@themoltnet/pi-runtime 0.15.2 → 0.16.0

package/dist/index.js

@@ -234,1676 +234,193 @@ function computeContentCid(entryType, title, content, tags) {
 	return CID.createV1(raw.code, digest).toString(base32);
 }
 //#endregion
-//#region src/moltnet/render-phase6.ts
-function slugToTitle(value) {
-	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
-}
-function extractScope(tags) {
-	const scope = tags?.find((tag) => tag.startsWith("scope:"));
-	return scope ? scope.slice(6) : null;
-}
-function extractSeverity(tags) {
-	const severity = tags?.find((tag) => tag.startsWith("severity:"));
-	return severity ? severity.slice(9) : null;
-}
-function stripEntryScaffolding(content) {
-	let out = content;
-	out = out.replace(/<moltnet-signed>[\s\S]*?<content>([\s\S]*?)<\/content>[\s\S]*?<\/moltnet-signed>/gi, "$1");
-	out = out.replace(/<metadata>[\s\S]*?<\/metadata>/gi, "");
-	out = out.replace(/<signature>[\s\S]*?<\/signature>/gi, "");
-	out = out.replace(/<\/?(?:moltnet-signed|content|signature|metadata)[^>]*>/gi, "");
-	out = out.replace(/^- Compression:.*$/gim, "");
-	out = out.replace(/^- Tokens:.*$/gim, "");
-	return out.trim();
-}
-function normalizeKey(value) {
-	return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
-}
-function extractRules(content) {
-	return stripEntryScaffolding(content).split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && (/(^rule:|^watch for:|^must\b|^never\b)/i.test(line) || /\b(MUST|NEVER)\b/.test(line))).slice(0, 5);
-}
-function renderSourceRefs(entries) {
-	return entries.map((entry) => {
-		const shortId = entry.entryId.slice(0, 8);
-		const fingerprint = entry.entry.creator?.fingerprint?.replaceAll("-", "").slice(0, 4).toLowerCase();
-		return `[\`e:${shortId}\`](@unknown · ${fingerprint ? `agent:${fingerprint}` : "agent:unkn"})`;
-	}).join(", ");
-}
-function renderKeywords(tags) {
-	const keywords = (tags ?? []).filter((tag) => !tag.startsWith("scope:") && !tag.startsWith("severity:"));
-	if (keywords.length === 0) return "";
-	return `Relevant search terms include ${keywords.slice(0, 6).map((tag) => `\`${tag}\``).join(", ")}.`;
-}
-function renderPhase6Markdown(pack) {
-	const entries = pack.entries ?? [];
-	const grouped = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		const scope = extractScope(entry.entry.tags) ?? "general";
-		const title = entry.entry.title?.trim() || `Entry ${entry.entryId.slice(0, 8)}`;
-		const groupKey = normalizeKey(scope);
-		const topicKey = normalizeKey(title) || entry.entryId;
-		if (!grouped.has(groupKey)) grouped.set(groupKey, /* @__PURE__ */ new Map());
-		const topics = grouped.get(groupKey);
-		const existing = topics.get(topicKey);
-		if (existing) existing.entries.push(entry);
-		else topics.set(topicKey, {
-			title,
-			scope,
-			entries: [entry]
-		});
-	}
-	const lines = [];
-	lines.push("# Rendered Pack");
-	lines.push("");
-	lines.push("## Source");
-	lines.push("");
-	lines.push("| Pack UUID | Pack CID | Entries |");
-	lines.push("| --------- | -------- | ------- |");
-	lines.push(`| \`${pack.id}\` | \`${pack.packCid}\` | ${entries.length} |`);
-	lines.push("");
-	for (const [, topics] of grouped) {
-		const scope = topics.values().next().value?.scope ?? "general";
-		lines.push(`## ${slugToTitle(scope)}`);
-		lines.push("");
-		for (const [, topic] of topics) {
-			const primary = topic.entries[0];
-			const mergedContent = topic.entries.map((entry) => stripEntryScaffolding(entry.entry.content)).filter(Boolean).join("\n\n");
-			const rules = topic.entries.flatMap((entry) => extractRules(entry.entry.content));
-			const severity = extractSeverity(primary.entry.tags);
-			lines.push(`### ${topic.title}`);
-			lines.push("");
-			lines.push(`**Subsystem:** ${slugToTitle(topic.scope)}`);
-			if (severity) lines.push(`**Severity:** ${slugToTitle(severity)}`);
-			lines.push(`**Type:** ${primary.entry.entryType}`);
-			lines.push("");
-			if (rules.length > 0) {
-				lines.push("**Rules**");
-				lines.push("");
-				for (const rule of Array.from(new Set(rules))) lines.push(`- ${rule}`);
-				lines.push("");
-			}
-			lines.push(mergedContent);
-			lines.push("");
-			const keywords = renderKeywords(primary.entry.tags);
-			if (keywords) {
-				lines.push(keywords);
-				lines.push("");
-			}
-			lines.push("Provenance:");
-			for (const entry of topic.entries) lines.push(`- Entry ID \`${entry.entryId}\`, CID \`${entry.entryCidSnapshot}\``);
-			lines.push("");
-			lines.push(`*Sources: ${renderSourceRefs(topic.entries)}*`);
-			lines.push("");
-		}
-	}
-	if (entries.length === 0) {
-		lines.push("_This pack has no expanded entries._");
-		lines.push("");
-	}
-	return lines.join("\n").trim();
-}
-//#endregion
-//#region src/moltnet/tools.ts
+//#region ../models/src/credential-scopes.ts
+var CREDENTIAL_SCOPES = {
+	AgentProfile: "agent:profile",
+	ConnectorInvoke: "connector:invoke",
+	CryptoSign: "crypto:sign",
+	DiaryManage: "diary:manage",
+	DiaryRead: "diary:read",
+	DiaryWrite: "diary:write",
+	HumanProfile: "human:profile",
+	KeyManage: "key:manage",
+	PackRead: "pack:read",
+	PackWrite: "pack:write",
+	RuntimeManage: "runtime:manage",
+	RuntimeRead: "runtime:read",
+	TaskClaim: "task:claim",
+	TaskExecute: "task:execute",
+	TaskManage: "task:manage",
+	TaskRead: "task:read",
+	TaskWrite: "task:write",
+	TeamManage: "team:manage",
+	TeamRead: "team:read"
+};
+var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.CryptoSign, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
+Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
 /**
-* MoltNet custom tools for pi.
+* REST capabilities exercised by the current MCP tool surface.
 *
-* Factory that produces ready-to-register pi tool definitions.
-* These tools run on the host (not in the VM) via the MoltNet SDK,
-* so agent credentials never touch the VM filesystem.
+* Intentionally excludes connector invocation, key management, runtime
+* management/read, and task claiming because MCP exposes none of those
+* operations.
 */
-var MOLTNET_TOOL_NAMES = [
-	"moltnet_pack_get",
-	"moltnet_pack_create",
-	"moltnet_pack_provenance",
-	"moltnet_pack_render",
-	"moltnet_rendered_pack_list",
-	"moltnet_rendered_pack_get",
-	"moltnet_diary_tags",
-	"moltnet_list_entries",
-	"moltnet_get_entry",
-	"moltnet_search_entries",
-	"moltnet_create_entry",
-	"moltnet_get_task",
-	"moltnet_list_task_attempts",
-	"moltnet_list_task_messages",
-	"moltnet_upload_task_artifact",
-	"moltnet_list_task_artifacts",
-	"moltnet_download_task_artifact",
-	"moltnet_review_session_errors",
-	"moltnet_host_exec"
+var MCP_CLIENT_SCOPES = [
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.DiaryManage,
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.DiaryWrite,
+	CREDENTIAL_SCOPES.HumanProfile,
+	CREDENTIAL_SCOPES.PackRead,
+	CREDENTIAL_SCOPES.PackWrite,
+	CREDENTIAL_SCOPES.TaskExecute,
+	CREDENTIAL_SCOPES.TaskManage,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TaskWrite,
+	CREDENTIAL_SCOPES.TeamManage,
+	CREDENTIAL_SCOPES.TeamRead
 ];
-var DIARY_TAG_MAX_LENGTH$1 = 128;
-/**
-* Baseline env keys forwarded to host-exec child processes.
-* Callers can extend this set at sandbox startup via `MoltNetToolsConfig.hostExecBaseEnv`.
-*/
-var HOST_EXEC_DEFAULT_BASE_ENV = new Set([
-	"PATH",
-	"HOME",
-	"LANG",
-	"LC_ALL",
-	"TMPDIR",
-	"GIT_CONFIG_GLOBAL",
-	"MOLTNET_CREDENTIALS_PATH",
-	"GIT_AUTHOR_NAME",
-	"GIT_AUTHOR_EMAIL",
-	"GIT_COMMITTER_NAME",
-	"GIT_COMMITTER_EMAIL",
-	"SSH_AUTH_SOCK"
-]);
-function ensureConnected(config) {
-	const agent = config.getAgent();
-	const diaryId = config.getDiaryId();
-	if (!agent || !diaryId) throw new Error("MoltNet not connected");
-	return {
-		agent,
-		diaryId,
-		teamId: config.getTeamId() ?? ""
-	};
-}
-function hostExecMatchesAutoApproveRule(params, rule) {
-	if (params.executable !== rule.executable) return false;
-	if (rule.argsExcludes?.some((arg) => params.args.includes(arg))) return false;
-	if (rule.argsPrefix && !rule.argsPrefix.every((arg, index) => params.args[index] === arg)) return false;
-	if (rule.argsContains && !rule.argsContains.every((arg) => params.args.includes(arg))) return false;
-	return true;
-}
-function shouldAutoApproveHostExec(params, config) {
-	const policy = config.autoApproveHostExec === true ? true : config.hostExecAutoApprove ?? false;
-	if (policy === true) return true;
-	if (!Array.isArray(policy)) return false;
-	return policy.some((rule) => hostExecMatchesAutoApproveRule(params, rule));
-}
-async function resolveWorkspaceFilePath(cwd, filePath) {
-	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
-	const realCwd = await realpath(cwd);
-	let realResolved;
-	try {
-		realResolved = await realpath(resolved);
-	} catch (err) {
-		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
-		throw err;
-	}
-	const rel = path.relative(realCwd, realResolved);
-	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`task artifact path escapes workspace: ${filePath}`);
-	return realResolved;
-}
-async function openWorkspaceArtifactInput(config, cwd, filePath) {
-	if (config.openWorkspaceFileForRead) try {
-		return await config.openWorkspaceFileForRead(filePath);
-	} catch (err) {
-		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
-		throw err;
-	}
-	const resolved = await resolveWorkspaceFilePath(cwd, filePath);
-	const info = await stat(resolved);
-	return {
-		stream: createReadStream(resolved),
-		isFile: info.isFile(),
-		sizeBytes: info.size,
-		displayPath: path.relative(cwd, resolved)
-	};
-}
-async function resolveWorkspaceOutputPath(cwd, filePath) {
-	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
-	const workspaceRoot = path.resolve(cwd);
-	const lexicalRel = path.relative(workspaceRoot, resolved);
-	if (lexicalRel === "" || lexicalRel.startsWith("..") || path.isAbsolute(lexicalRel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
-	const realCwd = await realpath(cwd);
-	const parent = path.dirname(resolved);
-	assertPathInsideWorkspace(realCwd, await findExistingAncestor(parent), filePath);
-	await mkdir(parent, { recursive: true });
-	assertPathInsideWorkspace(realCwd, await realpath(parent), filePath);
-	return resolved;
-}
-async function findExistingAncestor(candidate) {
-	let current = candidate;
-	for (;;) {
-		try {
-			return await realpath(current);
-		} catch (err) {
-			if (!err || typeof err !== "object" || !("code" in err) || err.code !== "ENOENT") throw err;
-		}
-		const parent = path.dirname(current);
-		if (parent === current) throw new Error(`task artifact output has no existing ancestor: ${candidate}`);
-		current = parent;
-	}
-}
-function assertPathInsideWorkspace(realCwd, realPath, displayPath) {
-	if (!isResolvedPathInsideRoot$1(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
-}
-/**
-* Expand the `taskFilter` shorthand on the diary list/search tools into
-* the matching `task:*` provenance tags emitted by `moltnet_create_entry`
-* during a task. Returning an array (possibly empty) lets callers spread
-* it into a larger `tags` AND-filter without conditionals.
-*/
-function compileTaskFilterTags(filter) {
-	if (!filter) return [];
-	const tags = [];
-	if (filter.taskId) tags.push(`task:id:${filter.taskId}`);
-	if (filter.taskType) tags.push(`task:type:${filter.taskType}`);
-	if (filter.correlationId) tags.push(`task:correlation:${filter.correlationId}`);
-	if (typeof filter.attemptN === "number") tags.push(`task:attempt:${filter.attemptN}`);
-	return tags;
+MCP_CLIENT_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+Object.freeze([...[
+	"openid",
+	"offline",
+	"offline_access"
+], ...MCP_CLIENT_SCOPES]);
+//#endregion
+//#region ../models/src/preview-sign.ts
+function schemaRef$1(schema, id) {
+	return Type.Unsafe(Type.Ref(id));
 }
+var PreviewSignBase64UrlSchema = Type.String({
+	$id: "PreviewSignBase64Url",
+	minLength: 1,
+	maxLength: 5462,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignSha256Base64UrlSchema = Type.String({
+	$id: "PreviewSignSha256Base64Url",
+	minLength: 43,
+	maxLength: 43,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
+	$id: "PreviewSignP256DerSignatureBase64Url",
+	minLength: 11,
+	maxLength: 96,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignEs256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-7),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEs256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-25),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEcdhEsHkdf256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEsp256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-9),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEsp256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignArkgSeedPublicKeySchema = Type.Object({
+	kty: Type.Literal(-65537),
+	algorithm: Type.Literal(-65700),
+	derivedAlgorithm: Type.Literal(-9),
+	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
+}, {
+	$id: "PreviewSignArkgSeedPublicKey",
+	additionalProperties: false
+});
+var PreviewSignPublicMaterialSchema = Type.Object({
+	version: Type.Literal(1),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
+}, {
+	$id: "PreviewSignPublicMaterial",
+	additionalProperties: false
+});
+var PreviewSignChallengeSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	version: Type.Literal(1),
+	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
+}, {
+	$id: "PreviewSignChallenge",
+	additionalProperties: false
+});
+var PreviewSignChallengeValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
+}, {
+	$id: "PreviewSignChallengeValue",
+	additionalProperties: false
+});
+var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
+var PreviewSignReceiptSchema = Type.Object({
+	version: Type.Literal(1),
+	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
+}, {
+	$id: "PreviewSignReceipt",
+	additionalProperties: false
+});
+var PreviewSignReceiptValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
+}, {
+	$id: "PreviewSignReceiptValue",
+	additionalProperties: false
+});
+var previewSignSchemaContext = {
+	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
+	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
+	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
+	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
+	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
+	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
+	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
+	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
+	PreviewSignChallenge: PreviewSignChallengeSchema,
+	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
+	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
+	PreviewSignReceipt: PreviewSignReceiptSchema,
+	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
+};
+//#endregion
+//#region ../models/src/verification-method.ts
 /**
-* Create all MoltNet tool definitions, ready to pass to `pi.registerTool()`.
-*/
-function createMoltNetTools(config) {
-	const getPack = defineTool({
-		name: "moltnet_pack_get",
-		label: "Get MoltNet Pack",
-		description: "Get a context pack by ID. Optionally expand included entries.",
-		parameters: Type$1.Object({
-			packId: Type$1.String({ description: "Context pack ID" }),
-			expandEntries: Type$1.Optional(Type$1.Boolean({ description: "Include full expanded entries" }))
-		}),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const pack = await agent.packs.get(params.packId, { expand: params.expandEntries ? "entries" : void 0 });
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(pack, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const createPack = defineTool({
-		name: "moltnet_pack_create",
-		label: "Create MoltNet Pack",
-		description: "Persist a curated context pack. Entries are caller-ranked (lower rank = more prominent). Recipe/prompt/selection_rationale belong in params. Defaults to pinned=false — packs in the attribution pipeline are ephemeral unless the caller explicitly opts in.",
-		parameters: Type$1.Object({
-			entries: Type$1.Array(Type$1.Object({
-				entryId: Type$1.String({ description: "Diary entry UUID" }),
-				rank: Type$1.Number({ description: "Rank (1..N, lower = more prominent)" })
-			}), { description: "Selected entries with their ranks" }),
-			params: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
-			tokenBudget: Type$1.Optional(Type$1.Number({ description: "Soft token budget recorded on the pack (optional)" })),
-			pinned: Type$1.Optional(Type$1.Boolean({ description: "Pin the pack against retention policy (default false)" }))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId } = ensureConnected(config);
-			const pack = await agent.packs.create(diaryId, {
-				packType: "custom",
-				params: params.params ?? {},
-				entries: params.entries,
-				tokenBudget: params.tokenBudget,
-				pinned: params.pinned ?? false
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(pack, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const getPackProvenance = defineTool({
-		name: "moltnet_pack_provenance",
-		label: "Get MoltNet Pack Provenance",
-		description: "Get the provenance graph for a context pack by ID or CID.",
-		parameters: Type$1.Object({
-			packId: Type$1.Optional(Type$1.String({ description: "Context pack ID" })),
-			packCid: Type$1.Optional(Type$1.String({ description: "Context pack CID" })),
-			depth: Type$1.Optional(Type$1.Number({ description: "Supersession ancestry depth to include (default 2)" }))
-		}),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			if (!params.packId && !params.packCid) throw new Error("Provide either packId or packCid");
-			if (params.packId && params.packCid) throw new Error("Provide only one of packId or packCid");
-			const graph = params.packId ? await agent.packs.getProvenance(params.packId, { depth: params.depth ?? 2 }) : await agent.packs.getProvenanceByCid(params.packCid, { depth: params.depth ?? 2 });
-			const payload = {
-				metadata: graph.metadata,
-				counts: {
-					nodes: graph.nodes.length,
-					edges: graph.edges.length
-				},
-				graph
-			};
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(payload, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const renderPack = defineTool({
-		name: "moltnet_pack_render",
-		label: "Render MoltNet Pack",
-		description: "Fetch a pack with entries, transform it into docs, then preview or persist the rendered pack.",
-		parameters: Type$1.Object({
-			packId: Type$1.String({ description: "Context pack ID" }),
-			renderMethod: Type$1.Optional(Type$1.String({ description: "Render method label. Defaults to pi:pack-to-docs-v1" })),
-			markdown: Type$1.Optional(Type$1.String({ description: "Optional caller-authored markdown override" })),
-			preview: Type$1.Optional(Type$1.Boolean({ description: "Preview without persisting (default false)" })),
-			pinned: Type$1.Optional(Type$1.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
-		}),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const renderMethod = params.renderMethod ?? "pi:pack-to-docs-v1";
-			let renderedMarkdown = params.markdown;
-			if (!renderedMarkdown && !renderMethod.startsWith("server:")) renderedMarkdown = renderPhase6Markdown(await agent.packs.get(params.packId, { expand: "entries" }));
-			const result = params.preview ?? false ? await agent.packs.previewRendered(params.packId, {
-				renderMethod,
-				renderedMarkdown
-			}) : await agent.packs.render(params.packId, {
-				renderMethod,
-				renderedMarkdown,
-				pinned: params.pinned
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(result, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const listRenderedPacks = defineTool({
-		name: "moltnet_rendered_pack_list",
-		label: "List MoltNet Rendered Packs",
-		description: "List rendered packs for the current MoltNet diary, optionally filtered by source pack or render method.",
-		parameters: Type$1.Object({
-			sourcePackId: Type$1.Optional(Type$1.String({ description: "Filter by source pack ID" })),
-			renderMethod: Type$1.Optional(Type$1.String({ description: "Filter by render method" })),
-			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 10)" })),
-			offset: Type$1.Optional(Type$1.Number({ description: "Offset for pagination (default 0)" }))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId } = ensureConnected(config);
-			const rendered = await agent.packs.listRendered(diaryId, {
-				sourcePackId: params.sourcePackId,
-				renderMethod: params.renderMethod,
-				limit: params.limit ?? 10,
-				offset: params.offset ?? 0
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(rendered, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const getRenderedPack = defineTool({
-		name: "moltnet_rendered_pack_get",
-		label: "Get MoltNet Rendered Pack",
-		description: "Get a rendered pack by ID.",
-		parameters: Type$1.Object({ renderedPackId: Type$1.String({ description: "Rendered pack ID" }) }),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const rendered = await agent.packs.getRendered(params.renderedPackId);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(rendered, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const diaryTags = defineTool({
-		name: "moltnet_diary_tags",
-		label: "List MoltNet Diary Tags",
-		description: "Inventory tags on the current diary with entry counts. Cheap reconnaissance before committing to a search or list — use it to discover scope prefixes and cluster sizes. Optional prefix/minCount/entryTypes filters narrow the result.",
-		parameters: Type$1.Object({
-			prefix: Type$1.Optional(Type$1.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
-			minCount: Type$1.Optional(Type$1.Number({ description: "Exclude tags with fewer than this many entries" })),
-			entryTypes: Type$1.Optional(Type$1.Array(Type$1.Union([
-				Type$1.Literal("episodic"),
-				Type$1.Literal("semantic"),
-				Type$1.Literal("procedural"),
-				Type$1.Literal("reflection")
-			]), { description: "Scope the tag count to these entry types" }))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId } = ensureConnected(config);
-			const result = await agent.diaries.tags(diaryId, {
-				prefix: params.prefix,
-				minCount: params.minCount,
-				entryTypes: params.entryTypes
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(result, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const listEntries = defineTool({
-		name: "moltnet_list_entries",
-		label: "List MoltNet Diary Entries",
-		description: "List entries from the MoltNet diary. When `entryIds` is provided, batch-fetches those specific entries (max 50) and returns full fields including entryType, contentSignature, and contentHash for signature checks. Otherwise returns recent entries with a content preview, filtered by any combination of tags (AND), excludeTags (NONE), entryType, and the taskFilter shorthand which expands into the right `task:*` tags.",
-		parameters: Type$1.Object({
-			limit: Type$1.Optional(Type$1.Number({ description: "Max entries to return (default 10)" })),
-			tags: Type$1.Optional(Type$1.Array(Type$1.String({
-				minLength: 1,
-				maxLength: DIARY_TAG_MAX_LENGTH$1
-			}), {
-				description: "Tags filter — entry must have ALL listed tags (AND). Max 20.",
-				maxItems: 20
-			})),
-			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
-				minLength: 1,
-				maxLength: DIARY_TAG_MAX_LENGTH$1
-			}), {
-				description: "Tags to exclude — entry must have NONE of these. Max 20.",
-				maxItems: 20
-			})),
-			entryType: Type$1.Optional(Type$1.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
-			taskFilter: Type$1.Optional(Type$1.Object({
-				taskId: Type$1.Optional(Type$1.String()),
-				taskType: Type$1.Optional(Type$1.String()),
-				correlationId: Type$1.Optional(Type$1.String()),
-				attemptN: Type$1.Optional(Type$1.Number())
-			}, { description: "Shorthand: any combination compiles to the matching task:* tags (task:id:<id>, task:type:<type>, task:correlation:<id>, task:attempt:<n>) and is merged into the tags filter." })),
-			entryIds: Type$1.Optional(Type$1.Array(Type$1.String(), {
-				description: "Batch-fetch specific entries by UUID (max 50). Overrides every other filter.",
-				maxItems: 50
-			}))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId } = ensureConnected(config);
-			const query = {
-				orderBy: "createdAt",
-				order: "desc"
-			};
-			const batchMode = !!params.entryIds?.length;
-			if (batchMode) query.ids = params.entryIds;
-			else {
-				query.limit = params.limit ?? 10;
-				const expandedTags = compileTaskFilterTags(params.taskFilter);
-				const allTags = [...params.tags ?? [], ...expandedTags];
-				if (allTags.length) query.tags = allTags;
-				if (params.excludeTags?.length) query.excludeTags = params.excludeTags;
-				if (params.entryType) query.entryType = params.entryType;
-			}
-			const entries = await agent.entries.list(diaryId, query);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(entries.items?.map((e) => batchMode ? {
-						id: e.id,
-						title: e.title,
-						entryType: e.entryType,
-						tags: e.tags,
-						importance: e.importance,
-						contentHash: e.contentHash,
-						contentSignature: e.contentSignature,
-						signingNonce: e.signingNonce,
-						createdAt: e.createdAt
-					} : {
-						id: e.id,
-						title: e.title,
-						tags: e.tags,
-						importance: e.importance,
-						createdAt: e.createdAt,
-						contentPreview: typeof e.content === "string" ? e.content.slice(0, 200) : void 0
-					}), null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const getEntry = defineTool({
-		name: "moltnet_get_entry",
-		label: "Get MoltNet Diary Entry",
-		description: "Get the full content of a specific diary entry by ID.",
-		parameters: Type$1.Object({ entryId: Type$1.String({ description: "The entry ID to fetch" }) }),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const entry = await agent.entries.get(params.entryId);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						id: entry.id,
-						title: entry.title,
-						content: entry.content,
-						tags: entry.tags,
-						importance: entry.importance,
-						createdAt: entry.createdAt
-					}, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const searchEntries = defineTool({
-		name: "moltnet_search_entries",
-		label: "Search MoltNet Diary Entries",
-		description: "Hybrid (semantic + lexical) search over diary entries. Use proactively before non-trivial investigation, code changes, review, or episodic incident capture so prior decisions and recurring failures surface before you act. Do not search randomly: pass taskFilter for task/correlation-local searches and tags or entryTypes for broader prior-knowledge searches. Optional tags / excludeTags / entryTypes filters AND with the query; the taskFilter shorthand expands into task:* provenance tags so `taskFilter: { taskType: \"fulfill_brief\" }` returns only entries from fulfill_brief attempts. Filters apply server-side before ranking.",
-		parameters: Type$1.Object({
-			query: Type$1.String({ description: "Natural language search query" }),
-			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 5)" })),
-			tags: Type$1.Optional(Type$1.Array(Type$1.String({
-				minLength: 1,
-				maxLength: DIARY_TAG_MAX_LENGTH$1
-			}), {
-				description: "Entry must have ALL listed tags (AND). Max 20.",
-				maxItems: 20
-			})),
-			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
-				minLength: 1,
-				maxLength: DIARY_TAG_MAX_LENGTH$1
-			}), {
-				description: "Entry must have NONE of these tags. Max 20.",
-				maxItems: 20
-			})),
-			entryTypes: Type$1.Optional(Type$1.Array(Type$1.String(), {
-				description: "Restrict to these entry types (procedural, semantic, episodic, reflection). Max 4.",
-				maxItems: 4
-			})),
-			taskFilter: Type$1.Optional(Type$1.Object({
-				taskId: Type$1.Optional(Type$1.String()),
-				taskType: Type$1.Optional(Type$1.String()),
-				correlationId: Type$1.Optional(Type$1.String()),
-				attemptN: Type$1.Optional(Type$1.Number())
-			}, { description: "Shorthand: any combination compiles to the matching task:* tags and is merged into the tags filter." }))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId } = ensureConnected(config);
-			const expandedTags = compileTaskFilterTags(params.taskFilter);
-			const allTags = [...params.tags ?? [], ...expandedTags];
-			const results = await agent.entries.search({
-				diaryId,
-				query: params.query,
-				limit: params.limit ?? 5,
-				...allTags.length ? { tags: allTags } : {},
-				...params.excludeTags?.length ? { excludeTags: params.excludeTags } : {},
-				...params.entryTypes?.length ? { entryTypes: params.entryTypes } : {}
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(results.results?.map((e) => ({
-						id: e.id,
-						title: e.title,
-						tags: e.tags,
-						importance: e.importance,
-						contentPreview: typeof e.content === "string" ? e.content.slice(0, 200) : void 0
-					})), null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const createEntry = defineTool({
-		name: "moltnet_create_entry",
-		label: "Create MoltNet Diary Entry",
-		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. Before creating an episodic incident entry, first call moltnet_search_entries with the title/root-cause/error/watch-for terms plus taskFilter, tags, or entryTypes filters, then reference close matches instead of creating an isolated duplicate. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
-		parameters: Type$1.Object({
-			title: Type$1.String({ description: "Entry title (concise, descriptive)" }),
-			content: Type$1.String({ description: "Entry content (markdown)" }),
-			tags: Type$1.Optional(Type$1.Array(Type$1.String(), { description: "Tags for categorization" })),
-			importance: Type$1.Optional(Type$1.Number({ description: "Importance 1-10 (default 5)" })),
-			entryType: Type$1.Optional(Type$1.Union([
-				Type$1.Literal("episodic"),
-				Type$1.Literal("semantic"),
-				Type$1.Literal("procedural"),
-				Type$1.Literal("reflection")
-			], { description: "Entry type. Use episodic for incidents, workarounds, bugs, or recurrence evidence; defaults to semantic." })),
-			diaryId: Type$1.Optional(Type$1.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." })),
-			signed: Type$1.Optional(Type$1.Boolean({ description: "Create a content-signed (immutable) entry. The signature is produced on the trusted host through the agent-signing capability; fails when the runtime does not expose it." }))
-		}),
-		async execute(_id, params) {
-			const { agent, diaryId: envDiaryId } = ensureConnected(config);
-			const signer = params.signed ? config.getSigner?.() ?? null : null;
-			if (params.signed && !signer) throw new Error("entries_create: signed entries require the agent-signing capability; create an unsigned entry or run under a runtime that declares it.");
-			const taskCtx = config.getTaskContext?.() ?? null;
-			let targetDiaryId;
-			let autoTags = [];
-			if (taskCtx) {
-				if (params.diaryId && params.diaryId !== taskCtx.diaryId) throw new Error(`entries_create: diaryId "${params.diaryId}" does not match the active task diary "${taskCtx.diaryId}". Entries created during a task must land in the task diary.`);
-				targetDiaryId = taskCtx.diaryId;
-				autoTags = [
-					`task:id:${taskCtx.taskId}`,
-					`task:type:${taskCtx.taskType}`,
-					`task:attempt:${taskCtx.attemptN}`,
-					...taskCtx.correlationId ? [`task:correlation:${taskCtx.correlationId}`] : []
-				];
-			} else targetDiaryId = params.diaryId ?? envDiaryId;
-			const userTags = params.tags ?? [];
-			const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
-			let entry;
-			try {
-				let signingRequestId;
-				if (signer) {
-					const contentCid = computeContentCid(params.entryType ?? "semantic", params.title, params.content, mergedTags);
-					const request = await agent.crypto.signingRequests.create({
-						message: contentCid,
-						verificationMethod: "agent-ed25519"
-					});
-					await signer.signDiaryEntry({ signingRequestId: request.id });
-					signingRequestId = request.id;
-				}
-				entry = await agent.entries.create(targetDiaryId, {
-					title: params.title,
-					content: params.content,
-					tags: mergedTags,
-					importance: params.importance ?? 5,
-					...params.entryType ? { entryType: params.entryType } : {},
-					...signingRequestId ? { signingRequestId } : {}
-				});
-			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				if (taskCtx && /\b403\b|forbidden|not authorized|permission/i.test(message)) {
-					await config.onTaskProvenanceEvent?.("task.provenance.entry_denied", {
-						taskId: taskCtx.taskId,
-						diaryId: targetDiaryId,
-						error: message
-					});
-					throw new Error(`entries_create: the task provenance diary denied this entry. The diary may have moved to another team or its grants may have changed. The task and runtime session remain active; ask a diary manager to restore write access, then retry. (${message})`, { cause: error });
-				}
-				throw error;
-			}
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						id: entry.id,
-						title: entry.title,
-						createdAt: entry.createdAt,
-						diaryId: targetDiaryId,
-						entryType: entry.entryType,
-						importance: entry.importance,
-						tags: mergedTags,
-						signed: signer !== null
-					}, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const getTask = defineTool({
-		name: "moltnet_get_task",
-		label: "Get MoltNet Task",
-		description: "Fetch a task by ID — the row, including taskType, status, acceptedAttemptN, references, input, timeouts. Use this when you need to inspect another task (e.g. an assess_brief judging a fulfill_brief: fetch the target task here, then list its attempts via moltnet_list_task_attempts to read the producer's output and decide what to investigate).",
-		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const task = await agent.tasks.get(params.taskId);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(task, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const listTaskAttempts = defineTool({
-		name: "moltnet_list_task_attempts",
-		label: "List MoltNet Task Attempts",
-		description: "List every attempt made on a task, in attempt-number order. Each attempt carries the claimed agent, status, output, outputCid, and timing. The accepted attempt (whose attemptN matches the parent task's acceptedAttemptN) is the canonical one — its `output` is what consumers should reason against. Earlier failed or timed_out attempts are kept for audit but should not drive downstream decisions.",
-		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const attempts = await agent.tasks.listAttempts(params.taskId);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(attempts, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const listTaskMessages = defineTool({
-		name: "moltnet_list_task_messages",
-		label: "List MoltNet Task Attempt Messages",
-		description: "List messages for a specific task attempt. Use this when you need the turn-by-turn execution record behind an accepted attempt — tool calls, text deltas, and error/info events that do not appear in the attempt output alone.",
-		parameters: Type$1.Object({
-			taskId: Type$1.String({ description: "Task ID (UUID)." }),
-			attemptN: Type$1.Integer({
-				minimum: 1,
-				description: "Attempt number to inspect."
-			}),
-			afterSeq: Type$1.Optional(Type$1.Integer({
-				minimum: 0,
-				description: "Optional cursor: only return messages with seq > afterSeq."
-			})),
-			limit: Type$1.Optional(Type$1.Integer({
-				minimum: 1,
-				maximum: 500,
-				description: "Optional maximum messages to return. Defaults to the API value."
-			}))
-		}),
-		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const messages = await agent.tasks.listMessages(params.taskId, params.attemptN, {
-				afterSeq: params.afterSeq,
-				limit: params.limit
-			});
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(messages, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const uploadTaskArtifact = defineTool({
-		name: "moltnet_upload_task_artifact",
-		label: "Upload MoltNet Task Artifact",
-		description: "Upload a file from the current task workspace as an immutable task artifact. Only available during an active task attempt; the tool attaches the artifact to the active taskId/attemptN and returns metadata including cid, sizeBytes, kind, and title. Use this for large logs, reports, build outputs, screenshots, generated files, or other bytes that should be referenced by CID instead of pasted into structured task output.",
-		parameters: Type$1.Object({
-			filePath: Type$1.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
-			kind: Type$1.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
-			title: Type$1.String({ description: "Human-readable artifact title, usually the file name." }),
-			contentType: Type$1.Optional(Type$1.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
-			contentEncoding: Type$1.Optional(Type$1.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
-		}),
-		async execute(_id, params) {
-			const { agent, teamId } = ensureConnected(config);
-			if (!teamId) throw new Error("moltnet_upload_task_artifact requires a team context");
-			const taskCtx = config.getTaskContext?.() ?? null;
-			if (!taskCtx) throw new Error("moltnet_upload_task_artifact is only available during an active task attempt");
-			const input = await openWorkspaceArtifactInput(config, config.getHostCwd?.() ?? process.cwd(), params.filePath);
-			if (!input.isFile) throw new Error(`task artifact path is not a file: ${params.filePath}`);
-			const artifact = await agent.tasks.artifacts.upload({
-				taskId: taskCtx.taskId,
-				attemptN: taskCtx.attemptN
-			}, input.stream, {
-				kind: params.kind,
-				title: params.title,
-				contentType: params.contentType ?? "application/octet-stream",
-				contentEncoding: params.contentEncoding
-			}, { teamId });
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						...artifact,
-						filePath: input.displayPath ?? params.filePath,
-						localSizeBytes: input.sizeBytes ?? null
-					}, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const listTaskArtifacts = defineTool({
-		name: "moltnet_list_task_artifacts",
-		label: "List MoltNet Task Artifacts",
-		description: "List immutable artifacts attached to a task, including each artifact CID, attempt number, kind, title, content type, size, uploader, and creation time. Use this when judging or continuing work that references task artifacts.",
-		parameters: Type$1.Object({
-			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
-			limit: Type$1.Optional(Type$1.Integer({
-				minimum: 1,
-				maximum: 100,
-				description: "Maximum artifacts to return. Defaults to the server page size."
-			})),
-			cursor: Type$1.Optional(Type$1.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
-		}),
-		async execute(_id, params) {
-			const { agent, teamId } = ensureConnected(config);
-			if (!teamId) throw new Error("moltnet_list_task_artifacts requires a team context");
-			const taskId = params.taskId ?? config.getTaskContext?.()?.taskId;
-			if (!taskId) throw new Error("moltnet_list_task_artifacts requires taskId outside an active task");
-			const page = await agent.tasks.artifacts.listPage(taskId, {
-				cursor: params.cursor,
-				limit: params.limit
-			}, { teamId });
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(page, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const downloadTaskArtifact = defineTool({
-		name: "moltnet_download_task_artifact",
-		label: "Download MoltNet Task Artifact",
-		description: "Download immutable task artifact bytes by taskId and CID into a new file in the current task workspace. Use moltnet_list_task_artifacts first to choose the correct CID. Omit attemptN for a bound input artifact; pass it only to require an artifact from one exact task attempt.",
-		parameters: Type$1.Object({
-			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
-			attemptN: Type$1.Optional(Type$1.Integer({
-				minimum: 1,
-				description: "Attempt number that produced the artifact. Omit for bound input artifacts, which have no producing attempt."
-			})),
-			cid: Type$1.String({
-				minLength: 1,
-				description: "Artifact CID returned by moltnet_list_task_artifacts."
-			}),
-			outputPath: Type$1.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
-		}),
-		async execute(_id, params) {
-			const { agent, teamId } = ensureConnected(config);
-			if (!teamId) throw new Error("moltnet_download_task_artifact requires a team context");
-			const taskId = params.taskId ?? config.getTaskContext?.()?.taskId;
-			if (!taskId) throw new Error("moltnet_download_task_artifact requires taskId outside an active task");
-			const cwd = config.getHostCwd?.() ?? process.cwd();
-			const outputPath = await resolveWorkspaceOutputPath(cwd, params.outputPath);
-			const artifactPath = params.attemptN === void 0 ? {
-				taskId,
-				cid: params.cid
-			} : {
-				taskId,
-				attemptN: params.attemptN,
-				cid: params.cid
-			};
-			const download = await agent.tasks.artifacts.download(artifactPath, { teamId });
-			await pipeline(download.stream, createWriteStream(outputPath, { flags: "wx" }));
-			const info = await stat(outputPath);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						taskId,
-						...params.attemptN === void 0 ? {} : { attemptN: params.attemptN },
-						cid: params.cid,
-						artifactId: download.artifactId,
-						contentType: download.contentType,
-						contentEncoding: download.contentEncoding,
-						outputPath: path.relative(cwd, outputPath),
-						sizeBytes: info.size
-					}, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const reviewSessionErrors = defineTool({
-		name: "moltnet_review_session_errors",
-		label: "Review Session Tool Errors",
-		description: "Review tool failures buffered during this session (isError=true results). Use this to decide whether any failures are worth persisting as a diary entry via moltnet_create_entry. Most failures are transient (denied prompts, empty greps, mid-iteration typecheck errors) and should NOT be written to the diary — only persist incidents that represent a real finding (root cause identified, non-obvious workaround, recurring pattern). Pass clear=true to drop the buffer after reviewing.",
-		parameters: Type$1.Object({ clear: Type$1.Optional(Type$1.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
-		async execute(_id, params) {
-			const errors = config.getSessionErrors();
-			const payload = {
-				count: errors.length,
-				errors: errors.map((e) => ({
-					toolName: e.toolName,
-					toolCallId: e.toolCallId,
-					timestamp: new Date(e.timestamp).toISOString(),
-					input: e.input,
-					error: e.error
-				}))
-			};
-			if (params.clear) config.clearSessionErrors();
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(payload, null, 2)
-				}],
-				details: {}
-			};
-		}
-	});
-	const HOST_EXEC_ALLOWED = new Set([
-		"git",
-		"gh",
-		"moltnet"
-	]);
-	const hostExecBaseEnv = config.hostExecBaseEnv ?? HOST_EXEC_DEFAULT_BASE_ENV;
-	const HOST_EXEC_TIMEOUT_MS = 6e4;
-	return [
-		getPack,
-		createPack,
-		getPackProvenance,
-		renderPack,
-		listRenderedPacks,
-		getRenderedPack,
-		diaryTags,
-		listEntries,
-		getEntry,
-		searchEntries,
-		createEntry,
-		getTask,
-		listTaskAttempts,
-		listTaskMessages,
-		uploadTaskArtifact,
-		listTaskArtifacts,
-		downloadTaskArtifact,
-		reviewSessionErrors,
-		defineTool({
-			name: "moltnet_host_exec",
-			label: "Run command on host (escape hatch — requires user approval)",
-			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations, and commit signing is brokered through the `agent-signing` host capability when declared; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
-			parameters: Type$1.Object({
-				executable: Type$1.String({ description: "Executable to run (git | gh | moltnet)" }),
-				args: Type$1.Array(Type$1.String(), { description: "Arguments to pass to the executable" }),
-				env: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
-			}),
-			async execute(_id, params, _signal, _onUpdate, ctx) {
-				if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
-				if (ctx?.ui && !shouldAutoApproveHostExec(params, config)) {
-					const cmdDisplay = [params.executable, ...params.args].join(" ");
-					if (!await ctx.ui.confirm("Allow host command?", `The agent wants to run on your machine:\n\n  ${cmdDisplay}\n\nAllow?`)) throw new Error(`host_exec: user declined approval for: ${cmdDisplay}`);
-				}
-				const cwd = config.getHostCwd?.() ?? process.cwd();
-				const baseEnv = {};
-				for (const key of hostExecBaseEnv) {
-					const val = process.env[key];
-					if (val !== void 0) baseEnv[key] = val;
-				}
-				const mergedEnv = {
-					...baseEnv,
-					...params.env ?? {}
-				};
-				let stdout;
-				let stderr = "";
-				try {
-					stdout = execFileSync(params.executable, params.args, {
-						encoding: "utf8",
-						cwd,
-						env: mergedEnv,
-						stdio: [
-							"pipe",
-							"pipe",
-							"pipe"
-						],
-						timeout: HOST_EXEC_TIMEOUT_MS
-					});
-				} catch (err) {
-					const e = err;
-					stdout = e.stdout ?? "";
-					stderr = e.stderr ?? e.message ?? String(err);
-				}
-				const result = {
-					host_exec: true,
-					executable: params.executable,
-					args: params.args,
-					cwd,
-					stdout: stdout.trimEnd(),
-					stderr: stderr.trimEnd() || void 0
-				};
-				return {
-					content: [{
-						type: "text",
-						text: JSON.stringify(result, null, 2)
-					}],
-					details: {}
-				};
-			}
-		})
-	];
-}
-//#endregion
-//#region src/otel/index.ts
-var TRACER_NAME = "@themoltnet/pi-extension/otel";
-function stripReservedAttrs(attrs) {
-	const out = {};
-	for (const [k, v] of Object.entries(attrs)) {
-		if (k.startsWith("gen_ai.")) continue;
-		out[k] = v;
-	}
-	return out;
-}
-function createPiOtelExtension(options = {}) {
-	return function piOtelExtension(pi) {
-		const tracer = trace.getTracer(TRACER_NAME);
-		const extraAttrs = stripReservedAttrs(options.spanAttributes ?? {});
-		let sessionSpan;
-		let sessionCtx = context.active();
-		let turnSpan;
-		let turnCtx = context.active();
-		let currentModel;
-		const toolSpans = /* @__PURE__ */ new Map();
-		function drainToolSpans(reason) {
-			for (const [, entry] of toolSpans) {
-				entry.span.setStatus({
-					code: SpanStatusCode.ERROR,
-					message: reason
-				});
-				entry.span.end();
-			}
-			toolSpans.clear();
-		}
-		function endTurnSpan() {
-			if (!turnSpan) return;
-			drainToolSpans("tool span not closed before turn end");
-			turnSpan.end();
-			turnSpan = void 0;
-			turnCtx = sessionCtx;
-		}
-		function endSessionSpan() {
-			drainToolSpans("tool span not closed before session shutdown");
-			endTurnSpan();
-			if (sessionSpan) {
-				sessionSpan.setStatus({ code: SpanStatusCode.OK });
-				sessionSpan.end();
-				sessionSpan = void 0;
-				sessionCtx = context.active();
-				options.onSessionContextChange?.(void 0);
-			}
-			currentModel = void 0;
-		}
-		pi.on("session_start", (event, ctx) => {
-			endSessionSpan();
-			const agentName = options.agentName ?? "pi";
-			const parentContext = options.sessionParentContext ?? context.active();
-			sessionSpan = tracer.startSpan(`invoke_agent ${agentName}`, { attributes: {
-				...extraAttrs,
-				"gen_ai.operation.name": "invoke_agent",
-				"gen_ai.agent.name": agentName,
-				"session.reason": event.reason,
-				"session.cwd": ctx.cwd
-			} }, parentContext);
-			sessionCtx = trace.setSpan(parentContext, sessionSpan);
-			options.onSessionContextChange?.(sessionCtx);
-			turnCtx = sessionCtx;
-		});
-		pi.on("session_shutdown", () => {
-			endSessionSpan();
-		});
-		pi.on("model_select", (event) => {
-			currentModel = {
-				provider: event.model.provider,
-				id: event.model.id
-			};
-			if (sessionSpan) {
-				sessionSpan.setAttribute("gen_ai.request.model", event.model.id);
-				sessionSpan.setAttribute("gen_ai.provider.name", event.model.provider);
-			}
-		});
-		pi.on("turn_start", (event) => {
-			if (!sessionSpan) return;
-			const modelLabel = currentModel?.id ?? "unknown";
-			const turnParentContext = options.getTurnParentContext?.() ?? sessionCtx;
-			turnSpan = tracer.startSpan(`chat ${modelLabel}`, { attributes: {
-				...extraAttrs,
-				"gen_ai.operation.name": "chat",
-				"gen_ai.request.model": currentModel?.id ?? "unknown",
-				"gen_ai.provider.name": currentModel?.provider ?? "unknown",
-				"turn.index": event.turnIndex
-			} }, turnParentContext);
-			turnCtx = trace.setSpan(turnParentContext, turnSpan);
-		});
-		pi.on("turn_end", (event) => {
-			if (!turnSpan) return;
-			const usage = extractUsage(event.message);
-			if (usage) {
-				turnSpan.setAttribute("gen_ai.usage.input_tokens", usage.input);
-				turnSpan.setAttribute("gen_ai.usage.output_tokens", usage.output);
-			}
-			turnSpan.setAttribute("turn.tool_results", event.toolResults?.length ?? 0);
-			turnSpan.setStatus({ code: SpanStatusCode.OK });
-			endTurnSpan();
-		});
-		pi.on("tool_execution_start", (event) => {
-			const parentCtx = turnSpan ? turnCtx : sessionCtx;
-			const span = tracer.startSpan(`execute_tool ${event.toolName}`, { attributes: {
-				...extraAttrs,
-				"gen_ai.operation.name": "execute_tool",
-				"gen_ai.tool.name": event.toolName,
-				"gen_ai.tool.call.id": event.toolCallId
-			} }, parentCtx);
-			toolSpans.set(event.toolCallId, {
-				span,
-				startedAt: Date.now()
-			});
-		});
-		pi.on("tool_execution_end", (event) => {
-			const entry = toolSpans.get(event.toolCallId);
-			if (!entry) return;
-			const durationMs = Date.now() - entry.startedAt;
-			entry.span.setAttribute("tool.duration_ms", durationMs);
-			if (event.isError) {
-				entry.span.setAttribute("error.type", "tool_execution_error");
-				entry.span.setStatus({
-					code: SpanStatusCode.ERROR,
-					message: "tool execution failed"
-				});
-			} else entry.span.setStatus({ code: SpanStatusCode.OK });
-			entry.span.end();
-			toolSpans.delete(event.toolCallId);
-		});
-	};
-}
-function extractUsage(message) {
-	if (!message || typeof message !== "object" || !("usage" in message) || !("role" in message)) return null;
-	const msg = message;
-	if (msg.role !== "assistant" || !msg.usage) return null;
-	return {
-		input: msg.usage.input ?? 0,
-		output: msg.usage.output ?? 0
-	};
-}
-//#endregion
-//#region src/runtime/model-options-extension.ts
-function hasPiModelOptions(options) {
-	return options.temperature !== void 0 && options.temperature !== null || options.topP !== void 0 && options.topP !== null || options.topK !== void 0 && options.topK !== null || options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null;
-}
-function createPiModelOptionsExtension(options) {
-	return function piModelOptionsExtension(pi) {
-		pi.on("before_provider_request", (event) => {
-			return applyPiModelOptions(event.payload, options);
-		});
-	};
-}
-function applyPiModelOptions(payload, options) {
-	if (!isRecord$1(payload)) return void 0;
-	if (!hasPiModelOptions(options)) return void 0;
-	if (isGooglePayload(payload)) {
-		const config = isRecord$1(payload.config) ? payload.config : {};
-		return {
-			...payload,
-			config: applyConfigOptions(config, options)
-		};
-	}
-	if (isBedrockPayload(payload)) {
-		const inferenceConfig = isRecord$1(payload.inferenceConfig) ? payload.inferenceConfig : {};
-		return {
-			...payload,
-			inferenceConfig: applyBedrockOptions(inferenceConfig, options)
-		};
-	}
-	return applyTopLevelOptions(payload, options);
-}
-function applyConfigOptions(config, options) {
-	return {
-		...config,
-		...options.temperature !== void 0 && options.temperature !== null ? { temperature: options.temperature } : {},
-		...options.topP !== void 0 && options.topP !== null ? { topP: options.topP } : {},
-		...options.topK !== void 0 && options.topK !== null ? { topK: options.topK } : {},
-		...options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null ? { maxOutputTokens: options.maxOutputTokens } : {}
-	};
-}
-function applyBedrockOptions(inferenceConfig, options) {
-	return {
-		...inferenceConfig,
-		...options.temperature !== void 0 && options.temperature !== null ? { temperature: options.temperature } : {},
-		...options.topP !== void 0 && options.topP !== null ? { topP: options.topP } : {},
-		...options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null ? { maxTokens: options.maxOutputTokens } : {}
-	};
-}
-function applyTopLevelOptions(payload, options) {
-	const reasoningEnabled = hasActiveThinking(payload.thinking) || "reasoning" in payload || "reasoning_effort" in payload;
-	const next = { ...payload };
-	if (options.temperature !== void 0 && options.temperature !== null && !reasoningEnabled) next.temperature = options.temperature;
-	if (options.topP !== void 0 && options.topP !== null && !reasoningEnabled) next.top_p = options.topP;
-	if (options.topK !== void 0 && options.topK !== null && !reasoningEnabled && isAnthropicPayload(next)) next.top_k = options.topK;
-	if (options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null) {
-		const maxOutputTokens = options.maxOutputTokens;
-		if ("max_output_tokens" in next || isResponsesPayload(next)) next.max_output_tokens = maxOutputTokens;
-		else if ("max_completion_tokens" in next) next.max_completion_tokens = maxOutputTokens;
-		else if ("maxTokens" in next) next.maxTokens = maxOutputTokens;
-		else next.max_tokens = maxOutputTokens;
-	}
-	return next;
-}
-function isGooglePayload(payload) {
-	return "contents" in payload && ("config" in payload || "model" in payload);
-}
-function isBedrockPayload(payload) {
-	return "inferenceConfig" in payload || "additionalModelRequestFields" in payload;
-}
-function isResponsesPayload(payload) {
-	return "input" in payload && !("messages" in payload);
-}
-function isAnthropicPayload(payload) {
-	return "anthropic_version" in payload;
-}
-function hasActiveThinking(value) {
-	if (!isRecord$1(value)) return false;
-	const type = value.type;
-	return type !== "disabled" && type !== "off" && type !== false;
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/runtime/agent-session-factory.ts
-var NO_SKILLS = () => ({
-	skills: [],
-	diagnostics: []
-});
-/**
-* Construct an `AgentSession`. By default it is in-memory; callers may opt
-* parent sessions into daemon-owned file persistence via `sessionPersistence`.
-* The caller is responsible for eventually invoking `session.prompt(...)` and
-* for tearing down — the helper does no lifecycle management beyond
-* construction.
-*/
-async function buildAgentSession(args) {
-	const piOtelExtension = createPiOtelExtension({
-		agentName: args.agentName,
-		spanAttributes: args.otelSpanAttrs,
-		sessionParentContext: args.otelSessionParentContext,
-		getTurnParentContext: args.getOtelTurnParentContext,
-		onSessionContextChange: args.onOtelSessionContextChange
-	});
-	const modelOptions = {
-		temperature: args.temperature,
-		topP: args.topP,
-		topK: args.topK,
-		maxOutputTokens: args.maxOutputTokens
-	};
-	const extensionFactories = [
-		piOtelExtension,
-		...hasPiModelOptions(modelOptions) ? [createPiModelOptionsExtension(modelOptions)] : [],
-		...args.extraExtensionFactories ?? []
-	];
-	const resourceLoader = new DefaultResourceLoader({
-		cwd: args.cwdPath,
-		agentDir: args.piAuthDir,
-		extensionFactories,
-		appendSystemPrompt: args.appendSystemPrompt,
-		skillsOverride: args.skillsOverride ?? NO_SKILLS
-	});
-	await resourceLoader.reload();
-	const sessionManager = args.sessionPersistence ? await resolvePersistentSessionManager({
-		cwd: args.cwdPath,
-		sessionDir: args.sessionPersistence.sessionDir,
-		forkFromSessionPath: args.sessionPersistence.forkFromSessionPath
-	}) : SessionManager.inMemory(args.cwdPath);
-	return (await createAgentSession({
-		agentDir: args.piAuthDir,
-		cwd: args.cwdPath,
-		model: args.modelHandle,
-		...args.modelRuntime ? { modelRuntime: args.modelRuntime } : {},
-		thinkingLevel: args.thinkingLevel ?? void 0,
-		tools: args.tools,
-		customTools: args.customTools,
-		sessionManager,
-		resourceLoader
-	})).session;
-}
-async function resolvePersistentSessionManager(args) {
-	if (args.forkFromSessionPath) return SessionManager.forkFrom(args.forkFromSessionPath, args.cwd, args.sessionDir);
-	await SessionManager.list(args.cwd, args.sessionDir);
-	return SessionManager.continueRecent(args.cwd, args.sessionDir);
-}
-//#endregion
-//#region ../crypto-service/src/json-cid.ts
-/**
-* Generic JSON CID — CIDv1 for arbitrary JSON-serialisable values.
-*
-* Uses the dag-json codec and sha2-256, producing a base32lower CIDv1.
-* Suitable for content-addressing task inputs, schema objects, and other
-* JSON payloads that don't need diary-entry canonical normalisation.
-*/
-async function computeJsonCid(value) {
-	const bytes = json.encode(value);
-	const hash = await sha256$1.digest(bytes);
-	return CID.create(1, json.code, hash).toString();
-}
-//#endregion
-//#region src/config.ts
-/** Resolve Pi's host-side auth/config directory from process configuration. */
-function resolvePiCodingAgentDir() {
-	return process.env["PI_CODING_AGENT_DIR"] ?? path.join(homedir(), ".pi", "agent");
-}
-//#endregion
-//#region ../runtime-profiles/src/context.ts
-/**
-* How an executor delivers a context entry to its underlying LLM.
-* V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
-* tool_response_seed, additional_context_hook) ship in a later slice.
-*/
-var CONTEXT_BINDINGS = [
-	"skill",
-	"context_inline",
-	"prompt_prefix",
-	"user_inline"
-];
-/** Maximum UTF-16 code units accepted in one ContextRef content field. */
-var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
-var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
-/**
-* One context entry. Bytes are inlined: the proposer chose them, and the
-* task's `inputCid` already pins the entire input — including
-* `context[]` — so we don't need a separate per-entry hash, fetcher, or
-* flagged-content gate. Tasks reference rendered packs (or any other
-* external content) by copying their bytes into `content` at task
-* creation time.
-*
-* - `slug` — short identifier the daemon uses to disambiguate
-*            entries. For `skill` binding it becomes the directory
-*            name under the runtime's skill discovery path. Must be
-*            kebab-case-safe (alphanumeric + dashes/underscores).
-* - `binding` — how the bytes are delivered to the LLM (see above).
-* - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
-*               entry; total per-task context bytes are bounded by the
-*               soft `maxItems` cap and per-binding daemon limits.
-*               Raised from 32 KiB in 2026-05 — protocol-heavy operator
-*               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
-*               at ~35 KiB inline, and the original cap was sized for
-*               short example skills, not the kind of skill the eval
-*               substrate is dogfooded on (#943, #823).
-*/
-var ContextRef = Type.Object({
-	slug: Type.String({
-		minLength: 1,
-		maxLength: 64,
-		pattern: "^[a-zA-Z0-9_-]+$"
-	}),
-	binding: ContextBinding,
-	content: Type.String({
-		minLength: 1,
-		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
-	})
-}, {
-	$id: "ContextRef",
-	additionalProperties: false
-});
-/** Reusable input fragment for any task type. Soft cap at 5 items. */
-var TaskContext = Type.Array(ContextRef, {
-	$id: "TaskContext",
-	maxItems: 5
-});
-//#endregion
-//#region ../runtime-profiles/src/runtime-models.ts
-/**
-* Runtime model catalog: a list of supported provider/model couples that
-* MoltNet daemons can target. Backed by the `runtime_models` table.
-*
-* Scope is intrinsic to the row:
-*   - `teamId == null`  => global entry (MoltNet-seeded, read-only to most callers)
-*   - `teamId != null`  => team-owned custom entry
-*
-* The REST API exposes a single shape regardless of scope; the team header
-* gates which rows are returned.
-*/
-var RuntimeModelProvider = Type.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
-});
-var RuntimeModelName = Type.String({
-	minLength: 1,
-	maxLength: 200,
-	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
-});
-var RuntimeModelCapabilities = Type.Record(Type.String({
-	minLength: 1,
-	maxLength: 64
-}), Type.Union([
-	Type.Boolean(),
-	Type.Number(),
-	Type.String({ maxLength: 256 })
-]));
-Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	provider: RuntimeModelProvider,
-	model: RuntimeModelName,
-	displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
-	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
-	capabilities: RuntimeModelCapabilities,
-	isActive: Type.Boolean(),
-	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdAt: Type.String({ format: "date-time" }),
-	updatedAt: Type.String({ format: "date-time" })
-}, {
-	$id: "RuntimeModel",
-	additionalProperties: false
-});
-//#endregion
-//#region ../runtime-profiles/src/runtime-profile-context-recipes.ts
-var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
-	version: 1,
-	fragments: {
-		"artifact-planner-v1": {
-			binding: "prompt_prefix",
-			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
-			slug: "artifact-planner-v1"
-		},
-		"accountable-delivery-v1": {
-			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
-			slug: "accountable-delivery-v1"
-		},
-		"judgment-diary-v1": {
-			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
-			slug: "judgment-diary-v1"
-		},
-		"proactive-memory-v1": {
-			binding: "prompt_prefix",
-			content: "# Proactive memory use\n\n- Before non-trivial investigation, debugging, code changes, or review, check the task diary for relevant prior knowledge instead of waiting for a human to ask. Use `moltnet_diary_tags` for cheap reconnaissance, `moltnet_list_entries` when tags or task provenance are known, and `moltnet_search_entries` for semantic similarity. Do not search randomly: pass `taskFilter` for task-local or correlation-local queries, and pass `tags` / `entryTypes` for broader prior-knowledge queries using known tags such as `incident`, `decision`, or `scope:<area>`. Broaden only after constrained searches miss.\n- Before creating an `episodic` incident entry, search for similar incidents using the proposed title, root cause, error text, affected subsystem, and watch-for terms, filtered by `entryTypes: [\"episodic\", \"semantic\"]` and any known `scope:*` or task-provenance tags. If a close prior match exists, do not create an isolated duplicate: reference the prior entry in your response or diary content, update or link it when the new occurrence adds material evidence, or create a new recurrence entry only when the recurrence itself is important signal.\n- When you create a recurrence entry, include the prior matching entry id(s) in the content and explain what is new about this occurrence.",
-			slug: "proactive-memory-v1"
-		},
-		"run-eval-direct-v1": {
-			binding: "prompt_prefix",
-			content: "# Direct evaluation run\n\nThe supplied scenario, typed task facts, injected context, and registered submit-output tool are the complete task contract. Do not search diaries, create diary entries, modify a repository, commit, branch, push, or open a pull request unless a task fact explicitly requires it. Submit the agent-authored payload in the first turn; correction turns exist only to recover a rejected or missing submission.",
-			slug: "run-eval-direct-v1"
-		},
-		"task-diary-discipline-v1": {
-			binding: "prompt_prefix",
-			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
-			slug: "task-diary-discipline-v1"
-		},
-		"verification-and-artifacts-v1": {
-			binding: "prompt_prefix",
-			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
-			slug: "verification-and-artifacts-v1"
-		}
-	},
-	recipes: {
-		"artifact-planner@v1": {
-			description: "Minimal artifact-only context for bounded semantic classification and planning.",
-			fragments: ["artifact-planner-v1"]
-		},
-		"run-eval-direct@v1": {
-			description: "Minimal direct context for a short, isolated evaluation run.",
-			fragments: ["run-eval-direct-v1"]
-		},
-		"standard-engineering@v1": {
-			description: "Full opt-in operating guidance for engineering tasks that need diary research, accountable delivery, and verification discipline.",
-			fragments: [
-				"proactive-memory-v1",
-				"task-diary-discipline-v1",
-				"accountable-delivery-v1",
-				"judgment-diary-v1",
-				"verification-and-artifacts-v1"
-			]
-		}
-	}
-};
-function deepFreeze(value) {
-	if (value && typeof value === "object") {
-		for (const key of Object.keys(value)) deepFreeze(value[key]);
-		Object.freeze(value);
-	}
-	return value;
-}
-deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
-Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
-//#endregion
-//#region ../models/src/credential-scopes.ts
-var CREDENTIAL_SCOPES = {
-	AgentProfile: "agent:profile",
-	ConnectorInvoke: "connector:invoke",
-	CryptoSign: "crypto:sign",
-	DiaryManage: "diary:manage",
-	DiaryRead: "diary:read",
-	DiaryWrite: "diary:write",
-	HumanProfile: "human:profile",
-	KeyManage: "key:manage",
-	PackRead: "pack:read",
-	PackWrite: "pack:write",
-	RuntimeManage: "runtime:manage",
-	RuntimeRead: "runtime:read",
-	TaskClaim: "task:claim",
-	TaskExecute: "task:execute",
-	TaskManage: "task:manage",
-	TaskRead: "task:read",
-	TaskWrite: "task:write",
-	TeamManage: "team:manage",
-	TeamRead: "team:read"
-};
-var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
-CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.CryptoSign, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
-CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
-CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
-Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
-/**
-* REST capabilities exercised by the current MCP tool surface.
-*
-* Intentionally excludes connector invocation, key management, runtime
-* management/read, and task claiming because MCP exposes none of those
-* operations.
-*/
-var MCP_CLIENT_SCOPES = [
-	CREDENTIAL_SCOPES.AgentProfile,
-	CREDENTIAL_SCOPES.CryptoSign,
-	CREDENTIAL_SCOPES.DiaryManage,
-	CREDENTIAL_SCOPES.DiaryRead,
-	CREDENTIAL_SCOPES.DiaryWrite,
-	CREDENTIAL_SCOPES.HumanProfile,
-	CREDENTIAL_SCOPES.PackRead,
-	CREDENTIAL_SCOPES.PackWrite,
-	CREDENTIAL_SCOPES.TaskExecute,
-	CREDENTIAL_SCOPES.TaskManage,
-	CREDENTIAL_SCOPES.TaskRead,
-	CREDENTIAL_SCOPES.TaskWrite,
-	CREDENTIAL_SCOPES.TeamManage,
-	CREDENTIAL_SCOPES.TeamRead
-];
-MCP_CLIENT_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
-Object.freeze([...[
-	"openid",
-	"offline",
-	"offline_access"
-], ...MCP_CLIENT_SCOPES]);
-//#endregion
-//#region ../models/src/preview-sign.ts
-function schemaRef$1(schema, id) {
-	return Type.Unsafe(Type.Ref(id));
-}
-var PreviewSignBase64UrlSchema = Type.String({
-	$id: "PreviewSignBase64Url",
-	minLength: 1,
-	maxLength: 5462,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignSha256Base64UrlSchema = Type.String({
-	$id: "PreviewSignSha256Base64Url",
-	minLength: 43,
-	maxLength: 43,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
-	$id: "PreviewSignP256DerSignatureBase64Url",
-	minLength: 11,
-	maxLength: 96,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignEs256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-7),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
-}, {
-	$id: "PreviewSignEs256PublicKey",
-	additionalProperties: false
-});
-var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-25),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
-}, {
-	$id: "PreviewSignEcdhEsHkdf256PublicKey",
-	additionalProperties: false
-});
-var PreviewSignEsp256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-9),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
-}, {
-	$id: "PreviewSignEsp256PublicKey",
-	additionalProperties: false
-});
-var PreviewSignArkgSeedPublicKeySchema = Type.Object({
-	kty: Type.Literal(-65537),
-	algorithm: Type.Literal(-65700),
-	derivedAlgorithm: Type.Literal(-9),
-	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
-}, {
-	$id: "PreviewSignArkgSeedPublicKey",
-	additionalProperties: false
-});
-var PreviewSignPublicMaterialSchema = Type.Object({
-	version: Type.Literal(1),
-	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
-}, {
-	$id: "PreviewSignPublicMaterial",
-	additionalProperties: false
-});
-var PreviewSignChallengeSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	version: Type.Literal(1),
-	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
-}, {
-	$id: "PreviewSignChallenge",
-	additionalProperties: false
-});
-var PreviewSignChallengeValueSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
-}, {
-	$id: "PreviewSignChallengeValue",
-	additionalProperties: false
-});
-var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
-var PreviewSignReceiptSchema = Type.Object({
-	version: Type.Literal(1),
-	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
-}, {
-	$id: "PreviewSignReceipt",
-	additionalProperties: false
-});
-var PreviewSignReceiptValueSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
-}, {
-	$id: "PreviewSignReceiptValue",
-	additionalProperties: false
-});
-var previewSignSchemaContext = {
-	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
-	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
-	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
-	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
-	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
-	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
-	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
-	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
-	PreviewSignChallenge: PreviewSignChallengeSchema,
-	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
-	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
-	PreviewSignReceipt: PreviewSignReceiptSchema,
-	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
-};
-//#endregion
-//#region ../models/src/verification-method.ts
-/**
-* Persisted and wire-level signing verification method identifiers.
-*
-* This vocabulary is append-only. Never rename, remove, or change an existing
-* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
-* strings. Future signing methods must add a new property and value.
+* Persisted and wire-level signing verification method identifiers.
+*
+* This vocabulary is append-only. Never rename, remove, or change an existing
+* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
+* strings. Future signing methods must add a new property and value.
 */
 var VERIFICATION_METHOD = {
 	AgentEd25519: "agent-ed25519",
@@ -2139,576 +656,2116 @@ var TeamRoleSchema = Type.Union([
 	Type.Literal("executor"),
 	Type.Literal("member")
 ]);
-Type.Object({
-	id: UuidSchema,
-	name: Type.String()
-});
-var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
-Type.Object({
-	id: UuidSchema,
-	code: Type.String(),
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	]),
-	maxUses: Type.Integer(),
-	useCount: Type.Integer(),
-	expiresAt: DateTimeUnsafe,
-	createdAt: DateTimeUnsafe
-});
-var TeamMemberSchema = Type.Object({
-	subjectId: UuidSchema,
-	subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
-	role: TeamRoleSchema,
-	displayName: Type.String(),
-	alias: Type.Optional(AgentAliasSchema),
-	fingerprint: Type.Optional(Type.String()),
-	email: Type.Optional(Type.String())
+Type.Object({
+	id: UuidSchema,
+	name: Type.String()
+});
+var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
+Type.Object({
+	id: UuidSchema,
+	code: Type.String(),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	]),
+	maxUses: Type.Integer(),
+	useCount: Type.Integer(),
+	expiresAt: DateTimeUnsafe,
+	createdAt: DateTimeUnsafe
+});
+var TeamMemberSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
+	role: TeamRoleSchema,
+	displayName: Type.String(),
+	alias: Type.Optional(AgentAliasSchema),
+	fingerprint: Type.Optional(Type.String()),
+	email: Type.Optional(Type.String())
+});
+Type.Object({
+	id: UuidSchema,
+	name: Type.String(),
+	personal: Type.Boolean(),
+	status: Type.String(),
+	role: TeamRoleSchema
+});
+Type.Object({
+	id: UuidSchema,
+	name: Type.String(),
+	status: Type.String(),
+	personal: Type.Boolean(),
+	createdAt: DateTimeUnsafe,
+	updatedAt: DateTimeUnsafe,
+	members: Type.Array(TeamMemberSchema)
+});
+Type.Object({
+	teamId: UuidSchema,
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
+});
+Type.Object({
+	updated: Type.Boolean(),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
+});
+Type.Object({ deleted: Type.Boolean() });
+Type.Object({ removed: Type.Boolean() });
+var FoundingMemberSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: Type.Union([Type.Literal("Agent"), Type.Literal("Human")]),
+	role: Type.Union([
+		Type.Literal("owner"),
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
+});
+Type.Object({
+	name: Type.String({
+		minLength: 1,
+		maxLength: 255
+	}),
+	foundingMembers: Type.Optional(Type.Array(FoundingMemberSchema, { minItems: 1 }))
+});
+Type.Object({
+	id: UuidSchema,
+	name: Type.String(),
+	status: Type.String(),
+	workflowId: Type.Optional(Type.String())
+});
+Type.Object({});
+Type.Object({
+	accepted: Type.Boolean(),
+	teamStatus: Type.String()
+});
+Type.Object({ destinationTeamId: UuidSchema });
+Type.Object({ transferId: UuidSchema });
+var TransferResponseSchema = Type.Object({
+	id: UuidSchema,
+	diaryId: UuidSchema,
+	sourceTeamId: UuidSchema,
+	destinationTeamId: UuidSchema,
+	status: Type.String(),
+	initiatedBy: UuidSchema,
+	expiresAt: Type.Unsafe(Type.String({ format: "date-time" })),
+	createdAt: Type.Unsafe(Type.String({ format: "date-time" }))
+});
+Type.Object({ items: Type.Array(TransferResponseSchema) });
+Type.Object({ groupId: UuidSchema });
+Type.Object({
+	groupId: UuidSchema,
+	subjectId: UuidSchema
+});
+Type.Object({ name: Type.String({
+	minLength: 1,
+	maxLength: 255
+}) });
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: Type.Optional(Type.Union([Type.Literal("Agent"), Type.Literal("Human")]))
+});
+Type.Object({
+	id: UuidSchema,
+	name: Type.String(),
+	teamId: UuidSchema
+});
+var GroupMemberResponseSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: Type.String()
+});
+Type.Object({
+	id: UuidSchema,
+	name: Type.String(),
+	teamId: UuidSchema,
+	createdAt: DateTimeUnsafe,
+	members: Type.Array(GroupMemberResponseSchema)
+});
+var DiaryGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
+var GrantSubjectNsSchema = Type.Union([
+	Type.Literal("Agent"),
+	Type.Literal("Human"),
+	Type.Literal("Group")
+]);
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+var DiaryGrantResponseSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+Type.Object({ grants: Type.Array(DiaryGrantResponseSchema) });
+Type.Object({ revoked: Type.Boolean() });
+var TaskGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+var TaskGrantResponseSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type.Object({ grants: Type.Array(TaskGrantResponseSchema) });
+Type.Object({ "x-moltnet-team-id": Type.String({
+	format: "uuid",
+	description: "Team ID (UUID) that will own the resource. Required."
+}) });
+Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
+	format: "uuid",
+	description: "Team ID (UUID) for scoping the request. Optional."
+})) });
+Type.Object({
+	kind: Type.Literal("agent"),
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, {
+	$id: "AgentPrincipal",
+	additionalProperties: false
+});
+Type.Object({
+	kind: Type.Literal("human"),
+	humanId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()])
+}, {
+	$id: "HumanPrincipal",
+	additionalProperties: false
+});
+var principalUnionVariants = [Type.Object({
+	kind: Type.Literal("agent"),
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, { additionalProperties: false }), Type.Object({
+	kind: Type.Literal("human"),
+	humanId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()])
+}, { additionalProperties: false })];
+Type.Union(principalUnionVariants, {
+	$id: "PrincipalIdentity",
+	discriminator: { propertyName: "kind" }
+});
+/**
+* `$id`-less twin of `PrincipalIdentitySchema`. Required anywhere the
+* schema is **embedded** inline into another schema (MCP `outputSchema`
+* — every tool that returns a creator-bearing object embeds its own
+* copy; provenance-graph node `meta.creator`, etc.). Ajv 8 throws
+* `reference "PrincipalIdentity" resolves to more than one schema` if
+* the same `$id` appears twice in the same compilation pass, which is
+* exactly what happens when the MCP server lists tools and Ajv
+* traverses every advertised `outputSchema`.
+*
+* Structurally identical to `PrincipalIdentitySchema` (they share the
+* variants array); change one, change both.
+*/
+var PrincipalIdentitySchemaInline = Type.Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
+//#endregion
+//#region ../models/src/problem-details.ts
+var ProblemCodeSchema = Type.Union([
+	Type.Literal("UNAUTHORIZED"),
+	Type.Literal("FORBIDDEN"),
+	Type.Literal("NOT_FOUND"),
+	Type.Literal("CONFLICT"),
+	Type.Literal("UNSUPPORTED_MEDIA_TYPE"),
+	Type.Literal("VALIDATION_FAILED"),
+	Type.Literal("INVALID_CHALLENGE"),
+	Type.Literal("INVALID_SIGNATURE"),
+	Type.Literal("RATE_LIMIT_EXCEEDED"),
+	Type.Literal("SERIALIZATION_EXHAUSTED"),
+	Type.Literal("SIGNING_REQUEST_EXPIRED"),
+	Type.Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
+	Type.Literal("SIGNING_REQUEST_LIMIT_REACHED"),
+	Type.Literal("REGISTRATION_FAILED"),
+	Type.Literal("UPSTREAM_ERROR"),
+	Type.Literal("SERVICE_UNAVAILABLE"),
+	Type.Literal("INTERNAL_SERVER_ERROR"),
+	Type.Literal("TEAM_PERSONAL_IMMUTABLE"),
+	Type.Literal("TEAM_NOT_ACTIVE"),
+	Type.Literal("INVITE_EXPIRED"),
+	Type.Literal("INVITE_EXHAUSTED"),
+	Type.Literal("TEAM_LAST_OWNER"),
+	Type.Literal("TEAM_ALREADY_ACTIVE"),
+	Type.Literal("TEAM_NOT_FOUNDING"),
+	Type.Literal("FOUNDING_ALREADY_ACCEPTED"),
+	Type.Literal("DIARY_TRANSFER_PENDING"),
+	Type.Literal("DIARY_TRANSFER_NOT_FOUND"),
+	Type.Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
+]);
+var ProblemDetailsSchema = Type.Object({
+	type: Type.String({ format: "uri" }),
+	title: Type.String(),
+	status: Type.Integer({
+		minimum: 100,
+		maximum: 599
+	}),
+	code: ProblemCodeSchema,
+	detail: Type.Optional(Type.String()),
+	instance: Type.Optional(Type.String()),
+	retryAfter: Type.Optional(Type.Integer({
+		minimum: 0,
+		description: "Non-negative delay in seconds before retrying, matching the Retry-After response header when present."
+	}))
+}, {
+	$id: "ProblemDetails",
+	additionalProperties: true
 });
 Type.Object({
-	id: UuidSchema,
-	name: Type.String(),
-	personal: Type.Boolean(),
-	status: Type.String(),
-	role: TeamRoleSchema
+	field: Type.String(),
+	message: Type.String(),
+	code: Type.Optional(Type.String())
+}, {
+	$id: "ValidationError",
+	additionalProperties: false
 });
 Type.Object({
-	id: UuidSchema,
-	name: Type.String(),
-	status: Type.String(),
-	personal: Type.Boolean(),
-	createdAt: DateTimeUnsafe,
-	updatedAt: DateTimeUnsafe,
-	members: Type.Array(TeamMemberSchema)
+	resource: Type.String(),
+	id: Type.Optional(Type.String({ format: "uuid" })),
+	keys: Type.Optional(Type.Record(Type.String(), Type.String()))
+}, {
+	$id: "ConflictTarget",
+	additionalProperties: false
 });
 Type.Object({
-	teamId: UuidSchema,
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+	constraint: Type.Optional(Type.String()),
+	target: Type.Optional(Type.Ref("ConflictTarget"))
+}, {
+	$id: "ConflictError",
+	additionalProperties: false
 });
+var ConflictProblemDetailsSchema = Type.Intersect([ProblemDetailsSchema, Type.Object({ conflict: Type.Ref("ConflictError") })], { $id: "ConflictProblemDetails" });
 Type.Object({
-	updated: Type.Boolean(),
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+	type: Type.String(),
+	severity: Type.Number(),
+	match: Type.String()
+}, {
+	$id: "InjectionThreat",
+	additionalProperties: false
 });
-Type.Object({ deleted: Type.Boolean() });
-Type.Object({ removed: Type.Boolean() });
-var FoundingMemberSchema = Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: Type.Union([Type.Literal("Agent"), Type.Literal("Human")]),
-	role: Type.Union([
-		Type.Literal("owner"),
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Optional(Type.Array(Type.Object({
+	id: Type.String({ format: "uuid" }),
+	threats: Type.Array(Type.Ref("InjectionThreat"))
+}, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
+Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
+Type.Union([
+	Type.Literal("pack"),
+	Type.Literal("entry"),
+	Type.Literal("rendered_pack")
+]);
+var ProvenanceGraphEdgeKindSchema = Type.Union([
+	Type.Literal("includes"),
+	Type.Literal("supersedes"),
+	Type.Literal("rendered_from")
+]);
+var ProvenanceGraphPackMetaSchema = Type.Object({
+	packId: UuidSchema,
+	diaryId: UuidSchema,
+	packCid: Type.String(),
+	packType: Type.String(),
+	packCodec: Type.String(),
+	pinned: Type.Boolean(),
+	createdAt: TimestampSchema,
+	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
+	supersedesPackId: Type.Union([UuidSchema, Type.Null()])
 });
-Type.Object({
-	name: Type.String({
-		minLength: 1,
-		maxLength: 255
-	}),
-	foundingMembers: Type.Optional(Type.Array(FoundingMemberSchema, { minItems: 1 }))
+/**
+* Discriminated creator embedded inside provenance-node response
+* payloads. Re-uses the shared `PrincipalIdentitySchemaInline` (the
+* `$id`-less twin) — embedding the named `PrincipalIdentitySchema`
+* here would clash with the top-level registration via @fastify/swagger
+* (`reference "PrincipalIdentity" resolves to more than one schema`).
+*/
+var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
+var ProvenanceGraphEntryMetaSchema = Type.Object({
+	entryId: UuidSchema,
+	diaryId: UuidSchema,
+	entryType: EntryTypeSchema,
+	contentHash: Type.Union([Type.String(), Type.Null()]),
+	createdAt: TimestampSchema,
+	updatedAt: TimestampSchema,
+	signed: Type.Boolean(),
+	title: Type.Union([Type.String(), Type.Null()]),
+	tags: Type.Array(Type.String()),
+	creator: Type.Optional(ProvenanceGraphCreatorSchema)
 });
-Type.Object({
-	id: UuidSchema,
-	name: Type.String(),
-	status: Type.String(),
-	workflowId: Type.Optional(Type.String())
+var ProvenanceGraphPackNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("pack"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
+	meta: Type.Intersect([ProvenanceGraphPackMetaSchema, Type.Object({ creator: Type.Optional(ProvenanceGraphCreatorSchema) })])
 });
-Type.Object({});
-Type.Object({
-	accepted: Type.Boolean(),
-	teamStatus: Type.String()
+var ProvenanceGraphEntryNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("entry"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
+	meta: ProvenanceGraphEntryMetaSchema
 });
-Type.Object({ destinationTeamId: UuidSchema });
-Type.Object({ transferId: UuidSchema });
-var TransferResponseSchema = Type.Object({
-	id: UuidSchema,
+var ProvenanceGraphRenderedPackMetaSchema = Type.Object({
+	renderedPackId: UuidSchema,
+	sourcePackId: UuidSchema,
 	diaryId: UuidSchema,
-	sourceTeamId: UuidSchema,
-	destinationTeamId: UuidSchema,
-	status: Type.String(),
-	initiatedBy: UuidSchema,
-	expiresAt: Type.Unsafe(Type.String({ format: "date-time" })),
-	createdAt: Type.Unsafe(Type.String({ format: "date-time" }))
-});
-Type.Object({ items: Type.Array(TransferResponseSchema) });
-Type.Object({ groupId: UuidSchema });
-Type.Object({
-	groupId: UuidSchema,
-	subjectId: UuidSchema
+	packCid: Type.String(),
+	renderMethod: Type.String(),
+	totalTokens: Type.Number(),
+	pinned: Type.Boolean(),
+	createdAt: TimestampSchema,
+	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
+	creator: Type.Optional(ProvenanceGraphCreatorSchema)
 });
-Type.Object({ name: Type.String({
-	minLength: 1,
-	maxLength: 255
-}) });
-Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: Type.Optional(Type.Union([Type.Literal("Agent"), Type.Literal("Human")]))
+var ProvenanceGraphRenderedPackNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("rendered_pack"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
+	meta: ProvenanceGraphRenderedPackMetaSchema
 });
-Type.Object({
-	id: UuidSchema,
-	name: Type.String(),
-	teamId: UuidSchema
+var ProvenanceGraphNodeSchema = Type.Union([
+	ProvenanceGraphPackNodeSchema,
+	ProvenanceGraphEntryNodeSchema,
+	ProvenanceGraphRenderedPackNodeSchema
+]);
+var ProvenanceGraphEdgeSchema = Type.Object({
+	id: Type.String(),
+	from: Type.String(),
+	to: Type.String(),
+	kind: ProvenanceGraphEdgeKindSchema,
+	label: Type.Optional(Type.String()),
+	meta: Type.Optional(Type.Record(Type.String(), Type.Union([
+		Type.String(),
+		Type.Number(),
+		Type.Boolean(),
+		Type.Null()
+	])))
 });
-var GroupMemberResponseSchema = Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: Type.String()
+var ProvenanceGraphMetadataSchema = Type.Object({
+	format: Type.Literal("moltnet.provenance-graph/v1"),
+	generatedAt: TimestampSchema,
+	rootNodeId: Type.String(),
+	rootPackId: UuidSchema,
+	depth: Type.Number({ minimum: 0 })
 });
 Type.Object({
-	id: UuidSchema,
-	name: Type.String(),
-	teamId: UuidSchema,
-	createdAt: DateTimeUnsafe,
-	members: Type.Array(GroupMemberResponseSchema)
+	metadata: ProvenanceGraphMetadataSchema,
+	nodes: Type.Array(ProvenanceGraphNodeSchema),
+	edges: Type.Array(ProvenanceGraphEdgeSchema)
+}, { $id: "ProvenanceGraph" });
+//#endregion
+//#region ../models/src/render-method.ts
+/**
+* The `renderMethod` convention for rendered packs (#1857).
+*
+* `renderedPacks.renderMethod` is a free-text `varchar(100)`. The server
+* bifurcates on exactly one thing — whether the label starts with `server:`
+* — and everything else is a caller-authored render whose markdown the
+* caller must supply. This module is the single owner of that convention:
+* the service, the API schemas, the runtime default and the console's
+* trust-tier derivation all read from here.
+*
+* The Go CLI (`apps/moltnet-cli/cobra_pack.go`) cannot import this module;
+* it carries a pointer comment and its default must be kept in sync with
+* `DEFAULT_SERVER_RENDER_METHOD` by hand.
+*
+* Values observed in production data and accepted unchanged:
+* `server:pack-to-docs-v1`, `agent:pack-to-docs-v1`, `agent-refined`.
+* `pi:pack-to-docs-v1` is the live pi-runtime default.
+*/
+/** Labels carrying this prefix are rendered deterministically by the server. */
+var SERVER_RENDER_PREFIX = "server:";
+/**
+* Prefixes that identify caller-authored markdown.
+*
+* `agent:` is the canonical documented label, `pi:` is what the pi-runtime
+* emits by default, and `agent-` covers the `agent-refined` family that is
+* live in production data.
+*/
+var CALLER_AUTHORED_PREFIXES = [
+	"agent:",
+	"pi:",
+	"agent-"
+];
+var DEFAULT_SERVER_RENDER_METHOD = "server:pack-to-docs-v1";
+var DEFAULT_AGENT_RENDER_METHOD = "agent:pack-to-docs-v1";
+var DEFAULT_PI_RENDER_METHOD = "pi:pack-to-docs-v1";
+/**
+* Write-side validation pattern: a known prefix followed by at least one
+* non-whitespace character. Stored rows are never re-validated against
+* this; it applies to new writes at the API boundary only.
+*/
+var RENDER_METHOD_PATTERN = `^(${[SERVER_RENDER_PREFIX, ...CALLER_AUTHORED_PREFIXES].join("|")})\\S+$`;
+Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: RENDER_METHOD_PATTERN,
+	description: "Render method label. Server render methods start with \"server:\" and must omit renderedMarkdown; caller-authored methods start with \"agent:\", \"pi:\" or \"agent-\" and require it.",
+	examples: [DEFAULT_SERVER_RENDER_METHOD, DEFAULT_AGENT_RENDER_METHOD]
 });
-var DiaryGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
-var GrantSubjectNsSchema = Type.Union([
-	Type.Literal("Agent"),
-	Type.Literal("Human"),
-	Type.Literal("Group")
+/**
+* The server's bifurcation: a server method is rendered from the source
+* pack; any other method requires caller-supplied markdown.
+*/
+function isServerRenderMethod(method) {
+	return method.startsWith(SERVER_RENDER_PREFIX);
+}
+//#endregion
+//#region ../models/src/signer-constraint.ts
+var SIGNER_CONSTRAINT_TYPE = {
+	Human: "human",
+	TeamRole: "team-role",
+	Group: "group"
+};
+Type.Union([
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Human),
+		id: Type.String({ format: "uuid" })
+	}),
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
+		id: TeamRoleSchema
+	}),
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Group),
+		id: Type.String({ format: "uuid" })
+	})
 ]);
-Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: DiaryGrantRoleSchema
+//#endregion
+//#region ../models/src/signer-protocol.ts
+function schemaRef(schema) {
+	const id = schemaId(schema);
+	return Type.Ref(id);
+}
+function schemaId(schema) {
+	const id = schema.$id;
+	if (typeof id !== "string" || id.length === 0) throw new Error("Signer protocol schemas must have an identifier");
+	return id;
+}
+var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
+var SignerUuidSchema = Type.String({
+	$id: "SignerUuid",
+	pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
 });
-Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: DiaryGrantRoleSchema
+var SignerOperationSchema = Type.Union([
+	Type.Literal("credential-enrollment"),
+	Type.Literal("credential-registration"),
+	Type.Literal("signing-request")
+], { $id: "SignerOperation" });
+var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
+var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
+var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
+var SignerProblemSchema = Type.Object({
+	code: Type.String({ minLength: 1 }),
+	message: Type.String({ minLength: 1 })
+}, {
+	$id: "SignerProblem",
+	additionalProperties: false
 });
-var DiaryGrantResponseSchema = Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: DiaryGrantRoleSchema
+var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
+	$id: "SignerCeremonyParams",
+	additionalProperties: false
 });
-Type.Object({ grants: Type.Array(DiaryGrantResponseSchema) });
-Type.Object({ revoked: Type.Boolean() });
-var TaskGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
-Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: TaskGrantRoleSchema
+var SignerSessionSchema = Type.Object({
+	version: Type.Literal(1),
+	token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	expiresAt: Type.String()
+}, {
+	$id: "SignerSession",
+	additionalProperties: false
 });
-Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: TaskGrantRoleSchema
+var SignerEnrollmentCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Literal("credential-enrollment"),
+	label: Type.String({
+		minLength: 1,
+		maxLength: 255
+	}),
+	teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
+}, {
+	$id: "SignerEnrollmentCeremonyRequest",
+	additionalProperties: false
 });
-var TaskGrantResponseSchema = Type.Object({
-	subjectId: UuidSchema,
-	subjectNs: GrantSubjectNsSchema,
-	role: TaskGrantRoleSchema
+var SignerChallengeCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
+	challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
+}, {
+	$id: "SignerChallengeCeremonyRequest",
+	additionalProperties: false
 });
-Type.Object({ grants: Type.Array(TaskGrantResponseSchema) });
-Type.Object({ "x-moltnet-team-id": Type.String({
-	format: "uuid",
-	description: "Team ID (UUID) that will own the resource. Required."
-}) });
-Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
-	format: "uuid",
-	description: "Team ID (UUID) for scoping the request. Optional."
-})) });
-Type.Object({
-	kind: Type.Literal("agent"),
-	agentId: UuidSchema,
-	identityId: Type.Union([UuidSchema, Type.Null()]),
-	fingerprint: FingerprintSchema,
-	publicKey: PublicKeySchema
+var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
+var SignerCeremonySchema = Type.Object({
+	version: Type.Literal(1),
+	id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	approvalUrl: Type.String(),
+	expiresAt: Type.String()
 }, {
-	$id: "AgentPrincipal",
+	$id: "SignerCeremony",
 	additionalProperties: false
 });
-Type.Object({
-	kind: Type.Literal("human"),
-	humanId: UuidSchema,
-	identityId: Type.Union([UuidSchema, Type.Null()])
+var SignerPendingResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("pending"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema))
 }, {
-	$id: "HumanPrincipal",
+	$id: "SignerPendingResult",
 	additionalProperties: false
 });
-var principalUnionVariants = [Type.Object({
-	kind: Type.Literal("agent"),
-	agentId: UuidSchema,
-	identityId: Type.Union([UuidSchema, Type.Null()]),
-	fingerprint: FingerprintSchema,
-	publicKey: PublicKeySchema
-}, { additionalProperties: false }), Type.Object({
-	kind: Type.Literal("human"),
-	humanId: UuidSchema,
-	identityId: Type.Union([UuidSchema, Type.Null()])
-}, { additionalProperties: false })];
-Type.Union(principalUnionVariants, {
-	$id: "PrincipalIdentity",
-	discriminator: { propertyName: "kind" }
+var SignerEnrollmentResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Literal("credential-enrollment"),
+	publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
+}, {
+	$id: "SignerEnrollmentResult",
+	additionalProperties: false
+});
+var SignerReceiptSchema = PreviewSignReceiptValueSchema;
+var SignerSignatureResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
+}, {
+	$id: "SignerSignatureResult",
+	additionalProperties: false
+});
+var SignerFailedResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("failed"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	code: Type.String(),
+	message: Type.String()
+}, {
+	$id: "SignerFailedResult",
+	additionalProperties: false
 });
+var SignerCeremonyResultSchema = Type.Union([
+	Type.Unsafe(schemaRef(SignerPendingResultSchema)),
+	Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
+	Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
+	Type.Unsafe(schemaRef(SignerFailedResultSchema))
+], { $id: "SignerCeremonyResult" });
+({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
+//#endregion
+//#region ../models/src/tool-enforcement.ts
+var TOOL_ENFORCEMENT_VALUES = [
+	"off",
+	"watch",
+	"enforce"
+];
+var toolEnforcementLiterals = [
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
+];
+var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+//#endregion
+//#region src/moltnet/render-phase6.ts
+function slugToTitle(value) {
+	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
+}
+function extractScope(tags) {
+	const scope = tags?.find((tag) => tag.startsWith("scope:"));
+	return scope ? scope.slice(6) : null;
+}
+function extractSeverity(tags) {
+	const severity = tags?.find((tag) => tag.startsWith("severity:"));
+	return severity ? severity.slice(9) : null;
+}
+function stripEntryScaffolding(content) {
+	let out = content;
+	out = out.replace(/<moltnet-signed>[\s\S]*?<content>([\s\S]*?)<\/content>[\s\S]*?<\/moltnet-signed>/gi, "$1");
+	out = out.replace(/<metadata>[\s\S]*?<\/metadata>/gi, "");
+	out = out.replace(/<signature>[\s\S]*?<\/signature>/gi, "");
+	out = out.replace(/<\/?(?:moltnet-signed|content|signature|metadata)[^>]*>/gi, "");
+	out = out.replace(/^- Compression:.*$/gim, "");
+	out = out.replace(/^- Tokens:.*$/gim, "");
+	return out.trim();
+}
+function normalizeKey(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+function extractRules(content) {
+	return stripEntryScaffolding(content).split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && (/(^rule:|^watch for:|^must\b|^never\b)/i.test(line) || /\b(MUST|NEVER)\b/.test(line))).slice(0, 5);
+}
+function renderSourceRefs(entries) {
+	return entries.map((entry) => {
+		const shortId = entry.entryId.slice(0, 8);
+		const fingerprint = entry.entry.creator?.fingerprint?.replaceAll("-", "").slice(0, 4).toLowerCase();
+		return `[\`e:${shortId}\`](@unknown · ${fingerprint ? `agent:${fingerprint}` : "agent:unkn"})`;
+	}).join(", ");
+}
+function renderKeywords(tags) {
+	const keywords = (tags ?? []).filter((tag) => !tag.startsWith("scope:") && !tag.startsWith("severity:"));
+	if (keywords.length === 0) return "";
+	return `Relevant search terms include ${keywords.slice(0, 6).map((tag) => `\`${tag}\``).join(", ")}.`;
+}
+function renderPhase6Markdown(pack) {
+	const entries = pack.entries ?? [];
+	const grouped = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const scope = extractScope(entry.entry.tags) ?? "general";
+		const title = entry.entry.title?.trim() || `Entry ${entry.entryId.slice(0, 8)}`;
+		const groupKey = normalizeKey(scope);
+		const topicKey = normalizeKey(title) || entry.entryId;
+		if (!grouped.has(groupKey)) grouped.set(groupKey, /* @__PURE__ */ new Map());
+		const topics = grouped.get(groupKey);
+		const existing = topics.get(topicKey);
+		if (existing) existing.entries.push(entry);
+		else topics.set(topicKey, {
+			title,
+			scope,
+			entries: [entry]
+		});
+	}
+	const lines = [];
+	lines.push("# Rendered Pack");
+	lines.push("");
+	lines.push("## Source");
+	lines.push("");
+	lines.push("| Pack UUID | Pack CID | Entries |");
+	lines.push("| --------- | -------- | ------- |");
+	lines.push(`| \`${pack.id}\` | \`${pack.packCid}\` | ${entries.length} |`);
+	lines.push("");
+	for (const [, topics] of grouped) {
+		const scope = topics.values().next().value?.scope ?? "general";
+		lines.push(`## ${slugToTitle(scope)}`);
+		lines.push("");
+		for (const [, topic] of topics) {
+			const primary = topic.entries[0];
+			const mergedContent = topic.entries.map((entry) => stripEntryScaffolding(entry.entry.content)).filter(Boolean).join("\n\n");
+			const rules = topic.entries.flatMap((entry) => extractRules(entry.entry.content));
+			const severity = extractSeverity(primary.entry.tags);
+			lines.push(`### ${topic.title}`);
+			lines.push("");
+			lines.push(`**Subsystem:** ${slugToTitle(topic.scope)}`);
+			if (severity) lines.push(`**Severity:** ${slugToTitle(severity)}`);
+			lines.push(`**Type:** ${primary.entry.entryType}`);
+			lines.push("");
+			if (rules.length > 0) {
+				lines.push("**Rules**");
+				lines.push("");
+				for (const rule of Array.from(new Set(rules))) lines.push(`- ${rule}`);
+				lines.push("");
+			}
+			lines.push(mergedContent);
+			lines.push("");
+			const keywords = renderKeywords(primary.entry.tags);
+			if (keywords) {
+				lines.push(keywords);
+				lines.push("");
+			}
+			lines.push("Provenance:");
+			for (const entry of topic.entries) lines.push(`- Entry ID \`${entry.entryId}\`, CID \`${entry.entryCidSnapshot}\``);
+			lines.push("");
+			lines.push(`*Sources: ${renderSourceRefs(topic.entries)}*`);
+			lines.push("");
+		}
+	}
+	if (entries.length === 0) {
+		lines.push("_This pack has no expanded entries._");
+		lines.push("");
+	}
+	return lines.join("\n").trim();
+}
+//#endregion
+//#region src/moltnet/tools.ts
 /**
-* `$id`-less twin of `PrincipalIdentitySchema`. Required anywhere the
-* schema is **embedded** inline into another schema (MCP `outputSchema`
-* — every tool that returns a creator-bearing object embeds its own
-* copy; provenance-graph node `meta.creator`, etc.). Ajv 8 throws
-* `reference "PrincipalIdentity" resolves to more than one schema` if
-* the same `$id` appears twice in the same compilation pass, which is
-* exactly what happens when the MCP server lists tools and Ajv
-* traverses every advertised `outputSchema`.
+* MoltNet custom tools for pi.
 *
-* Structurally identical to `PrincipalIdentitySchema` (they share the
-* variants array); change one, change both.
+* Factory that produces ready-to-register pi tool definitions.
+* These tools run on the host (not in the VM) via the MoltNet SDK,
+* so agent credentials never touch the VM filesystem.
 */
-var PrincipalIdentitySchemaInline = Type.Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
+var MOLTNET_TOOL_NAMES = [
+	"moltnet_pack_get",
+	"moltnet_pack_create",
+	"moltnet_pack_provenance",
+	"moltnet_pack_render",
+	"moltnet_rendered_pack_list",
+	"moltnet_rendered_pack_get",
+	"moltnet_diary_tags",
+	"moltnet_list_entries",
+	"moltnet_get_entry",
+	"moltnet_search_entries",
+	"moltnet_create_entry",
+	"moltnet_get_task",
+	"moltnet_list_task_attempts",
+	"moltnet_list_task_messages",
+	"moltnet_upload_task_artifact",
+	"moltnet_list_task_artifacts",
+	"moltnet_download_task_artifact",
+	"moltnet_review_session_errors",
+	"moltnet_host_exec"
+];
+var DIARY_TAG_MAX_LENGTH = 128;
+/**
+* Baseline env keys forwarded to host-exec child processes.
+* Callers can extend this set at sandbox startup via `MoltNetToolsConfig.hostExecBaseEnv`.
+*/
+var HOST_EXEC_DEFAULT_BASE_ENV = new Set([
+	"PATH",
+	"HOME",
+	"LANG",
+	"LC_ALL",
+	"TMPDIR",
+	"GIT_CONFIG_GLOBAL",
+	"MOLTNET_CREDENTIALS_PATH",
+	"GIT_AUTHOR_NAME",
+	"GIT_AUTHOR_EMAIL",
+	"GIT_COMMITTER_NAME",
+	"GIT_COMMITTER_EMAIL",
+	"SSH_AUTH_SOCK"
+]);
+function ensureConnected(config) {
+	const agent = config.getAgent();
+	const diaryId = config.getDiaryId();
+	if (!agent || !diaryId) throw new Error("MoltNet not connected");
+	return {
+		agent,
+		diaryId,
+		teamId: config.getTeamId() ?? ""
+	};
+}
+function hostExecMatchesAutoApproveRule(params, rule) {
+	if (params.executable !== rule.executable) return false;
+	if (rule.argsExcludes?.some((arg) => params.args.includes(arg))) return false;
+	if (rule.argsPrefix && !rule.argsPrefix.every((arg, index) => params.args[index] === arg)) return false;
+	if (rule.argsContains && !rule.argsContains.every((arg) => params.args.includes(arg))) return false;
+	return true;
+}
+function shouldAutoApproveHostExec(params, config) {
+	const policy = config.autoApproveHostExec === true ? true : config.hostExecAutoApprove ?? false;
+	if (policy === true) return true;
+	if (!Array.isArray(policy)) return false;
+	return policy.some((rule) => hostExecMatchesAutoApproveRule(params, rule));
+}
+async function resolveWorkspaceFilePath(cwd, filePath) {
+	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
+	const realCwd = await realpath(cwd);
+	let realResolved;
+	try {
+		realResolved = await realpath(resolved);
+	} catch (err) {
+		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
+		throw err;
+	}
+	const rel = path.relative(realCwd, realResolved);
+	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`task artifact path escapes workspace: ${filePath}`);
+	return realResolved;
+}
+async function openWorkspaceArtifactInput(config, cwd, filePath) {
+	if (config.openWorkspaceFileForRead) try {
+		return await config.openWorkspaceFileForRead(filePath);
+	} catch (err) {
+		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
+		throw err;
+	}
+	const resolved = await resolveWorkspaceFilePath(cwd, filePath);
+	const info = await stat(resolved);
+	return {
+		stream: createReadStream(resolved),
+		isFile: info.isFile(),
+		sizeBytes: info.size,
+		displayPath: path.relative(cwd, resolved)
+	};
+}
+async function resolveWorkspaceOutputPath(cwd, filePath) {
+	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
+	const workspaceRoot = path.resolve(cwd);
+	const lexicalRel = path.relative(workspaceRoot, resolved);
+	if (lexicalRel === "" || lexicalRel.startsWith("..") || path.isAbsolute(lexicalRel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
+	const realCwd = await realpath(cwd);
+	const parent = path.dirname(resolved);
+	assertPathInsideWorkspace(realCwd, await findExistingAncestor(parent), filePath);
+	await mkdir(parent, { recursive: true });
+	assertPathInsideWorkspace(realCwd, await realpath(parent), filePath);
+	return resolved;
+}
+async function findExistingAncestor(candidate) {
+	let current = candidate;
+	for (;;) {
+		try {
+			return await realpath(current);
+		} catch (err) {
+			if (!err || typeof err !== "object" || !("code" in err) || err.code !== "ENOENT") throw err;
+		}
+		const parent = path.dirname(current);
+		if (parent === current) throw new Error(`task artifact output has no existing ancestor: ${candidate}`);
+		current = parent;
+	}
+}
+function assertPathInsideWorkspace(realCwd, realPath, displayPath) {
+	if (!isResolvedPathInsideRoot$1(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
+}
+/**
+* Expand the `taskFilter` shorthand on the diary list/search tools into
+* the matching `task:*` provenance tags emitted by `moltnet_create_entry`
+* during a task. Returning an array (possibly empty) lets callers spread
+* it into a larger `tags` AND-filter without conditionals.
+*/
+function compileTaskFilterTags(filter) {
+	if (!filter) return [];
+	const tags = [];
+	if (filter.taskId) tags.push(`task:id:${filter.taskId}`);
+	if (filter.taskType) tags.push(`task:type:${filter.taskType}`);
+	if (filter.correlationId) tags.push(`task:correlation:${filter.correlationId}`);
+	if (typeof filter.attemptN === "number") tags.push(`task:attempt:${filter.attemptN}`);
+	return tags;
+}
+/**
+* Create all MoltNet tool definitions, ready to pass to `pi.registerTool()`.
+*/
+function createMoltNetTools(config) {
+	const getPack = defineTool({
+		name: "moltnet_pack_get",
+		label: "Get MoltNet Pack",
+		description: "Get a context pack by ID. Optionally expand included entries.",
+		parameters: Type$1.Object({
+			packId: Type$1.String({ description: "Context pack ID" }),
+			expandEntries: Type$1.Optional(Type$1.Boolean({ description: "Include full expanded entries" }))
+		}),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const pack = await agent.packs.get(params.packId, { expand: params.expandEntries ? "entries" : void 0 });
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(pack, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const createPack = defineTool({
+		name: "moltnet_pack_create",
+		label: "Create MoltNet Pack",
+		description: "Persist a curated context pack. Entries are caller-ranked (lower rank = more prominent). Recipe/prompt/selection_rationale belong in params. Defaults to pinned=false — packs in the attribution pipeline are ephemeral unless the caller explicitly opts in.",
+		parameters: Type$1.Object({
+			entries: Type$1.Array(Type$1.Object({
+				entryId: Type$1.String({ description: "Diary entry UUID" }),
+				rank: Type$1.Number({ description: "Rank (1..N, lower = more prominent)" })
+			}), { description: "Selected entries with their ranks" }),
+			params: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
+			tokenBudget: Type$1.Optional(Type$1.Number({ description: "Soft token budget recorded on the pack (optional)" })),
+			pinned: Type$1.Optional(Type$1.Boolean({ description: "Pin the pack against retention policy (default false)" }))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId } = ensureConnected(config);
+			const pack = await agent.packs.create(diaryId, {
+				packType: "custom",
+				params: params.params ?? {},
+				entries: params.entries,
+				tokenBudget: params.tokenBudget,
+				pinned: params.pinned ?? false
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(pack, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const getPackProvenance = defineTool({
+		name: "moltnet_pack_provenance",
+		label: "Get MoltNet Pack Provenance",
+		description: "Get the provenance graph for a context pack by ID or CID.",
+		parameters: Type$1.Object({
+			packId: Type$1.Optional(Type$1.String({ description: "Context pack ID" })),
+			packCid: Type$1.Optional(Type$1.String({ description: "Context pack CID" })),
+			depth: Type$1.Optional(Type$1.Number({ description: "Supersession ancestry depth to include (default 2)" }))
+		}),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			if (!params.packId && !params.packCid) throw new Error("Provide either packId or packCid");
+			if (params.packId && params.packCid) throw new Error("Provide only one of packId or packCid");
+			const graph = params.packId ? await agent.packs.getProvenance(params.packId, { depth: params.depth ?? 2 }) : await agent.packs.getProvenanceByCid(params.packCid, { depth: params.depth ?? 2 });
+			const payload = {
+				metadata: graph.metadata,
+				counts: {
+					nodes: graph.nodes.length,
+					edges: graph.edges.length
+				},
+				graph
+			};
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(payload, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const renderPack = defineTool({
+		name: "moltnet_pack_render",
+		label: "Render MoltNet Pack",
+		description: "Fetch a pack with entries, transform it into docs, then preview or persist the rendered pack.",
+		parameters: Type$1.Object({
+			packId: Type$1.String({ description: "Context pack ID" }),
+			renderMethod: Type$1.Optional(Type$1.String({ description: `Render method label. Defaults to ${DEFAULT_PI_RENDER_METHOD}` })),
+			markdown: Type$1.Optional(Type$1.String({ description: "Optional caller-authored markdown override" })),
+			preview: Type$1.Optional(Type$1.Boolean({ description: "Preview without persisting (default false)" })),
+			pinned: Type$1.Optional(Type$1.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
+		}),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const renderMethod = params.renderMethod ?? "pi:pack-to-docs-v1";
+			let renderedMarkdown = params.markdown;
+			if (!renderedMarkdown && !isServerRenderMethod(renderMethod)) renderedMarkdown = renderPhase6Markdown(await agent.packs.get(params.packId, { expand: "entries" }));
+			const result = params.preview ?? false ? await agent.packs.previewRendered(params.packId, {
+				renderMethod,
+				renderedMarkdown
+			}) : await agent.packs.render(params.packId, {
+				renderMethod,
+				renderedMarkdown,
+				pinned: params.pinned
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(result, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const listRenderedPacks = defineTool({
+		name: "moltnet_rendered_pack_list",
+		label: "List MoltNet Rendered Packs",
+		description: "List rendered packs for the current MoltNet diary, optionally filtered by source pack or render method.",
+		parameters: Type$1.Object({
+			sourcePackId: Type$1.Optional(Type$1.String({ description: "Filter by source pack ID" })),
+			renderMethod: Type$1.Optional(Type$1.String({ description: "Filter by render method" })),
+			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 10)" })),
+			offset: Type$1.Optional(Type$1.Number({ description: "Offset for pagination (default 0)" }))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId } = ensureConnected(config);
+			const rendered = await agent.packs.listRendered(diaryId, {
+				sourcePackId: params.sourcePackId,
+				renderMethod: params.renderMethod,
+				limit: params.limit ?? 10,
+				offset: params.offset ?? 0
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(rendered, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const getRenderedPack = defineTool({
+		name: "moltnet_rendered_pack_get",
+		label: "Get MoltNet Rendered Pack",
+		description: "Get a rendered pack by ID.",
+		parameters: Type$1.Object({ renderedPackId: Type$1.String({ description: "Rendered pack ID" }) }),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const rendered = await agent.packs.getRendered(params.renderedPackId);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(rendered, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const diaryTags = defineTool({
+		name: "moltnet_diary_tags",
+		label: "List MoltNet Diary Tags",
+		description: "Inventory tags on the current diary with entry counts. Cheap reconnaissance before committing to a search or list — use it to discover scope prefixes and cluster sizes. Optional prefix/minCount/entryTypes filters narrow the result.",
+		parameters: Type$1.Object({
+			prefix: Type$1.Optional(Type$1.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
+			minCount: Type$1.Optional(Type$1.Number({ description: "Exclude tags with fewer than this many entries" })),
+			entryTypes: Type$1.Optional(Type$1.Array(Type$1.Union([
+				Type$1.Literal("episodic"),
+				Type$1.Literal("semantic"),
+				Type$1.Literal("procedural"),
+				Type$1.Literal("reflection")
+			]), { description: "Scope the tag count to these entry types" }))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId } = ensureConnected(config);
+			const result = await agent.diaries.tags(diaryId, {
+				prefix: params.prefix,
+				minCount: params.minCount,
+				entryTypes: params.entryTypes
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(result, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const listEntries = defineTool({
+		name: "moltnet_list_entries",
+		label: "List MoltNet Diary Entries",
+		description: "List entries from the MoltNet diary. When `entryIds` is provided, batch-fetches those specific entries (max 50) and returns full fields including entryType, contentSignature, and contentHash for signature checks. Otherwise returns recent entries with a content preview, filtered by any combination of tags (AND), excludeTags (NONE), entryType, and the taskFilter shorthand which expands into the right `task:*` tags.",
+		parameters: Type$1.Object({
+			limit: Type$1.Optional(Type$1.Number({ description: "Max entries to return (default 10)" })),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String({
+				minLength: 1,
+				maxLength: DIARY_TAG_MAX_LENGTH
+			}), {
+				description: "Tags filter — entry must have ALL listed tags (AND). Max 20.",
+				maxItems: 20
+			})),
+			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
+				minLength: 1,
+				maxLength: DIARY_TAG_MAX_LENGTH
+			}), {
+				description: "Tags to exclude — entry must have NONE of these. Max 20.",
+				maxItems: 20
+			})),
+			entryType: Type$1.Optional(Type$1.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
+			taskFilter: Type$1.Optional(Type$1.Object({
+				taskId: Type$1.Optional(Type$1.String()),
+				taskType: Type$1.Optional(Type$1.String()),
+				correlationId: Type$1.Optional(Type$1.String()),
+				attemptN: Type$1.Optional(Type$1.Number())
+			}, { description: "Shorthand: any combination compiles to the matching task:* tags (task:id:<id>, task:type:<type>, task:correlation:<id>, task:attempt:<n>) and is merged into the tags filter." })),
+			entryIds: Type$1.Optional(Type$1.Array(Type$1.String(), {
+				description: "Batch-fetch specific entries by UUID (max 50). Overrides every other filter.",
+				maxItems: 50
+			}))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId } = ensureConnected(config);
+			const query = {
+				orderBy: "createdAt",
+				order: "desc"
+			};
+			const batchMode = !!params.entryIds?.length;
+			if (batchMode) query.ids = params.entryIds;
+			else {
+				query.limit = params.limit ?? 10;
+				const expandedTags = compileTaskFilterTags(params.taskFilter);
+				const allTags = [...params.tags ?? [], ...expandedTags];
+				if (allTags.length) query.tags = allTags;
+				if (params.excludeTags?.length) query.excludeTags = params.excludeTags;
+				if (params.entryType) query.entryType = params.entryType;
+			}
+			const entries = await agent.entries.list(diaryId, query);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(entries.items?.map((e) => batchMode ? {
+						id: e.id,
+						title: e.title,
+						entryType: e.entryType,
+						tags: e.tags,
+						importance: e.importance,
+						contentHash: e.contentHash,
+						contentSignature: e.contentSignature,
+						signingNonce: e.signingNonce,
+						createdAt: e.createdAt
+					} : {
+						id: e.id,
+						title: e.title,
+						tags: e.tags,
+						importance: e.importance,
+						createdAt: e.createdAt,
+						contentPreview: typeof e.content === "string" ? e.content.slice(0, 200) : void 0
+					}), null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const getEntry = defineTool({
+		name: "moltnet_get_entry",
+		label: "Get MoltNet Diary Entry",
+		description: "Get the full content of a specific diary entry by ID.",
+		parameters: Type$1.Object({ entryId: Type$1.String({ description: "The entry ID to fetch" }) }),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const entry = await agent.entries.get(params.entryId);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						id: entry.id,
+						title: entry.title,
+						content: entry.content,
+						tags: entry.tags,
+						importance: entry.importance,
+						createdAt: entry.createdAt
+					}, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const searchEntries = defineTool({
+		name: "moltnet_search_entries",
+		label: "Search MoltNet Diary Entries",
+		description: "Hybrid (semantic + lexical) search over diary entries. Use proactively before non-trivial investigation, code changes, review, or episodic incident capture so prior decisions and recurring failures surface before you act. Do not search randomly: pass taskFilter for task/correlation-local searches and tags or entryTypes for broader prior-knowledge searches. Optional tags / excludeTags / entryTypes filters AND with the query; the taskFilter shorthand expands into task:* provenance tags so `taskFilter: { taskType: \"fulfill_brief\" }` returns only entries from fulfill_brief attempts. Filters apply server-side before ranking.",
+		parameters: Type$1.Object({
+			query: Type$1.String({ description: "Natural language search query" }),
+			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 5)" })),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String({
+				minLength: 1,
+				maxLength: DIARY_TAG_MAX_LENGTH
+			}), {
+				description: "Entry must have ALL listed tags (AND). Max 20.",
+				maxItems: 20
+			})),
+			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
+				minLength: 1,
+				maxLength: DIARY_TAG_MAX_LENGTH
+			}), {
+				description: "Entry must have NONE of these tags. Max 20.",
+				maxItems: 20
+			})),
+			entryTypes: Type$1.Optional(Type$1.Array(Type$1.String(), {
+				description: "Restrict to these entry types (procedural, semantic, episodic, reflection). Max 4.",
+				maxItems: 4
+			})),
+			taskFilter: Type$1.Optional(Type$1.Object({
+				taskId: Type$1.Optional(Type$1.String()),
+				taskType: Type$1.Optional(Type$1.String()),
+				correlationId: Type$1.Optional(Type$1.String()),
+				attemptN: Type$1.Optional(Type$1.Number())
+			}, { description: "Shorthand: any combination compiles to the matching task:* tags and is merged into the tags filter." }))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId } = ensureConnected(config);
+			const expandedTags = compileTaskFilterTags(params.taskFilter);
+			const allTags = [...params.tags ?? [], ...expandedTags];
+			const results = await agent.entries.search({
+				diaryId,
+				query: params.query,
+				limit: params.limit ?? 5,
+				...allTags.length ? { tags: allTags } : {},
+				...params.excludeTags?.length ? { excludeTags: params.excludeTags } : {},
+				...params.entryTypes?.length ? { entryTypes: params.entryTypes } : {}
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(results.results?.map((e) => ({
+						id: e.id,
+						title: e.title,
+						tags: e.tags,
+						importance: e.importance,
+						contentPreview: typeof e.content === "string" ? e.content.slice(0, 200) : void 0
+					})), null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const createEntry = defineTool({
+		name: "moltnet_create_entry",
+		label: "Create MoltNet Diary Entry",
+		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. Before creating an episodic incident entry, first call moltnet_search_entries with the title/root-cause/error/watch-for terms plus taskFilter, tags, or entryTypes filters, then reference close matches instead of creating an isolated duplicate. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
+		parameters: Type$1.Object({
+			title: Type$1.String({ description: "Entry title (concise, descriptive)" }),
+			content: Type$1.String({ description: "Entry content (markdown)" }),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String(), { description: "Tags for categorization" })),
+			importance: Type$1.Optional(Type$1.Number({ description: "Importance 1-10 (default 5)" })),
+			entryType: Type$1.Optional(Type$1.Union([
+				Type$1.Literal("episodic"),
+				Type$1.Literal("semantic"),
+				Type$1.Literal("procedural"),
+				Type$1.Literal("reflection")
+			], { description: "Entry type. Use episodic for incidents, workarounds, bugs, or recurrence evidence; defaults to semantic." })),
+			diaryId: Type$1.Optional(Type$1.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." })),
+			signed: Type$1.Optional(Type$1.Boolean({ description: "Create a content-signed (immutable) entry. The signature is produced on the trusted host through the agent-signing capability; fails when the runtime does not expose it." }))
+		}),
+		async execute(_id, params) {
+			const { agent, diaryId: envDiaryId } = ensureConnected(config);
+			const signer = params.signed ? config.getSigner?.() ?? null : null;
+			if (params.signed && !signer) throw new Error("entries_create: signed entries require the agent-signing capability; create an unsigned entry or run under a runtime that declares it.");
+			const taskCtx = config.getTaskContext?.() ?? null;
+			let targetDiaryId;
+			let autoTags = [];
+			if (taskCtx) {
+				if (params.diaryId && params.diaryId !== taskCtx.diaryId) throw new Error(`entries_create: diaryId "${params.diaryId}" does not match the active task diary "${taskCtx.diaryId}". Entries created during a task must land in the task diary.`);
+				targetDiaryId = taskCtx.diaryId;
+				autoTags = [
+					`task:id:${taskCtx.taskId}`,
+					`task:type:${taskCtx.taskType}`,
+					`task:attempt:${taskCtx.attemptN}`,
+					...taskCtx.correlationId ? [`task:correlation:${taskCtx.correlationId}`] : []
+				];
+			} else targetDiaryId = params.diaryId ?? envDiaryId;
+			const userTags = params.tags ?? [];
+			const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
+			let entry;
+			try {
+				let signingRequestId;
+				if (signer) {
+					const contentCid = computeContentCid(params.entryType ?? "semantic", params.title, params.content, mergedTags);
+					const request = await agent.crypto.signingRequests.create({
+						message: contentCid,
+						verificationMethod: "agent-ed25519"
+					});
+					await signer.signDiaryEntry({ signingRequestId: request.id });
+					signingRequestId = request.id;
+				}
+				entry = await agent.entries.create(targetDiaryId, {
+					title: params.title,
+					content: params.content,
+					tags: mergedTags,
+					importance: params.importance ?? 5,
+					...params.entryType ? { entryType: params.entryType } : {},
+					...signingRequestId ? { signingRequestId } : {}
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				if (taskCtx && /\b403\b|forbidden|not authorized|permission/i.test(message)) {
+					await config.onTaskProvenanceEvent?.("task.provenance.entry_denied", {
+						taskId: taskCtx.taskId,
+						diaryId: targetDiaryId,
+						error: message
+					});
+					throw new Error(`entries_create: the task provenance diary denied this entry. The diary may have moved to another team or its grants may have changed. The task and runtime session remain active; ask a diary manager to restore write access, then retry. (${message})`, { cause: error });
+				}
+				throw error;
+			}
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						id: entry.id,
+						title: entry.title,
+						createdAt: entry.createdAt,
+						diaryId: targetDiaryId,
+						entryType: entry.entryType,
+						importance: entry.importance,
+						tags: mergedTags,
+						signed: signer !== null
+					}, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const getTask = defineTool({
+		name: "moltnet_get_task",
+		label: "Get MoltNet Task",
+		description: "Fetch a task by ID — the row, including taskType, status, acceptedAttemptN, references, input, timeouts. Use this when you need to inspect another task (e.g. an assess_brief judging a fulfill_brief: fetch the target task here, then list its attempts via moltnet_list_task_attempts to read the producer's output and decide what to investigate).",
+		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const task = await agent.tasks.get(params.taskId);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(task, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const listTaskAttempts = defineTool({
+		name: "moltnet_list_task_attempts",
+		label: "List MoltNet Task Attempts",
+		description: "List every attempt made on a task, in attempt-number order. Each attempt carries the claimed agent, status, output, outputCid, and timing. The accepted attempt (whose attemptN matches the parent task's acceptedAttemptN) is the canonical one — its `output` is what consumers should reason against. Earlier failed or timed_out attempts are kept for audit but should not drive downstream decisions.",
+		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const attempts = await agent.tasks.listAttempts(params.taskId);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(attempts, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const listTaskMessages = defineTool({
+		name: "moltnet_list_task_messages",
+		label: "List MoltNet Task Attempt Messages",
+		description: "List messages for a specific task attempt. Use this when you need the turn-by-turn execution record behind an accepted attempt — tool calls, text deltas, and error/info events that do not appear in the attempt output alone.",
+		parameters: Type$1.Object({
+			taskId: Type$1.String({ description: "Task ID (UUID)." }),
+			attemptN: Type$1.Integer({
+				minimum: 1,
+				description: "Attempt number to inspect."
+			}),
+			afterSeq: Type$1.Optional(Type$1.Integer({
+				minimum: 0,
+				description: "Optional cursor: only return messages with seq > afterSeq."
+			})),
+			limit: Type$1.Optional(Type$1.Integer({
+				minimum: 1,
+				maximum: 500,
+				description: "Optional maximum messages to return. Defaults to the API value."
+			}))
+		}),
+		async execute(_id, params) {
+			const { agent } = ensureConnected(config);
+			const messages = await agent.tasks.listMessages(params.taskId, params.attemptN, {
+				afterSeq: params.afterSeq,
+				limit: params.limit
+			});
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(messages, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const uploadTaskArtifact = defineTool({
+		name: "moltnet_upload_task_artifact",
+		label: "Upload MoltNet Task Artifact",
+		description: "Upload a file from the current task workspace as an immutable task artifact. Only available during an active task attempt; the tool attaches the artifact to the active taskId/attemptN and returns metadata including cid, sizeBytes, kind, and title. Use this for large logs, reports, build outputs, screenshots, generated files, or other bytes that should be referenced by CID instead of pasted into structured task output.",
+		parameters: Type$1.Object({
+			filePath: Type$1.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
+			kind: Type$1.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
+			title: Type$1.String({ description: "Human-readable artifact title, usually the file name." }),
+			contentType: Type$1.Optional(Type$1.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
+			contentEncoding: Type$1.Optional(Type$1.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
+		}),
+		async execute(_id, params) {
+			const { agent, teamId } = ensureConnected(config);
+			if (!teamId) throw new Error("moltnet_upload_task_artifact requires a team context");
+			const taskCtx = config.getTaskContext?.() ?? null;
+			if (!taskCtx) throw new Error("moltnet_upload_task_artifact is only available during an active task attempt");
+			const input = await openWorkspaceArtifactInput(config, config.getHostCwd?.() ?? process.cwd(), params.filePath);
+			if (!input.isFile) throw new Error(`task artifact path is not a file: ${params.filePath}`);
+			const artifact = await agent.tasks.artifacts.upload({
+				taskId: taskCtx.taskId,
+				attemptN: taskCtx.attemptN
+			}, input.stream, {
+				kind: params.kind,
+				title: params.title,
+				contentType: params.contentType ?? "application/octet-stream",
+				contentEncoding: params.contentEncoding
+			}, { teamId });
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						...artifact,
+						filePath: input.displayPath ?? params.filePath,
+						localSizeBytes: input.sizeBytes ?? null
+					}, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const listTaskArtifacts = defineTool({
+		name: "moltnet_list_task_artifacts",
+		label: "List MoltNet Task Artifacts",
+		description: "List immutable artifacts attached to a task, including each artifact CID, attempt number, kind, title, content type, size, uploader, and creation time. Use this when judging or continuing work that references task artifacts.",
+		parameters: Type$1.Object({
+			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
+			limit: Type$1.Optional(Type$1.Integer({
+				minimum: 1,
+				maximum: 100,
+				description: "Maximum artifacts to return. Defaults to the server page size."
+			})),
+			cursor: Type$1.Optional(Type$1.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
+		}),
+		async execute(_id, params) {
+			const { agent, teamId } = ensureConnected(config);
+			if (!teamId) throw new Error("moltnet_list_task_artifacts requires a team context");
+			const taskId = params.taskId ?? config.getTaskContext?.()?.taskId;
+			if (!taskId) throw new Error("moltnet_list_task_artifacts requires taskId outside an active task");
+			const page = await agent.tasks.artifacts.listPage(taskId, {
+				cursor: params.cursor,
+				limit: params.limit
+			}, { teamId });
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(page, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const downloadTaskArtifact = defineTool({
+		name: "moltnet_download_task_artifact",
+		label: "Download MoltNet Task Artifact",
+		description: "Download immutable task artifact bytes by taskId and CID into a new file in the current task workspace. Use moltnet_list_task_artifacts first to choose the correct CID. Omit attemptN for a bound input artifact; pass it only to require an artifact from one exact task attempt.",
+		parameters: Type$1.Object({
+			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
+			attemptN: Type$1.Optional(Type$1.Integer({
+				minimum: 1,
+				description: "Attempt number that produced the artifact. Omit for bound input artifacts, which have no producing attempt."
+			})),
+			cid: Type$1.String({
+				minLength: 1,
+				description: "Artifact CID returned by moltnet_list_task_artifacts."
+			}),
+			outputPath: Type$1.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
+		}),
+		async execute(_id, params) {
+			const { agent, teamId } = ensureConnected(config);
+			if (!teamId) throw new Error("moltnet_download_task_artifact requires a team context");
+			const taskId = params.taskId ?? config.getTaskContext?.()?.taskId;
+			if (!taskId) throw new Error("moltnet_download_task_artifact requires taskId outside an active task");
+			const cwd = config.getHostCwd?.() ?? process.cwd();
+			const outputPath = await resolveWorkspaceOutputPath(cwd, params.outputPath);
+			const artifactPath = params.attemptN === void 0 ? {
+				taskId,
+				cid: params.cid
+			} : {
+				taskId,
+				attemptN: params.attemptN,
+				cid: params.cid
+			};
+			const download = await agent.tasks.artifacts.download(artifactPath, { teamId });
+			await pipeline(download.stream, createWriteStream(outputPath, { flags: "wx" }));
+			const info = await stat(outputPath);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						taskId,
+						...params.attemptN === void 0 ? {} : { attemptN: params.attemptN },
+						cid: params.cid,
+						artifactId: download.artifactId,
+						contentType: download.contentType,
+						contentEncoding: download.contentEncoding,
+						outputPath: path.relative(cwd, outputPath),
+						sizeBytes: info.size
+					}, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const reviewSessionErrors = defineTool({
+		name: "moltnet_review_session_errors",
+		label: "Review Session Tool Errors",
+		description: "Review tool failures buffered during this session (isError=true results). Use this to decide whether any failures are worth persisting as a diary entry via moltnet_create_entry. Most failures are transient (denied prompts, empty greps, mid-iteration typecheck errors) and should NOT be written to the diary — only persist incidents that represent a real finding (root cause identified, non-obvious workaround, recurring pattern). Pass clear=true to drop the buffer after reviewing.",
+		parameters: Type$1.Object({ clear: Type$1.Optional(Type$1.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
+		async execute(_id, params) {
+			const errors = config.getSessionErrors();
+			const payload = {
+				count: errors.length,
+				errors: errors.map((e) => ({
+					toolName: e.toolName,
+					toolCallId: e.toolCallId,
+					timestamp: new Date(e.timestamp).toISOString(),
+					input: e.input,
+					error: e.error
+				}))
+			};
+			if (params.clear) config.clearSessionErrors();
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(payload, null, 2)
+				}],
+				details: {}
+			};
+		}
+	});
+	const HOST_EXEC_ALLOWED = new Set([
+		"git",
+		"gh",
+		"moltnet"
+	]);
+	const hostExecBaseEnv = config.hostExecBaseEnv ?? HOST_EXEC_DEFAULT_BASE_ENV;
+	const HOST_EXEC_TIMEOUT_MS = 6e4;
+	return [
+		getPack,
+		createPack,
+		getPackProvenance,
+		renderPack,
+		listRenderedPacks,
+		getRenderedPack,
+		diaryTags,
+		listEntries,
+		getEntry,
+		searchEntries,
+		createEntry,
+		getTask,
+		listTaskAttempts,
+		listTaskMessages,
+		uploadTaskArtifact,
+		listTaskArtifacts,
+		downloadTaskArtifact,
+		reviewSessionErrors,
+		defineTool({
+			name: "moltnet_host_exec",
+			label: "Run command on host (escape hatch — requires user approval)",
+			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations, and commit signing is brokered through the `agent-signing` host capability when declared; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
+			parameters: Type$1.Object({
+				executable: Type$1.String({ description: "Executable to run (git | gh | moltnet)" }),
+				args: Type$1.Array(Type$1.String(), { description: "Arguments to pass to the executable" }),
+				env: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
+			}),
+			async execute(_id, params, _signal, _onUpdate, ctx) {
+				if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
+				if (ctx?.ui && !shouldAutoApproveHostExec(params, config)) {
+					const cmdDisplay = [params.executable, ...params.args].join(" ");
+					if (!await ctx.ui.confirm("Allow host command?", `The agent wants to run on your machine:\n\n  ${cmdDisplay}\n\nAllow?`)) throw new Error(`host_exec: user declined approval for: ${cmdDisplay}`);
+				}
+				const cwd = config.getHostCwd?.() ?? process.cwd();
+				const baseEnv = {};
+				for (const key of hostExecBaseEnv) {
+					const val = process.env[key];
+					if (val !== void 0) baseEnv[key] = val;
+				}
+				const mergedEnv = {
+					...baseEnv,
+					...params.env ?? {}
+				};
+				let stdout;
+				let stderr = "";
+				try {
+					stdout = execFileSync(params.executable, params.args, {
+						encoding: "utf8",
+						cwd,
+						env: mergedEnv,
+						stdio: [
+							"pipe",
+							"pipe",
+							"pipe"
+						],
+						timeout: HOST_EXEC_TIMEOUT_MS
+					});
+				} catch (err) {
+					const e = err;
+					stdout = e.stdout ?? "";
+					stderr = e.stderr ?? e.message ?? String(err);
+				}
+				const result = {
+					host_exec: true,
+					executable: params.executable,
+					args: params.args,
+					cwd,
+					stdout: stdout.trimEnd(),
+					stderr: stderr.trimEnd() || void 0
+				};
+				return {
+					content: [{
+						type: "text",
+						text: JSON.stringify(result, null, 2)
+					}],
+					details: {}
+				};
+			}
+		})
+	];
+}
+//#endregion
+//#region src/otel/index.ts
+var TRACER_NAME = "@themoltnet/pi-extension/otel";
+function stripReservedAttrs(attrs) {
+	const out = {};
+	for (const [k, v] of Object.entries(attrs)) {
+		if (k.startsWith("gen_ai.")) continue;
+		out[k] = v;
+	}
+	return out;
+}
+function createPiOtelExtension(options = {}) {
+	return function piOtelExtension(pi) {
+		const tracer = trace.getTracer(TRACER_NAME);
+		const extraAttrs = stripReservedAttrs(options.spanAttributes ?? {});
+		let sessionSpan;
+		let sessionCtx = context.active();
+		let turnSpan;
+		let turnCtx = context.active();
+		let currentModel;
+		const toolSpans = /* @__PURE__ */ new Map();
+		function drainToolSpans(reason) {
+			for (const [, entry] of toolSpans) {
+				entry.span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: reason
+				});
+				entry.span.end();
+			}
+			toolSpans.clear();
+		}
+		function endTurnSpan() {
+			if (!turnSpan) return;
+			drainToolSpans("tool span not closed before turn end");
+			turnSpan.end();
+			turnSpan = void 0;
+			turnCtx = sessionCtx;
+		}
+		function endSessionSpan() {
+			drainToolSpans("tool span not closed before session shutdown");
+			endTurnSpan();
+			if (sessionSpan) {
+				sessionSpan.setStatus({ code: SpanStatusCode.OK });
+				sessionSpan.end();
+				sessionSpan = void 0;
+				sessionCtx = context.active();
+				options.onSessionContextChange?.(void 0);
+			}
+			currentModel = void 0;
+		}
+		pi.on("session_start", (event, ctx) => {
+			endSessionSpan();
+			const agentName = options.agentName ?? "pi";
+			const parentContext = options.sessionParentContext ?? context.active();
+			sessionSpan = tracer.startSpan(`invoke_agent ${agentName}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "invoke_agent",
+				"gen_ai.agent.name": agentName,
+				"session.reason": event.reason,
+				"session.cwd": ctx.cwd
+			} }, parentContext);
+			sessionCtx = trace.setSpan(parentContext, sessionSpan);
+			options.onSessionContextChange?.(sessionCtx);
+			turnCtx = sessionCtx;
+		});
+		pi.on("session_shutdown", () => {
+			endSessionSpan();
+		});
+		pi.on("model_select", (event) => {
+			currentModel = {
+				provider: event.model.provider,
+				id: event.model.id
+			};
+			if (sessionSpan) {
+				sessionSpan.setAttribute("gen_ai.request.model", event.model.id);
+				sessionSpan.setAttribute("gen_ai.provider.name", event.model.provider);
+			}
+		});
+		pi.on("turn_start", (event) => {
+			if (!sessionSpan) return;
+			const modelLabel = currentModel?.id ?? "unknown";
+			const turnParentContext = options.getTurnParentContext?.() ?? sessionCtx;
+			turnSpan = tracer.startSpan(`chat ${modelLabel}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "chat",
+				"gen_ai.request.model": currentModel?.id ?? "unknown",
+				"gen_ai.provider.name": currentModel?.provider ?? "unknown",
+				"turn.index": event.turnIndex
+			} }, turnParentContext);
+			turnCtx = trace.setSpan(turnParentContext, turnSpan);
+		});
+		pi.on("turn_end", (event) => {
+			if (!turnSpan) return;
+			const usage = extractUsage(event.message);
+			if (usage) {
+				turnSpan.setAttribute("gen_ai.usage.input_tokens", usage.input);
+				turnSpan.setAttribute("gen_ai.usage.output_tokens", usage.output);
+			}
+			turnSpan.setAttribute("turn.tool_results", event.toolResults?.length ?? 0);
+			turnSpan.setStatus({ code: SpanStatusCode.OK });
+			endTurnSpan();
+		});
+		pi.on("tool_execution_start", (event) => {
+			const parentCtx = turnSpan ? turnCtx : sessionCtx;
+			const span = tracer.startSpan(`execute_tool ${event.toolName}`, { attributes: {
+				...extraAttrs,
+				"gen_ai.operation.name": "execute_tool",
+				"gen_ai.tool.name": event.toolName,
+				"gen_ai.tool.call.id": event.toolCallId
+			} }, parentCtx);
+			toolSpans.set(event.toolCallId, {
+				span,
+				startedAt: Date.now()
+			});
+		});
+		pi.on("tool_execution_end", (event) => {
+			const entry = toolSpans.get(event.toolCallId);
+			if (!entry) return;
+			const durationMs = Date.now() - entry.startedAt;
+			entry.span.setAttribute("tool.duration_ms", durationMs);
+			if (event.isError) {
+				entry.span.setAttribute("error.type", "tool_execution_error");
+				entry.span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: "tool execution failed"
+				});
+			} else entry.span.setStatus({ code: SpanStatusCode.OK });
+			entry.span.end();
+			toolSpans.delete(event.toolCallId);
+		});
+	};
+}
+function extractUsage(message) {
+	if (!message || typeof message !== "object" || !("usage" in message) || !("role" in message)) return null;
+	const msg = message;
+	if (msg.role !== "assistant" || !msg.usage) return null;
+	return {
+		input: msg.usage.input ?? 0,
+		output: msg.usage.output ?? 0
+	};
+}
 //#endregion
-//#region ../models/src/problem-details.ts
-var ProblemCodeSchema = Type.Union([
-	Type.Literal("UNAUTHORIZED"),
-	Type.Literal("FORBIDDEN"),
-	Type.Literal("NOT_FOUND"),
-	Type.Literal("CONFLICT"),
-	Type.Literal("UNSUPPORTED_MEDIA_TYPE"),
-	Type.Literal("VALIDATION_FAILED"),
-	Type.Literal("INVALID_CHALLENGE"),
-	Type.Literal("INVALID_SIGNATURE"),
-	Type.Literal("RATE_LIMIT_EXCEEDED"),
-	Type.Literal("SERIALIZATION_EXHAUSTED"),
-	Type.Literal("SIGNING_REQUEST_EXPIRED"),
-	Type.Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
-	Type.Literal("SIGNING_REQUEST_LIMIT_REACHED"),
-	Type.Literal("REGISTRATION_FAILED"),
-	Type.Literal("UPSTREAM_ERROR"),
-	Type.Literal("SERVICE_UNAVAILABLE"),
-	Type.Literal("INTERNAL_SERVER_ERROR"),
-	Type.Literal("TEAM_PERSONAL_IMMUTABLE"),
-	Type.Literal("TEAM_NOT_ACTIVE"),
-	Type.Literal("INVITE_EXPIRED"),
-	Type.Literal("INVITE_EXHAUSTED"),
-	Type.Literal("TEAM_LAST_OWNER"),
-	Type.Literal("TEAM_ALREADY_ACTIVE"),
-	Type.Literal("TEAM_NOT_FOUNDING"),
-	Type.Literal("FOUNDING_ALREADY_ACCEPTED"),
-	Type.Literal("DIARY_TRANSFER_PENDING"),
-	Type.Literal("DIARY_TRANSFER_NOT_FOUND"),
-	Type.Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
-]);
-var ProblemDetailsSchema = Type.Object({
-	type: Type.String({ format: "uri" }),
-	title: Type.String(),
-	status: Type.Integer({
-		minimum: 100,
-		maximum: 599
-	}),
-	code: ProblemCodeSchema,
-	detail: Type.Optional(Type.String()),
-	instance: Type.Optional(Type.String()),
-	retryAfter: Type.Optional(Type.Integer({
-		minimum: 0,
-		description: "Non-negative delay in seconds before retrying, matching the Retry-After response header when present."
-	}))
-}, {
-	$id: "ProblemDetails",
-	additionalProperties: true
-});
-Type.Object({
-	field: Type.String(),
-	message: Type.String(),
-	code: Type.Optional(Type.String())
-}, {
-	$id: "ValidationError",
-	additionalProperties: false
-});
-Type.Object({
-	resource: Type.String(),
-	id: Type.Optional(Type.String({ format: "uuid" })),
-	keys: Type.Optional(Type.Record(Type.String(), Type.String()))
-}, {
-	$id: "ConflictTarget",
-	additionalProperties: false
-});
-Type.Object({
-	constraint: Type.Optional(Type.String()),
-	target: Type.Optional(Type.Ref("ConflictTarget"))
-}, {
-	$id: "ConflictError",
-	additionalProperties: false
-});
-var ConflictProblemDetailsSchema = Type.Intersect([ProblemDetailsSchema, Type.Object({ conflict: Type.Ref("ConflictError") })], { $id: "ConflictProblemDetails" });
-Type.Object({
-	type: Type.String(),
-	severity: Type.Number(),
-	match: Type.String()
-}, {
-	$id: "InjectionThreat",
-	additionalProperties: false
-});
-Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Optional(Type.Array(Type.Object({
-	id: Type.String({ format: "uuid" }),
-	threats: Type.Array(Type.Ref("InjectionThreat"))
-}, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
-Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
-Type.Union([
-	Type.Literal("pack"),
-	Type.Literal("entry"),
-	Type.Literal("rendered_pack")
-]);
-var ProvenanceGraphEdgeKindSchema = Type.Union([
-	Type.Literal("includes"),
-	Type.Literal("supersedes"),
-	Type.Literal("rendered_from")
-]);
-var ProvenanceGraphPackMetaSchema = Type.Object({
-	packId: UuidSchema,
-	diaryId: UuidSchema,
-	packCid: Type.String(),
-	packType: Type.String(),
-	packCodec: Type.String(),
-	pinned: Type.Boolean(),
-	createdAt: TimestampSchema,
-	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
-	supersedesPackId: Type.Union([UuidSchema, Type.Null()])
+//#region src/runtime/model-options-extension.ts
+function hasPiModelOptions(options) {
+	return options.temperature !== void 0 && options.temperature !== null || options.topP !== void 0 && options.topP !== null || options.topK !== void 0 && options.topK !== null || options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null;
+}
+function createPiModelOptionsExtension(options) {
+	return function piModelOptionsExtension(pi) {
+		pi.on("before_provider_request", (event) => {
+			return applyPiModelOptions(event.payload, options);
+		});
+	};
+}
+function applyPiModelOptions(payload, options) {
+	if (!isRecord$1(payload)) return void 0;
+	if (!hasPiModelOptions(options)) return void 0;
+	if (isGooglePayload(payload)) {
+		const config = isRecord$1(payload.config) ? payload.config : {};
+		return {
+			...payload,
+			config: applyConfigOptions(config, options)
+		};
+	}
+	if (isBedrockPayload(payload)) {
+		const inferenceConfig = isRecord$1(payload.inferenceConfig) ? payload.inferenceConfig : {};
+		return {
+			...payload,
+			inferenceConfig: applyBedrockOptions(inferenceConfig, options)
+		};
+	}
+	return applyTopLevelOptions(payload, options);
+}
+function applyConfigOptions(config, options) {
+	return {
+		...config,
+		...options.temperature !== void 0 && options.temperature !== null ? { temperature: options.temperature } : {},
+		...options.topP !== void 0 && options.topP !== null ? { topP: options.topP } : {},
+		...options.topK !== void 0 && options.topK !== null ? { topK: options.topK } : {},
+		...options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null ? { maxOutputTokens: options.maxOutputTokens } : {}
+	};
+}
+function applyBedrockOptions(inferenceConfig, options) {
+	return {
+		...inferenceConfig,
+		...options.temperature !== void 0 && options.temperature !== null ? { temperature: options.temperature } : {},
+		...options.topP !== void 0 && options.topP !== null ? { topP: options.topP } : {},
+		...options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null ? { maxTokens: options.maxOutputTokens } : {}
+	};
+}
+function applyTopLevelOptions(payload, options) {
+	const reasoningEnabled = hasActiveThinking(payload.thinking) || "reasoning" in payload || "reasoning_effort" in payload;
+	const next = { ...payload };
+	if (options.temperature !== void 0 && options.temperature !== null && !reasoningEnabled) next.temperature = options.temperature;
+	if (options.topP !== void 0 && options.topP !== null && !reasoningEnabled) next.top_p = options.topP;
+	if (options.topK !== void 0 && options.topK !== null && !reasoningEnabled && isAnthropicPayload(next)) next.top_k = options.topK;
+	if (options.maxOutputTokens !== void 0 && options.maxOutputTokens !== null) {
+		const maxOutputTokens = options.maxOutputTokens;
+		if ("max_output_tokens" in next || isResponsesPayload(next)) next.max_output_tokens = maxOutputTokens;
+		else if ("max_completion_tokens" in next) next.max_completion_tokens = maxOutputTokens;
+		else if ("maxTokens" in next) next.maxTokens = maxOutputTokens;
+		else next.max_tokens = maxOutputTokens;
+	}
+	return next;
+}
+function isGooglePayload(payload) {
+	return "contents" in payload && ("config" in payload || "model" in payload);
+}
+function isBedrockPayload(payload) {
+	return "inferenceConfig" in payload || "additionalModelRequestFields" in payload;
+}
+function isResponsesPayload(payload) {
+	return "input" in payload && !("messages" in payload);
+}
+function isAnthropicPayload(payload) {
+	return "anthropic_version" in payload;
+}
+function hasActiveThinking(value) {
+	if (!isRecord$1(value)) return false;
+	const type = value.type;
+	return type !== "disabled" && type !== "off" && type !== false;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/runtime/agent-session-factory.ts
+var NO_SKILLS = () => ({
+	skills: [],
+	diagnostics: []
 });
 /**
-* Discriminated creator embedded inside provenance-node response
-* payloads. Re-uses the shared `PrincipalIdentitySchemaInline` (the
-* `$id`-less twin) — embedding the named `PrincipalIdentitySchema`
-* here would clash with the top-level registration via @fastify/swagger
-* (`reference "PrincipalIdentity" resolves to more than one schema`).
+* Construct an `AgentSession`. By default it is in-memory; callers may opt
+* parent sessions into daemon-owned file persistence via `sessionPersistence`.
+* The caller is responsible for eventually invoking `session.prompt(...)` and
+* for tearing down — the helper does no lifecycle management beyond
+* construction.
 */
-var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
-var ProvenanceGraphEntryMetaSchema = Type.Object({
-	entryId: UuidSchema,
-	diaryId: UuidSchema,
-	entryType: EntryTypeSchema,
-	contentHash: Type.Union([Type.String(), Type.Null()]),
-	createdAt: TimestampSchema,
-	updatedAt: TimestampSchema,
-	signed: Type.Boolean(),
-	title: Type.Union([Type.String(), Type.Null()]),
-	tags: Type.Array(Type.String()),
-	creator: Type.Optional(ProvenanceGraphCreatorSchema)
-});
-var ProvenanceGraphPackNodeSchema = Type.Object({
-	id: Type.String(),
-	kind: Type.Literal("pack"),
-	label: Type.String(),
-	cid: Type.Union([Type.String(), Type.Null()]),
-	meta: Type.Intersect([ProvenanceGraphPackMetaSchema, Type.Object({ creator: Type.Optional(ProvenanceGraphCreatorSchema) })])
-});
-var ProvenanceGraphEntryNodeSchema = Type.Object({
-	id: Type.String(),
-	kind: Type.Literal("entry"),
-	label: Type.String(),
-	cid: Type.Union([Type.String(), Type.Null()]),
-	meta: ProvenanceGraphEntryMetaSchema
-});
-var ProvenanceGraphRenderedPackMetaSchema = Type.Object({
-	renderedPackId: UuidSchema,
-	sourcePackId: UuidSchema,
-	diaryId: UuidSchema,
-	packCid: Type.String(),
-	renderMethod: Type.String(),
-	totalTokens: Type.Number(),
-	pinned: Type.Boolean(),
-	createdAt: TimestampSchema,
-	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
-	creator: Type.Optional(ProvenanceGraphCreatorSchema)
-});
-var ProvenanceGraphRenderedPackNodeSchema = Type.Object({
-	id: Type.String(),
-	kind: Type.Literal("rendered_pack"),
-	label: Type.String(),
-	cid: Type.Union([Type.String(), Type.Null()]),
-	meta: ProvenanceGraphRenderedPackMetaSchema
-});
-var ProvenanceGraphNodeSchema = Type.Union([
-	ProvenanceGraphPackNodeSchema,
-	ProvenanceGraphEntryNodeSchema,
-	ProvenanceGraphRenderedPackNodeSchema
-]);
-var ProvenanceGraphEdgeSchema = Type.Object({
-	id: Type.String(),
-	from: Type.String(),
-	to: Type.String(),
-	kind: ProvenanceGraphEdgeKindSchema,
-	label: Type.Optional(Type.String()),
-	meta: Type.Optional(Type.Record(Type.String(), Type.Union([
-		Type.String(),
-		Type.Number(),
-		Type.Boolean(),
-		Type.Null()
-	])))
-});
-var ProvenanceGraphMetadataSchema = Type.Object({
-	format: Type.Literal("moltnet.provenance-graph/v1"),
-	generatedAt: TimestampSchema,
-	rootNodeId: Type.String(),
-	rootPackId: UuidSchema,
-	depth: Type.Number({ minimum: 0 })
-});
-Type.Object({
-	metadata: ProvenanceGraphMetadataSchema,
-	nodes: Type.Array(ProvenanceGraphNodeSchema),
-	edges: Type.Array(ProvenanceGraphEdgeSchema)
-}, { $id: "ProvenanceGraph" });
-//#endregion
-//#region ../models/src/signer-constraint.ts
-var SIGNER_CONSTRAINT_TYPE = {
-	Human: "human",
-	TeamRole: "team-role",
-	Group: "group"
-};
-Type.Union([
-	Type.Object({
-		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Human),
-		id: Type.String({ format: "uuid" })
-	}),
-	Type.Object({
-		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
-		id: TeamRoleSchema
-	}),
-	Type.Object({
-		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Group),
-		id: Type.String({ format: "uuid" })
-	})
-]);
+async function buildAgentSession(args) {
+	const piOtelExtension = createPiOtelExtension({
+		agentName: args.agentName,
+		spanAttributes: args.otelSpanAttrs,
+		sessionParentContext: args.otelSessionParentContext,
+		getTurnParentContext: args.getOtelTurnParentContext,
+		onSessionContextChange: args.onOtelSessionContextChange
+	});
+	const modelOptions = {
+		temperature: args.temperature,
+		topP: args.topP,
+		topK: args.topK,
+		maxOutputTokens: args.maxOutputTokens
+	};
+	const extensionFactories = [
+		piOtelExtension,
+		...hasPiModelOptions(modelOptions) ? [createPiModelOptionsExtension(modelOptions)] : [],
+		...args.extraExtensionFactories ?? []
+	];
+	const resourceLoader = new DefaultResourceLoader({
+		cwd: args.cwdPath,
+		agentDir: args.piAuthDir,
+		extensionFactories,
+		appendSystemPrompt: args.appendSystemPrompt,
+		skillsOverride: args.skillsOverride ?? NO_SKILLS
+	});
+	await resourceLoader.reload();
+	const sessionManager = args.sessionPersistence ? await resolvePersistentSessionManager({
+		cwd: args.cwdPath,
+		sessionDir: args.sessionPersistence.sessionDir,
+		forkFromSessionPath: args.sessionPersistence.forkFromSessionPath
+	}) : SessionManager.inMemory(args.cwdPath);
+	return (await createAgentSession({
+		agentDir: args.piAuthDir,
+		cwd: args.cwdPath,
+		model: args.modelHandle,
+		...args.modelRuntime ? { modelRuntime: args.modelRuntime } : {},
+		thinkingLevel: args.thinkingLevel ?? void 0,
+		tools: args.tools,
+		customTools: args.customTools,
+		sessionManager,
+		resourceLoader
+	})).session;
+}
+async function resolvePersistentSessionManager(args) {
+	if (args.forkFromSessionPath) return SessionManager.forkFrom(args.forkFromSessionPath, args.cwd, args.sessionDir);
+	await SessionManager.list(args.cwd, args.sessionDir);
+	return SessionManager.continueRecent(args.cwd, args.sessionDir);
+}
 //#endregion
-//#region ../models/src/signer-protocol.ts
-function schemaRef(schema) {
-	const id = schemaId(schema);
-	return Type.Ref(id);
+//#region ../crypto-service/src/json-cid.ts
+/**
+* Generic JSON CID — CIDv1 for arbitrary JSON-serialisable values.
+*
+* Uses the dag-json codec and sha2-256, producing a base32lower CIDv1.
+* Suitable for content-addressing task inputs, schema objects, and other
+* JSON payloads that don't need diary-entry canonical normalisation.
+*/
+async function computeJsonCid(value) {
+	const bytes = json.encode(value);
+	const hash = await sha256$1.digest(bytes);
+	return CID.create(1, json.code, hash).toString();
 }
-function schemaId(schema) {
-	const id = schema.$id;
-	if (typeof id !== "string" || id.length === 0) throw new Error("Signer protocol schemas must have an identifier");
-	return id;
+//#endregion
+//#region src/config.ts
+/** Resolve Pi's host-side auth/config directory from process configuration. */
+function resolvePiCodingAgentDir() {
+	return process.env["PI_CODING_AGENT_DIR"] ?? path.join(homedir(), ".pi", "agent");
 }
-var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
-var SignerUuidSchema = Type.String({
-	$id: "SignerUuid",
-	pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
-});
-var SignerOperationSchema = Type.Union([
-	Type.Literal("credential-enrollment"),
-	Type.Literal("credential-registration"),
-	Type.Literal("signing-request")
-], { $id: "SignerOperation" });
-var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
-var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
-var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
-var SignerProblemSchema = Type.Object({
-	code: Type.String({ minLength: 1 }),
-	message: Type.String({ minLength: 1 })
-}, {
-	$id: "SignerProblem",
-	additionalProperties: false
-});
-var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
-	$id: "SignerCeremonyParams",
-	additionalProperties: false
-});
-var SignerSessionSchema = Type.Object({
-	version: Type.Literal(1),
-	token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	expiresAt: Type.String()
-}, {
-	$id: "SignerSession",
-	additionalProperties: false
-});
-var SignerEnrollmentCeremonyRequestSchema = Type.Object({
-	version: Type.Literal(1),
-	operation: Type.Literal("credential-enrollment"),
-	label: Type.String({
+//#endregion
+//#region ../runtime-profiles/src/context.ts
+/**
+* How an executor delivers a context entry to its underlying LLM.
+* V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
+* tool_response_seed, additional_context_hook) ship in a later slice.
+*/
+var CONTEXT_BINDINGS = [
+	"skill",
+	"context_inline",
+	"prompt_prefix",
+	"user_inline"
+];
+/** Maximum UTF-16 code units accepted in one ContextRef content field. */
+var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
+var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
+/**
+* One context entry. Bytes are inlined: the proposer chose them, and the
+* task's `inputCid` already pins the entire input — including
+* `context[]` — so we don't need a separate per-entry hash, fetcher, or
+* flagged-content gate. Tasks reference rendered packs (or any other
+* external content) by copying their bytes into `content` at task
+* creation time.
+*
+* - `slug` — short identifier the daemon uses to disambiguate
+*            entries. For `skill` binding it becomes the directory
+*            name under the runtime's skill discovery path. Must be
+*            kebab-case-safe (alphanumeric + dashes/underscores).
+* - `binding` — how the bytes are delivered to the LLM (see above).
+* - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
+*               entry; total per-task context bytes are bounded by the
+*               soft `maxItems` cap and per-binding daemon limits.
+*               Raised from 32 KiB in 2026-05 — protocol-heavy operator
+*               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
+*               at ~35 KiB inline, and the original cap was sized for
+*               short example skills, not the kind of skill the eval
+*               substrate is dogfooded on (#943, #823).
+*/
+var ContextRef = Type.Object({
+	slug: Type.String({
 		minLength: 1,
-		maxLength: 255
+		maxLength: 64,
+		pattern: "^[a-zA-Z0-9_-]+$"
 	}),
-	teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
-}, {
-	$id: "SignerEnrollmentCeremonyRequest",
-	additionalProperties: false
-});
-var SignerChallengeCeremonyRequestSchema = Type.Object({
-	version: Type.Literal(1),
-	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
-	challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
-}, {
-	$id: "SignerChallengeCeremonyRequest",
-	additionalProperties: false
-});
-var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
-var SignerCeremonySchema = Type.Object({
-	version: Type.Literal(1),
-	id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
-	approvalUrl: Type.String(),
-	expiresAt: Type.String()
+	binding: ContextBinding,
+	content: Type.String({
+		minLength: 1,
+		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
+	})
 }, {
-	$id: "SignerCeremony",
+	$id: "ContextRef",
 	additionalProperties: false
 });
-var SignerPendingResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("pending"),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema))
-}, {
-	$id: "SignerPendingResult",
-	additionalProperties: false
+/** Reusable input fragment for any task type. Soft cap at 5 items. */
+var TaskContext = Type.Array(ContextRef, {
+	$id: "TaskContext",
+	maxItems: 5
 });
-var SignerEnrollmentResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("completed"),
-	operation: Type.Literal("credential-enrollment"),
-	publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
-}, {
-	$id: "SignerEnrollmentResult",
-	additionalProperties: false
+//#endregion
+//#region ../runtime-profiles/src/runtime-models.ts
+/**
+* Runtime model catalog: a list of supported provider/model couples that
+* MoltNet daemons can target. Backed by the `runtime_models` table.
+*
+* Scope is intrinsic to the row:
+*   - `teamId == null`  => global entry (MoltNet-seeded, read-only to most callers)
+*   - `teamId != null`  => team-owned custom entry
+*
+* The REST API exposes a single shape regardless of scope; the team header
+* gates which rows are returned.
+*/
+var RuntimeModelProvider = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
 });
-var SignerReceiptSchema = PreviewSignReceiptValueSchema;
-var SignerSignatureResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("completed"),
-	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
-}, {
-	$id: "SignerSignatureResult",
-	additionalProperties: false
+var RuntimeModelName = Type.String({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
 });
-var SignerFailedResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("failed"),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
-	code: Type.String(),
-	message: Type.String()
+var RuntimeModelCapabilities = Type.Record(Type.String({
+	minLength: 1,
+	maxLength: 64
+}), Type.Union([
+	Type.Boolean(),
+	Type.Number(),
+	Type.String({ maxLength: 256 })
+]));
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	provider: RuntimeModelProvider,
+	model: RuntimeModelName,
+	displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
+	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
+	capabilities: RuntimeModelCapabilities,
+	isActive: Type.Boolean(),
+	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
 }, {
-	$id: "SignerFailedResult",
+	$id: "RuntimeModel",
 	additionalProperties: false
 });
-var SignerCeremonyResultSchema = Type.Union([
-	Type.Unsafe(schemaRef(SignerPendingResultSchema)),
-	Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
-	Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
-	Type.Unsafe(schemaRef(SignerFailedResultSchema))
-], { $id: "SignerCeremonyResult" });
-({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
 //#endregion
-//#region ../models/src/tool-enforcement.ts
-var TOOL_ENFORCEMENT_VALUES = [
-	"off",
-	"watch",
-	"enforce"
-];
-var toolEnforcementLiterals = [
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
-];
-var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+//#region ../runtime-profiles/src/runtime-profile-context-recipes.ts
+var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
+	version: 1,
+	fragments: {
+		"artifact-planner-v1": {
+			binding: "prompt_prefix",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			slug: "artifact-planner-v1"
+		},
+		"accountable-delivery-v1": {
+			binding: "prompt_prefix",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			slug: "accountable-delivery-v1"
+		},
+		"judgment-diary-v1": {
+			binding: "prompt_prefix",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			slug: "judgment-diary-v1"
+		},
+		"proactive-memory-v1": {
+			binding: "prompt_prefix",
+			content: "# Proactive memory use\n\n- Before non-trivial investigation, debugging, code changes, or review, check the task diary for relevant prior knowledge instead of waiting for a human to ask. Use `moltnet_diary_tags` for cheap reconnaissance, `moltnet_list_entries` when tags or task provenance are known, and `moltnet_search_entries` for semantic similarity. Do not search randomly: pass `taskFilter` for task-local or correlation-local queries, and pass `tags` / `entryTypes` for broader prior-knowledge queries using known tags such as `incident`, `decision`, or `scope:<area>`. Broaden only after constrained searches miss.\n- Before creating an `episodic` incident entry, search for similar incidents using the proposed title, root cause, error text, affected subsystem, and watch-for terms, filtered by `entryTypes: [\"episodic\", \"semantic\"]` and any known `scope:*` or task-provenance tags. If a close prior match exists, do not create an isolated duplicate: reference the prior entry in your response or diary content, update or link it when the new occurrence adds material evidence, or create a new recurrence entry only when the recurrence itself is important signal.\n- When you create a recurrence entry, include the prior matching entry id(s) in the content and explain what is new about this occurrence.",
+			slug: "proactive-memory-v1"
+		},
+		"run-eval-direct-v1": {
+			binding: "prompt_prefix",
+			content: "# Direct evaluation run\n\nThe supplied scenario, typed task facts, injected context, and registered submit-output tool are the complete task contract. Do not search diaries, create diary entries, modify a repository, commit, branch, push, or open a pull request unless a task fact explicitly requires it. Submit the agent-authored payload in the first turn; correction turns exist only to recover a rejected or missing submission.",
+			slug: "run-eval-direct-v1"
+		},
+		"task-diary-discipline-v1": {
+			binding: "prompt_prefix",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			slug: "task-diary-discipline-v1"
+		},
+		"verification-and-artifacts-v1": {
+			binding: "prompt_prefix",
+			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
+			slug: "verification-and-artifacts-v1"
+		}
+	},
+	recipes: {
+		"artifact-planner@v1": {
+			description: "Minimal artifact-only context for bounded semantic classification and planning.",
+			fragments: ["artifact-planner-v1"]
+		},
+		"run-eval-direct@v1": {
+			description: "Minimal direct context for a short, isolated evaluation run.",
+			fragments: ["run-eval-direct-v1"]
+		},
+		"standard-engineering@v1": {
+			description: "Full opt-in operating guidance for engineering tasks that need diary research, accountable delivery, and verification discipline.",
+			fragments: [
+				"proactive-memory-v1",
+				"task-diary-discipline-v1",
+				"accountable-delivery-v1",
+				"judgment-diary-v1",
+				"verification-and-artifacts-v1"
+			]
+		}
+	}
+};
+function deepFreeze(value) {
+	if (value && typeof value === "object") {
+		for (const key of Object.keys(value)) deepFreeze(value[key]);
+		Object.freeze(value);
+	}
+	return value;
+}
+deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
+Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
 //#endregion
 //#region ../runtime-profiles/src/runtime-profiles.ts
 var RuntimeProfileName = Type.String({
@@ -2833,18 +2890,6 @@ Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
 	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
-var RuntimeProfileLeaseTtlSec = Type.Integer({
-	minimum: 1,
-	maximum: 86400
-});
-var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
-	minimum: 0,
-	maximum: 36e5
-});
-var RuntimeProfileMaxBatchSize = Type.Integer({
-	minimum: 1,
-	maximum: 1e3
-});
 var RuntimeProfileMaxTurns = Type.Integer({
 	minimum: 0,
 	maximum: 1e4
@@ -2873,21 +2918,8 @@ Type.Object({
 	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
 	runtimeKind: RuntimeProfileRuntimeKind,
 	sandbox: RuntimeProfileSandbox,
-	sessionStorageMode: Type.Literal("local"),
-	workspaceStorageMode: Type.Literal("local"),
 	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
 	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
-	sessionTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	workspaceTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	leaseTtlSec: RuntimeProfileLeaseTtlSec,
-	heartbeatIntervalMs: RuntimeProfileHeartbeatIntervalMs,
-	maxBatchSize: RuntimeProfileMaxBatchSize,
 	maxTurns: RuntimeProfileMaxTurns,
 	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
 	toolEnforcement: RuntimeProfileToolEnforcement,
@@ -3020,6 +3052,7 @@ var ResolvedRuntimeSlot = Type.Object({
 	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
 }, { $id: "ResolvedRuntimeSlot" });
 Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
+var MAX_RUNTIME_WARM_RETENTION_SEC = 86400;
 Type.Object({
 	agentName: Type.String({
 		minLength: 1,
@@ -3046,7 +3079,11 @@ Type.Object({
 	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
 	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
 	lastTaskId: Type.String({ format: "uuid" }),
-	lastAttemptN: Type.Integer({ minimum: 1 })
+	lastAttemptN: Type.Integer({ minimum: 1 }),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "BeginRuntimeSlotBody",
 	additionalProperties: false
@@ -3068,7 +3105,11 @@ Type.Object({
 	slotKey: Type.String({ minLength: 1 }),
 	taskId: Type.String({ format: "uuid" }),
 	attemptN: Type.Integer({ minimum: 1 }),
-	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
+	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "FinishRuntimeSlotBody",
 	additionalProperties: false
@@ -3921,14 +3962,19 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 *    allow-set can't bound it. This is the interim conservative stance for
 *    issue #1348 — an operator who lists `bash` still cannot smuggle
 *    `bash -c "curl … | sh"` past `enforce`.
-* 3. **Unlisted executables** — any resolved executable not in `allowedTools`.
+* 3. **Unauthorized executables** — any resolved executable without a matching
+*    shell-command rule. Tool names in `allowedTools` never authorize a shell
+*    invocation.
+* 4. **Output redirection** — a `bash` command that redirects output (`>`,
+*    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+*    through structured tools.
 *
 * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
 * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
 * is NOT blocked on the tier alone. The analyzer already re-analyzes the
 * sub-commands it can see through documented escape flags (`find -exec`,
 * `tar --to-command`, …), but techniques it cannot parse statically could still
-* escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+* escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
 * capability-aware allow-set) is tracked as future work.
 */
 function decideToolCall(input) {
@@ -3954,18 +4000,20 @@ function decideToolCall(input) {
 	}
 	const matchedShellCommands = [];
 	const missingShellCommands = resolved.tools.filter((tool) => {
-		if (input.allowedTools.has(tool.name)) return false;
 		const matched = input.allowedShellCommands.find((rule) => matchesArgvPrefix(tool.argv, rule.argvPrefix));
 		if (!matched) return true;
 		matchedShellCommands.push(toMatchedShellCommand(tool.name, matched.argvPrefix));
 		return false;
 	}).map(toMissingShellCommand);
-	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection && matchedShellCommands.length > 0) return fenced(input.enforcement, "shell_output_redirection_requires_broad_permission", "shell output redirection requires broad executable permission", "would block shell output redirection under scoped command policy", [...new Set(matchedShellCommands.map(({ executable }) => executable))], matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
-		executable,
-		argvFingerprint: argvPrefixFingerprint,
-		argvLength: argvPrefixLength,
-		dynamicTokenCount: 0
-	})));
+	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection) {
+		const executables = [...new Set(matchedShellCommands.map(({ executable }) => executable))];
+		return fenced(input.enforcement, "shell_output_redirection_not_permitted", "shell output redirection is not permitted by tool policy", "would block shell output redirection (watch)", executables.length > 0 ? executables : void 0, matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
+			executable,
+			argvFingerprint: argvPrefixFingerprint,
+			argvLength: argvPrefixLength,
+			dynamicTokenCount: 0
+		})));
+	}
 	if (missingShellCommands.length === 0) return matchedShellCommands.length > 0 ? {
 		allow: true,
 		reasonCode: "shell_command_prefix_allowed",
@@ -4079,7 +4127,7 @@ async function resolveSessionToolPolicy(input) {
 			enforcement: resolved.enforcement,
 			allowedTools: new Set(resolved.allowedTools),
 			allowedShellCommands: shellCommands.map((rule) => {
-				if (rule.argvPrefix.length < 2 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
+				if (rule.argvPrefix.length < 1 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
 				return { argvPrefix: rule.argvPrefix };
 			}),
 			executionPolicySnapshotHash: resolved.policySnapshotHash,
@@ -4686,7 +4734,7 @@ function buildToolPolicyInstructions(policy) {
 	lines.push(policy.allowedTools.length > 0 ? "- The visible structured-tool definitions are the authorized surface." : policy.enforcement === "enforce" ? "- No optional structured tools are authorized." : "- No optional structured tools are registered.");
 	if (policy.enforcement === "watch") lines.push("- Watch mode records policy decisions but does not block tool calls.");
 	else if (policy.allowedShellCommands.length === 0) lines.push("- No shell commands are authorized. `bash` is not available; do not", "  attempt shell, filesystem, git, GitHub CLI, or MoltNet CLI commands.");
-	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.");
+	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.", "- Output redirection (`>`, `2>`, `>>`, `&>`) is never authorized, even", "  for an authorized prefix. Write files with the structured file tools.");
 	lines.push("- Tools and commands absent from this effective policy are unavailable,", "  even if advisory context mentions them.");
 	return lines.join("\n");
 }
@@ -6408,6 +6456,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				}))
 			};
 			const toolPolicyDecisionContext = buildToolPolicyDecisionContext(claimedTask, opts.runtimeProfileId);
+			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
 			if (opts.runtimeProfileId && opts.toolEnforcement) {
 				const policy = await resolveSessionToolPolicy({
 					agent: moltnetAgent,
@@ -6476,7 +6525,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 				policy: resolvedToolPolicy
 			}), gondolinLifecycle) : [];
 			const visibleBaseTools = filterModelVisibleTools([...gondolinCustomTools, ...moltnetTools], resolvedToolPolicy);
-			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
 			const visibleParentToolNames = modelVisiblePiToolNames({
 				tools: [
 					...visibleBaseTools,