@hachej/boring-agent 0.1.41 → 0.1.43

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   StopPayloadSchema,
   extractToolUiMetadata,
   sanitizeToolUiMetadata2 as sanitizeToolUiMetadata
-} from "../chunk-VQ7VSSSX.js";
+} from "../chunk-YUDMSYAO.js";
 
 // src/server/sandbox/direct/createDirectSandbox.ts
 import { spawn } from "child_process";
@@ -257,7 +257,7 @@ function createDirectSandbox(opts = {}) {
 import { access, stat as stat3 } from "fs/promises";
 import { constants } from "fs";
 import { spawn as spawn2 } from "child_process";
-import { dirname as dirname4, isAbsolute as isAbsolute3, join as join2, posix, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join3, posix, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
 
 // src/server/sandbox/bwrap/buildBwrapArgs.ts
 import { isAbsolute } from "path";
@@ -305,10 +305,13 @@ function validateWorkspaceRoot(workspaceRoot) {
 }
 function buildBwrapArgs(workspaceRoot, options) {
   validateWorkspaceRoot(workspaceRoot);
+  const network = options?.network ?? "shared";
   const args = [
     "--unshare-all",
-    "--share-net",
+    ...network === "shared" ? ["--share-net"] : [],
     "--die-with-parent",
+    ...options?.newSession === false ? [] : ["--new-session"],
+    ...options?.dropAllCapabilities ? ["--cap-drop", "ALL"] : [],
     "--tmpfs",
     "/",
     "--proc",
@@ -345,9 +348,8 @@ function buildBwrapArgs(workspaceRoot, options) {
 }
 
 // src/server/workspace/createNodeWorkspace.ts
-import { lstat as lstat2, mkdir, readdir, readFile, rename, rm, stat as stat2, unlink, writeFile } from "fs/promises";
-import { dirname as dirname3, relative as relative2, resolve as resolve3, sep } from "path";
-import chokidar from "chokidar";
+import { lstat as lstat2, mkdir, readdir as readdir2, readFile, rename, rm, stat as stat2, unlink, writeFile } from "fs/promises";
+import { dirname as dirname3, resolve as resolve3 } from "path";
 
 // src/server/workspace/paths.ts
 import { lstat, realpath, stat } from "fs/promises";
@@ -428,6 +430,11 @@ async function ensureWritableWorkspacePath(workspaceRoot, relPath) {
   return absPath;
 }
 
+// src/server/workspace/nodeWatcher.ts
+import { readdir } from "fs/promises";
+import { join as join2, relative as relative2, sep } from "path";
+import chokidar from "chokidar";
+
 // src/server/workspace/ignore.ts
 var DEFAULT_IGNORED_DIR_NAMES = [
   "node_modules",
@@ -446,19 +453,136 @@ function isIgnoredDirName(name) {
   return IGNORED_SET.has(name) || name.endsWith(".tsbuildinfo");
 }
 
-// src/server/workspace/createNodeWorkspace.ts
-var EPERM_CODE = "EPERM";
+// src/server/logging.ts
+var SENSITIVE_KEYS = new Set([
+  "apiKey",
+  "api_key",
+  "token",
+  "secret",
+  "password",
+  "authorization",
+  "cookie",
+  "oidcToken",
+  "accessToken",
+  "refreshToken",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "VERCEL_OIDC_TOKEN",
+  "VERCEL_TEAM_ID"
+].map((key) => key.toLowerCase()));
+function isSensitiveKey(key) {
+  return SENSITIVE_KEYS.has(key.toLowerCase());
+}
+function redactValue(key, value, seen) {
+  if (key && isSensitiveKey(key) && value != null) return "***";
+  if (value == null || typeof value !== "object") return value;
+  if (value instanceof Date) return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const out2 = value.map((item) => redactValue(void 0, item, seen));
+    seen.delete(value);
+    return out2;
+  }
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactValue(childKey, childValue, seen);
+  }
+  seen.delete(value);
+  return out;
+}
+function redact(fields) {
+  const out = {};
+  const seen = /* @__PURE__ */ new WeakSet();
+  for (const [k, v] of Object.entries(fields)) {
+    out[k] = redactValue(k, v, seen);
+  }
+  return out;
+}
+var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
+function createLogger(prefix) {
+  function emit(level, msg, fields) {
+    const entry = {
+      level,
+      prefix,
+      msg,
+      ...fields ? redact(fields) : {},
+      t: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (level === "error") {
+      console.error(JSON.stringify(entry));
+    } else if (level === "warn") {
+      console.warn(JSON.stringify(entry));
+    } else {
+      console.log(JSON.stringify(entry));
+    }
+  }
+  return {
+    debug(msg, fields) {
+      if (verbose) emit("debug", msg, fields);
+    },
+    info(msg, fields) {
+      emit("info", msg, fields);
+    },
+    warn(msg, fields) {
+      emit("warn", msg, fields);
+    },
+    error(msg, fields) {
+      emit("error", msg, fields);
+    }
+  };
+}
+
+// src/server/workspace/nodeWatcher.ts
+var log = createLogger("workspace-watch");
 function shouldIgnoreWatchPath(root, path4) {
   const relPath = relative2(root, path4);
   const parts = relPath.split(sep);
   return parts.some((part) => isIgnoredDirName(part));
 }
+function toPosixRel(root, absPath) {
+  return relative2(root, absPath).split(sep).join("/");
+}
+var RENAME_ECHO_IDLE_MS = 1e3;
+var RENAME_ECHO_MAX_MS = 3e4;
+var RENAME_ECHO_FROM_KINDS = /* @__PURE__ */ new Set(["unlink", "unlinkDir"]);
+var RENAME_ECHO_TO_KINDS = /* @__PURE__ */ new Set(["add", "addDir"]);
+var DEFAULT_MAX_WATCHED_ENTRIES = 5e4;
+function maxWatchedEntries() {
+  const raw = getEnv("BORING_MAX_WATCHED_ENTRIES");
+  if (!raw) return DEFAULT_MAX_WATCHED_ENTRIES;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_MAX_WATCHED_ENTRIES;
+}
+async function countWatchableEntries(root, cap) {
+  let count = 0;
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      count += 1;
+      if (count > cap) return count;
+      if (entry.isDirectory() && !isIgnoredDirName(entry.name)) {
+        stack.push(join2(dir, entry.name));
+      }
+    }
+  }
+  return count;
+}
 function createNodeWatcher(root) {
   const listeners = /* @__PURE__ */ new Set();
+  const suppressions = [];
   let fsw = null;
   let closed = false;
-  const ensureFsw = () => {
-    if (fsw) return fsw;
+  let readiness = null;
+  const startFsw = () => {
+    if (fsw || closed) return;
     fsw = chokidar.watch(root, {
       ignored: (path4) => shouldIgnoreWatchPath(root, path4),
       ignoreInitial: true,
@@ -468,23 +592,43 @@ function createNodeWatcher(root) {
       // servers. Consumers already reconcile by mtime after invalidation.
       // No native renames from chokidar — `unlinkDir`/`addDir`/
       // `unlink`/`add` are the primitives we get. We surface them as
-      // separate `unlink` + `write`/`mkdir` events; renames are best
-      // recovered at the consumer level if needed.
+      // separate `unlink` + `write`/`mkdir` events. Renames the host
+      // performs itself arrive via `emitRename` instead, which also
+      // mutes this echo.
     });
-    fsw.on("add", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
-    fsw.on("change", (p, s) => emit({ op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
-    fsw.on("addDir", (p) => emit({ op: "mkdir", path: rel(p) }));
-    fsw.on("unlink", (p) => emit({ op: "unlink", path: rel(p) }));
-    fsw.on("unlinkDir", (p) => emit({ op: "unlink", path: rel(p) }));
-    fsw.on("error", () => {
+    fsw.on("add", (p, s) => emit("add", { op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
+    fsw.on("change", (p, s) => emit("change", { op: "write", path: rel(p), mtimeMs: s?.mtimeMs }));
+    fsw.on("addDir", (p) => emit("addDir", { op: "mkdir", path: rel(p) }));
+    fsw.on("unlink", (p) => emit("unlink", { op: "unlink", path: rel(p) }));
+    fsw.on("unlinkDir", (p) => emit("unlinkDir", { op: "unlink", path: rel(p) }));
+    let loggedError = false;
+    fsw.on("error", (err) => {
+      if (loggedError) return;
+      loggedError = true;
+      log.error("file watcher error \u2014 live file events may be incomplete", {
+        root,
+        error: err instanceof Error ? err.message : String(err)
+      });
     });
-    return fsw;
   };
-  const rel = (abs) => {
-    const r = relative2(root, abs);
-    return r.split(sep).join("/");
+  const ensureFsw = () => {
+    if (readiness) return readiness;
+    readiness = (async () => {
+      const cap = maxWatchedEntries();
+      const count = await countWatchableEntries(root, cap);
+      if (closed) return { ok: false, reason: "closed" };
+      if (count > cap) {
+        const message = `workspace at ${root} has more than ${cap} entries \u2014 file watching disabled. Start boring-ui in a smaller subfolder for live file updates, or raise BORING_MAX_WATCHED_ENTRIES.`;
+        log.error(message, { root, cap });
+        return { ok: false, reason: "workspace_too_large", message };
+      }
+      startFsw();
+      return { ok: true };
+    })();
+    return readiness;
   };
-  const emit = (event) => {
+  const rel = (abs) => toPosixRel(root, abs);
+  const fanout = (event) => {
     if (closed) return;
     if (event.path === "" || event.path.startsWith("..")) return;
     for (const l of [...listeners]) {
@@ -494,26 +638,67 @@ function createNodeWatcher(root) {
       }
     }
   };
+  const isSuppressedEcho = (kind, path4) => {
+    const now = Date.now();
+    for (let i = suppressions.length - 1; i >= 0; i--) {
+      const s = suppressions[i];
+      if (now > s.idleDeadline || now > s.hardDeadline) {
+        suppressions.splice(i, 1);
+        continue;
+      }
+      if (s.kinds.has(kind) && (path4 === s.prefix || path4.startsWith(`${s.prefix}/`))) {
+        s.idleDeadline = Math.min(now + RENAME_ECHO_IDLE_MS, s.hardDeadline);
+        return true;
+      }
+    }
+    return false;
+  };
+  const emit = (kind, event) => {
+    if (isSuppressedEcho(kind, event.path)) return;
+    fanout(event);
+  };
   return {
     subscribe(listener) {
       if (closed) return () => {
       };
       listeners.add(listener);
-      ensureFsw();
+      void ensureFsw();
       return () => {
         listeners.delete(listener);
       };
     },
+    whenReady() {
+      return ensureFsw();
+    },
+    emitRename(fromRel, toRel) {
+      if (closed) return;
+      if (fsw) {
+        const now = Date.now();
+        const window = {
+          idleDeadline: now + RENAME_ECHO_IDLE_MS,
+          hardDeadline: now + RENAME_ECHO_MAX_MS
+        };
+        suppressions.push(
+          { prefix: fromRel, kinds: RENAME_ECHO_FROM_KINDS, ...window },
+          { prefix: toRel, kinds: RENAME_ECHO_TO_KINDS, ...window }
+        );
+      }
+      fanout({ op: "rename", path: toRel, oldPath: fromRel });
+    },
     close() {
       if (closed) return;
       closed = true;
       listeners.clear();
+      suppressions.length = 0;
       fsw?.close().catch(() => {
       });
       fsw = null;
     }
   };
 }
+
+// src/server/workspace/createNodeWorkspace.ts
+var EPERM_CODE = "EPERM";
 var nodeWorkspaceHostRoots = /* @__PURE__ */ new WeakMap();
 function getNodeWorkspaceHostRoot(workspace) {
   return nodeWorkspaceHostRoots.get(workspace);
@@ -594,7 +779,7 @@ function createNodeWorkspace(root, opts = {}) {
     },
     async readdir(relPath) {
       const absPath = await ensureExistingWorkspacePath(root, relPath);
-      const entries = await readdir(absPath, { withFileTypes: true });
+      const entries = await readdir2(absPath, { withFileTypes: true });
       return entries.map((entry) => ({
         name: entry.name,
         kind: entry.isDirectory() ? "dir" : "file"
@@ -632,6 +817,7 @@ function createNodeWorkspace(root, opts = {}) {
       const fromAbsPath = await ensureExistingWorkspacePath(root, fromRelPath);
       const toAbsPath = await ensureWritableWorkspacePath(root, toRelPath2);
       await rename(fromAbsPath, toAbsPath);
+      cachedWatcher?.emitRename(toPosixRel(root, fromAbsPath), toPosixRel(root, toAbsPath));
     }
   };
   nodeWorkspaceHostRoots.set(workspace, root);
@@ -757,8 +943,8 @@ async function buildGlobalToolMounts(workspaceRoot) {
   if (globalRoot === workspaceRoot) return [];
   const args = [];
   const mountIfChildLacks = async (runtimeRelPath) => {
-    const parentRuntimePath = join2(globalRoot, runtimeRelPath);
-    const childRuntimePath = join2(workspaceRoot, runtimeRelPath);
+    const parentRuntimePath = join3(globalRoot, runtimeRelPath);
+    const childRuntimePath = join3(workspaceRoot, runtimeRelPath);
     if (!await dirExists(parentRuntimePath)) return false;
     if (await pathExists(childRuntimePath)) return false;
     args.push("--ro-bind", parentRuntimePath, `${SANDBOX_HOME2}/${runtimeRelPath}`);
@@ -770,10 +956,45 @@ async function buildGlobalToolMounts(workspaceRoot) {
   }
   return args;
 }
+function positiveInteger(value, name) {
+  if (value === void 0) return void 0;
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return Math.floor(value);
+}
+function buildResourceLimitCommands(limits) {
+  if (!limits) return [];
+  const commands = [];
+  const cpuSeconds = positiveInteger(limits.cpuSeconds, "resourceLimits.cpuSeconds");
+  const fileSizeBlocks = positiveInteger(limits.fileSizeBlocks, "resourceLimits.fileSizeBlocks");
+  const maxProcesses = positiveInteger(limits.maxProcesses, "resourceLimits.maxProcesses");
+  const openFiles = positiveInteger(limits.openFiles, "resourceLimits.openFiles");
+  const virtualMemoryKb = positiveInteger(limits.virtualMemoryKb, "resourceLimits.virtualMemoryKb");
+  if (cpuSeconds !== void 0) commands.push(`ulimit -t ${cpuSeconds}`);
+  if (fileSizeBlocks !== void 0) commands.push(`ulimit -f ${fileSizeBlocks}`);
+  if (maxProcesses !== void 0) commands.push(`ulimit -u ${maxProcesses}`);
+  if (openFiles !== void 0) commands.push(`ulimit -n ${openFiles}`);
+  if (virtualMemoryKb !== void 0) commands.push(`ulimit -v ${virtualMemoryKb}`);
+  return commands;
+}
+function buildCommandArgs(cmd, limits) {
+  const limitCommands = buildResourceLimitCommands(limits);
+  if (limitCommands.length === 0) return ["bash", "-c", cmd];
+  return [
+    "bash",
+    "-c",
+    `${limitCommands.join("\n")}
+exec bash -c "$1"`,
+    "boring-exec",
+    cmd
+  ];
+}
 function createBwrapSandbox(opts = {}) {
+  const sandboxOptions = opts;
   let workspace = null;
-  let hostWorkspaceRoot = opts.hostWorkspaceRoot;
-  let runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
+  let hostWorkspaceRoot = sandboxOptions.hostWorkspaceRoot;
+  let runtimeContext = sandboxOptions.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
   return {
     id: "bwrap",
     placement: "server",
@@ -784,8 +1005,8 @@ function createBwrapSandbox(opts = {}) {
     },
     async init(ctx) {
       workspace = ctx.workspace;
-      hostWorkspaceRoot = opts.hostWorkspaceRoot ?? getNodeWorkspaceHostRoot(ctx.workspace) ?? ctx.workspace.root;
-      runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
+      hostWorkspaceRoot = sandboxOptions.hostWorkspaceRoot ?? getNodeWorkspaceHostRoot(ctx.workspace) ?? ctx.workspace.root;
+      runtimeContext = sandboxOptions.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
       await assertBwrapAvailable();
     },
     async exec(cmd, opts2) {
@@ -798,12 +1019,14 @@ function createBwrapSandbox(opts = {}) {
       const workspaceRoot = hostWorkspaceRoot ?? workspace.root;
       const sandboxCwd = computeSandboxCwd(workspaceRoot, runtimeContext.runtimeCwd, opts2?.cwd);
       const postWorkspaceArgs = await buildGlobalToolMounts(workspaceRoot);
-      const baseArgs = buildBwrapArgs(workspaceRoot, { postWorkspaceArgs });
+      const baseArgs = buildBwrapArgs(workspaceRoot, {
+        postWorkspaceArgs,
+        network: sandboxOptions.network,
+        dropAllCapabilities: sandboxOptions.dropAllCapabilities
+      });
       const args = [
         ...withSandboxCwd(baseArgs, sandboxCwd),
-        "bash",
-        "-c",
-        cmd
+        ...buildCommandArgs(cmd, sandboxOptions.resourceLimits)
       ];
       return await new Promise((resolve11, reject) => {
         const child = spawn2("bwrap", args, {
@@ -1634,6 +1857,492 @@ async function prepareVercelDeploymentSnapshot(opts) {
   });
 }
 
+// src/server/runtime/createServerFileSearch.ts
+var DEFAULT_LIMIT = 500;
+var MAX_LIMIT = 5e3;
+var SEARCH_TIMEOUT_MS = 5e3;
+var SEARCH_MAX_OUTPUT_BYTES = 256e3;
+function shellQuote2(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function normalizeLimit(limit) {
+  if (typeof limit !== "number" || !Number.isFinite(limit)) {
+    return DEFAULT_LIMIT;
+  }
+  const normalized = Math.trunc(limit);
+  if (normalized <= 0) return DEFAULT_LIMIT;
+  return Math.min(normalized, MAX_LIMIT);
+}
+function buildFindArgs(glob) {
+  const isPathShaped = glob.includes("/") || glob.includes("**");
+  if (!isPathShaped) {
+    return `-iname ${shellQuote2(glob)}`;
+  }
+  let translated = glob.replaceAll("**", "*");
+  translated = translated.replace(/^\/+/, "");
+  if (!translated.startsWith("*")) {
+    translated = `*${translated}`;
+  }
+  return `-ipath ${shellQuote2(translated)}`;
+}
+function createServerFileSearch(workspace, sandbox) {
+  return {
+    async search(glob, limit = DEFAULT_LIMIT) {
+      const safeLimit = normalizeLimit(limit);
+      const command = [
+        "find .",
+        "-maxdepth 10",
+        "\\( -path './.boring-agent' -o -path './.git' -o -path './node_modules' \\) -prune -o",
+        buildFindArgs(glob),
+        "-type f",
+        "-print",
+        `| head -n ${safeLimit}`
+      ].join(" ");
+      const { stdout, exitCode } = await sandbox.exec(command, {
+        cwd: workspace.root,
+        timeoutMs: SEARCH_TIMEOUT_MS,
+        maxOutputBytes: SEARCH_MAX_OUTPUT_BYTES
+      });
+      if (exitCode !== 0) {
+        throw new Error(`file-search failed: exit ${exitCode}`);
+      }
+      const decoded = new TextDecoder().decode(stdout);
+      return decoded.split("\n").map((line) => line.replace(/\r$/, "")).filter((line) => line.length > 0).map((line) => line.replace(/^\.\//, ""));
+    }
+  };
+}
+
+// src/server/sandbox/remote-worker/protocol.ts
+var REMOTE_WORKER_RUNTIME_CWD = "/workspace";
+var REMOTE_WORKER_PROVIDER = "remote-worker";
+var WORKER_INTERNAL_TOKEN_HEADER = "x-boring-internal-token";
+var WORKER_WORKSPACE_ID_HEADER = "x-boring-workspace-id";
+var WORKER_REQUEST_ID_HEADER = "x-boring-request-id";
+
+// src/server/sandbox/remote-worker/createRemoteWorkerSandbox.ts
+function filteredEnv(env) {
+  if (!env) return void 0;
+  return Object.fromEntries(
+    Object.entries(env).filter((entry) => typeof entry[1] === "string")
+  );
+}
+function createRemoteWorkerSandbox(client) {
+  return {
+    id: REMOTE_WORKER_PROVIDER,
+    placement: "remote",
+    provider: REMOTE_WORKER_PROVIDER,
+    capabilities: ["exec"],
+    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+    async init() {
+      await client.health();
+    },
+    async exec(cmd, opts = {}) {
+      const request = {
+        cmd,
+        cwd: opts.cwd,
+        env: filteredEnv(opts.env),
+        timeoutMs: opts.timeoutMs,
+        maxOutputBytes: opts.maxOutputBytes
+      };
+      const startedAt = Date.now();
+      const heartbeat = opts.onHeartbeat ? setInterval(() => opts.onHeartbeat?.(Date.now() - startedAt), 1e3) : null;
+      try {
+        const result = await client.exec(request, { signal: opts.signal });
+        opts.onStdout?.(result.stdout);
+        opts.onStderr?.(result.stderr);
+        return result;
+      } finally {
+        if (heartbeat) clearInterval(heartbeat);
+      }
+    }
+  };
+}
+
+// src/server/sandbox/remote-worker/workerClient.ts
+import { timingSafeEqual } from "crypto";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_EXEC_TIMEOUT_MS = 3e4;
+var DEFAULT_EXEC_REQUEST_GRACE_MS = 1e4;
+var RemoteWorkerClientError = class extends Error {
+  statusCode;
+  code;
+  details;
+  constructor(message, opts) {
+    super(message);
+    this.name = "RemoteWorkerClientError";
+    this.statusCode = opts.statusCode;
+    this.code = opts.code ?? "remote_worker_error";
+    this.details = opts.details;
+  }
+};
+function requireNonEmpty(value, label) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new Error(`${label} is required for ${REMOTE_WORKER_PROVIDER} mode`);
+  return trimmed;
+}
+function normalizeBaseUrl(value) {
+  return requireNonEmpty(value, "BORING_WORKER_BASE_URL").replace(/\/+$/, "");
+}
+function positiveInteger2(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
+  return Math.trunc(value);
+}
+function encodeWorkspaceId(workspaceId) {
+  return encodeURIComponent(requireNonEmpty(workspaceId, "workspaceId"));
+}
+function bytesToBase64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function base64ToBytes(value) {
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+function makeHeaders(opts) {
+  const headers = new Headers();
+  headers.set(WORKER_INTERNAL_TOKEN_HEADER, requireNonEmpty(opts.token, "BORING_WORKER_INTERNAL_TOKEN"));
+  headers.set(WORKER_WORKSPACE_ID_HEADER, requireNonEmpty(opts.workspaceId, "workspaceId"));
+  if (opts.requestId) headers.set(WORKER_REQUEST_ID_HEADER, opts.requestId);
+  if (opts.contentType) headers.set("content-type", opts.contentType);
+  return headers;
+}
+async function parseError(response) {
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+  }
+  return new RemoteWorkerClientError(
+    payload?.error?.message ?? `remote worker request failed (${response.status})`,
+    {
+      statusCode: payload?.error?.statusCode ?? response.status,
+      code: payload?.error?.code,
+      details: payload?.error?.details
+    }
+  );
+}
+var RemoteWorkerClient = class {
+  baseUrl;
+  token;
+  workspaceId;
+  requestId;
+  fetchImpl;
+  requestTimeoutMs;
+  execTimeoutMs;
+  execRequestGraceMs;
+  constructor(opts) {
+    this.baseUrl = normalizeBaseUrl(opts.baseUrl);
+    this.token = requireNonEmpty(opts.token, "BORING_WORKER_INTERNAL_TOKEN");
+    this.workspaceId = requireNonEmpty(opts.workspaceId, "workspaceId");
+    this.requestId = opts.requestId;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.requestTimeoutMs = positiveInteger2(opts.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS, "requestTimeoutMs");
+    this.execTimeoutMs = positiveInteger2(opts.execTimeoutMs, DEFAULT_EXEC_TIMEOUT_MS, "execTimeoutMs");
+    this.execRequestGraceMs = positiveInteger2(opts.execRequestGraceMs, DEFAULT_EXEC_REQUEST_GRACE_MS, "execRequestGraceMs");
+  }
+  timeoutError(timeoutMs) {
+    return new RemoteWorkerClientError("remote worker request timed out", {
+      statusCode: 504,
+      code: ErrorCode.enum.REMOTE_WORKER_TIMEOUT,
+      details: { timeoutMs, retryable: true }
+    });
+  }
+  abortedError() {
+    return new RemoteWorkerClientError("remote worker request aborted", {
+      statusCode: 499,
+      code: ErrorCode.enum.ABORTED
+    });
+  }
+  async fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    const upstreamSignal = init.signal;
+    const abortFromUpstream = () => controller.abort();
+    if (upstreamSignal?.aborted) {
+      clearTimeout(timer);
+      throw this.abortedError();
+    }
+    upstreamSignal?.addEventListener("abort", abortFromUpstream, { once: true });
+    try {
+      return await this.fetchImpl(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (timedOut) throw this.timeoutError(timeoutMs);
+      if (upstreamSignal?.aborted) throw this.abortedError();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      upstreamSignal?.removeEventListener("abort", abortFromUpstream);
+    }
+  }
+  async health() {
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/health`, {
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId })
+    }, this.requestTimeoutMs);
+    if (!response.ok) throw await parseError(response);
+  }
+  async workspace(op) {
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/fs`, {
+      method: "POST",
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId, contentType: "application/json" }),
+      body: JSON.stringify(op)
+    }, this.requestTimeoutMs);
+    if (!response.ok) throw await parseError(response);
+    return await response.json();
+  }
+  async exec(input, opts = {}) {
+    const timeoutMs = (input.timeoutMs ?? this.execTimeoutMs) + this.execRequestGraceMs;
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/exec`, {
+      method: "POST",
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId, contentType: "application/json" }),
+      body: JSON.stringify(input),
+      signal: opts.signal
+    }, timeoutMs);
+    if (!response.ok) throw await parseError(response);
+    const body = await response.json();
+    return {
+      stdout: base64ToBytes(body.stdoutBase64),
+      stderr: base64ToBytes(body.stderrBase64),
+      exitCode: body.exitCode,
+      durationMs: body.durationMs,
+      truncated: body.truncated,
+      stdoutEncoding: body.stdoutEncoding,
+      stderrEncoding: body.stderrEncoding
+    };
+  }
+  watch(onEvent, onError) {
+    const controller = new AbortController();
+    void this.consumeEvents(controller.signal, onEvent).catch((error) => {
+      if (!controller.signal.aborted) onError?.(error instanceof Error ? error : new Error(String(error)));
+    });
+    return { close: () => controller.abort() };
+  }
+  async consumeEvents(signal, onEvent) {
+    const response = await this.fetchImpl(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/fs/events`, {
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId }),
+      signal
+    });
+    if (!response.ok) throw await parseError(response);
+    if (!response.body) throw new RemoteWorkerClientError("remote worker event stream missing body", { statusCode: 502 });
+    const reader = response.body.getReader();
+    const decoder2 = new TextDecoder();
+    let buffer = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) {
+          if (signal.aborted) return;
+          throw new RemoteWorkerClientError("remote worker event stream closed", {
+            statusCode: 502,
+            code: ErrorCode.enum.REMOTE_WORKER_STREAM_CLOSED
+          });
+        }
+        buffer += decoder2.decode(value, { stream: true });
+        let boundary = buffer.indexOf("\n\n");
+        while (boundary >= 0) {
+          const frame = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          this.handleSseFrame(frame, onEvent);
+          boundary = buffer.indexOf("\n\n");
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  handleSseFrame(frame, onEvent) {
+    let eventName = "message";
+    const dataLines = [];
+    for (const line of frame.split("\n")) {
+      if (line.startsWith(":")) continue;
+      if (line.startsWith("event:")) eventName = line.slice("event:".length).trim();
+      if (line.startsWith("data:")) dataLines.push(line.slice("data:".length).trimStart());
+    }
+    if (eventName !== "change" || dataLines.length === 0) return;
+    const payload = JSON.parse(dataLines.join("\n"));
+    onEvent(payload.event);
+  }
+};
+function encodeBytesForWorker(bytes) {
+  return bytesToBase64(bytes);
+}
+function decodeBytesFromWorker(value) {
+  return base64ToBytes(value);
+}
+function constantTimeTokenEqual(a, b) {
+  if (!a || !b) return false;
+  const aBytes = Buffer.from(a);
+  const bBytes = Buffer.from(b);
+  if (aBytes.length !== bBytes.length) return false;
+  return timingSafeEqual(aBytes, bBytes);
+}
+
+// src/server/workspace/createRemoteWorkerWorkspace.ts
+function expectContent(result) {
+  if ("content" in result && typeof result.content === "string") return result.content;
+  throw new Error("remote worker returned invalid file content response");
+}
+function expectData(result) {
+  if ("dataBase64" in result && typeof result.dataBase64 === "string") return decodeBytesFromWorker(result.dataBase64);
+  throw new Error("remote worker returned invalid binary response");
+}
+function expectStat(result) {
+  if ("stat" in result && result.stat) return result.stat;
+  throw new Error("remote worker returned invalid stat response");
+}
+function expectEntries(result) {
+  if ("entries" in result && Array.isArray(result.entries)) return result.entries;
+  throw new Error("remote worker returned invalid readdir response");
+}
+function createRemoteWatcher(client) {
+  const listeners = /* @__PURE__ */ new Map();
+  let stream = null;
+  let reconnectTimer = null;
+  let closed = false;
+  const clearReconnectTimer = () => {
+    if (!reconnectTimer) return;
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  };
+  const scheduleReconnect = () => {
+    if (closed || listeners.size === 0 || reconnectTimer) return;
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      ensureStream();
+    }, 1e3);
+  };
+  const handleStreamEnd = () => {
+    stream = null;
+    for (const options of [...listeners.values()]) {
+      try {
+        options?.onControlEvent?.({ type: "resync-required", reason: "remote_worker_stream_closed" });
+      } catch {
+      }
+    }
+    scheduleReconnect();
+  };
+  const ensureStream = () => {
+    if (stream || closed || listeners.size === 0) return;
+    clearReconnectTimer();
+    stream = client.watch((event) => {
+      for (const listener of [...listeners.keys()]) {
+        try {
+          listener(event);
+        } catch {
+        }
+      }
+    }, handleStreamEnd);
+  };
+  return {
+    subscribe(listener, options) {
+      if (closed) return () => {
+      };
+      listeners.set(listener, options);
+      ensureStream();
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          clearReconnectTimer();
+          stream?.close();
+          stream = null;
+        }
+      };
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      listeners.clear();
+      clearReconnectTimer();
+      stream?.close();
+      stream = null;
+    }
+  };
+}
+function createRemoteWorkerWorkspace(client) {
+  let watcher = null;
+  return {
+    root: REMOTE_WORKER_RUNTIME_CWD,
+    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+    fsCapability: "best-effort",
+    watch() {
+      watcher ??= createRemoteWatcher(client);
+      return watcher;
+    },
+    async readFile(path4) {
+      return expectContent(await client.workspace({ op: "readFile", path: path4 }));
+    },
+    async readBinaryFile(path4) {
+      return expectData(await client.workspace({ op: "readBinaryFile", path: path4 }));
+    },
+    async writeFile(path4, data) {
+      await client.workspace({ op: "writeFile", path: path4, data });
+    },
+    async writeBinaryFile(path4, data) {
+      await client.workspace({ op: "writeBinaryFile", path: path4, dataBase64: encodeBytesForWorker(data) });
+    },
+    async readFileWithStat(path4) {
+      const result = await client.workspace({ op: "readFileWithStat", path: path4 });
+      if ("content" in result && "stat" in result) return { content: result.content, stat: result.stat };
+      throw new Error("remote worker returned invalid readFileWithStat response");
+    },
+    async writeFileWithStat(path4, data) {
+      return expectStat(await client.workspace({ op: "writeFileWithStat", path: path4, data }));
+    },
+    async writeBinaryFileWithStat(path4, data) {
+      return expectStat(await client.workspace({ op: "writeBinaryFileWithStat", path: path4, dataBase64: encodeBytesForWorker(data) }));
+    },
+    async unlink(path4) {
+      await client.workspace({ op: "unlink", path: path4 });
+    },
+    async readdir(path4) {
+      return expectEntries(await client.workspace({ op: "readdir", path: path4 }));
+    },
+    async stat(path4) {
+      return expectStat(await client.workspace({ op: "stat", path: path4 }));
+    },
+    async mkdir(path4, opts) {
+      await client.workspace({ op: "mkdir", path: path4, recursive: opts?.recursive });
+    },
+    async rename(from, to) {
+      await client.workspace({ op: "rename", from, to });
+    }
+  };
+}
+
+// src/server/runtime/modes/remote-worker.ts
+function requireOption(value, name) {
+  const trimmed = value?.trim();
+  if (!trimmed) throw new Error(`${name} is required for remote-worker mode`);
+  return trimmed;
+}
+function createRemoteWorkerModeAdapter(opts = {}) {
+  return {
+    id: REMOTE_WORKER_PROVIDER,
+    workspaceFsCapability: "best-effort",
+    async create(ctx) {
+      const workspaceId = requireOption(ctx.workspaceId ?? ctx.sessionId, "workspaceId");
+      const client = new RemoteWorkerClient({
+        baseUrl: requireOption(opts.baseUrl ?? getEnv("BORING_WORKER_BASE_URL"), "BORING_WORKER_BASE_URL"),
+        token: requireOption(opts.token ?? getEnv("BORING_WORKER_INTERNAL_TOKEN"), "BORING_WORKER_INTERNAL_TOKEN"),
+        workspaceId,
+        requestId: ctx.requestId,
+        fetchImpl: opts.fetchImpl
+      });
+      const workspace = createRemoteWorkerWorkspace(client);
+      const sandbox = createRemoteWorkerSandbox(client);
+      await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
+      return {
+        runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+        workspace,
+        sandbox,
+        fileSearch: createServerFileSearch(workspace, sandbox)
+      };
+    }
+  };
+}
+
 // src/server/http/routes/file.ts
 import { dirname as dirname5, extname as extname2, relative as relative4 } from "path/posix";
 
@@ -1682,102 +2391,22 @@ function createAuthMiddleware(opts = {}) {
       }
       return;
     }
-    const header = request.headers.authorization;
-    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
-      reply.code(401).send(
-        errorPayload(
-          ERROR_CODE_AUTH_REQUIRED,
-          "Missing Bearer token"
-        )
-      );
-      return;
-    }
-    const candidateToken = header.slice("Bearer ".length);
-    if (candidateToken !== authToken) {
-      reply.code(403).send(errorPayload(ERROR_CODE_AUTH_INVALID, "Invalid token"));
-      return;
-    }
-    ensureWorkspaceContext(request, workspaceId, true);
-  };
-}
-
-// src/server/logging.ts
-var SENSITIVE_KEYS = new Set([
-  "apiKey",
-  "api_key",
-  "token",
-  "secret",
-  "password",
-  "authorization",
-  "cookie",
-  "oidcToken",
-  "accessToken",
-  "refreshToken",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-  "VERCEL_OIDC_TOKEN",
-  "VERCEL_TEAM_ID"
-].map((key) => key.toLowerCase()));
-function isSensitiveKey(key) {
-  return SENSITIVE_KEYS.has(key.toLowerCase());
-}
-function redactValue(key, value, seen) {
-  if (key && isSensitiveKey(key) && value != null) return "***";
-  if (value == null || typeof value !== "object") return value;
-  if (value instanceof Date) return value;
-  if (seen.has(value)) return "[Circular]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    const out2 = value.map((item) => redactValue(void 0, item, seen));
-    seen.delete(value);
-    return out2;
-  }
-  const out = {};
-  for (const [childKey, childValue] of Object.entries(value)) {
-    out[childKey] = redactValue(childKey, childValue, seen);
-  }
-  seen.delete(value);
-  return out;
-}
-function redact(fields) {
-  const out = {};
-  const seen = /* @__PURE__ */ new WeakSet();
-  for (const [k, v] of Object.entries(fields)) {
-    out[k] = redactValue(k, v, seen);
-  }
-  return out;
-}
-var verbose = typeof process !== "undefined" && process.env?.BORING_AGENT_VERBOSE === "1";
-function createLogger(prefix) {
-  function emit(level, msg, fields) {
-    const entry = {
-      level,
-      prefix,
-      msg,
-      ...fields ? redact(fields) : {},
-      t: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (level === "error") {
-      console.error(JSON.stringify(entry));
-    } else if (level === "warn") {
-      console.warn(JSON.stringify(entry));
-    } else {
-      console.log(JSON.stringify(entry));
-    }
-  }
-  return {
-    debug(msg, fields) {
-      if (verbose) emit("debug", msg, fields);
-    },
-    info(msg, fields) {
-      emit("info", msg, fields);
-    },
-    warn(msg, fields) {
-      emit("warn", msg, fields);
-    },
-    error(msg, fields) {
-      emit("error", msg, fields);
+    const header = request.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      reply.code(401).send(
+        errorPayload(
+          ERROR_CODE_AUTH_REQUIRED,
+          "Missing Bearer token"
+        )
+      );
+      return;
+    }
+    const candidateToken = header.slice("Bearer ".length);
+    if (candidateToken !== authToken) {
+      reply.code(403).send(errorPayload(ERROR_CODE_AUTH_INVALID, "Invalid token"));
+      return;
     }
+    ensureWorkspaceContext(request, workspaceId, true);
   };
 }
 
@@ -1987,7 +2616,7 @@ function buildFileRecordsResult(args) {
 }
 
 // src/server/http/routes/file.ts
-var log = createLogger("boring/workspace-settings");
+var log2 = createLogger("boring/workspace-settings");
 var BORING_SETTINGS_PATH = ".boring/settings";
 var DEFAULT_MARKDOWN_IMAGE_UPLOAD_DIR = "assets/images";
 var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
@@ -2062,7 +2691,7 @@ function parseWorkspaceSettings(raw) {
       }
     };
   } catch (err) {
-    log.warn("failed to parse .boring/settings \u2014 falling back to defaults", {
+    log2.warn("failed to parse .boring/settings \u2014 falling back to defaults", {
       error: err instanceof Error ? err.message : String(err)
     });
     return defaultWorkspaceSettings();
@@ -2410,8 +3039,8 @@ function fileRoutes(app, opts, done) {
 // src/server/workspace/provisionRuntime.ts
 import { createHash as createHash3 } from "crypto";
 import { constants as constants2 } from "fs";
-import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join3, relative as relative5, resolve as resolve5 } from "path";
+import { access as access2, chmod as chmod3, cp, mkdir as mkdir4, readdir as readdir3, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join4, relative as relative5, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -2447,11 +3076,11 @@ async function commandExists(cmd) {
 async function hashPath(path4, hash) {
   const info = await stat4(path4);
   if (info.isDirectory()) {
-    const entries = (await readdir2(path4)).filter((entry) => entry !== "__pycache__" && entry !== "build" && !entry.endsWith(".egg-info")).sort();
+    const entries = (await readdir3(path4)).filter((entry) => entry !== "__pycache__" && entry !== "build" && !entry.endsWith(".egg-info")).sort();
     for (const entry of entries) {
       hash.update(`dir:${entry}
 `);
-      await hashPath(join3(path4, entry), hash);
+      await hashPath(join4(path4, entry), hash);
     }
     return;
   }
@@ -2484,16 +3113,16 @@ async function fingerprint(contributions) {
       const packageRoot = toPath(spec.packageRoot);
       hash.update(`node-package:${spec.id}:${spec.packageName}:${packageRoot}
 `);
-      const packageJson = join3(packageRoot, "package.json");
-      const distDir = join3(packageRoot, "dist");
-      const docsDir = join3(packageRoot, "docs");
-      const skillsDir = join3(packageRoot, "skills");
-      const referencesDir = join3(packageRoot, "references");
-      const sourceDocsDir = join3(packageRoot, "src", "server", "docs");
+      const packageJson = join4(packageRoot, "package.json");
+      const distDir = join4(packageRoot, "dist");
+      const docsDir = join4(packageRoot, "docs");
+      const skillsDir = join4(packageRoot, "skills");
+      const referencesDir = join4(packageRoot, "references");
+      const sourceDocsDir = join4(packageRoot, "src", "server", "docs");
       if (await exists(packageJson)) await hashPath(packageJson, hash);
       if (await exists(distDir)) await hashPath(distDir, hash);
-      const templatesDir = join3(packageRoot, "templates");
-      const publicDir = join3(packageRoot, "public");
+      const templatesDir = join4(packageRoot, "templates");
+      const publicDir = join4(packageRoot, "public");
       if (await exists(templatesDir)) await hashPath(templatesDir, hash);
       if (await exists(publicDir)) await hashPath(publicDir, hash);
       if (await exists(docsDir)) await hashPath(docsDir, hash);
@@ -2544,7 +3173,7 @@ function nodePackageTarget(workspaceRoot, packageName) {
   if (parts.length === 0 || parts.some((part) => part === "." || part === "..")) {
     throw new Error(`Invalid node package name: ${packageName}`);
   }
-  return join3(workspaceRoot, "node_modules", ...parts);
+  return join4(workspaceRoot, "node_modules", ...parts);
 }
 async function copyIfExists(source, target) {
   if (!await exists(source)) return false;
@@ -2562,27 +3191,27 @@ async function ensureNodePackages(workspaceRoot, specs) {
     const packageRoot = toPath(spec.packageRoot);
     const target = nodePackageTarget(workspaceRoot, spec.packageName);
     await mkdir4(target, { recursive: true });
-    const copiedPackageJson = await copyIfExists(join3(packageRoot, "package.json"), join3(target, "package.json"));
+    const copiedPackageJson = await copyIfExists(join4(packageRoot, "package.json"), join4(target, "package.json"));
     if (!copiedPackageJson) {
       throw new Error(`Node package provisioning source is missing package.json: ${packageRoot}`);
     }
-    await copyIfExists(join3(packageRoot, "dist"), join3(target, "dist"));
-    await copyIfExists(join3(packageRoot, "templates"), join3(target, "templates"));
-    await copyIfExists(join3(packageRoot, "public"), join3(target, "public"));
-    if (!await exists(join3(target, "dist", "docs", "plugins.md"))) {
-      await copyIfExists(join3(packageRoot, "src", "server", "docs"), join3(target, "dist", "docs"));
+    await copyIfExists(join4(packageRoot, "dist"), join4(target, "dist"));
+    await copyIfExists(join4(packageRoot, "templates"), join4(target, "templates"));
+    await copyIfExists(join4(packageRoot, "public"), join4(target, "public"));
+    if (!await exists(join4(target, "dist", "docs", "plugins.md"))) {
+      await copyIfExists(join4(packageRoot, "src", "server", "docs"), join4(target, "dist", "docs"));
     }
-    if (!await copyIfExists(join3(packageRoot, "docs"), join3(target, "docs"))) {
-      await copyIfExists(join3(packageRoot, "src", "server", "docs"), join3(target, "docs"));
+    if (!await copyIfExists(join4(packageRoot, "docs"), join4(target, "docs"))) {
+      await copyIfExists(join4(packageRoot, "src", "server", "docs"), join4(target, "docs"));
     }
-    await copyIfExists(join3(packageRoot, "skills"), join3(target, "skills"));
-    await copyIfExists(join3(packageRoot, "references"), join3(target, "references"));
-    await copyIfExists(join3(packageRoot, "src", "globals.css"), join3(target, "src", "globals.css"));
+    await copyIfExists(join4(packageRoot, "skills"), join4(target, "skills"));
+    await copyIfExists(join4(packageRoot, "references"), join4(target, "references"));
+    await copyIfExists(join4(packageRoot, "src", "globals.css"), join4(target, "src", "globals.css"));
   }
 }
 async function ensurePython(workspaceRoot, specs) {
   if (specs.length === 0) return;
-  const venvPython = join3(workspaceRoot, ".boring-agent", "venv", "bin", "python");
+  const venvPython = join4(workspaceRoot, ".boring-agent", "venv", "bin", "python");
   const uv = await commandExists("uv");
   if (!await exists(venvPython)) {
     if (uv) await run("uv", ["venv", ".boring-agent/venv"], workspaceRoot);
@@ -2615,17 +3244,17 @@ function assertEnvKey(key) {
 }
 async function isRuntimeMaterialized(workspaceRoot, contributions) {
   const hasPython = contributions.some(({ provisioning }) => (provisioning.python ?? []).length > 0);
-  if (hasPython && !await exists(join3(workspaceRoot, ".boring-agent", "venv", "bin", "python"))) return false;
+  if (hasPython && !await exists(join4(workspaceRoot, ".boring-agent", "venv", "bin", "python"))) return false;
   for (const { provisioning } of contributions) {
     for (const spec of provisioning.nodePackages ?? []) {
-      if (!await exists(join3(nodePackageTarget(workspaceRoot, spec.packageName), "package.json"))) return false;
+      if (!await exists(join4(nodePackageTarget(workspaceRoot, spec.packageName), "package.json"))) return false;
     }
   }
   return true;
 }
 async function writeShims(workspaceRoot, env) {
-  const shimDir = join3(workspaceRoot, ".boring-agent", "bin");
-  const venvBin = join3(workspaceRoot, ".boring-agent", "venv", "bin");
+  const shimDir = join4(workspaceRoot, ".boring-agent", "bin");
+  const venvBin = join4(workspaceRoot, ".boring-agent", "venv", "bin");
   await mkdir4(shimDir, { recursive: true });
   const exports = Object.entries(env).map(([key, value]) => {
     assertEnvKey(key);
@@ -2639,21 +3268,21 @@ export BORING_AGENT_WORKSPACE_ROOT="$WORKSPACE_ROOT"
 ${exports}
 VENV_BIN="$WORKSPACE_ROOT/.boring-agent/venv/bin"
 `;
-  await writeExecutable(join3(shimDir, "python"), `${base}exec "$VENV_BIN/python" "$@"
+  await writeExecutable(join4(shimDir, "python"), `${base}exec "$VENV_BIN/python" "$@"
 `);
-  await writeExecutable(join3(shimDir, "python3"), `${base}exec "$VENV_BIN/python" "$@"
+  await writeExecutable(join4(shimDir, "python3"), `${base}exec "$VENV_BIN/python" "$@"
 `);
-  await writeExecutable(join3(shimDir, "pip"), `${base}exec "$VENV_BIN/python" -m pip "$@"
+  await writeExecutable(join4(shimDir, "pip"), `${base}exec "$VENV_BIN/python" -m pip "$@"
 `);
-  await writeExecutable(join3(shimDir, "pip3"), `${base}exec "$VENV_BIN/python" -m pip "$@"
+  await writeExecutable(join4(shimDir, "pip3"), `${base}exec "$VENV_BIN/python" -m pip "$@"
 `);
   if (await exists(venvBin)) {
-    for (const entry of await readdir2(venvBin)) {
+    for (const entry of await readdir3(venvBin)) {
       if (["python", "python3", "pip", "pip3"].includes(entry)) continue;
-      const full = join3(venvBin, entry);
+      const full = join4(venvBin, entry);
       const info = await stat4(full).catch(() => null);
       if (!info?.isFile()) continue;
-      await writeExecutable(join3(shimDir, entry), `${base}TARGET="$VENV_BIN"/${bashSingleQuote(entry)}
+      await writeExecutable(join4(shimDir, entry), `${base}TARGET="$VENV_BIN"/${bashSingleQuote(entry)}
 SHEBANG="$(head -n 1 "$TARGET" 2>/dev/null || true)"
 case "$SHEBANG" in
   *python*) exec "$VENV_BIN/python" "$TARGET" "$@" ;;
@@ -2676,8 +3305,8 @@ async function provisionRuntimeWorkspace({
   await mkdir4(workspaceRoot, { recursive: true });
   const env = collectEnv(active);
   const hash = await fingerprint(active);
-  const markerPath = join3(workspaceRoot, ".boring-agent", "provisioning.json");
-  const binDir = join3(workspaceRoot, ".boring-agent", "bin");
+  const markerPath = join4(workspaceRoot, ".boring-agent", "provisioning.json");
+  const binDir = join4(workspaceRoot, ".boring-agent", "bin");
   if (!force && await exists(markerPath)) {
     try {
       const marker = JSON.parse(await readFile4(markerPath, "utf8"));
@@ -2748,7 +3377,7 @@ function cloneStat(stat11) {
 function cloneEntries(entries) {
   return entries.map((entry) => ({ name: entry.name, kind: entry.kind }));
 }
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 async function runJson(sandbox, script) {
@@ -2828,7 +3457,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
   async function assertRealPathWithinSandboxRoot(sandboxPath) {
     const isWithinRoot = await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote2(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote2(sandboxPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote3(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote3(sandboxPath)}`
     );
     if (!isWithinRoot) {
       throw Object.assign(new Error("resolved path escapes workspace root"), { code: EPERM_CODE2 });
@@ -2837,7 +3466,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
   async function isSandboxSymlink(sandboxPath) {
     return await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote2(sandboxPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote3(sandboxPath)}`
     );
   }
   async function listDescendantPaths(relPath, sandboxPath) {
@@ -2857,7 +3486,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
     }
     return await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=process.argv[1]; const relRoot=process.argv[2]; function walk(abs,rel){ const s=fs.statSync(abs); if(!s.isDirectory()) return []; const out=[]; for (const entry of fs.readdirSync(abs,{withFileTypes:true})) { const childRel=rel==='.'?entry.name:rel+'/'+entry.name; out.push(childRel); if(entry.isDirectory()) out.push(...walk(path.join(abs,entry.name),childRel)); } return out; } process.stdout.write(JSON.stringify(walk(root,relRoot)))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(relPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=process.argv[1]; const relRoot=process.argv[2]; function walk(abs,rel){ const s=fs.statSync(abs); if(!s.isDirectory()) return []; const out=[]; for (const entry of fs.readdirSync(abs,{withFileTypes:true})) { const childRel=rel==='.'?entry.name:rel+'/'+entry.name; out.push(childRel); if(entry.isDirectory()) out.push(...walk(path.join(abs,entry.name),childRel)); } return out; } process.stdout.write(JSON.stringify(walk(root,relRoot)))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(relPath)}`
     );
   }
   return {
@@ -2950,7 +3579,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const version = metadataVersion;
       const result = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); const content=fs.readFileSync(p,'utf8'); process.stdout.write(JSON.stringify({content,stat:{size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}}))`)} ${shellQuote2(sandboxPath)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); const content=fs.readFileSync(p,'utf8'); process.stdout.write(JSON.stringify({content,stat:{size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}}))`)} ${shellQuote3(sandboxPath)}`
       );
       if (metadataVersion === version) {
         statCache.set(sandboxPath, result.stat);
@@ -2978,7 +3607,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
           };
         })() : await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
         statCache.set(sandboxPath, writtenStat2);
         emitChange({ op: "write", path: relPath, mtimeMs: writtenStat2.mtimeMs });
@@ -2987,7 +3616,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const encoded = payload.toString("base64");
       const writtenStat = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(encoded)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(encoded)}`
       );
       invalidateMetadataCache();
       statCache.set(sandboxPath, writtenStat);
@@ -3016,7 +3645,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
           };
         })() : await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
         statCache.set(sandboxPath, writtenStat2);
         emitChange({ op: "write", path: relPath, mtimeMs: writtenStat2.mtimeMs });
@@ -3025,7 +3654,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const encoded = payload.toString("base64");
       const writtenStat = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(encoded)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(encoded)}`
       );
       invalidateMetadataCache();
       statCache.set(sandboxPath, writtenStat);
@@ -3041,7 +3670,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       await assertRealPathWithinSandboxRoot(sandboxPath);
       const descendantPaths = await isSandboxSymlink(sandboxPath) ? [] : await listDescendantPaths(relPath, sandboxPath);
       if (remote.fs?.rm) await remote.fs.rm(sandboxPath, { recursive: true, force: false });
-      else await runShell(remote, `rm -r -- ${shellQuote2(sandboxPath)}`);
+      else await runShell(remote, `rm -r -- ${shellQuote3(sandboxPath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "unlink", path: relPath });
@@ -3059,7 +3688,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
         kind: entry.isDirectory() ? "dir" : "file"
       })) : await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const entries=fs.readdirSync(p,{withFileTypes:true}).map((e)=>({name:e.name,kind:e.isDirectory()?'dir':'file'})); process.stdout.write(JSON.stringify(entries))`)} ${shellQuote2(sandboxPath)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const entries=fs.readdirSync(p,{withFileTypes:true}).map((e)=>({name:e.name,kind:e.isDirectory()?'dir':'file'})); process.stdout.write(JSON.stringify(entries))`)} ${shellQuote3(sandboxPath)}`
       );
       if (metadataVersion === version) {
         readdirCache.set(sandboxPath, mappedEntries);
@@ -3082,7 +3711,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       } else {
         mappedStat = await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
       }
       if (metadataVersion === version) {
@@ -3093,9 +3722,9 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
     async mkdir(relPath, opts) {
       const sandboxPath = toSandboxPath(relPath);
       if (remote.fs?.mkdir) await remote.fs.mkdir(sandboxPath, { recursive: opts?.recursive ?? false });
-      else if (opts?.recursive) await runShell(remote, `mkdir -p -- ${shellQuote2(sandboxPath)}`);
+      else if (opts?.recursive) await runShell(remote, `mkdir -p -- ${shellQuote3(sandboxPath)}`);
       else if (remote.mkDir) await remote.mkDir(sandboxPath);
-      else await runShell(remote, `mkdir -- ${shellQuote2(sandboxPath)}`);
+      else await runShell(remote, `mkdir -- ${shellQuote3(sandboxPath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "mkdir", path: relPath });
@@ -3104,7 +3733,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const fromSandboxPath = toSandboxPath(fromRelPath);
       const toSandboxAbsolutePath = toSandboxPath(toRelPath2);
       if (remote.fs?.rename) await remote.fs.rename(fromSandboxPath, toSandboxAbsolutePath);
-      else await runShell(remote, `mv -- ${shellQuote2(fromSandboxPath)} ${shellQuote2(toSandboxAbsolutePath)}`);
+      else await runShell(remote, `mv -- ${shellQuote3(fromSandboxPath)} ${shellQuote3(toSandboxAbsolutePath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "rename", path: toRelPath2, oldPath: fromRelPath });
@@ -3115,7 +3744,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
 // src/server/workspace/provisioning/packArtifact.ts
 import { execFile as execFile2 } from "child_process";
 import { mkdir as mkdir5, mkdtemp, rename as rename4 } from "fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute5, join as join4 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute5, join as join5 } from "path";
 import { tmpdir } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { promisify as promisify2 } from "util";
@@ -3160,7 +3789,7 @@ async function packProvisioningArtifact(request) {
     ], { maxBuffer: 1024 * 1024 * 20 });
     const packedName = stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
     if (!packedName) throw new Error(`pnpm pack produced no artifact for ${sourcePath}`);
-    const packedPath = isAbsolute5(packedName) ? packedName : join4(dirname7(request.outputPath), packedName);
+    const packedPath = isAbsolute5(packedName) ? packedName : join5(dirname7(request.outputPath), packedName);
     await rename4(packedPath, request.outputPath);
     return;
   }
@@ -3182,8 +3811,8 @@ async function resolveArtifactInstallSource(args) {
   const name = provisioningArtifactName(kind, id, fingerprint2);
   const workspaceRel = `.boring-agent/tmp/${name}`;
   if (!await args.workspaceFs.exists(workspaceRel)) {
-    const artifactDir = await mkdtemp(join4(tmpdir(), "boring-agent-artifact-"));
-    const outputPath = join4(artifactDir, name);
+    const artifactDir = await mkdtemp(join5(tmpdir(), "boring-agent-artifact-"));
+    const outputPath = join5(artifactDir, name);
     try {
       await args.prepareArtifact({ kind, id, fingerprint: fingerprint2, source: args.source, outputPath });
       await args.workspaceFs.copyFromHost(outputPath, workspaceRel);
@@ -3290,7 +3919,7 @@ function createPythonRuntimeFingerprint(input) {
 }
 
 // src/server/workspace/provisioning/node.ts
-import { join as join5, relative as relative6, sep as sep3 } from "path";
+import { join as join6, relative as relative6, sep as sep3 } from "path";
 var NODE_RUNTIME_REL = ".boring-agent/node";
 var NODE_PACKAGE_JSON_REL = `${NODE_RUNTIME_REL}/package.json`;
 var NODE_FINGERPRINT_REL = `${NODE_RUNTIME_REL}/.fingerprint`;
@@ -3328,9 +3957,9 @@ function nodeInstallSource(spec) {
 }
 function expectedNodeOutputs(paths, packages) {
   return [
-    join5(paths.node, "package-lock.json"),
+    join6(paths.node, "package-lock.json"),
     ...packages.flatMap(
-      (pkg) => (pkg.expectedBins ?? []).map((bin) => join5(paths.nodeBin, bin))
+      (pkg) => (pkg.expectedBins ?? []).map((bin) => join6(paths.nodeBin, bin))
     )
   ];
 }
@@ -3421,7 +4050,7 @@ async function ensureNodeRuntime(options) {
 }
 
 // src/server/workspace/provisioning/python.ts
-import { dirname as dirname9, join as join6, relative as relative7, sep as sep4 } from "path";
+import { dirname as dirname9, join as join7, relative as relative7, sep as sep4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var VENV_REL = ".boring-agent/venv";
 var VENV_FINGERPRINT_REL = `${VENV_REL}/.fingerprint`;
@@ -3440,7 +4069,7 @@ async function ensureUv(options) {
       const uvVersion = await commandOutput2(options.adapter, explicitUvBin, ["--version"]) || "uv unknown";
       try {
         await options.adapter.exec("mkdir", ["-p", options.runtimeLayout.uvBin], { cwd: options.runtimeLayout.workspaceRoot });
-        await options.adapter.exec("ln", ["-sf", explicitUvBin, join6(options.runtimeLayout.uvBin, "uv")], { cwd: options.runtimeLayout.workspaceRoot });
+        await options.adapter.exec("ln", ["-sf", explicitUvBin, join7(options.runtimeLayout.uvBin, "uv")], { cwd: options.runtimeLayout.workspaceRoot });
       } catch {
       }
       return { uvBin: explicitUvBin, uvVersion, installedWorkspaceUv: false };
@@ -3467,7 +4096,7 @@ async function ensureUv(options) {
     await options.adapter.workspaceFs.mkdir(".boring-agent/sdk/uv/bin");
     await options.adapter.workspaceFs.rm(UV_BIN_REL);
     await options.adapter.workspaceFs.copyFromHost(options.uvStandaloneSource, UV_BIN_REL);
-    const uvBin = join6(options.runtimeLayout.uvBin, "uv");
+    const uvBin = join7(options.runtimeLayout.uvBin, "uv");
     await options.adapter.exec("chmod", ["+x", uvBin], { cwd: options.runtimeLayout.workspaceRoot });
     return {
       uvBin,
@@ -3500,7 +4129,7 @@ function expectedPythonOutputs(paths, packages) {
   return [
     paths.venvPython,
     ...packages.flatMap(
-      (pkg) => (pkg.expectedBins ?? []).map((bin) => join6(paths.venvBin, bin))
+      (pkg) => (pkg.expectedBins ?? []).map((bin) => join7(paths.venvBin, bin))
     )
   ];
 }
@@ -3613,7 +4242,7 @@ async function ensurePythonRuntime(options) {
 
 // src/server/workspace/provisioning/skills.ts
 import { stat as stat5 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var GENERATED_SKILLS_REL = ".boring-agent/skills";
 var USER_SKILLS_REL = ".agents/skills";
@@ -3626,7 +4255,7 @@ function assertSafeSegment(kind, value) {
   }
 }
 function getProvisionedSkillPaths(paths) {
-  return [paths.skills, join7(paths.workspaceRoot, USER_SKILLS_REL)];
+  return [paths.skills, join8(paths.workspaceRoot, USER_SKILLS_REL)];
 }
 async function mirrorPluginSkills(options) {
   await options.adapter.workspaceFs.rm(GENERATED_SKILLS_REL);
@@ -3659,7 +4288,7 @@ async function mirrorPluginSkills(options) {
 // src/server/workspace/provisioning/workspaceFiles.ts
 import { basename, join as joinPath } from "path";
 import { posix as posix2 } from "path";
-import { readdir as readdir3, stat as stat6 } from "fs/promises";
+import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { fileURLToPath as fileURLToPath5, pathToFileURL } from "url";
 function sourceToPath3(source) {
   return source instanceof URL ? fileURLToPath5(source) : source;
@@ -3701,7 +4330,7 @@ async function collectTemplateWorkItems(template) {
         kind: "directory"
       });
     }
-    const entries = await readdir3(dir, { withFileTypes: true });
+    const entries = await readdir4(dir, { withFileTypes: true });
     for (const entry of entries) {
       const childPath = joinPath(dir, entry.name);
       const childRel = rel ? `${rel}/${entry.name}` : entry.name;
@@ -3958,61 +4587,6 @@ import { spawnSync } from "child_process";
 // src/server/runtime/modes/direct.ts
 import { mkdir as mkdir8 } from "fs/promises";
 
-// src/server/runtime/createServerFileSearch.ts
-var DEFAULT_LIMIT = 500;
-var MAX_LIMIT = 5e3;
-var SEARCH_TIMEOUT_MS = 5e3;
-var SEARCH_MAX_OUTPUT_BYTES = 256e3;
-function shellQuote3(value) {
-  return `'${value.replaceAll("'", "'\\''")}'`;
-}
-function normalizeLimit(limit) {
-  if (typeof limit !== "number" || !Number.isFinite(limit)) {
-    return DEFAULT_LIMIT;
-  }
-  const normalized = Math.trunc(limit);
-  if (normalized <= 0) return DEFAULT_LIMIT;
-  return Math.min(normalized, MAX_LIMIT);
-}
-function buildFindArgs(glob) {
-  const isPathShaped = glob.includes("/") || glob.includes("**");
-  if (!isPathShaped) {
-    return `-iname ${shellQuote3(glob)}`;
-  }
-  let translated = glob.replaceAll("**", "*");
-  translated = translated.replace(/^\/+/, "");
-  if (!translated.startsWith("*")) {
-    translated = `*${translated}`;
-  }
-  return `-ipath ${shellQuote3(translated)}`;
-}
-function createServerFileSearch(workspace, sandbox) {
-  return {
-    async search(glob, limit = DEFAULT_LIMIT) {
-      const safeLimit = normalizeLimit(limit);
-      const command = [
-        "find .",
-        "-maxdepth 10",
-        "\\( -path './.boring-agent' -o -path './.git' -o -path './node_modules' \\) -prune -o",
-        buildFindArgs(glob),
-        "-type f",
-        "-print",
-        `| head -n ${safeLimit}`
-      ].join(" ");
-      const { stdout, exitCode } = await sandbox.exec(command, {
-        cwd: workspace.root,
-        timeoutMs: SEARCH_TIMEOUT_MS,
-        maxOutputBytes: SEARCH_MAX_OUTPUT_BYTES
-      });
-      if (exitCode !== 0) {
-        throw new Error(`file-search failed: exit ${exitCode}`);
-      }
-      const decoded = new TextDecoder().decode(stdout);
-      return decoded.split("\n").map((line) => line.replace(/\r$/, "")).filter((line) => line.length > 0).map((line) => line.replace(/^\.\//, ""));
-    }
-  };
-}
-
 // src/server/workspace/provision.ts
 import { cp as cp2 } from "fs/promises";
 async function copyTemplate(templatePath, workspaceRoot) {
@@ -4300,8 +4874,8 @@ var localModeAdapter = {
 };
 
 // src/server/runtime/modes/vercel-sandbox.ts
-import { readFile as readFile8, readdir as readdir5, stat as stat8 } from "fs/promises";
-import { join as join8 } from "path";
+import { readFile as readFile8, readdir as readdir6, stat as stat8 } from "fs/promises";
+import { join as join9 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 import { Sandbox as VercelSandbox } from "@vercel/sandbox";
 
@@ -4447,20 +5021,20 @@ function createVercelSandboxExec(sandbox, execOpts = {}) {
 
 // src/server/sandbox/vercel-sandbox/packageTemplate.ts
 import { createHash as createHash5 } from "crypto";
-import { readFile as readFile7, readdir as readdir4 } from "fs/promises";
+import { readFile as readFile7, readdir as readdir5 } from "fs/promises";
 import path3 from "path";
 import { Readable } from "stream";
 import { createGzip } from "zlib";
 import { put } from "@vercel/blob";
 var urlCache = /* @__PURE__ */ new Map();
 var LOG_PREFIX = "[template-tarball]";
-function log2(msg, meta = {}) {
+function log3(msg, meta = {}) {
   const metaStr = Object.keys(meta).length > 0 ? ` ${JSON.stringify(meta)}` : "";
   process.stderr.write(`${LOG_PREFIX} ${msg}${metaStr}
 `);
 }
 async function collectFiles(dir, base = "") {
-  const entries = await readdir4(dir, { withFileTypes: true });
+  const entries = await readdir5(dir, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const fullPath = path3.join(dir, entry.name);
@@ -4537,11 +5111,11 @@ async function packageTemplate(templatePath, opts = {}) {
   const hash = computeTemplateHash(files);
   const cached = urlCache.get(hash);
   if (cached) {
-    log2("cache hit", { hash, fileCount: files.length });
+    log3("cache hit", { hash, fileCount: files.length });
     return { url: cached, hash };
   }
   const tarball = await buildTarGz(files);
-  log2("tarball built", {
+  log3("tarball built", {
     hash,
     fileCount: files.length,
     sizeBytes: tarball.length,
@@ -4550,7 +5124,7 @@ async function packageTemplate(templatePath, opts = {}) {
   const upload = opts.uploadFn ?? defaultUpload;
   const url = await upload(hash, tarball);
   urlCache.set(hash, url);
-  log2("uploaded", { hash, url, totalMs: Date.now() - startMs });
+  log3("uploaded", { hash, url, totalMs: Date.now() - startMs });
   return { url, hash };
 }
 
@@ -4716,10 +5290,10 @@ async function copyHostPathToVercelWorkspace(options) {
   const sourceStat = await stat8(sourcePath);
   if (sourceStat.isDirectory()) {
     await options.workspace.mkdir(options.targetRel, { recursive: true });
-    for (const entry of await readdir5(sourcePath, { withFileTypes: true })) {
+    for (const entry of await readdir6(sourcePath, { withFileTypes: true })) {
       await copyHostPathToVercelWorkspace({
         workspace: options.workspace,
-        source: join8(sourcePath, entry.name),
+        source: join9(sourcePath, entry.name),
         targetRel: `${options.targetRel}/${entry.name}`
       });
     }
@@ -5147,7 +5721,7 @@ function getRuntimeBundleStorageRoot(bundle) {
 
 // src/server/harness/pi-coding-agent/createHarness.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { extname as extname3, join as join10 } from "path";
+import { extname as extname3, join as join11 } from "path";
 import {
   createAgentSession,
   SessionManager,
@@ -5427,7 +6001,7 @@ function createPiAgentSessionAdapter(session, options = {}) {
 // src/server/harness/pi-coding-agent/sessions.ts
 import { randomUUID } from "crypto";
 import {
-  readdir as readdir6,
+  readdir as readdir7,
   readFile as readFile9,
   stat as fsStat,
   rm as rm4,
@@ -5438,7 +6012,7 @@ import {
   open as open2
 } from "fs/promises";
 import { closeSync, openSync, readFileSync, readSync, readdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join9, basename as basename2, resolve as resolve7 } from "path";
+import { join as join10, basename as basename2, resolve as resolve7 } from "path";
 import { homedir as homedir3 } from "os";
 import {
   parseSessionEntries,
@@ -5446,7 +6020,7 @@ import {
 } from "@mariozechner/pi-coding-agent";
 function defaultSessionDir(cwd) {
   const safePath = `--${cwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")}--`;
-  return join9(homedir3(), ".pi", "agent", "sessions", safePath);
+  return join10(homedir3(), ".pi", "agent", "sessions", safePath);
 }
 var SAFE_ID = /^[a-zA-Z0-9_-]+$/;
 var SAFE_SESSION_NAMESPACE = /^[a-zA-Z0-9_-]+$/;
@@ -5456,7 +6030,7 @@ function sessionDirForNamespace(namespace) {
   if (!SAFE_SESSION_NAMESPACE.test(safeNamespace)) {
     throw new Error("session namespace must contain only letters, numbers, underscores, and dashes");
   }
-  return join9(homedir3(), ".pi", "agent", "sessions", safeNamespace);
+  return join10(homedir3(), ".pi", "agent", "sessions", safeNamespace);
 }
 function normalizeListOptions(options) {
   return {
@@ -5501,9 +6075,9 @@ var PiSessionStore = class {
     }
   }
   async listUncached(_ctx, options) {
-    const files = await readdir6(this.sessionDir).catch(() => []);
+    const files = await readdir7(this.sessionDir).catch(() => []);
     const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
-    const filepaths = jsonlFiles.map((f) => join9(this.sessionDir, f));
+    const filepaths = jsonlFiles.map((f) => join10(this.sessionDir, f));
     const fileStats = await Promise.all(filepaths.map(async (filepath) => {
       try {
         return { filepath, stat: await fsStat(filepath) };
@@ -5547,7 +6121,7 @@ var PiSessionStore = class {
       };
       lines.push(JSON.stringify(infoEntry));
     }
-    const filepath = join9(this.sessionDir, `${id}.jsonl`);
+    const filepath = join10(this.sessionDir, `${id}.jsonl`);
     await writeFile6(filepath, lines.join("\n") + "\n", "utf-8");
     return {
       id,
@@ -5629,7 +6203,7 @@ var PiSessionStore = class {
   loadPiSessionFileSync(sessionId) {
     if (!SAFE_ID.test(sessionId)) return null;
     try {
-      const direct = join9(this.sessionDir, `${sessionId}.jsonl`);
+      const direct = join10(this.sessionDir, `${sessionId}.jsonl`);
       let filepath = direct;
       let content;
       try {
@@ -5639,7 +6213,7 @@ var PiSessionStore = class {
           (f) => f.endsWith(`_${sessionId}.jsonl`) || f === `${sessionId}.jsonl`
         );
         if (files.length === 0) return null;
-        filepath = join9(this.sessionDir, files[0]);
+        filepath = join10(this.sessionDir, files[0]);
         content = readFileSync(filepath, "utf-8");
       }
       const entries = safeParseEntries(content);
@@ -5695,18 +6269,18 @@ var PiSessionStore = class {
     if (!SAFE_ID.test(sessionId)) {
       throw new Error(`Session not found: ${sessionId}`);
     }
-    const direct = join9(this.sessionDir, `${sessionId}.jsonl`);
+    const direct = join10(this.sessionDir, `${sessionId}.jsonl`);
     try {
       await fsStat(direct);
       return direct;
     } catch {
     }
-    const files = await readdir6(this.sessionDir).catch(() => []);
+    const files = await readdir7(this.sessionDir).catch(() => []);
     const match = files.find(
       (f) => f.endsWith(`_${sessionId}.jsonl`) || f === `${sessionId}.jsonl`
     );
     if (!match) throw new Error(`Session not found: ${sessionId}`);
-    const matchedPath = join9(this.sessionDir, match);
+    const matchedPath = join10(this.sessionDir, match);
     if (!isTimestampNamedPiSessionFile(matchedPath, sessionId)) return matchedPath;
     const existingWrapper = await this.findWrapperReferencingNativeSession(matchedPath);
     if (existingWrapper) {
@@ -5871,7 +6445,7 @@ var PiSessionStore = class {
     try {
       const files = readdirSync(this.sessionDir).filter((file) => file.endsWith(".jsonl"));
       for (const file of files) {
-        const filepath = join9(this.sessionDir, file);
+        const filepath = join10(this.sessionDir, file);
         if (resolve7(filepath) === resolvedNativePath) continue;
         try {
           const linkedPiFile = extractPiSessionFilePath(parseJsonlPrefixEntries(readJsonlPrefixSync(filepath)));
@@ -5886,10 +6460,10 @@ var PiSessionStore = class {
   }
   async findWrapperReferencingNativeSession(nativePath) {
     const resolvedNativePath = resolve7(nativePath);
-    const files = await readdir6(this.sessionDir).catch(() => []);
+    const files = await readdir7(this.sessionDir).catch(() => []);
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filepath = join9(this.sessionDir, file);
+      const filepath = join10(this.sessionDir, file);
       if (resolve7(filepath) === resolvedNativePath) continue;
       try {
         const linkedPiFile = extractPiSessionFilePath(parseJsonlPrefixEntries(await readJsonlPrefix(filepath)));
@@ -5900,7 +6474,7 @@ var PiSessionStore = class {
     return null;
   }
   ensureWrapperForNativeSessionSync(sessionId, nativePath, entries) {
-    const wrapperPath = join9(this.sessionDir, `${sessionId}.jsonl`);
+    const wrapperPath = join10(this.sessionDir, `${sessionId}.jsonl`);
     if (resolve7(wrapperPath) === resolve7(nativePath)) return wrapperPath;
     try {
       readFileSync(wrapperPath, "utf-8");
@@ -5920,7 +6494,7 @@ var PiSessionStore = class {
     return wrapperPath;
   }
   async ensureWrapperForNativeSession(sessionId, nativePath) {
-    const wrapperPath = join9(this.sessionDir, `${sessionId}.jsonl`);
+    const wrapperPath = join10(this.sessionDir, `${sessionId}.jsonl`);
     if (resolve7(wrapperPath) === resolve7(nativePath)) return wrapperPath;
     try {
       await fsStat(wrapperPath);
@@ -6087,6 +6661,11 @@ var INFOMANIAK_PROVIDER = "infomaniak";
 var INFOMANIAK_API_BASE = "https://api.infomaniak.com";
 var DEFAULT_CUSTOM_MODEL_MAX_TOKENS = 16384;
 var DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW = 2e5;
+var DEFAULT_INFOMANIAK_MODELS = [
+  "moonshotai/Kimi-K2.6",
+  "nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B-FP8",
+  "Qwen/Qwen3.5-122B-A10B-FP8"
+];
 function clean(value) {
   const trimmed = value?.trim();
   return trimmed && trimmed.length > 0 ? trimmed : void 0;
@@ -6110,6 +6689,19 @@ function readModelInput(name) {
   const parsed = raw.split(",").map((part) => part.trim()).filter((part) => part === "text" || part === "image");
   return parsed.length > 0 ? parsed : ["text"];
 }
+function readMaxTokensField(name, fallback = "max_completion_tokens") {
+  const raw = clean(getEnv(name));
+  return raw === "max_tokens" || raw === "max_completion_tokens" ? raw : fallback;
+}
+function buildOpenAICompletionsCompat(envPrefix, defaults = {}) {
+  return {
+    supportsStore: readBoolean(`${envPrefix}_SUPPORTS_STORE`, defaults.supportsStore ?? false),
+    supportsDeveloperRole: readBoolean(`${envPrefix}_SUPPORTS_DEVELOPER_ROLE`, defaults.supportsDeveloperRole ?? true),
+    supportsReasoningEffort: readBoolean(`${envPrefix}_SUPPORTS_REASONING_EFFORT`, defaults.supportsReasoningEffort ?? true),
+    supportsUsageInStreaming: readBoolean(`${envPrefix}_SUPPORTS_USAGE_IN_STREAMING`, defaults.supportsUsageInStreaming ?? true),
+    maxTokensField: readMaxTokensField(`${envPrefix}_MAX_TOKENS_FIELD`, defaults.maxTokensField)
+  };
+}
 function readApiKeyEnv(candidates) {
   for (const candidate of candidates) {
     const envName = clean(candidate);
@@ -6122,31 +6714,23 @@ function buildOpenAICompatibleProviderConfig(opts) {
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKeyEnv,
     api: "openai-completions",
-    models: [
-      {
-        id: opts.modelId,
-        name: opts.modelName ?? opts.modelId,
-        api: "openai-completions",
-        reasoning: readBoolean(`${opts.envPrefix}_REASONING`, true),
-        input: readModelInput(`${opts.envPrefix}_INPUT`),
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: readPositiveInt(
-          `${opts.envPrefix}_CONTEXT_WINDOW`,
-          DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW
-        ),
-        maxTokens: readPositiveInt(
-          `${opts.envPrefix}_MAX_TOKENS`,
-          DEFAULT_CUSTOM_MODEL_MAX_TOKENS
-        ),
-        compat: {
-          supportsStore: false,
-          supportsDeveloperRole: true,
-          supportsReasoningEffort: true,
-          supportsUsageInStreaming: true,
-          maxTokensField: "max_completion_tokens"
-        }
-      }
-    ]
+    models: opts.models.map((model) => ({
+      id: model.id,
+      name: model.name ?? model.id,
+      api: "openai-completions",
+      reasoning: readBoolean(`${opts.envPrefix}_REASONING`, true),
+      input: readModelInput(`${opts.envPrefix}_INPUT`),
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      contextWindow: readPositiveInt(
+        `${opts.envPrefix}_CONTEXT_WINDOW`,
+        DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW
+      ),
+      maxTokens: readPositiveInt(
+        `${opts.envPrefix}_MAX_TOKENS`,
+        DEFAULT_CUSTOM_MODEL_MAX_TOKENS
+      ),
+      compat: buildOpenAICompletionsCompat(opts.envPrefix, opts.compatDefaults)
+    }))
   };
 }
 function readInfomaniakBaseUrl() {
@@ -6156,25 +6740,46 @@ function readInfomaniakBaseUrl() {
   if (!productId) return void 0;
   return `${INFOMANIAK_API_BASE}/2/ai/${productId}/openai/v1`;
 }
+function readInfomaniakModelIds() {
+  const configured = clean(getEnv("BORING_AGENT_INFOMANIAK_MODELS"))?.split(",").map((part) => part.trim()).filter(Boolean);
+  const ids = configured?.length ? configured : [...DEFAULT_INFOMANIAK_MODELS];
+  const legacyModel = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL"));
+  if (legacyModel && !ids.includes(legacyModel)) ids.push(legacyModel);
+  return Array.from(new Set(ids));
+}
 function readInfomaniakProvider() {
-  const modelId = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL")) ?? clean(getEnv("BORING_AGENT_DEFAULT_MODEL_ID"));
+  const modelIds = readInfomaniakModelIds();
+  const defaultModelId = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL")) ?? clean(getEnv("BORING_AGENT_DEFAULT_MODEL_ID")) ?? modelIds[0];
   const baseUrl = readInfomaniakBaseUrl();
   const apiKeyEnv = readApiKeyEnv([
     clean(getEnv("BORING_AGENT_INFOMANIAK_API_KEY_ENV")) ?? "",
     "INFOMANIAK_API_TOKEN",
     "BORING_AGENT_INFOMANIAK_API_KEY"
   ]);
-  if (!modelId || !baseUrl || !apiKeyEnv) return void 0;
+  if (!defaultModelId || !baseUrl || !apiKeyEnv) return void 0;
   const provider = clean(getEnv("BORING_AGENT_INFOMANIAK_PROVIDER")) ?? INFOMANIAK_PROVIDER;
+  const modelName = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL_NAME"));
+  const models = modelIds.map((id) => {
+    const model = { id };
+    if (id === defaultModelId && modelName) model.name = modelName;
+    return model;
+  });
+  if (!models.some((model) => model.id === defaultModelId)) {
+    models.push({ id: defaultModelId, name: modelName });
+  }
   return {
     provider,
-    model: { provider, id: modelId },
+    models: models.map((model) => ({ provider, id: model.id })),
+    defaultModel: { provider, id: defaultModelId },
     config: buildOpenAICompatibleProviderConfig({
-      modelId,
-      modelName: clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL_NAME")),
+      models,
       apiKeyEnv,
       baseUrl,
-      envPrefix: "BORING_AGENT_INFOMANIAK"
+      envPrefix: "BORING_AGENT_INFOMANIAK",
+      // Infomaniak's OpenAI-compatible chat endpoint rejects OpenAI's newer
+      // `developer` role (surfacing as "400 Unexpected message role"). Hosts
+      // can opt back in with BORING_AGENT_INFOMANIAK_SUPPORTS_DEVELOPER_ROLE=1.
+      compatDefaults: { supportsDeveloperRole: false, supportsReasoningEffort: false }
     })
   };
 }
@@ -6187,12 +6792,15 @@ function readCustomProvider() {
     "BORING_AGENT_CUSTOM_MODEL_API_KEY"
   ]);
   if (!provider || !modelId || !baseUrl || !apiKeyEnv) return void 0;
+  const modelName = clean(getEnv("BORING_AGENT_CUSTOM_MODEL_NAME"));
+  const model = { id: modelId };
+  if (modelName) model.name = modelName;
   return {
     provider,
-    model: { provider, id: modelId },
+    models: [{ provider, id: modelId }],
+    defaultModel: { provider, id: modelId },
     config: buildOpenAICompatibleProviderConfig({
-      modelId,
-      modelName: clean(getEnv("BORING_AGENT_CUSTOM_MODEL_NAME")),
+      models: [model],
       apiKeyEnv,
       baseUrl,
       envPrefix: "BORING_AGENT_CUSTOM_MODEL"
@@ -6206,7 +6814,7 @@ function registerConfiguredModelProviders(registry) {
     if (!provider) continue;
     if (seen.has(provider.provider)) continue;
     registry.registerProvider(provider.provider, provider.config);
-    registered.push(provider.model);
+    registered.push(...provider.models);
     seen.add(provider.provider);
   }
   return registered;
@@ -6234,7 +6842,7 @@ function readConfiguredDefaultModel() {
   if (explicitProvider && explicitId) {
     return { provider: explicitProvider, id: explicitId };
   }
-  return readPiSettingsDefaultModel() ?? readInfomaniakProvider()?.model ?? readCustomProvider()?.model;
+  return readPiSettingsDefaultModel() ?? readInfomaniakProvider()?.defaultModel ?? readCustomProvider()?.defaultModel;
 }
 
 // src/server/piPackages.ts
@@ -6299,6 +6907,10 @@ var PYTHON_RUNTIME_GUIDELINE = [
 function composeSystemPromptAppend(hostAppend) {
   return [WORKSPACE_PATHS_GUIDELINE, PYTHON_RUNTIME_GUIDELINE, hostAppend?.trim()].filter(Boolean).join("\n\n");
 }
+function withPiHarnessDefaults(pi) {
+  const { noContextFiles = true, noSkills = true, ...rest } = pi ?? {};
+  return { ...rest, noContextFiles, noSkills };
+}
 function buildDynamicPromptExtension(source) {
   return (pi) => {
     pi.on("before_agent_start", async (event) => {
@@ -6354,8 +6966,8 @@ function mergeInjectedProjectPackages(settingsJson, piPackages) {
 }
 function createResourceSettingsManager(cwd, agentDir, piPackages) {
   if (piPackages.length === 0) return SettingsManager2.create(cwd, agentDir);
-  const globalSettingsPath = join10(agentDir, "settings.json");
-  const projectSettingsPath = join10(cwd, ".pi", "settings.json");
+  const globalSettingsPath = join11(agentDir, "settings.json");
+  const projectSettingsPath = join11(cwd, ".pi", "settings.json");
   let globalSettingsOverrideJson;
   let projectSettingsOverrideJson;
   const storage = {
@@ -6385,7 +6997,7 @@ async function applyRequestedSessionOptions(handle, input) {
     handle.piSession.setThinkingLevel(input.thinkingLevel);
   }
 }
-var log3 = createLogger("pi-harness");
+var log4 = createLogger("pi-harness");
 function deriveSourcePlugin(sourceInfo) {
   if (!sourceInfo) return void 0;
   const path4 = typeof sourceInfo.path === "string" ? sourceInfo.path : "";
@@ -6410,6 +7022,7 @@ function normalizeSlashCommandInfo(command) {
   };
 }
 function createPiCodingAgentHarness(opts) {
+  const pi = withPiHarnessDefaults(opts.pi);
   const sessionStore = new PiSessionStore(opts.runtimeCwd ?? opts.cwd, {
     sessionNamespace: opts.sessionNamespace,
     sessionDir: opts.sessionDir,
@@ -6420,22 +7033,22 @@ function createPiCodingAgentHarness(opts) {
   const effectivePackages = [];
   const effectiveExtensionPaths = [];
   const refreshEffectiveResources = () => {
-    const dynamic = opts.pi?.getHotReloadableResources?.() ?? {};
+    const dynamic = pi.getHotReloadableResources?.() ?? {};
     effectiveSkillPaths.splice(
       0,
       effectiveSkillPaths.length,
-      ...opts.pi?.additionalSkillPaths ?? [],
+      ...pi.additionalSkillPaths ?? [],
       ...dynamic.additionalSkillPaths ?? []
     );
     effectivePackages.splice(
       0,
       effectivePackages.length,
-      ...mergePiPackageSources(opts.pi?.packages ?? [], dynamic.packages ?? [])
+      ...mergePiPackageSources(pi.packages ?? [], dynamic.packages ?? [])
     );
     effectiveExtensionPaths.splice(
       0,
       effectiveExtensionPaths.length,
-      ...opts.pi?.extensionPaths ?? [],
+      ...pi.extensionPaths ?? [],
       ...dynamic.extensionPaths ?? []
     );
   };
@@ -6492,7 +7105,7 @@ function createPiCodingAgentHarness(opts) {
     const extensionFactories = [
       toolErrorResultExtension,
       ...dynamicPromptExtension ? [dynamicPromptExtension] : [],
-      ...opts.pi?.extensionFactories ?? []
+      ...pi.extensionFactories ?? []
     ];
     const settingsManager = createResourceSettingsManager(
       opts.cwd,
@@ -6506,8 +7119,8 @@ function createPiCodingAgentHarness(opts) {
       appendSystemPromptOverride: (base) => [...base, composedSystemPromptAppend],
       ...effectiveExtensionPaths.length ? { additionalExtensionPaths: effectiveExtensionPaths } : {},
       ...extensionFactories.length ? { extensionFactories } : {},
-      ...opts.pi?.noContextFiles ? { noContextFiles: true } : {},
-      ...opts.pi?.noSkills ? { noSkills: true } : {},
+      ...pi.noContextFiles ? { noContextFiles: true } : {},
+      ...pi.noSkills ? { noSkills: true } : {},
       ...effectiveSkillPaths.length ? { additionalSkillPaths: effectiveSkillPaths } : {},
       // skillsOverride REPLACES Pi's resolved skill set, which includes
       // skills contributed by host-declared pi packages (e.g.
@@ -6516,7 +7129,7 @@ function createPiCodingAgentHarness(opts) {
       // Passing additionalSkillPaths is not, by itself, a request to throw
       // away package skills — those should keep flowing through Pi's loader
       // and merge with the additional paths.
-      ...opts.pi?.noSkills ? {
+      ...pi.noSkills ? {
         skillsOverride: () => loadSkills({
           cwd: opts.cwd,
           agentDir,
@@ -6647,12 +7260,12 @@ ${entry.message}`;
 }
 
 // src/server/harness/pi-coding-agent/pluginLoader.ts
-import { readdir as readdir7, stat as stat9, readFile as readFile10 } from "fs/promises";
-import { join as join11, extname as extname4, resolve as resolve8, sep as sep6, relative as relative9 } from "path";
+import { readdir as readdir8, stat as stat9, readFile as readFile10 } from "fs/promises";
+import { join as join12, extname as extname4, resolve as resolve8, sep as sep6, relative as relative9 } from "path";
 import { homedir as homedir4 } from "os";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var VALID_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs"]);
-var GLOBAL_DIR = join11(homedir4(), ".pi", "agent", "extensions");
+var GLOBAL_DIR = join12(homedir4(), ".pi", "agent", "extensions");
 var LOCAL_DIR = ".pi/extensions";
 var EXTENSIONS_JSON = ".pi/extensions.json";
 async function dirExists2(path4) {
@@ -6673,8 +7286,8 @@ async function fileExists(path4) {
 }
 async function discoverFromDir(dir, source) {
   if (!await dirExists2(dir)) return [];
-  const entries = await readdir7(dir);
-  return entries.filter((e) => VALID_EXTENSIONS.has(extname4(e))).map((e) => ({ path: join11(dir, e), source }));
+  const entries = await readdir8(dir);
+  return entries.filter((e) => VALID_EXTENSIONS.has(extname4(e))).map((e) => ({ path: join12(dir, e), source }));
 }
 function extractTools(mod) {
   const tools = [];
@@ -6704,17 +7317,17 @@ async function loadModule(filePath, importFn) {
   return extractTools(mod);
 }
 async function discoverNpmPlugins(cwd) {
-  const nodeModulesDir = join11(cwd, "node_modules");
+  const nodeModulesDir = join12(cwd, "node_modules");
   if (!await dirExists2(nodeModulesDir)) return [];
   try {
-    const entries = await readdir7(nodeModulesDir);
-    return entries.filter((e) => e.startsWith("pi-plugin-")).map((e) => join11(nodeModulesDir, e));
+    const entries = await readdir8(nodeModulesDir);
+    return entries.filter((e) => e.startsWith("pi-plugin-")).map((e) => join12(nodeModulesDir, e));
   } catch {
     return [];
   }
 }
 async function loadNpmPlugin(pkgDir, importFn) {
-  const pkgJsonPath = join11(pkgDir, "package.json");
+  const pkgJsonPath = join12(pkgDir, "package.json");
   if (!await fileExists(pkgJsonPath)) return [];
   const pkgJson = JSON.parse(await readFile10(pkgJsonPath, "utf-8"));
   const main = pkgJson.main ?? "index.js";
@@ -6730,7 +7343,7 @@ async function loadNpmPlugin(pkgDir, importFn) {
   return loadModule(resolvedMain, importFn);
 }
 async function loadExtensionsJson(cwd) {
-  const configPath = join11(cwd, EXTENSIONS_JSON);
+  const configPath = join12(cwd, EXTENSIONS_JSON);
   if (!await fileExists(configPath)) return null;
   try {
     const raw = await readFile10(configPath, "utf-8");
@@ -6748,7 +7361,7 @@ async function loadPlugins(options) {
     const globals = await discoverFromDir(GLOBAL_DIR, "global");
     candidates.push(...globals);
   }
-  const localDir = join11(options.cwd, LOCAL_DIR);
+  const localDir = join12(options.cwd, LOCAL_DIR);
   const locals = await discoverFromDir(localDir, "local");
   candidates.push(...locals);
   const npmDirs = await discoverNpmPlugins(options.cwd);
@@ -6758,7 +7371,7 @@ async function loadPlugins(options) {
   const config = await loadExtensionsJson(options.cwd);
   if (config?.npm) {
     for (const pkg of config.npm) {
-      const pkgDir = join11(options.cwd, "node_modules", pkg);
+      const pkgDir = join12(options.cwd, "node_modules", pkg);
       if (await dirExists2(pkgDir)) {
         const already = candidates.some((c) => c.path === pkgDir);
         if (!already) {
@@ -6807,8 +7420,8 @@ import {
 
 // src/server/tools/operations/bound.ts
 import { constants as constants4 } from "fs";
-import { access as access4, lstat as lstat4, mkdir as mkdir12, readFile as readFile11, readdir as readdir8, readlink, realpath as realpath4, stat as stat10, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute7, join as join12, relative as relative10, resolve as resolve9 } from "path";
+import { access as access4, lstat as lstat4, mkdir as mkdir12, readFile as readFile11, readdir as readdir9, readlink, realpath as realpath4, stat as stat10, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname11, isAbsolute as isAbsolute7, join as join13, relative as relative10, resolve as resolve9 } from "path";
 function toPosixPath(value) {
   return value.split("\\").join("/");
 }
@@ -6861,7 +7474,7 @@ function shouldSkipDir(relativePath, ignore) {
 }
 async function walkMatches(root, current, pattern, ignore, limit, out) {
   if (out.length >= limit) return;
-  const entries = await readdir8(current, { withFileTypes: true });
+  const entries = await readdir9(current, { withFileTypes: true });
   for (const entry of entries) {
     if (out.length >= limit) return;
     const absolutePath = resolve9(current, entry.name);
@@ -6939,7 +7552,7 @@ function boundFs(workspaceRoot, opts = {}) {
     const normalized = toPosixPath(absolutePath);
     if (normalized === runtimeRoot) return workspaceRoot;
     if (normalized.startsWith(`${runtimeRoot}/`)) {
-      return join12(workspaceRoot, ...normalized.slice(runtimeRoot.length + 1).split("/"));
+      return join13(workspaceRoot, ...normalized.slice(runtimeRoot.length + 1).split("/"));
     }
     return absolutePath;
   };
@@ -7043,7 +7656,7 @@ function boundFs(workspaceRoot, opts = {}) {
     async readdir(absolutePath) {
       const storagePath = toStoragePath(absolutePath);
       await assertWithinWorkspace(workspaceRoot, storagePath);
-      return await readdir8(storagePath);
+      return await readdir9(storagePath);
     }
   };
   return { read, write, edit, find, grep, ls };
@@ -7083,10 +7696,10 @@ function vercelBashOps(sandbox, opts = {}) {
   return {
     exec(command, cwd, { onData, signal, timeout, env }) {
       const effectiveEnv = opts.mergeEnv ? opts.mergeEnv(env) : env;
-      const filteredEnv = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
+      const filteredEnv2 = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
       return sandbox.exec(command, {
         cwd,
-        env: filteredEnv,
+        env: filteredEnv2,
         signal,
         timeoutMs: timeout ? timeout * 1e3 : void 0,
         onStdout: (chunk) => onData(Buffer.from(chunk)),
@@ -7470,8 +8083,7 @@ function adaptPiTool(piTool) {
 }
 function buildFilesystemAgentTools(bundle) {
   const cwd = bundle.workspace.root;
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
-  if (bundle.sandbox.provider === "vercel-sandbox") {
+  if (bundle.sandbox.provider === "vercel-sandbox" || bundle.sandbox.provider === "remote-worker") {
     return [
       adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
       adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
@@ -7481,6 +8093,7 @@ function buildFilesystemAgentTools(bundle) {
       adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
     ];
   }
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   const ops = boundFs(storageRoot, { runtimeRoot: cwd });
   return [
     adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
@@ -7616,9 +8229,9 @@ function directSpawnHook(workspaceRoot, runtime) {
 }
 var VERCEL_SAFE_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/usr/local/bin:/usr/bin:/bin";
 function bashOptionsForMode(bundle, runtime) {
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   switch (bundle.sandbox.provider) {
     case "vercel-sandbox":
+    case "remote-worker":
       return {
         operations: vercelBashOps(bundle.sandbox, {
           // The pi bash tool's env may include the host process env. Never
@@ -7627,16 +8240,20 @@ function bashOptionsForMode(bundle, runtime) {
           mergeEnv: () => mergeRuntimeEnv(runtime, { PATH: VERCEL_SAFE_DEFAULT_PATH })
         })
       };
-    case "bwrap":
+    case "bwrap": {
+      const storageRoot = getRuntimeBundleStorageRoot(bundle);
       return {
         operations: createLocalBashOperations(),
         spawnHook: bwrapSpawnHook(storageRoot, runtime)
       };
-    default:
+    }
+    default: {
+      const storageRoot = getRuntimeBundleStorageRoot(bundle);
       return {
         operations: createLocalBashOperations(),
         spawnHook: directSpawnHook(storageRoot, runtime)
       };
+    }
   }
 }
 function isRuntimeReady(readiness) {
@@ -7813,9 +8430,21 @@ var DEFAULT_BUFFER_SIZE = 1e3;
 function createFsEventBroadcaster(watcher, opts = {}) {
   const bufferSize = opts.bufferSize ?? DEFAULT_BUFFER_SIZE;
   const buffer = [];
-  const listeners = /* @__PURE__ */ new Set();
+  const listeners = /* @__PURE__ */ new Map();
   let nextSeq = 1;
   let closed = false;
+  let gapAfterSeq = null;
+  const handleControlEvent = (event) => {
+    if (closed || event.type !== "resync-required") return;
+    gapAfterSeq = nextSeq - 1;
+    buffer.length = 0;
+    for (const { onResyncRequired } of [...listeners.values()]) {
+      try {
+        onResyncRequired?.();
+      } catch {
+      }
+    }
+  };
   const watcherUnsub = watcher.subscribe((change) => {
     if (closed) return;
     const env = {
@@ -7826,13 +8455,13 @@ function createFsEventBroadcaster(watcher, opts = {}) {
     };
     buffer.push(env);
     if (buffer.length > bufferSize) buffer.shift();
-    for (const l of [...listeners]) {
+    for (const l of [...listeners.keys()]) {
       try {
         l(env);
       } catch {
       }
     }
-  });
+  }, { onControlEvent: handleControlEvent });
   return {
     subscribe(listener, sopts) {
       if (closed) {
@@ -7843,13 +8472,13 @@ function createFsEventBroadcaster(watcher, opts = {}) {
       let resyncRequired = false;
       if (typeof sopts?.lastSeenSeq === "number" && sopts.lastSeenSeq > 0) {
         const head = buffer.length > 0 ? buffer[0].seq : nextSeq;
-        if (sopts.lastSeenSeq < head - 1) {
+        if (gapAfterSeq != null && sopts.lastSeenSeq <= gapAfterSeq || sopts.lastSeenSeq < head - 1) {
           resyncRequired = true;
         } else {
           replay = buffer.filter((e) => e.seq > sopts.lastSeenSeq);
         }
       }
-      listeners.add(listener);
+      listeners.set(listener, { onResyncRequired: sopts?.onResyncRequired });
       return {
         replay,
         resyncRequired,
@@ -7877,11 +8506,20 @@ function fsEventsRoutes(app, opts, done) {
   const ensureBroadcaster = async (request) => {
     const workspace = opts.getWorkspace ? await opts.getWorkspace(request) : opts.workspace;
     if (!workspace) throw new Error("fs event route requires workspace or getWorkspace");
-    if (typeof workspace.watch !== "function") return null;
+    if (typeof workspace.watch !== "function") {
+      return { unsupported: { reason: "watch_not_implemented" } };
+    }
     const workspaceId = request.workspaceContext?.workspaceId ?? "default";
     const existing = broadcasters.get(workspaceId);
     if (existing) return { workspaceId, entry: existing };
-    const broadcaster = createFsEventBroadcaster(workspace.watch());
+    const watcher = workspace.watch();
+    const readiness = await watcher.whenReady?.() ?? { ok: true };
+    if (!readiness.ok) {
+      return { unsupported: { reason: readiness.reason, ...readiness.message ? { message: readiness.message } : {} } };
+    }
+    const existingAfterWait = broadcasters.get(workspaceId);
+    if (existingAfterWait) return { workspaceId, entry: existingAfterWait };
+    const broadcaster = createFsEventBroadcaster(watcher);
     const entry = { broadcaster, subscribers: 0 };
     broadcasters.set(workspaceId, entry);
     return { workspaceId, entry };
@@ -7901,8 +8539,8 @@ function fsEventsRoutes(app, opts, done) {
     const resolved = await ensureBroadcaster(request);
     reply.hijack();
     setupSse(request, reply.raw);
-    if (!resolved) {
-      writeSse(reply.raw, "unsupported", { reason: "watch_not_implemented" });
+    if ("unsupported" in resolved) {
+      writeSse(reply.raw, "unsupported", resolved.unsupported);
       reply.raw.end();
       return;
     }
@@ -7913,7 +8551,10 @@ function fsEventsRoutes(app, opts, done) {
     try {
       sub = entry.broadcaster.subscribe(
         (env) => writeChange(reply.raw, env),
-        lastSeenSeq != null ? { lastSeenSeq } : void 0
+        {
+          ...lastSeenSeq != null ? { lastSeenSeq } : {},
+          onResyncRequired: () => writeSse(reply.raw, "resync-required", {})
+        }
       );
     } catch (error) {
       releaseBroadcaster(workspaceId, entry);
@@ -7924,10 +8565,6 @@ function fsEventsRoutes(app, opts, done) {
     }
     if (sub.resyncRequired) {
       writeSse(reply.raw, "resync-required", {});
-      sub.unsubscribe();
-      releaseBroadcaster(workspaceId, entry);
-      reply.raw.end();
-      return;
     }
     for (const env of sub.replay) writeChange(reply.raw, env);
     const heartbeat = setInterval(() => {
@@ -8128,8 +8765,8 @@ function skillsRoutes(app, opts, done) {
       const workspaceRoot = opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(request) : opts.workspaceRoot;
       const additionalSkillPaths = opts.getAdditionalSkillPaths ? await opts.getAdditionalSkillPaths(request) : opts.additionalSkillPaths;
       const piPackages = opts.getPiPackages ? await opts.getPiPackages(request) : opts.piPackages;
-      const noSkills = opts.getNoSkills ? await opts.getNoSkills(request) : opts.noSkills;
-      const cacheKey = JSON.stringify([workspaceRoot, additionalSkillPaths ?? [], piPackages ?? [], Boolean(noSkills)]);
+      const noSkills = (opts.getNoSkills ? await opts.getNoSkills(request) : opts.noSkills) ?? withPiHarnessDefaults().noSkills;
+      const cacheKey = JSON.stringify([workspaceRoot, additionalSkillPaths ?? [], piPackages ?? [], noSkills]);
       const now = Date.now();
       for (const [key, entry] of cached) {
         if (entry.expiresAt <= now) cached.delete(key);
@@ -8158,7 +8795,7 @@ function skillsRoutes(app, opts, done) {
         cwd: workspaceRoot,
         agentDir,
         skillPaths: [...packageSkillPaths, ...additionalSkillPaths ?? []],
-        includeDefaults: false
+        includeDefaults: !noSkills
       });
       const skills = result.skills.map((s) => ({
         name: s.name,
@@ -8567,6 +9204,7 @@ function statusCodeFromError(err) {
   }
   const parsedCode = ErrorCode.safeParse(err?.code);
   if (parsedCode.success && parsedCode.data === ErrorCode.enum.SESSION_NOT_FOUND) return 404;
+  if (parsedCode.success && parsedCode.data === ErrorCode.enum.PAYMENT_REQUIRED) return 402;
   return 500;
 }
 
@@ -9012,9 +9650,10 @@ function gitRoutes(app, opts, done) {
     if (path4 === null) return;
     const workspaceRoot = await resolveWorkspaceRoot(request);
     if (!workspaceRoot) {
-      return reply.code(500).send({
-        error: { code: ERROR_CODE_INTERNAL, message: "workspace root unavailable" }
-      });
+      return {
+        enabled: false,
+        reason: "Git file URLs are unavailable for this runtime."
+      };
     }
     try {
       return await resolveGitFileUrl(workspaceRoot, path4);
@@ -9406,7 +10045,9 @@ var PiChatEventMapper = class {
         const mapped = [
           ...this.mapAgentEndFinalAssistant(event, turnId),
           ...this.mapAgentEndError(event, turnId, status),
-          this.event({ type: "agent-end", turnId, status })
+          // willRetry marks a non-terminal end (auto-retry coming) so once-per-settle
+          // consumers can ignore it; mirrors mapAgentEndError's own willRetry gate.
+          this.event({ type: "agent-end", turnId, status, ...event.willRetry === true ? { willRetry: true } : {} })
         ];
         this.activeAssistantMessageId = void 0;
         this.toolCallMessageIds.clear();
@@ -10105,6 +10746,454 @@ function messageCreatedAtMs(message) {
   return Number.isFinite(timestamp) ? timestamp : void 0;
 }
 
+// src/server/pi-chat/metering.ts
+var meteringLogger = createLogger("pi-chat-metering");
+var defaultMeteringErrorLogger = (message, error) => {
+  meteringLogger.warn(message, { error });
+};
+function promptRunId(sessionId, clientNonce) {
+  return `pi-run:${sessionId}:prompt:${clientNonce}`;
+}
+function followUpRunId(sessionId, clientNonce, clientSeq) {
+  return `pi-run:${sessionId}:followup:${clientNonce}:${clientSeq}`;
+}
+function followUpMatches(run2, selector) {
+  const fu = run2.followUp;
+  if (!fu) return false;
+  if (selector.clientNonce !== void 0) return fu.clientNonce === selector.clientNonce;
+  if (selector.clientSeq !== void 0) return fu.clientSeq === selector.clientSeq;
+  return false;
+}
+function takeQueuedFollowUp(state, selector) {
+  const index = state.queued.findIndex((run2) => followUpMatches(run2, selector));
+  if (index < 0) return void 0;
+  return state.queued.splice(index, 1)[0];
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readTokenCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function normalizeMeteringUsage(value) {
+  if (!isRecord3(value)) return void 0;
+  const cost = isRecord3(value.cost) ? value.cost : {};
+  return {
+    input: readTokenCount(value.input),
+    output: readTokenCount(value.output),
+    cacheRead: readTokenCount(value.cacheRead),
+    cacheWrite: readTokenCount(value.cacheWrite),
+    cost: {
+      input: readTokenCount(cost.input),
+      output: readTokenCount(cost.output),
+      cacheRead: readTokenCount(cost.cacheRead),
+      cacheWrite: readTokenCount(cost.cacheWrite),
+      total: readTokenCount(cost.total)
+    }
+  };
+}
+var PiChatMeteringCoordinator = class {
+  sessions = /* @__PURE__ */ new Map();
+  inflightOps = /* @__PURE__ */ new Set();
+  runInstances = 0;
+  sink;
+  logError;
+  constructor(sink, logError) {
+    this.sink = sink;
+    this.logError = logError ?? defaultMeteringErrorLogger;
+  }
+  /** Reserve a prompt run. Throws (fail closed) when the sink rejects. */
+  async reservePrompt(input) {
+    const state = this.sessionState(input.sessionId);
+    const runId = promptRunId(input.sessionId, input.clientNonce);
+    const existing = this.findRun(state, runId);
+    if (existing) {
+      await existing.reservation;
+      return "duplicate";
+    }
+    const run2 = this.createRun(input, "prompt", runId);
+    state.pendingPrompts.push(run2);
+    return this.materializeReservation(state, run2, input);
+  }
+  /** Reserve a follow-up run. Throws (fail closed) when the sink rejects.
+   * Returns 'duplicate' when this selector already has a tracked/consumed run. */
+  async reserveFollowUp(input) {
+    const state = this.sessionState(input.sessionId);
+    const runId = followUpRunId(input.sessionId, input.clientNonce, input.clientSeq);
+    const existing = this.findRun(state, runId);
+    if (existing) {
+      await existing.reservation;
+      return "duplicate";
+    }
+    if (state.consumedFollowUpNonces.has(input.clientNonce)) return "duplicate";
+    const run2 = this.createRun(input, "followup", runId);
+    run2.followUp = { clientNonce: input.clientNonce, clientSeq: input.clientSeq };
+    state.queued.push(run2);
+    return this.materializeReservation(state, run2, input);
+  }
+  /**
+   * Acquire the reservation for a freshly-registered run. The reserve is put on
+   * the run's ops chain so a concurrent release/settle is ordered strictly
+   * after the reservation row exists. Returns 'cancelled' (skip execution) when
+   * a concurrent stop/interrupt/delete terminated the run while the reserve was
+   * in flight; throws (fail closed) when the sink rejects.
+   */
+  async materializeReservation(state, run2, input) {
+    run2.reservation = this.applyReservation(run2, input);
+    const reserveOp = run2.reservation.catch(() => {
+    });
+    run2.ops = reserveOp;
+    this.inflightOps.add(reserveOp);
+    void reserveOp.finally(() => this.inflightOps.delete(reserveOp));
+    try {
+      await run2.reservation;
+    } catch (err) {
+      this.removeReservingRun(state, run2, input.sessionId);
+      throw err;
+    }
+    return run2.terminal ? "cancelled" : "created";
+  }
+  /** True while a non-terminal prompt run exists for this nonce (accept →
+   * agent-end). Used to suppress duplicate-nonce execution for the full run
+   * lifetime, not just until the user message-start is consumed. */
+  hasPromptRun(sessionId, clientNonce) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return false;
+    const run2 = this.findRun(state, promptRunId(sessionId, clientNonce));
+    return run2 !== void 0 && !run2.terminal;
+  }
+  /** True while a non-terminal follow-up run exists for this selector (queued
+   * or consumed-and-active). Used to suppress duplicate follow-up enqueues. */
+  hasFollowUpRun(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return false;
+    if (selector.clientNonce !== void 0 && state.consumedFollowUpNonces.has(selector.clientNonce)) return true;
+    if (state.queued.some((run2) => followUpMatches(run2, selector))) return true;
+    const active = state.active;
+    return active !== void 0 && !active.terminal && active.followUp !== void 0 && followUpMatches(active, selector);
+  }
+  /** The accepted prompt failed before/without running (sync throw or run rejection). */
+  failPromptRun(sessionId, clientNonce) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const runId = promptRunId(sessionId, clientNonce);
+    const pendingIndex = state.pendingPrompts.findIndex((run2) => run2.scope.runId === runId);
+    if (pendingIndex >= 0) {
+      const [run2] = state.pendingPrompts.splice(pendingIndex, 1);
+      if (run2) this.finishRun(run2, "error");
+    } else if (state.active?.scope.runId === runId) {
+      this.finishRun(state.active, "error");
+      state.active = void 0;
+    }
+    this.pruneSession(sessionId, state);
+  }
+  /** A queued follow-up was rejected by the adapter before being queued. */
+  failFollowUpRun(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    this.release(run2, "run-rejected");
+    this.pruneSession(sessionId, state);
+  }
+  /**
+   * A queued follow-up is being re-posted as a plain prompt (interrupt
+   * fallback for runtimes without continueQueuedFollowUp). No
+   * `followup-consumed` event will arrive, so bind its reservation to the
+   * next agent-start instead.
+   */
+  promoteQueuedToPrompt(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    state.pendingPrompts.push(run2);
+  }
+  /**
+   * A promoted-to-prompt follow-up failed before agent-start (the fallback
+   * repost rejected). Release its reservation instead of stranding it in
+   * pendingPrompts, where a later agent-start would otherwise misattribute
+   * usage to it.
+   */
+  failPromotedFollowUp(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state || selector.clientNonce === void 0 || selector.clientSeq === void 0) return;
+    const runId = followUpRunId(sessionId, selector.clientNonce, selector.clientSeq);
+    const index = state.pendingPrompts.findIndex((run3) => run3.scope.runId === runId);
+    if (index < 0) return;
+    const [run2] = state.pendingPrompts.splice(index, 1);
+    if (run2) this.release(run2, "run-rejected");
+    this.pruneSession(sessionId, state);
+  }
+  /**
+   * Release prompt runs reserved but not yet bound to an agent-start —
+   * e.g. a stop/interrupt landing in the window between acceptance and the
+   * native agent_start. Without this they would sit `active` in the store
+   * until their TTL, holding the user's balance. No charge.
+   */
+  releasePending(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const run2 of state.pendingPrompts) this.release(run2, "cancelled");
+    state.pendingPrompts = [];
+    this.pruneSession(sessionId, state);
+  }
+  /** Queue cleared via selector or entirely; release affected reservations. */
+  releaseQueued(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    if (selector) {
+      const run2 = takeQueuedFollowUp(state, selector);
+      if (run2) this.release(run2, "queue-cleared");
+    } else {
+      for (const run2 of state.queued) this.release(run2, "queue-cleared");
+      state.queued = [];
+    }
+    this.pruneSession(sessionId, state);
+  }
+  /** Session deleted: tear down every non-terminal run without charging. */
+  releaseSession(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const run2 of state.queued) this.release(run2, "cancelled");
+    for (const run2 of state.pendingPrompts) this.release(run2, "cancelled");
+    if (state.active) this.finishRun(state.active, "aborted");
+    this.sessions.delete(sessionId);
+  }
+  /**
+   * Feed one native adapter event and its mapped PiChatEvents through the
+   * correlation state machine. Must be called after the mapped events were
+   * published (the mapper assigns turn ids during mapping).
+   */
+  observe(sessionId, nativeEvent, mappedEvents) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const event of mappedEvents) {
+      switch (event.type) {
+        case "agent-start": {
+          let next = state.pendingPrompts.shift();
+          while (next && next.terminal) next = state.pendingPrompts.shift();
+          if (next) {
+            if (state.active && !state.active.terminal) this.finishRun(state.active, "ok");
+            state.active = next;
+          }
+          break;
+        }
+        case "message-start": {
+          if (event.role === "user" && event.clientSeq !== void 0) {
+            this.consumeFollowUp(state, event);
+          }
+          break;
+        }
+        case "followup-consumed": {
+          this.consumeFollowUp(state, event);
+          break;
+        }
+        case "auto-retry-start": {
+          if (state.active) {
+            state.active.recordedMessageIds.clear();
+            state.active.lastIdlessUsageKey = void 0;
+          }
+          break;
+        }
+        case "agent-end": {
+          this.harvestAgentEndUsage(state, nativeEvent);
+          if (isRecord3(nativeEvent) && nativeEvent.willRetry === true) break;
+          if (state.active && !state.active.terminal) this.finishRun(state.active, event.status);
+          state.active = void 0;
+          break;
+        }
+        default:
+          break;
+      }
+    }
+    this.observeMessageEndUsage(state, nativeEvent);
+    this.pruneSession(sessionId, state);
+  }
+  /** Promote a queued follow-up to the active run, settling the previous one. */
+  consumeFollowUp(state, selector) {
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    if (run2.followUp?.clientNonce) state.consumedFollowUpNonces.add(run2.followUp.clientNonce);
+    if (state.active && !state.active.terminal) this.finishRun(state.active, "ok");
+    state.active = run2;
+  }
+  /** Test/diagnostic hook: resolves after every queued sink call settles. */
+  async flush() {
+    while (this.inflightOps.size > 0) {
+      await Promise.all([...this.inflightOps]);
+    }
+  }
+  observeMessageEndUsage(state, nativeEvent) {
+    if (!isRecord3(nativeEvent) || nativeEvent.type !== "message_end") return;
+    this.recordAssistantUsage(state, nativeEvent.message);
+  }
+  /**
+   * Some failure/abort paths never emit message_end; the final assistant
+   * message (and its usage) only rides on agent_end's messages array. Runs
+   * with already-recorded usage dedupe via recordedMessageIds.
+   */
+  harvestAgentEndUsage(state, nativeEvent) {
+    if (!isRecord3(nativeEvent) || !Array.isArray(nativeEvent.messages)) return;
+    for (let index = nativeEvent.messages.length - 1; index >= 0; index -= 1) {
+      const message = nativeEvent.messages[index];
+      if (!isRecord3(message) || message.role !== "assistant") continue;
+      this.recordAssistantUsage(state, message, { isAgentEndFinal: true });
+      return;
+    }
+  }
+  recordAssistantUsage(state, message, opts = {}) {
+    if (!isRecord3(message) || message.role !== "assistant") return;
+    const usage = normalizeMeteringUsage(message.usage);
+    if (!usage) return;
+    const run2 = state.active ?? state.pendingPrompts[0];
+    if (!run2 || run2.terminal) {
+      this.logError("assistant usage arrived with no reserved run; usage not metered", { messageRole: "assistant" });
+      return;
+    }
+    const messageId = typeof message.id === "string" && message.id.length > 0 ? message.id : void 0;
+    if (messageId) {
+      if (run2.recordedMessageIds.has(messageId)) return;
+      run2.recordedMessageIds.add(messageId);
+    } else {
+      const stopReason2 = typeof message.stopReason === "string" ? message.stopReason : "";
+      const signature = `sig:${usage.input}:${usage.output}:${usage.cacheRead}:${usage.cacheWrite}:${usage.cost.total}:${stopReason2}`;
+      if (opts.isAgentEndFinal && signature === run2.lastIdlessUsageKey) return;
+      run2.lastIdlessUsageKey = signature;
+    }
+    run2.usageCount += 1;
+    const model = typeof message.model === "string" && message.model.length > 0 ? message.model : void 0;
+    const provider = typeof message.provider === "string" && message.provider.length > 0 ? message.provider : void 0;
+    const stopReason = typeof message.stopReason === "string" ? message.stopReason : void 0;
+    const usageId = messageId ? `pi-usage:${run2.scope.sessionId}:message:${messageId}` : run2.reservationId ? `pi-usage:reservation:${run2.reservationId}:${run2.usageCount}` : `pi-usage:${run2.scope.runId}:${run2.instanceId}:${run2.usageCount}`;
+    this.enqueue(
+      run2,
+      async () => {
+        try {
+          const result = await this.sink.recordUsage({
+            ...run2.scope,
+            reservationId: run2.reservationId,
+            usageId,
+            messageId,
+            model: model || provider ? { provider, id: model } : void 0,
+            usage,
+            stopReason
+          });
+          if (result.billedMicros > 0) run2.billableUsageCount += 1;
+        } catch (error) {
+          const couldBill = usage.input + usage.output + usage.cacheRead + usage.cacheWrite > 0 || usage.cost.total > 0;
+          if (couldBill) run2.usageWriteFailed = true;
+          throw error;
+        }
+      },
+      "recordUsage failed"
+    );
+  }
+  /** Build a run synchronously (no await) so it can be registered before the
+   * reserve sink call, closing the concurrent-duplicate race. */
+  createRun(input, kind, runId) {
+    return {
+      scope: {
+        workspaceId: input.workspaceId,
+        userId: input.userId,
+        sessionId: input.sessionId,
+        runId,
+        source: "pi-chat"
+      },
+      kind,
+      reservationId: void 0,
+      instanceId: this.runInstances += 1,
+      usageCount: 0,
+      billableUsageCount: 0,
+      recordedMessageIds: /* @__PURE__ */ new Set(),
+      lastIdlessUsageKey: void 0,
+      usageWriteFailed: false,
+      reservation: Promise.resolve(),
+      terminal: false,
+      ops: Promise.resolve()
+    };
+  }
+  /** Acquire the host reservation; throws (fail closed) on a rejecting sink. */
+  async applyReservation(run2, input) {
+    const result = await this.sink.reserveRun({
+      ...run2.scope,
+      kind: run2.kind,
+      message: input.message,
+      model: input.model
+    });
+    run2.reservationId = result?.reservationId;
+  }
+  /** Remove a still-reserving run whose reservation failed, from either list. */
+  removeReservingRun(state, run2, sessionId) {
+    const pendingIndex = state.pendingPrompts.indexOf(run2);
+    if (pendingIndex >= 0) state.pendingPrompts.splice(pendingIndex, 1);
+    const queuedIndex = state.queued.indexOf(run2);
+    if (queuedIndex >= 0) state.queued.splice(queuedIndex, 1);
+    this.pruneSession(sessionId, state);
+  }
+  findRun(state, runId) {
+    if (state.active && !state.active.terminal && state.active.scope.runId === runId) return state.active;
+    const pending = state.pendingPrompts.find((run2) => run2.scope.runId === runId);
+    if (pending) return pending;
+    return state.queued.find((run2) => run2.scope.runId === runId);
+  }
+  finishRun(run2, status) {
+    if (run2.terminal) return;
+    run2.terminal = true;
+    this.enqueue(
+      run2,
+      () => {
+        if (run2.usageWriteFailed) {
+          return this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason: "usage-write-failed" });
+        }
+        if (run2.billableUsageCount > 0) {
+          return this.sink.settleRun({ ...run2.scope, reservationId: run2.reservationId, status });
+        }
+        const didPaidWork = status === "ok";
+        if (didPaidWork) {
+          return this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason: "fallback-hold-charge" });
+        }
+        return this.sink.releaseRun({
+          ...run2.scope,
+          reservationId: run2.reservationId,
+          reason: status === "error" ? "error-before-usage" : "cancelled"
+        });
+      },
+      "finishRun failed"
+    );
+  }
+  release(run2, reason) {
+    if (run2.terminal) return;
+    run2.terminal = true;
+    this.enqueue(
+      run2,
+      () => this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason }),
+      "releaseRun failed"
+    );
+  }
+  enqueue(run2, op, failureMessage) {
+    const chained = run2.ops.then(op).catch((error) => {
+      this.logError(`${failureMessage} (run ${run2.scope.runId})`, error);
+    });
+    run2.ops = chained;
+    this.inflightOps.add(chained);
+    void chained.finally(() => this.inflightOps.delete(chained));
+  }
+  sessionState(sessionId) {
+    let state = this.sessions.get(sessionId);
+    if (!state) {
+      state = { pendingPrompts: [], queued: [], consumedFollowUpNonces: /* @__PURE__ */ new Set() };
+      this.sessions.set(sessionId, state);
+    }
+    return state;
+  }
+  pruneSession(sessionId, state) {
+    if (!state.active && state.pendingPrompts.length === 0 && state.queued.length === 0 && state.consumedFollowUpNonces.size === 0) {
+      this.sessions.delete(sessionId);
+    }
+  }
+};
+
 // src/server/pi-chat/harnessPiChatService.ts
 var HarnessPiChatService = class {
   harness;
@@ -10120,10 +11209,16 @@ var HarnessPiChatService = class {
   activePromptRuns = /* @__PURE__ */ new Map();
   syntheticPromptFailures = /* @__PURE__ */ new Map();
   activeSyntheticPromptErrors = /* @__PURE__ */ new Map();
+  metering;
   constructor(options) {
     this.harness = options.harness;
     this.sessionStore = options.sessionStore;
     this.workdir = options.workdir;
+    this.metering = options.metering ? new PiChatMeteringCoordinator(options.metering, options.meteringLogger) : void 0;
+  }
+  /** Test/diagnostic hook: resolves once queued metering sink calls settle. */
+  async flushMetering() {
+    await this.metering?.flush();
   }
   async listSessions(ctx, options) {
     return this.sessionStore.list(toSessionCtx(ctx), options);
@@ -10132,8 +11227,16 @@ var HarnessPiChatService = class {
     return this.sessionStore.create(toSessionCtx(ctx), init);
   }
   async deleteSession(ctx, sessionId) {
-    this.channels.get(sessionId)?.unsubscribe();
+    const channel = this.channels.get(sessionId);
+    if (channel) {
+      const activeRun = this.activePromptRuns.get(sessionId);
+      await channel.adapter.abort();
+      await activeRun?.catch(() => {
+      });
+    }
+    channel?.unsubscribe();
     this.channels.delete(sessionId);
+    this.metering?.releaseSession(sessionId);
     this.messageMetadata.clearSession(sessionId);
     this.syntheticPromptFailures.delete(sessionId);
     this.activeSyntheticPromptErrors.delete(sessionId);
@@ -10183,16 +11286,35 @@ var HarnessPiChatService = class {
   async prompt(ctx, sessionId, payload) {
     const adapter = await this.getAdapter(ctx, sessionId, payload);
     await this.ensureChannel(ctx, sessionId, adapter);
+    const outcome = await this.metering?.reservePrompt({
+      workspaceId: ctx.workspaceId,
+      userId: ctx.authSubject,
+      sessionId,
+      clientNonce: payload.clientNonce,
+      message: payload.message,
+      model: payload.model
+    }) ?? "created";
+    if (outcome === "duplicate") {
+      return {
+        accepted: true,
+        cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0,
+        clientNonce: payload.clientNonce,
+        duplicate: true
+      };
+    }
+    if (outcome === "cancelled") throw promptCancelledError();
     this.messageMetadata.recordPrompt(sessionId, payload);
     const channel = this.channels.get(sessionId);
     const receiptCursor = nextPromptReceiptCursor(channel);
     try {
       const run2 = this.trackActiveRun(sessionId, adapter.prompt(toPiPromptInput(payload)));
       run2.catch((error) => {
+        this.metering?.failPromptRun(sessionId, payload.clientNonce);
         if (!this.messageMetadata.hasPrompt(sessionId, { clientNonce: payload.clientNonce, displayText: payload.displayMessage ?? payload.message })) return;
         this.publishPromptRunError(sessionId, channel, payload, error);
       });
     } catch (err) {
+      this.metering?.failPromptRun(sessionId, payload.clientNonce);
       this.messageMetadata.removePrompt(sessionId, { clientNonce: payload.clientNonce });
       throw err;
     }
@@ -10201,6 +11323,25 @@ var HarnessPiChatService = class {
   async followUp(ctx, sessionId, payload) {
     const adapter = await this.getAdapter(ctx, sessionId, payload.message);
     await this.ensureChannel(ctx, sessionId, adapter);
+    const outcome = await this.metering?.reserveFollowUp({
+      workspaceId: ctx.workspaceId,
+      userId: ctx.authSubject,
+      sessionId,
+      clientNonce: payload.clientNonce,
+      clientSeq: payload.clientSeq,
+      message: payload.message
+    }) ?? "created";
+    if (outcome === "duplicate") {
+      return {
+        accepted: true,
+        queued: true,
+        cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0,
+        clientNonce: payload.clientNonce,
+        clientSeq: payload.clientSeq,
+        duplicate: true
+      };
+    }
+    if (outcome === "cancelled") throw promptCancelledError();
     this.messageMetadata.recordFollowUp(sessionId, payload);
     try {
       await adapter.followUp(payload.message, {
@@ -10209,6 +11350,7 @@ var HarnessPiChatService = class {
         clientSeq: payload.clientSeq
       });
     } catch (err) {
+      this.metering?.failFollowUpRun(sessionId, payload);
       this.messageMetadata.removeFollowUp(sessionId, payload);
       throw err;
     }
@@ -10220,10 +11362,14 @@ var HarnessPiChatService = class {
       const before = adapter.readSnapshot().followUpMessages.length;
       adapter.clearFollowUp(payload);
       const after = adapter.readSnapshot().followUpMessages.length;
-      if (after < before) this.messageMetadata.removeFollowUp(sessionId, payload);
+      if (after < before) {
+        this.messageMetadata.removeFollowUp(sessionId, payload);
+        this.metering?.releaseQueued(sessionId, payload);
+      }
       return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, cleared: Math.max(0, before - after) };
     }
     const clearedQueue = this.clearAllFollowUps(adapter, sessionId);
+    this.metering?.releaseQueued(sessionId);
     return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, cleared: clearedQueue.length };
   }
   async interrupt(ctx, sessionId, _payload) {
@@ -10236,12 +11382,15 @@ var HarnessPiChatService = class {
     if (wasActive) await adapter.abort();
     await activeRun?.catch(() => {
     });
+    this.metering?.releasePending(sessionId);
     if (nextFollowUp) await this.autoPostInterruptedFollowUp(sessionId, adapter, nextFollowUp);
     return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0 };
   }
   async stop(ctx, sessionId, _payload) {
     const adapter = await this.getAdapter(ctx, sessionId, "");
     const clearedQueue = this.clearAllFollowUps(adapter, sessionId);
+    this.metering?.releaseQueued(sessionId);
+    this.metering?.releasePending(sessionId);
     await adapter.abort();
     return { accepted: true, stopped: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, clearedQueue: buildPiChatQueuedFollowUps(sessionId, clearedQueue) };
   }
@@ -10263,13 +11412,24 @@ var HarnessPiChatService = class {
     const metadata = this.messageMetadata.findFollowUpForQueueItem(sessionId, followUp);
     this.messageMetadata.recordConsumingFollowUp(sessionId, followUp, metadata?.serverText);
     if (adapter.continueQueuedFollowUp) {
-      await this.trackActiveRun(sessionId, adapter.continueQueuedFollowUp());
+      try {
+        await this.trackActiveRun(sessionId, adapter.continueQueuedFollowUp());
+      } catch (err) {
+        this.metering?.failFollowUpRun(sessionId, followUp);
+        throw err;
+      }
       return;
     }
     if (!this.canClearAutoPostedFollowUpForFallback(adapter, followUp)) {
       throw new AutoPostFollowUpError("Cannot auto-post queued follow-up because this runtime cannot safely remove only the consumed queued item.");
     }
-    await this.runPrompt(sessionId, adapter, metadata?.serverText ?? followUp.displayText);
+    this.metering?.promoteQueuedToPrompt(sessionId, followUp);
+    try {
+      await this.runPrompt(sessionId, adapter, metadata?.serverText ?? followUp.displayText);
+    } catch (err) {
+      this.metering?.failPromotedFollowUp(sessionId, followUp);
+      throw err;
+    }
     this.clearAutoPostedFollowUpForFallback(sessionId, adapter, followUp);
   }
   async runPrompt(sessionId, adapter, input) {
@@ -10414,10 +11574,14 @@ var HarnessPiChatService = class {
     const channel = { buffer, adapter, unsubscribe: () => {
     }, mapper, messageTurnIds: /* @__PURE__ */ new Map() };
     const unsubscribe = adapter.subscribe((event) => {
-      for (const mapped of mapper.map(event)) {
+      const mappedEvents = mapper.map(event);
+      const enrichedEvents = [];
+      for (const mapped of mappedEvents) {
         const enriched = this.messageMetadata.enrichEvent(sessionId, mapped);
+        enrichedEvents.push(enriched);
         this.publishChannelEvent(sessionId, channel, enriched);
       }
+      this.metering?.observe(sessionId, event, enrichedEvents);
     });
     channel.unsubscribe = unsubscribe;
     this.channels.set(sessionId, channel);
@@ -10426,6 +11590,13 @@ var HarnessPiChatService = class {
 };
 var AutoPostFollowUpError = class extends Error {
 };
+function promptCancelledError() {
+  return Object.assign(new Error("request cancelled before execution"), {
+    statusCode: 409,
+    code: ErrorCode.enum.ABORTED,
+    retryable: true
+  });
+}
 function nextPromptReceiptCursor(channel) {
   return (channel?.buffer.latestSeq ?? 0) + 1;
 }
@@ -10558,7 +11729,8 @@ async function createAgentApp(opts = {}) {
     templatePath
   });
   const pluginTools = [];
-  if (modeAdapter.workspaceFsCapability === "strong") {
+  const externalPluginsEnabled = opts.externalPlugins !== false;
+  if (externalPluginsEnabled && modeAdapter.workspaceFsCapability === "strong") {
     const pluginResult = await loadPlugins({ cwd: workspaceRoot });
     if (pluginResult.errors.length > 0) {
       for (const e of pluginResult.errors) {
@@ -10571,7 +11743,7 @@ async function createAgentApp(opts = {}) {
   }
   const getRuntimeProvisioning = opts.getRuntimeProvisioning ?? (() => opts.runtimeProvisioning);
   const runtimePi = {
-    ...opts.pi,
+    ...withPiHarnessDefaults(opts.pi),
     additionalSkillPaths: [
       ...getRuntimeProvisioning()?.skillPaths ?? [],
       ...opts.pi?.additionalSkillPaths ?? []
@@ -10589,21 +11761,17 @@ async function createAgentApp(opts = {}) {
     ...opts.disableDefaultFileTools ? [] : buildFilesystemAgentTools(runtimeBundle),
     ...opts.extraTools ?? [],
     ...pluginTools,
-    createPluginDiagnosticsTool({
+    ...externalPluginsEnabled ? [createPluginDiagnosticsTool({
       getLastReloadDiagnostics: () => lastReloadDiagnostics,
       getHarness: () => harnessRef,
       ...opts.getPluginDiagnostics ? {
         getPluginErrors: () => opts.getPluginDiagnostics({ workspaceId: sessionId, workspaceRoot })
       } : {}
-    })
+    })] : []
   ];
   const harnessFactory = opts.harnessFactory ?? ((input) => createPiCodingAgentHarness({
     ...input,
-    pi: {
-      noContextFiles: true,
-      noSkills: true,
-      ...runtimePi
-    }
+    pi: runtimePi
   }));
   const harness = await harnessFactory({
     tools,
@@ -10638,11 +11806,17 @@ async function createAgentApp(opts = {}) {
   await app.register(fsEventsRoutes, { workspace: runtimeBundle.workspace });
   await app.register(treeRoutes, { workspace: runtimeBundle.workspace });
   await app.register(searchRoutes, { fileSearch: runtimeBundle.fileSearch });
-  await app.register(gitRoutes, { getWorkspaceRoot: () => getRuntimeBundleStorageRoot(runtimeBundle) });
+  await app.register(gitRoutes, {
+    getWorkspaceRoot: () => {
+      if (runtimeBundle.sandbox.provider === "remote-worker") return void 0;
+      return getRuntimeBundleStorageRoot(runtimeBundle);
+    }
+  });
   const piChatService = new HarnessPiChatService({
     harness,
     sessionStore: harness.sessions,
-    workdir: runtimeBundle.workspace.root
+    workdir: runtimeBundle.workspace.root,
+    metering: opts.metering
   });
   await app.register(piChatRoutes, { service: piChatService });
   await app.register(systemPromptRoutes, { harness });
@@ -10739,7 +11913,7 @@ function mergeTools(options) {
 
 // src/server/tools/upload/index.ts
 import { readFile as readFile12 } from "fs/promises";
-import { extname as extname5, join as join13 } from "path";
+import { extname as extname5, join as join14 } from "path";
 var DEFAULT_UPLOAD_DIR = "assets/images";
 var MAX_UPLOAD_BYTES2 = 10 * 1024 * 1024;
 function contentTypeFromExt(path4) {
@@ -10779,7 +11953,6 @@ function basenameForUpload2(filename) {
 }
 function buildUploadAgentTools(bundle) {
   const { workspace } = bundle;
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   return [
     {
       name: "upload_file",
@@ -10808,7 +11981,7 @@ function buildUploadAgentTools(bundle) {
         const rawDir = typeof input.directory === "string" ? input.directory.trim() : "";
         const dir = rawDir ? rawDir.replace(/^\.\/+/, "").replace(/\/+$/, "") : DEFAULT_UPLOAD_DIR;
         try {
-          const bytes = workspace.readBinaryFile ? Buffer.from(await workspace.readBinaryFile(filePath)) : await readFile12(join13(storageRoot, filePath));
+          const bytes = workspace.readBinaryFile ? Buffer.from(await workspace.readBinaryFile(filePath)) : await readFile12(join14(getRuntimeBundleStorageRoot(bundle), filePath));
           if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES2) {
             return {
               content: [{ type: "text", text: `file must be between 1 byte and ${MAX_UPLOAD_BYTES2} bytes` }],
@@ -10962,6 +12135,7 @@ var registerAgentRoutes = async (app, opts) => {
   });
   const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function" || typeof opts.getTemplatePath === "function" || typeof opts.getPi === "function" || typeof opts.getSessionNamespace === "function" || typeof opts.getSystemPromptDynamic === "function";
   const sessionChangesTracker = new InMemorySessionChangesTracker();
+  const externalPluginsEnabled = opts.externalPlugins !== false;
   const runtimeBindings = /* @__PURE__ */ new Map();
   const MAX_RUNTIME_BINDINGS = 256;
   function evictRuntimeBindings() {
@@ -10971,10 +12145,13 @@ var registerAgentRoutes = async (app, opts) => {
       runtimeBindings.delete(keys[i]);
     }
   }
+  async function resolveScopePi(workspaceId, root, request) {
+    return withPiHarnessDefaults(opts.getPi ? await opts.getPi({ workspaceId, workspaceRoot: root, request }) : opts.pi);
+  }
   async function resolveRuntimeScope(workspaceId, request) {
     const root = request && opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(workspaceId, request) : workspaceRoot;
     const scopedTemplatePath = opts.getTemplatePath ? await opts.getTemplatePath({ workspaceId, workspaceRoot: root, request }) : templatePath;
-    const pi = opts.getPi ? await opts.getPi({ workspaceId, workspaceRoot: root, request }) : opts.pi;
+    const pi = await resolveScopePi(workspaceId, root, request);
     const sessionNamespace = normalizeSessionNamespace(opts.getSessionNamespace ? await opts.getSessionNamespace({ workspaceId, workspaceRoot: root, request }) : opts.sessionNamespace);
     return {
       root,
@@ -10986,29 +12163,29 @@ var registerAgentRoutes = async (app, opts) => {
         workspaceId,
         root,
         scopedTemplatePath ?? null,
-        pi ?? null,
+        pi,
         sessionNamespace ?? null
       ])
     };
   }
   async function resolveSkillScope(workspaceId, request) {
     const root = request && opts.getWorkspaceRoot ? await opts.getWorkspaceRoot(workspaceId, request) : workspaceRoot;
-    const pi = opts.getPi ? await opts.getPi({ workspaceId, workspaceRoot: root, request }) : opts.pi;
-    const hot = pi?.getHotReloadableResources?.();
+    const pi = await resolveScopePi(workspaceId, root, request);
+    const hot = pi.getHotReloadableResources?.();
     return {
       root,
       pi: hot ? {
         ...pi,
         additionalSkillPaths: [
-          ...pi?.additionalSkillPaths ?? [],
+          ...pi.additionalSkillPaths ?? [],
           ...hot.additionalSkillPaths ?? []
         ],
         packages: [
-          ...pi?.packages ?? [],
+          ...pi.packages ?? [],
           ...hot.packages ?? []
         ],
         extensionPaths: [
-          ...pi?.extensionPaths ?? [],
+          ...pi.extensionPaths ?? [],
           ...hot.extensionPaths ?? []
         ]
       } : pi
@@ -11142,17 +12319,17 @@ var registerAgentRoutes = async (app, opts) => {
       }),
       ...buildFilesystemAgentTools(runtimeBundle),
       ...buildUploadAgentTools(runtimeBundle),
-      createPluginDiagnosticsTool({
+      ...externalPluginsEnabled ? [createPluginDiagnosticsTool({
         // `binding` is assigned later in this function; read through thunks.
         getLastReloadDiagnostics: () => binding?.lastReloadDiagnostics ?? [],
         getHarness: () => binding?.harness,
         ...opts.getPluginDiagnostics ? {
           getPluginErrors: () => opts.getPluginDiagnostics({ workspaceId, workspaceRoot: root })
         } : {}
-      })
+      })] : []
     ];
     const pluginTools = [];
-    if (modeAdapter.workspaceFsCapability === "strong") {
+    if (externalPluginsEnabled && modeAdapter.workspaceFsCapability === "strong") {
       const pluginResult = await loadPlugins({ cwd: root });
       if (pluginResult.errors.length > 0) {
         for (const e of pluginResult.errors) {
@@ -11185,14 +12362,13 @@ var registerAgentRoutes = async (app, opts) => {
     const harnessFactory = opts.harnessFactory ?? ((input) => createPiCodingAgentHarness({
       ...input,
       pi: {
-        noContextFiles: true,
-        noSkills: true,
+        // scope.pi is already defaulted at the resolveScopePi chokepoint.
         ...scope.pi,
         additionalSkillPaths: [
-          ...scope.pi?.additionalSkillPaths ?? []
+          ...scope.pi.additionalSkillPaths ?? []
         ],
         getHotReloadableResources: () => {
-          const hot = scope.pi?.getHotReloadableResources?.() ?? {};
+          const hot = scope.pi.getHotReloadableResources?.() ?? {};
           return {
             ...hot,
             additionalSkillPaths: [
@@ -11412,7 +12588,11 @@ var registerAgentRoutes = async (app, opts) => {
     getFileSearch: async (request) => (await getBindingForRequest(request)).runtimeBundle.fileSearch
   });
   await app.register(gitRoutes, {
-    getWorkspaceRoot: async (request) => getRuntimeBundleStorageRoot((await getBindingForRequest(request)).runtimeBundle)
+    getWorkspaceRoot: async (request) => {
+      const bundle = (await getBindingForRequest(request)).runtimeBundle;
+      if (bundle.sandbox.provider === "remote-worker") return void 0;
+      return getRuntimeBundleStorageRoot(bundle);
+    }
   });
   await app.register(piChatRoutes, {
     getService: async (request) => {
@@ -11420,7 +12600,8 @@ var registerAgentRoutes = async (app, opts) => {
       binding.piChatService ??= new HarnessPiChatService({
         harness: binding.harness,
         sessionStore: binding.harness.sessions,
-        workdir: binding.runtimeBundle.workspace.root
+        workdir: binding.runtimeBundle.workspace.root,
+        metering: opts.metering
       });
       return binding.piChatService;
     }
@@ -11436,19 +12617,21 @@ var registerAgentRoutes = async (app, opts) => {
       ...opts.pi?.additionalSkillPaths ?? []
     ],
     piPackages: opts.pi?.packages,
+    // Undefined is fine: skillsRoutes resolves it through the canonical
+    // harness policy (withPiHarnessDefaults), same as the factory above.
     noSkills: opts.pi?.noSkills,
     getWorkspaceRoot: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).root,
     getAdditionalSkillPaths: staticBinding && !hasRuntimeProvisioningInput ? void 0 : async (request) => {
       const scope = await getSkillsScopeForRequest(request);
-      if (!hasRuntimeProvisioningInput) return scope.pi?.additionalSkillPaths;
+      if (!hasRuntimeProvisioningInput) return scope.pi.additionalSkillPaths;
       const binding = await getBindingForRequest(request);
       return [
         ...binding.runtimeProvisioning?.skillPaths ?? [],
-        ...scope.pi?.additionalSkillPaths ?? []
+        ...scope.pi.additionalSkillPaths ?? []
       ];
     },
-    getPiPackages: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).pi?.packages,
-    getNoSkills: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).pi?.noSkills
+    getPiPackages: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).pi.packages,
+    getNoSkills: staticBinding ? void 0 : async (request) => (await getSkillsScopeForRequest(request)).pi.noSkills
   });
   await app.register(sessionChangesRoutes, { tracker: sessionChangesTracker });
   app.post("/api/v1/agent/reload", async (request, reply) => {
@@ -11507,10 +12690,17 @@ var registerAgentRoutes = async (app, opts) => {
 export {
   FileHandleStore,
   PI_PACKAGE_RESOURCE_FILTERS,
+  REMOTE_WORKER_PROVIDER,
+  REMOTE_WORKER_RUNTIME_CWD,
+  RemoteWorkerClient,
+  RemoteWorkerClientError,
   UV_SETUP_COMMANDS,
   VERCEL_PROVISIONING_CACHE_ROOT,
   VERCEL_SANDBOX_WORKSPACE_ROOT,
   UV_SETUP_COMMANDS as VERCEL_UV_SETUP_COMMANDS,
+  WORKER_INTERNAL_TOKEN_HEADER,
+  WORKER_REQUEST_ID_HEADER,
+  WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
   autoDetectMode,
   bakeSnapshotIfNeeded,
@@ -11518,21 +12708,28 @@ export {
   buildPackageHash,
   buildSnapshotRecipeHash,
   compactPiPackages,
+  constantTimeTokenEqual,
   createAgentApp,
   createBwrapSandbox,
   createDirectSandbox,
   createLogger,
   createNodeWorkspace,
+  createRemoteWorkerModeAdapter,
+  createRemoteWorkerSandbox,
+  createRemoteWorkerWorkspace,
   createResourceSettingsManager,
   createVercelDeploymentSnapshotProvider,
   createVercelProvisioningAdapter,
   createVercelSandboxWorkspace,
+  decodeBytesFromWorker,
+  encodeBytesForWorker,
   fileRoutes,
   getBoringAgentPathEntries,
   getBoringAgentRuntimeEnv,
   getBoringAgentRuntimePaths,
   hasBwrap,
   mergePiPackageSources,
+  normalizeMeteringUsage,
   piPackageSourceKey,
   prepareDeploymentSnapshot,
   prepareVercelDeploymentSnapshot,