@mrrlin-dev/mcp 0.4.107 → 0.4.109

package/dist/bin.cjs

@@ -37432,6 +37432,7 @@ var openApiOperationIds = {
   listOperatorTranscriptMessages: "listOperatorTranscriptMessages",
   createIntentProposal: "createIntentProposal",
   getIntentProposal: "getIntentProposal",
+  listIntentProposals: "listIntentProposals",
   recordIntentClarification: "recordIntentClarification",
   answerIntentClarification: "answerIntentClarification",
   confirmIntentProposal: "confirmIntentProposal",
@@ -38171,13 +38172,13 @@ var mrrlinIntentProposalSchema = external_exports.object({
   updatedAt: external_exports.string()
 });
 var mrrlinIntentProposalCreateSchema = external_exports.object({
-  proposalId: external_exports.string().uuid(),
-  version: external_exports.number().int().min(1),
+  proposalId: external_exports.string().uuid().optional(),
+  version: external_exports.number().int().min(1).optional(),
   resolvedIntent: external_exports.record(external_exports.string(), external_exports.unknown()),
-  digest: external_exports.string().min(1),
+  digest: external_exports.string().min(1).optional(),
   transcriptRevision: external_exports.string().optional(),
-  expectedTranscriptRevisionNumber: external_exports.number().int().nonnegative(),
-  messageIds: external_exports.array(external_exports.string().uuid())
+  expectedTranscriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  messageIds: external_exports.array(external_exports.string().uuid()).min(1).optional()
 }).strict();
 var intentProposalResponseSchema = external_exports.object({
   data: mrrlinIntentProposalSchema
@@ -38221,7 +38222,8 @@ var mrrlinIntentConfirmRequestSchema = external_exports.object({
   actor: external_exports.string().min(1).optional(),
   materializeParams: external_exports.object({
     task: external_exports.object({
-      id: external_exports.string().min(1),
+      // Omitted ⇒ the API allocates the next per-project GT-N id before confirming.
+      id: external_exports.string().min(1).optional(),
       title: external_exports.string().min(1).optional(),
       category: external_exports.string().optional(),
       subcategory: external_exports.string().optional(),
@@ -38268,11 +38270,16 @@ var mrrlinIntentConfirmationSchema = external_exports.object({
   digest: external_exports.string().min(1),
   transcriptRevision: external_exports.string(),
   transcriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  // The task the confirmation materialized, when it materialized one.
+  materializedTaskId: external_exports.string().nullable().optional(),
   createdAt: external_exports.string()
 });
 var intentConfirmationMaybeResponseSchema = external_exports.object({
   data: mrrlinIntentConfirmationSchema.nullable()
 });
+var intentProposalListResponseSchema = external_exports.object({
+  data: external_exports.array(mrrlinIntentProposalSchema)
+});
 
 // ../../packages/schemas/dist/appsumo.js
 var APPSUMO_CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -41024,8 +41031,8 @@ function createMrrlinClient(config2) {
         throw error51;
       }
     },
-    async getActiveAsyncJob(projectSlug, toolName, dedupKey) {
-      const url2 = appendQuery(`${projectPath(projectSlug)}/async-jobs/active`, { toolName, dedupKey });
+    async getActiveAsyncJob(projectSlug, toolName2, dedupKey) {
+      const url2 = appendQuery(`${projectPath(projectSlug)}/async-jobs/active`, { toolName: toolName2, dedupKey });
       const body = await request(url2);
       return asyncJobMaybeResponseSchema.parse(body).data;
     },
@@ -41647,6 +41654,10 @@ function createMrrlinClient(config2) {
       });
       return intentProposalResponseSchema.parse(body).data;
     },
+    async listIntentProposals(projectSlug) {
+      const body = await request(`${projectPath(projectSlug)}/intent/proposals`);
+      return intentProposalListResponseSchema.parse(body).data;
+    },
     async getIntentProposal(projectSlug, proposalId, version2) {
       try {
         const body = await request(`${projectPath(projectSlug)}/intent/proposals/${encodeURIComponent(proposalId)}/${encodeURIComponent(String(version2))}`);
@@ -41685,7 +41696,7 @@ function createMrrlinClient(config2) {
         if (error51 instanceof MrrlinApiError && (error51.status === 409 || error51.status === 422)) {
           try {
             const parsed = JSON.parse(error51.responseBody);
-            const maybeResult = mrrlinIntentConfirmResponseSchema.safeParse(parsed);
+            const maybeResult = mrrlinIntentConfirmResponseSchema.safeParse(parsed?.data ?? parsed);
             if (maybeResult.success)
               return maybeResult.data;
           } catch {
@@ -44170,6 +44181,23 @@ var CodexAgentHandle = class {
   }
 };
 
+// ../../packages/agent-client/dist/providers/thread-env.js
+function threadProcessEnv(childEnv, additions) {
+  if (!additions || Object.keys(additions).length === 0)
+    return childEnv;
+  const env = { ...childEnv ?? process.env };
+  for (const [key, value] of Object.entries(additions)) {
+    if (value === null)
+      delete env[key];
+    else
+      env[key] = value;
+  }
+  return env;
+}
+function envOption(env) {
+  return env === void 0 ? {} : { env };
+}
+
 // ../../packages/agent-client/dist/providers/claude/process.js
 var import_node_child_process3 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
@@ -44198,7 +44226,11 @@ var ClaudeProcess = class {
     if (options.brokerSocket != null) {
       stdio[3] = options.brokerSocket;
     }
-    this.child = (0, import_node_child_process3.spawn)(spawnCmd[0], spawnCmd.slice(1), {
+    const [spawnExecutable, ...spawnArgs] = spawnCmd;
+    if (spawnExecutable === void 0) {
+      throw new Error("Claude command wrapper returned no executable");
+    }
+    this.child = (0, import_node_child_process3.spawn)(spawnExecutable, spawnArgs, {
       cwd: options.cwd?.trim() || void 0,
       // Inherit the operator's env so the CLI picks up their own ~/.claude.json tool registry —
       // unless an explicit mcpConfig was provided in options.
@@ -44546,7 +44578,7 @@ var ClaudeAgentHandle = class {
       appendSystemPrompt: params.baseInstructions,
       wrapCommand: this.wrapCommand,
       brokerSocket: this.brokerSocket,
-      ...this.childEnv === void 0 ? {} : { env: this.childEnv }
+      ...envOption(threadProcessEnv(this.childEnv, params.env))
     });
     this.processes.set(child.sessionId, child);
     this.mappers.set(child.sessionId, new ClaudeBridgeEventMapper());
@@ -44568,7 +44600,7 @@ var ClaudeAgentHandle = class {
       appendSystemPrompt: params.baseInstructions,
       wrapCommand: this.wrapCommand,
       brokerSocket: this.brokerSocket,
-      ...this.childEnv === void 0 ? {} : { env: this.childEnv }
+      ...envOption(threadProcessEnv(this.childEnv, params.env))
     });
     this.processes.set(threadId, child);
     this.mappers.set(threadId, new ClaudeBridgeEventMapper());
@@ -44740,7 +44772,11 @@ var AgyProcess = class _AgyProcess {
     if (options.brokerSocket != null) {
       stdio[3] = options.brokerSocket;
     }
-    this.child = (0, import_node_child_process4.spawn)(spawnCmd[0], spawnCmd.slice(1), {
+    const [spawnExecutable, ...spawnArgs] = spawnCmd;
+    if (spawnExecutable === void 0) {
+      throw new Error("Agy command wrapper returned no executable");
+    }
+    this.child = (0, import_node_child_process4.spawn)(spawnExecutable, spawnArgs, {
       cwd,
       env: options.env ?? process.env,
       stdio
@@ -45078,7 +45114,7 @@ var AgyAgentHandle = class {
       wrapCommand: this.wrapCommand,
       brokerSocket: this.brokerSocket,
       disabledTools: this.disabledTools,
-      ...this.childEnv === void 0 ? {} : { env: this.childEnv }
+      ...envOption(threadProcessEnv(this.childEnv, params.env))
     });
     this.processes.set(child.sessionId, child);
     this.mappers.set(child.sessionId, new AgyBridgeEventMapper());
@@ -45102,7 +45138,7 @@ var AgyAgentHandle = class {
       wrapCommand: this.wrapCommand,
       brokerSocket: this.brokerSocket,
       disabledTools: this.disabledTools,
-      ...this.childEnv === void 0 ? {} : { env: this.childEnv }
+      ...envOption(threadProcessEnv(this.childEnv, params.env))
     });
     this.processes.set(threadId, child);
     this.mappers.set(threadId, new AgyBridgeEventMapper());
@@ -45854,7 +45890,7 @@ async function resolvePinnedProviderIps(hosts, options) {
         result[normalized] = records;
         continue;
       }
-    } catch (err) {
+    } catch (_err) {
       if (options?.failClosedOnDnsError) {
         if ((process.env.NODE_ENV === "test" || !process.env.NODE_ENV || process.env.MRRLIN_TEST === "1") && DEFAULT_PINNED_PROVIDER_IPS[normalized]) {
           result[normalized] = DEFAULT_PINNED_PROVIDER_IPS[normalized];
@@ -45917,6 +45953,8 @@ function parseIpv4Bytes(ip) {
   const out = new Uint8Array(4);
   for (let i = 0; i < 4; i++) {
     const p = parts[i];
+    if (p === void 0)
+      return null;
     if (!/^\d+$/.test(p))
       return null;
     if (p.length > 1 && p.startsWith("0"))
@@ -45950,10 +45988,13 @@ function parseIpv6Bytes(ip) {
   }
   const out = new Uint8Array(16);
   if (v4Bytes) {
-    out[12] = v4Bytes[0];
-    out[13] = v4Bytes[1];
-    out[14] = v4Bytes[2];
-    out[15] = v4Bytes[3];
+    const [first, second, third, fourth] = v4Bytes;
+    if (first === void 0 || second === void 0 || third === void 0 || fourth === void 0)
+      return null;
+    out[12] = first;
+    out[13] = second;
+    out[14] = third;
+    out[15] = fourth;
   }
   const targetGroupCount = v4Bytes ? 6 : 8;
   if (doubleColonIdx === -1) {
@@ -45962,6 +46003,8 @@ function parseIpv6Bytes(ip) {
       return null;
     for (let i = 0; i < targetGroupCount; i++) {
       const g = groups[i];
+      if (g === void 0)
+        return null;
       if (!/^[0-9a-f]{1,4}$/.test(g))
         return null;
       const val = parseInt(g, 16);
@@ -45977,6 +46020,8 @@ function parseIpv6Bytes(ip) {
       return null;
     for (let i = 0; i < leftGroups.length; i++) {
       const g = leftGroups[i];
+      if (g === void 0)
+        return null;
       if (!/^[0-9a-f]{1,4}$/.test(g))
         return null;
       const val = parseInt(g, 16);
@@ -45986,6 +46031,8 @@ function parseIpv6Bytes(ip) {
     const omitted = targetGroupCount - leftGroups.length - rightGroups.length;
     for (let i = 0; i < rightGroups.length; i++) {
       const g = rightGroups[i];
+      if (g === void 0)
+        return null;
       if (!/^[0-9a-f]{1,4}$/.test(g))
         return null;
       const val = parseInt(g, 16);
@@ -45997,9 +46044,9 @@ function parseIpv6Bytes(ip) {
   return out;
 }
 function isRestrictedIpv4Bytes(b) {
-  const b0 = b[0];
-  const b1 = b[1];
-  const b2 = b[2];
+  const [b0, b1, b2] = b;
+  if (b0 === void 0 || b1 === void 0 || b2 === void 0)
+    return true;
   if (b0 === 0)
     return true;
   if (b0 === 10)
@@ -46067,9 +46114,13 @@ function isRestrictedIp(ip) {
   }
   if (isLoopback)
     return true;
-  if (v6[0] === 254 && (v6[1] & 192) === 128)
+  const firstByte = v6[0];
+  const secondByte = v6[1];
+  if (firstByte === void 0 || secondByte === void 0)
+    return true;
+  if (firstByte === 254 && (secondByte & 192) === 128)
     return true;
-  if ((v6[0] & 254) === 252)
+  if ((firstByte & 254) === 252)
     return true;
   if (v6[0] === 255)
     return true;
@@ -46098,6 +46149,8 @@ function extractTlsSni(buf) {
     if (offset >= buf.length)
       return null;
     const sidLen = buf[offset];
+    if (sidLen === void 0)
+      return null;
     offset += 1 + sidLen;
     if (offset + 2 > buf.length)
       return null;
@@ -46106,6 +46159,8 @@ function extractTlsSni(buf) {
     if (offset + 1 > buf.length)
       return null;
     const cmLen = buf[offset];
+    if (cmLen === void 0)
+      return null;
     offset += 1 + cmLen;
     if (offset + 2 > buf.length)
       return null;
@@ -46124,6 +46179,8 @@ function extractTlsSni(buf) {
         const sniEnd = Math.min(extensionsEnd, sniOffset + sniListLen);
         while (sniOffset + 3 <= sniEnd) {
           const nameType = buf[sniOffset];
+          if (nameType === void 0)
+            return null;
           const nameLen = buf.readUInt16BE(sniOffset + 1);
           sniOffset += 3;
           if (nameType === 0) {
@@ -46225,7 +46282,13 @@ async function startProviderProxy(allowedHosts, options) {
             return;
           }
         }
-        const validatedIp = options?.allowPrivateUpstream ? "127.0.0.1" : addresses[0].address;
+        const firstAddress = addresses[0];
+        if (!firstAddress) {
+          res.writeHead(502, { "content-type": "text/plain" });
+          res.end(`BAD_GATEWAY: DNS lookup failed for provider host "${effectiveHost}"`);
+          return;
+        }
+        const validatedIp = options?.allowPrivateUpstream ? "127.0.0.1" : firstAddress.address;
         const requestFn = isHttps ? import_node_https.default.request : import_node_http.default.request;
         const transportOpts = {
           host: validatedIp,
@@ -46304,7 +46367,12 @@ async function startProviderProxy(allowedHosts, options) {
           return;
         }
       }
-      const validatedIp = options?.allowPrivateUpstream ? "127.0.0.1" : addresses[0].address;
+      const firstAddress = addresses[0];
+      if (!firstAddress) {
+        clientSocket.end("HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n");
+        return;
+      }
+      const validatedIp = options?.allowPrivateUpstream ? "127.0.0.1" : firstAddress.address;
       const serverSocket = import_node_net.default.connect({ host: validatedIp, port: targetPort }, () => {
         clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
         let validatedAuthority = false;
@@ -46383,19 +46451,20 @@ async function startProviderProxy(allowedHosts, options) {
   await new Promise((resolve2, reject) => {
     server.on("error", reject);
     if (options?.socketPath) {
+      const socketPath = options.socketPath;
       try {
-        if (import_node_fs2.default.existsSync(options.socketPath)) {
-          import_node_fs2.default.unlinkSync(options.socketPath);
+        if (import_node_fs2.default.existsSync(socketPath)) {
+          import_node_fs2.default.unlinkSync(socketPath);
         }
       } catch {
       }
-      server.listen(options.socketPath, () => {
+      server.listen(socketPath, () => {
         try {
-          import_node_fs2.default.chmodSync(options.socketPath, 384);
+          import_node_fs2.default.chmodSync(socketPath, 384);
         } catch {
         }
         server.unref();
-        assignedSocketPath = options.socketPath;
+        assignedSocketPath = socketPath;
         resolve2();
       });
     } else {
@@ -46597,7 +46666,6 @@ async function createVerificationNetworkSandbox(config2) {
       }
     };
   }
-  const allPinnedIps = Array.from(new Set(Object.values(resolvedIpsMap).flat()));
   const hostsLines = [
     "127.0.0.1 localhost",
     "::1 localhost",
@@ -47137,8 +47205,7 @@ exit $EXIT_CODE`,
     dispose: () => {
       try {
         if (providerProxy) {
-          providerProxy.close().catch(() => {
-          });
+          providerProxy.close().catch(() => void 0);
         }
       } catch {
       }
@@ -50451,8 +50518,8 @@ var Protocol = class {
                   if (queuedMessage.type === "response") {
                     resolver(message);
                   } else {
-                    const errorMessage = message;
-                    const error51 = new McpError(errorMessage.error.code, errorMessage.error.message, errorMessage.error.data);
+                    const errorMessage2 = message;
+                    const error51 = new McpError(errorMessage2.error.code, errorMessage2.error.message, errorMessage2.error.data);
                     resolver(error51);
                   }
                 } else {
@@ -51758,8 +51825,8 @@ var Client = class extends Protocol {
       const wrappedHandler = async (request, extra) => {
         const validatedRequest = safeParse3(ElicitRequestSchema, request);
         if (!validatedRequest.success) {
-          const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid elicitation request: ${errorMessage}`);
+          const errorMessage2 = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid elicitation request: ${errorMessage2}`);
         }
         const { params } = validatedRequest.data;
         params.mode = params.mode ?? "form";
@@ -51774,15 +51841,15 @@ var Client = class extends Protocol {
         if (params.task) {
           const taskValidationResult = safeParse3(CreateTaskResultSchema, result);
           if (!taskValidationResult.success) {
-            const errorMessage = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
-            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
+            const errorMessage2 = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
+            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage2}`);
           }
           return taskValidationResult.data;
         }
         const validationResult = safeParse3(ElicitResultSchema, result);
         if (!validationResult.success) {
-          const errorMessage = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid elicitation result: ${errorMessage}`);
+          const errorMessage2 = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid elicitation result: ${errorMessage2}`);
         }
         const validatedResult = validationResult.data;
         const requestedSchema = params.mode === "form" ? params.requestedSchema : void 0;
@@ -51802,16 +51869,16 @@ var Client = class extends Protocol {
       const wrappedHandler = async (request, extra) => {
         const validatedRequest = safeParse3(CreateMessageRequestSchema, request);
         if (!validatedRequest.success) {
-          const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid sampling request: ${errorMessage}`);
+          const errorMessage2 = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid sampling request: ${errorMessage2}`);
         }
         const { params } = validatedRequest.data;
         const result = await Promise.resolve(handler(request, extra));
         if (params.task) {
           const taskValidationResult = safeParse3(CreateTaskResultSchema, result);
           if (!taskValidationResult.success) {
-            const errorMessage = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
-            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
+            const errorMessage2 = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
+            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage2}`);
           }
           return taskValidationResult.data;
         }
@@ -51819,8 +51886,8 @@ var Client = class extends Protocol {
         const resultSchema = hasTools ? CreateMessageResultWithToolsSchema : CreateMessageResultSchema;
         const validationResult = safeParse3(resultSchema, result);
         if (!validationResult.success) {
-          const errorMessage = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid sampling result: ${errorMessage}`);
+          const errorMessage2 = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid sampling result: ${errorMessage2}`);
         }
         return validationResult.data;
       };
@@ -52048,18 +52115,18 @@ var Client = class extends Protocol {
     }
     return result;
   }
-  isToolTask(toolName) {
+  isToolTask(toolName2) {
     if (!this._serverCapabilities?.tasks?.requests?.tools?.call) {
       return false;
     }
-    return this._cachedKnownTaskTools.has(toolName);
+    return this._cachedKnownTaskTools.has(toolName2);
   }
   /**
    * Check if a tool requires task-based execution.
    * Unlike isToolTask which includes 'optional' tools, this only checks for 'required'.
    */
-  isToolTaskRequired(toolName) {
-    return this._cachedRequiredTaskTools.has(toolName);
+  isToolTaskRequired(toolName2) {
+    return this._cachedRequiredTaskTools.has(toolName2);
   }
   /**
    * Cache validators for tool output schemas.
@@ -52086,8 +52153,8 @@ var Client = class extends Protocol {
   /**
    * Get cached validator for a tool
    */
-  getToolOutputValidator(toolName) {
-    return this._cachedToolOutputValidators.get(toolName);
+  getToolOutputValidator(toolName2) {
+    return this._cachedToolOutputValidators.get(toolName2);
   }
   async listTools(params, options) {
     const result = await this.request({ method: "tools/list", params }, ListToolsResultSchema, options);
@@ -52630,8 +52697,8 @@ async function parseErrorResponse(input) {
     return new errorClass(error_description || "", error_uri);
   } catch (error51) {
     const redirect = input instanceof Response ? unfollowedRedirect(input, input.url) : void 0;
-    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error51}. Raw body: ${body}`}`;
-    return new ServerError(errorMessage);
+    const errorMessage2 = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error51}. Raw body: ${body}`}`;
+    return new ServerError(errorMessage2);
   }
 }
 function issuersMatch(a, b) {
@@ -53974,7 +54041,7 @@ var StdioClientTransport = class {
 };
 
 // src/delivery/invoke.ts
-async function invokeCapability(server, toolName, payload) {
+async function invokeCapability(server, toolName2, payload) {
   const client = new Client({ name: "mrrlin-delivery-invoker", version: "1.0.0" });
   try {
     let result;
@@ -54020,14 +54087,14 @@ async function invokeCapability(server, toolName, payload) {
         await client.connect(transport);
       }
       result = await client.callTool({
-        name: toolName,
+        name: toolName2,
         arguments: isRecord(payload) ? payload : void 0
       });
     } catch (error51) {
-      throw classifyInvokeError(error51, target, toolName);
+      throw classifyInvokeError(error51, target, toolName2);
     }
     if (result.isError) {
-      throw new InvokeToolExecutionError(toolName, extractFirstText(result.content));
+      throw new InvokeToolExecutionError(toolName2, extractFirstText(result.content));
     }
     return { content: result.content, url: extractFirstUrl(result.content) };
   } finally {
@@ -54036,14 +54103,14 @@ async function invokeCapability(server, toolName, payload) {
   }
 }
 var InvokeToolNotFoundError = class extends Error {
-  constructor(toolName, cause) {
-    super(`invokeCapability: tool "${toolName}" not found on the granted server`, { cause });
+  constructor(toolName2, cause) {
+    super(`invokeCapability: tool "${toolName2}" not found on the granted server`, { cause });
     this.name = "InvokeToolNotFoundError";
   }
 };
 var InvokeToolExecutionError = class extends Error {
-  constructor(toolName, detail, cause) {
-    super(`invokeCapability: tool "${toolName}" reported isError -- ${detail}`, { cause });
+  constructor(toolName2, detail, cause) {
+    super(`invokeCapability: tool "${toolName2}" reported isError -- ${detail}`, { cause });
     this.name = "InvokeToolExecutionError";
   }
 };
@@ -54071,7 +54138,7 @@ var InvokeUnexpandedHeaderError = class extends Error {
     this.name = "InvokeUnexpandedHeaderError";
   }
 };
-function classifyInvokeError(error51, url2, toolName) {
+function classifyInvokeError(error51, url2, toolName2) {
   if (error51 instanceof InvokeUnexpandedHeaderError) {
     return error51;
   }
@@ -54081,10 +54148,10 @@ function classifyInvokeError(error51, url2, toolName) {
   }
   if (error51 instanceof McpError) {
     if (error51.code === ErrorCode.MethodNotFound) {
-      return new InvokeToolNotFoundError(toolName, error51);
+      return new InvokeToolNotFoundError(toolName2, error51);
     }
     if (error51.code === ErrorCode.InvalidParams) {
-      return new InvokeMalformedResultError(`invalid parameters for tool "${toolName}": ${error51.message}`, error51);
+      return new InvokeMalformedResultError(`invalid parameters for tool "${toolName2}": ${error51.message}`, error51);
     }
     return new InvokeMalformedResultError(error51.message, error51);
   }
@@ -54160,12 +54227,12 @@ function parsePullRequestUrl(url2) {
   }
   return {};
 }
-async function deliverToGit(server, toolName, payload) {
+async function deliverToGit(server, toolName2, payload) {
   const defaultRoute = server.id ? getDefaultCapabilityRouteForServer(server.id) : null;
   const isDefaultGitHubRoute = defaultRoute?.capability === "repo_host";
   if (payload.operation === "pull_request") {
     const { operation: _operation, ...args } = payload;
-    if (isDefaultGitHubRoute && toolName === defaultRoute.operations.pull_request) {
+    if (isDefaultGitHubRoute && toolName2 === defaultRoute.operations.pull_request) {
       let owner = args.owner;
       let repo = args.repo;
       const repository = args.repository;
@@ -54189,11 +54256,11 @@ async function deliverToGit(server, toolName, payload) {
       if (typeof payload.draft === "boolean") {
         adaptedArgs.draft = payload.draft;
       }
-      return invokeCapability(server, toolName, adaptedArgs);
+      return invokeCapability(server, toolName2, adaptedArgs);
     }
-    return invokeCapability(server, toolName, args);
+    return invokeCapability(server, toolName2, args);
   }
-  if (isDefaultGitHubRoute && (toolName === defaultRoute.operations.pull_request_state || toolName === "pull_request_read")) {
+  if (isDefaultGitHubRoute && (toolName2 === defaultRoute.operations.pull_request_state || toolName2 === "pull_request_read")) {
     const { operation: _operation, ...args } = payload;
     const urlParts = parsePullRequestUrl(payload.pullRequestUrl);
     let owner = args.owner ?? urlParts.owner;
@@ -54209,16 +54276,16 @@ async function deliverToGit(server, toolName, payload) {
     if (owner) adaptedArgs.owner = owner;
     if (repo) adaptedArgs.repo = repo;
     if (pullNumber !== void 0) {
-      if (toolName === "pull_request_read") {
+      if (toolName2 === "pull_request_read") {
         adaptedArgs.method = "get";
         adaptedArgs.pullNumber = pullNumber;
       } else {
         adaptedArgs.pull_number = pullNumber;
       }
     }
-    return invokeCapability(server, toolName, adaptedArgs);
+    return invokeCapability(server, toolName2, adaptedArgs);
   }
-  return invokeCapability(server, toolName, { pullRequestUrl: payload.pullRequestUrl });
+  return invokeCapability(server, toolName2, { pullRequestUrl: payload.pullRequestUrl });
 }
 
 // src/mcp-tool-error.ts
@@ -54297,11 +54364,11 @@ async function deliverToArtifacts(client, projectSlug, payload, bareFetch) {
 }
 
 // src/delivery/send.ts
-async function deliverToSend(server, toolName, payload) {
+async function deliverToSend(server, toolName2, payload) {
   const { operation: _operation, ...args } = payload;
   const defaultRoute = server.id ? getDefaultCapabilityRouteForServer(server.id) : null;
   const isDefaultSlackRoute = defaultRoute?.capability === "send";
-  if (payload.operation === "dispatch" && isDefaultSlackRoute && toolName === defaultRoute.operations.dispatch) {
+  if (payload.operation === "dispatch" && isDefaultSlackRoute && toolName2 === defaultRoute.operations.dispatch) {
     const rawChannel = args.channel_id ?? args.destination ?? args.channel ?? args.to;
     const channelId = typeof rawChannel === "string" ? rawChannel.trim() : rawChannel !== void 0 ? String(rawChannel) : void 0;
     const rawText = args.text ?? args.body ?? args.message ?? args.content;
@@ -54309,15 +54376,15 @@ async function deliverToSend(server, toolName, payload) {
     const adaptedArgs = {};
     if (channelId !== void 0) adaptedArgs.channel_id = channelId;
     if (text !== void 0) adaptedArgs.text = text;
-    return invokeCapability(server, toolName, adaptedArgs);
+    return invokeCapability(server, toolName2, adaptedArgs);
   }
-  return invokeCapability(server, toolName, args);
+  return invokeCapability(server, toolName2, args);
 }
 
 // src/delivery/publish.ts
-async function deliverToPublish(server, toolName, payload) {
+async function deliverToPublish(server, toolName2, payload) {
   const { operation: _operation, ...args } = payload;
-  return invokeCapability(server, toolName, args);
+  return invokeCapability(server, toolName2, args);
 }
 function parsePublishObserveResult(content) {
   const raw = parseStructuredContent(content);
@@ -54472,7 +54539,7 @@ async function proceedToDestination(client, route, resolvedToolName, input) {
       serverId: route.serverId,
       capability: route.capability,
       toolName: resolvedToolName,
-      operationClass: route.operationClass ?? "reversible",
+      operationClass: resolveOperationClass(route, "reversible"),
       payloadDigest
     });
     const idempotencyKey = `deliver:${input.taskProjectSlug}:${permit.id}`;
@@ -54492,7 +54559,7 @@ async function proceedToDestination(client, route, resolvedToolName, input) {
         return {
           ok: false,
           reason: "invocation_failed",
-          message: typeof redemption.error === "string" ? redemption.error : redemption.error?.message ?? "Capability invocation previously failed"
+          message: errorMessage(redemption.error) ?? "Capability invocation previously failed"
         };
       }
       await recordUse(client, route, resolvedToolName, input, "refused");
@@ -54504,7 +54571,7 @@ async function proceedToDestination(client, route, resolvedToolName, input) {
     }
   } catch (permitError) {
     await recordUse(client, route, resolvedToolName, input, "refused");
-    const msg = permitError?.message ?? String(permitError);
+    const msg = errorMessage(permitError) ?? String(permitError);
     const isNoGrant = msg.includes("GRANT_REQUIRED") || msg.includes("no active grant");
     return {
       ok: false,
@@ -54799,7 +54866,7 @@ async function readPublishState(client, projectSlug, taskProjectSlug, payload, m
       return redemption.result;
     }
     if (redemption.status === "failed") {
-      const errMsg = typeof redemption.error === "string" ? redemption.error : redemption.error?.message ?? "Capability invocation previously failed";
+      const errMsg = errorMessage(redemption.error) ?? "Capability invocation previously failed";
       throw new Error(`CAPABILITY_REPLAY_FAILED: ${errMsg}`);
     }
     throw new Error(`OPERATIONAL_INCIDENT: capability invocation ${redemption.id} is in status "${redemption.status}" and cannot be replayed as success`);
@@ -54866,7 +54933,7 @@ async function dispatchPublishOperation(client, projectSlug, taskProjectSlug, ta
       serverId: route.serverId,
       capability: route.capability,
       toolName: resolvedToolName,
-      operationClass: route.operationClass ?? (payload.operation === "preview" ? "reversible" : "irreversible"),
+      operationClass: resolveOperationClass(route, payload.operation === "preview" ? "reversible" : "irreversible"),
       payloadDigest
     });
     const idempotencyKey = `publish:${taskProjectSlug}:${permit.id}`;
@@ -54879,11 +54946,14 @@ async function dispatchPublishOperation(client, projectSlug, taskProjectSlug, ta
     if (redemption.replayed) {
       if (redemption.status === "completed") {
         const use2 = await recordUse(client, route, resolvedToolName, input, "ok");
-        return { ...redemption.result, use: use2 };
+        if (!isRecord3(redemption.result) || !("content" in redemption.result) || !("url" in redemption.result)) {
+          throw new Error("CAPABILITY_REPLAY_INVALID_RESULT: completed publish invocation has no object result");
+        }
+        return { content: redemption.result.content, url: typeof redemption.result.url === "string" ? redemption.result.url : null, use: use2 };
       }
       if (redemption.status === "failed") {
         const use2 = await recordUse(client, route, resolvedToolName, input, "error");
-        const errMsg = typeof redemption.error === "string" ? redemption.error : redemption.error?.message ?? "Capability invocation previously failed";
+        const errMsg = errorMessage(redemption.error) ?? "Capability invocation previously failed";
         throw Object.assign(new Error(`CAPABILITY_REPLAY_FAILED: ${errMsg}`), { use: use2 });
       }
       const use = await recordUse(client, route, resolvedToolName, input, "refused");
@@ -54928,8 +54998,8 @@ async function readPullRequestState(client, projectSlug, taskProjectSlug, pullRe
     throw new RepoHostRouteUnavailableError(`repo_host capability route unavailable: ${resolution.reason}`);
   }
   const { route } = resolution;
-  const toolName = route.operations.pull_request_state;
-  if (typeof toolName !== "string") {
+  const toolName2 = route.operations.pull_request_state;
+  if (typeof toolName2 !== "string") {
     throw new RepoHostRouteUnavailableError('operation "pull_request_state" is not configured for repo_host capability');
   }
   const server = readMcpServerById(mcpConfigPath ?? defaultMcpConfigPath(), route.serverId);
@@ -54950,7 +55020,7 @@ async function readPullRequestState(client, projectSlug, taskProjectSlug, pullRe
     taskId,
     serverId: route.serverId,
     capability: route.capability,
-    toolName,
+    toolName: toolName2,
     operationClass: "read",
     payloadDigest
   });
@@ -54961,18 +55031,18 @@ async function readPullRequestState(client, projectSlug, taskProjectSlug, pullRe
     payloadDigest
   });
   if (redemption.replayed) {
-    if (redemption.status === "completed" && redemption.result && typeof redemption.result.merged === "boolean") {
+    if (redemption.status === "completed" && isRecord3(redemption.result) && typeof redemption.result.merged === "boolean") {
       return { merged: redemption.result.merged };
     }
     if (redemption.status === "failed") {
-      const errMsg = typeof redemption.error === "string" ? redemption.error : redemption.error?.message ?? "Capability invocation previously failed";
+      const errMsg = errorMessage(redemption.error) ?? "Capability invocation previously failed";
       throw new Error(`CAPABILITY_REPLAY_FAILED: ${errMsg}`);
     }
     throw new Error(`OPERATIONAL_INCIDENT: capability invocation ${redemption.id} is in status "${redemption.status}" and cannot be replayed as success`);
   }
   const invocationId = redemption.id;
   try {
-    const result = await deliverToGit(server, toolName, payload);
+    const result = await deliverToGit(server, toolName2, payload);
     const raw = parseStructuredContent(result.content);
     const parsed = gitPullRequestStateResponseSchema.safeParse(raw);
     if (!parsed.success) {
@@ -55003,6 +55073,17 @@ async function readPullRequestState(client, projectSlug, taskProjectSlug, pullRe
 function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
+function errorMessage(value) {
+  if (typeof value === "string") return value;
+  if (value instanceof Error) return value.message;
+  if (isRecord3(value) && typeof value.message === "string") return value.message;
+  return void 0;
+}
+function resolveOperationClass(route, fallback) {
+  if (!isRecord3(route)) return fallback;
+  const operationClass = route.operationClass;
+  return operationClass === "read" || operationClass === "reversible" || operationClass === "irreversible" ? operationClass : fallback;
+}
 
 // src/decision-consensus.ts
 var ANCHOR_TIMEOUT_MS = Number(process.env["MRRLIN_DECISION_TIMEOUT_MS"] ?? 9e4);
@@ -55149,8 +55230,8 @@ var registry2 = /* @__PURE__ */ new Map();
 function registerAsyncTool(descriptor2) {
   registry2.set(descriptor2.toolName, descriptor2);
 }
-function getAsyncToolDescriptor(toolName) {
-  return registry2.get(toolName);
+function getAsyncToolDescriptor(toolName2) {
+  return registry2.get(toolName2);
 }
 
 // src/async-tools/consensus.ts
@@ -56793,12 +56874,12 @@ function buildProjection(payload, type, ms, telemetry) {
       const tool = rawEvent.tool;
       if (!isRecord4(tool)) return null;
       const toolId = tool.id;
-      const toolName = tool.name;
-      if (typeof toolId !== "string" || typeof toolName !== "string") return null;
+      const toolName2 = tool.name;
+      if (typeof toolId !== "string" || typeof toolName2 !== "string") return null;
       const input = tool.input;
       const argKeys = isRecord4(input) ? Object.keys(input) : [];
       const projectSlug = isRecord4(input) && typeof input.projectSlug === "string" ? input.projectSlug : void 0;
-      const proj = { kind: "tool_use", toolId, toolName, argKeys, seq: maybeSeq ?? 0 };
+      const proj = { kind: "tool_use", toolId, toolName: toolName2, argKeys, seq: maybeSeq ?? 0 };
       if (maybeTurnId !== void 0) proj.turnId = maybeTurnId;
       if (ms !== void 0) proj.ms = ms;
       if (projectSlug !== void 0) proj.projectSlug = projectSlug;
@@ -56963,6 +57044,9 @@ var READ_TOOL_NAMES = /* @__PURE__ */ new Set([
   "search_knowledge",
   "search_wiki_pages",
   "create_task",
+  // propose_task only records a pending intent proposal; nothing happens until the operator
+  // confirms it in the web UI, so it is as in-product as create_task.
+  "propose_task",
   "update_task",
   "create_wiki_page",
   "update_wiki_page",
@@ -56974,14 +57058,14 @@ var READ_TOOL_NAMES = /* @__PURE__ */ new Set([
   // call), making every turn that stops a run permanently, unfixably "unresolved".
   "stop_execution_run"
 ]);
-function normalizeToolName(toolName) {
-  return toolName.replace(/^mcp__.+?__/, "");
+function normalizeToolName(toolName2) {
+  return toolName2.replace(/^mcp__.+?__/, "");
 }
 var MRRLIN_MCP_NAMESPACE_PREFIXES = ["mcp__mrrlin__", "mcp__mrrlin-browser__"];
 function classifyToolEffect(rawToolName) {
-  const toolName = normalizeToolName(rawToolName);
-  if (READ_TOOL_NAMES.has(toolName)) return "read";
-  if (OUTWARD_TOOL_NAMES.has(toolName)) return "outward";
+  const toolName2 = normalizeToolName(rawToolName);
+  if (READ_TOOL_NAMES.has(toolName2)) return "read";
+  if (OUTWARD_TOOL_NAMES.has(toolName2)) return "outward";
   if (MRRLIN_MCP_NAMESPACE_PREFIXES.some((prefix) => rawToolName.startsWith(prefix))) return "outward";
   return "read";
 }
@@ -56994,10 +57078,10 @@ var BROWSER_OUTWARD_TOOL_NAMES = /* @__PURE__ */ new Set([
   "browser_select_option"
 ]);
 var IN_PRODUCT_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["create_task", "update_task", "create_wiki_page", "update_wiki_page", "create_inbox_item"]);
-function buildBrowserAttemptReceipt(toolName) {
+function buildBrowserAttemptReceipt(toolName2) {
   return {
     kind: "attempt",
-    evidence: { type: "human_tap", value: toolName },
+    evidence: { type: "human_tap", value: toolName2 },
     observedAt: (/* @__PURE__ */ new Date()).toISOString(),
     requiresCovered: []
   };
@@ -57127,20 +57211,20 @@ function createBridgeLogger(stateDir, env = process.env) {
           if (isNewTurn) state.pending = [];
         }
         if (projection?.kind === "tool_use" && typeof projection.toolName === "string" && typeof projection.toolId === "string") {
-          const toolName = normalizeToolName(projection.toolName);
+          const toolName2 = normalizeToolName(projection.toolName);
           if (classifyToolEffect(projection.toolName) === "outward") {
-            if (BROWSER_OUTWARD_TOOL_NAMES.has(toolName)) {
-              syntheticReceipt = buildBrowserAttemptReceipt(toolName);
+            if (BROWSER_OUTWARD_TOOL_NAMES.has(toolName2)) {
+              syntheticReceipt = buildBrowserAttemptReceipt(toolName2);
             } else {
               state.pending.push({
                 turnSpanId: projection.turnId,
-                toolName,
+                toolName: toolName2,
                 toolId: projection.toolId,
                 seq: projection.seq,
                 armedAt: (/* @__PURE__ */ new Date()).toISOString()
               });
             }
-          } else if (IN_PRODUCT_WRITE_TOOL_NAMES.has(toolName) && state.pending.length > 0) {
+          } else if (IN_PRODUCT_WRITE_TOOL_NAMES.has(toolName2) && state.pending.length > 0) {
             if (state.pending.length > 1) {
               recordingObligationMultiResolve = {
                 resolvedCount: state.pending.length,
@@ -57348,10 +57432,10 @@ async function assembleEvidence(stateDir, sessionId, reportId, gateCtx) {
       if (line.projection?.kind !== "tool_use") continue;
       const rawToolId = line.payload?.event?.tool?.id;
       const paired = typeof rawToolId === "string" ? resultByToolId.get(rawToolId) : void 0;
-      const toolName = line.projection.toolName ?? line.payload?.event?.tool?.name ?? "";
+      const toolName2 = line.projection.toolName ?? line.payload?.event?.tool?.name ?? "";
       const ms = line.projection.ms ?? 0;
       const outcome = paired?.projection?.kind === "tool_result" ? paired.projection.outcome ?? "unknown" : "unknown";
-      const step = { toolName, ms, outcome };
+      const step = { toolName: toolName2, ms, outcome };
       if (paired?.projection?.kind === "tool_result" && paired.projection.exitCode !== void 0) {
         step.exitCode = paired.projection.exitCode;
       }
@@ -57728,6 +57812,7 @@ var mcpToolNames = {
   deleteTaskDependency: "delete_task_dependency",
   createInboxItem: "create_inbox_item",
   createTask: "create_task",
+  proposeTask: "propose_task",
   decideInboxItem: "decide_inbox_item",
   getExecutionRun: "get_execution_run",
   getProjectSchedulerPolicy: "get_project_scheduler_policy",
@@ -58350,6 +58435,22 @@ var listTasksInputSchema = projectScopedSchema.merge(mrrlinTaskListFiltersSchema
 var getTaskInputSchema = taskScopedSchema;
 var createTaskInputSchema = proposalProvenanceSchema.merge(projectScopedSchema).merge(mrrlinTaskCreateWithoutIdSchema);
 var updateTaskInputSchema = taskScopedSchema.merge(mrrlinTaskUpdateSchema);
+var proposeTaskInputSchema = projectScopedSchema.extend({
+  kind: external_exports.enum(["task", "plan"]).optional().describe("What the operator's confirmation creates. 'task' (default): the task itself. 'plan': nothing yet \u2014 call create_plan with the confirmed proposalId/proposalVersion/proposalDigest."),
+  title: external_exports.string().min(1).max(500),
+  notes: external_exports.string().max(2e4).optional(),
+  type: mrrlinTaskTypeSchema.optional(),
+  category: external_exports.string().min(1).optional(),
+  subcategory: external_exports.string().min(1).optional(),
+  impact: mrrlinTaskImpactSchema.optional(),
+  autonomyLevel: mrrlinAutonomyLevelSchema.optional(),
+  autonomyReason: external_exports.string().min(1).max(240).optional(),
+  autoDeploy: mrrlinAutoDeploySchema.optional(),
+  domains: mrrlinTaskDomainsSchema.optional(),
+  tags: external_exports.array(external_exports.string().min(1)).optional(),
+  planId: mrrlinPlanIdSchema.optional(),
+  specWikiPageId: mrrlinWikiPageIdSchema.optional()
+});
 var resetDirectorThreadInputSchema = taskScopedSchema;
 var archiveTaskInputSchema = taskScopedSchema;
 var unarchiveTaskInputSchema = taskScopedSchema;
@@ -58487,6 +58588,7 @@ var mcpToolInputSchemas = {
   [mcpToolNames.createWikiPage]: createWikiPageInputSchema,
   [mcpToolNames.deleteTaskDependency]: deleteTaskDependencyInputSchema,
   [mcpToolNames.createTask]: createTaskInputSchema,
+  [mcpToolNames.proposeTask]: proposeTaskInputSchema,
   [mcpToolNames.getExecutionRun]: getExecutionRunInputSchema,
   [mcpToolNames.getProjectSchedulerPolicy]: getProjectSchedulerPolicyInputSchema,
   [mcpToolNames.getSchedulerPendingTasks]: getSchedulerPendingTasksInputSchema,
@@ -58551,6 +58653,7 @@ var mcpToolOperationIds = {
   [mcpToolNames.createWikiPage]: openApiOperationIds.createWikiPage,
   [mcpToolNames.deleteTaskDependency]: openApiOperationIds.deleteTaskDependency,
   [mcpToolNames.createTask]: openApiOperationIds.createTask,
+  [mcpToolNames.proposeTask]: openApiOperationIds.createIntentProposal,
   [mcpToolNames.getExecutionRun]: openApiOperationIds.getExecutionRun,
   [mcpToolNames.getProjectSchedulerPolicy]: openApiOperationIds.getProjectSchedulerPolicy,
   [mcpToolNames.getSchedulerPendingTasks]: openApiOperationIds.getSchedulerPendingTasks,
@@ -58605,7 +58708,8 @@ var mcpToolDescriptions = {
   [mcpToolNames.appendTaskEvent]: "Append an operator note to a task's activity timeline. Also use it as the task-linked receipt path for material immediate work that has a parent task; summarize scope, outcome/no-result, evidence or artifacts, blockers, and next action in the note body.",
   [mcpToolNames.createWikiPage]: "Create a markdown Wiki page.",
   [mcpToolNames.deleteTaskDependency]: "Delete a blocked-by relationship.",
-  [mcpToolNames.createTask]: "Create a new task in a project. Defaults to status='todo' to authorize immediate autopilot work; pass status='backlog' only if explicitly parking the task for later. 'backlog' and 'todo' are the only creatable statuses. Pass parentTaskId when spawning a follow-up task to continue work from an existing task \u2014 its operator_seed_request is inherited automatically if you don't supply your own. Domain is required UNLESS parentTaskId is supplied (a follow-up inherits its parent's domain automatically). Domain selects which reviewer roster judges the task's spec. Valid values: code, seo, marketing, content. When creating tasks for work that produces a published web page, author the work as a [code_change] task and a [page] task (with domain: 'content') linked by blocked_by. Set autoDeploy according to the publish policy: 'prod' if only meaningful once live (robots.txt, sitemap), 'dev' to stop at preview (landing page, layout), or 'off' if the repo is not the operator's own.",
+  [mcpToolNames.proposeTask]: "Propose a task (or plan) for the operator to confirm. This is how work gets created: a proposal does nothing on its own; the operator sees it in the Director chat and confirms it, and that confirmation creates the task. It binds to the operator's latest message in this chat, so call it right after the operator asked for the work, in the same turn. Call it once per task. Then tell the operator, in plain words, that the task is waiting for their confirmation in the chat \u2014 never say it was created. A new operator message makes an unconfirmed proposal stale; propose again if the operator still wants it. Fails with NO_OPERATOR_TRANSCRIPT when the operator has not said anything this proposal could quote.",
+  [mcpToolNames.createTask]: "Only for a proposal the operator already confirmed: pass its proposalId, proposalVersion and proposalDigest. A confirmed task proposal has already created its task, and this returns that task; never call it to create new work \u2014 use propose_task. Create a new task in a project. Defaults to status='todo' to authorize immediate autopilot work; pass status='backlog' only if explicitly parking the task for later. 'backlog' and 'todo' are the only creatable statuses. Pass parentTaskId when spawning a follow-up task to continue work from an existing task \u2014 its operator_seed_request is inherited automatically if you don't supply your own. Domain is required UNLESS parentTaskId is supplied (a follow-up inherits its parent's domain automatically). Domain selects which reviewer roster judges the task's spec. Valid values: code, seo, marketing, content. When creating tasks for work that produces a published web page, author the work as a [code_change] task and a [page] task (with domain: 'content') linked by blocked_by. Set autoDeploy according to the publish policy: 'prod' if only meaningful once live (robots.txt, sitemap), 'dev' to stop at preview (landing page, layout), or 'off' if the repo is not the operator's own.",
   [mcpToolNames.getProject]: "Fetch a single project summary by slug.",
   [mcpToolNames.getProjectSnapshot]: "Fetch the full project snapshot: GitHub binding, tasks, plans, and wiki pages.",
   [mcpToolNames.getTask]: "Fetch a single task by project slug and task id.",
@@ -58850,6 +58954,7 @@ async function getAgentProviderForPanel(client, opts = {}) {
 function createMrrlinTools(options) {
   const client = createMrrlinClient(withAuth(options));
   async function resolveBoundSlug() {
+    if (process.env.MRRLIN_PROJECT_BINDING === "none") return void 0;
     if (options.activeProjectSlug !== void 0) return options.activeProjectSlug;
     const envSlug = process.env.MRRLIN_PROJECT_SLUG?.trim();
     if (envSlug) return envSlug;
@@ -59049,10 +59154,35 @@ function createMrrlinTools(options) {
             `Task materialization digest mismatch for proposal ${proposalId} v${proposalVersion}.`
           );
         }
+        if (confirmation.materializedTaskId) {
+          return await c.getTask(projectSlug, confirmation.materializedTaskId);
+        }
         const status = input.status ?? "todo";
         return await c.createTask(projectSlug, { ...input, status });
       }
     ),
+    [mcpToolNames.proposeTask]: makeTool(
+      client,
+      mcpToolNames.proposeTask,
+      "TASK_PROPOSE_FAILED",
+      "Unable to propose task.",
+      async (c, { projectSlug, kind, ...intent }) => {
+        await checkTenantBoundary(projectSlug, "task proposal");
+        const proposal = await c.createIntentProposal(projectSlug, {
+          resolvedIntent: { kind: kind ?? "task", ...intent }
+        });
+        return {
+          proposalId: proposal.proposalId,
+          proposalVersion: proposal.version,
+          proposalDigest: proposal.digest,
+          state: proposal.state,
+          kind: kind ?? "task",
+          title: intent.title,
+          awaitingOperatorConfirmation: true,
+          next: (kind ?? "task") === "task" ? "Tell the operator the task is waiting for their confirmation in the chat. Their confirmation creates it; do not call create_task." : "Tell the operator the plan is waiting for their confirmation in the chat. After they confirm, call create_plan with proposalId, proposalVersion and proposalDigest."
+        };
+      }
+    ),
     [mcpToolNames.getProject]: makeTool(
       client,
       mcpToolNames.getProject,
@@ -61611,7 +61741,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.107";
+var PKG_VERSION = "0.4.109";
 
 // src/receipt-signing.ts
 var import_node_crypto13 = __toESM(require("node:crypto"), 1);
@@ -61838,26 +61968,26 @@ function turnReferences(events) {
     if (event.type === "tool_use") {
       hasToolEvents = true;
       const rawName = event.tool?.name ?? event.name ?? "";
-      const toolName = rawName.replace(/^.*__/, "");
-      const isMutation = MUTATION_TOOLS.has(toolName);
+      const toolName2 = rawName.replace(/^.*__/, "");
+      const isMutation = MUTATION_TOOLS.has(toolName2);
       const inputObj = event.tool?.input && typeof event.tool.input === "object" ? event.tool.input : event.input && typeof event.input === "object" ? event.input : {};
       const rawTargetId = typeof inputObj.taskId === "string" ? inputObj.taskId : typeof inputObj.pageId === "string" ? inputObj.pageId : typeof inputObj.id === "string" ? inputObj.id : null;
       let targetId = null;
       if (rawTargetId) {
-        if ((toolName === "create_task" || toolName === "update_task") && /^GT-\d+$/.test(rawTargetId)) {
+        if ((toolName2 === "create_task" || toolName2 === "update_task") && /^GT-\d+$/.test(rawTargetId)) {
           targetId = rawTargetId;
-        } else if ((toolName === "create_wiki_page" || toolName === "update_wiki_page") && /^WK-\d+$/.test(rawTargetId)) {
+        } else if ((toolName2 === "create_wiki_page" || toolName2 === "update_wiki_page") && /^WK-\d+$/.test(rawTargetId)) {
           targetId = rawTargetId;
         }
       }
       const callId = event.tool?.id ?? event.tool_use_id ?? event.id;
       if (callId && typeof callId === "string") {
         if (isMutation) {
-          keyedPending.set(callId, { toolName, targetId });
+          keyedPending.set(callId, { toolName: toolName2, targetId });
         }
       } else {
         if (isMutation) {
-          unkeyedCalls.push({ isMutation: true, toolName, targetId });
+          unkeyedCalls.push({ isMutation: true, toolName: toolName2, targetId });
         } else {
           unkeyedCalls.push({ isMutation: false });
         }
@@ -66306,7 +66436,7 @@ ${renderTaskStateSection(taskState)}`;
       turnCwd = worktreePath;
       useExecutor = true;
       if (deps.acquireExecutorAgent) {
-        const executorAgent = await deps.acquireExecutorAgent(worktreePath, resolvedProviderId);
+        const executorAgent = await deps.acquireExecutorAgent(worktreePath, resolvedProviderId, projectSlug);
         codex = executorAgent.handle;
         disposeCodex = executorAgent.dispose;
       } else {
@@ -67818,13 +67948,13 @@ async function driveAsyncJob(deps, projectSlug, jobId) {
   }
   if (descriptor2.wakeDirector) deps.wake(projectSlug, claimed.directorSessionId, delivery.body, delivery.kind);
 }
-async function deriveRequestedHash(client, toolName, input) {
+async function deriveRequestedHash(client, toolName2, input) {
   if (input.requestedHash) return input.requestedHash;
-  if (toolName === "run_spec_consensus" && input.pageId) {
+  if (toolName2 === "run_spec_consensus" && input.pageId) {
     const page = await client.getWikiPage(input.projectSlug, input.pageId);
     return page.contentHash ?? import_node_crypto18.default.createHash("sha256").update(page.markdownBody).digest("hex");
   }
-  if (toolName === "draft_task_spec" && input.taskId) {
+  if (toolName2 === "draft_task_spec" && input.taskId) {
     const task = await client.getTask(input.projectSlug, input.taskId);
     return task.updatedAt ?? import_node_crypto18.default.createHash("sha256").update(JSON.stringify(task)).digest("hex");
   }
@@ -72168,18 +72298,19 @@ async function startExecutorServer(opts) {
   const childEnv = withDisabledGitHooksEnv(baseEnv, opts.disabledGitHooksDir);
   const baseSpawn = opts.spawn ?? import_node_child_process22.spawn;
   const hasExtraFd = opts.brokerSocket != null || opts.brokerSocketFd != null;
-  const spawnFn = (cmd, args, spawnOpts) => {
-    const argList = Array.isArray(args) ? args : [];
-    const optsObj = args && !Array.isArray(args) ? args : spawnOpts ?? {};
+  const spawnFn = (cmd, args = [], spawnOpts = {}) => {
+    const argList = [...args];
     const fullCmd = [cmd, ...argList];
     const wrapped = opts.wrapCommand ? opts.wrapCommand(fullCmd) : fullCmd;
-    const finalSpawnOpts = { ...optsObj };
+    const finalSpawnOpts = { ...spawnOpts };
     if (hasExtraFd) {
-      const stdio = Array.isArray(finalSpawnOpts?.stdio) ? [...finalSpawnOpts.stdio] : ["pipe", "pipe", "pipe"];
+      const stdio = Array.isArray(finalSpawnOpts.stdio) ? [...finalSpawnOpts.stdio] : ["pipe", "pipe", "pipe"];
       stdio[3] = opts.brokerSocket ?? opts.brokerSocketFd;
       finalSpawnOpts.stdio = stdio;
     }
-    return baseSpawn(wrapped[0], wrapped.slice(1), finalSpawnOpts);
+    const executable = wrapped[0];
+    if (!executable) throw new Error("command wrapper returned an empty command");
+    return baseSpawn(executable, wrapped.slice(1), finalSpawnOpts);
   };
   if (opts.provider === "codex") {
     const manager = new CodexServerManager();
@@ -72429,19 +72560,21 @@ function parseIpv4Numeric(ipStr) {
     parsedParts.push(n);
   }
   if (parsedParts.length === 4) {
-    for (const b of parsedParts) {
-      if (b > 255) return null;
+    for (const b2 of parsedParts) {
+      if (b2 > 255) return null;
     }
-    return [parsedParts[0], parsedParts[1], parsedParts[2], parsedParts[3]];
+    const [a, b, c, d] = parsedParts;
+    if (a === void 0 || b === void 0 || c === void 0 || d === void 0) return null;
+    return [a, b, c, d];
   }
   if (parsedParts.length === 3) {
     const [a, b, c] = parsedParts;
-    if (a > 255 || b > 255 || c > 65535) return null;
+    if (a === void 0 || b === void 0 || c === void 0 || a > 255 || b > 255 || c > 65535) return null;
     return [a, b, c >>> 8 & 255, c & 255];
   }
   if (parsedParts.length === 2) {
     const [a, b] = parsedParts;
-    if (a > 255 || b > 16777215) return null;
+    if (a === void 0 || b === void 0 || a > 255 || b > 16777215) return null;
     return [a, b >>> 16 & 255, b >>> 8 & 255, b & 255];
   }
   return null;
@@ -72475,14 +72608,14 @@ function isGlobalIpv6(ipStr) {
   }
   const mappedMatch = /^::ffff:(?:0:)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(clean);
   if (mappedMatch) {
-    const ipv43 = parseIpv4Numeric(mappedMatch[1]);
+    const ipv43 = parseIpv4Numeric(mappedMatch[1] ?? "");
     if (!ipv43) return false;
     return isGlobalIpv4(ipv43);
   }
   const hexMappedMatch = /^::ffff:(?:0:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(clean);
   if (hexMappedMatch) {
-    const high = Number.parseInt(hexMappedMatch[1], 16);
-    const low = Number.parseInt(hexMappedMatch[2], 16);
+    const high = Number.parseInt(hexMappedMatch[1] ?? "", 16);
+    const low = Number.parseInt(hexMappedMatch[2] ?? "", 16);
     const b0 = high >>> 8 & 255;
     const b1 = high & 255;
     const b2 = low >>> 8 & 255;
@@ -72492,13 +72625,13 @@ function isGlobalIpv6(ipStr) {
   if (clean.startsWith("::ffff:")) return false;
   const compatMatch = /^::(?:0:)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(clean);
   if (compatMatch) {
-    const ipv43 = parseIpv4Numeric(compatMatch[1]);
+    const ipv43 = parseIpv4Numeric(compatMatch[1] ?? "");
     if (!ipv43) return false;
     return isGlobalIpv4(ipv43);
   }
   const nat64Match = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(clean);
   if (nat64Match) {
-    const ipv43 = parseIpv4Numeric(nat64Match[1]);
+    const ipv43 = parseIpv4Numeric(nat64Match[1] ?? "");
     if (!ipv43) return false;
     return isGlobalIpv4(ipv43);
   }
@@ -72618,7 +72751,9 @@ async function resolveAndPinAddress(hostname3, customResolver) {
   }
   return {
     hostname: cleanHost,
-    pinnedIp: allIps[0],
+    pinnedIp: allIps[0] ?? (() => {
+      throw new Error("DNS_RESOLUTION_FAILED: empty address set");
+    })(),
     allIps
   };
 }
@@ -72748,11 +72883,11 @@ async function createVerificationBrokerSession(options) {
             clearTimeout(timer);
             try {
               res.destroy();
-            } catch {
+            } catch (error51) {
             }
             try {
               req.destroy();
-            } catch {
+            } catch (error51) {
             }
             reject(err);
           };
@@ -72783,7 +72918,7 @@ async function createVerificationBrokerSession(options) {
               if (decompressedBytes > maxDecompBytes) {
                 try {
                   decompressor.destroy();
-                } catch {
+                } catch (error51) {
                 }
                 fail(new Error(`DECOMPRESSION_LIMIT_EXCEEDED: decompressed body exceeded ${maxDecompBytes} bytes`));
               }
@@ -72948,12 +73083,12 @@ async function createVerificationBrokerSession(options) {
     server.close();
     try {
       if (import_node_fs22.default.existsSync(socketPath)) import_node_fs22.default.unlinkSync(socketPath);
-    } catch {
+    } catch (error51) {
     }
     if (createdDir) {
       try {
         import_node_fs22.default.rmSync(createdDir, { recursive: true, force: true });
-      } catch {
+      } catch (error51) {
       }
     }
     throw new Error(`BROKER_SOCKET_ERROR: failed to establish inherited client socket connection: ${String(err)}`);
@@ -72973,7 +73108,7 @@ async function createVerificationBrokerSession(options) {
       if (clientSocket) {
         try {
           clientSocket.destroy();
-        } catch {
+        } catch (error51) {
         }
       }
       await new Promise((resolve2) => {
@@ -72997,6 +73132,31 @@ async function createVerificationBrokerSession(options) {
 }
 
 // src/verification-turn.ts
+function runtimeHandle(handle) {
+  return handle;
+}
+function toolName(tool) {
+  if (typeof tool === "string") return tool;
+  if (tool !== null && typeof tool === "object") {
+    const descriptor2 = tool;
+    if (typeof descriptor2.name === "string") return descriptor2.name;
+    if (typeof descriptor2.function?.name === "string") return descriptor2.function.name;
+  }
+  return "";
+}
+function disabledToolFromEvent(event, disabledTools) {
+  if (event === null || typeof event !== "object") return null;
+  const record2 = event;
+  if (record2.type !== "tool_use") return null;
+  const name = typeof record2.tool?.name === "string" ? record2.tool.name : null;
+  if (name === null) return null;
+  return disabledTools.some((tool) => tool.toLowerCase() === name.toLowerCase()) ? name : null;
+}
+function isDnsNoData(error51) {
+  if (error51 === null || typeof error51 !== "object") return false;
+  const code = error51.code;
+  return code === "ENODATA" || code === "ENOTFOUND";
+}
 var DISABLED_NATIVE_VERIFICATION_TOOLS = [
   "WebFetch",
   "WebSearch",
@@ -73007,42 +73167,40 @@ var DISABLED_NATIVE_VERIFICATION_TOOLS = [
   "curl"
 ];
 var DisabledToolInvocationError = class extends Error {
-  constructor(toolName) {
-    super(`TOOL_INVOCATION_FORBIDDEN: native network tool "${toolName}" is disabled in verification isolation mode`);
+  constructor(toolName2) {
+    super(`TOOL_INVOCATION_FORBIDDEN: native network tool "${toolName2}" is disabled in verification isolation mode`);
     this.name = "DisabledToolInvocationError";
   }
 };
-function assertNativeToolsDisabled(toolName, disabledTools = DISABLED_NATIVE_VERIFICATION_TOOLS) {
+function assertNativeToolsDisabled(toolName2, disabledTools = DISABLED_NATIVE_VERIFICATION_TOOLS) {
   const disabledSet = new Set(disabledTools.map((t) => t.toLowerCase()));
-  if (disabledSet.has(toolName.toLowerCase())) {
-    throw new DisabledToolInvocationError(toolName);
+  if (disabledSet.has(toolName2.toLowerCase())) {
+    throw new DisabledToolInvocationError(toolName2);
   }
 }
 function enforceNativeToolsDisabled(handle, disabledTools = DISABLED_NATIVE_VERIFICATION_TOOLS) {
   const disabledSet = new Set(disabledTools.map((t) => t.toLowerCase()));
+  const extendedHandle = runtimeHandle(handle);
   for (const prop of ["tools", "availableTools", "registeredTools"]) {
-    const val = handle[prop];
+    const val = extendedHandle[prop];
     if (Array.isArray(val)) {
-      handle[prop] = val.filter((t) => {
-        const name = typeof t === "string" ? t : t?.name ?? t?.function?.name ?? "";
-        return !disabledSet.has(String(name).toLowerCase());
-      });
+      extendedHandle[prop] = val.filter((tool) => !disabledSet.has(toolName(tool).toLowerCase()));
     }
   }
-  const toolsConfig = handle.toolsConfig;
+  const toolsConfig = extendedHandle.toolsConfig;
   if (toolsConfig && typeof toolsConfig === "object") {
     for (const tool of disabledTools) {
       toolsConfig[tool] = false;
       toolsConfig[tool.toLowerCase()] = false;
     }
   }
-  if (typeof handle.disableNativeTools === "function") {
+  if (typeof extendedHandle.disableNativeTools === "function") {
     try {
-      handle.disableNativeTools(disabledTools);
-    } catch {
+      extendedHandle.disableNativeTools(disabledTools);
+    } catch (error51) {
     }
   }
-  handle.disabledTools = disabledTools;
+  extendedHandle.disabledTools = disabledTools;
   return handle;
 }
 function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATIVE_VERIFICATION_TOOLS) {
@@ -73051,11 +73209,12 @@ function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATI
       throw new Error("INVALID_AGENT_HANDLE: handle is required for verification turn runner");
     }
     enforceNativeToolsDisabled(handle, disabledTools);
-    let origExecute = null;
+    const extendedHandle = runtimeHandle(handle);
+    let origExecute;
     let didPatchExecute = false;
-    let origStartThread = null;
-    let origResumeThread = null;
-    let origStartTurn = null;
+    let origStartThread;
+    let origResumeThread;
+    let origStartTurn;
     const unsubscribes = [];
     const subscribedThreads = /* @__PURE__ */ new Set();
     let toolViolationError = null;
@@ -73065,32 +73224,26 @@ function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATI
       if (typeof handle.onEvent === "function") {
         try {
           const unsub = handle.onEvent(threadId, (event) => {
-            if (event && event.type === "tool_use" && event.tool?.name) {
-              const name = String(event.tool.name).toLowerCase();
-              for (const disabled of disabledTools) {
-                if (name === disabled.toLowerCase()) {
-                  toolViolationError = new DisabledToolInvocationError(event.tool.name);
-                  if (typeof handle.interruptTurn === "function") {
-                    try {
-                      handle.interruptTurn(threadId).catch(() => {
-                      });
-                    } catch {
-                    }
-                  }
-                  break;
-                }
+            const disabledTool = disabledToolFromEvent(event, disabledTools);
+            if (disabledTool !== null) {
+              toolViolationError = new DisabledToolInvocationError(disabledTool);
+              try {
+                void handle.interruptTurn(threadId).catch((error51) => {
+                });
+              } catch (error51) {
               }
             }
           });
           unsubscribes.push(unsub);
-        } catch {
+        } catch (error51) {
         }
       }
     };
     if (typeof handle.startThread === "function") {
-      origStartThread = handle.startThread;
+      const startThread = handle.startThread;
+      origStartThread = startThread;
       handle.startThread = async (params) => {
-        const res = await origStartThread.call(handle, params);
+        const res = await startThread.call(handle, params);
         if (res?.threadId) {
           subscribeThread(res.threadId);
         }
@@ -73098,9 +73251,10 @@ function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATI
       };
     }
     if (typeof handle.resumeThread === "function") {
-      origResumeThread = handle.resumeThread;
+      const resumeThread = handle.resumeThread;
+      origResumeThread = resumeThread;
       handle.resumeThread = async (threadId, params) => {
-        const res = await origResumeThread.call(handle, threadId, params);
+        const res = await resumeThread.call(handle, threadId, params);
         if (res?.threadId) {
           subscribeThread(res.threadId);
         }
@@ -73108,44 +73262,39 @@ function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATI
       };
     }
     if (typeof handle.startTurn === "function") {
-      origStartTurn = handle.startTurn;
+      const startTurn = handle.startTurn;
+      origStartTurn = startTurn;
       handle.startTurn = async (threadId, input, effort) => {
         if (threadId) {
           subscribeThread(threadId);
         }
-        return origStartTurn.call(handle, threadId, input, effort);
+        return startTurn.call(handle, threadId, input, effort);
       };
     }
     if (typeof handle.onEvent === "function" && typeof handle.startThread !== "function") {
       try {
         const unsub = handle.onEvent("*", (event) => {
-          if (event && event.type === "tool_use" && event.tool?.name) {
-            const name = String(event.tool.name).toLowerCase();
-            for (const disabled of disabledTools) {
-              if (name === disabled.toLowerCase()) {
-                toolViolationError = new DisabledToolInvocationError(event.tool.name);
-                if (typeof handle.interruptTurn === "function") {
-                  try {
-                    handle.interruptTurn("*").catch(() => {
-                    });
-                  } catch {
-                  }
-                }
-                break;
-              }
+          const disabledTool = disabledToolFromEvent(event, disabledTools);
+          if (disabledTool !== null) {
+            toolViolationError = new DisabledToolInvocationError(disabledTool);
+            try {
+              void handle.interruptTurn("*").catch((error51) => {
+              });
+            } catch (error51) {
             }
           }
         });
         unsubscribes.push(unsub);
-      } catch {
+      } catch (error51) {
       }
     }
-    if (typeof handle.executeTool === "function") {
-      origExecute = handle.executeTool;
+    if (typeof extendedHandle.executeTool === "function") {
+      const executeTool = extendedHandle.executeTool;
+      origExecute = executeTool;
       didPatchExecute = true;
-      handle.executeTool = async (name, args) => {
+      extendedHandle.executeTool = async (name, args) => {
         assertNativeToolsDisabled(name, disabledTools);
-        return origExecute.call(handle, name, args);
+        return executeTool.call(handle, name, args);
       };
     }
     try {
@@ -73158,14 +73307,14 @@ function createVerificationTurnRunner(baseRunTurn, disabledTools = DISABLED_NATI
       for (const unsub of unsubscribes) {
         try {
           unsub();
-        } catch {
+        } catch (error51) {
         }
       }
       if (origStartThread) handle.startThread = origStartThread;
       if (origResumeThread) handle.resumeThread = origResumeThread;
       if (origStartTurn) handle.startTurn = origStartTurn;
       if (didPatchExecute && origExecute) {
-        handle.executeTool = origExecute;
+        extendedHandle.executeTool = origExecute;
       }
     }
   };
@@ -73245,7 +73394,7 @@ function createRunVerificationTurn(deps) {
       let v6 = [];
       try {
         v4 = await import_node_dns2.default.promises.resolve4(normalizedUrl.hostname).catch((err) => {
-          if (err?.code === "ENODATA" || err?.code === "ENOTFOUND") return [];
+          if (isDnsNoData(err)) return [];
           throw err;
         });
       } catch (err) {
@@ -73257,7 +73406,7 @@ function createRunVerificationTurn(deps) {
       }
       try {
         v6 = await import_node_dns2.default.promises.resolve6(normalizedUrl.hostname).catch((err) => {
-          if (err?.code === "ENODATA" || err?.code === "ENOTFOUND") return [];
+          if (isDnsNoData(err)) return [];
           throw err;
         });
       } catch (err) {
@@ -73302,7 +73451,7 @@ function createRunVerificationTurn(deps) {
     if (!brokerSession.clientSocket) {
       try {
         await brokerSession.close();
-      } catch {
+      } catch (error51) {
       }
       return {
         verdict: "fail",
@@ -73323,7 +73472,7 @@ function createRunVerificationTurn(deps) {
       if (brokerSession) {
         try {
           await brokerSession.close();
-        } catch {
+        } catch (error51) {
         }
       }
       return { verdict: "fail", summary: `network sandbox initialization failed: ${String(err)}`, turnRef: null };
@@ -73338,13 +73487,13 @@ function createRunVerificationTurn(deps) {
       if (sandboxHandle) {
         try {
           sandboxHandle.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (brokerSession) {
         try {
           await brokerSession.close();
-        } catch {
+        } catch (error51) {
         }
       }
       return {
@@ -73370,13 +73519,13 @@ function createRunVerificationTurn(deps) {
       if (sandboxHandle) {
         try {
           sandboxHandle.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (brokerSession) {
         try {
           await brokerSession.close();
-        } catch {
+        } catch (error51) {
         }
       }
       return { verdict: "fail", summary: `agent sandbox startup failed: ${String(err)}`, turnRef: null };
@@ -73385,19 +73534,19 @@ function createRunVerificationTurn(deps) {
       if (agentSandbox) {
         try {
           agentSandbox.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (sandboxHandle) {
         try {
           sandboxHandle.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (brokerSession) {
         try {
           await brokerSession.close();
-        } catch {
+        } catch (error51) {
         }
       }
       return {
@@ -73422,19 +73571,19 @@ function createRunVerificationTurn(deps) {
       if (agentSandbox) {
         try {
           agentSandbox.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (sandboxHandle) {
         try {
           sandboxHandle.dispose();
-        } catch {
+        } catch (error51) {
         }
       }
       if (brokerSession) {
         try {
           await brokerSession.close();
-        } catch {
+        } catch (error51) {
         }
       }
     }
@@ -74204,6 +74353,13 @@ function neutralCheckoutCwd(stateDir) {
   }
   return dir;
 }
+function directorThreadEnv(projectSlug) {
+  const slug = projectSlug ?? "";
+  if (!slug || slug.length > 200 || /[\s\p{Cc}]/u.test(slug)) {
+    return { MRRLIN_PROJECT_SLUG: null, MRRLIN_PROJECT_BINDING: "none" };
+  }
+  return { MRRLIN_PROJECT_SLUG: slug, MRRLIN_PROJECT_BINDING: null };
+}
 function buildThreadStartParams(msg, config2, desiredModel) {
   const baseInstructions = [
     "You are the Mrrlin Director assistant.",
@@ -74241,10 +74397,10 @@ function buildThreadStartParams(msg, config2, desiredModel) {
     "- Every read or write of Mrrlin data \u2014 tasks, plans, wiki pages, inbox items, execution runs,",
     "  projects \u2014 must go through the corresponding typed MCP tool. Never use `commandExecution`,",
     "  `curl`, `python`, or any direct HTTP call to the Mrrlin API.",
-    "- A single `create_task` call creates a task completely; it accepts `title`, `notes`, `category`,",
-    "  `subcategory`, `impact`, `autonomyLevel`, `planId`, `parentTaskId`, and more in one call.",
-    "  Do not create then patch, and do not re-read the task afterwards unless the operator asked",
-    "  for confirmation.",
+    "- New work is created through `propose_task`, one call per task: it accepts `title`, `notes`,",
+    "  `category`, `subcategory`, `impact`, `autonomyLevel`, `planId`, and more in one call. The",
+    "  operator confirms the proposal in the chat, and that confirmation creates the task \u2014 you do",
+    "  not call `create_task` for it. Do not propose then patch.",
     "- `commandExecution` is for the operator's own machine and repositories \u2014 running builds, tests,",
     "  `git`, inspecting local files \u2014 and for public third-party web checks. It is not a transport",
     "  for this product's API.",
@@ -74327,11 +74483,12 @@ function buildThreadStartParams(msg, config2, desiredModel) {
     "NOT add words of your own.",
     "",
     "Once the operator replies and clarifies or confirms the scope (or if scope was already clear),",
-    "you MUST create the tasks: create the plan (if needed) and call `create_task` in the same turn so",
-    "actionable task cards appear on the Tasks board immediately. Never leave the board empty with 0",
-    "tasks after agreeing on scope. Never claim tasks are created, queued, or ready unless `create_task`",
-    "was actually invoked and returned the task ID. Set `status: 'todo'` on newly created actionable",
-    "tasks unless explicitly asked for backlog, so they appear in active Kanban columns immediately.",
+    "you MUST propose the tasks in the same turn: call `propose_task` once per task (`kind: 'plan'` for",
+    "a plan) so the operator gets a confirmation card for each one immediately. Never leave the",
+    "operator with nothing to confirm after agreeing on scope. Never claim tasks are created, queued,",
+    "or ready before the operator confirmed them: say they are waiting for the operator's confirmation",
+    "in the chat. Proposals bind to the operator's latest message, so propose in the same turn as the",
+    "request \u2014 a later operator message makes an unconfirmed proposal stale.",
     "When referring to created tasks or where to view them, use natural, human-friendly language with a markdown link",
     "to the Tasks page (e.g. 'on the [Tasks page](/tasks)', '[Tasks board](/tasks)', or in Ukrainian '\u043D\u0430 [\u0441\u0442\u043E\u0440\u0456\u043D\u0446\u0456 \u0437\u0430\u0434\u0430\u0447](/tasks)').",
     "Never output raw technical URL fragments like '\u043D\u0430 /tasks' or 'on /tasks', and never use developer database",
@@ -74618,7 +74775,10 @@ function buildThreadStartParams(msg, config2, desiredModel) {
     model: desiredModel,
     baseInstructions,
     developerInstructions: null,
-    ephemeral: null
+    ephemeral: null,
+    // Claude and Agy spawn a process per thread and every Director turn starts or resumes one,
+    // so the turn's own project always reaches the child, including after a project switch.
+    env: directorThreadEnv(msg.context?.projectSlug)
   };
 }
 function readEnvInt(name, fallback) {
@@ -75990,7 +76150,15 @@ function createBridgeMessageHandler(deps) {
         project: projectContext,
         answeredQuestions,
         openQuestions: presentedLedger.shown.length ? presentedLedger.shown : void 0,
-        clarifications: msg.context?.clarifications ?? (presentedLedger.shown.some((i) => i.id) ? presentedLedger.shown : void 0),
+        clarifications: msg.context?.clarifications ?? (presentedLedger.shown.some((i) => i.id) ? presentedLedger.shown.map(({ id, round, ordinal, question, status, answer, actor }) => ({
+          id,
+          round,
+          ordinal,
+          question,
+          status,
+          answer,
+          actor
+        })) : void 0),
         directorSessionId
       });
       const sendInTurn = (msg2) => {
@@ -76698,9 +76866,12 @@ async function startDirectorBridge() {
     // Task 1.11: providerId is the caller's own pinned/minted seat (execution-consumer.ts's
     // resolvedProviderId), not resolved ambiently here — this run-scoped spawn has no business
     // re-reading a setting that could have moved since the run's own seat was decided.
-    acquireExecutorAgent: async (worktreePath, providerId) => {
+    acquireExecutorAgent: async (worktreePath, providerId, projectSlug) => {
       const executor = await startExecutorServer({
         worktree: worktreePath,
+        // The run's provider process carries exactly its own project (or none), so its Mrrlin MCP
+        // server is bound to it and never to whatever the bridge's environment names.
+        env: threadProcessEnv(process.env, directorThreadEnv(projectSlug)),
         disabledGitHooksDir: prepareDisabledGitHooksDir(import_node_path40.default.join(config2.stateDir, "locks"), import_node_path40.default.basename(worktreePath)),
         provider: providerId
       });
@@ -77631,7 +77802,7 @@ function renderContextPrefix(context) {
   }
   if (context?.activeProposal) {
     parts.push(
-      `[ACTIVE PROPOSAL] Proposal ID: ${context.activeProposal.id} (version ${context.activeProposal.version}). Work materialization requires explicit operator confirmation of this proposal. You MUST provide proposalId, proposalVersion, and proposalDigest when creating tasks or plans. Direct agent materialization without confirmation will fail closed.`
+      `[ACTIVE PROPOSAL] Proposal ID: ${context.activeProposal.id} (version ${context.activeProposal.version}). Work is created only by the operator confirming a proposal in the chat; propose new work with propose_task. create_plan, and create_task for an already-confirmed proposal, need its proposalId, proposalVersion, and proposalDigest.`
     );
   }
   if (context?.clarifications?.length) {
@@ -77935,23 +78106,23 @@ var Server = class extends Protocol {
       const wrappedHandler = async (request, extra) => {
         const validatedRequest = safeParse3(CallToolRequestSchema, request);
         if (!validatedRequest.success) {
-          const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage}`);
+          const errorMessage2 = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage2}`);
         }
         const { params } = validatedRequest.data;
         const result = await Promise.resolve(handler(request, extra));
         if (params.task) {
           const taskValidationResult = safeParse3(CreateTaskResultSchema, result);
           if (!taskValidationResult.success) {
-            const errorMessage = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
-            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
+            const errorMessage2 = taskValidationResult.error instanceof Error ? taskValidationResult.error.message : String(taskValidationResult.error);
+            throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage2}`);
           }
           return taskValidationResult.data;
         }
         const validationResult = safeParse3(CallToolResultSchema, result);
         if (!validationResult.success) {
-          const errorMessage = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
-          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call result: ${errorMessage}`);
+          const errorMessage2 = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
+          throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call result: ${errorMessage2}`);
         }
         return validationResult.data;
       };