@elisym/mcp 0.14.0 → 0.15.0

package/dist/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
-import { loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
+import { createIrohTransport, loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
 import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
-import { stat, readFile, writeFile, rename, unlink } from 'node:fs/promises';
-import { homedir, platform } from 'node:os';
-import { dirname, join, resolve, isAbsolute, relative } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { realpath, readFile, stat, rm, writeFile, rename, unlink } from 'node:fs/promises';
+import { tmpdir, homedir, platform } from 'node:os';
+import { dirname, join, resolve, isAbsolute, basename, relative } from 'node:path';
+import { readFileSync, mkdtempSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
@@ -346,6 +346,9 @@ function checkLen(field, value, max) {
 var MAX_INPUT_LEN = LIMITS.MAX_INPUT_LENGTH;
 var MAX_CAPABILITIES = LIMITS.MAX_CAPABILITIES;
 var MAX_TIMEOUT_SECS = LIMITS.MAX_TIMEOUT_SECS;
+LIMITS.NIP44_MAX_PLAINTEXT_BYTES;
+LIMITS.MAX_ENCRYPTED_INLINE_BYTES;
+LIMITS.MAX_REINLINE_TEXT_BYTES;
 var MAX_NPUB_LEN = 128;
 var MAX_EVENT_ID_LEN = 128;
 var MAX_PAYMENT_REQ_LEN = 1e4;
@@ -684,6 +687,32 @@ async function installToConfig(path, entry, agentRebind) {
   await safeRewriteJson(path, raw, config);
   return "installed";
 }
+function ensureIrohTransport(agent) {
+  if (agent.irohTransport) {
+    return agent.irohTransport;
+  }
+  let storePath;
+  if (agent.agentDir !== void 0) {
+    storePath = join(agent.agentDir, ".iroh");
+  } else {
+    storePath = mkdtempSync(join(tmpdir(), "elisym-iroh-"));
+    agent.irohStoreDir = storePath;
+  }
+  agent.irohTransport = createIrohTransport({ storePath });
+  return agent.irohTransport;
+}
+async function shutdownIrohTransport(agent) {
+  if (agent.irohTransport) {
+    await agent.irohTransport.shutdown().catch(() => {
+    });
+    agent.irohTransport = void 0;
+  }
+  if (agent.irohStoreDir !== void 0) {
+    await rm(agent.irohStoreDir, { recursive: true, force: true }).catch(() => {
+    });
+    agent.irohStoreDir = void 0;
+  }
+}
 function createLogger(destination) {
   const opts = {
     name: "elisym-mcp",
@@ -1009,8 +1038,27 @@ Solana: ${solanaSigner.address}
 ];
 var execFileP = promisify(execFile);
 var MAX_INPUT_PATH_LEN = 4096;
-var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key)$/i;
-var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([".elisym", ".ssh", ".aws", ".gnupg"]);
+var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key|\.bashrc|\.bash_profile|\.bash_login|\.bash_logout|\.bash_aliases|\.profile|\.zshrc|\.zprofile|\.zshenv|\.zlogin|\.zlogout|config\.fish|\.gitconfig|\.npmrc|\.netrc|crontab|sudoers|bash\.bashrc|.*\.service|.*\.desktop)$/i;
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([
+  ".elisym",
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".git",
+  "launchagents",
+  "launchdaemons",
+  "autostart",
+  "systemd",
+  "sudoers.d",
+  "cron.d",
+  "cron.daily",
+  "cron.hourly",
+  "cron.weekly",
+  "cron.monthly",
+  "crontabs",
+  "profile.d",
+  "init.d"
+]);
 function isSensitiveInputPath(absPath) {
   if (SENSITIVE_NAME_RE.test(absPath)) {
     return true;
@@ -1021,8 +1069,38 @@ function isSensitiveInputPath(absPath) {
   const segments = absPath.split(/[/\\]+/);
   return segments.some((segment) => SENSITIVE_DIR_SEGMENTS.has(segment.toLowerCase()));
 }
+async function resolveOutputPath(outputPath, options) {
+  if (outputPath.length > MAX_INPUT_PATH_LEN) {
+    throw new Error(
+      `output_path too long: ${outputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`
+    );
+  }
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(outputPath) ? resolve(outputPath) : resolve(cwd, outputPath);
+  const realParent = await realpath(dirname(logicalPath)).catch(() => dirname(logicalPath));
+  const absPath = resolve(realParent, basename(logicalPath));
+  const realDest = await realpath(logicalPath).catch(() => void 0);
+  const writeTarget = realDest ?? absPath;
+  const sensitiveCandidates = realDest !== void 0 ? [absPath, logicalPath, realDest] : [absPath, logicalPath];
+  if (sensitiveCandidates.some((candidate) => isSensitiveInputPath(candidate))) {
+    throw new Error(
+      `Refusing to write a job result to a sensitive path: ${writeTarget}. Choose a destination outside secret/config/auto-run locations.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, writeTarget);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `output_path "${writeTarget}" resolves outside the working directory (${realCwd}). Choose a destination under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  return writeTarget;
+}
 var GIT_TIMEOUT_MS = 3e4;
-var GIT_MAX_BUFFER = MAX_INPUT_LEN * 2;
+var GIT_MAX_BUFFER = LIMITS.MAX_REINLINE_TEXT_BYTES + MAX_INPUT_LEN;
 var GIT_SAFETY_ARGS = [
   "-c",
   "core.fsmonitor=",
@@ -1040,23 +1118,34 @@ function isValidGitRef(ref) {
   }
   return /^[A-Za-z0-9._/@~^-]+$/.test(ref);
 }
-async function readJobInputFile(inputPath, options) {
+async function validateInputPath(inputPath, options) {
   if (inputPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`input_path too long: ${inputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
   const cwd = resolve(process.cwd());
-  const absPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
-  if (isSensitiveInputPath(absPath)) {
+  const logicalPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`input_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve input_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
     throw new Error(
       `Refusing to read a sensitive file as job input: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
     );
   }
   if (!options?.allowOutsideCwd) {
-    const rel = relative(cwd, absPath);
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
     const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
     if (!insideCwd) {
       throw new Error(
-        `input_path "${absPath}" resolves outside the working directory (${cwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
+        `input_path "${absPath}" resolves outside the working directory (${realCwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
       );
     }
   }
@@ -1073,18 +1162,36 @@ async function readJobInputFile(inputPath, options) {
   if (!stats.isFile()) {
     throw new Error(`input_path is not a regular file: ${absPath}`);
   }
-  if (stats.size > MAX_INPUT_LEN) {
-    throw new Error(
-      `input_path too large: ${stats.size} bytes (max ${MAX_INPUT_LEN}). Trim the file or split the job.`
-    );
+  return { absPath, size: stats.size };
+}
+async function isProbablyText(absPath, size) {
+  if (size > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+    return false;
+  }
+  const bytes = await readFile(absPath);
+  if (bytes.includes(0)) {
+    return false;
+  }
+  try {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    decoder.decode(bytes);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function prepareFileInput(inputPath, options) {
+  const { absPath, size } = await validateInputPath(inputPath, options);
+  if (size === 0) {
+    throw new Error("input_path is an empty file - nothing to send.");
   }
-  const content = await readFile(absPath, "utf-8");
-  if (content.length > MAX_INPUT_LEN) {
+  if (size > LIMITS.MAX_FILE_SIZE) {
     throw new Error(
-      `input_path content too long after decoding: ${content.length} chars (max ${MAX_INPUT_LEN}).`
+      `input_path too large: ${size} bytes (max ${LIMITS.MAX_FILE_SIZE} for a file transfer).`
     );
   }
-  return content;
+  const mime = await isProbablyText(absPath, size) ? "text/plain" : "application/octet-stream";
+  return { absPath, size, name: basename(absPath), mime };
 }
 async function execGit(repoPath, args) {
   try {
@@ -1151,18 +1258,18 @@ async function computeGitDiff(repoPath, base) {
         `Invalid "base": ${base}. Use a branch/tag/commit ref (letters, digits, ". _ / @ ~ ^ -", no leading "-", no "..").`
       );
     }
-    args = ["diff", "--no-ext-diff", "--end-of-options", `${base}...HEAD`];
+    args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${base}...HEAD`];
     describedRange = `${base}...HEAD`;
   } else if (await isDirty(absRepo)) {
-    args = ["diff", "--no-ext-diff", "HEAD"];
+    args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
     describedRange = "HEAD (working tree, uncommitted changes)";
   } else {
     const detected = await detectDefaultBase(absRepo);
     if (detected) {
-      args = ["diff", "--no-ext-diff", "--end-of-options", `${detected}...HEAD`];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${detected}...HEAD`];
       describedRange = `${detected}...HEAD`;
     } else {
-      args = ["diff", "--no-ext-diff", "HEAD"];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
       describedRange = "HEAD (no main/master detected)";
     }
   }
@@ -1172,9 +1279,10 @@ async function computeGitDiff(repoPath, base) {
       `No changes in range ${describedRange}. Nothing to review - commit work, pass an explicit "base", or check the repo path.`
     );
   }
-  if (diff.length > MAX_INPUT_LEN) {
+  const diffBytes = utf8ByteLength(diff);
+  if (diffBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
     throw new Error(
-      `Diff for range ${describedRange} is ${diff.length} chars (max ${MAX_INPUT_LEN}). Pass a narrower "base" or split the review.`
+      `Diff for range ${describedRange} is ${diffBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or split the review.`
     );
   }
   return { diff, describedRange };
@@ -1416,7 +1524,13 @@ var CustomerJobEntrySchema = z.object({
   completedAt: z.number().int().nonnegative(),
   resultPreview: z.string().max(RESULT_PREVIEW_MAX_LEN).optional(),
   paymentSig: z.string().max(128).optional(),
-  customerFeedback: FeedbackSchema.optional()
+  customerFeedback: FeedbackSchema.optional(),
+  /** JSON-serialized FileAttachment when the result is a file (fetched via fetch_job_file). */
+  attachmentJson: z.string().max(8192).optional(),
+  /** Local path the result file was downloaded to (set by fetch_job_file). */
+  resultFilePath: z.string().max(4096).optional(),
+  /** Unix ms when the result file was downloaded. */
+  fetchedAt: z.number().int().nonnegative().optional()
 }).strict();
 var CustomerHistorySchema = z.object({
   version: z.literal(1),
@@ -1515,6 +1629,16 @@ var GetJobResultSchema = z.object({
   timeout_secs: z.number().int().min(1).max(600).default(60),
   lookback_secs: z.number().int().min(60).max(7 * 24 * 3600).default(24 * 3600).describe("How far back to search for the result. Defaults to 24h.")
 });
+var FetchJobFileSchema = z.object({
+  job_event_id: z.string(),
+  output_path: z.string().min(1).max(4096).describe("Local path to write the downloaded result file to."),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow writing outside the MCP server working directory. Off by default: the bytes come from an untrusted provider, so writes are confined to the working directory subtree (and never to a secret/auto-run path) unless this is set."
+  ),
+  provider_npub: z.string().optional(),
+  kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
+  timeout_secs: z.number().int().min(1).max(600).default(300)
+});
 var ListMyJobsSchema = z.object({
   limit: z.number().int().min(1).max(50).default(20),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
@@ -1749,7 +1873,7 @@ function makePaymentFeedbackHandler(opts) {
       opts.resolveNoWallet(
         `Payment required but no Solana wallet configured.
 Amount: ${signedAmount !== void 0 ? formatAssetAmount(asset, BigInt(signedAmount)) : "unknown"}
-Payment request: ${paymentRequest}`
+Payment request: ${sanitizeUntrusted(paymentRequest, "structured").text}`
       );
       return;
     }
@@ -1788,6 +1912,57 @@ Payment request: ${paymentRequest}`
   };
   return { onFeedback, onResultReceived };
 }
+function formatFileResultMetadata(jobId, attachment) {
+  const name = sanitizeField(attachment.name, 200);
+  const mime = sanitizeField(attachment.mime, 100);
+  const details = sanitizeUntrusted(
+    `name: ${name}
+size: ${attachment.size} bytes
+type: ${mime}`,
+    "text"
+  ).text;
+  return `Job completed. The result is a FILE (not inlined here):
+${details}
+Download it with fetch_job_file(job_event_id="${jobId}", output_path="<local path>").`;
+}
+function decodeResultPreview(rawContent) {
+  try {
+    const decoded = decodeJobPayload(rawContent);
+    if (decoded.attachment) {
+      return `[file result: ${decoded.attachment.name} (${decoded.attachment.size} bytes). Download with fetch_job_file.]`;
+    }
+    return decoded.text ?? rawContent;
+  } catch {
+    return rawContent;
+  }
+}
+async function prepareTextInput(agent, text) {
+  if (utf8ByteLength(text) <= LIMITS.MAX_ENCRYPTED_INLINE_BYTES) {
+    return { input: text };
+  }
+  const byteLength = utf8ByteLength(text);
+  if (agent.agentDir === void 0) {
+    return {
+      error: `Input is ${byteLength} bytes, over the ${LIMITS.MAX_ENCRYPTED_INLINE_BYTES}-byte inline limit, so it must be sent via P2P transfer - which requires a persistent agent (this is an ephemeral session).`
+    };
+  }
+  try {
+    const seeded = await ensureIrohTransport(agent).seedBytes(Buffer.from(text, "utf8"));
+    return {
+      input: "",
+      attachment: {
+        name: "input.txt",
+        size: seeded.size,
+        mime: "text/plain",
+        transports: [{ kind: "iroh", ticket: seeded.ticket }]
+      }
+    };
+  } catch (e) {
+    return {
+      error: `Failed to seed input for transfer: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
 async function executeSubmitAndPay(ctx, agent, params) {
   const ping = await agent.client.ping.pingAgent(params.providerPubkey, PRE_PING_TIMEOUT_MS);
   if (!ping.online) {
@@ -1819,12 +1994,14 @@ async function executeSubmitAndPay(ctx, agent, params) {
     input: params.input,
     capability: params.dTag,
     providerPubkey: params.providerPubkey,
-    kindOffset: params.kindOffset
+    kindOffset: params.kindOffset,
+    attachment: params.attachment
   });
   let paymentSig;
   let paidAmountSubunits;
   let paidAssetKey;
   let paymentWarnings = [];
+  let resultAttachment;
   try {
     const result = await awaitJobResult(
       agent,
@@ -1855,7 +2032,12 @@ async function executeSubmitAndPay(ctx, agent, params) {
           providerPubkey: params.providerPubkey,
           customerPublicKey: agent.identity.publicKey,
           callbacks: {
-            onResult(content) {
+            onResult(content, _eventId, attachment) {
+              if (attachment) {
+                resultAttachment = attachment;
+                payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                return;
+              }
               const kind = isLikelyBase64(content) ? "binary" : "text";
               const sanitized = sanitizeUntrusted(content, kind);
               payHandler.onResultReceived(`Job completed.
@@ -1864,7 +2046,7 @@ ${sanitized.text}`);
             },
             onFeedback: payHandler.onFeedback,
             onError(error) {
-              reject(new Error(`Job error: ${error}`));
+              reject(new Error(`Job error: ${sanitizeUntrusted(error, "text").text}`));
             },
             onTimeout(timeoutMs) {
               reject(new JobWaitTimeoutError(timeoutMs));
@@ -1887,7 +2069,8 @@ ${sanitized.text}`);
       submittedAt,
       completedAt: Date.now(),
       resultPreview: result.slice(0, RESULT_PREVIEW_MAX_LEN),
-      paymentSig
+      paymentSig,
+      attachmentJson: resultAttachment ? JSON.stringify(resultAttachment) : void 0
     });
     const warningBlock = paymentWarnings.length > 0 ? `${paymentWarnings.join("\n")}
 ` : "";
@@ -2018,7 +2201,11 @@ var customerTools = [
             providerPubkey,
             customerPublicKey: agent.identity.publicKey,
             callbacks: {
-              onResult(content, _eventId) {
+              onResult(content, _eventId, attachment) {
+                if (attachment) {
+                  resolve(formatFileResultMetadata(input.job_event_id, attachment));
+                  return;
+                }
                 const kind = isLikelyBase64(content) ? "binary" : "text";
                 const sanitized = sanitizeUntrusted(content, kind);
                 resolve(sanitized.text);
@@ -2054,6 +2241,79 @@ var customerTools = [
       return textResult(result);
     }
   }),
+  defineTool({
+    name: "fetch_job_file",
+    description: "Download a job result that was delivered as a FILE (transferred P2P via iroh) to a local path. Use this after submit_and_pay_job or get_job_result reports a file result. Resumable and bounded by a max file size; the bytes are written to disk, never returned to you inline.",
+    schema: FetchJobFileSchema,
+    async handler(ctx, input) {
+      checkLen("job_event_id", input.job_event_id, MAX_EVENT_ID_LEN);
+      let outputPath;
+      try {
+        outputPath = await resolveOutputPath(input.output_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
+      } catch (error) {
+        return errorResult(error instanceof Error ? error.message : String(error));
+      }
+      const agent = ctx.active();
+      let attachment;
+      if (agent.agentDir !== void 0) {
+        const entry = await findCustomerJob(agent.agentDir, input.job_event_id);
+        if (entry?.attachmentJson !== void 0) {
+          try {
+            attachment = JSON.parse(entry.attachmentJson);
+          } catch {
+          }
+        }
+      }
+      if (attachment === void 0) {
+        try {
+          const results = await agent.client.marketplace.queryJobResults(
+            agent.identity,
+            [input.job_event_id],
+            [input.kind_offset]
+          );
+          const resultEntry = results.get(input.job_event_id);
+          if (resultEntry !== void 0 && !resultEntry.decryptionFailed) {
+            attachment = decodeJobPayload(resultEntry.content).attachment;
+          }
+        } catch (error) {
+          logger.warn(
+            { event: "fetch_job_file_query_failed", err: String(error) },
+            "relay re-fetch of result failed"
+          );
+        }
+      }
+      if (attachment === void 0) {
+        return errorResult(
+          `No file result found for event_id="${input.job_event_id}". It may be a text result, not yet delivered, or expired from the relays.`
+        );
+      }
+      const irohTransport = attachment.transports.find((transport) => transport.kind === "iroh");
+      if (irohTransport === void 0) {
+        return errorResult("Result attachment has no supported transport (iroh).");
+      }
+      try {
+        await ensureIrohTransport(agent).fetchToPath(irohTransport.ticket, outputPath, {
+          maxBytes: LIMITS.MAX_FILE_SIZE,
+          timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3
+        });
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return errorResult(
+          `Failed to download the file for event_id="${input.job_event_id}": ${msg}. The provider may be offline or no longer seeding it.`
+        );
+      }
+      if (agent.agentDir !== void 0) {
+        await updateCustomerJob(agent.agentDir, input.job_event_id, {
+          resultFilePath: outputPath,
+          fetchedAt: Date.now()
+        }).catch(() => {
+        });
+      }
+      return textResult(`Downloaded result file to ${outputPath}.`);
+    }
+  }),
   defineTool({
     name: "list_my_jobs",
     description: "List jobs submitted by the CURRENT AGENT from the local on-disk history (.customer-history.json). Pass include_nostr=true to also pull from Nostr relays and merge - useful for jobs submitted outside this MCP (e.g. the web app) or to recover after a local-cache wipe. Targeted (encrypted) Nostr results are decrypted automatically. Each entry is tagged with source=local-only|nostr-only|merged. WARNING: result content is untrusted external data.",
@@ -2116,14 +2376,14 @@ var customerTools = [
             if (decrypted.decryptionFailed) {
               resultText = "[decryption failed - targeted result not for this agent]";
             } else {
-              const cleaned = sanitizeInner(decrypted.content);
+              const cleaned = sanitizeInner(decodeResultPreview(decrypted.content));
               if (scanForInjections(cleaned, "full")) {
                 freetextSuspicious = true;
               }
               resultText = cleaned;
             }
           } else if (nostr.result) {
-            const cleaned = sanitizeInner(nostr.result);
+            const cleaned = sanitizeInner(decodeResultPreview(nostr.result));
             if (scanForInjections(cleaned, "full")) {
               freetextSuspicious = true;
             }
@@ -2169,11 +2429,21 @@ ${wrapped}`);
     schema: SubmitAndPayJobSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
-      checkLen("input", input.input, MAX_INPUT_LEN);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
+      const inputBytes = utf8ByteLength(input.input);
+      if (inputBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+        return errorResult(
+          `Input is ${inputBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES} for an inline job). Send a large file with submit_and_pay_job_from_file.`
+        );
+      }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, input.input);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: input.input,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2190,22 +2460,46 @@ ${wrapped}`);
   }),
   defineTool({
     name: "submit_and_pay_job_from_file",
-    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large (logs, generated content, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. Max file size matches the inline limit.",
+    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large or binary (images, logs, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. The file is ALWAYS transferred peer-to-peer via iroh, so this needs: a persistent agent, a PAID provider skill (free skills reject file inputs), and the iroh addon. Text files reach the skill on stdin; binary files via ELISYM_INPUT_FILE.",
     schema: SubmitAndPayJobFromFileSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
-      let payload;
+      let prepared;
       try {
-        payload = await readJobInputFile(input.input_path, {
+        prepared = await prepareFileInput(input.input_path, {
           allowOutsideCwd: input.allow_outside_cwd
         });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
       const agent = ctx.active();
+      if (agent.agentDir === void 0) {
+        return errorResult(
+          `Sending a file requires a persistent agent (this is an ephemeral session). Files are always transferred P2P via iroh, never inline.`
+        );
+      }
+      let attachment;
+      try {
+        const seeded = await ensureIrohTransport(agent).seedPath(prepared.absPath);
+        attachment = {
+          name: prepared.name,
+          size: seeded.size,
+          mime: prepared.mime,
+          transports: [{ kind: "iroh", ticket: seeded.ticket }]
+        };
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/@number0\/iroh|iroh file transfer is unavailable/i.test(msg)) {
+          return errorResult(
+            `File transfer is unavailable: the optional @number0/iroh addon is not installed. Install it (e.g. \`bun add @number0/iroh\`) to send files.`
+          );
+        }
+        return errorResult(`Failed to seed file for transfer: ${msg}`);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: "",
+        attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2234,14 +2528,20 @@ ${wrapped}`);
 ` : "";
       const payload = `${promptBlock}--- git diff (${diffResult.describedRange}) ---
 ${diffResult.diff}`;
-      if (payload.length > MAX_INPUT_LEN) {
+      const payloadBytes = utf8ByteLength(payload);
+      if (payloadBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
         return errorResult(
-          `Combined prompt + diff is ${payload.length} chars (max ${MAX_INPUT_LEN}). Shorten the prompt or pass a narrower base.`
+          `Combined prompt + diff is ${payloadBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or shorten the prompt.`
         );
       }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, payload);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2367,7 +2667,11 @@ To confirm, call buy_capability again with max_price_lamports set (e.g. ${price}
               providerPubkey,
               customerPublicKey: agent.identity.publicKey,
               callbacks: {
-                onResult(content) {
+                onResult(content, _eventId, attachment) {
+                  if (attachment) {
+                    payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                    return;
+                  }
                   const kind = isLikelyBase64(content) ? "binary" : "text";
                   const sanitized = sanitizeUntrusted(content, kind);
                   payHandler.onResultReceived(
@@ -2892,7 +3196,13 @@ var discoveryTools = [
               asset_mint: asset.mint,
               chain: card.payment?.chain,
               network: card.payment?.network,
-              network_fee_estimate_sol: gasEstimate
+              network_fee_estimate_sol: gasEstimate,
+              // File-exchange hints (dynamic-script). Informational: the MCP/CLI
+              // CAN send files via submit_and_pay_job_from_file, so this does not
+              // gate anything - it just tells the caller a file input is expected.
+              // Already length-bounded by parseCapabilityEvent.
+              ...card.inputMime ? { input_mime: card.inputMime } : {},
+              ...card.outputMime ? { output_mime: card.outputMime } : {}
             };
           }),
           supported_kinds: a.supportedKinds,
@@ -3701,12 +4011,20 @@ if (toolMap.size !== allTools.length) {
   );
 }
 function redactSecrets(text) {
-  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]");
+  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]").replace(/\[\s*(?:\d{1,3}\s*,\s*){31,}\d{1,3}\s*\]/g, "[REDACTED]");
 }
 function safeError(context, e) {
   const message = e instanceof Error ? e.message : String(e);
   const stack = e instanceof Error ? e.stack : void 0;
-  logger.error({ event: "tool_error", context, err: message, stack }, "tool call failed");
+  logger.error(
+    {
+      event: "tool_error",
+      context,
+      err: redactSecrets(message),
+      stack: stack !== void 0 ? redactSecrets(stack) : void 0
+    },
+    "tool call failed"
+  );
   let msg;
   if (e instanceof ZodError) {
     const parts = e.issues.map((i) => {
@@ -3715,9 +4033,9 @@ function safeError(context, e) {
     });
     msg = `Invalid arguments: ${parts.join("; ")}`;
   } else if (e instanceof Error) {
-    msg = e.message.split("\n")[0].slice(0, 300);
+    msg = redactSecrets(e.message).split("\n")[0].slice(0, 300);
   } else {
-    msg = String(e).slice(0, 300);
+    msg = redactSecrets(String(e)).split("\n")[0].slice(0, 300);
   }
   return {
     // pino redact does not cover error-message string contents, so scrub key/secret
@@ -3847,6 +4165,7 @@ async function startServer(ctx) {
     shuttingDown = true;
     logger.info({ event: "shutdown", reason }, "shutting down");
     for (const agent of ctx.registry.values()) {
+      await shutdownIrohTransport(agent);
       try {
         agent.client.close();
       } catch (e) {