@nikolasp98/minion 2026.6.14-dev.20260616061802 → 2026.6.16-dev

package/dist/plugin-sdk/channels/line.js

@@ -47,6 +47,7 @@ import { Type as Type$1 } from "@sinclair/typebox";
 import { spinner } from "@clack/prompts";
 import { createOscProgressController, supportsOscProgress } from "osc-progress";
 import MarkdownIt from "markdown-it";
+import { Bash, InMemoryFs, MountableFs, ReadWriteFs } from "just-bash";
 import fs$2 from "fs/promises";
 import os$1 from "os";
 import path$1 from "path";
@@ -67,7 +68,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region src/shared/with-timeout.ts
-function withTimeout$4(promise, timeoutMs) {
+function withTimeout$5(promise, timeoutMs) {
 	if (!timeoutMs || timeoutMs <= 0) return promise;
 	let timer = null;
 	const timeout = new Promise((_, reject) => {
@@ -86,7 +87,7 @@ async function probeLineBot(channelAccessToken, timeoutMs = 5e3) {
 	};
 	const client = new messagingApi.MessagingApiClient({ channelAccessToken: channelAccessToken.trim() });
 	try {
-		const profile = await withTimeout$4(client.getBotInfo(), timeoutMs);
+		const profile = await withTimeout$5(client.getBotInfo(), timeoutMs);
 		return {
 			ok: true,
 			bot: {
@@ -413,7 +414,7 @@ function notifyMcpToolsChanged() {
 	}
 }
 var tools$1, sseSubscribers, EMPTY_OBJECT_SCHEMA;
-var init_registry$6 = __esmMin((() => {
+var init_registry$7 = __esmMin((() => {
 	tools$1 = /* @__PURE__ */ new Map();
 	sseSubscribers = /* @__PURE__ */ new Set();
 	EMPTY_OBJECT_SCHEMA = {
@@ -1346,7 +1347,7 @@ function createSubsystemLogger(subsystem) {
 }
 var SUBSYSTEM_COLORS, SUBSYSTEM_COLOR_OVERRIDES, SUBSYSTEM_PREFIXES_TO_DROP, SUBSYSTEM_MAX_SEGMENTS, CHANNEL_SUBSYSTEM_PREFIXES;
 var init_subsystem = __esmMin((() => {
-	init_registry$4();
+	init_registry$5();
 	init_globals();
 	init_runtime$3();
 	init_progress_line();
@@ -2280,9 +2281,9 @@ function createPluginRegistry(registryParams) {
 		registerTypedHook
 	};
 }
-var init_registry$5 = __esmMin((() => {
+var init_registry$6 = __esmMin((() => {
 	init_instant_commands();
-	init_registry$6();
+	init_registry$7();
 	init_internal_hooks();
 	init_utils$2();
 	init_channel_link_runtime();
@@ -2316,7 +2317,7 @@ function setActivePluginRuntime(runtime) {
 }
 var REGISTRY_STATE, CONFIG_STATE, RUNTIME_STATE, state$3, configState, runtimeState$1;
 var init_runtime$2 = __esmMin((() => {
-	init_registry$5();
+	init_registry$6();
 	REGISTRY_STATE = Symbol.for("minion.pluginRegistryState");
 	CONFIG_STATE = Symbol.for("minion.pluginRegistryConfig");
 	RUNTIME_STATE = Symbol.for("minion.activePluginRuntime");
@@ -2363,7 +2364,7 @@ function normalizeAnyChannelId(raw) {
 	})?.plugin.id ?? null;
 }
 var CHAT_CHANNEL_ORDER, CHANNEL_IDS, CHAT_CHANNEL_META, CHAT_CHANNEL_ALIASES, normalizeChannelKey;
-var init_registry$4 = __esmMin((() => {
+var init_registry$5 = __esmMin((() => {
 	init_runtime$2();
 	CHAT_CHANNEL_ORDER = [
 		"telegram",
@@ -2536,7 +2537,7 @@ function isMarkdownCapableMessageChannel(raw) {
 }
 var INTERNAL_MESSAGE_CHANNEL, MARKDOWN_CAPABLE_CHANNELS, listPluginChannelIds, listDeliverableMessageChannels, listGatewayMessageChannels;
 var init_message_channel = __esmMin((() => {
-	init_registry$4();
+	init_registry$5();
 	init_client_info();
 	init_runtime$2();
 	INTERNAL_MESSAGE_CHANNEL = "webchat";
@@ -4260,7 +4261,7 @@ function resolveDefaultAgentBoundAccountId(cfg, channelId) {
 }
 var init_bindings = __esmMin((() => {
 	init_agent_scope();
-	init_registry$4();
+	init_registry$5();
 	init_session_key$1();
 }));
 //#endregion
@@ -5106,7 +5107,7 @@ var init_dock = __esmMin((() => {
 	init_utils$2();
 	init_group_mentions();
 	init_signal$1();
-	init_registry$4();
+	init_registry$5();
 	formatLower = (allowFrom) => allowFrom.map((entry) => String(entry).trim()).filter(Boolean).map((entry) => entry.toLowerCase());
 	formatDiscordAllowFrom = (allowFrom) => allowFrom.map((entry) => String(entry).trim().replace(/^<@!?/, "").replace(/>$/, "").replace(/^discord:/i, "").replace(/^user:/i, "").replace(/^pk:/i, "").trim().toLowerCase()).filter(Boolean);
 	DOCKS = {
@@ -5531,7 +5532,7 @@ function normalizeChannelId(raw) {
 }
 var init_plugins = __esmMin((() => {
 	init_runtime$2();
-	init_registry$4();
+	init_registry$5();
 	init_directory_config();
 }));
 //#endregion
@@ -6427,6 +6428,7 @@ var init_zod_schema_agent_runtime = __esmMin((() => {
 		]).optional(),
 		perSession: z.boolean().optional(),
 		workspaceRoot: z.string().optional(),
+		tier0: z.object({ enabled: z.boolean().optional() }).strict().optional(),
 		docker: SandboxDockerSchema,
 		browser: SandboxBrowserSchema,
 		prune: SandboxPruneSchema
@@ -6628,7 +6630,8 @@ var init_zod_schema_agent_runtime = __esmMin((() => {
 		exec: ToolExecSchema,
 		fs: ToolFsSchema,
 		subagents: z.object({ tools: ToolPolicySchema }).strict().optional(),
-		sandbox: z.object({ tools: ToolPolicySchema }).strict().optional()
+		sandbox: z.object({ tools: ToolPolicySchema }).strict().optional(),
+		outputReduce: z.object({ enabled: z.boolean().optional() }).strict().optional()
 	}).strict().superRefine((value, ctx) => {
 		addAllowAlsoAllowConflictIssue(value, ctx, "tools cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)");
 	}).optional();
@@ -7124,7 +7127,7 @@ var init_shell_env = __esmMin((() => {
 //#region src/version.ts
 var VERSION;
 var init_version$1 = __esmMin((() => {
-	VERSION = "2026.6.14-dev.20260616061802";
+	VERSION = "2026.6.16-dev";
 }));
 //#endregion
 //#region src/config/agent-dirs.ts
@@ -16847,6 +16850,7 @@ var init_zod_schema = __esmMin((() => {
 				importContacts: z.boolean().optional()
 			}).strict().optional(),
 			memorySync: z.object({ enabled: z.boolean().optional() }).strict().optional(),
+			trajectory: z.object({ enabled: z.boolean().optional() }).strict().optional(),
 			personalAgentObservations: z.object({
 				enabled: z.boolean().optional(),
 				dbPath: z.string().optional()
@@ -16959,6 +16963,7 @@ var init_zod_schema = __esmMin((() => {
 		memory: MemorySchema,
 		skills: z.object({
 			allowBundled: z.array(z.string()).optional(),
+			progressiveDisclosure: z.boolean().optional(),
 			load: z.object({
 				extraDirs: z.array(z.string()).optional(),
 				watch: z.boolean().optional(),
@@ -17334,7 +17339,7 @@ function validateConfigObjectWithPluginsBase(raw, opts) {
 var AVATAR_SCHEME_RE, AVATAR_DATA_RE, AVATAR_HTTP_RE, WINDOWS_ABS_RE;
 var init_validation = __esmMin((() => {
 	init_agent_scope();
-	init_registry$4();
+	init_registry$5();
 	init_config_state();
 	init_manifest_registry();
 	init_schema_validator();
@@ -22919,6 +22924,24 @@ var init_bundled_dir = __esmMin((() => {
 	init_minion_root();
 }));
 //#endregion
+//#region src/agents/skills/compact-prompt.ts
+/**
+* Render a compact, name+description-only skills listing for progressive
+* disclosure. The full SKILL.md body is deliberately omitted; the agent is
+* instructed to load it on demand via the `skill_view` tool. This keeps the
+* system prompt small when many skills are available.
+*/
+function formatSkillsCompact(skills) {
+	if (skills.length === 0) return "";
+	return [
+		"<available_skills>",
+		...skills.map((s) => `- **${s.name}** — ${s.description.trim()}`),
+		"</available_skills>",
+		"Call the `skill_view` tool with a skill name to load its full instructions before using it."
+	].join("\n");
+}
+var init_compact_prompt = __esmMin((() => {}));
+//#endregion
 //#region src/shared/config-eval.ts
 function isTruthyValue(value) {
 	if (value === void 0 || value === null) return false;
@@ -23669,6 +23692,35 @@ function applySkillsPromptLimits(params) {
 		truncatedReason
 	};
 }
+/**
+* Resolve whether progressive disclosure is enabled. Default is ON; only an
+* explicit `false` disables it (inlining full skill bodies in the prompt).
+*/
+function resolveProgressiveDisclosure(config, override) {
+	if (override !== void 0) return override;
+	return config?.skills?.progressiveDisclosure !== false;
+}
+/**
+* Map prompt-eligible skill entries to compact `{ name, description, body }`
+* records. The body is the full SKILL.md text, read from disk on demand; if the
+* file can't be read we fall back to an empty body (compact mode omits bodies
+* from the prompt anyway, so this only affects callers that inspect `body`).
+*/
+function toCompactSkills(skills) {
+	return skills.map((skill) => {
+		let body = "";
+		try {
+			body = fs.readFileSync(skill.filePath, "utf-8");
+		} catch {
+			body = "";
+		}
+		return {
+			name: skill.name,
+			description: skill.description ?? "",
+			body
+		};
+	});
+}
 function buildWorkspaceSkillSnapshot(workspaceDir, opts) {
 	const eligible = filterSkillEntries(opts?.entries ?? loadSkillEntries(workspaceDir, opts), opts?.config, opts?.skillFilter, opts?.eligibility, opts?.denyFilter);
 	const resolvedSkills = eligible.filter((entry) => entry.invocation?.disableModelInvocation !== true).map((entry) => entry.skill);
@@ -23680,7 +23732,7 @@ function buildWorkspaceSkillSnapshot(workspaceDir, opts) {
 	const prompt = [
 		remoteNote,
 		truncated ? `⚠️ Skills truncated: included ${skillsForPrompt.length} of ${resolvedSkills.length}. Run \`openclaw skills check\` to audit.` : "",
-		formatSkillsForPrompt(compactSkillPaths(skillsForPrompt))
+		resolveProgressiveDisclosure(opts?.config, opts?.progressive) ? formatSkillsCompact(toCompactSkills(skillsForPrompt)) : formatSkillsForPrompt(compactSkillPaths(skillsForPrompt))
 	].filter(Boolean).join("\n");
 	const skillFilter = normalizeSkillFilter(opts?.skillFilter);
 	const denyFilter = normalizeSkillFilter(opts?.denyFilter);
@@ -23707,7 +23759,7 @@ function buildWorkspaceSkillsPrompt(workspaceDir, opts) {
 	return [
 		remoteNote,
 		truncated ? `⚠️ Skills truncated: included ${skillsForPrompt.length} of ${resolvedSkills.length}. Run \`openclaw skills check\` to audit.` : "",
-		formatSkillsForPrompt(compactSkillPaths(skillsForPrompt))
+		resolveProgressiveDisclosure(opts?.config, opts?.progressive) ? formatSkillsCompact(toCompactSkills(skillsForPrompt)) : formatSkillsForPrompt(compactSkillPaths(skillsForPrompt))
 	].filter(Boolean).join("\n");
 }
 function resolveSkillsPromptForRun(params) {
@@ -23860,6 +23912,7 @@ var init_workspace$1 = __esmMin((() => {
 	init_utils$2();
 	init_sandbox_paths();
 	init_bundled_dir();
+	init_compact_prompt();
 	init_config$3();
 	init_filter();
 	init_frontmatter();
@@ -28032,7 +28085,7 @@ var init_parse$2 = __esmMin((() => {
 	ERROR_PAYLOAD_PREFIX_RE = /^(?:error|api\s*error|apierror|openai\s*error|anthropic\s*error|gateway\s*error)[:\s-]+/i;
 })), DEFAULT_SANDBOX_WORKSPACE_ROOT, DEFAULT_SANDBOX_IMAGE, DEFAULT_TOOL_ALLOW, DEFAULT_TOOL_DENY, SANDBOX_AGENT_WORKSPACE_MOUNT, SANDBOX_STATE_DIR, SANDBOX_REGISTRY_PATH, SANDBOX_BROWSER_REGISTRY_PATH;
 var init_constants$2 = __esmMin((() => {
-	init_registry$4();
+	init_registry$5();
 	init_config$4();
 	DEFAULT_SANDBOX_WORKSPACE_ROOT = path.join(STATE_DIR, "sandboxes");
 	DEFAULT_SANDBOX_IMAGE = "minion-sandbox:bookworm-slim";
@@ -28537,6 +28590,7 @@ function resolveSandboxConfigForAgent(cfg, agentId) {
 		scope,
 		workspaceAccess: agentSandbox?.workspaceAccess ?? agent?.workspaceAccess ?? "none",
 		workspaceRoot: agentSandbox?.workspaceRoot ?? agent?.workspaceRoot ?? DEFAULT_SANDBOX_WORKSPACE_ROOT,
+		tier0: { enabled: agentSandbox?.tier0?.enabled ?? agent?.tier0?.enabled ?? false },
 		docker: resolveSandboxDockerConfig({
 			scope,
 			globalDocker: agent?.docker,
@@ -36508,7 +36562,7 @@ async function removeBrowserRegistryEntry(containerName) {
 		return next;
 	});
 }
-var init_registry$3 = __esmMin((() => {
+var init_registry$4 = __esmMin((() => {
 	init_session_write_lock();
 	init_constants$2();
 }));
@@ -36969,7 +37023,7 @@ var init_docker = __esmMin((() => {
 	init_runtime$3();
 	init_config_hash();
 	init_constants$2();
-	init_registry$3();
+	init_registry$4();
 	init_shared$1();
 	init_validate_sandbox_security();
 	log$44 = createSubsystemLogger("sandbox/docker");
@@ -37195,7 +37249,7 @@ var init_browser = __esmMin((() => {
 	init_config$2();
 	init_constants$2();
 	init_docker();
-	init_registry$3();
+	init_registry$4();
 	init_shared$1();
 	init_tool_policy();
 	HOT_BROWSER_WINDOW_MS = 300 * 1e3;
@@ -37561,7 +37615,7 @@ var init_prune = __esmMin((() => {
 	init_runtime$3();
 	init_browser_bridges();
 	init_docker();
-	init_registry$3();
+	init_registry$4();
 	lastPruneAtMs = 0;
 }));
 //#endregion
@@ -37867,7 +37921,7 @@ var init_manage = __esmMin((() => {
 	init_config$4();
 	init_config$2();
 	init_docker();
-	init_registry$3();
+	init_registry$4();
 	init_shared$1();
 }));
 //#endregion
@@ -42694,7 +42748,7 @@ function resolveCommandAuthorization(params) {
 }
 var init_command_auth = __esmMin((() => {
 	init_dock();
-	init_registry$4();
+	init_registry$5();
 	init_message_channel();
 }));
 //#endregion
@@ -44997,7 +45051,7 @@ var loggedListActionErrors;
 var init_channel_tools = __esmMin((() => {
 	init_dock();
 	init_plugins();
-	init_registry$4();
+	init_registry$5();
 	init_runtime$3();
 	loggedListActionErrors = /* @__PURE__ */ new Set();
 }));
@@ -61418,7 +61472,7 @@ function loadOpenClawPlugins(options = {}) {
 }
 var registryCache, defaultLogger, resolvePluginSdkAliasFile, resolvePluginSdkAlias;
 var init_loader = __esmMin((() => {
-	init_registry$6();
+	init_registry$7();
 	init_subsystem();
 	init_utils$2();
 	init_version$1();
@@ -61429,7 +61483,7 @@ var init_loader = __esmMin((() => {
 	init_config_state();
 	init_discovery();
 	init_manifest_registry();
-	init_registry$5();
+	init_registry$6();
 	init_runtime$2();
 	init_runtime$1();
 	init_schema_validator();
@@ -62902,6 +62956,198 @@ var init_landlock = __esmMin((() => {
 	_caps = null;
 }));
 //#endregion
+//#region src/agents/sandbox/tier0/router.ts
+function shouldTryTier0(command) {
+	const cmd = command.trim();
+	if (!cmd) return false;
+	for (const re of ESCALATE_PATTERNS) if (re.test(cmd)) return false;
+	return true;
+}
+/**
+* Distinguish "just-bash can't do this" from "the user's command legitimately
+* failed". Known limitations in just-bash@3.0.1 include `$(( ))` arithmetic
+* expansion (trips its own defense-in-depth `node:module` guard) and any
+* unimplemented builtin. These must escalate to Docker, not surface as failures.
+*/
+function isInterpreterLimitation(stderr) {
+	if (!stderr) return false;
+	return /security violation/i.test(stderr) || /indicates a bug in just-bash/i.test(stderr) || /\bcommand not found\b/i.test(stderr) || /not (yet )?(supported|implemented)/i.test(stderr) || /unknown command/i.test(stderr);
+}
+var ESCALATE_PATTERNS;
+var init_router = __esmMin((() => {
+	ESCALATE_PATTERNS = [
+		/\b(curl|wget|nc|ncat|netcat|ssh|scp|sftp|rsync|ping|dig|nslookup|host)\b/,
+		/\b(python3?|pip3?|node|npm|pnpm|yarn|bun|deno|ruby|perl|php|cargo|rustc|go|gcc|g\+\+|cc|clang|make|cmake|java|javac|dotnet)\b/,
+		/\b(apt|apt-get|dpkg|yum|dnf|apk|brew|sudo|su|systemctl|service|mount|umount|chroot|insmod|modprobe|iptables)\b/,
+		/\b(docker|kubectl|helm|git|gh|aws|gcloud|az|terraform|ffmpeg|convert|magick|pandoc)\b/,
+		/(^|\s|=)\/(dev|proc|sys)\//,
+		/<\(|>\(/
+	];
+}));
+//#endregion
+//#region src/agents/sandbox/tier0/virtual-sandbox.ts
+/**
+* Tier-0 virtual sandbox — an in-process bash backend powered by just-bash.
+*
+* This is the cheap/fast tier in front of the Docker sandbox. For the high-volume
+* "safe" majority of agent shell calls (string munging, fs reads/writes in the
+* workspace, grep/sed/jq-style pipelines) it runs the command in-process against
+* an in-memory shell with the real workspace dir mounted — no container spawn.
+*
+* Correctness: the agent's real workspace dir is mounted (read-write, symlink-
+* blocked, root-jailed via just-bash's ReadWriteFs) at the container workdir, so
+* file visibility is identical to the Docker path. `/tmp` etc. live on an
+* InMemoryFs base. Network and python are OFF by default (just-bash defaults).
+*
+* Anything just-bash can't serve (an unimplemented builtin, an internal error)
+* sets `unsupported: true`; callers MUST escalate those to the Docker backend.
+* See ./router.ts for the routing + interpreter-limitation heuristics.
+*/
+function withTimeout$4(p, ms) {
+	if (!ms) return p;
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(new TimeoutError()), ms);
+		p.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+var Tier0VirtualSandbox, TimeoutError;
+var init_virtual_sandbox = __esmMin((() => {
+	init_router();
+	Tier0VirtualSandbox = class {
+		constructor() {
+			this.instances = /* @__PURE__ */ new Map();
+		}
+		getInstance(req) {
+			const existing = this.instances.get(req.scopeKey);
+			if (existing && existing.workspaceHostDir === req.workspaceHostDir && existing.workdir === req.workdir) {
+				existing.lastUsed = Date.now();
+				return existing.bash;
+			}
+			const fs = new MountableFs({ base: new InMemoryFs() });
+			fs.mount(req.workdir, new ReadWriteFs({ root: req.workspaceHostDir }));
+			const bash = new Bash({
+				fs,
+				cwd: req.workdir,
+				env: {
+					LANG: "C.UTF-8",
+					...req.env
+				},
+				executionLimits: {
+					maxCommandCount: 1e4,
+					maxLoopIterations: 1e6
+				}
+			});
+			const inst = {
+				bash,
+				workspaceHostDir: req.workspaceHostDir,
+				workdir: req.workdir,
+				lastUsed: Date.now()
+			};
+			this.instances.set(req.scopeKey, inst);
+			return bash;
+		}
+		async exec(req) {
+			const startedAt = Date.now();
+			let bash;
+			try {
+				bash = this.getInstance(req);
+			} catch {
+				return {
+					status: "failed",
+					exitCode: null,
+					durationMs: Date.now() - startedAt,
+					aggregated: "",
+					timedOut: false,
+					unsupported: true
+				};
+			}
+			try {
+				const result = await withTimeout$4(bash.exec(req.command, {
+					cwd: req.workdir,
+					env: req.env
+				}), req.timeoutSec ? req.timeoutSec * 1e3 : void 0);
+				const durationMs = Date.now() - startedAt;
+				const combined = [result.stdout, result.stderr].filter(Boolean).join("").trim();
+				if (result.exitCode === 0) return {
+					status: "completed",
+					exitCode: 0,
+					durationMs,
+					aggregated: combined,
+					timedOut: false,
+					unsupported: false
+				};
+				return {
+					status: "failed",
+					exitCode: result.exitCode,
+					durationMs,
+					aggregated: combined,
+					timedOut: false,
+					unsupported: isInterpreterLimitation(result.stderr)
+				};
+			} catch (err) {
+				const timedOut = err instanceof TimeoutError;
+				return {
+					status: "failed",
+					exitCode: null,
+					durationMs: Date.now() - startedAt,
+					aggregated: "",
+					timedOut,
+					unsupported: !timedOut
+				};
+			}
+		}
+		dispose(scopeKey) {
+			if (scopeKey) this.instances.delete(scopeKey);
+			else this.instances.clear();
+		}
+		/** test/inspection helper */
+		get liveInstances() {
+			return this.instances.size;
+		}
+	};
+	TimeoutError = class extends Error {};
+}));
+//#endregion
+//#region src/agents/sandbox/tier0/registry.ts
+function getTier0Sandbox() {
+	if (!singleton$1) singleton$1 = new Tier0VirtualSandbox();
+	return singleton$1;
+}
+/**
+* Resolve the tier-0 binding for an exec, or undefined to use the Docker/host
+* path. `workspaceHostDir` is the real sandbox workspace dir (mounted into the
+* Docker container too), so tier-0 sees the same files.
+*/
+function resolveTier0Binding(params) {
+	if (!params.workspaceHostDir) return;
+	const sandboxCfg = resolveSandboxConfigForAgent(params.config ?? loadConfig(), params.agentId);
+	if (!sandboxCfg.tier0.enabled) return;
+	if (sandboxCfg.workspaceAccess === "ro") return;
+	return {
+		backend: getTier0Sandbox(),
+		workspaceHostDir: params.workspaceHostDir
+	};
+}
+var singleton$1;
+var init_registry$3 = __esmMin((() => {
+	init_config$4();
+	init_config$2();
+	init_virtual_sandbox();
+}));
+//#endregion
+//#region src/agents/sandbox/tier0/index.ts
+var init_tier0 = __esmMin((() => {
+	init_router();
+	init_registry$3();
+	init_virtual_sandbox();
+}));
+//#endregion
 //#region src/agents/tools/automation/gateway.ts
 function readGatewayCallOptions(params) {
 	return {
@@ -64584,10 +64830,112 @@ function emitExecSystemEvent(text, opts) {
 	});
 	requestHeartbeatNow({ reason: "exec-event" });
 }
+/**
+* Tier-0 fast path: run `execCommand` in the in-process virtual sandbox. Returns
+* a completed ExecProcessHandle on success, or null when just-bash can't serve
+* the command (so the caller escalates to Docker). Output is sanitized and a
+* ProcessSession is registered exactly like the normal path, so downstream
+* session listing / tailing is unaffected.
+*/
+async function tryTier0Exec(args) {
+	const { opts, sessionId, startedAt, execCommand } = args;
+	const tier0 = opts.tier0;
+	const sandbox = opts.sandbox;
+	if (!tier0 || !sandbox) return null;
+	const workdir = opts.containerWorkdir ?? sandbox.containerWorkdir;
+	let outcome;
+	try {
+		outcome = await tier0.backend.exec({
+			command: execCommand,
+			workdir,
+			workspaceHostDir: tier0.workspaceHostDir,
+			env: opts.env,
+			scopeKey: sandbox.containerName,
+			timeoutSec: opts.timeoutSec
+		});
+	} catch {
+		return null;
+	}
+	if (outcome.unsupported) return null;
+	const session = {
+		id: sessionId,
+		command: opts.command,
+		scopeKey: opts.scopeKey,
+		sessionKey: opts.sessionKey,
+		notifyOnExit: opts.notifyOnExit,
+		notifyOnExitEmptySuccess: opts.notifyOnExitEmptySuccess === true,
+		exitNotified: false,
+		child: void 0,
+		stdin: void 0,
+		pid: void 0,
+		startedAt,
+		cwd: opts.workdir,
+		maxOutputChars: opts.maxOutput,
+		pendingMaxOutputChars: opts.pendingMaxOutput,
+		totalOutputChars: 0,
+		pendingStdout: [],
+		pendingStderr: [],
+		pendingStdoutChars: 0,
+		pendingStderrChars: 0,
+		aggregated: "",
+		tail: "",
+		exited: false,
+		exitCode: void 0,
+		exitSignal: void 0,
+		truncated: false,
+		backgrounded: false
+	};
+	addSession(session);
+	const sanitized = stripAnsi(sanitizeBinaryOutput(outcome.aggregated));
+	for (const chunk of chunkString(sanitized)) appendOutput(session, "stdout", chunk);
+	const status = outcome.status === "completed" ? "completed" : "failed";
+	markExited(session, outcome.exitCode ?? 0, null, status);
+	const durationMs = Date.now() - startedAt;
+	const aggregated = session.aggregated.trim();
+	let result;
+	if (status === "completed") {
+		const exitCode = outcome.exitCode ?? 0;
+		result = {
+			status: "completed",
+			exitCode,
+			exitSignal: null,
+			durationMs,
+			aggregated: aggregated + (exitCode !== 0 ? `\n\n(Command exited with code ${exitCode})` : ""),
+			timedOut: false
+		};
+	} else {
+		const reason = outcome.timedOut ? `Command timed out after ${opts.timeoutSec} seconds` : `Command exited with code ${outcome.exitCode ?? 1}`;
+		result = {
+			status: "failed",
+			exitCode: outcome.exitCode,
+			exitSignal: null,
+			durationMs,
+			aggregated,
+			timedOut: outcome.timedOut,
+			reason: aggregated ? `${aggregated}\n\n${reason}` : reason
+		};
+	}
+	return {
+		session,
+		startedAt,
+		pid: void 0,
+		promise: Promise.resolve(result),
+		kill: () => {}
+	};
+}
 async function runExecProcess(opts) {
 	const startedAt = Date.now();
 	const sessionId = createSessionSlug();
 	const execCommand = opts.execCommand ?? opts.command;
+	if (opts.tier0 && opts.sandbox && !opts.usePty && shouldTryTier0(execCommand)) {
+		const tier0Handle = await tryTier0Exec({
+			opts,
+			sessionId,
+			startedAt,
+			execCommand
+		});
+		if (tier0Handle) return tier0Handle;
+	}
 	const supervisor = getProcessSupervisor();
 	const session = {
 		id: sessionId,
@@ -64818,6 +65166,7 @@ var init_bash_tools_exec_runtime = __esmMin((() => {
 	init_supervisor();
 	init_pty_dsr();
 	init_shell_utils();
+	init_tier0();
 	init_bash_process_registry();
 	init_bash_tools_shared();
 	DANGEROUS_HOST_ENV_VARS = new Set([
@@ -65421,7 +65770,11 @@ function createExecTool(defaults) {
 				scopeKey: defaults?.scopeKey,
 				sessionKey: notifySessionKey,
 				timeoutSec: effectiveTimeout,
-				onUpdate
+				onUpdate,
+				tier0: sandbox ? resolveTier0Binding({
+					agentId,
+					workspaceHostDir: sandbox.workspaceDir
+				}) : void 0
 			});
 			let yielded = false;
 			let yieldTimer = null;
@@ -65496,6 +65849,7 @@ var init_bash_tools_exec = __esmMin((() => {
 	init_logger$2();
 	init_session_key$1();
 	init_landlock();
+	init_tier0();
 	init_gateway();
 	init_nodes_utils();
 	init_bash_process_registry();
@@ -79158,7 +79512,7 @@ function resolvePingPongTurns(cfg) {
 var ANNOUNCE_SKIP_TOKEN, REPLY_SKIP_TOKEN, DEFAULT_PING_PONG_TURNS, MAX_PING_PONG_TURNS;
 var init_sessions_send_helpers = __esmMin((() => {
 	init_plugins();
-	init_registry$4();
+	init_registry$5();
 	ANNOUNCE_SKIP_TOKEN = "ANNOUNCE_SKIP";
 	REPLY_SKIP_TOKEN = "REPLY_SKIP";
 	DEFAULT_PING_PONG_TURNS = 5;
@@ -91633,11 +91987,12 @@ var init_agent_type = __esmMin((() => {
 				if (!trimmed) return [];
 				return [
 					"## Skills (mandatory)",
-					"Before replying: scan <available_skills> <description> entries.",
-					`- If exactly one skill clearly applies: read its SKILL.md at <location> with \`${ctx.readToolName}\`, then follow it.`,
-					"- If multiple could apply: choose the most specific one, then read/follow it.",
-					"- If none clearly apply: do not read any SKILL.md.",
-					"Constraints: never read more than one skill up front; only read after selecting.",
+					"Before replying: scan the <available_skills> entries.",
+					"- If exactly one skill clearly applies: load its full instructions, then follow it.",
+					"- If multiple could apply: choose the most specific one, then load/follow it.",
+					"- If none clearly apply: do not load any skill.",
+					`To load a skill's full instructions: if they aren't already shown, call the \`skill_view\` tool with the skill name; otherwise read its SKILL.md at <location> with \`${ctx.readToolName}\`.`,
+					"Constraints: never load more than one skill up front; only load after selecting.",
 					trimmed,
 					""
 				];
@@ -91783,6 +92138,37 @@ var init_agent_type = __esmMin((() => {
 	];
 }));
 //#endregion
+//#region src/agents/sections/behaviour.ts
+var BEHAVIOUR_SECTIONS;
+var init_behaviour = __esmMin((() => {
+	init_prose_loader();
+	BEHAVIOUR_SECTIONS = [{
+		id: "behaviour",
+		layer: "identity",
+		order: 2200,
+		modes: ["full", "minimal"],
+		cacheable: false,
+		header: "## Operating Rules (self-maintained)",
+		source: "file",
+		render: (ctx) => {
+			const workspaceDir = ctx.params.workspaceDir;
+			if (!workspaceDir) return [];
+			const content = resolveProse({
+				layer: "identity",
+				id: "behaviour",
+				agentWorkspaceDir: workspaceDir
+			})?.content.trim();
+			if (!content) return [];
+			return [
+				"## Operating Rules (self-maintained)",
+				"",
+				content,
+				""
+			];
+		}
+	}];
+}));
+//#endregion
 //#region src/agents/sections/identity.ts
 var IDENTITY_SECTIONS;
 var init_identity = __esmMin((() => {
@@ -92751,6 +93137,7 @@ function getBuiltinRegistry() {
 	_registry.registerAll(PLATFORM_SECTIONS);
 	_registry.registerAll(AGENT_TYPE_SECTIONS);
 	_registry.registerAll(IDENTITY_SECTIONS);
+	_registry.registerAll(BEHAVIOUR_SECTIONS);
 	_registry.registerAll(USER_SECTIONS);
 	_registry.registerAll(SESSION_SECTIONS);
 	return _registry;
@@ -92769,6 +93156,7 @@ function assembleAgentSystemPrompt(params) {
 var _registry;
 var init_assemble = __esmMin((() => {
 	init_agent_type();
+	init_behaviour();
 	init_identity();
 	init_platform();
 	init_registry$1();
@@ -98491,6 +98879,36 @@ async function prepareSessionManagerForRun(params) {
 }
 var init_session_manager_init = __esmMin((() => {}));
 //#endregion
+//#region src/agents/pi-embedded-runner/tool-result-reduce.ts
+/** Pure text reducer for oversized/repetitive tool output. Never throws. */
+function reduceToolOutputText(text, opts) {
+	let lines = text.split("\n");
+	if (opts.collapseRuns) {
+		const collapsed = [];
+		let i = 0;
+		while (i < lines.length) {
+			let j = i + 1;
+			while (j < lines.length && lines[j] === lines[i]) j += 1;
+			const run = j - i;
+			if (run >= 5) collapsed.push(`${lines[i]}  (repeated ${run}×)`);
+			else for (let k = i; k < j; k++) collapsed.push(lines[k]);
+			i = j;
+		}
+		lines = collapsed;
+	}
+	if (lines.length <= opts.maxLines) return lines.join("\n");
+	if (opts.headLines + opts.tailLines >= lines.length) return lines.join("\n");
+	const head = lines.slice(0, opts.headLines);
+	const tail = lines.slice(lines.length - opts.tailLines);
+	const elided = lines.length - head.length - tail.length;
+	return [
+		...head,
+		`… ${elided} lines elided …`,
+		...tail
+	].join("\n");
+}
+var init_tool_result_reduce = __esmMin((() => {}));
+//#endregion
 //#region src/agents/pi-embedded-runner/tool-result-context-guard.ts
 function isTextBlock(block) {
 	return !!block && typeof block === "object" && block.type === "text";
@@ -98625,8 +99043,28 @@ function applyMessageMutationInPlace(target, source) {
 	for (const key of Object.keys(targetRecord)) if (!(key in sourceRecord)) delete targetRecord[key];
 	Object.assign(targetRecord, sourceRecord);
 }
+/**
+* Run the pure line-reducer over each tool-result message's text content,
+* mutating messages in place. Skips reductions that wouldn't shrink the text.
+*/
+function reduceToolResultOutputsInPlace(messages) {
+	for (const message of messages) {
+		if (!isToolResultMessage(message)) continue;
+		const rawText = getToolResultText(message);
+		if (!rawText) continue;
+		const reduced = reduceToolOutputText(rawText, {
+			maxLines: REDUCE_MAX_LINES,
+			headLines: REDUCE_HEAD_LINES,
+			tailLines: REDUCE_TAIL_LINES,
+			collapseRuns: true
+		});
+		if (reduced === rawText) continue;
+		applyMessageMutationInPlace(message, replaceToolResultText(message, reduced));
+	}
+}
 function enforceToolResultContextBudgetInPlace(params) {
-	const { messages, contextBudgetChars, maxSingleToolResultChars } = params;
+	const { messages, contextBudgetChars, maxSingleToolResultChars, reduceOutput } = params;
+	if (reduceOutput) reduceToolResultOutputsInPlace(messages);
 	for (const message of messages) {
 		if (!isToolResultMessage(message)) continue;
 		applyMessageMutationInPlace(message, truncateToolResultToChars(message, maxSingleToolResultChars));
@@ -98648,6 +99086,7 @@ function enforceToolResultContextBudgetInPlace(params) {
 * @returns An async function suitable for use as Agent's transformContext callback.
 */
 function createToolResultContextGuardTransform(params) {
+	const reduceOutput = params.reduceOutput !== false;
 	const contextWindowTokens = Math.max(1, Math.floor(params.contextWindowTokens));
 	const contextBudgetChars = Math.max(1024, Math.floor(contextWindowTokens * CHARS_PER_TOKEN_ESTIMATE * CONTEXT_INPUT_HEADROOM_RATIO));
 	const maxSingleToolResultChars = Math.max(1024, Math.floor(contextWindowTokens * TOOL_RESULT_CHARS_PER_TOKEN_ESTIMATE * SINGLE_TOOL_RESULT_CONTEXT_SHARE));
@@ -98658,13 +99097,15 @@ function createToolResultContextGuardTransform(params) {
 		enforceToolResultContextBudgetInPlace({
 			messages: contextMessages,
 			contextBudgetChars,
-			maxSingleToolResultChars
+			maxSingleToolResultChars,
+			reduceOutput
 		});
 		return contextMessages;
 	};
 }
-var CHARS_PER_TOKEN_ESTIMATE, CONTEXT_INPUT_HEADROOM_RATIO, SINGLE_TOOL_RESULT_CONTEXT_SHARE, TOOL_RESULT_CHARS_PER_TOKEN_ESTIMATE, IMAGE_CHAR_ESTIMATE, CONTEXT_LIMIT_TRUNCATION_NOTICE, CONTEXT_LIMIT_TRUNCATION_SUFFIX, PREEMPTIVE_TOOL_RESULT_COMPACTION_PLACEHOLDER;
+var CHARS_PER_TOKEN_ESTIMATE, CONTEXT_INPUT_HEADROOM_RATIO, SINGLE_TOOL_RESULT_CONTEXT_SHARE, TOOL_RESULT_CHARS_PER_TOKEN_ESTIMATE, IMAGE_CHAR_ESTIMATE, CONTEXT_LIMIT_TRUNCATION_NOTICE, CONTEXT_LIMIT_TRUNCATION_SUFFIX, PREEMPTIVE_TOOL_RESULT_COMPACTION_PLACEHOLDER, REDUCE_MAX_LINES, REDUCE_HEAD_LINES, REDUCE_TAIL_LINES;
 var init_tool_result_context_guard = __esmMin((() => {
+	init_tool_result_reduce();
 	CHARS_PER_TOKEN_ESTIMATE = 4;
 	CONTEXT_INPUT_HEADROOM_RATIO = .75;
 	SINGLE_TOOL_RESULT_CONTEXT_SHARE = .5;
@@ -98673,6 +99114,9 @@ var init_tool_result_context_guard = __esmMin((() => {
 	CONTEXT_LIMIT_TRUNCATION_NOTICE = "[truncated: output exceeded context limit]";
 	CONTEXT_LIMIT_TRUNCATION_SUFFIX = `\n${CONTEXT_LIMIT_TRUNCATION_NOTICE}`;
 	PREEMPTIVE_TOOL_RESULT_COMPACTION_PLACEHOLDER = "[compacted: tool output removed to free context]";
+	REDUCE_MAX_LINES = 200;
+	REDUCE_HEAD_LINES = 40;
+	REDUCE_TAIL_LINES = 40;
 }));
 //#endregion
 //#region src/agents/pi-embedded-runner/run/attempt-session.ts
@@ -98765,7 +99209,10 @@ async function createRunSession(params, env) {
 		applySystemPromptOverrideToSession(session, env.systemPromptText);
 		if (!session) throw new Error("Embedded agent session missing");
 		const activeSession = session;
-		const contextGuardTransform = createToolResultContextGuardTransform({ contextWindowTokens: Math.max(1, Math.floor(params.model.contextWindow ?? params.model.maxTokens ?? 2e5)) });
+		const contextGuardTransform = createToolResultContextGuardTransform({
+			contextWindowTokens: Math.max(1, Math.floor(params.model.contextWindow ?? params.model.maxTokens ?? 2e5)),
+			reduceOutput: params.config?.tools?.outputReduce?.enabled !== false
+		});
 		activeSession.agent.transformContext = contextGuardTransform;
 		const cacheTrace = createCacheTrace({
 			cfg: params.config,
@@ -103057,7 +103504,7 @@ var init_commands_allowlist = __esmMin((() => {
 	init_resolve_users();
 	init_config_writes();
 	init_pairing();
-	init_registry$4();
+	init_registry$5();
 	init_accounts$1();
 	init_accounts();
 	init_config$4();
@@ -104397,7 +104844,7 @@ var init_debug_commands = __esmMin((() => {
 var handleConfigCommand, handleDebugCommand;
 var init_commands_config = __esmMin((() => {
 	init_config_writes();
-	init_registry$4();
+	init_registry$5();
 	init_config_paths();
 	init_config$4();
 	init_runtime_overrides();
@@ -108578,7 +109025,7 @@ var init_reply_elevated = __esmMin((() => {
 	init_agent_scope();
 	init_dock();
 	init_plugins();
-	init_registry$4();
+	init_registry$5();
 	init_message_channel();
 	init_string_normalization();
 	init_elevated_unavailable();
@@ -110179,7 +110626,7 @@ var BUN_FETCH_SOCKET_ERROR_RE, isBunFetchSocketError, formatBunFetchSocketError,
 var init_agent_runner_utils = __esmMin((() => {
 	init_agent_scope();
 	init_dock();
-	init_registry$4();
+	init_registry$5();
 	init_sessions$1();
 	init_provider_utils();
 	init_usage_format();