@zenera/neo 1.1.20 → 1.1.22

package/dist/inspect/css.d.ts

@@ -1,2 +1,2 @@
-export declare const CSS = "\n:root {\n  --bg: #0f1115; --panel: #161922; --line: #262b36; --fg: #d7dbe3; --dim: #8a92a6;\n  --accent: #6ea8fe; --ok: #4ec9a0; --err: #f0776c; --warn: #e2b341; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;\n}\n* { box-sizing: border-box; }\nbody { margin: 0; background: var(--bg); color: var(--fg);\n  font: 14px/1.5 system-ui, -apple-system, Segoe UI, sans-serif; }\nheader { padding: 12px 16px; border-bottom: 1px solid var(--line); background: var(--panel);\n  display: flex; flex-wrap: wrap; gap: 8px 20px; align-items: baseline; }\nheader h1 { font-size: 15px; margin: 0 12px 0 0; font-weight: 600; }\nheader .kv { color: var(--dim); font-size: 12px; }\nheader .kv b { color: var(--fg); font-weight: 600; }\nmain { display: grid; grid-template-columns: 340px 1fr; height: calc(100vh - 49px); }\naside { border-right: 1px solid var(--line); overflow: auto; background: var(--panel); }\n.pad { padding: 10px; position: sticky; top: 0; background: var(--panel); border-bottom: 1px solid var(--line); }\n#filter { width: 100%; padding: 6px 8px; background: var(--bg); color: var(--fg);\n  border: 1px solid var(--line); border-radius: 6px; }\n#timeline { list-style: none; margin: 0; padding: 4px 0; }\n#timeline li { padding: 6px 10px; border-left: 3px solid transparent; cursor: pointer; }\n#timeline li:hover { background: #1c2130; }\n#timeline li.sel { background: #1f2637; border-left-color: var(--accent); }\n#timeline li.covered { opacity: .45; }\n#timeline .row { display: flex; gap: 6px; align-items: baseline; }\n#timeline .t { color: var(--fg); font: 11px var(--mono); min-width: 38px; text-align: right; }\n#timeline .t.same { color: #3d4453; }\n#timeline .dur { margin-left: auto; color: var(--dim); font: 11px var(--mono); }\n#timeline .idx { color: var(--dim); font: 11px var(--mono); min-width: 22px; }\n#timeline .prev { color: var(--dim); font-size: 11px; white-space: nowrap;\n  overflow: hidden; text-overflow: ellipsis; padding-left: 44px; }\n/* Branch histories are contiguous in this list, so a coloured edge plus a\n   header is enough to stop ten parallel branches reading as one long run. */\n#timeline li.sep { cursor: default; padding: 10px 10px 4px; display: flex; gap: 7px;\n  align-items: center; font-size: 11px; letter-spacing: .06em; text-transform: uppercase;\n  color: var(--dim); border-left-color: transparent; }\n#timeline li.sep:hover { background: none; }\n#timeline li.sep .dot { width: 8px; height: 8px; border-radius: 2px;\n  background: var(--bc, var(--dim)); }\n/* The group header shouts in uppercase; its elapsed time should not. */\n#timeline li.sep .dur { text-transform: none; letter-spacing: 0; }\n/* The branch the join actually waited for. */\n#timeline li.sep.slow { background: #232a38; color: var(--fg); }\n#timeline li.sep.slow .dur { color: var(--fg); }\n#timeline li.branch { padding-left: 20px; border-left-color: var(--bc, var(--line)); }\n#timeline li.branch.sel { border-left-color: var(--bc, var(--accent)); }\n#middle { display: flex; flex-direction: column; overflow: hidden; }\n.tabs { display: flex; gap: 4px; padding: 8px 12px; border-bottom: 1px solid var(--line); }\n.tabs button { background: none; border: 1px solid transparent; color: var(--dim);\n  padding: 4px 12px; border-radius: 6px; cursor: pointer; font-size: 13px; }\n.tabs button.on { color: var(--fg); background: var(--panel); border-color: var(--line); }\n#detail { overflow: auto; padding: 16px; flex: 1; }\n#stats { overflow: auto; padding: 16px; flex: 1; }\ntable.st { width: 100%; border-collapse: collapse; font: 12px var(--mono); }\ntable.st th { text-align: right; color: var(--dim); font-weight: 600; padding: 6px 12px;\n  border-bottom: 1px solid var(--line); white-space: nowrap; }\ntable.st td { text-align: right; padding: 5px 12px; border-bottom: 1px solid #1d2230;\n  white-space: nowrap; }\ntable.st th:first-child, table.st td:first-child { text-align: left; }\ntable.st tbody tr:hover { background: #1c2130; }\ntable.st tbody tr:last-child td { border-bottom: none; }\n/* The total is a different kind of row, not one more of the same: it gets its\n   own band so nobody reads it as another model or another agent. */\ntable.st tfoot td { color: var(--fg); font-weight: 600; background: #191e2a;\n  border-top: 1px solid #2b3346; border-bottom: none; padding: 7px 12px; }\ntable.st tfoot td:first-child { color: var(--dim); text-transform: uppercase;\n  letter-spacing: .07em; font-size: 11px; }\n/* Two panes hold a zoomable diagram (the run graph and the architecture), so\n   everything about one is written for both. */\n.pane { display: flex; flex-direction: column; overflow: hidden; flex: 1; }\n/* An explicit display on the pane would otherwise beat the hidden attribute\n   and both views would show at once. */\n.pane[hidden], #detail[hidden], #stats[hidden] { display: none; }\n.pane svg { max-width: none; display: block; }\n.pane .node { cursor: pointer; }\n/* A node with nothing behind it in this run is not clickable, and says so. */\n.pane .node.idle { cursor: default; }\n.gtools { display: flex; align-items: center; gap: 6px; padding: 6px 10px;\n  border-bottom: 1px solid var(--line); background: var(--panel); }\n.gtools button { background: var(--bg); border: 1px solid var(--line); color: var(--fg);\n  border-radius: 6px; padding: 2px 10px; cursor: pointer; font: 12px var(--mono); }\n.gtools button:hover { border-color: var(--accent); }\n.gtools .hint:first-of-type { margin-left: 8px; }\n.gtools .lvl { margin-left: auto; font-family: var(--mono); }\n.gtools label.check { display: flex; align-items: center; gap: 5px; margin-left: 8px;\n  color: var(--dim); font-size: 12px; cursor: pointer; user-select: none; }\n/* The memory view reads left to right: the graph is the index, the panel is\n   the page. Putting the body under a tab of its own would mean losing the\n   picture every time you asked what a node actually says. */\n#memory .split { display: flex; flex: 1; overflow: hidden; }\n#mdetail { width: 380px; flex: none; padding: 16px; overflow: auto;\n  border-right: none; border-left: 1px solid var(--line); }\n#mdetail .dt { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin: 0 0 10px; }\n#mdetail .idrow { display: flex; gap: 8px; align-items: center; margin: 0 0 14px; }\n#mdetail .idrow code { flex: 1; min-width: 0; font: 12px var(--mono); color: var(--fg);\n  background: var(--bg); border: 1px solid var(--line); border-radius: 6px;\n  padding: 4px 8px; word-break: break-all; }\n#mdetail .idrow button { flex: 0 0 auto; background: var(--bg); border: 1px solid var(--line);\n  color: var(--dim); border-radius: 6px; padding: 4px 9px; font: 11px var(--mono);\n  cursor: pointer; }\n#mdetail .idrow button:hover { border-color: var(--accent); color: var(--fg); }\n#mdetail dl.props { display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 5px 14px;\n  margin: 0 0 14px; font: 12px var(--mono); }\n#mdetail dl.props dt { color: var(--dim); }\n#mdetail dl.props dd { margin: 0; word-break: break-word; }\n/* A block that shares the panel's own background has no edges to show. */\n#mdetail section.blk { background: var(--bg); }\n#mdetail ul.links { list-style: none; margin: 0; padding: 0; }\n#mdetail ul.links li { display: grid; grid-template-columns: 96px auto minmax(0, 1fr);\n  gap: 8px; align-items: baseline; padding: 6px 12px; }\n#mdetail ul.links li + li { border-top: 1px solid var(--line); }\n#mdetail ul.links .rel { font: 11px var(--mono); color: var(--warn); white-space: nowrap; }\n#mdetail button.link { font: 12px/1.4 system-ui, sans-serif; padding: 0; text-align: left;\n  overflow-wrap: anywhere; }\n#mdetail button.link:hover { text-decoration: underline; }\n#mcount .ok { color: var(--ok); }\n#mcount .bad { color: var(--err); }\n/* The kind palette is the memory page's, so a node reads the same in both. */\n.kind { font-size: 11px; letter-spacing: .04em; text-transform: uppercase;\n  padding: 1px 6px; border-radius: 4px; background: #232a38; color: var(--dim); }\n.kind.task { background: #1e3357; color: #9dc1ff; }\n.kind.plan { background: #3a2450; color: #d1a6ff; }\n.kind.fact { background: #14392c; color: #8ee0c2; }\n.kind.snippet { background: #1e3d33; color: #8ee0c2; }\n.kind.file { background: #40331a; color: #f0dfb4; }\n.kind.operation { background: #3d2a1b; color: #f2d9c2; }\n.kind.preference { background: #3d1f2c; color: #f5b8cd; }\n/* Selection is a class rather than attributes written onto the shapes: the\n   previous pick has to lose its outline without a redraw. White, because the\n   accent already means \"the recall matched this one\". */\n#memory .node.picked rect, #memory .node.picked polygon,\n#memory .node.picked path, #memory .node.picked circle {\n  stroke: var(--fg) !important; stroke-width: 4px !important; }\n/* The canvas is transformed, not scrolled: panning has to work past the edges\n   of the diagram, which overflow:auto would forbid. */\n.viewport { flex: 1; overflow: hidden; position: relative; cursor: grab; touch-action: none;\n  user-select: none; -webkit-user-select: none; }\n.viewport.drag { cursor: grabbing; }\n.canvas { position: absolute; top: 0; left: 0; transform-origin: 0 0; }\n.hint { color: var(--dim); font-size: 12px; }\n.hint.pad { padding: 16px; }\n.type { font-size: 11px; letter-spacing: .04em; text-transform: uppercase;\n  padding: 1px 6px; border-radius: 4px; background: #232a38; color: var(--dim); }\n.type.llm_call { background: #1e3357; color: #9dc1ff; }\n.type.tool_call, .type.tool_result { background: #1e3d33; color: #8ee0c2; }\n.type.compaction { background: #40331a; color: var(--warn); }\n.type.fork, .type.join { background: #3a2450; color: #d1a6ff; }\n.type.final_output { background: #14392c; color: var(--ok); }\n.type.err { background: #4a1f1c; color: var(--err); }\nh2.dt { font-size: 16px; margin: 0 0 4px; display: flex; gap: 10px; align-items: center; }\n.meta { color: var(--dim); font-size: 12px; font-family: var(--mono); margin-bottom: 14px;\n  display: flex; flex-wrap: wrap; gap: 4px 14px; }\nsection.blk { border: 1px solid var(--line); border-radius: 8px; margin-bottom: 12px;\n  background: var(--panel); overflow: hidden; }\nsection.blk > h3 { margin: 0; padding: 7px 12px; font-size: 12px; font-weight: 600;\n  color: var(--dim); border-bottom: 1px solid var(--line); letter-spacing: .03em; }\nsection.blk > h3 .tag { float: right; font-weight: 400; }\nsection.blk.sys { border-left: 3px solid var(--warn); }\n/* An LLM call has three things a reader wants to tell apart at a glance: what\n   went in, what came back, and what it cost. Groups carry the first two. */\n.group { border: 1px solid var(--line); border-radius: 10px; margin-bottom: 14px;\n  background: #12151d; overflow: hidden; }\n.group > .ghdr { display: flex; align-items: center; gap: 10px; padding: 8px 12px;\n  font-size: 11px; font-weight: 700; letter-spacing: .09em; text-transform: uppercase;\n  background: #1b2130; border-bottom: 1px solid var(--line); }\n.group > .ghdr .tag { margin-left: auto; font: 11px var(--mono); font-weight: 400;\n  letter-spacing: 0; text-transform: none; color: var(--dim); }\n.group > .body { padding: 10px; }\n.group > .body > .blk:last-child { margin-bottom: 0; }\n.group.req { border-left: 3px solid var(--accent); }\n.group.req > .ghdr { color: #9dc1ff; }\n.group.res { border-left: 3px solid var(--ok); }\n.group.res > .ghdr { color: #8ee0c2; }\n.stats { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 14px; }\n.stat { background: var(--panel); border: 1px solid var(--line); border-radius: 999px;\n  padding: 3px 12px; font: 12px var(--mono); color: var(--dim); }\n.stat b { color: var(--fg); font-weight: 600; }\npre { margin: 0; padding: 10px 12px; font: 12px/1.55 var(--mono); white-space: pre-wrap;\n  word-break: break-word; overflow-wrap: anywhere; }\npre.text { white-space: pre-wrap; }\n/* Section tags inside a prompt (<house_rules src=\"...\">, <role>, ...): the only\n   structure a composed prompt has, and invisible without this. */\npre .xtag { color: #ffb0cd; background: #2d1b27; border: 1px solid #4e2c40;\n  border-radius: 4px; padding: 0 4px; font-weight: 600; }\npre .xtag.end { color: #a07f92; background: #201a1e; border-color: #3b2b35;\n  font-weight: 400; }\nimg.media { display: block; max-width: 100%; max-height: 420px; margin: 10px 12px;\n  border: 1px solid var(--line); border-radius: 6px; background: #0d1017; }\nimg.media.thumb { max-height: 88px; margin: 8px 12px; cursor: zoom-in; }\n.msg { border-top: 1px solid var(--line); border-left: 3px solid transparent; }\n.msg:first-of-type { border-top: none; }\n.msg > .role { padding: 5px 12px; font-size: 11px; text-transform: uppercase;\n  letter-spacing: .05em; color: var(--dim); background: #1b202c;\n  display: flex; justify-content: space-between; }\n.msg.user > .role { color: #9dc1ff; }\n.msg.user { border-left-color: #35507f; }\n.msg.assistant > .role { color: #c3a6ff; }\n.msg.assistant { border-left-color: #5a4380; }\n.msg.tool > .role { color: #8ee0c2; }\n.msg.tool { border-left-color: #2f6b58; }\n.msg.system > .role { color: var(--warn); }\n.msg.system { border-left-color: #7a6535; }\n.msg.err > .role { color: var(--err); }\n.msg.err { border-left-color: #8a3a33; }\n.call { border-top: 1px dashed var(--line); }\n.call .name { padding: 5px 12px; font: 12px var(--mono); color: #8ee0c2; }\ndetails > summary { cursor: pointer; padding: 6px 12px; color: var(--dim); font-size: 12px; }\n.badge { font: 11px var(--mono); color: var(--dim); }\n.badge.ok { color: var(--ok); } .badge.bad { color: var(--err); }\n.empty { padding: 10px 12px; color: var(--dim); font-size: 12px; font-style: italic; }\nbutton.link { background: none; border: none; color: var(--accent); cursor: pointer;\n  font: 12px var(--mono); padding: 0 6px 0 0; }\n";
+export declare const CSS = "\n:root {\n  --bg: #0f1115; --panel: #161922; --line: #262b36; --fg: #d7dbe3; --dim: #8a92a6;\n  --accent: #6ea8fe; --ok: #4ec9a0; --err: #f0776c; --warn: #e2b341; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;\n}\n* { box-sizing: border-box; }\nbody { margin: 0; background: var(--bg); color: var(--fg);\n  font: 14px/1.5 system-ui, -apple-system, Segoe UI, sans-serif; }\nheader { padding: 12px 16px; border-bottom: 1px solid var(--line); background: var(--panel);\n  display: flex; flex-wrap: wrap; gap: 8px 20px; align-items: baseline; }\nheader h1 { font-size: 15px; margin: 0 12px 0 0; font-weight: 600; }\nheader .kv { color: var(--dim); font-size: 12px; }\nheader .kv b { color: var(--fg); font-weight: 600; }\nmain { display: grid; grid-template-columns: 340px 1fr; height: calc(100vh - 49px); }\naside { border-right: 1px solid var(--line); overflow: auto; background: var(--panel); }\n.pad { padding: 10px; position: sticky; top: 0; background: var(--panel); border-bottom: 1px solid var(--line); }\n#filter { width: 100%; padding: 6px 8px; background: var(--bg); color: var(--fg);\n  border: 1px solid var(--line); border-radius: 6px; }\n#timeline { list-style: none; margin: 0; padding: 4px 0; }\n#timeline li { padding: 6px 10px; border-left: 3px solid transparent; cursor: pointer; }\n#timeline li:hover { background: #1c2130; }\n#timeline li.sel { background: #1f2637; border-left-color: var(--accent); }\n#timeline li.covered { opacity: .45; }\n#timeline .row { display: flex; gap: 6px; align-items: baseline; }\n#timeline .t { color: var(--fg); font: 11px var(--mono); min-width: 38px; text-align: right; }\n#timeline .t.same { color: #3d4453; }\n#timeline .dur { margin-left: auto; color: var(--dim); font: 11px var(--mono); }\n#timeline .idx { color: var(--dim); font: 11px var(--mono); min-width: 22px; }\n#timeline .prev { color: var(--dim); font-size: 11px; white-space: nowrap;\n  overflow: hidden; text-overflow: ellipsis; padding-left: 44px; }\n/* Branch histories are contiguous in this list, so a coloured edge plus a\n   header is enough to stop ten parallel branches reading as one long run. */\n#timeline li.sep { cursor: default; padding: 10px 10px 4px; display: flex; gap: 7px;\n  align-items: center; font-size: 11px; letter-spacing: .06em; text-transform: uppercase;\n  color: var(--dim); border-left-color: transparent; }\n#timeline li.sep:hover { background: none; }\n#timeline li.sep .dot { width: 8px; height: 8px; border-radius: 2px;\n  background: var(--bc, var(--dim)); }\n/* The group header shouts in uppercase; its elapsed time should not. */\n#timeline li.sep .dur { text-transform: none; letter-spacing: 0; }\n/* The branch the join actually waited for. */\n#timeline li.sep.slow { background: #232a38; color: var(--fg); }\n#timeline li.sep.slow .dur { color: var(--fg); }\n#timeline li.branch { padding-left: 20px; border-left-color: var(--bc, var(--line)); }\n#timeline li.branch.sel { border-left-color: var(--bc, var(--accent)); }\n#middle { display: flex; flex-direction: column; overflow: hidden; }\n.tabs { display: flex; gap: 4px; padding: 8px 12px; border-bottom: 1px solid var(--line); }\n.tabs button { background: none; border: 1px solid transparent; color: var(--dim);\n  padding: 4px 12px; border-radius: 6px; cursor: pointer; font-size: 13px; }\n.tabs button.on { color: var(--fg); background: var(--panel); border-color: var(--line); }\n#detail { overflow: auto; padding: 16px; flex: 1; }\n#stats { overflow: auto; padding: 16px; flex: 1; }\ntable.st { width: 100%; border-collapse: collapse; font: 12px var(--mono); }\ntable.st th { text-align: right; color: var(--dim); font-weight: 600; padding: 6px 12px;\n  border-bottom: 1px solid var(--line); white-space: nowrap; }\ntable.st td { text-align: right; padding: 5px 12px; border-bottom: 1px solid #1d2230;\n  white-space: nowrap; }\ntable.st th:first-child, table.st td:first-child { text-align: left; }\ntable.st tbody tr:hover { background: #1c2130; }\ntable.st tbody tr:last-child td { border-bottom: none; }\n/* The total is a different kind of row, not one more of the same: it gets its\n   own band so nobody reads it as another model or another agent. */\ntable.st tfoot td { color: var(--fg); font-weight: 600; background: #191e2a;\n  border-top: 1px solid #2b3346; border-bottom: none; padding: 7px 12px; }\ntable.st tfoot td:first-child { color: var(--dim); text-transform: uppercase;\n  letter-spacing: .07em; font-size: 11px; }\n/* Two panes hold a zoomable diagram (the run graph and the architecture), so\n   everything about one is written for both. */\n.pane { display: flex; flex-direction: column; overflow: hidden; flex: 1; }\n/* An explicit display on the pane would otherwise beat the hidden attribute\n   and both views would show at once. */\n.pane[hidden], #detail[hidden], #stats[hidden] { display: none; }\n.pane svg { max-width: none; display: block; }\n.pane .node { cursor: pointer; }\n/* A node with nothing behind it in this run is not clickable, and says so. */\n.pane .node.idle { cursor: default; }\n.gtools { display: flex; align-items: center; gap: 6px; padding: 6px 10px;\n  border-bottom: 1px solid var(--line); background: var(--panel); }\n.gtools button { background: var(--bg); border: 1px solid var(--line); color: var(--fg);\n  border-radius: 6px; padding: 2px 10px; cursor: pointer; font: 12px var(--mono); }\n.gtools button:hover { border-color: var(--accent); }\n.gtools .hint:first-of-type { margin-left: 8px; }\n.gtools .lvl { margin-left: auto; font-family: var(--mono); }\n.gtools label.check { display: flex; align-items: center; gap: 5px; margin-left: 8px;\n  color: var(--dim); font-size: 12px; cursor: pointer; user-select: none; }\n/* The memory view reads left to right: the graph is the index, the panel is\n   the page. Putting the body under a tab of its own would mean losing the\n   picture every time you asked what a node actually says. */\n#memory .split { display: flex; flex: 1; overflow: hidden; }\n#mdetail { width: 380px; flex: none; padding: 16px; overflow: auto;\n  border-right: none; border-left: 1px solid var(--line); }\n#mdetail .dt { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin: 0 0 10px; }\n#mdetail .idrow { display: flex; gap: 8px; align-items: center; margin: 0 0 14px; }\n#mdetail .idrow code { flex: 1; min-width: 0; font: 12px var(--mono); color: var(--fg);\n  background: var(--bg); border: 1px solid var(--line); border-radius: 6px;\n  padding: 4px 8px; word-break: break-all; }\n#mdetail .idrow button { flex: 0 0 auto; background: var(--bg); border: 1px solid var(--line);\n  color: var(--dim); border-radius: 6px; padding: 4px 9px; font: 11px var(--mono);\n  cursor: pointer; }\n#mdetail .idrow button:hover { border-color: var(--accent); color: var(--fg); }\n#mdetail dl.props { display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 5px 14px;\n  margin: 0 0 14px; font: 12px var(--mono); }\n#mdetail dl.props dt { color: var(--dim); }\n#mdetail dl.props dd { margin: 0; word-break: break-word; }\n/* A block that shares the panel's own background has no edges to show. */\n#mdetail section.blk { background: var(--bg); }\n#mdetail ul.links { list-style: none; margin: 0; padding: 0; }\n#mdetail ul.links li { display: grid; grid-template-columns: 96px auto minmax(0, 1fr);\n  gap: 8px; align-items: baseline; padding: 6px 12px; }\n#mdetail ul.links li + li { border-top: 1px solid var(--line); }\n#mdetail ul.links .rel { font: 11px var(--mono); color: var(--warn); white-space: nowrap; }\n#mdetail button.link { font: 12px/1.4 system-ui, sans-serif; padding: 0; text-align: left;\n  overflow-wrap: anywhere; }\n#mdetail button.link:hover { text-decoration: underline; }\n#mcount .ok { color: var(--ok); }\n#mcount .bad { color: var(--err); }\n/* The kind palette is the memory page's, so a node reads the same in both. */\n.kind { font-size: 11px; letter-spacing: .04em; text-transform: uppercase;\n  padding: 1px 6px; border-radius: 4px; background: #232a38; color: var(--dim); }\n.kind.task { background: #1e3357; color: #9dc1ff; }\n.kind.plan { background: #3a2450; color: #d1a6ff; }\n.kind.fact { background: #14392c; color: #8ee0c2; }\n.kind.snippet { background: #1e3d33; color: #8ee0c2; }\n.kind.file { background: #40331a; color: #f0dfb4; }\n.kind.operation { background: #3d2a1b; color: #f2d9c2; }\n.kind.preference { background: #3d1f2c; color: #f5b8cd; }\n/* Selection is a class rather than attributes written onto the shapes: the\n   previous pick has to lose its outline without a redraw. White, because the\n   accent already means \"the recall matched this one\". */\n#memory .node.picked rect, #memory .node.picked polygon,\n#memory .node.picked path, #memory .node.picked circle {\n  stroke: var(--fg) !important; stroke-width: 4px !important; }\n/* The canvas is transformed, not scrolled: panning has to work past the edges\n   of the diagram, which overflow:auto would forbid. */\n.viewport { flex: 1; overflow: hidden; position: relative; cursor: grab; touch-action: none;\n  user-select: none; -webkit-user-select: none; }\n.viewport.drag { cursor: grabbing; }\n.canvas { position: absolute; top: 0; left: 0; transform-origin: 0 0; }\n.hint { color: var(--dim); font-size: 12px; }\n.hint.pad { padding: 16px; }\n.type { font-size: 11px; letter-spacing: .04em; text-transform: uppercase;\n  padding: 1px 6px; border-radius: 4px; background: #232a38; color: var(--dim); }\n.type.llm_call { background: #1e3357; color: #9dc1ff; }\n.type.tool_call, .type.tool_result { background: #1e3d33; color: #8ee0c2; }\n.type.compaction { background: #40331a; color: var(--warn); }\n.type.fork, .type.join { background: #3a2450; color: #d1a6ff; }\n.type.final_output { background: #14392c; color: var(--ok); }\n.type.err { background: #4a1f1c; color: var(--err); }\nh2.dt { font-size: 16px; margin: 0 0 4px; display: flex; gap: 10px; align-items: center; }\n.meta { color: var(--dim); font-size: 12px; font-family: var(--mono); margin-bottom: 14px;\n  display: flex; flex-wrap: wrap; gap: 4px 14px; }\nsection.blk { border: 1px solid var(--line); border-radius: 8px; margin-bottom: 12px;\n  background: var(--panel); overflow: hidden; }\nsection.blk > h3 { margin: 0; padding: 7px 12px; font-size: 12px; font-weight: 600;\n  color: var(--dim); border-bottom: 1px solid var(--line); letter-spacing: .03em; }\nsection.blk > h3 .tag { float: right; font-weight: 400; }\nsection.blk.sys { border-left: 3px solid var(--warn); }\n/* An LLM call has three things a reader wants to tell apart at a glance: what\n   went in, what came back, and what it cost. Groups carry the first two. */\n.group { border: 1px solid var(--line); border-radius: 10px; margin-bottom: 14px;\n  background: #12151d; overflow: hidden; }\n.group > .ghdr { display: flex; align-items: center; gap: 10px; padding: 8px 12px;\n  font-size: 11px; font-weight: 700; letter-spacing: .09em; text-transform: uppercase;\n  background: #1b2130; border-bottom: 1px solid var(--line); }\n.group > .ghdr .tag { margin-left: auto; font: 11px var(--mono); font-weight: 400;\n  letter-spacing: 0; text-transform: none; color: var(--dim); }\n.group > .body { padding: 10px; }\n.group > .body > .blk:last-child { margin-bottom: 0; }\n.group.req { border-left: 3px solid var(--accent); }\n.group.req > .ghdr { color: #9dc1ff; }\n.group.res { border-left: 3px solid var(--ok); }\n.group.res > .ghdr { color: #8ee0c2; }\n.stats { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 14px; }\n.stat { background: var(--panel); border: 1px solid var(--line); border-radius: 999px;\n  padding: 3px 12px; font: 12px var(--mono); color: var(--dim); }\n.stat b { color: var(--fg); font-weight: 600; }\npre { margin: 0; padding: 10px 12px; font: 12px/1.55 var(--mono); white-space: pre-wrap;\n  word-break: break-word; overflow-wrap: anywhere; }\npre.text { white-space: pre-wrap; }\n.tagged-pre { margin: 4px 0; }\n.tagged-pre > pre.text { margin: 0; padding: 6px 12px; }\n/* Section tags inside a prompt (<house_rules src=\"...\">, <role>, ...): the only\n   structure a composed prompt has, and invisible without this. */\n.xtag { color: #ffb0cd; background: #2d1b27; border: 1px solid #4e2c40;\n  border-radius: 4px; padding: 1px 5px; font-weight: 600; font: 12px var(--mono); }\n.xtag.end { color: #a07f92; background: #201a1e; border-color: #3b2b35;\n  font-weight: 400; }\ndetails.xtag-section {\n  border: 1px solid var(--line); border-radius: 6px; margin: 6px 12px;\n  background: var(--panel);\n}\ndetails.xtag-section > summary {\n  cursor: pointer; padding: 6px 10px; font: 12px/1.55 var(--mono);\n  color: var(--dim); white-space: nowrap; overflow: hidden;\n  text-overflow: ellipsis; user-select: none;\n}\ndetails.xtag-section > summary:hover { background: rgba(255, 255, 255, 0.03); }\ndetails.xtag-section > summary .preview {\n  color: var(--dim); margin-left: 8px; font-size: 11px;\n}\ndetails.xtag-section[open] > summary {\n  white-space: normal; border-bottom: 1px solid var(--line);\n  background: rgba(0, 0, 0, 0.15);\n}\ndetails.xtag-section[open] > summary .preview { display: none; }\ndetails.xtag-section > pre.xtag-body {\n  margin: 0; padding: 8px 12px 10px; background: #0d1017;\n  border-radius: 0 0 5px 5px; font: 12px/1.55 var(--mono);\n  white-space: pre-wrap; word-break: break-word; overflow-wrap: anywhere;\n}\nimg.media { display: block; max-width: 100%; max-height: 420px; margin: 10px 12px;\n  border: 1px solid var(--line); border-radius: 6px; background: #0d1017; }\nimg.media.thumb { max-height: 88px; margin: 8px 12px; cursor: zoom-in; }\n.msg { border-top: 1px solid var(--line); border-left: 3px solid transparent; }\n.msg:first-of-type { border-top: none; }\n.msg > .role { padding: 5px 12px; font-size: 11px; text-transform: uppercase;\n  letter-spacing: .05em; color: var(--dim); background: #1b202c;\n  display: flex; justify-content: space-between; }\n.msg.user > .role { color: #9dc1ff; }\n.msg.user { border-left-color: #35507f; }\n.msg.assistant > .role { color: #c3a6ff; }\n.msg.assistant { border-left-color: #5a4380; }\n.msg.tool > .role { color: #8ee0c2; }\n.msg.tool { border-left-color: #2f6b58; }\n.msg.system > .role { color: var(--warn); }\n.msg.system { border-left-color: #7a6535; }\n.msg.err > .role { color: var(--err); }\n.msg.err { border-left-color: #8a3a33; }\n.call { border-top: 1px dashed var(--line); }\n.call .name { padding: 5px 12px; font: 12px var(--mono); color: #8ee0c2; }\ndetails > summary { cursor: pointer; padding: 6px 12px; color: var(--dim); font-size: 12px; }\n.badge { font: 11px var(--mono); color: var(--dim); }\n.badge.ok { color: var(--ok); } .badge.bad { color: var(--err); }\n.empty { padding: 10px 12px; color: var(--dim); font-size: 12px; font-style: italic; }\nbutton.link { background: none; border: none; color: var(--accent); cursor: pointer;\n  font: 12px var(--mono); padding: 0 6px 0 0; }\n";
 //# sourceMappingURL=css.d.ts.map

package/dist/inspect/css.js

@@ -183,12 +183,37 @@ section.blk.sys { border-left: 3px solid var(--warn); }
 pre { margin: 0; padding: 10px 12px; font: 12px/1.55 var(--mono); white-space: pre-wrap;
   word-break: break-word; overflow-wrap: anywhere; }
 pre.text { white-space: pre-wrap; }
+.tagged-pre { margin: 4px 0; }
+.tagged-pre > pre.text { margin: 0; padding: 6px 12px; }
 /* Section tags inside a prompt (<house_rules src="...">, <role>, ...): the only
    structure a composed prompt has, and invisible without this. */
-pre .xtag { color: #ffb0cd; background: #2d1b27; border: 1px solid #4e2c40;
-  border-radius: 4px; padding: 0 4px; font-weight: 600; }
-pre .xtag.end { color: #a07f92; background: #201a1e; border-color: #3b2b35;
+.xtag { color: #ffb0cd; background: #2d1b27; border: 1px solid #4e2c40;
+  border-radius: 4px; padding: 1px 5px; font-weight: 600; font: 12px var(--mono); }
+.xtag.end { color: #a07f92; background: #201a1e; border-color: #3b2b35;
   font-weight: 400; }
+details.xtag-section {
+  border: 1px solid var(--line); border-radius: 6px; margin: 6px 12px;
+  background: var(--panel);
+}
+details.xtag-section > summary {
+  cursor: pointer; padding: 6px 10px; font: 12px/1.55 var(--mono);
+  color: var(--dim); white-space: nowrap; overflow: hidden;
+  text-overflow: ellipsis; user-select: none;
+}
+details.xtag-section > summary:hover { background: rgba(255, 255, 255, 0.03); }
+details.xtag-section > summary .preview {
+  color: var(--dim); margin-left: 8px; font-size: 11px;
+}
+details.xtag-section[open] > summary {
+  white-space: normal; border-bottom: 1px solid var(--line);
+  background: rgba(0, 0, 0, 0.15);
+}
+details.xtag-section[open] > summary .preview { display: none; }
+details.xtag-section > pre.xtag-body {
+  margin: 0; padding: 8px 12px 10px; background: #0d1017;
+  border-radius: 0 0 5px 5px; font: 12px/1.55 var(--mono);
+  white-space: pre-wrap; word-break: break-word; overflow-wrap: anywhere;
+}
 img.media { display: block; max-width: 100%; max-height: 420px; margin: 10px 12px;
   border: 1px solid var(--line); border-radius: 6px; background: #0d1017; }
 img.media.thumb { max-height: 88px; margin: 8px 12px; cursor: zoom-in; }

package/dist/kernel.js

@@ -378,11 +378,32 @@ export async function applySystemPrompt(state, reg, env) {
 }
 function parseForkArgs(raw) {
     const args = parseArgs(raw);
-    const branches = args.branches;
+    let branches = args.branches;
+    // When a model delegates a single task, it frequently flattens the branch
+    // fields directly into the root arguments instead of wrapping them in a
+    // 1-element array. Coerce it if name and instructions are present at the root.
+    if (!Array.isArray(branches) &&
+        typeof args.name === 'string' &&
+        typeof args.instructions === 'string') {
+        branches = [
+            {
+                name: args.name,
+                instructions: args.instructions,
+                agent: typeof args.agent === 'string' ? args.agent : undefined,
+            },
+        ];
+    }
     // Spelled out rather than "invalid arguments": this string is fed back to
     // the model as the tool result, and it is the only chance it gets to work
     // out what to do differently.
     if (!Array.isArray(branches) || branches.length === 0) {
+        if (args.name !== undefined ||
+            args.instructions !== undefined ||
+            args.agent !== undefined) {
+            return ('the "branches" argument is missing; "fork" requires an array of branches: ' +
+                '{ "branches": [{ "name": "...", "instructions": "...", "agent": "..." }] }. ' +
+                'Do not pass branch fields at the top level.');
+        }
         return 'the "branches" argument is missing or empty; it must be an array of at least one branch';
     }
     const parsed = [];

package/dist/memory/files.d.ts

@@ -8,6 +8,8 @@ export declare const MEMORY_MOUNT = "/memory";
 export declare const MAX_FILE_BYTES: number;
 export interface RememberOptions {
     maxBytes?: number;
+    /** Display path as passed to the tool, for reporting errors without leaking the host filesystem */
+    path?: string;
 }
 /**
  * Copy `source` into the memory directory under `id` and describe it.

package/dist/memory/files.js

@@ -35,23 +35,24 @@ const MAX_FORMAT_LEN = 16;
  */
 export async function rememberFile(dir, source, id, opts = {}) {
     const maxBytes = opts.maxBytes ?? MAX_FILE_BYTES;
-    const info = await describe(source);
+    const name = opts.path ?? source;
+    const info = await describe(source, name);
     if (!info.isFile()) {
-        throw new MemoryError(`${source} is not a regular file`, 'only files can be remembered; write a `fact` node describing a directory instead');
+        throw new MemoryError(`${name} is not a regular file`, 'only files can be remembered; write a `fact` node describing a directory instead');
     }
     if (info.size > maxBytes) {
-        throw new MemoryError(`${source} is ${info.size} bytes, over the ${maxBytes} byte limit for a remembered file`, 'keep the artifact in the workspace and remember a `snippet` of the part that matters');
+        throw new MemoryError(`${name} is ${info.size} bytes, over the ${maxBytes} byte limit for a remembered file`, 'keep the artifact in the workspace and remember a `snippet` of the part that matters');
     }
     const bytes = await readFile(source);
     if (bytes.byteLength > maxBytes) {
-        throw new MemoryError(`${source} grew past the ${maxBytes} byte limit while being read`);
+        throw new MemoryError(`${name} grew past the ${maxBytes} byte limit while being read`);
     }
     const format = formatOf(source);
-    const name = id + (format ? `.${format}` : '');
+    const fileName = id + (format ? `.${format}` : '');
     await mkdir(join(dir, FILES_DIR), { recursive: true });
-    await writeFile(join(dir, FILES_DIR, name), bytes);
+    await writeFile(join(dir, FILES_DIR, fileName), bytes);
     return {
-        path: `${MEMORY_MOUNT}/${name}`,
+        path: `${MEMORY_MOUNT}/${fileName}`,
         bytes: bytes.byteLength,
         sha256: createHash('sha256').update(bytes).digest('hex'),
         format,
@@ -66,12 +67,12 @@ export function hostPath(dir, file) {
 export async function forgetFile(dir, file) {
     await rm(hostPath(dir, file), { force: true });
 }
-async function describe(source) {
+async function describe(source, name = source) {
     try {
         return await stat(source);
     }
     catch {
-        throw new MemoryError(`${source} does not exist`, 'remember a file the run actually wrote, by the path the file tools use');
+        throw new MemoryError(`${name} does not exist`, 'remember a file the run actually wrote, by the path the file tools use');
     }
 }
 /**

package/dist/memory/index.d.ts

@@ -31,6 +31,7 @@ export interface CommitNode {
     /** absolute host path of a file to copy in, already resolved by the caller */
     file?: {
         source: string;
+        path?: string;
     };
     expectedRevision?: number;
 }

package/dist/memory/index.js

@@ -111,7 +111,9 @@ export class MemoryIndex {
         const written = [];
         try {
             for (const item of plan.files) {
-                const file = await rememberFile(this.store.dir, item.source, item.id);
+                const file = await rememberFile(this.store.dir, item.source, item.id, {
+                    path: item.path,
+                });
                 written.push(file);
                 item.target.file = file;
             }
@@ -239,20 +241,41 @@ export class MemoryIndex {
         const files = [];
         const embed = [];
         for (const [i, node] of nodes.entries()) {
-            const where = node.ref ?? node.id ?? `nodes[${i}]`;
-            if ((node.ref === undefined) === (node.id === undefined)) {
+            let ref = node.ref;
+            let id = node.id;
+            const where = ref ?? id ?? `nodes[${i}]`;
+            // If the model passed both ref and id with the same value (e.g. ref: "x", id: "x"),
+            // and id is not an existing node, treat it as a new node create.
+            if (ref !== undefined && id !== undefined) {
+                if (ref === id && !this.graph.has(id)) {
+                    id = undefined;
+                }
+                else {
+                    throw new MemoryError(`${where}: give either a ref (to create) or an id (to update), not both`);
+                }
+            }
+            else if (ref === undefined &&
+                id !== undefined &&
+                !this.graph.has(id) &&
+                (node.kind !== undefined || (node.text !== undefined && node.text.trim()))) {
+                // Models often assign "id" to new nodes instead of "ref". If the id does not
+                // match an existing node in memory, treat it as the local ref for creation.
+                ref = id;
+                id = undefined;
+            }
+            if (ref === undefined && id === undefined) {
                 throw new MemoryError(`${where}: give either a ref (to create) or an id (to update), not both`);
             }
             const audience = this.#audience(node, opts.writes, where);
-            if (node.id) {
-                const existing = this.graph.get(node.id);
+            if (id) {
+                const existing = this.graph.get(id);
                 if (!existing) {
                     throw new MemoryError(`${where}: no such memory`);
                 }
                 if (node.kind !== undefined) {
                     this.#kind(node.kind, where);
                 }
-                ids[node.id] = node.id;
+                ids[id] = id;
                 const patch = {
                     ...(node.kind !== undefined ? { kind: node.kind } : {}),
                     ...(node.text !== undefined ? { text: node.text } : {}),
@@ -262,18 +285,22 @@ export class MemoryIndex {
                         ? { expectedRevision: node.expectedRevision }
                         : {}),
                 };
-                planned.push({ existing: true, id: node.id, patch });
+                planned.push({ existing: true, id, patch });
                 // Only a text change invalidates the vector; re-embedding on an
                 // audience edit would burn a call to store the same numbers.
                 if (node.text !== undefined && node.text !== existing.text) {
-                    embed.push({ id: node.id, text: node.text });
+                    embed.push({ id, text: node.text });
                 }
                 if (node.file) {
-                    files.push({ id: node.id, source: node.file.source, target: patch });
+                    files.push({
+                        id,
+                        source: node.file.source,
+                        path: node.file.path,
+                        target: patch,
+                    });
                 }
                 continue;
             }
-            const ref = node.ref;
             if (ref in ids) {
                 throw new MemoryError(`${where}: two nodes share the ref "${ref}"`);
             }
@@ -281,19 +308,24 @@ export class MemoryIndex {
                 throw new MemoryError(`${where}: a new node needs text`, 'text is the only thing a search can match, so it has to describe the node');
             }
             const kind = this.#kind(node.kind, where);
-            const id = opts.clock.newId();
-            ids[ref] = id;
+            const newId = opts.clock.newId();
+            ids[ref] = newId;
             const draft = {
-                id,
+                id: newId,
                 kind,
                 text: node.text,
                 audience: audience ?? [ALL_AGENTS],
                 ...(node.metadata !== undefined ? { metadata: node.metadata } : {}),
             };
-            planned.push({ existing: false, id, draft });
-            embed.push({ id, text: node.text });
+            planned.push({ existing: false, id: newId, draft });
+            embed.push({ id: newId, text: node.text });
             if (node.file) {
-                files.push({ id, source: node.file.source, target: draft });
+                files.push({
+                    id: newId,
+                    source: node.file.source,
+                    path: node.file.path,
+                    target: draft,
+                });
             }
         }
         const resolved = edges.map((edge, i) => {

package/dist/memory/tools.js

@@ -161,11 +161,11 @@ export function memoryTools(opts) {
                         properties: {
                             ref: {
                                 type: 'string',
-                                description: 'a short name for a new node, used by edges in this call',
+                                description: 'a short local name for a new node (e.g. "task_1", "file_1"), used by edges in this call. Use ref (not id) when creating new nodes.',
                             },
                             id: {
                                 type: 'string',
-                                description: 'to change an existing node instead of adding one',
+                                description: 'the permanent id of an existing node to update in place (from search/load). Do not use for new nodes; use ref instead.',
                             },
                             kind: { type: 'string', enum: kinds, description: kindHelp },
                             text: {
@@ -173,8 +173,25 @@ export function memoryTools(opts) {
                                 description: 'what to remember, in your own words',
                             },
                             file: {
-                                type: 'string',
-                                description: 'path of a file to keep a copy of, for kind "file"',
+                                oneOf: [
+                                    {
+                                        type: 'string',
+                                        description: 'path of an existing file in the workspace to keep a copy of (e.g. "report.py" or "/workspace/report.py"), for kind "file"',
+                                    },
+                                    {
+                                        type: 'object',
+                                        properties: {
+                                            path: {
+                                                type: 'string',
+                                                description: 'path of an existing file in the workspace',
+                                            },
+                                        },
+                                        required: ['path'],
+                                        additionalProperties: false,
+                                        description: 'file object with path',
+                                    },
+                                ],
+                                description: 'path of an existing file in the workspace to keep a copy of (e.g. "report.py" or "/workspace/report.py"), for kind "file"',
                             },
                             ...audience,
                             expected_revision: {
@@ -192,11 +209,11 @@ export function memoryTools(opts) {
                         properties: {
                             from: {
                                 type: 'string',
-                                description: 'a ref from this call, or an id',
+                                description: 'a ref from this call, or an existing node id',
                             },
                             to: {
                                 type: 'string',
-                                description: 'a ref from this call, or an id',
+                                description: 'a ref from this call, or an existing node id',
                             },
                             relation: {
                                 type: 'string',
@@ -216,15 +233,28 @@ export function memoryTools(opts) {
             const opId = memoryOpId(tc.state.runId, tc.callId);
             let nodes;
             try {
-                nodes = args.nodes.map((n) => ({
-                    ref: n.ref,
-                    id: n.id,
-                    kind: n.kind,
-                    text: n.text,
-                    audience: n.audience,
-                    expectedRevision: n.expected_revision,
-                    file: n.file === undefined ? undefined : { source: source(tc, n.file) },
-                }));
+                nodes = args.nodes.map((n) => {
+                    let fileSpec;
+                    if (n.file !== undefined) {
+                        const rawPath = extractFilePath(n.file);
+                        if (!rawPath.trim()) {
+                            throw new MemoryError('file path is required', 'pass the path of the file in the workspace to remember, e.g. "report.py"');
+                        }
+                        fileSpec = {
+                            source: source(tc, rawPath),
+                            path: rawPath,
+                        };
+                    }
+                    return {
+                        ref: n.ref,
+                        id: n.id,
+                        kind: n.kind,
+                        text: n.text,
+                        audience: n.audience,
+                        expectedRevision: n.expected_revision,
+                        file: fileSpec,
+                    };
+                });
             }
             catch (err) {
                 return refusal(err);
@@ -322,11 +352,31 @@ function refusal(err) {
     }
     throw err;
 }
+function extractFilePath(raw) {
+    if (typeof raw === 'string') {
+        return raw;
+    }
+    if (raw &&
+        typeof raw === 'object' &&
+        'path' in raw &&
+        typeof raw.path === 'string') {
+        return raw.path;
+    }
+    return '';
+}
 function source(tc, path) {
     if (!tc.services.resolveFile) {
         throw new MemoryError('this agent cannot remember files', 'commit the node without `file`, or give the agent a workspace');
     }
-    return tc.services.resolveFile(path);
+    try {
+        return tc.services.resolveFile(path);
+    }
+    catch (err) {
+        if (err instanceof MemoryError) {
+            throw err;
+        }
+        throw new MemoryError(err instanceof Error ? err.message : String(err), 'remember a file the run actually wrote, by the path the file tools use');
+    }
 }
 function changed(index, ids) {
     return Object.values(ids).flatMap((id) => {

package/dist/project/config.d.ts

@@ -169,6 +169,10 @@ declare const sandbox: z.ZodObject<{
     }>>;
     workdir: z.ZodOptional<z.ZodString>;
     timeout: z.ZodOptional<z.ZodInt>;
+    hardening: z.ZodOptional<z.ZodEnum<{
+        strict: "strict";
+        standard: "standard";
+    }>>;
     user: z.ZodOptional<z.ZodString>;
     persist: z.ZodOptional<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -295,6 +299,10 @@ export declare const projectSchema: z.ZodObject<{
         }>>;
         workdir: z.ZodOptional<z.ZodString>;
         timeout: z.ZodOptional<z.ZodInt>;
+        hardening: z.ZodOptional<z.ZodEnum<{
+            strict: "strict";
+            standard: "standard";
+        }>>;
         user: z.ZodOptional<z.ZodString>;
         persist: z.ZodOptional<z.ZodBoolean>;
         env: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -355,6 +363,10 @@ export declare const projectSchema: z.ZodObject<{
             }>>;
             workdir: z.ZodOptional<z.ZodString>;
             timeout: z.ZodOptional<z.ZodInt>;
+            hardening: z.ZodOptional<z.ZodEnum<{
+                strict: "strict";
+                standard: "standard";
+            }>>;
             user: z.ZodOptional<z.ZodString>;
             persist: z.ZodOptional<z.ZodBoolean>;
             env: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/project/config.js

@@ -263,6 +263,20 @@ const sandbox = z
     workdir: z.string().min(1).optional(),
     /** seconds one command may take before it is killed */
     timeout: z.int().positive().optional(),
+    /**
+     * How much of the host the container is allowed to be.
+     *
+     * `standard` (the default) keeps the kernel capabilities and a
+     * writable root filesystem, so `apt` and `pip` work — which is what a
+     * project whose agents install their own dependencies needs.
+     *
+     * `strict` drops every capability, mounts the root filesystem
+     * read-only with an in-memory `noexec` `/tmp`, runs as an
+     * unprivileged uid and turns the network off unless this block asks
+     * for one. Nothing can be installed at run time, so the image has to
+     * carry everything the agent will need. It requires rootless podman.
+     */
+    hardening: z.enum(['standard', 'strict']).optional(),
     /** uid, name or `uid:gid`; unset means the image's own user */
     user: z.string().min(1).optional(),
     /** keep the container between sessions instead of removing it */

package/dist/project/load.js

@@ -234,6 +234,63 @@ function readHouseRules(root) {
     }
     return rules;
 }
+const FILE_TOOLS = [
+    'read_file',
+    'list_dir',
+    'find_files',
+    'write_file',
+    'apply_patch',
+    'move_file',
+    'delete_file',
+];
+const FILE_WRITE_TOOLS = new Set(['write_file', 'apply_patch', 'move_file', 'delete_file']);
+function activeFileTools(selectors) {
+    const active = new Set();
+    if (!selectors?.length) {
+        return active;
+    }
+    for (const raw of selectors) {
+        const drop = raw.startsWith('-');
+        const selector = (drop ? raw.slice(1) : raw).trim();
+        if (selector === '*' || selector === 'files:*' || selector === 'workspace:*') {
+            for (const t of FILE_TOOLS) {
+                if (drop) {
+                    active.delete(t);
+                }
+                else {
+                    active.add(t);
+                }
+            }
+            continue;
+        }
+        const colon = selector.lastIndexOf(':');
+        const name = colon >= 0 ? selector.slice(colon + 1) : selector;
+        const group = colon >= 0 ? selector.slice(0, colon) : undefined;
+        if (FILE_TOOLS.includes(name)) {
+            if (!group || group === 'files' || group === 'workspace') {
+                if (drop) {
+                    active.delete(name);
+                }
+                else {
+                    active.add(name);
+                }
+            }
+        }
+    }
+    return active;
+}
+function hasFileTools(spec) {
+    return activeFileTools(spec.tools).size > 0;
+}
+function hasFileWriteTools(spec) {
+    const active = activeFileTools(spec.tools);
+    for (const t of FILE_WRITE_TOOLS) {
+        if (active.has(t)) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * What `requires:` may name, and what each one means. A closed vocabulary
  * rather than an expression language: these are the capabilities the runtime
@@ -253,6 +310,10 @@ const CAPABILITIES = {
     memory: (spec) => Boolean(spec.memory),
     'memory-write': (spec) => spec.memory?.access === 'read-write' || spec.memory?.access === 'full',
     'memory-forget': (spec) => spec.memory?.access === 'full',
+    files: (spec) => hasFileTools(spec),
+    'files-write': (spec) => hasFileWriteTools(spec),
+    workspace: (spec) => hasFileTools(spec),
+    'workspace-write': (spec) => hasFileWriteTools(spec),
 };
 /**
  * The document as this agent gets it, or `undefined` when its conditions rule

package/dist/tools/sandbox.d.ts

@@ -23,6 +23,8 @@ export interface SandboxSpec {
     workdir?: string;
     /** default seconds a single command may take */
     timeout?: number;
+    /** how much of the host the container is allowed to be; `standard` by default */
+    hardening?: SandboxHardening;
     /** uid, name, or `uid:gid`; unset means the image's own user */
     user?: string;
     /** keep the container between sessions rather than removing it */
@@ -42,6 +44,27 @@ export interface SandboxSpec {
     secrets?: readonly string[];
 }
 export type SandboxNetwork = 'bridge' | 'none' | 'host';
+/**
+ * Two postures, because they cannot both be the default.
+ *
+ * `standard` is the one this tool was built around: a container with an init,
+ * a pid ceiling and `no-new-privileges`, running an image the agent can still
+ * install into. Installing a package is the ordinary use of a shell, so the
+ * capabilities stay and the root filesystem stays writable.
+ *
+ * `strict` is for running code nobody has read. Every capability is dropped,
+ * the root filesystem is read-only, the only writable temporary space is an
+ * in-memory `/tmp` with `noexec,nosuid,nodev`, the process runs as the host's
+ * own unprivileged uid rather than as container root, and the network is off
+ * unless the project turns it back on. What that costs is exactly what it
+ * removes: `apt`, `pip` and anything else that writes outside the mounts stop
+ * working, so a strict project bakes its dependencies into the image instead.
+ *
+ * What it does *not* do is make the bind mounts go away. `/workspace` is the
+ * work itself and stays writable — the profile shrinks the blast radius of a
+ * command, it does not pretend the agent has nothing to edit.
+ */
+export type SandboxHardening = 'standard' | 'strict';
 export interface SandboxMount {
     /** absolute host path */
     host: string;
@@ -104,6 +127,8 @@ interface Resolved extends Required<Omit<SandboxSpec, 'user'>> {
     readOnly: boolean;
     mounts: readonly SandboxMount[];
     engine: string;
+    explicitCpus?: boolean;
+    explicitMemory?: boolean;
 }
 export interface ExecOptions {
     cwd?: string;