@elisym/cli 0.31.0 → 0.33.0

package/dist/index.js

@@ -1,20 +1,20 @@
 #!/usr/bin/env -S node --no-deprecation
 import { ReadableStream } from 'node:stream/web';
-import { readFileSync, existsSync, readdirSync, statSync, renameSync, chmodSync, mkdirSync, writeFileSync, appendFileSync, unlinkSync, rmdirSync, realpathSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync, realpathSync, renameSync, chmodSync, mkdirSync, writeFileSync, unlinkSync, appendFileSync, rmdirSync } from 'node:fs';
 import { dirname, join, resolve, basename, extname, relative, sep } from 'node:path';
-import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
-import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, readMediaCache, loadPoliciesFromDir, ensureGitignoreHasIrohEntry, ensureGitignoreHasX402Entries, ensureGitignoreHasSessionsEntry, ensureGitignoreHasDelegationNoncesEntry, readAgentPublic, lookupCachedUrl, newCacheEntry, writeMediaCache } from '@elisym/sdk/agent-store';
+import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, deleteControlCharacters, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, flattenForComparison, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, excerptUntrusted, isScriptBillingExhaustedError, excerptUntrustedTail, scriptOutput, isScriptExecutionError, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, isLlmHealthError, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, clipToCodeUnits, degenerateReference, PROVIDER_REFUSED_PREFIX, PROVIDER_FAILED_MESSAGE, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
+import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, ensureGitignoreHasX402Entries, readMediaCache, ensureGitignoreHasPrivateStateEntries, loadPoliciesFromDir, ensureGitignoreHasDelegationNoncesEntry, ensureGitignoreHasIrohEntry, ensureGitignoreHasSessionsEntry, readAgentPublic, isBlockingNodeSync, AgentNameSchema, lookupCachedUrl, newCacheEntry, isBlockingNode, writeMediaCache } from '@elisym/sdk/agent-store';
 import { isAddress, createSolanaRpc, address, signature } from '@solana/kit';
 import { generateSecretKey, getPublicKey, nip19, verifyEvent } from 'nostr-tools';
 import YAML2 from 'yaml';
 import { Command } from 'commander';
-import { mkdir, writeFile, readFile, mkdtemp, rm, rename, stat } from 'node:fs/promises';
-import { parseSkillMd, validateSkillFrontmatter, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
+import { parseSkillMd, validateSkillFrontmatter, isHostScratchError, isScriptRefusalError, startsWithRefusalHint, HostScratchError, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, loadSkillsFromDir, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
+import { mkdtemp, writeFile, rm, readFile, mkdir, chmod, rename, readdir, stat } from 'node:fs/promises';
 import chalk from 'chalk';
 import Decimal from 'decimal.js-light';
 import { decodePaymentRequiredHeader } from '@x402/core/http';
-import { createHash } from 'node:crypto';
-import { LlmHealthMonitor, startLlmRecovery, createFreeLlmLimiterSet, ScriptBillingExhaustedError, ScriptExecutionError, FREE_LLM_GLOBAL_KEY, freeLlmCustomerKey, LlmHealthError } from '@elisym/sdk/llm-health';
+import { createHash, randomBytes } from 'node:crypto';
+import { LlmHealthMonitor, startLlmRecovery, createFreeLlmLimiterSet, FREE_LLM_GLOBAL_KEY, freeLlmCustomerKey } from '@elisym/sdk/llm-health';
 import { createIrohTransport } from '@elisym/sdk/node';
 import { lookup } from 'node:dns/promises';
 import { Socket } from 'node:net';
@@ -1553,6 +1553,129 @@ function formatSplBalanceValue(asset, balance) {
 async function fetchUsdcBalance(rpc, owner, network) {
   return fetchSplBalance(rpc, owner, resolveUsdcAsset(network));
 }
+async function findSharedPayoutNeighbors(cwd, ownDir, network, payoutAddress) {
+  let ownReal;
+  try {
+    ownReal = realpathSync(ownDir);
+  } catch {
+    return [];
+  }
+  const listed = await listAgents(cwd);
+  const candidates = [];
+  for (const agent of listed) {
+    candidates.push({ name: agent.name, dir: agent.dir, source: agent.source });
+    if (agent.shadowsGlobal) {
+      const homeDir = resolveInHome(agent.name);
+      if (homeDir !== null) {
+        candidates.push({ name: agent.name, dir: homeDir, source: "home" });
+      }
+    }
+  }
+  const neighbors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    if (!AgentNameSchema.safeParse(candidate.name).success) {
+      continue;
+    }
+    let candidateReal;
+    try {
+      candidateReal = realpathSync(candidate.dir);
+    } catch {
+      continue;
+    }
+    if (candidateReal === ownReal || seen.has(candidateReal)) {
+      continue;
+    }
+    seen.add(candidateReal);
+    let neighborAddress;
+    let neighborNetwork;
+    try {
+      const { yaml } = await readAgentPublic({
+        name: candidate.name,
+        dir: candidate.dir,
+        source: candidate.source,
+        shadowsGlobal: false
+      });
+      const solana = yaml.payments.find((entry) => entry.chain === "solana");
+      neighborAddress = solana?.address;
+      neighborNetwork = solana?.network;
+    } catch {
+      continue;
+    }
+    if (neighborAddress !== payoutAddress || neighborNetwork !== network) {
+      continue;
+    }
+    const paid = await neighborPaidState(candidate.dir, network);
+    if (paid === false) {
+      continue;
+    }
+    neighbors.push({
+      name: candidate.name,
+      // Sanitized, and newlines collapsed SEPARATELY: the sanitizer deletes
+      // every C0/C1 control except tab and newline, and a newline in a POSIX
+      // path is legal - left alone it would break the banner across lines. Two
+      // different defenses, and neither substitutes for the other: the name is
+      // checked by a pattern that admits nothing the sanitizer touches, while
+      // the path carries an operator's project root that nobody validates.
+      // `\s+` would be wrong here - it would eat the legitimate double spaces
+      // and tabs a real path can carry, and the printed path would stop
+      // matching the one on disk.
+      dir: deleteControlCharacters(candidate.dir).replace(/\n+/g, " "),
+      paid
+    });
+  }
+  return neighbors;
+}
+async function neighborPaidState(neighborDir, network) {
+  const skillsDir = agentPaths(neighborDir).skills;
+  let entries;
+  try {
+    entries = readdirSync(skillsDir);
+  } catch (error) {
+    return error.code === "ENOENT" ? false : "unknown";
+  }
+  let denominator = 0;
+  let sawLess = false;
+  for (const entry of entries) {
+    const entryPath = join(skillsDir, entry);
+    try {
+      if (!statSync(entryPath).isDirectory()) {
+        continue;
+      }
+    } catch {
+      sawLess = true;
+      continue;
+    }
+    const skillMd = join(entryPath, "SKILL.md");
+    try {
+      if (isBlockingNodeSync(skillMd)) {
+        return "unknown";
+      }
+      readFileSync(skillMd, "utf-8");
+      denominator += 1;
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        sawLess = true;
+      }
+    }
+  }
+  let skills;
+  try {
+    skills = loadSkillsFromDir(skillsDir, {
+      network,
+      allowFreeSkills: true,
+      allowX402Skills: true,
+      logger: { warn: () => {
+      } }
+    });
+  } catch {
+    return "unknown";
+  }
+  if (skills.some((skill) => skill.priceSubunits > 0n)) {
+    return true;
+  }
+  return sawLess || skills.length < denominator ? "unknown" : false;
+}
 
 // src/x402/constants.ts
 var X402_SOLANA_DEVNET_CAIP2 = "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1";
@@ -1787,13 +1910,10 @@ function fail(message) {
 `);
   process.exit(1);
 }
+var CONTROL_CHARACTERS = /\p{Cc}/gu;
+var UNSEEN_CHARACTERS = /[\p{Cf}\p{Default_Ignorable_Code_Point}\uFFFD]/gu;
 function sanitizeUpstreamText(raw, maxLength) {
-  let withoutControls = "";
-  for (const char of raw) {
-    const code = char.codePointAt(0) ?? 0;
-    withoutControls += code < 32 || code === 127 ? " " : char;
-  }
-  return withoutControls.replace(/—/g, "-").replace(/\s+/g, " ").trim().slice(0, maxLength).trim();
+  return raw.normalize("NFKC").replace(CONTROL_CHARACTERS, " ").replace(UNSEEN_CHARACTERS, "").replace(/—/g, "-").replace(/\s+/g, " ").trim().slice(0, maxLength).trim();
 }
 function slugFromUrl(url) {
   const pathPart = url.pathname.replace(/\/+$/, "").split("/").filter(Boolean).pop() ?? "";
@@ -1892,6 +2012,12 @@ function scanExistingSkills(skillsDir, candidateDTag, url) {
       if (!statSync(join(skillsDir, entry)).isDirectory()) {
         continue;
       }
+      if (isBlockingNodeSync(skillMdPath)) {
+        console.warn(
+          `  ! Could not check ${skillMdPath} for a name collision: it is a pipe, socket or device, not a file`
+        );
+        continue;
+      }
       const { frontmatter } = parseSkillMd(readFileSync(skillMdPath, "utf-8"));
       if (typeof frontmatter.name !== "string") {
         continue;
@@ -1928,6 +2054,16 @@ function describeUnacceptableAccepts(probe, agentNetwork) {
   }
   return `no exact-scheme ${agentNetwork}-USDC requirement found (service accepts: ${networks.join(", ") || "nothing parseable"})`;
 }
+async function writeSkillMdRefusingBlockingNode(targetDir, content) {
+  await mkdir(targetDir, { recursive: true, mode: 448 });
+  await chmod(targetDir, 448).catch(() => void 0);
+  const skillMdPath = join(targetDir, "SKILL.md");
+  if (isBlockingNodeSync(skillMdPath)) {
+    throw new Error(`Refusing to write ${skillMdPath}: it is a pipe, socket or device, not a file`);
+  }
+  await writeFile(skillMdPath, content, "utf-8");
+  return skillMdPath;
+}
 async function cmdX402Add(url, agentName, options) {
   const cwd = process.cwd();
   const { default: inquirer } = await import('inquirer');
@@ -2242,8 +2378,7 @@ async function cmdX402Add(url, agentName, options) {
     allowFreeSkills: false,
     allowX402Skills: true
   });
-  await mkdir(targetDir, { recursive: true });
-  await writeFile(join(targetDir, "SKILL.md"), content, "utf-8");
+  await writeSkillMdRefusingBlockingNode(targetDir, content);
   await ensureGitignoreHasX402Entries(dirname(loaded.dir));
   console.log(`
   Wrote ${join(targetDir, "SKILL.md")}`);
@@ -3279,6 +3414,9 @@ async function probeRelays(relays, logger, timeoutMs = TCP_PROBE_TIMEOUT_MS) {
 }
 var LEDGER_DIR_MODE = 448;
 var LEDGER_FILE_MODE = 384;
+function isUsableSignature(value) {
+  return typeof value === "string" && value.length > 0;
+}
 var VALID_TRANSITIONS = {
   paid: ["executed", "failed"],
   executed: ["delivered", "failed"],
@@ -3286,6 +3424,30 @@ var VALID_TRANSITIONS = {
   failed: []
 };
 var MAX_DOUBLE_SETTLE_WARNINGS = 20;
+var STRANDED_TEMP_MIN_AGE_MS = 60 * 60 * 1e3;
+function sweepStrandedTemporaries(path) {
+  const legacyName = `${basename(path)}.tmp`;
+  const prefix = `${legacyName}.`;
+  const cutoff = Date.now() - STRANDED_TEMP_MIN_AGE_MS;
+  let names;
+  try {
+    names = readdirSync(dirname(path));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (name !== legacyName && !name.startsWith(prefix)) {
+      continue;
+    }
+    const candidate = join(dirname(path), name);
+    try {
+      if (statSync(candidate).mtimeMs < cutoff) {
+        unlinkSync(candidate);
+      }
+    } catch {
+    }
+  }
+}
 var JobLedger = class {
   entries = /* @__PURE__ */ new Map();
   /**
@@ -3303,8 +3465,14 @@ var JobLedger = class {
   constructor(ledgerPath) {
     this.path = ledgerPath;
     this.load();
+    sweepStrandedTemporaries(this.path);
   }
   load() {
+    if (isBlockingNodeSync(this.path)) {
+      throw new Error(
+        `Refusing to read the job ledger at ${this.path}: it is a pipe, socket or device, not a file. An empty ledger would drop the record of which transaction paid for which job.`
+      );
+    }
     try {
       const raw = readFileSync(this.path, "utf-8");
       const data = JSON.parse(raw);
@@ -3327,6 +3495,11 @@ var JobLedger = class {
         );
       }
     } catch (e) {
+      if (typeof e?.code === "string" && e.code !== "ENOENT") {
+        throw new Error(
+          `Refusing to start on a job ledger that cannot be read (${e.code}) at ${this.path}. An empty ledger would drop the record of which transaction paid for which job. Check the file's owner and mode (a ledger written under sudo needs a chown).`
+        );
+      }
       if (e?.code !== "ENOENT") {
         console.warn(`  ! Ledger load warning: ${e?.message ?? "unknown error"}`);
         try {
@@ -3343,10 +3516,18 @@ var JobLedger = class {
     const dir = dirname(this.path);
     mkdirSync(dir, { recursive: true, mode: LEDGER_DIR_MODE });
     const obj = Object.fromEntries(this.entries);
-    const tmp = this.path + ".tmp";
-    writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: LEDGER_FILE_MODE });
-    chmodSync(tmp, LEDGER_FILE_MODE);
-    renameSync(tmp, this.path);
+    const tmp = `${this.path}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: LEDGER_FILE_MODE });
+      chmodSync(tmp, LEDGER_FILE_MODE);
+      renameSync(tmp, this.path);
+    } catch (error) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      throw error;
+    }
   }
   recordPaid(entry) {
     if (this.entries.has(entry.job_id)) {
@@ -3414,7 +3595,7 @@ var JobLedger = class {
     let suppressed = 0;
     for (const entry of this.entries.values()) {
       const paymentSignature = entry.payment_signature;
-      if (typeof paymentSignature !== "string" || paymentSignature.length === 0) {
+      if (!isUsableSignature(paymentSignature)) {
         continue;
       }
       const owner = this.paymentSignatureOwners.get(paymentSignature);
@@ -3484,6 +3665,9 @@ var JobLedger = class {
    * this job - refusing the owner its own settlement until the next restart.
    */
   claimPaymentSignature(paymentSignature, jobId) {
+    if (!isUsableSignature(paymentSignature)) {
+      return "unknown-job";
+    }
     const entry = this.entries.get(jobId);
     if (entry === void 0) {
       return "unknown-job";
@@ -3603,7 +3787,7 @@ var JobLedger = class {
     for (const [id, entry] of this.entries) {
       if ((entry.status === "delivered" || entry.status === "failed") && entry.created_at < cutoff) {
         this.entries.delete(id);
-        if (typeof entry.payment_signature === "string" && entry.payment_signature.length > 0) {
+        if (isUsableSignature(entry.payment_signature)) {
           prunedSignatures.add(entry.payment_signature);
         }
         deleted += 1;
@@ -3651,8 +3835,14 @@ var UsedNonceStore = class {
     this.path = noncePath;
     this.maxEntries = maxEntries;
     this.load();
+    sweepStrandedTemporaries(this.path);
   }
   load() {
+    if (isBlockingNodeSync(this.path)) {
+      throw new Error(
+        `Refusing to read the nonce store at ${this.path}: it is a pipe, socket or device, not a file. An empty store would let a delegated pull be replayed.`
+      );
+    }
     try {
       const raw = readFileSync(this.path, "utf-8");
       const data = JSON.parse(raw);
@@ -3662,6 +3852,11 @@ var UsedNonceStore = class {
         }
       }
     } catch (e) {
+      if (typeof e?.code === "string" && e.code !== "ENOENT") {
+        throw new Error(
+          `Refusing to start on a nonce store that cannot be read (${e.code}) at ${this.path}. An empty store would let a delegated pull be replayed. Check the file's owner and mode (a store written under sudo needs a chown).`
+        );
+      }
       if (e?.code !== "ENOENT") {
         console.warn(`  ! Nonce store load warning: ${e?.message ?? "unknown error"}`);
         try {
@@ -3677,9 +3872,17 @@ var UsedNonceStore = class {
     const dir = dirname(this.path);
     mkdirSync(dir, { recursive: true, mode: LEDGER_DIR_MODE });
     const obj = Object.fromEntries(this.entries);
-    const tmp = this.path + ".tmp";
-    writeFileSync(tmp, JSON.stringify(obj), { mode: LEDGER_FILE_MODE });
-    renameSync(tmp, this.path);
+    const tmp = `${this.path}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      writeFileSync(tmp, JSON.stringify(obj), { mode: LEDGER_FILE_MODE });
+      renameSync(tmp, this.path);
+    } catch (error) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      throw error;
+    }
     chmodSync(this.path, LEDGER_FILE_MODE);
   }
   has(key) {
@@ -3804,9 +4007,6 @@ function resolveProviderApiKey(input) {
     error: `Provider "${provider}" needs an API key (required by skill(s): ${skillList}). Set secrets.llm_api_keys.${provider} via 'npx @elisym/cli profile <agent>' or export ${descriptor.envVar}.`
   };
 }
-function sanitizeForTerminal(value) {
-  return value.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "");
-}
 function resolveLevel(options) {
   if (options.level) {
     return options.level;
@@ -3845,7 +4045,7 @@ function createLogger(options = {}) {
     logger = pino(baseOptions, pino.destination(2));
   }
   function logWithIndent(line) {
-    process.stdout.write(`  ${sanitizeForTerminal(line)}
+    process.stdout.write(`  ${deleteControlCharacters(line)}
 `);
   }
   return {
@@ -3866,6 +4066,43 @@ var MIME_BY_EXT = {
 function mimeFromPath(path) {
   return MIME_BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
+var IMAGE_EXTENSIONS = Object.keys(MIME_BY_EXT);
+function isImagePath(path) {
+  return Object.hasOwn(MIME_BY_EXT, extname(path).toLowerCase());
+}
+
+// src/rpc-redact.ts
+var PUBLIC_SOLANA_RPC_HOSTS = /* @__PURE__ */ new Set([
+  "api.devnet.solana.com",
+  "api.mainnet-beta.solana.com",
+  "api.testnet.solana.com"
+]);
+function stripRpcSecrets(raw) {
+  try {
+    const parsed = new URL(raw);
+    parsed.username = "";
+    parsed.password = "";
+    if (!PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname)) {
+      return `${parsed.protocol}//${parsed.host}/***`;
+    }
+    const marker = parsed.search.length > 0 ? "?***" : "";
+    parsed.search = "";
+    return `${parsed.toString()}${marker}`;
+  } catch {
+    return "[unparseable RPC URL]";
+  }
+}
+function isPublicSolanaRpcUrl(raw) {
+  try {
+    const parsed = new URL(raw);
+    return PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname) && !parsed.username && !parsed.password && !parsed.search && (parsed.pathname === "" || parsed.pathname === "/");
+  } catch {
+    return false;
+  }
+}
+function redactRpcUrlsInText(text) {
+  return text.replace(/https?:\/\/[^\s)'"]+/g, (url) => stripRpcSecrets(url));
+}
 var REFERENCE_SCAN_WINDOW = DEFAULTS.VERIFY_SIGNATURE_LIMIT;
 var REFERENCE_SCAN_LIST_ATTEMPTS = 3;
 var REFERENCE_SCAN_LIST_RETRY_DELAY_MS = 400;
@@ -4250,7 +4487,7 @@ var PaymentRecovery = class {
    * An error is never "the customer did not pay" - the caller keeps the job
    * recoverable.
    */
-  async listReferenceCandidates(reference, rpc, deadline) {
+  async listReferenceCandidates(reference, rpc, pastDeadline) {
     let lastMessage = "unknown error";
     let attempts = 0;
     for (let attempt = 0; attempt < REFERENCE_SCAN_LIST_ATTEMPTS; attempt++) {
@@ -4266,7 +4503,7 @@ var PaymentRecovery = class {
         };
       } catch (e) {
         lastMessage = e?.message ?? "unknown error";
-        if (Date.now() >= deadline) {
+        if (pastDeadline()) {
           break;
         }
         if (attempt < REFERENCE_SCAN_LIST_ATTEMPTS - 1) {
@@ -4306,7 +4543,9 @@ var PaymentRecovery = class {
    * the SDK default of 10 retries x 3s x a full window - over ten minutes for
    * one deferred entry.
    *
-   * TERMINAL ("none") REQUIRES ALL THREE, and the caller adds two more:
+   * TERMINAL ("none") REQUIRES ALL FOUR OF THESE, and the caller adds four more
+   * on top (they are counted as six in the docs, where 2-4 below are read as one
+   * condition - "nothing was skipped and nothing was left unverified"):
    *   1. the listing SUCCEEDED and came back SHORT of the window, so this is the
    *      reference's whole history rather than a truncated page. A flood that
    *      fills the window could be hiding the payment behind it, which is
@@ -4318,26 +4557,40 @@ var PaymentRecovery = class {
    *      evidence of non-payment;
    *   3. no candidate was SKIPPED for belonging to another job. A skip means
    *      something did touch this reference and we chose not to look at it, so
-   *      the scan saw less than the whole truth.
-   * The caller then requires the payment request's own expiry to have passed and
-   * a second consecutive sighting. Anything else is inconclusive: a false
-   * deferral costs latency, a false "unpaid" destroys the customer's money.
+   *      the scan saw less than the whole truth;
+   *   4. no candidate was SKIPPED for an unusable signature. Same reasoning as
+   *      3, with the node rather than the ledger as the reason we did not look:
+   *      a blanked signature is still a transaction on this reference.
+   * The caller then requires, in this order: that the job owns no settlement of
+   * its own, that the payment request's own expiry has passed, that the endpoint
+   * proved its cluster and that it serves address history, and - one level up,
+   * in `runtime.ts` - a second consecutive sighting. Anything else is
+   * inconclusive: a false deferral costs latency, a false "unpaid" destroys the
+   * customer's money.
    *
    * What "none" therefore means is narrow and honest: after the failed-on-chain
    * transactions are dropped, the reference's entire history is EMPTY - there
    * was nothing at all to look at.
    */
-  async verifyByReferenceScan(reference, rpc, jobId, deadline, verifySignature) {
-    const listed = await this.listReferenceCandidates(reference, rpc, deadline);
+  async verifyByReferenceScan(reference, rpc, jobId, pastDeadline, verifySignature) {
+    if (pastDeadline()) {
+      return { outcome: "inconclusive", error: "the reference scan ran out of time" };
+    }
+    const listed = await this.listReferenceCandidates(reference, rpc, pastDeadline);
     if ("error" in listed) {
       return { outcome: "inconclusive", error: listed.error };
     }
     let skippedConsumed = false;
+    let skippedUnusable = false;
     let unverifiableCandidate;
     for (const candidate of listed.signatures) {
-      if (Date.now() > deadline) {
+      if (pastDeadline()) {
         return { outcome: "inconclusive", error: "the reference scan ran out of time" };
       }
+      if (!isUsableSignature(candidate)) {
+        skippedUnusable = true;
+        continue;
+      }
       const owner = this.ledger.paymentSignatureOwner(candidate);
       if (owner !== void 0 && owner !== jobId) {
         skippedConsumed = true;
@@ -4349,6 +4602,9 @@ var PaymentRecovery = class {
       }
       unverifiableCandidate ??= verified.error ?? "no reason given";
     }
+    if (pastDeadline()) {
+      return { outcome: "inconclusive", error: "the reference scan ran out of time" };
+    }
     if (listed.windowFull) {
       return {
         outcome: "inconclusive",
@@ -4361,6 +4617,12 @@ var PaymentRecovery = class {
         error: "the reference carries a transaction another job already settled, so this scan did not see the whole picture"
       };
     }
+    if (skippedUnusable) {
+      return {
+        outcome: "inconclusive",
+        error: "the reference carries a transaction whose signature the node reported unusably, so this scan did not see the whole picture"
+      };
+    }
     if (unverifiableCandidate !== void 0) {
       return {
         outcome: "inconclusive",
@@ -4408,10 +4670,25 @@ var PaymentRecovery = class {
       );
       return "corrupt-state";
     }
-    const deadline = Date.now() + REFERENCE_SCAN_DEADLINE_MS;
+    let deadline;
     try {
       const rpc = createSolanaRpc(getRpcUrl(this.network));
       const protocolConfig = await this.fetchProtocolConfig();
+      deadline = Date.now() + REFERENCE_SCAN_DEADLINE_MS;
+      const pastDeadline = () => signal?.aborted === true || Date.now() >= deadline;
+      const degenerate = await degenerateReference(request, this.network, protocolConfig.treasury);
+      if (degenerate !== void 0) {
+        if (!isUsableSignature(entry.payment_signature)) {
+          log(
+            `[${shortId}] Recovery: the payment request's reference (${request.reference}) is an address the payment itself is computed from, so the transfer cannot be singled out by listing it. This is provider-side state, not a chain or customer problem.`
+          );
+          return "corrupt-state";
+        }
+        log(
+          `[${shortId}] Recovery: the reference (${request.reference}) is an address the payment is computed from, but this job already owns settlement ${entry.payment_signature} - deferring rather than failing it, in case this build's list grew past what the settlement was accepted under. Not listing the reference: it cannot single out a payment.`
+        );
+        return "deferred";
+      }
       const verify = async (txSignature2, retries) => {
         const verification = this.strategy.verifyPayment(rpc, request, protocolConfig, {
           txSignature: txSignature2,
@@ -4443,7 +4720,7 @@ var PaymentRecovery = class {
       };
       const ownSignature = entry.payment_signature;
       let txSignature;
-      if (ownSignature !== void 0) {
+      if (isUsableSignature(ownSignature) && !pastDeadline()) {
         const own = await verify(ownSignature, OWN_SETTLEMENT_VERIFY_RETRIES);
         if (own.verified) {
           txSignature = ownSignature;
@@ -4458,11 +4735,11 @@ var PaymentRecovery = class {
           reference,
           rpc,
           entry.job_id,
-          deadline,
+          pastDeadline,
           verify
         );
         if (scan.outcome === "none") {
-          if (ownSignature !== void 0) {
+          if (isUsableSignature(ownSignature)) {
             log(
               `[${shortId}] Recovery: the reference scan is empty, but this job already owns settlement ${ownSignature} - treating the empty scan as an RPC history gap, not as non-payment. Deferring.`
             );
@@ -4803,14 +5080,24 @@ var SessionStore = class {
     }
     const payload = lines.map((line) => JSON.stringify(line)).join("\n") + "\n";
     const path = this.sessionPath(customerId, sessionId);
+    if (isBlockingNodeSync(path)) {
+      this.log(`[sessions] session file is not a regular file; not recording this exchange`);
+      return;
+    }
     try {
-      appendFileSync(path, payload, { mode: FILE_MODE });
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        throw error;
+      try {
+        appendFileSync(path, payload, { mode: FILE_MODE });
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+        mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
+        appendFileSync(path, payload, { mode: FILE_MODE });
       }
-      mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
-      appendFileSync(path, payload, { mode: FILE_MODE });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      this.log(`[sessions] could not record this exchange (${reason}); delivering without it`);
+      return;
     }
     this.globalBytes += Buffer.byteLength(payload);
   }
@@ -4882,6 +5169,9 @@ var SessionStore = class {
     let raw;
     let size;
     try {
+      if (isBlockingNodeSync(path)) {
+        return null;
+      }
       size = statSync(path).size;
       raw = readFileSync(path, "utf-8");
     } catch {
@@ -4913,9 +5203,17 @@ var SessionStore = class {
     }
     if (torn) {
       const payload = lines.map((line) => JSON.stringify(line)).join("\n") + (lines.length > 0 ? "\n" : "");
-      const tempPath = `${path}.tmp`;
-      writeFileSync(tempPath, payload, { mode: FILE_MODE });
-      renameSync(tempPath, path);
+      const tempPath = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+      try {
+        writeFileSync(tempPath, payload, { mode: FILE_MODE });
+        renameSync(tempPath, path);
+      } catch (error) {
+        try {
+          unlinkSync(tempPath);
+        } catch {
+        }
+        throw error;
+      }
       this.globalBytes = Math.max(0, this.globalBytes - size + Buffer.byteLength(payload));
     }
     return lines;
@@ -4984,10 +5282,18 @@ var SessionStore = class {
     const payload = rewritten.map((line) => JSON.stringify(line)).join("\n") + "\n";
     const path = this.sessionPath(customerId, sessionId);
     const oldSize = existsSync(path) ? statSync(path).size : 0;
-    const tempPath = `${path}.tmp`;
+    const tempPath = `${path}.tmp.${randomBytes(6).toString("hex")}`;
     mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
-    writeFileSync(tempPath, payload, { mode: FILE_MODE });
-    renameSync(tempPath, path);
+    try {
+      writeFileSync(tempPath, payload, { mode: FILE_MODE });
+      renameSync(tempPath, path);
+    } catch (error) {
+      try {
+        unlinkSync(tempPath);
+      } catch {
+      }
+      throw error;
+    }
     this.globalBytes = Math.max(0, this.globalBytes - oldSize + Buffer.byteLength(payload));
     return assembleReplay(rewritten, void 0);
   }
@@ -5124,7 +5430,7 @@ var SessionStore = class {
         continue;
       }
       for (const name of names) {
-        if (!name.includes(".corrupt.")) {
+        if (!name.includes(".corrupt.") && !name.includes(".tmp")) {
           continue;
         }
         const path = join(dir, name);
@@ -5290,6 +5596,15 @@ var X402PermanentError = class extends Error {
 };
 
 // src/runtime.ts
+var MAX_LOGGED_MIME_CHARS = 128;
+function ledgerAmount(subunits) {
+  if (subunits < 0n || subunits > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(
+      `Amount ${subunits.toString()} subunits cannot be recorded exactly: the ledger holds amounts as numbers, and this one is outside the range a number represents without rounding.`
+    );
+  }
+  return Number(subunits);
+}
 var payment = new SolanaPaymentStrategy();
 var LEDGER_GC_INTERVAL_MS = 60 * 60 * 1e3;
 var SIG_PATH_TIMEOUT_MS = 60 * 1e3;
@@ -5324,24 +5639,106 @@ function resolveJobAsset(tags, skills) {
   const skill = skills.route(tags);
   return skill?.asset ?? NATIVE_SOL;
 }
-var BILLING_BODY_MARKERS3 = ["credit balance", "billing", "insufficient", "insufficient_quota"];
 var SCRIPT_BILLING_INVALID_MARKERS = [
-  "credit balance",
-  "billing",
-  "insufficient",
-  "insufficient_quota",
-  "x-api-key",
-  "invalid api key",
-  "invalid_api_key",
-  "authentication_error",
-  "unauthorized",
-  "unauthenticated"
+  // Three questions, one row each, so an edit cannot land half-applied: does
+  // this phrase gate THIS pair at all, does it also take every model on the
+  // operator's key offline (`cascades`), and is it about money rather than
+  // credentials (`billing`, which picks the reason the operator is shown and
+  // the recovery probe reads).
+  //
+  // `cascades` is the expensive one. Gating ONE pair on a false positive costs
+  // the operator a capability until the recovery probe clears it; a cascade
+  // costs them every capability on that key. So it needs a phrase an unrelated
+  // failure does not produce: `insufficient` alone is a Solana builder saying
+  // "insufficient funds for rent" and `billing` alone is a form field, while
+  // nothing prints `invalid x-api-key` or `credit balance` except the provider
+  // whose key it is. The bare status words carry `cascades: false` for the same
+  // reason - `unauthorized` is what any proxy says when it did not like a
+  // request. The LLM path next door demands an HTTP 401/402 before cascading;
+  // this is the script path's version of that bar.
+  { phrase: "credit balance", cascades: true, billing: true },
+  { phrase: "billing", cascades: false, billing: true },
+  { phrase: "insufficient", cascades: false, billing: true },
+  { phrase: "insufficient_quota", cascades: true, billing: true },
+  // Gates this pair, never cascades: `x-api-key` is the name of a REQUEST
+  // HEADER, which `curl -v` and any client that prints its own headers emit on a
+  // perfectly ordinary failure. Taking every model on the key offline for that
+  // is the expensive direction; `invalid x-api-key` below is the provider
+  // actually rejecting it.
+  { phrase: "x-api-key", cascades: false, billing: false },
+  // The provider REJECTING the key, which no request header says.
+  { phrase: "invalid x-api-key", cascades: true, billing: false },
+  { phrase: "invalid api key", cascades: true, billing: false },
+  { phrase: "invalid_api_key", cascades: true, billing: false },
+  { phrase: "authentication_error", cascades: true, billing: false },
+  { phrase: "unauthorized", cascades: false, billing: false },
+  { phrase: "unauthenticated", cascades: false, billing: false }
 ];
-function scriptMessageLooksLikeBillingOrInvalid(message) {
-  const lower = message.toLowerCase();
-  return SCRIPT_BILLING_INVALID_MARKERS.some((marker) => lower.includes(marker));
+var BILLING_BODY_MARKERS3 = SCRIPT_BILLING_INVALID_MARKERS.filter((marker) => marker.billing).map(
+  (marker) => marker.phrase
+);
+function classifyScriptSignal(message) {
+  let looksBillingOrInvalid = false;
+  let billing = false;
+  let cascade = false;
+  let signalAt = -1;
+  for (const match of message.matchAll(ALL_MARKERS_RE)) {
+    const marker = MARKER_BY_PHRASE.get(match[0].toLowerCase());
+    looksBillingOrInvalid = true;
+    billing = billing || marker?.billing === true;
+    cascade = cascade || marker?.cascades === true;
+    if (signalAt === -1) {
+      signalAt = match.index;
+    }
+  }
+  return { looksBillingOrInvalid, reason: billing ? "billing" : "invalid", cascade, signalAt };
+}
+var HOST_DISK_CODES = /* @__PURE__ */ new Set(["ENOSPC", "EROFS", "EDQUOT", "EMFILE", "ENFILE", "EIO"]);
+function asHostScratchFailure(error) {
+  const code = error?.code;
+  if (code === void 0 || !HOST_DISK_CODES.has(code)) {
+    return void 0;
+  }
+  return new HostScratchError(error instanceof Error ? error.message : String(error));
+}
+var HEALTH_REASON_CHARS = 500;
+var SIGNAL_LEAD_UNITS = 80;
+function markerPattern(phrases, flags) {
+  const longestFirst = [...phrases].sort((left, right) => right.length - left.length);
+  return new RegExp(
+    longestFirst.map((phrase) => phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"),
+    flags
+  );
+}
+var ALL_MARKERS_RE = markerPattern(
+  SCRIPT_BILLING_INVALID_MARKERS.map((marker) => marker.phrase),
+  "gi"
+);
+var MARKER_BY_PHRASE = new Map(
+  SCRIPT_BILLING_INVALID_MARKERS.map((marker) => [marker.phrase, marker])
+);
+function signalIndex(text) {
+  ALL_MARKERS_RE.lastIndex = 0;
+  const found = ALL_MARKERS_RE.exec(text)?.index ?? -1;
+  ALL_MARKERS_RE.lastIndex = 0;
+  return found;
+}
+function operatorReason(diagnostic, known, budget = HEALTH_REASON_CHARS) {
+  if (startsWithRefusalHint(diagnostic)) {
+    return excerptUntrusted(diagnostic, budget);
+  }
+  const signalAt = known ?? signalIndex(diagnostic);
+  if (signalAt === -1) {
+    return excerptUntrustedTail(diagnostic, budget);
+  }
+  const from = Math.max(0, signalAt - SIGNAL_LEAD_UNITS);
+  if (from === 0) {
+    return excerptUntrusted(diagnostic, budget);
+  }
+  return `\u2026${excerptUntrusted(diagnostic.slice(from, from + budget * 8), budget - 1)}`;
 }
 var AGENT_UNAVAILABLE_MESSAGE = "Agent temporarily unavailable";
+var OPERATOR_EXCERPT_CHARS = 1500;
 var AgentUnavailableError = class extends Error {
   constructor() {
     super(AGENT_UNAVAILABLE_MESSAGE);
@@ -5395,16 +5792,49 @@ function customerSafeMessage(error) {
   if (error instanceof AgentUnavailableError || error instanceof ExecutionBudgetExceededError || error instanceof SeedFailedError) {
     return error.message;
   }
-  if (error instanceof ScriptExecutionError) {
-    return error.message;
+  if (isScriptRefusalError(error)) {
+    return `${PROVIDER_REFUSED_PREFIX}${error.message}`;
   }
-  if (error instanceof ScriptBillingExhaustedError) {
+  if (isScriptExecutionError(error)) {
+    return PROVIDER_FAILED_MESSAGE;
+  }
+  if (isScriptBillingExhaustedError(error) || isHostScratchError(error) || error instanceof X402TransientError) {
     return AGENT_UNAVAILABLE_MESSAGE;
   }
   if (error instanceof Error && CUSTOMER_SAFE_MESSAGE_PREFIXES.some((prefix) => error.message.startsWith(prefix))) {
     return error.message;
   }
-  return "Internal processing error";
+  return PROVIDER_FAILED_MESSAGE;
+}
+function needsScratchSpace(mode, hasAttachment) {
+  if (hasAttachment) {
+    return true;
+  }
+  return mode !== void 0 && mode !== "llm" && mode !== "static-file" && mode !== "static-script";
+}
+function describeForOperator(error) {
+  if (isHostScratchError(error)) {
+    return `${error.message}: ${excerptUntrusted(error.detail, OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (isScriptBillingExhaustedError(error)) {
+    return `script signalled billing exhausted: ${excerptUntrustedTail(scriptOutput(error), OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (isScriptRefusalError(error)) {
+    return error.stderr === "" ? `refused: ${error.message}` : `refused: ${error.message} (stderr: ${error.stderr})`;
+  }
+  if (isScriptExecutionError(error)) {
+    return `${error.message}: ${excerptUntrustedTail(error.detail, OPERATOR_EXCERPT_CHARS)}`;
+  }
+  if (typeof error === "string") {
+    return excerptUntrusted(error, OPERATOR_EXCERPT_CHARS);
+  }
+  if (typeof error === "object" && error !== null && "message" in error) {
+    const message = error.message;
+    if (typeof message === "string" && message !== "") {
+      return excerptUntrusted(message, OPERATOR_EXCERPT_CHARS);
+    }
+  }
+  return "Unknown error";
 }
 function parseRawEventDelegated(rawEventJson) {
   if (rawEventJson === void 0) {
@@ -5691,12 +6121,51 @@ var AgentRuntime = class {
     }
     return ` (cascading to ${siblings} other model(s) for ${provider} sharing the same API key)`;
   }
+  /**
+   * Whether this agent can still make itself a scratch directory.
+   *
+   * A `HostScratchError` says the last job could not run because the temp
+   * directory refused it. That is not the operator's API key, so it must not
+   * gate the health pair - but SOMETHING has to stop the next customer paying
+   * into an agent that will fail them the same way, which is what the health
+   * gate used to do by accident. Probed before payment, and only once such a
+   * failure has been seen - a working host pays nothing for this, and a broken
+   * one is asked again on every job rather than after a timer: an agent whose
+   * jobs arrive minutes apart would otherwise let every customer through.
+   */
+  scratchFailed = false;
+  async scratchSpaceUsable() {
+    if (!this.scratchFailed) {
+      return true;
+    }
+    const probe = await mkdtemp(join(tmpdir(), "elisym-probe-")).catch(() => null);
+    if (probe === null) {
+      return false;
+    }
+    const wrote = await writeFile(join(probe, "probe"), "x").then(() => true).catch(() => false);
+    await rm(probe, { recursive: true, force: true }).catch(() => {
+    });
+    if (!wrote) {
+      return false;
+    }
+    this.scratchFailed = false;
+    return true;
+  }
   markHealthFromExecuteError(skill, err, log, jobId) {
     if (!this.healthMonitor) {
       return false;
     }
     const tag = `[${jobId.slice(0, 8)}]`;
-    if (err instanceof ScriptBillingExhaustedError) {
+    if (isHostScratchError(err)) {
+      log(
+        `${tag} Skill "${skill.name}" could not be given scratch space by THIS AGENT: ${excerptUntrusted(err.detail, 300)} Health state unchanged; the job stays paid for recovery.`
+      );
+      return false;
+    }
+    if (isScriptRefusalError(err)) {
+      return false;
+    }
+    if (isScriptBillingExhaustedError(err)) {
       const provider = skill.llmOverride?.provider;
       const model = skill.llmOverride?.model;
       if (!provider || !model) {
@@ -5708,7 +6177,12 @@ var AgentRuntime = class {
       log(
         `${tag} Script signaled billing-exhausted (exit ${err.exitCode}). Marking ${provider}/${model} unhealthy${this.cascadeSuffix(provider, model)}; future jobs against this pair will be refused until recovery probe succeeds.`
       );
-      this.healthMonitor.markUnhealthyFromJob(provider, model, "billing", err.message);
+      this.healthMonitor.markUnhealthyFromJob(
+        provider,
+        model,
+        "billing",
+        excerptUntrustedTail(scriptOutput(err), 200)
+      );
       return true;
     }
     if (skill.mode === "llm" && skill.resolvedTriple) {
@@ -5718,7 +6192,7 @@ var AgentRuntime = class {
         return false;
       }
       const status = Number(match[1]);
-      const body = (match[2] ?? "").slice(0, 200);
+      const body = excerptUntrusted(match[2] ?? "", 200);
       const isBillingStatus = status === 402;
       const isAuthStatus = status === 401 || status === 403;
       const isBilling400 = status === 400 && bodyLooksLikeBilling3(body);
@@ -5737,33 +6211,43 @@ var AgentRuntime = class {
     }
     if (skill.mode !== "llm") {
       let message;
-      if (err instanceof ScriptExecutionError) {
-        message = err.detail;
+      let scanned;
+      let diagnostic;
+      if (isScriptExecutionError(err)) {
+        message = err.stderr ?? err.detail;
+        diagnostic = startsWithRefusalHint(err.detail) || message.trim() === "" ? err.detail : message;
+        scanned = err.stderr === void 0 ? "the skill error" : "stderr";
       } else if (err instanceof Error) {
         message = err.message;
+        diagnostic = message;
+        scanned = "the skill error";
       } else {
         message = String(err);
+        diagnostic = message;
+        scanned = "the skill error";
       }
       const provider = skill.llmOverride?.provider;
       const model = skill.llmOverride?.model;
       if (!provider || !model) {
         log(
-          `${tag} Script "${skill.name}" failed ("${message.slice(0, 120)}") but did not declare provider/model in SKILL.md - cannot gate future jobs.`
+          `${tag} Script "${skill.name}" failed ("${operatorReason(diagnostic)}") but did not declare provider/model in SKILL.md - cannot gate future jobs.`
         );
         return false;
       }
-      const lower = message.toLowerCase();
-      const looksBillingOrInvalid = scriptMessageLooksLikeBillingOrInvalid(message);
-      const reason = looksBillingOrInvalid && (lower.includes("credit balance") || lower.includes("billing") || lower.includes("insufficient")) ? "billing" : "invalid";
-      const cascade = looksBillingOrInvalid;
+      const { looksBillingOrInvalid, reason, cascade, signalAt } = classifyScriptSignal(message);
       const cascadeNote = cascade ? this.cascadeSuffix(provider, model) : " (no cascade)";
-      const signalNote = looksBillingOrInvalid ? `${reason} signal in stderr` : `generic exit (no billing/invalid markers, classified as ${reason}, skill-local)`;
+      const signalNote = looksBillingOrInvalid ? `${reason} signal in ${scanned}` : `generic exit (no billing/invalid markers, classified as ${reason}, skill-local)`;
       log(
         `${tag} Script failure (${signalNote}). Marking ${provider}/${model} unhealthy${cascadeNote}; future jobs against this pair will be refused until recovery probe succeeds.`
       );
-      this.healthMonitor.markUnhealthyFromJob(provider, model, reason, message.slice(0, 200), {
-        cascade
-      });
+      this.healthMonitor.markUnhealthyFromJob(
+        provider,
+        model,
+        reason,
+        // The index only when the quote is of the same string the scan read.
+        operatorReason(diagnostic, diagnostic === message ? signalAt : void 0),
+        { cascade }
+      );
       return true;
     }
     return false;
@@ -5777,8 +6261,31 @@ var AgentRuntime = class {
     });
     return { feeBps: config.feeBps, treasury: config.treasury };
   }
+  /**
+   * The ONE way a line leaves this runtime for the operator.
+   *
+   * Every line is scrubbed of RPC credentials here, once, rather than at the
+   * call sites that happen to quote an error. Third-party RPC providers carry
+   * the API key in the URL, and an error reaching this file can quote that URL:
+   * `@solana/kit` does not put it in its own transport errors - measured across
+   * refused connections, DNS failures, 429, 401, a JSON-RPC error and a body
+   * that is not JSON - but for a JSON-RPC error it does not recognize it passes
+   * the SERVER's message through, and a proxy is free to write the request URL
+   * into that. `start.ts` already scrubbed the wallet error for this reason and
+   * nothing here did.
+   *
+   * One place because the call sites are many and grow: seven bound a logger
+   * of their own, and the payment path alone quotes an error in four. Nothing
+   * this runtime logs carries a URL of its own, so the scrub costs no
+   * diagnostic. The sink is `onLog`, which `start` fans out to the terminal and
+   * to the structured log - so both are covered by the one pass.
+   */
+  get operatorLog() {
+    const sink = this.callbacks.onLog ?? console.log;
+    return (line) => sink(redactRpcUrlsInText(line));
+  }
   async run() {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     this.ledger.pruneOldEntries(LEDGER_RETENTION_MS);
     this.sessionStore?.init();
     this.reconcileUsedNonces();
@@ -5878,8 +6385,8 @@ var AgentRuntime = class {
       if (jobSession) {
         jobSession.store.admitLive(jobSession.customerId, jobSession.sessionId);
       }
-      this.limit(() => this.processJob(job)).catch((e) => {
-        this.callbacks.onJobError?.(job.jobId, e.message);
+      this.limit(() => this.processJob(job)).catch((err) => {
+        this.callbacks.onJobError?.(job.jobId, describeForOperator(err));
       }).finally(() => {
         this.inFlight.delete(job.jobId);
         this.pending--;
@@ -5928,7 +6435,7 @@ var AgentRuntime = class {
       this.callbacks.onStop?.();
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
-      (this.callbacks.onLog ?? console.log)(`onStop error: ${msg}`);
+      this.operatorLog(`onStop error: ${msg}`);
     }
     this.abortController.abort();
     for (const controller of this.jobAbortControllers) {
@@ -5964,18 +6471,31 @@ var AgentRuntime = class {
     this.jobAbortControllers.add(jobAbort);
     try {
       await this.executeJob(job, jobAbort.signal);
-    } catch (e) {
-      const log = this.callbacks.onLog ?? console.log;
-      log(`[${job.jobId.slice(0, 8)}] Error: ${e.message}`);
+    } catch (raw) {
+      const e = asHostScratchFailure(raw) ?? raw;
+      const log = this.operatorLog;
+      const operatorMessage = describeForOperator(e);
+      log(`[${job.jobId.slice(0, 8)}] Error: ${operatorMessage}`);
+      if (isHostScratchError(e)) {
+        this.scratchFailed = true;
+      }
       const currentStatus = this.ledger.getStatus(job.jobId);
-      const keepPaidForRecovery = (e instanceof AgentUnavailableError || e instanceof SeedFailedError || e instanceof PaymentTimeoutError || e instanceof X402TransientError || e instanceof ExecutionBudgetExceededError && this.skills.route(job.tags)?.mode === "x402") && currentStatus === "paid";
+      const keepPaidForRecovery = (e instanceof AgentUnavailableError || // The exit-42 contract: the key is out of credits, not the job out of
+      // sense, so the job waits for the operator to top up. Reached when the
+      // gate did NOT flip - an agent with no health monitor, or a skill that
+      // declares no pair - where the customer is told "temporarily
+      // unavailable" and that has to stay true of their money.
+      isScriptBillingExhaustedError(e) || // The agent's own disk, not the job: a tmpdir that is full or
+      // read-only now may not be in five minutes, and the customer has
+      // already paid. Terminating here would keep their money for a failure
+      // that was never about their request.
+      isHostScratchError(e) || e instanceof SeedFailedError || e instanceof PaymentTimeoutError || e instanceof X402TransientError || e instanceof ExecutionBudgetExceededError && this.skills.route(job.tags)?.mode === "x402") && currentStatus === "paid";
       if (currentStatus !== "executed" && !keepPaidForRecovery) {
         this.ledger.markFailed(job.jobId);
       }
       if (keepPaidForRecovery) {
         log(`[${job.jobId.slice(0, 8)}] Keeping status=paid; recovery will retry (24h cutoff).`);
       }
-      const operatorMessage = e instanceof ScriptExecutionError ? `${e.message}: ${e.detail}` : e.message ?? "Unknown error";
       this.callbacks.onJobError?.(job.jobId, operatorMessage);
       const safeMessage = customerSafeMessage(e);
       await this.transport.sendFeedback(job, { type: "error", message: safeMessage }).catch(() => {
@@ -5986,7 +6506,7 @@ var AgentRuntime = class {
   }
   /** Core job processing logic - payment, skill execution, result delivery. */
   async executeJob(job, signal) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     const inputBytes = utf8ByteLength(job.input);
     if (inputBytes > LIMITS.MAX_INPUT_LENGTH) {
       throw new Error(`Input too long: ${inputBytes} bytes (max ${LIMITS.MAX_INPUT_LENGTH})`);
@@ -6007,13 +6527,25 @@ var AgentRuntime = class {
         return;
       }
     }
+    if (needsScratchSpace(matched?.mode, job.attachment !== void 0) && !await this.scratchSpaceUsable()) {
+      log(
+        `[${job.jobId.slice(0, 8)}] Refusing job before payment: this agent cannot create scratch space (check the temp directory).`
+      );
+      await this.transport.sendFeedback(job, { type: "error", message: AGENT_UNAVAILABLE_MESSAGE }).catch(() => {
+      });
+      return;
+    }
     if (matched?.mode === "x402" && job.attachment !== void 0) {
       const method = matched.x402?.method ?? "POST";
       const maxInputBytes = matched.x402?.maxInputBytes ?? 0;
       const attachmentOk = method === "POST" && job.attachment.mime.startsWith("text/") && job.attachment.size <= maxInputBytes;
       if (!attachmentOk) {
         log(
-          `[${job.jobId.slice(0, 8)}] Rejecting attachment on x402 skill (mime=${job.attachment.mime}, size=${job.attachment.size})`
+          // `mime` is the customer's string and its schema bounds only the
+          // length, so a newline in it forged whole log lines. Every other
+          // piece of untrusted text in this file already goes through the
+          // excerpt; this was the one that did not.
+          `[${job.jobId.slice(0, 8)}] Rejecting attachment on x402 skill (mime=${excerptUntrusted(job.attachment.mime, MAX_LOGGED_MIME_CHARS)}, size=${job.attachment.size})`
         );
         await this.transport.sendFeedback(job, {
           type: "error",
@@ -6066,7 +6598,7 @@ var AgentRuntime = class {
       if (delegatedPull === void 0) {
         return;
       }
-      netAmount = Number(delegatedPull.priceSubunits);
+      netAmount = ledgerAmount(delegatedPull.priceSubunits);
     } else if (jobPrice > 0) {
       const result = await this.collectPayment(job, jobPrice, jobAsset, signal);
       netAmount = result.netAmount;
@@ -6190,7 +6722,7 @@ var AgentRuntime = class {
           log
         );
         const outcome = await this.executeDelegatedPull(job, delegatedPull, log);
-        netAmount = Number(delegatedPull.chargedSubunits ?? delegatedPull.priceSubunits);
+        netAmount = ledgerAmount(delegatedPull.chargedSubunits ?? delegatedPull.priceSubunits);
         if (outcome === "dead") {
           this.ledger.markFailed(job.jobId);
           await this.transport.sendFeedback(job, {
@@ -6447,7 +6979,7 @@ var AgentRuntime = class {
       job.jobId,
       pull.signature,
       Number(pull.lastValidBlockHeight),
-      Number(amount)
+      ledgerAmount(amount)
     );
     ctx.pullSignature = pull.signature;
     const outcome = await sendConfirmToTerminal(ctx.rpc, pull, {});
@@ -6653,7 +7185,7 @@ var AgentRuntime = class {
    * rather than losing the customer's paid job.
    */
   async seedGuarded(jobId, kind, run) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     const started = Date.now();
     try {
       const seeded = await run();
@@ -6800,6 +7332,9 @@ var AgentRuntime = class {
       return void 0;
     }
     try {
+      if (await isBlockingNode(filePath)) {
+        return void 0;
+      }
       const bytes = await readFile(filePath);
       return await this.seedBlossomMember(bytes, recipientPubkey);
     } catch {
@@ -6893,7 +7428,9 @@ var AgentRuntime = class {
           });
           return this.materializeBytesInput(bytes, attachment.mime);
         }
-        const dir = await mkdtemp(join(tmpdir(), "elisym-job-"));
+        const dir = await mkdtemp(join(tmpdir(), "elisym-job-")).catch((err) => {
+          throw new HostScratchError(err instanceof Error ? err.message : String(err));
+        });
         const filePath = join(dir, "input");
         try {
           await this.irohTransport.fetchToPath(irohMember.ticket, filePath, {
@@ -6945,14 +7482,16 @@ var AgentRuntime = class {
       return { inlineText: Buffer.from(bytes).toString("utf8"), cleanup: async () => {
       } };
     }
-    const dir = await mkdtemp(join(tmpdir(), "elisym-job-"));
+    const dir = await mkdtemp(join(tmpdir(), "elisym-job-")).catch((err) => {
+      throw new HostScratchError(err instanceof Error ? err.message : String(err));
+    });
     const filePath = join(dir, "input");
     try {
       await writeFile(filePath, bytes);
     } catch (error) {
       await rm(dir, { recursive: true, force: true }).catch(() => {
       });
-      throw error;
+      throw asHostScratchFailure(error) ?? error;
     }
     return {
       filePath,
@@ -6966,7 +7505,7 @@ var AgentRuntime = class {
    * polls for on-chain confirmation. Aborts if signal fires.
    */
   async collectPayment(job, jobPrice, jobAsset, signal) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     if (!this.config.solanaAddress) {
       throw new Error("Solana address not configured");
     }
@@ -7038,7 +7577,7 @@ var AgentRuntime = class {
             return;
           }
           const txSignature = askedSignature ?? verified.txSignature;
-          if (txSignature === void 0) {
+          if (!isUsableSignature(txSignature)) {
             paymentRefusal = { consumedByOther: false, sentence: UNNAMED_SETTLEMENT_SENTENCE };
             lose({ verified: false }, `${pathLabel}: ${UNNAMED_SETTLEMENT_SENTENCE}`);
             return;
@@ -7207,7 +7746,7 @@ var AgentRuntime = class {
         (jobId) => this.ledger.getStatus(jobId) === "paid"
       );
     }
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     this.logDeferralSummary(log);
     if (pending.length === 0) {
       return;
@@ -7287,12 +7826,13 @@ var AgentRuntime = class {
       this.limit(async () => {
         try {
           await this.recoverSingleJob(entry, log);
-        } catch (e) {
-          log(`[${entry.job_id.slice(0, 8)}] Recovery: failed: ${e.message}`);
+        } catch (err) {
+          log(`[${entry.job_id.slice(0, 8)}] Recovery: failed: ${describeForOperator(err)}`);
         } finally {
           this.inFlight.delete(entry.job_id);
           this.pending--;
         }
+      }).catch(() => {
       });
     }
   }
@@ -7398,7 +7938,7 @@ var AgentRuntime = class {
           try {
             await this.healthMonitor.assertReady(healthPair.provider, healthPair.model);
           } catch (err) {
-            if (err instanceof LlmHealthError) {
+            if (isLlmHealthError(err)) {
               log(
                 `[${entry.job_id.slice(0, 8)}] Recovery: pair ${healthPair.provider}/${healthPair.model} still unhealthy (${err.reason}); waiting for recovery probe.`
               );
@@ -7442,7 +7982,15 @@ var AgentRuntime = class {
             entry.customer_id,
             recoveryAbort.signal
           );
-        } catch {
+        } catch (raw) {
+          const err = asHostScratchFailure(raw) ?? raw;
+          if (isHostScratchError(err)) {
+            this.scratchFailed = true;
+            log(
+              `[${entry.job_id.slice(0, 8)}] Recovery: no scratch space for the input file; leaving the job paid.`
+            );
+            return;
+          }
           log(`[${entry.job_id.slice(0, 8)}] Recovery: input file unavailable, marking failed`);
           await this.failRecoveredJob(entry, fakeJob, RECOVERY_INPUT_UNAVAILABLE_CUSTOMER_MESSAGE);
           return;
@@ -7453,6 +8001,7 @@ var AgentRuntime = class {
           skill
         );
         const runRecoveryExecution = async (history) => {
+          let budgetExceeded = false;
           let budgetTimer;
           try {
             const execPromise = skill.execute(
@@ -7474,6 +8023,7 @@ var AgentRuntime = class {
                 execPromise,
                 new Promise((_resolve, reject) => {
                   budgetTimer = setTimeout(() => {
+                    budgetExceeded = true;
                     recoveryAbort.abort();
                     reject(new ExecutionBudgetExceededError(recoveryBudgetMs));
                   }, recoveryBudgetMs);
@@ -7482,6 +8032,12 @@ var AgentRuntime = class {
             }
             return await execPromise;
           } catch (err) {
+            if (isHostScratchError(err)) {
+              this.scratchFailed = true;
+            }
+            if (budgetExceeded) {
+              throw new ExecutionBudgetExceededError(recoveryBudgetMs);
+            }
             this.markHealthFromExecuteError(skill, err, log, entry.job_id);
             throw err;
           } finally {
@@ -7494,18 +8050,28 @@ var AgentRuntime = class {
             }
           }
         };
-        const output = recoveryJobSession === null ? await runRecoveryExecution() : await this.runSessionExchange({
-          session: recoveryJobSession,
-          jobId: entry.job_id,
-          userRecord: buildUserRecord(
-            recoveryInputFile?.inlineText ?? entry.input,
-            recoveryInputFile?.filePath !== void 0 ? "attachment" : void 0
-          ),
-          signal: recoveryAbort.signal,
-          log,
-          execute: runRecoveryExecution,
-          excludeOwnTurns: true
-        });
+        let output;
+        try {
+          output = recoveryJobSession === null ? await runRecoveryExecution() : await this.runSessionExchange({
+            session: recoveryJobSession,
+            jobId: entry.job_id,
+            userRecord: buildUserRecord(
+              recoveryInputFile?.inlineText ?? entry.input,
+              recoveryInputFile?.filePath !== void 0 ? "attachment" : void 0
+            ),
+            signal: recoveryAbort.signal,
+            log,
+            execute: runRecoveryExecution,
+            excludeOwnTurns: true
+          });
+        } catch (error) {
+          if (!isScriptRefusalError(error)) {
+            throw error;
+          }
+          log(`[${entry.job_id.slice(0, 8)}] Recovery: ${describeForOperator(error)}`);
+          await this.failRecoveredJob(entry, fakeJob, customerSafeMessage(error));
+          return;
+        }
         const { attachments: resultAttachments, deliveredContent } = await this.buildResultAttachment(
           entry.job_id,
           output,
@@ -8028,7 +8594,7 @@ function buildCliSkill(parsed, entryPath, scriptEnv, network) {
   }
   return skill;
 }
-function loadSkillsFromDir(skillsDir, options) {
+function loadSkillsFromDir2(skillsDir, options) {
   const skills = [];
   let entries;
   try {
@@ -8047,6 +8613,9 @@ function loadSkillsFromDir(skillsDir, options) {
     }
     const skillMdPath = join(entryPath, "SKILL.md");
     try {
+      if (isBlockingNodeSync(skillMdPath)) {
+        throw new Error("it is a pipe, socket or device, not a file");
+      }
       const content = readFileSync(skillMdPath, "utf-8");
       const { frontmatter, systemPrompt } = parseSkillMd(content);
       const parsed = validateSkillFrontmatter(frontmatter, systemPrompt, {
@@ -8394,6 +8963,9 @@ function startWatchdog(deps) {
     }
   };
 }
+var INDEX_FILE_MODE = 384;
+var REPAIR_HINT = "every bridged job is refused until that entry is corrected or removed by hand; removing it forgets what was already paid for that job";
+var STRANDED_TEMP_MIN_AGE_MS2 = 60 * 60 * 1e3;
 var X402_JOBS_FILE = ".x402-jobs.json";
 var X402_RESULTS_DIR = ".x402-results";
 function sanitizeJobId(jobId) {
@@ -8419,6 +8991,11 @@ var X402JobStore = class {
     return scheduled;
   }
   async load() {
+    if (await isBlockingNode(this.jobsPath)) {
+      throw new Error(
+        `Refusing to read ${this.jobsPath}: it is a pipe, socket or device, not a file`
+      );
+    }
     let raw;
     try {
       raw = await readFile(this.jobsPath, "utf-8");
@@ -8432,16 +9009,73 @@ var X402JobStore = class {
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       throw new Error(`x402 store ${this.jobsPath} is not a JSON object`);
     }
+    const isCount = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
+    for (const [jobId, record] of Object.entries(parsed)) {
+      if (record === null || typeof record !== "object" || Array.isArray(record)) {
+        throw new Error(
+          `x402 store ${this.jobsPath} holds a non-record at ${jobId} - ${REPAIR_HINT}`
+        );
+      }
+      const slot = record;
+      if (!isCount(slot.attempts) || !isCount(slot.created_at) || !isCount(slot.updated_at) || slot.signatures !== void 0 && !isCount(slot.signatures)) {
+        throw new Error(
+          `x402 store ${this.jobsPath} holds an unusable record at ${jobId} - ${REPAIR_HINT}`
+        );
+      }
+    }
     return parsed;
   }
   async save(file) {
-    const tempPath = `${this.jobsPath}.tmp`;
-    await writeFile(tempPath, JSON.stringify(file, null, 2), "utf-8");
-    await rename(tempPath, this.jobsPath);
+    const tempPath = `${this.jobsPath}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      await writeFile(tempPath, JSON.stringify(file, null, 2), {
+        encoding: "utf-8",
+        mode: INDEX_FILE_MODE
+      });
+      await chmod(tempPath, INDEX_FILE_MODE);
+      await rename(tempPath, this.jobsPath);
+    } catch (error) {
+      try {
+        await rm(tempPath, { force: true });
+      } catch {
+      }
+      throw error;
+    }
   }
   resultFilePath(jobId) {
     return join(this.resultsDir, sanitizeJobId(jobId));
   }
+  /** Remove `<result>.tmp.<hex>` leftovers for one job. Best effort. */
+  async sweepStrandedTemporaries(jobId) {
+    const prefix = `${sanitizeJobId(jobId)}.tmp.`;
+    try {
+      const entries = await readdir(this.resultsDir);
+      await Promise.all(
+        entries.filter((entry) => entry.startsWith(prefix)).map((entry) => this.removeIfStale(join(this.resultsDir, entry)))
+      );
+    } catch {
+    }
+  }
+  /**
+   * Remove a temporary only once it is too old to be a live writer's.
+   *
+   * The queue serializes writers inside ONE process, and there is meant to be
+   * one store per agent directory - but `sweepExpired` runs from the driver's
+   * constructor, so a second `elisym start` on the same directory sweeps while
+   * the first is mid-write. Same argument as the ledger's guard: two agents on
+   * one directory is unsupported, and a sweep is no place to make it worse.
+   */
+  async removeIfStale(path) {
+    try {
+      const info = await stat(path);
+      if (Date.now() - info.mtimeMs < STRANDED_TEMP_MIN_AGE_MS2) {
+        return;
+      }
+    } catch {
+      return;
+    }
+    await rm(path, { force: true }).catch(() => void 0);
+  }
   /**
    * Atomically claim one paid attempt: increment iff still under BOTH caps
    * (durable attempts and the monotonic signature count), and FLUSH before
@@ -8522,8 +9156,20 @@ var X402JobStore = class {
   /** Binary result: bytes hit disk BEFORE the record flush (crash-safe ordering). */
   async saveFileResult(jobId, mime, bytes) {
     const filePath = this.resultFilePath(jobId);
-    await mkdir(this.resultsDir, { recursive: true });
-    await writeFile(filePath, bytes);
+    await mkdir(this.resultsDir, { recursive: true, mode: 448 });
+    await chmod(this.resultsDir, 448).catch(() => {
+    });
+    const tempPath = `${filePath}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      await writeFile(tempPath, bytes, { mode: 384 });
+      await rename(tempPath, filePath);
+    } catch (error) {
+      try {
+        await rm(tempPath, { force: true });
+      } catch {
+      }
+      throw error;
+    }
     await this.runExclusive(async () => {
       const file = await this.load();
       const now = Date.now();
@@ -8559,9 +9205,32 @@ var X402JobStore = class {
     }
     return { data: "", outputMime: result.mime, filePath };
   }
+  /**
+   * Remove fragments of the INDEX left by a crash between write and rename.
+   *
+   * Keyed by record id like the result sweep cannot be: the index has no job to
+   * expire with, so nothing would ever visit its fragments - the suffix is
+   * random, the name is not `.x402-jobs.json`, and `sweepStrandedTemporaries`
+   * walks the results directory only. What a fragment holds is which upstream
+   * calls this bridge has already paid for.
+   */
+  async sweepStrandedIndexTemporaries() {
+    const dir = dirname(this.jobsPath);
+    const legacyName = `${basename(this.jobsPath)}.tmp`;
+    const prefix = `${legacyName}.`;
+    try {
+      const entries = await readdir(dir);
+      await Promise.all(
+        entries.filter((entry) => entry === legacyName || entry.startsWith(prefix)).map((entry) => this.removeIfStale(join(dir, entry)))
+      );
+    } catch {
+    }
+  }
   /** Drop records (and their result files) older than the cache TTL. */
   async sweepExpired(now = Date.now()) {
     await this.runExclusive(async () => {
+      await this.sweepStrandedIndexTemporaries();
+      await chmod(this.jobsPath, INDEX_FILE_MODE).catch(() => void 0);
       const file = await this.load();
       let changed = false;
       for (const [jobId, record] of Object.entries(file)) {
@@ -8572,6 +9241,7 @@ var X402JobStore = class {
         changed = true;
         await rm(this.resultFilePath(jobId), { force: true }).catch(() => {
         });
+        await this.sweepStrandedTemporaries(jobId);
       }
       if (changed) {
         await this.save(file);
@@ -8731,21 +9401,17 @@ function withPaymentIdentifier(headerValue, declaration, jobId) {
     return headerValue;
   }
 }
-var UNICODE_FORMAT_MARKS = /\p{Cf}/gu;
-function flattenForOperator(text) {
-  return sanitizeForTerminal(text).replace(UNICODE_FORMAT_MARKS, "").replace(/\s+/g, " ").trim();
-}
 function printedPrefix(flattened) {
-  return flattened.length <= X402_ERROR_EXCERPT_CHARS ? flattened : flattened.slice(0, X402_ERROR_EXCERPT_CHARS).replace(/[\ud800-\udbff]$/, "");
+  return clipToCodeUnits(flattened, X402_ERROR_EXCERPT_CHARS);
 }
 function clipForOperator(flattened) {
   return flattened.length <= X402_ERROR_EXCERPT_CHARS ? flattened : `${printedPrefix(flattened)}...`;
 }
 function quoteUpstream(text) {
-  return clipForOperator(flattenForOperator(text));
+  return clipForOperator(flattenForComparison(text));
 }
 function quoteUpstreamWithInput(text, sentInput) {
-  return clipForOperator(maskCustomerInput(flattenForOperator(text), inputForms(sentInput)));
+  return clipForOperator(maskCustomerInput(flattenForComparison(text), inputForms(sentInput)));
 }
 function wireForm(sentInput) {
   return new TextDecoder().decode(new TextEncoder().encode(sentInput));
@@ -8767,7 +9433,7 @@ function endsInsideInput(text, forms) {
 }
 function inputForms(sentInput) {
   return [wireForm(sentInput), jsonEscapedForm(sentInput), ...urlEncodedForms(sentInput)].map(
-    flattenForOperator
+    flattenForComparison
   );
 }
 function maskCustomerInput(text, forms) {
@@ -8811,7 +9477,7 @@ var X402Driver = class {
   signerPromise = null;
   repriceHintLogged = /* @__PURE__ */ new Set();
   log(message) {
-    (this.options.log ?? console.log)(`[x402] ${flattenForOperator(message)}`);
+    (this.options.log ?? console.log)(`[x402] ${flattenForComparison(message)}`);
   }
   getSigner() {
     const secret = this.options.solanaSecretKeyBase58;
@@ -9015,7 +9681,7 @@ var X402Driver = class {
         this.options.errorBodyReadMs ?? X402_ERROR_BODY_READ_MS
       );
       const forms = inputForms(sentInput);
-      const quoted = maskCustomerInput(flattenForOperator(body.text), forms);
+      const quoted = maskCustomerInput(flattenForComparison(body.text), forms);
       if (quoted.length === 0) {
         return "";
       }
@@ -9242,7 +9908,7 @@ async function cmdStart(nameArg, options = {}) {
   const scriptEnv = buildScriptEnv(loaded.secrets);
   const paths = agentPaths(loaded.dir);
   const skillsDir = paths.skills;
-  const allSkills = loadSkillsFromDir(skillsDir, { network: walletNetwork, scriptEnv });
+  const allSkills = loadSkillsFromDir2(skillsDir, { network: walletNetwork, scriptEnv });
   if (allSkills.length === 0) {
     console.error(`  ! No skills found in ${skillsDir}
 `);
@@ -9265,6 +9931,31 @@ async function cmdStart(nameArg, options = {}) {
     );
     process.exit(1);
   }
+  if (hasPaid && solanaAddress) {
+    try {
+      const neighbors = await findSharedPayoutNeighbors(
+        cwd,
+        loaded.dir,
+        walletNetwork,
+        solanaAddress
+      );
+      for (const neighbor of neighbors) {
+        console.log(
+          `  ! WARNING: agent "${neighbor.name}" (${neighbor.dir}) ` + (neighbor.paid === "unknown" ? `shares this payout address on ${walletNetwork}, and its skills could not be read to tell whether any of them are paid.` : `is paid at the same address on ${walletNetwork}.`) + ` One transaction can then be counted for jobs of both agents, so a customer could be served twice for one transfer. See https://docs.elisym.network/protocol/payments for what the rail does and does not promise.`
+        );
+      }
+      if (neighbors.length > 0) {
+        console.log();
+      }
+    } catch (error) {
+      console.log(
+        `  ! Could not check whether another agent is paid at this address (${deleteControlCharacters(
+          error instanceof Error ? error.message : String(error)
+        )}). Starting anyway.`
+      );
+      console.log();
+    }
+  }
   const llmSkills = allSkills.filter((skill) => skill.mode === "llm");
   const scriptDepSkills = allSkills.filter(
     (skill) => skill.mode !== "llm" && skill.llmOverride?.provider && skill.llmOverride?.model
@@ -9449,6 +10140,7 @@ async function cmdStart(nameArg, options = {}) {
   const x402Skills = allSkills.filter((skill) => skill.mode === "x402");
   let x402InvariantBroken;
   if (x402Skills.length > 0) {
+    await ensureGitignoreHasX402Entries(dirname(loaded.dir));
     const solanaSecretKey = loaded.secrets.solana_secret_key;
     if (solanaSecretKey === void 0 || solanaSecretKey.length === 0) {
       x402InvariantBroken = "no solana_secret_key in .secrets.json";
@@ -9555,8 +10247,11 @@ async function cmdStart(nameArg, options = {}) {
     }
   }
   if (mediaCacheDirty) {
+    await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
     await writeMediaCache(loaded.dir, mediaCache);
   }
+  await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
+  const ledger = new JobLedger(paths.jobs);
   let profilePublished = false;
   try {
     await client.discovery.publishProfile(
@@ -9667,7 +10362,7 @@ async function cmdStart(nameArg, options = {}) {
     }
     try {
       await client.policies.deletePolicy(identity2, type);
-      console.log(`  Removed stale policy: ${sanitizeForTerminal(type)}`);
+      console.log(`  Removed stale policy: ${deleteControlCharacters(type)}`);
     } catch {
     }
   }
@@ -9708,6 +10403,16 @@ async function cmdStart(nameArg, options = {}) {
       console.warn(`  ! Run \`npx @elisym/cli delegate-key ${loaded.name}\` to enable it.`);
     }
   }
+  if (delegateSigner !== void 0) {
+    await ensureGitignoreHasDelegationNoncesEntry(dirname(loaded.dir));
+  }
+  const nonceStore = delegateSigner !== void 0 ? new UsedNonceStore(join(loaded.dir, ".delegation-nonces.json")) : void 0;
+  await ensureGitignoreHasIrohEntry(dirname(loaded.dir));
+  await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
+  const hasContextSkills = registry.all().some((skill) => skill.context === true);
+  if (hasContextSkills) {
+    await ensureGitignoreHasSessionsEntry(dirname(loaded.dir));
+  }
   const buildCard = (skill) => buildCapabilityCard(skill, { walletNetwork, solanaAddress, delegatePubkey });
   function retiredModelKeyForSkill(skill) {
     if (skill.resolvedTriple) {
@@ -9778,7 +10483,7 @@ async function cmdStart(nameArg, options = {}) {
         const card = JSON.parse(ev.content);
         if (card.name && toDTag(card.name) === dTag) {
           await client.discovery.deleteCapability(identity2, card.name);
-          console.log(`  Removed stale capability: ${sanitizeForTerminal(card.name)}`);
+          console.log(`  Removed stale capability: ${deleteControlCharacters(card.name)}`);
         }
       } catch {
       }
@@ -9797,16 +10502,7 @@ async function cmdStart(nameArg, options = {}) {
     });
   };
   const transport = new NostrTransport(client, identity2, [DEFAULT_KIND_OFFSET]);
-  const ledger = new JobLedger(paths.jobs);
   const irohTransport = createIrohTransport({ storePath: join(loaded.dir, ".iroh") });
-  await ensureGitignoreHasIrohEntry(dirname(loaded.dir));
-  if (x402Skills.length > 0) {
-    await ensureGitignoreHasX402Entries(dirname(loaded.dir));
-  }
-  const hasContextSkills = registry.all().some((skill) => skill.context === true);
-  if (hasContextSkills) {
-    await ensureGitignoreHasSessionsEntry(dirname(loaded.dir));
-  }
   const runtimeConfig = {
     paymentTimeoutSecs: DEFAULTS.PAYMENT_EXPIRY_SECS,
     maxConcurrentJobs: MAX_CONCURRENT_JOBS,
@@ -9821,10 +10517,6 @@ async function cmdStart(nameArg, options = {}) {
     // the payment key) to execute post-work pulls from customer delegations.
     delegateSigner
   };
-  const nonceStore = delegateSigner !== void 0 ? new UsedNonceStore(join(loaded.dir, ".delegation-nonces.json")) : void 0;
-  if (nonceStore !== void 0) {
-    await ensureGitignoreHasDelegationNoncesEntry(dirname(loaded.dir));
-  }
   const rpcUrlForLog = stripRpcSecrets(process.env.SOLANA_RPC_URL ?? getRpcUrl(walletNetwork));
   logger.debug(
     {
@@ -9871,7 +10563,7 @@ async function cmdStart(nameArg, options = {}) {
     ledger,
     {
       onJobReceived: (job) => {
-        const cap = sanitizeForTerminal(job.tags.find((t) => t !== "elisym") ?? "unknown");
+        const cap = deleteControlCharacters(job.tags.find((t) => t !== "elisym") ?? "unknown");
         process.stdout.write(`  [job] ${job.jobId.slice(0, 16)} | cap=${cap}
 `);
         logger.info({ event: "job_received", jobId: job.jobId, capability: cap });
@@ -9882,7 +10574,7 @@ async function cmdStart(nameArg, options = {}) {
         logger.info({ event: "job_delivered", jobId });
       },
       onJobError: (jobId, error) => {
-        const safeError = sanitizeForTerminal(error);
+        const safeError = deleteControlCharacters(error);
         process.stderr.write(`  [job] ${jobId.slice(0, 16)} | error: ${safeError}
 `);
         logger.error({ event: "job_error", jobId, error: safeError });
@@ -9974,37 +10666,6 @@ function buildScriptEnv(secrets) {
   }
   return scriptEnv;
 }
-var PUBLIC_SOLANA_RPC_HOSTS = /* @__PURE__ */ new Set([
-  "api.devnet.solana.com",
-  "api.mainnet-beta.solana.com",
-  "api.testnet.solana.com"
-]);
-function stripRpcSecrets(raw) {
-  try {
-    const parsed = new URL(raw);
-    parsed.username = "";
-    parsed.password = "";
-    if (!PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname)) {
-      return `${parsed.protocol}//${parsed.host}/***`;
-    }
-    const marker = parsed.search.length > 0 ? "?***" : "";
-    parsed.search = "";
-    return `${parsed.toString()}${marker}`;
-  } catch {
-    return "[unparseable RPC URL]";
-  }
-}
-function isPublicSolanaRpcUrl(raw) {
-  try {
-    const parsed = new URL(raw);
-    return PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname) && !parsed.username && !parsed.password && !parsed.search && (parsed.pathname === "" || parsed.pathname === "/");
-  } catch {
-    return false;
-  }
-}
-function redactRpcUrlsInText(text) {
-  return text.replace(/https?:\/\/[^\s)'"]+/g, (url) => stripRpcSecrets(url));
-}
 async function resolveMediaField(value, agentDir, cache, blossom, identity2, onCacheUpdate) {
   if (!value) {
     return void 0;
@@ -10057,11 +10718,23 @@ async function uploadOrReuse(cacheKey, absPath, containRoot, cache, blossom, ide
     );
     return void 0;
   }
+  if (!isImagePath(realPath)) {
+    console.warn(
+      `  ! Skipping upload of ${basename(absPath)}: not an image (${IMAGE_EXTENSIONS.join(", ")}). Nothing else is published from an agent directory.`
+    );
+    return void 0;
+  }
   try {
     const cached = await lookupCachedUrl(cache, cacheKey, realPath);
     if (cached) {
       return cached;
     }
+    if (isBlockingNodeSync(realPath)) {
+      console.warn(
+        `  ! Skipping ${basename(realPath)}: it is a pipe, socket or device, not a file`
+      );
+      return void 0;
+    }
     console.log(`  Uploading ${basename(realPath)}...`);
     const data = readFileSync(realPath);
     const sha256 = createHash("sha256").update(data).digest("hex");