@provos/ironcurtain 0.9.1 → 0.11.0

package/dist/session/index.js

@@ -7,34 +7,24 @@
  */
 import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { loadConfig } from '../config/index.js';
-import { getIronCurtainHome, getPackageConfigDir, getSessionDir, getSessionSandboxDir, getSessionEscalationDir, getSessionAuditLogPath, getSessionLogPath, getSessionLlmLogPath, getSessionAutoApproveLlmLogPath, } from '../config/paths.js';
+import { loadConfig, applyAllowedDirectoryToMcpArgs, loadGeneratedPolicy, getPackageGeneratedDir, } from '../config/index.js';
+import { extractRequiredServers } from '../trusted-process/policy-roots.js';
+import { getSessionDir, getSessionSandboxDir, getSessionEscalationDir, getSessionAuditLogPath, getSessionLogPath, getSessionLlmLogPath, getSessionAutoApproveLlmLogPath, SESSION_LOG_FILENAME, SESSION_METADATA_FILENAME, } from '../config/paths.js';
+import { validatePolicyDir as sharedValidatePolicyDir } from '../config/validate-policy-dir.js';
 import * as logger from '../logger.js';
-import { resolveRealPath } from '../types/argument-roles.js';
-import { resolvePersona, applyServerAllowlist } from '../persona/resolve.js';
+import { resolvePersona, applyServerAllowlist, filterMcpServersByPolicy } from '../persona/resolve.js';
+import { resolveSkillsForSession } from '../skills/discovery.js';
 import { buildPersonaSystemPromptAugmentation } from '../persona/persona-prompt.js';
 import { resolveMemoryDbPath } from '../memory/resolve-memory-path.js';
 import { buildMemoryServerConfig, MEMORY_SERVER_NAME } from '../memory/memory-annotations.js';
 import { buildMemorySystemPrompt, adaptMemoryToolNames } from '../memory/memory-prompt.js';
+import { isMemoryEnabledFor } from '../memory/memory-policy.js';
+import { createJobId } from '../cron/types.js';
+import { loadJob } from '../cron/job-store.js';
 import { AgentSession } from './agent-session.js';
-import { SessionError } from './errors.js';
-import { saveSessionMetadata, loadSessionMetadata } from './session-metadata.js';
-import { isEqualOrInside } from './workspace-validation.js';
-import { createSessionId } from './types.js';
-/**
- * Creates and initializes a new session.
- *
- * This is the only public entry point for session creation.
- * The concrete implementations are not exported -- callers
- * depend on the Session interface only.
- *
- * When mode is 'docker', spawns an external agent in a Docker
- * container with MCP proxy mediation. Otherwise (default), creates
- * the built-in AgentSession using UTCP Code Mode + AI SDK.
- *
- * @throws {SessionError} with code SESSION_INIT_FAILED if
- *   sandbox or MCP connection setup fails.
- */
+import { SessionError } from '../types/errors.js';
+import { saveSessionMetadata, saveSessionMetadataTo, loadSessionMetadata } from './session-metadata.js';
+import { bundleIdFromSessionId, createAgentConversationId, createSessionId } from './types.js';
 export async function createSession(options = {}) {
     // When resuming, restore persisted session settings (persona, workspace, etc.)
     const effectiveOptions = applyResumeMetadata(options);
@@ -44,6 +34,39 @@ export async function createSession(options = {}) {
     }
     return createBuiltinSession(effectiveOptions);
 }
+/**
+ * Entry point for callers outside the workflow orchestrator — CLI,
+ * daemon, signal bot, web UI. For Docker mode: resumes the persisted
+ * `AgentConversationId` when `resumeSessionId` is set (so
+ * `ironcurtain --resume <id>` continues the prior Claude conversation
+ * via `--resume <conv-id>` on the adapter), otherwise mints fresh.
+ * Builtin mode ignores the field.
+ *
+ * Legacy-session fallback: sessions created before
+ * `agentConversationId` was persisted in metadata will have no stored
+ * id. Those resumes mint fresh, and the agent CLI starts a new
+ * conversation — the prior transcript is unreachable but nothing is
+ * corrupted. New sessions created post-refactor always persist the id,
+ * so subsequent resumes recover the conversation.
+ *
+ * Workflow callers must not use this: they must thread
+ * `agentConversationId` from `context.agentConversationsByState` via
+ * `createSession()` directly so `freshSession: false` states resume
+ * the prior conversation.
+ */
+export async function createStandaloneSession(options) {
+    if (options.mode?.kind === 'docker') {
+        const persistedId = options.resumeSessionId
+            ? loadSessionMetadata(options.resumeSessionId)?.agentConversationId
+            : undefined;
+        return createSession({
+            ...options,
+            mode: options.mode,
+            agentConversationId: persistedId ?? createAgentConversationId(),
+        });
+    }
+    return createSession({ ...options, mode: options.mode });
+}
 /**
  * Merges persisted session metadata into options when resuming.
  * Returns options unchanged for new sessions or when no metadata exists
@@ -63,6 +86,14 @@ function applyResumeMetadata(options) {
         ...(metadata.workspacePath !== undefined ? { workspacePath: metadata.workspacePath } : {}),
         ...(metadata.policyDir !== undefined ? { policyDir: metadata.policyDir } : {}),
         ...(metadata.disableAutoApprove !== undefined ? { disableAutoApprove: metadata.disableAutoApprove } : {}),
+        // Caller-supplied `agentConversationId` wins over the persisted
+        // one (workflow orchestrator always passes its own explicitly).
+        // Only the CLI / daemon `createStandaloneSession` path leaves the
+        // field unset, and that's exactly the path we want to restore from
+        // metadata so `--resume` continues the prior Claude conversation.
+        ...(options.agentConversationId === undefined && metadata.agentConversationId !== undefined
+            ? { agentConversationId: metadata.agentConversationId }
+            : {}),
     };
 }
 /**
@@ -92,7 +123,8 @@ async function createBuiltinSession(options) {
         await session.initialize();
     }
     catch (error) {
-        // Clean up on init failure
+        // Clean up on init failure. Teardown logger so error messages from
+        // callers (orchestrator, XState) go to the terminal, not the log file.
         await session.close().catch(() => { });
         if (!loggerWasActive)
             logger.teardown();
@@ -103,96 +135,178 @@ async function createBuiltinSession(options) {
 /**
  * Creates a DockerAgentSession that runs an external agent in a container.
  *
- * Uses prepareDockerInfrastructure() for shared Docker setup (proxies,
- * orientation, image resolution), then creates the session with pre-built
- * infrastructure so initialize() only does container creation + watchers.
+ * Two paths:
+ * - Standalone (default): calls `createDockerInfrastructure()` to stand up
+ *   the full infrastructure bundle (proxies, orientation, image, running
+ *   agent container, sidecar and internal network for TCP mode). The
+ *   session is constructed with `ownsInfra=true`, so `close()` tears down
+ *   the bundle.
+ * - Borrow (`options.workflow.infrastructure` set): uses the caller-supplied
+ *   bundle as-is and constructs the session with `ownsInfra=false`. The
+ *   caller retains full responsibility for the bundle's lifetime; the
+ *   session's `close()` only tears down session-local state.
+ *
+ * In both paths the session wires up escalation watcher and audit tailer
+ * and writes any per-session files (CLAUDE.md, effective system prompt)
+ * using fields on the bundle.
  */
 async function createDockerSession(agentId, options) {
     const config = options.config ?? loadConfig();
     const sessionId = createSessionId();
     const effectiveSessionId = options.resumeSessionId ?? sessionId;
+    // Agent-CLI conversation id must be minted by the caller. Docker-mode
+    // callers pass `DockerSessionOptions`, which makes this field required
+    // at the type level. The runtime guard catches callers that widen to
+    // the base `SessionOptions` type and forget to supply it — the factory
+    // will not mint on their behalf because the single-conversation model
+    // makes the minting site load-bearing (workflow orchestrator reuses
+    // per state; each CLI run mints fresh). See §11 step 4 and §3
+    // "Identity flow" in docs/designs/workflow-session-identity.md.
+    if (!options.agentConversationId) {
+        throw new SessionError('agentConversationId is required for Docker sessions: mint via createAgentConversationId() at the call site', 'SESSION_INIT_FAILED');
+    }
+    const agentConversationId = options.agentConversationId;
     const loggerWasActive = logger.isActive();
     const sessionConfig = buildSessionConfig(config, effectiveSessionId, sessionId, options);
-    const { prepareDockerInfrastructure } = await import('../docker/docker-infrastructure.js');
-    const { DockerAgentSession } = await import('../docker/docker-agent-session.js');
-    const { buildDockerClaudeMd } = await import('../docker/claude-md-seed.js');
-    const claudeMdContent = buildDockerClaudeMd({
-        personaName: options.persona,
-        memoryEnabled: config.userConfig.memory.enabled,
-    });
-    const infra = await prepareDockerInfrastructure(sessionConfig.config, { kind: 'docker', agent: agentId }, sessionConfig.sessionDir, sessionConfig.sandboxDir, sessionConfig.escalationDir, sessionConfig.auditLogPath, sessionId);
-    // Write CLAUDE.md into conversation state dir (unconditionally, even on
-    // resume, since persona/memory config may change between sessions).
-    // Clean up stale CLAUDE.md when memory is disabled to avoid leftover rules.
-    if (infra.conversationStateDir) {
-        const claudeMdPath = resolve(infra.conversationStateDir, 'CLAUDE.md');
-        if (claudeMdContent) {
-            writeFileSync(claudeMdPath, claudeMdContent);
+    // Wrap the entire infrastructure + init sequence so that logger.teardown()
+    // runs on ANY failure, not just session.initialize() failures.
+    // buildSessionConfig() calls logger.setup() which hijacks console globally;
+    // if we don't teardown on error, all subsequent console output (including
+    // error messages from the orchestrator and XState) silently goes to a log
+    // file instead of the terminal.
+    let session;
+    // Track the infra bundle in outer scope so the catch path can clean
+    // up containers/proxies even if failure happens BEFORE the session
+    // instance exists (e.g., writeFileSync for CLAUDE.md throws, or the
+    // DockerAgentSession constructor throws). Without this, the session
+    // is undefined and `session?.close()` is a no-op — the container,
+    // sidecar, network, and proxies all leak.
+    let infra;
+    // Tracks whether THIS factory allocated the infra bundle. When true and
+    // the session never reaches a constructed state, the catch path tears
+    // down the bundle directly. When false (borrow path), the caller owns
+    // the bundle and the factory must NEVER destroy it, even on error.
+    let builtInfra = false;
+    try {
+        const { DockerAgentSession } = await import('../docker/docker-agent-session.js');
+        const { buildDockerClaudeMd } = await import('../docker/claude-md-seed.js');
+        if (options.workflow?.infrastructure) {
+            // Borrow path: the orchestrator owns the bundle's lifetime. We do
+            // not call createDockerInfrastructure(); we do not destroy on close.
+            // The orchestrator is also responsible for `setTokenSessionId`: it
+            // flips the MITM proxy's routing target to the active agent's session
+            // ID before each run and clears it on session end.
+            infra = options.workflow.infrastructure;
         }
         else {
-            try {
-                unlinkSync(claudeMdPath);
+            // Standalone path: factory creates and owns the bundle.
+            // Single-session invariant (§2.1 of workflow-session-identity): the
+            // SessionId value doubles as the BundleId. The helper preserves
+            // the deterministic `ironcurtain-<sessionId[0:12]>` container
+            // name for prior-crash recovery.
+            const bundleId = bundleIdFromSessionId(sessionId);
+            const { createDockerInfrastructure } = await import('../docker/docker-infrastructure.js');
+            infra = await createDockerInfrastructure(sessionConfig.config, { kind: 'docker', agent: agentId }, sessionConfig.sessionDir, sessionConfig.sandboxDir, sessionConfig.escalationDir, bundleId, undefined, undefined, sessionConfig.resolvedSkills);
+            // Standalone sessions use their bundle for the session's entire
+            // lifetime; pin the token-stream routing ID to this session's ID.
+            // Clearing on close is unnecessary because the bundle itself is
+            // destroyed by `session.close()` (ownsInfra=true).
+            infra.setTokenSessionId(sessionId);
+            builtInfra = true;
+        }
+        const claudeMdContent = buildDockerClaudeMd({
+            personaName: options.persona,
+            memoryEnabled: sessionConfig.memoryEnabled,
+        });
+        // Write CLAUDE.md into conversation state dir (unconditionally, even on
+        // resume, since persona/memory config may change between sessions).
+        // Clean up stale CLAUDE.md when memory is disabled to avoid leftover rules.
+        if (infra.conversationStateDir) {
+            const claudeMdPath = resolve(infra.conversationStateDir, 'CLAUDE.md');
+            if (claudeMdContent) {
+                writeFileSync(claudeMdPath, claudeMdContent);
             }
-            catch {
-                /* not present */
+            else {
+                try {
+                    unlinkSync(claudeMdPath);
+                }
+                catch {
+                    /* not present */
+                }
             }
         }
-    }
-    const session = new DockerAgentSession({
-        config: sessionConfig.config,
-        sessionId,
-        adapter: infra.adapter,
-        docker: infra.docker,
-        proxy: infra.proxy,
-        mitmProxy: infra.mitmProxy,
-        ca: infra.ca,
-        fakeKeys: infra.fakeKeys,
-        sessionDir: sessionConfig.sessionDir,
-        sandboxDir: sessionConfig.sandboxDir,
-        escalationDir: sessionConfig.escalationDir,
-        auditLogPath: sessionConfig.auditLogPath,
-        useTcp: infra.useTcp,
-        onEscalation: options.onEscalation,
-        onEscalationExpired: options.onEscalationExpired,
-        onEscalationResolved: options.onEscalationResolved,
-        onDiagnostic: options.onDiagnostic,
-        preBuiltInfrastructure: {
-            systemPrompt: sessionConfig.systemPromptAugmentation
-                ? `${infra.systemPrompt}\n\n${sessionConfig.systemPromptAugmentation}`
-                : infra.systemPrompt,
-            image: infra.image,
-            mitmAddr: infra.mitmAddr,
-        },
-    });
-    try {
+        const systemPromptOverride = sessionConfig.systemPromptAugmentation
+            ? `${infra.systemPrompt}\n\n${sessionConfig.systemPromptAugmentation}`
+            : undefined;
+        session = new DockerAgentSession({
+            config: sessionConfig.config,
+            sessionId,
+            agentConversationId,
+            infra,
+            // Ownership mirrors who allocated the bundle: standalone path owns
+            // and tears down on close; borrow path leaves the bundle alive for
+            // the external orchestrator.
+            ownsInfra: builtInfra,
+            agentModelOverride: options.agentModelOverride,
+            onEscalation: options.onEscalation,
+            onEscalationExpired: options.onEscalationExpired,
+            onEscalationResolved: options.onEscalationResolved,
+            onDiagnostic: options.onDiagnostic,
+            systemPromptOverride,
+        });
         await session.initialize();
+        return session;
     }
     catch (error) {
-        await session.close().catch(() => { });
+        // If the session was constructed, its close() respects the ownsInfra
+        // flag we passed in: standalone sessions (ownsInfra=true) destroy the
+        // bundle they own; borrow-mode sessions (ownsInfra=false) leave the
+        // caller's bundle intact. We need only invoke close() -- no
+        // conditional cleanup here.
+        //
+        // Otherwise, if we allocated the bundle ourselves but failed before
+        // the session was constructed (e.g., the DockerAgentSession
+        // constructor threw, or the CLAUDE.md write threw), destroy it
+        // directly. NEVER destroy a caller-supplied bundle on this branch --
+        // `builtInfra` is false in borrow mode, so the guard below skips it.
+        if (session) {
+            await session.close().catch(() => { });
+        }
+        else if (builtInfra && infra) {
+            const { destroyDockerInfrastructure } = await import('../docker/docker-infrastructure.js');
+            await destroyDockerInfrastructure(infra).catch(() => { });
+        }
         if (!loggerWasActive)
             logger.teardown();
-        throw new SessionError(`Docker session initialization failed: ${error instanceof Error ? error.message : String(error)}`, 'SESSION_INIT_FAILED');
+        throw error instanceof SessionError
+            ? error
+            : new SessionError(`Docker session failed: ${error instanceof Error ? error.message : String(error)}`, 'SESSION_INIT_FAILED');
     }
-    return session;
 }
 /**
  * Validates that a policyDir path resolves to a location under the
  * IronCurtain home directory or the package config directory. Prevents
  * loading attacker-controlled policy files from arbitrary filesystem locations.
  *
- * The package config directory is allowed so that built-in policy variants
- * (e.g., the read-only policy for constitution generation) can be loaded
- * without copying files into the user home.
+ * Thin wrapper around the shared validator in `config/validate-policy-dir.ts`
+ * so failures surface as `SessionError` with our standard code — the
+ * shared helper throws `PolicyDirValidationError`, which other callers
+ * (e.g., the coordinator's `loadPolicy` RPC) surface in their own way.
+ *
+ * Returns the realpath-canonicalized path. Callers must use the return
+ * value for all subsequent reads: feeding the original (possibly-symlinked)
+ * path to downstream artifact loaders would reopen the symlink-swap TOCTOU
+ * window the validator was introduced to close.
  *
  * @throws {SessionError} if the path escapes all trusted directories.
  */
 function validatePolicyDir(policyDir) {
-    const resolvedPolicy = resolveRealPath(policyDir);
-    const trustedDirs = [getIronCurtainHome(), getPackageConfigDir()].map(resolveRealPath);
-    if (!trustedDirs.some((dir) => isEqualOrInside(resolvedPolicy, dir))) {
-        throw new SessionError(`policyDir must be under a trusted directory. ` +
-            `Received: ${resolvedPolicy}; ` +
-            `trusted: ${trustedDirs.join(', ')}`, 'SESSION_INIT_FAILED');
+    try {
+        return sharedValidatePolicyDir(policyDir);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new SessionError(message, 'SESSION_INIT_FAILED');
     }
 }
 /**
@@ -211,10 +325,24 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
     let { workspacePath, policyDir, systemPromptAugmentation } = opts;
     const { resumeSessionId, disableAutoApprove } = opts;
     let serverAllowlist;
-    // Resolve persona early -- derives policyDir, workspace, server filter,
-    // and system prompt augmentation from the persona definition.
+    let personaDef = undefined;
+    // Borrow-mode invariant: per-state artifact dir / slug only make sense
+    // alongside an infrastructure bundle. The nested record keeps these
+    // fields colocated; the runtime guard catches the all-or-nothing
+    // mismatch (the union of the two-bit input domain isn't expressible
+    // at the type level without a discriminator on the workflow record).
+    if (opts.workflow?.stateDir && !opts.workflow.infrastructure) {
+        throw new SessionError('workflow.stateDir requires workflow.infrastructure; borrow-mode artifacts have no owner without a bundle', 'SESSION_INIT_FAILED');
+    }
+    // Resolve persona early -- derives policyDir, workspace, and server
+    // filter from the persona definition. The persona system prompt
+    // augmentation is deferred until after the memory gate is computed
+    // with the full (persona + job) scope, so the augmentation and the
+    // server bolt-on cannot disagree when both opts.persona and opts.jobId
+    // are set.
     if (opts.persona) {
         const resolved = resolvePersona(opts.persona);
+        personaDef = resolved.persona;
         if (policyDir) {
             logger.warn('Both persona and policyDir specified; using persona.');
         }
@@ -224,35 +352,70 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
         if (!workspacePath) {
             workspacePath = resolved.workspacePath;
         }
-        // Build persona system prompt augmentation (includes MCP memory prompt when enabled).
-        const memoryEnabled = config.userConfig.memory.enabled;
-        const personaAugmentation = buildPersonaSystemPromptAugmentation(resolved.persona, memoryEnabled);
+        logger.info(`Persona "${opts.persona}" resolved: policyDir=${policyDir}`);
+    }
+    // Single gate computation with the full scope. Reused for the persona
+    // augmentation, the cron-job memory prompt, and the server bolt-on so
+    // the prompt cannot mention memory while the relay is gated off (or
+    // vice versa). Skip the loadJob disk read when the global kill switch
+    // would short-circuit anyway.
+    const memoryConfig = config.userConfig.memory;
+    const jobDef = memoryConfig.enabled && opts.jobId ? loadJob(createJobId(opts.jobId)) : undefined;
+    const memoryEnabled = isMemoryEnabledFor({
+        persona: personaDef,
+        job: jobDef,
+        userConfig: config.userConfig,
+    });
+    if (personaDef) {
+        const personaAugmentation = buildPersonaSystemPromptAugmentation(personaDef, memoryEnabled);
         systemPromptAugmentation = systemPromptAugmentation
             ? `${personaAugmentation}\n\n${systemPromptAugmentation}`
             : personaAugmentation;
-        logger.info(`Persona "${opts.persona}" resolved: policyDir=${policyDir}`);
     }
     if (policyDir) {
-        validatePolicyDir(policyDir);
+        // Use the validator's realpath-canonicalized return value. Passing
+        // the original (possibly-symlinked) path through to `generatedDir`
+        // would reopen the symlink-swap TOCTOU window the validator was
+        // introduced to close: downstream artifact reads (compiled policy,
+        // dynamic lists) must happen against the same canonical path the
+        // containment check approved.
+        policyDir = validatePolicyDir(policyDir);
     }
-    const sessionDir = getSessionDir(effectiveSessionId);
+    // Paths differ by mode:
+    // - Borrow mode: per-state artifacts go under `workflow.stateDir` when
+    //   the orchestrator supplied one; otherwise fall back to the bundle's
+    //   bundleDir (legacy path, still used by factory-level tests). The
+    //   bundle owns workspace/escalation/audit on `workflow.infrastructure`.
+    // - Standalone/CLI: everything lives under `{home}/sessions/{id}/`.
+    const borrowInfra = opts.workflow?.infrastructure;
+    const artifactDir = borrowInfra ? (opts.workflow.stateDir ?? borrowInfra.bundleDir) : undefined;
+    const sessionDir = artifactDir ?? getSessionDir(effectiveSessionId);
     const sandboxDir = workspacePath ?? getSessionSandboxDir(effectiveSessionId);
-    const escalationDir = getSessionEscalationDir(effectiveSessionId);
-    const auditLogPath = getSessionAuditLogPath(effectiveSessionId);
-    // Create the directory when not using an explicit --workspace flag.
-    // When persona is set, `workspacePath` was derived internally (not
-    // from the caller), so we still need to ensure it exists.
-    // Only skip creation for explicit user-provided workspace paths.
-    if (!opts.workspacePath) {
-        mkdirSync(sandboxDir, { recursive: true });
+    const escalationDir = borrowInfra ? borrowInfra.escalationDir : getSessionEscalationDir(effectiveSessionId);
+    const auditLogPath = borrowInfra ? borrowInfra.auditLogPath : getSessionAuditLogPath(effectiveSessionId);
+    // Standalone mode creates its own session tree. Borrow mode relies on
+    // directories the orchestrator and bundle already own.
+    if (!borrowInfra) {
+        if (!opts.workspacePath) {
+            mkdirSync(sandboxDir, { recursive: true });
+        }
+        mkdirSync(escalationDir, { recursive: true });
     }
-    mkdirSync(escalationDir, { recursive: true });
-    const sessionLogPath = getSessionLogPath(effectiveSessionId);
+    const sessionLogPath = artifactDir
+        ? resolve(artifactDir, SESSION_LOG_FILENAME)
+        : getSessionLogPath(effectiveSessionId);
+    // llm-interactions / auto-approve-llm still live under the standalone
+    // session dir even in borrow mode (per-turn LLM logs are not scoped to
+    // the workflow state artifact dir; config.llmLogPath is only read when
+    // the builtin agent is active, and borrow-mode sessions are Docker).
     const llmLogPath = getSessionLlmLogPath(effectiveSessionId);
     const autoApproveLlmLogPath = getSessionAutoApproveLlmLogPath(effectiveSessionId);
-    // Set up session logging -- captures all console output to file
+    // Set up session logging -- captures all console output to file.
+    // In borrow mode, setup() retargets the singleton to the new state's
+    // log file; a prior state's teardown in session.close() releases the
+    // console hijack first.
     logger.setup({ logFilePath: sessionLogPath });
-    logger.info(`Session ${sessionId} created`);
+    logger.info(`Session ${sessionId} created${opts.workflow?.stateSlug ? ` (state=${opts.workflow.stateSlug})` : ''}`);
     logger.info(`${workspacePath ? 'Workspace' : 'Sandbox'}: ${sandboxDir}`);
     logger.info(`Escalation dir: ${escalationDir}`);
     logger.info(`Audit log: ${auditLogPath}`);
@@ -260,6 +423,18 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
     if (resumeSessionId) {
         logger.info(`Resumed from session: ${resumeSessionId}`);
     }
+    // Build userConfig overrides (auto-approver disable, resource budget).
+    // Composed incrementally so multiple overrides don't clobber each other.
+    let patchedUserConfig = config.userConfig;
+    if (disableAutoApprove) {
+        patchedUserConfig = { ...patchedUserConfig, autoApprove: { ...patchedUserConfig.autoApprove, enabled: false } };
+    }
+    if (opts.resourceBudgetOverrides) {
+        patchedUserConfig = {
+            ...patchedUserConfig,
+            resourceBudget: { ...patchedUserConfig.resourceBudget, ...opts.resourceBudgetOverrides },
+        };
+    }
     // Override config paths for this session's isolated directories.
     // Deep-clone mcpServers so patching doesn't mutate the caller's config.
     const sessionConfig = {
@@ -280,19 +455,23 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
             }
             : {}),
         mcpServers: JSON.parse(JSON.stringify(config.mcpServers)),
-        // Disable auto-approver for headless sessions (no interactive user context)
-        ...(disableAutoApprove
-            ? { userConfig: { ...config.userConfig, autoApprove: { ...config.userConfig.autoApprove, enabled: false } } }
-            : {}),
+        userConfig: patchedUserConfig,
     };
     // Apply server allowlist if persona specifies one
     if (serverAllowlist) {
         sessionConfig.mcpServers = applyServerAllowlist(sessionConfig.mcpServers, serverAllowlist);
     }
+    const { compiledPolicy: policyForFilter } = loadGeneratedPolicy({
+        policyDir: sessionConfig.generatedDir,
+        toolAnnotationsDir: sessionConfig.toolAnnotationsDir ?? sessionConfig.generatedDir,
+        fallbackDir: getPackageGeneratedDir(),
+    });
+    sessionConfig.mcpServers = filterMcpServersByPolicy(sessionConfig.mcpServers, extractRequiredServers(policyForFilter));
     // Inject the memory MCP server for persona and cron job sessions only.
     // Default (ad-hoc) sessions are stateless and don't benefit from memory.
-    const memoryConfig = config.userConfig.memory;
-    if (memoryConfig.enabled && (opts.persona || opts.jobId)) {
+    // The gate decision was made once above; reuse it here so the prompt
+    // and the relay cannot diverge.
+    if (memoryEnabled) {
         const dbPath = resolveMemoryDbPath({
             persona: opts.persona,
             jobId: opts.jobId,
@@ -315,18 +494,47 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
         }
     }
     // Patch MCP server args to use the session-specific sandbox directory
-    patchMcpServerAllowedDirectory(sessionConfig, sandboxDir);
+    applyAllowedDirectoryToMcpArgs(sessionConfig.mcpServers, sandboxDir);
     // Persist session settings so --resume can restore them.
     // Only write on initial creation (not when resuming).
     if (!resumeSessionId) {
-        saveSessionMetadata(effectiveSessionId, {
+        const metadata = {
             createdAt: new Date().toISOString(),
             ...(opts.persona ? { persona: opts.persona } : {}),
             ...(opts.workspacePath ? { workspacePath: opts.workspacePath } : {}),
             // Only store policyDir when no persona is set (persona derives its own)
             ...(!opts.persona && policyDir ? { policyDir } : {}),
             ...(opts.disableAutoApprove ? { disableAutoApprove: true } : {}),
+            // Persist the agent-CLI conversation id so `ironcurtain --resume`
+            // can continue the same Claude conversation rather than starting
+            // fresh. Docker-mode sessions only; builtin has no agent CLI.
+            ...(opts.agentConversationId ? { agentConversationId: opts.agentConversationId } : {}),
+        };
+        if (artifactDir) {
+            saveSessionMetadataTo(resolve(artifactDir, SESSION_METADATA_FILENAME), metadata);
+        }
+        else {
+            saveSessionMetadata(effectiveSessionId, metadata);
+        }
+    }
+    // Borrow-mode: re-stage the bundle in-place so per-state persona skills
+    // become visible without remounting. Standalone mode returns the set
+    // through SessionDirConfig for the docker factory to stage at bundle
+    // creation. Builtin (non-Docker) sessions never mount skills, so we
+    // skip the discovery walk entirely to avoid spurious filesystem reads
+    // and `[skills] Ignoring …` warnings.
+    const dockerMode = opts.mode?.kind === 'docker';
+    let resolvedSkills;
+    if (borrowInfra || dockerMode) {
+        resolvedSkills = resolveSkillsForSession({
+            ...(opts.persona ? { personaName: opts.persona } : {}),
+            ...(opts.workflow?.skillsDir ? { workflowSkillsDir: opts.workflow.skillsDir } : {}),
+            ...(opts.workflow?.skillFilter ? { workflowSkillFilter: opts.workflow.skillFilter } : {}),
+            ...(opts.workflow?.disableAllSkills ? { disableAllSkills: true } : {}),
         });
+        if (borrowInfra) {
+            borrowInfra.restageSkills(resolvedSkills);
+        }
     }
     return {
         config: sessionConfig,
@@ -335,24 +543,10 @@ export function buildSessionConfig(config, effectiveSessionId, sessionId, opts =
         escalationDir,
         auditLogPath,
         systemPromptAugmentation,
+        memoryEnabled,
+        resolvedSkills: borrowInfra ? [] : resolvedSkills,
     };
 }
-/**
- * Patches the filesystem MCP server's allowed directory argument
- * to use the session-specific sandbox directory, mirroring the
- * logic in loadConfig() that syncs ALLOWED_DIRECTORY.
- */
-export function patchMcpServerAllowedDirectory(config, sandboxDir) {
-    const fsServer = config.mcpServers['filesystem'];
-    if (!fsServer)
-        return;
-    // Replace any existing allowed directory path in args.
-    // The config may have the original default or a previously patched value.
-    const lastArgIndex = fsServer.args.length - 1;
-    if (lastArgIndex >= 0) {
-        fsServer.args[lastArgIndex] = sandboxDir;
-    }
-}
-export { SessionError, SessionNotReadyError, SessionClosedError, BudgetExhaustedError } from './errors.js';
+export { SessionError, SessionNotReadyError, SessionClosedError, BudgetExhaustedError } from '../types/errors.js';
 export { resolveSessionMode, PreflightError } from './preflight.js';
 //# sourceMappingURL=index.js.map