@skydiveai/pi-extensions 0.1.0-beta.16 → 0.1.0-beta.1601

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { DefaultExecutionEventBusManager, DefaultRequestHandler, InMemoryTaskStore } from "@a2a-js/sdk/server";
 import { UserBuilder, restHandler } from "@a2a-js/sdk/server/express";
 import { buildAgentCard, chainMiddleware, composeHandlers, createAgentExecutor, createProtocolHandlers, getCurrentTraceparent, logger, mountAt, requestHeaders, requestUrl, webHandlerToMiddleware } from "@skydiveai/pi-server";
-import { mkdir, open, readFile, readdir, stat, unlink } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { pathToFileURL } from "node:url";
@@ -19,8 +19,12 @@ import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import { Resource } from "@opentelemetry/resources";
 import { BatchSpanProcessor, NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME } from "@opentelemetry/semantic-conventions";
+import { execFile } from "node:child_process";
+import { availableParallelism } from "node:os";
+import { promisify } from "node:util";
 import { hc } from "hono/client";
 import { parse } from "yaml";
+import { quote } from "shell-quote";
 import { createWriteStream } from "node:fs";
 import { finished } from "node:stream/promises";
 import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
@@ -255,7 +259,7 @@ function createHealthHandler({ metadata }) {
 * read on the hot path before every LLM call), it falls back to the default
 * for that knob and logs once.
 */
-const log$13 = logger.child({ module: "context-management-config" });
+const log$15 = logger.child({ module: "context-management-config" });
 const DEFAULT_CONTEXT_MANAGEMENT_CONFIG = {
 	enabled: false,
 	perResultMaxBytes: 16 * 1024,
@@ -303,7 +307,7 @@ function resolveContextManagementConfig(env = process.env) {
 		maxModelCallsPerTurn: env.SKYDIVE_CTX_MAX_MODEL_CALLS
 	});
 	if (!parsed.success) {
-		log$13.warn({
+		log$15.warn({
 			event: "context_management_config_invalid",
 			err: parsed.error
 		}, "falling back to default context-management config");
@@ -437,7 +441,7 @@ const CAPABILITY_SOUL_NUDGE = "New capability gained — once the current task i
 * or `ToolDefinition[]`. Files starting with `_` or `.` are skipped, so
 * `tools/_example.ts` documents the shape without registering.
 */
-const log$12 = logger.child({ module: "local-tools-extension" });
+const log$14 = logger.child({ module: "local-tools-extension" });
 const TOOLS_DIRNAME = "tools";
 const fileState = /* @__PURE__ */ new Map();
 let pendingLocalToolsUpdate = null;
@@ -581,7 +585,7 @@ async function reconcileAndQueue({ pi, dir, reason }) {
 		dir
 	});
 	if (reason !== "session_start" && summaryHasChanges$1(summary)) pendingLocalToolsUpdate = summary;
-	log$12.info({
+	log$14.info({
 		event: "local_tools_reconcile",
 		reason,
 		total_tools: summary.totalTools,
@@ -603,7 +607,7 @@ const localToolsExtension = (pi) => {
 				reason: "session_start"
 			});
 		} catch (err) {
-			log$12.error({
+			log$14.error({
 				err,
 				event: "local_tools_reconcile_failed"
 			}, "local tools reconcile failed");
@@ -615,7 +619,7 @@ const localToolsExtension = (pi) => {
 		try {
 			current = await listToolFiles(dir);
 		} catch (err) {
-			log$12.warn({
+			log$14.warn({
 				err,
 				event: "local_tools_listing_failed"
 			}, "tools/ listing failed");
@@ -637,7 +641,7 @@ const localToolsExtension = (pi) => {
 				reason: "auto_reload"
 			});
 		} catch (err) {
-			log$12.error({
+			log$14.error({
 				err,
 				event: "local_tools_auto_reload_failed"
 			}, "auto-reload after tools/ change failed");
@@ -691,6 +695,19 @@ const STDERR_BUFFER_BYTES = 4096;
 * indistinguishable from any other transport problem. Walk the cause
 * chain so the agent sees the real underlying error.
 */
+/**
+* True when an error from an http MCP transport (connect, listTools, or a tool
+* call) is an authentication failure. With no authProvider configured the SDK
+* surfaces a 401 as `StreamableHTTPError(401)`; older paths translate it to
+* `UnauthorizedError`. A dead/expired OAuth token (the proxy can no longer
+* mint one) shows up here on the NEXT request against a previously-connected
+* client — not just at connect — so reconcile must re-classify such a failure
+* as `pending_auth` instead of a generic `failed`, keeping the "waiting on
+* auth" report consistent with `platform auth`.
+*/
+function isUnauthorizedError(err) {
+	return err instanceof UnauthorizedError || err instanceof StreamableHTTPError && err.code === 401;
+}
 function formatError(err) {
 	if (!(err instanceof Error)) return String(err);
 	const parts = [err.message];
@@ -712,7 +729,7 @@ async function connectHttp(_id, config, client) {
 			stderr: null
 		};
 	} catch (err) {
-		if (err instanceof UnauthorizedError || err instanceof StreamableHTTPError && err.code === 401) return {
+		if (isUnauthorizedError(err)) return {
 			status: "pending_auth",
 			client,
 			stderr: "",
@@ -862,7 +879,7 @@ async function loadMcpConfig(path) {
 * Clients are keyed by JSON-stringified config and reused across
 * reloads — only changed configs reconnect.
 */
-const log$11 = logger.child({ module: "mcp-extension" });
+const log$13 = logger.child({ module: "mcp-extension" });
 async function closeConnected(connected) {
 	try {
 		await connected.client.close();
@@ -1189,6 +1206,64 @@ var McpExtension = class {
 		try {
 			mcpTools = (await connected.client.listTools()).tools;
 		} catch (err) {
+			if (isUnauthorizedError(err) && serverConfig.transport === "http") {
+				await closeConnected(connected);
+				const retry = await connectClient(id, serverConfig, { connectTimeoutMs });
+				if (retry.status === "pending_auth") return {
+					id,
+					store: {
+						client: retry.client,
+						configKey,
+						status: "pending_auth",
+						stderrBuffer: null,
+						cliHint: retry.cliHint
+					},
+					serverStatus: {
+						status: "pending_auth",
+						stderr: "",
+						cliHint: retry.cliHint
+					},
+					change: null,
+					error: null,
+					tools: null
+				};
+				if (retry.status === "failed") return {
+					id,
+					store: null,
+					serverStatus: {
+						status: "failed",
+						error: retry.error,
+						stderr: retry.stderr
+					},
+					change: null,
+					error: {
+						serverId: id,
+						message: retry.error
+					},
+					tools: null
+				};
+				if (retry.status === "connected") {
+					connected = {
+						client: retry.client,
+						configKey,
+						status: "connected",
+						stderrBuffer: retry.stderr,
+						cliHint: null
+					};
+					mcpTools = (await connected.client.listTools()).tools;
+					return {
+						id,
+						store: connected,
+						serverStatus: { status: "connected" },
+						change: action === "reused" ? "refreshed" : action,
+						error: null,
+						tools: {
+							client: connected.client,
+							list: mcpTools
+						}
+					};
+				}
+			}
 			const message = err instanceof Error ? err.message : String(err);
 			const stderr = connected.stderrBuffer?.read() ?? "";
 			return {
@@ -1226,7 +1301,7 @@ var McpExtension = class {
 		});
 		this.lastConfigMtimeMs = await readConfigMtimeMs(configPath);
 		if (reason !== "session_start" && summaryHasChanges(summary)) this.pendingMcpUpdate = summary;
-		log$11.info({
+		log$13.info({
 			event: "mcp_reconcile",
 			reason,
 			total_tools: summary.totalTools,
@@ -1249,7 +1324,7 @@ var McpExtension = class {
 						reason: "session_start"
 					});
 				} catch (err) {
-					log$11.error({
+					log$13.error({
 						err,
 						event: "mcp_reconcile_failed"
 					}, "MCP reconcile failed");
@@ -1261,7 +1336,7 @@ var McpExtension = class {
 				try {
 					mtime = await readConfigMtimeMs(configPath);
 				} catch (err) {
-					log$11.warn({
+					log$13.warn({
 						err,
 						event: "mcp_mtime_check_failed"
 					}, "mtime check on mcp.config.json failed");
@@ -1275,7 +1350,7 @@ var McpExtension = class {
 						reason: "auto_reload"
 					});
 				} catch (err) {
-					log$11.error({
+					log$13.error({
 						err,
 						event: "mcp_auto_reload_failed"
 					}, "auto-reload after mcp.config.json change failed");
@@ -1638,16 +1713,380 @@ const bashDefaultTimeoutExtension = (pi) => {
 	});
 };
 //#endregion
+//#region src/extensions/resource-pressure-warning.ts
+/**
+* Mid-run resource-pressure warning to the agent.
+*
+* The sandbox already detects pressure — the boot scripts cap the
+* user-workload cgroup (memory.high/memory.max) and watchers log warn/crit
+* edges for memory and disk — but nothing told the *agent*, so a turn burned
+* straight to the OOM kill (or a full disk) and only learned about it from
+* the post-mortem notice. This extension closes that gap in-process: while a
+* turn is active it polls the agent cgroup and the root filesystem and, the
+* first time usage crosses a warn threshold, folds a system notification into
+* the open turn so the agent can checkpoint, shed work (constrain
+* parallelism, kill a background hog, clean scratch space), or request a
+* bigger tier BEFORE the kill.
+*
+* The notification is triggered by the two conditions that actually kill
+* work — memory near the cgroup hard cap, disk near full — and reports a
+* snapshot of all the relevant stats (memory, CPU utilization, disk) so the
+* agent can tell which resource is the problem and how much headroom the
+* others have.
+*
+* Edge-triggered, once per trigger per turn: the fired flags reset on
+* agent_start, so a turn that rides a threshold gets one warning per
+* resource, not a stream. Polling only runs while the agent is active — an
+* idle sandbox's resource usage is not the agent's problem and there is no
+* open turn to deliver into anyway.
+*
+* Best-effort throughout: any read failure (cgroup absent, controller not
+* delegated, non-cgroup-v2 host, df missing) reads as "no signal" for that
+* stat and the extension warns on what it can see — it must never break a
+* turn over an observability feature.
+*/
+const execFileAsync = promisify(execFile);
+const log$12 = logger.child({ module: "resource-pressure-warning" });
+const POLL_INTERVAL_MS = 1e4;
+function envOverride(name) {
+	for (const prefix of ["SKYDIVE_", "ANYONE_"]) {
+		const value = process.env[`${prefix}${name}`];
+		if (value != null && value !== "") return value;
+	}
+	return null;
+}
+function cgroupDir() {
+	return envOverride("AGENT_CGROUP") ?? "/sys/fs/cgroup/agent";
+}
+function diskRoot() {
+	return envOverride("DISK_ROOT") ?? "/";
+}
+/**
+* Read a cgroup v2 scalar file. Returns a number, or null for "max"
+* (uncapped), an empty/absent file, or any read/parse error — an uncapped or
+* unreadable limit means there is nothing meaningful to warn against.
+*/
+async function readScalar(file) {
+	try {
+		const raw = (await readFile(`${cgroupDir()}/${file}`, "utf8")).trim();
+		if (raw === "" || raw === "max") return null;
+		const n = Number(raw);
+		return Number.isFinite(n) ? n : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Read a cgroup v2 "flat keyed" file (one `key value` pair per line, e.g.
+* cpu.stat) and return the counter for `key`, or null when absent.
+*/
+async function readKeyedCounter(file, key) {
+	try {
+		const raw = await readFile(`${cgroupDir()}/${file}`, "utf8");
+		for (const line of raw.split("\n")) {
+			const [k, v] = line.trim().split(/\s+/);
+			if (k === key) {
+				const n = Number(v);
+				return Number.isFinite(n) ? n : null;
+			}
+		}
+		return null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* Live memory usage as an integer percent of the hard cap, or null when
+* either side is unreadable/uncapped. Exported for tests.
+*/
+async function readMemUsePct() {
+	const [current, max] = await Promise.all([readScalar("memory.current"), readScalar("memory.max")]);
+	if (current === null || max === null || max <= 0) return null;
+	return {
+		pct: Math.floor(current / max * 100),
+		currentBytes: current,
+		maxBytes: max
+	};
+}
+/**
+* Root filesystem used% (df -P Capacity column), or null on any failure.
+* Exported for tests.
+*/
+async function readDiskUsePct() {
+	try {
+		const { stdout } = await execFileAsync("df", ["-P", diskRoot()]);
+		const dataRow = stdout.trim().split("\n")[1];
+		if (dataRow == null) return null;
+		const capacity = dataRow.trim().split(/\s+/)[4];
+		if (capacity == null) return null;
+		const pct = Number(capacity.replace("%", ""));
+		return Number.isFinite(pct) ? pct : null;
+	} catch (_error) {
+		return null;
+	}
+}
+/**
+* CPU utilization sampler. cgroup v2 exposes cumulative CPU time
+* (cpu.stat usage_usec); utilization is the delta between two samples over
+* the wall time between them, normalized by core count. The first call after
+* construction has no previous sample and returns null.
+*/
+function createCpuSampler() {
+	let prevUsageUsec = null;
+	let prevAtMs = null;
+	return async () => {
+		const usage = await readKeyedCounter("cpu.stat", "usage_usec");
+		const now = Date.now();
+		const prev = prevUsageUsec;
+		const prevAt = prevAtMs;
+		prevUsageUsec = usage;
+		prevAtMs = now;
+		if (usage === null || prev === null || prevAt === null) return null;
+		const wallUsec = (now - prevAt) * 1e3;
+		if (wallUsec <= 0) return null;
+		const cores = availableParallelism();
+		const pct = Math.round((usage - prev) / (wallUsec * cores) * 100);
+		return Math.max(0, Math.min(100, pct));
+	};
+}
+function fmtMb(bytes) {
+	return Math.round(bytes / 1024 / 1024);
+}
+/** The model-facing warning text. Exported for tests. */
+function resourcePressureWarningText(trigger, { mem, cpuPct, diskPct }) {
+	const stats = [];
+	if (mem) stats.push(`memory ${mem.pct}% of cap (${fmtMb(mem.currentBytes)}/${fmtMb(mem.maxBytes)} MB)`);
+	if (cpuPct !== null) stats.push(`CPU ${cpuPct}%`);
+	if (diskPct !== null) stats.push(`disk ${diskPct}% full`);
+	const lead = trigger === "memory" ? `Your sandbox is at ${mem?.pct}% of its memory cap. If usage keeps climbing, the kernel will kill the offending process and this turn may die with it.` : `Your sandbox's disk is ${diskPct}% full. If it fills completely, writes will start failing and this turn may die with them.`;
+	const remedy = trigger === "memory" ? "checkpoint in-flight work (commit and push), then reduce the footprint — constrain parallelism, run heavy steps sequentially, or kill background processes you no longer need." : "checkpoint in-flight work (commit and push), then free space — clean build artifacts, caches, and scratch files you no longer need.";
+	return `<system_notification>${lead} Current usage: ${stats.join(", ")}. Act now: ${remedy} If the workload genuinely needs more resources, request a bigger sandbox with \`platform compute request\`. This is an automated resource warning, not a message from the user; continue the task, adjusted.</system_notification>`;
+}
+const resourcePressureWarningExtension = (pi) => {
+	let agentActive = false;
+	let warnedMemThisTurn = false;
+	let warnedDiskThisTurn = false;
+	let timer = null;
+	const sampleCpu = createCpuSampler();
+	async function checkOnce() {
+		if (!agentActive || warnedMemThisTurn && warnedDiskThisTurn) return;
+		const [mem, cpuPct, diskPct] = await Promise.all([
+			readMemUsePct(),
+			sampleCpu(),
+			readDiskUsePct()
+		]);
+		let trigger = null;
+		if (!warnedMemThisTurn && mem !== null && mem.pct >= 80) {
+			trigger = "memory";
+			warnedMemThisTurn = true;
+		} else if (!warnedDiskThisTurn && diskPct !== null && diskPct >= 80) {
+			trigger = "disk";
+			warnedDiskThisTurn = true;
+		}
+		if (trigger === null) return;
+		log$12.warn({
+			trigger,
+			mem,
+			cpuPct,
+			diskPct
+		}, "resource pressure warning delivered to agent");
+		await pi.sendMessage({
+			customType: "anyone-resource-pressure-warning",
+			content: resourcePressureWarningText(trigger, {
+				mem,
+				cpuPct,
+				diskPct
+			}),
+			display: false
+		}, {
+			triggerTurn: true,
+			deliverAs: "followUp"
+		});
+	}
+	pi.on("agent_start", async () => {
+		agentActive = true;
+		warnedMemThisTurn = false;
+		warnedDiskThisTurn = false;
+		if (!timer) {
+			timer = setInterval(() => {
+				checkOnce().catch((err) => {
+					log$12.error({ err }, "resource pressure check failed");
+				});
+			}, POLL_INTERVAL_MS);
+			timer.unref?.();
+		}
+	});
+	pi.on("agent_end", async () => {
+		agentActive = false;
+		if (timer) {
+			clearInterval(timer);
+			timer = null;
+		}
+	});
+};
+//#endregion
+//#region src/extensions/disk-guard.ts
+const log$11 = logger.child({ module: "disk-guard" });
+/**
+* In-band bypass. The guard is a safety net, not a jail: when the agent knows
+* a flagged command is genuinely safe (writing to a different mount, a tiny
+* bounded download, a delete-then-clone one-liner, an emergency it accepts the
+* risk on) it can force the command through by appending this marker as a
+* trailing shell comment. Kept as a comment so it never changes what the
+* command does, and matched case-insensitively with flexible spacing so the
+* agent doesn't have to reproduce it byte-for-byte.
+*/
+const BYPASS_MARKER = /#\s*disk-guard:\s*allow\b/i;
+/** The exact marker text the block message tells the agent to append. */
+const BYPASS_HINT = "# disk-guard: allow";
+/**
+* Harness-level kill switch: set DISK_GUARD_DISABLE=1 to turn the guard off
+* entirely. This is the "I own my harness, let me opt out" knob — an agent
+* that boots its own harness can disable the guard for its whole process
+* without a code roll, and it's also the fleet-wide escape hatch if the
+* classifier ever misfires and blocks real work. The bare name is honored
+* first; the SKYDIVE_/ANYONE_ prefixes are accepted too for consistency with
+* the other env overrides. Empty/unset/"0"/"false" leave the guard on.
+*/
+function guardDisabledByEnv() {
+	for (const name of [
+		"DISK_GUARD_DISABLE",
+		"SKYDIVE_DISK_GUARD_DISABLE",
+		"ANYONE_DISK_GUARD_DISABLE"
+	]) {
+		const value = process.env[name];
+		if (value != null && value !== "" && value !== "0" && value !== "false") return true;
+	}
+	return false;
+}
+/** True when the command carries the in-band bypass marker. */
+function hasBypassMarker(command) {
+	return BYPASS_MARKER.test(command);
+}
+/**
+* Commands that reclaim space or merely inspect it. If any of these verbs
+* appears in the command line, we never block — otherwise the guard would trap
+* the agent by blocking the exact command it needs to dig out. Matched as
+* whole words so `remove-item` etc. don't accidentally match `rm`.
+*/
+const RECLAIM_PATTERNS = [
+	/\brm\b/,
+	/\brmdir\b/,
+	/\bdf\b/,
+	/\bdu\b/,
+	/\bncdu\b/,
+	/\bfind\b[^|]*\s-delete\b/,
+	/\btruncate\b/,
+	/\bgit\s+(gc|prune|clean|worktree\s+remove|worktree\s+prune)\b/,
+	/\b(yarn|npm|pnpm|bun)\s+.*\b(cache\s+clean|cache\s+clear|store\s+prune)\b/,
+	/\bcache\s+(clean|clear|prune)\b/,
+	/\b(docker|podman)\s+.*\bprune\b/,
+	/\bapt(-get)?\s+clean\b/,
+	/\bjournalctl\b[^|]*--vacuum/
+];
+/**
+* File extensions that mean a download is actually LARGE — archives, disk
+* images, compiled/binary artifacts, model weights, media. A curl/wget is only
+* gated when it writes one of these; an API/page fetch to a `.json`/`.html`/
+* `.txt` file is tiny and must not be blocked. Derived from 4,144 real
+* commands: ~64% of `curl -o` uses were tiny fetches, only ~4% large.
+*/
+const BIG_DOWNLOAD_EXT = "(?:tar\\.gz|tgz|tar|zip|iso|gz|bz2|xz|zst|deb|rpm|pkg|dmg|whl|jar|7z|img|mp4|mov|avi|mkv|onnx|gguf|safetensors|bin|node)";
+/**
+* Commands that consume a meaningful amount of disk. Kept deliberately tight
+* and high-precision: validated against 4,144 real commands from the last 7
+* days, the earlier "writes a file" heuristic flagged 82% of everything (a
+* `curl -o /tmp/x.json` API call is not a disk event). This set flags ~33%,
+* almost all genuinely large — real installs, clones, big-archive downloads,
+* extractions. What was DROPPED and why:
+*   - `git fetch` / `git pull` — incremental on an existing clone, usually tiny.
+*   - `git checkout` — overwhelmingly `git checkout <ref> -- <file>` or a
+*     branch switch, ~zero net growth; the rare full materialization isn't
+*     worth the false-positive rate.
+*   - bare `curl -o` / `wget -o` — see BIG_DOWNLOAD_EXT above.
+*   - loose `… build` — matched `--mode=skip-build`, `oxfmt … build`, prose.
+* The remaining big-disk op in escher is `git clone` and `git worktree add`
+* (which is really a checkout), both kept.
+*/
+const SPACE_HUNGRY_PATTERNS = [
+	/\bgit\s+clone\b/,
+	/\bgit\s+worktree\s+add\b/,
+	/\b(yarn|npm|pnpm|bun)\s+(install|add|ci)\b/,
+	/\byarn\s*$/,
+	/\byarn\s+--(?!version|help)\S/,
+	/\bpip3?\s+install\b/,
+	/\bapt(-get)?\s+install\b/,
+	/\bnpm\s+pack\b/,
+	/\bdocker\s+(build|pull)\b/,
+	new RegExp(`\\b(?:curl|wget)\\b[^\\n]*\\s-[a-zA-Z]*[oO]\\b[^\\n]*\\.${BIG_DOWNLOAD_EXT}\\b`, "i"),
+	new RegExp(`\\b(?:curl|wget)\\b[^\\n]*\\.${BIG_DOWNLOAD_EXT}\\b[^\\n]*\\s-[a-zA-Z]*[oO]\\b`, "i"),
+	/\btar\s+[^\n|]*x[^\n|]*f/,
+	/\bunzip\b/,
+	/\bdd\b[^\n|]*\bof=/
+];
+/**
+* True when the command reclaims or inspects space — these are always allowed,
+* even on a 100%-full box, so the agent can dig itself out.
+*/
+function isReclaimCommand(command) {
+	return RECLAIM_PATTERNS.some((re) => re.test(command));
+}
+/**
+* True when the command is likely to consume a meaningful amount of disk.
+* A reclaim/inspect command is never space-hungry — the reclaim check wins so a
+* `git worktree remove` or a `yarn cache clean` is never mistaken for growth.
+*/
+function isSpaceHungryCommand(command) {
+	if (isReclaimCommand(command)) return false;
+	return SPACE_HUNGRY_PATTERNS.some((re) => re.test(command));
+}
+/**
+* The decision, factored out and pure so it's exhaustively testable without a
+* real filesystem. Block only when we have a disk reading, it's at/above the
+* critical threshold, the command is space-hungry (and not a reclaim), and the
+* agent hasn't explicitly opted out with the bypass marker.
+*/
+function shouldBlockForDisk(command, diskPct) {
+	if (diskPct === null) return false;
+	if (diskPct < 95) return false;
+	if (hasBypassMarker(command)) return false;
+	return isSpaceHungryCommand(command);
+}
+/** The agent-facing explanation returned as the blocked tool result. */
+function diskBlockReason(command, diskPct) {
+	return `Blocked: the sandbox disk is ${diskPct}% full and this command (\`${command.trim().slice(0, 120)}\`) writes a large amount, so it would fail partway with ENOSPC and leave a corrupt result. Reclaim space FIRST, then retry. Free ONLY what THIS conversation created — scratch/build output you wrote this run, downloads you're done with, and worktrees/branches whose work you've already committed and pushed (\`git worktree remove\`, \`yarn cache clean\`, delete your own scratch). Do NOT blindly wipe /tmp or delete a clone/worktree you don't recognize — other conversations share this box. Check headroom with \`df -h /\` and \`du -sh ~/workspace/* 2>/dev/null\`. If you genuinely can't free enough, stop and tell the user you're blocked on disk rather than retrying the write. If you're certain this command is safe anyway (writes elsewhere, tiny bounded size, delete-then-write), force it through by appending \` ${BYPASS_HINT}\` to the command.`;
+}
+const diskGuardExtension = (pi) => {
+	pi.on("tool_call", async (event) => {
+		if (event.toolName !== "bash") return;
+		if (guardDisabledByEnv()) return;
+		const command = event.input.command;
+		if (typeof command !== "string" || command.length === 0) return;
+		if (hasBypassMarker(command)) return;
+		if (!isSpaceHungryCommand(command)) return;
+		const diskPct = await readDiskUsePct();
+		if (!shouldBlockForDisk(command, diskPct)) return;
+		log$11.warn({
+			diskPct,
+			command: command.slice(0, 200)
+		}, "blocked space-hungry bash command on near-full disk");
+		return {
+			block: true,
+			reason: diskBlockReason(command, diskPct)
+		};
+	});
+};
+//#endregion
 //#region src/channel-context-ref.ts
 /**
-* The worker injects only a reference — `{ channel, messageId }` — into the
-* sandbox env (`SKYDIVE_CHANNEL_CONTEXT`) rather than the full context.
+* The worker injects a small reference — `{ channel, messageId, runId }` —
+* into the sandbox env (`SKYDIVE_CHANNEL_CONTEXT`) rather than the full context.
 *
 * The canonical `ChannelContextRef` type + `parseChannelContextRef` live in
 * `@createinc/anyone-channels`, but the harness (`@skydiveai/*`) keeps zero
 * `@createinc/*` dependencies — importing that package would pull the whole
-* platform channel stack (Slack/email/Linq SDKs, messaging) in just to read
-* two fields. So we validate the (stable) shape locally instead.
+* platform channel stack (Slack/email/Linq SDKs, messaging) just to read one
+* field. So we validate the field this consumer needs locally instead.
 */
 const channelContextRefSchema = z.object({ messageId: z.string().nullable() });
 /**
@@ -1679,6 +2118,23 @@ function apiBaseUrl() {
 }
 //#endregion
 //#region src/extensions/platform.ts
+/**
+* Platform extension — bridges the agent harness to the Skydive platform daemon.
+*
+* Responsibilities:
+* - Heartbeat: periodic POST to the API so the sandbox manager knows the
+*   agent is alive. Throttled to once per minute, triggered by tool events.
+* - Session tracking: registers the session with the daemon on start,
+*   streams tool_call / tool_result events so the daemon can track which
+*   session is actively executing, and signals session end on agent_end.
+* - Channel context: passes the SKYDIVE_CHANNEL_CONTEXT (containing the
+*   messageId) to the daemon so file writes can be attributed to the
+*   correct conversation.
+*
+* All daemon POSTs are fire-and-forget — failures are logged but never
+* block the agent. The daemon may not be running (e.g. local dev without
+* a sandbox), and that's fine.
+*/
 const HEARTBEAT_THROTTLE_MS = 6e4;
 const TOOL_HEARTBEAT_INTERVAL_MS = 5e3;
 const MAX_TOOL_HEARTBEATS = 1440 * 60 * 1e3 / TOOL_HEARTBEAT_INTERVAL_MS;
@@ -1690,9 +2146,56 @@ function sandboxClient() {
 	return hc(`${apiUrl}/api/v1/sandbox`);
 }
 /**
-* Fetch every harness feature flag in one GET (`{ contextManagement, subagent,
-* ... }` — see apps/anyone/api/src/routes/sandbox-feature-flags.ts). Returns
-* null when indeterminate (no api url, or the request failed) so the shared
+* Is this box still an unclaimed warm-pool sandbox? (ANY-6000, the
+* feature-flags half of the ANY-5184 pool 403 wave.)
+*
+* `GET /sandbox/feature-flags` is agent-only, so the shared poller's request
+* from a pool box can only 403 — a guaranteed-failing GET every 60s for the
+* life of the pool phase. The discriminator is the sandbox token's `type`
+* claim, read UNVERIFIED (this box never holds the signing secret): not an
+* authorization decision, only "should I bother calling?", and the api still
+* authorizes every request.
+*
+* Read per call from the daemon's persisted env file, NOT process.env:
+* claiming a pool box rebinds the token in place (the daemon rewrites this
+* file) while the harness's process.env keeps the boot snapshot, so a
+* process-env gate would leave a claimed box permanently skipping — trading a
+* wasted request for silently frozen flags, which is strictly worse. "Cannot
+* tell" (no file, no token, unparseable payload) reports false so the poll
+* proceeds.
+*/
+const daemonEnvIdentitySchema = z.object({
+	ANYONE_SANDBOX_TOKEN: z.string().optional(),
+	SKYDIVE_SANDBOX_TOKEN: z.string().optional()
+}).passthrough();
+const tokenTypeSchema = z.object({ type: z.string() }).passthrough();
+async function isPoolIdentity() {
+	try {
+		const override = process.env.ANYONE_DAEMON_ENV_CACHE;
+		const candidates = override ? [override] : ["/run/anyone-system/daemon-env.json", "/tmp/.anyone/daemon-env.json"];
+		let raw = null;
+		for (const file of candidates) {
+			raw = await readFile(file, "utf8").catch(() => null);
+			if (raw !== null) break;
+		}
+		if (raw === null) return false;
+		const env = daemonEnvIdentitySchema.safeParse(JSON.parse(raw));
+		if (!env.success) return false;
+		const token = env.data.ANYONE_SANDBOX_TOKEN ?? env.data.SKYDIVE_SANDBOX_TOKEN;
+		if (typeof token !== "string" || token === "") return false;
+		const payload = token.split(".")[1];
+		if (!payload) return false;
+		const claims = tokenTypeSchema.safeParse(JSON.parse(Buffer.from(payload, "base64url").toString("utf8")));
+		return claims.success && claims.data.type === "onboarding-pool";
+	} catch (_err) {
+		return false;
+	}
+}
+/**
+* Fetch every harness feature flag in one GET (`{ contextManagement, ... }`
+* — see apps/anyone/api/src/routes/sandbox-feature-flags.ts). Returns
+* null when indeterminate (no api url, the request failed, or the box is an
+* unclaimed pool sandbox whose token the route would 403) so the shared
 * poller keeps the last-known values rather than flipping on a transient error.
 * This is the single fetch behind `feature-flags-poll.ts`; extensions read the
 * polled values there instead of issuing their own GET.
@@ -1700,6 +2203,7 @@ function sandboxClient() {
 async function fetchHarnessFlags() {
 	const client = sandboxClient();
 	if (!client) return null;
+	if (await isPoolIdentity()) return null;
 	try {
 		const res = await client["feature-flags"].$get();
 		if (!res.ok) {
@@ -1709,11 +2213,7 @@ async function fetchHarnessFlags() {
 			}, "feature-flags fetch failed");
 			return null;
 		}
-		const body = await res.json();
-		return {
-			contextManagement: body.contextManagement ?? null,
-			subagent: body.subagent ?? null
-		};
+		return { contextManagement: (await res.json()).contextManagement ?? null };
 	} catch (err) {
 		log$10.debug({
 			err,
@@ -1764,6 +2264,19 @@ async function postBackgroundTaskDone({ messageId, content }) {
 	} });
 	if (!res.ok) throw new Error(`bg-task-done POST failed: ${res.status}`);
 }
+function postBackgroundTasksSnapshot({ messageId, tasks }) {
+	const client = sandboxClient();
+	if (!client || !messageId) return;
+	client["bg-tasks"].$post({ json: {
+		messageId,
+		tasks
+	} }).catch((err) => {
+		log$10.debug({
+			err,
+			event: "bg_tasks_snapshot_failed"
+		}, "bg-tasks snapshot publish failed");
+	});
+}
 async function postSubagentSpawn({ messageId, tasks }) {
 	const client = sandboxClient();
 	if (!client) throw new Error("no api url for subagent-spawn");
@@ -1771,8 +2284,19 @@ async function postSubagentSpawn({ messageId, tasks }) {
 		messageId,
 		tasks
 	} });
-	if (!res.ok) throw new Error(`subagent-spawn POST failed: ${res.status}`);
-	return { taskIds: (await res.json()).taskIds };
+	if (!res.ok) {
+		let detail = "";
+		try {
+			const errBody = await res.json();
+			if (errBody && typeof errBody.error === "string") detail = `: ${errBody.error}`;
+		} catch {}
+		throw new Error(`subagent-spawn POST failed (${res.status})${detail}`);
+	}
+	const body = await res.json();
+	return {
+		taskIds: body.taskIds,
+		tasks: body.tasks ?? []
+	};
 }
 function createHeartbeatThrottle({ messageId }) {
 	let lastAt = 0;
@@ -1921,20 +2445,16 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 * Shared harness feature-flag poll.
 *
 * The api exposes one `/feature-flags` GET that returns every harness flag in a
-* single response (`{ contextManagement, subagent, commandFlags }` — see
+* single response (`{ contextManagement, commandFlags }` — see
 * apps/anyone/api/src/routes/sandbox-feature-flags.ts). Rather than each
 * extension issuing its own GET — and, worse, a *blocking* GET on the
 * pre-first-token `session_start` path — a single background poller fetches
 * that response once per interval and fans the values out to every subscriber.
 *
-* Why one poller: the subagent extension gates its tool registration on the
-* `subagent` flag. If it awaited a fresh GET inside `session_start` the tool
-* schema (part of the prefill) couldn't be finalized until a serial
-* sandbox→api round-trip settled, adding a net-new pre-token network hop on
-* every session, flag on or off. Reading the last-polled value instead keeps
-* the hot path allocation-only. A cold cache reads as `null` (fail-open to
-* unregistered); a newly-flipped flag takes effect on the next poll, matching
-* how context-management already treats its flag.
+* Why one poller: context-management consumes the `contextManagement` flag
+* without a blocking GET on the pre-first-token `session_start` path. Reading
+* the last-polled value keeps the hot path allocation-only; a cold cache reads
+* as `null` and a newly-flipped flag takes effect on the next poll.
 *
 * The poll is fire-and-forget and self-unref'd — it never keeps the process
 * alive and an indeterminate result (no api url / transient failure) leaves the
@@ -1943,15 +2463,21 @@ function createPlatformExtensions({ sessionId, channelContext }) {
 const log$9 = logger.child({ module: "feature-flags-poll" });
 const FLAG_POLL_INTERVAL_MS = 6e4;
 let contextManagement = null;
-let subagent = null;
-const subscribers = {
-	contextManagement: /* @__PURE__ */ new Set(),
-	subagent: /* @__PURE__ */ new Set()
-};
+const subscribers = { contextManagement: /* @__PURE__ */ new Set() };
 let pollerStarted = false;
+let firstPollSettled = false;
+let resolveFirstPoll = null;
+new Promise((resolve) => {
+	resolveFirstPoll = resolve;
+});
+function markFirstPollSettled() {
+	if (firstPollSettled) return;
+	firstPollSettled = true;
+	resolveFirstPoll?.();
+}
 /** Last-polled value of a flag, or `null` if not yet resolved. */
-function getPolledFlag(name) {
-	return name === "contextManagement" ? contextManagement : subagent;
+function getPolledFlag(_name) {
+	return contextManagement;
 }
 /**
 * Subscribe to changes of a flag. The callback fires only on a *transition*
@@ -1964,9 +2490,8 @@ function onFlagChange(name, cb) {
 }
 function apply(name, next) {
 	if (next === null) return;
-	const prev = name === "contextManagement" ? contextManagement : subagent;
-	if (name === "contextManagement") contextManagement = next;
-	else subagent = next;
+	const prev = contextManagement;
+	contextManagement = next;
 	if (next !== prev) for (const cb of subscribers[name]) try {
 		cb(next);
 	} catch (err) {
@@ -1977,10 +2502,13 @@ function apply(name, next) {
 	}
 }
 async function pollOnce() {
-	const flags = await fetchHarnessFlags();
-	if (!flags) return;
-	apply("contextManagement", flags.contextManagement ?? null);
-	apply("subagent", flags.subagent ?? null);
+	try {
+		const flags = await fetchHarnessFlags();
+		if (!flags) return;
+		apply("contextManagement", flags.contextManagement ?? null);
+	} catch (err) {
+		log$9.debug({ err }, "feature-flag poll threw");
+	}
 }
 /**
 * Start the shared background poll (idempotent). No-op when there's no
@@ -1991,7 +2519,7 @@ async function pollOnce() {
 function startFeatureFlagPoller() {
 	if (pollerStarted || !hasFlagSource()) return;
 	pollerStarted = true;
-	pollOnce();
+	pollOnce().finally(markFirstPollSettled);
 	setInterval(() => void pollOnce(), FLAG_POLL_INTERVAL_MS).unref?.();
 }
 //#endregion
@@ -2209,37 +2737,35 @@ const currentTimeExtension = (pi) => {
 //#endregion
 //#region src/memory.ts
 /**
-* In-harness memory index builder.
-*
-* The agent has an agent-level file-based memory at `<cwd>/.memory/`,
-* organized by directory:
+* In-harness memory readers.
 *
-*   .memory/users/<id>-<name>/<topic>.md
-*   .memory/projects/<project_slug>/<topic>.md
-*   .memory/feedback/<topic>.md
-*   .memory/reference/<topic>.md
+* The agent has an agent-level file-based memory at `<cwd>/.memory/`, split
+* into two halves that are surfaced differently:
 *
-* The path encodes type and subject (for `users/`, the subject is the
-* person's stable id with a readable name suffix); each `.md` file's
-* frontmatter only carries `name` and `description`.
+* 1. Shared knowledge (projects, lessons, external systems) — indexed by a
+*    single hand-maintained `<cwd>/.memory/MEMORY.md` that the *agent* writes
+*    and curates, Claude-Code style: one line per fact pointing at the file
+*    that holds it. `readMemoryIndexFile` just reads that file; the agent owns
+*    its contents. This is the whole index for the shared half — there is no
+*    derived walk and no per-directory `MEMORY.md`.
 *
-* `buildMemoryIndex` walks `.memory/` by type directory, reads only the
-* frontmatter of each `.md` (open fd → read first ~4KB → close, in
-* parallel), and renders a markdown index grouped by type and (where
-* applicable) by subject. Files outside the four type directories are
-* ignored. Bodies are never read — the agent loads a specific memory's
-* body on demand via the `read` tool when the index entry says it's
-* relevant.
+* 2. Per-person memory — `.memory/users/<id>-<name>/<topic>.md`. This half is
+*    *derived*, not hand-maintained, because it has to be filtered to the one
+*    person on the current turn (a single hand-written index couldn't be
+*    scoped per-user without leaking one person's notes into another's
+*    conversation). `buildMemoryIndex` walks a single user's directory, reads
+*    only the frontmatter of each `.md` (open fd → read first ~4KB → close, in
+*    parallel), and renders an index. Each `.md`'s frontmatter carries `name`
+*    and `description`; bodies are never read — the agent loads a specific
+*    memory's body on demand via the `read` tool.
 *
-* Mtime cache keyed by cwd — within the lifetime of a sandbox the cwd
-* is fixed, so this is effectively a single-entry cache. Cache invalidates
-* when any `.md` in the tree is added/modified/deleted; turns where
-* memory didn't change reuse the cached string.
+* Mtime cache (for the derived per-user half) keyed by cwd — within the
+* lifetime of a sandbox the cwd is fixed, so this is effectively a single-entry
+* cache. It invalidates when any `.md` under `users/` is added/modified/
+* deleted; turns where memory didn't change reuse the cached entries.
 *
-* Frontmatter is parsed as YAML (`yaml` package) and validated with a
-* zod schema — files that don't match the shape are dropped from the
-* index. The same schema can be reused at write time if we want to
-* validate before commit.
+* Frontmatter is parsed as YAML (`yaml` package) and validated with a zod
+* schema — files that don't match the shape are dropped from the index.
 */
 const FRONTMATTER_READ_BYTES = 4096;
 const FrontmatterSchema = z.object({
@@ -2247,33 +2773,118 @@ const FrontmatterSchema = z.object({
 	description: z.string().min(1)
 }).passthrough();
 const MEMORY_DIRNAME = ".memory";
-const TYPE_DIRS = [
-	"users",
-	"projects",
-	"feedback",
-	"reference"
+const MEMORY_INDEX_FILENAME = "MEMORY.md";
+const USERS_DIRNAME = "users";
+/**
+* The shared-knowledge type dirs from the old frontmatter-indexed layout, used
+* only to seed a `MEMORY.md` for agents created before it existed (see
+* `seedMemoryIndexFile`). `users/` is deliberately excluded — per-person memory
+* stays derived and never lands in the shared, un-scoped `MEMORY.md`.
+*/
+const LEGACY_SHARED_TYPES = [
+	{
+		dir: "projects",
+		label: "Projects"
+	},
+	{
+		dir: "feedback",
+		label: "Feedback"
+	},
+	{
+		dir: "reference",
+		label: "Reference"
+	}
 ];
-const TYPES_WITH_SUBJECT = new Set(["users", "projects"]);
-const TYPE_LABELS = {
-	users: "Users",
-	projects: "Projects",
-	feedback: "Feedback",
-	reference: "Reference"
-};
+/**
+* Soft budget for an injected index block. The index is read and injected into
+* the system prompt on every turn, so every entry costs context for the rest of
+* the conversation. Past this size we nudge the agent to consolidate and prune
+* rather than keep appending. Not a hard cap — nothing is truncated.
+*/
+const MEMORY_INDEX_SOFT_BUDGET_CHARS = 2e4;
+/**
+* Hard cap on the injected index — double the soft budget. The soft budget only
+* warns; this actually bounds what we inject so a runaway index can't consume
+* unbounded context on every turn. Past this, the index is truncated (on a line
+* boundary) before injection. It's a backstop, not a normal operating point.
+*/
+const MEMORY_INDEX_HARD_BUDGET_CHARS = MEMORY_INDEX_SOFT_BUDGET_CHARS * 2;
+/**
+* Cheap size summary of a rendered index block, used to surface how much of the
+* every-turn context budget the index is spending so the agent keeps it lean.
+* Counts pointer/file lines — both the derived `` - `path` — desc`` form and
+* the hand-maintained `- [Title](path) — hook` form — not the group headers.
+*/
+function summarizeIndex(index) {
+	const entryCount = index.split("\n").filter((line) => /^\s*- (?:`|\[)/.test(line)).length;
+	const charCount = index.length;
+	return {
+		entryCount,
+		charCount,
+		overBudget: charCount > MEMORY_INDEX_SOFT_BUDGET_CHARS
+	};
+}
+/**
+* One-line size note for an index block header, e.g. `12 entries, 3187 chars`.
+*/
+function indexSizeNote(index) {
+	const { entryCount, charCount } = summarizeIndex(index);
+	return `${entryCount} ${entryCount === 1 ? "entry" : "entries"}, ${charCount} chars`;
+}
+/**
+* An explicit warning to surface to the agent when an index has grown past its
+* budget, or `null` when it's within budget. Extensions render this prominently
+* above the index so the agent prunes before it keeps appending.
+*/
+function indexBudgetWarning(index) {
+	const { charCount, overBudget } = summarizeIndex(index);
+	if (!overBudget) return null;
+	return `⚠️ This memory index is ${charCount} chars, over its ${MEMORY_INDEX_SOFT_BUDGET_CHARS}-char budget. It's costing you context on every turn — consolidate duplicate entries and delete stale ones to bring it back under budget before adding anything new.`;
+}
+/**
+* Enforce the hard cap on an index before injection. Under the cap the index is
+* returned unchanged; over it, the index is truncated on a line boundary and a
+* notice is appended naming the true size so the agent knows entries are hidden
+* and must be pruned. This is the actual bound on injected context — callers
+* still report the true size via {@link indexSizeNote} so nothing is masked.
+*/
+function enforceMemoryIndexHardBudget(index) {
+	if (index.length <= 4e4) return index;
+	const clipped = index.slice(0, MEMORY_INDEX_HARD_BUDGET_CHARS);
+	const lastNewline = clipped.lastIndexOf("\n");
+	return `${lastNewline > 0 ? clipped.slice(0, lastNewline) : clipped}\n\n⚠️ Memory index truncated at ${MEMORY_INDEX_HARD_BUDGET_CHARS} chars (it is ${index.length}). Entries past this point are NOT shown. Prune the index now — delete stale entries and consolidate duplicates.`;
+}
+/**
+* Read the agent's hand-maintained shared index at `.memory/MEMORY.md`.
+* Returns the trimmed contents, or `null` when the file is absent or empty —
+* the agent owns this file, so we surface exactly what it wrote.
+*/
+async function readMemoryIndexFile({ cwd }) {
+	const path = join(cwd, MEMORY_DIRNAME, MEMORY_INDEX_FILENAME);
+	try {
+		const trimmed = (await readFile(path, "utf-8")).trim();
+		return trimmed.length > 0 ? trimmed : null;
+	} catch {
+		return null;
+	}
+}
 const cache = /* @__PURE__ */ new Map();
 /**
+* Build the derived per-person index for a single user.
+*
 * Returns:
-* - `null` if `.memory/` doesn't exist
-* - `""` if the dir exists but contains nothing in the requested scope
+* - `null` if `.memory/users/` doesn't exist
+* - `""` if it exists but this user has no memory
 * - rendered markdown body (no surrounding header — caller wraps)
 *
-* The mtime-keyed cache stores the raw walked entries (the cost is the FS
-* walk); filtering by scope is cheap and runs per call, so two turns with
-* different scopes on the same cwd render correctly from one cached walk.
+* Scoping by id keeps one person's memory from bleeding into another's
+* conversation. The mtime-keyed cache stores the raw walked entries (the cost
+* is the FS walk); filtering by user is cheap and runs per call, so two turns
+* with different users on the same cwd render correctly from one cached walk.
 */
-async function buildMemoryIndex({ cwd, scope }) {
-	const memoryDirAbs = join(cwd, MEMORY_DIRNAME);
-	const maxMtimeMs = await maxMtimeAcrossDir(memoryDirAbs);
+async function buildMemoryIndex({ cwd, userId }) {
+	const usersDirAbs = join(cwd, MEMORY_DIRNAME, USERS_DIRNAME);
+	const maxMtimeMs = await maxMtimeAcrossDir(usersDirAbs);
 	if (maxMtimeMs === null) {
 		cache.delete(cwd);
 		return null;
@@ -2281,13 +2892,13 @@ async function buildMemoryIndex({ cwd, scope }) {
 	let cached = cache.get(cwd);
 	if (!cached || cached.builtAtMs < maxMtimeMs) {
 		cached = {
-			entries: await collectEntries(memoryDirAbs, cwd),
+			entries: await collectUserEntries(usersDirAbs, cwd),
 			builtAtMs: Date.now()
 		};
 		cache.set(cwd, cached);
 	}
-	const visible = cached.entries.filter((entry) => scope.kind === "user" ? entry.type === "users" && entry.subject?.startsWith(scope.userId) === true : entry.type !== "users");
-	return visible.length === 0 ? "" : renderIndex(visible);
+	const visible = cached.entries.filter((entry) => entry.subject.startsWith(userId));
+	return visible.length === 0 ? "" : renderUserIndex(visible);
 }
 async function maxMtimeAcrossDir(dir) {
 	let dirStat;
@@ -2335,45 +2946,22 @@ async function listSubdirs(dir) {
 	}
 	return entries.filter((e) => e.isDirectory()).map((e) => join(dir, e.name));
 }
-async function collectEntries(rootDirAbs, cwd) {
-	const collected = [];
-	await Promise.all(TYPE_DIRS.map(async (type) => {
-		const typeDirAbs = join(rootDirAbs, type);
-		if (TYPES_WITH_SUBJECT.has(type)) {
-			const subjectDirs = await listSubdirs(typeDirAbs);
-			await Promise.all(subjectDirs.map(async (subjectDirAbs) => {
-				const subject = basename(subjectDirAbs);
-				const files = await listMdFilesShallow(subjectDirAbs);
-				const parsed = await Promise.all(files.map(async (file) => {
-					const fm = await readFrontmatterOnly(file);
-					if (!fm?.name || !fm?.description) return null;
-					return {
-						name: fm.name,
-						description: fm.description,
-						type,
-						subject,
-						relPath: relative(cwd, file)
-					};
-				}));
-				for (const e of parsed) if (e) collected.push(e);
-			}));
-		} else {
-			const files = await listMdFilesShallow(typeDirAbs);
-			const parsed = await Promise.all(files.map(async (file) => {
-				const fm = await readFrontmatterOnly(file);
-				if (!fm?.name || !fm?.description) return null;
-				return {
-					name: fm.name,
-					description: fm.description,
-					type,
-					subject: null,
-					relPath: relative(cwd, file)
-				};
-			}));
-			for (const e of parsed) if (e) collected.push(e);
-		}
-	}));
-	return collected;
+async function collectUserEntries(usersDirAbs, cwd) {
+	const subjectDirs = await listSubdirs(usersDirAbs);
+	return (await Promise.all(subjectDirs.map(async (subjectDirAbs) => {
+		const subject = basename(subjectDirAbs);
+		const files = await listMdFilesShallow(subjectDirAbs);
+		return (await Promise.all(files.map(async (file) => {
+			const fm = await readFrontmatterOnly(file);
+			if (!fm?.name || !fm?.description) return null;
+			return {
+				name: fm.name,
+				description: fm.description,
+				subject,
+				relPath: relative(cwd, file)
+			};
+		}))).filter((e) => e !== null);
+	}))).flat();
 }
 async function readFrontmatterOnly(filePath) {
 	let fh;
@@ -2404,68 +2992,180 @@ function parseFrontmatter(text) {
 	const result = FrontmatterSchema.safeParse(parsed);
 	return result.success ? result.data : null;
 }
-function renderIndex(entries) {
-	const byType = {
-		users: [],
-		projects: [],
-		feedback: [],
-		reference: []
-	};
-	for (const e of entries) byType[e.type].push(e);
+function renderUserIndex(entries) {
+	const bySubject = /* @__PURE__ */ new Map();
+	for (const e of entries) {
+		const list = bySubject.get(e.subject) ?? [];
+		list.push(e);
+		bySubject.set(e.subject, list);
+	}
+	const lines = ["### Users"];
+	for (const subject of [...bySubject.keys()].sort()) {
+		lines.push(`- **${subject}**`);
+		for (const e of bySubject.get(subject) ?? []) lines.push(`  - \`${e.relPath}\` — ${e.description}`);
+	}
+	return lines.join("\n");
+}
+/**
+* One-time migration for agents created before `MEMORY.md` existed. If there is
+* no hand-maintained `.memory/MEMORY.md` yet but the agent has shared memory
+* files from the old frontmatter-indexed layout (`projects/`, `feedback/`,
+* `reference/`), derive a `MEMORY.md` from their frontmatter and write it once.
+* After that the agent owns the file — this never runs again for that agent and
+* never clobbers an existing index.
+*
+* Returns the seeded contents (also written to disk), or `null` when nothing
+* was seeded (index already present, or no legacy shared files). A write
+* failure propagates so the caller can log it; the read path then falls back to
+* whatever is on disk.
+*/
+async function seedMemoryIndexFile({ cwd }) {
+	const memoryDirAbs = join(cwd, MEMORY_DIRNAME);
+	const indexPath = join(memoryDirAbs, MEMORY_INDEX_FILENAME);
+	if (await stat(indexPath).catch(() => null)) return null;
+	const perType = await Promise.all(LEGACY_SHARED_TYPES.map(async ({ dir, label }) => {
+		const typeDirAbs = join(memoryDirAbs, dir);
+		const files = [];
+		await walkMdFiles(typeDirAbs, files);
+		return {
+			label,
+			entries: (await Promise.all(files.map(async (file) => {
+				const fm = await readFrontmatterOnly(file);
+				if (!fm?.name || !fm?.description) return null;
+				return {
+					name: fm.name,
+					description: fm.description,
+					relPath: relative(cwd, file)
+				};
+			}))).filter((e) => !!e)
+		};
+	}));
+	if (perType.every((group) => group.entries.length === 0)) return null;
+	const content = renderSeededIndex(perType);
+	await writeFile(indexPath, `${content}\n`, "utf-8");
+	return content;
+}
+function renderSeededIndex(groups) {
 	const sections = [];
-	for (const type of TYPE_DIRS) {
-		const items = byType[type];
-		if (items.length === 0) continue;
-		sections.push(`### ${TYPE_LABELS[type]}`);
-		if (TYPES_WITH_SUBJECT.has(type)) {
-			const bySubject = /* @__PURE__ */ new Map();
-			for (const e of items) {
-				const subject = e.subject ?? "(unknown)";
-				const list = bySubject.get(subject) ?? [];
-				list.push(e);
-				bySubject.set(subject, list);
-			}
-			const subjects = [...bySubject.keys()].sort();
-			for (const subject of subjects) {
-				sections.push(`- **${subject}**`);
-				for (const e of bySubject.get(subject) ?? []) sections.push(`  - \`${e.relPath}\` — ${e.description}`);
-			}
-		} else for (const e of items) sections.push(`- \`${e.relPath}\` — ${e.description}`);
+	for (const { label, entries } of groups) {
+		if (entries.length === 0) continue;
+		sections.push(`### ${label}`);
+		const sorted = [...entries].sort((a, b) => a.relPath.localeCompare(b.relPath));
+		for (const e of sorted) sections.push(`- [${e.name}](${e.relPath}) — ${e.description}`);
 		sections.push("");
 	}
 	return sections.join("\n").trimEnd();
 }
+/**
+* The version at which the hand-maintained `MEMORY.md` layout was introduced.
+* Used to classify an unversioned `.memory/`: if it already has a `MEMORY.md`
+* it's on this layout (not the pre-MEMORY.md v1 frontmatter layout), so it
+* shouldn't be treated as v1 and re-seeded.
+*/
+const HAND_MAINTAINED_INDEX_VERSION = 2;
+const VERSION_FILENAME = ".version";
+const MEMORY_MIGRATIONS = [{
+	from: 1,
+	to: 2,
+	apply: async ({ cwd }) => {
+		await seedMemoryIndexFile({ cwd });
+	}
+}];
+/**
+* The layout version of an agent's `.memory/`:
+* - `null` when there's no `.memory/` at all (a fresh agent is current by
+*   construction; nothing to migrate).
+* - `1` when `.memory/` exists but carries no `.version` marker — i.e. it
+*   predates versioning.
+* - otherwise the integer in `.memory/.version`.
+*/
+async function readMemoryVersion(cwd) {
+	const memoryDirAbs = join(cwd, MEMORY_DIRNAME);
+	if (!(await stat(memoryDirAbs).catch(() => null))?.isDirectory()) return null;
+	const raw = await readFile(join(memoryDirAbs, VERSION_FILENAME), "utf-8").catch(() => null);
+	if (raw === null) return await stat(join(memoryDirAbs, MEMORY_INDEX_FILENAME)).then((s) => s.isFile()).catch(() => false) ? HAND_MAINTAINED_INDEX_VERSION : 1;
+	const parsed = Number.parseInt(raw.trim(), 10);
+	return Number.isInteger(parsed) && parsed > 0 ? parsed : 1;
+}
+async function writeMemoryVersion(cwd, version) {
+	await writeFile(join(cwd, MEMORY_DIRNAME, VERSION_FILENAME), `${version}\n`, "utf-8");
+}
+/**
+* Bring an agent's `.memory/` up to `CURRENT_MEMORY_VERSION` by applying the
+* ordered migrations. Runs on session start. No-op when there's no `.memory/`
+* yet or it's already current. Migrations must be idempotent, so a lost/unwritten
+* version marker (the file isn't committed by the harness) only costs a repeated
+* no-op, never corruption. Returns the `{ from, to }` actually applied, or
+* `null` when nothing ran.
+*/
+async function migrateMemory({ cwd }) {
+	const from = await readMemoryVersion(cwd);
+	if (from === null || from >= 2) return null;
+	let version = from;
+	while (version < 2) {
+		const migration = MEMORY_MIGRATIONS.find((m) => m.from === version);
+		if (!migration) break;
+		await migration.apply({ cwd });
+		version = migration.to;
+	}
+	await writeMemoryVersion(cwd, version);
+	return {
+		from,
+		to: version
+	};
+}
 //#endregion
 //#region src/extensions/memory.ts
 const log$6 = logger.child({ module: "memory-extension" });
 /**
 * The standing instructions for the memory system. Always injected (even with
-* an empty `.memory/`) so the agent knows it can persist notes. `users/` is
+* no `MEMORY.md`) so the agent knows it can persist notes and how. `users/` is
 * described by the platform memory extension, which is the only thing that can
 * scope it to a person — here we just point at it.
 */
 function memoryInstructions(cwd) {
 	return `## Memory across conversations
 
-Persistent notes across conversations live at \`${cwd}/.memory/\` — plain markdown files in your repo. The harness builds and injects an **index** of these files (paths + one-line descriptions) into your system prompt every turn; **bodies are NOT auto-loaded** — when an index entry looks relevant, use your \`read\` tool to load that specific file.
+Persistent notes across conversations live at \`${cwd}/.memory/\` — plain markdown files in your repo, one fact per file. You maintain a hand-written index of them at \`${cwd}/.memory/MEMORY.md\`, and the harness injects that index into your system prompt every turn. **Bodies are NOT auto-loaded** — when an index line looks relevant, use your \`read\` tool to load that specific file.
 
 Memory records **what happened**: facts you learned, events, investigation findings, project and system details worth carrying forward. It is NOT where behavior goes. A standing rule about how you should act — a "from now on, always/never …", a tone or format preference, a workflow convention a user wants you to follow — belongs in \`soul.md\` (see the Persona / Standing instructions section), not here. When a note is really an instruction about your behavior, write it to \`soul.md\`; when it is a fact or a record of something that occurred, write it here.
 
-Shared knowledge is laid out as \`projects/<slug>/<topic>.md\` for project and system context, \`feedback/<topic>.md\` for concrete lessons learned from something that happened (the event and what it taught you — not a free-floating rule; the rule itself, if durable, goes in \`soul.md\`), and \`reference/<topic>.md\` for how external systems work. (Notes about a specific person live under \`users/\` and are shown separately, scoped to whoever you're talking to.) Each file's frontmatter declares \`name\` and \`description\` (the description is what shows up in the index, so make it a one-line behavior-triggering hook). Commit and push after writing to persist it.`;
+You own \`MEMORY.md\`. When you learn something durable, write the fact to its own \`.md\` file and add a one-line pointer to \`MEMORY.md\` in the form \`- [Title](relative/path.md) — one-line hook\`, where the hook is what tells future-you when to open the file. \`MEMORY.md\` is an *index*, never a store — put the actual content in the topic file and only a pointer line in \`MEMORY.md\`; do not inline a fact's body into the index even when it seems cheaper. Start each topic file with \`name:\`/\`description:\` frontmatter (the \`description\` is the one-line hook) so the index can be re-seeded, re-derived, or linted from the files themselves. When a fact changes, edit both the file and its line; when it stops being true, delete the file and its line. Shared knowledge is laid out as \`projects/<slug>/<topic>.md\` for project and system context, \`feedback/<topic>.md\` for concrete lessons learned from something that happened (the event and what it taught you — not a free-floating rule; the rule itself, if durable, goes in \`soul.md\`), and \`reference/<topic>.md\` for how external systems work. (Notes about a specific person live under \`users/\` and are indexed for you separately, scoped to whoever you're talking to — don't put people's private notes in the shared \`MEMORY.md\`.)
+
+Keep \`MEMORY.md\` lean. It's re-injected on *every* turn, so a small, high-signal index is worth far more than an exhaustive one — curate it like a tightly-edited table of contents, not a log:
+- Be selective. Only record something durable that will matter in a *future* conversation. Don't record what only matters right now, what you can re-derive on demand, or what's already obvious from the repo.
+- Consolidate before you create. Before adding a line, scan \`MEMORY.md\` for one that already covers the topic; if it exists, \`read\` that file and rewrite it with the new facts merged in rather than adding a near-duplicate. One fact per file, but don't fragment a topic across many thin files.
+- Prune as you go. Delete lines (and their files) that are wrong, stale, or superseded. The index header reports its size — when it's flagged over budget, consolidate and delete before adding anything new.
+- Write dates absolute, not relative. Resolve "last week" / "yesterday" to a concrete date when you record it (e.g. "on 7/3 Dhruv told me to …"), so the note still reads correctly in a future conversation.
+
+Commit and push after editing \`.memory/\` to persist it.`;
 }
 function composeBlock$1({ cwd, index }) {
 	const instructions = memoryInstructions(cwd);
 	if (!index || index.length === 0) return instructions;
-	return `${instructions}\n\n## Memory index\n\n${index}`;
+	const header = `## Memory index (${indexSizeNote(index)})`;
+	const warning = indexBudgetWarning(index);
+	const rendered = enforceMemoryIndexHardBudget(index);
+	return `${instructions}\n\n${warning ? `${header}\n\n${warning}\n\n${rendered}` : `${header}\n\n${rendered}`}`;
 }
 const memoryExtension = (pi) => {
 	let cachedBlock = null;
 	pi.on("session_start", async (_event, ctx) => {
 		try {
-			const index = await buildMemoryIndex({
-				cwd: ctx.cwd,
-				scope: { kind: "shared" }
-			});
+			const migrated = await migrateMemory({ cwd: ctx.cwd });
+			if (migrated !== null) log$6.info({
+				event: "memory_migrated",
+				from: migrated.from,
+				to: migrated.to
+			}, "migrated memory layout to current version");
+		} catch (err) {
+			log$6.warn({
+				err,
+				event: "memory_migration_failed"
+			}, "memory migration failed; continuing with existing index");
+		}
+		try {
+			const index = await readMemoryIndexFile({ cwd: ctx.cwd });
 			cachedBlock = composeBlock$1({
 				cwd: ctx.cwd,
 				index
@@ -2474,7 +3174,7 @@ const memoryExtension = (pi) => {
 			log$6.warn({
 				err,
 				event: "memory_index_failed"
-			}, "memory index build failed; injecting instructions only");
+			}, "memory index read failed; injecting instructions only");
 			cachedBlock = memoryInstructions(ctx.cwd);
 		}
 	});
@@ -2533,9 +3233,12 @@ function slugifyName(name) {
 function composeBlock({ index, user }) {
 	const instructions = `## Current user memory
 
-Notes about the person on this turn — the only \`users/\` memory you can see. Store anything you learn about them under \`${`.memory/users/${user.id}-${slugifyName(user.displayName)}/`}<topic>.md\`, using exactly this directory. Other people's \`users/\` notes are never shown, so never address someone by a name you only find in memory.`;
+Notes about the person on this turn — the only \`users/\` memory you can see. Store anything you learn about them under \`${`.memory/users/${user.id}-${slugifyName(user.displayName)}/`}<topic>.md\`, using exactly this directory. Other people's \`users/\` notes are never shown, so never address someone by a name you only find in memory. Keep it lean and be selective — this is re-injected every turn; consolidate related facts into one file and delete what's stale rather than piling on near-duplicates.`;
 	if (!index || index.length === 0) return instructions;
-	return `${instructions}\n\n${index}`;
+	const warning = indexBudgetWarning(index);
+	const header = `Memory index (${indexSizeNote(index)}):`;
+	const rendered = enforceMemoryIndexHardBudget(index);
+	return `${instructions}\n\n${warning ? `${warning}\n\n${header}\n\n${rendered}` : `${header}\n\n${rendered}`}`;
 }
 /**
 * Build the platform memory extension. `channelContext` is the per-turn ref
@@ -2556,10 +3259,7 @@ function createPlatformMemoryExtension({ channelContext }) {
 				cachedBlock = composeBlock({
 					index: await buildMemoryIndex({
 						cwd: ctx.cwd,
-						scope: {
-							kind: "user",
-							userId: user.id
-						}
+						userId: user.id
 					}),
 					user
 				});
@@ -2736,7 +3436,7 @@ function soulSection(cwd, soul) {
 
 **\`soul.md\` is where behavior lives.** Any standing instruction about how you should act — a rule a user wants you to follow going forward, a tone or format preference, a workflow convention, a "from now on, always/never …" — belongs here, not in \`.memory/\`. Memory records *what happened* (facts, events, findings); soul defines *how you behave*. When a user gives you a durable behavioral rule, write it to \`soul.md\`. If you find behavioral rules that ended up in \`.memory/\`, treat that as misfiled and move them here.
 
-Keep it current. When you gain a durable new capability — a tool you build, a skill or integration you set up, a service you connect — or a user hands you a lasting behavioral rule, record it in \`soul.md\` so a future conversation knows it's part of you rather than rediscovering it from scratch. Edit it (then \`git add soul.md && git commit && git push\`) to redefine yourself; picked up on the next message.
+Keep it current. When you gain a durable new capability — a tool you build, a skill or integration you set up, a service you connect, a secret or auth credential you wire in — or a user hands you a lasting behavioral rule, record it in \`soul.md\` so a future conversation knows it's part of you rather than rediscovering it from scratch. Do this the moment you gain the capability, and for a credential that means the moment it verifies with a real call, not after a human points out that you forgot. Connecting a capability is itself a durable change worth recording, not merely a step toward the task in front of you. Edit \`soul.md\` (then \`git add soul.md && git commit && git push\`) to redefine yourself; picked up on the next message.
 
 ${soul ? soul : "_(empty — write to `soul.md` to define your persona)_"}`;
 }
@@ -2758,9 +3458,19 @@ const log$2 = logger.child({ module: "subagent-ext" });
 const MAX_TASKS = 8;
 const TaskItem = Type.Object({
 	task: Type.String({ description: "The task to delegate to a subagent run." }),
+	title: Type.String({
+		description: "A SHORT name for this task — 3-6 words, sentence case, no trailing period. This is what the person in the chat sees as the row for this subagent, so name the work, do not restate the prompt. Good: \"Audit the billing gate\", \"Compare competitor pricing\", \"Draft the migration\". Bad: \"You are looking at apps/anyone/web and should check every component…\".",
+		maxLength: 120
+	}),
 	persona: Type.Optional(Type.String({ description: "Optional extra system prompt / role for this task, applied ON TOP of the child run's own default persona (your full identity and soul are still there underneath). Omit to run with just your default persona." })),
-	model: Type.Optional(Type.String({ description: "Optional model id to run this subagent on (e.g. \"anthropic/claude-opus-4-8\"). Must be a real catalogued model. Omit to run on your own model. If you are locked to a Google-compliant model, only compliant models are accepted." }))
+	model: Type.Optional(Type.String({ description: "Optional model id to run this subagent on. PREFER A LOWER-COST, FASTER MODEL when the task is well-scoped and does not need your full reasoning depth — most delegated subtasks (searching, summarizing, mechanical edits, gathering or reformatting data, running a check) run just as well on a lighter model and cost far less. Reserve a top-tier model for subtasks that genuinely need deep reasoning or careful judgment. Must be a real catalogued model id. Omit to inherit your own model. If you are locked to a Google-compliant model, only compliant models are accepted." })),
+	timeoutMinutes: Type.Optional(Type.Integer({
+		description: "Optional wall-clock timeout for this subagent, in minutes. If the run is still going after this long it is ended and you are rewoken with a timeout result, so a hung subagent can never strand you. Omit for the default (30 minutes). Raise it for genuinely long work (a big migration, a large audit); lower it for a quick lookup. Range 1-360.",
+		minimum: 1,
+		maximum: 360
+	}))
 });
+const DEFAULT_SUBAGENT_TIMEOUT_MS = 30 * 6e4;
 const SubagentParams = Type.Object({ tasks: Type.Array(TaskItem, {
 	description: "One or more tasks to delegate. Each spawns an isolated subagent run linked to this conversation; they run in parallel and each rewakes you with its result when it finishes.",
 	minItems: 1,
@@ -2775,7 +3485,9 @@ function buildTool(messageId) {
 			"Delegate one or more tasks to subagent runs — fresh isolated copies of yourself, each with its own context window, linked to this conversation.",
 			"Use it to parallelize independent work, to keep a large or noisy subtask out of your own context, or to run a task under a specialized persona.",
 			"Fire-and-forget: this returns immediately after queueing. It does NOT wait for results. Each subagent runs on its own and, when it finishes, sends you its result on this thread — so queue the work, then keep going or end your turn. To chain, re-delegate after a result lands.",
-			"Pass tasks: [{ task, persona?, model? }]. persona is an optional extra system prompt layered ON TOP of your default persona for that task (it adds to, it does not replace, your identity); omit it to run with just your default persona. model is an optional model id for that task; omit it to run on your own model."
+			"Pass tasks: [{ task, title, persona?, model? }]. title is a short 3-6 word name for the task — it is shown to the person in the chat as that subagent's row, so name the work rather than restating the prompt. persona is an optional extra system prompt layered ON TOP of your default persona for that task (it adds to, it does not replace, your identity); omit it to run with just your default persona. model is an optional model id for that task — prefer a lower-cost, faster model for well-scoped subtasks that don't need deep reasoning, and reserve a top-tier model for the ones that do; omit it to inherit your own model.",
+			"Peering: each queued task comes back with its own conversation id. A subagent is a real linked conversation, so to see what one is doing RIGHT NOW while it runs — its reasoning, the tools it has called and their results, its progress — read that conversation with `platform conversations show <conversationId>` (you are already authorized; it is your own delegated run). Check in that way instead of waiting blind for the final result. The read reflects the child's persisted state, which lags a few seconds behind live (tool results land as they complete; in-progress reasoning can be up to ~5s stale), so peek between checkpoints rather than polling in a tight loop.",
+			"Steering: to add context, correct course, or answer a question a subagent needs mid-run, post to its conversation with `platform conversations post <conversationId> --message \"...\"`. If the subagent is still running, your message lands as a live steer picked up in that same turn; if it has gone idle, it queues as its next turn. This is the same primitive as any conversation message — there is no separate steer channel."
 		].join(" "),
 		promptSnippet: "subagent — delegate tasks to isolated subagent runs; each rewakes you with its result when done",
 		parameters: SubagentParams,
@@ -2791,25 +3503,37 @@ function buildTool(messageId) {
 			};
 			const spawnTasks = tasks.map((t) => ({
 				task: t.task,
+				title: t.title ?? null,
 				persona: t.persona ?? null,
-				model: t.model ?? null
+				model: t.model ?? null,
+				timeoutMs: t.timeoutMinutes != null ? t.timeoutMinutes * 6e4 : DEFAULT_SUBAGENT_TIMEOUT_MS
 			}));
 			try {
-				const { taskIds } = await postSubagentSpawn({
+				const spawned = await postSubagentSpawn({
 					messageId,
 					tasks: spawnTasks
 				});
+				const { taskIds } = spawned;
 				log$2.info({
 					event: "subagent_spawned",
 					count: taskIds.length
 				}, "subagent tasks queued");
-				const lines = taskIds.map((id, i) => `- ${id}: ${spawnTasks[i]?.task ?? ""}`).join("\n");
+				const convByTask = new Map(spawned.tasks.map((t) => [t.taskId, t.conversationId]));
+				const lines = taskIds.map((id, i) => {
+					const label = spawnTasks[i]?.title ?? spawnTasks[i]?.task ?? "";
+					const conv = convByTask.get(id);
+					return `- ${id}: ${label}${conv ? ` — conversation ${conv}` : ""}`;
+				}).join("\n");
+				const peerHint = spawned.tasks.length ? "\nEach subagent runs on its own conversation (id shown per task above). To SEE what one is doing while it runs, read it with `platform conversations show <conversationId>`. To STEER one mid-run — add context, correct course, answer a question — post to its conversation with `platform conversations post <conversationId> --message \"...\"`; it lands as a live steer if the subagent is still running, or as its next turn if it has gone idle." : "";
 				return {
 					content: [{
 						type: "text",
-						text: `Queued ${taskIds.length} subagent ${taskIds.length === 1 ? "run" : "runs"}. Each runs on its own and will send you its result on this thread when it finishes — keep working or end your turn meanwhile.\n${lines}`
+						text: `Queued ${taskIds.length} subagent ${taskIds.length === 1 ? "run" : "runs"}. Each runs on its own and will send you its result on this thread when it finishes — keep working or end your turn meanwhile.\n${lines}${peerHint}`
 					}],
-					details: { taskIds }
+					details: {
+						taskIds,
+						tasks: spawned.tasks
+					}
 				};
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
@@ -2830,31 +3554,37 @@ function buildTool(messageId) {
 	};
 }
 /**
-* Gated on `harness-subagent-enabled`, read from the shared feature-flag poll.
 * The factory takes the session's channel context to resolve the originating
 * messageId — the api links each spawned run to the conversation that message
 * belongs to and rewakes it on completion (nothing about the parent is piped
-* from the sandbox beyond that id).
+* from the sandbox beyond that id). The tool is registered unconditionally at
+* session_start.
 */
 function createSubagentExtension({ channelContext }) {
 	return (pi) => {
 		const messageId = extractMessageId(channelContext);
-		startFeatureFlagPoller();
-		pi.on("session_start", async () => {
-			if (getPolledFlag("subagent") === true) {
-				pi.registerTool(buildTool(messageId));
-				log$2.info({ event: "subagent_enabled" }, "subagent tool registered");
-			}
+		let registered = false;
+		const registerOnce = () => {
+			if (registered) return;
+			registered = true;
+			pi.registerTool(buildTool(messageId));
+			log$2.info({ event: "subagent_enabled" }, "subagent tool registered");
+		};
+		pi.on("session_start", () => {
+			registerOnce();
 		});
 	};
 }
 //#endregion
 //#region src/extensions/tool-call-env.ts
 const TOOL_CALL_ID_VAR = "TOOL_CALL_ID";
+function shellQuoteValue(value) {
+	return quote([value]);
+}
 function withToolCallId({ command, toolCallId }) {
-	return `export ${TOOL_CALL_ID_VAR}=${toolCallId}; ${command}`;
+	return `export ${TOOL_CALL_ID_VAR}=${shellQuoteValue(toolCallId)}; ${command}`;
 }
-const PLATFORM_EXPORT = new RegExp(`^\\s*export\\s+(?:${TOOL_CALL_ID_VAR}|ANYONE_\\w+|SKYDIVE_\\w+)=(?:"(?:\\\\.|[^"])*"|'[^']*'|[^;\\s]*)\\s*;\\s*`);
+const PLATFORM_EXPORT = new RegExp(`^\\s*export\\s+(?:${TOOL_CALL_ID_VAR}|ANYONE_\\w+|SKYDIVE_\\w+)=(?:"(?:\\\\.|[^"])*"|'(?:'\\\\''|[^'])*'|[^;\\s]*)\\s*;\\s*`);
 function stripPlatformExportsForDisplay(command) {
 	let c = command;
 	let m;
@@ -3119,8 +3849,14 @@ const toolCallSummaryExtension = (pi) => {
 * from the origin messageId in its channel context (`resolveConversationFromApi`)
 * — and every run of the same conversation resolves to the same id, keeping the
 * shared map correctly scoped across turns. `bg_*`, the completion wake, and the
-* next-session injection all filter to the resolved conversation — an agent
-* never sees or is woken by a task from a different chat. Only the output log
+* next-session injection all filter by a **scope key** — the resolved
+* conversation id, or, when a session's conversation is unresolvable (a bare
+* CLI session, or a run whose channel-context ref carries no messageId), a
+* sentinel unique to that one session instance. Comparing on the raw
+* `conversationId` would bucket every unresolvable session together under
+* `null` and leak one's completion wake / status / next-session injection into
+* another; the sentinel keeps each isolated so an agent never sees or is woken
+* by a task from a different chat. Only the output log
 * spills to disk (/home/user/.anyone/bg-tasks/<id>.log) to avoid buffering a chatty job
 * in memory; exit code and run state live on the in-memory task.
 *
@@ -3144,6 +3880,7 @@ const WATCHDOG_INTERVAL_MS = 3e4;
 const KEEPALIVE_EVERY_MS = 6e4;
 const KEEPALIVE_MAX_MS = 3600 * 1e3;
 const STALL_HINT_AFTER_MS = 120 * 1e3;
+const PUBLISH_DEBOUNCE_MS = 300;
 const MAX_LOG_BYTES = 100 * 1024 * 1024;
 const DEFAULT_TAIL_LINES = 30;
 const TAIL_READ_BYTES = 64 * 1024;
@@ -3151,11 +3888,12 @@ function taskLabel(meta) {
 	return `${meta.id} "${meta.description ?? meta.command.slice(0, 60)}"`;
 }
 let taskCounter = 0;
+let sessionScopeCounter = 0;
 const tasks = /* @__PURE__ */ new Map();
 let watchdogInterval = null;
 let lastKeepaliveAt = 0;
-function sameConversation(meta, conversationId) {
-	return meta.conversationId === conversationId;
+function sameScope(meta, scopeKey) {
+	return meta.scopeKey === scopeKey;
 }
 function logPath(id) {
 	return join(tasksDir(), `${id}.log`);
@@ -3268,6 +4006,10 @@ function createBackgroundTasksExtension({ channelContext }) {
 				return id;
 			});
 		}
+		const unresolvedScopeSentinel = `unresolved:${process.pid.toString(36)}:${(sessionScopeCounter += 1).toString(36)}`;
+		function scopeKey() {
+			return conversationId ?? unresolvedScopeSentinel;
+		}
 		let agentActive = false;
 		pi.on("agent_start", async () => {
 			agentActive = true;
@@ -3301,7 +4043,7 @@ This is a background-task completion, not a message from the user. If it needs n
 		}
 		async function notifyCompletion(meta) {
 			if (meta.notified) return;
-			if (agentActive && sameConversation(meta, conversationId)) {
+			if (agentActive && sameScope(meta, scopeKey())) {
 				meta.notified = true;
 				pi.sendMessage(await taskDoneMessage(meta), {
 					triggerTurn: true,
@@ -3332,6 +4074,80 @@ This is a background-task completion, not a message from the user. If it needs n
 				});
 			} else log.info({ taskId: meta.id }, "bg task completed idle with no origin message; deferring to next session_start");
 		}
+		const SNAPSHOT_TAIL_LINES = 40;
+		let lastPublishedSignature = null;
+		let publishInFlight = null;
+		let publishQueued = false;
+		function snapshotSignature(snapshot) {
+			return JSON.stringify(snapshot.map((t) => ({
+				id: t.id,
+				state: t.state,
+				exitCode: t.exitCode,
+				killedReason: t.killedReason,
+				outputTail: t.outputTail
+			})));
+		}
+		async function doPublishSnapshot() {
+			if (!messageId) return;
+			const mine = [...tasks.values()].filter((t) => sameScope(t, scopeKey()));
+			try {
+				const snapshot = await Promise.all(mine.map(async (t) => ({
+					id: t.id,
+					command: t.command,
+					description: t.description,
+					startedAt: t.startedAt,
+					state: t.running ? "running" : "finished",
+					exitCode: t.exitCode,
+					killedReason: t.killedReason,
+					outputTail: await tailLog(t.id, SNAPSHOT_TAIL_LINES)
+				})));
+				const signature = snapshotSignature(snapshot);
+				if (signature === lastPublishedSignature) return;
+				lastPublishedSignature = signature;
+				postBackgroundTasksSnapshot({
+					messageId,
+					tasks: snapshot
+				});
+			} catch (err) {
+				log.debug({
+					err,
+					event: "bg_tasks_snapshot_build_failed"
+				}, "building bg-tasks snapshot failed");
+			}
+		}
+		async function publishSnapshotNow() {
+			if (publishInFlight) {
+				publishQueued = true;
+				return;
+			}
+			publishInFlight = (async () => {
+				try {
+					do {
+						publishQueued = false;
+						await doPublishSnapshot();
+					} while (publishQueued);
+				} finally {
+					publishInFlight = null;
+				}
+			})();
+			await publishInFlight;
+		}
+		let publishTimer = null;
+		function schedulePublishSnapshot() {
+			if (publishTimer) return;
+			publishTimer = setTimeout(() => {
+				publishTimer = null;
+				publishSnapshotNow();
+			}, PUBLISH_DEBOUNCE_MS);
+			publishTimer.unref?.();
+		}
+		async function flushPublishSnapshot() {
+			if (publishTimer) {
+				clearTimeout(publishTimer);
+				publishTimer = null;
+			}
+			await publishSnapshotNow();
+		}
 		async function launchTask({ command, description, cwd }) {
 			taskCounter += 1;
 			const id = `bg-${process.pid.toString(36)}-${taskCounter}`;
@@ -3358,6 +4174,7 @@ This is a background-task completion, not a message from the user. If it needs n
 				logBytes: 0,
 				lastOutputAt: startedAt,
 				conversationId,
+				scopeKey: scopeKey(),
 				messageId,
 				description,
 				notified: false,
@@ -3393,6 +4210,7 @@ This is a background-task completion, not a message from the user. If it needs n
 					taskId: id,
 					exitCode: meta.exitCode
 				}, "bg task finished");
+				schedulePublishSnapshot();
 				await notifyCompletion(meta);
 			});
 			ensureWatchdog();
@@ -3400,19 +4218,20 @@ This is a background-task completion, not a message from the user. If it needs n
 				taskId: id,
 				conversationId
 			}, "bg task started");
+			schedulePublishSnapshot();
 			return meta;
 		}
 		function knownTaskIds() {
-			return [...tasks.values()].filter((t) => sameConversation(t, conversationId)).map((t) => t.id).join(", ") || "(none)";
+			return [...tasks.values()].filter((t) => sameScope(t, scopeKey())).map((t) => t.id).join(", ") || "(none)";
 		}
 		pi.on("session_start", async () => {
 			if (tasks.size === 0) return;
 			await ensureConversationId();
-			for (const [id, meta] of tasks) if (sameConversation(meta, conversationId) && !meta.running && meta.notified) {
+			for (const [id, meta] of tasks) if (sameScope(meta, scopeKey()) && !meta.running && meta.notified) {
 				tasks.delete(id);
 				await unlink(logPath(id)).catch(() => {});
 			}
-			const unnotified = [...tasks.values()].filter((t) => sameConversation(t, conversationId) && !t.notified && !t.running);
+			const unnotified = [...tasks.values()].filter((t) => sameScope(t, scopeKey()) && !t.notified && !t.running);
 			for (const meta of unnotified) {
 				meta.notified = true;
 				pi.sendMessage(await taskDoneMessage(meta));
@@ -3421,7 +4240,9 @@ This is a background-task completion, not a message from the user. If it needs n
 				conversationId,
 				count: unnotified.length
 			}, "injected completed bg tasks at session_start");
-			if ([...tasks.values()].some((t) => sameConversation(t, conversationId) && t.running)) ensureWatchdog();
+			if ([...tasks.values()].some((t) => sameScope(t, scopeKey()) && t.running)) ensureWatchdog();
+			lastPublishedSignature = null;
+			await flushPublishSnapshot();
 		});
 		function err(text) {
 			return {
@@ -3438,11 +4259,11 @@ This is a background-task completion, not a message from the user. If it needs n
 		}
 		function resolveTask(taskId) {
 			const exact = tasks.get(taskId);
-			if (exact && sameConversation(exact, conversationId)) return {
+			if (exact && sameScope(exact, scopeKey())) return {
 				error: null,
 				meta: exact
 			};
-			const matches = [...tasks.values()].filter((t) => sameConversation(t, conversationId) && t.id.startsWith(taskId));
+			const matches = [...tasks.values()].filter((t) => sameScope(t, scopeKey()) && t.id.startsWith(taskId));
 			if (matches.length === 1) return {
 				error: null,
 				meta: matches[0]
@@ -3451,7 +4272,7 @@ This is a background-task completion, not a message from the user. If it needs n
 			return err(`Unknown task ${taskId}. Known tasks: ${knownTaskIds()}`);
 		}
 		function listTasks() {
-			const mine = [...tasks.values()].filter((t) => sameConversation(t, conversationId));
+			const mine = [...tasks.values()].filter((t) => sameScope(t, scopeKey()));
 			if (mine.length === 0) return "No background tasks.";
 			return mine.map((t) => {
 				const state = t.running ? "running" : t.exitCode !== null ? `exited ${t.exitCode}${t.killedReason ? ` (killed: ${t.killedReason})` : ""}` : t.killedReason ? `killed: ${t.killedReason}` : "ended";
@@ -3601,6 +4422,7 @@ const all = [
 	localToolsExtension,
 	toolCallEnvExtension,
 	bashDefaultTimeoutExtension,
+	diskGuardExtension,
 	toolCallSummaryExtension
 ];
 /**
@@ -3619,7 +4441,8 @@ function platformExtensions({ sessionId, channelContext }) {
 		selfTraceExtension,
 		createBackgroundTasksExtension({ channelContext }),
 		createSubagentExtension({ channelContext }),
-		createContextManagementExtension()
+		createContextManagementExtension(),
+		resourcePressureWarningExtension
 	];
 }
 //#endregion