@prismer/runtime 2.0.2 → 2.0.3

package/dist/cli.cjs

@@ -987,15 +987,30 @@ No @ needed; the human is the only other party.
             );
           }
           await stopStaleHermesGateways(profileName, portOverride, config.startupTimeoutMs);
+          const hermesProfileDir = getHermesProfileDir(profileName);
+          try {
+            (0, import_node_fs2.mkdirSync)(hermesProfileDir, { recursive: true });
+          } catch (err) {
+            process.stderr.write(
+              `[hermes-adapter] failed to ensure hermes profile dir ${hermesProfileDir}: ${err.message}
+`
+            );
+          }
           (0, import_node_child_process3.spawn)("hermes", ["-p", profileName, "gateway", "run"], {
             detached: false,
             stdio: "ignore",
+            cwd: hermesProfileDir,
             env: {
               ...process.env,
               API_SERVER_ENABLED: "true",
               API_SERVER_KEY: config.apiKey,
               API_SERVER_PORT: String(portOverride),
               API_SERVER_HOST: "127.0.0.1",
+              // TERMINAL_CWD is the env that hermes file_tools._resolve_path
+              // honors over `os.getcwd()` for relative paths. Pin it to the
+              // profile dir so even non-LLM-initiated writes (e.g. hermes
+              // internal book-keeping) land in the sandbox.
+              TERMINAL_CWD: hermesProfileDir,
               [config.prismerApiKeyEnv]: resolvePrismerApiKey(config)
             }
           });
@@ -1919,7 +1934,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@prismer/runtime",
-      version: "2.0.2",
+      version: "2.0.3",
       description: "Prismer Cloud daemon runtime \u2014 TS-only adapter host for hosted IM agents",
       type: "module",
       main: "dist/index.js",
@@ -6566,12 +6581,23 @@ async function handleDispatch(payload, requestId, deps) {
   let reply;
   const outboxBase = deps.paths?.runsDir ? path2.join(deps.paths.runsDir, taskId) : null;
   const outboxDir = outboxBase ? path2.join(outboxBase, "_outbox") : null;
+  const workDir = outboxBase ? path2.join(outboxBase, "workdir") : null;
   if (outboxDir) {
     try {
       await import_node_fs12.promises.mkdir(outboxDir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `[daemon] outbox provision failed task=${taskId} dir=${outboxDir}: ${err.message}
+`
+      );
+    }
+  }
+  if (workDir) {
+    try {
+      await import_node_fs12.promises.mkdir(workDir, { recursive: true });
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] workdir provision failed task=${taskId} dir=${workDir}: ${err.message}
 `
       );
     }
@@ -6654,7 +6680,8 @@ async function handleDispatch(payload, requestId, deps) {
         profile
       ),
       outboxDir,
-      profile.config
+      profile.config,
+      workDir
     );
     const cfg = profile.config;
     let profileSystemPrompt;
@@ -6676,12 +6703,16 @@ async function handleDispatch(payload, requestId, deps) {
         conversationId: payload.conversationId,
         prismerGoals: goalContext.map(toGoalMirrorPayload),
         ...composedSystemPrompt ? { systemPrompt: composedSystemPrompt } : {},
-        // Wave-9: spawn-style adapters (claude-code, codex, openclaw) read
-        // this and inject `PRISMER_OUTBOX_DIR=<abs>` into the child env so
-        // the LLM tool can resolve the path even if it doesn't read the
-        // prompt instruction. Long-running adapters (Hermes) ignore this
-        // and rely on the prompt-side instruction added above.
+        // Wave-9 / F18: spawn-style adapters (claude-code, codex, openclaw)
+        // read these and inject `PRISMER_OUTBOX_DIR` / `PRISMER_WORKDIR`
+        // into the child env so the LLM tool can resolve the paths even if
+        // it doesn't read the prompt instruction. Long-running adapters
+        // (Hermes) ignore these and rely on the prompt-side instruction
+        // added above — but Hermes is now cwd-sandboxed to its profile
+        // dir (~/.hermes/profiles/<name>/) so relative-path writes still
+        // stay out of the user's source tree.
         ...outboxDir ? { prismerOutboxDir: outboxDir } : {},
+        ...workDir ? { prismerWorkDir: workDir } : {},
         prismerObservability: {
           identity: {
             loaded: Boolean(profileSystemPrompt),
@@ -7085,18 +7116,43 @@ function stringifyPrinciples(value) {
   }
   return void 0;
 }
-function appendOutboxInstruction(prompt, outboxDir, profileConfig) {
+function appendOutboxInstruction(prompt, outboxDir, profileConfig, workDir = null) {
   if (!outboxDir) return prompt;
   if (profileConfig?.disableOutboxHints === true) return prompt;
-  const block = [
-    "[Output Files]",
-    "If you produce any files for the user (documents, images, code archives, reports, generated media):",
-    `  1. Write them to: ${outboxDir}`,
-    "  2. They will be uploaded automatically and shown to the user as chat attachments.",
-    "Use the directory path above verbatim. The same path is also exposed as the `PRISMER_OUTBOX_DIR` environment variable.",
+  const lines = [
+    "[File system rules \u2014 MANDATORY, server-enforced]",
+    "",
+    "You have TWO designated directories for this task. ALWAYS use absolute paths.",
+    "NEVER write files with relative paths \u2014 they resolve against the agent process",
+    "cwd which is sandboxed but unpredictable, and any path outside the two",
+    "directories below is treated as malformed.",
+    "",
+    `1. **Outbox (auto-uploaded as chat attachments)** \u2014 write deliverables here:`,
+    `     ${outboxDir}`,
+    "   Any file you place here will be uploaded and shown to the user as an",
+    "   attachment in your reply. Use this for the final artifacts the user",
+    "   actually wants (PNG charts, DOCX reports, CSV exports, archives).",
+    ""
+  ];
+  if (workDir) {
+    lines.push(
+      `2. **Workdir (scratch, NOT uploaded)** \u2014 write intermediate stuff here:`,
+      `     ${workDir}`,
+      "   Use for draft scripts, log files, intermediate CSVs, temp downloads \u2014",
+      "   anything the user doesn't need to see. These files are deleted later",
+      "   and never become chat attachments.",
+      ""
+    );
+  }
+  lines.push(
+    "If you produce a file but write it OUTSIDE both directories with a",
+    "relative path, it will NOT become a chat attachment and may pollute the",
+    "user's working directory. This is treated as a hard error.",
+    "",
+    "These paths are also exposed via env vars: PRISMER_OUTBOX_DIR" + (workDir ? " and PRISMER_WORKDIR" : "") + ".",
     ""
-  ].join("\n");
-  return `${block}
+  );
+  return `${lines.join("\n")}
 ${prompt}`;
 }
 function appendChannelContext(prompt, payload, profile) {
@@ -14937,7 +14993,7 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "2.0.2";
+var VERSION = "2.0.3";
 function buildProgram() {
   const program = new import_commander20.Command("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
   program.addCommand(buildBannerCommand());

package/dist/cli.js

@@ -965,15 +965,30 @@ No @ needed; the human is the only other party.
             );
           }
           await stopStaleHermesGateways(profileName, portOverride, config.startupTimeoutMs);
+          const hermesProfileDir = getHermesProfileDir(profileName);
+          try {
+            mkdirSync(hermesProfileDir, { recursive: true });
+          } catch (err) {
+            process.stderr.write(
+              `[hermes-adapter] failed to ensure hermes profile dir ${hermesProfileDir}: ${err.message}
+`
+            );
+          }
           spawn3("hermes", ["-p", profileName, "gateway", "run"], {
             detached: false,
             stdio: "ignore",
+            cwd: hermesProfileDir,
             env: {
               ...process.env,
               API_SERVER_ENABLED: "true",
               API_SERVER_KEY: config.apiKey,
               API_SERVER_PORT: String(portOverride),
               API_SERVER_HOST: "127.0.0.1",
+              // TERMINAL_CWD is the env that hermes file_tools._resolve_path
+              // honors over `os.getcwd()` for relative paths. Pin it to the
+              // profile dir so even non-LLM-initiated writes (e.g. hermes
+              // internal book-keeping) land in the sandbox.
+              TERMINAL_CWD: hermesProfileDir,
               [config.prismerApiKeyEnv]: resolvePrismerApiKey(config)
             }
           });
@@ -1896,7 +1911,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@prismer/runtime",
-      version: "2.0.2",
+      version: "2.0.3",
       description: "Prismer Cloud daemon runtime \u2014 TS-only adapter host for hosted IM agents",
       type: "module",
       main: "dist/index.js",
@@ -6550,12 +6565,23 @@ async function handleDispatch(payload, requestId, deps) {
   let reply;
   const outboxBase = deps.paths?.runsDir ? path2.join(deps.paths.runsDir, taskId) : null;
   const outboxDir = outboxBase ? path2.join(outboxBase, "_outbox") : null;
+  const workDir = outboxBase ? path2.join(outboxBase, "workdir") : null;
   if (outboxDir) {
     try {
       await fsp3.mkdir(outboxDir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `[daemon] outbox provision failed task=${taskId} dir=${outboxDir}: ${err.message}
+`
+      );
+    }
+  }
+  if (workDir) {
+    try {
+      await fsp3.mkdir(workDir, { recursive: true });
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] workdir provision failed task=${taskId} dir=${workDir}: ${err.message}
 `
       );
     }
@@ -6638,7 +6664,8 @@ async function handleDispatch(payload, requestId, deps) {
         profile
       ),
       outboxDir,
-      profile.config
+      profile.config,
+      workDir
     );
     const cfg = profile.config;
     let profileSystemPrompt;
@@ -6660,12 +6687,16 @@ async function handleDispatch(payload, requestId, deps) {
         conversationId: payload.conversationId,
         prismerGoals: goalContext.map(toGoalMirrorPayload),
         ...composedSystemPrompt ? { systemPrompt: composedSystemPrompt } : {},
-        // Wave-9: spawn-style adapters (claude-code, codex, openclaw) read
-        // this and inject `PRISMER_OUTBOX_DIR=<abs>` into the child env so
-        // the LLM tool can resolve the path even if it doesn't read the
-        // prompt instruction. Long-running adapters (Hermes) ignore this
-        // and rely on the prompt-side instruction added above.
+        // Wave-9 / F18: spawn-style adapters (claude-code, codex, openclaw)
+        // read these and inject `PRISMER_OUTBOX_DIR` / `PRISMER_WORKDIR`
+        // into the child env so the LLM tool can resolve the paths even if
+        // it doesn't read the prompt instruction. Long-running adapters
+        // (Hermes) ignore these and rely on the prompt-side instruction
+        // added above — but Hermes is now cwd-sandboxed to its profile
+        // dir (~/.hermes/profiles/<name>/) so relative-path writes still
+        // stay out of the user's source tree.
         ...outboxDir ? { prismerOutboxDir: outboxDir } : {},
+        ...workDir ? { prismerWorkDir: workDir } : {},
         prismerObservability: {
           identity: {
             loaded: Boolean(profileSystemPrompt),
@@ -7069,18 +7100,43 @@ function stringifyPrinciples(value) {
   }
   return void 0;
 }
-function appendOutboxInstruction(prompt, outboxDir, profileConfig) {
+function appendOutboxInstruction(prompt, outboxDir, profileConfig, workDir = null) {
   if (!outboxDir) return prompt;
   if (profileConfig?.disableOutboxHints === true) return prompt;
-  const block = [
-    "[Output Files]",
-    "If you produce any files for the user (documents, images, code archives, reports, generated media):",
-    `  1. Write them to: ${outboxDir}`,
-    "  2. They will be uploaded automatically and shown to the user as chat attachments.",
-    "Use the directory path above verbatim. The same path is also exposed as the `PRISMER_OUTBOX_DIR` environment variable.",
+  const lines = [
+    "[File system rules \u2014 MANDATORY, server-enforced]",
+    "",
+    "You have TWO designated directories for this task. ALWAYS use absolute paths.",
+    "NEVER write files with relative paths \u2014 they resolve against the agent process",
+    "cwd which is sandboxed but unpredictable, and any path outside the two",
+    "directories below is treated as malformed.",
+    "",
+    `1. **Outbox (auto-uploaded as chat attachments)** \u2014 write deliverables here:`,
+    `     ${outboxDir}`,
+    "   Any file you place here will be uploaded and shown to the user as an",
+    "   attachment in your reply. Use this for the final artifacts the user",
+    "   actually wants (PNG charts, DOCX reports, CSV exports, archives).",
+    ""
+  ];
+  if (workDir) {
+    lines.push(
+      `2. **Workdir (scratch, NOT uploaded)** \u2014 write intermediate stuff here:`,
+      `     ${workDir}`,
+      "   Use for draft scripts, log files, intermediate CSVs, temp downloads \u2014",
+      "   anything the user doesn't need to see. These files are deleted later",
+      "   and never become chat attachments.",
+      ""
+    );
+  }
+  lines.push(
+    "If you produce a file but write it OUTSIDE both directories with a",
+    "relative path, it will NOT become a chat attachment and may pollute the",
+    "user's working directory. This is treated as a hard error.",
+    "",
+    "These paths are also exposed via env vars: PRISMER_OUTBOX_DIR" + (workDir ? " and PRISMER_WORKDIR" : "") + ".",
     ""
-  ].join("\n");
-  return `${block}
+  );
+  return `${lines.join("\n")}
 ${prompt}`;
 }
 function appendChannelContext(prompt, payload, profile) {
@@ -14920,7 +14976,7 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "2.0.2";
+var VERSION = "2.0.3";
 function buildProgram() {
   const program = new Command20("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
   program.addCommand(buildBannerCommand());

package/dist/index.cjs

@@ -987,15 +987,30 @@ No @ needed; the human is the only other party.
             );
           }
           await stopStaleHermesGateways(profileName, portOverride, config.startupTimeoutMs);
+          const hermesProfileDir = getHermesProfileDir(profileName);
+          try {
+            (0, import_node_fs2.mkdirSync)(hermesProfileDir, { recursive: true });
+          } catch (err) {
+            process.stderr.write(
+              `[hermes-adapter] failed to ensure hermes profile dir ${hermesProfileDir}: ${err.message}
+`
+            );
+          }
           (0, import_node_child_process.spawn)("hermes", ["-p", profileName, "gateway", "run"], {
             detached: false,
             stdio: "ignore",
+            cwd: hermesProfileDir,
             env: {
               ...process.env,
               API_SERVER_ENABLED: "true",
               API_SERVER_KEY: config.apiKey,
               API_SERVER_PORT: String(portOverride),
               API_SERVER_HOST: "127.0.0.1",
+              // TERMINAL_CWD is the env that hermes file_tools._resolve_path
+              // honors over `os.getcwd()` for relative paths. Pin it to the
+              // profile dir so even non-LLM-initiated writes (e.g. hermes
+              // internal book-keeping) land in the sandbox.
+              TERMINAL_CWD: hermesProfileDir,
               [config.prismerApiKeyEnv]: resolvePrismerApiKey(config)
             }
           });
@@ -2280,7 +2295,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@prismer/runtime",
-      version: "2.0.2",
+      version: "2.0.3",
       description: "Prismer Cloud daemon runtime \u2014 TS-only adapter host for hosted IM agents",
       type: "module",
       main: "dist/index.js",
@@ -4256,12 +4271,23 @@ async function handleDispatch(payload, requestId, deps) {
   let reply;
   const outboxBase = deps.paths?.runsDir ? path.join(deps.paths.runsDir, taskId) : null;
   const outboxDir = outboxBase ? path.join(outboxBase, "_outbox") : null;
+  const workDir = outboxBase ? path.join(outboxBase, "workdir") : null;
   if (outboxDir) {
     try {
       await import_node_fs8.promises.mkdir(outboxDir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `[daemon] outbox provision failed task=${taskId} dir=${outboxDir}: ${err.message}
+`
+      );
+    }
+  }
+  if (workDir) {
+    try {
+      await import_node_fs8.promises.mkdir(workDir, { recursive: true });
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] workdir provision failed task=${taskId} dir=${workDir}: ${err.message}
 `
       );
     }
@@ -4344,7 +4370,8 @@ async function handleDispatch(payload, requestId, deps) {
         profile
       ),
       outboxDir,
-      profile.config
+      profile.config,
+      workDir
     );
     const cfg = profile.config;
     let profileSystemPrompt;
@@ -4366,12 +4393,16 @@ async function handleDispatch(payload, requestId, deps) {
         conversationId: payload.conversationId,
         prismerGoals: goalContext.map(toGoalMirrorPayload),
         ...composedSystemPrompt ? { systemPrompt: composedSystemPrompt } : {},
-        // Wave-9: spawn-style adapters (claude-code, codex, openclaw) read
-        // this and inject `PRISMER_OUTBOX_DIR=<abs>` into the child env so
-        // the LLM tool can resolve the path even if it doesn't read the
-        // prompt instruction. Long-running adapters (Hermes) ignore this
-        // and rely on the prompt-side instruction added above.
+        // Wave-9 / F18: spawn-style adapters (claude-code, codex, openclaw)
+        // read these and inject `PRISMER_OUTBOX_DIR` / `PRISMER_WORKDIR`
+        // into the child env so the LLM tool can resolve the paths even if
+        // it doesn't read the prompt instruction. Long-running adapters
+        // (Hermes) ignore these and rely on the prompt-side instruction
+        // added above — but Hermes is now cwd-sandboxed to its profile
+        // dir (~/.hermes/profiles/<name>/) so relative-path writes still
+        // stay out of the user's source tree.
         ...outboxDir ? { prismerOutboxDir: outboxDir } : {},
+        ...workDir ? { prismerWorkDir: workDir } : {},
         prismerObservability: {
           identity: {
             loaded: Boolean(profileSystemPrompt),
@@ -4775,18 +4806,43 @@ function stringifyPrinciples(value) {
   }
   return void 0;
 }
-function appendOutboxInstruction(prompt, outboxDir, profileConfig) {
+function appendOutboxInstruction(prompt, outboxDir, profileConfig, workDir = null) {
   if (!outboxDir) return prompt;
   if (profileConfig?.disableOutboxHints === true) return prompt;
-  const block = [
-    "[Output Files]",
-    "If you produce any files for the user (documents, images, code archives, reports, generated media):",
-    `  1. Write them to: ${outboxDir}`,
-    "  2. They will be uploaded automatically and shown to the user as chat attachments.",
-    "Use the directory path above verbatim. The same path is also exposed as the `PRISMER_OUTBOX_DIR` environment variable.",
+  const lines = [
+    "[File system rules \u2014 MANDATORY, server-enforced]",
+    "",
+    "You have TWO designated directories for this task. ALWAYS use absolute paths.",
+    "NEVER write files with relative paths \u2014 they resolve against the agent process",
+    "cwd which is sandboxed but unpredictable, and any path outside the two",
+    "directories below is treated as malformed.",
+    "",
+    `1. **Outbox (auto-uploaded as chat attachments)** \u2014 write deliverables here:`,
+    `     ${outboxDir}`,
+    "   Any file you place here will be uploaded and shown to the user as an",
+    "   attachment in your reply. Use this for the final artifacts the user",
+    "   actually wants (PNG charts, DOCX reports, CSV exports, archives).",
+    ""
+  ];
+  if (workDir) {
+    lines.push(
+      `2. **Workdir (scratch, NOT uploaded)** \u2014 write intermediate stuff here:`,
+      `     ${workDir}`,
+      "   Use for draft scripts, log files, intermediate CSVs, temp downloads \u2014",
+      "   anything the user doesn't need to see. These files are deleted later",
+      "   and never become chat attachments.",
+      ""
+    );
+  }
+  lines.push(
+    "If you produce a file but write it OUTSIDE both directories with a",
+    "relative path, it will NOT become a chat attachment and may pollute the",
+    "user's working directory. This is treated as a hard error.",
+    "",
+    "These paths are also exposed via env vars: PRISMER_OUTBOX_DIR" + (workDir ? " and PRISMER_WORKDIR" : "") + ".",
     ""
-  ].join("\n");
-  return `${block}
+  );
+  return `${lines.join("\n")}
 ${prompt}`;
 }
 function appendChannelContext(prompt, payload, profile) {
@@ -15110,7 +15166,7 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "2.0.2";
+var VERSION = "2.0.3";
 function buildProgram() {
   const program = new import_commander20.Command("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
   program.addCommand(buildBannerCommand());

package/dist/index.d.cts

@@ -2269,8 +2269,8 @@ declare const CodexConfigSchema: z.ZodObject<{
     apiKeyEnv: z.ZodDefault<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     model: string;
-    sandbox: "read-only" | "workspace-write" | "danger-full-access";
     cwd: string;
+    sandbox: "read-only" | "workspace-write" | "danger-full-access";
     apiKeyEnv: string;
     systemPrompt?: string | undefined;
     envVars?: Record<string, string> | undefined;

package/dist/index.d.ts

@@ -2269,8 +2269,8 @@ declare const CodexConfigSchema: z.ZodObject<{
     apiKeyEnv: z.ZodDefault<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     model: string;
-    sandbox: "read-only" | "workspace-write" | "danger-full-access";
     cwd: string;
+    sandbox: "read-only" | "workspace-write" | "danger-full-access";
     apiKeyEnv: string;
     systemPrompt?: string | undefined;
     envVars?: Record<string, string> | undefined;

package/dist/index.js

@@ -964,15 +964,30 @@ No @ needed; the human is the only other party.
             );
           }
           await stopStaleHermesGateways(profileName, portOverride, config.startupTimeoutMs);
+          const hermesProfileDir = getHermesProfileDir(profileName);
+          try {
+            mkdirSync(hermesProfileDir, { recursive: true });
+          } catch (err) {
+            process.stderr.write(
+              `[hermes-adapter] failed to ensure hermes profile dir ${hermesProfileDir}: ${err.message}
+`
+            );
+          }
           spawn("hermes", ["-p", profileName, "gateway", "run"], {
             detached: false,
             stdio: "ignore",
+            cwd: hermesProfileDir,
             env: {
               ...process.env,
               API_SERVER_ENABLED: "true",
               API_SERVER_KEY: config.apiKey,
               API_SERVER_PORT: String(portOverride),
               API_SERVER_HOST: "127.0.0.1",
+              // TERMINAL_CWD is the env that hermes file_tools._resolve_path
+              // honors over `os.getcwd()` for relative paths. Pin it to the
+              // profile dir so even non-LLM-initiated writes (e.g. hermes
+              // internal book-keeping) land in the sandbox.
+              TERMINAL_CWD: hermesProfileDir,
               [config.prismerApiKeyEnv]: resolvePrismerApiKey(config)
             }
           });
@@ -2256,7 +2271,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@prismer/runtime",
-      version: "2.0.2",
+      version: "2.0.3",
       description: "Prismer Cloud daemon runtime \u2014 TS-only adapter host for hosted IM agents",
       type: "module",
       main: "dist/index.js",
@@ -4182,12 +4197,23 @@ async function handleDispatch(payload, requestId, deps) {
   let reply;
   const outboxBase = deps.paths?.runsDir ? path.join(deps.paths.runsDir, taskId) : null;
   const outboxDir = outboxBase ? path.join(outboxBase, "_outbox") : null;
+  const workDir = outboxBase ? path.join(outboxBase, "workdir") : null;
   if (outboxDir) {
     try {
       await fsp3.mkdir(outboxDir, { recursive: true });
     } catch (err) {
       process.stderr.write(
         `[daemon] outbox provision failed task=${taskId} dir=${outboxDir}: ${err.message}
+`
+      );
+    }
+  }
+  if (workDir) {
+    try {
+      await fsp3.mkdir(workDir, { recursive: true });
+    } catch (err) {
+      process.stderr.write(
+        `[daemon] workdir provision failed task=${taskId} dir=${workDir}: ${err.message}
 `
       );
     }
@@ -4270,7 +4296,8 @@ async function handleDispatch(payload, requestId, deps) {
         profile
       ),
       outboxDir,
-      profile.config
+      profile.config,
+      workDir
     );
     const cfg = profile.config;
     let profileSystemPrompt;
@@ -4292,12 +4319,16 @@ async function handleDispatch(payload, requestId, deps) {
         conversationId: payload.conversationId,
         prismerGoals: goalContext.map(toGoalMirrorPayload),
         ...composedSystemPrompt ? { systemPrompt: composedSystemPrompt } : {},
-        // Wave-9: spawn-style adapters (claude-code, codex, openclaw) read
-        // this and inject `PRISMER_OUTBOX_DIR=<abs>` into the child env so
-        // the LLM tool can resolve the path even if it doesn't read the
-        // prompt instruction. Long-running adapters (Hermes) ignore this
-        // and rely on the prompt-side instruction added above.
+        // Wave-9 / F18: spawn-style adapters (claude-code, codex, openclaw)
+        // read these and inject `PRISMER_OUTBOX_DIR` / `PRISMER_WORKDIR`
+        // into the child env so the LLM tool can resolve the paths even if
+        // it doesn't read the prompt instruction. Long-running adapters
+        // (Hermes) ignore these and rely on the prompt-side instruction
+        // added above — but Hermes is now cwd-sandboxed to its profile
+        // dir (~/.hermes/profiles/<name>/) so relative-path writes still
+        // stay out of the user's source tree.
         ...outboxDir ? { prismerOutboxDir: outboxDir } : {},
+        ...workDir ? { prismerWorkDir: workDir } : {},
         prismerObservability: {
           identity: {
             loaded: Boolean(profileSystemPrompt),
@@ -4701,18 +4732,43 @@ function stringifyPrinciples(value) {
   }
   return void 0;
 }
-function appendOutboxInstruction(prompt, outboxDir, profileConfig) {
+function appendOutboxInstruction(prompt, outboxDir, profileConfig, workDir = null) {
   if (!outboxDir) return prompt;
   if (profileConfig?.disableOutboxHints === true) return prompt;
-  const block = [
-    "[Output Files]",
-    "If you produce any files for the user (documents, images, code archives, reports, generated media):",
-    `  1. Write them to: ${outboxDir}`,
-    "  2. They will be uploaded automatically and shown to the user as chat attachments.",
-    "Use the directory path above verbatim. The same path is also exposed as the `PRISMER_OUTBOX_DIR` environment variable.",
+  const lines = [
+    "[File system rules \u2014 MANDATORY, server-enforced]",
+    "",
+    "You have TWO designated directories for this task. ALWAYS use absolute paths.",
+    "NEVER write files with relative paths \u2014 they resolve against the agent process",
+    "cwd which is sandboxed but unpredictable, and any path outside the two",
+    "directories below is treated as malformed.",
+    "",
+    `1. **Outbox (auto-uploaded as chat attachments)** \u2014 write deliverables here:`,
+    `     ${outboxDir}`,
+    "   Any file you place here will be uploaded and shown to the user as an",
+    "   attachment in your reply. Use this for the final artifacts the user",
+    "   actually wants (PNG charts, DOCX reports, CSV exports, archives).",
+    ""
+  ];
+  if (workDir) {
+    lines.push(
+      `2. **Workdir (scratch, NOT uploaded)** \u2014 write intermediate stuff here:`,
+      `     ${workDir}`,
+      "   Use for draft scripts, log files, intermediate CSVs, temp downloads \u2014",
+      "   anything the user doesn't need to see. These files are deleted later",
+      "   and never become chat attachments.",
+      ""
+    );
+  }
+  lines.push(
+    "If you produce a file but write it OUTSIDE both directories with a",
+    "relative path, it will NOT become a chat attachment and may pollute the",
+    "user's working directory. This is treated as a hard error.",
+    "",
+    "These paths are also exposed via env vars: PRISMER_OUTBOX_DIR" + (workDir ? " and PRISMER_WORKDIR" : "") + ".",
     ""
-  ].join("\n");
-  return `${block}
+  );
+  return `${lines.join("\n")}
 ${prompt}`;
 }
 function appendChannelContext(prompt, payload, profile) {
@@ -15042,7 +15098,7 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "2.0.2";
+var VERSION = "2.0.3";
 function buildProgram() {
   const program = new Command20("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
   program.addCommand(buildBannerCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prismer/runtime",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Prismer Cloud daemon runtime — TS-only adapter host for hosted IM agents",
   "type": "module",
   "main": "dist/index.js",