@elisym/mcp 0.14.0 → 0.15.1

package/dist/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, formatNetworkBaseline, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
-import { loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
+import { createIrohTransport, loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
 import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
-import { stat, readFile, writeFile, rename, unlink } from 'node:fs/promises';
-import { homedir, platform } from 'node:os';
-import { dirname, join, resolve, isAbsolute, relative } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { realpath, readFile, stat, rm, writeFile, rename, unlink } from 'node:fs/promises';
+import { tmpdir, homedir, platform } from 'node:os';
+import { dirname, join, resolve, isAbsolute, basename, relative } from 'node:path';
+import { readFileSync, mkdtempSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
@@ -346,6 +346,9 @@ function checkLen(field, value, max) {
 var MAX_INPUT_LEN = LIMITS.MAX_INPUT_LENGTH;
 var MAX_CAPABILITIES = LIMITS.MAX_CAPABILITIES;
 var MAX_TIMEOUT_SECS = LIMITS.MAX_TIMEOUT_SECS;
+LIMITS.NIP44_MAX_PLAINTEXT_BYTES;
+LIMITS.MAX_ENCRYPTED_INLINE_BYTES;
+LIMITS.MAX_REINLINE_TEXT_BYTES;
 var MAX_NPUB_LEN = 128;
 var MAX_EVENT_ID_LEN = 128;
 var MAX_PAYMENT_REQ_LEN = 1e4;
@@ -684,6 +687,32 @@ async function installToConfig(path, entry, agentRebind) {
   await safeRewriteJson(path, raw, config);
   return "installed";
 }
+function ensureIrohTransport(agent) {
+  if (agent.irohTransport) {
+    return agent.irohTransport;
+  }
+  let storePath;
+  if (agent.agentDir !== void 0) {
+    storePath = join(agent.agentDir, ".iroh");
+  } else {
+    storePath = mkdtempSync(join(tmpdir(), "elisym-iroh-"));
+    agent.irohStoreDir = storePath;
+  }
+  agent.irohTransport = createIrohTransport({ storePath });
+  return agent.irohTransport;
+}
+async function shutdownIrohTransport(agent) {
+  if (agent.irohTransport) {
+    await agent.irohTransport.shutdown().catch(() => {
+    });
+    agent.irohTransport = void 0;
+  }
+  if (agent.irohStoreDir !== void 0) {
+    await rm(agent.irohStoreDir, { recursive: true, force: true }).catch(() => {
+    });
+    agent.irohStoreDir = void 0;
+  }
+}
 function createLogger(destination) {
   const opts = {
     name: "elisym-mcp",
@@ -1009,8 +1038,27 @@ Solana: ${solanaSigner.address}
 ];
 var execFileP = promisify(execFile);
 var MAX_INPUT_PATH_LEN = 4096;
-var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key)$/i;
-var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([".elisym", ".ssh", ".aws", ".gnupg"]);
+var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key|\.bashrc|\.bash_profile|\.bash_login|\.bash_logout|\.bash_aliases|\.profile|\.zshrc|\.zprofile|\.zshenv|\.zlogin|\.zlogout|config\.fish|\.gitconfig|\.npmrc|\.netrc|crontab|sudoers|bash\.bashrc|.*\.service|.*\.desktop)$/i;
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([
+  ".elisym",
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".git",
+  "launchagents",
+  "launchdaemons",
+  "autostart",
+  "systemd",
+  "sudoers.d",
+  "cron.d",
+  "cron.daily",
+  "cron.hourly",
+  "cron.weekly",
+  "cron.monthly",
+  "crontabs",
+  "profile.d",
+  "init.d"
+]);
 function isSensitiveInputPath(absPath) {
   if (SENSITIVE_NAME_RE.test(absPath)) {
     return true;
@@ -1021,8 +1069,38 @@ function isSensitiveInputPath(absPath) {
   const segments = absPath.split(/[/\\]+/);
   return segments.some((segment) => SENSITIVE_DIR_SEGMENTS.has(segment.toLowerCase()));
 }
+async function resolveOutputPath(outputPath, options) {
+  if (outputPath.length > MAX_INPUT_PATH_LEN) {
+    throw new Error(
+      `output_path too long: ${outputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`
+    );
+  }
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(outputPath) ? resolve(outputPath) : resolve(cwd, outputPath);
+  const realParent = await realpath(dirname(logicalPath)).catch(() => dirname(logicalPath));
+  const absPath = resolve(realParent, basename(logicalPath));
+  const realDest = await realpath(logicalPath).catch(() => void 0);
+  const writeTarget = realDest ?? absPath;
+  const sensitiveCandidates = realDest !== void 0 ? [absPath, logicalPath, realDest] : [absPath, logicalPath];
+  if (sensitiveCandidates.some((candidate) => isSensitiveInputPath(candidate))) {
+    throw new Error(
+      `Refusing to write a job result to a sensitive path: ${writeTarget}. Choose a destination outside secret/config/auto-run locations.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, writeTarget);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `output_path "${writeTarget}" resolves outside the working directory (${realCwd}). Choose a destination under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  return writeTarget;
+}
 var GIT_TIMEOUT_MS = 3e4;
-var GIT_MAX_BUFFER = MAX_INPUT_LEN * 2;
+var GIT_MAX_BUFFER = LIMITS.MAX_REINLINE_TEXT_BYTES + MAX_INPUT_LEN;
 var GIT_SAFETY_ARGS = [
   "-c",
   "core.fsmonitor=",
@@ -1040,23 +1118,34 @@ function isValidGitRef(ref) {
   }
   return /^[A-Za-z0-9._/@~^-]+$/.test(ref);
 }
-async function readJobInputFile(inputPath, options) {
+async function validateInputPath(inputPath, options) {
   if (inputPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`input_path too long: ${inputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
   const cwd = resolve(process.cwd());
-  const absPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
-  if (isSensitiveInputPath(absPath)) {
+  const logicalPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`input_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve input_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
     throw new Error(
       `Refusing to read a sensitive file as job input: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
     );
   }
   if (!options?.allowOutsideCwd) {
-    const rel = relative(cwd, absPath);
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
     const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
     if (!insideCwd) {
       throw new Error(
-        `input_path "${absPath}" resolves outside the working directory (${cwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
+        `input_path "${absPath}" resolves outside the working directory (${realCwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
       );
     }
   }
@@ -1073,18 +1162,36 @@ async function readJobInputFile(inputPath, options) {
   if (!stats.isFile()) {
     throw new Error(`input_path is not a regular file: ${absPath}`);
   }
-  if (stats.size > MAX_INPUT_LEN) {
-    throw new Error(
-      `input_path too large: ${stats.size} bytes (max ${MAX_INPUT_LEN}). Trim the file or split the job.`
-    );
+  return { absPath, size: stats.size };
+}
+async function isProbablyText(absPath, size) {
+  if (size > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+    return false;
+  }
+  const bytes = await readFile(absPath);
+  if (bytes.includes(0)) {
+    return false;
   }
-  const content = await readFile(absPath, "utf-8");
-  if (content.length > MAX_INPUT_LEN) {
+  try {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    decoder.decode(bytes);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function prepareFileInput(inputPath, options) {
+  const { absPath, size } = await validateInputPath(inputPath, options);
+  if (size === 0) {
+    throw new Error("input_path is an empty file - nothing to send.");
+  }
+  if (size > LIMITS.MAX_FILE_SIZE) {
     throw new Error(
-      `input_path content too long after decoding: ${content.length} chars (max ${MAX_INPUT_LEN}).`
+      `input_path too large: ${size} bytes (max ${LIMITS.MAX_FILE_SIZE} for a file transfer).`
     );
   }
-  return content;
+  const mime = await isProbablyText(absPath, size) ? "text/plain" : "application/octet-stream";
+  return { absPath, size, name: basename(absPath), mime };
 }
 async function execGit(repoPath, args) {
   try {
@@ -1137,11 +1244,45 @@ async function assertGitRepo(repoPath) {
     throw new Error(`"${repoPath}" is not inside a git work tree: ${message}`);
   }
 }
-async function computeGitDiff(repoPath, base) {
+async function validateRepoPath(repoPath, options) {
   if (repoPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`repo_path too long: ${repoPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absRepo = isAbsolute(repoPath) ? repoPath : resolve(process.cwd(), repoPath);
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(repoPath) ? resolve(repoPath) : resolve(cwd, repoPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`repo_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve repo_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
+    throw new Error(
+      `Refusing to review a sensitive path: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
+    const insideCwd = rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `repo_path "${absPath}" resolves outside the working directory (${realCwd}). Move the repo under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  const stats = await stat(absPath);
+  if (!stats.isDirectory()) {
+    throw new Error(`repo_path is not a directory: ${absPath}`);
+  }
+  return absPath;
+}
+async function computeGitDiff(repoPath, base, options) {
+  const absRepo = await validateRepoPath(repoPath, options);
   await assertGitRepo(absRepo);
   let args;
   let describedRange;
@@ -1151,18 +1292,18 @@ async function computeGitDiff(repoPath, base) {
         `Invalid "base": ${base}. Use a branch/tag/commit ref (letters, digits, ". _ / @ ~ ^ -", no leading "-", no "..").`
       );
     }
-    args = ["diff", "--no-ext-diff", "--end-of-options", `${base}...HEAD`];
+    args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${base}...HEAD`];
     describedRange = `${base}...HEAD`;
   } else if (await isDirty(absRepo)) {
-    args = ["diff", "--no-ext-diff", "HEAD"];
+    args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
     describedRange = "HEAD (working tree, uncommitted changes)";
   } else {
     const detected = await detectDefaultBase(absRepo);
     if (detected) {
-      args = ["diff", "--no-ext-diff", "--end-of-options", `${detected}...HEAD`];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${detected}...HEAD`];
       describedRange = `${detected}...HEAD`;
     } else {
-      args = ["diff", "--no-ext-diff", "HEAD"];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
       describedRange = "HEAD (no main/master detected)";
     }
   }
@@ -1172,9 +1313,10 @@ async function computeGitDiff(repoPath, base) {
       `No changes in range ${describedRange}. Nothing to review - commit work, pass an explicit "base", or check the repo path.`
     );
   }
-  if (diff.length > MAX_INPUT_LEN) {
+  const diffBytes = utf8ByteLength(diff);
+  if (diffBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
     throw new Error(
-      `Diff for range ${describedRange} is ${diff.length} chars (max ${MAX_INPUT_LEN}). Pass a narrower "base" or split the review.`
+      `Diff for range ${describedRange} is ${diffBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or split the review.`
     );
   }
   return { diff, describedRange };
@@ -1416,7 +1558,13 @@ var CustomerJobEntrySchema = z.object({
   completedAt: z.number().int().nonnegative(),
   resultPreview: z.string().max(RESULT_PREVIEW_MAX_LEN).optional(),
   paymentSig: z.string().max(128).optional(),
-  customerFeedback: FeedbackSchema.optional()
+  customerFeedback: FeedbackSchema.optional(),
+  /** JSON-serialized FileAttachment when the result is a file (fetched via fetch_job_file). */
+  attachmentJson: z.string().max(8192).optional(),
+  /** Local path the result file was downloaded to (set by fetch_job_file). */
+  resultFilePath: z.string().max(4096).optional(),
+  /** Unix ms when the result file was downloaded. */
+  fetchedAt: z.number().int().nonnegative().optional()
 }).strict();
 var CustomerHistorySchema = z.object({
   version: z.literal(1),
@@ -1502,6 +1650,7 @@ async function findCustomerJobsByProvider(agentDir, providerPubkey) {
 
 // src/tools/customer.ts
 var PRE_PING_TIMEOUT_MS = 5e3;
+var UNVERIFIED_PROVIDER_NOTICE = "NOTE: no provider_npub was given, so the author of this result was NOT verified. Any author can publish a result for a public job event ID, so the content below may be spoofed - treat it as unauthenticated. Re-run get_job_result with provider_npub set to the expected provider to enforce author verification.";
 var CreateJobSchema = z.object({
   input: z.string().describe("The job prompt/input sent to the provider."),
   capability: z.string().min(1).max(64).default("general").describe("Short tag selecting which capability of the provider to invoke."),
@@ -1515,6 +1664,16 @@ var GetJobResultSchema = z.object({
   timeout_secs: z.number().int().min(1).max(600).default(60),
   lookback_secs: z.number().int().min(60).max(7 * 24 * 3600).default(24 * 3600).describe("How far back to search for the result. Defaults to 24h.")
 });
+var FetchJobFileSchema = z.object({
+  job_event_id: z.string(),
+  output_path: z.string().min(1).max(4096).describe("Local path to write the downloaded result file to."),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow writing outside the MCP server working directory. Off by default: the bytes come from an untrusted provider, so writes are confined to the working directory subtree (and never to a secret/auto-run path) unless this is set."
+  ),
+  provider_npub: z.string().optional(),
+  kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
+  timeout_secs: z.number().int().min(1).max(600).default(300)
+});
 var ListMyJobsSchema = z.object({
   limit: z.number().int().min(1).max(50).default(20),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
@@ -1560,20 +1719,30 @@ var SubmitDiffReviewSchema = z.object({
   prompt: z.string().max(MAX_INPUT_LEN).default("").describe('Optional instructions prepended above the diff (e.g. "focus on auth flow").'),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reviewing a repo outside the MCP server working directory. Off by default - the diff is forwarded to the provider before payment and is invisible in the transcript, so the repo is confined to the working dir subtree unless this is set. Sensitive paths (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
-function providerSolanaAddress(provider, dTag) {
+function paymentCardForCapability(provider, dTag) {
   const cards = provider.cards ?? [];
   const candidates = dTag ? cards.filter(
-    (c) => toDTag(c.name) === dTag || c.capabilities?.some((cap) => toDTag(cap) === dTag)
+    (card) => toDTag(card.name) === dTag || card.capabilities?.some((capability) => toDTag(capability) === dTag)
   ) : cards;
   for (const card of candidates.length > 0 ? candidates : cards) {
     if (card.payment?.chain === "solana" && card.payment?.address) {
-      return card.payment.address;
+      return card;
     }
   }
   return void 0;
 }
+function providerSolanaAddress(provider, dTag) {
+  return paymentCardForCapability(provider, dTag)?.payment?.address;
+}
+function advertisedPriceForCapability(provider, dTag) {
+  const card = paymentCardForCapability(provider, dTag);
+  return { price: card?.payment?.job_price ?? 0, asset: assetFromCardPayment(card?.payment) };
+}
 function wsUrlFor(httpUrl) {
   return httpUrl.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://");
 }
@@ -1623,6 +1792,29 @@ ${formatNetworkBaseline(baseline)}`;
     return "";
   }
 }
+async function confirmPriceGate(opts) {
+  const { agent, providerLabel, capability, price, asset, maxPriceLamports, toolName } = opts;
+  if (maxPriceLamports !== void 0 && price > maxPriceLamports) {
+    return errorResult(
+      `Price ${formatAssetAmount(asset, BigInt(price))} exceeds max ${formatAssetAmount(asset, BigInt(maxPriceLamports))}`
+    );
+  }
+  if (price > 0 && maxPriceLamports === void 0) {
+    const gasLine = await gasHintForCardAsset(agent, asset);
+    const subject = toolName === "buy_capability" ? `Capability "${capability}" from "${providerLabel}"` : `Job for capability "${capability}" from "${providerLabel}"`;
+    const { text } = sanitizeUntrusted(
+      `${subject} costs ${formatAssetAmount(asset, BigInt(price))}.${gasLine}
+
+To confirm, call ${toolName} again with max_price_lamports set (e.g. ${price} or higher).`,
+      "text"
+    );
+    return { content: [{ type: "text", text }] };
+  }
+  return null;
+}
+function rejectWithProviderError(reject, providerError) {
+  reject(new Error(`Job error: ${sanitizeUntrusted(providerError, "text").text}`));
+}
 var paymentStrategy = new SolanaPaymentStrategy();
 async function executePaymentFlow(agent, paymentRequest, jobId, providerPubkey, expectedRecipient) {
   let requestData;
@@ -1749,7 +1941,7 @@ function makePaymentFeedbackHandler(opts) {
       opts.resolveNoWallet(
         `Payment required but no Solana wallet configured.
 Amount: ${signedAmount !== void 0 ? formatAssetAmount(asset, BigInt(signedAmount)) : "unknown"}
-Payment request: ${paymentRequest}`
+Payment request: ${sanitizeUntrusted(paymentRequest, "structured").text}`
       );
       return;
     }
@@ -1788,6 +1980,57 @@ Payment request: ${paymentRequest}`
   };
   return { onFeedback, onResultReceived };
 }
+function formatFileResultMetadata(jobId, attachment) {
+  const name = sanitizeField(attachment.name, 200);
+  const mime = sanitizeField(attachment.mime, 100);
+  const details = sanitizeUntrusted(
+    `name: ${name}
+size: ${attachment.size} bytes
+type: ${mime}`,
+    "text"
+  ).text;
+  return `Job completed. The result is a FILE (not inlined here):
+${details}
+Download it with fetch_job_file(job_event_id="${jobId}", output_path="<local path>").`;
+}
+function decodeResultPreview(rawContent) {
+  try {
+    const decoded = decodeJobPayload(rawContent);
+    if (decoded.attachment) {
+      return `[file result: ${decoded.attachment.name} (${decoded.attachment.size} bytes). Download with fetch_job_file.]`;
+    }
+    return decoded.text ?? rawContent;
+  } catch {
+    return rawContent;
+  }
+}
+async function prepareTextInput(agent, text) {
+  if (utf8ByteLength(text) <= LIMITS.MAX_ENCRYPTED_INLINE_BYTES) {
+    return { input: text };
+  }
+  const byteLength = utf8ByteLength(text);
+  if (agent.agentDir === void 0) {
+    return {
+      error: `Input is ${byteLength} bytes, over the ${LIMITS.MAX_ENCRYPTED_INLINE_BYTES}-byte inline limit, so it must be sent via P2P transfer - which requires a persistent agent (this is an ephemeral session).`
+    };
+  }
+  try {
+    const seeded = await ensureIrohTransport(agent).seedBytes(Buffer.from(text, "utf8"));
+    return {
+      input: "",
+      attachment: {
+        name: "input.txt",
+        size: seeded.size,
+        mime: "text/plain",
+        transports: [{ kind: "iroh", ticket: seeded.ticket }]
+      }
+    };
+  } catch (e) {
+    return {
+      error: `Failed to seed input for transfer: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
 async function executeSubmitAndPay(ctx, agent, params) {
   const ping = await agent.client.ping.pingAgent(params.providerPubkey, PRE_PING_TIMEOUT_MS);
   if (!ping.online) {
@@ -1814,17 +2057,35 @@ async function executeSubmitAndPay(ctx, agent, params) {
       `Cannot buy from yourself - your agent's Solana wallet (${buyerWallet}) matches the provider's payment address. Use a different agent or provider.`
     );
   }
+  const { price: advertisedPrice, asset: advertisedAsset } = advertisedPriceForCapability(
+    provider,
+    params.dTag
+  );
+  const priceGate = await confirmPriceGate({
+    agent,
+    providerLabel: sanitizeField(provider.name || params.providerNpub, 64),
+    capability: params.capability,
+    price: advertisedPrice,
+    asset: advertisedAsset,
+    maxPriceLamports: params.maxPriceLamports,
+    toolName: params.toolName
+  });
+  if (priceGate) {
+    return priceGate;
+  }
   const submittedAt = Date.now();
   const jobId = await agent.client.marketplace.submitJobRequest(agent.identity, {
     input: params.input,
     capability: params.dTag,
     providerPubkey: params.providerPubkey,
-    kindOffset: params.kindOffset
+    kindOffset: params.kindOffset,
+    attachment: params.attachment
   });
   let paymentSig;
   let paidAmountSubunits;
   let paidAssetKey;
   let paymentWarnings = [];
+  let resultAttachment;
   try {
     const result = await awaitJobResult(
       agent,
@@ -1855,7 +2116,12 @@ async function executeSubmitAndPay(ctx, agent, params) {
           providerPubkey: params.providerPubkey,
           customerPublicKey: agent.identity.publicKey,
           callbacks: {
-            onResult(content) {
+            onResult(content, _eventId, attachment) {
+              if (attachment) {
+                resultAttachment = attachment;
+                payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                return;
+              }
               const kind = isLikelyBase64(content) ? "binary" : "text";
               const sanitized = sanitizeUntrusted(content, kind);
               payHandler.onResultReceived(`Job completed.
@@ -1864,7 +2130,7 @@ ${sanitized.text}`);
             },
             onFeedback: payHandler.onFeedback,
             onError(error) {
-              reject(new Error(`Job error: ${error}`));
+              rejectWithProviderError(reject, error);
             },
             onTimeout(timeoutMs) {
               reject(new JobWaitTimeoutError(timeoutMs));
@@ -1887,7 +2153,8 @@ ${sanitized.text}`);
       submittedAt,
       completedAt: Date.now(),
       resultPreview: result.slice(0, RESULT_PREVIEW_MAX_LEN),
-      paymentSig
+      paymentSig,
+      attachmentJson: resultAttachment ? JSON.stringify(resultAttachment) : void 0
     });
     const warningBlock = paymentWarnings.length > 0 ? `${paymentWarnings.join("\n")}
 ` : "";
@@ -2018,7 +2285,11 @@ var customerTools = [
             providerPubkey,
             customerPublicKey: agent.identity.publicKey,
             callbacks: {
-              onResult(content, _eventId) {
+              onResult(content, _eventId, attachment) {
+                if (attachment) {
+                  resolve(formatFileResultMetadata(input.job_event_id, attachment));
+                  return;
+                }
                 const kind = isLikelyBase64(content) ? "binary" : "text";
                 const sanitized = sanitizeUntrusted(content, kind);
                 resolve(sanitized.text);
@@ -2029,7 +2300,7 @@ var customerTools = [
                 }
               },
               onError(error) {
-                reject(new Error(`Job error: ${error}`));
+                rejectWithProviderError(reject, error);
               },
               onTimeout(timeoutMs) {
                 reject(new JobWaitTimeoutError(timeoutMs));
@@ -2051,9 +2322,87 @@ var customerTools = [
         }
         return errorResult(`Failed to fetch result for event_id="${input.job_event_id}": ${msg}`);
       }
+      if (providerPubkey === void 0) {
+        return textResult(`${UNVERIFIED_PROVIDER_NOTICE}
+
+${result}`);
+      }
       return textResult(result);
     }
   }),
+  defineTool({
+    name: "fetch_job_file",
+    description: "Download a job result that was delivered as a FILE (transferred P2P via iroh) to a local path. Use this after submit_and_pay_job or get_job_result reports a file result. Resumable and bounded by a max file size; the bytes are written to disk, never returned to you inline.",
+    schema: FetchJobFileSchema,
+    async handler(ctx, input) {
+      checkLen("job_event_id", input.job_event_id, MAX_EVENT_ID_LEN);
+      let outputPath;
+      try {
+        outputPath = await resolveOutputPath(input.output_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
+      } catch (error) {
+        return errorResult(error instanceof Error ? error.message : String(error));
+      }
+      const agent = ctx.active();
+      let attachment;
+      if (agent.agentDir !== void 0) {
+        const entry = await findCustomerJob(agent.agentDir, input.job_event_id);
+        if (entry?.attachmentJson !== void 0) {
+          try {
+            attachment = JSON.parse(entry.attachmentJson);
+          } catch {
+          }
+        }
+      }
+      if (attachment === void 0) {
+        try {
+          const results = await agent.client.marketplace.queryJobResults(
+            agent.identity,
+            [input.job_event_id],
+            [input.kind_offset]
+          );
+          const resultEntry = results.get(input.job_event_id);
+          if (resultEntry !== void 0 && !resultEntry.decryptionFailed) {
+            attachment = decodeJobPayload(resultEntry.content).attachment;
+          }
+        } catch (error) {
+          logger.warn(
+            { event: "fetch_job_file_query_failed", err: String(error) },
+            "relay re-fetch of result failed"
+          );
+        }
+      }
+      if (attachment === void 0) {
+        return errorResult(
+          `No file result found for event_id="${input.job_event_id}". It may be a text result, not yet delivered, or expired from the relays.`
+        );
+      }
+      const irohTransport = attachment.transports.find((transport) => transport.kind === "iroh");
+      if (irohTransport === void 0) {
+        return errorResult("Result attachment has no supported transport (iroh).");
+      }
+      try {
+        await ensureIrohTransport(agent).fetchToPath(irohTransport.ticket, outputPath, {
+          maxBytes: LIMITS.MAX_FILE_SIZE,
+          timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3
+        });
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return errorResult(
+          `Failed to download the file for event_id="${input.job_event_id}": ${msg}. The provider may be offline or no longer seeding it.`
+        );
+      }
+      if (agent.agentDir !== void 0) {
+        await updateCustomerJob(agent.agentDir, input.job_event_id, {
+          resultFilePath: outputPath,
+          fetchedAt: Date.now()
+        }).catch(() => {
+        });
+      }
+      return textResult(`Downloaded result file to ${outputPath}.`);
+    }
+  }),
   defineTool({
     name: "list_my_jobs",
     description: "List jobs submitted by the CURRENT AGENT from the local on-disk history (.customer-history.json). Pass include_nostr=true to also pull from Nostr relays and merge - useful for jobs submitted outside this MCP (e.g. the web app) or to recover after a local-cache wipe. Targeted (encrypted) Nostr results are decrypted automatically. Each entry is tagged with source=local-only|nostr-only|merged. WARNING: result content is untrusted external data.",
@@ -2116,14 +2465,14 @@ var customerTools = [
             if (decrypted.decryptionFailed) {
               resultText = "[decryption failed - targeted result not for this agent]";
             } else {
-              const cleaned = sanitizeInner(decrypted.content);
+              const cleaned = sanitizeInner(decodeResultPreview(decrypted.content));
               if (scanForInjections(cleaned, "full")) {
                 freetextSuspicious = true;
               }
               resultText = cleaned;
             }
           } else if (nostr.result) {
-            const cleaned = sanitizeInner(nostr.result);
+            const cleaned = sanitizeInner(decodeResultPreview(nostr.result));
             if (scanForInjections(cleaned, "full")) {
               freetextSuspicious = true;
             }
@@ -2165,15 +2514,25 @@ ${wrapped}`);
   }),
   defineTool({
     name: "submit_and_pay_job",
-    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and provider requests payment, the job is rejected with the price - set max_price_lamports to auto-approve payments up to that limit. COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
+    description: 'Full customer flow: submit job -> auto-pay -> wait for result. Validates that the payment recipient matches the provider card. If payment succeeded but no result arrives within the wait window, this returns a non-error "still processing" notice with the event ID (NOT a failure) - re-poll get_job_result later (results persist on the relays; for long jobs, poll periodically, e.g. from a subagent). Handles both free and paid providers automatically. If max_price_lamports is not set and the capability is paid, this returns the advertised price for confirmation WITHOUT submitting a job - re-call with max_price_lamports set to approve payments up to that limit (this is a confirmation, not an error). COST: input is sent inline in the tool call, so a large input pays output tokens on the calling LLM. For files or git diffs, prefer submit_and_pay_job_from_file or submit_diff_review respectively.',
     schema: SubmitAndPayJobSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
-      checkLen("input", input.input, MAX_INPUT_LEN);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
+      const inputBytes = utf8ByteLength(input.input);
+      if (inputBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+        return errorResult(
+          `Input is ${inputBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES} for an inline job). Send a large file with submit_and_pay_job_from_file.`
+        );
+      }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, input.input);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: input.input,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2184,35 +2543,61 @@ ${wrapped}`);
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job"
       });
     }
   }),
   defineTool({
     name: "submit_and_pay_job_from_file",
-    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large (logs, generated content, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. Max file size matches the inline limit.",
+    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large or binary (images, logs, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. The file is ALWAYS transferred peer-to-peer via iroh, so this needs: a persistent agent, a PAID provider skill (free skills reject file inputs), and the iroh addon. Text files reach the skill on stdin; binary files via ELISYM_INPUT_FILE.",
     schema: SubmitAndPayJobFromFileSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
-      let payload;
+      let prepared;
       try {
-        payload = await readJobInputFile(input.input_path, {
+        prepared = await prepareFileInput(input.input_path, {
           allowOutsideCwd: input.allow_outside_cwd
         });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
       const agent = ctx.active();
+      if (agent.agentDir === void 0) {
+        return errorResult(
+          `Sending a file requires a persistent agent (this is an ephemeral session). Files are always transferred P2P via iroh, never inline.`
+        );
+      }
+      let attachment;
+      try {
+        const seeded = await ensureIrohTransport(agent).seedPath(prepared.absPath);
+        attachment = {
+          name: prepared.name,
+          size: seeded.size,
+          mime: prepared.mime,
+          transports: [{ kind: "iroh", ticket: seeded.ticket }]
+        };
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/@number0\/iroh|iroh file transfer is unavailable/i.test(msg)) {
+          return errorResult(
+            `File transfer is unavailable: the optional @number0/iroh addon is not installed. Install it (e.g. \`bun add @number0/iroh\`) to send files.`
+          );
+        }
+        return errorResult(`Failed to seed file for transfer: ${msg}`);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: "",
+        attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_and_pay_job_from_file"
       });
     }
   }),
@@ -2225,7 +2610,9 @@ ${wrapped}`);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
       let diffResult;
       try {
-        diffResult = await computeGitDiff(input.repo_path, input.base);
+        diffResult = await computeGitDiff(input.repo_path, input.base, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
@@ -2234,21 +2621,28 @@ ${wrapped}`);
 ` : "";
       const payload = `${promptBlock}--- git diff (${diffResult.describedRange}) ---
 ${diffResult.diff}`;
-      if (payload.length > MAX_INPUT_LEN) {
+      const payloadBytes = utf8ByteLength(payload);
+      if (payloadBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
         return errorResult(
-          `Combined prompt + diff is ${payload.length} chars (max ${MAX_INPUT_LEN}). Shorten the prompt or pass a narrower base.`
+          `Combined prompt + diff is ${payloadBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or shorten the prompt.`
         );
       }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, payload);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
         dTag: toDTag(input.capability),
         kindOffset: input.kind_offset,
         timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3,
-        maxPriceLamports: input.max_price_lamports
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "submit_diff_review"
       });
     }
   }),
@@ -2290,30 +2684,17 @@ ${diffResult.diff}`;
         );
         return errorResult(text);
       }
-      const price = card.payment?.job_price ?? 0;
-      const cardAsset = assetFromCardPayment(card.payment);
-      if (input.max_price_lamports !== void 0 && price > input.max_price_lamports) {
-        return errorResult(
-          `Price ${formatAssetAmount(cardAsset, BigInt(price))} exceeds max ${formatAssetAmount(cardAsset, BigInt(input.max_price_lamports))}`
-        );
-      }
-      if (price > 0 && input.max_price_lamports === void 0) {
-        const gasLine = await gasHintForCardAsset(agent, cardAsset);
-        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
-        const { text } = sanitizeUntrusted(
-          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
-          "text"
-        );
-        return {
-          content: [
-            {
-              type: "text",
-              text
-            }
-          ]
-        };
+      const priceGate = await confirmPriceGate({
+        agent,
+        providerLabel: sanitizeField(provider.name || input.provider_npub, 64),
+        capability: input.capability,
+        price: card.payment?.job_price ?? 0,
+        asset: assetFromCardPayment(card.payment),
+        maxPriceLamports: input.max_price_lamports,
+        toolName: "buy_capability"
+      });
+      if (priceGate) {
+        return priceGate;
       }
       const expectedRecipient = card.payment?.chain === "solana" ? card.payment.address : void 0;
       if (agent.solanaKeypair && !expectedRecipient) {
@@ -2367,7 +2748,11 @@ To confirm, call buy_capability again with max_price_lamports set (e.g. ${price}
               providerPubkey,
               customerPublicKey: agent.identity.publicKey,
               callbacks: {
-                onResult(content) {
+                onResult(content, _eventId, attachment) {
+                  if (attachment) {
+                    payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                    return;
+                  }
                   const kind = isLikelyBase64(content) ? "binary" : "text";
                   const sanitized = sanitizeUntrusted(content, kind);
                   payHandler.onResultReceived(
@@ -2378,7 +2763,7 @@ ${sanitized.text}`
                 },
                 onFeedback: payHandler.onFeedback,
                 onError(error) {
-                  reject(new Error(`Job error: ${error}`));
+                  rejectWithProviderError(reject, error);
                 },
                 onTimeout(timeoutMs) {
                   reject(new JobWaitTimeoutError(timeoutMs));
@@ -2892,7 +3277,13 @@ var discoveryTools = [
               asset_mint: asset.mint,
               chain: card.payment?.chain,
               network: card.payment?.network,
-              network_fee_estimate_sol: gasEstimate
+              network_fee_estimate_sol: gasEstimate,
+              // File-exchange hints (dynamic-script). Informational: the MCP/CLI
+              // CAN send files via submit_and_pay_job_from_file, so this does not
+              // gate anything - it just tells the caller a file input is expected.
+              // Already length-bounded by parseCapabilityEvent.
+              ...card.inputMime ? { input_mime: card.inputMime } : {},
+              ...card.outputMime ? { output_mime: card.outputMime } : {}
             };
           }),
           supported_kinds: a.supportedKinds,
@@ -3701,12 +4092,20 @@ if (toolMap.size !== allTools.length) {
   );
 }
 function redactSecrets(text) {
-  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]");
+  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]").replace(/\[\s*(?:\d{1,3}\s*,\s*){31,}\d{1,3}\s*\]/g, "[REDACTED]");
 }
 function safeError(context, e) {
   const message = e instanceof Error ? e.message : String(e);
   const stack = e instanceof Error ? e.stack : void 0;
-  logger.error({ event: "tool_error", context, err: message, stack }, "tool call failed");
+  logger.error(
+    {
+      event: "tool_error",
+      context,
+      err: redactSecrets(message),
+      stack: stack !== void 0 ? redactSecrets(stack) : void 0
+    },
+    "tool call failed"
+  );
   let msg;
   if (e instanceof ZodError) {
     const parts = e.issues.map((i) => {
@@ -3715,9 +4114,9 @@ function safeError(context, e) {
     });
     msg = `Invalid arguments: ${parts.join("; ")}`;
   } else if (e instanceof Error) {
-    msg = e.message.split("\n")[0].slice(0, 300);
+    msg = redactSecrets(e.message).split("\n")[0].slice(0, 300);
   } else {
-    msg = String(e).slice(0, 300);
+    msg = redactSecrets(String(e)).split("\n")[0].slice(0, 300);
   }
   return {
     // pino redact does not cover error-message string contents, so scrub key/secret
@@ -3847,6 +4246,7 @@ async function startServer(ctx) {
     shuttingDown = true;
     logger.info({ event: "shutdown", reason }, "shutting down");
     for (const agent of ctx.registry.values()) {
+      await shutdownIrohTransport(agent);
       try {
         agent.client.close();
       } catch (e) {