@hachej/boring-agent 0.1.12 → 0.1.14

package/dist/server/index.js

@@ -1489,286 +1489,827 @@ function createNodeWorkspace(root) {
   };
 }
 
-// src/server/workspace/provisionRuntime.ts
-import { createHash as createHash3 } from "crypto";
-import { constants as constants2 } from "fs";
-import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir2, readFile as readFile4, stat as stat3, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, join as join3, resolve as resolve3 } from "path";
-import { fileURLToPath } from "url";
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var PROVISIONING_VERSION = 1;
-function toPath(value) {
-  return value instanceof URL ? fileURLToPath(value) : value;
-}
-async function exists(path4) {
-  try {
-    await access2(path4, constants2.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function run(cmd, args, cwd) {
-  await execFileAsync(cmd, args, {
-    cwd,
-    env: process.env,
-    maxBuffer: 1024 * 1024 * 20,
-    timeout: 5 * 60 * 1e3
-  });
+// src/server/http/routes/file.ts
+import { dirname as dirname4, extname, relative as relative4 } from "path/posix";
+
+// src/server/http/middleware.ts
+var ERROR_CODE_AUTH_REQUIRED = "auth_required";
+var ERROR_CODE_AUTH_INVALID = "auth_invalid";
+var ERROR_CODE_INVALID_PATH = "invalid_path";
+var ERROR_CODE_VALIDATION_ERROR = "validation_error";
+var ERROR_CODE_PATH_REJECTED = "path_rejected";
+var ERROR_CODE_NOT_FOUND = "not_found";
+var ERROR_CODE_ALREADY_EXISTS = "already_exists";
+var ERROR_CODE_CONFLICT = "conflict";
+var ERROR_CODE_RANGE_NOT_SATISFIABLE = "range_not_satisfiable";
+var ERROR_CODE_INTERNAL = "internal";
+var ERROR_CODE_NOT_IMPLEMENTED = "not_implemented";
+var DEV_MODE_WARNING = "No auth token set \u2014 running in dev mode";
+var DEFAULT_WORKSPACE_ID = "default";
+function errorPayload(code, message, field) {
+  return {
+    error: {
+      code,
+      message,
+      ...field ? { field } : {}
+    }
+  };
 }
-async function commandExists(cmd) {
-  try {
-    await execFileAsync(cmd, ["--version"], { maxBuffer: 1024 * 1024 });
-    return true;
-  } catch {
-    return false;
-  }
+function ensureWorkspaceContext(request, workspaceId, authenticated) {
+  request.workspaceContext = {
+    workspaceId,
+    authenticated
+  };
 }
-async function hashPath(path4, hash) {
-  const info = await stat3(path4);
-  if (info.isDirectory()) {
-    const entries = (await readdir2(path4)).filter((entry) => entry !== "__pycache__" && entry !== "build" && !entry.endsWith(".egg-info")).sort();
-    for (const entry of entries) {
-      hash.update(`dir:${entry}
-`);
-      await hashPath(join3(path4, entry), hash);
+function createAuthMiddleware(opts = {}) {
+  let warnedDevMode = false;
+  return async function authMiddleware(request, reply) {
+    const workspaceId = opts.workspaceId ?? DEFAULT_WORKSPACE_ID;
+    const authToken = opts.authToken?.trim() || void 0;
+    ensureWorkspaceContext(request, workspaceId, false);
+    if (opts.publicPaths?.includes(request.url.split("?")[0])) {
+      return;
     }
-    return;
-  }
-  if (!info.isFile()) return;
-  hash.update(`file:${path4}
-`);
-  hash.update(await readFile4(path4));
-}
-async function fingerprint(contributions) {
-  const hash = createHash3("sha256");
-  hash.update(JSON.stringify({ v: PROVISIONING_VERSION }));
-  for (const { id, provisioning } of contributions) {
-    hash.update(`plugin:${id}
-`);
-    for (const template of provisioning.templateDirs ?? []) {
-      const templatePath = toPath(template.path);
-      hash.update(`template:${template.id}:${template.target ?? ""}:${templatePath}
-`);
-      if (await exists(templatePath)) await hashPath(templatePath, hash);
+    if (!authToken) {
+      if (!warnedDevMode) {
+        warnedDevMode = true;
+        request.log.warn(DEV_MODE_WARNING);
+        opts.onDevModeWarning?.(DEV_MODE_WARNING);
+      }
+      return;
     }
-    for (const spec of provisioning.python ?? []) {
-      const projectFile = toPath(spec.projectFile);
-      hash.update(`python:${spec.id}:${projectFile}
-`);
-      hash.update(JSON.stringify(spec.extraLibs ?? []));
-      hash.update(JSON.stringify(Object.fromEntries(Object.entries(spec.env ?? {}).map(([k, v]) => [k, String(v)]))));
-      if (await exists(projectFile)) await hashPath(dirname4(projectFile), hash);
+    const header = request.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      reply.code(401).send(
+        errorPayload(
+          ERROR_CODE_AUTH_REQUIRED,
+          "Missing Bearer token"
+        )
+      );
+      return;
     }
-  }
-  return `sha256:${hash.digest("hex")}`;
-}
-function collectEnv(contributions) {
-  const env = {};
-  for (const { provisioning } of contributions) {
-    for (const spec of provisioning.python ?? []) {
-      for (const [key, value] of Object.entries(spec.env ?? {})) {
-        env[key] = toPath(value);
-      }
+    const candidateToken = header.slice("Bearer ".length);
+    if (candidateToken !== authToken) {
+      reply.code(403).send(errorPayload(ERROR_CODE_AUTH_INVALID, "Invalid token"));
+      return;
     }
-  }
-  return env;
+    ensureWorkspaceContext(request, workspaceId, true);
+  };
 }
-async function seedTemplates(workspaceRoot, contributions) {
-  for (const { provisioning } of contributions) {
-    for (const template of provisioning.templateDirs ?? []) {
-      await cp(toPath(template.path), resolve3(workspaceRoot, template.target ?? "."), {
-        recursive: true,
-        force: false,
-        errorOnExist: false
-      });
+function createBodyValidator(schema) {
+  return async function validateBody(request, reply) {
+    const parsed = schema.safeParse(request.body);
+    if (!parsed.success) {
+      const firstIssue = parsed.error.issues[0];
+      const fieldName = firstIssue?.path?.map((segment) => String(segment)).join(".");
+      reply.code(400).send(
+        errorPayload(
+          ERROR_CODE_VALIDATION_ERROR,
+          firstIssue?.message ?? "Invalid request body",
+          fieldName || void 0
+        )
+      );
+      return;
     }
+    request.body = parsed.data;
+  };
+}
+
+// src/server/logging.ts
+var SENSITIVE_KEYS = new Set([
+  "apiKey",
+  "api_key",
+  "token",
+  "secret",
+  "password",
+  "authorization",
+  "cookie",
+  "oidcToken",
+  "accessToken",
+  "refreshToken",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "VERCEL_OIDC_TOKEN",
+  "VERCEL_TEAM_ID"
+].map((key) => key.toLowerCase()));
+function isSensitiveKey(key) {
+  return SENSITIVE_KEYS.has(key.toLowerCase());
+}
+function redactValue(key, value, seen) {
+  if (key && isSensitiveKey(key) && value != null) return "***";
+  if (value == null || typeof value !== "object") return value;
+  if (value instanceof Date) return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const out2 = value.map((item) => redactValue(void 0, item, seen));
+    seen.delete(value);
+    return out2;
+  }
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactValue(childKey, childValue, seen);
   }
+  seen.delete(value);
+  return out;
 }
-async function ensurePython(workspaceRoot, specs) {
-  if (specs.length === 0) return;
-  const venvPython = join3(workspaceRoot, ".venv", "bin", "python");
-  const uv = await commandExists("uv");
-  if (!await exists(venvPython)) {
-    if (uv) await run("uv", ["venv", ".venv"], workspaceRoot);
-    else await run("/usr/bin/python3", ["-m", "venv", ".venv"], workspaceRoot);
+function redact(fields) {
+  const out = {};
+  const seen = /* @__PURE__ */ new WeakSet();
+  for (const [k, v] of Object.entries(fields)) {
+    out[k] = redactValue(k, v, seen);
   }
-  for (const spec of specs) {
-    const projectDir = dirname4(toPath(spec.projectFile));
-    if (uv) {
-      await run("uv", ["pip", "install", "--python", venvPython, projectDir], workspaceRoot);
-      if (spec.extraLibs?.length) {
-        await run("uv", ["pip", "install", "--python", venvPython, ...spec.extraLibs], workspaceRoot);
-      }
+  return out;
+}
+var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
+function createLogger(prefix) {
+  function emit(level, msg, fields) {
+    const entry = {
+      level,
+      prefix,
+      msg,
+      ...fields ? redact(fields) : {},
+      t: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (level === "error") {
+      console.error(JSON.stringify(entry));
+    } else if (level === "warn") {
+      console.warn(JSON.stringify(entry));
     } else {
-      await run(venvPython, ["-m", "pip", "install", projectDir], workspaceRoot);
-      if (spec.extraLibs?.length) await run(venvPython, ["-m", "pip", "install", ...spec.extraLibs], workspaceRoot);
+      console.log(JSON.stringify(entry));
     }
   }
+  return {
+    debug(msg, fields) {
+      if (verbose) emit("debug", msg, fields);
+    },
+    info(msg, fields) {
+      emit("info", msg, fields);
+    },
+    warn(msg, fields) {
+      emit("warn", msg, fields);
+    },
+    error(msg, fields) {
+      emit("error", msg, fields);
+    }
+  };
 }
-async function writeExecutable(path4, body) {
-  await writeFile4(path4, body, "utf8");
-  await chmod3(path4, 493);
-}
-function bashSingleQuote(value) {
-  return `'${value.replaceAll("'", "'\\''")}'`;
-}
-function assertEnvKey(key) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-    throw new Error(`Invalid provisioning env key: ${key}`);
-  }
+
+// src/server/http/routes/file.ts
+var log = createLogger("boring/workspace-settings");
+var BORING_SETTINGS_PATH = ".boring/settings";
+var DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR = "assets/images";
+var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+function defaultWorkspaceSettings() {
+  return { markdown: { imageUploadDir: DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR } };
 }
-async function isRuntimeMaterialized(workspaceRoot, contributions) {
-  const hasPython = contributions.some(({ provisioning }) => (provisioning.python ?? []).length > 0);
-  if (hasPython && !await exists(join3(workspaceRoot, ".venv", "bin", "python"))) return false;
-  return true;
+function isPathValidationError(err) {
+  return err instanceof Error && typeof err.reason === "string";
 }
-async function writeShims(workspaceRoot, env) {
-  const shimDir = join3(workspaceRoot, ".boring-agent", "bin");
-  const venvBin = join3(workspaceRoot, ".venv", "bin");
-  await mkdir4(shimDir, { recursive: true });
-  const exports = Object.entries(env).map(([key, value]) => {
-    assertEnvKey(key);
-    return `export ${key}=${bashSingleQuote(value)}`;
-  }).join("\n");
-  const base = `#!/usr/bin/env bash
-set -euo pipefail
-SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-WORKSPACE_ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../.." && pwd)"
-export BORING_AGENT_WORKSPACE_ROOT="$WORKSPACE_ROOT"
-${exports}
-VENV_BIN="$WORKSPACE_ROOT/.venv/bin"
-`;
-  await writeExecutable(join3(shimDir, "python"), `${base}exec "$VENV_BIN/python" "$@"
-`);
-  await writeExecutable(join3(shimDir, "python3"), `${base}exec "$VENV_BIN/python" "$@"
-`);
-  await writeExecutable(join3(shimDir, "pip"), `${base}exec "$VENV_BIN/python" -m pip "$@"
-`);
-  await writeExecutable(join3(shimDir, "pip3"), `${base}exec "$VENV_BIN/python" -m pip "$@"
-`);
-  if (await exists(venvBin)) {
-    for (const entry of await readdir2(venvBin)) {
-      if (["python", "python3", "pip", "pip3"].includes(entry)) continue;
-      const full = join3(venvBin, entry);
-      const info = await stat3(full).catch(() => null);
-      if (!info?.isFile()) continue;
-      await writeExecutable(join3(shimDir, entry), `${base}TARGET="$VENV_BIN"/${bashSingleQuote(entry)}
-SHEBANG="$(head -n 1 "$TARGET" 2>/dev/null || true)"
-case "$SHEBANG" in
-  *python*) exec "$VENV_BIN/python" "$TARGET" "$@" ;;
-esac
-exec "$TARGET" "$@"
-`);
-    }
+function classifyError(err, reply, subject) {
+  if (isPathValidationError(err)) {
+    return reply.code(403).send({
+      error: { code: ERROR_CODE_PATH_REJECTED, message: "path traversal rejected" }
+    });
   }
-  return shimDir;
-}
-async function provisionRuntimeWorkspace({
-  workspaceRoot,
-  contributions,
-  force = false
-}) {
-  const active = [];
-  for (const contribution of contributions ?? []) {
-    if (contribution.provisioning) active.push({ id: contribution.id, provisioning: contribution.provisioning });
+  const message = err instanceof Error ? err.message : "unknown error";
+  const code = err?.code;
+  if (code === "EPERM" || message.toLowerCase().includes("traversal") || message.includes("EPERM")) {
+    return reply.code(403).send({
+      error: { code: ERROR_CODE_PATH_REJECTED, message: "path traversal rejected" }
+    });
   }
-  await mkdir4(workspaceRoot, { recursive: true });
-  const env = collectEnv(active);
-  const hash = await fingerprint(active);
-  const markerPath = join3(workspaceRoot, ".boring-agent", "provisioning.json");
-  const binDir = join3(workspaceRoot, ".boring-agent", "bin");
-  if (!force && await exists(markerPath)) {
-    try {
-      const marker = JSON.parse(await readFile4(markerPath, "utf8"));
-      if (marker.fingerprint === hash && await isRuntimeMaterialized(workspaceRoot, active)) {
-        await writeShims(workspaceRoot, env);
-        return { fingerprint: hash, changed: false, env, binDir };
-      }
-    } catch {
-    }
+  if (code === "ENOENT" || message.includes("ENOENT")) {
+    return reply.code(404).send({
+      error: { code: ERROR_CODE_NOT_FOUND, message: `${subject} not found` }
+    });
   }
-  await seedTemplates(workspaceRoot, active);
-  await ensurePython(workspaceRoot, active.flatMap(({ provisioning }) => provisioning.python ?? []));
-  const actualBinDir = await writeShims(workspaceRoot, env);
-  await mkdir4(dirname4(markerPath), { recursive: true });
-  await writeFile4(markerPath, JSON.stringify({ v: PROVISIONING_VERSION, fingerprint: hash }, null, 2), "utf8");
-  return { fingerprint: hash, changed: true, env, binDir: actualBinDir };
+  if (code === "EEXIST" || message.includes("EEXIST")) {
+    return reply.code(409).send({
+      error: { code: ERROR_CODE_ALREADY_EXISTS, message: `${subject} already exists` }
+    });
+  }
+  return reply.code(500).send({
+    error: { code: ERROR_CODE_INTERNAL, message }
+  });
 }
-
-// src/server/workspace/createVercelSandboxWorkspace.ts
-var VERCEL_SANDBOX_REMOTE_ROOT = "/vercel/sandbox";
-var VERCEL_SANDBOX_WORKSPACE_ROOT = "/workspace";
-var CACHE_TTL_MS = 15e3;
-var CACHE_MAX_ENTRIES = 512;
-var MAX_INLINE_WRITE_BYTES = 128 * 1024;
-var metadataInvalidators = /* @__PURE__ */ new WeakMap();
-function toSandboxPath(relPath) {
-  return validatePath(VERCEL_SANDBOX_REMOTE_ROOT, relPath);
+function requireStringParam(value, field, reply) {
+  if (typeof value !== "string" || value.length === 0) {
+    reply.code(400).send({
+      error: { code: ERROR_CODE_VALIDATION_ERROR, message: `${field} is required`, field }
+    });
+    return null;
+  }
+  if (value.includes("\0")) {
+    reply.code(400).send({
+      error: { code: ERROR_CODE_INVALID_PATH, message: "null bytes not allowed", field }
+    });
+    return null;
+  }
+  return value;
 }
-function createTimedLruCache(ttlMs, maxEntries) {
-  const entries = /* @__PURE__ */ new Map();
-  return {
-    get(key) {
-      const now = Date.now();
-      const entry = entries.get(key);
-      if (!entry) return void 0;
-      if (entry.expiresAt <= now) {
-        entries.delete(key);
-        return void 0;
-      }
-      entries.delete(key);
-      entries.set(key, entry);
-      return entry.value;
-    },
-    set(key, value) {
-      entries.delete(key);
-      entries.set(key, { value, expiresAt: Date.now() + ttlMs });
-      while (entries.size > maxEntries) {
-        const oldest = entries.keys().next().value;
-        if (!oldest) return;
-        entries.delete(oldest);
+function parseWorkspaceSettings(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const dir = parsed?.markdown?.imageUploadDir;
+    return {
+      ...parsed,
+      markdown: {
+        ...parsed.markdown ?? {},
+        imageUploadDir: typeof dir === "string" && dir.trim() ? dir.trim() : DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR
       }
-    },
-    clear() {
-      entries.clear();
-    }
-  };
+    };
+  } catch (err) {
+    log.warn("failed to parse .boring/settings \u2014 falling back to defaults", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return defaultWorkspaceSettings();
+  }
 }
-function cloneStat(stat7) {
-  return {
-    size: stat7.size,
-    mtimeMs: stat7.mtimeMs,
-    kind: stat7.kind
-  };
+async function readWorkspaceSettings(workspace) {
+  try {
+    return parseWorkspaceSettings(await workspace.readFile(BORING_SETTINGS_PATH));
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT") return defaultWorkspaceSettings();
+    throw error;
+  }
 }
-function cloneEntries(entries) {
-  return entries.map((entry) => ({ name: entry.name, kind: entry.kind }));
+function normalizeUploadDir(value) {
+  if (typeof value !== "string") return null;
+  const dir = value.trim().replace(/^\.\/+/, "").replace(/\/+/g, "/");
+  if (!dir || dir.includes("\0") || dir.startsWith("/") || dir.split("/").includes("..")) return null;
+  return dir.replace(/\/+$/, "");
 }
-function shellQuote2(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+function extForUpload(filename, contentType) {
+  const fromName = extname(filename).toLowerCase().replace(/^\./, "");
+  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
+  if (contentType === "image/jpeg") return "jpg";
+  if (contentType === "image/png") return "png";
+  if (contentType === "image/gif") return "gif";
+  if (contentType === "image/webp") return "webp";
+  if (contentType === "image/svg+xml") return "svg";
+  return "bin";
 }
-async function runJson(sandbox, script) {
-  const result = await sandbox.runCommand({ cmd: "sh", args: ["-c", script] });
-  const [out, err] = await Promise.all([
-    result.stdout?.() ?? Promise.resolve(""),
-    result.stderr?.() ?? Promise.resolve("")
-  ]);
-  if ((result.exitCode ?? 1) !== 0) {
-    throw new Error(err || `sandbox command failed with exit code ${result.exitCode}`);
-  }
-  return JSON.parse(out);
+function basenameForUpload(filename) {
+  const base = filename.split("/").pop()?.split("\\").pop() ?? "image";
+  const withoutExt = base.replace(/\.[^.]*$/, "");
+  const safe = withoutExt.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return safe || "image";
 }
-async function runShell(sandbox, script) {
-  const result = await sandbox.runCommand({ cmd: "sh", args: ["-c", script] });
-  if ((result.exitCode ?? 1) !== 0) {
-    const err = await (result.stderr?.() ?? Promise.resolve(""));
-    throw new Error(err || `sandbox command failed with exit code ${result.exitCode}`);
+function markdownUrlFor(sourcePath, assetPath) {
+  if (!sourcePath) return assetPath;
+  const fromDir = dirname4(sourcePath.replace(/\\/g, "/"));
+  const rel = relative4(fromDir === "." ? "" : fromDir, assetPath);
+  return rel && !rel.startsWith(".") ? rel : rel || assetPath;
+}
+function contentTypeForPath(path4) {
+  switch (extname(path4).toLowerCase()) {
+    case ".avif":
+      return "image/avif";
+    case ".gif":
+      return "image/gif";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".png":
+      return "image/png";
+    case ".svg":
+      return "image/svg+xml";
+    case ".webp":
+      return "image/webp";
+    case ".css":
+      return "text/css; charset=utf-8";
+    case ".html":
+    case ".htm":
+      return "text/html; charset=utf-8";
+    case ".js":
+      return "text/javascript; charset=utf-8";
+    case ".mjs":
+      return "text/javascript; charset=utf-8";
+    case ".pdf":
+      return "application/pdf";
+    default:
+      return "application/octet-stream";
   }
 }
-function registerMetadataInvalidator(sandbox, invalidate) {
+function fileRoutes(app, opts, done) {
+  async function resolveWorkspace(request) {
+    if (opts.getWorkspace) return await opts.getWorkspace(request);
+    if (opts.workspace) return opts.workspace;
+    throw new Error("file route requires workspace or getWorkspace");
+  }
+  app.get("/api/v1/files/raw", async (request, reply) => {
+    const query = request.query;
+    const path4 = requireStringParam(query.path, "path", reply);
+    if (path4 === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      if (!workspace.readBinaryFile) {
+        return reply.code(501).send({
+          error: { code: ERROR_CODE_INTERNAL, message: "workspace does not support binary reads" }
+        });
+      }
+      const stat7 = await workspace.stat(path4);
+      if (stat7.kind !== "file") {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: "path is not a file", field: "path" }
+        });
+      }
+      const bytes = await workspace.readBinaryFile(path4);
+      return reply.header("content-type", contentTypeForPath(path4)).header("content-length", String(bytes.byteLength)).header("cache-control", "no-store").send(Buffer.from(bytes));
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
+  app.get("/api/v1/files", async (request, reply) => {
+    const query = request.query;
+    const path4 = requireStringParam(query.path, "path", reply);
+    if (path4 === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      if (workspace.readFileWithStat) {
+        const { content: content2, stat: stat8 } = await workspace.readFileWithStat(path4);
+        return { content: content2, mtimeMs: stat8.kind === "file" ? stat8.mtimeMs : void 0 };
+      }
+      const content = await workspace.readFile(path4);
+      const stat7 = await workspace.stat(path4);
+      return { content, mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0 };
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
+  app.post("/api/v1/files", async (request, reply) => {
+    const body = request.body;
+    const path4 = requireStringParam(body?.path, "path", reply);
+    if (path4 === null) return;
+    if (typeof body.content !== "string") {
+      return reply.code(400).send({
+        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "content is required", field: "content" }
+      });
+    }
+    const expectedMtimeMs = typeof body.expectedMtimeMs === "number" ? body.expectedMtimeMs : null;
+    try {
+      const workspace = await resolveWorkspace(request);
+      if (expectedMtimeMs !== null) {
+        try {
+          const current = await workspace.stat(path4);
+          if (current.kind === "file" && current.mtimeMs !== expectedMtimeMs) {
+            return reply.code(409).send({
+              error: {
+                code: ERROR_CODE_CONFLICT,
+                message: "file has been modified since last read",
+                currentMtimeMs: current.mtimeMs,
+                expectedMtimeMs
+              }
+            });
+          }
+        } catch (statErr) {
+          const code = statErr?.code;
+          if (code === "ENOENT") {
+            return reply.code(409).send({
+              error: {
+                code: ERROR_CODE_CONFLICT,
+                message: "file no longer exists",
+                expectedMtimeMs
+              }
+            });
+          }
+          throw statErr;
+        }
+      }
+      if (body.createDirs) {
+        const dir = path4.includes("/") ? path4.slice(0, path4.lastIndexOf("/")) : void 0;
+        if (dir) await workspace.mkdir(dir, { recursive: true });
+      }
+      const content = body.content;
+      const stat7 = workspace.writeFileWithStat ? await workspace.writeFileWithStat(path4, content) : await (async () => {
+        await workspace.writeFile(path4, content);
+        return await workspace.stat(path4);
+      })();
+      return { ok: true, mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0 };
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
+  app.post("/api/v1/files/upload", async (request, reply) => {
+    const body = request.body;
+    const filename = requireStringParam(body?.filename, "filename", reply);
+    if (filename === null) return;
+    const contentBase64 = requireStringParam(body?.contentBase64, "contentBase64", reply);
+    if (contentBase64 === null) return;
+    const contentType = typeof body.contentType === "string" ? body.contentType.trim().toLowerCase() : "";
+    if (!contentType.startsWith("image/")) {
+      return reply.code(400).send({
+        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "contentType must be an image/* MIME type", field: "contentType" }
+      });
+    }
+    try {
+      const workspace = await resolveWorkspace(request);
+      const settings = await readWorkspaceSettings(workspace);
+      const dir = normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR;
+      const ext = extForUpload(filename, contentType);
+      const base = basenameForUpload(filename);
+      const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+      const path4 = `${dir}/${base}-${unique}.${ext}`;
+      const estimatedBytes = Math.ceil(contentBase64.length * 0.75);
+      if (estimatedBytes === 0 || estimatedBytes > MAX_UPLOAD_BYTES) {
+        return reply.code(400).send({
+          error: { code: ERROR_CODE_VALIDATION_ERROR, message: `upload must be 1 byte to ${MAX_UPLOAD_BYTES} bytes`, field: "contentBase64" }
+        });
+      }
+      const bytes = Buffer.from(contentBase64, "base64");
+      await workspace.mkdir(dir, { recursive: true });
+      const stat7 = workspace.writeBinaryFileWithStat ? await workspace.writeBinaryFileWithStat(path4, bytes) : await (async () => {
+        if (!workspace.writeBinaryFile) {
+          throw new Error("workspace does not support binary uploads");
+        }
+        await workspace.writeBinaryFile(path4, bytes);
+        return await workspace.stat(path4);
+      })();
+      const MAX_SOURCE_PATH = 1024;
+      const rawSourcePath = body.sourcePath;
+      const sourcePath = typeof rawSourcePath === "string" && rawSourcePath.length > 0 && rawSourcePath.length <= MAX_SOURCE_PATH && !rawSourcePath.includes("\0") ? rawSourcePath : null;
+      return {
+        ok: true,
+        path: path4,
+        markdownUrl: markdownUrlFor(sourcePath, path4),
+        mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0
+      };
+    } catch (err) {
+      return classifyError(err, reply, "upload");
+    }
+  });
+  app.get("/api/v1/workspace-settings", async (request, reply) => {
+    try {
+      const workspace = await resolveWorkspace(request);
+      return { settings: await readWorkspaceSettings(workspace) };
+    } catch (err) {
+      return classifyError(err, reply, "settings");
+    }
+  });
+  app.put("/api/v1/workspace-settings", async (request, reply) => {
+    const body = request.body;
+    const incoming = body?.settings ?? body;
+    const markdown = incoming.markdown ?? {};
+    const imageUploadDir = normalizeUploadDir(markdown.imageUploadDir);
+    if (!imageUploadDir) {
+      return reply.code(400).send({
+        error: { code: ERROR_CODE_INVALID_PATH, message: "markdown.imageUploadDir must be a relative workspace path", field: "markdown.imageUploadDir" }
+      });
+    }
+    try {
+      const workspace = await resolveWorkspace(request);
+      const current = await readWorkspaceSettings(workspace);
+      const next = {
+        ...current,
+        markdown: {
+          ...current.markdown ?? {},
+          imageUploadDir
+        }
+      };
+      await workspace.mkdir(".boring", { recursive: true });
+      await workspace.writeFile(BORING_SETTINGS_PATH, `${JSON.stringify(next, null, 2)}
+`);
+      return { settings: next };
+    } catch (err) {
+      return classifyError(err, reply, "settings");
+    }
+  });
+  app.delete("/api/v1/files", async (request, reply) => {
+    const query = request.query;
+    const path4 = requireStringParam(query.path, "path", reply);
+    if (path4 === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      await workspace.unlink(path4);
+      return { ok: true };
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
+  app.post("/api/v1/files/move", async (request, reply) => {
+    const body = request.body;
+    const from = requireStringParam(body?.from, "from", reply);
+    if (from === null) return;
+    const to = requireStringParam(body?.to, "to", reply);
+    if (to === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      await workspace.rename(from, to);
+      return { ok: true };
+    } catch (err) {
+      return classifyError(err, reply, "file");
+    }
+  });
+  app.post("/api/v1/dirs", async (request, reply) => {
+    const body = request.body;
+    const path4 = requireStringParam(body?.path, "path", reply);
+    if (path4 === null) return;
+    const recursive = body.recursive === true;
+    try {
+      const workspace = await resolveWorkspace(request);
+      await workspace.mkdir(path4, { recursive });
+      return { ok: true };
+    } catch (err) {
+      return classifyError(err, reply, "directory");
+    }
+  });
+  app.get("/api/v1/stat", async (request, reply) => {
+    const query = request.query;
+    const path4 = requireStringParam(query.path, "path", reply);
+    if (path4 === null) return;
+    try {
+      const workspace = await resolveWorkspace(request);
+      const stat7 = await workspace.stat(path4);
+      return stat7;
+    } catch (err) {
+      return classifyError(err, reply, "path");
+    }
+  });
+  done();
+}
+
+// src/server/workspace/provisionRuntime.ts
+import { createHash as createHash3 } from "crypto";
+import { constants as constants2 } from "fs";
+import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir2, readFile as readFile4, stat as stat3, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname5, join as join3, resolve as resolve3 } from "path";
+import { fileURLToPath } from "url";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var PROVISIONING_VERSION = 1;
+function toPath(value) {
+  return value instanceof URL ? fileURLToPath(value) : value;
+}
+async function exists(path4) {
+  try {
+    await access2(path4, constants2.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function run(cmd, args, cwd) {
+  await execFileAsync(cmd, args, {
+    cwd,
+    env: process.env,
+    maxBuffer: 1024 * 1024 * 20,
+    timeout: 5 * 60 * 1e3
+  });
+}
+async function commandExists(cmd) {
+  try {
+    await execFileAsync(cmd, ["--version"], { maxBuffer: 1024 * 1024 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function hashPath(path4, hash) {
+  const info = await stat3(path4);
+  if (info.isDirectory()) {
+    const entries = (await readdir2(path4)).filter((entry) => entry !== "__pycache__" && entry !== "build" && !entry.endsWith(".egg-info")).sort();
+    for (const entry of entries) {
+      hash.update(`dir:${entry}
+`);
+      await hashPath(join3(path4, entry), hash);
+    }
+    return;
+  }
+  if (!info.isFile()) return;
+  hash.update(`file:${path4}
+`);
+  hash.update(await readFile4(path4));
+}
+async function fingerprint(contributions) {
+  const hash = createHash3("sha256");
+  hash.update(JSON.stringify({ v: PROVISIONING_VERSION }));
+  for (const { id, provisioning } of contributions) {
+    hash.update(`plugin:${id}
+`);
+    for (const template of provisioning.templateDirs ?? []) {
+      const templatePath = toPath(template.path);
+      hash.update(`template:${template.id}:${template.target ?? ""}:${templatePath}
+`);
+      if (await exists(templatePath)) await hashPath(templatePath, hash);
+    }
+    for (const spec of provisioning.python ?? []) {
+      const projectFile = toPath(spec.projectFile);
+      hash.update(`python:${spec.id}:${projectFile}
+`);
+      hash.update(JSON.stringify(spec.extraLibs ?? []));
+      hash.update(JSON.stringify(Object.fromEntries(Object.entries(spec.env ?? {}).map(([k, v]) => [k, String(v)]))));
+      if (await exists(projectFile)) await hashPath(dirname5(projectFile), hash);
+    }
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function collectEnv(contributions) {
+  const env = {};
+  for (const { provisioning } of contributions) {
+    for (const spec of provisioning.python ?? []) {
+      for (const [key, value] of Object.entries(spec.env ?? {})) {
+        env[key] = toPath(value);
+      }
+    }
+  }
+  return env;
+}
+async function seedTemplates(workspaceRoot, contributions) {
+  for (const { provisioning } of contributions) {
+    for (const template of provisioning.templateDirs ?? []) {
+      await cp(toPath(template.path), resolve3(workspaceRoot, template.target ?? "."), {
+        recursive: true,
+        force: false,
+        errorOnExist: false
+      });
+    }
+  }
+}
+async function ensurePython(workspaceRoot, specs) {
+  if (specs.length === 0) return;
+  const venvPython = join3(workspaceRoot, ".venv", "bin", "python");
+  const uv = await commandExists("uv");
+  if (!await exists(venvPython)) {
+    if (uv) await run("uv", ["venv", ".venv"], workspaceRoot);
+    else await run("/usr/bin/python3", ["-m", "venv", ".venv"], workspaceRoot);
+  }
+  for (const spec of specs) {
+    const projectDir = dirname5(toPath(spec.projectFile));
+    if (uv) {
+      await run("uv", ["pip", "install", "--python", venvPython, projectDir], workspaceRoot);
+      if (spec.extraLibs?.length) {
+        await run("uv", ["pip", "install", "--python", venvPython, ...spec.extraLibs], workspaceRoot);
+      }
+    } else {
+      await run(venvPython, ["-m", "pip", "install", projectDir], workspaceRoot);
+      if (spec.extraLibs?.length) await run(venvPython, ["-m", "pip", "install", ...spec.extraLibs], workspaceRoot);
+    }
+  }
+}
+async function writeExecutable(path4, body) {
+  await writeFile4(path4, body, "utf8");
+  await chmod3(path4, 493);
+}
+function bashSingleQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function assertEnvKey(key) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+    throw new Error(`Invalid provisioning env key: ${key}`);
+  }
+}
+async function isRuntimeMaterialized(workspaceRoot, contributions) {
+  const hasPython = contributions.some(({ provisioning }) => (provisioning.python ?? []).length > 0);
+  if (hasPython && !await exists(join3(workspaceRoot, ".venv", "bin", "python"))) return false;
+  return true;
+}
+async function writeShims(workspaceRoot, env) {
+  const shimDir = join3(workspaceRoot, ".boring-agent", "bin");
+  const venvBin = join3(workspaceRoot, ".venv", "bin");
+  await mkdir4(shimDir, { recursive: true });
+  const exports = Object.entries(env).map(([key, value]) => {
+    assertEnvKey(key);
+    return `export ${key}=${bashSingleQuote(value)}`;
+  }).join("\n");
+  const base = `#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+WORKSPACE_ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../.." && pwd)"
+export BORING_AGENT_WORKSPACE_ROOT="$WORKSPACE_ROOT"
+${exports}
+VENV_BIN="$WORKSPACE_ROOT/.venv/bin"
+`;
+  await writeExecutable(join3(shimDir, "python"), `${base}exec "$VENV_BIN/python" "$@"
+`);
+  await writeExecutable(join3(shimDir, "python3"), `${base}exec "$VENV_BIN/python" "$@"
+`);
+  await writeExecutable(join3(shimDir, "pip"), `${base}exec "$VENV_BIN/python" -m pip "$@"
+`);
+  await writeExecutable(join3(shimDir, "pip3"), `${base}exec "$VENV_BIN/python" -m pip "$@"
+`);
+  if (await exists(venvBin)) {
+    for (const entry of await readdir2(venvBin)) {
+      if (["python", "python3", "pip", "pip3"].includes(entry)) continue;
+      const full = join3(venvBin, entry);
+      const info = await stat3(full).catch(() => null);
+      if (!info?.isFile()) continue;
+      await writeExecutable(join3(shimDir, entry), `${base}TARGET="$VENV_BIN"/${bashSingleQuote(entry)}
+SHEBANG="$(head -n 1 "$TARGET" 2>/dev/null || true)"
+case "$SHEBANG" in
+  *python*) exec "$VENV_BIN/python" "$TARGET" "$@" ;;
+esac
+exec "$TARGET" "$@"
+`);
+    }
+  }
+  return shimDir;
+}
+async function provisionRuntimeWorkspace({
+  workspaceRoot,
+  contributions,
+  force = false
+}) {
+  const active = [];
+  for (const contribution of contributions ?? []) {
+    if (contribution.provisioning) active.push({ id: contribution.id, provisioning: contribution.provisioning });
+  }
+  await mkdir4(workspaceRoot, { recursive: true });
+  const env = collectEnv(active);
+  const hash = await fingerprint(active);
+  const markerPath = join3(workspaceRoot, ".boring-agent", "provisioning.json");
+  const binDir = join3(workspaceRoot, ".boring-agent", "bin");
+  if (!force && await exists(markerPath)) {
+    try {
+      const marker = JSON.parse(await readFile4(markerPath, "utf8"));
+      if (marker.fingerprint === hash && await isRuntimeMaterialized(workspaceRoot, active)) {
+        await writeShims(workspaceRoot, env);
+        return { fingerprint: hash, changed: false, env, binDir };
+      }
+    } catch {
+    }
+  }
+  await seedTemplates(workspaceRoot, active);
+  await ensurePython(workspaceRoot, active.flatMap(({ provisioning }) => provisioning.python ?? []));
+  const actualBinDir = await writeShims(workspaceRoot, env);
+  await mkdir4(dirname5(markerPath), { recursive: true });
+  await writeFile4(markerPath, JSON.stringify({ v: PROVISIONING_VERSION, fingerprint: hash }, null, 2), "utf8");
+  return { fingerprint: hash, changed: true, env, binDir: actualBinDir };
+}
+
+// src/server/workspace/createVercelSandboxWorkspace.ts
+var VERCEL_SANDBOX_REMOTE_ROOT = "/vercel/sandbox";
+var VERCEL_SANDBOX_WORKSPACE_ROOT = "/workspace";
+var CACHE_TTL_MS = 15e3;
+var CACHE_MAX_ENTRIES = 512;
+var MAX_INLINE_WRITE_BYTES = 128 * 1024;
+var metadataInvalidators = /* @__PURE__ */ new WeakMap();
+function toSandboxPath(relPath) {
+  return validatePath(VERCEL_SANDBOX_REMOTE_ROOT, relPath);
+}
+function createTimedLruCache(ttlMs, maxEntries) {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    get(key) {
+      const now = Date.now();
+      const entry = entries.get(key);
+      if (!entry) return void 0;
+      if (entry.expiresAt <= now) {
+        entries.delete(key);
+        return void 0;
+      }
+      entries.delete(key);
+      entries.set(key, entry);
+      return entry.value;
+    },
+    set(key, value) {
+      entries.delete(key);
+      entries.set(key, { value, expiresAt: Date.now() + ttlMs });
+      while (entries.size > maxEntries) {
+        const oldest = entries.keys().next().value;
+        if (!oldest) return;
+        entries.delete(oldest);
+      }
+    },
+    clear() {
+      entries.clear();
+    }
+  };
+}
+function cloneStat(stat7) {
+  return {
+    size: stat7.size,
+    mtimeMs: stat7.mtimeMs,
+    kind: stat7.kind
+  };
+}
+function cloneEntries(entries) {
+  return entries.map((entry) => ({ name: entry.name, kind: entry.kind }));
+}
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+async function runJson(sandbox, script) {
+  const result = await sandbox.runCommand({ cmd: "sh", args: ["-c", script] });
+  const [out, err] = await Promise.all([
+    result.stdout?.() ?? Promise.resolve(""),
+    result.stderr?.() ?? Promise.resolve("")
+  ]);
+  if ((result.exitCode ?? 1) !== 0) {
+    throw new Error(err || `sandbox command failed with exit code ${result.exitCode}`);
+  }
+  return JSON.parse(out);
+}
+async function runShell(sandbox, script) {
+  const result = await sandbox.runCommand({ cmd: "sh", args: ["-c", script] });
+  if ((result.exitCode ?? 1) !== 0) {
+    const err = await (result.stderr?.() ?? Promise.resolve(""));
+    throw new Error(err || `sandbox command failed with exit code ${result.exitCode}`);
+  }
+}
+function registerMetadataInvalidator(sandbox, invalidate) {
   const existing = metadataInvalidators.get(sandbox);
   if (existing) {
     existing.add(invalidate);
@@ -2128,7 +2669,7 @@ function createServerFileSearch(workspace, sandbox) {
 
 // src/server/workspace/provision.ts
 import { cp as cp2, mkdir as mkdir5, stat as stat4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join4 } from "path";
+import { dirname as dirname6, join as join4 } from "path";
 var PROVISION_MARKER_REL_PATH = ".boring-agent/provisioned";
 async function fileExists(targetPath) {
   try {
@@ -2157,13 +2698,14 @@ async function copyTemplate(templatePath, workspaceRoot) {
       { cause: error }
     );
   }
-  await mkdir5(dirname5(markerPath), { recursive: true });
+  await mkdir5(dirname6(markerPath), { recursive: true });
   await writeFile5(markerPath, (/* @__PURE__ */ new Date()).toISOString(), "utf-8");
 }
 
 // src/server/runtime/modes/direct.ts
 var directModeAdapter = {
   id: "direct",
+  workspaceFsCapability: "strong",
   async create(ctx) {
     await mkdir6(ctx.workspaceRoot, { recursive: true });
     await copyTemplate(ctx.templatePath, ctx.workspaceRoot);
@@ -2182,6 +2724,7 @@ var directModeAdapter = {
 import { mkdir as mkdir7 } from "fs/promises";
 var localModeAdapter = {
   id: "local",
+  workspaceFsCapability: "strong",
   async create(ctx) {
     if (process.platform !== "linux") {
       throw new Error("local mode requires Linux with bubblewrap");
@@ -2249,17 +2792,32 @@ function toRemotePath(value) {
   }
   return value;
 }
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var WORKSPACE_ALIAS_PREFIX_BOUNDARY = String.raw`(^|[\s"'=:;,\[({<>&|])`;
+var WORKSPACE_ALIAS_SUFFIX_BOUNDARY = String.raw`(?=/|$|[\s"'=:;,)\]}> &|])`;
+var WORKSPACE_ALIAS_PATTERN = new RegExp(
+  `${WORKSPACE_ALIAS_PREFIX_BOUNDARY}${escapeRegExp(VERCEL_SANDBOX_WORKSPACE_ROOT)}${WORKSPACE_ALIAS_SUFFIX_BOUNDARY}`,
+  "g"
+);
+function replaceWorkspaceAliases(value) {
+  return value.replace(
+    WORKSPACE_ALIAS_PATTERN,
+    (_match, prefix) => `${prefix}${VERCEL_SANDBOX_REMOTE_ROOT}`
+  );
+}
 function toRemoteCwd(cwd) {
   if (!cwd) return cwd;
   return toRemotePath(cwd);
 }
 function toRemoteCommand(command) {
-  return command.replaceAll(VERCEL_SANDBOX_WORKSPACE_ROOT, VERCEL_SANDBOX_REMOTE_ROOT);
+  return replaceWorkspaceAliases(command);
 }
 function toRemoteEnv(env) {
   if (!env) return void 0;
   return Object.fromEntries(
-    Object.entries(env).map(([key, value]) => [key, toRemotePath(value)])
+    Object.entries(env).map(([key, value]) => [key, replaceWorkspaceAliases(toRemotePath(value))])
   );
 }
 function createVercelSandboxExec(sandbox, execOpts = {}) {
@@ -2347,7 +2905,7 @@ import { createGzip } from "zlib";
 import { put } from "@vercel/blob";
 var urlCache = /* @__PURE__ */ new Map();
 var LOG_PREFIX = "[template-tarball]";
-function log(msg, meta = {}) {
+function log2(msg, meta = {}) {
   const metaStr = Object.keys(meta).length > 0 ? ` ${JSON.stringify(meta)}` : "";
   process.stderr.write(`${LOG_PREFIX} ${msg}${metaStr}
 `);
@@ -2430,11 +2988,11 @@ async function packageTemplate(templatePath, opts = {}) {
   const hash = computeTemplateHash(files);
   const cached = urlCache.get(hash);
   if (cached) {
-    log("cache hit", { hash, fileCount: files.length });
+    log2("cache hit", { hash, fileCount: files.length });
     return { url: cached, hash };
   }
   const tarball = await buildTarGz(files);
-  log("tarball built", {
+  log2("tarball built", {
     hash,
     fileCount: files.length,
     sizeBytes: tarball.length,
@@ -2443,7 +3001,7 @@ async function packageTemplate(templatePath, opts = {}) {
   const upload = opts.uploadFn ?? defaultUpload;
   const url = await upload(hash, tarball);
   urlCache.set(hash, url);
-  log("uploaded", { hash, url, totalMs: Date.now() - startMs });
+  log2("uploaded", { hash, url, totalMs: Date.now() - startMs });
   return { url, hash };
 }
 
@@ -2590,6 +3148,7 @@ function createVercelSandboxModeAdapter(opts = {}) {
   const snapshotScheduler = opts.snapshotScheduler ?? null;
   return {
     id: "vercel-sandbox",
+    workspaceFsCapability: "best-effort",
     async dispose() {
       await snapshotScheduler?.shutdown();
     },
@@ -2669,149 +3228,70 @@ function createVercelSandboxModeAdapter(opts = {}) {
       const sandbox = createVercelSandboxExec(sandboxHandle, {
         onMutation: markDirty
       });
-      await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
-      return {
-        workspace,
-        sandbox,
-        fileSearch: createServerFileSearch(workspace, sandbox)
-      };
-    }
-  };
-}
-var vercelSandboxModeAdapter = createVercelSandboxModeAdapter();
-
-// src/server/runtime/resolveMode.ts
-var MODE_ADAPTERS = {
-  direct: directModeAdapter,
-  local: localModeAdapter,
-  "vercel-sandbox": vercelSandboxModeAdapter
-};
-function isRuntimeModeId(value) {
-  return value === "direct" || value === "local" || value === "vercel-sandbox";
-}
-function hasBwrap() {
-  const result = spawnSync("bwrap", ["--version"], { stdio: "ignore" });
-  return !result.error && result.status === 0;
-}
-function autoDetectMode() {
-  const explicitMode = getEnv("BORING_AGENT_MODE");
-  if (explicitMode) {
-    if (!isRuntimeModeId(explicitMode)) {
-      throw new Error(
-        `Invalid BORING_AGENT_MODE "${explicitMode}". Expected direct, local, or vercel-sandbox.`
-      );
-    }
-    return explicitMode;
-  }
-  if (process.platform === "linux" && hasBwrap()) {
-    return "local";
-  }
-  return "direct";
-}
-function resolveMode(mode = autoDetectMode()) {
-  return MODE_ADAPTERS[mode];
-}
-
-// src/server/createAgentApp.ts
-import Fastify from "fastify";
-import { basename as basename2 } from "path";
-
-// src/server/harness/pi-coding-agent/createHarness.ts
-import { mkdir as mkdir9, writeFile as writeFile7 } from "fs/promises";
-import { extname, join as join6 } from "path";
-import {
-  createAgentSession,
-  SessionManager,
-  AuthStorage,
-  ModelRegistry,
-  DefaultResourceLoader,
-  SettingsManager,
-  getAgentDir,
-  loadSkills
-} from "@mariozechner/pi-coding-agent";
-
-// src/server/logging.ts
-var SENSITIVE_KEYS = new Set([
-  "apiKey",
-  "api_key",
-  "token",
-  "secret",
-  "password",
-  "authorization",
-  "cookie",
-  "oidcToken",
-  "accessToken",
-  "refreshToken",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-  "VERCEL_OIDC_TOKEN",
-  "VERCEL_TEAM_ID"
-].map((key) => key.toLowerCase()));
-function isSensitiveKey(key) {
-  return SENSITIVE_KEYS.has(key.toLowerCase());
-}
-function redactValue(key, value, seen) {
-  if (key && isSensitiveKey(key) && value != null) return "***";
-  if (value == null || typeof value !== "object") return value;
-  if (value instanceof Date) return value;
-  if (seen.has(value)) return "[Circular]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    const out2 = value.map((item) => redactValue(void 0, item, seen));
-    seen.delete(value);
-    return out2;
-  }
-  const out = {};
-  for (const [childKey, childValue] of Object.entries(value)) {
-    out[childKey] = redactValue(childKey, childValue, seen);
-  }
-  seen.delete(value);
-  return out;
-}
-function redact(fields) {
-  const out = {};
-  const seen = /* @__PURE__ */ new WeakSet();
-  for (const [k, v] of Object.entries(fields)) {
-    out[k] = redactValue(k, v, seen);
-  }
-  return out;
-}
-var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
-function createLogger(prefix) {
-  function emit(level, msg, fields) {
-    const entry = {
-      level,
-      prefix,
-      msg,
-      ...fields ? redact(fields) : {},
-      t: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (level === "error") {
-      console.error(JSON.stringify(entry));
-    } else if (level === "warn") {
-      console.warn(JSON.stringify(entry));
-    } else {
-      console.log(JSON.stringify(entry));
-    }
-  }
-  return {
-    debug(msg, fields) {
-      if (verbose) emit("debug", msg, fields);
-    },
-    info(msg, fields) {
-      emit("info", msg, fields);
-    },
-    warn(msg, fields) {
-      emit("warn", msg, fields);
-    },
-    error(msg, fields) {
-      emit("error", msg, fields);
+      await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
+      return {
+        workspace,
+        sandbox,
+        fileSearch: createServerFileSearch(workspace, sandbox)
+      };
     }
   };
 }
+var vercelSandboxModeAdapter = createVercelSandboxModeAdapter();
+
+// src/server/runtime/resolveMode.ts
+var MODE_ADAPTERS = {
+  direct: directModeAdapter,
+  local: localModeAdapter,
+  "vercel-sandbox": vercelSandboxModeAdapter
+};
+function isBuiltinRuntimeModeId(value) {
+  return value === "direct" || value === "local" || value === "vercel-sandbox";
+}
+function hasBwrap() {
+  const result = spawnSync("bwrap", ["--version"], { stdio: "ignore" });
+  return !result.error && result.status === 0;
+}
+function autoDetectMode() {
+  const explicitMode = getEnv("BORING_AGENT_MODE");
+  if (explicitMode) {
+    if (!isBuiltinRuntimeModeId(explicitMode)) {
+      throw new Error(
+        `Invalid BORING_AGENT_MODE "${explicitMode}". Expected direct, local, or vercel-sandbox.`
+      );
+    }
+    return explicitMode;
+  }
+  if (process.platform === "linux" && hasBwrap()) {
+    return "local";
+  }
+  return "direct";
+}
+function resolveMode(mode = autoDetectMode()) {
+  if (isBuiltinRuntimeModeId(mode)) return MODE_ADAPTERS[mode];
+  throw new Error(`Runtime mode "${mode}" has no built-in adapter. Pass runtimeModeAdapter to use a custom sandbox mode.`);
+}
+
+// src/server/createAgentApp.ts
+import Fastify from "fastify";
+import { basename as basename2 } from "path";
+
+// src/server/harness/pi-coding-agent/createHarness.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { mkdir as mkdir9, writeFile as writeFile7 } from "fs/promises";
+import { extname as extname2, join as join6 } from "path";
+import {
+  createAgentSession,
+  SessionManager,
+  AuthStorage,
+  ModelRegistry,
+  DefaultResourceLoader,
+  SettingsManager as SettingsManager2,
+  getAgentDir as getAgentDir2
+} from "@mariozechner/pi-coding-agent";
 
 // src/server/harness/pi-coding-agent/tool-adapter.ts
-function adaptToolForPi(tool) {
+function adaptToolForPi(tool, sessionId) {
   return {
     name: tool.name,
     label: tool.name,
@@ -2822,7 +3302,8 @@ function adaptToolForPi(tool) {
       const result = await tool.execute(params, {
         toolCallId,
         abortSignal: signal ?? new AbortController().signal,
-        onUpdate: onUpdate ? (partial) => onUpdate({ content: [{ type: "text", text: partial }], details: void 0 }) : void 0
+        onUpdate: onUpdate ? (partial) => onUpdate({ content: [{ type: "text", text: partial }], details: void 0 }) : void 0,
+        sessionId
       });
       if (result.isError) {
         throw new Error(result.content.map((c) => c.text).join("\n"));
@@ -2834,8 +3315,8 @@ function adaptToolForPi(tool) {
     }
   };
 }
-function adaptToolsForPi(tools) {
-  return tools.map(adaptToolForPi);
+function adaptToolsForPi(tools, sessionId) {
+  return tools.map((tool) => adaptToolForPi(tool, sessionId));
 }
 
 // src/server/harness/pi-coding-agent/stream-adapter.ts
@@ -3045,12 +3526,24 @@ function defaultSessionDir(cwd) {
   return join5(homedir3(), ".pi", "agent", "sessions", safePath);
 }
 var SAFE_ID = /^[a-zA-Z0-9_-]+$/;
+var SAFE_SESSION_NAMESPACE = /^[a-zA-Z0-9_-]+$/;
+function sessionDirForNamespace(namespace) {
+  const safeNamespace = namespace.trim();
+  if (!SAFE_SESSION_NAMESPACE.test(safeNamespace)) {
+    throw new Error("session namespace must contain only letters, numbers, underscores, and dashes");
+  }
+  return join5(homedir3(), ".pi", "agent", "sessions", safeNamespace);
+}
 var PiSessionStore = class {
   cwd;
   sessionDir;
-  constructor(cwd, sessionDir) {
+  constructor(cwd, options) {
     this.cwd = cwd;
-    this.sessionDir = sessionDir ?? defaultSessionDir(cwd);
+    if (typeof options === "string") {
+      this.sessionDir = options;
+      return;
+    }
+    this.sessionDir = options?.sessionDir ?? (options?.sessionNamespace ? sessionDirForNamespace(options.sessionNamespace) : defaultSessionDir(cwd));
   }
   async list(ctx) {
     const files = await readdir4(this.sessionDir).catch(() => []);
@@ -3486,7 +3979,7 @@ function createSessionTitleScheduler(opts) {
       if (!detail || detail.turnCount !== 1) return;
       if (hasCustomTitle(detail.title)) return;
       const fallbackTitle = formatFallbackTitle(getNow());
-      const apiKey = opts.getApiKey?.()?.trim() || getEnv("ANTHROPIC_API_KEY")?.trim() || "";
+      const apiKey = opts.getApiKey?.()?.trim() || "";
       if (!apiKey || !fetchImpl) {
         opts.writeTitle(input.sessionId, fallbackTitle);
         return;
@@ -3514,6 +4007,7 @@ function createSessionTitleScheduler(opts) {
 }
 
 // src/server/models/modelConfig.ts
+import { getAgentDir, SettingsManager } from "@mariozechner/pi-coding-agent";
 var INFOMANIAK_PROVIDER = "infomaniak";
 var INFOMANIAK_API_BASE = "https://api.infomaniak.com";
 var DEFAULT_CUSTOM_MODEL_MAX_TOKENS = 16384;
@@ -3642,6 +4136,16 @@ function registerConfiguredModelProviders(registry) {
   }
   return registered;
 }
+function readPiSettingsDefaultModel() {
+  try {
+    const settings = SettingsManager.create(process.cwd(), getAgentDir());
+    const provider = clean(settings.getDefaultProvider());
+    const id = clean(settings.getDefaultModel());
+    return provider && id ? { provider, id } : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function readConfiguredDefaultModel() {
   const encoded = clean(getEnv("BORING_AGENT_DEFAULT_MODEL"));
   if (encoded) {
@@ -3655,7 +4159,7 @@ function readConfiguredDefaultModel() {
   if (explicitProvider && explicitId) {
     return { provider: explicitProvider, id: explicitId };
   }
-  return readInfomaniakProvider()?.model ?? readCustomProvider()?.model;
+  return readPiSettingsDefaultModel() ?? readInfomaniakProvider()?.model ?? readCustomProvider()?.model;
 }
 
 // src/server/piPackages.ts
@@ -3701,6 +4205,17 @@ function mergePiPackageSources(base = [], additional = []) {
 }
 
 // src/server/harness/pi-coding-agent/createHarness.ts
+var WORKSPACE_PATHS_GUIDELINE = [
+  "## Workspace paths",
+  "",
+  '- The "Current working directory" above is the workspace root. Tool path arguments must be relative to it (e.g. `README.md`, `src/foo.ts`).',
+  "- Never pass an absolute path or a path that walks outside the workspace (no leading `/`, no `..` that escapes the root). The sandbox will reject it and the call is wasted.",
+  "- For `find`/`grep`/`ls`: omit the `path` argument to search from the workspace root. Pass `path` only when you need to restrict to a subdirectory, and only as a workspace-relative path.",
+  "- For `read`/`edit`/`write`: pass workspace-relative paths only."
+].join("\n");
+function composeSystemPromptAppend(hostAppend) {
+  return [WORKSPACE_PATHS_GUIDELINE, hostAppend?.trim()].filter(Boolean).join("\n\n");
+}
 function extractUserMessageText(message) {
   const record = message;
   if (record?.role !== "user") return "";
@@ -3729,6 +4244,16 @@ function findLastAssistantMessage(messages) {
   }
   return void 0;
 }
+function extractAssistantReasoningTexts(message) {
+  const content = message?.content;
+  if (!Array.isArray(content)) return [];
+  return content.flatMap((part) => {
+    const item = part;
+    if (item.type !== "thinking" && item.type !== "reasoning") return [];
+    const text = item.thinking ?? item.text ?? item.content;
+    return typeof text === "string" && text.length > 0 ? [text] : [];
+  });
+}
 function resolveRequestedModel(modelRegistry, input) {
   const requestedId = input.model?.id;
   if (!input.model || !requestedId) return void 0;
@@ -3748,27 +4273,37 @@ function resolveDefaultModel(modelRegistry) {
   }
   return void 0;
 }
-function createResourceSettingsManager(cwd, agentDir, piPackages) {
-  const fileSettingsManager = SettingsManager.create(cwd, agentDir);
-  if (piPackages.length === 0) return fileSettingsManager;
-  const projectSettings = fileSettingsManager.getProjectSettings();
-  let globalSettingsJson = JSON.stringify(
-    fileSettingsManager.getGlobalSettings()
-  );
-  let projectSettingsJson = JSON.stringify({
-    ...projectSettings,
-    packages: mergePiPackageSources(projectSettings.packages ?? [], piPackages)
+function readSettingsFileIfPresent(path4) {
+  return existsSync(path4) ? readFileSync2(path4, "utf-8") : void 0;
+}
+function mergeInjectedProjectPackages(settingsJson, piPackages) {
+  const settings = settingsJson ? JSON.parse(settingsJson) : {};
+  const configuredPackages = Array.isArray(settings.packages) ? settings.packages : [];
+  return JSON.stringify({
+    ...settings,
+    packages: mergePiPackageSources(configuredPackages, piPackages)
   });
+}
+function createResourceSettingsManager(cwd, agentDir, piPackages) {
+  if (piPackages.length === 0) return SettingsManager2.create(cwd, agentDir);
+  const globalSettingsPath = join6(agentDir, "settings.json");
+  const projectSettingsPath = join6(cwd, ".pi", "settings.json");
+  let globalSettingsOverrideJson;
+  let projectSettingsOverrideJson;
   const storage = {
     withLock(scope, fn) {
       if (scope === "global") {
-        globalSettingsJson = fn(globalSettingsJson) ?? globalSettingsJson;
-      } else {
-        projectSettingsJson = fn(projectSettingsJson) ?? projectSettingsJson;
+        const current2 = globalSettingsOverrideJson ?? readSettingsFileIfPresent(globalSettingsPath);
+        const next2 = fn(current2);
+        if (next2 !== void 0) globalSettingsOverrideJson = next2;
+        return;
       }
+      const current = projectSettingsOverrideJson ?? mergeInjectedProjectPackages(readSettingsFileIfPresent(projectSettingsPath), piPackages);
+      const next = fn(current);
+      if (next !== void 0) projectSettingsOverrideJson = next;
     }
   };
-  return SettingsManager.fromStorage(storage);
+  return SettingsManager2.fromStorage(storage);
 }
 async function applyRequestedSessionOptions(handle, input) {
   const requestedModel = resolveRequestedModel(handle.modelRegistry, input);
@@ -3782,10 +4317,10 @@ async function applyRequestedSessionOptions(handle, input) {
     handle.piSession.setThinkingLevel(input.thinkingLevel);
   }
 }
-var log2 = createLogger("pi-harness");
+var log3 = createLogger("pi-harness");
 var DEFAULT_ATTACHMENT_DIR = "assets/images";
 function extForAttachment(filename, contentType) {
-  const fromName = extname(filename).toLowerCase().replace(/^\./, "");
+  const fromName = extname2(filename).toLowerCase().replace(/^\./, "");
   if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
   if (contentType === "image/jpeg") return "jpg";
   if (contentType === "image/png") return "png";
@@ -3801,7 +4336,10 @@ function basenameForAttachment(filename) {
   return safe || "image";
 }
 function createPiCodingAgentHarness(opts) {
-  const sessionStore = new PiSessionStore(opts.cwd);
+  const sessionStore = new PiSessionStore(opts.cwd, {
+    sessionNamespace: opts.sessionNamespace,
+    sessionDir: opts.sessionDir
+  });
   const piSessions = /* @__PURE__ */ new Map();
   const scheduleSessionTitle = createSessionTitleScheduler({
     loadSession: (sessionId) => sessionStore.load({ workspaceId: "default" }, sessionId),
@@ -3835,38 +4373,29 @@ function createPiCodingAgentHarness(opts) {
     }
     const resolvedModel = resolveRequestedModel(modelRegistry, input);
     const model = resolvedModel ?? resolveDefaultModel(modelRegistry);
-    const resourceLoader = opts.systemPromptAppend || opts.resourceLoaderOptions?.noContextFiles || opts.resourceLoaderOptions?.noSkills || (opts.resourceLoaderOptions?.additionalSkillPaths?.length ?? 0) > 0 || (opts.resourceLoaderOptions?.piPackages?.length ?? 0) > 0 ? (() => {
-      const agentDir = getAgentDir();
-      const additionalSkillPaths = opts.resourceLoaderOptions?.additionalSkillPaths ?? [];
-      const piPackages = opts.resourceLoaderOptions?.piPackages ?? [];
-      const settingsManager = createResourceSettingsManager(
-        ctx.workdir,
-        agentDir,
-        piPackages
-      );
-      return new DefaultResourceLoader({
-        cwd: ctx.workdir,
-        agentDir,
-        settingsManager,
-        ...opts.systemPromptAppend ? { appendSystemPrompt: [opts.systemPromptAppend] } : {},
-        ...opts.resourceLoaderOptions?.noContextFiles ? { noContextFiles: true } : {},
-        ...opts.resourceLoaderOptions?.noSkills ? { noSkills: true } : {},
-        ...additionalSkillPaths.length ? { additionalSkillPaths } : {},
-        ...opts.resourceLoaderOptions?.noSkills || additionalSkillPaths.length ? {
-          skillsOverride: () => loadSkills({
-            cwd: ctx.workdir,
-            agentDir,
-            skillPaths: additionalSkillPaths,
-            includeDefaults: false
-          })
-        } : {}
-      });
-    })() : void 0;
+    const composedSystemPromptAppend = composeSystemPromptAppend(opts.systemPromptAppend);
+    const agentDir = getAgentDir2();
+    const additionalSkillPaths = opts.resourceLoaderOptions?.additionalSkillPaths ?? [];
+    const piPackages = opts.resourceLoaderOptions?.piPackages ?? [];
+    const settingsManager = createResourceSettingsManager(
+      ctx.workdir,
+      agentDir,
+      piPackages
+    );
+    const resourceLoader = new DefaultResourceLoader({
+      cwd: ctx.workdir,
+      agentDir,
+      settingsManager,
+      appendSystemPromptOverride: (base) => [...base, composedSystemPromptAppend],
+      ...opts.resourceLoaderOptions?.noContextFiles ? { noContextFiles: true } : {},
+      ...opts.resourceLoaderOptions?.noSkills ? { noSkills: true } : {},
+      ...additionalSkillPaths.length ? { additionalSkillPaths } : {}
+    });
     await resourceLoader?.reload();
     const { session: piSession } = await createAgentSession({
       cwd: ctx.workdir,
       tools: [],
-      customTools: adaptToolsForPi(opts.tools),
+      customTools: adaptToolsForPi(opts.tools, input.sessionId),
       model,
       thinkingLevel: input.thinkingLevel ?? "off",
       sessionManager,
@@ -3890,6 +4419,7 @@ function createPiCodingAgentHarness(opts) {
     if (!handle) return;
     handle.piSession.dispose();
     piSessions.delete(sessionId);
+    clearNativeFollowUpWork(sessionId);
   }
   const originalDelete = sessionStore.delete.bind(sessionStore);
   sessionStore.delete = async (ctx, sessionId) => {
@@ -3897,17 +4427,95 @@ function createPiCodingAgentHarness(opts) {
     disposePiSession(sessionId);
   };
   const nativeFollowUpPending = /* @__PURE__ */ new Set();
+  const nativeFollowUpQueues = /* @__PURE__ */ new Map();
+  function clearNativeFollowUpWork(sessionId) {
+    nativeFollowUpPending.delete(sessionId);
+    nativeFollowUpQueues.delete(sessionId);
+  }
+  function userMessageText(message) {
+    const content = message.content;
+    if (!Array.isArray(content)) return "";
+    return content.map((part) => part.type === "text" && typeof part.text === "string" ? part.text : "").join("");
+  }
+  function removeFirstMatchingOrdinal(items, matches, ordinal) {
+    let seen = 0;
+    const index = items.findIndex((item) => {
+      if (!matches(item)) return false;
+      if (seen++ !== ordinal) return false;
+      return true;
+    });
+    if (index >= 0) items.splice(index, 1);
+  }
+  function removePiQueuedFollowUp(piSession, text, textOrdinal = 0) {
+    const session = piSession;
+    if (!text) {
+      session.agent?.clearFollowUpQueue?.();
+      if (Array.isArray(session._followUpMessages)) session._followUpMessages = [];
+      session._emitQueueUpdate?.();
+      return;
+    }
+    const queuedMessages = session.agent?.followUpQueue?.messages;
+    if (Array.isArray(queuedMessages)) {
+      removeFirstMatchingOrdinal(queuedMessages, (message) => userMessageText(message) === text, textOrdinal);
+    }
+    if (Array.isArray(session._followUpMessages)) {
+      removeFirstMatchingOrdinal(session._followUpMessages, (message) => message === text, textOrdinal);
+    }
+    session._emitQueueUpdate?.();
+  }
+  function hasFollowUpSelector(options) {
+    return Boolean(options?.clientNonce) || options?.clientSeq !== void 0;
+  }
+  function matchesFollowUpSelector(item, options) {
+    if (!hasFollowUpSelector(options)) return true;
+    return Boolean(options?.clientNonce && item.clientNonce === options.clientNonce) || options?.clientSeq !== void 0 && item.clientSeq === options.clientSeq;
+  }
+  function removeNativeFollowUp(sessionId, options) {
+    const queue = nativeFollowUpQueues.get(sessionId);
+    if (!queue?.length) {
+      if (!hasFollowUpSelector(options)) clearNativeFollowUpWork(sessionId);
+      return [];
+    }
+    const removed = [];
+    const next = [];
+    const textCounts = /* @__PURE__ */ new Map();
+    for (const request of queue) {
+      const textOrdinal = textCounts.get(request.text) ?? 0;
+      textCounts.set(request.text, textOrdinal + 1);
+      if (matchesFollowUpSelector(request, options)) removed.push({ request, textOrdinal });
+      else next.push(request);
+    }
+    if (next.length > 0) nativeFollowUpQueues.set(sessionId, next);
+    else clearNativeFollowUpWork(sessionId);
+    return removed;
+  }
   return {
     id: "pi-coding-agent",
     placement: "server",
     sessions: sessionStore,
-    async followUp(sessionId, text, _attachments, _displayText = text) {
+    async followUp(sessionId, text, _attachments, displayText = text, options) {
       const handle = piSessions.get(sessionId);
-      if (!handle) return;
+      if (!handle) throw new Error("followup_session_not_ready");
+      const queue = nativeFollowUpQueues.get(sessionId) ?? [];
+      queue.push({
+        text,
+        displayText,
+        clientNonce: options?.clientNonce,
+        clientSeq: options?.clientSeq
+      });
+      nativeFollowUpQueues.set(sessionId, queue);
       nativeFollowUpPending.add(sessionId);
       await handle.piSession.followUp(text);
     },
-    clearFollowUp(_sessionId) {
+    clearFollowUp(sessionId, options) {
+      const handle = piSessions.get(sessionId);
+      const removed = removeNativeFollowUp(sessionId, options);
+      if (!handle) return;
+      if (!options?.clientNonce && options?.clientSeq === void 0) {
+        removePiQueuedFollowUp(handle.piSession);
+        return;
+      }
+      for (const item of removed) removePiQueuedFollowUp(handle.piSession, item.request.text, item.textOrdinal);
     },
     /**
      * Pi exposes the resolved system prompt as a getter on AgentSession.
@@ -3973,6 +4581,27 @@ function createPiCodingAgentHarness(opts) {
       }
       let sawTextChunk = false;
       let inlineTurnIndex = 0;
+      let currentPiAssistantMessageId = null;
+      const messageIdsWithStreamedReasoning = /* @__PURE__ */ new Set();
+      let piSeq = 0;
+      const nextPiSeq = () => ++piSeq;
+      const STANDARD_VISIBLE_CHUNK_TYPES = /* @__PURE__ */ new Set([
+        "text-start",
+        "text-delta",
+        "text-end",
+        "reasoning-start",
+        "reasoning-delta",
+        "reasoning-end",
+        "tool-input-available",
+        "tool-input-error",
+        "tool-output-available",
+        "tool-output-error"
+      ]);
+      const standardToolInputsSeen = /* @__PURE__ */ new Set();
+      function isStandardVisibleChunk(chunk2) {
+        const type = chunk2.type;
+        return typeof type === "string" && STANDARD_VISIBLE_CHUNK_TYPES.has(type);
+      }
       function namespaceInlinePartIds(input2) {
         if (inlineTurnIndex === 0) return input2;
         return input2.map((chunk2) => {
@@ -3983,6 +4612,23 @@ function createPiCodingAgentHarness(opts) {
           return chunk2;
         });
       }
+      function filterSdkChunksForCurrentSegment(input2) {
+        const out = [];
+        for (const chunk2 of input2) {
+          const rec = chunk2;
+          if (inlineTurnIndex > 0 && isStandardVisibleChunk(chunk2)) continue;
+          if (rec.type === "tool-input-available" && rec.toolCallId) {
+            standardToolInputsSeen.add(rec.toolCallId);
+            out.push(chunk2);
+            continue;
+          }
+          if ((rec.type === "tool-output-available" || rec.type === "tool-output-error" || rec.type === "tool-output-denied") && rec.toolCallId && !standardToolInputsSeen.has(rec.toolCallId)) {
+            continue;
+          }
+          out.push(chunk2);
+        }
+        return out;
+      }
       let promptSettled = false;
       let promptPromise = Promise.resolve();
       const unsubscribe = piSession.subscribe((event) => {
@@ -4005,56 +4651,138 @@ function createPiCodingAgentHarness(opts) {
           if (activeTools.size === 0) stopHeartbeat();
         }
         let converted;
+        const piHistoryChunks = [];
+        const eventMessage = event.message;
+        if (event.type === "message_start" && (eventMessage?.role === "user" || eventMessage?.role === "assistant")) {
+          const messageId = typeof eventMessage.id === "string" ? eventMessage.id : `${eventMessage.role}-${Date.now()}`;
+          const role = eventMessage.role;
+          if (role === "assistant") currentPiAssistantMessageId = messageId;
+          const text = role === "user" ? extractUserMessageText(eventMessage) : void 0;
+          if (role === "user" && text || role === "assistant") {
+            piHistoryChunks.push({
+              type: "data-pi-message-start",
+              data: { seq: nextPiSeq(), messageId, role, ...text ? { text } : {} }
+            });
+          }
+        }
+        if (event.type === "message_update") {
+          const ame = event.assistantMessageEvent;
+          const messageId = typeof event.messageId === "string" ? event.messageId : typeof event.message?.id === "string" ? event.message.id : currentPiAssistantMessageId ?? "assistant-streaming";
+          if (ame.type === "text_start") {
+            piHistoryChunks.push({
+              type: "data-pi-text-start",
+              data: { seq: nextPiSeq(), messageId, partId: String(ame.contentIndex) }
+            });
+          } else if (ame.type === "text_delta" && ame.delta) {
+            const seq = nextPiSeq();
+            piHistoryChunks.push(
+              {
+                type: "data-pi-text-delta",
+                data: { seq, messageId, partId: String(ame.contentIndex), delta: ame.delta }
+              },
+              // Back-compat for the current client projection. Remove once
+              // ChatPanel consumes the stable data-pi-text-* DTOs directly.
+              {
+                type: "data-pi-message-delta",
+                data: { seq, messageId, role: "assistant", delta: ame.delta }
+              }
+            );
+          } else if (ame.type === "text_end") {
+            piHistoryChunks.push({
+              type: "data-pi-text-end",
+              data: { seq: nextPiSeq(), messageId, partId: String(ame.contentIndex), ...typeof ame.content === "string" ? { text: ame.content } : {} }
+            });
+          } else if (ame.type === "thinking_start") {
+            messageIdsWithStreamedReasoning.add(messageId);
+            piHistoryChunks.push({
+              type: "data-pi-reasoning-start",
+              data: { seq: nextPiSeq(), messageId, partId: String(ame.contentIndex) }
+            });
+          } else if (ame.type === "thinking_delta") {
+            messageIdsWithStreamedReasoning.add(messageId);
+            piHistoryChunks.push({
+              type: "data-pi-reasoning-delta",
+              data: { seq: nextPiSeq(), messageId, partId: String(ame.contentIndex), delta: ame.delta }
+            });
+          } else if (ame.type === "thinking_end") {
+            piHistoryChunks.push({
+              type: "data-pi-reasoning-end",
+              data: { seq: nextPiSeq(), messageId, partId: String(ame.contentIndex) }
+            });
+          } else if (ame.type === "toolcall_end") {
+            piHistoryChunks.push({
+              type: "data-pi-tool-call-end",
+              data: { seq: nextPiSeq(), messageId, toolCallId: ame.toolCall.id, toolName: ame.toolCall.name, input: ame.toolCall.arguments }
+            });
+          }
+        }
+        if (event.type === "message_end" && (eventMessage?.role === "user" || eventMessage?.role === "assistant")) {
+          const role = eventMessage.role;
+          const messageId = typeof eventMessage.id === "string" ? eventMessage.id : role === "assistant" && currentPiAssistantMessageId ? currentPiAssistantMessageId : `${role}-${Date.now()}`;
+          const text = role === "user" ? extractUserMessageText(eventMessage) : extractAssistantMessageText(eventMessage).text;
+          if (role === "assistant" && !messageIdsWithStreamedReasoning.has(messageId)) {
+            for (const reasoningText of extractAssistantReasoningTexts(eventMessage)) {
+              const partId = `reasoning-${nextPiSeq()}`;
+              piHistoryChunks.push(
+                { type: "data-pi-reasoning-start", data: { seq: nextPiSeq(), messageId, partId } },
+                { type: "data-pi-reasoning-delta", data: { seq: nextPiSeq(), messageId, partId, delta: reasoningText } },
+                { type: "data-pi-reasoning-end", data: { seq: nextPiSeq(), messageId, partId } }
+              );
+            }
+          }
+          piHistoryChunks.push({
+            type: "data-pi-message-end",
+            data: { seq: nextPiSeq(), messageId, role, ...text ? { text } : {} }
+          });
+        }
+        if (event.type === "tool_execution_start" && currentPiAssistantMessageId) {
+          piHistoryChunks.push({
+            type: "data-pi-tool-call-end",
+            data: { seq: nextPiSeq(), messageId: currentPiAssistantMessageId, toolCallId: event.toolCallId, toolName: event.toolName, input: event.args }
+          });
+        }
+        if (event.type === "tool_execution_end" && currentPiAssistantMessageId) {
+          piHistoryChunks.push({
+            type: "data-pi-tool-result",
+            data: { seq: nextPiSeq(), messageId: currentPiAssistantMessageId, toolCallId: event.toolCallId, output: event.result, isError: event.isError }
+          });
+        }
         if (event.type === "message_start" && event.message?.role === "user") {
           const text = extractUserMessageText(event.message);
-          converted = text && text !== input.message ? [{ type: "data-followup-consumed", data: { text } }] : [];
+          converted = text && text !== input.message ? [{ type: "data-followup-consumed", data: { text } }, ...piHistoryChunks] : piHistoryChunks;
           if (text && text !== input.message) {
             inlineTurnIndex += 1;
-            nativeFollowUpPending.delete(input.sessionId);
+            sawTextChunk = false;
+            currentPiAssistantMessageId = null;
+            const queue = nativeFollowUpQueues.get(input.sessionId);
+            if (queue?.length) {
+              const index = queue.findIndex((item) => item.text === text || item.displayText === text);
+              if (index >= 0) queue.splice(index, 1);
+              else queue.shift();
+              if (queue.length > 0) nativeFollowUpQueues.set(input.sessionId, queue);
+              else clearNativeFollowUpWork(input.sessionId);
+            } else {
+              nativeFollowUpPending.delete(input.sessionId);
+            }
           }
         } else if (event.type === "message_end" && event.message?.role === "user") {
-          converted = [];
+          converted = piHistoryChunks;
         } else {
-          converted = namespaceInlinePartIds(dedupStartChunks(piEventToChunks(event)));
-        }
-        if (event.type === "message_update") {
-          const ame = event.assistantMessageEvent;
-          if (ame.type === "text_end" && typeof ame.content === "string" && ame.content.length > 0 && !textDeltaSeen.has(ame.contentIndex)) {
-            const id = inlineTurnIndex === 0 ? String(ame.contentIndex) : `turn-${inlineTurnIndex}:${ame.contentIndex}`;
-            converted = [
-              ...textStartSeen.has(ame.contentIndex) ? [] : [{ type: "text-start", id }],
-              { type: "text-delta", id, delta: ame.content },
-              ...converted
-            ];
-            textDeltaSeen.add(ame.contentIndex);
-            assistantText += ame.content;
-          }
+          const sdkChunks = namespaceInlinePartIds(dedupStartChunks(piEventToChunks(event)));
+          const sdkChunksForTurn = filterSdkChunksForCurrentSegment(sdkChunks);
+          converted = [...piHistoryChunks, ...sdkChunksForTurn];
         }
         for (const chunk2 of converted) {
           const t = chunk2.type;
-          if (t === "text-delta") {
+          if (t === "text-delta" || t === "data-pi-text-delta" || t === "data-pi-text-end") {
             sawTextChunk = true;
           }
-        }
-        chunks.push(...converted);
-        if (event.type === "message_end" && !sawTextChunk) {
-          const { role, text, errorText } = extractAssistantMessageText(
-            event.message
-          );
-          if (role === "assistant" && errorText.length > 0) {
-            chunks.push({ type: "error", errorText });
-            sawTextChunk = true;
-          } else if (role === "assistant" && text.length > 0) {
-            const id = inlineTurnIndex === 0 ? "0" : `turn-${inlineTurnIndex}:0`;
-            chunks.push(
-              { type: "text-start", id },
-              { type: "text-delta", id, delta: text },
-              { type: "text-end", id }
-            );
+          const piEndData = chunk2.data;
+          if (t === "data-pi-message-end" && piEndData?.role === "assistant" && typeof piEndData.text === "string" && piEndData.text.length > 0) {
             sawTextChunk = true;
-            assistantText += text;
           }
         }
+        chunks.push(...converted);
         if (event.type === "agent_end") {
           if (!sawTextChunk) {
             const { role, text, errorText } = extractAssistantMessageText(
@@ -4066,11 +4794,10 @@ function createPiCodingAgentHarness(opts) {
               chunks.push({ type: "error", errorText });
               sawTextChunk = true;
             } else if (role === "assistant" && text.length > 0) {
-              const id = inlineTurnIndex === 0 ? "0" : `turn-${inlineTurnIndex}:0`;
+              const messageId = currentPiAssistantMessageId ?? "assistant-streaming";
               chunks.push(
-                { type: "text-start", id },
-                { type: "text-delta", id, delta: text },
-                { type: "text-end", id }
+                { type: "data-pi-message-start", data: { seq: nextPiSeq(), messageId, role } },
+                { type: "data-pi-message-end", data: { seq: nextPiSeq(), messageId, role, text } }
               );
               sawTextChunk = true;
               assistantText += text;
@@ -4098,6 +4825,11 @@ function createPiCodingAgentHarness(opts) {
             continue;
           }
           try {
+            const estimatedSize = Math.ceil(b64.length * 0.75);
+            if (estimatedSize > 10 * 1024 * 1024) {
+              writeErrors.push(`${a.filename ?? "image"}: attachment exceeds 10 MB limit`);
+              continue;
+            }
             const bytes = Buffer.from(b64, "base64");
             const ext = extForAttachment(a.filename ?? "image", contentType);
             const base = basenameForAttachment(a.filename ?? "image");
@@ -4108,7 +4840,7 @@ function createPiCodingAgentHarness(opts) {
             savedPaths.push(relPath);
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            log2.error("attachment write failed", { workdir: ctx.workdir, error: msg });
+            log3.error("attachment write failed", { workdir: ctx.workdir, error: msg });
             writeErrors.push(`${a.filename ?? "image"}: ${msg}`);
           }
         }
@@ -4132,6 +4864,12 @@ ${attachmentNotes.join("\n")}` : message,
         const prepared = await prepareTurn(message, attachments);
         return piSession.prompt(prepared.message, prepared.promptOpts).then(() => {
           promptSettled = true;
+          if (!done && nativeFollowUpPending.has(input.sessionId)) {
+            clearNativeFollowUpWork(input.sessionId);
+            done = true;
+            stopHeartbeat();
+            if (wake) wake();
+          }
         }).catch((err) => {
           promptSettled = true;
           streamError = err;
@@ -4188,7 +4926,7 @@ ${attachmentNotes.join("\n")}` : message,
 
 // src/server/harness/pi-coding-agent/pluginLoader.ts
 import { readdir as readdir5, stat as stat5, readFile as readFile7 } from "fs/promises";
-import { join as join7, extname as extname2, resolve as resolve4, sep as sep3 } from "path";
+import { join as join7, extname as extname3, resolve as resolve4, sep as sep3, relative as relative5 } from "path";
 import { homedir as homedir4 } from "os";
 import { pathToFileURL } from "url";
 var VALID_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs"]);
@@ -4214,7 +4952,7 @@ async function fileExists2(path4) {
 async function discoverFromDir(dir, source) {
   if (!await dirExists(dir)) return [];
   const entries = await readdir5(dir);
-  return entries.filter((e) => VALID_EXTENSIONS.has(extname2(e))).map((e) => ({ path: join7(dir, e), source }));
+  return entries.filter((e) => VALID_EXTENSIONS.has(extname3(e))).map((e) => ({ path: join7(dir, e), source }));
 }
 function extractTools(mod) {
   const tools = [];
@@ -4263,6 +5001,10 @@ async function loadNpmPlugin(pkgDir, importFn) {
   if (resolvedMain !== resolvedPkgDir && !resolvedMain.startsWith(resolvedPkgDir + sep3)) {
     return [];
   }
+  const relPath = relative5(resolvedPkgDir, resolvedMain);
+  if (relPath.startsWith("..")) {
+    return [];
+  }
   return loadModule(resolvedMain, importFn);
 }
 async function loadExtensionsJson(cwd) {
@@ -4344,7 +5086,7 @@ import {
 // src/server/tools/operations/bound.ts
 import { constants as constants3 } from "fs";
 import { access as access3, lstat as lstat3, mkdir as mkdir10, readFile as readFile8, readdir as readdir6, readlink, realpath as realpath2, stat as stat6, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative6, resolve as resolve5 } from "path";
 function toPosixPath(value) {
   return value.split("\\").join("/");
 }
@@ -4401,7 +5143,7 @@ async function walkMatches(root, current, pattern, ignore, limit, out) {
   for (const entry of entries) {
     if (out.length >= limit) return;
     const absolutePath = resolve5(current, entry.name);
-    const relativePath = toPosixPath(relative4(root, absolutePath));
+    const relativePath = toPosixPath(relative6(root, absolutePath));
     if (entry.isDirectory() && shouldSkipDir(relativePath, ignore)) continue;
     if (matchesGlob(relativePath, pattern)) {
       out.push(absolutePath);
@@ -4418,7 +5160,7 @@ async function findNearestExistingAncestor(absPath) {
       await stat6(current);
       return current;
     } catch {
-      const parent = dirname6(current);
+      const parent = dirname7(current);
       if (parent === current) return current;
       current = parent;
     }
@@ -4430,10 +5172,10 @@ async function assertWithinWorkspace(workspaceRoot, absPath) {
     const s = await lstat3(absPath);
     if (s.isSymbolicLink()) {
       const target = await readlink(absPath);
-      const resolvedTarget = resolve5(dirname6(absPath), target);
+      const resolvedTarget = resolve5(dirname7(absPath), target);
       const nearestAncestor = await findNearestExistingAncestor(resolvedTarget);
       const realAncestor = await realpath2(nearestAncestor);
-      const rel2 = relative4(realRoot, realAncestor);
+      const rel2 = relative6(realRoot, realAncestor);
       if (rel2.startsWith("..") || isAbsolute4(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
@@ -4452,1140 +5194,695 @@ async function assertWithinWorkspace(workspaceRoot, absPath) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      const nearestAncestor = await findNearestExistingAncestor(dirname6(absPath));
+      const nearestAncestor = await findNearestExistingAncestor(dirname7(absPath));
       const realAncestor = await realpath2(nearestAncestor);
-      const rel2 = relative4(realRoot, realAncestor);
+      const rel2 = relative6(realRoot, realAncestor);
       if (rel2.startsWith("..") || isAbsolute4(rel2)) {
         throw new Error(`path "${absPath}" is outside workspace`);
       }
-      return;
-    }
-    throw err;
-  }
-  const rel = relative4(realRoot, realCandidate);
-  if (rel.startsWith("..") || isAbsolute4(rel)) {
-    throw new Error(`path "${absPath}" is outside workspace`);
-  }
-}
-function boundFs(workspaceRoot) {
-  const read = {
-    async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile8(absolutePath);
-    },
-    async access(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await access3(absolutePath, constants3.R_OK);
-    }
-  };
-  const write = {
-    async writeFile(absolutePath, content) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await mkdir10(dirname6(absolutePath), { recursive: true });
-      await writeFile8(absolutePath, content);
-    },
-    async mkdir(dir) {
-      await assertWithinWorkspace(workspaceRoot, dir);
-      await mkdir10(dir, { recursive: true });
-    }
-  };
-  const edit = {
-    async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile8(absolutePath);
-    },
-    async writeFile(absolutePath, content) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await writeFile8(absolutePath, content);
-    },
-    async access(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      await access3(absolutePath, constants3.R_OK | constants3.W_OK);
-    }
-  };
-  const find = {
-    async exists(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      try {
-        await stat6(absolutePath);
-        return true;
-      } catch (err) {
-        if (err.code === "ENOENT") return false;
-        throw err;
-      }
-    },
-    async glob(pattern, cwd, options) {
-      await assertWithinWorkspace(workspaceRoot, cwd);
-      const matches = [];
-      await walkMatches(cwd, cwd, pattern, options.ignore, options.limit, matches);
-      return matches;
-    }
-  };
-  const grep = {
-    async isDirectory(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return (await stat6(absolutePath)).isDirectory();
-    },
-    async readFile(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readFile8(absolutePath, "utf8");
-    }
-  };
-  const ls = {
-    async exists(absolutePath) {
-      try {
-        await assertWithinWorkspace(workspaceRoot, absolutePath);
-        await stat6(absolutePath);
-        return true;
-      } catch {
-        return false;
-      }
-    },
-    async stat(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await stat6(absolutePath);
-    },
-    async readdir(absolutePath) {
-      await assertWithinWorkspace(workspaceRoot, absolutePath);
-      return await readdir6(absolutePath);
-    }
-  };
-  return { read, write, edit, find, grep, ls };
-}
-
-// src/server/tools/operations/vercel.ts
-import { relative as relative5 } from "path";
-function rootAliases(workspace) {
-  const aliases = [workspace.root];
-  if (workspace.root === VERCEL_SANDBOX_WORKSPACE_ROOT) aliases.push(VERCEL_SANDBOX_REMOTE_ROOT);
-  if (workspace.root === VERCEL_SANDBOX_REMOTE_ROOT) aliases.push(VERCEL_SANDBOX_WORKSPACE_ROOT);
-  return aliases;
-}
-function toRelPath(workspace, absolutePath) {
-  for (const root of rootAliases(workspace)) {
-    const rel = relative5(root, absolutePath);
-    if (!rel.startsWith("..") && !rel.startsWith("/")) return rel;
+      return;
+    }
+    throw err;
   }
-  const skillMarker = "/.agents/skills/";
-  const skillIndex = absolutePath.indexOf(skillMarker);
-  if (skillIndex >= 0) {
-    return `.agents/skills/${absolutePath.slice(skillIndex + skillMarker.length)}`;
+  const rel = relative6(realRoot, realCandidate);
+  if (rel.startsWith("..") || isAbsolute4(rel)) {
+    throw new Error(`path "${absPath}" is outside workspace`);
   }
-  throw new Error(
-    `path "${absolutePath}" is outside workspace; use a path relative to the workspace root or under ${rootAliases(workspace).join(" / ")}`
-  );
-}
-function vercelBashOps(sandbox) {
-  return {
-    exec(command, cwd, { onData, signal, timeout, env }) {
-      const filteredEnv = env ? Object.fromEntries(Object.entries(env).filter((e) => e[1] != null)) : void 0;
-      return sandbox.exec(command, {
-        cwd,
-        env: filteredEnv,
-        signal,
-        timeoutMs: timeout ? timeout * 1e3 : void 0,
-        onStdout: (chunk2) => onData(Buffer.from(chunk2)),
-        onStderr: (chunk2) => onData(Buffer.from(chunk2))
-      }).then((result) => ({ exitCode: result.exitCode }));
-    }
-  };
 }
-function vercelReadOps(workspace) {
-  return {
+function boundFs(workspaceRoot) {
+  const read = {
     async readFile(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const content = await workspace.readFile(rel);
-      return Buffer.from(content, "utf-8");
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return await readFile8(absolutePath);
     },
     async access(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      await workspace.stat(rel);
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      await access3(absolutePath, constants3.R_OK);
     }
   };
-}
-function vercelWriteOps(workspace) {
-  return {
+  const write = {
     async writeFile(absolutePath, content) {
-      const rel = toRelPath(workspace, absolutePath);
-      await workspace.writeFile(rel, content);
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      await mkdir10(dirname7(absolutePath), { recursive: true });
+      await writeFile8(absolutePath, content);
     },
     async mkdir(dir) {
-      const rel = toRelPath(workspace, dir);
-      await workspace.mkdir(rel, { recursive: true });
+      await assertWithinWorkspace(workspaceRoot, dir);
+      await mkdir10(dir, { recursive: true });
     }
   };
-}
-function vercelEditOps(workspace) {
-  return {
+  const edit = {
     async readFile(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const content = await workspace.readFile(rel);
-      return Buffer.from(content, "utf-8");
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return await readFile8(absolutePath);
     },
     async writeFile(absolutePath, content) {
-      const rel = toRelPath(workspace, absolutePath);
-      await workspace.writeFile(rel, content);
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      await writeFile8(absolutePath, content);
     },
     async access(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      await workspace.stat(rel);
-    }
-  };
-}
-function toRemotePath2(value) {
-  if (value === VERCEL_SANDBOX_WORKSPACE_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
-  if (value.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
-    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_WORKSPACE_ROOT.length)}`;
-  }
-  return value;
-}
-function findPredicate(pattern) {
-  const isPathShaped = pattern.includes("/") || pattern.includes("**");
-  if (!isPathShaped) return `-name ${shellEscape(pattern)}`;
-  let translated = pattern.replaceAll("**", "*").replace(/^\/+/, "");
-  if (!translated.startsWith("*")) translated = `*${translated}`;
-  return `-path ${shellEscape(translated)}`;
-}
-function findIgnoreArgs(cwd, ignore) {
-  return ignore.map((pattern) => `! -path ${shellEscape(`${cwd}/${pattern.replace(/^\/+/, "")}/*`)}`).join(" ");
-}
-function fallbackFindCommand(pattern, cwd, options) {
-  return [
-    "find",
-    shellEscape(cwd),
-    "-maxdepth 20",
-    "-type f",
-    findIgnoreArgs(cwd, options.ignore),
-    findPredicate(pattern),
-    `| head -n ${Math.max(1, Math.trunc(options.limit))}`
-  ].filter(Boolean).join(" ");
-}
-function isFdMissing(result) {
-  if (result.exitCode !== 127) return false;
-  const stderr = Buffer.from(result.stderr).toString("utf-8");
-  return /fd: not found|fd: command not found|not found/i.test(stderr);
-}
-function vercelFindOps(sandbox, workspace) {
-  return {
-    async exists(absolutePath) {
-      if (workspace) {
-        try {
-          const rel = toRelPath(workspace, absolutePath);
-          await workspace.stat(rel);
-          return true;
-        } catch {
-          return false;
-        }
-      }
-      const result = await sandbox.exec(`test -e ${shellEscape(absolutePath)}`, {
-        timeoutMs: 5e3
-      });
-      return result.exitCode === 0;
-    },
-    async glob(pattern, cwd, options) {
-      const remoteCwd = toRemotePath2(cwd);
-      const args = ["fd", "--glob", "--no-require-git", "--max-results", String(options.limit)];
-      for (const ig of options.ignore) {
-        args.push("--exclude", ig);
-      }
-      args.push(pattern, remoteCwd);
-      let result = await sandbox.exec(args.map(shellEscape).join(" "), {
-        timeoutMs: 3e4,
-        maxOutputBytes: 1048576
-      });
-      if (isFdMissing(result)) {
-        result = await sandbox.exec(fallbackFindCommand(pattern, remoteCwd, options), {
-          timeoutMs: 3e4,
-          maxOutputBytes: 1048576
-        });
-      }
-      if (result.exitCode !== 0 && result.exitCode !== 1) {
-        const stderr = Buffer.from(result.stderr).toString("utf-8").trim();
-        throw new Error(`file search failed (exit ${result.exitCode}): ${stderr}`);
-      }
-      const stdout = Buffer.from(result.stdout).toString("utf-8");
-      return stdout.split("\n").filter(Boolean);
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      await access3(absolutePath, constants3.R_OK | constants3.W_OK);
     }
   };
-}
-function vercelLsOps(workspace) {
-  return {
+  const find = {
     async exists(absolutePath) {
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
       try {
-        const rel = toRelPath(workspace, absolutePath);
-        await workspace.stat(rel);
+        await stat6(absolutePath);
         return true;
-      } catch {
-        return false;
+      } catch (err) {
+        if (err.code === "ENOENT") return false;
+        throw err;
       }
     },
-    async stat(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const s = await workspace.stat(rel);
-      return { isDirectory: () => s.kind === "dir" };
-    },
-    async readdir(absolutePath) {
-      const rel = toRelPath(workspace, absolutePath);
-      const entries = await workspace.readdir(rel);
-      return entries.map((e) => e.name);
+    async glob(pattern, cwd, options) {
+      await assertWithinWorkspace(workspaceRoot, cwd);
+      const matches = [];
+      await walkMatches(cwd, cwd, pattern, options.ignore, options.limit, matches);
+      return matches;
     }
   };
-}
-function shellEscape(arg) {
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-
-// src/server/tools/vercelGrepTool.ts
-import {
-  createGrepToolDefinition,
-  formatSize,
-  truncateHead,
-  truncateLine
-} from "@mariozechner/pi-coding-agent";
-import { resolve as resolve6, relative as relative6 } from "path";
-
-// src/server/catalog/tools/_shared.ts
-function makeError(message) {
-  return {
-    content: [{ type: "text", text: message }],
-    isError: true
-  };
-}
-function bytesWritten(content) {
-  return new TextEncoder().encode(content).byteLength;
-}
-var decoder = new TextDecoder("utf-8", { fatal: false });
-function decode(bytes) {
-  return decoder.decode(bytes);
-}
-
-// src/server/tools/vercelGrepTool.ts
-var PI_GREP_TOOL = createGrepToolDefinition("/");
-var DEFAULT_LIMIT2 = 100;
-var GREP_MAX_LINE_LENGTH = 500;
-var GREP_TIMEOUT_MS = 3e4;
-var GREP_MAX_OUTPUT_BYTES = 2097152;
-function quoteShell(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function numberParam(value, fallback, min = 1) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
-  return Math.max(min, Math.floor(value));
-}
-function optionalStringParam(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function buildRgCommand(params) {
-  const args = ["--json", "--line-number", "--color=never", "--hidden"];
-  if (params.ignoreCase === true) args.push("--ignore-case");
-  if (params.literal === true) args.push("--fixed-strings");
-  const glob = optionalStringParam(params.glob);
-  if (glob) args.push("--glob", quoteShell(glob));
-  const context = numberParam(params.context, 0, 0);
-  if (context > 0) args.push("--context", String(context));
-  const pattern = params.pattern;
-  const searchPath = optionalStringParam(params.path) ?? ".";
-  args.push("--", quoteShell(pattern), quoteShell(searchPath));
-  return `rg ${args.join(" ")}`;
-}
-function parseRgJson(stdout, limit) {
-  const outputLines = [];
-  let matchCount = 0;
-  let matchLimitReached = false;
-  let linesTruncated = false;
-  for (const rawLine of stdout.split("\n")) {
-    if (rawLine.trim().length === 0) continue;
-    let event;
-    try {
-      event = JSON.parse(rawLine);
-    } catch {
-      continue;
-    }
-    const filePath = event.data?.path?.text;
-    const lineNumber = event.data?.line_number;
-    const lineText = event.data?.lines?.text;
-    if (!filePath || typeof lineNumber !== "number" || typeof lineText !== "string") {
-      continue;
-    }
-    const isMatch = event.type === "match";
-    if (isMatch) {
-      matchCount += 1;
-      if (matchCount > limit) {
-        matchLimitReached = true;
-        break;
+  const grep = {
+    async isDirectory(absolutePath) {
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return (await stat6(absolutePath)).isDirectory();
+    },
+    async readFile(absolutePath) {
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return await readFile8(absolutePath, "utf8");
+    }
+  };
+  const ls = {
+    async exists(absolutePath) {
+      try {
+        await assertWithinWorkspace(workspaceRoot, absolutePath);
+        await stat6(absolutePath);
+        return true;
+      } catch {
+        return false;
       }
-    } else if (event.type !== "context") {
-      continue;
+    },
+    async stat(absolutePath) {
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return await stat6(absolutePath);
+    },
+    async readdir(absolutePath) {
+      await assertWithinWorkspace(workspaceRoot, absolutePath);
+      return await readdir6(absolutePath);
     }
-    const sanitized = lineText.replace(/\r\n/g, "\n").replace(/\r/g, "").replace(/\n$/, "");
-    const { text, wasTruncated } = truncateLine(sanitized);
-    if (wasTruncated) linesTruncated = true;
-    const separator = isMatch ? ":" : "-";
-    outputLines.push(`${filePath}${separator}${lineNumber}${separator} ${text}`);
-  }
-  return { outputLines, matchCount, matchLimitReached, linesTruncated };
-}
-function syntheticExecTruncation(output) {
-  const outputLines = output.length === 0 ? 0 : output.split("\n").length;
-  const outputBytes = bytesWritten(output);
-  return {
-    content: output,
-    truncated: true,
-    truncatedBy: "bytes",
-    totalLines: outputLines,
-    totalBytes: outputBytes,
-    outputLines,
-    outputBytes,
-    lastLinePartial: false,
-    firstLineExceedsLimit: false,
-    maxLines: Number.MAX_SAFE_INTEGER,
-    maxBytes: GREP_MAX_OUTPUT_BYTES
   };
+  return { read, write, edit, find, grep, ls };
 }
-function buildSuccessResult(parsed, effectiveLimit, sandboxTruncated) {
-  if (parsed.matchCount === 0) {
-    return {
-      content: [{ type: "text", text: "No matches found" }],
-      details: void 0
-    };
-  }
-  const rawOutput = parsed.outputLines.join("\n");
-  const truncation = truncateHead(rawOutput, { maxLines: Number.MAX_SAFE_INTEGER });
-  let output = truncation.content;
-  const details = {};
-  const notices = [];
-  if (parsed.matchLimitReached) {
-    notices.push(
-      `${effectiveLimit} matches limit reached. Use limit=${effectiveLimit * 2} for more, or refine pattern`
-    );
-    details.matchLimitReached = effectiveLimit;
-  }
-  if (truncation.truncated || sandboxTruncated) {
-    const effectiveTruncation = truncation.truncated ? truncation : syntheticExecTruncation(output);
-    notices.push(`${formatSize(effectiveTruncation.maxBytes)} limit reached`);
-    details.truncation = effectiveTruncation;
+
+// src/server/tools/operations/vercel.ts
+import { isAbsolute as isAbsolute5, relative as relative7 } from "path";
+function rootAliases(workspace) {
+  const aliases = [workspace.root];
+  if (workspace.root === VERCEL_SANDBOX_WORKSPACE_ROOT) aliases.push(VERCEL_SANDBOX_REMOTE_ROOT);
+  if (workspace.root === VERCEL_SANDBOX_REMOTE_ROOT) aliases.push(VERCEL_SANDBOX_WORKSPACE_ROOT);
+  return aliases;
+}
+function isOutsideWorkspaceRel(rel) {
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute5(rel);
+}
+function toRelPath(workspace, absolutePath) {
+  for (const root of rootAliases(workspace)) {
+    const rel = relative7(root, absolutePath);
+    if (!isOutsideWorkspaceRel(rel)) return rel;
   }
-  if (parsed.linesTruncated) {
-    notices.push(
-      `Some lines truncated to ${GREP_MAX_LINE_LENGTH} chars. Use read tool to see full lines`
-    );
-    details.linesTruncated = true;
+  const skillMarker = "/.agents/skills/";
+  const skillIndex = absolutePath.indexOf(skillMarker);
+  if (skillIndex >= 0) {
+    const skillPath = absolutePath.slice(skillIndex + skillMarker.length);
+    if (skillPath.includes("\0") || skillPath.split(/[\\/]+/).includes("..")) {
+      throw new Error(`path "${absolutePath}" escapes the workspace skills directory`);
+    }
+    return `.agents/skills/${skillPath}`;
   }
-  if (notices.length > 0) output += `
-
-[${notices.join(". ")}]`;
+  throw new Error(
+    `path "${absolutePath}" is outside workspace; use a path relative to the workspace root or under ${rootAliases(workspace).join(" / ")}`
+  );
+}
+function vercelBashOps(sandbox) {
   return {
-    content: [{ type: "text", text: output }],
-    details: Object.keys(details).length > 0 ? details : void 0
+    exec(command, cwd, { onData, signal, timeout, env }) {
+      const filteredEnv = env ? Object.fromEntries(Object.entries(env).filter((e) => e[1] != null)) : void 0;
+      return sandbox.exec(command, {
+        cwd,
+        env: filteredEnv,
+        signal,
+        timeoutMs: timeout ? timeout * 1e3 : void 0,
+        onStdout: (chunk2) => onData(Buffer.from(chunk2)),
+        onStderr: (chunk2) => onData(Buffer.from(chunk2))
+      }).then((result) => ({ exitCode: result.exitCode }));
+    }
   };
 }
-function vercelGrepTool(sandbox, workspaceRoot) {
+function vercelReadOps(workspace) {
   return {
-    name: PI_GREP_TOOL.name,
-    description: PI_GREP_TOOL.description,
-    promptSnippet: PI_GREP_TOOL.promptSnippet,
-    parameters: PI_GREP_TOOL.parameters,
-    async execute(input, ctx) {
-      const params = input;
-      if (ctx.abortSignal.aborted) {
-        return makeError("grep aborted");
-      }
-      if (typeof params.pattern !== "string" || params.pattern.length === 0) {
-        return makeError("pattern is required");
-      }
-      if (workspaceRoot && typeof params.path === "string" && params.path.length > 0) {
-        const resolved = resolve6(workspaceRoot, params.path);
-        const rel = relative6(workspaceRoot, resolved);
-        if (rel.startsWith("..") || rel.startsWith("/")) {
-          return makeError(`path "${params.path}" is outside workspace`);
-        }
-      }
-      try {
-        const result = await sandbox.exec(buildRgCommand(params), {
-          signal: ctx.abortSignal,
-          timeoutMs: GREP_TIMEOUT_MS,
-          maxOutputBytes: GREP_MAX_OUTPUT_BYTES
-        });
-        if (result.exitCode !== 0 && result.exitCode !== 1) {
-          const stderr = decode(result.stderr).trim();
-          const message = stderr || `ripgrep exited with code ${result.exitCode}`;
-          return makeError(`grep failed: ${message}`);
-        }
-        const limit = numberParam(params.limit, DEFAULT_LIMIT2);
-        const parsed = parseRgJson(decode(result.stdout), limit);
-        return buildSuccessResult(parsed, limit, result.truncated);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : "unknown error";
-        return makeError(`grep failed: ${message}`);
-      }
+    async readFile(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      const content = await workspace.readFile(rel);
+      return Buffer.from(content, "utf-8");
+    },
+    async access(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      await workspace.stat(rel);
     }
   };
 }
-
-// src/server/tools/filesystem/index.ts
-function isTextContent(content) {
-  return content.type === "text" && typeof content.text === "string";
+function vercelWriteOps(workspace) {
+  return {
+    async writeFile(absolutePath, content) {
+      const rel = toRelPath(workspace, absolutePath);
+      await workspace.writeFile(rel, content);
+    },
+    async mkdir(dir) {
+      const rel = toRelPath(workspace, dir);
+      await workspace.mkdir(rel, { recursive: true });
+    }
+  };
 }
-function adaptPiTool(piTool) {
+function vercelEditOps(workspace) {
   return {
-    name: piTool.name,
-    description: piTool.description,
-    promptSnippet: piTool.promptSnippet,
-    parameters: piTool.parameters,
-    async execute(params, ctx) {
-      const result = await piTool.execute(
-        ctx.toolCallId,
-        params,
-        ctx.abortSignal,
-        ctx.onUpdate ? (update) => {
-          const text = update.content?.filter(isTextContent).map((c) => c.text).join("");
-          if (text) ctx.onUpdate?.(text);
-        } : void 0,
-        {}
-      );
-      const textContent = (result.content ?? []).filter(isTextContent).map((c) => ({ type: "text", text: c.text }));
-      return {
-        content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
-        isError: false,
-        details: result.details
-      };
+    async readFile(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      const content = await workspace.readFile(rel);
+      return Buffer.from(content, "utf-8");
+    },
+    async writeFile(absolutePath, content) {
+      const rel = toRelPath(workspace, absolutePath);
+      await workspace.writeFile(rel, content);
+    },
+    async access(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      await workspace.stat(rel);
     }
   };
 }
-function buildFilesystemAgentTools(bundle) {
-  const cwd = bundle.workspace.root;
-  if (bundle.sandbox.provider === "vercel-sandbox") {
-    return [
-      adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
-      adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
-      adaptPiTool(createEditToolDefinition(cwd, { operations: vercelEditOps(bundle.workspace) })),
-      adaptPiTool(createFindToolDefinition(cwd, { operations: vercelFindOps(bundle.sandbox, bundle.workspace) })),
-      vercelGrepTool(bundle.sandbox, cwd),
-      adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
-    ];
+function toRemotePath2(value) {
+  if (value === VERCEL_SANDBOX_WORKSPACE_ROOT) return VERCEL_SANDBOX_REMOTE_ROOT;
+  if (value.startsWith(`${VERCEL_SANDBOX_WORKSPACE_ROOT}/`)) {
+    return `${VERCEL_SANDBOX_REMOTE_ROOT}${value.slice(VERCEL_SANDBOX_WORKSPACE_ROOT.length)}`;
   }
-  const ops = boundFs(cwd);
-  return [
-    adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
-    adaptPiTool(createWriteToolDefinition(cwd, { operations: ops.write })),
-    adaptPiTool(createEditToolDefinition(cwd, { operations: ops.edit })),
-    adaptPiTool(createFindToolDefinition(cwd, { operations: ops.find })),
-    adaptPiTool(createGrepToolDefinition2(cwd, { operations: ops.grep })),
-    adaptPiTool(createLsToolDefinition(cwd, { operations: ops.ls }))
-  ];
-}
-
-// src/server/tools/harness/index.ts
-import {
-  createBashToolDefinition,
-  createLocalBashOperations
-} from "@mariozechner/pi-coding-agent";
-function shellEscape2(s) {
-  return `'${s.replace(/'/g, "'\\''")}'`;
+  return value;
 }
-function bwrapSpawnHook(workspaceRoot) {
-  const args = buildBwrapArgs(workspaceRoot);
-  const bwrapPrefix = ["bwrap", ...args].map(shellEscape2).join(" ");
-  return (context) => ({
-    ...context,
-    command: `${bwrapPrefix} bash -lc ${shellEscape2(context.command)}`,
-    env: withWorkspacePythonEnv({
-      workspaceRoot,
-      env: context.env,
-      sandboxRoot: "/workspace"
-    })
-  });
+function findPredicate(pattern) {
+  const isPathShaped = pattern.includes("/") || pattern.includes("**");
+  if (!isPathShaped) return `-name ${shellEscape(pattern)}`;
+  let translated = pattern.replaceAll("**", "*").replace(/^\/+/, "");
+  if (!translated.startsWith("*")) translated = `*${translated}`;
+  return `-path ${shellEscape(translated)}`;
 }
-function directSpawnHook(workspaceRoot) {
-  return (context) => ({
-    ...context,
-    env: withWorkspacePythonEnv({ workspaceRoot, env: context.env })
-  });
+function findIgnoreArgs(cwd, ignore) {
+  return ignore.map((pattern) => `! -path ${shellEscape(`${cwd}/${pattern.replace(/^\/+/, "")}/*`)}`).join(" ");
 }
-function bashOptionsForMode(bundle) {
-  switch (bundle.sandbox.provider) {
-    case "vercel-sandbox":
-      return { operations: vercelBashOps(bundle.sandbox) };
-    case "bwrap":
-      return {
-        operations: createLocalBashOperations(),
-        spawnHook: bwrapSpawnHook(bundle.workspace.root)
-      };
-    default:
-      return {
-        operations: createLocalBashOperations(),
-        spawnHook: directSpawnHook(bundle.workspace.root)
-      };
-  }
+function fallbackFindCommand(pattern, cwd, options) {
+  return [
+    "find",
+    shellEscape(cwd),
+    "-maxdepth 20",
+    "-type f",
+    findIgnoreArgs(cwd, options.ignore),
+    findPredicate(pattern),
+    `| head -n ${Math.max(1, Math.trunc(options.limit))}`
+  ].filter(Boolean).join(" ");
 }
-function adaptPiTool2(piTool) {
-  return {
-    name: piTool.name,
-    description: piTool.description,
-    promptSnippet: piTool.promptSnippet,
-    parameters: piTool.parameters,
-    async execute(params, ctx) {
-      const result = await piTool.execute(
-        ctx.toolCallId,
-        params,
-        ctx.abortSignal,
-        ctx.onUpdate ? (update) => {
-          const text = update.content.filter((c) => c.type === "text").map((c) => c.text).join("");
-          ctx.onUpdate(text);
-        } : void 0,
-        {}
-      );
-      const textContent = (result.content ?? []).filter((c) => c.type === "text").map((c) => ({ type: "text", text: c.text }));
-      return {
-        content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
-        isError: false,
-        details: result.details
-      };
-    }
-  };
+function isFdMissing(result) {
+  if (result.exitCode !== 127) return false;
+  const stderr = Buffer.from(result.stderr).toString("utf-8");
+  return /\bfd: (?:not found|command not found)\b/i.test(stderr);
 }
-function createExecuteIsolatedCodeTool(sandbox) {
+function vercelFindOps(sandbox, workspace) {
   return {
-    name: "execute_isolated_code",
-    description: "Execute code in an isolated sandbox environment.",
-    parameters: {
-      type: "object",
-      properties: {
-        code: { type: "string" },
-        language: { type: "string", enum: ["python", "shell"] },
-        image: { type: "string" },
-        packages: { type: "array", items: { type: "string" } },
-        sandboxId: { type: "string" },
-        vmSize: { type: "string", enum: ["xxs", "xs", "s", "m", "l"] }
-      },
-      required: ["code", "language"],
-      additionalProperties: false
+    async exists(absolutePath) {
+      if (workspace) {
+        try {
+          const rel = toRelPath(workspace, absolutePath);
+          await workspace.stat(rel);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      const result = await sandbox.exec(`test -e ${shellEscape(absolutePath)}`, {
+        timeoutMs: 5e3
+      });
+      return result.exitCode === 0;
     },
-    async execute(input) {
-      if (!sandbox.executeIsolatedCode) {
-        return {
-          content: [{ type: "text", text: "isolated-code capability is not available" }],
-          isError: true
-        };
+    async glob(pattern, cwd, options) {
+      const remoteCwd = toRemotePath2(cwd);
+      const args = ["fd", "--glob", "--no-require-git", "--max-results", String(options.limit)];
+      for (const ig of options.ignore) {
+        args.push("--exclude", ig);
       }
-      const code = input.code;
-      const language = input.language;
-      if (typeof code !== "string" || code.length === 0) {
-        return { content: [{ type: "text", text: "code is required" }], isError: true };
+      args.push(pattern, remoteCwd);
+      let result = await sandbox.exec(args.map(shellEscape).join(" "), {
+        timeoutMs: 3e4,
+        maxOutputBytes: 1048576
+      });
+      if (isFdMissing(result)) {
+        result = await sandbox.exec(fallbackFindCommand(pattern, remoteCwd, options), {
+          timeoutMs: 3e4,
+          maxOutputBytes: 1048576
+        });
       }
-      if (language !== "python" && language !== "shell") {
-        return { content: [{ type: "text", text: "language must be python or shell" }], isError: true };
+      if (result.exitCode !== 0 && result.exitCode !== 1) {
+        const stderr = Buffer.from(result.stderr).toString("utf-8").trim();
+        throw new Error(`file search failed (exit ${result.exitCode}): ${stderr}`);
       }
+      const stdout = Buffer.from(result.stdout).toString("utf-8");
+      return stdout.split("\n").filter(Boolean);
+    }
+  };
+}
+function vercelLsOps(workspace) {
+  return {
+    async exists(absolutePath) {
       try {
-        const result = await sandbox.executeIsolatedCode({
-          code,
-          language,
-          image: typeof input.image === "string" ? input.image : void 0,
-          packages: Array.isArray(input.packages) ? input.packages.filter((v) => typeof v === "string") : void 0,
-          sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : void 0,
-          vmSize: input.vmSize === "xxs" || input.vmSize === "xs" || input.vmSize === "s" || input.vmSize === "m" || input.vmSize === "l" ? input.vmSize : void 0
-        });
-        return {
-          content: [{ type: "text", text: JSON.stringify(result) }],
-          isError: result.exitCode !== 0,
-          details: result
-        };
-      } catch (error) {
-        return {
-          content: [{ type: "text", text: error instanceof Error ? error.message : "execute_isolated_code failed" }],
-          isError: true
-        };
+        const rel = toRelPath(workspace, absolutePath);
+        await workspace.stat(rel);
+        return true;
+      } catch {
+        return false;
       }
+    },
+    async stat(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      const s = await workspace.stat(rel);
+      return { isDirectory: () => s.kind === "dir" };
+    },
+    async readdir(absolutePath) {
+      const rel = toRelPath(workspace, absolutePath);
+      const entries = await workspace.readdir(rel);
+      return entries.map((e) => e.name);
     }
   };
 }
-function buildHarnessAgentTools(bundle) {
-  const tools = [
-    adaptPiTool2(createBashToolDefinition(bundle.workspace.root, bashOptionsForMode(bundle)))
-  ];
-  if (bundle.sandbox.capabilities.includes("isolated-code")) {
-    tools.push(createExecuteIsolatedCodeTool(bundle.sandbox));
-  }
-  return tools;
+function shellEscape(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
 }
 
-// src/server/http/middleware.ts
-var ERROR_CODE_AUTH_REQUIRED = "auth_required";
-var ERROR_CODE_AUTH_INVALID = "auth_invalid";
-var ERROR_CODE_INVALID_PATH = "invalid_path";
-var ERROR_CODE_VALIDATION_ERROR = "validation_error";
-var ERROR_CODE_PATH_REJECTED = "path_rejected";
-var ERROR_CODE_NOT_FOUND = "not_found";
-var ERROR_CODE_ALREADY_EXISTS = "already_exists";
-var ERROR_CODE_CONFLICT = "conflict";
-var ERROR_CODE_RANGE_NOT_SATISFIABLE = "range_not_satisfiable";
-var ERROR_CODE_INTERNAL = "internal";
-var ERROR_CODE_NOT_IMPLEMENTED = "not_implemented";
-var DEV_MODE_WARNING = "No auth token set \u2014 running in dev mode";
-var DEFAULT_WORKSPACE_ID = "default";
-function errorPayload(code, message, field) {
+// src/server/tools/vercelGrepTool.ts
+import {
+  createGrepToolDefinition,
+  formatSize,
+  truncateHead,
+  truncateLine
+} from "@mariozechner/pi-coding-agent";
+import { resolve as resolve6, relative as relative8 } from "path";
+
+// src/server/catalog/tools/_shared.ts
+function makeError(message) {
   return {
-    error: {
-      code,
-      message,
-      ...field ? { field } : {}
+    content: [{ type: "text", text: message }],
+    isError: true
+  };
+}
+function bytesWritten(content) {
+  return new TextEncoder().encode(content).byteLength;
+}
+var decoder = new TextDecoder("utf-8", { fatal: false });
+function decode(bytes) {
+  return decoder.decode(bytes);
+}
+
+// src/server/tools/vercelGrepTool.ts
+var PI_GREP_TOOL = createGrepToolDefinition("/");
+var DEFAULT_LIMIT2 = 100;
+var GREP_MAX_LINE_LENGTH = 500;
+var GREP_TIMEOUT_MS = 3e4;
+var GREP_MAX_OUTPUT_BYTES = 2097152;
+function quoteShell(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function numberParam(value, fallback, min = 1) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
+  return Math.max(min, Math.floor(value));
+}
+function optionalStringParam(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function buildRgCommand(params) {
+  const args = ["--json", "--line-number", "--color=never", "--hidden"];
+  if (params.ignoreCase === true) args.push("--ignore-case");
+  if (params.literal === true) args.push("--fixed-strings");
+  const glob = optionalStringParam(params.glob);
+  if (glob) args.push("--glob", quoteShell(glob));
+  const context = numberParam(params.context, 0, 0);
+  if (context > 0) args.push("--context", String(context));
+  const pattern = params.pattern;
+  const searchPath = optionalStringParam(params.path) ?? ".";
+  args.push("--", quoteShell(pattern), quoteShell(searchPath));
+  return `rg ${args.join(" ")}`;
+}
+function parseRgJson(stdout, limit) {
+  const outputLines = [];
+  let matchCount = 0;
+  let matchLimitReached = false;
+  let linesTruncated = false;
+  for (const rawLine of stdout.split("\n")) {
+    if (rawLine.trim().length === 0) continue;
+    let event;
+    try {
+      event = JSON.parse(rawLine);
+    } catch {
+      continue;
     }
-  };
-}
-function ensureWorkspaceContext(request, workspaceId, authenticated) {
-  request.workspaceContext = {
-    workspaceId,
-    authenticated
-  };
-}
-function createAuthMiddleware(opts = {}) {
-  let warnedDevMode = false;
-  return async function authMiddleware(request, reply) {
-    const workspaceId = opts.workspaceId ?? DEFAULT_WORKSPACE_ID;
-    const authToken = opts.authToken?.trim() || void 0;
-    ensureWorkspaceContext(request, workspaceId, false);
-    if (opts.publicPaths?.includes(request.url.split("?")[0])) {
-      return;
+    const filePath = event.data?.path?.text;
+    const lineNumber = event.data?.line_number;
+    const lineText = event.data?.lines?.text;
+    if (!filePath || typeof lineNumber !== "number" || typeof lineText !== "string") {
+      continue;
     }
-    if (!authToken) {
-      if (!warnedDevMode) {
-        warnedDevMode = true;
-        request.log.warn(DEV_MODE_WARNING);
-        opts.onDevModeWarning?.(DEV_MODE_WARNING);
+    const isMatch = event.type === "match";
+    if (isMatch) {
+      matchCount += 1;
+      if (matchCount > limit) {
+        matchLimitReached = true;
+        break;
       }
-      return;
-    }
-    const header = request.headers.authorization;
-    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
-      reply.code(401).send(
-        errorPayload(
-          ERROR_CODE_AUTH_REQUIRED,
-          "Missing Bearer token"
-        )
-      );
-      return;
-    }
-    const candidateToken = header.slice("Bearer ".length);
-    if (candidateToken !== authToken) {
-      reply.code(403).send(errorPayload(ERROR_CODE_AUTH_INVALID, "Invalid token"));
-      return;
+    } else if (event.type !== "context") {
+      continue;
     }
-    ensureWorkspaceContext(request, workspaceId, true);
-  };
+    const sanitized = lineText.replace(/\r\n/g, "\n").replace(/\r/g, "").replace(/\n$/, "");
+    const { text, wasTruncated } = truncateLine(sanitized);
+    if (wasTruncated) linesTruncated = true;
+    const separator = isMatch ? ":" : "-";
+    outputLines.push(`${filePath}${separator}${lineNumber}${separator} ${text}`);
+  }
+  return { outputLines, matchCount, matchLimitReached, linesTruncated };
 }
-function createBodyValidator(schema) {
-  return async function validateBody(request, reply) {
-    const parsed = schema.safeParse(request.body);
-    if (!parsed.success) {
-      const firstIssue = parsed.error.issues[0];
-      const fieldName = firstIssue?.path?.map((segment) => String(segment)).join(".");
-      reply.code(400).send(
-        errorPayload(
-          ERROR_CODE_VALIDATION_ERROR,
-          firstIssue?.message ?? "Invalid request body",
-          fieldName || void 0
-        )
-      );
-      return;
-    }
-    request.body = parsed.data;
+function syntheticExecTruncation(output) {
+  const outputLines = output.length === 0 ? 0 : output.split("\n").length;
+  const outputBytes = bytesWritten(output);
+  return {
+    content: output,
+    truncated: true,
+    truncatedBy: "bytes",
+    totalLines: outputLines,
+    totalBytes: outputBytes,
+    outputLines,
+    outputBytes,
+    lastLinePartial: false,
+    firstLineExceedsLimit: false,
+    maxLines: Number.MAX_SAFE_INTEGER,
+    maxBytes: GREP_MAX_OUTPUT_BYTES
   };
 }
-
-// src/server/http/routes/health.ts
-function healthRoutes(app, opts, done) {
-  const startTime = Date.now();
-  app.get("/health", async () => {
+function buildSuccessResult(parsed, effectiveLimit, sandboxTruncated) {
+  if (parsed.matchCount === 0) {
     return {
-      status: "ok",
-      version: opts.version,
-      uptime: Math.floor((Date.now() - startTime) / 1e3)
+      content: [{ type: "text", text: "No matches found" }],
+      details: void 0
     };
-  });
-  app.get("/ready", async (_request, reply) => {
-    const state = opts.getReadiness();
-    if (state.degradedReason) {
-      return reply.code(503).send({
-        status: "degraded",
-        reason: state.degradedReason
-      });
-    }
-    if (!state.sandboxReady || !state.harnessReady) {
-      return reply.code(503).send({
-        status: "provisioning",
-        retryAfter: 2
-      });
-    }
-    return { status: "ready" };
-  });
-  done();
-}
-
-// src/server/http/routes/file.ts
-import { dirname as dirname7, extname as extname3, relative as relative7 } from "path/posix";
-var BORING_SETTINGS_PATH = ".boring/settings";
-var DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR = "assets/images";
-var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
-function defaultWorkspaceSettings() {
-  return { markdown: { imageUploadDir: DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR } };
-}
-function isPathValidationError(err) {
-  return err instanceof Error && typeof err.reason === "string";
-}
-function classifyError(err, reply, subject) {
-  if (isPathValidationError(err)) {
-    return reply.code(403).send({
-      error: { code: ERROR_CODE_PATH_REJECTED, message: "path traversal rejected" }
-    });
-  }
-  const message = err instanceof Error ? err.message : "unknown error";
-  const code = err?.code;
-  if (code === "EPERM" || message.includes("traversal") || message.includes("EPERM")) {
-    return reply.code(403).send({
-      error: { code: ERROR_CODE_PATH_REJECTED, message: "path traversal rejected" }
-    });
-  }
-  if (code === "ENOENT" || message.includes("ENOENT")) {
-    return reply.code(404).send({
-      error: { code: ERROR_CODE_NOT_FOUND, message: `${subject} not found` }
-    });
   }
-  if (code === "EEXIST" || message.includes("EEXIST")) {
-    return reply.code(409).send({
-      error: { code: ERROR_CODE_ALREADY_EXISTS, message: `${subject} already exists` }
-    });
+  const rawOutput = parsed.outputLines.join("\n");
+  const truncation = truncateHead(rawOutput, { maxLines: Number.MAX_SAFE_INTEGER });
+  let output = truncation.content;
+  const details = {};
+  const notices = [];
+  if (parsed.matchLimitReached) {
+    notices.push(
+      `${effectiveLimit} matches limit reached. Use limit=${effectiveLimit * 2} for more, or refine pattern`
+    );
+    details.matchLimitReached = effectiveLimit;
   }
-  return reply.code(500).send({
-    error: { code: ERROR_CODE_INTERNAL, message }
-  });
-}
-function requireStringParam(value, field, reply) {
-  if (typeof value !== "string" || value.length === 0) {
-    reply.code(400).send({
-      error: { code: ERROR_CODE_VALIDATION_ERROR, message: `${field} is required`, field }
-    });
-    return null;
+  if (truncation.truncated || sandboxTruncated) {
+    const effectiveTruncation = truncation.truncated ? truncation : syntheticExecTruncation(output);
+    notices.push(`${formatSize(effectiveTruncation.maxBytes)} limit reached`);
+    details.truncation = effectiveTruncation;
   }
-  if (value.includes("\0")) {
-    reply.code(400).send({
-      error: { code: ERROR_CODE_INVALID_PATH, message: "null bytes not allowed", field }
-    });
-    return null;
+  if (parsed.linesTruncated) {
+    notices.push(
+      `Some lines truncated to ${GREP_MAX_LINE_LENGTH} chars. Use read tool to see full lines`
+    );
+    details.linesTruncated = true;
   }
-  return value;
+  if (notices.length > 0) output += `
+
+[${notices.join(". ")}]`;
+  return {
+    content: [{ type: "text", text: output }],
+    details: Object.keys(details).length > 0 ? details : void 0
+  };
 }
-function parseWorkspaceSettings(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    const dir = parsed?.markdown?.imageUploadDir;
-    return {
-      ...parsed,
-      markdown: {
-        ...parsed.markdown ?? {},
-        imageUploadDir: typeof dir === "string" && dir.trim() ? dir.trim() : DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR
+function vercelGrepTool(sandbox, workspaceRoot) {
+  return {
+    name: PI_GREP_TOOL.name,
+    description: PI_GREP_TOOL.description,
+    promptSnippet: PI_GREP_TOOL.promptSnippet,
+    parameters: PI_GREP_TOOL.parameters,
+    async execute(input, ctx) {
+      const params = input;
+      if (ctx.abortSignal.aborted) {
+        return makeError("grep aborted");
       }
-    };
-  } catch {
-    return defaultWorkspaceSettings();
-  }
+      if (typeof params.pattern !== "string" || params.pattern.length === 0) {
+        return makeError("pattern is required");
+      }
+      if (workspaceRoot && typeof params.path === "string" && params.path.length > 0) {
+        const resolved = resolve6(workspaceRoot, params.path);
+        const rel = relative8(workspaceRoot, resolved);
+        if (rel.startsWith("..") || rel.startsWith("/")) {
+          return makeError(`path "${params.path}" is outside workspace`);
+        }
+      }
+      try {
+        const result = await sandbox.exec(buildRgCommand(params), {
+          signal: ctx.abortSignal,
+          timeoutMs: GREP_TIMEOUT_MS,
+          maxOutputBytes: GREP_MAX_OUTPUT_BYTES
+        });
+        if (result.exitCode !== 0 && result.exitCode !== 1) {
+          const stderr = decode(result.stderr).trim();
+          const message = stderr || `ripgrep exited with code ${result.exitCode}`;
+          return makeError(`grep failed: ${message}`);
+        }
+        const limit = numberParam(params.limit, DEFAULT_LIMIT2);
+        const parsed = parseRgJson(decode(result.stdout), limit);
+        return buildSuccessResult(parsed, limit, result.truncated);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "unknown error";
+        return makeError(`grep failed: ${message}`);
+      }
+    }
+  };
+}
+
+// src/server/tools/filesystem/index.ts
+function isTextContent(content) {
+  return content.type === "text" && typeof content.text === "string";
+}
+function adaptPiTool(piTool) {
+  return {
+    name: piTool.name,
+    description: piTool.description,
+    promptSnippet: piTool.promptSnippet,
+    parameters: piTool.parameters,
+    async execute(params, ctx) {
+      const result = await piTool.execute(
+        ctx.toolCallId,
+        params,
+        ctx.abortSignal,
+        ctx.onUpdate ? (update) => {
+          const text = update.content?.filter(isTextContent).map((c) => c.text).join("");
+          if (text) ctx.onUpdate?.(text);
+        } : void 0,
+        {}
+      );
+      const textContent = (result.content ?? []).filter(isTextContent).map((c) => ({ type: "text", text: c.text }));
+      return {
+        content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
+        isError: false,
+        details: result.details
+      };
+    }
+  };
 }
-async function readWorkspaceSettings(workspace) {
-  try {
-    return parseWorkspaceSettings(await workspace.readFile(BORING_SETTINGS_PATH));
-  } catch (error) {
-    const code = error?.code;
-    if (code === "ENOENT") return defaultWorkspaceSettings();
-    throw error;
+function buildFilesystemAgentTools(bundle) {
+  const cwd = bundle.workspace.root;
+  if (bundle.sandbox.provider === "vercel-sandbox") {
+    return [
+      adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
+      adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
+      adaptPiTool(createEditToolDefinition(cwd, { operations: vercelEditOps(bundle.workspace) })),
+      adaptPiTool(createFindToolDefinition(cwd, { operations: vercelFindOps(bundle.sandbox, bundle.workspace) })),
+      vercelGrepTool(bundle.sandbox, cwd),
+      adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
+    ];
   }
+  const ops = boundFs(cwd);
+  return [
+    adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
+    adaptPiTool(createWriteToolDefinition(cwd, { operations: ops.write })),
+    adaptPiTool(createEditToolDefinition(cwd, { operations: ops.edit })),
+    adaptPiTool(createFindToolDefinition(cwd, { operations: ops.find })),
+    adaptPiTool(createGrepToolDefinition2(cwd, { operations: ops.grep })),
+    adaptPiTool(createLsToolDefinition(cwd, { operations: ops.ls }))
+  ];
 }
-function normalizeUploadDir(value) {
-  if (typeof value !== "string") return null;
-  const dir = value.trim().replace(/^\.\/+/, "").replace(/\/+/g, "/");
-  if (!dir || dir.includes("\0") || dir.startsWith("/") || dir.split("/").includes("..")) return null;
-  return dir.replace(/\/+$/, "");
-}
-function extForUpload(filename, contentType) {
-  const fromName = extname3(filename).toLowerCase().replace(/^\./, "");
-  if (/^[a-z0-9]{1,12}$/.test(fromName)) return fromName;
-  if (contentType === "image/jpeg") return "jpg";
-  if (contentType === "image/png") return "png";
-  if (contentType === "image/gif") return "gif";
-  if (contentType === "image/webp") return "webp";
-  if (contentType === "image/svg+xml") return "svg";
-  return "bin";
+
+// src/server/tools/harness/index.ts
+import {
+  createBashToolDefinition,
+  createLocalBashOperations
+} from "@mariozechner/pi-coding-agent";
+function shellEscape2(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
 }
-function basenameForUpload(filename) {
-  const base = filename.split("/").pop()?.split("\\").pop() ?? "image";
-  const withoutExt = base.replace(/\.[^.]*$/, "");
-  const safe = withoutExt.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
-  return safe || "image";
+function bwrapSpawnHook(workspaceRoot) {
+  const args = buildBwrapArgs(workspaceRoot);
+  const bwrapPrefix = ["bwrap", ...args].map(shellEscape2).join(" ");
+  return (context) => ({
+    ...context,
+    command: `${bwrapPrefix} bash -lc ${shellEscape2(context.command)}`,
+    env: withWorkspacePythonEnv({
+      workspaceRoot,
+      env: context.env,
+      sandboxRoot: "/workspace"
+    })
+  });
 }
-function markdownUrlFor(sourcePath, assetPath) {
-  if (!sourcePath) return assetPath;
-  const fromDir = dirname7(sourcePath.replace(/\\/g, "/"));
-  const rel = relative7(fromDir === "." ? "" : fromDir, assetPath);
-  return rel && !rel.startsWith(".") ? rel : rel || assetPath;
+function directSpawnHook(workspaceRoot) {
+  return (context) => ({
+    ...context,
+    env: withWorkspacePythonEnv({ workspaceRoot, env: context.env })
+  });
 }
-function contentTypeForPath(path4) {
-  switch (extname3(path4).toLowerCase()) {
-    case ".avif":
-      return "image/avif";
-    case ".gif":
-      return "image/gif";
-    case ".jpg":
-    case ".jpeg":
-      return "image/jpeg";
-    case ".png":
-      return "image/png";
-    case ".svg":
-      return "image/svg+xml";
-    case ".webp":
-      return "image/webp";
-    case ".css":
-      return "text/css; charset=utf-8";
-    case ".html":
-    case ".htm":
-      return "text/html; charset=utf-8";
-    case ".js":
-      return "text/javascript; charset=utf-8";
-    case ".mjs":
-      return "text/javascript; charset=utf-8";
-    case ".pdf":
-      return "application/pdf";
+function bashOptionsForMode(bundle) {
+  switch (bundle.sandbox.provider) {
+    case "vercel-sandbox":
+      return { operations: vercelBashOps(bundle.sandbox) };
+    case "bwrap":
+      return {
+        operations: createLocalBashOperations(),
+        spawnHook: bwrapSpawnHook(bundle.workspace.root)
+      };
     default:
-      return "application/octet-stream";
+      return {
+        operations: createLocalBashOperations(),
+        spawnHook: directSpawnHook(bundle.workspace.root)
+      };
   }
 }
-function fileRoutes(app, opts, done) {
-  async function resolveWorkspace(request) {
-    if (opts.getWorkspace) return await opts.getWorkspace(request);
-    if (opts.workspace) return opts.workspace;
-    throw new Error("file route requires workspace or getWorkspace");
-  }
-  app.get("/api/v1/files/raw", async (request, reply) => {
-    const query = request.query;
-    const path4 = requireStringParam(query.path, "path", reply);
-    if (path4 === null) return;
-    try {
-      const workspace = await resolveWorkspace(request);
-      if (!workspace.readBinaryFile) {
-        return reply.code(501).send({
-          error: { code: ERROR_CODE_INTERNAL, message: "workspace does not support binary reads" }
-        });
-      }
-      const stat7 = await workspace.stat(path4);
-      if (stat7.kind !== "file") {
-        return reply.code(400).send({
-          error: { code: ERROR_CODE_VALIDATION_ERROR, message: "path is not a file", field: "path" }
-        });
-      }
-      const bytes = await workspace.readBinaryFile(path4);
-      return reply.header("content-type", contentTypeForPath(path4)).header("content-length", String(bytes.byteLength)).header("cache-control", "no-store").send(Buffer.from(bytes));
-    } catch (err) {
-      return classifyError(err, reply, "file");
-    }
-  });
-  app.get("/api/v1/files", async (request, reply) => {
-    const query = request.query;
-    const path4 = requireStringParam(query.path, "path", reply);
-    if (path4 === null) return;
-    try {
-      const workspace = await resolveWorkspace(request);
-      if (workspace.readFileWithStat) {
-        const { content: content2, stat: stat8 } = await workspace.readFileWithStat(path4);
-        return { content: content2, mtimeMs: stat8.kind === "file" ? stat8.mtimeMs : void 0 };
-      }
-      const content = await workspace.readFile(path4);
-      const stat7 = await workspace.stat(path4);
-      return { content, mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0 };
-    } catch (err) {
-      return classifyError(err, reply, "file");
-    }
-  });
-  app.post("/api/v1/files", async (request, reply) => {
-    const body = request.body;
-    const path4 = requireStringParam(body?.path, "path", reply);
-    if (path4 === null) return;
-    if (typeof body.content !== "string") {
-      return reply.code(400).send({
-        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "content is required", field: "content" }
-      });
+function adaptPiTool2(piTool) {
+  return {
+    name: piTool.name,
+    description: piTool.description,
+    promptSnippet: piTool.promptSnippet,
+    parameters: piTool.parameters,
+    async execute(params, ctx) {
+      const result = await piTool.execute(
+        ctx.toolCallId,
+        params,
+        ctx.abortSignal,
+        ctx.onUpdate ? (update) => {
+          const text = update.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+          ctx.onUpdate(text);
+        } : void 0,
+        {}
+      );
+      const textContent = (result.content ?? []).filter((c) => c.type === "text").map((c) => ({ type: "text", text: c.text }));
+      return {
+        content: textContent.length > 0 ? textContent : [{ type: "text", text: "" }],
+        isError: false,
+        details: result.details
+      };
     }
-    const expectedMtimeMs = typeof body.expectedMtimeMs === "number" ? body.expectedMtimeMs : null;
-    try {
-      const workspace = await resolveWorkspace(request);
-      if (expectedMtimeMs !== null) {
-        try {
-          const current = await workspace.stat(path4);
-          if (current.kind === "file" && current.mtimeMs !== expectedMtimeMs) {
-            return reply.code(409).send({
-              error: {
-                code: ERROR_CODE_CONFLICT,
-                message: "file has been modified since last read",
-                currentMtimeMs: current.mtimeMs,
-                expectedMtimeMs
-              }
-            });
-          }
-        } catch (statErr) {
-          const code = statErr?.code;
-          if (code === "ENOENT") {
-            return reply.code(409).send({
-              error: {
-                code: ERROR_CODE_CONFLICT,
-                message: "file no longer exists",
-                expectedMtimeMs
-              }
-            });
-          }
-          throw statErr;
-        }
+  };
+}
+function createExecuteIsolatedCodeTool(sandbox) {
+  return {
+    name: "execute_isolated_code",
+    description: "Execute code in an isolated sandbox environment.",
+    parameters: {
+      type: "object",
+      properties: {
+        code: { type: "string" },
+        language: { type: "string", enum: ["python", "shell"] },
+        image: { type: "string" },
+        packages: { type: "array", items: { type: "string" } },
+        sandboxId: { type: "string" },
+        vmSize: { type: "string", enum: ["xxs", "xs", "s", "m", "l"] }
+      },
+      required: ["code", "language"],
+      additionalProperties: false
+    },
+    async execute(input) {
+      if (!sandbox.executeIsolatedCode) {
+        return {
+          content: [{ type: "text", text: "isolated-code capability is not available" }],
+          isError: true
+        };
       }
-      if (body.createDirs) {
-        const dir = path4.includes("/") ? path4.slice(0, path4.lastIndexOf("/")) : void 0;
-        if (dir) await workspace.mkdir(dir, { recursive: true });
+      const code = input.code;
+      const language = input.language;
+      if (typeof code !== "string" || code.length === 0) {
+        return { content: [{ type: "text", text: "code is required" }], isError: true };
       }
-      const content = body.content;
-      const stat7 = workspace.writeFileWithStat ? await workspace.writeFileWithStat(path4, content) : await (async () => {
-        await workspace.writeFile(path4, content);
-        return await workspace.stat(path4);
-      })();
-      return { ok: true, mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0 };
-    } catch (err) {
-      return classifyError(err, reply, "file");
-    }
-  });
-  app.post("/api/v1/files/upload", async (request, reply) => {
-    const body = request.body;
-    const filename = requireStringParam(body?.filename, "filename", reply);
-    if (filename === null) return;
-    const contentBase64 = requireStringParam(body?.contentBase64, "contentBase64", reply);
-    if (contentBase64 === null) return;
-    const contentType = typeof body.contentType === "string" ? body.contentType.trim().toLowerCase() : "";
-    if (!contentType.startsWith("image/")) {
-      return reply.code(400).send({
-        error: { code: ERROR_CODE_VALIDATION_ERROR, message: "contentType must be an image/* MIME type", field: "contentType" }
-      });
-    }
-    try {
-      const workspace = await resolveWorkspace(request);
-      const settings = await readWorkspaceSettings(workspace);
-      const dir = normalizeUploadDir(body.directory) ?? normalizeUploadDir(settings.markdown?.imageUploadDir) ?? DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR;
-      const ext = extForUpload(filename, contentType);
-      const base = basenameForUpload(filename);
-      const unique = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-      const path4 = `${dir}/${base}-${unique}.${ext}`;
-      const bytes = Buffer.from(contentBase64, "base64");
-      if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES) {
-        return reply.code(400).send({
-          error: { code: ERROR_CODE_VALIDATION_ERROR, message: `upload must be 1 byte to ${MAX_UPLOAD_BYTES} bytes`, field: "contentBase64" }
+      if (language !== "python" && language !== "shell") {
+        return { content: [{ type: "text", text: "language must be python or shell" }], isError: true };
+      }
+      try {
+        const result = await sandbox.executeIsolatedCode({
+          code,
+          language,
+          image: typeof input.image === "string" ? input.image : void 0,
+          packages: Array.isArray(input.packages) ? input.packages.filter((v) => typeof v === "string") : void 0,
+          sandboxId: typeof input.sandboxId === "string" ? input.sandboxId : void 0,
+          vmSize: input.vmSize === "xxs" || input.vmSize === "xs" || input.vmSize === "s" || input.vmSize === "m" || input.vmSize === "l" ? input.vmSize : void 0
         });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }],
+          isError: result.exitCode !== 0,
+          details: result
+        };
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : "execute_isolated_code failed" }],
+          isError: true
+        };
       }
-      await workspace.mkdir(dir, { recursive: true });
-      const stat7 = workspace.writeBinaryFileWithStat ? await workspace.writeBinaryFileWithStat(path4, bytes) : await (async () => {
-        if (!workspace.writeBinaryFile) {
-          throw new Error("workspace does not support binary uploads");
-        }
-        await workspace.writeBinaryFile(path4, bytes);
-        return await workspace.stat(path4);
-      })();
-      const sourcePath = typeof body.sourcePath === "string" && !body.sourcePath.includes("\0") ? body.sourcePath : null;
-      return {
-        ok: true,
-        path: path4,
-        markdownUrl: markdownUrlFor(sourcePath, path4),
-        mtimeMs: stat7.kind === "file" ? stat7.mtimeMs : void 0
-      };
-    } catch (err) {
-      return classifyError(err, reply, "upload");
-    }
-  });
-  app.get("/api/v1/workspace-settings", async (request, reply) => {
-    try {
-      const workspace = await resolveWorkspace(request);
-      return { settings: await readWorkspaceSettings(workspace) };
-    } catch (err) {
-      return classifyError(err, reply, "settings");
     }
+  };
+}
+function buildHarnessAgentTools(bundle) {
+  const tools = [
+    adaptPiTool2(createBashToolDefinition(bundle.workspace.root, bashOptionsForMode(bundle)))
+  ];
+  if (bundle.sandbox.capabilities.includes("isolated-code")) {
+    tools.push(createExecuteIsolatedCodeTool(bundle.sandbox));
+  }
+  return tools;
+}
+
+// src/server/http/routes/health.ts
+function healthRoutes(app, opts, done) {
+  const startTime = Date.now();
+  app.get("/health", async () => {
+    return {
+      status: "ok",
+      version: opts.version,
+      uptime: Math.floor((Date.now() - startTime) / 1e3)
+    };
   });
-  app.put("/api/v1/workspace-settings", async (request, reply) => {
-    const body = request.body;
-    const incoming = body?.settings ?? body;
-    const markdown = incoming.markdown ?? {};
-    const imageUploadDir = normalizeUploadDir(markdown.imageUploadDir);
-    if (!imageUploadDir) {
-      return reply.code(400).send({
-        error: { code: ERROR_CODE_INVALID_PATH, message: "markdown.imageUploadDir must be a relative workspace path", field: "markdown.imageUploadDir" }
+  app.get("/ready", async (_request, reply) => {
+    const state = opts.getReadiness();
+    if (state.degradedReason) {
+      return reply.code(503).send({
+        status: "degraded",
+        reason: state.degradedReason
       });
     }
-    try {
-      const workspace = await resolveWorkspace(request);
-      const current = await readWorkspaceSettings(workspace);
-      const next = {
-        ...current,
-        markdown: {
-          ...current.markdown ?? {},
-          imageUploadDir
-        }
-      };
-      await workspace.mkdir(".boring", { recursive: true });
-      await workspace.writeFile(BORING_SETTINGS_PATH, `${JSON.stringify(next, null, 2)}
-`);
-      return { settings: next };
-    } catch (err) {
-      return classifyError(err, reply, "settings");
-    }
-  });
-  app.delete("/api/v1/files", async (request, reply) => {
-    const query = request.query;
-    const path4 = requireStringParam(query.path, "path", reply);
-    if (path4 === null) return;
-    try {
-      const workspace = await resolveWorkspace(request);
-      await workspace.unlink(path4);
-      return { ok: true };
-    } catch (err) {
-      return classifyError(err, reply, "file");
-    }
-  });
-  app.post("/api/v1/files/move", async (request, reply) => {
-    const body = request.body;
-    const from = requireStringParam(body?.from, "from", reply);
-    if (from === null) return;
-    const to = requireStringParam(body?.to, "to", reply);
-    if (to === null) return;
-    try {
-      const workspace = await resolveWorkspace(request);
-      await workspace.rename(from, to);
-      return { ok: true };
-    } catch (err) {
-      return classifyError(err, reply, "file");
-    }
-  });
-  app.post("/api/v1/dirs", async (request, reply) => {
-    const body = request.body;
-    const path4 = requireStringParam(body?.path, "path", reply);
-    if (path4 === null) return;
-    const recursive = body.recursive === true;
-    try {
-      const workspace = await resolveWorkspace(request);
-      await workspace.mkdir(path4, { recursive });
-      return { ok: true };
-    } catch (err) {
-      return classifyError(err, reply, "directory");
-    }
-  });
-  app.get("/api/v1/stat", async (request, reply) => {
-    const query = request.query;
-    const path4 = requireStringParam(query.path, "path", reply);
-    if (path4 === null) return;
-    try {
-      const workspace = await resolveWorkspace(request);
-      const stat7 = await workspace.stat(path4);
-      return stat7;
-    } catch (err) {
-      return classifyError(err, reply, "path");
+    if (!state.sandboxReady || !state.harnessReady) {
+      return reply.code(503).send({
+        status: "provisioning",
+        retryAfter: 2
+      });
     }
+    return { status: "ready" };
   });
   done();
 }
@@ -6027,6 +6324,60 @@ function parseFileChangeChunk(chunk2) {
   return change;
 }
 
+// src/server/harness/pi-coding-agent/projectPiDataMessages.ts
+function projectPiDataMessages(messages) {
+  const dataParts = messages.flatMap((message) => message.parts ?? []).filter((part) => {
+    const type = part.type;
+    return typeof type === "string" && type.startsWith("data-pi-");
+  });
+  if (dataParts.length === 0) return messages;
+  const projected = [];
+  const ensureMessage = (id, role, text = "") => {
+    let msg = projected.find((item) => item.id === id);
+    if (!msg) {
+      msg = { id, role, parts: text ? [{ type: "text", text }] : [] };
+      projected.push(msg);
+    } else if (text && !(msg.parts ?? []).some((part) => part.type === "text" && part.text)) {
+      msg.parts = [...msg.parts ?? [], { type: "text", text }];
+    }
+    return msg;
+  };
+  for (const part of dataParts) {
+    const data = part.data ?? {};
+    const messageId = typeof data.messageId === "string" ? data.messageId : void 0;
+    if (!messageId) continue;
+    if (part.type === "data-pi-message-start" && (data.role === "user" || data.role === "assistant")) {
+      ensureMessage(messageId, data.role, typeof data.text === "string" ? data.text : "");
+    } else if (part.type === "data-pi-text-start") {
+      const msg = ensureMessage(messageId, "assistant");
+      if (!msg.parts?.some((p) => p.type === "text")) msg.parts = [...msg.parts ?? [], { type: "text", text: "" }];
+    } else if (part.type === "data-pi-text-delta") {
+      const msg = ensureMessage(messageId, "assistant");
+      const delta = typeof data.delta === "string" ? data.delta : "";
+      const index = (msg.parts ?? []).findIndex((p) => p.type === "text");
+      if (index >= 0) {
+        msg.parts = (msg.parts ?? []).map((p, i) => i === index && p.type === "text" ? { ...p, text: `${p.text}${delta}` } : p);
+      } else {
+        msg.parts = [...msg.parts ?? [], { type: "text", text: delta }];
+      }
+    } else if (part.type === "data-pi-text-end" || part.type === "data-pi-message-end" && data.role === "assistant") {
+      const msg = ensureMessage(messageId, "assistant");
+      const text = typeof data.text === "string" ? data.text : "";
+      if (text && !(msg.parts ?? []).some((p) => p.type === "text" && p.text)) msg.parts = [...msg.parts ?? [], { type: "text", text }];
+    }
+  }
+  if (projected.length === 0) return messages;
+  const projectedIds = new Set(projected.map((message) => message.id));
+  const preserved = messages.filter((message) => {
+    if (projectedIds.has(message.id)) return false;
+    return !(message.parts ?? []).some((part) => {
+      const type = part.type;
+      return typeof type === "string" && type.startsWith("data-pi-");
+    });
+  });
+  return [...preserved, ...projected];
+}
+
 // src/server/http/routes/chat.ts
 var chatBodySchema = z.object({
   sessionId: z.string().min(1).max(128),
@@ -6052,6 +6403,35 @@ function chatRoutes(app, opts, done) {
   const { sessionChangesTracker } = opts;
   const validateBody = createBodyValidator(chatBodySchema);
   const buffers = new StreamBufferStore();
+  const lastFollowUpBySession = /* @__PURE__ */ new Map();
+  const cancelledFollowUpsBySession = /* @__PURE__ */ new Map();
+  const MAX_FOLLOWUP_CACHE = 5e3;
+  function followUpCancelKeys(clientNonce, clientSeq) {
+    return [
+      clientNonce ? `nonce:${clientNonce}` : void 0,
+      clientSeq !== void 0 ? `seq:${clientSeq}` : void 0
+    ].filter((key) => Boolean(key));
+  }
+  function isFollowUpCancelled(sessionId, clientNonce, clientSeq) {
+    const cancelled = cancelledFollowUpsBySession.get(sessionId);
+    if (!cancelled) return false;
+    return followUpCancelKeys(clientNonce, clientSeq).some((key) => cancelled.has(key));
+  }
+  function markFollowUpCancelled(sessionId, clientNonce, clientSeq) {
+    const keys = followUpCancelKeys(clientNonce, clientSeq);
+    if (keys.length === 0) return;
+    const cancelled = cancelledFollowUpsBySession.get(sessionId) ?? /* @__PURE__ */ new Set();
+    for (const key of keys) cancelled.add(key);
+    cancelledFollowUpsBySession.set(sessionId, cancelled);
+  }
+  function evictFollowupCache() {
+    const keys = Array.from(/* @__PURE__ */ new Set([...lastFollowUpBySession.keys(), ...cancelledFollowUpsBySession.keys()]));
+    if (keys.length <= MAX_FOLLOWUP_CACHE) return;
+    for (let i = 0; i < keys.length - MAX_FOLLOWUP_CACHE; i++) {
+      lastFollowUpBySession.delete(keys[i]);
+      cancelledFollowUpsBySession.delete(keys[i]);
+    }
+  }
   async function resolveRuntime(request) {
     if (opts.getRuntime) return await opts.getRuntime(request);
     if (opts.harness && opts.workdir) {
@@ -6230,13 +6610,49 @@ function chatRoutes(app, opts, done) {
           error: { code: ERROR_CODE_VALIDATION_ERROR, message: "attachments is invalid" }
         });
       }
+      const clientSeq = typeof body.clientSeq === "number" && Number.isFinite(body.clientSeq) ? body.clientSeq : void 0;
+      const clientNonce = typeof body.clientNonce === "string" && body.clientNonce.length > 0 ? body.clientNonce : void 0;
+      if (isFollowUpCancelled(sessionId, clientNonce, clientSeq)) {
+        return reply.code(202).send({ queued: false, deleted: true });
+      }
+      if (clientSeq !== void 0) {
+        const last = lastFollowUpBySession.get(sessionId);
+        if (last !== void 0 && clientSeq <= last.seq) {
+          if (clientSeq === last.seq && clientNonce && clientNonce === last.nonce) {
+            return reply.code(202).send({ queued: true, duplicate: true });
+          }
+          return reply.code(409).send({
+            error: { code: ERROR_CODE_CONFLICT, message: "followup_out_of_order" }
+          });
+        }
+      }
       const runtime = await resolveRuntime(request);
-      await runtime.harness.followUp?.(
-        sessionId,
-        body.message,
-        parsedAttachments.data,
-        typeof body.displayText === "string" && body.displayText.length > 0 ? body.displayText : body.message
-      );
+      if (!runtime.harness.followUp) {
+        return reply.code(409).send({
+          error: { code: ERROR_CODE_CONFLICT, message: "followup_unsupported" }
+        });
+      }
+      try {
+        await runtime.harness.followUp(
+          sessionId,
+          body.message,
+          parsedAttachments.data,
+          typeof body.displayText === "string" && body.displayText.length > 0 ? body.displayText : body.message,
+          { clientNonce, clientSeq }
+        );
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message === "followup_session_not_ready") {
+          return reply.code(409).send({
+            error: { code: ERROR_CODE_CONFLICT, message: "followup_session_not_ready" }
+          });
+        }
+        throw err;
+      }
+      if (clientSeq !== void 0) {
+        lastFollowUpBySession.set(sessionId, { seq: clientSeq, nonce: clientNonce });
+        evictFollowupCache();
+      }
       return reply.code(202).send({ queued: true });
     }
   );
@@ -6244,8 +6660,14 @@ function chatRoutes(app, opts, done) {
     "/api/v1/agent/chat/:sessionId/followup",
     async (request, reply) => {
       const { sessionId } = request.params;
+      const query = request.query;
+      const clientNonce = typeof query.clientNonce === "string" && query.clientNonce.length > 0 ? query.clientNonce : void 0;
+      const rawClientSeq = typeof query.clientSeq === "string" ? Number(query.clientSeq) : query.clientSeq;
+      const clientSeq = typeof rawClientSeq === "number" && Number.isFinite(rawClientSeq) ? rawClientSeq : void 0;
       const runtime = await resolveRuntime(request);
-      runtime.harness.clearFollowUp?.(sessionId);
+      markFollowUpCancelled(sessionId, clientNonce, clientSeq);
+      evictFollowupCache();
+      runtime.harness.clearFollowUp?.(sessionId, { clientNonce, clientSeq });
       return reply.code(204).send();
     }
   );
@@ -6263,7 +6685,7 @@ function chatRoutes(app, opts, done) {
       try {
         const runtime = await resolveRuntime(request);
         if (runtime.harness.sessions.saveMessages) {
-          await runtime.harness.sessions.saveMessages(ctx, sessionId, body.messages);
+          await runtime.harness.sessions.saveMessages(ctx, sessionId, projectPiDataMessages(body.messages));
         }
         return reply.code(204).send();
       } catch {
@@ -6318,7 +6740,7 @@ function modelsRoutes(app, _opts, done) {
       return a.id.localeCompare(b.id);
     });
     const configuredDefaultModel = readConfiguredDefaultModel();
-    const defaultModel = configuredDefaultModel && models.some((m) => m.available && m.provider === configuredDefaultModel.provider && m.id === configuredDefaultModel.id) ? configuredDefaultModel : models.find((m) => m.available);
+    const defaultModel = configuredDefaultModel && models.some((m) => m.available && m.provider === configuredDefaultModel.provider && m.id === configuredDefaultModel.id) ? configuredDefaultModel : void 0;
     const payload = defaultModel ? { models, defaultModel: { provider: defaultModel.provider, id: defaultModel.id } } : { models };
     return reply.code(200).send(payload);
   });
@@ -6326,26 +6748,55 @@ function modelsRoutes(app, _opts, done) {
 }
 
 // src/server/http/routes/skills.ts
-import { loadSkills as loadSkills2 } from "@mariozechner/pi-coding-agent";
+import {
+  DefaultPackageManager,
+  getAgentDir as getAgentDir3,
+  loadSkills
+} from "@mariozechner/pi-coding-agent";
 var CACHE_TTL_MS2 = 3e4;
 function skillsRoutes(app, opts, done) {
-  let cached = null;
-  app.get("/api/v1/agent/skills", (_request, reply) => {
-    const now = Date.now();
-    if (cached && cached.expiresAt > now) {
-      return reply.code(200).send({ skills: cached.skills });
-    }
+  const cached = /* @__PURE__ */ new Map();
+  app.get("/api/v1/agent/skills", async (request, reply) => {
     try {
-      const result = loadSkills2({
-        cwd: opts.workspaceRoot,
-        skillPaths: opts.additionalSkillPaths ?? [],
-        includeDefaults: true
+      const workspaceRoot = opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(request) : opts.workspaceRoot;
+      const additionalSkillPaths = opts.getAdditionalSkillPaths ? await opts.getAdditionalSkillPaths(request) : opts.additionalSkillPaths;
+      const piPackages = opts.getPiPackages ? await opts.getPiPackages(request) : opts.piPackages;
+      const noSkills = opts.getNoSkills ? await opts.getNoSkills(request) : opts.noSkills;
+      const cacheKey = JSON.stringify([workspaceRoot, additionalSkillPaths ?? [], piPackages ?? [], Boolean(noSkills)]);
+      const now = Date.now();
+      for (const [key, entry] of cached) {
+        if (entry.expiresAt <= now) cached.delete(key);
+      }
+      const cachedEntry = cached.get(cacheKey);
+      if (cachedEntry && cachedEntry.expiresAt > now) {
+        return reply.code(200).send({ skills: cachedEntry.skills });
+      }
+      const agentDir = getAgentDir3();
+      const packageSkillPaths = noSkills ? [] : await (async () => {
+        const settingsManager = createResourceSettingsManager(
+          workspaceRoot,
+          agentDir,
+          piPackages ?? []
+        );
+        const packageManager = new DefaultPackageManager({
+          cwd: workspaceRoot,
+          agentDir,
+          settingsManager
+        });
+        const resolved = await packageManager.resolve();
+        return resolved.skills.filter((resource) => resource.enabled).map((resource) => resource.path);
+      })();
+      const result = loadSkills({
+        cwd: workspaceRoot,
+        agentDir,
+        skillPaths: [...packageSkillPaths, ...additionalSkillPaths ?? []],
+        includeDefaults: false
       });
       const skills = result.skills.map((s) => ({
         name: s.name,
         description: s.description
       }));
-      cached = { skills, expiresAt: now + CACHE_TTL_MS2 };
+      cached.set(cacheKey, { skills, expiresAt: now + CACHE_TTL_MS2 });
       return reply.code(200).send({ skills });
     } catch {
       return reply.code(200).send({ skills: [] });
@@ -6998,14 +7449,15 @@ async function createAgentApp(opts = {}) {
   const sessionId = opts.sessionId ?? DEFAULT_SESSION_ID;
   const templatePath = opts.templatePath ?? getEnv("BORING_AGENT_TEMPLATE_PATH");
   const app = Fastify({ logger: opts.logger ?? true, bodyLimit: 16 * 1024 * 1024 });
-  const resolvedMode = opts.mode ?? autoDetectMode();
-  const runtimeBundle = await resolveMode(resolvedMode).create({
+  const resolvedMode = opts.runtimeModeAdapter?.id ?? opts.mode ?? autoDetectMode();
+  const modeAdapter = opts.runtimeModeAdapter ?? resolveMode(resolvedMode);
+  const runtimeBundle = await modeAdapter.create({
     workspaceRoot,
     sessionId,
     templatePath
   });
   const pluginTools = [];
-  if (resolvedMode !== "vercel-sandbox") {
+  if (modeAdapter.workspaceFsCapability === "strong") {
     const pluginResult = await loadPlugins({ cwd: workspaceRoot });
     if (pluginResult.errors.length > 0) {
       for (const e of pluginResult.errors) {
@@ -7025,12 +7477,10 @@ async function createAgentApp(opts = {}) {
   const harness = createPiCodingAgentHarness({
     tools,
     cwd: workspaceRoot,
+    sessionNamespace: opts.sessionNamespace,
+    sessionDir: opts.sessionDir,
     systemPromptAppend: opts.systemPromptAppend,
-    resourceLoaderOptions: {
-      noContextFiles: true,
-      noSkills: true,
-      ...opts.resourceLoaderOptions
-    }
+    resourceLoaderOptions: opts.resourceLoaderOptions
   });
   const sessionChangesTracker = new InMemorySessionChangesTracker();
   const readyTracker = new ReadyStatusTracker({
@@ -7116,6 +7566,11 @@ function mergeTools(options) {
     setLastRegistered(merged, tool);
   }
   for (const tool of options.extraTools ?? []) {
+    if (merged.has(tool.name)) {
+      options.logger?.warn(
+        `[catalog] Tool "${tool.name}" overridden by extraTools`
+      );
+    }
     setLastRegistered(merged, tool);
   }
   for (const plugin of options.pluginTools ?? []) {
@@ -7271,7 +7726,7 @@ function getRequestWorkspaceId(request) {
 }
 function isWorkspaceAgnosticAgentRequest(request) {
   const pathname = request.url.split("?")[0] ?? request.url;
-  return pathname === "/api/v1/agent/models" || pathname === "/api/v1/agent/skills" || pathname === "/api/v1/ready-status";
+  return pathname === "/health" || pathname === "/ready" || pathname === "/api/v1/agent/models" || pathname === "/api/v1/ready-status";
 }
 function extractHttpStatus2(error) {
   const statusCode = error?.statusCode;
@@ -7281,6 +7736,11 @@ function extractHttpStatus2(error) {
   const responseStatus = error?.response?.status;
   return typeof responseStatus === "number" ? responseStatus : null;
 }
+function normalizeSessionNamespace(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
 function isExpiredSandboxRuntimeError(error) {
   const code = error?.code;
   if (code === ErrorCode.enum.SANDBOX_EXPIRED) return true;
@@ -7293,28 +7753,54 @@ var registerAgentRoutes = async (app, opts) => {
   const workspaceRoot = opts.workspaceRoot ?? process.cwd();
   const sessionId = opts.sessionId ?? DEFAULT_WORKSPACE_ID3;
   const templatePath = opts.templatePath ?? getEnv("BORING_AGENT_TEMPLATE_PATH");
-  const resolvedMode = opts.mode ?? autoDetectMode();
-  const modeAdapter = selectRuntimeModeAdapter(resolvedMode, opts.sandboxHandleStore);
+  const resolvedMode = opts.runtimeModeAdapter?.id ?? opts.mode ?? autoDetectMode();
+  const modeAdapter = opts.runtimeModeAdapter ?? selectRuntimeModeAdapter(resolvedMode, opts.sandboxHandleStore);
   app.addHook("onClose", async () => {
     await modeAdapter.dispose?.();
   });
-  const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function";
+  const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function" || typeof opts.getTemplatePath === "function" || typeof opts.getResourceLoaderOptions === "function" || typeof opts.getSessionNamespace === "function";
   const sessionChangesTracker = new InMemorySessionChangesTracker();
   const runtimeBindings = /* @__PURE__ */ new Map();
+  const MAX_RUNTIME_BINDINGS = 256;
+  function evictRuntimeBindings() {
+    if (runtimeBindings.size <= MAX_RUNTIME_BINDINGS) return;
+    const keys = Array.from(runtimeBindings.keys());
+    for (let i = 0; i < keys.length - MAX_RUNTIME_BINDINGS; i++) {
+      runtimeBindings.delete(keys[i]);
+    }
+  }
   async function resolveRuntimeScope(workspaceId, request) {
     const root = request && opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(workspaceId, request) : workspaceRoot;
+    const scopedTemplatePath = opts.getTemplatePath ? await opts.getTemplatePath({ workspaceId, workspaceRoot: root, request }) : templatePath;
+    const resourceLoaderOptions = opts.getResourceLoaderOptions ? await opts.getResourceLoaderOptions({ workspaceId, workspaceRoot: root, request }) : opts.resourceLoaderOptions;
+    const sessionNamespace = normalizeSessionNamespace(opts.getSessionNamespace ? await opts.getSessionNamespace({ workspaceId, workspaceRoot: root, request }) : opts.sessionNamespace);
     return {
       root,
-      key: `${resolvedMode}:${workspaceId}:${root}`
+      templatePath: scopedTemplatePath,
+      resourceLoaderOptions,
+      sessionNamespace,
+      key: JSON.stringify([
+        resolvedMode,
+        workspaceId,
+        root,
+        scopedTemplatePath ?? null,
+        resourceLoaderOptions ?? null,
+        sessionNamespace ?? null
+      ])
     };
   }
-  async function createRuntimeBinding(workspaceId, root, request) {
-    const scopedTemplatePath = opts.getTemplatePath ? await opts.getTemplatePath({ workspaceId, workspaceRoot: root, request }) : templatePath;
+  async function resolveSkillScope(workspaceId, request) {
+    const root = request && opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(workspaceId, request) : workspaceRoot;
+    const resourceLoaderOptions = opts.getResourceLoaderOptions ? await opts.getResourceLoaderOptions({ workspaceId, workspaceRoot: root, request }) : opts.resourceLoaderOptions;
+    return { root, resourceLoaderOptions };
+  }
+  async function createRuntimeBinding(workspaceId, scope, request) {
+    const root = scope.root;
     const runtimeBundle = await modeAdapter.create({
       workspaceRoot: root,
       sessionId: workspaceId,
       workspaceId,
-      templatePath: scopedTemplatePath
+      templatePath: scope.templatePath
     });
     const standardTools = [
       ...buildHarnessAgentTools(runtimeBundle),
@@ -7322,7 +7808,7 @@ var registerAgentRoutes = async (app, opts) => {
       ...buildUploadAgentTools(runtimeBundle)
     ];
     const pluginTools = [];
-    if (resolvedMode !== "vercel-sandbox") {
+    if (modeAdapter.workspaceFsCapability === "strong") {
       const pluginResult = await loadPlugins({ cwd: root });
       if (pluginResult.errors.length > 0) {
         for (const e of pluginResult.errors) {
@@ -7339,7 +7825,8 @@ var registerAgentRoutes = async (app, opts) => {
     const scopedExtraTools = opts.getExtraTools ? await opts.getExtraTools({
       workspaceId,
       workspaceRoot: root,
-      runtimeMode: resolvedMode
+      runtimeMode: resolvedMode,
+      workspaceFsCapability: runtimeBundle.workspace.fsCapability
     }) : [];
     const tools = mergeTools({
       standardTools,
@@ -7353,12 +7840,9 @@ var registerAgentRoutes = async (app, opts) => {
     const harness = createPiCodingAgentHarness({
       tools,
       cwd: root,
+      sessionNamespace: scope.sessionNamespace,
       systemPromptAppend: opts.systemPromptAppend,
-      resourceLoaderOptions: {
-        noContextFiles: true,
-        noSkills: true,
-        ...opts.resourceLoaderOptions
-      }
+      resourceLoaderOptions: scope.resourceLoaderOptions
     });
     const readyTracker = new ReadyStatusTracker({
       sandboxReady: resolvedMode !== "vercel-sandbox",
@@ -7384,8 +7868,9 @@ var registerAgentRoutes = async (app, opts) => {
         await existing
       );
     }
-    const created = createRuntimeBinding(workspaceId, scope.root, request);
+    const created = createRuntimeBinding(workspaceId, scope, request);
     runtimeBindings.set(scope.key, created);
+    evictRuntimeBindings();
     try {
       return await ensureRuntimeBindingReady(
         workspaceId,
@@ -7400,8 +7885,9 @@ var registerAgentRoutes = async (app, opts) => {
   async function recreateRuntimeBinding(workspaceId, scope) {
     runtimeBindings.delete(scope.key);
     evictSandboxHandleCacheForWorkspace(workspaceId);
-    const created = createRuntimeBinding(workspaceId, scope.root);
+    const created = createRuntimeBinding(workspaceId, scope);
     runtimeBindings.set(scope.key, created);
+    evictRuntimeBindings();
     try {
       const binding = await created;
       binding.lastHealthCheckMs = Date.now();
@@ -7431,6 +7917,15 @@ var registerAgentRoutes = async (app, opts) => {
     }
   }
   const staticBinding = requestScopedRuntime ? null : await getOrCreateRuntimeBinding(sessionId);
+  const skillsScopeByRequest = /* @__PURE__ */ new WeakMap();
+  function getSkillsScopeForRequest(request) {
+    let promise = skillsScopeByRequest.get(request);
+    if (!promise) {
+      promise = resolveSkillScope(getRequestWorkspaceId(request), request);
+      skillsScopeByRequest.set(request, promise);
+    }
+    return promise;
+  }
   async function getBindingForRequest(request) {
     if (staticBinding) return staticBinding;
     return await getOrCreateRuntimeBinding(getRequestWorkspaceId(request), request);
@@ -7530,7 +8025,13 @@ var registerAgentRoutes = async (app, opts) => {
   await app.register(modelsRoutes);
   await app.register(skillsRoutes, {
     workspaceRoot,
-    additionalSkillPaths: opts.resourceLoaderOptions?.additionalSkillPaths
+    additionalSkillPaths: opts.resourceLoaderOptions?.additionalSkillPaths,
+    piPackages: opts.resourceLoaderOptions?.piPackages,
+    noSkills: opts.resourceLoaderOptions?.noSkills,
+    getWorkspaceRoot: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).root,
+    getAdditionalSkillPaths: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).resourceLoaderOptions?.additionalSkillPaths,
+    getPiPackages: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).resourceLoaderOptions?.piPackages,
+    getNoSkills: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).resourceLoaderOptions?.noSkills
   });
   await app.register(sessionChangesRoutes, { tracker: sessionChangesTracker });
   await app.register(
@@ -7563,6 +8064,7 @@ export {
   createNodeWorkspace,
   createVercelDeploymentSnapshotProvider,
   createVercelSandboxWorkspace,
+  fileRoutes,
   hasBwrap,
   mergePiPackageSources,
   piPackageSourceKey,