.id);
+  const artifacts = deps.artifacts ? {
+    store: deps.artifacts,
+    runId: run2.id,
+    nextSeq: () => ++artifactSeq,
+    ...runUrl ? { runUrl } : {},
+    reply: (text) => io.reply(text)
+  } : void 0;
   const toolContext = {
     executor,
     reportProgress,
     ...attachFile ? { attach: attachFile } : {},
+    ...artifacts ? { artifacts } : {},
+    ...uploadTicket ? { uploadTicket } : {},
     web: webCapability(),
     skills: deps.skills,
     github: githubCapabilityFor(deps, msg.userId),
@@ -30927,6 +31509,23 @@ async function runLoop2(deps, ctx) {
         // operator stop from /runs
         inbox: admitted.inbox,
         // thread follow-ups steered into this run (thread-admission item 2)
+        // A steered follow-up's staged files (record 0033): copied into the
+        // store and pulled into this workspace before the model reads the turn.
+        ...deps.artifacts ? {
+          stageFollowUps: async (inputs) => {
+            const files = inputs.flatMap((i) => i.staged ?? []);
+            if (files.length === 0) return "";
+            const staged = await stageIntoWorkspace(files, {
+              store: deps.artifacts,
+              threadKey: msg.threadKey,
+              publish: (e) => registry.publish(run2.id, e),
+              nextIndex: nextStagedIndex,
+              executor,
+              resident: round2.selection.resident !== void 0
+            });
+            return staged.line;
+          }
+        } : {},
         // The step record before each step's tools (run-history item 35).
         ...ledgerRun ? { onStep: ledgerRun.step.bind(ledgerRun) } : {},
         // A resume re-enters the loop from the plan (run-history item 37).
@@ -31150,7 +31749,8 @@ async function runLoop2(deps, ctx) {
       ...dispositions !== void 0 ? { dispositions } : {},
       ...reviewPost !== void 0 ? { reviewPost } : {},
       ...parentRunId !== void 0 ? { parentRunId } : {},
-      ...coordinator !== void 0 ? { coordinator } : {}
+      ...coordinator !== void 0 ? { coordinator } : {},
+      ...seed !== void 0 ? { seed } : {}
     });
     if (runFailed)
       await root.span(
@@ -31209,6 +31809,7 @@ var init_runLoop = __esm({
     init_secrets2();
     init_record();
     init_reply();
+    init_staging();
     init_run2();
   }
 });
@@ -31675,7 +32276,7 @@ async function plan(deps, input) {
   try {
     planId = planIdOf(request.planPath);
   } catch (err2) {
-    return { ok: false, reply: `\u{1F6AB} ${describe3(err2)}` };
+    return { ok: false, reply: `\u{1F6AB} ${describe5(err2)}` };
   }
   let text;
   try {
@@ -31683,7 +32284,7 @@ async function plan(deps, input) {
   } catch (err2) {
     return {
       ok: false,
-      reply: `\u{1F6AB} The plan \`${request.planPath}\` could not be read at \`${base}\` in ${entry.repo}: ${describe3(err2)}`
+      reply: `\u{1F6AB} The plan \`${request.planPath}\` could not be read at \`${base}\` in ${entry.repo}: ${describe5(err2)}`
     };
   }
   const graph = parsePlanGraph(text, planId);
@@ -31696,7 +32297,7 @@ async function plan(deps, input) {
   try {
     selected = openPlanCursor(graph, request.units).order;
   } catch (err2) {
-    return { ok: false, reply: `\u{1F6AB} ${describe3(err2)}` };
+    return { ok: false, reply: `\u{1F6AB} ${describe5(err2)}` };
   }
   return { ok: true, planned: { kind: "plan", planId, path: request.planPath, base, graph, selected, identity: identity2 } };
 }
@@ -31812,7 +32413,7 @@ async function start(deps, input, instance, units, where, write) {
   try {
     answer = await deps.create(instance.id);
   } catch (err2) {
-    answer = { kind: "unanswered", reason: describe3(err2) };
+    answer = { kind: "unanswered", reason: describe5(err2) };
   }
   switch (answer.kind) {
     case "created": {
@@ -31834,7 +32435,7 @@ async function start(deps, input, instance, units, where, write) {
       );
   }
 }
-var refused3, describe3, RUNNING, ENDED;
+var refused3, describe5, RUNNING, ENDED;
 var init_handOff = __esm({
   "../../src/core/coordinator/handOff.ts"() {
     "use strict";
@@ -31842,7 +32443,7 @@ var init_handOff = __esm({
     init_coordinator();
     init_briefs();
     refused3 = (reply) => ({ status: "aborted", reply });
-    describe3 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+    describe5 = (err2) => err2 instanceof Error ? err2.message : String(err2);
     RUNNING = /* @__PURE__ */ new Set(["queued", "running", "paused", "waiting", "waitingForPause"]);
     ENDED = /* @__PURE__ */ new Set(["complete", "errored", "terminated"]);
   }
@@ -32533,22 +33134,22 @@ function createRunEnding(deps) {
       try {
         deps.registry.seal(id, replyOk === void 0 ? {} : { replyOk });
       } catch (err2) {
-        log(`[ending] seal ${id}: ${describe4(err2)}`);
+        log(`[ending] seal ${id}: ${describe6(err2)}`);
       }
       try {
         afterSeal?.();
       } catch (err2) {
-        log(`[ending] after seal ${id}: ${describe4(err2)}`);
+        log(`[ending] after seal ${id}: ${describe6(err2)}`);
       }
     }
     for (const entry of pending2.splice(0)) {
       try {
         const result = deps.registry.seal(entry.runId);
         void Promise.resolve(entry.write(result, entry.failedAfterFinish)).catch(
-          (err2) => log(`[ending] record ${entry.runId}: ${describe4(err2)}`)
+          (err2) => log(`[ending] record ${entry.runId}: ${describe6(err2)}`)
         );
       } catch (err2) {
-        log(`[ending] record ${entry.runId}: ${describe4(err2)}`);
+        log(`[ending] record ${entry.runId}: ${describe6(err2)}`);
       }
     }
   };
@@ -32558,7 +33159,7 @@ function createRunEnding(deps) {
       try {
         deps.onFinished?.(runId3);
       } catch (err2) {
-        log(`[ending] finished ${runId3}: ${describe4(err2)}`);
+        log(`[ending] finished ${runId3}: ${describe6(err2)}`);
       }
     },
     register(entry) {
@@ -32586,7 +33187,7 @@ function createRunEnding(deps) {
     }
   };
 }
-function describe4(err2) {
+function describe6(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
 }
 var init_runEnding = __esm({
@@ -32715,6 +33316,7 @@ async function dispatch(deps, msg, io, opts = {}) {
     if (outcome.kind === "redispatch")
       return dispatch(deps, msg, io, {
         ...opts.parent ? { parent: opts.parent } : {},
+        ...opts.seed ? { seed: opts.seed } : {},
         ...opts.coordinator ? { coordinator: opts.coordinator } : {}
       });
     if (outcome.kind !== "proceed") return ended;
@@ -32784,7 +33386,8 @@ async function dispatch(deps, msg, io, opts = {}) {
     }
     const contractBlock = opts.contract ? renderContract(opts.contract, { maxChars: DEFAULT_CONTRACT_MAX_CHARS }).text : void 0;
     const requestText = route3?.parts ? compoundBrief(directives.text, route3.parts) : directives.text;
-    const built = buildMessages(history, requestText, msg.images, msg.documents);
+    const seed = opts.seed ? "parent" : "channel";
+    const built = buildMessages(opts.seed ?? history, requestText, msg.images, msg.documents);
     const messages = resume ? resume.plan.messages : contractBlock !== void 0 && agent.name !== "review" ? withContractInFirstUserTurn(built, contractBlock) : built;
     const headPreflight = await authorizePrHead({
       msg,
@@ -32821,11 +33424,21 @@ async function dispatch(deps, msg, io, opts = {}) {
       admitted,
       parentRunId,
       coordinator,
+      seed,
+      ...opts.seed ? { seedTurns: opts.seed } : {},
       agentSource,
       ...routeEvent ? { route: routeEvent } : {}
     });
     const { run: run2, runId: runId3, channelVisibility, liveUrl, publishText, publishMeta } = registration;
     registered = run2;
+    const staged = !resume && deps.artifacts && msg.staged && msg.staged.length > 0 ? msg.staged : [];
+    const nextStagedIndex = stagingIndex();
+    const stagedCopies = staged.length > 0 && agent.machine !== "none" ? copyStaged(staged, {
+      store: deps.artifacts,
+      threadKey: msg.threadKey,
+      nextIndex: nextStagedIndex,
+      publish: (e) => registry.publish(runId3, e)
+    }) : void 0;
     const reservation = await reserveRun(deps, {
       msg,
       agent,
@@ -32843,7 +33456,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       admitted,
       root,
       parentRunId,
-      coordinator
+      coordinator,
+      seed
     });
     if (reservation) {
       reserved = reservation.reserved;
@@ -32873,6 +33487,22 @@ async function dispatch(deps, msg, io, opts = {}) {
       });
       return ended;
     }
+    if (staged.length > 0) {
+      const line3 = stagedCopies ? attachmentsLine(
+        await pullStaged(await stagedCopies, {
+          store: deps.artifacts,
+          executor,
+          resident: resident !== void 0
+        })
+      ) : noWorkspaceLine(staged);
+      const request = messages[messages.length - 1];
+      if (request && request.role === "user" && line3) {
+        request.content = Array.isArray(request.content) ? [...request.content, { type: "text", text: line3 }] : [
+          { type: "text", text: request.content },
+          { type: "text", text: line3 }
+        ];
+      }
+    }
     const bearer = mintRunBearer(deps, { runId: runId3, agent, profile, resolved, registry, root, clock: clock3 });
     const headGate = await authorizeAttachedHead(deps, {
       msg,
@@ -32937,7 +33567,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       registry,
       resume,
       parentRunId,
-      coordinator
+      coordinator,
+      seed
     });
     ledgerRun = await claimRun(deps, {
       msg,
@@ -32960,7 +33591,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       clock: clock3,
       root,
       parentRunId,
-      coordinator
+      coordinator,
+      seed
     });
     const { spawn: spawn7, runs, steer, wait } = runToolCapabilities(
       { core: deps, dispatch, registry, clock: clock3 },
@@ -32980,6 +33612,7 @@ async function dispatch(deps, msg, io, opts = {}) {
       agent,
       profile,
       resolved,
+      stagingIndex: nextStagedIndex,
       provider,
       model,
       messages,
@@ -33013,6 +33646,7 @@ async function dispatch(deps, msg, io, opts = {}) {
       wait,
       parentRunId,
       coordinator,
+      seed,
       ...opts.fixRound ? { fixRound: opts.fixRound } : {},
       ...bearer !== void 0 ? { bearer } : {}
     });
@@ -33128,6 +33762,7 @@ var init_dispatcher = __esm({
     init_route();
     init_authorize2();
     init_messages();
+    init_staging();
     init_provision();
     init_run2();
     init_runLoop();
@@ -33146,7 +33781,7 @@ var init_dispatcher = __esm({
 });
 
 // ../../src/core/runHistoryWriter.ts
-function describe5(err2) {
+function describe7(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
 }
 function createRunHistoryWriter(opts) {
@@ -33163,7 +33798,7 @@ function createRunHistoryWriter(opts) {
     try {
       opts.onPersisted?.(id);
     } catch (err2) {
-      opts.warn(`[run-history] onPersisted hook failed for ${id}: ${describe5(err2)}`);
+      opts.warn(`[run-history] onPersisted hook failed for ${id}: ${describe7(err2)}`);
     }
   };
   const attemptAll = async (record2, flag2, sink, span) => {
@@ -33186,12 +33821,12 @@ function createRunHistoryWriter(opts) {
         }
         if (err2 instanceof PermanentStoreError) {
           failures++;
-          opts.warn(`[run-history] ${record2.id} not persisted (permanent, not retried): ${describe5(err2)}`);
+          opts.warn(`[run-history] ${record2.id} not persisted (permanent, not retried): ${describe7(err2)}`);
           return;
         }
         if (attempt >= attempts) {
           failures++;
-          opts.warn(`[run-history] ${record2.id} not persisted after ${attempts} attempts: ${describe5(err2)}`);
+          opts.warn(`[run-history] ${record2.id} not persisted after ${attempts} attempts: ${describe7(err2)}`);
           return;
         }
         await sleep2(jittered(RUN_HISTORY_RETRY_DELAYS_MS[attempt - 1]));
@@ -33211,7 +33846,7 @@ function createRunHistoryWriter(opts) {
       }
       const p = attemptAll(record2, flag2, writeOpts?.via ?? opts.store, writeOpts?.span).catch((err2) => {
         failures++;
-        opts.warn(`[run-history] ${record2.id} writer failed unexpectedly: ${describe5(err2)}`);
+        opts.warn(`[run-history] ${record2.id} writer failed unexpectedly: ${describe7(err2)}`);
       }).finally(() => {
         if (flag2) provisionalFlags.delete(flag2);
         void inFlight.delete(p);
@@ -33605,7 +34240,7 @@ function createLedgerWriteThrough(opts) {
           return "untracked";
         }
         if (err2 instanceof PermanentStoreError || attempt >= claimAttempts) {
-          warn(`[ledger] ${req.threadKey} not tracked: claim failed after ${attempt} attempt(s): ${describe6(err2)}`);
+          warn(`[ledger] ${req.threadKey} not tracked: claim failed after ${attempt} attempt(s): ${describe8(err2)}`);
           return "untracked";
         }
         await sleep2(RETRY_MS[Math.min(attempt, RETRY_MS.length) - 1]);
@@ -33729,7 +34364,7 @@ function createLedgerWriteThrough(opts) {
         if (!recorded.ok) this.detach(`seed record refused (${recorded.reason})`);
         else this.seeded = true;
       } catch (err2) {
-        this.detach(`seed failed: ${describe6(err2)}`);
+        this.detach(`seed failed: ${describe8(err2)}`);
       }
     }
     async step(report2) {
@@ -33752,7 +34387,7 @@ function createLedgerWriteThrough(opts) {
           return;
         } catch (err2) {
           if (err2 instanceof RouteMissingError || err2 instanceof PermanentStoreError || attempt >= 2) {
-            this.detach(`step ${record2.step} failed: ${describe6(err2)}`);
+            this.detach(`step ${record2.step} failed: ${describe8(err2)}`);
             return;
           }
           await sleep2(RETRY_MS[0]);
@@ -33785,7 +34420,7 @@ function createLedgerWriteThrough(opts) {
         } catch (err2) {
           if (err2 instanceof RouteMissingError || err2 instanceof PermanentStoreError || attempt >= 2) {
             this.stateDirty = true;
-            warn(`[ledger] ${this.threadKey} state not written: ${describe6(err2)}`);
+            warn(`[ledger] ${this.threadKey} state not written: ${describe8(err2)}`);
             return;
           }
           await sleep2(RETRY_MS[0]);
@@ -33803,7 +34438,7 @@ function createLedgerWriteThrough(opts) {
         this.detach(`finishing refused (fenced)`);
         return "fenced";
       } catch (err2) {
-        warn(`[ledger] ${this.threadKey} finishing failed: ${describe6(err2)}`);
+        warn(`[ledger] ${this.threadKey} finishing failed: ${describe8(err2)}`);
         return "unavailable";
       }
     }
@@ -33818,7 +34453,7 @@ function createLedgerWriteThrough(opts) {
           warn(`[ledger] ${this.threadKey} abandon refused (fenced) \u2014 the row is another generation's`);
       } catch (err2) {
         warn(
-          `[ledger] ${this.threadKey} abandon failed: ${describe6(err2)} \u2014 the sweep will take the row once its lease lapses`
+          `[ledger] ${this.threadKey} abandon failed: ${describe8(err2)} \u2014 the sweep will take the row once its lease lapses`
         );
       }
     }
@@ -33839,7 +34474,7 @@ function createLedgerWriteThrough(opts) {
           this.onStop(result.stop);
         }
       } catch (err2) {
-        warn(`[ledger] ${this.threadKey} heartbeat failed: ${describe6(err2)}`);
+        warn(`[ledger] ${this.threadKey} heartbeat failed: ${describe8(err2)}`);
       }
     }
     stopHeartbeat() {
@@ -33906,7 +34541,7 @@ function createLedgerWriteThrough(opts) {
         warn(`[ledger] inbox push refused for run ${runId3}: no live row \u2014 the follow-up rides in memory only`);
         return void 0;
       } catch (err2) {
-        warn(`[ledger] inbox push failed for run ${runId3}: ${describe6(err2)} \u2014 the follow-up rides in memory only`);
+        warn(`[ledger] inbox push failed for run ${runId3}: ${describe8(err2)} \u2014 the follow-up rides in memory only`);
         return void 0;
       }
     },
@@ -33915,7 +34550,7 @@ function createLedgerWriteThrough(opts) {
         return await ledger.readInbox(runId3, afterSeq);
       } catch (err2) {
         warn(
-          err2 instanceof RouteMissingError ? `[ledger] state Worker has no inbox read route \u2014 run ${runId3} resumes with the reclaim's inbox snapshot only` : `[ledger] inbox read failed for run ${runId3}: ${describe6(err2)} \u2014 resuming with the reclaim's snapshot only`
+          err2 instanceof RouteMissingError ? `[ledger] state Worker has no inbox read route \u2014 run ${runId3} resumes with the reclaim's inbox snapshot only` : `[ledger] inbox read failed for run ${runId3}: ${describe8(err2)} \u2014 resuming with the reclaim's snapshot only`
         );
         return [];
       }
@@ -33932,12 +34567,12 @@ function createLedgerWriteThrough(opts) {
         for (const r of candidates) if (markedSet.has(r.runId)) r.markHandedOff();
         return { marked };
       } catch (err2) {
-        return { marked: [], failed: describe6(err2) };
+        return { marked: [], failed: describe8(err2) };
       }
     }
   };
 }
-var NullLedgerWriteThrough, NullLedgerRun, RETRY_MS, describe6;
+var NullLedgerWriteThrough, NullLedgerRun, RETRY_MS, describe8;
 var init_writeThrough = __esm({
   "../../src/core/runLedger/writeThrough.ts"() {
     "use strict";
@@ -34000,7 +34635,7 @@ var init_writeThrough = __esm({
       }
     };
     RETRY_MS = [200, 800];
-    describe6 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+    describe8 = (err2) => err2 instanceof Error ? err2.message : String(err2);
   }
 });
 
@@ -34092,6 +34727,24 @@ var init_residentFleet = __esm({
 });
 
 // ../../src/providers/openaiCompat.ts
+function buildOpenAIBody(req) {
+  const messages = [];
+  if (req.system) messages.push({ role: "system", content: req.system });
+  for (const m of req.messages) messages.push(...toOAIMessages(m));
+  const body = {
+    model: req.model,
+    max_tokens: req.maxTokens,
+    messages
+  };
+  if (req.tools && req.tools.length > 0) {
+    body.tools = req.tools.map((t) => ({
+      type: "function",
+      function: { name: t.name, description: t.description, parameters: t.inputSchema }
+    }));
+    if (req.toolChoice) body.tool_choice = { type: "function", function: { name: req.toolChoice.name } };
+  }
+  return body;
+}
 function toOAIMessages(m) {
   if (m.role === "assistant") {
     const text = m.content.filter((p) => p.type === "text").map((p) => p.text).join("\n");
@@ -34178,20 +34831,7 @@ var init_openaiCompat = __esm({
         this.apiKey = cfg.apiKeyEnv ? processSecrets.named(cfg.apiKeyEnv) : void 0;
       }
       async complete(req) {
-        const messages = [];
-        if (req.system) messages.push({ role: "system", content: req.system });
-        for (const m of req.messages) messages.push(...toOAIMessages(m));
-        const body = {
-          model: req.model,
-          max_tokens: req.maxTokens,
-          messages
-        };
-        if (req.tools && req.tools.length > 0) {
-          body.tools = req.tools.map((t) => ({
-            type: "function",
-            function: { name: t.name, description: t.description, parameters: t.inputSchema }
-          }));
-        }
+        const body = buildOpenAIBody(req);
         const res = await fetch(`${this.baseUrl}/chat/completions`, {
           method: "POST",
           headers: {
@@ -34683,6 +35323,7 @@ function classifyDocument(mimetype, name) {
 async function fetchImages(files, maxImages, maxTotalBytes = Infinity) {
   const images = [];
   const skipped = [];
+  const skippedFiles = [];
   let bytes = 0;
   const candidates = [];
   for (const f of files ?? []) {
@@ -34690,6 +35331,7 @@ async function fetchImages(files, maxImages, maxTotalBytes = Infinity) {
     const url = f.url_private_download ?? f.url_private;
     if (!url || !f.mimetype || !IMAGE_TYPES2.has(f.mimetype) || (f.size ?? 0) > MAX_IMAGE_BYTES || candidates.length >= maxImages) {
       skipped.push(label);
+      skippedFiles.push(f);
       continue;
     }
     candidates.push({ f, label, url, mediaType: f.mimetype });
@@ -34703,12 +35345,13 @@ async function fetchImages(files, maxImages, maxTotalBytes = Infinity) {
     const buf2 = downloads[i];
     if (!buf2 || buf2.byteLength > MAX_IMAGE_BYTES || bytes + buf2.byteLength > maxTotalBytes) {
       skipped.push(label);
+      skippedFiles.push(f);
       return;
     }
     bytes += buf2.byteLength;
     images.push({ mediaType, data: buf2.toString("base64"), name: f.name });
   });
-  return { images, skipped, bytes };
+  return { images, skipped, skippedFiles, bytes };
 }
 async function downloadSlackFile(url, label, isLoginPage) {
   const token2 = processSecrets.get("SLACK_BOT_TOKEN");
@@ -34727,6 +35370,7 @@ async function downloadSlackFile(url, label, isLoginPage) {
 async function fetchDocuments(files, maxDocs, maxTotalBytes = Infinity) {
   const documents = [];
   const skipped = [];
+  const skippedFiles = [];
   let bytes = 0;
   const candidates = [];
   for (const f of files ?? []) {
@@ -34735,6 +35379,7 @@ async function fetchDocuments(files, maxDocs, maxTotalBytes = Infinity) {
     const kind = classifyDocument(f.mimetype, f.name);
     if (!url || !kind || (f.size ?? 0) > MAX_DOCUMENT_BYTES || candidates.length >= maxDocs) {
       skipped.push(label);
+      skippedFiles.push(f);
       continue;
     }
     candidates.push({ f, label, url, kind });
@@ -34748,6 +35393,7 @@ async function fetchDocuments(files, maxDocs, maxTotalBytes = Infinity) {
     const buf2 = downloads[i];
     if (!buf2 || buf2.byteLength > MAX_DOCUMENT_BYTES || bytes + buf2.byteLength > maxTotalBytes) {
       skipped.push(label);
+      skippedFiles.push(f);
       return;
     }
     bytes += buf2.byteLength;
@@ -34757,9 +35403,43 @@ async function fetchDocuments(files, maxDocs, maxTotalBytes = Infinity) {
       name: f.name
     });
   });
-  return { documents, skipped, bytes };
+  return { documents, skipped, skippedFiles, bytes };
+}
+function stagedFiles(unsupported, opts) {
+  if (!opts.staging) return { staged: [], skipped: unsupported.map(fileLabel) };
+  const staged = [];
+  const skipped = [];
+  let total = 0;
+  for (const f of unsupported) {
+    const label = fileLabel(f);
+    const url = f.url_private_download ?? f.url_private;
+    const size = f.size ?? 0;
+    if (isSecretFile(f.name)) {
+      skipped.push(`${label} \u2014 looks like a credential or key file`);
+      continue;
+    }
+    if (!url || !f.name || size <= 0) {
+      skipped.push(`${label} \u2014 Slack gave no download URL, name or size`);
+      continue;
+    }
+    if (size > MAX_STAGED_FILE_BYTES) {
+      skipped.push(`${label} \u2014 ${size} bytes is over the ${MAX_STAGED_FILE_BYTES}-byte per-file ceiling`);
+      continue;
+    }
+    if (staged.length >= MAX_STAGED_PER_MESSAGE) {
+      skipped.push(`${label} \u2014 more than ${MAX_STAGED_PER_MESSAGE} files on one message`);
+      continue;
+    }
+    if (total + size > opts.maxBytesPerMessage) {
+      skipped.push(`${label} \u2014 the message's files exceed the ${opts.maxBytesPerMessage}-byte budget`);
+      continue;
+    }
+    total += size;
+    staged.push({ name: f.name, size, type: f.mimetype ?? "application/octet-stream", url, messageId: opts.messageId });
+  }
+  return { staged, skipped };
 }
-var IMAGE_TYPES2, MAX_IMAGE_BYTES, MAX_IMAGES_PER_MESSAGE, MAX_HISTORY_IMAGES, MAX_HISTORY_IMAGE_BYTES, PDF_TYPE2, TEXT_MIME_TYPES, GENERIC_MIME_TYPES, TEXT_EXTENSIONS, SECRET_FILE_EXTENSIONS, SECRET_FILE_PREFIXES, MAX_DOCUMENT_BYTES, MAX_DOCS_PER_MESSAGE, MAX_HISTORY_DOCS, MAX_HISTORY_DOCUMENT_BYTES, fileLabel;
+var IMAGE_TYPES2, MAX_IMAGE_BYTES, MAX_IMAGES_PER_MESSAGE, MAX_HISTORY_IMAGES, MAX_HISTORY_IMAGE_BYTES, PDF_TYPE2, TEXT_MIME_TYPES, GENERIC_MIME_TYPES, TEXT_EXTENSIONS, SECRET_FILE_EXTENSIONS, SECRET_FILE_PREFIXES, MAX_DOCUMENT_BYTES, MAX_DOCS_PER_MESSAGE, MAX_HISTORY_DOCS, MAX_HISTORY_DOCUMENT_BYTES, fileLabel, MAX_STAGED_FILE_BYTES, MAX_STAGED_PER_MESSAGE;
 var init_attachments = __esm({
   "../../src/channels/slack/attachments.ts"() {
     "use strict";
@@ -34842,6 +35522,8 @@ var init_attachments = __esm({
     MAX_HISTORY_DOCS = 20;
     MAX_HISTORY_DOCUMENT_BYTES = 32 * 1024 * 1024;
     fileLabel = (f) => `${f.name ?? f.id ?? "file"} (${f.mimetype ?? "unknown type"})`;
+    MAX_STAGED_FILE_BYTES = 1073741824;
+    MAX_STAGED_PER_MESSAGE = 10;
   }
 });
 
@@ -35480,7 +36162,13 @@ async function handle(deps, { client, statusClient }, ev) {
   const receivedAt = systemClock();
   const trace = startRequestRoot(deps, { channel: "slack", receivedAt, originAt: tsMs(ev.ts) });
   try {
-    const received = await trace.root.span("slack.receive", (span) => receiveSlackMessage(client, ev, span));
+    const received = await trace.root.span(
+      "slack.receive",
+      (span) => receiveSlackMessage(client, ev, span, {
+        staging: deps.artifacts !== void 0,
+        maxBytesPerMessage: deps.config.config.artifacts?.inbound?.maxBytesPerMessage ?? ARTIFACT_DEFAULTS.maxBytesPerMessage
+      })
+    );
     if (!received) {
       trace.root.end("ok", { status: "refused" });
       return;
@@ -35495,7 +36183,7 @@ async function handle(deps, { client, statusClient }, ev) {
     if (!trace.root.ended) trace.root.end("error", { status: "failed" });
   }
 }
-async function receiveSlackMessage(client, ev, span) {
+async function receiveSlackMessage(client, ev, span, policy) {
   const drop = await dedupeDelivery(client, ev);
   if (drop) {
     console.log(`[redelivery] ${ev.channel}:${ev.ts} dropped: ${drop}`);
@@ -35509,12 +36197,13 @@ async function receiveSlackMessage(client, ev, span) {
   const delayNote = ev.caughtUp ? new SlackIO(client, ev).reply(catchUpDelayNote(ev.ts, systemClock())).catch((err2) => {
     console.error(`[catch-up] ${ev.channel}:${ev.ts} delay note failed: ${err2.message}`);
   }) : Promise.resolve();
-  const [{ images, skipped: skippedImages }, { documents, skipped: skippedDocs }] = await Promise.all([
+  const [{ images, skippedFiles: imagePassSkipped }, { documents, skippedFiles: documentPassSkipped }] = await Promise.all([
     fetchImages(ev.files, MAX_IMAGES_PER_MESSAGE),
     fetchDocuments(ev.files, MAX_DOCS_PER_MESSAGE),
     delayNote
   ]);
-  const skipped = skippedImages.filter((s) => skippedDocs.includes(s));
+  const unsupported = imagePassSkipped.filter((f) => documentPassSkipped.includes(f));
+  const { staged, skipped } = stagedFiles(unsupported, { ...policy, messageId: ev.ts });
   const [channelName, userName, team] = await Promise.all([
     resolveChannelName(client, ev.channel),
     resolveUserName(client, ev.user),
@@ -35532,7 +36221,8 @@ async function receiveSlackMessage(client, ev, span) {
     userName,
     sourceUrl: team ? slackPermalink(team, ev.channel, ev.ts, ev.threadTs) : void 0,
     images: images.length > 0 ? images : void 0,
-    documents: documents.length > 0 ? documents : void 0
+    documents: documents.length > 0 ? documents : void 0,
+    ...staged.length > 0 ? { staged } : {}
   };
 }
 function resumeSlackIO(client, run2, opts = {}) {
@@ -35599,6 +36289,7 @@ var init_slack = __esm({
     init_statusCard();
     init_slackCatchUp();
     init_secrets2();
+    init_config();
     init_slackCatchUpStatus();
     init_slackSocketStatus();
     init_slackTriggers();
@@ -35664,6 +36355,30 @@ ${file.text}`));
           initial_comment: mdToMrkdwn(file.lead)
         });
       }
+      /** The external-upload flow (docs/reference/specs/slack-channel.md item 10,
+       *  record 0033): `files.getUploadURLExternal` mints a URL for exactly
+       *  `size` bytes under `name`; the run's container POSTs the file there; then
+       *  `complete` shares it into this thread with the lead as the comment
+       *  (`files.completeUploadExternal`). The bot never sees the bytes. A ticket
+       *  Slack answers without a URL or id is refused by name. */
+      async uploadTicket(file) {
+        const minted = await this.client.files.getUploadURLExternal({ filename: file.name, length: file.size });
+        const url = minted.upload_url;
+        const id = minted.file_id;
+        if (!url || !id)
+          throw new Error(`files.getUploadURLExternal answered without an upload_url and file_id for ${file.name}`);
+        return {
+          url,
+          complete: async (lead) => {
+            await this.client.files.completeUploadExternal({
+              files: [{ id, title: file.name }],
+              channel_id: this.ev.channel,
+              thread_ts: this.ev.threadTs,
+              initial_comment: mdToMrkdwn(lead)
+            });
+          }
+        };
+      }
       async post(mrkdwn) {
         for (const chunk of chunkText(mrkdwn, SLACK_MSG_LIMIT)) {
           await this.client.chat.postMessage({
@@ -36385,31 +37100,6 @@ var init_mcp3 = __esm({
   }
 });
 
-// ../../src/artifacts/contentType.ts
-var INLINE_IMAGE_TYPES;
-var init_contentType = __esm({
-  "../../src/artifacts/contentType.ts"() {
-    "use strict";
-    INLINE_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
-  }
-});
-
-// ../../src/artifacts/keys.ts
-function safeBasename(name) {
-  const segments2 = name.split(/[\\/]+/).filter((s) => s.length > 0);
-  const last = segments2[segments2.length - 1] ?? "";
-  const reduced = last.replace(SAFE, "_").replace(/\.{2,}/g, "_").replace(/_+/g, "_");
-  if (reduced === "" || /^[._-]+$/.test(reduced)) return "file";
-  return reduced;
-}
-var SAFE;
-var init_keys = __esm({
-  "../../src/artifacts/keys.ts"() {
-    "use strict";
-    SAFE = /[^A-Za-z0-9._-]+/g;
-  }
-});
-
 // ../../src/channels/scheduledPanel.ts
 function buildScheduledRows(schedules, firings, liveRuns, now) {
   const byName = /* @__PURE__ */ new Map();
@@ -37226,7 +37916,7 @@ var init_liveView = __esm({
 // ../../src/channels/webAssets.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync3 } from "node:fs";
 import { join as join13 } from "node:path";
-function contentTypeFor(path) {
+function contentTypeFor2(path) {
   const dot = path.lastIndexOf(".");
   return (dot === -1 ? void 0 : CONTENT_TYPES[path.slice(dot)]) ?? "application/octet-stream";
 }
@@ -37271,7 +37961,7 @@ function loadWebAssets(distDir) {
       return true;
     }
     res.writeHead(200, {
-      "content-type": contentTypeFor(path),
+      "content-type": contentTypeFor2(path),
       "content-length": String(body.byteLength),
       "cache-control": "public, max-age=31536000, immutable"
     });
@@ -38491,7 +39181,7 @@ async function reclaimRuns(opts) {
     reclaimed = await ledger.reclaim(gen, now(), LEASE_MS);
   } catch (err2) {
     warn(
-      err2 instanceof RouteMissingError ? "[reclaim] state Worker has no run-ledger routes \u2014 nothing to take over" : `[reclaim] reclaim failed: ${describe7(err2)} \u2014 runs the last generation left stay on the ledger until the next boot`
+      err2 instanceof RouteMissingError ? "[reclaim] state Worker has no run-ledger routes \u2014 nothing to take over" : `[reclaim] reclaim failed: ${describe9(err2)} \u2014 runs the last generation left stay on the ledger until the next boot`
     );
     return outcome;
   }
@@ -38558,8 +39248,8 @@ async function reclaimRuns(opts) {
         `[reclaim] ${row.runId} ${row.threadKey} closed ${status3} (from ${run2.reclaimedFrom}; ${why}; ${events.length} event(s))`
       );
     } catch (err2) {
-      outcome.failed.push({ runId: row.runId, error: describe7(err2) });
-      warn(`[reclaim] ${row.runId} ${row.threadKey}: ${describe7(err2)} \u2014 left on the ledger for the next boot`);
+      outcome.failed.push({ runId: row.runId, error: describe9(err2) });
+      warn(`[reclaim] ${row.runId} ${row.threadKey}: ${describe9(err2)} \u2014 left on the ledger for the next boot`);
     }
   }
   try {
@@ -38575,7 +39265,7 @@ async function reclaimRuns(opts) {
         });
     }
   } catch (err2) {
-    warn(`[reclaim] listing live runs failed: ${describe7(err2)} \u2014 the card sweep runs without the ledger's guard`);
+    warn(`[reclaim] listing live runs failed: ${describe9(err2)} \u2014 the card sweep runs without the ledger's guard`);
   }
   if (reclaimed.length > 0 || outcome.liveElsewhere.length > 0) {
     log(
@@ -38597,7 +39287,7 @@ function startReclaimSweep(opts) {
         await opts.onOutcome(outcome);
       }
     } catch (err2) {
-      warn(`[reclaim] sweep failed: ${describe7(err2)}`);
+      warn(`[reclaim] sweep failed: ${describe9(err2)}`);
     } finally {
       running = false;
     }
@@ -38622,7 +39312,7 @@ async function completenessVerdict(ledger, runId3, lastStep) {
   try {
     transcript = await ledger.readTranscript(runId3);
   } catch (err2) {
-    return { resumable: false, why: `transcript unreadable (${describe7(err2)})` };
+    return { resumable: false, why: `transcript unreadable (${describe9(err2)})` };
   }
   if (!transcript.complete) return { resumable: false, why: `transcript incomplete: ${transcript.gap}` };
   const verdict = transcriptCompleteness({
@@ -38643,7 +39333,7 @@ async function completenessVerdict(ledger, runId3, lastStep) {
       return { resumable: false, why: verdict.why };
   }
 }
-var TERMINAL, describe7;
+var TERMINAL, describe9;
 var init_boot = __esm({
   "../../src/core/boot.ts"() {
     "use strict";
@@ -38659,7 +39349,7 @@ var init_boot = __esm({
       "failed",
       "interrupted"
     ]);
-    describe7 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+    describe9 = (err2) => err2 instanceof Error ? err2.message : String(err2);
   }
 });
 
@@ -39495,11 +40185,14 @@ var init_adminModelProxy = __esm({
 
 // ../../src/core/harness/pi/toolRules.ts
 import { isAbsolute as isAbsolute5, relative, resolve as resolve11 } from "node:path";
+function reachFor(identity2) {
+  return identity2 === "write" ? CODING_REACH : READ_REACH;
+}
 function judgeToolCall(tool, input, ctx) {
   const bundle = PI_TOOL_BUNDLES[tool];
-  if (bundle === void 0) return outside(`${tool} is not in any bundle the coding preset reaches`);
-  if (!CODING_REACH.has(bundle)) {
-    return outside(`${tool} is the \`${bundle}\` bundle; the coding preset's reach does not include it`);
+  if (bundle === void 0) return outside(`${tool} is not in any bundle the ${ctx.identity} identity reaches`);
+  if (!reachFor(ctx.identity).has(bundle)) {
+    return outside(`${tool} is the \`${bundle}\` bundle, outside the ${ctx.identity} identity's reach`);
   }
   const args = isRecord5(input) ? input : {};
   if (tool === "bash") return judgeBash(args.command, ctx);
@@ -39514,6 +40207,13 @@ function judgeBash(command2, ctx) {
   if (MERGE_OR_APPROVE.test(command2)) {
     return refused4("merge/approve \u2014 a coding run never merges or approves a pull request");
   }
+  if (ctx.identity !== "write") {
+    if (ANY_PUSH.test(command2)) return refused4("read-only \u2014 a read-identity run never pushes");
+    if (GH_WRITE_VERB.test(command2) || GH_API_WRITE.test(command2) || CURL_GITHUB_WRITE.test(command2)) {
+      return refused4("read-only \u2014 a read-identity run never writes to GitHub");
+    }
+    return allowed;
+  }
   for (const match of command2.matchAll(GIT_PUSH)) {
     const verdict = judgePush(match[1], ctx);
     if (verdict.verdict !== "allowed") return verdict;
@@ -39549,7 +40249,7 @@ function judgePath(path, ctx) {
   if (rel.startsWith("..") || isAbsolute5(rel)) return refused4(`path \u2014 \`${path}\` resolves outside the checkout`);
   return allowed;
 }
-var PI_TOOL_BUNDLES, CODING_REACH, allowed, refused4, outside, isRecord5, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_PUSH;
+var PI_TOOL_BUNDLES, CODING_REACH, READ_REACH, allowed, refused4, outside, isRecord5, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_THEN_PUSH, GIT_PUSH, ANY_PUSH, GH_WRITE_VERB, WRITE_METHOD, GH_API_WRITE, CURL_GITHUB_WRITE;
 var init_toolRules = __esm({
   "../../src/core/harness/pi/toolRules.ts"() {
     "use strict";
@@ -39573,6 +40273,7 @@ var init_toolRules = __esm({
       "github-write",
       "pr"
     ]);
+    READ_REACH = /* @__PURE__ */ new Set(["shell", "files", "web", "search", "github-read", "verdict"]);
     allowed = { verdict: "allowed" };
     refused4 = (reason) => ({ verdict: "refused", reason });
     outside = (reason) => ({ verdict: "outside-profile", reason });
@@ -39581,7 +40282,17 @@ var init_toolRules = __esm({
     ENV_DUMP = /(^|[;&|(]\s*)((printenv|env)(\s+-[A-Za-z0-9-]+)*|export\s+-p|declare\s+-[a-zA-Z]*[px][a-zA-Z]*|set)\s*($|[|;&>)])|\/proc\/(self|\d+)\/environ|process\.env(?![.[\w])/;
     CREDENTIAL_VAR = /\$\{?[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b|printenv\s+[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b/;
     MERGE_OR_APPROVE = /\bgh\s+pr\s+(merge|review)\b|\/pulls\/\d+\/(merge|reviews)\b/;
-    GIT_PUSH = /\bgit\s+push\b([^;&|]*)/g;
+    GIT_THEN_PUSH = String.raw`\bgit(?:\s+(?:-C\s+\S+|--git-dir=\S+|--work-tree=\S+|-c\s+\S+|--no-pager))*\s+push\b`;
+    GIT_PUSH = new RegExp(`${GIT_THEN_PUSH}([^;&|]*)`, "g");
+    ANY_PUSH = new RegExp(GIT_THEN_PUSH);
+    GH_WRITE_VERB = /\bgh\s+(pr|issue)\s+(comment|create|edit|close|reopen|ready|lock|unlock|review|merge|delete|transfer|pin|unpin)\b/;
+    WRITE_METHOD = "(POST|post|PATCH|patch|PUT|put|DELETE|delete)";
+    GH_API_WRITE = new RegExp(
+      `\\bgh\\s+api\\b(?=[^;&|]*(?:\\s(?:-X|--method)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-f|-F|--field|--raw-field|--input)[\\s=]))`
+    );
+    CURL_GITHUB_WRITE = new RegExp(
+      `\\bcurl\\b(?=[^;&|]*api\\.github\\.com)(?=[^;&|]*(?:\\s(?:-X|--request)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-d|--data(?:-\\w+)?|--json|-T|--upload-file)[\\s=]))`
+    );
   }
 });
 
@@ -39590,6 +40301,7 @@ function relayedToolDefinitions(harness) {
   return harness.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema }));
 }
 function authorizeToolCall(harness, ask) {
+  harness.gateSaw(ask.toolCallId);
   const blocked = harness.toolsBlocked();
   const refuse3 = (reason) => {
     harness.emit({
@@ -40109,6 +40821,7 @@ function watched(io, on) {
   };
   if (io.attach) out.attach = (file) => io.attach(file);
   if (io.attachFile) out.attachFile = (file) => io.attachFile(file);
+  if (io.uploadTicket) out.uploadTicket = (file) => io.uploadTicket(file);
   if (io.runFinished) out.runFinished = (receipt) => io.runFinished(receipt);
   if (io.openThread) out.openThread = (lead) => io.openThread(lead);
   return out;
@@ -40140,8 +40853,8 @@ async function spawn6(body, deps) {
       const composed = await composeChild(req.brief, instance, unit.row, briefReaders(deps, instance, io));
       turn = composed;
     } catch (err2) {
-      log(`[coordinator] ${instance.id} ${req.step}: the brief could not be composed: ${describe8(err2)}`);
-      return json(502, { ok: false, error: "brief_failed", message: describe8(err2), at });
+      log(`[coordinator] ${instance.id} ${req.step}: the brief could not be composed: ${describe10(err2)}`);
+      return json(502, { ok: false, error: "brief_failed", message: describe10(err2), at });
     }
   } else {
     turn = { prompt: req.prompt };
@@ -40192,7 +40905,7 @@ async function spawn6(body, deps) {
   );
   void settled.then((end) => {
     if (end.kind === "threw")
-      log(`[coordinator] ${instance.id} ${req.step}: the child's dispatch threw: ${describe8(end.err)}`);
+      log(`[coordinator] ${instance.id} ${req.step}: the child's dispatch threw: ${describe10(end.err)}`);
   });
   const first = await Promise.race([started.then((id) => ({ kind: "started", id })), settled]);
   if (first.kind === "started" || startedId !== void 0) {
@@ -40200,7 +40913,7 @@ async function spawn6(body, deps) {
     log(`[coordinator] ${instance.id} ${req.step}: spawned ${req.preset} run ${runId3} in ${threadKey}`);
     return json(200, { ok: true, runId: runId3, threadKey, at });
   }
-  if (first.kind === "threw") return json(502, { ok: false, error: "spawn_failed", message: describe8(first.err), at });
+  if (first.kind === "threw") return json(502, { ok: false, error: "spawn_failed", message: describe10(first.err), at });
   const refusal = first.outcome.refusal;
   if (refusal === "coordinator_thread_live") {
     const now = await liveOnThread(deps.runs, instance, threadKey);
@@ -40353,7 +41066,7 @@ async function prCheck(body, deps) {
       at
     });
   } catch (err2) {
-    return json(502, { ok: false, error: "github_unavailable", message: describe8(err2), at });
+    return json(502, { ok: false, error: "github_unavailable", message: describe10(err2), at });
   }
 }
 async function plan2(body, deps) {
@@ -40412,7 +41125,7 @@ async function unitStart(body, deps) {
           ...opened.thread.sourceUrl !== void 0 ? { sourceUrl: opened.thread.sourceUrl } : {}
         };
       } catch (err2) {
-        return json(502, { ok: false, error: "thread_failed", message: describe8(err2), at });
+        return json(502, { ok: false, error: "thread_failed", message: describe10(err2), at });
       }
     }
   }
@@ -40454,7 +41167,7 @@ async function branch(body, deps) {
     await deps.createBranchRef(instance.repo, name, base);
     return json(200, { ok: true, branch: name, base, at });
   } catch (err2) {
-    return json(200, { ok: false, reason: describe8(err2), at });
+    return json(200, { ok: false, reason: describe10(err2), at });
   }
 }
 function unitLines(units) {
@@ -40506,7 +41219,7 @@ async function round(body, deps) {
     instance,
     units.map((u) => u.unit === updated.unit ? updated : u)
   ).catch(
-    (err2) => (deps.log ?? console.warn)(`[coordinator] ${instance.id}: the card could not be redrawn: ${describe8(err2)}`)
+    (err2) => (deps.log ?? console.warn)(`[coordinator] ${instance.id}: the card could not be redrawn: ${describe10(err2)}`)
   );
   return json(200, { ok: true, at });
 }
@@ -40540,7 +41253,7 @@ async function unitEnd(body, deps) {
       told = true;
     } catch (err2) {
       (deps.log ?? console.warn)(
-        `[coordinator] ${instance.id} ${row.unit}: the report could not be posted: ${describe8(err2)}`
+        `[coordinator] ${instance.id} ${row.unit}: the report could not be posted: ${describe10(err2)}`
       );
     }
   }
@@ -40554,7 +41267,7 @@ ${ending.report}` + (rendered !== void 0 ? `
 ${rendered}` : "");
     await deps.github.commentIssue(instance.repo, row.issue, comment).catch(
       (err2) => (deps.log ?? console.warn)(
-        `[coordinator] ${instance.id} ${row.unit}: the board comment could not be posted: ${describe8(err2)}`
+        `[coordinator] ${instance.id} ${row.unit}: the board comment could not be posted: ${describe10(err2)}`
       )
     );
   }
@@ -40609,7 +41322,7 @@ async function merge(body, deps, subject2) {
   try {
     facts2 = await deps.fetchPrFacts(pr);
   } catch (err2) {
-    return json(502, { ok: false, error: "github_unavailable", message: describe8(err2), at });
+    return json(502, { ok: false, error: "github_unavailable", message: describe10(err2), at });
   }
   if (facts2 === void 0)
     return json(502, { ok: false, error: "github_unavailable", message: `${where} could not be read`, at });
@@ -40661,7 +41374,7 @@ async function merge(body, deps, subject2) {
       title: facts2.title ?? `Merge pull request #${pr.number}`
     });
   } catch (err2) {
-    return json(502, { ok: false, error: "github_unavailable", message: describe8(err2), at });
+    return json(502, { ok: false, error: "github_unavailable", message: describe10(err2), at });
   }
   if (!merged.ok) {
     log(
@@ -40836,13 +41549,13 @@ function createAdminCoordinatorHandler(deps) {
         }
         write(res, await answerCoordinatorStep(door, read.body, deps));
       } catch (err2) {
-        (deps.log ?? console.error)(`[coordinator] ${describe8(err2)}`);
+        (deps.log ?? console.error)(`[coordinator] ${describe10(err2)}`);
         write(res, json(500, { ok: false, error: "internal error" }));
       }
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json, describe8, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json, describe10, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -40875,7 +41588,7 @@ var init_adminCoordinator = __esm({
     };
     invalid = (error) => ({ ok: false, error });
     json = (status3, body) => ({ status: status3, body });
-    describe8 = (err2) => err2 instanceof Error ? err2.message : String(err2);
+    describe10 = (err2) => err2 instanceof Error ? err2.message : String(err2);
     EVERY_RUN = { kind: "all" };
     REVIEW_POSTED_CHECKS = 3;
     REVIEW_POSTED_RECHECK_MS = 2e3;