bazilion 0.10.0 → 0.11.0

package/dist/daemon.js

@@ -62,15 +62,15 @@ var require_windows = __commonJS({
       }
       return false;
     }
-    function checkStat(stat, path, options) {
-      if (!stat.isSymbolicLink() && !stat.isFile()) {
+    function checkStat(stat2, path, options) {
+      if (!stat2.isSymbolicLink() && !stat2.isFile()) {
         return false;
       }
       return checkPathExt(path, options);
     }
     function isexe(path, options, cb) {
-      fs.stat(path, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path, options));
+      fs.stat(path, function(er, stat2) {
+        cb(er, er ? false : checkStat(stat2, path, options));
       });
     }
     function sync(path, options) {
@@ -87,20 +87,20 @@ var require_mode = __commonJS({
     isexe.sync = sync;
     var fs = __require("fs");
     function isexe(path, options, cb) {
-      fs.stat(path, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, options));
+      fs.stat(path, function(er, stat2) {
+        cb(er, er ? false : checkStat(stat2, options));
       });
     }
     function sync(path, options) {
       return checkStat(fs.statSync(path), options);
     }
-    function checkStat(stat, options) {
-      return stat.isFile() && checkMode(stat, options);
+    function checkStat(stat2, options) {
+      return stat2.isFile() && checkMode(stat2, options);
     }
-    function checkMode(stat, options) {
-      var mod = stat.mode;
-      var uid = stat.uid;
-      var gid = stat.gid;
+    function checkMode(stat2, options) {
+      var mod = stat2.mode;
+      var uid = stat2.uid;
+      var gid = stat2.gid;
       var myUid = options.uid !== void 0 ? options.uid : process.getuid && process.getuid();
       var myGid = options.gid !== void 0 ? options.gid : process.getgid && process.getgid();
       var u = parseInt("100", 8);
@@ -135,12 +135,12 @@ var require_isexe = __commonJS({
         if (typeof Promise !== "function") {
           throw new TypeError("callback not provided");
         }
-        return new Promise(function(resolve4, reject) {
+        return new Promise(function(resolve7, reject) {
           isexe(path, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
-              resolve4(is);
+              resolve7(is);
             }
           });
         });
@@ -207,27 +207,27 @@ var require_which = __commonJS({
         opt = {};
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
       const found = [];
-      const step = (i) => new Promise((resolve4, reject) => {
+      const step = (i) => new Promise((resolve7, reject) => {
         if (i === pathEnv.length)
-          return opt.all && found.length ? resolve4(found) : reject(getNotFoundError(cmd));
+          return opt.all && found.length ? resolve7(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
         const pCmd = path.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
-        resolve4(subStep(p, i, 0));
+        resolve7(subStep(p, i, 0));
       });
-      const subStep = (p, i, ii) => new Promise((resolve4, reject) => {
+      const subStep = (p, i, ii) => new Promise((resolve7, reject) => {
         if (ii === pathExt.length)
-          return resolve4(step(i + 1));
+          return resolve7(step(i + 1));
         const ext = pathExt[ii];
         isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
           if (!er && is) {
             if (opt.all)
               found.push(p + ext);
             else
-              return resolve4(p + ext);
+              return resolve7(p + ext);
           }
-          return resolve4(subStep(p, i, ii + 1));
+          return resolve7(subStep(p, i, ii + 1));
         });
       });
       return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
@@ -7796,7 +7796,7 @@ var init_stdio2 = __esm({
         if (this._process) {
           throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
         }
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve7, reject) => {
           this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
             // merge default env with server env because mcp server needs some env vars
             env: {
@@ -7813,7 +7813,7 @@ var init_stdio2 = __esm({
             this.onerror?.(error2);
           });
           this._process.on("spawn", () => {
-            resolve4();
+            resolve7();
           });
           this._process.on("close", (_code) => {
             this._process = void 0;
@@ -7872,22 +7872,22 @@ var init_stdio2 = __esm({
         if (this._process) {
           const processToClose = this._process;
           this._process = void 0;
-          const closePromise = new Promise((resolve4) => {
+          const closePromise = new Promise((resolve7) => {
             processToClose.once("close", () => {
-              resolve4();
+              resolve7();
             });
           });
           try {
             processToClose.stdin?.end();
           } catch {
           }
-          await Promise.race([closePromise, new Promise((resolve4) => setTimeout(resolve4, 2e3).unref())]);
+          await Promise.race([closePromise, new Promise((resolve7) => setTimeout(resolve7, 2e3).unref())]);
           if (processToClose.exitCode === null) {
             try {
               processToClose.kill("SIGTERM");
             } catch {
             }
-            await Promise.race([closePromise, new Promise((resolve4) => setTimeout(resolve4, 2e3).unref())]);
+            await Promise.race([closePromise, new Promise((resolve7) => setTimeout(resolve7, 2e3).unref())]);
           }
           if (processToClose.exitCode === null) {
             try {
@@ -7899,15 +7899,15 @@ var init_stdio2 = __esm({
         this._readBuffer.clear();
       }
       send(message) {
-        return new Promise((resolve4) => {
+        return new Promise((resolve7) => {
           if (!this._process?.stdin) {
             throw new Error("Not connected");
           }
           const json = serializeMessage(message);
           if (this._process.stdin.write(json)) {
-            resolve4();
+            resolve7();
           } else {
-            this._process.stdin.once("drain", resolve4);
+            this._process.stdin.once("drain", resolve7);
           }
         });
       }
@@ -9803,7 +9803,7 @@ var init_sse = __esm({
       }
       _startOrAuth() {
         const fetchImpl = this?._eventSourceInit?.fetch ?? this._fetch ?? fetch;
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve7, reject) => {
           this._eventSource = new EventSource(this._url.href, {
             ...this._eventSourceInit,
             fetch: async (url2, init) => {
@@ -9824,7 +9824,7 @@ var init_sse = __esm({
           this._abortController = new AbortController();
           this._eventSource.onerror = (event2) => {
             if (event2.code === 401 && this._authProvider) {
-              this._authThenStart().then(resolve4, reject);
+              this._authThenStart().then(resolve7, reject);
               return;
             }
             const error2 = new SseError(event2.code, event2.message, event2);
@@ -9846,7 +9846,7 @@ var init_sse = __esm({
               void this.close();
               return;
             }
-            resolve4();
+            resolve7();
           });
           this._eventSource.onmessage = (event2) => {
             const messageEvent = event2;
@@ -11016,7 +11016,7 @@ var init_protocol = __esm({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
+            await new Promise((resolve7) => setTimeout(resolve7, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error2) {
@@ -11033,7 +11033,7 @@ var init_protocol = __esm({
        */
       request(request2, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve7, reject) => {
           const earlyReject = (error2) => {
             reject(error2);
           };
@@ -11111,7 +11111,7 @@ var init_protocol = __esm({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve4(parseResult.data);
+                resolve7(parseResult.data);
               }
             } catch (error2) {
               reject(error2);
@@ -11372,12 +11372,12 @@ var init_protocol = __esm({
           }
         } catch {
         }
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve7, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve4, interval);
+          const timeoutId = setTimeout(resolve7, interval);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -11830,11 +11830,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants4) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants);
+          this.rhs = optimizeExpr(this.rhs, names, constants4);
         return this;
       }
       get names() {
@@ -11851,10 +11851,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants4) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants);
+        this.rhs = optimizeExpr(this.rhs, names, constants4);
         return this;
       }
       get names() {
@@ -11915,8 +11915,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants) {
-        this.code = optimizeExpr(this.code, names, constants);
+      optimizeNames(names, constants4) {
+        this.code = optimizeExpr(this.code, names, constants4);
         return this;
       }
       get names() {
@@ -11945,12 +11945,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants4) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants))
+          if (n.optimizeNames(names, constants4))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -12003,12 +12003,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants4) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants);
-        if (!(super.optimizeNames(names, constants) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
+        if (!(super.optimizeNames(names, constants4) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants);
+        this.condition = optimizeExpr(this.condition, names, constants4);
         return this;
       }
       get names() {
@@ -12031,10 +12031,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants) {
-        if (!super.optimizeNames(names, constants))
+      optimizeNames(names, constants4) {
+        if (!super.optimizeNames(names, constants4))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants);
+        this.iteration = optimizeExpr(this.iteration, names, constants4);
         return this;
       }
       get names() {
@@ -12070,10 +12070,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants) {
-        if (!super.optimizeNames(names, constants))
+      optimizeNames(names, constants4) {
+        if (!super.optimizeNames(names, constants4))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants);
+        this.iterable = optimizeExpr(this.iterable, names, constants4);
         return this;
       }
       get names() {
@@ -12115,11 +12115,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants4) {
         var _a3, _b;
-        super.optimizeNames(names, constants);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants);
+        super.optimizeNames(names, constants4);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants4);
         return this;
       }
       get names() {
@@ -12420,7 +12420,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants) {
+    function optimizeExpr(expr, names, constants4) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -12435,14 +12435,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants[n.str];
+        const c = constants4[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants4[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -14404,7 +14404,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve4.call(this, root, ref);
+      let _sch = resolve7.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -14431,7 +14431,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve4(root, ref) {
+    function resolve7(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -15062,55 +15062,55 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve4(baseURI, relativeURI, options) {
+    function resolve7(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative = parse3(serialize(relative, options), options);
+        relative5 = parse3(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative.scheme) {
-        target.scheme = relative.scheme;
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-          target.userinfo = relative.userinfo;
-          target.host = relative.host;
-          target.port = relative.port;
-          target.path = removeDotSegments(relative.path || "");
-          target.query = relative.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative.query !== void 0) {
-              target.query = relative.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative.path[0] === "/") {
-              target.path = removeDotSegments(relative.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -15118,7 +15118,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -15320,7 +15320,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve4,
+      resolve: resolve7,
       resolveComponent,
       equal,
       serialize,
@@ -19125,7 +19125,7 @@ var init_client2 = __esm({
 import { serve } from "@hono/node-server";
 
 // ../daemon/src/app.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 
 // ../daemon/src/lib/middleware-auth.ts
 import { getCookie } from "hono/cookie";
@@ -20558,7 +20558,7 @@ function unarchiveAgent(db, id) {
 }
 
 // ../daemon/src/core/db/client.ts
-import { DatabaseSync } from "node:sqlite";
+import { backup, DatabaseSync } from "node:sqlite";
 function wrap(rawDb) {
   const cache = /* @__PURE__ */ new Map();
   let transactionDepth = 0;
@@ -20631,10 +20631,13 @@ function applyPragmas(rawDb, includeWal) {
   rawDb.exec("PRAGMA foreign_keys = ON");
 }
 function openDb(path) {
-  const raw2 = new DatabaseSync(path);
+  const raw2 = new DatabaseSync(path, { timeout: 5e3 });
   applyPragmas(raw2, true);
   return {
     raw: wrap(raw2),
+    backupTo(path2) {
+      return backup(raw2, path2);
+    },
     close() {
       raw2.close();
     }
@@ -21236,6 +21239,8 @@ __export(communicationApprovals_exports, {
   expirePending: () => expirePending,
   finishDelivery: () => finishDelivery,
   get: () => get7,
+  getByAttempt: () => getByAttempt,
+  grantSchedulerTrigger: () => grantSchedulerTrigger,
   list: () => list6,
   request: () => request
 });
@@ -21396,6 +21401,12 @@ function get7(db, id, includePayload = false) {
   if (!includePayload) return approval;
   return detailFromRow(db, row);
 }
+function getByAttempt(db, attemptKind, attemptId, includePayload = false) {
+  expirePending(db);
+  const row = rawByAttempt(db, attemptKind, attemptId);
+  if (!row) return null;
+  return includePayload ? detailFromRow(db, row) : toApproval(row);
+}
 function detailFromRow(db, row) {
   const events = db.raw.query(
     "SELECT * FROM communication_approval_events WHERE approval_id = ? ORDER BY created_at, rowid"
@@ -21484,6 +21495,74 @@ function claimDelivery(db, id, actor, revalidate, now = Date.now()) {
   if (!outcome.detail) throw new Error("approval_state_conflict: delivery claim failed");
   return outcome.detail;
 }
+function grantSchedulerTrigger(db, id, actor, revalidate, validateDelivery, now = Date.now()) {
+  expirePending(db, now);
+  return db.raw.transaction(() => {
+    const current = raw(db, id);
+    if (!current) throw new Error(`approval_not_found: ${id}`);
+    const detail3 = detailFromRow(db, current);
+    if (detail3.status !== "pending")
+      throw new Error(`approval_state_conflict: current ${detail3.status}`);
+    if (detail3.operation !== "scheduler_trigger" || detail3.payloadKind !== "scheduler_trigger") {
+      throw new Error("approval_payload_conflict: not a scheduler trigger approval");
+    }
+    const authorization = revalidate(detail3);
+    const refsMatch = JSON.stringify(authorization.policyRefs) === JSON.stringify(detail3.policyRefs) && JSON.stringify(authorization.requiredEdgeIds) === JSON.stringify(detail3.requiredEdgeIds);
+    if (authorization.decision !== "approval_required" || !refsMatch) {
+      const error2 = "policy or membership changed";
+      const changed2 = db.raw.run(
+        `UPDATE communication_approvals
+         SET status = 'denied', decided_at = ?, decided_by = ?, decision_reason = ?,
+             updated_at = ? WHERE id = ? AND status = 'pending'`,
+        [now, actor, error2, now, id]
+      ).changes;
+      if (changed2 !== 1) throw new Error("approval_state_conflict: concurrent approval");
+      appendEvent(db, id, "denied", actor, error2, now);
+      return {
+        approval: toApproval(raw(db, id)),
+        granted: false,
+        failureKind: "revalidation",
+        error: error2
+      };
+    }
+    let deliveryError = null;
+    try {
+      deliveryError = validateDelivery(detail3);
+    } catch (error2) {
+      deliveryError = error2 instanceof Error ? error2.message : String(error2);
+    }
+    if (deliveryError) {
+      const changed2 = db.raw.run(
+        `UPDATE communication_approvals
+         SET status = 'delivery_failed', decided_at = ?, decided_by = ?,
+             delivery_error = ?, updated_at = ?
+         WHERE id = ? AND status = 'pending'`,
+        [now, actor, deliveryError, now, id]
+      ).changes;
+      if (changed2 !== 1) throw new Error("approval_state_conflict: concurrent approval");
+      appendEvent(db, id, "approved", actor, null, now);
+      appendEvent(db, id, "delivery_started", actor, null, now);
+      appendEvent(db, id, "delivery_failed", actor, deliveryError, now);
+      return {
+        approval: toApproval(raw(db, id)),
+        granted: false,
+        failureKind: "delivery",
+        error: deliveryError
+      };
+    }
+    const changed = db.raw.run(
+      `UPDATE communication_approvals
+       SET status = 'delivered', decided_at = ?, decided_by = ?, delivery_error = NULL,
+           updated_at = ? WHERE id = ? AND status = 'pending'`,
+      [now, actor, now, id]
+    ).changes;
+    if (changed !== 1) throw new Error("approval_state_conflict: concurrent approval");
+    appendEvent(db, id, "approved", actor, null, now);
+    appendEvent(db, id, "delivery_started", actor, null, now);
+    appendEvent(db, id, "delivered", actor, null, now);
+    return { approval: toApproval(raw(db, id)), granted: true };
+  })();
+}
 function finishDelivery(db, id, ok, actor, error2, now = Date.now()) {
   return db.raw.transaction(() => {
     const status = ok ? "delivered" : "delivery_failed";
@@ -21906,6 +21985,43 @@ var SERVICES = [
       }
     ]
   },
+  {
+    id: "shell-security",
+    displayName: "Agent Shell Security",
+    category: "service",
+    team: "Agent Runtime",
+    hint: "Optional dangerous-command approval and Docker isolation. Disabled by default.",
+    fields: [
+      {
+        envVar: "BAZILION_BASH_APPROVAL",
+        kind: "config",
+        label: "Dangerous-command approval",
+        placeholder: "off",
+        description: "Use off (current behavior) or dangerous (classified bash commands require per-call approval before execution)."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX",
+        kind: "config",
+        label: "Sandbox mode",
+        placeholder: "off",
+        description: "Use off (current host tools) or docker (containerized bash only; host-backed coding tools are hidden)."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX_IMAGE",
+        kind: "config",
+        label: "Docker image",
+        placeholder: "debian:bookworm-slim",
+        description: "Local image with /bin/bash and /usr/bin/env and no VOLUME declarations. Bazilion never falls back to host execution if it is unavailable or incompatible."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST",
+        kind: "config",
+        label: "Extra environment allowlist",
+        placeholder: "MY_SAFE_VARIABLE,ANOTHER_SAFE_VARIABLE",
+        description: "Optional comma-separated variable names copied into the container. Provider credentials remain excluded unless explicitly named."
+      }
+    ]
+  },
   {
     id: "browser",
     displayName: "Browser Automation",
@@ -22457,10 +22573,154 @@ function remove7(db, userId) {
   return true;
 }
 
+// ../daemon/src/core/repos/triggerDispatches.ts
+var triggerDispatches_exports = {};
+__export(triggerDispatches_exports, {
+  cancelPendingForTrigger: () => cancelPendingForTrigger,
+  cancelRunning: () => cancelRunning,
+  claim: () => claim,
+  defer: () => defer,
+  fail: () => fail,
+  get: () => get12,
+  hasOpenForTrigger: () => hasOpenForTrigger,
+  listClaimable: () => listClaimable,
+  listForTrigger: () => listForTrigger,
+  materialize: () => materialize,
+  succeed: () => succeed
+});
+import { randomUUID as randomUUID7 } from "crypto";
+function toDispatch(row) {
+  return {
+    id: row.id,
+    triggerId: row.trigger_id,
+    agentId: row.agent_id,
+    scheduledAt: row.scheduled_at,
+    status: row.status,
+    attemptCount: row.attempt_count,
+    nextAttemptAt: row.next_attempt_at,
+    leaseExpiresAt: row.lease_expires_at,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at,
+    lastError: row.last_error,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function materialize(db, input) {
+  const now = input.now ?? Date.now();
+  db.raw.run(
+    `INSERT INTO trigger_dispatches
+       (id, trigger_id, agent_id, scheduled_at, status, attempt_count, next_attempt_at,
+        lease_expires_at, started_at, finished_at, last_error, created_at, updated_at)
+     VALUES (?, ?, ?, ?, 'pending', 0, ?, NULL, NULL, NULL, NULL, ?, ?)
+     ON CONFLICT(trigger_id, scheduled_at) DO NOTHING`,
+    [randomUUID7(), input.triggerId, input.agentId, input.scheduledAt, now, now, now]
+  );
+  const row = db.raw.query(
+    "SELECT * FROM trigger_dispatches WHERE trigger_id = ? AND scheduled_at = ?"
+  ).get(input.triggerId, input.scheduledAt);
+  if (!row) throw new Error("trigger dispatch materialization failed");
+  return toDispatch(row);
+}
+function get12(db, id) {
+  const row = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
+  return row ? toDispatch(row) : null;
+}
+function listClaimable(db, now = Date.now()) {
+  return db.raw.query(
+    `SELECT * FROM trigger_dispatches
+       WHERE (status IN ('pending','retrying') AND next_attempt_at <= ?)
+          OR (status = 'running' AND lease_expires_at <= ?)
+       ORDER BY scheduled_at ASC, created_at ASC`
+  ).all(now, now).map(toDispatch);
+}
+function hasOpenForTrigger(db, triggerId) {
+  return db.raw.query(
+    `SELECT 1 found FROM trigger_dispatches
+         WHERE trigger_id = ? AND status IN ('pending','running','retrying') LIMIT 1`
+  ).get(triggerId) !== null;
+}
+function claim(db, id, options = {}) {
+  const now = options.now ?? Date.now();
+  const leaseExpiresAt = now + (options.leaseMs ?? 5 * 6e4);
+  return db.raw.transaction(() => {
+    const result = db.raw.run(
+      `UPDATE trigger_dispatches
+       SET status = 'running', attempt_count = attempt_count + 1,
+           lease_expires_at = ?, started_at = ?, finished_at = NULL, updated_at = ?
+       WHERE id = ? AND (
+         (status IN ('pending','retrying') AND next_attempt_at <= ?)
+         OR (status = 'running' AND lease_expires_at <= ?)
+       )`,
+      [leaseExpiresAt, now, now, id, now, now]
+    );
+    if (Number(result.changes) !== 1) return null;
+    const row = db.raw.query("SELECT * FROM trigger_dispatches WHERE id = ?").get(id);
+    return row ? toDispatch(row) : null;
+  })();
+}
+function succeed(db, id, now = Date.now()) {
+  db.raw.run(
+    `UPDATE trigger_dispatches SET status = 'succeeded', lease_expires_at = NULL,
+     finished_at = ?, last_error = NULL, updated_at = ? WHERE id = ? AND status = 'running'`,
+    [now, now, id]
+  );
+}
+function defer(db, id, nextAttemptAt = Date.now() + 1e3) {
+  db.raw.run(
+    `UPDATE trigger_dispatches SET status = 'pending',
+     attempt_count = CASE WHEN attempt_count > 0 THEN attempt_count - 1 ELSE 0 END,
+     next_attempt_at = ?, lease_expires_at = NULL, started_at = NULL, updated_at = ?
+     WHERE id = ? AND status = 'running'`,
+    [nextAttemptAt, Date.now(), id]
+  );
+}
+function cancelRunning(db, id, reason, now = Date.now()) {
+  db.raw.run(
+    `UPDATE trigger_dispatches SET status = 'cancelled', lease_expires_at = NULL,
+     finished_at = ?, last_error = ?, updated_at = ? WHERE id = ? AND status = 'running'`,
+    [now, reason.slice(0, 2e3), now, id]
+  );
+}
+function fail(db, id, error2, options = {}) {
+  const now = options.now ?? Date.now();
+  const maxAttempts = options.maxAttempts ?? 3;
+  const retryDelayMs = options.retryDelayMs ?? 5e3;
+  const current = db.raw.query(
+    "SELECT attempt_count FROM trigger_dispatches WHERE id = ?"
+  ).get(id);
+  if (!current) return;
+  const terminal = current.attempt_count >= maxAttempts;
+  db.raw.run(
+    `UPDATE trigger_dispatches SET status = ?, next_attempt_at = ?, lease_expires_at = NULL,
+     finished_at = ?, last_error = ?, updated_at = ? WHERE id = ? AND status = 'running'`,
+    [
+      terminal ? "failed" : "retrying",
+      terminal ? now : now + retryDelayMs * 2 ** Math.max(0, current.attempt_count - 1),
+      terminal ? now : null,
+      error2.slice(0, 2e3),
+      now,
+      id
+    ]
+  );
+}
+function cancelPendingForTrigger(db, triggerId, now = Date.now()) {
+  db.raw.run(
+    `UPDATE trigger_dispatches SET status = 'cancelled', finished_at = ?, updated_at = ?
+     WHERE trigger_id = ? AND status IN ('pending','retrying')`,
+    [now, now, triggerId]
+  );
+}
+function listForTrigger(db, triggerId, limit = 20) {
+  return db.raw.query(
+    "SELECT * FROM trigger_dispatches WHERE trigger_id = ? ORDER BY scheduled_at DESC LIMIT ?"
+  ).all(triggerId, limit).map(toDispatch);
+}
+
 // ../daemon/src/core/repos/triggers.ts
 var triggers_exports = {};
 __export(triggers_exports, {
-  get: () => get12,
+  get: () => get13,
   insert: () => insert5,
   listEnabled: () => listEnabled3,
   listForAgent: () => listForAgent,
@@ -22468,7 +22728,7 @@ __export(triggers_exports, {
   remove: () => remove8,
   setEnabled: () => setEnabled3
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function toTrigger(r) {
   return {
     id: r.id,
@@ -22483,7 +22743,7 @@ function toTrigger(r) {
   };
 }
 function insert5(db, input) {
-  const id = randomUUID7();
+  const id = randomUUID8();
   const now = Date.now();
   const enabled = input.enabled === false ? 0 : 1;
   db.raw.run(
@@ -22504,7 +22764,7 @@ function insert5(db, input) {
     createdAt: now
   };
 }
-function get12(db, id) {
+function get13(db, id) {
   const row = db.raw.query("SELECT * FROM agent_triggers WHERE id = ?").get(id);
   return row ? toTrigger(row) : null;
 }
@@ -22522,7 +22782,10 @@ function listEnabled3(db) {
   ).all().map(toTrigger);
 }
 function setEnabled3(db, id, enabled) {
-  db.raw.run("UPDATE agent_triggers SET enabled = ? WHERE id = ?", [enabled ? 1 : 0, id]);
+  db.raw.transaction(() => {
+    db.raw.run("UPDATE agent_triggers SET enabled = ? WHERE id = ?", [enabled ? 1 : 0, id]);
+    if (!enabled) cancelPendingForTrigger(db, id);
+  })();
 }
 function markFired(db, id, when = Date.now()) {
   db.raw.run("UPDATE agent_triggers SET last_fired_at = ? WHERE id = ?", [when, id]);
@@ -22536,13 +22799,13 @@ var webTokens_exports = {};
 __export(webTokens_exports, {
   create: () => create,
   findActiveByToken: () => findActiveByToken,
-  get: () => get13,
+  get: () => get14,
   hashToken: () => hashToken,
   list: () => list9,
   markUsed: () => markUsed,
   revoke: () => revoke
 });
-import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID9 } from "crypto";
 function toToken(r) {
   return {
     id: r.id,
@@ -22556,7 +22819,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function create(db, label) {
-  const id = randomUUID8();
+  const id = randomUUID9();
   const token = randomBytes2(24).toString("hex");
   const tokenHash = hashToken(token);
   const now = Date.now();
@@ -22574,7 +22837,7 @@ function list9(db, opts) {
   const sql = opts?.includeRevoked ? "SELECT * FROM web_tokens ORDER BY created_at ASC" : "SELECT * FROM web_tokens WHERE revoked_at IS NULL ORDER BY created_at ASC";
   return db.raw.query(sql).all().map(toToken);
 }
-function get13(db, id) {
+function get14(db, id) {
   const row = db.raw.query("SELECT * FROM web_tokens WHERE id = ?").get(id);
   return row ? toToken(row) : null;
 }
@@ -22856,7 +23119,7 @@ function resolveAgentSkills(db, paths, agentId) {
 }
 
 // ../daemon/src/core/team/delete.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { existsSync as existsSync9, renameSync as renameSync2, rmSync as rmSync6 } from "fs";
 function deleteTeam(db, paths, id, expectedTeamPolicyRevision) {
   const g2 = get3(db, id, paths);
@@ -22875,7 +23138,7 @@ function deleteTeam(db, paths, id, expectedTeamPolicyRevision) {
       `cannot delete team "${id}": ${members.length} agent(s) still belong to it: ${names}. Move or delete them first.`
     );
   }
-  const stagedPath = `${g2.path}.deleting-${randomUUID9()}`;
+  const stagedPath = `${g2.path}.deleting-${randomUUID10()}`;
   const hadSlot = existsSync9(g2.path);
   if (hadSlot) renameSync2(g2.path, stagedPath);
   try {
@@ -22899,7 +23162,7 @@ function deleteTeam(db, paths, id, expectedTeamPolicyRevision) {
 }
 
 // ../daemon/src/core/team-policy/adopt.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function previewTeamPolicyAdoption(db, teamId, input) {
   return resolveAdoptionPlan(db, teamId, { ...input, previewEdges: [] }).resolved;
 }
@@ -22972,7 +23235,7 @@ function adoptTeamTemplate(db, teamId, input) {
     );
     db.raw.run("DELETE FROM template_instantiations WHERE team_id = ?", [teamId]);
     db.raw.run("DELETE FROM team_policy_edges WHERE team_id = ?", [teamId]);
-    const instantiationId = randomUUID10();
+    const instantiationId = randomUUID11();
     db.raw.run(
       `INSERT INTO template_instantiations
          (id, team_id, template_id, template_revision, created_at)
@@ -23070,7 +23333,7 @@ function edgeKey(edge) {
 }
 
 // ../daemon/src/core/team-policy/authorization.ts
-import { createHash as createHash3, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID12 } from "crypto";
 function denied(channel, code, reason) {
   return {
     decision: "deny",
@@ -23250,7 +23513,7 @@ function recordDenial(db, input, operation, result) {
   const sourceGroup = agentGroup(input.source) ?? agentGroup(input.target) ?? ("teamId" in input.source ? input.source.teamId : null);
   const targetGroup = agentGroup(input.target) ?? agentGroup(input.source) ?? ("teamId" in input.target ? input.target.teamId : null);
   const values = [
-    randomUUID11(),
+    randomUUID12(),
     input.attemptKind,
     input.attemptId,
     operation,
@@ -23300,7 +23563,7 @@ function recordDenial(db, input, operation, result) {
 }
 
 // ../daemon/src/core/team-policy/source.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 function diffTeamPolicy(db, teamId) {
   const detail3 = detail(db, teamId);
   if (!detail3) throw new Error(`team_policy_missing: ${teamId}`);
@@ -23368,7 +23631,7 @@ function saveTeamPolicyAsTemplate(db, paths, teamId, input) {
     const team = get3(db, teamId, paths);
     if (!team) throw new Error(`team not found: ${teamId}`);
     const members = list(db, { includeArchived: true }).filter((agent) => agent.teamId === teamId);
-    const slotByAgent = new Map(members.map((agent) => [agent.id, randomUUID12()]));
+    const slotByAgent = new Map(members.map((agent) => [agent.id, randomUUID13()]));
     const stateByAgent = new Map(
       agentState(db, teamId).map((state3) => [state3.agentId, state3])
     );
@@ -23444,7 +23707,7 @@ function updateTeamPolicySource(db, teamId, input) {
       baselineBindings.map((binding) => [binding.agentId, binding.sourceSlotId])
     );
     for (const id of selectedIds) {
-      if (!slotByAgent.has(id)) slotByAgent.set(id, randomUUID12());
+      if (!slotByAgent.has(id)) slotByAgent.set(id, randomUUID13());
     }
     const previousSlotById = new Map(previous.slots.map((slot) => [slot.slotId, slot]));
     const selectedMembers = [...selectedIds].map((id) => {
@@ -23512,7 +23775,7 @@ function pruneEmptyNonbaselineInstantiation(db, instantiationId, baselineId) {
 }
 
 // ../daemon/src/core/team-policy/spawn.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 import { readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
 
 // ../daemon/src/core/team-policy/rm-with-retry.ts
@@ -23679,7 +23942,7 @@ async function spawnTeamTemplate(db, paths, input) {
           })
         );
       }
-      const instantiationId = randomUUID13();
+      const instantiationId = randomUUID14();
       db.raw.run(
         `INSERT INTO template_instantiations
            (id, team_id, template_id, template_revision, created_at)
@@ -23766,7 +24029,7 @@ function safeReaddir(path) {
 }
 
 // ../daemon/src/lib/ctx.ts
-import { chmodSync, existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
+import { chmodSync, existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "fs";
 
 // ../daemon/src/lib/agent-cancel.ts
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("bazilion.agent-cancel.registry");
@@ -23816,9 +24079,9 @@ function acquireAgentLifecycleLease(agentId) {
     leases.held.add(agentId);
     return Promise.resolve(makeRelease(agentId));
   }
-  return new Promise((resolve4) => {
+  return new Promise((resolve7) => {
     const queue = leases.waiters.get(agentId) ?? [];
-    queue.push({ resolve: resolve4 });
+    queue.push({ resolve: resolve7 });
     leases.waiters.set(agentId, queue);
   });
 }
@@ -23851,12 +24114,13 @@ async function runAgentLifecycleMutation(agentId, mutation) {
 }
 
 // ../daemon/src/lib/agent-turn.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 
 // ../daemon/src/runtime/auth/openai-codex.ts
 import { loginOpenAICodex, refreshOpenAICodexToken } from "@earendil-works/pi-ai/oauth";
 var OPENAI_CODEX_SECRET_KEY = "OPENAI_CODEX_OAUTH";
 var REFRESH_MARGIN_MS = 6e4;
+var refreshFlights = /* @__PURE__ */ new WeakMap();
 function readCredentials(db, authToken) {
   const raw2 = openSecrets(db, authToken).get(OPENAI_CODEX_SECRET_KEY);
   if (!raw2) return null;
@@ -23901,10 +24165,28 @@ function getStatus(db, authToken) {
 async function loadAccessToken(db, authToken) {
   const creds = readCredentials(db, authToken);
   if (!creds) {
-    throw new Error(
-      "OpenAI ChatGPT OAuth not configured \u2014 run `bazilion auth openai login` (or use the Connect button on /config)"
-    );
+    throw credentialsMissingError();
+  }
+  if (creds.expires > Date.now() + REFRESH_MARGIN_MS) return creds.access;
+  let dbFlights = refreshFlights.get(db);
+  if (!dbFlights) {
+    dbFlights = /* @__PURE__ */ new Map();
+    refreshFlights.set(db, dbFlights);
+  }
+  const existing = dbFlights.get(authToken);
+  if (existing) return existing;
+  const pending = Promise.resolve().then(() => refreshExpiredAccessToken(db, authToken));
+  dbFlights.set(authToken, pending);
+  try {
+    return await pending;
+  } finally {
+    if (dbFlights.get(authToken) === pending) dbFlights.delete(authToken);
+    if (dbFlights.size === 0) refreshFlights.delete(db);
   }
+}
+async function refreshExpiredAccessToken(db, authToken) {
+  const creds = readCredentials(db, authToken);
+  if (!creds) throw credentialsMissingError();
   if (creds.expires > Date.now() + REFRESH_MARGIN_MS) return creds.access;
   const refreshed = await refreshOpenAICodexToken(creds.refresh);
   const next = {
@@ -23912,9 +24194,23 @@ async function loadAccessToken(db, authToken) {
     access: refreshed.access,
     expires: refreshed.expires
   };
+  const current = readCredentials(db, authToken);
+  if (!current) throw credentialsMissingError();
+  if (!sameCredentials(current, creds)) {
+    if (current.expires > Date.now() + REFRESH_MARGIN_MS) return current.access;
+    throw new Error("OpenAI ChatGPT OAuth credentials changed while refresh was in progress");
+  }
   writeCredentials(db, authToken, next);
   return next.access;
 }
+function credentialsMissingError() {
+  return new Error(
+    "OpenAI ChatGPT OAuth not configured \u2014 run `bazilion auth openai login` (or use the Connect button on /config)"
+  );
+}
+function sameCredentials(left, right) {
+  return left.refresh === right.refresh && left.access === right.access && left.expires === right.expires;
+}
 function saveLoginCredentials(db, authToken, creds) {
   writeCredentials(db, authToken, {
     refresh: creds.refresh,
@@ -23937,15 +24233,19 @@ import { dirname as dirname2, join as join12 } from "path";
 
 // ../daemon/src/runtime/memory/qmd.ts
 import {
-  existsSync as existsSync11,
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
   mkdirSync as mkdirSync5,
+  openSync,
   readdirSync as readdirSync6,
   readFileSync as readFileSync9,
+  realpathSync,
   rmSync as rmSync10,
-  statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname3, join as join13 } from "path";
+import { dirname as dirname3, isAbsolute, join as join13, relative, resolve as resolve3, sep as sep2 } from "path";
 import { createStore, extractSnippet } from "@tobilu/qmd";
 var INDEX_FILENAME = ".qmd-index.sqlite";
 var COLLECTION_NAME = "memory";
@@ -23966,61 +24266,222 @@ function getStore(dir) {
   }
   return p;
 }
+function unsafeMemoryPath(path, reason) {
+  return new Error(`unsafe memory path "${path}": ${reason}`);
+}
+function lstatIfPresent(path) {
+  try {
+    return lstatSync(path);
+  } catch (error2) {
+    if (error2.code === "ENOENT") return void 0;
+    throw error2;
+  }
+}
+function isContained(root, candidate) {
+  const rel = relative(root, candidate);
+  return rel === "" || !isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
+}
+function assertContained(root, candidate) {
+  if (!isContained(root, candidate)) {
+    throw unsafeMemoryPath(candidate, `resolved outside memory root "${root}"`);
+  }
+}
+function initializeSafeRoot(root) {
+  mkdirSync5(root, { recursive: true });
+  const info = lstatSync(root);
+  if (info.isSymbolicLink()) {
+    throw unsafeMemoryPath(root, "memory root must not be a symbolic link");
+  }
+  if (!info.isDirectory()) {
+    throw unsafeMemoryPath(root, "memory root is not a directory");
+  }
+  return realpathSync(root);
+}
+function assertRootUnchanged(root, canonicalRoot) {
+  const info = lstatIfPresent(root);
+  if (!info) throw unsafeMemoryPath(root, "memory root disappeared");
+  if (info.isSymbolicLink()) {
+    throw unsafeMemoryPath(root, "memory root must not be a symbolic link");
+  }
+  if (!info.isDirectory()) {
+    throw unsafeMemoryPath(root, "memory root is not a directory");
+  }
+  const current = realpathSync(root);
+  if (relative(canonicalRoot, current) !== "" || relative(current, canonicalRoot) !== "") {
+    throw unsafeMemoryPath(root, "memory root changed after initialization");
+  }
+}
 function safeKey(root, key2) {
-  if (key2.includes("..") || key2.startsWith("/") || key2.includes("\0")) {
+  const segments = key2.split(/[\\/]/);
+  if (key2.length === 0 || key2.includes("\0") || isAbsolute(key2) || /^[A-Za-z]:[\\/]/.test(key2) || key2.startsWith("\\\\") || segments.includes("..")) {
     throw new Error(`unsafe memory key: ${key2}`);
   }
-  return join13(root, key2);
-}
-function walkMd(dir, prefix, out) {
-  if (!existsSync11(dir)) return;
-  for (const e of readdirSync6(dir, { withFileTypes: true })) {
-    if (e.name.startsWith(".")) continue;
-    const full = join13(dir, e.name);
-    const key2 = prefix ? `${prefix}/${e.name}` : e.name;
-    if (e.isDirectory()) {
-      walkMd(full, key2, out);
-    } else if (e.isFile() && e.name.endsWith(".md")) {
-      const stats = statSync4(full);
-      out.push({
-        key: key2,
-        content: readFileSync9(full, "utf8"),
-        updatedAt: stats.mtimeMs
-      });
+  const candidate = resolve3(root, key2);
+  if (candidate === root) throw new Error(`unsafe memory key: ${key2}`);
+  assertContained(root, candidate);
+  return candidate;
+}
+function inspectSafePath(root, path) {
+  assertContained(root, path);
+  const rel = relative(root, path);
+  let current = root;
+  const components = rel.split(sep2).filter(Boolean);
+  for (let index = 0; index < components.length; index += 1) {
+    current = join13(current, components[index]);
+    const info = lstatIfPresent(current);
+    if (!info) return void 0;
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(current, "symbolic links are not allowed");
+    }
+    if (index < components.length - 1 && !info.isDirectory()) {
+      throw unsafeMemoryPath(current, "path ancestor is not a directory");
+    }
+    assertContained(root, realpathSync(current));
+  }
+  return lstatIfPresent(path);
+}
+function ensureSafeParentDirectories(root, path) {
+  const parent = dirname3(path);
+  assertContained(root, parent);
+  const rel = relative(root, parent);
+  let current = root;
+  for (const component of rel.split(sep2).filter(Boolean)) {
+    current = join13(current, component);
+    let info = lstatIfPresent(current);
+    if (!info) {
+      mkdirSync5(current);
+      info = lstatSync(current);
+    }
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(current, "symbolic-link ancestors are not allowed");
+    }
+    if (!info.isDirectory()) {
+      throw unsafeMemoryPath(current, "path ancestor is not a directory");
+    }
+    assertContained(root, realpathSync(current));
+  }
+}
+function readSafeFile(root, path) {
+  const info = inspectSafePath(root, path);
+  if (!info) throw new Error(`memory entry not found: ${relative(root, path)}`);
+  if (!info.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+    return { content: readFileSync9(fd, "utf8"), stats };
+  } catch (error2) {
+    if (error2.code === "ELOOP") {
+      throw unsafeMemoryPath(path, "symbolic links are not allowed");
+    }
+    throw error2;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function writeSafeFile(root, path, content) {
+  ensureSafeParentDirectories(root, path);
+  const existing = inspectSafePath(root, path);
+  if (existing?.isSymbolicLink()) {
+    throw unsafeMemoryPath(path, "symbolic links are not allowed");
+  }
+  if (existing && !existing.isFile()) {
+    throw unsafeMemoryPath(path, "memory entry is not a regular file");
+  }
+  let fd;
+  try {
+    fd = openSync(
+      path,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW,
+      438
+    );
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+    writeFileSync7(fd, content);
+    return fstatSync(fd);
+  } catch (error2) {
+    if (error2.code === "ELOOP") {
+      throw unsafeMemoryPath(path, "symbolic links are not allowed");
+    }
+    throw error2;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function assertSafeTree(root, dir = root) {
+  assertContained(root, realpathSync(dir));
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    const full = join13(dir, entry.name);
+    const info = lstatSync(full);
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(full, "symbolic links are not allowed in memory storage");
+    }
+    if (info.isDirectory()) {
+      assertSafeTree(root, full);
+    } else if (!info.isFile()) {
+      throw unsafeMemoryPath(full, "special files are not allowed in memory storage");
+    }
+  }
+}
+function walkMd(root, dir, prefix, out) {
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    const full = join13(dir, entry.name);
+    const info = lstatSync(full);
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(full, "symbolic links are not allowed in memory storage");
+    }
+    if (entry.name.startsWith(".")) continue;
+    const key2 = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (info.isDirectory()) {
+      walkMd(root, full, key2, out);
+    } else if (info.isFile() && entry.name.endsWith(".md")) {
+      const { content, stats } = readSafeFile(root, full);
+      out.push({ key: key2, content, updatedAt: stats.mtimeMs });
+    } else if (!info.isFile()) {
+      throw unsafeMemoryPath(full, "special files are not allowed in memory storage");
     }
   }
 }
 function qmdBackend(root) {
+  let canonicalRoot;
+  const safeRoot = () => {
+    if (!canonicalRoot) canonicalRoot = initializeSafeRoot(root);
+    else assertRootUnchanged(root, canonicalRoot);
+    return canonicalRoot;
+  };
   return {
     async init() {
-      mkdirSync5(root, { recursive: true });
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
     },
     async read(key2) {
-      const path = safeKey(root, key2);
-      if (!existsSync11(path)) {
-        throw new Error(`memory entry not found: ${key2}`);
-      }
-      const stats = statSync4(path);
+      const safe = safeRoot();
+      const path = safeKey(safe, key2);
+      const { content, stats } = readSafeFile(safe, path);
       return {
         key: key2,
-        content: readFileSync9(path, "utf8"),
+        content,
         updatedAt: stats.mtimeMs
       };
     },
     async write(key2, content) {
-      const path = safeKey(root, key2);
-      mkdirSync5(dirname3(path), { recursive: true });
-      writeFileSync7(path, content);
-      const stats = statSync4(path);
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const path = safeKey(safe, key2);
+      const stats = writeSafeFile(safe, path, content);
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
       return { key: key2, content, updatedAt: stats.mtimeMs };
     },
     async search(query, opts) {
       const limit = opts?.limit ?? 10;
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       const results = await store.searchLex(query, {
         limit,
         collection: COLLECTION_NAME
@@ -24029,13 +24490,13 @@ function qmdBackend(root) {
       for (const r of results) {
         const prefix = `${COLLECTION_NAME}/`;
         const key2 = r.displayPath.startsWith(prefix) ? r.displayPath.slice(prefix.length) : r.displayPath;
+        const path = safeKey(safe, key2);
+        const info = inspectSafePath(safe, path);
+        if (!info) continue;
+        if (!info.isFile()) throw unsafeMemoryPath(path, "search result is not a regular file");
         let content = r.body ?? "";
         if (!content) {
-          try {
-            content = readFileSync9(join13(root, key2), "utf8");
-          } catch {
-            content = "";
-          }
+          content = readSafeFile(safe, path).content;
         }
         const snippet = extractSnippet(content, query).snippet;
         hits.push({ key: key2, snippet, score: r.score });
@@ -24043,14 +24504,23 @@ function qmdBackend(root) {
       return hits;
     },
     async list() {
+      const safe = safeRoot();
+      assertSafeTree(safe);
       const out = [];
-      walkMd(root, "", out);
+      walkMd(safe, safe, "", out);
       return out.sort((a, b2) => a.key.localeCompare(b2.key));
     },
     async remove(key2) {
-      const path = safeKey(root, key2);
-      if (existsSync11(path)) rmSync10(path);
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const path = safeKey(safe, key2);
+      const info = inspectSafePath(safe, path);
+      if (info) {
+        if (!info.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+        rmSync10(path);
+      }
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
     }
   };
@@ -24139,8 +24609,8 @@ function piMessagesToProviderView(messages) {
 }
 
 // ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync8, statSync as statSync7 } from "fs";
-import { basename as basename3, join as join17 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync9, statSync as statSync6 } from "fs";
+import { basename as basename3, join as join19 } from "path";
 import {
   AuthStorage,
   createAgentSession,
@@ -24426,14 +24896,14 @@ function isRetryableError(err) {
   return false;
 }
 function sleepWithAbort(ms, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     if (signal?.aborted) {
       reject(new Error("aborted"));
       return;
     }
     const t = setTimeout(() => {
       if (signal) signal.removeEventListener("abort", onAbort);
-      resolve4();
+      resolve7();
     }, ms);
     const onAbort = () => {
       clearTimeout(t);
@@ -24948,7 +25418,7 @@ var PROVIDERS = {
 function createProviderRegistry(config2, opts = {}) {
   const cache = /* @__PURE__ */ new Map();
   const enabledSet = opts.enabledSet;
-  function get14(name) {
+  function get15(name) {
     const cached2 = cache.get(name);
     if (cached2) return cached2;
     const entry = PROVIDERS[name];
@@ -24980,7 +25450,7 @@ function createProviderRegistry(config2, opts = {}) {
       }
       const providerName = modelString.slice(0, idx);
       const model = modelString.slice(idx + 1);
-      return { provider: get14(providerName), model };
+      return { provider: get15(providerName), model };
     },
     list() {
       return Object.entries(PROVIDERS).filter(([name, entry]) => {
@@ -25000,15 +25470,38 @@ function listAllProviders(config2) {
 }
 
 // ../daemon/src/runtime/session/prompt.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync10 } from "fs";
 import { join as join14 } from "path";
+var SANDBOX_SKILLS_DIR = "/skills";
+function loadPromptSkills(skillsDir, attachedNames) {
+  if (!existsSync11(skillsDir) || attachedNames.length === 0) return [];
+  const attached = new Set(attachedNames);
+  const discovered = readdirSync7(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b2) => a.name.localeCompare(b2.name));
+  const loaded = [];
+  for (const entry of discovered) {
+    const hostDir = join14(skillsDir, entry.name);
+    try {
+      const parsed = parseSkillFile(join14(hostDir, "SKILL.md"));
+      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
+      loaded.push({
+        name: entry.name,
+        description: parsed.frontmatter.description,
+        body: parsed.body.trim(),
+        hostDir,
+        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
+      });
+    } catch {
+    }
+  }
+  return loaded;
+}
 var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
-function buildSystemPrompt(agent) {
+function buildSystemPrompt(agent, options = {}) {
   const parts = [];
   const contextBlocks = [];
   for (const file of CONTEXT_FILE_ORDER) {
     const path = join14(agent.agent.dir, file);
-    if (!existsSync12(path)) continue;
+    if (!existsSync11(path)) continue;
     const content = readFileSync10(path, "utf8").trimEnd();
     if (!content) continue;
     contextBlocks.push(`## ${file}
@@ -25021,7 +25514,7 @@ ${content}`);
 ${contextBlocks.join("\n\n")}`);
   }
   const bootstrapPath = join14(agent.agent.dir, "BOOTSTRAP.md");
-  if (existsSync12(bootstrapPath)) {
+  if (existsSync11(bootstrapPath)) {
     const bootstrap2 = readFileSync10(bootstrapPath, "utf8").trimEnd();
     if (bootstrap2) {
       parts.push(
@@ -25051,14 +25544,35 @@ ${contextBlocks.join("\n\n")}`);
       "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
       "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
       "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
-      "- To produce work output (code, docs, artefacts): use `write` / `edit` \u2014 those land in your workspace, not your home."
+      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
     ].join("\n")
   );
   if (agent.skills.length > 0) {
+    const loaded = options.skills ?? [];
+    const loadedNames = new Set(loaded.map((skill) => skill.name));
+    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
+    const skillBlocks = loaded.map((skill) => {
+      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
+      return [
+        `## ${skill.name}`,
+        "",
+        skill.description,
+        "",
+        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
+        "",
+        skill.body
+      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
+    });
+    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
     parts.push(
-      `# Available Skills
-
-You have access to the following skills: ${agent.skills.join(", ")}.`
+      [
+        "# Available Skills",
+        "",
+        "Use these attached skill instructions when they are relevant to the task.",
+        "",
+        ...skillBlocks,
+        ...unavailableNote ? ["", unavailableNote] : []
+      ].join("\n")
     );
   }
   const teamLines = [
@@ -25066,7 +25580,7 @@ You have access to the following skills: ${agent.skills.join(", ")}.`
     "",
     `- ${agent.team.id} (${agent.team.name}): ${agent.team.path}`,
     "",
-    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Your coding tools (`read`, `bash`, `edit`, `write`, `grep`, `find`, `ls`) are rooted at the team directory. Never use these tools to edit your identity/soul/behaviour files \u2014 those live in your home and are reached via `home_write` / `home_read`."
+    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
   ];
   parts.push(teamLines.join("\n"));
   if (agent.team.userMd.trim()) {
@@ -25090,12 +25604,1040 @@ This team's USER.md is empty. As you learn STABLE facts about the human (prefere
   return parts.join("\n\n---\n\n");
 }
 
+// ../daemon/src/runtime/shell/tooling.ts
+import { existsSync as existsSync12, lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join16, relative as relative3, sep as sep4 } from "path";
+import {
+  createBashToolDefinition,
+  createLocalBashOperations,
+  defineTool as defineTool2
+} from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/shell/approval.ts
+import { defineTool } from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/shell/security.ts
+var DEFAULT_BASH_SANDBOX_IMAGE = "debian:bookworm-slim";
+var SAFE_SHELL_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "SHELL",
+  "TMPDIR",
+  "TZ"
+];
+var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var DOCKER_IMAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/;
+var DOCKER_CLIENT_CONTROL_ENV = /* @__PURE__ */ new Set([
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR"
+]);
+var SANDBOX_CONTROL_ENV = /* @__PURE__ */ new Set(["BASH_ENV"]);
+var SENSITIVE_HOME_PATH_RE = /(?:~(?:[A-Za-z0-9_-]+)?|\$(?:HOME|\{HOME\})|\/(?:home|Users)\/[^\s'"`;|&/]+|\/root)\/\.(?:ssh|aws|gnupg)(?:\/[^\s'"`;|&]*)?/gi;
+var SENSITIVE_FILE_RE = /(?:\bauth\.json\b|\bbazilion\.db\b|(?:^|[\s/'"=])\.env(?:\.[A-Za-z0-9_-]+)?(?=$|[\s/'"`;|&])|\/etc\/(?:shadow|sudoers)(?:\.d\/[^\s'"`;|&]+)?)/gim;
+var SENSITIVE_ENV_RE = /\b(?:OPENAI_CODEX_OAUTH|AWS_ACCESS_KEY_ID|AWS_PROFILE|GOOGLE_APPLICATION_CREDENTIALS|BAZILION_TOKEN|(?:[A-Z][A-Z0-9_]*_)?(?:API_KEY|ACCESS_TOKEN|AUTH_TOKEN|OAUTH_TOKEN|CLIENT_SECRET|SECRET_ACCESS_KEY|PRIVATE_KEY))\b/g;
+var REMOTE_PIPE_RE = /(?:^|[;&|(\n])\s*(?:command\s+)?(?:curl|wget)\b[^;&\n]*(?:\|\s*(?:(?:sudo|env)\s+)*(?:[^\s;&|()]+\/)?(?:sh|bash|dash|zsh|fish|node|python(?:3)?|perl|ruby)\b)/gim;
+var COMMAND_BOUNDARY_RE = /[;&|)\n]/;
+var ShellSecurityConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ShellSecurityConfigError";
+  }
+};
+function isValidEnvName(name) {
+  return ENV_NAME_RE.test(name) && !RESERVED_OBJECT_KEYS.has(name);
+}
+function addRisk(command, risks, seen, input) {
+  const start = Math.max(0, input.start);
+  const end = Math.min(command.length, Math.max(start, input.end));
+  const key2 = `${input.code}:${start}:${end}`;
+  if (seen.has(key2)) return;
+  seen.add(key2);
+  risks.push({
+    code: input.code,
+    severity: input.severity ?? "danger",
+    message: input.message,
+    matchedText: command.slice(start, end),
+    span: { start, end }
+  });
+}
+function addRegexRisks(command, risks, seen, pattern, code, message) {
+  pattern.lastIndex = 0;
+  for (const match of command.matchAll(pattern)) {
+    if (match.index === void 0) continue;
+    let start = match.index;
+    let matchedText = match[0];
+    const leading = matchedText.match(/^[;&|(\n\s]+/);
+    if (leading) {
+      start += leading[0].length;
+      matchedText = matchedText.slice(leading[0].length);
+    }
+    addRisk(command, risks, seen, {
+      code,
+      message,
+      start,
+      end: start + matchedText.length
+    });
+  }
+}
+function shellTokens(fragment) {
+  return Array.from(
+    fragment.matchAll(/"(?:\\.|[^"\\])*"|'[^']*'|[^\s]+/g),
+    (match) => match[0].replace(/^(?:"|')|(?:"|')$/g, "")
+  );
+}
+function isBroadFilesystemTarget(rawTarget) {
+  const target = rawTarget.replace(/[;,]+$/, "");
+  if (target.startsWith("/")) return true;
+  return /^(?:\.|\.\/\*+|\*+|~(?:\/.*)?|\$(?:HOME|\{HOME\})(?:\/.*)?|\.\.(?:\/.*)?)$/.test(target);
+}
+function classifyBroadFilesystemOperations(command, risks, seen) {
+  const commandRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(rm|find|chmod|chown)\b[^;&|)\n]*/gim;
+  for (const match of command.matchAll(commandRe)) {
+    if (match.index === void 0 || !match[1]) continue;
+    const nameOffset = match[0].toLowerCase().indexOf(match[1].toLowerCase());
+    const start = match.index + nameOffset;
+    const text2 = command.slice(start, match.index + match[0].length).trimEnd();
+    const tokens = shellTokens(text2);
+    const name = tokens[0]?.toLowerCase();
+    const args = tokens.slice(1);
+    let risky = false;
+    if (name === "rm") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /[rR]/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
+    } else if (name === "find") {
+      const target = args.find((arg) => !arg.startsWith("-"));
+      risky = args.includes("-delete") && target !== void 0 && isBroadFilesystemTarget(target);
+    } else if (name === "chmod" || name === "chown") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /R/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
+    }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "broad-destructive-operation",
+      message: "Recursively changes or deletes a broad filesystem target.",
+      start,
+      end: start + text2.length
+    });
+  }
+}
+function isLocalHostname(rawHostname) {
+  const hostname = rawHostname.trim().replace(/^.*@/, "").replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "0.0.0.0" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function hasExternalHttpDestination(segment) {
+  const urls = Array.from(segment.matchAll(/https?:\/\/[^\s'"`]+/gi), (match) => match[0]);
+  if (urls.length === 0) return true;
+  return urls.some((rawUrl) => {
+    try {
+      return !isLocalHostname(new URL(rawUrl).hostname);
+    } catch {
+      return true;
+    }
+  });
+}
+function remoteTransferHosts(segment) {
+  const hosts = [];
+  const uriRe = /(?:sftp|ssh|rsync):\/\/(?:[^@\s/]+@)?(\[[^\]]+\]|[^\s/:]+)(?::\d+)?/gi;
+  for (const match of segment.matchAll(uriRe)) {
+    if (match[1]) hosts.push(match[1]);
+  }
+  const scpRe = /(?:^|\s)(?:[^@\s:]+@)?(\[[^\]]+\]|[A-Za-z0-9._-]+):[^\s]+/g;
+  for (const match of segment.matchAll(scpRe)) {
+    if (match[1]) hosts.push(match[1]);
+  }
+  return hosts;
+}
+function invocationSegment(command, match, commandName) {
+  if (match.index === void 0) return null;
+  const nameOffset = match[0].toLowerCase().indexOf(commandName.toLowerCase());
+  if (nameOffset < 0) return null;
+  const start = match.index + nameOffset;
+  const boundaryOffset = command.slice(start).search(COMMAND_BOUNDARY_RE);
+  const end = boundaryOffset < 0 ? command.length : start + boundaryOffset;
+  return { start, text: command.slice(start, end).trimEnd() };
+}
+function classifyOutboundExfiltration(command, risks, seen) {
+  const invocationRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(curl|wget|scp|rsync|nc|netcat|sftp)\b/gim;
+  for (const match of command.matchAll(invocationRe)) {
+    const name = match[1]?.toLowerCase();
+    if (!name) continue;
+    const segment = invocationSegment(command, match, name);
+    if (!segment) continue;
+    let risky = false;
+    if (name === "curl") {
+      const uploads = /(?:^|\s)(?:-X\s*POST\b|-[dFT](?:\s|[^\s]))/.test(segment.text) || /(?:^|\s)(?:--request(?:=|\s+)POST\b|--data(?:-[a-z-]+)?(?:=|\s)|--form(?:-string)?(?:=|\s)|--upload-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "wget") {
+      const uploads = /(?:^|\s)(?:--method(?:=|\s+)POST\b|--post-data(?:=|\s)|--post-file(?:=|\s)|--body-data(?:=|\s)|--body-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "scp" || name === "rsync") {
+      const hosts = remoteTransferHosts(segment.text);
+      risky = hosts.some((host2) => !isLocalHostname(host2)) || hosts.length === 0 && /\$/.test(segment.text);
+    } else if (name === "sftp") {
+      const hosts = remoteTransferHosts(segment.text);
+      if (hosts.length > 0) {
+        risky = hosts.some((host2) => !isLocalHostname(host2));
+      } else {
+        const destination = shellTokens(segment.text).at(-1);
+        risky = destination !== void 0 && destination !== name && !isLocalHostname(destination);
+      }
+    } else {
+      const tokens = shellTokens(segment.text);
+      const host2 = tokens.find(
+        (token, index) => index > 0 && !token.startsWith("-") && !/^\d+$/.test(token) && !["tcp", "udp"].includes(token.toLowerCase())
+      );
+      risky = host2 !== void 0 && !isLocalHostname(host2);
+    }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "outbound-exfiltration",
+      message: "Uploads data or opens a transfer connection to a non-local destination.",
+      start: segment.start,
+      end: segment.start + segment.text.length
+    });
+  }
+}
+function classifyPrivilegeAndCredentialAccess(command, risks, seen) {
+  const patterns = [
+    /(?:^|[;&|(\n])\s*(?:sudo|su|doas|pkexec)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*security\s+(?:find-(?:generic|internet)-password|dump-keychain)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*gcloud\s+auth\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*aws\s+(?:configure|sso\s+login)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*git\s+credential(?:-[A-Za-z0-9_-]+|\s+(?:fill|approve|reject))?\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:docker|npm|gh)\s+(?:login|auth\s+token)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:pass\s+(?:show|ls)|secret-tool\s+lookup|ssh-add\s+-[Ll])\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:env|printenv|set|export\s+-p)\s*(?=$|[;&|)\n])/gim
+  ];
+  for (const pattern of patterns) {
+    addRegexRisks(
+      command,
+      risks,
+      seen,
+      pattern,
+      "privilege-or-credential-access",
+      "Requests elevated privileges or accesses a credential store."
+    );
+  }
+}
+function classifyBashCommand(command) {
+  const risks = [];
+  const seen = /* @__PURE__ */ new Set();
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_HOME_PATH_RE,
+    "sensitive-path-read",
+    "Accesses a path that commonly contains credentials."
+  );
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_FILE_RE,
+    "sensitive-path-read",
+    "Accesses a sensitive environment, authentication, or database file."
+  );
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_ENV_RE,
+    "sensitive-path-read",
+    "References an environment variable name commonly used for credentials."
+  );
+  classifyBroadFilesystemOperations(command, risks, seen);
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    REMOTE_PIPE_RE,
+    "remote-pipe-execution",
+    "Pipes downloaded content directly into an interpreter."
+  );
+  classifyOutboundExfiltration(command, risks, seen);
+  classifyPrivilegeAndCredentialAccess(command, risks, seen);
+  return risks.sort((a, b2) => a.span.start - b2.span.start || a.code.localeCompare(b2.code));
+}
+function parseEnvAllowlist(raw2) {
+  if (raw2 === void 0 || raw2.trim() === "") return [];
+  const values = raw2.split(",").map((value) => value.trim());
+  if (values.some((value) => value === "")) {
+    throw new ShellSecurityConfigError(
+      "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains an empty environment variable name"
+    );
+  }
+  const unique = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (!isValidEnvName(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains invalid environment variable name: ${value}`
+      );
+    }
+    if (DOCKER_CLIENT_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include Docker client control variable: ${value}`
+      );
+    }
+    if (SANDBOX_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include shell startup control variable: ${value}`
+      );
+    }
+    if (!seen.has(value)) {
+      seen.add(value);
+      unique.push(value);
+    }
+  }
+  return unique;
+}
+function resolveShellSecurityConfig(env = process.env) {
+  const rawMode = env.BAZILION_BASH_SANDBOX?.trim() ?? "";
+  if (rawMode !== "" && rawMode !== "off" && rawMode !== "docker") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX must be "off" or "docker", received: ${rawMode}`
+    );
+  }
+  const rawApproval = env.BAZILION_BASH_APPROVAL?.trim() ?? "";
+  if (rawApproval !== "" && rawApproval !== "off" && rawApproval !== "dangerous") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_APPROVAL must be "off" or "dangerous", received: ${rawApproval}`
+    );
+  }
+  const rawImage = env.BAZILION_BASH_SANDBOX_IMAGE?.trim() ?? "";
+  if (rawImage !== "" && !DOCKER_IMAGE_RE.test(rawImage)) {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX_IMAGE is not a valid Docker image reference: ${rawImage}`
+    );
+  }
+  return {
+    sandboxMode: rawMode === "docker" ? "docker" : "off",
+    approvalMode: rawApproval === "dangerous" ? "dangerous" : "off",
+    sandboxImage: rawImage || DEFAULT_BASH_SANDBOX_IMAGE,
+    envAllowlist: parseEnvAllowlist(env.BAZILION_BASH_SANDBOX_ENV_ALLOWLIST)
+  };
+}
+function assertEnvName(name) {
+  if (!isValidEnvName(name)) {
+    throw new ShellSecurityConfigError(`invalid shell environment variable name: ${name}`);
+  }
+  if (DOCKER_CLIENT_CONTROL_ENV.has(name) || SANDBOX_CONTROL_ENV.has(name)) {
+    throw new ShellSecurityConfigError(`unsafe shell environment variable name: ${name}`);
+  }
+}
+function buildScrubbedShellEnv(env, allowedKeys = []) {
+  const scrubbed = {};
+  const keys = new Set(SAFE_SHELL_ENV_KEYS);
+  for (const key2 of allowedKeys) {
+    assertEnvName(key2);
+    keys.add(key2);
+  }
+  for (const key2 of keys) {
+    const value = env[key2];
+    if (value !== void 0) scrubbed[key2] = value;
+  }
+  return scrubbed;
+}
+
+// ../daemon/src/runtime/shell/approval.ts
+var BashApprovalDeniedError = class extends Error {
+  risks;
+  constructor(risks) {
+    const codes = [...new Set(risks.map((risk) => risk.code))];
+    super(`Dangerous bash command denied (${codes.join(", ")})`);
+    this.name = "BashApprovalDeniedError";
+    this.risks = risks;
+  }
+};
+function createApprovalGatedBashTool(base, host2) {
+  return defineTool({
+    ...base,
+    description: `${base.description} Commands classified as dangerous require operator approval before execution.`,
+    executionMode: "sequential",
+    async execute(toolCallId, params, signal, onUpdate, ctx) {
+      const risks = classifyBashCommand(params.command);
+      if (risks.length > 0) {
+        const decision = host2 ? await host2.requestApproval({
+          toolCallId,
+          command: params.command,
+          risks,
+          signal
+        }) : "denied";
+        if (decision !== "approved") throw new BashApprovalDeniedError(risks);
+      }
+      return base.execute(toolCallId, params, signal, onUpdate, ctx);
+    }
+  });
+}
+
+// ../daemon/src/runtime/shell/docker.ts
+import { spawn } from "child_process";
+import { randomUUID as randomUUID15 } from "crypto";
+import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync11, writeFileSync as writeFileSync8 } from "fs";
+import { access, realpath, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { isAbsolute as isAbsolute2, join as join15, relative as relative2, sep as sep3 } from "path";
+var CONTAINER_WORKDIR = "/workspace";
+var MAX_TIMEOUT_MS = 2147483647;
+var MAX_STDERR_CHARS = 16 * 1024;
+var CLEANUP_TIMEOUT_MS = 650;
+var CLEANUP_RETRY_DELAY_MS = 100;
+var CLEANUP_ATTEMPTS = 3;
+var DOCKER_CONTEXT_TIMEOUT_MS = 2e3;
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONTAINER_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]+$/;
+var DOCKER_CLIENT_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR"
+];
+var DOCKER_CLIENT_CONTROL_ENV2 = new Set(DOCKER_CLIENT_ENV_KEYS);
+var SANDBOX_CONTROL_ENV2 = /* @__PURE__ */ new Set(["BASH_ENV"]);
+var CONTAINER_LITERAL_ENV_KEYS = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "SHELL",
+  "TMPDIR",
+  "TZ"
+]);
+function buildDockerRunSpec(input) {
+  const executable = input.dockerPath ?? "docker";
+  validateDockerPath(executable);
+  validateImage(input.image);
+  if (input.resolvedImage !== void 0) validateImage(input.resolvedImage);
+  validateContainerName(input.containerName);
+  validateMountArgument(input.mountSource);
+  const readOnlyMounts = input.readOnlyMounts ?? [];
+  validateReadOnlyMounts(readOnlyMounts, input.mountSource);
+  validateHostIdentity(input.uid, input.gid);
+  if (input.command.includes("\0")) {
+    throw new Error("Docker sandbox command cannot contain a NUL byte");
+  }
+  const args = [
+    "run",
+    "--rm",
+    "--pull",
+    "never",
+    "--name",
+    input.containerName,
+    "--network",
+    "none",
+    "--read-only",
+    "--tmpfs",
+    "/tmp:rw,nosuid,nodev,size=64m,mode=1777",
+    "--user",
+    `${input.uid}:${input.gid}`,
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges=true",
+    "--pids-limit",
+    "256",
+    "--entrypoint",
+    "/bin/bash",
+    "--workdir",
+    CONTAINER_WORKDIR,
+    // A bind mount is read/write unless `readonly` is present. No other mount is added.
+    "--mount",
+    `type=bind,source=${input.mountSource},target=${CONTAINER_WORKDIR},bind-recursive=disabled`
+  ];
+  for (const mount of readOnlyMounts) {
+    args.push(
+      "--mount",
+      `type=bind,source=${mount.source},target=${mount.target},readonly,bind-recursive=disabled`
+    );
+  }
+  const processEnv = buildDockerClientEnv(input.hostEnv ?? process.env);
+  const envFileLines = [];
+  const containerEnvNames = [];
+  for (const [name, value] of sortedEnvironment(input.env)) {
+    containerEnvNames.push(name);
+    if (CONTAINER_LITERAL_ENV_KEYS.has(name)) {
+      args.push("--env", `${name}=${value}`);
+    } else {
+      envFileLines.push(`${name}=${value}`);
+    }
+  }
+  if (envFileLines.length > 0) args.push("--env-file", "/dev/fd/3");
+  args.push("--env", "BASH_ENV=");
+  const cleanAssignments = containerEnvNames.map((name) => `${name}="$${name}"`).join(" ");
+  const cleanEnvironmentCommand = `exec /usr/bin/env -i${cleanAssignments ? ` ${cleanAssignments}` : ""} /bin/bash --noprofile --norc -c "$1"`;
+  args.push(
+    input.resolvedImage ?? input.image,
+    "--noprofile",
+    "--norc",
+    "-c",
+    cleanEnvironmentCommand,
+    "bazilion-sandbox",
+    input.command
+  );
+  return {
+    executable,
+    args,
+    containerName: input.containerName,
+    image: input.image,
+    mountSource: input.mountSource,
+    processEnv,
+    ...envFileLines.length > 0 ? { envFileContent: `${envFileLines.join("\n")}
+` } : {}
+  };
+}
+function createDockerBashOperations(options) {
+  const image = options.image;
+  const env = { ...options.env };
+  const dockerPath = options.dockerPath ?? "docker";
+  const configuredReadOnlyMounts = options.readOnlyMounts ?? [];
+  const hostEnv = { ...options.hostEnv ?? process.env };
+  validateDockerPath(dockerPath);
+  validateImage(image);
+  return {
+    async exec(command, cwd, { onData, signal, timeout }) {
+      const timeoutMs = resolveTimeoutMs(timeout);
+      if (signal?.aborted) throw new Error("aborted");
+      const mountSource = await resolveMountSource(cwd);
+      const readOnlyMounts = await Promise.all(
+        configuredReadOnlyMounts.map(async (mount) => {
+          const source = await resolveMountSource(mount.source);
+          if (mount.sourceRoot && !isWithin(mount.sourceRoot, source)) {
+            throw new Error(
+              `Docker sandbox read-only mount escaped its configured root: ${mount.source}`
+            );
+          }
+          return { source, target: mount.target };
+        })
+      );
+      if (signal?.aborted) throw new Error("aborted");
+      const { uid, gid } = hostIdentity();
+      const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
+      const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
+      if (signal?.aborted) throw new Error("aborted");
+      const containerName = `bazilion-bash-${process.pid}-${randomUUID15().replaceAll("-", "")}`;
+      const spec = buildDockerRunSpec({
+        image,
+        env,
+        dockerPath,
+        command,
+        mountSource,
+        containerName,
+        uid,
+        gid,
+        resolvedImage,
+        readOnlyMounts,
+        hostEnv: dockerClientEnv
+      });
+      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+    }
+  };
+}
+function executeDockerRun(spec, options) {
+  let envFileFd;
+  try {
+    if (spec.envFileContent !== void 0) {
+      envFileFd = openAnonymousEnvFile(spec.envFileContent);
+    }
+  } catch (error2) {
+    return Promise.reject(
+      new Error(
+        `Docker sandbox could not prepare its environment: ${error2 instanceof Error ? error2.message : String(error2)}`
+      )
+    );
+  }
+  return new Promise((resolve7, reject) => {
+    const child = spawn(spec.executable, spec.args, {
+      stdio: ["ignore", "pipe", "pipe", envFileFd ?? "ignore"],
+      windowsHide: true,
+      env: spec.processEnv
+    });
+    if (envFileFd !== void 0) closeSync2(envFileFd);
+    let settled = false;
+    let termination;
+    let timeoutHandle;
+    let stderr = "";
+    const requestTermination = (reason) => {
+      termination ??= reason;
+      child.kill("SIGKILL");
+    };
+    const onAbort = () => requestTermination("aborted");
+    const finish = async (exitCode, spawnError) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      options.signal?.removeEventListener("abort", onAbort);
+      if (!termination && options.signal?.aborted) termination = "aborted";
+      if (termination) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(
+          termination === "aborted" ? new Error("aborted") : new Error(`timeout:${options.timeout}`)
+        );
+        return;
+      }
+      if (spawnError) {
+        reject(formatSpawnError(spec.executable, spawnError));
+        return;
+      }
+      if (exitCode === 125) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(formatDockerRunError(spec, stderr));
+        return;
+      }
+      if (exitCode === null) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(new Error(`Docker sandbox CLI for container "${spec.containerName}" was killed`));
+        return;
+      }
+      resolve7({ exitCode });
+    };
+    child.stdout?.on("data", options.onData);
+    child.stderr?.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-MAX_STDERR_CHARS);
+      options.onData(data);
+    });
+    child.once("error", (error2) => void finish(null, error2));
+    child.once("close", (exitCode) => void finish(exitCode));
+    if (options.timeoutMs !== void 0) {
+      timeoutHandle = setTimeout(() => requestTermination("timeout"), options.timeoutMs);
+    }
+    if (options.signal) {
+      options.signal.addEventListener("abort", onAbort, { once: true });
+      if (options.signal.aborted) onAbort();
+    }
+  });
+}
+function openAnonymousEnvFile(content) {
+  const dir = mkdtempSync2(join15(tmpdir2(), "bazilion-docker-env-"));
+  const path = join15(dir, "environment");
+  let fd;
+  try {
+    writeFileSync8(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    rmSync11(dir, { recursive: true, force: true });
+    return fd;
+  } catch (error2) {
+    if (fd !== void 0) closeSync2(fd);
+    rmSync11(dir, { recursive: true, force: true });
+    throw error2;
+  }
+}
+function resolveTimeoutMs(timeout) {
+  if (timeout === void 0) return void 0;
+  if (!Number.isFinite(timeout) || timeout <= 0) {
+    throw new Error("Invalid timeout: must be a finite number of seconds");
+  }
+  const timeoutMs = timeout * 1e3;
+  if (timeoutMs > MAX_TIMEOUT_MS) {
+    throw new Error(`Invalid timeout: maximum is ${MAX_TIMEOUT_MS / 1e3} seconds`);
+  }
+  return timeoutMs;
+}
+async function resolveMountSource(cwd) {
+  try {
+    await access(cwd, constants2.F_OK);
+    const info = await stat(cwd);
+    if (!info.isDirectory()) {
+      throw new Error(`Docker sandbox mount is not a directory: ${cwd}`);
+    }
+    return await realpath(cwd);
+  } catch (error2) {
+    if (error2 instanceof Error && error2.message.startsWith("Docker sandbox mount is not")) {
+      throw error2;
+    }
+    const code = error2.code;
+    if (code === "ENOENT") {
+      throw new Error(`Docker sandbox mount does not exist: ${cwd}`);
+    }
+    throw new Error(
+      `Docker sandbox cannot access mount "${cwd}": ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+  }
+}
+function hostIdentity() {
+  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
+    throw new Error("Docker sandbox requires a host platform with numeric uid/gid support");
+  }
+  return { uid: process.getuid(), gid: process.getgid() };
+}
+function sortedEnvironment(env) {
+  const entries = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (value === void 0) continue;
+    if (!ENV_NAME.test(name)) {
+      throw new Error(
+        `Docker sandbox environment variable name is invalid: ${JSON.stringify(name)}`
+      );
+    }
+    if (DOCKER_CLIENT_CONTROL_ENV2.has(name) && !CONTAINER_LITERAL_ENV_KEYS.has(name)) {
+      throw new Error(`Docker sandbox cannot pass Docker client control variable: ${name}`);
+    }
+    if (SANDBOX_CONTROL_ENV2.has(name)) {
+      throw new Error(`Docker sandbox cannot pass shell startup control variable: ${name}`);
+    }
+    if (value.includes("\0")) {
+      throw new Error(`Docker sandbox environment variable ${name} contains a NUL byte`);
+    }
+    if (value.includes("\n") || value.includes("\r")) {
+      throw new Error(`Docker sandbox environment variable ${name} cannot contain a line break`);
+    }
+    entries.push([name, value]);
+  }
+  return entries.sort(([a], [b2]) => a < b2 ? -1 : a > b2 ? 1 : 0);
+}
+async function resolveLocalDockerClientEnv(dockerPath, hostEnv) {
+  const discoveryEnv = buildDockerClientEnv(hostEnv);
+  const endpoint2 = await inspectDockerEndpoint(dockerPath, discoveryEnv);
+  const prefix = "unix://";
+  if (!endpoint2.startsWith(prefix) || !isAbsolute2(endpoint2.slice(prefix.length))) {
+    throw new Error(
+      `Docker sandbox requires a local Unix-socket context; active endpoint is ${JSON.stringify(endpoint2)}`
+    );
+  }
+  const pinned = { DOCKER_HOST: endpoint2 };
+  if (hostEnv.PATH !== void 0) pinned.PATH = hostEnv.PATH;
+  if (hostEnv.HOME !== void 0) pinned.HOME = hostEnv.HOME;
+  return pinned;
+}
+async function inspectDockerEndpoint(dockerPath, processEnv) {
+  const raw2 = await runDockerInspection(
+    dockerPath,
+    ["context", "inspect", "--format", "{{json .Endpoints.docker.Host}}"],
+    processEnv,
+    "the active context"
+  );
+  try {
+    const parsed = JSON.parse(raw2);
+    if (typeof parsed !== "string" || parsed.length === 0) throw new Error("empty endpoint");
+    return parsed;
+  } catch {
+    throw new Error(
+      `Docker sandbox could not resolve the active Docker endpoint: ${raw2 || "empty context response"}`
+    );
+  }
+}
+async function inspectSandboxImage(dockerPath, image, processEnv) {
+  let raw2;
+  try {
+    raw2 = await runDockerInspection(
+      dockerPath,
+      ["image", "inspect", "--format", '{{json .Id}}	{{json (index .Config "Volumes")}}', image],
+      processEnv,
+      `local image ${JSON.stringify(image)}`
+    );
+  } catch (error2) {
+    const detail3 = error2 instanceof Error ? error2.message : String(error2);
+    if (/no such image|unable to find image|manifest unknown/i.test(detail3)) {
+      throw new Error(`Docker sandbox image "${image}" is unavailable: ${detail3}`);
+    }
+    throw error2;
+  }
+  const separator = raw2.indexOf("	");
+  if (separator < 0) {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  let id;
+  let volumes;
+  try {
+    id = JSON.parse(raw2.slice(0, separator));
+    volumes = JSON.parse(raw2.slice(separator + 1));
+  } catch {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  if (typeof id !== "string" || !id.startsWith("sha256:")) {
+    throw new Error(`Docker sandbox received an invalid image id for "${image}"`);
+  }
+  if (volumes !== null && typeof volumes === "object" && Object.keys(volumes).length > 0) {
+    throw new Error(
+      `Docker sandbox image "${image}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
+    );
+  }
+  if (volumes !== null && (typeof volumes !== "object" || Array.isArray(volumes))) {
+    throw new Error(`Docker sandbox received invalid volume metadata for image "${image}"`);
+  }
+  return id;
+}
+function runDockerInspection(dockerPath, args, processEnv, subject) {
+  return new Promise((resolve7, reject) => {
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    let settled = false;
+    let stdout = "";
+    let stderr = "";
+    const finish = (error2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutHandle);
+      if (error2) {
+        reject(error2);
+        return;
+      }
+      resolve7(stdout.trim());
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(
+        new Error(
+          `Docker sandbox could not inspect ${subject} within ${DOCKER_CONTEXT_TIMEOUT_MS}ms`
+        )
+      );
+    }, DOCKER_CONTEXT_TIMEOUT_MS);
+    child.stdout.on("data", (data) => {
+      stdout = `${stdout}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.once("error", (error2) => finish(formatSpawnError(dockerPath, error2)));
+    child.once("close", (code) => {
+      if (code === 0) finish();
+      else
+        finish(
+          new Error(
+            `Docker sandbox could not inspect ${subject}: ${stderr.trim() || `Docker exited with status ${code}`}`
+          )
+        );
+    });
+  });
+}
+function buildDockerClientEnv(hostEnv) {
+  const env = {};
+  for (const key2 of DOCKER_CLIENT_ENV_KEYS) {
+    const value = hostEnv[key2];
+    if (value !== void 0) env[key2] = value;
+  }
+  return env;
+}
+function validateDockerPath(dockerPath) {
+  if (!dockerPath.trim()) throw new Error("Docker sandbox executable path is required");
+  if (dockerPath.includes("\0"))
+    throw new Error("Docker sandbox executable path contains a NUL byte");
+}
+function validateImage(image) {
+  if (!image.trim()) throw new Error("Docker sandbox image is required");
+  if (image.startsWith("-")) {
+    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image)}`);
+  }
+  if (image.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
+}
+function validateContainerName(containerName) {
+  if (!CONTAINER_NAME.test(containerName)) {
+    throw new Error(`Docker sandbox container name is invalid: ${JSON.stringify(containerName)}`);
+  }
+}
+function validateMountArgument(mountSource) {
+  if (!mountSource) throw new Error("Docker sandbox mount path is required");
+  if (mountSource.includes("\0") || mountSource.includes(",")) {
+    throw new Error(
+      `Docker sandbox mount path cannot be represented safely: ${JSON.stringify(mountSource)}`
+    );
+  }
+}
+function validateReadOnlyMounts(mounts, workspaceSource) {
+  const targets = /* @__PURE__ */ new Set([CONTAINER_WORKDIR, "/tmp"]);
+  for (const mount of mounts) {
+    validateMountArgument(mount.source);
+    if (mount.sourceRoot !== void 0 && (!isAbsolute2(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
+      throw new Error(
+        `Docker sandbox read-only mount root is invalid: ${JSON.stringify(mount.sourceRoot)}`
+      );
+    }
+    if (!mount.target.startsWith("/") || mount.target.includes("\0") || mount.target.includes(",") || mount.target.split("/").includes("..")) {
+      throw new Error(
+        `Docker sandbox read-only mount target is invalid: ${JSON.stringify(mount.target)}`
+      );
+    }
+    if (mount.source === workspaceSource) {
+      throw new Error("Docker sandbox cannot mount the writable workspace again as an input");
+    }
+    if (targets.has(mount.target)) {
+      throw new Error(`Docker sandbox mount target is duplicated or reserved: ${mount.target}`);
+    }
+    targets.add(mount.target);
+  }
+}
+function isWithin(root, candidate) {
+  const rel = relative2(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute2(rel);
+}
+function validateHostIdentity(uid, gid) {
+  if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
+    throw new Error(`Docker sandbox received an invalid host uid/gid: ${uid}:${gid}`);
+  }
+}
+function formatSpawnError(dockerPath, error2) {
+  const code = error2.code;
+  if (code === "ENOENT") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
+  }
+  if (code === "EACCES") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+  }
+  return new Error(`Docker sandbox could not start "${dockerPath}": ${error2.message}`);
+}
+function formatDockerRunError(spec, stderr) {
+  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
+  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
+    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  }
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  }
+  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
+}
+async function removeContainer(dockerPath, containerName, processEnv) {
+  const args = ["container", "rm", "--force", containerName];
+  let last;
+  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
+    last = await runCleanupCommand(dockerPath, args, processEnv);
+    if (last.ok) return;
+    if (attempt < CLEANUP_ATTEMPTS - 1) {
+      await new Promise((resolve7) => setTimeout(resolve7, CLEANUP_RETRY_DELAY_MS));
+    }
+  }
+  if (last && !last.missing) {
+    console.warn(
+      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+    );
+  }
+}
+function runCleanupCommand(dockerPath, args, processEnv) {
+  return new Promise((resolve7) => {
+    let done = false;
+    let stderr = "";
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    const finish = (ok, error2 = "") => {
+      if (done) return;
+      done = true;
+      clearTimeout(timeoutHandle);
+      const detail3 = error2 || stderr.trim();
+      resolve7({
+        ok,
+        missing: /no such container/i.test(detail3),
+        error: detail3
+      });
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
+    }, CLEANUP_TIMEOUT_MS);
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
+    });
+    child.once("error", (error2) => finish(false, error2.message));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+
+// ../daemon/src/runtime/shell/tooling.ts
+var HOST_CODING_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
+var HOST_FILE_TOOL_NAMES = ["read", "edit", "write", "grep", "find", "ls"];
+var CONTAINER_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var SANDBOX_INPUTS_DIR = "/inputs";
+var SANDBOX_MEMORY_DIR = "/workspace/memory";
+function buildSandboxContainerEnv(env, allowlist) {
+  return {
+    ...buildScrubbedShellEnv(env, allowlist),
+    PATH: CONTAINER_PATH,
+    HOME: "/tmp",
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    SHELL: "/bin/bash",
+    TMPDIR: "/tmp"
+  };
+}
+function createSessionShellTools(cwd, env, options = {}) {
+  const config2 = resolveShellSecurityConfig(env);
+  if (config2.sandboxMode === "off" && config2.approvalMode === "off") {
+    return { config: config2, hostToolNames: HOST_CODING_TOOL_NAMES };
+  }
+  if (config2.sandboxMode === "off") {
+    const base2 = createBashToolDefinition(cwd, {
+      operations: createLocalBashOperations()
+    });
+    const customBash2 = createApprovalGatedBashTool(base2, options.approvalHost);
+    return { config: config2, hostToolNames: HOST_FILE_TOOL_NAMES, customBash: customBash2 };
+  }
+  const operations = createDockerBashOperations({
+    image: config2.sandboxImage,
+    env: buildSandboxContainerEnv(env, config2.envAllowlist),
+    readOnlyMounts: [
+      ...existsSync12(join16(cwd, "memory")) ? [safeReadOnlyMount(join16(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
+      ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname4(options.inputsDir))] : [],
+      ...(options.skillMounts ?? []).map(
+        (mount) => safeReadOnlyMount(mount.source, mount.target, dirname4(mount.source))
+      )
+    ]
+  });
+  const base = createBashToolDefinition(cwd, { operations });
+  const dockerBash = defineTool2({
+    ...base,
+    label: "bash (Docker sandbox)",
+    description: `${base.description} Runs in an ephemeral, network-disabled Docker container with the team workspace mounted read/write plus only bounded read-only memory, skill, and attachment mounts. Other host files and host credentials are unavailable.`
+  });
+  const customBash = config2.approvalMode === "dangerous" ? createApprovalGatedBashTool(dockerBash, options.approvalHost) : dockerBash;
+  return { config: config2, hostToolNames: [], customBash };
+}
+function safeReadOnlyMount(source, target, expectedRoot) {
+  const info = lstatSync2(source);
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
+  }
+  const sourceRoot = realpathSync2(expectedRoot);
+  const canonicalSource = realpathSync2(source);
+  const rel = relative3(sourceRoot, canonicalSource);
+  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute3(rel);
+  if (!contained) {
+    throw new Error(`Docker sandbox read-only mount escaped its configured root: ${source}`);
+  }
+  return { source: canonicalSource, target, sourceRoot };
+}
+
 // ../daemon/src/runtime/pi/tools.ts
 import { Type as Type2 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
-import { existsSync as existsSync13, rmSync as rmSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync13, rmSync as rmSync12 } from "fs";
+import { join as join17 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -25104,9 +26646,9 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join15(agentDir, "BOOTSTRAP.md");
+      const path = join17(agentDir, "BOOTSTRAP.md");
       if (existsSync13(path)) {
-        rmSync11(path);
+        rmSync12(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
       }
       return "BOOTSTRAP.md was already removed.";
@@ -25244,8 +26786,16 @@ function browserTools(host2, agentId) {
 }
 
 // ../daemon/src/runtime/tools/deliver-file.ts
-import { readFileSync as readFileSync11, statSync as statSync5 } from "fs";
-import { basename as basename2, extname, isAbsolute, resolve as resolve3 } from "path";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  fstatSync as fstatSync2,
+  openSync as openSync3,
+  readFileSync as readFileSync11,
+  realpathSync as realpathSync3,
+  statSync as statSync4
+} from "fs";
+import { basename as basename2, extname, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4, sep as sep5 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -25261,7 +26811,17 @@ var MIME = {
   ".gif": "image/gif",
   ".webp": "image/webp"
 };
+function isWithin2(root, candidate) {
+  const rel = relative4(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute4(rel);
+}
 function deliverFileTool(cwd, sink) {
+  const workspacePath = resolve4(cwd);
+  let workspaceRealPath = null;
+  try {
+    workspaceRealPath = realpathSync3(workspacePath);
+  } catch {
+  }
   return {
     def: {
       name: "deliver_file",
@@ -25271,7 +26831,7 @@ function deliverFileTool(cwd, sink) {
         properties: {
           path: {
             type: "string",
-            description: "Path to the file, relative to your workspace or absolute."
+            description: "Path to a file, relative to your workspace."
           }
         },
         required: ["path"],
@@ -25281,29 +26841,71 @@ function deliverFileTool(cwd, sink) {
     async invoke(args) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
-      const abs = isAbsolute(p) ? p : resolve3(cwd, p);
-      let size;
+      if (isAbsolute4(p)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      const abs = resolve4(workspacePath, p);
+      if (!isWithin2(workspacePath, abs)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      if (!workspaceRealPath) {
+        throw new Error("deliver_file: workspace is unavailable");
+      }
+      let real;
+      let expected;
       try {
-        size = statSync5(abs).size;
+        real = realpathSync3(abs);
+        expected = statSync4(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
-      if (size > MAX_DELIVER_BYTES) {
-        throw new Error(
-          `deliver_file: "${basename2(abs)}" is too large (${(size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
-        );
+      if (!isWithin2(workspaceRealPath, real)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      let fd;
+      try {
+        fd = openSync3(real, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+      } catch {
+        throw new Error(`deliver_file: no such file: ${p}`);
+      }
+      let data;
+      try {
+        const stat2 = fstatSync2(fd);
+        if (!stat2.isFile()) {
+          throw new Error(`deliver_file: not a regular file: ${p}`);
+        }
+        if (stat2.dev !== expected.dev || stat2.ino !== expected.ino) {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        let confirmedReal;
+        try {
+          confirmedReal = realpathSync3(abs);
+        } catch {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        if (confirmedReal !== real) {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        if (stat2.size > MAX_DELIVER_BYTES) {
+          throw new Error(
+            `deliver_file: "${basename2(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
+          );
+        }
+        data = readFileSync11(fd).toString("base64");
+      } finally {
+        closeSync3(fd);
       }
       const name = basename2(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
-      sink({ name, mimeType, data: readFileSync11(abs).toString("base64") });
+      sink({ name, mimeType, data });
       return `Delivered "${name}" (${mimeType}) to the user.`;
     }
   };
 }
 
 // ../daemon/src/runtime/tools/home.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync12, statSync as statSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join16 } from "path";
+import { readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { join as join18 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
@@ -25333,7 +26935,7 @@ function homeTools(agentDir) {
             `home_read: "file" must be one of ${HOME_FILES_READABLE.join(", ")}; got "${file}"`
           );
         }
-        const path = join16(agentDir, file);
+        const path = join18(agentDir, file);
         try {
           return readFileSync12(path, "utf8");
         } catch (err) {
@@ -25363,8 +26965,8 @@ function homeTools(agentDir) {
           );
         }
         const content = typeof args.content === "string" ? args.content : "";
-        const path = join16(agentDir, file);
-        writeFileSync8(path, content, "utf8");
+        const path = join18(agentDir, file);
+        writeFileSync9(path, content, "utf8");
         return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
       }
     },
@@ -25377,9 +26979,9 @@ function homeTools(agentDir) {
       async invoke() {
         const entries = [];
         for (const file of HOME_FILES_READABLE) {
-          const path = join16(agentDir, file);
+          const path = join18(agentDir, file);
           try {
-            const s = statSync6(path);
+            const s = statSync5(path);
             entries.push(`${file} (${s.size}b)`);
           } catch {
           }
@@ -25387,7 +26989,7 @@ function homeTools(agentDir) {
         if (entries.length === 0) {
           const dirEntries = (() => {
             try {
-              return readdirSync7(agentDir);
+              return readdirSync8(agentDir);
             } catch {
               return [];
             }
@@ -26302,7 +27904,6 @@ function createBazilionCustomTools(opts) {
 }
 
 // ../daemon/src/runtime/pi/session.ts
-var BUILTIN_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
 async function createBazilionSession(opts) {
   const {
     agent,
@@ -26316,6 +27917,7 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    bashApprovalHost,
     refreshApiKey
   } = opts;
   const { providerName, modelId } = splitModelString(agent.model);
@@ -26348,7 +27950,17 @@ async function createBazilionSession(opts) {
   }
   const cwd = agent.team.path;
   if (!existsSync14(cwd)) mkdirSync6(cwd, { recursive: true });
-  const sessionDir = join17(paths.agentDir(agent.agent.id), "sessions");
+  const promptSkills = loadPromptSkills(paths.skillsDir, agent.skills);
+  const uploadsDir = join19(agent.agent.dir, "uploads");
+  const shellTools = createSessionShellTools(cwd, env, {
+    ...existsSync14(uploadsDir) ? { inputsDir: uploadsDir } : {},
+    skillMounts: promptSkills.map((skill) => ({
+      source: skill.hostDir,
+      target: skill.sandboxDir
+    })),
+    approvalHost: bashApprovalHost
+  });
+  const sessionDir = join19(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync6(sessionDir, { recursive: true });
   const existing = findMostRecent(sessionDir);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
@@ -26361,10 +27973,13 @@ async function createBazilionSession(opts) {
       provider: { maxRetryDelayMs: 8e3 }
     }
   });
-  const bazilionPrompt = buildSystemPrompt(agent);
+  const bazilionPrompt = buildSystemPrompt(agent, {
+    skills: promptSkills,
+    sandboxMode: shellTools.config.sandboxMode
+  });
   const resourceLoader = createBazilionResourceLoader(bazilionPrompt);
   await resourceLoader.reload();
-  const customTools = createBazilionCustomTools({
+  const bazilionTools = createBazilionCustomTools({
     agent,
     memory,
     messagingHost,
@@ -26375,10 +27990,11 @@ async function createBazilionSession(opts) {
     fileSink,
     env
   });
-  const allowedTools = [...BUILTIN_TOOL_NAMES, ...customTools.map((t) => t.name)];
+  const customTools = shellTools.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
+  const allowedTools = [...shellTools.hostToolNames, ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join17(paths.home, "pi"),
+    agentDir: join19(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(agent.reasoningLevel),
     tools: allowedTools,
@@ -26504,7 +28120,7 @@ function createBazilionResourceLoader(appendSystemPrompt) {
   };
 }
 function loadInitialMessages(agent, paths) {
-  const sessionDir = join17(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = join19(paths.agentDir(agent.agent.id), "sessions");
   if (!existsSync14(sessionDir)) return [];
   const cwd = agent.team.path;
   if (!existsSync14(cwd)) return [];
@@ -26523,12 +28139,12 @@ function loadInitialMessages(agent, paths) {
   }
 }
 function loadSessionHead(agent, paths) {
-  const sessionDir = join17(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = join19(paths.agentDir(agent.agent.id), "sessions");
   if (!existsSync14(sessionDir)) return { file: null, size: 0 };
   const recent = findMostRecent(sessionDir);
   if (!recent) return { file: null, size: 0 };
   try {
-    const s = statSync7(recent);
+    const s = statSync6(recent);
     return { file: basename3(recent), size: s.size };
   } catch {
     return { file: null, size: 0 };
@@ -26537,11 +28153,11 @@ function loadSessionHead(agent, paths) {
 function findMostRecent(sessionDir) {
   if (!existsSync14(sessionDir)) return null;
   let newest = null;
-  for (const entry of readdirSync8(sessionDir)) {
+  for (const entry of readdirSync9(sessionDir)) {
     if (!entry.endsWith(".jsonl")) continue;
-    const path = join17(sessionDir, entry);
+    const path = join19(sessionDir, entry);
     try {
-      const s = statSync7(path);
+      const s = statSync6(path);
       if (!newest || s.mtimeMs > newest.mtimeMs) newest = { path, mtimeMs: s.mtimeMs };
     } catch {
     }
@@ -26670,22 +28286,78 @@ function listCatalogModelsSync(providerName) {
 }
 
 // ../daemon/src/runtime/worker/spawn.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync15 } from "fs";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+
+// ../daemon/src/runtime/worker/api-key-refresh.ts
+async function refreshApiKeyForTurn(args, context, host2, signal) {
+  if (args.agentId !== context.agentId || args.turnId !== context.turnId) {
+    throw new Error("API key refresh request does not belong to this worker turn");
+  }
+  assertOpenAICodexProvider(args.providerName, context.providerName);
+  if (!host2) throw new Error("OpenAI Codex refresh is unavailable for this worker turn");
+  if (signal?.aborted) throw refreshCancelledError();
+  let token;
+  try {
+    const pending = host2.refresh(args.providerName, signal);
+    token = await waitForRefresh(pending, signal);
+  } catch (error2) {
+    if (error2 instanceof ApiKeyRefreshCancelledError) throw error2;
+    throw new Error("OpenAI Codex access token refresh failed \u2014 reconnect on /config and retry");
+  }
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("API key refresh returned an invalid token");
+  }
+  return token;
+}
+function assertOpenAICodexProvider(requested, expected) {
+  if (expected !== "openai-codex" || requested !== expected) {
+    throw new Error("unexpected API key refresh provider");
+  }
+}
+function waitForRefresh(pending, signal) {
+  if (!signal) return pending;
+  return new Promise((resolve7, reject) => {
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    };
+    const onAbort = () => finish(() => reject(refreshCancelledError()));
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    pending.then(
+      (value) => finish(() => resolve7(value)),
+      (error2) => finish(() => reject(error2))
+    );
+  });
+}
+var ApiKeyRefreshCancelledError = class extends Error {
+};
+function refreshCancelledError() {
+  return new ApiKeyRefreshCancelledError("API key refresh cancelled with the worker turn");
+}
+
+// ../daemon/src/runtime/worker/spawn.ts
 var DEFAULT_KILL_GRACE_MS = 3e3;
 var sourceEntryPath = fileURLToPath2(new URL("./entry.ts", import.meta.url));
 var bundledEntryPath = fileURLToPath2(new URL("./worker.js", import.meta.url));
 var entryPath = existsSync15(sourceEntryPath) ? sourceEntryPath : bundledEntryPath;
-var entryIsTs = entryPath.endsWith(".ts");
-function workerSpawnArgs() {
-  if (!entryIsTs) return [entryPath];
+function workerSpawnArgs(workerEntryPath = entryPath) {
+  const workerEntryIsTs = workerEntryPath.endsWith(".ts");
+  if (!workerEntryIsTs) return [workerEntryPath];
   const tsFeature = process.features.typescript;
   if (typeof tsFeature === "string" || tsFeature === true) {
-    return ["--experimental-strip-types", "--no-warnings", entryPath];
+    return ["--experimental-strip-types", "--no-warnings", workerEntryPath];
   }
-  return ["--import", tsxImportSpecifier(), entryPath];
+  return ["--import", tsxImportSpecifier(), workerEntryPath];
 }
 var cachedTsxImport = null;
 function tsxImportSpecifier() {
@@ -26695,23 +28367,42 @@ function tsxImportSpecifier() {
   return cachedTsxImport;
 }
 async function* spawnWorkerTurn(spec, opts = {}) {
-  const child = spawn(process.execPath, workerSpawnArgs(), {
+  const child = spawn2(process.execPath, workerSpawnArgs(opts.workerEntryPath), {
     env: opts.env ?? process.env,
     stdio: ["pipe", "pipe", "inherit", "ipc"]
   });
-  if (opts.messagingHost || opts.userMdHost || opts.browserHost || opts.mcpHost) {
+  const frames = new AsyncFrameQueue();
+  const ipcLifetime = new AbortController();
+  if (opts.messagingHost || opts.userMdHost || opts.browserHost || opts.mcpHost || opts.bashApprovalHost || opts.apiKeyRefreshHost) {
     attachIpcHandler(child, {
       messagingHost: opts.messagingHost,
       userMdHost: opts.userMdHost,
       browserHost: opts.browserHost,
-      mcpHost: opts.mcpHost
+      mcpHost: opts.mcpHost,
+      bashApprovalHost: opts.bashApprovalHost,
+      apiKeyRefreshHost: opts.apiKeyRefreshHost,
+      apiKeyRefreshContext: {
+        providerName: spec.agent.model.split(":", 1)[0] ?? "",
+        agentId: spec.agent.agent.id,
+        turnId: spec.turnId
+      },
+      ipcSignal: ipcLifetime.signal,
+      onBashApproval: (approval) => {
+        frames.push({ kind: "event", event: { type: "command_approval", approval } });
+      }
     });
   }
-  child.stdin?.write(JSON.stringify(spec));
+  child.stdin?.write(
+    JSON.stringify({
+      ...spec,
+      apiKeyRefreshEnabled: opts.apiKeyRefreshHost !== void 0
+    })
+  );
   child.stdin?.end();
   const grace = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
   let killTimer = null;
   const onAbort = () => {
+    ipcLifetime.abort();
     if (child.exitCode !== null || child.signalCode !== null) return;
     try {
       child.kill("SIGTERM");
@@ -26730,37 +28421,23 @@ async function* spawnWorkerTurn(spec, opts = {}) {
   if (opts.signal?.aborted) onAbort();
   else opts.signal?.addEventListener("abort", onAbort);
   const waitForExit = new Promise(
-    (resolve4) => {
+    (resolve7) => {
       if (child.exitCode !== null || child.signalCode !== null) {
-        resolve4({ code: child.exitCode, signal: child.signalCode });
+        resolve7({ code: child.exitCode, signal: child.signalCode });
         return;
       }
-      child.once("close", (code, signal) => resolve4({ code, signal }));
+      child.once("close", (code, signal) => resolve7({ code, signal }));
     }
   );
   let emittedFatal = false;
   try {
-    let buf = "";
     if (!child.stdout) throw new Error("worker spawn: stdout pipe missing");
-    for await (const chunk of child.stdout) {
-      buf += chunk.toString("utf8");
-      let idx = buf.indexOf("\n");
-      while (idx !== -1) {
-        const line = buf.slice(0, idx);
-        buf = buf.slice(idx + 1);
-        if (line.trim()) {
-          const frame = parseFrame(line);
-          if (frame.kind === "fatal") emittedFatal = true;
-          yield frame;
-        }
-        idx = buf.indexOf("\n");
-      }
-    }
-    if (buf.trim()) {
-      const frame = parseFrame(buf);
+    const stdoutTask = pumpWorkerFrames(child.stdout, frames);
+    for await (const frame of frames) {
       if (frame.kind === "fatal") emittedFatal = true;
       yield frame;
     }
+    await stdoutTask;
     const exit = await waitForExit;
     if (!emittedFatal && exit.code !== 0 && exit.code !== null) {
       yield {
@@ -26771,6 +28448,7 @@ async function* spawnWorkerTurn(spec, opts = {}) {
       yield { kind: "fatal", error: `worker killed by ${exit.signal}` };
     }
   } finally {
+    ipcLifetime.abort();
     opts.signal?.removeEventListener("abort", onAbort);
     if (killTimer) clearTimeout(killTimer);
     try {
@@ -26864,12 +28542,88 @@ async function dispatch(req, hosts) {
           req.args.args
         );
         break;
+      case "refreshApiKey":
+        result = await refreshApiKeyForTurn(
+          req.args,
+          require2(hosts.apiKeyRefreshContext, "apiKeyRefreshContext", req.method),
+          hosts.apiKeyRefreshHost,
+          hosts.ipcSignal
+        );
+        break;
+      case "bashApproval": {
+        const handle12 = require2(hosts.bashApprovalHost, "bashApproval", req.method).begin(
+          req.args,
+          hosts.ipcSignal
+        );
+        hosts.onBashApproval?.(handle12.approval);
+        const decision = await handle12.decision;
+        result = decision;
+        if (handle12.approval.status === "pending") {
+          hosts.onBashApproval?.({
+            ...handle12.approval,
+            status: approvalStatusForDecision(decision)
+          });
+        }
+        break;
+      }
     }
     return { type: "rpc-reply", id: req.id, ok: true, result };
   } catch (err) {
     return { type: "rpc-reply", id: req.id, ok: false, error: err.message };
   }
 }
+function approvalStatusForDecision(result) {
+  if (result.reason === "auto_deny") return "auto_denied";
+  if (result.reason === "timeout") return "expired";
+  if (result.reason === "cancelled") return "cancelled";
+  return result.decision === "allow" ? "allowed" : "denied";
+}
+var AsyncFrameQueue = class {
+  #frames = [];
+  #waiters = [];
+  #ended = false;
+  push(frame) {
+    if (this.#ended) return;
+    const waiter = this.#waiters.shift();
+    if (waiter) waiter({ done: false, value: frame });
+    else this.#frames.push(frame);
+  }
+  end() {
+    if (this.#ended) return;
+    this.#ended = true;
+    for (const waiter of this.#waiters.splice(0)) waiter({ done: true, value: void 0 });
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        const frame = this.#frames.shift();
+        if (frame) return Promise.resolve({ done: false, value: frame });
+        if (this.#ended) return Promise.resolve({ done: true, value: void 0 });
+        return new Promise((resolve7) => this.#waiters.push(resolve7));
+      }
+    };
+  }
+};
+async function pumpWorkerFrames(stdout, frames) {
+  let buf = "";
+  try {
+    for await (const chunk of stdout) {
+      buf += chunk.toString("utf8");
+      let idx = buf.indexOf("\n");
+      while (idx !== -1) {
+        const line = buf.slice(0, idx);
+        buf = buf.slice(idx + 1);
+        if (line.trim()) frames.push(parseFrame(line));
+        idx = buf.indexOf("\n");
+      }
+    }
+    if (buf.trim()) frames.push(parseFrame(buf));
+  } catch (error2) {
+    frames.push({ kind: "fatal", error: `worker stdout failed: ${error2.message}` });
+  } finally {
+    frames.end();
+  }
+}
 
 // ../daemon/src/lib/api-key.ts
 async function resolveAgentApiKey(db, authToken, agent, opts = {}) {
@@ -26894,9 +28648,9 @@ async function resolveAgentApiKey(db, authToken, agent, opts = {}) {
 }
 
 // ../daemon/src/lib/attachments.ts
-import { randomUUID as randomUUID14 } from "crypto";
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
-import { join as join18 } from "path";
+import { randomUUID as randomUUID16 } from "crypto";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "fs";
+import { join as join20, posix } from "path";
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
 function safeName(name) {
   const base = name.split(/[\\/]/).pop() ?? "file";
@@ -26907,9 +28661,9 @@ function fmtBytes(n) {
   if (n < 1024 * 1024) return `${Math.round(n / 1024)} KB`;
   return `${(n / (1024 * 1024)).toFixed(1)} MB`;
 }
-function saveInputFiles(agentDir, files) {
+function saveInputFiles(agentDir, files, options = {}) {
   if (!files || files.length === 0) return "";
-  const dir = join18(agentDir, "uploads");
+  const dir = join20(agentDir, "uploads");
   mkdirSync7(dir, { recursive: true });
   const lines = [];
   for (const f of files) {
@@ -26919,15 +28673,177 @@ function saveInputFiles(agentDir, files) {
       lines.push(`[attachment "${label}" skipped: too large (${fmtBytes(buf.byteLength)} > 25 MB)]`);
       continue;
     }
-    const path = join18(dir, `${randomUUID14().slice(0, 8)}-${safeName(label)}`);
-    writeFileSync9(path, buf);
+    const filename = `${randomUUID16().slice(0, 8)}-${safeName(label)}`;
+    const path = join20(dir, filename);
+    writeFileSync10(path, buf);
+    const referencePath = options.referenceDir ? posix.join(options.referenceDir, filename) : path;
     lines.push(
-      `[file saved to ${path} (${f.mimeType || "unknown"}, ${fmtBytes(buf.byteLength)}) \u2014 open it with your tools]`
+      `[file saved to ${referencePath} (${f.mimeType || "unknown"}, ${fmtBytes(buf.byteLength)}) \u2014 open it with your tools]`
     );
   }
   return lines.join("\n");
 }
 
+// ../daemon/src/lib/bash-approval.ts
+var DEFAULT_BASH_APPROVAL_TIMEOUT_MS = 12e4;
+var DEFAULT_TOMBSTONE_TTL_MS = 6e4;
+var CommandApprovalRegistry = class {
+  #pending = /* @__PURE__ */ new Map();
+  /**
+   * Exactly-once claim for one worker turn's tool call. Unlike response
+   * tombstones, this survives settlement and is released only when that
+   * worker's IPC lifetime ends (or the registry is explicitly cleared).
+   */
+  #attemptKeys = /* @__PURE__ */ new Map();
+  #terminal = /* @__PURE__ */ new Map();
+  #timeoutMs;
+  #tombstoneTtlMs;
+  #now;
+  #audit;
+  constructor(options = {}) {
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_BASH_APPROVAL_TIMEOUT_MS;
+    this.#tombstoneTtlMs = options.tombstoneTtlMs ?? DEFAULT_TOMBSTONE_TTL_MS;
+    this.#now = options.now ?? Date.now;
+    this.#audit = options.audit ?? logBashApprovalDecision;
+  }
+  begin(input, signal) {
+    const key2 = approvalKey(input.turnId, input.toolCallId);
+    if (this.#pending.has(input.id) || this.#terminal.has(input.id)) {
+      throw new Error(`duplicate shell approval id: ${input.id}`);
+    }
+    const existing = this.#attemptKeys.get(key2);
+    if (existing) {
+      const state3 = this.#pending.has(existing.approvalId) ? "already pending" : "already decided";
+      throw new Error(
+        `shell approval ${state3} for turn ${input.turnId} tool call ${input.toolCallId}`
+      );
+    }
+    const expiresAt = this.#now() + this.#timeoutMs;
+    const base = {
+      id: input.id,
+      turnId: input.turnId,
+      toolCallId: input.toolCallId,
+      agentId: input.agentId,
+      teamId: input.teamId,
+      command: input.command,
+      risks: input.risks,
+      status: "pending",
+      expiresAt
+    };
+    if (input.mode === "auto_deny") {
+      this.#claimAttempt(key2, input.id, signal);
+      const approval = { ...base, status: "auto_denied" };
+      const decision2 = { decision: "deny", reason: "auto_deny" };
+      this.#recordTerminal(approval, decision2);
+      return { approval, decision: Promise.resolve(decision2) };
+    }
+    if (signal?.aborted) {
+      const approval = { ...base, status: "cancelled" };
+      const decision2 = { decision: "deny", reason: "cancelled" };
+      this.#recordTerminal(approval, decision2);
+      return { approval, decision: Promise.resolve(decision2) };
+    }
+    let resolveDecision;
+    const decision = new Promise((resolve7) => {
+      resolveDecision = resolve7;
+    });
+    const timer = setTimeout(() => {
+      this.#settle(input.id, "deny", "timeout");
+    }, this.#timeoutMs);
+    timer.unref();
+    const entry = { approval: base, resolve: resolveDecision, timer };
+    this.#pending.set(input.id, entry);
+    this.#claimAttempt(key2, input.id, signal);
+    return { approval: base, decision };
+  }
+  list(agentId) {
+    return Array.from(this.#pending.values(), (entry) => entry.approval).filter((approval) => agentId === void 0 || approval.agentId === agentId).sort((a, b2) => a.expiresAt - b2.expiresAt || a.id.localeCompare(b2.id));
+  }
+  respond(id, decision) {
+    const pending = this.#pending.get(id);
+    if (pending) {
+      const approval = this.#settle(id, decision, "user");
+      if (!approval) return { kind: "not_found" };
+      return { kind: "accepted", approval };
+    }
+    const terminal = this.#terminal.get(id);
+    if (!terminal) return { kind: "not_found" };
+    if (terminal.decision.reason === "user" && terminal.decision.decision === decision) {
+      return { kind: "already_applied", approval: terminal.approval };
+    }
+    return { kind: "conflict", approval: terminal.approval };
+  }
+  /** Test/shutdown helper: fail closed and release every waiter. */
+  cancelAll() {
+    for (const id of [...this.#pending.keys()]) this.#settle(id, "deny", "cancelled");
+    for (const entry of this.#terminal.values()) clearTimeout(entry.timer);
+    this.#terminal.clear();
+    for (const [key2, entry] of [...this.#attemptKeys]) {
+      this.#releaseAttempt(key2, entry.approvalId);
+    }
+  }
+  #settle(id, decision, reason) {
+    const entry = this.#pending.get(id);
+    if (!entry) return void 0;
+    this.#pending.delete(id);
+    clearTimeout(entry.timer);
+    const result = { decision, reason };
+    const approval = {
+      ...entry.approval,
+      status: statusForDecision(result)
+    };
+    this.#recordTerminal(approval, result);
+    entry.resolve(result);
+    return approval;
+  }
+  #claimAttempt(key2, approvalId, signal) {
+    const entry = { approvalId, signal };
+    this.#attemptKeys.set(key2, entry);
+    if (!signal) return;
+    entry.onAbort = () => {
+      this.#settle(approvalId, "deny", "cancelled");
+      this.#releaseAttempt(key2, approvalId);
+    };
+    signal.addEventListener("abort", entry.onAbort, { once: true });
+    if (signal.aborted) entry.onAbort();
+  }
+  #releaseAttempt(key2, approvalId) {
+    const entry = this.#attemptKeys.get(key2);
+    if (!entry || entry.approvalId !== approvalId) return;
+    if (entry.signal && entry.onAbort) {
+      entry.signal.removeEventListener("abort", entry.onAbort);
+    }
+    this.#attemptKeys.delete(key2);
+  }
+  #recordTerminal(approval, decision) {
+    this.#audit({
+      approvalId: approval.id,
+      turnId: approval.turnId,
+      toolCallId: approval.toolCallId,
+      agentId: approval.agentId,
+      teamId: approval.teamId,
+      riskCodes: [...new Set(approval.risks.map((risk) => risk.code))],
+      status: approval.status
+    });
+    const timer = setTimeout(() => this.#terminal.delete(approval.id), this.#tombstoneTtlMs);
+    timer.unref();
+    this.#terminal.set(approval.id, { approval, decision, timer });
+  }
+};
+function approvalKey(turnId, toolCallId) {
+  return `${turnId}\0${toolCallId}`;
+}
+function statusForDecision(result) {
+  if (result.reason === "auto_deny") return "auto_denied";
+  if (result.reason === "timeout") return "expired";
+  if (result.reason === "cancelled") return "cancelled";
+  return result.decision === "allow" ? "allowed" : "denied";
+}
+function logBashApprovalDecision(entry) {
+  console.info("bash approval decision", entry);
+}
+var commandApprovalRegistry = new CommandApprovalRegistry();
+
 // ../daemon/src/lib/browser/config.ts
 var FALSEY = /* @__PURE__ */ new Set(["false", "0", "no", "off"]);
 function envBool(v2, def) {
@@ -27043,11 +28959,11 @@ async function getSsrfProxy() {
   if (serverUrl) return serverUrl;
   const s = createServer(onRequest);
   s.on("connect", onConnect);
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve7, reject) => {
     s.once("error", reject);
     s.listen(0, "127.0.0.1", () => {
       s.off("error", reject);
-      resolve4();
+      resolve7();
     });
   });
   const addr = s.address();
@@ -27062,7 +28978,7 @@ async function closeSsrfProxy() {
   server = null;
   serverUrl = null;
   if (!s) return;
-  await new Promise((resolve4) => s.close(() => resolve4()));
+  await new Promise((resolve7) => s.close(() => resolve7()));
 }
 
 // ../daemon/src/lib/resources.ts
@@ -27442,7 +29358,7 @@ function createBrowserHost(config2) {
 }
 
 // ../daemon/src/lib/communication.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 
 // ../daemon/src/lib/team-policy-contract.ts
 var TEAM_POLICY_MANAGEMENT_CONTRACT_VERSION = 1;
@@ -27589,7 +29505,7 @@ function isUserFacingFrame(frame) {
 function sendAgentMessage(db, input) {
   if (!teamPolicyEnforcementEnabled()) return messages_exports.send(db, input);
   const attemptKind = input.attemptKind ?? "agent_tool";
-  const attemptId = input.attemptId ?? randomUUID15();
+  const attemptId = input.attemptId ?? randomUUID17();
   const outcome = db.raw.transaction(
     () => {
       const authorization = {
@@ -27682,28 +29598,55 @@ function deliverableReplies(db, agentId, replyTo) {
   return deliverableInbox(db, agentId, false).filter((message) => message.replyTo === replyTo);
 }
 function claimSchedulerTrigger(db, input) {
+  const attempt = {
+    origin: "scheduler_trigger",
+    attemptKind: "scheduler_trigger",
+    attemptId: `${input.triggerId}:${input.occurrence}`
+  };
+  const existingApproval = communicationApprovals_exports.getByAttempt(
+    db,
+    attempt.attemptKind,
+    attempt.attemptId,
+    true
+  );
+  const existingPayload = existingApproval?.payload;
+  if (existingApproval && (existingApproval.operation !== "scheduler_trigger" || existingApproval.payloadKind !== "scheduler_trigger" || !existingPayload || existingPayload.dispatchId !== input.dispatchId || existingPayload.triggerId !== input.triggerId || existingPayload.occurrence !== input.occurrence || existingPayload.agentId !== input.agentId || typeof existingPayload.message !== "string")) {
+    return {
+      kind: "approval_terminal",
+      approval: existingApproval,
+      reason: "scheduler approval does not match the durable occurrence"
+    };
+  }
+  if (existingApproval && ["pending", "approved", "delivering"].includes(existingApproval.status)) {
+    return { kind: "approval_pending", approval: existingApproval };
+  }
+  if (existingApproval && existingApproval.status !== "delivered") {
+    return {
+      kind: "approval_terminal",
+      approval: existingApproval,
+      reason: existingApproval.deliveryError ?? existingApproval.decisionReason ?? `scheduler approval ${existingApproval.status}`
+    };
+  }
   if (!teamPolicyEnforcementEnabled()) {
     return db.raw.transaction(() => {
       const current = triggers_exports.get(db, input.triggerId);
       if (!current) throw new Error(`trigger not found: ${input.triggerId}`);
-      if (current.lastFiredAt !== null && current.lastFiredAt >= input.occurrence) {
-        return false;
+      if (!input.materialized && current.lastFiredAt !== null && current.lastFiredAt >= input.occurrence) {
+        return { kind: "already_claimed" };
+      }
+      if (current.lastFiredAt === null || current.lastFiredAt < input.occurrence) {
+        triggers_exports.markFired(db, input.triggerId, input.occurrence);
       }
-      triggers_exports.markFired(db, input.triggerId, input.occurrence);
       input.onAllowed?.();
-      return true;
+      communicationDecisionMetrics.allowed++;
+      return { kind: "claimed" };
     })();
   }
-  const attempt = {
-    origin: "scheduler_trigger",
-    attemptKind: "scheduler_trigger",
-    attemptId: `${input.triggerId}:${input.occurrence}`
-  };
   const outcome = db.raw.transaction(
     () => {
       const current = triggers_exports.get(db, input.triggerId);
       if (!current) throw new Error(`trigger not found: ${input.triggerId}`);
-      if (current.lastFiredAt !== null && current.lastFiredAt >= input.occurrence) {
+      if (!input.materialized && current.lastFiredAt !== null && current.lastFiredAt >= input.occurrence) {
         return {
           claimed: false,
           result: {
@@ -27725,14 +29668,36 @@ function claimSchedulerTrigger(db, input) {
         ...attempt
       };
       const result = authorizeInSnapshot(db, authorization);
-      triggers_exports.markFired(db, input.triggerId, input.occurrence);
+      if (current.lastFiredAt === null || current.lastFiredAt < input.occurrence) {
+        triggers_exports.markFired(db, input.triggerId, input.occurrence);
+      }
       if (result.decision === "deny") {
         return {
           claimed: true,
           result: recordDenial(db, authorization, "scheduler_trigger", result)
         };
       }
+      if (existingApproval?.status === "delivered" && result.decision !== "approval_required") {
+        return {
+          claimed: false,
+          result,
+          invalidApproval: "approved scheduler policy or membership changed"
+        };
+      }
       if (result.decision === "approval_required") {
+        if (existingApproval?.status === "delivered") {
+          const attemptMatches = existingPayload?.message === current.message;
+          const refsMatch = JSON.stringify(result.policyRefs) === JSON.stringify(existingApproval.policyRefs) && JSON.stringify(result.requiredEdgeIds) === JSON.stringify(existingApproval.requiredEdgeIds);
+          if (!attemptMatches || !refsMatch) {
+            return {
+              claimed: false,
+              result,
+              invalidApproval: !attemptMatches ? "approved scheduler occurrence changed" : "approved scheduler policy or membership changed"
+            };
+          }
+          input.onAllowed?.();
+          return { claimed: true, result };
+        }
         return {
           claimed: true,
           result,
@@ -27747,24 +29712,43 @@ function claimSchedulerTrigger(db, input) {
     observeDenial(outcome.result, attempt);
     throw new CommunicationDeniedError(outcome.result, attempt.attemptKind, attempt.attemptId);
   }
+  if (outcome.invalidApproval && existingApproval) {
+    return {
+      kind: "approval_terminal",
+      approval: existingApproval,
+      reason: outcome.invalidApproval
+    };
+  }
   if (outcome.approval) {
-    communicationApprovals_exports.request(
+    const approval = communicationApprovals_exports.request(
       db,
       outcome.approval.input,
       "scheduler_trigger",
       outcome.approval.authorization,
-      "agent_turn",
+      "scheduler_trigger",
       {
+        dispatchId: input.dispatchId,
+        triggerId: input.triggerId,
+        occurrence: input.occurrence,
         agentId: input.agentId,
-        message: outcome.approval.message,
-        attachments: []
+        message: outcome.approval.message
       },
       { requester: "scheduler" }
     );
-    return false;
+    if (["pending", "approved", "delivering"].includes(approval.status)) {
+      return { kind: "approval_pending", approval };
+    }
+    if (approval.status === "delivered") {
+      return { kind: "approval_pending", approval };
+    }
+    return {
+      kind: "approval_terminal",
+      approval,
+      reason: approval.deliveryError ?? approval.decisionReason ?? `scheduler approval ${approval.status}`
+    };
   }
   if (outcome.claimed) communicationDecisionMetrics.allowed++;
-  return outcome.claimed;
+  return outcome.claimed ? { kind: "claimed" } : { kind: "already_claimed" };
 }
 function claimDeliverableInbox(db, agentId, onAllowed) {
   if (!teamPolicyEnforcementEnabled()) {
@@ -29853,6 +31837,8 @@ function renderFrame(frame, mode) {
       return mode === "verbose" ? `\u2715 ${ev.name}: ${ev.error}` : null;
     case "file":
       return null;
+    case "command_approval":
+      return null;
     case "user_message":
     case "assistant_delta":
       return null;
@@ -29979,7 +31965,7 @@ async function* runAgentTurn(agentId, rawMessage, opts = {}) {
   const authorization = opts.authorization ?? {
     origin: "internal_turn",
     attemptKind: "turn",
-    attemptId: randomUUID16()
+    attemptId: randomUUID18()
   };
   const releaseLease = opts.acquiredLeaseRelease ?? await acquireAgentLifecycleLease(agentId);
   let agent;
@@ -30009,18 +31995,25 @@ async function* runAgentTurn(agentId, rawMessage, opts = {}) {
     releaseLease();
   }
   try {
+    const env = mergeSecretsIntoEnv(db, authToken);
+    const shellSecurity = resolveShellSecurityConfig(env);
     const attachments = opts.attachments ?? [];
     const images = attachments.filter((a) => a.mimeType.startsWith("image/"));
     const docs = attachments.filter((a) => !a.mimeType.startsWith("image/"));
-    const fileNote = saveInputFiles(agent.agent.dir, docs);
+    const fileNote = saveInputFiles(
+      agent.agent.dir,
+      docs,
+      shellSecurity.sandboxMode === "docker" ? { referenceDir: SANDBOX_INPUTS_DIR } : {}
+    );
     const message = fileNote ? rawMessage ? `${rawMessage}
 
 ${fileNote}` : fileNote : rawMessage;
     const enabledProviders = Array.from(providerState_exports.listEnabled(db));
-    const env = mergeSecretsIntoEnv(db, authToken);
     const messagingHost = createDbMessagingHost(db);
     const userMdHost = createDbUserMdHost(db, paths);
-    const { apiKey } = await resolveAgentApiKey(db, authToken, agent);
+    const { apiKey, refreshApiKey } = await resolveAgentApiKey(db, authToken, agent, {
+      withRefresher: true
+    });
     const browserEnabled = isBrowserEnabled(env);
     const browserHost = browserEnabled ? createBrowserHost(resolveBrowserConfig(env)) : void 0;
     const mcp = await resolveMcpForTurn(db, env, authToken);
@@ -30034,7 +32027,9 @@ ${fileNote}` : fileNote : rawMessage;
         apiKey,
         browserEnabled,
         mcpTools: mcp?.tools,
-        images
+        images,
+        turnId: authorization.attemptId,
+        bashApprovalMode: opts.bashApprovalMode ?? "auto_deny"
       },
       {
         signal: controller.signal,
@@ -30042,7 +32037,9 @@ ${fileNote}` : fileNote : rawMessage;
         messagingHost,
         userMdHost,
         browserHost,
-        mcpHost: mcp?.host
+        mcpHost: mcp?.host,
+        bashApprovalHost: commandApprovalRegistry,
+        apiKeyRefreshHost: refreshApiKey ? { refresh: refreshApiKey } : void 0
       }
     )) {
       void mirrorAgentTurnFrame(
@@ -30134,6 +32131,13 @@ function validateCron(expr) {
   parseCron(expr);
 }
 
+// ../daemon/src/lib/turn-outcome.ts
+function turnFrameFailure(frame) {
+  if (frame.kind === "fatal") return frame.error;
+  if (frame.kind === "event" && frame.event.type === "error") return frame.event.error;
+  return null;
+}
+
 // ../daemon/src/lib/scheduler.ts
 var SCHEDULER_KEY = /* @__PURE__ */ Symbol.for("bazilion.scheduler");
 var TICK_MS = Number(process.env.BAZILION_SCHEDULER_TICK_MS ?? 5e3);
@@ -30181,65 +32185,108 @@ function scheduledOccurrence(t, now) {
   if (every <= 0) return now;
   return baseline + Math.floor((now - baseline) / every) * every;
 }
-async function fireTrigger(t, occurrence) {
+async function fireTrigger(dispatch2) {
   const s = state2();
-  if (s.firing.has(t.id)) return;
-  s.firing.add(t.id);
+  const key2 = `trigger-dispatch:${dispatch2.id}`;
+  if (s.firing.has(key2)) return;
+  s.firing.add(key2);
   const ctx = getCtx();
-  const releaseLease = await acquireAgentLifecycleLease(t.agentId);
+  const releaseLease = await acquireAgentLifecycleLease(dispatch2.agentId);
+  const claimedDispatch = triggerDispatches_exports.claim(ctx.db, dispatch2.id);
+  if (!claimedDispatch) {
+    releaseLease();
+    s.firing.delete(key2);
+    return;
+  }
+  const t = triggers_exports.get(ctx.db, claimedDispatch.triggerId);
+  if (!t?.enabled) {
+    triggerDispatches_exports.fail(ctx.db, claimedDispatch.id, "trigger is disabled or deleted", {
+      maxAttempts: 1
+    });
+    releaseLease();
+    s.firing.delete(key2);
+    return;
+  }
   if (isActiveAgent(t.agentId)) {
     releaseLease();
-    s.firing.delete(t.id);
+    triggerDispatches_exports.defer(ctx.db, claimedDispatch.id);
+    s.firing.delete(key2);
     return;
   }
   const controller = new AbortController();
   let registered = false;
   try {
-    const claimed = claimSchedulerTrigger(ctx.db, {
+    const claim2 = claimSchedulerTrigger(ctx.db, {
+      dispatchId: claimedDispatch.id,
       triggerId: t.id,
       agentId: t.agentId,
-      occurrence,
+      occurrence: claimedDispatch.scheduledAt,
+      materialized: true,
       onAllowed: () => {
         registerAgent(t.agentId, controller);
         registered = true;
       }
     });
-    if (!claimed) {
+    if (claim2.kind === "already_claimed") {
+      releaseLease();
+      triggerDispatches_exports.succeed(ctx.db, claimedDispatch.id);
+      s.firing.delete(key2);
+      return;
+    }
+    if (claim2.kind === "approval_pending") {
       releaseLease();
-      s.firing.delete(t.id);
+      triggerDispatches_exports.defer(ctx.db, claimedDispatch.id, Date.now() + TICK_MS);
+      s.firing.delete(key2);
+      return;
+    }
+    if (claim2.kind === "approval_terminal") {
+      releaseLease();
+      triggerDispatches_exports.fail(ctx.db, claimedDispatch.id, claim2.reason, { maxAttempts: 1 });
+      s.firing.delete(key2);
       return;
     }
   } catch (err) {
     if (err instanceof CommunicationDeniedError) {
       releaseLease();
-      s.firing.delete(t.id);
+      triggerDispatches_exports.fail(ctx.db, claimedDispatch.id, err.message, { maxAttempts: 1 });
+      s.firing.delete(key2);
       return;
     }
     releaseLease();
     if (registered) unregisterAgent(t.agentId);
     console.error(`[scheduler] markFired failed for ${t.id}:`, err);
-    s.firing.delete(t.id);
+    triggerDispatches_exports.fail(ctx.db, claimedDispatch.id, err.message);
+    s.firing.delete(key2);
     return;
   }
+  let failure = null;
   try {
     for await (const frame of runAgentTurn(t.agentId, t.message, {
       authorization: {
         origin: "scheduler_trigger",
         attemptKind: "scheduler_trigger",
-        attemptId: `${t.id}:${occurrence}`
+        attemptId: `${t.id}:${claimedDispatch.scheduledAt}`
       },
       acquiredLeaseRelease: releaseLease,
       controller,
-      alreadyRegistered: true
+      alreadyRegistered: true,
+      bashApprovalMode: "auto_deny"
     })) {
-      if (frame.kind === "fatal") {
-        console.error(`[scheduler] trigger ${t.id} fatal:`, frame.error);
+      const frameFailure = turnFrameFailure(frame);
+      if (frameFailure) {
+        console.error(`[scheduler] trigger ${t.id} failed:`, frameFailure);
+        failure ??= frameFailure;
       }
     }
   } catch (err) {
     console.error(`[scheduler] trigger ${t.id} unexpected throw:`, err);
+    failure = err.message;
   } finally {
-    s.firing.delete(t.id);
+    if (controller.signal.aborted) {
+      triggerDispatches_exports.cancelRunning(ctx.db, claimedDispatch.id, "agent turn cancelled");
+    } else if (failure) triggerDispatches_exports.fail(ctx.db, claimedDispatch.id, failure);
+    else triggerDispatches_exports.succeed(ctx.db, claimedDispatch.id);
+    s.firing.delete(key2);
   }
 }
 function decodeText2(payload) {
@@ -30322,7 +32369,8 @@ async function fireInboxWake(agentId) {
         },
         acquiredLeaseRelease: releaseLease,
         controller,
-        alreadyRegistered: true
+        alreadyRegistered: true,
+        bashApprovalMode: "auto_deny"
       })) {
         if (frame.kind === "fatal") {
           console.error(`[scheduler] inbox wake ${agentId} fatal:`, frame.error);
@@ -30343,10 +32391,10 @@ async function tick() {
   const s = state2();
   if (s.stopped) return;
   const now = Date.now();
+  const ctx = getCtx();
   let triggers;
   let recipients = [];
   try {
-    const ctx = getCtx();
     communicationApprovals_exports.expirePending(ctx.db, now);
     triggers = triggers_exports.listEnabled(ctx.db);
     recipients = messages_exports.listRecipientsWithUnread(ctx.db);
@@ -30356,12 +32404,26 @@ async function tick() {
   }
   for (const t of triggers) {
     if (isDue(t, now, s.cronCache)) {
-      void fireTrigger(t, scheduledOccurrence(t, now));
+      const occurrence = scheduledOccurrence(t, now);
+      if (!triggerDispatches_exports.hasOpenForTrigger(ctx.db, t.id)) {
+        triggerDispatches_exports.materialize(ctx.db, {
+          triggerId: t.id,
+          agentId: t.agentId,
+          scheduledAt: occurrence,
+          now
+        });
+      }
+      triggers_exports.markFired(ctx.db, t.id, occurrence);
     }
   }
+  const work = [];
+  for (const dispatch2 of triggerDispatches_exports.listClaimable(ctx.db, now)) {
+    work.push(fireTrigger(dispatch2));
+  }
   for (const agentId of recipients) {
-    void fireInboxWake(agentId);
+    work.push(fireInboxWake(agentId));
   }
+  await Promise.allSettled(work);
 }
 function startScheduler() {
   const s = state2();
@@ -30397,7 +32459,7 @@ function bootstrap(paths) {
   }
   if (!existsSync16(paths.authFile)) {
     const created = webTokens_exports.create(db, "bootstrap");
-    writeFileSync10(paths.authFile, `${JSON.stringify({ token: created.token }, null, 2)}
+    writeFileSync11(paths.authFile, `${JSON.stringify({ token: created.token }, null, 2)}
 `, {
       mode: 384
     });
@@ -30425,6 +32487,12 @@ function getCtx() {
   }
   return { db: _db, paths: _paths, authToken: _authToken };
 }
+function closeCtxForShutdown() {
+  if (!_db) return;
+  _db.close();
+  _db = null;
+  _authToken = null;
+}
 
 // ../daemon/src/lib/auth.ts
 function isValidToken(token) {
@@ -30473,9 +32541,9 @@ async function authMiddleware(c, next) {
 }
 
 // ../daemon/src/routes/agents.ts
-import { randomUUID as randomUUID17 } from "crypto";
-import { existsSync as existsSync17, readdirSync as readdirSync9, readFileSync as readFileSync13, rmSync as rmSync12 } from "fs";
-import { join as join19 } from "path";
+import { randomUUID as randomUUID19 } from "crypto";
+import { existsSync as existsSync17, readdirSync as readdirSync10, readFileSync as readFileSync13, rmSync as rmSync13 } from "fs";
+import { join as join21 } from "path";
 
 // ../../packages/api-types/src/entities.ts
 var REASONING_LEVELS = [
@@ -31610,6 +33678,7 @@ async function drainLoop(agentId) {
       const batchAttempt = q2[0]?.authorization;
       for await (const _frame of runAgentTurn(agentId, message, {
         attachments,
+        bashApprovalMode: "auto_deny",
         ...batchAttempt ? { authorization: batchAttempt } : {}
       })) {
         void _frame;
@@ -32437,7 +34506,7 @@ agentsRouter.get("/", (c) => {
   const { db, paths, authToken } = getCtx();
   const agents = agents_exports.list(db, { includeArchived }).map((agent) => ({
     ...agent,
-    identity: loadIdentityFromFile(join19(agent.dir, "IDENTITY.md"))
+    identity: loadIdentityFromFile(join21(agent.dir, "IDENTITY.md"))
   }));
   return c.json(agents);
 });
@@ -32843,7 +34912,13 @@ agentsRouter.get("/:id/triggers", (c) => {
   const { db, paths, authToken } = getCtx();
   const agent = agents_exports.get(db, c.req.param("id"));
   if (!agent) return c.json({ error: `agent not found: ${c.req.param("id")}` }, 404);
-  return c.json({ triggers: triggers_exports.listForAgent(db, agent.id) });
+  const triggers = triggers_exports.listForAgent(db, agent.id);
+  return c.json({
+    triggers,
+    dispatches: triggers.flatMap(
+      (trigger) => triggerDispatches_exports.listForTrigger(db, trigger.id, 10)
+    )
+  });
 });
 agentsRouter.post("/:id/triggers", async (c) => {
   const body = await c.req.json().catch(() => null);
@@ -32988,11 +35063,14 @@ agentsRouter.post("/:id/chat", async (c) => {
   if (typeof message !== "string") {
     return c.json({ error: "message is required" }, 400);
   }
+  if (body.bashApprovalMode !== void 0 && body.bashApprovalMode !== "interactive" && body.bashApprovalMode !== "auto_deny") {
+    return c.json({ error: 'bashApprovalMode must be "interactive" or "auto_deny"' }, 400);
+  }
   const attachments = sanitizeAttachments(body.attachments);
   if (!message && attachments.length === 0) {
     return c.json({ error: "message or an attachment is required" }, 400);
   }
-  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID17();
+  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID19();
   try {
     authorizeUserIngress(db, id, {
       origin: "http_chat",
@@ -33043,7 +35121,8 @@ agentsRouter.post("/:id/chat", async (c) => {
             origin: "http_chat",
             attemptKind: "http_chat_ingress",
             attemptId: requestAttemptId
-          }
+          },
+          bashApprovalMode: body.bashApprovalMode ?? "auto_deny"
         })) {
           authorizeHttpChatFrame(db, id, requestAttemptId, frameIndex, frame);
           frameIndex++;
@@ -33099,9 +35178,9 @@ agentsRouter.post("/:id/chat/compact", async (c) => {
   const id = resolveAgentIdParam(db, c.req.param("id"));
   if (!agents_exports.get(db, id)) return c.json({ error: "agent not found" }, 404);
   const resolved = resolveAgent(db, paths, id);
-  const memory = qmdBackend(join19(resolved.team.path, "memory"));
-  await memory.init();
   const env = mergeSecretsIntoEnv(db, authToken);
+  const memory = qmdBackend(join21(resolved.team.path, "memory"));
+  await memory.init();
   const apiKeyResolution = await resolveAgentApiKey(db, authToken, resolved, {
     withRefresher: true
   });
@@ -33148,26 +35227,33 @@ agentsRouter.get("/:id/chat/context", async (c) => {
   const id = resolveAgentIdParam(db, c.req.param("id"));
   if (!agents_exports.get(db, id)) return c.json({ error: "agent not found" }, 404);
   const resolved = resolveAgent(db, paths, id);
+  const env = mergeSecretsIntoEnv(db, authToken);
+  const shellSecurity = resolveShellSecurityConfig(env);
+  const promptSkills = loadPromptSkills(paths.skillsDir, resolved.skills);
   const files = [];
   for (const file of CONTEXT_FILE_ORDER2) {
-    const path = join19(resolved.agent.dir, file);
+    const path = join21(resolved.agent.dir, file);
     if (!existsSync17(path)) continue;
     const content = readFileSync13(path, "utf8").trimEnd();
     if (!content) continue;
     const chars = content.length + file.length + 6;
     files.push({ name: file, chars, tokens: estimateTokens(chars) });
   }
-  const systemPromptText = buildSystemPrompt(resolved);
+  const systemPromptText = buildSystemPrompt(resolved, {
+    skills: promptSkills,
+    sandboxMode: shellSecurity.sandboxMode
+  });
   const systemPromptChars = systemPromptText.length;
-  const skillsListChars = resolved.skills.length > 0 ? `# Available Skills
-
-You have access to the following skills: ${resolved.skills.join(", ")}.`.length : 0;
+  const skillsListChars = promptSkills.reduce(
+    (total, skill) => total + skill.name.length + skill.description.length + skill.body.length,
+    0
+  );
   const teamLines = [
     "# Team",
     "",
     `- ${resolved.team.id} (${resolved.team.name}): ${resolved.team.path}`,
     "",
-    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Your coding tools (`read`, `bash`, `edit`, `write`, `grep`, `find`, `ls`) are rooted at the team directory. Never use these tools to edit your identity/soul/behaviour files \u2014 those live in your home and are reached via `home_write` / `home_read`."
+    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
   ];
   const teamListChars = teamLines.join("\n").length;
   const userMdChars = resolved.team.userMd.trim() ? `# About the User
@@ -33176,9 +35262,8 @@ Read-only context about the human you're working with in this team. You cannot e
 
 ${resolved.team.userMd.trim()}`.length : 0;
   const memoryHintChars = "# Memory\n\nYou have a persistent memory backend. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. Always check memory at the start of a session if the user might have told you something important before.".length;
-  const memory = qmdBackend(join19(resolved.team.path, "memory"));
+  const memory = qmdBackend(join21(resolved.team.path, "memory"));
   await memory.init();
-  const env = mergeSecretsIntoEnv(db, authToken);
   const apiKeyResolution = await resolveAgentApiKey(db, authToken, resolved, {
     withRefresher: true
   });
@@ -33286,13 +35371,13 @@ agentsRouter.post("/:id/chat/reset", (c) => {
   const id = resolveAgentIdParam(db, c.req.param("id"));
   const agent = agents_exports.get(db, id);
   if (!agent) return c.json({ error: "agent not found" }, 404);
-  const sessionsDir = join19(paths.agentDir(agent.id), "sessions");
+  const sessionsDir = join21(paths.agentDir(agent.id), "sessions");
   let deleted = 0;
   if (existsSync17(sessionsDir)) {
-    for (const file of readdirSync9(sessionsDir)) {
+    for (const file of readdirSync10(sessionsDir)) {
       if (!file.endsWith(".jsonl")) continue;
       try {
-        rmSync12(join19(sessionsDir, file));
+        rmSync13(join21(sessionsDir, file));
         deleted++;
       } catch {
       }
@@ -33315,7 +35400,7 @@ agentsRouter.post("/:id/chat/truncate", async (c) => {
   const id = resolveAgentIdParam(db, c.req.param("id"));
   if (!agents_exports.get(db, id)) return c.json({ error: "agent not found" }, 404);
   const resolved = resolveAgent(db, paths, id);
-  const memory = qmdBackend(join19(resolved.team.path, "memory"));
+  const memory = qmdBackend(join21(resolved.team.path, "memory"));
   await memory.init();
   const env = mergeSecretsIntoEnv(db, authToken);
   const apiKeyResolution = await resolveAgentApiKey(db, authToken, resolved, {
@@ -33434,6 +35519,37 @@ approvalsRouter.post("/:id/approve", async (c) => {
   const { db } = getCtx();
   const id = c.req.param("id");
   try {
+    const pending = communicationApprovals_exports.get(
+      db,
+      id,
+      true
+    );
+    if (!pending) return c.json({ error: `approval_not_found: ${id}` }, 404);
+    if (pending.operation === "scheduler_trigger" || pending.payloadKind === "scheduler_trigger") {
+      const granted = communicationApprovals_exports.grantSchedulerTrigger(
+        db,
+        id,
+        "authenticated_operator",
+        (approval) => authorizeInSnapshot(db, {
+          source: approval.source,
+          target: approval.target,
+          origin: approval.origin,
+          attemptKind: approval.attemptKind,
+          attemptId: approval.attemptId
+        }),
+        (approval) => validateSchedulerGrant(db, approval)
+      );
+      if (!granted.granted) {
+        return c.json(
+          {
+            error: granted.failureKind === "revalidation" ? "approval revalidation failed" : "approval delivery failed",
+            detail: granted.error
+          },
+          409
+        );
+      }
+      return c.json(granted.approval);
+    }
     const claimed = communicationApprovals_exports.claimDelivery(
       db,
       id,
@@ -33460,19 +35576,45 @@ approvalsRouter.post("/:id/approve", async (c) => {
     return approvalError(error2);
   }
 });
+function validateSchedulerGrant(db, approval) {
+  const payload = approval.payload;
+  if (typeof payload.dispatchId !== "string" || typeof payload.triggerId !== "string" || typeof payload.occurrence !== "number" || typeof payload.agentId !== "string" || typeof payload.message !== "string") {
+    return "scheduler approval payload is incomplete";
+  }
+  const trigger = triggers_exports.get(db, payload.triggerId);
+  if (!trigger?.enabled) return "scheduled trigger is disabled or deleted";
+  if (trigger.agentId !== payload.agentId) return "scheduled trigger target changed";
+  if (trigger.message !== payload.message) return "scheduled trigger message changed";
+  const dispatch2 = triggerDispatches_exports.get(db, payload.dispatchId);
+  if (!dispatch2) return "scheduled dispatch no longer exists";
+  if (dispatch2.triggerId !== payload.triggerId || dispatch2.agentId !== payload.agentId || dispatch2.scheduledAt !== payload.occurrence) {
+    return "scheduled dispatch no longer matches the approved occurrence";
+  }
+  if (["succeeded", "failed", "cancelled"].includes(dispatch2.status)) {
+    return `scheduled dispatch is already ${dispatch2.status}`;
+  }
+  return null;
+}
 async function deliver(approval) {
   if (approval.payloadKind === "agent_message") {
     const payload = approval.payload;
     messages_exports.send(getCtx().db, payload);
     return;
   }
+  if (approval.payloadKind === "scheduler_trigger") {
+    return;
+  }
   if (approval.payloadKind === "agent_turn") {
     const payload = approval.payload;
-    for await (const _frame of runAgentTurn(payload.agentId, payload.message, {
+    let failure = null;
+    for await (const frame of runAgentTurn(payload.agentId, payload.message, {
       attachments: payload.attachments ?? [],
-      skipUserIngress: true
+      skipUserIngress: true,
+      bashApprovalMode: "auto_deny"
     })) {
+      failure ??= turnFrameFailure(frame);
     }
+    if (failure) throw new Error(failure);
     return;
   }
   if (approval.payloadKind === "http_chat_frame") {
@@ -33514,11 +35656,15 @@ async function deliver(approval) {
         transport.threadId ? { message_thread_id: transport.threadId } : {}
       );
     }
-    for await (const _frame of runAgentTurn(payload.agentId, text2, {
+    let failure = null;
+    for await (const frame of runAgentTurn(payload.agentId, text2, {
       attachments,
-      skipUserIngress: true
+      skipUserIngress: true,
+      bashApprovalMode: "auto_deny"
     })) {
+      failure ??= turnFrameFailure(frame);
     }
+    if (failure) throw new Error(failure);
     return;
   }
   if (approval.payloadKind.startsWith("telegram_")) {
@@ -33589,7 +35735,7 @@ function approvalError(error2) {
 }
 
 // ../daemon/src/routes/auth-login.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { Hono as Hono3 } from "hono";
 import { setCookie } from "hono/cookie";
 var authRouter = new Hono3();
@@ -33697,7 +35843,7 @@ function openBrowser(url2) {
   const platform = process.platform;
   const [cmd, ...args] = platform === "darwin" ? ["open", url2] : platform === "win32" ? ["cmd", "/c", "start", '""', url2] : ["xdg-open", url2];
   try {
-    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn4(cmd, args, { stdio: "ignore", detached: true });
     child.unref();
     child.on("error", () => {
     });
@@ -34049,13 +36195,395 @@ messagesRouter.patch("/:id", async (c) => {
 });
 
 // ../daemon/src/routes/misc.ts
-import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync18 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join20 } from "path";
+import { join as join24 } from "path";
 import { Hono as Hono8 } from "hono";
+
+// ../daemon/src/lib/backup.ts
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync14 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join22, resolve as resolve5 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { create as create2 } from "tar";
+var snapshotTail = Promise.resolve();
+async function serializeSnapshot(work) {
+  let release = () => {
+  };
+  const previous = snapshotTail;
+  snapshotTail = new Promise((resolve7) => {
+    release = resolve7;
+  });
+  await previous;
+  try {
+    return await work();
+  } finally {
+    release();
+  }
+}
+function assertSnapshotIntegrity(path) {
+  const snapshot = new DatabaseSync2(path, { readOnly: true });
+  try {
+    const rows = snapshot.prepare("PRAGMA integrity_check").all();
+    if (rows.length !== 1 || rows[0]?.integrity_check !== "ok") {
+      const detail3 = rows.map((row) => row.integrity_check).join("; ") || "no result";
+      throw new Error(`SQLite snapshot failed integrity_check: ${detail3}`);
+    }
+    const foreignKeyErrors = snapshot.prepare("PRAGMA foreign_key_check").all();
+    if (foreignKeyErrors.length > 0) {
+      throw new Error(
+        `SQLite snapshot failed foreign_key_check with ${foreignKeyErrors.length} violation(s)`
+      );
+    }
+  } finally {
+    snapshot.close();
+  }
+}
+async function createBackupSnapshot(db) {
+  return serializeSnapshot(async () => {
+    const directory = mkdtempSync3(join22(tmpdir3(), "bazilion-backup-"));
+    const database = join22(directory, "bazilion.snapshot");
+    let cleaned = false;
+    const cleanup = () => {
+      if (cleaned) return;
+      try {
+        rmSync14(directory, { recursive: true, force: true });
+        cleaned = true;
+      } catch {
+      }
+    };
+    try {
+      await db.backupTo(database);
+      assertSnapshotIntegrity(database);
+      return { directory, database, cleanup };
+    } catch (error2) {
+      cleanup();
+      throw error2;
+    }
+  });
+}
+function createBackupArchive(paths, snapshot) {
+  const snapshotPath = resolve5(snapshot.database);
+  return create2(
+    {
+      cwd: paths.home,
+      gzip: true,
+      portable: true,
+      // The snapshot is an absolute, daemon-created path outside `cwd`. Its
+      // entry name is rewritten below before the header is emitted. Every
+      // user-controlled home entry still originates from the relative `.`.
+      preservePaths: true,
+      strict: true,
+      filter(path) {
+        if (resolve5(path) === snapshotPath) return true;
+        const normalized = path.replaceAll("\\", "/").replace(/^\.\//, "");
+        if (normalized === "bazilion.db" || normalized.startsWith("bazilion.db-")) return false;
+        if (normalized === "daemon-runtime.json" || normalized.startsWith("daemon-runtime.json.reclaim-")) {
+          return false;
+        }
+        if (/^teams\/[^/]+\/memory\/\.qmd-index\.sqlite/.test(normalized)) return false;
+        return true;
+      },
+      onWriteEntry(entry) {
+        if (resolve5(entry.absolute) === snapshotPath) entry.path = "./bazilion.db";
+      }
+    },
+    [".", snapshotPath]
+  );
+}
+
+// ../daemon/src/lib/daemon-liveness.ts
+import { createHash as createHash5, randomUUID as randomUUID20 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync4,
+  fstatSync as fstatSync3,
+  fsyncSync,
+  ftruncateSync,
+  futimesSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync9,
+  openSync as openSync4,
+  readFileSync as readFileSync14,
+  realpathSync as realpathSync4,
+  renameSync as renameSync3,
+  rmSync as rmSync15,
+  writeSync
+} from "fs";
+import { basename as basename4, dirname as dirname5, join as join23, resolve as resolve6 } from "path";
+var HEARTBEAT_MS = 2e3;
+function canonicalHomeIdentity(home) {
+  const absolute = resolve6(home);
+  try {
+    return realpathSync4.native(absolute);
+  } catch (error2) {
+    if (errorCode(error2) !== "ENOENT") throw error2;
+    const parent = dirname5(absolute);
+    if (parent === absolute) throw error2;
+    return join23(canonicalHomeIdentity(parent), basename4(absolute));
+  }
+}
+function daemonLivenessPath(home) {
+  const canonicalHome = canonicalHomeIdentity(home);
+  const identity = createHash5("sha256").update(canonicalHome).digest("hex").slice(0, 24);
+  return join23(dirname5(canonicalHome), `.bazilion-runtime-${identity}.json`);
+}
+var activeInstanceId = null;
+function getDaemonInstanceId() {
+  return activeInstanceId;
+}
+function sameFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function errorCode(error2) {
+  return error2 instanceof Error && "code" in error2 && typeof error2.code === "string" ? error2.code : void 0;
+}
+function readExisting(path) {
+  try {
+    const stat2 = lstatSync3(path);
+    const raw2 = stat2.isFile() ? readFileSync14(path, "utf8") : "";
+    let instanceId;
+    let version2;
+    let pid;
+    let owner;
+    let state3;
+    let recoveryPath;
+    let hadPrevious;
+    let host2;
+    let port2;
+    let startedAt;
+    try {
+      const parsed = JSON.parse(raw2);
+      if (parsed.version === 1) version2 = 1;
+      if (typeof parsed.instanceId === "string" && parsed.instanceId) {
+        instanceId = parsed.instanceId;
+      }
+      if (Number.isSafeInteger(parsed.pid) && parsed.pid > 0) {
+        pid = parsed.pid;
+      }
+      if (parsed.owner === "daemon" || parsed.owner === "restore") owner = parsed.owner;
+      if (typeof parsed.state === "string" && [
+        "starting",
+        "listening",
+        "restoring",
+        "swapping",
+        "installed",
+        "recovery-required"
+      ].includes(parsed.state)) {
+        state3 = parsed.state;
+      }
+      if (typeof parsed.recoveryPath === "string" && parsed.recoveryPath) {
+        recoveryPath = parsed.recoveryPath;
+      }
+      if (typeof parsed.hadPrevious === "boolean") hadPrevious = parsed.hadPrevious;
+      if (typeof parsed.host === "string" && parsed.host) host2 = parsed.host;
+      if (Number.isSafeInteger(parsed.port) && parsed.port > 0 && parsed.port <= 65535) {
+        port2 = parsed.port;
+      }
+      if (typeof parsed.startedAt === "number" && Number.isFinite(parsed.startedAt)) {
+        startedAt = parsed.startedAt;
+      }
+      const validOwnerState = owner === "daemon" && state3 !== void 0 && ["starting", "listening"].includes(state3) && (state3 !== "listening" || host2 !== void 0 && port2 !== void 0) || owner === "restore" && state3 !== void 0 && ["restoring", "swapping", "installed", "recovery-required"].includes(state3) && (!["swapping", "recovery-required"].includes(state3) || recoveryPath !== void 0 && hadPrevious !== void 0);
+      if (!validOwnerState) {
+        owner = void 0;
+        state3 = void 0;
+      }
+    } catch {
+    }
+    return {
+      raw: raw2,
+      stat: stat2,
+      version: version2,
+      instanceId,
+      pid,
+      owner,
+      state: state3,
+      recoveryPath,
+      hadPrevious,
+      host: host2,
+      port: port2,
+      startedAt
+    };
+  } catch (error2) {
+    if (errorCode(error2) === "ENOENT") return null;
+    throw error2;
+  }
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error2) {
+    return errorCode(error2) !== "ESRCH";
+  }
+}
+function reclaimStaleRecord(path, existing) {
+  const identity = createHash5("sha256").update(existing.instanceId ?? existing.raw).update(`\0${existing.stat.dev}\0${existing.stat.ino}`).digest("hex").slice(0, 24);
+  const claim2 = `${path}.reclaim-${identity}`;
+  try {
+    mkdirSync9(claim2, { mode: 448 });
+  } catch (error2) {
+    if (errorCode(error2) === "EEXIST") return null;
+    throw error2;
+  }
+  try {
+    const current = readExisting(path);
+    if (!current || !sameFile(current.stat, existing.stat) || current.raw !== existing.raw) {
+      return null;
+    }
+    renameSync3(path, join23(claim2, "stale-record.json"));
+    return claim2;
+  } catch (error2) {
+    if (!["ENOENT", "EEXIST"].includes(errorCode(error2) ?? "")) throw error2;
+    return null;
+  }
+}
+function writeRecord(fd, record2) {
+  const body = `${JSON.stringify(record2, null, 2)}
+`;
+  ftruncateSync(fd, 0);
+  writeSync(fd, body, 0, "utf8");
+  fsyncSync(fd);
+}
+function fsyncParentDirectory(path) {
+  let directoryFd = null;
+  try {
+    directoryFd = openSync4(dirname5(path), "r");
+    fsyncSync(directoryFd);
+  } catch (error2) {
+    if (process.platform !== "win32") throw error2;
+  } finally {
+    if (directoryFd !== null) closeSync4(directoryFd);
+  }
+}
+function acquireDaemonLiveness(paths) {
+  mkdirSync9(dirname5(resolve6(paths.home)), { recursive: true });
+  const path = daemonLivenessPath(paths.home);
+  mkdirSync9(dirname5(path), { recursive: true });
+  const instanceId = randomUUID20();
+  const startedAt = Date.now();
+  let fd = null;
+  let reclaimClaim = null;
+  for (let attempt = 0; attempt < 8 && fd === null; attempt++) {
+    try {
+      fd = openSync4(path, "wx", 384);
+    } catch (error2) {
+      if (errorCode(error2) !== "EEXIST") throw error2;
+      const existing = readExisting(path);
+      if (!existing) continue;
+      if (!existing.instanceId || existing.version !== 1 || existing.pid === void 0 || !existing.owner || !existing.state || existing.startedAt === void 0) {
+        throw new Error(
+          `the daemon ownership record at ${path} is invalid; verify no daemon is running before removing it manually`
+        );
+      }
+      const livePid = pidIsAlive(existing.pid);
+      if (existing.owner === "restore" && ["swapping", "recovery-required"].includes(existing.state)) {
+        if (livePid) {
+          throw new Error(
+            `restore process ${existing.pid} is ${existing.state} this home; wait for it to finish`
+          );
+        }
+        const recovery = existing.recoveryPath ? ` Recovery data is at ${existing.recoveryPath}.` : "";
+        throw new Error(
+          `restore recovery is required before this home can start.${recovery} Recover the previous home, then remove ${path} manually.`
+        );
+      }
+      if (livePid) {
+        const owner = ` ${existing.owner} process ${existing.pid} (instance ${existing.instanceId})`;
+        throw new Error(
+          `another Bazilion daemon owns this home${owner}; stop it before starting another`
+        );
+      }
+      const claim2 = reclaimStaleRecord(path, existing);
+      if (claim2) reclaimClaim = claim2;
+    }
+  }
+  if (fd === null) {
+    throw new Error("could not acquire daemon ownership after reclaiming a stale record");
+  }
+  const ownedStat = fstatSync3(fd);
+  const record2 = {
+    version: 1,
+    instanceId,
+    pid: process.pid,
+    owner: "daemon",
+    state: "starting",
+    startedAt
+  };
+  try {
+    writeRecord(fd, record2);
+    fsyncParentDirectory(path);
+    if (reclaimClaim) rmSync15(reclaimClaim, { recursive: true, force: true });
+    try {
+      chmodSync2(path, 384);
+    } catch {
+    }
+  } catch (error2) {
+    closeSync4(fd);
+    fd = null;
+    try {
+      if (sameFile(lstatSync3(path), ownedStat)) rmSync15(path, { force: true });
+    } catch {
+    }
+    throw error2;
+  }
+  activeInstanceId = instanceId;
+  let stopped = false;
+  const stillOwnsPath = () => {
+    try {
+      return sameFile(lstatSync3(path), ownedStat);
+    } catch {
+      return false;
+    }
+  };
+  const heartbeat = setInterval(() => {
+    if (stopped) return;
+    if (!stillOwnsPath()) {
+      console.error("daemon ownership was lost; exiting to protect the Bazilion database");
+      process.exit(1);
+    }
+    try {
+      const now = /* @__PURE__ */ new Date();
+      futimesSync(fd, now, now);
+    } catch (error2) {
+      console.error(
+        "daemon ownership heartbeat failed:",
+        error2 instanceof Error ? error2.message : error2
+      );
+      process.exit(1);
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref();
+  return {
+    instanceId,
+    path,
+    publishEndpoint(endpoint2) {
+      if (stopped || !stillOwnsPath()) {
+        throw new Error("daemon ownership was lost before the HTTP endpoint was published");
+      }
+      record2.state = "listening";
+      record2.host = endpoint2.host;
+      record2.port = endpoint2.port;
+      writeRecord(fd, record2);
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(heartbeat);
+      if (activeInstanceId === instanceId) activeInstanceId = null;
+      const ownsPath = stillOwnsPath();
+      closeSync4(fd);
+      fd = null;
+      if (ownsPath) rmSync15(path, { force: true });
+    }
+  };
+}
+
+// ../daemon/src/routes/misc.ts
 var miscRouter = new Hono8();
 miscRouter.get("/health", (c) => {
+  const instanceId = getDaemonInstanceId();
+  if (instanceId) c.header("x-bazilion-daemon-instance", instanceId);
   const paths = resolvePaths();
   const pathChecks = {
     home: existsSync18(paths.home),
@@ -34111,7 +36639,7 @@ miscRouter.get("/health", (c) => {
   }
   const providerConfig = loadProviderConfigFromEnv(effectiveEnv, oauth);
   const braveKey = effectiveEnv.BRAVE_API_KEY;
-  const openclawSkillsDir = join20(homedir2(), ".openclaw", "skills");
+  const openclawSkillsDir = join24(homedir2(), ".openclaw", "skills");
   const CLOUD_KEYS = [
     ["anthropic", "anthropic"],
     ["openai", "openai"],
@@ -34136,8 +36664,25 @@ miscRouter.get("/health", (c) => {
     },
     ollama: { baseURL: providerConfig.ollama?.baseURL ?? "http://localhost:11434/v1" }
   };
+  let shellSecurity;
+  try {
+    const shellConfig = resolveShellSecurityConfig(effectiveEnv);
+    shellSecurity = {
+      ok: true,
+      sandboxMode: shellConfig.sandboxMode,
+      approvalMode: shellConfig.approvalMode,
+      sandboxImage: shellConfig.sandboxImage,
+      hostCodingTools: shellConfig.sandboxMode === "off",
+      network: shellConfig.sandboxMode === "docker" ? "none" : "host"
+    };
+  } catch (err) {
+    shellSecurity = {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
   const report = {
-    ok: pathChecks.home && pathChecks.db && pathChecks.auth && pathChecks.profiles && pathChecks.agents && pathChecks.skills && (database === null || database.ok) && parseErrors === 0,
+    ok: pathChecks.home && pathChecks.db && pathChecks.auth && pathChecks.profiles && pathChecks.agents && pathChecks.skills && (database === null || database.ok) && parseErrors === 0 && shellSecurity.ok,
     home: paths.home,
     paths: pathChecks,
     database,
@@ -34157,6 +36702,7 @@ miscRouter.get("/health", (c) => {
       enabled: process.env.BAZILION_SCHEDULER !== "off",
       tickMs: Number(process.env.BAZILION_SCHEDULER_TICK_MS ?? 5e3)
     },
+    shellSecurity,
     teamPolicyManagement: {
       contractVersion: TEAM_POLICY_MANAGEMENT_CONTRACT_VERSION,
       enforcementRequested: teamPolicyEnforcementRequested(),
@@ -34168,47 +36714,54 @@ miscRouter.get("/health", (c) => {
   };
   return c.json(report);
 });
-miscRouter.get("/backup", (c) => {
-  const paths = resolvePaths();
+miscRouter.get("/backup", async (c) => {
+  const { db, paths } = getCtx();
   if (!existsSync18(paths.home)) {
     return c.json({ error: `bazilion home not found at ${paths.home}` }, 404);
   }
-  const proc = spawn4("tar", ["-czf", "-", "-C", paths.home, "."], {
-    stdio: ["ignore", "pipe", "pipe"]
-  });
+  let snapshot;
+  try {
+    snapshot = await createBackupSnapshot(db);
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    return c.json({ error: `could not create database snapshot: ${message}` }, 500);
+  }
+  let archive2;
+  try {
+    archive2 = createBackupArchive(paths, snapshot);
+  } catch (error2) {
+    snapshot.cleanup();
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    return c.json({ error: `could not start backup archive: ${message}` }, 500);
+  }
+  const iterator = archive2[Symbol.asyncIterator]();
   const stream = new ReadableStream({
-    start(controller) {
-      proc.stdout.on("data", (chunk) => controller.enqueue(chunk));
-      proc.stdout.on("end", () => {
-        try {
-          controller.close();
-        } catch {
-        }
-      });
-      proc.on("error", (err) => {
-        try {
-          controller.error(err);
-        } catch {
-        }
-      });
-      proc.on("exit", (code) => {
-        if (code !== 0) {
-          try {
-            controller.error(new Error(`tar exited with code ${code}`));
-          } catch {
-          }
+    async pull(controller) {
+      try {
+        const next = await iterator.next();
+        if (!next.done) {
+          controller.enqueue(Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value));
+          return;
         }
-      });
+        snapshot.cleanup();
+        controller.close();
+      } catch (error2) {
+        snapshot.cleanup();
+        controller.error(error2);
+      }
     },
-    cancel() {
-      proc.kill("SIGTERM");
+    async cancel() {
+      await iterator.return?.();
+      archive2.destroy();
+      snapshot.cleanup();
     }
   });
   const date4 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   return new Response(stream, {
     headers: {
       "content-type": "application/gzip",
-      "content-disposition": `attachment; filename="bazilion-backup-${date4}.tar.gz"`
+      "content-disposition": `attachment; filename="bazilion-backup-${date4}.tar.gz"`,
+      "cache-control": "no-store"
     }
   });
 });
@@ -34247,8 +36800,8 @@ miscRouter.delete("/tokens/:id", (c) => {
 });
 
 // ../daemon/src/routes/profiles.ts
-import { existsSync as existsSync19, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { join as join25 } from "path";
 import { Hono as Hono9 } from "hono";
 var profilesRouter = new Hono9();
 profilesRouter.get("/", (c) => {
@@ -34383,7 +36936,7 @@ profilesRouter.get("/:id/files/:file", (c) => {
   const path = resolveFilePath(paths.profilesDir, c.req.param("id"), c.req.param("file"));
   if (!path) return c.json({ error: `unsupported file: ${c.req.param("file")}` }, 400);
   if (!existsSync19(path)) return c.json({ error: `file not present: ${c.req.param("file")}` }, 404);
-  const body = { content: readFileSync14(path, "utf8") };
+  const body = { content: readFileSync15(path, "utf8") };
   return c.json(body);
 });
 profilesRouter.put("/:id/files/:file", async (c) => {
@@ -34395,12 +36948,12 @@ profilesRouter.put("/:id/files/:file", async (c) => {
     return c.json({ error: `profile not found: ${c.req.param("id")}` }, 404);
   const path = resolveFilePath(paths.profilesDir, c.req.param("id"), c.req.param("file"));
   if (!path) return c.json({ error: `unsupported file: ${c.req.param("file")}` }, 400);
-  writeFileSync11(path, body.content);
+  writeFileSync12(path, body.content);
   return c.body(null, 204);
 });
 function resolveFilePath(profilesDir, id, file) {
   if (!PROFILE_FILES.includes(file)) return null;
-  return join21(profilesDir, id, file);
+  return join25(profilesDir, id, file);
 }
 function csvToArray(v2) {
   if (Array.isArray(v2)) return v2.filter((s) => typeof s === "string");
@@ -34428,13 +36981,46 @@ function parseCommunicationDefaults(value) {
   };
 }
 
-// ../daemon/src/routes/skills.ts
-import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, rmSync as rmSync13, writeFileSync as writeFileSync12 } from "fs";
-import { homedir as homedir3, tmpdir as tmpdir2 } from "os";
-import { join as join22 } from "path";
+// ../daemon/src/routes/shell-approvals.ts
 import { Hono as Hono10 } from "hono";
+var shellApprovalsRouter = new Hono10();
+shellApprovalsRouter.get("/", (c) => {
+  const agentId = c.req.query("agentId")?.trim();
+  if (!agentId) return c.json({ error: "agentId query parameter is required" }, 400);
+  const body = {
+    approvals: commandApprovalRegistry.list(agentId)
+  };
+  return c.json(body);
+});
+shellApprovalsRouter.post("/:id", async (c) => {
+  const body = await c.req.json().catch(() => null);
+  if (!body || body.decision !== "allow" && body.decision !== "deny") {
+    return c.json({ error: 'body must be {"decision":"allow"|"deny"}' }, 400);
+  }
+  const result = commandApprovalRegistry.respond(c.req.param("id"), body.decision);
+  if (result.kind === "not_found") {
+    return c.json({ error: "shell approval not found", code: "shell_approval_not_found" }, 404);
+  }
+  if (result.kind === "conflict") {
+    return c.json(
+      {
+        error: `shell approval already decided: ${result.approval.status}`,
+        code: "shell_approval_already_decided"
+      },
+      409
+    );
+  }
+  const response = { approval: result.approval };
+  return c.json(response);
+});
+
+// ../daemon/src/routes/skills.ts
+import { existsSync as existsSync20, mkdtempSync as mkdtempSync4, rmSync as rmSync16, writeFileSync as writeFileSync13 } from "fs";
+import { homedir as homedir3, tmpdir as tmpdir4 } from "os";
+import { join as join26 } from "path";
+import { Hono as Hono11 } from "hono";
 var MAX_ZIP_BYTES = 50 * 1024 * 1024;
-var skillsRouter = new Hono10();
+var skillsRouter = new Hono11();
 skillsRouter.get("/", (c) => {
   const { db, paths } = getCtx();
   const out = [];
@@ -34462,7 +37048,7 @@ skillsRouter.delete("/:name", (c) => {
   const name = c.req.param("name");
   const dir = paths.skillDir(name);
   if (!existsSync20(dir)) return c.json({ error: `skill not found: ${name}` }, 404);
-  rmSync13(dir, { recursive: true, force: true });
+  rmSync16(dir, { recursive: true, force: true });
   skillMeta_exports.remove(db, name);
   return c.body(null, 204);
 });
@@ -34499,7 +37085,7 @@ skillsRouter.post("/import", async (c) => {
     }
     return c.json({ error: err.message }, 400);
   } finally {
-    if (input.tempZipPath) rmSync13(input.tempZipPath, { recursive: true, force: true });
+    if (input.tempZipPath) rmSync16(input.tempZipPath, { recursive: true, force: true });
   }
 });
 function flattenFindings(findings) {
@@ -34525,10 +37111,10 @@ async function parseImportInput(request2) {
     if (!filename.toLowerCase().endsWith(".zip")) {
       throw new Error("uploaded file must be a .zip archive");
     }
-    const tmpDir = mkdtempSync2(join22(tmpdir2(), "bazilion-skill-upload-"));
-    const zipPath = join22(tmpDir, filename.replace(/[^\w.-]+/g, "_"));
+    const tmpDir = mkdtempSync4(join26(tmpdir4(), "bazilion-skill-upload-"));
+    const zipPath = join26(tmpDir, filename.replace(/[^\w.-]+/g, "_"));
     const buf = Buffer.from(await file.arrayBuffer());
-    writeFileSync12(zipPath, buf);
+    writeFileSync13(zipPath, buf);
     const forceField = form.get("force");
     return {
       source: zipPath,
@@ -34541,7 +37127,7 @@ async function parseImportInput(request2) {
   if (!body) throw new Error("invalid JSON body");
   const from = body.source ?? body.from;
   if (typeof from !== "string" || !from) throw new Error("source is required");
-  const source = from === "openclaw" ? join22(homedir3(), ".openclaw", "skills") : from;
+  const source = from === "openclaw" ? join26(homedir3(), ".openclaw", "skills") : from;
   return {
     source,
     force: Boolean(body.force),
@@ -34551,9 +37137,9 @@ async function parseImportInput(request2) {
 }
 
 // ../daemon/src/routes/team-templates.ts
-import { randomUUID as randomUUID18 } from "crypto";
-import { Hono as Hono11 } from "hono";
-var teamTemplatesRouter = new Hono11();
+import { randomUUID as randomUUID21 } from "crypto";
+import { Hono as Hono12 } from "hono";
+var teamTemplatesRouter = new Hono12();
 teamTemplatesRouter.get("/", (c) => {
   const { db } = getCtx();
   return c.json(
@@ -34591,7 +37177,7 @@ teamTemplatesRouter.post("/import", async (c) => {
       if (!profiles_exports.get(db, parsed.profileId)) {
         throw new Error(`profile not found: ${parsed.profileId}`);
       }
-      const slotId = randomUUID18();
+      const slotId = randomUUID21();
       keyToSlot.set(clientKey, slotId);
       return { ...parsed, slotId };
     });
@@ -34883,10 +37469,10 @@ function canonicalError(c, error2) {
 }
 
 // ../daemon/src/routes/teams.ts
-import { join as join23 } from "path";
-import { Hono as Hono12 } from "hono";
+import { join as join27 } from "path";
+import { Hono as Hono13 } from "hono";
 var USER_MD_MAX_BYTES2 = 12e3;
-var teamsRouter = new Hono12();
+var teamsRouter = new Hono13();
 teamsRouter.get("/", (c) => {
   const { db, paths } = getCtx();
   return c.json(teams_exports.list(db, paths));
@@ -35178,7 +37764,7 @@ async function openMemory(rawId) {
   const { db, paths } = getCtx();
   const team = teams_exports.get(db, rawId, paths);
   if (!team) throw new Error(`team not found: ${rawId}`);
-  const mem = qmdBackend(join23(team.path, "memory"));
+  const mem = qmdBackend(join27(team.path, "memory"));
   await mem.init();
   return { mem, team };
 }
@@ -35255,7 +37841,7 @@ function teamPolicyError(c, error2) {
 }
 
 // ../daemon/src/routes/telegram.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // ../daemon/src/lib/telegram/preflight.ts
 var TELEGRAM_API_BASE = "https://api.telegram.org";
@@ -35284,7 +37870,7 @@ async function runPreflight(args) {
       clearTimeout(t);
     }
   };
-  const fail = (step, message) => ({
+  const fail2 = (step, message) => ({
     configured: true,
     preflight: null,
     error: { step, message },
@@ -35294,13 +37880,13 @@ async function runPreflight(args) {
   try {
     me2 = await call("getMe", {});
   } catch (e) {
-    return fail("getMe", errorMessage(e));
+    return fail2("getMe", errorMessage(e));
   }
   let chat;
   try {
     chat = await call("getChat", { chat_id: chatId(args.chatId) });
   } catch (e) {
-    return fail("getChat", errorMessage(e));
+    return fail2("getChat", errorMessage(e));
   }
   let member;
   try {
@@ -35309,7 +37895,7 @@ async function runPreflight(args) {
       user_id: me2.id
     });
   } catch (e) {
-    return fail("getChatMember", errorMessage(e));
+    return fail2("getChatMember", errorMessage(e));
   }
   const hasManageTopics = member.status === "creator" || member.can_manage_topics === true;
   const preflight = {
@@ -35349,7 +37935,7 @@ var DERIVED_STATE_KEYS = [
   "TELEGRAM_DIRECTORY_MESSAGE_ID",
   MIGRATED_CHAT_ID_KEY
 ];
-var telegramRouter = new Hono13();
+var telegramRouter = new Hono14();
 telegramRouter.get("/", (c) => {
   const { db, authToken } = getCtx();
   return c.json(readState(db, authToken));
@@ -35488,8 +38074,19 @@ function maskBotToken(t) {
 }
 
 // ../daemon/src/routes/triggers.ts
-import { Hono as Hono14 } from "hono";
-var triggersRouter = new Hono14();
+import { Hono as Hono15 } from "hono";
+var triggersRouter = new Hono15();
+triggersRouter.get("/:id/dispatches", (c) => {
+  const { db } = getCtx();
+  const id = c.req.param("id");
+  if (!triggers_exports.get(db, id)) return c.json({ error: `trigger not found: ${id}` }, 404);
+  const requestedLimit = Number(c.req.query("limit") ?? 20);
+  if (!Number.isInteger(requestedLimit) || requestedLimit < 1) {
+    return c.json({ error: "limit must be a positive integer" }, 400);
+  }
+  const limit = Math.min(100, requestedLimit);
+  return c.json({ dispatches: triggerDispatches_exports.listForTrigger(db, id, limit) });
+});
 triggersRouter.delete("/:id", (c) => {
   const { db } = getCtx();
   const id = c.req.param("id");
@@ -35511,10 +38108,11 @@ triggersRouter.patch("/:id", async (c) => {
 
 // ../daemon/src/app.ts
 function createApp() {
-  const app2 = new Hono15();
+  const app2 = new Hono16();
   app2.use("*", authMiddleware);
   app2.route("/api/agents", agentsRouter);
   app2.route("/api/approvals", approvalsRouter);
+  app2.route("/api/shell-approvals", shellApprovalsRouter);
   app2.route("/api/teams", teamsRouter);
   app2.route("/api/team-templates", teamTemplatesRouter);
   app2.route("/api/profiles", profilesRouter);
@@ -35533,8 +38131,19 @@ function createApp() {
 // ../daemon/src/index.ts
 var host = process.env.HOST ?? "127.0.0.1";
 var port = Number.parseInt(process.env.PORT ?? "4321", 10);
+var daemonLiveness;
+try {
+  daemonLiveness = acquireDaemonLiveness(resolvePaths());
+} catch (error2) {
+  console.error(
+    "failed to acquire daemon ownership:",
+    error2 instanceof Error ? error2.message : error2
+  );
+  process.exit(1);
+}
 getCtx();
 var app = createApp();
+var shuttingDown = false;
 var server2 = serve({ fetch: app.fetch, hostname: host, port }, (info) => {
   console.log(`bazilion daemon listening at http://${info.address}:${info.port}`);
   if (host !== "127.0.0.1" && host !== "localhost" && host !== "::1") {
@@ -35544,6 +38153,16 @@ var server2 = serve({ fetch: app.fetch, hostname: host, port }, (info) => {
     console.error("  put a TLS proxy in front for untrusted networks.");
     console.error("");
   }
+  try {
+    daemonLiveness.publishEndpoint({ host, port: info.port });
+  } catch (error2) {
+    console.error(
+      "failed to publish daemon liveness record:",
+      error2 instanceof Error ? error2.message : error2
+    );
+    server2.close(() => process.exit(1));
+    return;
+  }
   const { db, authToken } = getCtx();
   setTelegramAuthToken(authToken);
   maybeStartTelegramBot(db, authToken).catch((err) => {
@@ -35551,6 +38170,8 @@ var server2 = serve({ fetch: app.fetch, hostname: host, port }, (info) => {
   });
 });
 var shutdown = (signal) => {
+  if (shuttingDown) return;
+  shuttingDown = true;
   console.log(`
 bazilion daemon caught ${signal}, shutting down\u2026`);
   const botStop = isTelegramBotRunning() ? stopTelegramBot().catch(
@@ -35569,6 +38190,16 @@ bazilion daemon caught ${signal}, shutting down\u2026`);
         console.error("shutdown error:", err);
         process.exit(1);
       }
+      try {
+        closeCtxForShutdown();
+        daemonLiveness.stop();
+      } catch (closeError) {
+        console.error(
+          "database shutdown error:",
+          closeError instanceof Error ? closeError.message : closeError
+        );
+        process.exit(1);
+      }
       process.exit(0);
     });
   });