@iowarp/clio-coder 0.3.3 → 0.3.6

package/dist/{chunk-LWLEKMDQ.js → chunk-XXQNGV4M.js}

@@ -1,12 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  DEFAULT_AUTONOMY_LEVEL,
-  autonomyAskRejection,
-  autonomyDenyRejection,
-  isAutonomyLevel,
-  mapAutonomy,
   typedValidationSummary
-} from "./chunk-STBPMHSX.js";
+} from "./chunk-EKY57CSP.js";
 import {
   ROUTE_POLICY_VERSION,
   deriveExecutionRole,
@@ -15,36 +10,47 @@ import {
   isRoutingIntent,
   routePriorForLatencyClass,
   sameRouteIdentity
-} from "./chunk-GGXXDWE4.js";
+} from "./chunk-22NAGB7X.js";
 import {
   AGENT_AUTOMATION_AUTHORITIES,
-  agentSpecFingerprint,
+  agentSpecFingerprint
+} from "./chunk-AOCYTWAV.js";
+import {
   detectValidationCommand,
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   tokenizeShellLike,
   toolMutationPaths
-} from "./chunk-5UUP6MWO.js";
+} from "./chunk-MV3K5QF2.js";
 import {
+  expandPath,
   resolveReadPath
 } from "./chunk-OQE5J4C6.js";
 import {
-  isSkillActivation
-} from "./chunk-T6YILFSB.js";
+  DEFAULT_AUTONOMY_LEVEL,
+  autonomyAskRejection,
+  autonomyDenyRejection,
+  isAutonomyLevel,
+  mapAutonomy
+} from "./chunk-HWUFFB6L.js";
 import {
   DEFAULT_MAX_LINES,
   OBSERVATION_POLICY_SLACK_BYTES,
   OBSERVE_SELF_CAPS,
+  deterministicDiagnosticSummary,
   finalizeObservation,
-  formatSize,
   isSessionOffloadPath,
   observationBudgetExhausted,
   reserveObservation,
   splitLinesForCounting,
   truncateHead,
   truncateTail
-} from "./chunk-VAKQQHWR.js";
+} from "./chunk-ODFEOB4F.js";
+import {
+  formatSize
+} from "./chunk-OZNBF4L3.js";
 import {
+  byteLength,
   truncateUtf8
 } from "./chunk-6XLNIQDB.js";
 import {
@@ -56,12 +62,24 @@ import {
 } from "./chunk-CGKSTWHD.js";
 import {
   THINKING_LEVELS
-} from "./chunk-ZDOOVTXZ.js";
+} from "./chunk-4OC57DA6.js";
+import {
+  gitCommitAttributionEnabled,
+  reportCommitAttributionDiagnostic,
+  resolveSafeCwd,
+  withManagedGitCommitAttributionEnvironment
+} from "./chunk-VEZEGCGW.js";
+import {
+  clampTimerDelayMs
+} from "./chunk-FQ4SKYE4.js";
 import {
   GUARDRAIL_DEFAULTS,
   GUARDRAIL_ENV_VARS,
   resolveGuardrail
 } from "./chunk-4ZG3XFUR.js";
+import {
+  AI_AGENT_NAME
+} from "./chunk-6EJMN2Y3.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -137,6 +155,255 @@ function applyCodewikiWorkerPolicy(tools, context) {
   return tools.filter((tool) => !isCodewikiTool(tool));
 }
 
+// src/core/bash-exec.ts
+init_esm_shims();
+import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+var BASH_HARD_CAP_BYTES = 16 * 1024 * 1024;
+var CLIO_CONTROL_ENV_KEYS = ["CLIO_CODER_INTERACTIVE", "CLIO_CODER_RESUME_SESSION_ID"];
+var BASH_UPDATE_THROTTLE_MS = 100;
+function buildToolEnv() {
+  const env = { ...process.env };
+  env.AI_AGENT = AI_AGENT_NAME;
+  for (const key of CLIO_CONTROL_ENV_KEYS) {
+    Reflect.deleteProperty(env, key);
+  }
+  return env;
+}
+var LOGIN_ENV_CAPTURE_TIMEOUT_MS = 1e4;
+var loginEnvCapture = null;
+function parseNullDelimitedEnv(raw) {
+  const env = {};
+  for (const entry of raw.split("\0")) {
+    if (entry.length === 0) continue;
+    const eq = entry.indexOf("=");
+    if (eq <= 0) continue;
+    env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return typeof env.PATH === "string" && env.PATH.length > 0 ? env : null;
+}
+function captureLoginEnv() {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const child = spawn("/bin/bash", ["-lc", "env -0"], {
+      env: buildToolEnv(),
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(null);
+    }, LOGIN_ENV_CAPTURE_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.on("error", () => finish(null));
+    child.on("close", (code) => finish(code === 0 ? parseNullDelimitedEnv(stdout) : null));
+  });
+}
+async function bashSpawnPlan() {
+  loginEnvCapture ??= captureLoginEnv();
+  const captured = await loginEnvCapture;
+  if (captured === null) return { mode: "-lc", env: buildToolEnv() };
+  const env = { ...process.env, ...captured };
+  env.AI_AGENT = AI_AGENT_NAME;
+  for (const key of CLIO_CONTROL_ENV_KEYS) {
+    Reflect.deleteProperty(env, key);
+  }
+  return { mode: "-c", env };
+}
+function combineBashOutput(result) {
+  const { stdout, stderr } = result;
+  return stderr.length > 0 ? `${stdout}${stdout.endsWith("\n") || stdout.length === 0 ? "" : "\n"}${stderr}` : stdout;
+}
+async function runBashCommand(command, options = {}) {
+  const plan = await bashSpawnPlan();
+  const attribution = withManagedGitCommitAttributionEnvironment(plan.env, {
+    cwd: options.cwd ?? process.cwd(),
+    enabled: gitCommitAttributionEnabled(process.env)
+  });
+  reportCommitAttributionDiagnostic(attribution.diagnostic);
+  return new Promise((resolve) => {
+    const timeout = clampTimerDelayMs(options.timeoutMs ?? 3e5);
+    let aborted = false;
+    let timedOut = false;
+    let settled = false;
+    let timeoutId = null;
+    let killGraceTimer = null;
+    let killSent = false;
+    let stdout = "";
+    let stderr = "";
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
+    let decodersFinished = false;
+    let outputBytes = 0;
+    let outputCapped = false;
+    let updateTimer = null;
+    let updateDirty = false;
+    let lastUpdateAt = 0;
+    const child = spawn("/bin/bash", [plan.mode, command], {
+      ...options.cwd === void 0 ? {} : { cwd: options.cwd },
+      env: attribution.env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const finishDecoders = () => {
+      if (decodersFinished) return;
+      decodersFinished = true;
+      if (outputCapped) return;
+      stdout += stdoutDecoder.end();
+      stderr += stderrDecoder.end();
+    };
+    const emitUpdate = () => {
+      if (options.onUpdate === void 0 || !updateDirty) return;
+      updateDirty = false;
+      lastUpdateAt = Date.now();
+      try {
+        options.onUpdate({ stdout, stderr, outputBytes: Math.min(outputBytes, BASH_HARD_CAP_BYTES) });
+      } catch {
+      }
+    };
+    const clearUpdateTimer = () => {
+      if (updateTimer === null) return;
+      clearTimeout(updateTimer);
+      updateTimer = null;
+    };
+    const scheduleUpdate = () => {
+      if (options.onUpdate === void 0) return;
+      updateDirty = true;
+      const delay = BASH_UPDATE_THROTTLE_MS - (Date.now() - lastUpdateAt);
+      if (delay <= 0) {
+        clearUpdateTimer();
+        emitUpdate();
+        return;
+      }
+      updateTimer ??= setTimeout(() => {
+        updateTimer = null;
+        emitUpdate();
+      }, delay);
+    };
+    const finishUpdates = () => {
+      clearUpdateTimer();
+      emitUpdate();
+    };
+    if (options.onUpdate !== void 0) {
+      updateDirty = true;
+      emitUpdate();
+    }
+    const clearKillGraceTimer = () => {
+      if (!killGraceTimer) return;
+      clearTimeout(killGraceTimer);
+      killGraceTimer = null;
+    };
+    const sendSignal = (signalName) => {
+      const pid = child.pid;
+      if (pid && process.platform !== "win32") {
+        try {
+          process.kill(-pid, signalName);
+          return;
+        } catch {
+        }
+      }
+      child.kill(signalName);
+    };
+    const killChild = () => {
+      if (killSent) return;
+      killSent = true;
+      sendSignal("SIGTERM");
+      killGraceTimer = setTimeout(() => {
+        sendSignal("SIGKILL");
+      }, 5e3);
+    };
+    function onAbort() {
+      aborted = true;
+      killChild();
+    }
+    if (timeout > 0) {
+      timeoutId = setTimeout(() => {
+        timedOut = true;
+        killChild();
+      }, timeout);
+    }
+    if (options.signal?.aborted) {
+      onAbort();
+    } else {
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+    }
+    const appendChunk = (target, chunk) => {
+      if (outputCapped) return;
+      const remaining = BASH_HARD_CAP_BYTES - outputBytes;
+      const accepted = chunk.byteLength <= remaining ? chunk : chunk.subarray(0, Math.max(0, remaining));
+      outputBytes += accepted.byteLength;
+      if (accepted.byteLength > 0) {
+        const decoded = target === "stdout" ? stdoutDecoder.write(accepted) : stderrDecoder.write(accepted);
+        if (target === "stdout") stdout += decoded;
+        else stderr += decoded;
+      }
+      if (accepted.byteLength < chunk.byteLength) {
+        outputCapped = true;
+        scheduleUpdate();
+        killChild();
+        return;
+      }
+      scheduleUpdate();
+    };
+    child.stdout?.on("data", (chunk) => appendChunk("stdout", chunk));
+    child.stderr?.on("data", (chunk) => appendChunk("stderr", chunk));
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutId) clearTimeout(timeoutId);
+      clearKillGraceTimer();
+      finishDecoders();
+      finishUpdates();
+      options.signal?.removeEventListener("abort", onAbort);
+      resolve({
+        error,
+        stdout,
+        stderr,
+        exitCode: null,
+        signal: null,
+        aborted,
+        timedOut,
+        outputCapped,
+        outputBytes
+      });
+    });
+    child.on("close", (code, signalName) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutId) clearTimeout(timeoutId);
+      clearKillGraceTimer();
+      finishDecoders();
+      finishUpdates();
+      options.signal?.removeEventListener("abort", onAbort);
+      const error = code === 0 && signalName === null ? null : {
+        name: "Error",
+        message: signalName ? `command terminated by ${signalName}` : `command exited with code ${code ?? "?"}`,
+        code: code ?? void 0,
+        signal: signalName ?? void 0
+      };
+      resolve({
+        error,
+        stdout,
+        stderr,
+        exitCode: code,
+        signal: signalName,
+        aborted,
+        timedOut,
+        outputCapped,
+        outputBytes
+      });
+    });
+  });
+}
+
 // src/tools/network-policy.ts
 init_esm_shims();
 var NO_NETWORK_TOOLS_ENV = "CLIO_CODER_NO_NETWORK_TOOLS";
@@ -534,10 +801,13 @@ function validateAllowedTools(value) {
 }
 function validateWorkerBudget(value) {
   const budget = readRecord(value, "WorkerSpec.budget");
-  const expected = ["hardCap", "readReserve", "synthesis", "toolCalls"];
+  const expected = ["hardCap", "readReserve", "revision", "synthesis", "toolCalls"];
   const actual = Object.keys(budget).sort();
-  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
-    throw new Error(`WorkerSpec.budget must contain exactly: ${expected.join(", ")}`);
+  if (actual.some((key) => !expected.includes(key)) || actual.some((key) => key === "revision" && budget.revision === void 0)) {
+    throw new Error(`WorkerSpec.budget may contain only: ${expected.join(", ")}`);
+  }
+  for (const required of ["hardCap", "readReserve", "synthesis", "toolCalls"]) {
+    if (!Object.hasOwn(budget, required)) throw new Error(`WorkerSpec.budget.${required} is required`);
   }
   for (const key of ["toolCalls", "readReserve", "hardCap"]) {
     const value2 = budget[key];
@@ -554,6 +824,30 @@ function validateWorkerBudget(value) {
     throw new Error("WorkerSpec.budget.readReserve must be an integer in [0, toolCalls)");
   }
   if (typeof budget.synthesis !== "boolean") throw new Error("WorkerSpec.budget.synthesis must be a boolean");
+  if (budget.revision !== void 0) {
+    const revision = readRecord(budget.revision, "WorkerSpec.budget.revision");
+    const revisionKeys = Object.keys(revision).sort();
+    if (revisionKeys.length !== 2 || revisionKeys[0] !== "readReserve" || revisionKeys[1] !== "toolCalls") {
+      throw new Error("WorkerSpec.budget.revision must contain exactly: readReserve, toolCalls");
+    }
+    for (const key of ["toolCalls", "readReserve"]) {
+      if (typeof revision[key] !== "number" || !Number.isSafeInteger(revision[key])) {
+        throw new Error(`WorkerSpec.budget.revision.${key} must be a safe integer`);
+      }
+    }
+    if (revision.toolCalls < budget.toolCalls) {
+      throw new Error("WorkerSpec.budget.revision.toolCalls must not be smaller than WorkerSpec.budget.toolCalls");
+    }
+    if (revision.toolCalls === budget.toolCalls && revision.readReserve <= budget.readReserve) {
+      throw new Error("WorkerSpec.budget.revision must increase toolCalls or readReserve");
+    }
+    if (revision.toolCalls > budget.hardCap) {
+      throw new Error("WorkerSpec.budget.revision.toolCalls must not exceed WorkerSpec.budget.hardCap");
+    }
+    if (revision.readReserve < 0 || revision.readReserve >= revision.toolCalls) {
+      throw new Error("WorkerSpec.budget.revision.readReserve must be an integer in [0, toolCalls)");
+    }
+  }
 }
 function validateRuntimeCapabilityDecision(value, source) {
   const caps = readRecord(value, source);
@@ -777,6 +1071,293 @@ function validateRehydratedWorkerRuntime(spec, runtime) {
   }
 }
 
+// src/domains/dispatch/budget-envelope.ts
+init_esm_shims();
+var BudgetAdmissionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(`dispatch: budget admission denied (${code}): ${message}`);
+    this.name = "BudgetAdmissionError";
+    this.code = code;
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clonePhase(value, prefix) {
+  if (!isRecord(value)) throw new Error(`${prefix} must be an object`);
+  for (const key of Object.keys(value)) {
+    if (key !== "toolCalls" && key !== "readReserve") throw new Error(`${prefix}.${key} is unknown`);
+  }
+  for (const key of ["toolCalls", "readReserve"]) {
+    if (!Object.hasOwn(value, key)) throw new Error(`${prefix}.${key} is required`);
+  }
+  const toolCalls = value.toolCalls;
+  if (typeof toolCalls !== "number" || !Number.isSafeInteger(toolCalls) || toolCalls <= 0) {
+    throw new Error(`${prefix}.toolCalls must be a positive safe integer`);
+  }
+  const readReserve = value.readReserve;
+  if (typeof readReserve !== "number" || !Number.isSafeInteger(readReserve) || readReserve < 0) {
+    throw new Error(`${prefix}.readReserve must be a non-negative safe integer`);
+  }
+  if (readReserve >= toolCalls) throw new Error(`${prefix}.readReserve must be less than ${prefix}.toolCalls`);
+  return { toolCalls, readReserve };
+}
+function cloneDispatchBudgetRequest(value, prefix = "budget") {
+  if (!isRecord(value)) throw new Error(`${prefix} must be an object`);
+  for (const key of Object.keys(value)) {
+    if (key !== "toolCalls" && key !== "readReserve" && key !== "retryRevision") {
+      throw new Error(`${prefix}.${key} is unknown`);
+    }
+  }
+  const phase = clonePhase({ toolCalls: value.toolCalls, readReserve: value.readReserve }, prefix);
+  const retryRevision = value.retryRevision === void 0 ? void 0 : clonePhase(value.retryRevision, `${prefix}.retryRevision`);
+  return { ...phase, ...retryRevision === void 0 ? {} : { retryRevision } };
+}
+function freezeEnvelope(envelope) {
+  Object.freeze(envelope.policy.default);
+  Object.freeze(envelope.policy.maximum);
+  Object.freeze(envelope.policy);
+  if (envelope.request !== null) {
+    if (envelope.request.retryRevision !== void 0) Object.freeze(envelope.request.retryRevision);
+    Object.freeze(envelope.request);
+  }
+  Object.freeze(envelope.effective);
+  for (const reason of envelope.reasons) Object.freeze(reason);
+  Object.freeze(envelope.reasons);
+  return Object.freeze(envelope);
+}
+function phaseWithin(candidate, maximum) {
+  return candidate.toolCalls <= maximum.toolCalls && candidate.readReserve <= maximum.readReserve;
+}
+function samePhase(left, right) {
+  return left.toolCalls === right.toolCalls && left.readReserve === right.readReserve;
+}
+function assertRequestAdmitted(input) {
+  const { request, policy, hardCap } = input;
+  const authoredMaximum = policy.maximum ?? policy;
+  if (policy.maximum === void 0 && !samePhase(request, policy)) {
+    throw new BudgetAdmissionError(
+      "exact-recipe-policy",
+      `the recipe pins ${policy.toolCalls} tool calls with a read reserve of ${policy.readReserve}`
+    );
+  }
+  if (!phaseWithin(request, authoredMaximum)) {
+    throw new BudgetAdmissionError(
+      "recipe-maximum",
+      `the requested phase ${request.toolCalls}/${request.readReserve} exceeds recipe maximum ${authoredMaximum.toolCalls}/${authoredMaximum.readReserve}`
+    );
+  }
+  if (request.toolCalls > hardCap) {
+    throw new BudgetAdmissionError(
+      "global-cap",
+      `the requested ${request.toolCalls} tool calls exceed the operator cap of ${hardCap}`
+    );
+  }
+  const ceiling = request.retryRevision;
+  if (ceiling === void 0) return;
+  if (ceiling.toolCalls < request.toolCalls || ceiling.readReserve < request.readReserve) {
+    throw new BudgetAdmissionError(
+      "ceiling-below-request",
+      `retryRevision ${ceiling.toolCalls}/${ceiling.readReserve} must not be smaller than the requested phase ${request.toolCalls}/${request.readReserve}`
+    );
+  }
+  if (policy.maximum === void 0 && !samePhase(ceiling, policy)) {
+    throw new BudgetAdmissionError(
+      "exact-recipe-policy",
+      `the recipe pins ${policy.toolCalls} tool calls with a read reserve of ${policy.readReserve}`
+    );
+  }
+  if (!phaseWithin(ceiling, authoredMaximum)) {
+    throw new BudgetAdmissionError(
+      "recipe-maximum",
+      `retryRevision ${ceiling.toolCalls}/${ceiling.readReserve} exceeds recipe maximum ${authoredMaximum.toolCalls}/${authoredMaximum.readReserve}`
+    );
+  }
+  if (ceiling.toolCalls > hardCap) {
+    throw new BudgetAdmissionError(
+      "global-cap",
+      `retryRevision ${ceiling.toolCalls} exceeds the operator cap of ${hardCap}`
+    );
+  }
+}
+function resolveToolBudgetEnvelope(input) {
+  if (!Number.isSafeInteger(input.hardCap) || input.hardCap <= 0) {
+    throw new Error("dispatch: worker tool-call cap must be a positive safe integer");
+  }
+  if (input.request !== void 0)
+    assertRequestAdmitted({ request: input.request, policy: input.policy, hardCap: input.hardCap });
+  const request = input.request === void 0 ? null : cloneDispatchBudgetRequest(input.request);
+  const base = request ?? input.policy;
+  const reasons = [];
+  let selected = base;
+  const phaseKind = input.retry ? "retry" : input.revision ? "revision" : null;
+  if (phaseKind !== null) {
+    const ceiling = request?.retryRevision;
+    if (ceiling !== void 0 && !samePhase(ceiling, base)) {
+      selected = ceiling;
+      reasons.push({
+        code: phaseKind === "retry" ? "retry-growth-authorized" : "revision-growth-authorized",
+        detail: `${phaseKind} phase grew from ${base.toolCalls}/${base.readReserve} to the preauthorized ceiling ${ceiling.toolCalls}/${ceiling.readReserve}`
+      });
+    } else {
+      reasons.push({
+        code: phaseKind === "retry" ? "retry-growth-denied" : "revision-growth-denied",
+        detail: ceiling === void 0 ? `${phaseKind} phase retained ${base.toolCalls}/${base.readReserve} because the original request declared no ceiling` : `${phaseKind} phase retained ${base.toolCalls}/${base.readReserve} because the declared ceiling did not authorize growth`
+      });
+    }
+  }
+  const revisionCeiling = phaseKind === null ? request?.retryRevision : void 0;
+  if (revisionCeiling !== void 0 && !samePhase(revisionCeiling, selected)) {
+    reasons.push({
+      code: "revision-growth-authorized",
+      detail: `a result-contract revision may grow from ${selected.toolCalls}/${selected.readReserve} to the preauthorized ceiling ${revisionCeiling.toolCalls}/${revisionCeiling.readReserve}`
+    });
+  }
+  let toolCalls = selected.toolCalls;
+  if (toolCalls > input.hardCap) {
+    reasons.push({
+      code: "global-cap-clamp",
+      detail: `tool calls were clamped from ${toolCalls} to the operator cap of ${input.hardCap}`
+    });
+    toolCalls = input.hardCap;
+  }
+  let readReserve = selected.readReserve;
+  if (!input.hasReadTool && readReserve > 0) {
+    reasons.push({
+      code: "read-reserve-unavailable-clamp",
+      detail: `read reserve was clamped from ${readReserve} to 0 because the read tool is unavailable`
+    });
+    readReserve = 0;
+  }
+  const maximumEffectiveReserve = Math.max(0, toolCalls - 1);
+  if (readReserve > maximumEffectiveReserve) {
+    reasons.push({
+      code: "read-reserve-cap-clamp",
+      detail: `read reserve was clamped from ${readReserve} to ${maximumEffectiveReserve} after the tool-call cap`
+    });
+    readReserve = maximumEffectiveReserve;
+  }
+  let effectiveRevision;
+  if (revisionCeiling !== void 0 && !samePhase(revisionCeiling, selected)) {
+    let revisionReadReserve = revisionCeiling.readReserve;
+    if (!input.hasReadTool && revisionReadReserve > 0) {
+      reasons.push({
+        code: "read-reserve-unavailable-clamp",
+        detail: `result-contract revision read reserve was clamped from ${revisionReadReserve} to 0 because the read tool is unavailable`
+      });
+      revisionReadReserve = 0;
+    }
+    effectiveRevision = { toolCalls: revisionCeiling.toolCalls, readReserve: revisionReadReserve };
+  }
+  const authoredMaximum = input.policy.maximum ?? input.policy;
+  return freezeEnvelope({
+    version: 1,
+    policy: {
+      recipeId: input.recipeId,
+      default: {
+        toolCalls: input.policy.toolCalls,
+        readReserve: input.policy.readReserve,
+        synthesis: input.policy.synthesis
+      },
+      maximum: { toolCalls: authoredMaximum.toolCalls, readReserve: authoredMaximum.readReserve },
+      exact: input.policy.maximum === void 0
+    },
+    request,
+    effective: {
+      toolCalls,
+      readReserve,
+      synthesis: input.policy.synthesis,
+      hardCap: input.hardCap,
+      ...effectiveRevision === void 0 ? {} : { revision: effectiveRevision }
+    },
+    reasons
+  });
+}
+function formatBudgetPolicy(envelope) {
+  const policy = envelope.policy;
+  const range = policy.exact ? `exact ${policy.default.toolCalls}/${policy.default.readReserve}` : `default ${policy.default.toolCalls}/${policy.default.readReserve}, max ${policy.maximum.toolCalls}/${policy.maximum.readReserve}`;
+  return `${policy.recipeId} ${range}, synthesis=${policy.default.synthesis ? "on" : "off"}`;
+}
+function formatBudgetRequest(envelope) {
+  const request = envelope.request;
+  if (request === null) return "recipe default";
+  const ceiling = request.retryRevision;
+  return ceiling === void 0 ? `${request.toolCalls}/${request.readReserve}, no retry/revision growth` : `${request.toolCalls}/${request.readReserve}, retry/revision ceiling ${ceiling.toolCalls}/${ceiling.readReserve}`;
+}
+function formatEffectiveBudget(envelope) {
+  const budget = envelope.effective;
+  const revision = budget.revision ? `, result revision ${budget.revision.toolCalls}/${budget.revision.readReserve}` : "";
+  return `${budget.toolCalls}/${budget.readReserve}${revision}, lifetime cap ${budget.hardCap}, synthesis=${budget.synthesis ? "on" : "off"}`;
+}
+function formatBudgetReasons(envelope) {
+  return envelope.reasons.length === 0 ? "none" : envelope.reasons.map((reason) => reason.code).join(",");
+}
+var BUDGET_REASON_CODES = /* @__PURE__ */ new Set([
+  "global-cap-clamp",
+  "read-reserve-unavailable-clamp",
+  "read-reserve-cap-clamp",
+  "retry-growth-authorized",
+  "retry-growth-denied",
+  "revision-growth-authorized",
+  "revision-growth-denied"
+]);
+function cloneRunToolBudgetEnvelope(value) {
+  try {
+    if (!isRecord(value) || value.version !== 1 || !isRecord(value.policy) || !isRecord(value.effective)) {
+      return void 0;
+    }
+    const recipeId = value.policy.recipeId;
+    if (typeof recipeId !== "string" || recipeId.length === 0 || typeof value.policy.exact !== "boolean") {
+      return void 0;
+    }
+    if (!isRecord(value.policy.default) || typeof value.policy.default.synthesis !== "boolean") return void 0;
+    const defaultPhase = clonePhase(
+      { toolCalls: value.policy.default.toolCalls, readReserve: value.policy.default.readReserve },
+      "budget.policy.default"
+    );
+    const maximum = clonePhase(value.policy.maximum, "budget.policy.maximum");
+    const request = value.request === null ? null : cloneDispatchBudgetRequest(value.request);
+    const effectivePhase = clonePhase(
+      { toolCalls: value.effective.toolCalls, readReserve: value.effective.readReserve },
+      "budget.effective"
+    );
+    const revision = value.effective.revision === void 0 ? void 0 : clonePhase(value.effective.revision, "budget.effective.revision");
+    if (typeof value.effective.synthesis !== "boolean" || typeof value.effective.hardCap !== "number" || !Number.isSafeInteger(value.effective.hardCap) || value.effective.hardCap <= 0 || !Array.isArray(value.reasons)) {
+      return void 0;
+    }
+    if (maximum.toolCalls < defaultPhase.toolCalls || maximum.readReserve < defaultPhase.readReserve || value.policy.exact && !samePhase(maximum, defaultPhase) || effectivePhase.toolCalls > value.effective.hardCap || value.effective.synthesis !== value.policy.default.synthesis || revision !== void 0 && (revision.toolCalls < effectivePhase.toolCalls || revision.toolCalls > value.effective.hardCap || revision.toolCalls === effectivePhase.toolCalls && revision.readReserve <= effectivePhase.readReserve)) {
+      return void 0;
+    }
+    const reasons = [];
+    for (const reason of value.reasons) {
+      if (!isRecord(reason) || typeof reason.code !== "string" || !BUDGET_REASON_CODES.has(reason.code) || typeof reason.detail !== "string") {
+        return void 0;
+      }
+      reasons.push({ code: reason.code, detail: reason.detail });
+    }
+    return freezeEnvelope({
+      version: 1,
+      policy: {
+        recipeId,
+        default: { ...defaultPhase, synthesis: value.policy.default.synthesis },
+        maximum,
+        exact: value.policy.exact
+      },
+      request,
+      effective: {
+        ...effectivePhase,
+        synthesis: value.effective.synthesis,
+        hardCap: value.effective.hardCap,
+        ...revision === void 0 ? {} : { revision }
+      },
+      reasons
+    });
+  } catch {
+    return void 0;
+  }
+}
+
 // src/domains/dispatch/gate-role-prompts.ts
 init_esm_shims();
 var REVIEWER_GATE_PROMPT = [
@@ -831,525 +1412,222 @@ function runKindSupportsLiveSteering(kind) {
   return kind === "http" || kind === "sdk";
 }
 
-// src/domains/session/task-board.ts
+// src/domains/safety/call-target.ts
 init_esm_shims();
-import { randomUUID } from "node:crypto";
 
-// src/domains/session/entries.ts
+// src/domains/safety/redaction.ts
 init_esm_shims();
-var SESSION_ENTRY_KINDS = [
-  "message",
-  "bashExecution",
-  "custom",
-  "modelChange",
-  "thinkingLevelChange",
-  "fileEntry",
-  "branchSummary",
-  "compactionSummary",
-  "sessionInfo",
-  "label",
-  "protectedArtifact",
-  "skillActivation",
-  "taskLedger",
-  "decisionLedger",
-  "workerRun"
-];
-function isRecord(value) {
-  return !!value && typeof value === "object";
-}
-function isString(value) {
-  return typeof value === "string";
-}
-function isOptionalString(value) {
-  return value === void 0 || typeof value === "string";
-}
-function isOptionalBoolean(value) {
-  return value === void 0 || typeof value === "boolean";
-}
-function isNumber(value) {
-  return typeof value === "number" && Number.isFinite(value);
-}
-function isPositiveInteger(value) {
-  return isNumber(value) && Number.isInteger(value) && value > 0;
-}
-function isOptionalNumber(value) {
-  return value === void 0 || isNumber(value);
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+var SECRET_KEY_RE = /(?:api[-_]?key|access[-_]?key|auth(?:orization)?|credential|password|private[-_]?key|secret|token)/iu;
+var ENV_KEY_RE = /^env(?:ironment)?$/iu;
+var SECRET_STRING_RE = /(https?:\/\/[^\s/@]+:)[^\s/@]+@/giu;
+var SECRET_URL_PARAM_RE = /([?&](?:api[-_]?key|access[-_]?token|auth(?:orization)?|credential|password|secret|token)[^=\s]*=)[^&#\s]+/giu;
+var SECRET_ASSIGNMENT_RE = /(?<![A-Z0-9_])((?:[A-Z0-9_]*(?:ACCESS|API|AUTH|CREDENTIAL|KEY|PASS(?:WORD)?|PRIVATE|SECRET|TOKEN)[A-Z0-9_]*)=)[^\s;&|]+/giu;
+var SECRET_FLAG_RE = /(--?(?:[a-z0-9-]*(?:api[-_]?key|access[-_]?token|auth(?:orization)?|credential|password|secret|token)[a-z0-9-]*))(=|\s+)([^\s;&|]+)/giu;
+function redactSecretString(value) {
+  return value.replace(SECRET_STRING_RE, "$1[redacted]@").replace(SECRET_URL_PARAM_RE, "$1[redacted]").replace(SECRET_ASSIGNMENT_RE, "$1[redacted]").replace(SECRET_FLAG_RE, "$1$2[redacted]");
+}
+function isSecretArgKey(key) {
+  return SECRET_KEY_RE.test(key);
+}
+function isEnvironmentArgKey(key) {
+  return ENV_KEY_RE.test(key);
+}
+function redactEnvironmentValue(value, depth) {
+  if (depth > 8) return "[redacted nested values]";
+  if (typeof value === "string") return "[redacted]";
+  if (Array.isArray(value)) return value.map((item) => redactEnvironmentValue(item, depth + 1));
+  if (!isPlainObject2(value)) return value;
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactEnvironmentValue(childValue, depth + 1);
+  }
+  return out;
 }
-function isNullableString(value) {
-  return value === null || typeof value === "string";
+function redactToolArgs(value, key = "", depth = 0) {
+  if (isSecretArgKey(key)) return "[redacted]";
+  if (isEnvironmentArgKey(key)) return redactEnvironmentValue(value, depth);
+  if (typeof value === "string") return redactSecretString(value);
+  if (depth > 8) return "[redacted nested values]";
+  if (Array.isArray(value)) return value.map((item) => redactToolArgs(item, key, depth + 1));
+  if (!isPlainObject2(value)) return value;
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactToolArgs(childValue, childKey, depth + 1);
+  }
+  return out;
 }
-function isOneOf(value, allowed) {
-  return typeof value === "string" && allowed.includes(value);
+
+// src/domains/safety/call-target.ts
+var ESC_CHAR = String.fromCharCode(27);
+var BEL_CHAR = String.fromCharCode(7);
+var OSC_PATTERN = new RegExp(`${ESC_CHAR}\\][\\s\\S]*?(?:${BEL_CHAR}|${ESC_CHAR}\\\\|$)`, "g");
+var CSI_PATTERN = new RegExp(`${ESC_CHAR}\\[[0-9;?]*[0-9A-Za-z]`, "g");
+function sanitizeForDisplay(value) {
+  const stripped = value.replace(OSC_PATTERN, "").replace(CSI_PATTERN, "");
+  let out = "";
+  for (const ch of stripped) {
+    const code = ch.codePointAt(0) ?? 0;
+    out += code < 32 || code === 127 ? " " : ch;
+  }
+  return out;
 }
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function sanitizeCallTargetText(value) {
+  return oneLine(sanitizeForDisplay(value));
+}
+var CALL_ACTION_OBJECT_MAX_CHARS = 64;
+var CALL_TARGET_MAX_CHARS = 120;
+var CALL_ACTION_VOCABULARY = {
+  read: { verb: "reading", field: "path" },
+  edit: { verb: "editing", field: "path" },
+  write: { verb: "writing", field: "path" },
+  ls: { verb: "listing", field: "path" },
+  bash: { verb: "running", field: "command" },
+  grep: { verb: "searching", field: "pattern" },
+  find: { verb: "finding", field: "pattern" },
+  web_fetch: { verb: "fetching", field: "url" },
+  git: { verb: "git", field: "op" },
+  verify: { verb: "verifying", field: "check" },
+  code_nav: { verb: "navigating", field: "query" },
+  context: { verb: "context", field: "scope" },
+  artifact: { verb: "writing", field: "kind" },
+  monitor: { verb: "monitoring", field: "run_id" },
+  steer: { verb: "steering", field: "run_id" },
+  tasks: { verb: "tasks", field: "action" },
+  dispatch: { verb: "dispatching", field: "agent" },
+  // ACP tool kinds. A peer names its own argument fields, so these rely on
+  // the shared allowlist below rather than on a field this side can predict.
+  execute: { verb: "running", field: "command" },
+  search: { verb: "searching", field: "query" },
+  fetch: { verb: "fetching", field: "url" },
+  delete: { verb: "deleting", field: "path" },
+  move: { verb: "moving", field: "path" },
+  think: { verb: "thinking", field: "" }
+};
+var CALL_ACTION_OBJECT_FIELDS = ["path", "file_path", "command", "pattern", "query", "url"];
+var CALL_TARGET_FIELDS = {
+  read: ["path", "offset", "limit", "tail"],
+  grep: ["pattern", "path", "mode", "glob", "ignore_case", "literal", "context", "limit", "include_ignored"],
+  find: ["pattern", "path", "order", "limit", "include_ignored"],
+  ls: ["path", "limit"],
+  code_nav: ["mode", "query", "limit"],
+  context: ["scope", "query", "name", "limit", "ref", "include_tree"],
+  credential_present: ["name", "source", "file"],
+  write: ["path"],
+  edit: ["path"],
+  bash: ["command", "cwd", "timeout_ms", "output_policy"],
+  git: ["op", "path", "cached", "stat", "name_only", "limit", "cwd", "timeout_ms", "max_output_bytes"],
+  verify: ["check", "path", "browser", "cwd", "timeout_ms", "max_output_bytes"],
+  dispatch: [
+    "list",
+    "mode",
+    "agent",
+    "target",
+    "model",
+    "node",
+    "autonomy",
+    "tool_profile",
+    "thinking_level",
+    "detach",
+    "timeout_ms"
+  ],
+  monitor: ["run_id", "mode"],
+  steer: ["run_id", "action"],
+  tasks: ["action", "id"],
+  ledger: ["action", "kind", "path", "line", "target", "passed", "since"],
+  web_fetch: ["url", "method", "timeout_ms", "max_bytes", "format"],
+  ask_user: ["action", "mode", "max_rounds", "exposure"],
+  artifact: ["kind", "path", "title"],
+  // ACP tool kinds use only fields whose meaning the protocol defines.
+  execute: ["command", "cwd"],
+  search: ["query", "path"],
+  fetch: ["url", "method"],
+  delete: ["path"],
+  move: ["path", "target"]
+};
+function boundActionObject(value) {
+  if (typeof value !== "string") return null;
+  const clean = sanitizeCallTargetText(redactSecretString(value));
+  if (clean.length === 0) return null;
+  if (clean.length <= CALL_ACTION_OBJECT_MAX_CHARS) return { object: clean, truncated: false };
+  return { object: clean.slice(0, CALL_ACTION_OBJECT_MAX_CHARS), truncated: true };
+}
+function describeCallAction(tool, args) {
+  const known = CALL_ACTION_VOCABULARY[tool];
+  const candidates = known?.field ? [known.field, ...CALL_ACTION_OBJECT_FIELDS] : [...CALL_ACTION_OBJECT_FIELDS];
+  let bounded = null;
+  if (args) {
+    for (const field of candidates) {
+      if (isSecretArgKey(field)) continue;
+      bounded = boundActionObject(args[field]);
+      if (bounded !== null) break;
+    }
+  }
+  if (known === void 0 && bounded === null) return null;
+  const verb = known?.verb ?? "calling";
+  if (bounded === null) return { verb };
+  return { verb, object: bounded.object, ...bounded.truncated ? { truncated: true } : {} };
+}
+function renderAllowedTargetValue(value) {
+  if (typeof value === "string") {
+    const rendered = sanitizeCallTargetText(redactSecretString(value));
+    return rendered.length > 0 ? rendered : null;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "boolean") return String(value);
+  return null;
 }
-function hasBaseSessionEntryFields(v) {
-  return isString(v.turnId) && isNullableString(v.parentTurnId) && isString(v.timestamp);
+function countLabel(count, singular, plural) {
+  return `${count} ${count === 1 ? singular : plural}`;
 }
-var MESSAGE_ROLES = ["user", "assistant", "tool_call", "tool_result", "system", "checkpoint"];
-var FILE_OPERATIONS = ["read", "write", "edit", "create", "delete"];
-var COMPACTION_TRIGGERS = ["auto", "force", "overflow"];
-var PROTECTED_ARTIFACT_SOURCES = [
-  "validation",
-  "middleware",
-  "user",
-  "session"
-];
-var TASK_LEDGER_STATUSES = ["pending", "active", "completed", "blocked", "cancelled"];
-var TASK_LEDGER_EVIDENCE_STATUSES = [
-  "required",
-  "pending",
-  "passed",
-  "failed",
-  "missing"
-];
-var DECISION_STATUSES = ["active", "superseded"];
-var DECISION_INTERVIEW_STATUSES = ["complete", "cancelled"];
-var WORKER_RUN_ORIGINS = ["user", "agent"];
-var WORKER_RUN_RUNTIME_KINDS = ["clio", "acp", "claude-sdk", "claude-code"];
-function isWorkerRunRuntime(value) {
-  if (!isRecord(value)) return false;
-  return isOneOf(value.kind, WORKER_RUN_RUNTIME_KINDS) && isOptionalString(value.targetId) && isOptionalString(value.wireModelId) && isOptionalString(value.peerId);
-}
-function isTaskLedgerGoal(value) {
-  if (!isRecord(value)) return false;
-  if (!isString(value.id) || !isString(value.title)) return false;
-  if (!isOneOf(value.status, TASK_LEDGER_STATUSES)) return false;
-  if (value.parentGoalId !== void 0 && !isNullableString(value.parentGoalId)) return false;
-  const hasPairedProvenance = value.origin === "user" ? isString(value.userTaskId) && /^u[1-9]\d*$/.test(value.userTaskId) : (value.origin === void 0 || value.origin === "agent") && value.userTaskId === void 0;
-  return isOptionalString(value.description) && hasPairedProvenance;
-}
-function isTaskLedgerEvidence(value) {
-  if (!isRecord(value)) return false;
-  if (!isString(value.id) || !isString(value.description)) return false;
-  if (!isOneOf(value.status, TASK_LEDGER_EVIDENCE_STATUSES)) return false;
-  return isOptionalString(value.command) && isOptionalString(value.artifactPath) && isOptionalString(value.observedAt) && isOptionalString(value.notes);
-}
-function isDecisionRecord(value) {
-  if (!isRecord(value)) return false;
-  if (!isString(value.key) || !/^[a-z0-9]+(?:_[a-z0-9]+)*$/.test(value.key)) return false;
-  if (!isString(value.value) || !isOneOf(value.status, DECISION_STATUSES) || !isString(value.decidedAt)) return false;
-  if (!isOptionalString(value.label) || !isOptionalString(value.source_question)) return false;
-  if (!isOptionalString(value.revisedAt) || !isOptionalString(value.correction)) return false;
-  return value.status === "superseded" ? isString(value.revisedAt) : value.revisedAt === void 0 && value.correction === void 0;
-}
-function isOptionalCompactionUsage(value) {
-  if (value === void 0) return true;
-  if (!isRecord(value)) return false;
-  const cost = value.cost;
-  return isNumber(value.input) && isNumber(value.output) && isNumber(value.cacheRead) && isNumber(value.cacheWrite) && isNumber(value.reasoning) && isNumber(value.totalTokens) && isNumber(value.apiCalls) && isRecord(cost) && isNumber(cost.total);
-}
-function isProtectedArtifact(value) {
-  if (!isRecord(value)) return false;
-  return isString(value.path) && isString(value.protectedAt) && isString(value.reason) && isOneOf(value.source, PROTECTED_ARTIFACT_SOURCES) && isOptionalString(value.validationCommand) && isOptionalNumber(value.validationExitCode);
-}
-function isSessionHeader(value) {
-  if (!isRecord(value)) return false;
-  return value.type === "session" && isPositiveInteger(value.version) && isString(value.id) && isString(value.timestamp) && isString(value.cwd) && isOptionalString(value.parentSession) && isOptionalString(value.parentTurnId);
-}
-function isSessionEntry(value) {
-  if (!value || typeof value !== "object") return false;
-  const v = value;
-  if (!hasBaseSessionEntryFields(v)) return false;
-  if (!isOneOf(v.kind, SESSION_ENTRY_KINDS)) return false;
-  switch (v.kind) {
-    case "message":
-      return Object.hasOwn(v, "payload") && isOneOf(v.role, MESSAGE_ROLES);
-    case "bashExecution":
-      return isString(v.command) && isString(v.output) && (v.exitCode === null || isNumber(v.exitCode)) && typeof v.cancelled === "boolean" && typeof v.truncated === "boolean" && isOptionalString(v.fullOutputPath) && isOptionalBoolean(v.excludeFromContext);
-    case "custom":
-      return isString(v.customType) && isOptionalBoolean(v.display);
-    case "modelChange":
-      return isString(v.provider) && isString(v.modelId) && isOptionalString(v.target);
-    case "thinkingLevelChange":
-      return isString(v.thinkingLevel);
-    case "fileEntry":
-      return isString(v.path) && isOneOf(v.operation, FILE_OPERATIONS) && isOptionalNumber(v.bytes) && isOptionalString(v.hash);
-    case "branchSummary":
-      return isString(v.fromTurnId) && isString(v.summary);
-    case "compactionSummary":
-      return isString(v.summary) && isNumber(v.tokensBefore) && isString(v.firstKeptTurnId) && isOptionalCompactionUsage(v.usage) && (v.trigger === void 0 || isOneOf(v.trigger, COMPACTION_TRIGGERS)) && isOptionalNumber(v.tokensAfter) && isOptionalNumber(v.messagesSummarized) && isOptionalBoolean(v.isSplitTurn);
-    case "sessionInfo":
-      return isOptionalString(v.name) && isOptionalString(v.targetTurnId) && isOptionalString(v.label);
-    case "label":
-      return isString(v.targetTurnId) && isOptionalString(v.label);
-    case "protectedArtifact":
-      return v.action === "protect" && isProtectedArtifact(v.artifact) && isOptionalString(v.toolName) && isOptionalString(v.toolCallId) && isOptionalString(v.runId) && isOptionalString(v.correlationId);
-    case "skillActivation":
-      return isSkillActivation(v.activation);
-    case "taskLedger":
-      return isOptionalString(v.boardId) && Array.isArray(v.goals) && v.goals.every(isTaskLedgerGoal) && Array.isArray(v.subgoals) && v.subgoals.every(isTaskLedgerGoal) && isStringArray(v.activeRunIds) && Array.isArray(v.requiredValidationEvidence) && v.requiredValidationEvidence.every(isTaskLedgerEvidence);
-    case "decisionLedger":
-      return isString(v.interviewId) && isOneOf(v.interviewStatus, DECISION_INTERVIEW_STATUSES) && isString(v.startedAt) && isString(v.endedAt) && isNumber(v.roundCount) && Number.isInteger(v.roundCount) && v.roundCount >= 0 && isOptionalString(v.summary) && isOptionalString(v.transcriptPath) && Array.isArray(v.decisions) && v.decisions.every(isDecisionRecord);
-    case "workerRun":
-      return isString(v.assignmentId) && isString(v.runId) && isOneOf(v.origin, WORKER_RUN_ORIGINS) && isString(v.agentId) && isWorkerRunRuntime(v.runtime) && isOptionalString(v.parentToolCallId);
+function summarizeUnlistedTargetValue(value) {
+  if (typeof value === "string") {
+    return `<string ${countLabel(Buffer.byteLength(value, "utf8"), "byte", "bytes")}>`;
   }
-  return false;
+  if (Array.isArray(value)) return `<array ${countLabel(value.length, "item", "items")}>`;
+  if (value !== null && typeof value === "object") {
+    return `<object ${countLabel(Object.keys(value).length, "field", "fields")}>`;
+  }
+  if (value === null) return "<null 0 values>";
+  if (typeof value === "undefined") return "<undefined 0 values>";
+  return `<${typeof value} 1 value>`;
 }
-
-// src/domains/session/task-board.ts
-var TASK_BOARD_GOAL_ID = "board";
-var LEGACY_TASK_BOARD_ID = "legacy";
-function isOpenUserTask(task) {
-  return task.origin === "user" && (task.status === "pending" || task.status === "active");
-}
-function taskBoardCounts(board) {
-  const counts = {
-    total: board.tasks.length,
-    completed: 0,
-    active: 0,
-    pending: 0,
-    blocked: 0,
-    cancelled: 0,
-    open: 0
-  };
-  for (const task of board.tasks) {
-    if (task.status === "completed") counts.completed += 1;
-    else if (task.status === "active") counts.active += 1;
-    else if (task.status === "pending") counts.pending += 1;
-    else if (task.status === "blocked") counts.blocked += 1;
-    else counts.cancelled += 1;
-  }
-  counts.open = counts.pending + counts.active;
-  return counts;
-}
-function boardStatus(tasks) {
-  const counts = taskBoardCounts({ tasks });
-  if (counts.total === 0) return "pending";
-  if (counts.active > 0) return "active";
-  if (counts.open === 0 && counts.blocked === 0) return "completed";
-  if (counts.blocked > 0 && counts.open === 0) return "blocked";
-  return "pending";
-}
-function toTaskLedgerEntryFields(board, now) {
-  const evidence = [];
-  const subgoals = board.tasks.map((task) => {
-    if (task.status === "completed" && task.evidence) {
-      evidence.push({
-        id: `${task.id}.evidence`,
-        description: task.evidence,
-        status: "passed",
-        observedAt: now.toISOString()
-      });
-    }
-    const goal = {
-      id: task.id,
-      title: task.title,
-      status: task.status,
-      parentGoalId: TASK_BOARD_GOAL_ID
-    };
-    if (task.origin) goal.origin = task.origin;
-    if (task.userTaskId) goal.userTaskId = task.userTaskId;
-    if (task.reason) goal.description = task.reason;
-    return goal;
-  });
-  return {
-    kind: "taskLedger",
-    parentTurnId: null,
-    boardId: board.boardId,
-    goals: [{ id: TASK_BOARD_GOAL_ID, title: board.title, status: boardStatus(board.tasks) }],
-    subgoals,
-    activeRunIds: [...board.activeRunIds],
-    requiredValidationEvidence: evidence
-  };
+function targetFieldName(value) {
+  return sanitizeCallTargetText(value).slice(0, 32) || "field";
 }
-function isTaskLedgerShaped(value) {
-  return isSessionEntry(value) && value.kind === "taskLedger";
-}
-function foldTaskBoard(entries) {
-  let last = null;
-  for (const raw of entries) {
-    if (isTaskLedgerShaped(raw)) last = toEntryView(raw);
-  }
-  return last;
-}
-function foldSessionTaskHistory(entries) {
-  const boards = /* @__PURE__ */ new Map();
-  for (const [index, raw] of entries.entries()) {
-    if (!isTaskLedgerShaped(raw)) continue;
-    const view = toEntryView(raw);
-    if (!view) continue;
-    const boardId = typeof raw.boardId === "string" && raw.boardId.length > 0 ? raw.boardId : LEGACY_TASK_BOARD_ID;
-    const timestamp = typeof raw.timestamp === "string" ? raw.timestamp : "";
-    if (boardId === LEGACY_TASK_BOARD_ID) {
-      boards.set(boardId, {
-        boardId,
-        title: view.title,
-        tasks: new Map(view.tasks.map((task) => [task.id, task])),
-        lastSnapshotAt: timestamp,
-        lastIndex: index
-      });
+function describeCallTarget(tool, args) {
+  if (!args) return "";
+  const allowedFields = CALL_TARGET_FIELDS[tool] ?? [];
+  const allowed = new Set(allowedFields);
+  const parts = [];
+  for (const field of allowedFields) {
+    if (!(field in args)) continue;
+    if (isSecretArgKey(field)) {
+      parts.push(`${targetFieldName(field)}=${summarizeUnlistedTargetValue(args[field])}`);
       continue;
     }
-    const existing = boards.get(boardId);
-    if (!existing) {
-      boards.set(boardId, {
-        boardId,
-        title: view.title,
-        tasks: new Map(view.tasks.map((task) => [task.id, task])),
-        lastSnapshotAt: timestamp,
-        lastIndex: index
-      });
+    const rendered = renderAllowedTargetValue(args[field]);
+    if (rendered === null) {
+      parts.push(`${targetFieldName(field)}=${summarizeUnlistedTargetValue(args[field])}`);
       continue;
     }
-    existing.title = view.title;
-    for (const task of view.tasks) existing.tasks.set(task.id, task);
-    existing.lastSnapshotAt = timestamp;
-    existing.lastIndex = index;
-  }
-  return [...boards.values()].sort((left, right) => right.lastIndex - left.lastIndex).map(({ lastIndex: _lastIndex, tasks, ...board }) => ({ ...board, tasks: [...tasks.values()] }));
-}
-function toEntryView(entry) {
-  const boardGoal = entry.goals[0];
-  if (!boardGoal) return null;
-  const evidenceByTask = /* @__PURE__ */ new Map();
-  for (const item of entry.requiredValidationEvidence) {
-    const taskId = item.id.endsWith(".evidence") ? item.id.slice(0, -".evidence".length) : item.id;
-    evidenceByTask.set(taskId, item.description);
-  }
-  return {
-    boardId: entry.boardId ?? LEGACY_TASK_BOARD_ID,
-    title: boardGoal.title,
-    tasks: entry.subgoals.map((goal) => {
-      const task = {
-        id: goal.id,
-        title: goal.title,
-        status: goal.status,
-        origin: goal.origin ?? "agent"
-      };
-      if (goal.userTaskId) task.userTaskId = goal.userTaskId;
-      if (goal.description) task.reason = goal.description;
-      const evidence = evidenceByTask.get(goal.id);
-      if (evidence) task.evidence = evidence;
-      return task;
-    }),
-    // Run linkage is process-live: the runs recorded in old entries ended
-    // with the process that dispatched them, so a refold starts empty and
-    // the historical linkage stays readable in the earlier entries.
-    activeRunIds: []
-  };
-}
-function nextTaskId(tasks) {
-  let max = 0;
-  for (const task of tasks) {
-    const match = /^t(\d+)$/.exec(task.id);
-    if (match) max = Math.max(max, Number(match[1]));
-  }
-  return max + 1;
-}
-function normalizeTitles(titles) {
-  return titles.map((title) => title.trim()).filter((title) => title.length > 0);
-}
-function applyMutation(board, mutation) {
-  if (mutation.op === "plan") {
-    const titles = normalizeTitles(mutation.tasks);
-    if (mutation.title.trim().length === 0) return { error: "plan requires a non-empty title" };
-    if (titles.length === 0) return { error: "plan requires at least one task" };
-    const retained = board?.tasks.filter(isOpenUserTask) ?? [];
-    const notes2 = [];
-    const replacedOpen = board ? taskBoardCounts(board).open - retained.length : 0;
-    if (board && replacedOpen > 0) {
-      notes2.push(`replaced board "${board.title}" with ${replacedOpen} agent task(s) still open`);
-    }
-    if (retained.length > 0) notes2.push(`preserved ${retained.length} open operator task(s)`);
-    const start = nextTaskId(retained);
-    return {
-      board: {
-        boardId: "",
-        title: mutation.title.trim(),
-        tasks: [
-          ...retained,
-          ...titles.map((title, index) => ({
-            id: `t${start + index}`,
-            title,
-            status: "pending",
-            origin: "agent"
-          }))
-        ],
-        // Runs in flight outlive a board swap: they belong to the session,
-        // so the fresh board inherits the linkage until the runs finish.
-        activeRunIds: board?.activeRunIds ?? []
-      },
-      notes: notes2
-    };
-  }
-  if (mutation.op === "pick") {
-    const title = mutation.title.trim();
-    if (title.length === 0) return { error: "pick requires a non-empty operator task title" };
-    if (!/^u[1-9]\d*$/.test(mutation.userTaskId)) return { error: "pick requires an operator task id like u3" };
-    if (board?.tasks.some(
-      (task) => task.userTaskId === mutation.userTaskId && (task.status === "pending" || task.status === "active" || task.status === "completed")
-    )) {
-      return { error: `operator task ${mutation.userTaskId} is already linked to durable board work` };
-    }
-    const tasks2 = board?.tasks ?? [];
-    const picked = {
-      id: `t${nextTaskId(tasks2)}`,
-      title,
-      status: "pending",
-      origin: "user",
-      userTaskId: mutation.userTaskId
-    };
-    return {
-      board: {
-        boardId: board?.boardId ?? "",
-        title: board?.title ?? "Operator tasks",
-        tasks: [...tasks2, picked],
-        activeRunIds: board?.activeRunIds ?? []
-      },
-      notes: []
-    };
+    parts.push(parts.length === 0 ? rendered : `${targetFieldName(field)}=${rendered}`);
   }
-  if (board === null) return { error: 'no task board yet; declare one with action="plan" first' };
-  if (mutation.op === "add") {
-    const titles = normalizeTitles(mutation.tasks);
-    if (titles.length === 0) return { error: "add requires at least one task" };
-    const start = nextTaskId(board.tasks);
-    const added = titles.map((title, index) => ({
-      id: `t${start + index}`,
-      title,
-      status: "pending",
-      origin: "agent"
-    }));
-    return { board: { ...board, tasks: [...board.tasks, ...added] }, notes: [] };
-  }
-  const target = board.tasks.find((task) => task.id === mutation.id);
-  if (!target) return { error: `task ${mutation.id} not found on the board` };
-  if (mutation.op === "block" && mutation.reason.trim().length === 0) {
-    return { error: "block requires a reason so the ledger records why work stopped" };
-  }
-  if (mutation.op === "done") {
-    if (mutation.evidence.trim().length === 0) {
-      return {
-        error: "done requires note as the evidence that the task actually finished (the command you ran, the file:line you verified). If the work did not happen, use block with a reason or drop it."
-      };
-    }
-    if (target.status === "pending") {
-      return {
-        error: `task ${target.id} was never started, so it cannot be completed. Start it and do the work, or record the truth with block (reason) or drop.`
-      };
-    }
+  for (const [field, value] of Object.entries(args)) {
+    if (allowed.has(field)) continue;
+    parts.push(`${targetFieldName(field)}=${summarizeUnlistedTargetValue(value)}`);
   }
-  const notes = [];
-  const tasks = board.tasks.map((task) => {
-    if (task.id !== target.id) {
-      if (mutation.op === "start" && task.status === "active") {
-        notes.push(`parked ${task.id} back to pending (one task active at a time)`);
-        return { ...task, status: "pending" };
-      }
-      return task;
-    }
-    return applyStatusMutation(task, mutation);
-  });
-  return { board: { ...board, tasks }, notes };
-}
-function applyStatusMutation(task, mutation) {
-  switch (mutation.op) {
-    case "start":
-      return { ...task, status: "active" };
-    case "done": {
-      const done = { ...task, status: "completed", evidence: mutation.evidence.trim() };
-      delete done.reason;
-      return done;
-    }
-    case "block":
-      return { ...task, status: "blocked", reason: mutation.reason.trim() };
-    case "drop": {
-      const dropped = { ...task, status: "cancelled" };
-      if (mutation.reason?.trim()) dropped.reason = mutation.reason.trim();
-      return dropped;
-    }
-  }
-}
-function createTaskBoardStore(deps = {}) {
-  let cachedSessionId;
-  let dirty = true;
-  let board = null;
-  const syncToSession = () => {
-    const sessionId = deps.getSessionId?.() ?? null;
-    if (!dirty && cachedSessionId === sessionId) return;
-    dirty = false;
-    cachedSessionId = sessionId;
-    try {
-      board = deps.readEntries ? foldTaskBoard(deps.readEntries()) : null;
-    } catch {
-      board = null;
-    }
-  };
-  const persist = (next) => {
-    try {
-      deps.appendEntry?.(toTaskLedgerEntryFields(next, deps.now?.() ?? /* @__PURE__ */ new Date()));
-    } catch {
-    }
-  };
-  const mutationRequiresAcknowledgement = (current, mutation) => {
-    if (mutation.op === "pick") return true;
-    if (mutation.op === "plan") return current?.tasks.some(isOpenUserTask) ?? false;
-    if (mutation.op !== "done") return false;
-    return current?.tasks.some((task) => task.id === mutation.id && task.origin === "user") ?? false;
-  };
-  return {
-    snapshot() {
-      syncToSession();
-      return board;
-    },
-    cachedSnapshot() {
-      const sessionId = deps.getSessionId?.() ?? null;
-      return !dirty && cachedSessionId === sessionId ? board : null;
-    },
-    historySnapshot() {
-      syncToSession();
-      try {
-        return deps.readEntries ? foldSessionTaskHistory(deps.readEntries()) : [];
-      } catch {
-        return [];
-      }
-    },
-    apply(mutation) {
-      syncToSession();
-      const result = applyMutation(board, mutation);
-      if ("error" in result) return { ok: false, message: result.error };
-      const needsBoardId = mutation.op === "plan" || result.board.boardId.length === 0;
-      const nextBoard = needsBoardId ? { ...result.board, boardId: deps.createBoardId?.() ?? randomUUID() } : result.board;
-      if (mutationRequiresAcknowledgement(board, mutation)) {
-        if (!deps.appendEntry) {
-          return { ok: false, message: "durable task-ledger persistence is unavailable for operator-linked work" };
-        }
-        try {
-          deps.appendEntry(toTaskLedgerEntryFields(nextBoard, deps.now?.() ?? /* @__PURE__ */ new Date()));
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          return { ok: false, message: `could not persist operator-linked task board: ${message}` };
-        }
-        board = nextBoard;
-        return { ok: true, board: nextBoard, notes: result.notes };
-      }
-      board = nextBoard;
-      persist(nextBoard);
-      return { ok: true, board: nextBoard, notes: result.notes };
-    },
-    attachRun(runId) {
-      syncToSession();
-      if (board === null || runId.length === 0 || board.activeRunIds.includes(runId)) return;
-      board = { ...board, activeRunIds: [...board.activeRunIds, runId] };
-      persist(board);
-    },
-    detachRun(runId) {
-      syncToSession();
-      if (board === null || !board.activeRunIds.includes(runId)) return;
-      board = { ...board, activeRunIds: board.activeRunIds.filter((id) => id !== runId) };
-      persist(board);
-    },
-    invalidate() {
-      dirty = true;
-    }
-  };
+  return sanitizeCallTargetText(parts.join(" \xB7 ")).slice(0, CALL_TARGET_MAX_CHARS);
 }
 
 // src/engine/antigravity/subprocess-runtime.ts
 init_esm_shims();
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 
 // src/engine/external-subprocess.ts
 init_esm_shims();
@@ -1464,7 +1742,7 @@ async function readStdout(child, emit, state) {
 }
 function startAntigravityWorkerRun(input, emit) {
   const args = buildAgyArgs(input);
-  const child = spawn(ANTIGRAVITY_BINARY, args, {
+  const child = spawn2(ANTIGRAVITY_BINARY, args, {
     cwd: process.cwd(),
     env: process.env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -1519,7 +1797,7 @@ function startAntigravityWorkerRun(input, emit) {
 
 // src/engine/claude/subprocess-runtime.ts
 init_esm_shims();
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { createInterface } from "node:readline";
 
 // src/engine/claude/session-id.ts
@@ -1712,7 +1990,7 @@ async function readJsonLines(child, emit, state) {
 }
 function startClaudeCodeWorkerRun(input, emit) {
   const args = buildClaudeCodeArgs(input);
-  const child = spawn2("claude", args, {
+  const child = spawn3("claude", args, {
     cwd: process.cwd(),
     env: process.env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -1775,6 +2053,12 @@ function startClaudeCodeWorkerRun(input, emit) {
 init_esm_shims();
 var WORKER_RUNTIME_MEDIATES_CLIO_DISPATCH = false;
 
+// src/tools/builtin-tool-catalog.ts
+init_esm_shims();
+
+// src/tools/bash.ts
+init_esm_shims();
+
 // src/tools/presentation.ts
 init_esm_shims();
 var FOLDED = { foldDefault: "folded", showDiffWhenFolded: false, failureExcerpt: true };
@@ -1827,8 +2111,215 @@ function toolPresentationPolicy(toolName, args) {
   return TOOL_PRESENTATION[toolName] ?? FOLDED;
 }
 
-// src/tools/builtin-tool-catalog.ts
-init_esm_shims();
+// src/tools/bash.ts
+var BASH_DISPLAY_MAX_BYTES = 16 * 1024;
+var BASH_OUTPUT_POLICIES = /* @__PURE__ */ new Set(["full", "bounded", "summary", "metadata-only"]);
+function bashContextDisposition(policy) {
+  if (policy === "full") {
+    return { mode: "full", maxBytes: BASH_DISPLAY_MAX_BYTES, downgradeExcerpt: "tail" };
+  }
+  if (policy === "summary") {
+    return {
+      mode: "summary",
+      maxBytes: BASH_DISPLAY_MAX_BYTES,
+      strategy: "diagnostic",
+      redact: true
+    };
+  }
+  if (policy === "metadata-only") return { mode: "metadata-only", maxBytes: BASH_DISPLAY_MAX_BYTES };
+  return { mode: "bounded", maxBytes: BASH_DISPLAY_MAX_BYTES, excerpt: "tail" };
+}
+var BASH_DEFAULT_RESULT_DISPOSITION = {
+  presentation: {
+    ...toolPresentationPolicy(ToolNames.Bash, void 0),
+    maxBytes: BASH_DISPLAY_MAX_BYTES,
+    overflow: "tail"
+  },
+  context: bashContextDisposition("bounded")
+};
+function normalizeBashArguments(args) {
+  return args.output_policy === void 0 ? { ...args, output_policy: "bounded" } : args;
+}
+function bashOutputPolicy(args) {
+  const value = args.output_policy;
+  return typeof value === "string" && BASH_OUTPUT_POLICIES.has(value) ? value : null;
+}
+function resolveBashResultDisposition(args, declared = BASH_DEFAULT_RESULT_DISPOSITION) {
+  const policy = bashOutputPolicy(args) ?? "bounded";
+  const base = declared ?? BASH_DEFAULT_RESULT_DISPOSITION;
+  return { presentation: base.presentation, context: bashContextDisposition(policy) };
+}
+function normalizedBashDisposition(policy) {
+  return {
+    presentation: { ...BASH_DEFAULT_RESULT_DISPOSITION.presentation, maxBytes: BASH_DISPLAY_MAX_BYTES },
+    context: bashContextDisposition(policy)
+  };
+}
+function shapeBashProgress(rawOutput, outputBytes, policy) {
+  const disposition = normalizedBashDisposition(policy);
+  let output;
+  if (policy === "metadata-only") {
+    output = `bash: running; captured ${outputBytes} bytes; stdout/stderr omitted by metadata-only policy`;
+  } else if (policy === "summary") {
+    output = deterministicDiagnosticSummary(rawOutput, BASH_DISPLAY_MAX_BYTES, true).text;
+  } else {
+    output = truncateTail(rawOutput, {
+      maxLines: DEFAULT_MAX_LINES,
+      maxBytes: disposition.context.maxBytes
+    }).content;
+  }
+  return {
+    kind: "ok",
+    output,
+    details: {
+      resultSize: {
+        bytes: outputBytes,
+        shownBytes: byteLength(output),
+        maxBytes: BASH_DISPLAY_MAX_BYTES,
+        truncated: byteLength(rawOutput) > byteLength(output),
+        policy
+      }
+    }
+  };
+}
+function bashResultDetails(result, rawOutput, outcome) {
+  return {
+    outcome,
+    exitCode: result.exitCode,
+    signal: result.signal,
+    timedOut: result.timedOut,
+    aborted: result.aborted,
+    outputCapped: result.outputCapped,
+    outputBytes: result.outputBytes,
+    retainedBytes: byteLength(rawOutput),
+    stdoutBytes: byteLength(result.stdout),
+    stderrBytes: byteLength(result.stderr)
+  };
+}
+var OBSERVE_COMMAND_PATTERN = /^\s*(?:cat|head|tail|ls|grep|rg|find)\b/;
+var OBSERVE_NUDGE_SESSION_LIMIT = 64;
+var observeNudgeSeenSessions = /* @__PURE__ */ new Set();
+function observeToolsNudge(command, sessionId) {
+  if (!OBSERVE_COMMAND_PATTERN.test(command)) return "";
+  const key = sessionId ?? "no-session";
+  if (observeNudgeSeenSessions.has(key)) return "";
+  if (observeNudgeSeenSessions.size >= OBSERVE_NUDGE_SESSION_LIMIT) {
+    const oldest = observeNudgeSeenSessions.values().next().value;
+    if (oldest !== void 0) observeNudgeSeenSessions.delete(oldest);
+  }
+  observeNudgeSeenSessions.add(key);
+  return "\n\n[note: prefer the structured observe tools over shell file inspection: read pages files with offset/limit, ls lists directories, grep and find search, code_nav maps symbols. Their results are capped and continuable; keep bash for builds, git, and scripts.]";
+}
+var bashTool = {
+  name: ToolNames.Bash,
+  description: "Execute a bash command inside the session workspace. output_policy controls model context: bounded keeps the diagnostic tail and is the default; summary keeps deterministic redacted diagnostics; metadata-only keeps facts and retrieval; full is admitted only within the result budget.",
+  parameters: typebox_exports.Object({
+    command: typebox_exports.String({ description: "Bash command to execute." }),
+    cwd: typebox_exports.Optional(
+      typebox_exports.String({
+        description: "Omit this. The command already runs at the session workspace root. Set it only to run in a subdirectory of that root, as a relative path; an absolute path outside the root is blocked."
+      })
+    ),
+    timeout_ms: typebox_exports.Optional(typebox_exports.Number({ description: "Timeout in milliseconds." })),
+    output_policy: typebox_exports.Optional(
+      typebox_exports.Union([typebox_exports.Literal("full"), typebox_exports.Literal("bounded"), typebox_exports.Literal("summary"), typebox_exports.Literal("metadata-only")], {
+        description: "Model-context disposition. Omit for bounded tail output. Use summary for noisy runs, metadata-only when only status and retrieval matter, and full only for known-small output."
+      })
+    )
+  }),
+  baseActionClass: "execute",
+  executionMode: "sequential",
+  prepareArguments: normalizeBashArguments,
+  resolveResultDisposition: resolveBashResultDisposition,
+  async run(args, options) {
+    args = normalizeBashArguments(args);
+    if (typeof args.command !== "string" || args.command.length === 0) {
+      return { kind: "error", message: "bash: missing command argument" };
+    }
+    const outputPolicy = bashOutputPolicy(args);
+    if (outputPolicy === null) {
+      return {
+        kind: "error",
+        message: "bash: output_policy must be one of full, bounded, summary, or metadata-only (omit it for bounded)",
+        details: { outcome: "invalid-arguments", exitCode: null }
+      };
+    }
+    const cwdArg = typeof args.cwd === "string" && args.cwd.length > 0 ? args.cwd : void 0;
+    let cwd;
+    try {
+      cwd = resolveSafeCwd(cwdArg === void 0 ? void 0 : expandPath(cwdArg), process.cwd());
+    } catch {
+      return {
+        kind: "error",
+        message: `bash: cwd '${cwdArg}' escapes workspace root '${process.cwd()}'; use a typed tool or a project policy entry with explicit cwd`
+      };
+    }
+    const timeout = typeof args.timeout_ms === "number" && args.timeout_ms > 0 ? args.timeout_ms : 3e5;
+    try {
+      const runOptions = {
+        cwd,
+        timeoutMs: timeout,
+        ...options?.signal === void 0 ? {} : { signal: options.signal }
+      };
+      if (options?.onUpdate !== void 0) {
+        runOptions.onUpdate = (progress) => {
+          options.onUpdate?.(shapeBashProgress(combineBashOutput(progress), progress.outputBytes, outputPolicy));
+        };
+      }
+      const result = await runBashCommand(args.command, runOptions);
+      const { error, aborted, timedOut, outputCapped } = result;
+      const rawOutput = combineBashOutput(result);
+      const output = rawOutput.trim();
+      if (aborted) {
+        const status = "bash: command aborted";
+        return {
+          kind: "error",
+          message: output.length > 0 ? `${output}
+
+${status}` : status,
+          details: bashResultDetails(result, rawOutput, "abort")
+        };
+      }
+      if (timedOut) {
+        const status = `bash: command timed out after ${timeout}ms`;
+        return {
+          kind: "error",
+          message: output.length > 0 ? `${output}
+
+${status}` : status,
+          details: bashResultDetails(result, rawOutput, "timeout")
+        };
+      }
+      if (outputCapped) {
+        const status = `bash: command output exceeded ${BASH_HARD_CAP_BYTES} bytes and was stopped`;
+        return {
+          kind: "error",
+          message: output.length > 0 ? `${output}
+
+${status}` : status,
+          details: bashResultDetails(result, rawOutput, "output-cap")
+        };
+      }
+      if (error) {
+        const code = typeof error.code === "number" ? error.code : error.code;
+        const status = `bash: command failed (exit ${code ?? "?"})`;
+        const message = output.length > 0 ? `${output}
+
+${status}` : `${status}: ${error.message}`;
+        return { kind: "error", message, details: bashResultDetails(result, rawOutput, "nonzero") };
+      }
+      const body = rawOutput.length > 0 ? rawOutput : "(no output)";
+      return {
+        kind: "ok",
+        output: `${body}${observeToolsNudge(args.command, options?.sessionId)}`,
+        details: bashResultDetails(result, rawOutput, "success")
+      };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { kind: "error", message: `bash: ${msg}` };
+    }
+  }
+};
 
 // src/tools/read.ts
 init_esm_shims();
@@ -2031,7 +2522,7 @@ var TOOL_METADATA = {
       "Use a narrower query or scope to inspect omitted content."
     ),
     costLatency: "local_fast",
-    promptHint: 'Call context with scope="skills" to list installed and marketplace skills; when one matches the task, or the operator names a skill or asks how one works, suggest the operator run /skill <name> (a marketplace skill is offered for install) and never load it uninvited. When the user message carries a skill request, first load that skill via context (scope="skills", name=<skill>) before doing anything else.'
+    promptHint: 'Call context with scope="skills" to list installed and marketplace skills; when one matches the task, or the operator names a skill or asks how one works, suggest the operator run /skill <name> (a marketplace skill is offered for install) and never load it uninvited. When the user message carries a skill request, first load that skill via context (scope="skills", name=<skill>) before doing anything else. When an [evicted ...] marker names content you need, recall it with context(scope="recall", ref=...); re-read the file only when the marker says it changed.'
   },
   [ToolNames.CredentialPresent]: {
     objective: "Check whether a credential key is present without returning its value.",
@@ -2059,15 +2550,18 @@ var TOOL_METADATA = {
     resultSizePolicy: exactMutationPolicy,
     costLatency: "local_fast"
   },
-  // EXECUTE: the safe-exec spine (bash offloads its own overflow).
+  // EXECUTE: the safe-exec spine (canonical shaping offloads Bash overflow).
   [ToolNames.Bash]: {
     objective: "Execute an explicit shell command when narrower tools are insufficient.",
     uiLabel: "Shell",
     retrySafety: "unknown",
-    resultSizePolicy: summaryPolicy(
-      "Use a narrower command or a dedicated verification/read/search tool to inspect omitted output."
-    ),
-    costLatency: "local_slow"
+    resultSizePolicy: {
+      ...summaryPolicy("Use a narrower command or a dedicated verification/read/search tool to inspect omitted output."),
+      offloadMaxBytes: BASH_HARD_CAP_BYTES
+    },
+    resultDisposition: BASH_DEFAULT_RESULT_DISPOSITION,
+    costLatency: "local_slow",
+    promptHint: "Bash output_policy defaults to bounded diagnostic tail. Use summary for noisy commands, metadata-only when only outcome and retrieval matter, and full only when output is known to fit the bounded result budget."
   },
   [ToolNames.Git]: {
     objective: "Read-only git inspection: status, diff, or log.",
@@ -2548,6 +3042,7 @@ var KNOWN_KEYS = /* @__PURE__ */ new Set([
   "target",
   "model",
   "thinkingLevel",
+  "budget",
   "node",
   "routingIntent",
   "failover",
@@ -2578,12 +3073,12 @@ var VALID_COMPETE_STANCES = new Set(COMPETE_STANCES);
 var VALID_THINKING = new Set(THINKING_LEVELS);
 var VALID_REQUEST_ORIGINS = /* @__PURE__ */ new Set(["user", "agent", "internal"]);
 var VALID_FAILOVER_MODES = /* @__PURE__ */ new Set(["none", "approved", "automatic"]);
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function validateJobSpec(spec) {
   const errors = [];
-  if (!isPlainObject2(spec)) {
+  if (!isPlainObject3(spec)) {
     return { ok: false, errors: ["spec must be an object"] };
   }
   for (const key of Object.keys(spec)) {
@@ -2672,7 +3167,7 @@ function validateJobSpec(spec) {
     errors.push("failover automatic is not allowed on a plan-approved dispatch");
   }
   if ("plannedNode" in spec && spec.plannedNode !== void 0) {
-    if (!isPlainObject2(spec.plannedNode)) {
+    if (!isPlainObject3(spec.plannedNode)) {
       errors.push("plannedNode must be an object");
     } else {
       for (const key of Object.keys(spec.plannedNode)) {
@@ -2693,7 +3188,7 @@ function validateJobSpec(spec) {
     }
   }
   if ("protectedArtifactRemap" in spec && spec.protectedArtifactRemap !== void 0) {
-    if (!isPlainObject2(spec.protectedArtifactRemap) || Object.keys(spec.protectedArtifactRemap).some((key) => key !== "sourceRoot" && key !== "workerRoot") || typeof spec.protectedArtifactRemap.sourceRoot !== "string" || !path2.isAbsolute(spec.protectedArtifactRemap.sourceRoot) || typeof spec.protectedArtifactRemap.workerRoot !== "string" || !path2.isAbsolute(spec.protectedArtifactRemap.workerRoot)) {
+    if (!isPlainObject3(spec.protectedArtifactRemap) || Object.keys(spec.protectedArtifactRemap).some((key) => key !== "sourceRoot" && key !== "workerRoot") || typeof spec.protectedArtifactRemap.sourceRoot !== "string" || !path2.isAbsolute(spec.protectedArtifactRemap.sourceRoot) || typeof spec.protectedArtifactRemap.workerRoot !== "string" || !path2.isAbsolute(spec.protectedArtifactRemap.workerRoot)) {
       errors.push("protectedArtifactRemap must carry absolute sourceRoot and workerRoot paths");
     }
   }
@@ -2707,6 +3202,14 @@ function validateJobSpec(spec) {
       errors.push("thinkingLevel must be one of: off|minimal|low|medium|high|xhigh");
     }
   }
+  let budget;
+  if ("budget" in spec && spec.budget !== void 0) {
+    try {
+      budget = cloneDispatchBudgetRequest(spec.budget);
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
   if ("requiredCapabilities" in spec && spec.requiredCapabilities !== void 0) {
     if (!Array.isArray(spec.requiredCapabilities) || spec.requiredCapabilities.some((c) => typeof c !== "string")) {
       errors.push("requiredCapabilities must be a string[]");
@@ -2833,6 +3336,7 @@ function validateJobSpec(spec) {
     out.reroutes = spec.reroutes.map((hop) => ({ ...hop }));
   }
   if (typeof spec.thinkingLevel === "string") out.thinkingLevel = spec.thinkingLevel;
+  if (budget !== void 0) out.budget = budget;
   if (Array.isArray(spec.requiredCapabilities)) {
     out.requiredCapabilities = spec.requiredCapabilities.map((c) => String(c));
   }
@@ -2869,7 +3373,7 @@ function isValidPredecessorHandoffs(value) {
   if (!Array.isArray(value) || value.length > EXECUTION_HANDOFF_MAX_ITEMS || Buffer.byteLength(JSON.stringify(value), "utf8") > EXECUTION_HANDOFF_MAX_TEXT_BYTES * 2)
     return false;
   return value.every((candidate) => {
-    if (!isPlainObject2(candidate)) return false;
+    if (!isPlainObject3(candidate)) return false;
     const fields = [
       candidate.stepId,
       candidate.assignmentId,
@@ -2881,14 +3385,14 @@ function isValidPredecessorHandoffs(value) {
   });
 }
 function isValidPipelineInput(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   const fromRunOk = value.fromRunId === null || typeof value.fromRunId === "string" && value.fromRunId.length > 0;
   const positionOk = typeof value.position === "number" && Number.isInteger(value.position) && value.position >= 1;
   const textOk = typeof value.text === "string";
   return fromRunOk && positionOk && textOk;
 }
 function isValidReroute(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   const attemptOk = typeof value.attempt === "number" && Number.isInteger(value.attempt) && value.attempt >= 1;
   const fromOk = typeof value.fromNode === "string" && value.fromNode.length > 0;
   const toOk = typeof value.toNode === "string";
@@ -2896,7 +3400,7 @@ function isValidReroute(value) {
   return attemptOk && fromOk && toOk && reasonOk;
 }
 function isValidFailoverCandidate(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   if (Object.keys(value).some((key) => key !== "agentId" && key !== "target" && key !== "model" && key !== "node")) {
     return false;
   }
@@ -2905,26 +3409,26 @@ function isValidFailoverCandidate(value) {
   );
 }
 function isValidPlannedNode(value) {
-  if (!isPlainObject2(value) || typeof value.id !== "string" || value.id.trim().length === 0) return false;
+  if (!isPlainObject3(value) || typeof value.id !== "string" || value.id.trim().length === 0) return false;
   if (value.kind === "local") return value.host === void 0;
   return value.kind === "ssh" && typeof value.host === "string" && value.host.trim().length > 0;
 }
 function isValidProtectedArtifactRemap(value) {
-  return isPlainObject2(value) && typeof value.sourceRoot === "string" && path2.isAbsolute(value.sourceRoot) && typeof value.workerRoot === "string" && path2.isAbsolute(value.workerRoot);
+  return isPlainObject3(value) && typeof value.sourceRoot === "string" && path2.isAbsolute(value.sourceRoot) && typeof value.workerRoot === "string" && path2.isAbsolute(value.workerRoot);
 }
 var VALID_GATE_ROLES = /* @__PURE__ */ new Set(["builder", "reviewer", "candidate", "judge"]);
 var VALID_GATE_VERDICTS = /* @__PURE__ */ new Set(["pass", "fail", "revise"]);
 var VALID_PLAN_TOPOLOGIES = /* @__PURE__ */ new Set(["parallel", "sequential", "pipeline", "review", "compete", "detached", "fleet"]);
 var VALID_PLAN_APPROVALS = /* @__PURE__ */ new Set(["operator", "full-auto"]);
 function isValidGate(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   if (typeof value.role !== "string" || !VALID_GATE_ROLES.has(value.role)) return false;
   if (typeof value.group !== "string" || value.group.length === 0) return false;
   if (typeof value.cycle !== "number" || !Number.isInteger(value.cycle) || value.cycle < 1) return false;
   if (value.subjects !== void 0) {
     if (!Array.isArray(value.subjects)) return false;
     for (const subject of value.subjects) {
-      if (!isPlainObject2(subject)) return false;
+      if (!isPlainObject3(subject)) return false;
       if (typeof subject.runId !== "string" || subject.runId.length === 0) return false;
       if (subject.digest !== null && typeof subject.digest !== "string") return false;
     }
@@ -2944,13 +3448,13 @@ function cloneGate(gate) {
   };
 }
 function isValidPlan(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   if (typeof value.hash !== "string" || value.hash.length === 0) return false;
   if (typeof value.topology !== "string" || !VALID_PLAN_TOPOLOGIES.has(value.topology)) return false;
   if (typeof value.taskCount !== "number" || !Number.isInteger(value.taskCount) || value.taskCount < 1) return false;
   if (typeof value.approval !== "string" || !VALID_PLAN_APPROVALS.has(value.approval)) return false;
   if (value.source !== null) {
-    if (!isPlainObject2(value.source) || value.source.kind !== "scout-transition" || typeof value.source.runId !== "string" || value.source.runId.length === 0 || typeof value.source.receiptDigest !== "string" || !/^[0-9a-f]{64}$/u.test(value.source.receiptDigest) || typeof value.source.executionPlanHash !== "string" || !/^[0-9a-f]{64}$/u.test(value.source.executionPlanHash))
+    if (!isPlainObject3(value.source) || value.source.kind !== "scout-transition" || typeof value.source.runId !== "string" || value.source.runId.length === 0 || typeof value.source.receiptDigest !== "string" || !/^[0-9a-f]{64}$/u.test(value.source.receiptDigest) || typeof value.source.executionPlanHash !== "string" || !/^[0-9a-f]{64}$/u.test(value.source.executionPlanHash))
       return false;
   }
   if (value.approvalRequestId !== void 0 && (typeof value.approvalRequestId !== "string" || value.approvalRequestId.length === 0)) {
@@ -2965,7 +3469,7 @@ function isValidPlan(value) {
   return true;
 }
 function isValidLineage(value) {
-  if (!isPlainObject2(value)) return false;
+  if (!isPlainObject3(value)) return false;
   const parentOk = value.parentRunId === null || typeof value.parentRunId === "string" && value.parentRunId.length > 0;
   const rootOk = typeof value.rootRunId === "string" && value.rootRunId.length > 0;
   const attemptOk = typeof value.attempt === "number" && Number.isInteger(value.attempt) && value.attempt >= 0;
@@ -3180,9 +3684,10 @@ function finishDecision(decision) {
   if (decision.kind === "ask") return "permission_requested";
   return "blocked";
 }
-function emitToolFinish(emit, mapped, startedAtClock, decision, outcome, reason, reasonCode) {
+function emitToolFinish(emit, mapped, startedAtClock, decision, outcome, reason, reasonCode, toolCallId) {
   const event = {
     tool: mapped.clioToolName,
+    ...toolCallId !== void 0 ? { toolCallId } : {},
     posture: "operating",
     durationMs: Math.round(performance.now() - startedAtClock),
     outcome,
@@ -3200,10 +3705,14 @@ function emitClaudeToolPermissionDecision(input) {
   const startedAt = Date.now();
   const startedAtClock = performance.now();
   const decision = evaluateClaudeToolPermission(input);
+  const toolCallId = input.toolCallId?.trim() ? input.toolCallId : void 0;
+  const action = describeCallAction(decision.mapped.clioToolName, decision.mapped.args);
   const start = {
     tool: decision.mapped.clioToolName,
+    ...toolCallId !== void 0 ? { toolCallId } : {},
     posture: "operating",
-    startedAt
+    startedAt,
+    ...action !== null ? { action } : {}
   };
   input.emit({ type: "clio_tool_start", payload: start });
   if (decision.kind === "allow") {
@@ -3214,7 +3723,8 @@ function emitClaudeToolPermissionDecision(input) {
       decision.decision,
       "ok",
       decision.reason,
-      decision.reasonCode
+      decision.reasonCode,
+      toolCallId
     );
     return decision;
   }
@@ -3237,7 +3747,8 @@ function emitClaudeToolPermissionDecision(input) {
     decision.decision,
     "blocked",
     decision.reason,
-    decision.reasonCode
+    decision.reasonCode,
+    toolCallId
   );
   return decision;
 }
@@ -3419,6 +3930,11 @@ export {
   responseSchemaConflictsWithTools,
   UnsupportedResponseSchemaError,
   isResponseSchemaRejection,
+  redactSecretString,
+  redactToolArgs,
+  sanitizeCallTargetText,
+  describeCallAction,
+  describeCallTarget,
   TOOL_PROFILE_NAMES,
   isToolProfileName,
   assertToolProfileEnforceable,
@@ -3433,8 +3949,11 @@ export {
   emitClaudeToolPermissionDecision,
   coerceToolInput,
   WORKER_RUNTIME_MEDIATES_CLIO_DISPATCH,
+  combineBashOutput,
+  runBashCommand,
   classifyResourceRead,
   toolPresentationPolicy,
+  bashTool,
   readMaxBytes,
   readTool,
   toolPromptHintsForNames,
@@ -3461,6 +3980,13 @@ export {
   AGENT_LEDGER_PROMPT_MAX_CHARS,
   claimConflicts,
   renderAgentLedger,
+  cloneDispatchBudgetRequest,
+  resolveToolBudgetEnvelope,
+  formatBudgetPolicy,
+  formatBudgetRequest,
+  formatEffectiveBudget,
+  formatBudgetReasons,
+  cloneRunToolBudgetEnvelope,
   REVIEWER_GATE_PROMPT,
   JUDGE_GATE_PROMPT,
   COMPETE_STANCES,
@@ -3472,11 +3998,6 @@ export {
   runKindSupportsLiveSteering,
   projectExecutionHandoffs,
   DISPATCH_BRIEFING_MAX_BYTES,
-  validateJobSpec,
-  isSessionHeader,
-  isSessionEntry,
-  taskBoardCounts,
-  foldSessionTaskHistory,
-  createTaskBoardStore
+  validateJobSpec
 };
-//# sourceMappingURL=chunk-LWLEKMDQ.js.map
+//# sourceMappingURL=chunk-XXQNGV4M.js.map