@skydiveai/pi-extensions 0.1.0-beta.1003

package/dist/index.mjs

@@ -0,0 +1,3942 @@
+import { createRequire } from "node:module";
+import { DefaultExecutionEventBusManager, DefaultRequestHandler, InMemoryTaskStore } from "@a2a-js/sdk/server";
+import { UserBuilder, restHandler } from "@a2a-js/sdk/server/express";
+import { buildAgentCard, chainMiddleware, composeHandlers, createAgentExecutor, createProtocolHandlers, getCurrentTraceparent, logger, mountAt, requestHeaders, requestUrl, webHandlerToMiddleware } from "@skydiveai/pi-server";
+import { mkdir, open, readFile, readdir, stat, unlink } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { z } from "zod";
+import { pathToFileURL } from "node:url";
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Type } from "typebox";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Check, Errors } from "typebox/value";
+import { ROOT_CONTEXT, SpanStatusCode, propagation, trace } from "@opentelemetry/api";
+import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { Resource } from "@opentelemetry/resources";
+import { BatchSpanProcessor, NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { ATTR_SERVICE_NAME } from "@opentelemetry/semantic-conventions";
+import { hc } from "hono/client";
+import { parse } from "yaml";
+import { execFile } from "node:child_process";
+import { availableParallelism } from "node:os";
+import { promisify } from "node:util";
+import { quote } from "shell-quote";
+import { createWriteStream } from "node:fs";
+import { finished } from "node:stream/promises";
+import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
+//#region src/platform-env-middleware.ts
+const ENVD_TOKEN_HEADER = "x-e2b-envd-token";
+const ENVD_URL = "http://localhost:49983/envs";
+const DAEMON_ENV_URL = "http://localhost:38994/v1/env";
+const DAEMON_SET_ENVD_URL = "http://localhost:38994/v1/set-envd";
+/**
+* Identity env the daemon's `/v1/rebind` can swap when a warm pooled sandbox is
+* claimed for a new agent. e2b envd (see below) is a create-time snapshot and
+* can NEVER reflect a rebind, so these keys must come from the daemon store,
+* which rebind mutates. Kept in sync with the daemon's REBINDABLE_KEYS.
+*/
+const REBINDABLE_IDENTITY_KEYS = [
+	"ANYONE_AGENT_ID",
+	"ANYONE_SANDBOX_TOKEN",
+	"SKYDIVE_AGENT_ID",
+	"SKYDIVE_SANDBOX_TOKEN"
+];
+let loaded = false;
+function isPlatformConfigLoaded() {
+	return loaded;
+}
+async function loadPlatformConfig(request) {
+	if (loaded) return;
+	const token = request.headers.get(ENVD_TOKEN_HEADER) ?? void 0;
+	if (token) {
+		const envs = await fetchEnvdDirect(token);
+		if (envs && Object.keys(envs).length > 0) {
+			for (const [k, v] of Object.entries(envs)) process.env[k] = v;
+			const reboundKeys = await overlayReboundIdentity(token);
+			loaded = true;
+			logger.info({
+				event: "platform_config_loaded",
+				source: "envd",
+				keys: Object.keys(envs).length,
+				reboundKeys
+			}, "platform config loaded from envd");
+			setTimeout(() => pushToDaemon(token), 0);
+			return;
+		}
+	}
+	const envs = await fetchDaemonEnv(token);
+	if (envs) {
+		for (const [k, v] of Object.entries(envs)) process.env[k] = v;
+		loaded = true;
+		logger.info({
+			event: "platform_config_loaded",
+			source: "daemon",
+			keys: Object.keys(envs).length
+		}, "platform config loaded from daemon");
+		return;
+	}
+	logger.warn({ event: "platform_config_missing" }, "no platform config available");
+}
+/**
+* Overlay the rebindable identity keys from the daemon env store onto
+* `process.env`, so a claimed warm-pool sandbox resolves the claiming agent's
+* identity rather than the create-time pool identity that e2b envd still holds.
+* The daemon store is authoritative for these keys because `/v1/rebind` mutates
+* it (and it persists across the harness restart the claim path performs).
+* Returns the number of keys actually changed (0 on a fresh, never-rebound box).
+*/
+async function overlayReboundIdentity(token) {
+	const daemonEnv = await fetchDaemonEnv(token);
+	if (!daemonEnv) return 0;
+	let changed = 0;
+	for (const key of REBINDABLE_IDENTITY_KEYS) {
+		const value = daemonEnv[key];
+		if (typeof value === "string" && value && process.env[key] !== value) {
+			process.env[key] = value;
+			changed += 1;
+		}
+	}
+	return changed;
+}
+async function fetchEnvdDirect(token) {
+	try {
+		const res = await fetch(ENVD_URL, { headers: { "X-Access-Token": token } });
+		if (!res.ok) return null;
+		const raw = await res.json();
+		if (!raw || typeof raw !== "object") return null;
+		const data = {};
+		for (const [k, v] of Object.entries(raw)) if (typeof v === "string") data[k] = v;
+		return data;
+	} catch (error) {
+		logger.error({ err: error }, "Failed to fetch envd direct");
+		return null;
+	}
+}
+function pushToDaemon(token) {
+	fetch(DAEMON_SET_ENVD_URL, {
+		method: "POST",
+		headers: {
+			"x-envd-token": token,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ sandboxId: process.env["E2B_SANDBOX_ID"] ?? "" })
+	}).catch(() => {});
+}
+async function fetchDaemonEnv(token) {
+	try {
+		const headers = {};
+		if (token) headers["x-envd-token"] = token;
+		const res = await fetch(DAEMON_ENV_URL, { headers });
+		if (!res.ok) return null;
+		return await res.json();
+	} catch (error) {
+		logger.error({ err: error }, "Failed to fetch daemon env");
+		return null;
+	}
+}
+//#endregion
+//#region src/versions.ts
+/**
+* Installed versions of the Skydive platform packages — the first-party
+* packages the harness process loads (the pi server and these extensions),
+* which we publish and bump. When they change, the agent is running different
+* platform code. Surfaced via GET /health so a stale runtime is observable
+* from outside a sandbox without shelling in (and so the self-upgrade flow can
+* confirm an install took effect).
+*/
+const require = createRequire(import.meta.url);
+const PLATFORM_PACKAGES = ["@skydiveai/pi-server", "@skydiveai/pi-extensions"];
+/**
+* Resolve a package's own package.json by resolving its entry point and walking
+* up to the nearest package.json whose `name` matches. We can't resolve
+* `${pkg}/package.json` directly — these packages' `exports` don't expose it.
+*/
+async function readPackageVersion(pkg) {
+	let dir;
+	try {
+		dir = dirname(require.resolve(pkg));
+	} catch {
+		return null;
+	}
+	let current = dir;
+	while (true) {
+		try {
+			const manifest = JSON.parse(await readFile(resolve(current, "package.json"), "utf8"));
+			if (manifest.name === pkg && typeof manifest.version === "string") return manifest.version;
+		} catch {}
+		const parent = dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+/**
+* Map of platform package name -> installed version. Packages that can't be
+* resolved are omitted (running from source, partial install) rather than
+* reported as a bogus version.
+*/
+async function readPlatformVersions() {
+	const versions = {};
+	await Promise.all(PLATFORM_PACKAGES.map(async (pkg) => {
+		const version = await readPackageVersion(pkg);
+		if (version) versions[pkg] = version;
+	}));
+	return versions;
+}
+//#endregion
+//#region src/platform-middleware.ts
+/**
+* Express-mountable platform middleware: Skydive env injection and the
+* health endpoint. Built on @skydiveai/pi-server's node:http bridge
+* helpers so the express app itself stays in the agent's workspace.
+*/
+let platformVersionsPromise = null;
+function platformVersions() {
+	return platformVersionsPromise ??= readPlatformVersions();
+}
+/**
+* Middleware that loads platform config (e2b envd / daemon env) before
+* requests reach the protocol handlers. Builds a headers-only Request —
+* the body stream must stay untouched for the downstream handlers.
+* Mount above everything except /health; it can wait up to 10s for env
+* vars during boot.
+*/
+function createPlatformEnvMiddleware() {
+	return async (req, _res, next) => {
+		try {
+			await loadPlatformConfig(new Request(requestUrl(req), { headers: requestHeaders(req) }));
+		} catch {}
+		next();
+	};
+}
+/**
+* GET /health handler: platform health data plus whatever the agent's
+* `metadata` callback returns. Must respond immediately (readiness
+* probes, prewarm stashing) — mount it above the platform env
+* middleware.
+*/
+function createHealthHandler({ metadata }) {
+	return async (_req, res) => {
+		let meta;
+		try {
+			meta = metadata?.() ?? void 0;
+		} catch (err) {
+			logger.error({
+				err,
+				event: "health_metadata_failed"
+			}, "health metadata callback threw");
+		}
+		const runtimeVersions = await platformVersions();
+		res.writeHead(200, { "content-type": "application/json" });
+		res.end(JSON.stringify({
+			ok: true,
+			uptime: process.uptime(),
+			platformConfigLoaded: isPlatformConfigLoaded(),
+			runtimeVersions,
+			...meta ? { metadata: meta } : {}
+		}));
+	};
+}
+//#endregion
+//#region src/extensions/context-management-config.ts
+/**
+* Configuration for the context-management capability (tool-output trimming
+* and client-side microcompact). See the design notes in the extension for
+* what each layer does; this module is purely the env → config surface.
+*
+* The harness is provider-agnostic and runs inside the sandbox, where its
+* only config channel is the environment (loaded by the platform env
+* middleware before any session starts — see platform-env-middleware.ts). So
+* the LaunchDarkly flag `harness-context-management-enabled` is resolved by
+* the platform when it provisions the sandbox and passed through as
+* `SKYDIVE_CONTEXT_MANAGEMENT`; the individual knobs override the defaults
+* below when present.
+*
+* Resolution is defensive: a malformed value never throws (this config is
+* read on the hot path before every LLM call), it falls back to the default
+* for that knob and logs once.
+*/
+const log$14 = logger.child({ module: "context-management-config" });
+const DEFAULT_CONTEXT_MANAGEMENT_CONFIG = {
+	enabled: false,
+	perResultMaxBytes: 16 * 1024,
+	keepRecentToolResults: 3,
+	coldCacheGapSeconds: 240,
+	warmClearTriggerTokens: 5e4,
+	clearAtLeastTokens: 1e4,
+	excludeTools: [],
+	maxModelCallsPerTurn: 80,
+	nativeAnthropicEdits: false
+};
+const boolFromEnv = (value, fallback) => {
+	if (value === void 0) return fallback;
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "1" || normalized === "true") return true;
+	if (normalized === "0" || normalized === "false") return false;
+	return fallback;
+};
+const positiveInt = (fallback) => z.coerce.number().int().positive().catch(fallback);
+const nonNegativeInt = (fallback) => z.coerce.number().int().nonnegative().catch(fallback);
+const configSchema = z.object({
+	perResultMaxBytes: positiveInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.perResultMaxBytes),
+	keepRecentToolResults: nonNegativeInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.keepRecentToolResults),
+	coldCacheGapSeconds: positiveInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.coldCacheGapSeconds),
+	warmClearTriggerTokens: positiveInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.warmClearTriggerTokens),
+	clearAtLeastTokens: positiveInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.clearAtLeastTokens),
+	maxModelCallsPerTurn: positiveInt(DEFAULT_CONTEXT_MANAGEMENT_CONFIG.maxModelCallsPerTurn)
+});
+const parseExcludeTools = (value) => {
+	if (!value) return DEFAULT_CONTEXT_MANAGEMENT_CONFIG.excludeTools;
+	return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+};
+/**
+* Reads the context-management config from `env` (defaults to `process.env`).
+* Never throws — invalid values fall back to defaults.
+*/
+function resolveContextManagementConfig(env = process.env) {
+	if (!boolFromEnv(env.SKYDIVE_CONTEXT_MANAGEMENT, false)) return { ...DEFAULT_CONTEXT_MANAGEMENT_CONFIG };
+	const parsed = configSchema.safeParse({
+		perResultMaxBytes: env.SKYDIVE_CTX_PER_RESULT_MAX_BYTES,
+		keepRecentToolResults: env.SKYDIVE_CTX_KEEP_RECENT,
+		coldCacheGapSeconds: env.SKYDIVE_CTX_COLD_GAP_SECONDS,
+		warmClearTriggerTokens: env.SKYDIVE_CTX_WARM_TRIGGER_TOKENS,
+		clearAtLeastTokens: env.SKYDIVE_CTX_CLEAR_AT_LEAST_TOKENS,
+		maxModelCallsPerTurn: env.SKYDIVE_CTX_MAX_MODEL_CALLS
+	});
+	if (!parsed.success) {
+		log$14.warn({
+			event: "context_management_config_invalid",
+			err: parsed.error
+		}, "falling back to default context-management config");
+		return {
+			...DEFAULT_CONTEXT_MANAGEMENT_CONFIG,
+			enabled: true
+		};
+	}
+	return {
+		enabled: true,
+		...parsed.data,
+		excludeTools: parseExcludeTools(env.SKYDIVE_CTX_EXCLUDE_TOOLS),
+		nativeAnthropicEdits: boolFromEnv(env.SKYDIVE_CTX_NATIVE_ANTHROPIC_EDITS, DEFAULT_CONTEXT_MANAGEMENT_CONFIG.nativeAnthropicEdits)
+	};
+}
+//#endregion
+//#region src/extensions/context-management-runtime.ts
+/**
+* Live, mutable view of the context-management config.
+*
+* The env-derived config (context-management-config.ts) is the boot-time
+* default. On top of it, the platform can deliver a global on/off at runtime
+* via the LaunchDarkly flag `harness-context-management-enabled` — resolved
+* server-side and polled by the harness (see the poller in
+* context-management.ts). This holder is where that override lands so a flip
+* (especially a kill-switch) reaches long-lived sandboxes without a restart.
+*
+* Only the master `enabled` toggle is overridable at runtime; the per-knob
+* tunables stay env-derived. `enabled` resolves to the flag override when the
+* platform has reported one, else the env value.
+*/
+let baseConfig = null;
+let flagOverride = null;
+function base() {
+	baseConfig ??= resolveContextManagementConfig();
+	return baseConfig;
+}
+/** The effective config, with the runtime flag override applied to `enabled`. */
+function getContextManagementConfig() {
+	const resolved = base();
+	return {
+		...resolved,
+		enabled: flagOverride ?? resolved.enabled
+	};
+}
+/**
+* Apply the platform-reported flag value. `null` clears the override (fall back
+* to the env default) — used when the phone-home result is indeterminate so a
+* transient failure never silently changes behavior.
+*/
+function setContextManagementFlagOverride(enabled) {
+	flagOverride = enabled;
+}
+/**
+* Whether a phone-home channel exists to learn the flag at runtime. When false
+* (e.g. a bare local CLI with no platform API), the env value is the only
+* source and there's nothing to poll.
+*/
+function hasFlagSource(env = process.env) {
+	return Boolean(env.SKYDIVE_API_URL ?? env.ANYONE_API_URL);
+}
+//#endregion
+//#region src/iteration-cap.ts
+function installIterationCap({ session, log }, configOverride = null) {
+	const readConfig = () => configOverride ?? getContextManagementConfig();
+	if (!readConfig().enabled && (configOverride !== null || !hasFlagSource())) return;
+	const agent = session.agent;
+	if (typeof agent.createLoopConfig !== "function") throw new Error("installIterationCap: session.agent.createLoopConfig is missing — pi-agent-core internals changed; update iteration-cap.ts.");
+	const original = agent.createLoopConfig.bind(agent);
+	agent.createLoopConfig = (options) => {
+		const loopConfig = original(options);
+		const previousStop = loopConfig.shouldStopAfterTurn;
+		let modelCalls = 0;
+		return {
+			...loopConfig,
+			shouldStopAfterTurn: async (ctx) => {
+				if (previousStop && await previousStop(ctx)) return true;
+				const config = readConfig();
+				if (!config.enabled) return false;
+				modelCalls += 1;
+				if (modelCalls >= config.maxModelCallsPerTurn) {
+					log.warn({
+						event: "iteration_cap_reached",
+						modelCalls,
+						max: config.maxModelCallsPerTurn
+					}, "reached per-turn model-call cap; stopping turn gracefully");
+					return true;
+				}
+				return false;
+			}
+		};
+	};
+}
+//#endregion
+//#region src/extensions/capability-soul-nudge.ts
+/**
+* One-line reminder appended to a tool-update continuation when the agent
+* gains a *new* capability (a freshly-loaded tool file or a newly-connected
+* MCP server — not a refresh or removal). It points the agent back at
+* `soul.md`, which the soul extension frames as the durable home of identity
+* *and* capabilities. Without this, an added capability lives only in the
+* mechanical tool/skill inventory and never becomes part of the self-concept
+* a future conversation starts from — the "agent forgets what it can do"
+* gap.
+*
+* Phrased to defer ("once the current task is done") so it nudges reflection
+* without derailing the in-flight turn into a soul edit.
+*/
+const CAPABILITY_SOUL_NUDGE = "New capability gained — once the current task is done, if this changes what you can do for the user, record it in `soul.md` so it carries into future conversations rather than being rediscovered from scratch (then commit and push).";
+//#endregion
+//#region src/extensions/local-tools.ts
+/**
+* Local-tools adapter as a pi extension. Mirrors the mcp.ts hot-reload pattern
+* one level over: walks `tools/` (relative to the harness cwd), imports each
+* module, and registers the exported `ToolDefinition`s with pi.
+*
+* The agent edits files under `tools/` between turns; on every `tool_result`
+* the extension stat()s the directory's children, compares mtimes against
+* what we last reconciled against, and queues a `pendingLocalToolsUpdate`
+* if anything was added/removed/changed. The chat handler drains that queue
+* after the current `session.prompt(...)` returns, calls `session.reload()`,
+* and injects a synthetic continuation message — same dance as MCP.
+*
+* **ESM cache-busting.** `import(url)` in Node's ESM loader keys cached
+* modules by URL. Re-importing the same path after editing the file gets
+* the *original* module back. To force a fresh load on mtime change we
+* append `?v=<mtimeMs>` to the URL — different URL, fresh module
+* evaluation. The old version stays in memory but is unreachable.
+*
+* Each `.ts`/`.mjs`/`.js` file's default export should be a `ToolDefinition`
+* or `ToolDefinition[]`. Files starting with `_` or `.` are skipped, so
+* `tools/_example.ts` documents the shape without registering.
+*/
+const log$13 = logger.child({ module: "local-tools-extension" });
+const TOOLS_DIRNAME = "tools";
+const fileState = /* @__PURE__ */ new Map();
+let pendingLocalToolsUpdate = null;
+function consumePendingLocalToolsUpdate() {
+	const update = pendingLocalToolsUpdate;
+	pendingLocalToolsUpdate = null;
+	return update;
+}
+/**
+* Non-consuming peek used by the agent loop's `shouldStopAfterTurn` hook to
+* decide whether to end the current `prompt()` after the in-flight turn so a
+* fresh tool snapshot can be taken. The drain still happens in postPrompt via
+* `consumePendingLocalToolsUpdate`.
+*/
+function hasPendingLocalToolsUpdate() {
+	return pendingLocalToolsUpdate !== null;
+}
+function formatLocalToolsUpdateMessage(summary) {
+	const lines = ["[system] Your local tools/ inventory changed during the previous turn. Your tool list is now updated; act on the new set rather than what was visible before."];
+	if (summary.added.length > 0) lines.push(`Newly loaded tool files: ${summary.added.join(", ")}`);
+	if (summary.refreshed.length > 0) lines.push(`Refreshed tool files: ${summary.refreshed.join(", ")}`);
+	if (summary.removed.length > 0) lines.push(`Removed tool files (and their tools): ${summary.removed.join(", ")}`);
+	if (summary.errors.length > 0) {
+		lines.push("Errors:");
+		for (const e of summary.errors) lines.push(`  - ${e.file}: ${e.message}`);
+	}
+	if (summary.added.length > 0) lines.push(CAPABILITY_SOUL_NUDGE);
+	lines.push("Continue from where you left off, using the current tool list. Do not re-do work that already succeeded last turn.");
+	return lines.join("\n");
+}
+function isToolDefinition(x) {
+	return !!x && typeof x === "object" && typeof x.name === "string" && typeof x.execute === "function";
+}
+/**
+* Pi's system-prompt builder filters its visible-tool list to entries with a
+* non-empty `promptSnippet` (system-prompt.js:49) — a tool with only a
+* `description` won't appear in the system prompt's "available tools"
+* section, which biases the LLM against using it. If the local tool author
+* didn't set a snippet, default to the tool's description so the tool stays
+* visible.
+*/
+function withDefaultPromptSnippet(tool) {
+	if (typeof tool.promptSnippet === "string" && tool.promptSnippet.trim()) return tool;
+	const fallback = tool.description?.trim();
+	if (!fallback) return tool;
+	return {
+		...tool,
+		promptSnippet: fallback
+	};
+}
+async function listToolFiles(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch (err) {
+		if (err?.code === "ENOENT") return [];
+		throw err;
+	}
+	const out = [];
+	for (const file of entries) {
+		if (!file.endsWith(".ts") && !file.endsWith(".mjs") && !file.endsWith(".js")) continue;
+		if (file.startsWith("_") || file.startsWith(".")) continue;
+		const full = join(dir, file);
+		try {
+			const s = await stat(full);
+			if (!s.isFile()) continue;
+			out.push({
+				file,
+				mtimeMs: s.mtimeMs
+			});
+		} catch {}
+	}
+	return out;
+}
+async function importToolFile({ dir, file, mtimeMs }) {
+	const mod = await import(`${pathToFileURL(join(dir, file)).href}?v=${mtimeMs}`);
+	const exported = mod.default ?? mod.tool ?? mod.tools;
+	const tools = [];
+	if (Array.isArray(exported)) {
+		for (const t of exported) if (isToolDefinition(t)) tools.push(t);
+	} else if (isToolDefinition(exported)) tools.push(exported);
+	if (tools.length === 0) throw new Error("no valid ToolDefinition export");
+	return tools;
+}
+async function reconcileLocalTools({ pi, dir }) {
+	const summary = {
+		added: [],
+		removed: [],
+		refreshed: [],
+		errors: [],
+		totalTools: 0
+	};
+	const current = await listToolFiles(dir);
+	const currentByName = new Map(current.map((e) => [e.file, e.mtimeMs]));
+	for (const file of [...fileState.keys()]) if (!currentByName.has(file)) {
+		fileState.delete(file);
+		summary.removed.push(file);
+	}
+	for (const { file, mtimeMs } of current) {
+		const existing = fileState.get(file);
+		let tools;
+		let action;
+		if (existing && existing.mtimeMs === mtimeMs) {
+			tools = existing.tools;
+			action = "reused";
+		} else {
+			try {
+				tools = await importToolFile({
+					dir,
+					file,
+					mtimeMs
+				});
+			} catch (err) {
+				summary.errors.push({
+					file,
+					message: err instanceof Error ? err.message : String(err)
+				});
+				continue;
+			}
+			fileState.set(file, {
+				mtimeMs,
+				tools
+			});
+			action = existing ? "refreshed" : "added";
+		}
+		for (const tool of tools) {
+			pi.registerTool(withDefaultPromptSnippet(tool));
+			summary.totalTools++;
+		}
+		if (action === "added") summary.added.push(file);
+		else if (action === "refreshed") summary.refreshed.push(file);
+	}
+	return summary;
+}
+function summaryHasChanges$1(s) {
+	return s.added.length > 0 || s.removed.length > 0 || s.refreshed.length > 0 || s.errors.length > 0;
+}
+async function reconcileAndQueue({ pi, dir, reason }) {
+	const summary = await reconcileLocalTools({
+		pi,
+		dir
+	});
+	if (reason !== "session_start" && summaryHasChanges$1(summary)) pendingLocalToolsUpdate = summary;
+	log$13.info({
+		event: "local_tools_reconcile",
+		reason,
+		total_tools: summary.totalTools,
+		added: summary.added,
+		removed: summary.removed,
+		refreshed: summary.refreshed,
+		errors: summary.errors,
+		queued_continuation: reason !== "session_start" && summaryHasChanges$1(summary)
+	}, "local tools reconcile complete");
+	return summary;
+}
+const localToolsExtension = (pi) => {
+	pi.on("session_start", async (_event, ctx) => {
+		const dir = join(ctx.cwd, TOOLS_DIRNAME);
+		try {
+			await reconcileAndQueue({
+				pi,
+				dir,
+				reason: "session_start"
+			});
+		} catch (err) {
+			log$13.error({
+				err,
+				event: "local_tools_reconcile_failed"
+			}, "local tools reconcile failed");
+		}
+	});
+	pi.on("tool_result", async (_event, ctx) => {
+		const dir = join(ctx.cwd, TOOLS_DIRNAME);
+		let current;
+		try {
+			current = await listToolFiles(dir);
+		} catch (err) {
+			log$13.warn({
+				err,
+				event: "local_tools_listing_failed"
+			}, "tools/ listing failed");
+			return;
+		}
+		let changed = current.length !== fileState.size;
+		if (!changed) for (const { file, mtimeMs } of current) {
+			const existing = fileState.get(file);
+			if (!existing || existing.mtimeMs !== mtimeMs) {
+				changed = true;
+				break;
+			}
+		}
+		if (!changed) return;
+		try {
+			await reconcileAndQueue({
+				pi,
+				dir,
+				reason: "auto_reload"
+			});
+		} catch (err) {
+			log$13.error({
+				err,
+				event: "local_tools_auto_reload_failed"
+			}, "auto-reload after tools/ change failed");
+		}
+	});
+};
+//#endregion
+//#region src/extensions/mcp/stderr-buffer.ts
+function createStderrBuffer({ maxBytes }) {
+	const chunks = [];
+	let bytes = 0;
+	return {
+		attach(stream) {
+			stream.on("data", (chunk) => {
+				chunks.push(chunk);
+				bytes += chunk.length;
+				while (bytes > maxBytes && chunks.length > 1) {
+					const dropped = chunks.shift();
+					bytes -= dropped.length;
+				}
+			});
+		},
+		read() {
+			if (chunks.length === 0) return "";
+			const full = Buffer.concat(chunks).toString("utf8");
+			return full.length > maxBytes ? full.slice(full.length - maxBytes) : full;
+		}
+	};
+}
+//#endregion
+//#region src/extensions/mcp/connect-client.ts
+/**
+* Spawns an MCP server's transport and races the initialize handshake
+* against a bounded timeout. The motivating case is OAuth-pending
+* bridges like `mcp-remote`: they spawn fine, print their auth URL to
+* stderr, then block on JSON-RPC `initialize` until the user completes
+* OAuth. Without a bounded wait, `client.connect(transport)` hangs
+* forever and the reconcile loop stalls.
+*
+* On timeout we return `status: 'timeout'` with the captured stderr.
+* The transport stays alive — caller holds the client so the bridge's
+* callback server keeps listening and a later reconcile re-probes.
+*/
+const DEFAULT_CONNECT_TIMEOUT_MS = 5e3;
+const STDERR_BUFFER_BYTES = 4096;
+/**
+* undici's fetch throws `TypeError: fetch failed` with the actual
+* network error hung off `.cause` (e.g. `getaddrinfo ENOTFOUND ...`,
+* `ECONNREFUSED`, TLS errors). Surfacing only `err.message` makes
+* every network failure read as a bare "fetch failed", which is
+* indistinguishable from any other transport problem. Walk the cause
+* chain so the agent sees the real underlying error.
+*/
+function formatError(err) {
+	if (!(err instanceof Error)) return String(err);
+	const parts = [err.message];
+	let cursor = err.cause;
+	while (cursor instanceof Error) {
+		const code = cursor.code;
+		parts.push(typeof code === "string" ? `${cursor.message} (${code})` : cursor.message);
+		cursor = cursor.cause;
+	}
+	return parts.join(": ");
+}
+async function connectHttp(_id, config, client) {
+	const transport = new StreamableHTTPClientTransport(new URL(config.url), { ...config.headers !== null ? { requestInit: { headers: config.headers } } : {} });
+	try {
+		await client.connect(transport);
+		return {
+			status: "connected",
+			client,
+			stderr: null
+		};
+	} catch (err) {
+		if (err instanceof UnauthorizedError || err instanceof StreamableHTTPError && err.code === 401) return {
+			status: "pending_auth",
+			client,
+			stderr: "",
+			stderrBuffer: null,
+			cliHint: `platform auth mcp ${config.url}`
+		};
+		return {
+			status: "failed",
+			error: formatError(err),
+			stderr: ""
+		};
+	}
+}
+async function connectClient(id, config, opts = {}) {
+	const timeoutMs = opts.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+	const client = new Client({
+		name: "skydive-harness",
+		version: "0.1.0"
+	}, { capabilities: {} });
+	if (config.transport === "http") return connectHttp(id, config, client);
+	const params = {
+		command: config.command,
+		args: config.args,
+		stderr: "pipe"
+	};
+	if (config.env !== null) params.env = config.env;
+	if (config.cwd !== null) params.cwd = config.cwd;
+	const transport = new StdioClientTransport(params);
+	const stderrBuffer = createStderrBuffer({ maxBytes: STDERR_BUFFER_BYTES });
+	if (transport.stderr) stderrBuffer.attach(transport.stderr);
+	let exited = null;
+	const exitPromise = new Promise((resolve) => {
+		transport.onclose = () => {
+			exited = { code: null };
+			resolve();
+		};
+	});
+	const connectPromise = client.connect(transport);
+	const TIMEOUT_SENTINEL = Symbol("timeout");
+	const result = await Promise.race([
+		connectPromise.then(() => "connected").catch((err) => err),
+		exitPromise.then(() => "exited"),
+		new Promise((resolve) => setTimeout(() => resolve(TIMEOUT_SENTINEL), timeoutMs))
+	]);
+	if (result === "connected") return {
+		status: "connected",
+		client,
+		stderr: stderrBuffer
+	};
+	if (result === "exited" || exited !== null) return {
+		status: "failed",
+		error: `server "${id}" exited before completing initialize`,
+		stderr: stderrBuffer.read()
+	};
+	if (result === TIMEOUT_SENTINEL) return {
+		status: "timeout",
+		client,
+		stderr: stderrBuffer.read(),
+		stderrBuffer
+	};
+	try {
+		await client.close();
+	} catch {}
+	return {
+		status: "failed",
+		error: formatError(result),
+		stderr: stderrBuffer.read()
+	};
+}
+//#endregion
+//#region src/extensions/mcp/mcp-config.ts
+/**
+* mcp.config.json schema + loader. Split out from the extension so it has
+* a small, focused unit-test surface (typebox validation, error formatting).
+*/
+const MCP_CONFIG_FILENAME = "mcp.config.json";
+const StdioServerSchema = Type.Object({
+	transport: Type.Literal("stdio"),
+	command: Type.String(),
+	args: Type.Array(Type.String()),
+	env: Type.Optional(Type.Union([Type.Record(Type.String(), Type.String()), Type.Null()])),
+	cwd: Type.Optional(Type.Union([Type.String(), Type.Null()]))
+});
+const HttpServerSchema = Type.Object({
+	transport: Type.Literal("http"),
+	url: Type.String(),
+	headers: Type.Optional(Type.Union([Type.Record(Type.String(), Type.String()), Type.Null()]))
+});
+const ServerSchema = Type.Union([StdioServerSchema, HttpServerSchema]);
+const McpConfigSchema = Type.Object({ servers: Type.Record(Type.String(), ServerSchema) });
+const EMPTY_CONFIG = { servers: {} };
+async function loadMcpConfig(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (err) {
+		if (err?.code === "ENOENT") return EMPTY_CONFIG;
+		throw err;
+	}
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`Invalid JSON in MCP config at ${path}: ${err.message}`, { cause: err });
+	}
+	if (!Check(McpConfigSchema, json)) {
+		const details = Errors(McpConfigSchema, json).map((e) => `  ${e.instancePath || "/"}: ${e.message}`).join("\n");
+		throw new Error(`Invalid MCP config at ${path}:\n${details}`);
+	}
+	const servers = {};
+	for (const [id, server] of Object.entries(json.servers)) if (server.transport === "stdio") servers[id] = {
+		...server,
+		env: server.env ?? null,
+		cwd: server.cwd ?? null
+	};
+	else servers[id] = {
+		...server,
+		headers: server.headers ?? null
+	};
+	return { servers };
+}
+//#endregion
+//#region src/extensions/mcp/index.ts
+/**
+* MCP adapter as a pi extension.
+*
+* Owns the lifecycle of MCP server clients and registers their tools with pi
+* via `pi.registerTool`. The harness process is long-lived and runs one
+* McpExtension instance — state (open clients, registered tool names,
+* mtime baseline, pending update) is per-instance so tests can construct
+* fresh ones instead of poking module-scoped vars.
+*
+* **Mid-turn tool-list updates do not work in pi-agent-core.** The agent
+* loop snapshots `state.tools` at the top of each `session.prompt(...)`
+* and reuses that snapshot for every LLM iteration in the turn. New
+* registrations only land in the *next* prompt's snapshot. The harness
+* orchestrates around this via `runToolUpdateLoop` (postPrompt):
+*
+*   1. `session.reload()` rebuilds pi's tool registry; our session_start
+*      hook re-reconciles against an empty registry, so removed servers
+*      drop out (pi has no `unregisterTool`).
+*   2. `consumePendingMcpUpdate()` + `formatMcpUpdateMessage()` produce
+*      a synthetic system note injected via `sendCustomMessage(...,
+*      { triggerTurn: true })` — fresh `state.tools` snapshot for the
+*      next prompt.
+*
+* Clients are keyed by JSON-stringified config and reused across
+* reloads — only changed configs reconnect.
+*/
+const log$12 = logger.child({ module: "mcp-extension" });
+async function closeConnected(connected) {
+	try {
+		await connected.client.close();
+	} catch (err) {
+		logger.warn({
+			err,
+			event: "mcp_client_close_failed"
+		}, "failed to close MCP client; transport may leak");
+	}
+}
+async function readConfigMtimeMs(configPath) {
+	try {
+		return (await stat(configPath)).mtimeMs;
+	} catch (err) {
+		if (err?.code === "ENOENT") return 0;
+		throw err;
+	}
+}
+function makeToolName(serverId, toolName) {
+	return `mcp_${serverId}_${toolName}`;
+}
+function toMcpArguments(params) {
+	const out = {};
+	if (!params || typeof params !== "object" || Array.isArray(params)) return out;
+	for (const [key, value] of Object.entries(params)) out[key] = value;
+	return out;
+}
+function isCallToolResult(result) {
+	return "content" in result;
+}
+function mcpContentPartToText(part) {
+	switch (part.type) {
+		case "text": return part.text;
+		case "audio": return `[audio: ${part.mimeType}]`;
+		case "resource": {
+			const { resource } = part;
+			if ("text" in resource) return resource.text;
+			return `[resource: ${resource.uri}]`;
+		}
+		case "resource_link": return `[resource link: ${part.name} (${part.uri})]`;
+		default: return `[unsupported MCP content type: ${JSON.stringify(part)}]`;
+	}
+}
+function mcpResultToPiContent(result) {
+	const content = [];
+	const textParts = [];
+	if (result.isError) textParts.push("MCP tool reported an error.");
+	for (const part of result.content) {
+		if (part.type === "image") {
+			content.push({
+				type: "image",
+				data: part.data,
+				mimeType: part.mimeType
+			});
+			continue;
+		}
+		const text = mcpContentPartToText(part);
+		if (text) textParts.push(text);
+	}
+	if (result.structuredContent) textParts.push(`Structured content:\n${JSON.stringify(result.structuredContent, null, 2)}`);
+	if (textParts.length > 0) content.unshift({
+		type: "text",
+		text: textParts.join("\n")
+	});
+	return content.length > 0 ? content : [{
+		type: "text",
+		text: "MCP tool returned no content."
+	}];
+}
+var McpExtension = class {
+	mcpClients = /* @__PURE__ */ new Map();
+	registeredMcpToolNames = /* @__PURE__ */ new Set();
+	lastConfigMtimeMs = 0;
+	pendingMcpUpdate = null;
+	/** Non-consuming peek used by `shouldStopAfterTurn`. */
+	hasPendingUpdate() {
+		return this.pendingMcpUpdate !== null;
+	}
+	/** Read + clear the queued mid-turn update; null if nothing pending. */
+	consumePendingUpdate() {
+		const update = this.pendingMcpUpdate;
+		this.pendingMcpUpdate = null;
+		return update;
+	}
+	registerMcpTool({ pi, serverId, client, tool }) {
+		const name = makeToolName(serverId, tool.name);
+		const parameters = Type.Unsafe(tool.inputSchema);
+		const description = tool.description?.trim() ?? "";
+		const promptSnippet = description.length > 0 ? description : `MCP tool from server "${serverId}".`;
+		pi.registerTool({
+			name,
+			label: `MCP: ${serverId}/${tool.name}`,
+			description,
+			promptSnippet,
+			parameters,
+			async execute(_toolCallId, params) {
+				try {
+					const result = await client.callTool({
+						name: tool.name,
+						arguments: toMcpArguments(params)
+					}, CallToolResultSchema);
+					if (!isCallToolResult(result)) throw new Error("MCP tool returned an unsupported compatibility result");
+					return {
+						content: mcpResultToPiContent(result),
+						details: {
+							result,
+							error: null
+						}
+					};
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					return {
+						content: [{
+							type: "text",
+							text: `MCP tool ${serverId}/${tool.name} failed: ${message}`
+						}],
+						details: {
+							result: null,
+							error: message
+						}
+					};
+				}
+			}
+		});
+		this.registeredMcpToolNames.add(name);
+	}
+	async reconcile({ pi, configPath, connectTimeoutMs }) {
+		let config;
+		try {
+			config = await loadMcpConfig(configPath);
+		} catch (err) {
+			throw new Error(`Failed to load MCP config: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		const summary = {
+			added: [],
+			removed: [],
+			refreshed: [],
+			errors: [],
+			totalTools: 0,
+			servers: {}
+		};
+		const desiredIds = new Set(Object.keys(config.servers));
+		this.registeredMcpToolNames.clear();
+		for (const [id, existing] of [...this.mcpClients.entries()]) if (!desiredIds.has(id)) {
+			await closeConnected(existing);
+			this.mcpClients.delete(id);
+			summary.removed.push(id);
+		}
+		const outcomes = await Promise.all(Object.entries(config.servers).map(([id, serverConfig]) => this.reconcileServer({
+			id,
+			serverConfig,
+			existing: this.mcpClients.get(id),
+			connectTimeoutMs
+		})));
+		for (const outcome of outcomes) {
+			const { id } = outcome;
+			if (outcome.store) this.mcpClients.set(id, outcome.store);
+			else this.mcpClients.delete(id);
+			summary.servers[id] = outcome.serverStatus;
+			if (outcome.error) summary.errors.push(outcome.error);
+			if (outcome.change === "added") summary.added.push(id);
+			else if (outcome.change === "refreshed") summary.refreshed.push(id);
+			if (outcome.tools) for (const tool of outcome.tools.list) {
+				this.registerMcpTool({
+					pi,
+					serverId: id,
+					client: outcome.tools.client,
+					tool
+				});
+				summary.totalTools++;
+			}
+		}
+		return summary;
+	}
+	/**
+	* Probe one server end-to-end (connect → retry pending → listTools) and
+	* return what should be applied to shared state. Touches only its own
+	* client (closing a stale one before reconnecting), never the shared
+	* map/summary, so callers can run these concurrently.
+	*/
+	async reconcileServer({ id, serverConfig, existing, connectTimeoutMs }) {
+		const configKey = JSON.stringify(serverConfig);
+		let action;
+		let connected;
+		if (existing && existing.configKey === configKey) {
+			connected = existing;
+			action = "reused";
+		} else {
+			if (existing) await closeConnected(existing);
+			const result = await connectClient(id, serverConfig, { connectTimeoutMs });
+			const change = existing ? "refreshed" : "added";
+			if (result.status === "failed") return {
+				id,
+				store: null,
+				serverStatus: {
+					status: "failed",
+					error: result.error,
+					stderr: result.stderr
+				},
+				change,
+				error: {
+					serverId: id,
+					message: result.error
+				},
+				tools: null
+			};
+			if (result.status === "pending_auth") return {
+				id,
+				store: {
+					client: result.client,
+					configKey,
+					status: "pending_auth",
+					stderrBuffer: result.stderrBuffer,
+					cliHint: result.cliHint
+				},
+				serverStatus: {
+					status: "pending_auth",
+					stderr: result.stderr,
+					cliHint: result.cliHint
+				},
+				change,
+				error: null,
+				tools: null
+			};
+			if (result.status === "timeout") return {
+				id,
+				store: {
+					client: result.client,
+					configKey,
+					status: "timeout",
+					stderrBuffer: result.stderrBuffer,
+					cliHint: null
+				},
+				serverStatus: {
+					status: "timeout",
+					stderr: result.stderr
+				},
+				change,
+				error: null,
+				tools: null
+			};
+			connected = {
+				client: result.client,
+				configKey,
+				status: "connected",
+				stderrBuffer: result.stderr,
+				cliHint: null
+			};
+			action = existing ? "refreshed" : "added";
+		}
+		if (connected.status === "pending_auth") {
+			await closeConnected(connected);
+			const retry = await connectClient(id, serverConfig, { connectTimeoutMs });
+			if (retry.status === "pending_auth") return {
+				id,
+				store: {
+					client: retry.client,
+					configKey,
+					status: "pending_auth",
+					stderrBuffer: null,
+					cliHint: retry.cliHint
+				},
+				serverStatus: {
+					status: "pending_auth",
+					stderr: "",
+					cliHint: retry.cliHint
+				},
+				change: null,
+				error: null,
+				tools: null
+			};
+			if (retry.status === "timeout") return {
+				id,
+				store: {
+					client: retry.client,
+					configKey,
+					status: "timeout",
+					stderrBuffer: retry.stderrBuffer,
+					cliHint: null
+				},
+				serverStatus: {
+					status: "timeout",
+					stderr: retry.stderr
+				},
+				change: null,
+				error: null,
+				tools: null
+			};
+			if (retry.status === "failed") return {
+				id,
+				store: null,
+				serverStatus: {
+					status: "failed",
+					error: retry.error,
+					stderr: retry.stderr
+				},
+				change: null,
+				error: null,
+				tools: null
+			};
+			connected = {
+				client: retry.client,
+				configKey,
+				status: "connected",
+				stderrBuffer: retry.stderr,
+				cliHint: null
+			};
+			action = "refreshed";
+		} else if (connected.status === "timeout") {
+			const stderr = connected.stderrBuffer?.read() ?? "";
+			return {
+				id,
+				store: connected,
+				serverStatus: {
+					status: "timeout",
+					stderr
+				},
+				change: null,
+				error: null,
+				tools: null
+			};
+		}
+		let mcpTools;
+		try {
+			mcpTools = (await connected.client.listTools()).tools;
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			const stderr = connected.stderrBuffer?.read() ?? "";
+			return {
+				id,
+				store: connected,
+				serverStatus: {
+					status: "failed",
+					error: message,
+					stderr
+				},
+				change: null,
+				error: {
+					serverId: id,
+					message
+				},
+				tools: null
+			};
+		}
+		return {
+			id,
+			store: connected,
+			serverStatus: { status: "connected" },
+			change: action === "reused" ? null : action,
+			error: null,
+			tools: {
+				client: connected.client,
+				list: mcpTools
+			}
+		};
+	}
+	async reconcileAndRecordMtime({ pi, configPath, reason }) {
+		const summary = await this.reconcile({
+			pi,
+			configPath
+		});
+		this.lastConfigMtimeMs = await readConfigMtimeMs(configPath);
+		if (reason !== "session_start" && summaryHasChanges(summary)) this.pendingMcpUpdate = summary;
+		log$12.info({
+			event: "mcp_reconcile",
+			reason,
+			total_tools: summary.totalTools,
+			added: summary.added,
+			removed: summary.removed,
+			refreshed: summary.refreshed,
+			errors: summary.errors,
+			queued_continuation: reason !== "session_start" && summaryHasChanges(summary)
+		}, "MCP reconcile complete");
+		return summary;
+	}
+	asExtensionFactory() {
+		return (pi) => {
+			pi.on("session_start", async (_event, ctx) => {
+				const configPath = join(ctx.cwd, MCP_CONFIG_FILENAME);
+				try {
+					await this.reconcileAndRecordMtime({
+						pi,
+						configPath,
+						reason: "session_start"
+					});
+				} catch (err) {
+					log$12.error({
+						err,
+						event: "mcp_reconcile_failed"
+					}, "MCP reconcile failed");
+				}
+			});
+			pi.on("tool_result", async (_event, ctx) => {
+				const configPath = join(ctx.cwd, MCP_CONFIG_FILENAME);
+				let mtime;
+				try {
+					mtime = await readConfigMtimeMs(configPath);
+				} catch (err) {
+					log$12.warn({
+						err,
+						event: "mcp_mtime_check_failed"
+					}, "mtime check on mcp.config.json failed");
+					return;
+				}
+				if (mtime === this.lastConfigMtimeMs) return;
+				try {
+					await this.reconcileAndRecordMtime({
+						pi,
+						configPath,
+						reason: "auto_reload"
+					});
+				} catch (err) {
+					log$12.error({
+						err,
+						event: "mcp_auto_reload_failed"
+					}, "auto-reload after mcp.config.json change failed");
+				}
+			});
+			pi.registerTool({
+				name: "reload_mcp",
+				label: "Reload MCP servers (fallback)",
+				description: "Re-read mcp.config.json and reconcile MCP server connections. You usually do NOT need to call this — edits to mcp.config.json are detected automatically and the harness injects a follow-up turn that picks up the new tool set. Call it explicitly only when the config didn't change but the environment did: e.g. you just `pip install`'d a Python package that an existing MCP server's command needs to spawn, and you want to retry the connection without touching the file. The harness will inject a continuation turn after this call so the new tool inventory is visible.",
+				parameters: Type.Object({}),
+				execute: async (_toolCallId, _params, _signal, _onUpdate, ctx) => {
+					const configPath = join(ctx.cwd, MCP_CONFIG_FILENAME);
+					try {
+						const summary = await this.reconcileAndRecordMtime({
+							pi,
+							configPath,
+							reason: "tool"
+						});
+						return {
+							content: [{
+								type: "text",
+								text: summaryText(summary)
+							}],
+							details: {
+								toolCount: summary.totalTools,
+								summary
+							}
+						};
+					} catch (err) {
+						const message = err instanceof Error ? err.message : String(err);
+						return {
+							content: [{
+								type: "text",
+								text: `reload_mcp failed: ${message}`
+							}],
+							details: { error: message }
+						};
+					}
+				}
+			});
+		};
+	}
+};
+const defaultMcp = new McpExtension();
+defaultMcp.reconcile.bind(defaultMcp);
+const consumePendingMcpUpdate = defaultMcp.consumePendingUpdate.bind(defaultMcp);
+const hasPendingMcpUpdate = defaultMcp.hasPendingUpdate.bind(defaultMcp);
+var mcp_default = defaultMcp.asExtensionFactory();
+function pendingAuthEntries(summary) {
+	return Object.entries(summary.servers).flatMap(([id, status]) => status.status === "pending_auth" ? [{
+		id,
+		stderr: status.stderr,
+		cliHint: status.cliHint
+	}] : []);
+}
+function timeoutEntries(summary) {
+	return Object.entries(summary.servers).flatMap(([id, status]) => status.status === "timeout" ? [{
+		id,
+		stderr: status.stderr
+	}] : []);
+}
+function failedEntries(summary) {
+	return Object.entries(summary.servers).flatMap(([id, status]) => status.status === "failed" ? [{
+		id,
+		error: status.error,
+		stderr: status.stderr
+	}] : []);
+}
+function appendStderrBlock(lines, stderr) {
+	if (!stderr) return;
+	lines.push("    stderr:");
+	lines.push("    ---");
+	for (const line of stderr.trimEnd().split("\n")) lines.push(`    ${line}`);
+	lines.push("    ---");
+}
+function summaryText(summary) {
+	const lines = [];
+	lines.push(`MCP reconcile complete: ${summary.totalTools} tool(s) live.`);
+	if (summary.added.length > 0) lines.push(`  Added: ${summary.added.join(", ")}`);
+	if (summary.refreshed.length > 0) lines.push(`  Refreshed: ${summary.refreshed.join(", ")}`);
+	if (summary.removed.length > 0) lines.push(`  Removed: ${summary.removed.join(", ")}`);
+	for (const { id, stderr, cliHint } of pendingAuthEntries(summary)) {
+		lines.push(`  WAITING ON AUTH ${id}:`);
+		lines.push(`    run \`${cliHint}\` in the shell to authenticate.`);
+		appendStderrBlock(lines, stderr);
+	}
+	for (const { id, stderr } of timeoutEntries(summary)) {
+		lines.push(`  TIMED OUT ${id}:`);
+		lines.push(`    bridge spawned but did not complete initialize in time`);
+		lines.push(`    (usually mcp-remote mid-OAuth — see captured stderr).`);
+		appendStderrBlock(lines, stderr);
+	}
+	for (const { id, error, stderr } of failedEntries(summary)) {
+		lines.push(`  FAILED ${id}: ${error}`);
+		appendStderrBlock(lines, stderr);
+	}
+	for (const err of summary.errors) {
+		if (summary.servers[err.serverId]?.status === "failed") continue;
+		lines.push(`  ERROR ${err.serverId}: ${err.message}`);
+	}
+	return lines.join("\n");
+}
+function summaryHasChanges(summary) {
+	return summary.added.length > 0 || summary.removed.length > 0 || summary.refreshed.length > 0 || summary.errors.length > 0;
+}
+/**
+* Format a queued tool-update as a synthetic system-style message for
+* the harness to inject as a continuation prompt. The agent reads this
+* on its next turn (which has a fresh tool-snapshot) and acts on the
+* new set.
+*/
+function formatMcpUpdateMessage(summary) {
+	const lines = ["[system] Your MCP tool inventory changed during the previous turn. Your tool list is now updated; act on the new set rather than what was visible before."];
+	if (summary.added.length > 0) lines.push(`Newly available servers: ${summary.added.join(", ")}`);
+	if (summary.refreshed.length > 0) lines.push(`Refreshed servers: ${summary.refreshed.join(", ")}`);
+	if (summary.removed.length > 0) lines.push(`Removed servers (and their tools): ${summary.removed.join(", ")}`);
+	const pending = pendingAuthEntries(summary);
+	if (pending.length > 0) {
+		lines.push("");
+		lines.push("Servers awaiting OAuth (http transport returned 401):");
+		for (const { id, stderr, cliHint } of pending) {
+			lines.push(`  - ${id}:`);
+			lines.push(`    run \`${cliHint}\` to authenticate`);
+			appendStderrBlock(lines, stderr);
+		}
+		lines.push("After authentication completes, call `reload_mcp` to pick up the now-connected tools — the harness won't reconcile on its own until you do.");
+	}
+	const timedOut = timeoutEntries(summary);
+	if (timedOut.length > 0) {
+		lines.push("");
+		lines.push("Servers that timed out during initialize (bridge is still alive in the background; usually mcp-remote-style stdio bridges mid-OAuth):");
+		for (const { id, stderr } of timedOut) {
+			lines.push(`  - ${id}:`);
+			appendStderrBlock(lines, stderr);
+		}
+		lines.push("If the bridge prints an auth URL in its stderr, share it with the user. Then call `reload_mcp` once they've finished.");
+	}
+	const failed = failedEntries(summary);
+	if (failed.length > 0) {
+		lines.push("");
+		lines.push("Servers that failed to start:");
+		for (const { id, error, stderr } of failed) {
+			lines.push(`  - ${id}: ${error}`);
+			appendStderrBlock(lines, stderr);
+		}
+	}
+	const unstructuredErrors = summary.errors.filter((e) => summary.servers[e.serverId]?.status !== "failed");
+	if (unstructuredErrors.length > 0) {
+		lines.push("Errors:");
+		for (const err of unstructuredErrors) lines.push(`  - ${err.serverId}: ${err.message}`);
+	}
+	if (summary.added.filter((id) => summary.servers[id]?.status === "connected").length > 0) lines.push(CAPABILITY_SOUL_NUDGE);
+	lines.push("Continue from where you left off, using the current tool list. Do not re-do work that already succeeded last turn.");
+	return lines.join("\n");
+}
+//#endregion
+//#region src/tool-update-loop.ts
+const MAX_TOOL_UPDATE_CONTINUATIONS = 3;
+function installToolUpdateAutoStop({ session, log }) {
+	const agent = session.agent;
+	if (typeof agent.createLoopConfig !== "function") throw new Error("installToolUpdateAutoStop: session.agent.createLoopConfig is missing — pi-agent-core internals changed; update tool-update-loop.ts.");
+	const original = agent.createLoopConfig.bind(agent);
+	agent.createLoopConfig = (options) => {
+		return {
+			...original(options),
+			shouldStopAfterTurn: (ctx) => {
+				if (ctx.message.stopReason === "error" || ctx.message.stopReason === "aborted") return false;
+				const stop = hasPendingMcpUpdate() || hasPendingLocalToolsUpdate();
+				if (stop) log.info({
+					event: "tool_update_auto_stop_after_turn",
+					mcp: hasPendingMcpUpdate(),
+					local_tools: hasPendingLocalToolsUpdate()
+				}, "ending turn so next prompt() snapshots refreshed tool list");
+				return stop;
+			}
+		};
+	};
+}
+async function runToolUpdateLoop({ session, log }) {
+	for (let i = 0; i < MAX_TOOL_UPDATE_CONTINUATIONS; i++) {
+		const mcpUpdate = consumePendingMcpUpdate();
+		const localToolsUpdate = consumePendingLocalToolsUpdate();
+		if (!mcpUpdate && !localToolsUpdate) return;
+		const parts = [];
+		if (mcpUpdate) parts.push(formatMcpUpdateMessage(mcpUpdate));
+		if (localToolsUpdate) parts.push(formatLocalToolsUpdateMessage(localToolsUpdate));
+		const content = parts.join("\n\n");
+		log.info({
+			event: "tool_update_continuation_injected",
+			iteration: i + 1,
+			mcp: mcpUpdate ? {
+				added: mcpUpdate.added,
+				removed: mcpUpdate.removed,
+				refreshed: mcpUpdate.refreshed
+			} : null,
+			mcp_servers: mcpUpdate?.servers ?? null,
+			local_tools: localToolsUpdate ? {
+				added: localToolsUpdate.added,
+				removed: localToolsUpdate.removed,
+				refreshed: localToolsUpdate.refreshed
+			} : null,
+			formatted_content: content
+		}, "injecting tool-update continuation prompt");
+		await session.reload();
+		await session.bindExtensions({});
+		const customType = mcpUpdate && localToolsUpdate ? "tool-update" : mcpUpdate ? "mcp-tool-update" : "local-tools-update";
+		await session.sendCustomMessage({
+			customType,
+			content,
+			display: false,
+			details: {
+				mcp: mcpUpdate,
+				localTools: localToolsUpdate
+			}
+		}, { triggerTurn: true });
+	}
+	if (consumePendingMcpUpdate() || consumePendingLocalToolsUpdate()) log.warn({
+		event: "tool_update_continuation_capped",
+		cap: MAX_TOOL_UPDATE_CONTINUATIONS
+	}, "reached tool-update continuation cap; further updates will land on next request");
+}
+//#endregion
+//#region src/tracing.ts
+const SERVICE_NAME = "skydive-agent-harness";
+const DAEMON_TRACES_URL = "http://localhost:38994/v1/traces";
+let provider = null;
+function initTracing() {
+	if (provider) return;
+	propagation.setGlobalPropagator(new W3CTraceContextPropagator());
+	provider = new NodeTracerProvider({ resource: new Resource({ [ATTR_SERVICE_NAME]: SERVICE_NAME }) });
+	const exporter = new OTLPTraceExporter({ url: DAEMON_TRACES_URL });
+	provider.addSpanProcessor(new BatchSpanProcessor(exporter, { scheduledDelayMillis: 1e3 }));
+	provider.register();
+	logger.info({
+		event: "tracing_enabled",
+		endpoint: DAEMON_TRACES_URL
+	}, "OTel tracing initialized — exporting via daemon");
+	const shutdown = async () => {
+		await shutdownTracing();
+		process.exit(0);
+	};
+	process.on("SIGTERM", shutdown);
+	process.on("SIGINT", shutdown);
+}
+function getTracer() {
+	return trace.getTracer(SERVICE_NAME);
+}
+function extractRemoteContext() {
+	const traceparent = getCurrentTraceparent();
+	if (!traceparent) return ROOT_CONTEXT;
+	const carrier = { traceparent };
+	return propagation.extract(ROOT_CONTEXT, carrier, {
+		get: (c, key) => c[key],
+		keys: (c) => Object.keys(c)
+	});
+}
+async function shutdownTracing() {
+	if (provider) await provider.shutdown();
+}
+//#endregion
+//#region src/harness.ts
+/**
+* Skydive composition over @skydiveai/pi-server: wires the platform
+* defaults (tracing to the daemon, tool-update hot-reload hooks, prewarm
+* paths, header passthrough for proxy routing, Skydive agent-card
+* branding) into the generic protocol server, and returns mountable
+* handlers. The agent supplies the pi session factory (their session.ts)
+* and owns the express app:
+*
+*   const { platform, protocols } = createHarness({
+*     cwd: process.cwd(),
+*     createSession,
+*   });
+*   app.get('/health', platform.handlers.health);
+*   app.use(platform.handlers.injectEnv);
+*   app.use(platform.handlers.prewarm); // matches /_skydive/prewarm + legacy alias
+*   app.use(protocols.handlers.all);
+*/
+const A2A_PATH = "/a2a";
+const AGENT_CARD_PATH = "/.well-known/agent-card.json";
+const PREWARM_PATHS = ["/_skydive/prewarm", "/_anyone/prewarm"];
+const PASSTHROUGH_HEADER_PREFIXES = ["x-anyone-", "x-skydive-"];
+function createHarness(options) {
+	initTracing();
+	readPlatformVersions().then((runtimeVersions) => logger.info({
+		event: "runtime_versions",
+		runtimeVersions
+	}, "platform runtime versions"));
+	const serverOptions = {
+		...options,
+		onSessionSetup: options.onSessionSetup ?? ((args) => {
+			installToolUpdateAutoStop(args);
+			installIterationCap(args);
+		}),
+		postPrompt: options.postPrompt ?? runToolUpdateLoop,
+		passthroughHeaderPrefixes: options.passthroughHeaderPrefixes ?? PASSTHROUGH_HEADER_PREFIXES,
+		prewarmPaths: options.prewarmPaths ?? PREWARM_PATHS
+	};
+	const webHandlers = createProtocolHandlers(serverOptions);
+	const cardOverrides = {
+		name: "Skydive Agent",
+		description: "An AI coding agent powered by the Skydive platform.",
+		...options.agentCard
+	};
+	const agentCardWeb = async (request) => {
+		const url = new URL(request.url);
+		if (request.method !== "GET" || url.pathname !== AGENT_CARD_PATH) return null;
+		return Response.json(buildAgentCard(cardOverrides.url ?? `${url.origin}${A2A_PATH}`, cardOverrides));
+	};
+	const a2a = restHandler({
+		requestHandler: new DefaultRequestHandler(buildAgentCard(cardOverrides.url ?? A2A_PATH, cardOverrides), new InMemoryTaskStore(), createAgentExecutor(serverOptions), new DefaultExecutionEventBusManager()),
+		userBuilder: UserBuilder.noAuthentication
+	});
+	return {
+		platform: { handlers: {
+			/**
+			* Platform health plus the agent's `healthMetadata`. Mount above
+			* injectEnv — health must respond immediately for prewarm
+			* stashing and readiness probes, and injectEnv can wait up to
+			* 10s for env vars during boot.
+			*/
+			health: createHealthHandler({ metadata: options.healthMetadata ?? null }),
+			/** Loads platform env (e2b envd / daemon long-poll). */
+			injectEnv: createPlatformEnvMiddleware(),
+			prewarm: webHandlerToMiddleware(webHandlers.prewarm)
+		} },
+		protocols: { handlers: {
+			/** Express-style; mount at /a2a. */
+			a2a,
+			/** GET /.well-known/agent-card.json. */
+			agentCard: webHandlerToMiddleware(agentCardWeb),
+			/** Mirrors each vendor's API shape. */
+			openai: { v1: {
+				chat: { completions: webHandlerToMiddleware(webHandlers.chatCompletions) },
+				responses: webHandlerToMiddleware(webHandlers.responses)
+			} },
+			anthropic: { v1: { messages: webHandlerToMiddleware(webHandlers.messages) } },
+			/**
+			* Everything in one mount: a2a (+ agent card) at their well-known
+			* paths, then chat-completions / anthropic-messages / responses.
+			* Calls next() when nothing matches.
+			*/
+			all: chainMiddleware([mountAt(A2A_PATH, a2a), webHandlerToMiddleware(composeHandlers([
+				agentCardWeb,
+				webHandlers.chatCompletions,
+				webHandlers.messages,
+				webHandlers.responses
+			]))])
+		} }
+	};
+}
+/** Effective bash timeout: the model's value when it gave a positive number, else the default. */
+function resolveBashTimeout(provided) {
+	return typeof provided === "number" && provided > 0 ? provided : 600;
+}
+const bashDefaultTimeoutExtension = (pi) => {
+	pi.on("tool_call", async (event) => {
+		if (event.toolName !== "bash") return;
+		event.input.timeout = resolveBashTimeout(event.input.timeout);
+	});
+};
+//#endregion
+//#region src/channel-context-ref.ts
+/**
+* The worker injects only a reference — `{ channel, messageId }` — into the
+* sandbox env (`SKYDIVE_CHANNEL_CONTEXT`) rather than the full context.
+*
+* The canonical `ChannelContextRef` type + `parseChannelContextRef` live in
+* `@createinc/anyone-channels`, but the harness (`@skydiveai/*`) keeps zero
+* `@createinc/*` dependencies — importing that package would pull the whole
+* platform channel stack (Slack/email/Linq SDKs, messaging) in just to read
+* two fields. So we validate the (stable) shape locally instead.
+*/
+const channelContextRefSchema = z.object({ messageId: z.string().nullable() });
+/**
+* Pull the current turn's message id out of the ref blob. Returns `null`
+* outside a turn (cron / system) or if the blob is missing/malformed.
+*/
+function extractMessageId(channelContextJson) {
+	if (!channelContextJson) return null;
+	try {
+		const parsed = channelContextRefSchema.safeParse(JSON.parse(channelContextJson));
+		return parsed.success ? parsed.data.messageId : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/api-url.ts
+/**
+* Resolve the Skydive API base URL from the sandbox env. Newly-provisioned
+* sandboxes get `ANYONE_API_URL` (see `apps/anyone/infra` stack); `SKYDIVE_API_URL`
+* is the legacy name that only already-provisioned sandboxes still carry, and
+* it won't be injected going forward. We check the legacy name first (matching
+* the other sandbox env readers, e.g. `platform.ts` and `anyone-platform-cli`)
+* and fall back to the current one. Returns `null` when neither is set (e.g.
+* local dev with no sandbox), which callers treat as "API unavailable".
+*/
+function apiBaseUrl() {
+	return process.env.SKYDIVE_API_URL ?? process.env.ANYONE_API_URL ?? null;
+}
+//#endregion
+//#region src/extensions/platform.ts
+/**
+* Platform extension — bridges the agent harness to the Skydive platform daemon.
+*
+* Responsibilities:
+* - Heartbeat: periodic POST to the API so the sandbox manager knows the
+*   agent is alive. Throttled to once per minute, triggered by tool events.
+* - Session tracking: registers the session with the daemon on start,
+*   streams tool_call / tool_result events so the daemon can track which
+*   session is actively executing, and signals session end on agent_end.
+* - Channel context: passes the SKYDIVE_CHANNEL_CONTEXT (containing the
+*   messageId) to the daemon so file writes can be attributed to the
+*   correct conversation.
+*
+* All daemon POSTs are fire-and-forget — failures are logged but never
+* block the agent. The daemon may not be running (e.g. local dev without
+* a sandbox), and that's fine.
+*/
+const HEARTBEAT_THROTTLE_MS = 6e4;
+const TOOL_HEARTBEAT_INTERVAL_MS = 5e3;
+const MAX_TOOL_HEARTBEATS = 1440 * 60 * 1e3 / TOOL_HEARTBEAT_INTERVAL_MS;
+const DAEMON_URL = "http://localhost:38994";
+const log$11 = logger.child({ module: "platform-ext" });
+function sandboxClient() {
+	const apiUrl = apiBaseUrl();
+	if (!apiUrl) return null;
+	return hc(`${apiUrl}/api/v1/sandbox`);
+}
+/**
+* Is this box still an unclaimed warm-pool sandbox? (ANY-6000, the
+* feature-flags half of the ANY-5184 pool 403 wave.)
+*
+* `GET /sandbox/feature-flags` is agent-only, so the shared poller's request
+* from a pool box can only 403 — a guaranteed-failing GET every 60s for the
+* life of the pool phase. The discriminator is the sandbox token's `type`
+* claim, read UNVERIFIED (this box never holds the signing secret): not an
+* authorization decision, only "should I bother calling?", and the api still
+* authorizes every request.
+*
+* Read per call from the daemon's persisted env file, NOT process.env:
+* claiming a pool box rebinds the token in place (the daemon rewrites this
+* file) while the harness's process.env keeps the boot snapshot, so a
+* process-env gate would leave a claimed box permanently skipping — trading a
+* wasted request for silently frozen flags, which is strictly worse. "Cannot
+* tell" (no file, no token, unparseable payload) reports false so the poll
+* proceeds.
+*/
+const daemonEnvIdentitySchema = z.object({
+	ANYONE_SANDBOX_TOKEN: z.string().optional(),
+	SKYDIVE_SANDBOX_TOKEN: z.string().optional()
+}).passthrough();
+const tokenTypeSchema = z.object({ type: z.string() }).passthrough();
+async function isPoolIdentity() {
+	try {
+		const envFile = process.env.ANYONE_DAEMON_ENV_CACHE ?? "/tmp/.anyone/daemon-env.json";
+		const env = daemonEnvIdentitySchema.safeParse(JSON.parse(await readFile(envFile, "utf8")));
+		if (!env.success) return false;
+		const token = env.data.ANYONE_SANDBOX_TOKEN ?? env.data.SKYDIVE_SANDBOX_TOKEN;
+		if (typeof token !== "string" || token === "") return false;
+		const payload = token.split(".")[1];
+		if (!payload) return false;
+		const claims = tokenTypeSchema.safeParse(JSON.parse(Buffer.from(payload, "base64url").toString("utf8")));
+		return claims.success && claims.data.type === "onboarding-pool";
+	} catch (_err) {
+		return false;
+	}
+}
+/**
+* Fetch every harness feature flag in one GET (`{ contextManagement, ... }`
+* — see apps/anyone/api/src/routes/sandbox-feature-flags.ts). Returns
+* null when indeterminate (no api url, the request failed, or the box is an
+* unclaimed pool sandbox whose token the route would 403) so the shared
+* poller keeps the last-known values rather than flipping on a transient error.
+* This is the single fetch behind `feature-flags-poll.ts`; extensions read the
+* polled values there instead of issuing their own GET.
+*/
+async function fetchHarnessFlags() {
+	const client = sandboxClient();
+	if (!client) return null;
+	if (await isPoolIdentity()) return null;
+	try {
+		const res = await client["feature-flags"].$get();
+		if (!res.ok) {
+			log$11.debug({
+				status: res.status,
+				event: "feature_flags_fetch_failed"
+			}, "feature-flags fetch failed");
+			return null;
+		}
+		return { contextManagement: (await res.json()).contextManagement ?? null };
+	} catch (err) {
+		log$11.debug({
+			err,
+			event: "feature_flags_fetch_error"
+		}, "feature-flags request errored");
+		return null;
+	}
+}
+function postHeartbeat({ messageId }) {
+	const client = sandboxClient();
+	if (!client) return;
+	client.heartbeat.$post({ json: { messageId } }).catch((err) => {
+		log$11.debug({
+			err,
+			event: "heartbeat_failed"
+		}, "heartbeat failed");
+	});
+}
+async function resolveConversationFromApi(messageId) {
+	const client = sandboxClient();
+	if (!client) return null;
+	try {
+		const res = await client["message-conversation"].$get({ query: { messageId } });
+		if (!res.ok) {
+			log$11.warn({
+				status: res.status,
+				messageId,
+				event: "resolve_conversation_failed"
+			}, "resolve conversation failed");
+			return null;
+		}
+		return (await res.json()).conversationId ?? null;
+	} catch (err) {
+		log$11.warn({
+			err,
+			messageId,
+			event: "resolve_conversation_error"
+		}, "resolve conversation request errored");
+		return null;
+	}
+}
+async function postBackgroundTaskDone({ messageId, content }) {
+	const client = sandboxClient();
+	if (!client) throw new Error("no api url for bg-task-done");
+	const res = await client["bg-task-done"].$post({ json: {
+		messageId,
+		content
+	} });
+	if (!res.ok) throw new Error(`bg-task-done POST failed: ${res.status}`);
+}
+async function postSubagentSpawn({ messageId, tasks }) {
+	const client = sandboxClient();
+	if (!client) throw new Error("no api url for subagent-spawn");
+	const res = await client["subagent-spawn"].$post({ json: {
+		messageId,
+		tasks
+	} });
+	if (!res.ok) {
+		let detail = "";
+		try {
+			const errBody = await res.json();
+			if (errBody && typeof errBody.error === "string") detail = `: ${errBody.error}`;
+		} catch {}
+		throw new Error(`subagent-spawn POST failed (${res.status})${detail}`);
+	}
+	const body = await res.json();
+	return {
+		taskIds: body.taskIds,
+		tasks: body.tasks ?? []
+	};
+}
+function createHeartbeatThrottle({ messageId }) {
+	let lastAt = 0;
+	let pending = null;
+	function send() {
+		const now = Date.now();
+		if (now - lastAt < HEARTBEAT_THROTTLE_MS) {
+			if (!pending) pending = setTimeout(() => {
+				pending = null;
+				send();
+			}, HEARTBEAT_THROTTLE_MS - (now - lastAt));
+			return;
+		}
+		lastAt = now;
+		postHeartbeat({ messageId });
+	}
+	function cancel() {
+		if (pending) {
+			clearTimeout(pending);
+			pending = null;
+		}
+	}
+	return {
+		send,
+		cancel
+	};
+}
+function createToolHeartbeat({ messageId }) {
+	const activeToolCalls = /* @__PURE__ */ new Set();
+	let interval = null;
+	let heartbeatCount = 0;
+	function stop() {
+		if (interval) {
+			clearInterval(interval);
+			interval = null;
+		}
+		heartbeatCount = 0;
+	}
+	function start() {
+		if (interval) return;
+		heartbeatCount = 0;
+		interval = setInterval(() => {
+			if (activeToolCalls.size === 0) {
+				stop();
+				return;
+			}
+			heartbeatCount++;
+			if (heartbeatCount > MAX_TOOL_HEARTBEATS) {
+				log$11.warn({
+					heartbeatCount,
+					activeToolCalls: [...activeToolCalls]
+				}, "tool heartbeat max reached, stopping");
+				stop();
+				return;
+			}
+			postHeartbeat({ messageId });
+		}, TOOL_HEARTBEAT_INTERVAL_MS);
+	}
+	return {
+		onToolStart(toolCallId) {
+			activeToolCalls.add(toolCallId);
+			start();
+		},
+		onToolEnd(toolCallId) {
+			activeToolCalls.delete(toolCallId);
+			if (activeToolCalls.size === 0) stop();
+		},
+		stop,
+		get activeCount() {
+			return activeToolCalls.size;
+		}
+	};
+}
+function postToDaemon(path, body) {
+	fetch(`${DAEMON_URL}${path}`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	}).catch((err) => {
+		log$11.debug({
+			err,
+			path,
+			event: "daemon_post_failed"
+		}, "daemon POST failed");
+	});
+}
+function createPlatformExtensions({ sessionId, channelContext }) {
+	return (pi) => {
+		log$11.info({
+			sessionId,
+			hasChannelContext: Boolean(channelContext)
+		}, "platform extension initialized");
+		const messageId = extractMessageId(channelContext);
+		const throttle = createHeartbeatThrottle({ messageId });
+		const deferHeartbeat = () => {
+			setTimeout(throttle.send, 0);
+		};
+		pi.on("agent_start", deferHeartbeat);
+		pi.on("tool_execution_start", deferHeartbeat);
+		pi.on("tool_execution_end", deferHeartbeat);
+		pi.on("tool_execution_update", deferHeartbeat);
+		pi.on("agent_end", deferHeartbeat);
+		const toolHeartbeat = createToolHeartbeat({ messageId });
+		pi.on("tool_execution_start", (event) => {
+			toolHeartbeat.onToolStart(event.toolCallId);
+		});
+		pi.on("tool_execution_end", (event) => {
+			toolHeartbeat.onToolEnd(event.toolCallId);
+		});
+		pi.on("agent_end", () => {
+			toolHeartbeat.stop();
+			throttle.cancel();
+		});
+		postToDaemon("/session", {
+			sessionId,
+			channelContext
+		});
+		pi.on("tool_call", (event) => {
+			postToDaemon("/session/tool-event", {
+				sessionId,
+				kind: "tool_call",
+				toolName: event.toolName,
+				toolCallId: event.toolCallId,
+				input: event.input
+			});
+		});
+		pi.on("tool_result", (event) => {
+			postToDaemon("/session/tool-event", {
+				sessionId,
+				kind: "tool_result",
+				toolName: event.toolName,
+				toolCallId: event.toolCallId,
+				isError: event.isError,
+				input: event.input
+			});
+		});
+		pi.on("agent_end", () => {
+			log$11.info({ sessionId }, "session ending");
+			postToDaemon("/session/end", { sessionId });
+		});
+	};
+}
+//#endregion
+//#region src/extensions/feature-flags-poll.ts
+/**
+* Shared harness feature-flag poll.
+*
+* The api exposes one `/feature-flags` GET that returns every harness flag in a
+* single response (`{ contextManagement, commandFlags }` — see
+* apps/anyone/api/src/routes/sandbox-feature-flags.ts). Rather than each
+* extension issuing its own GET — and, worse, a *blocking* GET on the
+* pre-first-token `session_start` path — a single background poller fetches
+* that response once per interval and fans the values out to every subscriber.
+*
+* Why one poller: context-management consumes the `contextManagement` flag
+* without a blocking GET on the pre-first-token `session_start` path. Reading
+* the last-polled value keeps the hot path allocation-only; a cold cache reads
+* as `null` and a newly-flipped flag takes effect on the next poll.
+*
+* The poll is fire-and-forget and self-unref'd — it never keeps the process
+* alive and an indeterminate result (no api url / transient failure) leaves the
+* last-known values untouched so a blip can't silently flip behavior.
+*/
+const log$10 = logger.child({ module: "feature-flags-poll" });
+const FLAG_POLL_INTERVAL_MS = 6e4;
+let contextManagement = null;
+const subscribers = { contextManagement: /* @__PURE__ */ new Set() };
+let pollerStarted = false;
+let firstPollSettled = false;
+let resolveFirstPoll = null;
+new Promise((resolve) => {
+	resolveFirstPoll = resolve;
+});
+function markFirstPollSettled() {
+	if (firstPollSettled) return;
+	firstPollSettled = true;
+	resolveFirstPoll?.();
+}
+/** Last-polled value of a flag, or `null` if not yet resolved. */
+function getPolledFlag(_name) {
+	return contextManagement;
+}
+/**
+* Subscribe to changes of a flag. The callback fires only on a *transition*
+* (skipped while the value is unchanged), so a subscriber registered before the
+* first poll still learns the initial value. Returns an unsubscribe fn.
+*/
+function onFlagChange(name, cb) {
+	subscribers[name].add(cb);
+	return () => subscribers[name].delete(cb);
+}
+function apply(name, next) {
+	if (next === null) return;
+	const prev = contextManagement;
+	contextManagement = next;
+	if (next !== prev) for (const cb of subscribers[name]) try {
+		cb(next);
+	} catch (err) {
+		log$10.warn({
+			err,
+			flag: name
+		}, "flag subscriber threw");
+	}
+}
+async function pollOnce() {
+	try {
+		const flags = await fetchHarnessFlags();
+		if (!flags) return;
+		apply("contextManagement", flags.contextManagement ?? null);
+	} catch (err) {
+		log$10.debug({ err }, "feature-flag poll threw");
+	}
+}
+/**
+* Start the shared background poll (idempotent). No-op when there's no
+* phone-home channel (bare CLI): there's nothing to poll and callers keep their
+* env/boot default. Kicks an immediate poll, then repeats on an interval that
+* does not keep the process alive.
+*/
+function startFeatureFlagPoller() {
+	if (pollerStarted || !hasFlagSource()) return;
+	pollerStarted = true;
+	pollOnce().finally(markFirstPollSettled);
+	setInterval(() => void pollOnce(), FLAG_POLL_INTERVAL_MS).unref?.();
+}
+//#endregion
+//#region src/extensions/context-management-trim.ts
+const CLEARED_PLACEHOLDER = "[old tool result cleared to save context — re-run the tool or re-read the source to recover it]";
+/** Rough token estimate (~4 chars/token); good enough for trigger decisions. */
+function estimateTokens(text) {
+	return Math.ceil(text.length / 4);
+}
+function isToolResult(message) {
+	return message.role === "toolResult";
+}
+function isTextBlock(block) {
+	return block.type === "text";
+}
+function joinText(content) {
+	return content.filter(isTextBlock).map((block) => block.text).join("");
+}
+function isCleared(content) {
+	const first = content[0];
+	return content.length === 1 && first !== void 0 && first.type === "text" && first.text === CLEARED_PLACEHOLDER;
+}
+/**
+* Returns a head/tail excerpt of `text` that fits within `maxBytes`, or null
+* if `text` is already within budget. Idempotent: the excerpt itself is within
+* budget, so re-running yields null.
+*/
+function excerpt(text, maxBytes) {
+	if (Buffer.byteLength(text) <= maxBytes) return null;
+	const removedNotice = (removed) => `\n\n…[${removed} bytes truncated — re-run the tool or re-read the source for the full output]…\n\n`;
+	const sample = removedNotice(Buffer.byteLength(text));
+	const noticeBytes = Buffer.byteLength(sample);
+	const budget = Math.max(maxBytes - noticeBytes, 0);
+	if (budget < 64) return text.slice(0, Math.max(maxBytes, 0));
+	const headChars = Math.floor(budget * .6);
+	const tailChars = Math.floor(budget * .3);
+	const head = text.slice(0, headChars);
+	const tail = text.slice(text.length - tailChars);
+	return `${head}${removedNotice(Buffer.byteLength(text) - Buffer.byteLength(head) - Buffer.byteLength(tail))}${tail}`;
+}
+/**
+* Transforms the message list in place (callers pass a clone) applying L1
+* insertion trimming and L2/L3 microcompact. Never throws.
+*/
+function transformContextMessages(messages, config, now) {
+	const stats = {
+		trimmedResults: 0,
+		trimmedTokens: 0,
+		clearedResults: 0,
+		clearedTokens: 0,
+		clearTrigger: "none",
+		remainingToolTokens: 0
+	};
+	const excluded = new Set(config.excludeTools);
+	const toolResults = messages.filter((message) => isToolResult(message) && !excluded.has(message.toolName));
+	for (const result of toolResults) {
+		if (isCleared(result.content)) continue;
+		const joined = joinText(result.content);
+		const trimmed = excerpt(joined, config.perResultMaxBytes);
+		if (trimmed === null) continue;
+		const images = result.content.filter((block) => block.type === "image");
+		result.content = [{
+			type: "text",
+			text: trimmed
+		}, ...images];
+		stats.trimmedResults += 1;
+		stats.trimmedTokens += estimateTokens(joined) - estimateTokens(trimmed);
+	}
+	const clearable = toolResults.filter((result) => !isCleared(result.content)).slice(0, Math.max(toolResults.length - config.keepRecentToolResults, 0));
+	const clearableTokens = clearable.reduce((sum, result) => sum + estimateTokens(joinText(result.content)), 0);
+	const lastActivity = messages.reduce((max, message) => {
+		if (message.role !== "assistant" && message.role !== "toolResult") return max;
+		return Math.max(max, message.timestamp ?? 0);
+	}, 0);
+	const isCold = lastActivity > 0 && now - lastActivity > config.coldCacheGapSeconds * 1e3;
+	if (clearable.length > 0 && (isCold || clearableTokens >= config.warmClearTriggerTokens && clearableTokens >= config.clearAtLeastTokens)) {
+		stats.clearTrigger = isCold ? "cold" : "warm";
+		for (const result of clearable) {
+			stats.clearedTokens += estimateTokens(joinText(result.content));
+			result.content = [{
+				type: "text",
+				text: CLEARED_PLACEHOLDER
+			}];
+			stats.clearedResults += 1;
+		}
+	}
+	stats.remainingToolTokens = toolResults.reduce((sum, result) => sum + estimateTokens(joinText(result.content)), 0);
+	return {
+		messages,
+		stats
+	};
+}
+//#endregion
+//#region src/extensions/context-management.ts
+const log$9 = logger.child({ module: "context-management-extension" });
+function isAnthropicMessagesPayload(payload) {
+	if (typeof payload !== "object" || payload === null) return false;
+	const candidate = payload;
+	return typeof candidate.model === "string" && candidate.model.includes("claude") && Array.isArray(candidate.messages);
+}
+function buildAnthropicEdits(config) {
+	return [{
+		type: "clear_tool_uses_20250919",
+		trigger: {
+			type: "input_tokens",
+			value: config.warmClearTriggerTokens
+		},
+		keep: {
+			type: "tool_uses",
+			value: config.keepRecentToolResults
+		},
+		clear_at_least: {
+			type: "input_tokens",
+			value: config.clearAtLeastTokens
+		},
+		...config.excludeTools.length > 0 ? { exclude_tools: config.excludeTools } : {}
+	}, { type: "clear_thinking_20251015" }];
+}
+/**
+* L4 body-field injection (pure). Returns the payload untouched unless the
+* feature is on, native edits are enabled, the payload is an Anthropic messages
+* request, and it doesn't already carry a `context_management` field.
+*/
+function applyNativeAnthropicEdits(payload, config) {
+	if (!config.enabled || !config.nativeAnthropicEdits) return payload;
+	if (!isAnthropicMessagesPayload(payload)) return payload;
+	if (payload.context_management !== void 0) return payload;
+	return {
+		...payload,
+		context_management: { edits: buildAnthropicEdits(config) }
+	};
+}
+/**
+* L1–L3 transform behind the enabled gate (pure). When disabled, returns the
+* messages untouched and `stats: null`.
+*/
+function transformContextIfEnabled(messages, config, now) {
+	if (!config.enabled) return {
+		messages,
+		stats: null
+	};
+	const result = transformContextMessages(messages, config, now);
+	return {
+		messages: result.messages,
+		stats: result.stats
+	};
+}
+/**
+* Builds the context-management extension. Reads the live (override-aware)
+* config from the runtime holder on every call, so the platform flag can flip
+* the feature on/off mid-session.
+*/
+function createContextManagementExtension() {
+	return (pi) => {
+		const initial = getContextManagementConfig();
+		if (!initial.enabled && !hasFlagSource()) return;
+		setContextManagementFlagOverride(getPolledFlag("contextManagement"));
+		onFlagChange("contextManagement", (enabled) => {
+			setContextManagementFlagOverride(enabled);
+			log$9.info({
+				event: "context_management_flag_update",
+				enabled
+			}, "context-management flag updated from platform");
+		});
+		startFeatureFlagPoller();
+		log$9.info({
+			event: "context_management_registered",
+			enabled: initial.enabled,
+			flagSource: hasFlagSource(),
+			perResultMaxBytes: initial.perResultMaxBytes,
+			keepRecentToolResults: initial.keepRecentToolResults,
+			nativeAnthropicEdits: initial.nativeAnthropicEdits
+		}, "context-management handlers registered");
+		pi.on("context", (event) => {
+			const { messages } = event;
+			try {
+				const result = transformContextIfEnabled(messages, getContextManagementConfig(), Date.now());
+				if (result.stats && (result.stats.clearedResults > 0 || result.stats.trimmedResults > 0)) log$9.info({
+					event: "context_management_applied",
+					...result.stats
+				}, "trimmed/cleared tool output before LLM call");
+				return { messages: result.messages };
+			} catch (err) {
+				log$9.error({
+					err,
+					event: "context_management_transform_failed"
+				}, "context transform failed; passing messages through unchanged");
+				return { messages };
+			}
+		});
+		pi.on("before_provider_request", (event) => applyNativeAnthropicEdits(event.payload, getContextManagementConfig()));
+	};
+}
+//#endregion
+//#region src/extensions/current-time.ts
+const log$8 = logger.child({ module: "current-time-extension" });
+const PI_DATE_LINE = /^Current date:.*$/m;
+function formatCurrentTimeLine(now) {
+	return `Current date: ${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}-${String(now.getUTCDate()).padStart(2, "0")} (${new Intl.DateTimeFormat("en-US", {
+		weekday: "long",
+		timeZone: "UTC"
+	}).format(now)} UTC)`;
+}
+const currentTimeExtension = (pi) => {
+	pi.on("before_agent_start", (event) => {
+		const line = formatCurrentTimeLine(/* @__PURE__ */ new Date());
+		const base = event.systemPrompt;
+		if (PI_DATE_LINE.test(base)) {
+			log$8.info({ event: "pi_date_line_present" }, "pi base prompt carries its own 'Current date:' line again; replacing it in place (pi prompt format may have changed)");
+			return { systemPrompt: base.replace(PI_DATE_LINE, line) };
+		}
+		return { systemPrompt: `${base}\n${line}` };
+	});
+};
+//#endregion
+//#region src/memory.ts
+/**
+* In-harness memory index builder.
+*
+* The agent has an agent-level file-based memory at `<cwd>/.memory/`,
+* organized by directory:
+*
+*   .memory/users/<id>-<name>/<topic>.md
+*   .memory/projects/<project_slug>/<topic>.md
+*   .memory/feedback/<topic>.md
+*   .memory/reference/<topic>.md
+*
+* The path encodes type and subject (for `users/`, the subject is the
+* person's stable id with a readable name suffix); each `.md` file's
+* frontmatter only carries `name` and `description`.
+*
+* `buildMemoryIndex` walks `.memory/` by type directory, reads only the
+* frontmatter of each `.md` (open fd → read first ~4KB → close, in
+* parallel), and renders a markdown index grouped by type and (where
+* applicable) by subject. Files outside the four type directories are
+* ignored. Bodies are never read — the agent loads a specific memory's
+* body on demand via the `read` tool when the index entry says it's
+* relevant.
+*
+* Mtime cache keyed by cwd — within the lifetime of a sandbox the cwd
+* is fixed, so this is effectively a single-entry cache. Cache invalidates
+* when any `.md` in the tree is added/modified/deleted; turns where
+* memory didn't change reuse the cached string.
+*
+* Frontmatter is parsed as YAML (`yaml` package) and validated with a
+* zod schema — files that don't match the shape are dropped from the
+* index. The same schema can be reused at write time if we want to
+* validate before commit.
+*/
+const FRONTMATTER_READ_BYTES = 4096;
+const FrontmatterSchema = z.object({
+	name: z.string().min(1),
+	description: z.string().min(1)
+}).passthrough();
+const MEMORY_DIRNAME = ".memory";
+const TYPE_DIRS = [
+	"users",
+	"projects",
+	"feedback",
+	"reference"
+];
+const TYPES_WITH_SUBJECT = new Set(["users", "projects"]);
+const TYPE_LABELS = {
+	users: "Users",
+	projects: "Projects",
+	feedback: "Feedback",
+	reference: "Reference"
+};
+const cache = /* @__PURE__ */ new Map();
+/**
+* Returns:
+* - `null` if `.memory/` doesn't exist
+* - `""` if the dir exists but contains nothing in the requested scope
+* - rendered markdown body (no surrounding header — caller wraps)
+*
+* The mtime-keyed cache stores the raw walked entries (the cost is the FS
+* walk); filtering by scope is cheap and runs per call, so two turns with
+* different scopes on the same cwd render correctly from one cached walk.
+*/
+async function buildMemoryIndex({ cwd, scope }) {
+	const memoryDirAbs = join(cwd, MEMORY_DIRNAME);
+	const maxMtimeMs = await maxMtimeAcrossDir(memoryDirAbs);
+	if (maxMtimeMs === null) {
+		cache.delete(cwd);
+		return null;
+	}
+	let cached = cache.get(cwd);
+	if (!cached || cached.builtAtMs < maxMtimeMs) {
+		cached = {
+			entries: await collectEntries(memoryDirAbs, cwd),
+			builtAtMs: Date.now()
+		};
+		cache.set(cwd, cached);
+	}
+	const visible = cached.entries.filter((entry) => scope.kind === "user" ? entry.type === "users" && entry.subject?.startsWith(scope.userId) === true : entry.type !== "users");
+	return visible.length === 0 ? "" : renderIndex(visible);
+}
+async function maxMtimeAcrossDir(dir) {
+	let dirStat;
+	try {
+		dirStat = await stat(dir);
+	} catch {
+		return null;
+	}
+	if (!dirStat.isDirectory()) return null;
+	let max = dirStat.mtimeMs;
+	const files = [];
+	await walkMdFiles(dir, files);
+	const fileStats = await Promise.all(files.map((f) => stat(f).catch(() => null)));
+	for (const s of fileStats) if (s && s.mtimeMs > max) max = s.mtimeMs;
+	return max;
+}
+async function walkMdFiles(dir, out) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	await Promise.all(entries.map(async (entry) => {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) await walkMdFiles(full, out);
+		else if (entry.isFile() && entry.name.endsWith(".md")) out.push(full);
+	}));
+}
+async function listMdFilesShallow(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	return entries.filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => join(dir, e.name));
+}
+async function listSubdirs(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	return entries.filter((e) => e.isDirectory()).map((e) => join(dir, e.name));
+}
+async function collectEntries(rootDirAbs, cwd) {
+	const collected = [];
+	await Promise.all(TYPE_DIRS.map(async (type) => {
+		const typeDirAbs = join(rootDirAbs, type);
+		if (TYPES_WITH_SUBJECT.has(type)) {
+			const subjectDirs = await listSubdirs(typeDirAbs);
+			await Promise.all(subjectDirs.map(async (subjectDirAbs) => {
+				const subject = basename(subjectDirAbs);
+				const files = await listMdFilesShallow(subjectDirAbs);
+				const parsed = await Promise.all(files.map(async (file) => {
+					const fm = await readFrontmatterOnly(file);
+					if (!fm?.name || !fm?.description) return null;
+					return {
+						name: fm.name,
+						description: fm.description,
+						type,
+						subject,
+						relPath: relative(cwd, file)
+					};
+				}));
+				for (const e of parsed) if (e) collected.push(e);
+			}));
+		} else {
+			const files = await listMdFilesShallow(typeDirAbs);
+			const parsed = await Promise.all(files.map(async (file) => {
+				const fm = await readFrontmatterOnly(file);
+				if (!fm?.name || !fm?.description) return null;
+				return {
+					name: fm.name,
+					description: fm.description,
+					type,
+					subject: null,
+					relPath: relative(cwd, file)
+				};
+			}));
+			for (const e of parsed) if (e) collected.push(e);
+		}
+	}));
+	return collected;
+}
+async function readFrontmatterOnly(filePath) {
+	let fh;
+	try {
+		fh = await open(filePath, "r");
+	} catch {
+		return null;
+	}
+	try {
+		const buf = Buffer.alloc(FRONTMATTER_READ_BYTES);
+		const { bytesRead } = await fh.read(buf, 0, FRONTMATTER_READ_BYTES, 0);
+		return parseFrontmatter(buf.toString("utf-8", 0, bytesRead));
+	} catch {
+		return null;
+	} finally {
+		await fh.close().catch(() => {});
+	}
+}
+function parseFrontmatter(text) {
+	const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+	if (!match || match[1] === void 0) return null;
+	let parsed;
+	try {
+		parsed = parse(match[1]);
+	} catch {
+		return null;
+	}
+	const result = FrontmatterSchema.safeParse(parsed);
+	return result.success ? result.data : null;
+}
+function renderIndex(entries) {
+	const byType = {
+		users: [],
+		projects: [],
+		feedback: [],
+		reference: []
+	};
+	for (const e of entries) byType[e.type].push(e);
+	const sections = [];
+	for (const type of TYPE_DIRS) {
+		const items = byType[type];
+		if (items.length === 0) continue;
+		sections.push(`### ${TYPE_LABELS[type]}`);
+		if (TYPES_WITH_SUBJECT.has(type)) {
+			const bySubject = /* @__PURE__ */ new Map();
+			for (const e of items) {
+				const subject = e.subject ?? "(unknown)";
+				const list = bySubject.get(subject) ?? [];
+				list.push(e);
+				bySubject.set(subject, list);
+			}
+			const subjects = [...bySubject.keys()].sort();
+			for (const subject of subjects) {
+				sections.push(`- **${subject}**`);
+				for (const e of bySubject.get(subject) ?? []) sections.push(`  - \`${e.relPath}\` — ${e.description}`);
+			}
+		} else for (const e of items) sections.push(`- \`${e.relPath}\` — ${e.description}`);
+		sections.push("");
+	}
+	return sections.join("\n").trimEnd();
+}
+//#endregion
+//#region src/extensions/memory.ts
+const log$7 = logger.child({ module: "memory-extension" });
+/**
+* The standing instructions for the memory system. Always injected (even with
+* an empty `.memory/`) so the agent knows it can persist notes. `users/` is
+* described by the platform memory extension, which is the only thing that can
+* scope it to a person — here we just point at it.
+*/
+function memoryInstructions(cwd) {
+	return `## Memory across conversations
+
+Persistent notes across conversations live at \`${cwd}/.memory/\` — plain markdown files in your repo. The harness builds and injects an **index** of these files (paths + one-line descriptions) into your system prompt every turn; **bodies are NOT auto-loaded** — when an index entry looks relevant, use your \`read\` tool to load that specific file.
+
+Memory records **what happened**: facts you learned, events, investigation findings, project and system details worth carrying forward. It is NOT where behavior goes. A standing rule about how you should act — a "from now on, always/never …", a tone or format preference, a workflow convention a user wants you to follow — belongs in \`soul.md\` (see the Persona / Standing instructions section), not here. When a note is really an instruction about your behavior, write it to \`soul.md\`; when it is a fact or a record of something that occurred, write it here.
+
+Shared knowledge is laid out as \`projects/<slug>/<topic>.md\` for project and system context, \`feedback/<topic>.md\` for concrete lessons learned from something that happened (the event and what it taught you — not a free-floating rule; the rule itself, if durable, goes in \`soul.md\`), and \`reference/<topic>.md\` for how external systems work. (Notes about a specific person live under \`users/\` and are shown separately, scoped to whoever you're talking to.) Each file's frontmatter declares \`name\` and \`description\` (the description is what shows up in the index, so make it a one-line behavior-triggering hook). Commit and push after writing to persist it.`;
+}
+function composeBlock$1({ cwd, index }) {
+	const instructions = memoryInstructions(cwd);
+	if (!index || index.length === 0) return instructions;
+	return `${instructions}\n\n## Memory index\n\n${index}`;
+}
+const memoryExtension = (pi) => {
+	let cachedBlock = null;
+	pi.on("session_start", async (_event, ctx) => {
+		try {
+			const index = await buildMemoryIndex({
+				cwd: ctx.cwd,
+				scope: { kind: "shared" }
+			});
+			cachedBlock = composeBlock$1({
+				cwd: ctx.cwd,
+				index
+			});
+		} catch (err) {
+			log$7.warn({
+				err,
+				event: "memory_index_failed"
+			}, "memory index build failed; injecting instructions only");
+			cachedBlock = memoryInstructions(ctx.cwd);
+		}
+	});
+	pi.on("before_agent_start", (event) => {
+		if (!cachedBlock) return void 0;
+		return { systemPrompt: `${event.systemPrompt}\n\n${cachedBlock}` };
+	});
+};
+//#endregion
+//#region src/extensions/platform-memory.ts
+const log$6 = logger.child({ module: "platform-memory-extension" });
+/**
+* Resolve the human on this turn via the API, keyed by the message id.
+* `/sandbox/channel-context` only returns a sender for a platform-known
+* account (a `userId`); accountless channel senders (Slack/email) come back as
+* no sender. Returns `null` outside a turn, on any failure, or when there's no
+* account — all of which withhold `users/` memory rather than scoping it to a
+* non-account identity. We use the typed `hc<SandboxAppType>` client, so the
+* response shape can't drift from the route.
+*/
+async function resolveTurnUser(messageId) {
+	const client = sandboxClient();
+	if (!client) {
+		log$6.debug({ event: "resolve_turn_user_no_api_url" }, "no API url in env; withholding user memory");
+		return null;
+	}
+	try {
+		const res = await client["channel-context"].$get({ query: { messageId } });
+		if (!res.ok) {
+			log$6.warn({
+				event: "resolve_turn_user_failed",
+				status: res.status
+			}, "channel-context returned non-ok; withholding user memory");
+			return null;
+		}
+		const { sender } = await res.json();
+		if (!sender) return null;
+		return {
+			id: sender.userId,
+			displayName: sender.displayName
+		};
+	} catch (err) {
+		log$6.warn({
+			err,
+			event: "resolve_turn_user_failed"
+		}, "failed to resolve current user; withholding user memory");
+		return null;
+	}
+}
+/** Filesystem-safe, readable suffix for the per-user memory directory. */
+function slugifyName(name) {
+	if (!name) return "user";
+	const slug = name.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48).replace(/-+$/g, "");
+	return slug.length > 0 ? slug : "user";
+}
+function composeBlock({ index, user }) {
+	const instructions = `## Current user memory
+
+Notes about the person on this turn — the only \`users/\` memory you can see. Store anything you learn about them under \`${`.memory/users/${user.id}-${slugifyName(user.displayName)}/`}<topic>.md\`, using exactly this directory. Other people's \`users/\` notes are never shown, so never address someone by a name you only find in memory.`;
+	if (!index || index.length === 0) return instructions;
+	return `${instructions}\n\n${index}`;
+}
+/**
+* Build the platform memory extension. `channelContext` is the per-turn ref
+* blob the worker injects (it carries the message id used to resolve the
+* user).
+*/
+function createPlatformMemoryExtension({ channelContext }) {
+	return (pi) => {
+		let cachedBlock = null;
+		pi.on("session_start", async (_event, ctx) => {
+			try {
+				const messageId = extractMessageId(channelContext);
+				const user = messageId ? await resolveTurnUser(messageId) : null;
+				if (!user) {
+					cachedBlock = null;
+					return;
+				}
+				cachedBlock = composeBlock({
+					index: await buildMemoryIndex({
+						cwd: ctx.cwd,
+						scope: {
+							kind: "user",
+							userId: user.id
+						}
+					}),
+					user
+				});
+			} catch (err) {
+				log$6.warn({
+					err,
+					event: "user_memory_index_failed"
+				}, "user memory index build failed; skipping injection");
+				cachedBlock = null;
+			}
+		});
+		pi.on("before_agent_start", (event) => {
+			if (!cachedBlock) return void 0;
+			return { systemPrompt: `${event.systemPrompt}\n\n${cachedBlock}` };
+		});
+	};
+}
+//#endregion
+//#region src/extensions/self-trace.ts
+const log$5 = logger.child({ module: "self-trace-extension" });
+/**
+* Reports the agent's own execution as OpenTelemetry spans:
+* agent.session → agent.run → agent.turn.N → tool.NAME, with token/cost
+* usage on the run span and exception events on failed tool spans.
+*
+* Reporting only — querying traces back is the platform CLI's job
+* (`platform trace list` / `platform trace query`), scoped server-side
+* to the calling agent's id.
+*/
+const selfTraceExtension = (pi) => {
+	let sessionSpan = null;
+	let sessionCtx = null;
+	let runSpan = null;
+	let runCtx = null;
+	let turnSpan = null;
+	let turnCtx = null;
+	const toolSpans = /* @__PURE__ */ new Map();
+	pi.on("session_start", async (_event, ctx) => {
+		const tracer = getTracer();
+		const remoteCtx = extractRemoteContext();
+		const modelId = ctx.model?.id ?? "unknown";
+		sessionSpan = tracer.startSpan("agent.session", { attributes: { "agent.model": modelId } }, remoteCtx);
+		sessionCtx = trace.setSpan(remoteCtx, sessionSpan);
+		const sc = sessionSpan.spanContext();
+		log$5.info({
+			event: "self_trace_session_start",
+			trace_id: sc.traceId,
+			span_id: sc.spanId,
+			model: modelId
+		}, "self-trace session span started");
+	});
+	pi.on("agent_start", () => {
+		if (!sessionCtx) return;
+		runSpan = getTracer().startSpan("agent.run", {}, sessionCtx);
+		runCtx = trace.setSpan(sessionCtx, runSpan);
+	});
+	pi.on("turn_start", (event) => {
+		const parentCtx = runCtx ?? sessionCtx;
+		if (!parentCtx) return;
+		const tracer = getTracer();
+		const turnIndex = event.turnIndex ?? 0;
+		turnSpan = tracer.startSpan(`agent.turn.${turnIndex}`, { attributes: { "turn.index": turnIndex } }, parentCtx);
+		turnCtx = trace.setSpan(parentCtx, turnSpan);
+	});
+	pi.on("tool_execution_start", (event) => {
+		const parentCtx = turnCtx ?? runCtx ?? sessionCtx;
+		if (!parentCtx) return;
+		const { toolCallId, toolName } = event;
+		const span = getTracer().startSpan(`tool.${toolName}`, { attributes: {
+			"tool.name": toolName,
+			"tool.call_id": toolCallId
+		} }, parentCtx);
+		toolSpans.set(toolCallId, span);
+	});
+	pi.on("tool_execution_end", (event) => {
+		const { toolCallId, isError, result } = event;
+		const span = toolSpans.get(toolCallId);
+		if (!span) return;
+		span.setAttribute("tool.is_error", isError);
+		if (isError) {
+			span.setStatus({ code: SpanStatusCode.ERROR });
+			const errorText = typeof result === "string" ? result : Array.isArray(result?.content) ? result.content.filter((p) => p?.type === "text").map((p) => p.text ?? "").join("") : "tool execution failed";
+			span.recordException(new Error(errorText));
+		}
+		span.end();
+		toolSpans.delete(toolCallId);
+	});
+	pi.on("turn_end", () => {
+		if (turnSpan) {
+			turnSpan.end();
+			turnSpan = null;
+			turnCtx = null;
+		}
+	});
+	pi.on("agent_end", (event) => {
+		const ev = event;
+		if (ev.messages && runSpan) {
+			let totalInput = 0;
+			let totalOutput = 0;
+			let totalCacheRead = 0;
+			let totalCacheWrite = 0;
+			let totalTokens = 0;
+			let totalCost = 0;
+			for (const m of ev.messages) if (m?.role === "assistant" && m.usage) {
+				totalInput += m.usage.input ?? 0;
+				totalOutput += m.usage.output ?? 0;
+				totalCacheRead += m.usage.cacheRead ?? 0;
+				totalCacheWrite += m.usage.cacheWrite ?? 0;
+				totalTokens += m.usage.totalTokens ?? 0;
+				totalCost += m.usage.cost?.total ?? 0;
+			}
+			runSpan.setAttributes({
+				"llm.usage.input_tokens": totalInput,
+				"llm.usage.output_tokens": totalOutput,
+				"llm.usage.cache_read_tokens": totalCacheRead,
+				"llm.usage.cache_write_tokens": totalCacheWrite,
+				"llm.usage.total_tokens": totalTokens,
+				"llm.usage.cost": totalCost
+			});
+		}
+		for (const [id, span] of toolSpans) {
+			span.end();
+			toolSpans.delete(id);
+		}
+		if (turnSpan) {
+			turnSpan.end();
+			turnSpan = null;
+			turnCtx = null;
+		}
+		if (runSpan) {
+			runSpan.end();
+			runSpan = null;
+			runCtx = null;
+		}
+		if (sessionSpan) {
+			sessionSpan.end();
+			sessionSpan = null;
+			sessionCtx = null;
+		}
+	});
+};
+//#endregion
+//#region src/extensions/soul.ts
+/**
+* Soul adapter as a pi extension.
+*
+* On `session_start`, reads `soul.md` from the agent's repo and caches it.
+* On `before_agent_start`, appends a "Persona / Standing instructions"
+* section to the system prompt using the cached content. The block is
+* always emitted (even when `soul.md` is absent) so the agent learns the
+* affordance — `soul.md` is editable, picked up on the next message, and
+* is the place to redefine itself.
+*
+* Lives in the harness package — soul.md is content from the agent's
+* own git repo, not from the platform — so its handling stays here.
+*/
+const log$4 = logger.child({ module: "soul-extension" });
+async function readSoul(cwd) {
+	try {
+		return (await readFile(join(cwd, "soul.md"), "utf8")).trim() || null;
+	} catch (err) {
+		if (err?.code === "ENOENT") return null;
+		log$4.warn({
+			err,
+			event: "soul_read_failed"
+		}, "soul.md read failed");
+		return null;
+	}
+}
+function soulSection(cwd, soul) {
+	return `# Persona / Standing instructions
+
+\`${cwd}/soul.md\` is your durable self — the one place that says who you are, how you should behave, and what you're for: your persona, your principles, your standing behavioral rules, your recurring style preferences, and the capabilities that make up your purpose. It is the only identity that carries across conversations. The tool, skill, and integration lists in this prompt tell you what's *available* in this session; \`soul.md\` is what you *are*.
+
+**\`soul.md\` is where behavior lives.** Any standing instruction about how you should act — a rule a user wants you to follow going forward, a tone or format preference, a workflow convention, a "from now on, always/never …" — belongs here, not in \`.memory/\`. Memory records *what happened* (facts, events, findings); soul defines *how you behave*. When a user gives you a durable behavioral rule, write it to \`soul.md\`. If you find behavioral rules that ended up in \`.memory/\`, treat that as misfiled and move them here.
+
+Keep it current. When you gain a durable new capability — a tool you build, a skill or integration you set up, a service you connect, a secret or auth credential you wire in — or a user hands you a lasting behavioral rule, record it in \`soul.md\` so a future conversation knows it's part of you rather than rediscovering it from scratch. Do this the moment you gain the capability, and for a credential that means the moment it verifies with a real call, not after a human points out that you forgot. Connecting a capability is itself a durable change worth recording, not merely a step toward the task in front of you. Edit \`soul.md\` (then \`git add soul.md && git commit && git push\`) to redefine yourself; picked up on the next message.
+
+${soul ? soul : "_(empty — write to `soul.md` to define your persona)_"}`;
+}
+const soulExtension = (pi) => {
+	let cachedSection = null;
+	pi.on("session_start", async (_event, ctx) => {
+		const soul = await readSoul(ctx.cwd);
+		cachedSection = soulSection(ctx.cwd, soul);
+	});
+	pi.on("before_agent_start", (event, ctx) => {
+		const section = cachedSection ?? soulSection(ctx.cwd, null);
+		const base = event.systemPrompt;
+		return { systemPrompt: base.length > 0 ? `${base}\n\n${section}` : section };
+	});
+};
+//#endregion
+//#region src/extensions/subagent/index.ts
+const log$3 = logger.child({ module: "subagent-ext" });
+const MAX_TASKS = 8;
+const TaskItem = Type.Object({
+	task: Type.String({ description: "The task to delegate to a subagent run." }),
+	title: Type.String({
+		description: "A SHORT name for this task — 3-6 words, sentence case, no trailing period. This is what the person in the chat sees as the row for this subagent, so name the work, do not restate the prompt. Good: \"Audit the billing gate\", \"Compare competitor pricing\", \"Draft the migration\". Bad: \"You are looking at apps/anyone/web and should check every component…\".",
+		maxLength: 120
+	}),
+	persona: Type.Optional(Type.String({ description: "Optional extra system prompt / role for this task, applied ON TOP of the child run's own default persona (your full identity and soul are still there underneath). Omit to run with just your default persona." })),
+	model: Type.Optional(Type.String({ description: "Optional model id to run this subagent on. PREFER A LOWER-COST, FASTER MODEL when the task is well-scoped and does not need your full reasoning depth — most delegated subtasks (searching, summarizing, mechanical edits, gathering or reformatting data, running a check) run just as well on a lighter model and cost far less. Reserve a top-tier model for subtasks that genuinely need deep reasoning or careful judgment. Must be a real catalogued model id. Omit to inherit your own model. If you are locked to a Google-compliant model, only compliant models are accepted." })),
+	timeoutMinutes: Type.Optional(Type.Integer({
+		description: "Optional wall-clock timeout for this subagent, in minutes. If the run is still going after this long it is ended and you are rewoken with a timeout result, so a hung subagent can never strand you. Omit for the default (30 minutes). Raise it for genuinely long work (a big migration, a large audit); lower it for a quick lookup. Range 1-360.",
+		minimum: 1,
+		maximum: 360
+	}))
+});
+const DEFAULT_SUBAGENT_TIMEOUT_MS = 30 * 6e4;
+const SubagentParams = Type.Object({ tasks: Type.Array(TaskItem, {
+	description: "One or more tasks to delegate. Each spawns an isolated subagent run linked to this conversation; they run in parallel and each rewakes you with its result when it finishes.",
+	minItems: 1,
+	maxItems: MAX_TASKS
+}) });
+const SUBAGENT_TOOL_NAME = "subagent";
+function buildTool(messageId) {
+	return {
+		name: SUBAGENT_TOOL_NAME,
+		label: "Subagent",
+		description: [
+			"Delegate one or more tasks to subagent runs — fresh isolated copies of yourself, each with its own context window, linked to this conversation.",
+			"Use it to parallelize independent work, to keep a large or noisy subtask out of your own context, or to run a task under a specialized persona.",
+			"Fire-and-forget: this returns immediately after queueing. It does NOT wait for results. Each subagent runs on its own and, when it finishes, sends you its result on this thread — so queue the work, then keep going or end your turn. To chain, re-delegate after a result lands.",
+			"Pass tasks: [{ task, title, persona?, model? }]. title is a short 3-6 word name for the task — it is shown to the person in the chat as that subagent's row, so name the work rather than restating the prompt. persona is an optional extra system prompt layered ON TOP of your default persona for that task (it adds to, it does not replace, your identity); omit it to run with just your default persona. model is an optional model id for that task — prefer a lower-cost, faster model for well-scoped subtasks that don't need deep reasoning, and reserve a top-tier model for the ones that do; omit it to inherit your own model.",
+			"Peering: each queued task comes back with its own conversation id. A subagent is a real linked conversation, so to see what one is doing RIGHT NOW while it runs — its reasoning, the tools it has called and their results, its progress — read that conversation with `platform conversations show <conversationId>` (you are already authorized; it is your own delegated run). Check in that way instead of waiting blind for the final result. The read reflects the child's persisted state, which lags a few seconds behind live (tool results land as they complete; in-progress reasoning can be up to ~5s stale), so peek between checkpoints rather than polling in a tight loop.",
+			"Steering: to add context, correct course, or answer a question a subagent needs mid-run, post to its conversation with `platform conversations post <conversationId> --message \"...\"`. If the subagent is still running, your message lands as a live steer picked up in that same turn; if it has gone idle, it queues as its next turn. This is the same primitive as any conversation message — there is no separate steer channel."
+		].join(" "),
+		promptSnippet: "subagent — delegate tasks to isolated subagent runs; each rewakes you with its result when done",
+		parameters: SubagentParams,
+		async execute(_toolCallId, params) {
+			const { tasks } = params;
+			if (!messageId) return {
+				content: [{
+					type: "text",
+					text: "Subagent delegation is unavailable in this context (no originating conversation to link the runs to)."
+				}],
+				details: {},
+				isError: true
+			};
+			const spawnTasks = tasks.map((t) => ({
+				task: t.task,
+				title: t.title ?? null,
+				persona: t.persona ?? null,
+				model: t.model ?? null,
+				timeoutMs: t.timeoutMinutes != null ? t.timeoutMinutes * 6e4 : DEFAULT_SUBAGENT_TIMEOUT_MS
+			}));
+			try {
+				const spawned = await postSubagentSpawn({
+					messageId,
+					tasks: spawnTasks
+				});
+				const { taskIds } = spawned;
+				log$3.info({
+					event: "subagent_spawned",
+					count: taskIds.length
+				}, "subagent tasks queued");
+				const convByTask = new Map(spawned.tasks.map((t) => [t.taskId, t.conversationId]));
+				const lines = taskIds.map((id, i) => {
+					const label = spawnTasks[i]?.title ?? spawnTasks[i]?.task ?? "";
+					const conv = convByTask.get(id);
+					return `- ${id}: ${label}${conv ? ` — conversation ${conv}` : ""}`;
+				}).join("\n");
+				const peerHint = spawned.tasks.length ? "\nEach subagent runs on its own conversation (id shown per task above). To SEE what one is doing while it runs, read it with `platform conversations show <conversationId>`. To STEER one mid-run — add context, correct course, answer a question — post to its conversation with `platform conversations post <conversationId> --message \"...\"`; it lands as a live steer if the subagent is still running, or as its next turn if it has gone idle." : "";
+				return {
+					content: [{
+						type: "text",
+						text: `Queued ${taskIds.length} subagent ${taskIds.length === 1 ? "run" : "runs"}. Each runs on its own and will send you its result on this thread when it finishes — keep working or end your turn meanwhile.\n${lines}${peerHint}`
+					}],
+					details: {
+						taskIds,
+						tasks: spawned.tasks
+					}
+				};
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				log$3.warn({
+					err,
+					event: "subagent_spawn_failed"
+				}, "subagent spawn failed");
+				return {
+					content: [{
+						type: "text",
+						text: `Failed to queue subagent runs: ${message}`
+					}],
+					details: {},
+					isError: true
+				};
+			}
+		}
+	};
+}
+/**
+* The factory takes the session's channel context to resolve the originating
+* messageId — the api links each spawned run to the conversation that message
+* belongs to and rewakes it on completion (nothing about the parent is piped
+* from the sandbox beyond that id). The tool is registered unconditionally at
+* session_start.
+*/
+function createSubagentExtension({ channelContext }) {
+	return (pi) => {
+		const messageId = extractMessageId(channelContext);
+		let registered = false;
+		const registerOnce = () => {
+			if (registered) return;
+			registered = true;
+			pi.registerTool(buildTool(messageId));
+			log$3.info({ event: "subagent_enabled" }, "subagent tool registered");
+		};
+		pi.on("session_start", () => {
+			registerOnce();
+		});
+	};
+}
+//#endregion
+//#region src/extensions/resource-pressure-warning.ts
+/**
+* Mid-run resource-pressure warning to the agent.
+*
+* The sandbox already detects pressure — the boot scripts cap the
+* user-workload cgroup (memory.high/memory.max) and watchers log warn/crit
+* edges for memory and disk — but nothing told the *agent*, so a turn burned
+* straight to the OOM kill (or a full disk) and only learned about it from
+* the post-mortem notice. This extension closes that gap in-process: while a
+* turn is active it polls the agent cgroup and the root filesystem and, the
+* first time usage crosses a warn threshold, folds a system notification into
+* the open turn so the agent can checkpoint, shed work (constrain
+* parallelism, kill a background hog, clean scratch space), or request a
+* bigger tier BEFORE the kill.
+*
+* The notification is triggered by the two conditions that actually kill
+* work — memory near the cgroup hard cap, disk near full — and reports a
+* snapshot of all the relevant stats (memory, CPU utilization, disk) so the
+* agent can tell which resource is the problem and how much headroom the
+* others have.
+*
+* Edge-triggered, once per trigger per turn: the fired flags reset on
+* agent_start, so a turn that rides a threshold gets one warning per
+* resource, not a stream. Polling only runs while the agent is active — an
+* idle sandbox's resource usage is not the agent's problem and there is no
+* open turn to deliver into anyway.
+*
+* Best-effort throughout: any read failure (cgroup absent, controller not
+* delegated, non-cgroup-v2 host, df missing) reads as "no signal" for that
+* stat and the extension warns on what it can see — it must never break a
+* turn over an observability feature.
+*/
+const execFileAsync = promisify(execFile);
+const log$2 = logger.child({ module: "resource-pressure-warning" });
+const POLL_INTERVAL_MS = 1e4;
+function envOverride(name) {
+	for (const prefix of ["SKYDIVE_", "ANYONE_"]) {
+		const value = process.env[`${prefix}${name}`];
+		if (value != null && value !== "") return value;
+	}
+	return null;
+}
+function cgroupDir() {
+	return envOverride("AGENT_CGROUP") ?? "/sys/fs/cgroup/agent";
+}
+function diskRoot() {
+	return envOverride("DISK_ROOT") ?? "/";
+}
+/**
+* Read a cgroup v2 scalar file. Returns a number, or null for "max"
+* (uncapped), an empty/absent file, or any read/parse error — an uncapped or
+* unreadable limit means there is nothing meaningful to warn against.
+*/
+async function readScalar(file) {
+	try {
+		const raw = (await readFile(`${cgroupDir()}/${file}`, "utf8")).trim();
+		if (raw === "" || raw === "max") return null;
+		const n = Number(raw);
+		return Number.isFinite(n) ? n : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Read a cgroup v2 "flat keyed" file (one `key value` pair per line, e.g.
+* cpu.stat) and return the counter for `key`, or null when absent.
+*/
+async function readKeyedCounter(file, key) {
+	try {
+		const raw = await readFile(`${cgroupDir()}/${file}`, "utf8");
+		for (const line of raw.split("\n")) {
+			const [k, v] = line.trim().split(/\s+/);
+			if (k === key) {
+				const n = Number(v);
+				return Number.isFinite(n) ? n : null;
+			}
+		}
+		return null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Live memory usage as an integer percent of the hard cap, or null when
+* either side is unreadable/uncapped. Exported for tests.
+*/
+async function readMemUsePct() {
+	const [current, max] = await Promise.all([readScalar("memory.current"), readScalar("memory.max")]);
+	if (current === null || max === null || max <= 0) return null;
+	return {
+		pct: Math.floor(current / max * 100),
+		currentBytes: current,
+		maxBytes: max
+	};
+}
+/**
+* Root filesystem used% (df -P Capacity column), or null on any failure.
+* Exported for tests.
+*/
+async function readDiskUsePct() {
+	try {
+		const { stdout } = await execFileAsync("df", ["-P", diskRoot()]);
+		const dataRow = stdout.trim().split("\n")[1];
+		if (dataRow == null) return null;
+		const capacity = dataRow.trim().split(/\s+/)[4];
+		if (capacity == null) return null;
+		const pct = Number(capacity.replace("%", ""));
+		return Number.isFinite(pct) ? pct : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* CPU utilization sampler. cgroup v2 exposes cumulative CPU time
+* (cpu.stat usage_usec); utilization is the delta between two samples over
+* the wall time between them, normalized by core count. The first call after
+* construction has no previous sample and returns null.
+*/
+function createCpuSampler() {
+	let prevUsageUsec = null;
+	let prevAtMs = null;
+	return async () => {
+		const usage = await readKeyedCounter("cpu.stat", "usage_usec");
+		const now = Date.now();
+		const prev = prevUsageUsec;
+		const prevAt = prevAtMs;
+		prevUsageUsec = usage;
+		prevAtMs = now;
+		if (usage === null || prev === null || prevAt === null) return null;
+		const wallUsec = (now - prevAt) * 1e3;
+		if (wallUsec <= 0) return null;
+		const cores = availableParallelism();
+		const pct = Math.round((usage - prev) / (wallUsec * cores) * 100);
+		return Math.max(0, Math.min(100, pct));
+	};
+}
+function fmtMb(bytes) {
+	return Math.round(bytes / 1024 / 1024);
+}
+/** The model-facing warning text. Exported for tests. */
+function resourcePressureWarningText(trigger, { mem, cpuPct, diskPct }) {
+	const stats = [];
+	if (mem) stats.push(`memory ${mem.pct}% of cap (${fmtMb(mem.currentBytes)}/${fmtMb(mem.maxBytes)} MB)`);
+	if (cpuPct !== null) stats.push(`CPU ${cpuPct}%`);
+	if (diskPct !== null) stats.push(`disk ${diskPct}% full`);
+	const lead = trigger === "memory" ? `Your sandbox is at ${mem?.pct}% of its memory cap. If usage keeps climbing, the kernel will kill the offending process and this turn may die with it.` : `Your sandbox's disk is ${diskPct}% full. If it fills completely, writes will start failing and this turn may die with them.`;
+	const remedy = trigger === "memory" ? "checkpoint in-flight work (commit and push), then reduce the footprint — constrain parallelism, run heavy steps sequentially, or kill background processes you no longer need." : "checkpoint in-flight work (commit and push), then free space — clean build artifacts, caches, and scratch files you no longer need.";
+	return `<system_notification>${lead} Current usage: ${stats.join(", ")}. Act now: ${remedy} If the workload genuinely needs more resources, request a bigger sandbox with \`platform compute request\`. This is an automated resource warning, not a message from the user; continue the task, adjusted.</system_notification>`;
+}
+const resourcePressureWarningExtension = (pi) => {
+	let agentActive = false;
+	let warnedMemThisTurn = false;
+	let warnedDiskThisTurn = false;
+	let timer = null;
+	const sampleCpu = createCpuSampler();
+	async function checkOnce() {
+		if (!agentActive || warnedMemThisTurn && warnedDiskThisTurn) return;
+		const [mem, cpuPct, diskPct] = await Promise.all([
+			readMemUsePct(),
+			sampleCpu(),
+			readDiskUsePct()
+		]);
+		let trigger = null;
+		if (!warnedMemThisTurn && mem !== null && mem.pct >= 80) {
+			trigger = "memory";
+			warnedMemThisTurn = true;
+		} else if (!warnedDiskThisTurn && diskPct !== null && diskPct >= 80) {
+			trigger = "disk";
+			warnedDiskThisTurn = true;
+		}
+		if (trigger === null) return;
+		log$2.warn({
+			trigger,
+			mem,
+			cpuPct,
+			diskPct
+		}, "resource pressure warning delivered to agent");
+		await pi.sendMessage({
+			customType: "anyone-resource-pressure-warning",
+			content: resourcePressureWarningText(trigger, {
+				mem,
+				cpuPct,
+				diskPct
+			}),
+			display: false
+		}, {
+			triggerTurn: true,
+			deliverAs: "followUp"
+		});
+	}
+	pi.on("agent_start", async () => {
+		agentActive = true;
+		warnedMemThisTurn = false;
+		warnedDiskThisTurn = false;
+		if (!timer) {
+			timer = setInterval(() => {
+				checkOnce().catch((err) => {
+					log$2.error({ err }, "resource pressure check failed");
+				});
+			}, POLL_INTERVAL_MS);
+			timer.unref?.();
+		}
+	});
+	pi.on("agent_end", async () => {
+		agentActive = false;
+		if (timer) {
+			clearInterval(timer);
+			timer = null;
+		}
+	});
+};
+//#endregion
+//#region src/extensions/tool-call-env.ts
+const TOOL_CALL_ID_VAR = "TOOL_CALL_ID";
+function shellQuoteValue(value) {
+	return quote([value]);
+}
+function withToolCallId({ command, toolCallId }) {
+	return `export ${TOOL_CALL_ID_VAR}=${shellQuoteValue(toolCallId)}; ${command}`;
+}
+const PLATFORM_EXPORT = new RegExp(`^\\s*export\\s+(?:${TOOL_CALL_ID_VAR}|ANYONE_\\w+|SKYDIVE_\\w+)=(?:"(?:\\\\.|[^"])*"|'(?:'\\\\''|[^'])*'|[^;\\s]*)\\s*;\\s*`);
+function stripPlatformExportsForDisplay(command) {
+	let c = command;
+	let m;
+	while (m = c.match(PLATFORM_EXPORT)) c = c.slice(m[0].length);
+	return c;
+}
+const toolCallEnvExtension = (pi) => {
+	pi.on("tool_call", async (event) => {
+		if (event.toolName !== "bash") return;
+		if (typeof event.input.command !== "string") return;
+		event.input.command = withToolCallId({
+			command: event.input.command,
+			toolCallId: event.toolCallId
+		});
+	});
+};
+//#endregion
+//#region src/extensions/tool-call-summary.ts
+const log$1 = logger.child({ module: "tool-call-summary-extension" });
+/**
+* The injected parameter name: a namespaced sentinel, so it can never collide
+* with a real tool argument and is unmistakable in transcripts and logs. The
+* frontend renderer (ANY-2723) duplicates this literal — keep the two in sync.
+*/
+const TOOL_CALL_SUMMARY_FIELD = "__skydive_summary__";
+/** JSON Schema fragment for the injected parameter. */
+const SUMMARY_PROPERTY = {
+	type: "string",
+	description: "Required for every tool call. A concise, specific summary (max ~8 words) of what THIS call does and why, written for a person watching the conversation, e.g. \"Searching feedback for billing complaints\" or \"Reading the auth middleware\". Address the user directly in second person: the summary is read by the user, so refer to their things as \"your\", never in third person — \"Reading your emails\", not \"Reading his emails\". Always use the present progressive tense, since it is shown while the call runs: \"Updating your Slack\", never \"Updated your Slack\". Make each summary distinct from your other tool calls; never reuse a generic label like \"Search query\" or \"Running command\"."
+};
+const jsonSchemaObjectSchema = z.object({
+	type: z.unknown().optional(),
+	properties: z.record(z.string(), z.unknown()).optional(),
+	required: z.array(z.string()).optional(),
+	additionalProperties: z.unknown().optional()
+}).passthrough();
+const toolEntrySchema = z.object({
+	name: z.string().optional(),
+	input_schema: jsonSchemaObjectSchema.optional(),
+	parameters: jsonSchemaObjectSchema.optional(),
+	function: z.object({
+		name: z.string().optional(),
+		parameters: jsonSchemaObjectSchema.optional()
+	}).passthrough().optional()
+}).passthrough();
+const payloadWithToolsSchema = z.object({ tools: z.array(z.unknown()) }).passthrough();
+/**
+* Add the summary property to one JSON Schema object. Returns the augmented
+* copy, or `null` when the tool should be left untouched: a strict schema
+* (`additionalProperties: false`) whose validation would reject the extra
+* field, or one that already declares a `__skydive_summary__` property of its own.
+*/
+function augmentSchema(schema) {
+	if (schema.additionalProperties === false) return null;
+	const properties = schema.properties ?? {};
+	if ("__skydive_summary__" in properties) return null;
+	const required = schema.required ?? [];
+	return {
+		...schema,
+		type: schema.type ?? "object",
+		properties: {
+			[TOOL_CALL_SUMMARY_FIELD]: SUMMARY_PROPERTY,
+			...properties
+		},
+		required: required.includes("__skydive_summary__") ? required : [...required, TOOL_CALL_SUMMARY_FIELD]
+	};
+}
+/**
+* Augment a single tool entry, dispatching on which provider shape it is.
+* Returns the (possibly rebuilt) entry and whether anything changed. Skipped
+* tools — wrong shape, strict, or name in `strictToolNames` — return unchanged.
+*/
+function augmentToolEntry(entry, strictToolNames) {
+	const parsed = toolEntrySchema.safeParse(entry);
+	if (!parsed.success) return {
+		entry,
+		changed: false
+	};
+	const tool = parsed.data;
+	const name = tool.name ?? tool.function?.name ?? null;
+	if (name !== null && strictToolNames.has(name)) return {
+		entry,
+		changed: false
+	};
+	if (tool.input_schema) {
+		const augmented = augmentSchema(tool.input_schema);
+		if (!augmented) return {
+			entry,
+			changed: false
+		};
+		return {
+			entry: {
+				...tool,
+				input_schema: augmented
+			},
+			changed: true
+		};
+	}
+	if (tool.parameters) {
+		const augmented = augmentSchema(tool.parameters);
+		if (!augmented) return {
+			entry,
+			changed: false
+		};
+		return {
+			entry: {
+				...tool,
+				parameters: augmented
+			},
+			changed: true
+		};
+	}
+	if (tool.function?.parameters) {
+		const augmented = augmentSchema(tool.function.parameters);
+		if (!augmented) return {
+			entry,
+			changed: false
+		};
+		return {
+			entry: {
+				...tool,
+				function: {
+					...tool.function,
+					parameters: augmented
+				}
+			},
+			changed: true
+		};
+	}
+	return {
+		entry,
+		changed: false
+	};
+}
+/**
+* Inject the summary field into every eligible tool in a provider payload.
+* Returns a new payload when at least one tool was augmented, or `undefined`
+* to signal "no change" (which keeps the original payload, per the
+* `before_provider_request` contract).
+*
+* @param payload The outgoing provider payload (shape varies by provider).
+* @param strictToolNames Names of tools whose registered schema is strict and
+*   must be skipped to avoid validation errors.
+*/
+function injectToolCallSummary(payload, strictToolNames) {
+	const parsed = payloadWithToolsSchema.safeParse(payload);
+	if (!parsed.success || parsed.data.tools.length === 0) return void 0;
+	let changed = false;
+	const tools = parsed.data.tools.map((entry) => {
+		const result = augmentToolEntry(entry, strictToolNames);
+		if (result.changed) changed = true;
+		return result.entry;
+	});
+	if (!changed) return void 0;
+	return {
+		...parsed.data,
+		tools
+	};
+}
+/**
+* Names of registered tools whose schema sets `additionalProperties: false`.
+* Pi validates the model's tool args against this registered schema, so the
+* injected field would make a strict tool's call fail validation — skip them.
+*/
+function getStrictToolNames(pi) {
+	const names = /* @__PURE__ */ new Set();
+	for (const tool of pi.getAllTools()) {
+		const parsed = jsonSchemaObjectSchema.safeParse(tool.parameters);
+		if (parsed.success && parsed.data.additionalProperties === false) names.add(tool.name);
+	}
+	return names;
+}
+function toolDeclaresSummaryParam(pi, toolName) {
+	const tool = pi.getAllTools().find((candidate) => candidate.name === toolName);
+	if (!tool) return false;
+	const parsed = jsonSchemaObjectSchema.safeParse(tool.parameters);
+	return parsed.success && parsed.data.properties != null && "__skydive_summary__" in parsed.data.properties;
+}
+/**
+* Remove the injected summary from a tool's execution input. No-op when the
+* field is absent, or when the tool genuinely declares a `__skydive_summary__`
+* parameter of its own (which we never inject into, so its value is real).
+* Mutates `input` in place, matching the `tool_call` contract.
+*
+* Fails open: this runs on the critical path of tool execution, and the
+* `getAllTools()` lookup can throw. On any error we leave `input` untouched
+* (the sentinel may pass through to the tool, but a bug here can never break
+* tool execution).
+*/
+function stripInjectedSummary(pi, toolName, input) {
+	try {
+		if (!("__skydive_summary__" in input)) return;
+		if (toolDeclaresSummaryParam(pi, toolName)) return;
+		delete input[TOOL_CALL_SUMMARY_FIELD];
+	} catch (err) {
+		log$1.error({
+			err,
+			event: "tool_call_summary_strip_failed",
+			toolName
+		}, "tool_call_summary strip failed; leaving tool input untouched");
+	}
+}
+/**
+* Compute the rewritten payload for a `before_provider_request` event, failing
+* open: on any error the original payload is left untouched so a bug here can
+* never break an LLM call.
+*/
+function buildInjectedPayload(pi, payload) {
+	try {
+		return injectToolCallSummary(payload, getStrictToolNames(pi));
+	} catch (err) {
+		log$1.error({
+			err,
+			event: "tool_call_summary_injection_failed"
+		}, "tool_call_summary injection failed; passing payload through unchanged");
+		return;
+	}
+}
+const toolCallSummaryExtension = (pi) => {
+	pi.on("before_provider_request", (event) => buildInjectedPayload(pi, event.payload));
+	pi.on("tool_call", (event) => {
+		stripInjectedSummary(pi, event.toolName, event.input);
+	});
+};
+//#endregion
+//#region src/extensions/background-tasks.ts
+/**
+* Background bash tasks as a pi extension.
+*
+* Gives the agent Claude Code-style background execution so a long-running
+* command never blocks the turn loop (a blocked turn means steers queue and
+* the user sees silence — the 2026-06-11 incident shape):
+*
+* - `bg_run` launches the command in the background, streaming output to a log
+*   file, and returns immediately with a task id.
+* - `bg_status` / `bg_logs` / `bg_kill` inspect (with a stall hint), tail, and
+*   stop a task.
+* - On completion the agent is woken: mid-run via
+*   `pi.sendMessage(..., { deliverAs: 'followUp', triggerTurn: true })`; if no
+*   agent loop is active (the run already ended), the extension POSTs the result
+*   to the api (`/sandbox/bg-task-done`), which resolves the conversation from
+*   the task's origin messageId and spawns a fresh run carrying it (the same
+*   system-control-run path auth-fulfill / MCP-OAuth use to wake an idle agent —
+*   a new run, not a steer). A lost POST falls back to injecting at the next
+*   session_start for that conversation.
+* - A process-wide watchdog keeps the sandbox alive while any task runs
+*   (capped) and kills tasks whose log exceeds the size cap. A stall hint
+*   (no output for a while) surfaces on demand in `bg_status`.
+*
+* **Execution is pi's own.** Every task runs through pi's
+* `createLocalBashOperations().exec` — the same backend the built-in bash tool
+* uses — so shell config (`bash -c`), the agent's cwd, `getShellEnv()`, the
+* cwd-exists guard, process-tree kill, and orphan tracking all match pi's
+* built-in bash, by construction. We hold the exec promise rather than awaiting
+* it inline: it resolves on completion (→ the wake), and `bg_kill` / the
+* watchdog abort its signal (→ `killProcessTree`).
+*
+* **State is in-memory, scoped to the conversation.** One harness process
+* serves all of an agent's conversations, so task state is held in a
+* module-level map tagged with the conversation that started it. The sandbox
+* has no DB, so each session resolves its conversation once — lazily, api-side
+* from the origin messageId in its channel context (`resolveConversationFromApi`)
+* — and every run of the same conversation resolves to the same id, keeping the
+* shared map correctly scoped across turns. `bg_*`, the completion wake, and the
+* next-session injection all filter to the resolved conversation — an agent
+* never sees or is woken by a task from a different chat. Only the output log
+* spills to disk (/home/user/.anyone/bg-tasks/<id>.log) to avoid buffering a chatty job
+* in memory; exit code and run state live on the in-memory task.
+*
+* **No cross-restart survival (v1, deliberate).** Task state lives only in
+* the running harness process. A harness restart (crash → supervisord
+* respawn, or `platform harness reload` after the agent edits its own
+* harness) drops the map and pi's exec children are reaped with it. We don't
+* resurrect from disk because the common next-run case cold-provisions a
+* *different* sandbox anyway (warm reuse is the minority in prod), so on-disk
+* state would rarely be the box the next run lands on. The idle-completion wake
+* does cross the sandbox → platform boundary (a fresh run via `bg-task-done`),
+* but a task whose harness dies before it finishes is gone — it is not
+* resurrected, and this stays distinct from the scheduled-run (cron) system.
+*/
+const log = logger.child({ module: "background-tasks-ext" });
+const ops = createLocalBashOperations();
+function tasksDir() {
+	return process.env.SKYDIVE_BG_TASKS_DIR ?? process.env.ANYONE_BG_TASKS_DIR ?? "/home/user/.anyone/bg-tasks";
+}
+const WATCHDOG_INTERVAL_MS = 3e4;
+const KEEPALIVE_EVERY_MS = 6e4;
+const KEEPALIVE_MAX_MS = 3600 * 1e3;
+const STALL_HINT_AFTER_MS = 120 * 1e3;
+const MAX_LOG_BYTES = 100 * 1024 * 1024;
+const DEFAULT_TAIL_LINES = 30;
+const TAIL_READ_BYTES = 64 * 1024;
+function taskLabel(meta) {
+	return `${meta.id} "${meta.description ?? meta.command.slice(0, 60)}"`;
+}
+let taskCounter = 0;
+const tasks = /* @__PURE__ */ new Map();
+let watchdogInterval = null;
+let lastKeepaliveAt = 0;
+function sameConversation(meta, conversationId) {
+	return meta.conversationId === conversationId;
+}
+function logPath(id) {
+	return join(tasksDir(), `${id}.log`);
+}
+async function readLogChunk(id, maxBytes, anchor) {
+	let fh = null;
+	try {
+		fh = await open(logPath(id), "r");
+		const { size } = await fh.stat();
+		const readBytes = Math.min(size, maxBytes);
+		const offset = anchor === "tail" ? size - readBytes : 0;
+		const buffer = Buffer.alloc(readBytes);
+		await fh.read(buffer, 0, readBytes, offset);
+		let start = 0;
+		if (anchor === "tail" && readBytes < size) while (start < buffer.length && (buffer[start] & 192) === 128) start++;
+		return {
+			text: buffer.toString("utf8", start),
+			size
+		};
+	} catch {
+		return {
+			text: "",
+			size: 0
+		};
+	} finally {
+		await fh?.close();
+	}
+}
+function readLogEnd(id, maxBytes) {
+	return readLogChunk(id, maxBytes, "tail");
+}
+async function tailLog(id, lines) {
+	const { text } = await readLogEnd(id, TAIL_READ_BYTES);
+	const all = text.split("\n");
+	const tail = all.slice(Math.max(0, all.length - lines - 1)).join("\n");
+	return tail.trim().length > 0 ? tail : "(no output yet)";
+}
+async function headLog(id, lines) {
+	const { text } = await readLogChunk(id, TAIL_READ_BYTES, "head");
+	const head = text.split("\n").slice(0, lines).join("\n");
+	return head.trim().length > 0 ? head : "(no output yet)";
+}
+function secondsSinceLastOutput(meta) {
+	return Math.round((Date.now() - meta.lastOutputAt) / 1e3);
+}
+async function describeStatus(meta, lines) {
+	const killNote = meta.killedReason ? ` (killed: ${meta.killedReason})` : "";
+	if (!meta.running) {
+		if (meta.exitCode !== null) return `Task ${meta.id} finished with exit code ${meta.exitCode}${killNote}.\nLast output:\n${await tailLog(meta.id, lines)}`;
+		const why = meta.killedReason ? "" : meta.error ? ` (${meta.error})` : " (process ended without an exit code — likely killed or the sandbox restarted)";
+		return `Task ${meta.id} ended${killNote}${why}.\nLast output:\n${await tailLog(meta.id, lines)}`;
+	}
+	const runningForS = Math.round((Date.now() - meta.startedAt) / 1e3);
+	const quietS = secondsSinceLastOutput(meta);
+	const stallHint = quietS * 1e3 > STALL_HINT_AFTER_MS ? `\n⚠ No output for ${quietS}s — the command may be stalled or waiting for interactive input it will never get.` : "";
+	return `Task ${meta.id} is running (${runningForS}s elapsed).${stallHint}\nLast output:\n${await tailLog(meta.id, lines)}`;
+}
+function watchdogTick(now) {
+	const running = [...tasks.values()].filter((t) => t.running);
+	if (running.length === 0) {
+		stopWatchdog();
+		return;
+	}
+	for (const meta of running) {
+		const overRuntime = now - meta.startedAt > KEEPALIVE_MAX_MS;
+		const overSize = meta.logBytes > MAX_LOG_BYTES;
+		if (!overRuntime && !overSize) continue;
+		const reason = overSize ? `output exceeded ${MAX_LOG_BYTES / (1024 * 1024)}MiB` : `exceeded ${KEEPALIVE_MAX_MS / 6e4}m max runtime`;
+		log.warn({
+			taskId: meta.id,
+			reason
+		}, "watchdog killing bg task");
+		try {
+			killTask(meta, reason);
+		} catch (err) {
+			log.warn({
+				err,
+				taskId: meta.id
+			}, "watchdog kill failed");
+		}
+	}
+	if (now - lastKeepaliveAt >= KEEPALIVE_EVERY_MS) {
+		lastKeepaliveAt = now;
+		postHeartbeat({ messageId: null });
+	}
+}
+function stopWatchdog() {
+	if (watchdogInterval) {
+		clearInterval(watchdogInterval);
+		watchdogInterval = null;
+	}
+}
+function ensureWatchdog() {
+	if (watchdogInterval) return;
+	watchdogInterval = setInterval(() => watchdogTick(Date.now()), WATCHDOG_INTERVAL_MS);
+}
+function killTask(meta, reason) {
+	if (reason) meta.killedReason = reason;
+	meta.controller.abort();
+}
+function createBackgroundTasksExtension({ channelContext }) {
+	return (pi) => {
+		const messageId = extractMessageId(channelContext);
+		let conversationId = null;
+		let conversationIdPromise = null;
+		function ensureConversationId() {
+			if (!messageId) return Promise.resolve(null);
+			return conversationIdPromise ??= resolveConversationFromApi(messageId).then((id) => {
+				conversationId = id;
+				return id;
+			});
+		}
+		let agentActive = false;
+		pi.on("agent_start", async () => {
+			agentActive = true;
+		});
+		pi.on("agent_end", async () => {
+			agentActive = false;
+		});
+		async function taskDoneMessage(meta) {
+			const code = meta.exitCode;
+			const status = meta.killedReason ? "killed" : code === 0 ? "completed" : code === null ? "finished" : "failed";
+			const codeSuffix = code !== null ? ` (exit code ${code})` : "";
+			const killNote = meta.killedReason ? `\n<kill-reason>${meta.killedReason}</kill-reason>` : "";
+			const recentOutput = await tailLog(meta.id, 20);
+			return {
+				customType: "anyone-bg-task-done",
+				content: `<background-task-finished>
+<task-id>${meta.id}</task-id>
+<status>${status}</status>
+<exit-code>${code ?? "unknown"}</exit-code>
+<command>${meta.command}</command>
+<summary>Background task ${taskLabel(meta)} ${status}${codeSuffix}</summary>${killNote}
+<recent-output>
+${recentOutput}
+</recent-output>
+</background-task-finished>
+Run bg_logs for the full output.
+
+This is a background-task completion, not a message from the user. If it needs no user-facing response — a routine or expected finish, a leftover or self-killed process, nothing the user must act on or would want to know right now — call \`platform channel suppress-reply\` and output nothing. Only send a message if the outcome changes what the user should do or know, or if you were explicitly waiting to report this result.`,
+				display: false
+			};
+		}
+		async function notifyCompletion(meta) {
+			if (meta.notified) return;
+			if (agentActive && sameConversation(meta, conversationId)) {
+				meta.notified = true;
+				pi.sendMessage(await taskDoneMessage(meta), {
+					triggerTurn: true,
+					deliverAs: "followUp"
+				});
+				log.info({
+					taskId: meta.id,
+					conversationId
+				}, "bg task completion delivered live (followUp)");
+				return;
+			}
+			if (meta.messageId) {
+				meta.notified = true;
+				log.info({
+					taskId: meta.id,
+					messageId: meta.messageId
+				}, "posting idle bg-task-done wake");
+				const message = await taskDoneMessage(meta);
+				postBackgroundTaskDone({
+					messageId: meta.messageId,
+					content: message.content
+				}).catch((err) => {
+					meta.notified = false;
+					log.warn({
+						err,
+						taskId: meta.id
+					}, "bg-task-done wake failed; will retry at next session_start");
+				});
+			} else log.info({ taskId: meta.id }, "bg task completed idle with no origin message; deferring to next session_start");
+		}
+		async function launchTask({ command, description, cwd }) {
+			taskCounter += 1;
+			const id = `bg-${process.pid.toString(36)}-${taskCounter}`;
+			try {
+				await mkdir(tasksDir(), { recursive: true });
+			} catch (err) {
+				log.error({
+					err,
+					taskId: id
+				}, "background task dir unavailable");
+			}
+			const logStream = createWriteStream(logPath(id), { flags: "a" });
+			logStream.on("error", (err) => {
+				log.warn({
+					err,
+					taskId: id
+				}, "bg task log write failed");
+			});
+			const startedAt = Date.now();
+			const meta = {
+				id,
+				command: stripPlatformExportsForDisplay(command),
+				startedAt,
+				logBytes: 0,
+				lastOutputAt: startedAt,
+				conversationId,
+				messageId,
+				description,
+				notified: false,
+				killedReason: null,
+				controller: new AbortController(),
+				running: true,
+				exitCode: null,
+				error: null
+			};
+			tasks.set(id, meta);
+			ops.exec(command, cwd, {
+				onData: (chunk) => {
+					meta.logBytes += chunk.length;
+					meta.lastOutputAt = Date.now();
+					logStream.write(chunk);
+				},
+				signal: meta.controller.signal
+			}).then((r) => {
+				meta.exitCode = r.exitCode;
+			}).catch((err) => {
+				if (!meta.controller.signal.aborted) {
+					meta.error = err instanceof Error ? err.message : String(err);
+					log.warn({
+						err,
+						taskId: id
+					}, "bg task exec error");
+				}
+			}).finally(async () => {
+				logStream.end();
+				await finished(logStream).catch(() => {});
+				meta.running = false;
+				log.info({
+					taskId: id,
+					exitCode: meta.exitCode
+				}, "bg task finished");
+				await notifyCompletion(meta);
+			});
+			ensureWatchdog();
+			log.info({
+				taskId: id,
+				conversationId
+			}, "bg task started");
+			return meta;
+		}
+		function knownTaskIds() {
+			return [...tasks.values()].filter((t) => sameConversation(t, conversationId)).map((t) => t.id).join(", ") || "(none)";
+		}
+		pi.on("session_start", async () => {
+			if (tasks.size === 0) return;
+			await ensureConversationId();
+			for (const [id, meta] of tasks) if (sameConversation(meta, conversationId) && !meta.running && meta.notified) {
+				tasks.delete(id);
+				await unlink(logPath(id)).catch(() => {});
+			}
+			const unnotified = [...tasks.values()].filter((t) => sameConversation(t, conversationId) && !t.notified && !t.running);
+			for (const meta of unnotified) {
+				meta.notified = true;
+				pi.sendMessage(await taskDoneMessage(meta));
+			}
+			if (unnotified.length > 0) log.info({
+				conversationId,
+				count: unnotified.length
+			}, "injected completed bg tasks at session_start");
+			if ([...tasks.values()].some((t) => sameConversation(t, conversationId) && t.running)) ensureWatchdog();
+		});
+		function err(text) {
+			return {
+				error: {
+					content: [{
+						type: "text",
+						text
+					}],
+					details: {},
+					isError: true
+				},
+				meta: null
+			};
+		}
+		function resolveTask(taskId) {
+			const exact = tasks.get(taskId);
+			if (exact && sameConversation(exact, conversationId)) return {
+				error: null,
+				meta: exact
+			};
+			const matches = [...tasks.values()].filter((t) => sameConversation(t, conversationId) && t.id.startsWith(taskId));
+			if (matches.length === 1) return {
+				error: null,
+				meta: matches[0]
+			};
+			if (matches.length > 1) return err(`Ambiguous task prefix "${taskId}" matches: ${matches.map((t) => t.id).join(", ")}`);
+			return err(`Unknown task ${taskId}. Known tasks: ${knownTaskIds()}`);
+		}
+		function listTasks() {
+			const mine = [...tasks.values()].filter((t) => sameConversation(t, conversationId));
+			if (mine.length === 0) return "No background tasks.";
+			return mine.map((t) => {
+				const state = t.running ? "running" : t.exitCode !== null ? `exited ${t.exitCode}${t.killedReason ? ` (killed: ${t.killedReason})` : ""}` : t.killedReason ? `killed: ${t.killedReason}` : "ended";
+				const elapsed = Math.round((Date.now() - t.startedAt) / 1e3);
+				const cmd = t.description ? ` — ${t.command.slice(0, 60)}` : "";
+				return `${taskLabel(t)} — ${state}, ${elapsed}s${cmd}`;
+			}).join("\n");
+		}
+		const taskIdParam = Type.Object({ taskId: Type.String({ description: "Task id from bg_run" }) });
+		const bgRun = {
+			name: "bg_run",
+			label: "Run in background",
+			description: "Run a bash command in the background. Returns immediately with a task id; output streams to a log file. You are sent a message when it finishes — keep working or end your turn meanwhile. Use for anything over a couple of minutes (builds, batch jobs, retry loops, downloads). Inspect with bg_status / bg_logs, stop with bg_kill.",
+			promptSnippet: "bg_run — run a long command without blocking; you are notified on completion",
+			parameters: Type.Object({
+				command: Type.String({ description: "Bash command to execute" }),
+				description: Type.Optional(Type.String({ description: "Clear, concise description of what this command does in active voice (2-6 words)." }))
+			}),
+			async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+				await ensureConversationId();
+				const { command, description = null } = params;
+				const meta = await launchTask({
+					command,
+					description,
+					cwd: ctx.cwd
+				});
+				return {
+					content: [{
+						type: "text",
+						text: `Started background task ${taskLabel(meta)}.\nlog: ${logPath(meta.id)}\nYou will get a message when it finishes. Check on it with bg_status {"taskId":"${meta.id}"}.`
+					}],
+					details: {}
+				};
+			}
+		};
+		const bgStatus = {
+			name: "bg_status",
+			label: "Background task status",
+			description: "Report whether a background task is running or finished, with its exit code and recent output (and a stall warning if it has gone quiet).",
+			parameters: Type.Object({
+				taskId: Type.Optional(Type.String({ description: "Task id or unambiguous prefix. Omit to list all your tasks." })),
+				lines: Type.Optional(Type.Number({ description: "Lines of recent output to include" }))
+			}),
+			async execute(_toolCallId, params) {
+				await ensureConversationId();
+				const { taskId, lines = DEFAULT_TAIL_LINES } = params;
+				if (!taskId) return {
+					content: [{
+						type: "text",
+						text: listTasks()
+					}],
+					details: {}
+				};
+				const resolved = resolveTask(taskId);
+				if (resolved.error) return resolved.error;
+				return {
+					content: [{
+						type: "text",
+						text: await describeStatus(resolved.meta, lines)
+					}],
+					details: {}
+				};
+			}
+		};
+		const bgLogs = {
+			name: "bg_logs",
+			label: "Background task logs",
+			description: "Show a background task's output log — the last lines by default, or the first lines with tail=false.",
+			parameters: Type.Object({
+				taskId: Type.String({ description: "Task id or unambiguous prefix" }),
+				lines: Type.Optional(Type.Number({ description: "Number of lines" })),
+				tail: Type.Optional(Type.Boolean({ description: "Last lines (default) or first when false" }))
+			}),
+			async execute(_toolCallId, params) {
+				await ensureConversationId();
+				const { taskId, lines = DEFAULT_TAIL_LINES, tail = true } = params;
+				const resolved = resolveTask(taskId);
+				if (resolved.error) return resolved.error;
+				return {
+					content: [{
+						type: "text",
+						text: tail ? await tailLog(resolved.meta.id, lines) : await headLog(resolved.meta.id, lines)
+					}],
+					details: {}
+				};
+			}
+		};
+		const bgKill = {
+			name: "bg_kill",
+			label: "Kill background task",
+			description: "Terminate a running background task and its whole process group.",
+			parameters: taskIdParam,
+			async execute(_toolCallId, params) {
+				await ensureConversationId();
+				const { taskId } = params;
+				const resolved = resolveTask(taskId);
+				if (resolved.error) return resolved.error;
+				const meta = resolved.meta;
+				if (!meta.running) return {
+					content: [{
+						type: "text",
+						text: `Task ${taskId} is not running.\n${await describeStatus(meta, 10)}`
+					}],
+					details: {}
+				};
+				try {
+					killTask(meta, null);
+					meta.notified = true;
+					return {
+						content: [{
+							type: "text",
+							text: `Killed task ${taskId}.`
+						}],
+						details: {}
+					};
+				} catch (killErr) {
+					return {
+						content: [{
+							type: "text",
+							text: `Failed to kill task ${taskId}: ${killErr instanceof Error ? killErr.message : String(killErr)}`
+						}],
+						details: {},
+						isError: true
+					};
+				}
+			}
+		};
+		pi.registerTool(bgRun);
+		pi.registerTool(bgStatus);
+		pi.registerTool(bgLogs);
+		pi.registerTool(bgKill);
+	};
+}
+//#endregion
+//#region src/extensions/index.ts
+/**
+* The static (config-free) agent extensions, in load order. `memoryExtension`
+* is the generic, agent-owned slice (`projects/`/`feedback/`/`reference/`); the
+* per-user `users/` slice is rendered by the platform memory extension inside
+* `platformExtensions()`, which can resolve the current user.
+*/
+const all = [
+	currentTimeExtension,
+	soulExtension,
+	memoryExtension,
+	mcp_default,
+	localToolsExtension,
+	toolCallEnvExtension,
+	bashDefaultTimeoutExtension,
+	toolCallSummaryExtension
+];
+/**
+* Platform-owned extensions — daemon session tracking, sandbox heartbeats,
+* OTel self-tracing, and background tasks. These are platform capabilities
+* every session must include (not agent-authored content); the session
+* factory appends them to the agent-chosen set.
+*/
+function platformExtensions({ sessionId, channelContext }) {
+	return [
+		createPlatformExtensions({
+			sessionId,
+			channelContext
+		}),
+		createPlatformMemoryExtension({ channelContext }),
+		selfTraceExtension,
+		createBackgroundTasksExtension({ channelContext }),
+		createSubagentExtension({ channelContext }),
+		createContextManagementExtension(),
+		resourcePressureWarningExtension
+	];
+}
+//#endregion
+export { all, createHarness, createHealthHandler, createPlatformEnvMiddleware, installToolUpdateAutoStop, isPlatformConfigLoaded, loadPlatformConfig, localToolsExtension, mcp_default as mcpExtension, memoryExtension, platformExtensions, runToolUpdateLoop, soulExtension, toolCallEnvExtension };