bazilion 0.12.2 → 0.13.0

package/dist/worker.js

@@ -1,9 +1,7 @@
 #!/usr/bin/env node
 
 // ../daemon/src/runtime/worker/entry.ts
-import { randomUUID as randomUUID19 } from "crypto";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync12 } from "fs";
-import { join as join19 } from "path";
+import { randomUUID as randomUUID20 } from "crypto";
 import { Type as Type3 } from "typebox";
 
 // ../daemon/src/core/agent/delete.ts
@@ -166,6 +164,12 @@ var SERVICES = [
         kind: "config",
         label: "GCP region",
         placeholder: "us-central1"
+      },
+      {
+        envVar: "GOOGLE_VERTEX_CREDENTIALS_JSON",
+        kind: "secret",
+        label: "Explicit credentials JSON (protected turns)",
+        description: "Service-account or ADC JSON projected only into the selected protected worker; ambient ADC files remain unsupported."
       }
     ]
   },
@@ -244,6 +248,13 @@ var SERVICES = [
     hint: "Open-weight models \xB7 together.ai",
     fields: [{ envVar: "TOGETHER_API_KEY", kind: "secret", label: "API key" }]
   },
+  {
+    id: "baseten",
+    displayName: "Baseten",
+    category: "provider",
+    hint: "Hosted open-weight models \xB7 baseten.co",
+    fields: [{ envVar: "BASETEN_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "moonshotai",
     displayName: "Moonshot AI",
@@ -293,6 +304,13 @@ var SERVICES = [
     hint: "Coding-model subscription endpoint in China",
     fields: [{ envVar: "QWEN_TOKEN_PLAN_CN_API_KEY", kind: "secret", label: "API key" }]
   },
+  {
+    id: "qwen-token-plan-individual",
+    displayName: "Qwen Token Plan (Individual)",
+    category: "provider",
+    hint: "Individual subscription models via the international endpoint",
+    fields: [{ envVar: "QWEN_TOKEN_PLAN_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "xiaomi",
     displayName: "Xiaomi MiMo",
@@ -671,14 +689,25 @@ import { randomUUID as randomUUID8 } from "crypto";
 // ../daemon/src/core/repos/secrets.ts
 import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from "crypto";
 
+// ../daemon/src/core/repos/telegram-pairing.ts
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+var TTL_MS = 10 * 6e4;
+
 // ../daemon/src/core/repos/triggerDispatches.ts
 import { randomUUID as randomUUID9 } from "crypto";
 
 // ../daemon/src/core/repos/triggers.ts
 import { randomUUID as randomUUID10 } from "crypto";
 
+// ../daemon/src/core/repos/webSessions.ts
+import { createHash as createHash4, randomBytes as randomBytes4, randomUUID as randomUUID12 } from "crypto";
+
 // ../daemon/src/core/repos/webTokens.ts
-import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes3, randomUUID as randomUUID11 } from "crypto";
+
+// ../daemon/src/core/repos/webSessions.ts
+var SESSION_IDLE_MS = 12 * 60 * 60 * 1e3;
+var SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60 * 1e3;
 
 // ../daemon/src/core/secrets.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
@@ -718,26 +747,22 @@ function parseSkillContent(raw) {
   }
   return { frontmatter: fmObj, body, raw };
 }
-function parseSkillFile(path) {
-  const raw = readFileSync7(path, "utf8");
-  return parseSkillContent(raw);
-}
 
 // ../daemon/src/core/team/delete.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 import { existsSync as existsSync9, renameSync as renameSync2, rmSync as rmSync6 } from "fs";
 
 // ../daemon/src/core/team-policy/adopt.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 
 // ../daemon/src/core/team-policy/authorization.ts
-import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID15 } from "crypto";
 
 // ../daemon/src/core/team-policy/source.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 
 // ../daemon/src/core/team-policy/spawn.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
 
 // ../daemon/src/core/team-policy/rm-with-retry.ts
@@ -1188,8 +1213,11 @@ function piMessagesToProviderView(messages) {
 }
 
 // ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
-import { basename as basename3, join as join18 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename3, join as join19 } from "path";
+import {
+  createAssistantMessageEventStream
+} from "@earendil-works/pi-ai";
 import {
   createAgentSession,
   DefaultResourceLoader,
@@ -1204,6 +1232,50 @@ var PROVIDER_ALIASES = {
   bedrock: "amazon-bedrock",
   "azure-openai": "azure-openai-responses"
 };
+var PROTECTED_PROVIDER_NAMES = [
+  "anthropic",
+  "openai",
+  "openai-codex",
+  "google",
+  "google-vertex",
+  "azure-openai",
+  "bedrock",
+  "mistral",
+  "groq",
+  "cerebras",
+  "xai",
+  "zai",
+  "huggingface",
+  "openrouter",
+  "vercel-ai-gateway",
+  "deepseek",
+  "fireworks",
+  "together",
+  "baseten",
+  "moonshotai",
+  "moonshotai-cn",
+  "kimi-coding",
+  "minimax",
+  "minimax-cn",
+  "qwen-token-plan",
+  "qwen-token-plan-cn",
+  "qwen-token-plan-individual",
+  "xiaomi",
+  "xiaomi-token-plan-ams",
+  "xiaomi-token-plan-cn",
+  "xiaomi-token-plan-sgp",
+  "ant-ling",
+  "nvidia",
+  "opencode",
+  "opencode-go",
+  "zai-coding-cn",
+  "github-copilot",
+  "cloudflare-ai-gateway",
+  "cloudflare-workers-ai",
+  "lmstudio",
+  "ollama",
+  "llamacpp"
+];
 var LOCAL_PROVIDERS = {
   lmstudio: {
     baseUrl: "http://127.0.0.1:1234/v1",
@@ -1213,7 +1285,7 @@ var LOCAL_PROVIDERS = {
   ollama: { baseUrl: "http://127.0.0.1:11434/v1", apiKey: "ollama", authHeader: false },
   llamacpp: { baseUrl: "http://127.0.0.1:8080/v1", apiKey: "no-key", authHeader: true }
 };
-var API_KEY_ENV = {
+var PROVIDER_API_KEY_ENV = {
   anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
   openai: ["OPENAI_API_KEY"],
   google: ["GEMINI_API_KEY"],
@@ -1229,6 +1301,7 @@ var API_KEY_ENV = {
   deepseek: ["DEEPSEEK_API_KEY"],
   fireworks: ["FIREWORKS_API_KEY"],
   together: ["TOGETHER_API_KEY"],
+  baseten: ["BASETEN_API_KEY"],
   moonshotai: ["MOONSHOT_API_KEY"],
   "moonshotai-cn": ["MOONSHOT_CN_API_KEY"],
   "kimi-coding": ["KIMI_API_KEY"],
@@ -1236,6 +1309,7 @@ var API_KEY_ENV = {
   "minimax-cn": ["MINIMAX_CN_API_KEY"],
   "qwen-token-plan": ["QWEN_TOKEN_PLAN_API_KEY"],
   "qwen-token-plan-cn": ["QWEN_TOKEN_PLAN_CN_API_KEY"],
+  "qwen-token-plan-individual": ["QWEN_TOKEN_PLAN_API_KEY"],
   xiaomi: ["XIAOMI_API_KEY"],
   "xiaomi-token-plan-ams": ["XIAOMI_TOKEN_PLAN_AMS_API_KEY"],
   "xiaomi-token-plan-cn": ["XIAOMI_TOKEN_PLAN_CN_API_KEY"],
@@ -1252,7 +1326,7 @@ var API_KEY_ENV = {
   ollama: ["OLLAMA_API_KEY"],
   llamacpp: ["LLAMACPP_API_KEY"]
 };
-var PROVIDER_ENV = {
+var PROVIDER_CREDENTIAL_ENV = {
   bedrock: [
     "AWS_PROFILE",
     "AWS_BEARER_TOKEN_BEDROCK",
@@ -1274,7 +1348,7 @@ function piProviderName(providerName) {
   return PROVIDER_ALIASES[providerName] ?? providerName;
 }
 function providerApiKey(providerName, env) {
-  for (const name of API_KEY_ENV[providerName] ?? []) {
+  for (const name of PROVIDER_API_KEY_ENV[providerName] ?? []) {
     const value = env[name];
     if (value) return value;
   }
@@ -1296,7 +1370,7 @@ function providerBaseUrl(providerName, env) {
 }
 function providerCredentialEnv(providerName, env) {
   const result = {};
-  for (const name of PROVIDER_ENV[providerName] ?? []) {
+  for (const name of PROVIDER_CREDENTIAL_ENV[providerName] ?? []) {
     const value = env[name];
     if (value !== void 0) result[name] = value;
   }
@@ -1341,11 +1415,23 @@ async function createBazilionPiRuntime(options) {
   const apiKey = options.apiKey ?? providerApiKey(providerName, options.env);
   const credentialEnv = providerCredentialEnv(providerName, options.env);
   if (apiKey || credentialEnv) {
-    await credentials.modify(canonicalName, async () => ({
-      type: "api_key",
-      ...apiKey ? { key: apiKey } : {},
-      ...credentialEnv ? { env: credentialEnv } : {}
-    }));
+    await credentials.modify(
+      canonicalName,
+      async () => canonicalName === "openai-codex" && apiKey ? {
+        type: "oauth",
+        access: apiKey,
+        // Bazilion owns refresh outside Pi. This deliberately empty value
+        // satisfies Pi's canonical OAuth shape but is never used because
+        // the token is long-lived only inside this one-shot runtime and
+        // mid-turn replacement is supplied through Agent.getApiKey.
+        refresh: "",
+        expires: Number.MAX_SAFE_INTEGER
+      } : {
+        type: "api_key",
+        ...apiKey ? { key: apiKey } : {},
+        ...credentialEnv ? { env: credentialEnv } : {}
+      }
+    );
   }
   const runtime = await ModelRuntime.create({ credentials, modelsPath: null });
   const local = LOCAL_PROVIDERS[providerName];
@@ -1365,6 +1451,17 @@ async function createBazilionPiRuntime(options) {
   }
   return runtime;
 }
+async function createProtectedPiRuntime(options) {
+  const env = {};
+  for (const field of options.credentialEnv ?? []) env[field.name] = field.value;
+  return createBazilionPiRuntime({
+    providerName: options.providerName,
+    modelId: options.modelId,
+    env,
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl
+  });
+}
 function resolvePiModel(runtime, providerName, modelId, baseUrl) {
   const known = runtime.getModel(piProviderName(providerName), modelId);
   if (known) return baseUrl ? { ...known, baseUrl } : known;
@@ -1380,8 +1477,47 @@ import {
 } from "@earendil-works/pi-ai";
 
 // ../daemon/src/runtime/session/prompt.ts
-import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
 import { join as join13 } from "path";
+
+// ../daemon/src/runtime/safe-files.ts
+import {
+  closeSync as closeSync2,
+  constants as constants2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync2
+} from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "path";
+function resolveRealDirectory(path) {
+  const requested = resolve4(path);
+  const entry = lstatSync2(requested);
+  if (entry.isSymbolicLink() || !entry.isDirectory()) {
+    throw new Error("expected a real directory");
+  }
+  return realpathSync2(requested);
+}
+function readRegularFileNoFollow(path) {
+  const entry = lstatSync2(path);
+  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
+  if (!entry.isFile()) throw new Error("target is not a regular file");
+  let fd;
+  try {
+    fd = openSync2(path, constants2.O_RDONLY | noFollowFlag());
+    if (!fstatSync2(fd).isFile()) throw new Error("target is not a regular file");
+    return readFileSync9(fd, "utf8");
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
+function noFollowFlag() {
+  return typeof constants2.O_NOFOLLOW === "number" ? constants2.O_NOFOLLOW : 0;
+}
+
+// ../daemon/src/runtime/session/prompt.ts
 var SANDBOX_SKILLS_DIR = "/skills";
 function loadPromptSkills(skillsDir, attachedNames) {
   if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
@@ -1391,7 +1527,7 @@ function loadPromptSkills(skillsDir, attachedNames) {
   for (const entry of discovered) {
     const hostDir = join13(skillsDir, entry.name);
     try {
-      const parsed = parseSkillFile(join13(hostDir, "SKILL.md"));
+      const parsed = parseSkillContent(readRegularFileNoFollow(join13(hostDir, "SKILL.md")));
       const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
       loaded.push({
         name: entry.name,
@@ -1406,13 +1542,30 @@ function loadPromptSkills(skillsDir, attachedNames) {
   return loaded;
 }
 var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
+function loadProtectedHomeDocuments(agentDir) {
+  const root = resolveRealDirectory(agentDir);
+  const read = (file) => {
+    try {
+      return readRegularFileNoFollow(join13(root, file));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new Error(`private Agent home is unsafe at ${file}`);
+    }
+  };
+  return {
+    "AGENTS.md": read("AGENTS.md"),
+    "SOUL.md": read("SOUL.md"),
+    "TOOLS.md": read("TOOLS.md"),
+    "IDENTITY.md": read("IDENTITY.md"),
+    "BOOTSTRAP.md": read("BOOTSTRAP.md")
+  };
+}
 function buildSystemPrompt(agent, options = {}) {
   const parts = [];
+  const homeDocuments = options.homeDocuments ?? loadProtectedHomeDocuments(agent.agent.dir);
   const contextBlocks = [];
   for (const file of CONTEXT_FILE_ORDER) {
-    const path = join13(agent.agent.dir, file);
-    if (!existsSync10(path)) continue;
-    const content = readFileSync9(path, "utf8").trimEnd();
+    const content = homeDocuments[file]?.trimEnd();
     if (!content) continue;
     contextBlocks.push(`## ${file}
 
@@ -1423,27 +1576,24 @@ ${content}`);
 
 ${contextBlocks.join("\n\n")}`);
   }
-  const bootstrapPath = join13(agent.agent.dir, "BOOTSTRAP.md");
-  if (existsSync10(bootstrapPath)) {
-    const bootstrap = readFileSync9(bootstrapPath, "utf8").trimEnd();
-    if (bootstrap) {
-      parts.push(
-        [
-          "# First-Run Ritual",
-          "",
-          "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
-          "",
-          "## Hard rules",
-          "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
-          "- Each subsequent turn: at most one new question. Wait between turns.",
-          "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
-          "",
-          "## BOOTSTRAP.md",
-          "",
-          bootstrap
-        ].join("\n")
-      );
-    }
+  const bootstrap = homeDocuments["BOOTSTRAP.md"]?.trimEnd();
+  if (bootstrap) {
+    parts.push(
+      [
+        "# First-Run Ritual",
+        "",
+        "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
+        "",
+        "## Hard rules",
+        "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
+        "- Each subsequent turn: at most one new question. Wait between turns.",
+        "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
+        "",
+        "## BOOTSTRAP.md",
+        "",
+        bootstrap
+      ].join("\n")
+    );
   }
   parts.push(
     [
@@ -1488,7 +1638,7 @@ ${contextBlocks.join("\n\n")}`);
   const teamLines = [
     "# Team",
     "",
-    `- ${agent.team.id} (${agent.team.name}): ${agent.team.path}`,
+    `- ${agent.team.id} (${agent.team.name}): ${options.sandboxMode === "docker" ? "/workspace" : agent.team.path}`,
     "",
     "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
   ];
@@ -1538,8 +1688,8 @@ function boundReviewedLessons(lessons, maxCharacters = 8e3) {
 }
 
 // ../daemon/src/runtime/shell/tooling.ts
-import { existsSync as existsSync11, lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute3, join as join15, relative as relative3, sep as sep4 } from "path";
+import { existsSync as existsSync11, lstatSync as lstatSync3, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join15, relative as relative4, sep as sep4 } from "path";
 import {
   createBashToolDefinition,
   createLocalBashOperations,
@@ -1926,11 +2076,11 @@ function createApprovalGatedBashTool(base, host) {
 
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
-import { randomUUID as randomUUID17 } from "crypto";
-import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
-import { access, realpath, stat } from "fs/promises";
+import { randomUUID as randomUUID18 } from "crypto";
+import { closeSync as closeSync3, constants as constants3, mkdtempSync as mkdtempSync2, openSync as openSync3, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { access, lstat, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join14, relative as relative2, sep as sep3 } from "path";
+import { delimiter, isAbsolute as isAbsolute3, join as join14, relative as relative3, sep as sep3 } from "path";
 var CONTAINER_WORKDIR = "/workspace";
 var MAX_TIMEOUT_MS = 2147483647;
 var MAX_STDERR_CHARS = 16 * 1024;
@@ -1966,6 +2116,14 @@ var CONTAINER_LITERAL_ENV_KEYS = /* @__PURE__ */ new Set([
   "TMPDIR",
   "TZ"
 ]);
+var PROTECTED_CONTAINER_ENV = {
+  PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  HOME: "/tmp",
+  LANG: "C.UTF-8",
+  LC_ALL: "C.UTF-8",
+  SHELL: "/bin/bash",
+  TMPDIR: "/tmp"
+};
 function buildDockerRunSpec(input) {
   const executable = input.dockerPath ?? "docker";
   validateDockerPath(executable);
@@ -2048,6 +2206,143 @@ function buildDockerRunSpec(input) {
 ` } : {}
   };
 }
+function createPreparedDockerBashOperations(runtime) {
+  validatePreparedDockerRuntime(runtime);
+  return {
+    async exec(command, cwd, { onData, signal, timeout }) {
+      const timeoutMs = resolveTimeoutMs(timeout);
+      if (signal?.aborted) throw new Error("aborted");
+      const workspace = await recheckProtectedMount(runtime.workspace);
+      const requestedCwd = await resolveMountSource(cwd);
+      if (requestedCwd !== workspace.source) {
+        throw new Error("Docker sandbox execution workspace no longer matches preflight");
+      }
+      const readOnlyMounts = await Promise.all(
+        runtime.readOnlyMounts.map((mount) => recheckProtectedMount(mount))
+      );
+      await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
+      await assertLocalDockerSocket(runtime.endpoint);
+      const dockerClientEnv = { DOCKER_HOST: runtime.endpoint };
+      const currentImageId = await inspectSandboxImage(
+        runtime.dockerPath,
+        runtime.image,
+        dockerClientEnv
+      );
+      if (currentImageId !== runtime.imageId) {
+        throw new Error("Docker sandbox image no longer matches its preflighted immutable id");
+      }
+      await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
+      if (signal?.aborted) throw new Error("aborted");
+      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
+      const spec = buildDockerRunSpec({
+        image: runtime.image,
+        resolvedImage: runtime.imageId,
+        env: { ...runtime.containerEnv },
+        dockerPath: runtime.dockerPath,
+        hostEnv: dockerClientEnv,
+        command,
+        mountSource: workspace.source,
+        readOnlyMounts,
+        containerName,
+        uid: runtime.uid,
+        gid: runtime.gid
+      });
+      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+    }
+  };
+}
+async function recheckProtectedMount(mount) {
+  const sourceInfo = await lstat(mount.source);
+  if (sourceInfo.isSymbolicLink() || !sourceInfo.isDirectory()) {
+    throw new Error("Docker sandbox mount no longer matches preflight");
+  }
+  const sourceRoot = await resolveRequiredRoot(mount.sourceRoot);
+  const source = await resolveMountSource(mount.source);
+  if (sourceRoot !== mount.sourceRoot || source !== mount.source || !isWithin(sourceRoot, source)) {
+    throw new Error("Docker sandbox mount no longer matches preflight");
+  }
+  return { ...mount, source, sourceRoot };
+}
+async function resolveRequiredRoot(root) {
+  if (!isAbsolute3(root)) throw new Error("Docker sandbox mount root must be absolute");
+  return resolveMountSource(root);
+}
+async function inspectDockerExecutableIdentity(dockerPath) {
+  try {
+    await access(dockerPath, constants3.X_OK);
+    const info = await stat(dockerPath, { bigint: true });
+    if (!info.isFile()) throw new Error("not a regular file");
+    return {
+      device: info.dev.toString(),
+      inode: info.ino.toString(),
+      mode: info.mode.toString(),
+      size: info.size.toString(),
+      modifiedTimeNs: info.mtimeNs.toString(),
+      changedTimeNs: info.ctimeNs.toString()
+    };
+  } catch {
+    throw new Error(`Docker sandbox executable is unavailable: ${dockerPath}`);
+  }
+}
+async function assertDockerExecutableIdentity(dockerPath, expected) {
+  let current;
+  try {
+    current = await inspectDockerExecutableIdentity(dockerPath);
+  } catch {
+    throw new Error("Docker sandbox executable no longer matches its preflighted identity");
+  }
+  if (JSON.stringify(current) !== JSON.stringify(expected)) {
+    throw new Error("Docker sandbox executable no longer matches its preflighted identity");
+  }
+}
+async function assertLocalDockerSocket(endpoint) {
+  const prefix = "unix://";
+  if (!endpoint.startsWith(prefix) || !isAbsolute3(endpoint.slice(prefix.length))) {
+    throw new Error("Docker sandbox requires a local Unix-socket context");
+  }
+  const socketPath = endpoint.slice(prefix.length);
+  try {
+    const info = await stat(socketPath);
+    if (!info.isSocket()) throw new Error("not a Unix socket");
+    await access(socketPath, constants3.R_OK | constants3.W_OK);
+  } catch {
+    throw new Error("Docker sandbox local Unix socket is unavailable");
+  }
+}
+function validatePreparedDockerRuntime(runtime) {
+  if (!isAbsolute3(runtime.dockerPath)) {
+    throw new Error("protected Docker executable must be absolute");
+  }
+  validateDockerPath(runtime.dockerPath);
+  validateDockerExecutableIdentity(runtime.executableIdentity);
+  validateImage(runtime.image);
+  validateImage(runtime.imageId);
+  validateHostIdentity(runtime.uid, runtime.gid);
+  if (!runtime.endpoint.startsWith("unix://")) {
+    throw new Error("protected Docker endpoint must be a local Unix socket");
+  }
+  validateReadOnlyMounts(runtime.readOnlyMounts, runtime.workspace.source);
+  const expectedEnvironment = JSON.stringify(PROTECTED_CONTAINER_ENV);
+  if (JSON.stringify(runtime.containerEnv) !== expectedEnvironment) {
+    throw new Error("protected Docker container environment does not match policy");
+  }
+}
+function validateDockerExecutableIdentity(identity) {
+  if (typeof identity !== "object" || identity === null) {
+    throw new Error("protected Docker executable identity is invalid");
+  }
+  const fields = [
+    identity.device,
+    identity.inode,
+    identity.mode,
+    identity.size,
+    identity.modifiedTimeNs,
+    identity.changedTimeNs
+  ];
+  if (fields.some((field) => typeof field !== "string" || !/^\d+$/.test(field))) {
+    throw new Error("protected Docker executable identity is invalid");
+  }
+}
 function createDockerBashOperations(options) {
   const image = options.image;
   const env = { ...options.env };
@@ -2077,7 +2372,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID17().replaceAll("-", "")}`;
+      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -2108,13 +2403,13 @@ function executeDockerRun(spec, options) {
       )
     );
   }
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(spec.executable, spec.args, {
       stdio: ["ignore", "pipe", "pipe", envFileFd ?? "ignore"],
       windowsHide: true,
       env: spec.processEnv
     });
-    if (envFileFd !== void 0) closeSync2(envFileFd);
+    if (envFileFd !== void 0) closeSync3(envFileFd);
     let settled = false;
     let termination;
     let timeoutHandle;
@@ -2151,7 +2446,7 @@ function executeDockerRun(spec, options) {
         reject(new Error(`Docker sandbox CLI for container "${spec.containerName}" was killed`));
         return;
       }
-      resolve5({ exitCode });
+      resolve6({ exitCode });
     };
     child.stdout?.on("data", options.onData);
     child.stderr?.on("data", (data) => {
@@ -2175,11 +2470,11 @@ function openAnonymousEnvFile(content) {
   let fd;
   try {
     writeFileSync7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
-    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
     rmSync10(dir, { recursive: true, force: true });
     return fd;
   } catch (error) {
-    if (fd !== void 0) closeSync2(fd);
+    if (fd !== void 0) closeSync3(fd);
     rmSync10(dir, { recursive: true, force: true });
     throw error;
   }
@@ -2197,7 +2492,7 @@ function resolveTimeoutMs(timeout) {
 }
 async function resolveMountSource(cwd) {
   try {
-    await access(cwd, constants2.F_OK);
+    await access(cwd, constants3.F_OK);
     const info = await stat(cwd);
     if (!info.isDirectory()) {
       throw new Error(`Docker sandbox mount is not a directory: ${cwd}`);
@@ -2251,7 +2546,7 @@ async function resolveLocalDockerClientEnv(dockerPath, hostEnv) {
   const discoveryEnv = buildDockerClientEnv(hostEnv);
   const endpoint = await inspectDockerEndpoint(dockerPath, discoveryEnv);
   const prefix = "unix://";
-  if (!endpoint.startsWith(prefix) || !isAbsolute2(endpoint.slice(prefix.length))) {
+  if (!endpoint.startsWith(prefix) || !isAbsolute3(endpoint.slice(prefix.length))) {
     throw new Error(
       `Docker sandbox requires a local Unix-socket context; active endpoint is ${JSON.stringify(endpoint)}`
     );
@@ -2320,7 +2615,7 @@ async function inspectSandboxImage(dockerPath, image, processEnv) {
   return id;
 }
 function runDockerInspection(dockerPath, args, processEnv, subject) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(dockerPath, args, {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
@@ -2337,7 +2632,7 @@ function runDockerInspection(dockerPath, args, processEnv, subject) {
         reject(error);
         return;
       }
-      resolve5(stdout.trim());
+      resolve6(stdout.trim());
     };
     const timeoutHandle = setTimeout(() => {
       child.kill("SIGKILL");
@@ -2402,7 +2697,7 @@ function validateReadOnlyMounts(mounts, workspaceSource) {
   const targets = /* @__PURE__ */ new Set([CONTAINER_WORKDIR, "/tmp"]);
   for (const mount of mounts) {
     validateMountArgument(mount.source);
-    if (mount.sourceRoot !== void 0 && (!isAbsolute2(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
+    if (mount.sourceRoot !== void 0 && (!isAbsolute3(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
       throw new Error(
         `Docker sandbox read-only mount root is invalid: ${JSON.stringify(mount.sourceRoot)}`
       );
@@ -2422,8 +2717,8 @@ function validateReadOnlyMounts(mounts, workspaceSource) {
   }
 }
 function isWithin(root, candidate) {
-  const rel = relative2(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute2(rel);
+  const rel = relative3(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute3(rel);
 }
 function validateHostIdentity(uid, gid) {
   if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
@@ -2460,7 +2755,7 @@ async function removeContainer(dockerPath, containerName, processEnv) {
     last = await runCleanupCommand(dockerPath, args, processEnv);
     if (last.ok) return;
     if (attempt < CLEANUP_ATTEMPTS - 1) {
-      await new Promise((resolve5) => setTimeout(resolve5, CLEANUP_RETRY_DELAY_MS));
+      await new Promise((resolve6) => setTimeout(resolve6, CLEANUP_RETRY_DELAY_MS));
     }
   }
   if (last && !last.missing) {
@@ -2470,7 +2765,7 @@ async function removeContainer(dockerPath, containerName, processEnv) {
   }
 }
 function runCleanupCommand(dockerPath, args, processEnv) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let done = false;
     let stderr = "";
     const child = spawn(dockerPath, args, {
@@ -2483,7 +2778,7 @@ function runCleanupCommand(dockerPath, args, processEnv) {
       done = true;
       clearTimeout(timeoutHandle);
       const detail3 = error || stderr.trim();
-      resolve5({
+      resolve6({
         ok,
         missing: /no such container/i.test(detail3),
         error: detail3
@@ -2507,6 +2802,26 @@ var HOST_FILE_TOOL_NAMES = ["read", "edit", "write", "grep", "find", "ls"];
 var CONTAINER_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var SANDBOX_INPUTS_DIR = "/inputs";
 var SANDBOX_MEMORY_DIR = "/workspace/memory";
+function createProtectedSessionShellTools(cwd, runtime, approvalHost) {
+  const base = createBashToolDefinition(cwd, {
+    operations: createPreparedDockerBashOperations(runtime)
+  });
+  const dockerBash = defineTool2({
+    ...base,
+    label: "bash (protected Docker sandbox)",
+    description: `${base.description} Runs in an ephemeral, network-disabled Docker container with the Team workspace mounted read/write plus only the preflighted read-only memory, skill, and attachment mounts. Host files, host tools, and host credentials are unavailable.`
+  });
+  return {
+    config: {
+      sandboxMode: "docker",
+      approvalMode: "dangerous",
+      sandboxImage: runtime.image,
+      envAllowlist: []
+    },
+    hostToolNames: [],
+    customBash: createApprovalGatedBashTool(dockerBash, approvalHost)
+  };
+}
 function buildSandboxContainerEnv(env, allowlist) {
   return {
     ...buildScrubbedShellEnv(env, allowlist),
@@ -2535,9 +2850,9 @@ function createSessionShellTools(cwd, env, options = {}) {
     env: buildSandboxContainerEnv(env, config.envAllowlist),
     readOnlyMounts: [
       ...existsSync11(join15(cwd, "memory")) ? [safeReadOnlyMount(join15(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
-      ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname3(options.inputsDir))] : [],
+      ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname4(options.inputsDir))] : [],
       ...(options.skillMounts ?? []).map(
-        (mount) => safeReadOnlyMount(mount.source, mount.target, dirname3(mount.source))
+        (mount) => safeReadOnlyMount(mount.source, mount.target, dirname4(mount.source))
       )
     ]
   });
@@ -2551,26 +2866,667 @@ function createSessionShellTools(cwd, env, options = {}) {
   return { config, hostToolNames: [], customBash };
 }
 function safeReadOnlyMount(source, target, expectedRoot) {
-  const info = lstatSync2(source);
+  const info = lstatSync3(source);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
   }
-  const sourceRoot = realpathSync2(expectedRoot);
-  const canonicalSource = realpathSync2(source);
-  const rel = relative3(sourceRoot, canonicalSource);
-  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute3(rel);
+  const sourceRoot = realpathSync3(expectedRoot);
+  const canonicalSource = realpathSync3(source);
+  const rel = relative4(sourceRoot, canonicalSource);
+  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
   if (!contained) {
     throw new Error(`Docker sandbox read-only mount escaped its configured root: ${source}`);
   }
   return { source: canonicalSource, target, sourceRoot };
 }
 
+// ../daemon/src/runtime/worker/runtime.ts
+import {
+  constants as constants4,
+  existsSync as existsSync12,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync6,
+  mkdtempSync as mkdtempSync3,
+  realpathSync as realpathSync4,
+  rmSync as rmSync11,
+  statSync as statSync3
+} from "fs";
+import { access as access2 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { isAbsolute as isAbsolute5, join as join16, relative as relative5, sep as sep5 } from "path";
+var REDACTED_VALUE = "[REDACTED]";
+var REASONING_LEVELS = /* @__PURE__ */ new Set([
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh"
+]);
+var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agent",
+  "message",
+  "enabledProviders",
+  "apiKey",
+  "apiKeyRefreshEnabled",
+  "browserEnabled",
+  "mcpTools",
+  "images",
+  "turnId",
+  "bashApprovalMode"
+]);
+var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agent",
+  "message",
+  "enabledProviders",
+  "apiKeyRefreshEnabled",
+  "turnId",
+  "bashApprovalMode"
+]);
+var PROTECTED_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agent",
+  "message",
+  "images",
+  "turnId",
+  "bashApprovalMode",
+  "runtime",
+  "paths",
+  "docker",
+  "webFetchEnabled",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
+var PROTECTED_REQUIRED_KEYS = new Set([...PROTECTED_KEYS].filter((key) => key !== "images"));
+var REVIEW_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "review",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
+function minimalWorkerProcessEnv(scratch, platform = process.platform, hostEnv = process.env) {
+  assertMinimalWorkerScratch(scratch);
+  if (platform === "win32") {
+    const systemRoot = requireCanonicalWindowsDirectory(
+      hostEnv.SystemRoot ?? hostEnv.WINDIR,
+      "SystemRoot"
+    );
+    const windir = requireCanonicalWindowsDirectory(hostEnv.WINDIR ?? systemRoot, "WINDIR");
+    const comSpec = requireCanonicalWindowsFile(hostEnv.ComSpec, "ComSpec");
+    const pathExt = hostEnv.PATHEXT;
+    if (!pathExt || pathExt.includes("\0") || pathExt.includes("\n") || pathExt.includes("\r")) {
+      throw new Error("minimal worker bootstrap requires a valid PATHEXT on Windows");
+    }
+    return {
+      USERPROFILE: scratch.homeDir,
+      TMPDIR: scratch.tempDir,
+      TMP: scratch.tempDir,
+      TEMP: scratch.tempDir,
+      SystemRoot: systemRoot,
+      WINDIR: windir,
+      ComSpec: comSpec,
+      PATHEXT: pathExt
+    };
+  }
+  return {
+    HOME: scratch.homeDir,
+    TMPDIR: scratch.tempDir,
+    TMP: scratch.tempDir,
+    TEMP: scratch.tempDir,
+    LANG: "C",
+    LC_ALL: "C"
+  };
+}
+function validateMinimalWorkerProcessEnv(env, scratch, platform = process.platform) {
+  const expected = minimalWorkerProcessEnv(scratch, platform, env);
+  const actualKeys = Object.keys(env).sort();
+  const expectedKeys = Object.keys(expected).sort();
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    throw new Error(`minimal worker environment has unexpected keys: ${actualKeys.join(", ")}`);
+  }
+  for (const key of expectedKeys) {
+    if (env[key] !== expected[key]) {
+      throw new Error(`minimal worker environment has an invalid ${key} value`);
+    }
+  }
+}
+function parseWorkerInput(value) {
+  const input = objectRecord(value, "worker input");
+  const kind = input.kind;
+  if (kind === "configured_operator_http") {
+    assertExactKeys(input, CONFIGURED_KEYS, "configured worker input", CONFIGURED_REQUIRED_KEYS);
+    if (!isResolvedAgent(input.agent)) throw new Error("worker: configured input requires an agent");
+    requireString(input.message, "message");
+    if (!Array.isArray(input.enabledProviders) || !input.enabledProviders.every(isString)) {
+      throw new Error("worker: configured input requires enabledProviders");
+    }
+    requireString(input.turnId, "turnId");
+    if (input.bashApprovalMode !== "interactive" && input.bashApprovalMode !== "auto_deny") {
+      throw new Error("worker: configured input requires a valid bashApprovalMode");
+    }
+    if (typeof input.apiKeyRefreshEnabled !== "boolean") {
+      throw new Error("worker: configured input requires apiKeyRefreshEnabled");
+    }
+    if (input.apiKeyRefreshEnabled) {
+      const providerName = input.agent.model.split(":", 1)[0] ?? "";
+      if (providerName !== "openai-codex" || !nonEmptyString(input.apiKey)) {
+        throw new Error(
+          "worker: API key refresh requires an openai-codex turn with an initial token"
+        );
+      }
+    }
+    return value;
+  }
+  if (kind === "protected") {
+    assertExactKeys(input, PROTECTED_KEYS, "protected worker input", PROTECTED_REQUIRED_KEYS);
+    if (!isResolvedAgent(input.agent)) throw new Error("worker: protected input requires an agent");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    if (input.bashApprovalMode !== "auto_deny") {
+      throw new Error("worker: protected input requires auto-deny shell approval");
+    }
+    if (input.webFetchEnabled !== true) {
+      throw new Error("worker: protected input requires guarded web_fetch");
+    }
+    assertProtectedProviderRuntime(input.runtime);
+    const runtime = input.runtime;
+    const separator = input.agent.model.indexOf(":");
+    if (runtime.providerName !== input.agent.model.slice(0, separator) || runtime.modelId !== input.agent.model.slice(separator + 1)) {
+      throw new Error("worker: protected runtime does not match the resolved Agent model");
+    }
+    assertProtectedWorkerPaths(input.paths, input.agent);
+    assertProtectedDockerRuntime(input.docker, input.paths);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: protected input requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    return value;
+  }
+  if (kind === "restricted_review") {
+    assertExactKeys(input, REVIEW_KEYS, "restricted review worker input", REVIEW_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: restricted review requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const review = objectRecord(input.review, "review metadata");
+    assertExactKeys(
+      review,
+      /* @__PURE__ */ new Set(["reviewId", "evidence"]),
+      "review metadata",
+      /* @__PURE__ */ new Set(["reviewId", "evidence"])
+    );
+    requireString(review.reviewId, "reviewId");
+    if (!Array.isArray(review.evidence)) throw new Error("worker: review evidence must be an array");
+    for (const item of review.evidence) {
+      const evidence = objectRecord(item, "review evidence");
+      assertExactKeys(
+        evidence,
+        /* @__PURE__ */ new Set(["sessionId", "entryOrdinal"]),
+        "review evidence",
+        /* @__PURE__ */ new Set(["sessionId", "entryOrdinal"])
+      );
+      requireString(evidence.sessionId, "sessionId");
+      if (!Number.isInteger(evidence.entryOrdinal) || Number(evidence.entryOrdinal) < 0) {
+        throw new Error("worker: review evidence entryOrdinal must be a non-negative integer");
+      }
+    }
+    return value;
+  }
+  throw new Error("worker: unknown or missing runtime kind");
+}
+function assertProtectedProviderRuntime(value) {
+  const runtime = objectRecord(value, "protected provider runtime");
+  assertExactKeys(
+    runtime,
+    /* @__PURE__ */ new Set([
+      "providerName",
+      "modelId",
+      "reasoningLevel",
+      "apiKey",
+      "baseUrl",
+      "credentialEnv",
+      "credentialFile"
+    ]),
+    "protected provider runtime",
+    /* @__PURE__ */ new Set(["providerName", "modelId", "reasoningLevel"])
+  );
+  if (!PROTECTED_PROVIDER_NAMES.includes(runtime.providerName)) {
+    throw new Error("protected execution requires a registered provider");
+  }
+  if (!nonEmptyString(runtime.modelId))
+    throw new Error("protected provider runtime requires a model id");
+  if (!REASONING_LEVELS.has(runtime.reasoningLevel)) {
+    throw new Error("protected provider runtime requires a valid reasoning level");
+  }
+  if (runtime.apiKey !== void 0 && !nonEmptyString(runtime.apiKey)) {
+    throw new Error("protected provider runtime contains an invalid selected credential");
+  }
+  if (runtime.baseUrl !== void 0) requireString(runtime.baseUrl, "baseUrl");
+  if (runtime.credentialEnv !== void 0) {
+    if (!Array.isArray(runtime.credentialEnv)) {
+      throw new Error("protected provider credential fields must be an array");
+    }
+    const allowed = new Set(PROVIDER_CREDENTIAL_ENV[String(runtime.providerName)] ?? []);
+    const seen = /* @__PURE__ */ new Set();
+    for (const rawField of runtime.credentialEnv) {
+      const field = objectRecord(rawField, "protected provider credential field");
+      assertExactKeys(
+        field,
+        /* @__PURE__ */ new Set(["name", "value"]),
+        "protected provider credential field",
+        /* @__PURE__ */ new Set(["name", "value"])
+      );
+      requireString(field.name, "credential field name");
+      requireString(field.value, "credential field value");
+      if (!allowed.has(field.name) || seen.has(field.name)) {
+        throw new Error("protected provider runtime contains an unexpected credential field");
+      }
+      seen.add(field.name);
+    }
+  }
+  if (runtime.credentialFile !== void 0) {
+    const file = objectRecord(runtime.credentialFile, "protected provider credential file");
+    assertExactKeys(
+      file,
+      /* @__PURE__ */ new Set(["envName", "content"]),
+      "protected provider credential file",
+      /* @__PURE__ */ new Set(["envName", "content"])
+    );
+    if (runtime.providerName !== "google-vertex" || file.envName !== "GOOGLE_APPLICATION_CREDENTIALS" || !nonEmptyString(file.content) || Buffer.byteLength(file.content, "utf8") > 64 * 1024) {
+      throw new Error("protected provider runtime contains an invalid credential file");
+    }
+  }
+  if (!nonEmptyString(runtime.apiKey) && !Array.isArray(runtime.credentialEnv) && runtime.credentialFile === void 0) {
+    throw new Error("protected provider runtime requires selected credentials");
+  }
+}
+function protectedRuntimeSecrets(runtime) {
+  return [
+    runtime.apiKey,
+    ...(runtime.credentialEnv ?? []).map((field) => field.value),
+    runtime.credentialFile?.content
+  ].filter((value) => Boolean(value));
+}
+function redactExactValues(text, values) {
+  let redacted = text;
+  for (const value of [...new Set(values)].filter(Boolean).sort((a, b) => b.length - a.length)) {
+    redacted = redacted.replaceAll(value, REDACTED_VALUE);
+  }
+  return redacted;
+}
+function redactJsonValue(value, secrets) {
+  if (!secrets || Array.isArray(secrets) && secrets.length === 0) return value;
+  const values = typeof secrets === "string" ? [secrets] : secrets;
+  if (typeof value === "string") return redactExactValues(value, values);
+  if (Array.isArray(value)) return value.map((item) => redactJsonValue(item, values));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, redactJsonValue(item, values)])
+    );
+  }
+  return value;
+}
+function assertProtectedWorkerPaths(value, agent) {
+  const paths = objectRecord(value, "protected worker paths");
+  assertExactKeys(
+    paths,
+    /* @__PURE__ */ new Set([
+      "agentDir",
+      "teamDir",
+      "memoryDir",
+      "sessionDir",
+      "uploadsDir",
+      "skills",
+      "homeDocuments"
+    ]),
+    "protected worker paths",
+    /* @__PURE__ */ new Set(["agentDir", "teamDir", "memoryDir", "sessionDir", "skills", "homeDocuments"])
+  );
+  for (const key of ["agentDir", "teamDir", "memoryDir", "sessionDir"]) {
+    requireAbsolutePath(paths[key], key);
+  }
+  if (paths.uploadsDir !== void 0) requireAbsolutePath(paths.uploadsDir, "uploadsDir");
+  if (paths.agentDir !== agent.agent.dir || paths.teamDir !== agent.team.path) {
+    throw new Error("worker: protected paths do not match the resolved Agent");
+  }
+  const canonicalAgentDir = requireCanonicalRealDirectory(
+    paths.agentDir,
+    "Agent directory"
+  );
+  const canonicalTeamDir = resolveCanonicalDirectory(paths.teamDir, "Team directory");
+  requireCanonicalContainedDirectory(
+    canonicalAgentDir,
+    paths.sessionDir,
+    "session directory"
+  );
+  if (paths.uploadsDir !== void 0) {
+    requireCanonicalContainedDirectory(
+      canonicalAgentDir,
+      paths.uploadsDir,
+      "uploads directory"
+    );
+  }
+  requireCanonicalContainedDirectory(
+    canonicalTeamDir,
+    paths.memoryDir,
+    "memory directory"
+  );
+  if (!Array.isArray(paths.skills)) throw new Error("worker: protected skills must be an array");
+  for (const item of paths.skills) {
+    const skill = objectRecord(item, "protected skill");
+    assertExactKeys(
+      skill,
+      /* @__PURE__ */ new Set(["name", "description", "body", "hostDir", "sandboxDir"]),
+      "protected skill"
+    );
+    requireString(skill.name, "skill name");
+    requireString(skill.description, "skill description");
+    requireString(skill.body, "skill body");
+    requireAbsolutePath(skill.hostDir, "skill hostDir");
+    requireCanonicalRealDirectory(skill.hostDir, "skill hostDir");
+    if (typeof skill.sandboxDir !== "string" || !skill.sandboxDir.startsWith("/skills/")) {
+      throw new Error("worker: protected skill sandbox path must be under /skills");
+    }
+  }
+  const homeDocuments = objectRecord(paths.homeDocuments, "protected home documents");
+  const homeDocumentKeys = /* @__PURE__ */ new Set([
+    "AGENTS.md",
+    "SOUL.md",
+    "TOOLS.md",
+    "IDENTITY.md",
+    "BOOTSTRAP.md"
+  ]);
+  assertExactKeys(homeDocuments, homeDocumentKeys, "protected home documents", homeDocumentKeys);
+  for (const [name, contents] of Object.entries(homeDocuments)) {
+    if (contents !== null && typeof contents !== "string") {
+      throw new Error(`worker: protected home document ${name} must be text or null`);
+    }
+  }
+}
+function assertProtectedDockerRuntime(value, paths) {
+  const runtime = objectRecord(value, "protected Docker runtime");
+  assertExactKeys(
+    runtime,
+    /* @__PURE__ */ new Set([
+      "dockerPath",
+      "executableIdentity",
+      "endpoint",
+      "image",
+      "imageId",
+      "uid",
+      "gid",
+      "workspace",
+      "readOnlyMounts",
+      "containerEnv"
+    ]),
+    "protected Docker runtime",
+    /* @__PURE__ */ new Set([
+      "dockerPath",
+      "executableIdentity",
+      "endpoint",
+      "image",
+      "imageId",
+      "uid",
+      "gid",
+      "workspace",
+      "readOnlyMounts",
+      "containerEnv"
+    ])
+  );
+  requireAbsolutePath(runtime.dockerPath, "Docker executable");
+  const executableIdentity = objectRecord(
+    runtime.executableIdentity,
+    "protected Docker executable identity"
+  );
+  const executableIdentityKeys = /* @__PURE__ */ new Set([
+    "device",
+    "inode",
+    "mode",
+    "size",
+    "modifiedTimeNs",
+    "changedTimeNs"
+  ]);
+  assertExactKeys(
+    executableIdentity,
+    executableIdentityKeys,
+    "protected Docker executable identity",
+    executableIdentityKeys
+  );
+  for (const [name, field] of Object.entries(executableIdentity)) {
+    if (typeof field !== "string" || !/^\d+$/.test(field)) {
+      throw new Error(`worker: protected Docker executable identity has invalid ${name}`);
+    }
+  }
+  if (typeof runtime.endpoint !== "string" || !runtime.endpoint.startsWith("unix://") || !isAbsolute5(runtime.endpoint.slice("unix://".length)) || containsUnsafeDockerArgument(runtime.endpoint)) {
+    throw new Error("worker: protected Docker endpoint must be a local Unix socket");
+  }
+  if (!nonEmptyString(runtime.image) || runtime.image.startsWith("-") || runtime.image.includes("\0") || runtime.image.includes("\n") || runtime.image.includes("\r")) {
+    throw new Error("worker: protected Docker image is required");
+  }
+  if (typeof runtime.imageId !== "string" || !/^sha256:[a-fA-F0-9]{64}$/.test(runtime.imageId)) {
+    throw new Error("worker: protected Docker runtime requires an immutable image id");
+  }
+  if (!Number.isSafeInteger(runtime.uid) || !Number.isSafeInteger(runtime.gid)) {
+    throw new Error("worker: protected Docker runtime requires a numeric host identity");
+  }
+  if (Number(runtime.uid) < 0 || Number(runtime.gid) < 0) {
+    throw new Error("worker: protected Docker runtime requires a non-negative host identity");
+  }
+  const workspace = objectRecord(runtime.workspace, "protected Docker workspace");
+  assertExactKeys(
+    workspace,
+    /* @__PURE__ */ new Set(["source", "target", "sourceRoot"]),
+    "protected Docker workspace",
+    /* @__PURE__ */ new Set(["source", "target", "sourceRoot"])
+  );
+  requireAbsolutePath(workspace.source, "Docker workspace source");
+  requireAbsolutePath(workspace.sourceRoot, "Docker workspace root");
+  assertSafeDockerHostPath(workspace.source, "Docker workspace source");
+  assertSafeDockerHostPath(workspace.sourceRoot, "Docker workspace root");
+  if (workspace.target !== "/workspace") {
+    throw new Error("worker: protected Docker workspace target must be /workspace");
+  }
+  const canonicalTeamDir = resolveCanonicalDirectory(paths.teamDir, "Team directory");
+  if (workspace.source !== canonicalTeamDir || workspace.sourceRoot !== canonicalTeamDir) {
+    throw new Error("worker: protected Docker workspace does not match the canonical Team root");
+  }
+  if (!Array.isArray(runtime.readOnlyMounts)) {
+    throw new Error("worker: protected Docker read-only mounts must be an array");
+  }
+  const mountTargets = /* @__PURE__ */ new Set(["/workspace", "/tmp"]);
+  for (const item of runtime.readOnlyMounts) {
+    const mount = objectRecord(item, "protected Docker read-only mount");
+    assertExactKeys(
+      mount,
+      /* @__PURE__ */ new Set(["source", "target", "sourceRoot"]),
+      "protected Docker read-only mount",
+      /* @__PURE__ */ new Set(["source", "target", "sourceRoot"])
+    );
+    requireAbsolutePath(mount.source, "Docker read-only mount source");
+    requireAbsolutePath(mount.sourceRoot, "Docker read-only mount root");
+    assertSafeDockerHostPath(mount.source, "Docker read-only mount source");
+    assertSafeDockerHostPath(mount.sourceRoot, "Docker read-only mount root");
+    if (typeof mount.target !== "string" || !mount.target.startsWith("/") || containsUnsafeDockerArgument(mount.target) || mount.target.split("/").includes("..") || !mount.target.startsWith("/skills/") && mount.target !== "/inputs" && mount.target !== "/workspace/memory") {
+      throw new Error("worker: protected Docker read-only mount target is not permitted");
+    }
+    if (!lexicallyWithin(mount.sourceRoot, mount.source)) {
+      throw new Error("worker: protected Docker read-only mount escaped its root");
+    }
+    if (mountTargets.has(mount.target)) {
+      throw new Error("worker: protected Docker mount target is duplicated");
+    }
+    mountTargets.add(mount.target);
+  }
+  assertExactProtectedDockerMounts(
+    runtime.readOnlyMounts,
+    paths
+  );
+  const containerEnv = objectRecord(runtime.containerEnv, "protected Docker container environment");
+  const expectedContainerEnv = {
+    PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    HOME: "/tmp",
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    SHELL: "/bin/bash",
+    TMPDIR: "/tmp"
+  };
+  const expectedKeys = new Set(Object.keys(expectedContainerEnv));
+  assertExactKeys(
+    containerEnv,
+    expectedKeys,
+    "protected Docker container environment",
+    expectedKeys
+  );
+  for (const [key, expected] of Object.entries(expectedContainerEnv)) {
+    if (containerEnv[key] !== expected) {
+      throw new Error(`worker: protected Docker container environment has invalid ${key}`);
+    }
+  }
+}
+function assertExactProtectedDockerMounts(mounts, paths) {
+  const expected = new Map([
+    ["/workspace/memory", paths.memoryDir],
+    ...paths.uploadsDir ? [["/inputs", paths.uploadsDir]] : [],
+    ...paths.skills.map((skill) => [skill.sandboxDir, skill.hostDir])
+  ]);
+  if (mounts.length !== expected.size) {
+    throw new Error("worker: protected Docker read-only mount set is incomplete");
+  }
+  for (const mount of mounts) {
+    const source = expected.get(mount.target);
+    if (!source || mount.source !== source) {
+      throw new Error("worker: protected Docker read-only mount set does not match protected paths");
+    }
+  }
+}
+function assertSafeDockerHostPath(value, name) {
+  if (typeof value !== "string" || containsUnsafeDockerArgument(value)) {
+    throw new Error(`worker: ${name} cannot be represented safely`);
+  }
+}
+function containsUnsafeDockerArgument(value) {
+  return value.includes("\0") || value.includes(",") || value.includes("\n") || value.includes("\r");
+}
+function requireCanonicalRealDirectory(value, name) {
+  if (typeof value !== "string") throw new Error(`worker: ${name} must be a path`);
+  try {
+    const entry = lstatSync4(value);
+    if (entry.isSymbolicLink() || !entry.isDirectory()) {
+      throw new Error("unsafe entry");
+    }
+    const canonical = realpathSync4(value);
+    if (canonical !== value) throw new Error("non-canonical entry");
+    return canonical;
+  } catch {
+    throw new Error(`worker: ${name} must be a real directory`);
+  }
+}
+function resolveCanonicalDirectory(value, name) {
+  try {
+    const entry = statSync3(value);
+    if (!entry.isDirectory()) throw new Error("not a directory");
+    return realpathSync4(value);
+  } catch {
+    throw new Error(`worker: ${name} is unavailable or unsafe`);
+  }
+}
+function requireCanonicalContainedDirectory(root, value, name) {
+  const canonical = requireCanonicalRealDirectory(value, name);
+  if (!lexicallyWithin(root, canonical)) throw new Error(`worker: ${name} escaped its root`);
+  return canonical;
+}
+function assertMinimalWorkerScratch(value) {
+  const scratch = objectRecord(value, "minimal worker scratch");
+  assertExactKeys(
+    scratch,
+    /* @__PURE__ */ new Set(["root", "homeDir", "tempDir", "piAgentDir", "reviewCwd", "reviewSessionDir"]),
+    "minimal worker scratch",
+    /* @__PURE__ */ new Set(["root", "homeDir", "tempDir", "piAgentDir", "reviewCwd", "reviewSessionDir"])
+  );
+  requireAbsolutePath(scratch.root, "scratch root");
+  for (const key of [
+    "homeDir",
+    "tempDir",
+    "piAgentDir",
+    "reviewCwd",
+    "reviewSessionDir"
+  ]) {
+    requireAbsolutePath(scratch[key], key);
+    if (!lexicallyWithin(scratch.root, scratch[key])) {
+      throw new Error(`worker: ${key} escaped the scratch root`);
+    }
+  }
+}
+function requireCanonicalWindowsDirectory(value, name) {
+  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
+    throw new Error(`minimal worker bootstrap requires a valid ${name} directory`);
+  }
+  return realpathSync4(value);
+}
+function requireCanonicalWindowsFile(value, name) {
+  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isFile()) {
+    throw new Error(`minimal worker bootstrap requires a valid ${name} executable`);
+  }
+  return realpathSync4(value);
+}
+function objectRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`worker: ${label} must be an object`);
+  }
+  return value;
+}
+function assertExactKeys(value, allowed, label, required = allowed) {
+  const unexpected = Object.keys(value).filter((key) => !allowed.has(key));
+  if (unexpected.length > 0) {
+    throw new Error(`worker: ${label} contains unexpected fields: ${unexpected.sort().join(", ")}`);
+  }
+  const missing = [...required].filter((key) => !(key in value));
+  if (missing.length > 0) {
+    throw new Error(`worker: ${label} is missing required fields: ${missing.sort().join(", ")}`);
+  }
+}
+function isResolvedAgent(value) {
+  if (!value || typeof value !== "object") return false;
+  const resolved = value;
+  return Boolean(
+    resolved.agent && typeof resolved.agent.id === "string" && typeof resolved.agent.dir === "string" && resolved.team && typeof resolved.team.id === "string" && typeof resolved.team.path === "string" && typeof resolved.model === "string"
+  );
+}
+function requireString(value, name) {
+  if (typeof value !== "string") throw new Error(`worker: ${name} must be a string`);
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function isString(value) {
+  return typeof value === "string";
+}
+function requireAbsolutePath(value, name) {
+  if (typeof value !== "string" || !isAbsolute5(value) || value.includes("\0")) {
+    throw new Error(`worker: ${name} must be an absolute path`);
+  }
+}
+function lexicallyWithin(root, candidate) {
+  const rel = relative5(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
+}
+
 // ../daemon/src/runtime/pi/tools.ts
 import { Type as Type2 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
-import { existsSync as existsSync12, rmSync as rmSync11 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync13, rmSync as rmSync12 } from "fs";
+import { join as join17 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -2579,9 +3535,9 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join16(agentDir, "BOOTSTRAP.md");
-      if (existsSync12(path)) {
-        rmSync11(path);
+      const path = join17(agentDir, "BOOTSTRAP.md");
+      if (existsSync13(path)) {
+        rmSync12(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
       }
       return "BOOTSTRAP.md was already removed.";
@@ -2720,15 +3676,15 @@ function browserTools(host, agentId) {
 
 // ../daemon/src/runtime/tools/deliver-file.ts
 import {
-  closeSync as closeSync3,
-  constants as constants3,
-  fstatSync as fstatSync2,
-  openSync as openSync3,
+  closeSync as closeSync4,
+  constants as constants5,
+  fstatSync as fstatSync3,
+  openSync as openSync4,
   readFileSync as readFileSync10,
-  realpathSync as realpathSync3,
-  statSync as statSync3
+  realpathSync as realpathSync5,
+  statSync as statSync4
 } from "fs";
-import { basename as basename2, extname, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4, sep as sep5 } from "path";
+import { basename as basename2, extname, isAbsolute as isAbsolute6, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -2745,14 +3701,14 @@ var MIME = {
   ".webp": "image/webp"
 };
 function isWithin2(root, candidate) {
-  const rel = relative4(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute4(rel);
+  const rel = relative6(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute6(rel);
 }
 function deliverFileTool(cwd, sink) {
-  const workspacePath = resolve4(cwd);
+  const workspacePath = resolve5(cwd);
   let workspaceRealPath = null;
   try {
-    workspaceRealPath = realpathSync3(workspacePath);
+    workspaceRealPath = realpathSync5(workspacePath);
   } catch {
   }
   return {
@@ -2774,10 +3730,10 @@ function deliverFileTool(cwd, sink) {
     async invoke(args) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
-      if (isAbsolute4(p)) {
+      if (isAbsolute6(p)) {
         throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
       }
-      const abs = resolve4(workspacePath, p);
+      const abs = resolve5(workspacePath, p);
       if (!isWithin2(workspacePath, abs)) {
         throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
       }
@@ -2787,8 +3743,8 @@ function deliverFileTool(cwd, sink) {
       let real;
       let expected;
       try {
-        real = realpathSync3(abs);
-        expected = statSync3(real);
+        real = realpathSync5(abs);
+        expected = statSync4(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
@@ -2797,13 +3753,13 @@ function deliverFileTool(cwd, sink) {
       }
       let fd;
       try {
-        fd = openSync3(real, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+        fd = openSync4(real, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
       let data;
       try {
-        const stat2 = fstatSync2(fd);
+        const stat2 = fstatSync3(fd);
         if (!stat2.isFile()) {
           throw new Error(`deliver_file: not a regular file: ${p}`);
         }
@@ -2812,7 +3768,7 @@ function deliverFileTool(cwd, sink) {
         }
         let confirmedReal;
         try {
-          confirmedReal = realpathSync3(abs);
+          confirmedReal = realpathSync5(abs);
         } catch {
           throw new Error(`deliver_file: path changed during validation: ${p}`);
         }
@@ -2826,7 +3782,7 @@ function deliverFileTool(cwd, sink) {
         }
         data = readFileSync10(fd).toString("base64");
       } finally {
-        closeSync3(fd);
+        closeSync4(fd);
       }
       const name = basename2(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
@@ -2837,8 +3793,16 @@ function deliverFileTool(cwd, sink) {
 }
 
 // ../daemon/src/runtime/tools/home.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync4, writeFileSync as writeFileSync8 } from "fs";
-import { join as join17 } from "path";
+import {
+  closeSync as closeSync5,
+  constants as constants6,
+  fstatSync as fstatSync4,
+  lstatSync as lstatSync5,
+  openSync as openSync5,
+  readdirSync as readdirSync7,
+  writeFileSync as writeFileSync8
+} from "fs";
+import { join as join18 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
@@ -2848,6 +3812,7 @@ var HOME_FILES_READABLE = [
 ];
 var HOME_FILES_WRITABLE = ["IDENTITY.md", "SOUL.md", "AGENTS.md", "TOOLS.md"];
 function homeTools(agentDir) {
+  const homeRoot = resolvePrivateHomeRoot(agentDir);
   return [
     {
       def: {
@@ -2868,9 +3833,9 @@ function homeTools(agentDir) {
             `home_read: "file" must be one of ${HOME_FILES_READABLE.join(", ")}; got "${file}"`
           );
         }
-        const path = join17(agentDir, file);
+        const path = privateHomeFile(homeRoot, file);
         try {
-          return readFileSync11(path, "utf8");
+          return readRegularFileNoFollow(path);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           throw new Error(`home_read: could not read ${file}: ${msg}`);
@@ -2898,12 +3863,27 @@ function homeTools(agentDir) {
           );
         }
         const content = typeof args.content === "string" ? args.content : "";
-        const path = join17(agentDir, file);
-        writeFileSync8(path, content, "utf8");
-        return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
-      }
-    },
-    {
+        const path = privateHomeFile(homeRoot, file);
+        let fd;
+        try {
+          rejectExistingSymlinkOrNonFile(path);
+          fd = openSync5(
+            path,
+            constants6.O_WRONLY | constants6.O_CREAT | constants6.O_TRUNC | noFollowFlag(),
+            384
+          );
+          if (!fstatSync4(fd).isFile()) throw new Error("target is not a regular file");
+          writeFileSync8(fd, content, "utf8");
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw new Error(`home_write: could not write ${file}: ${msg}`);
+        } finally {
+          if (fd !== void 0) closeSync5(fd);
+        }
+        return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
+      }
+    },
+    {
       def: {
         name: "home_list",
         description: "List your home files with their sizes.",
@@ -2912,9 +3892,10 @@ function homeTools(agentDir) {
       async invoke() {
         const entries = [];
         for (const file of HOME_FILES_READABLE) {
-          const path = join17(agentDir, file);
+          const path = privateHomeFile(homeRoot, file);
           try {
-            const s = statSync4(path);
+            const s = lstatSync5(path);
+            if (s.isSymbolicLink() || !s.isFile()) continue;
             entries.push(`${file} (${s.size}b)`);
           } catch {
           }
@@ -2922,7 +3903,7 @@ function homeTools(agentDir) {
         if (entries.length === 0) {
           const dirEntries = (() => {
             try {
-              return readdirSync7(agentDir);
+              return readdirSync7(homeRoot);
             } catch {
               return [];
             }
@@ -2934,6 +3915,30 @@ function homeTools(agentDir) {
     }
   ];
 }
+function resolvePrivateHomeRoot(agentDir) {
+  try {
+    return resolveRealDirectory(agentDir);
+  } catch {
+    throw new Error("home tools require a real private Agent directory");
+  }
+}
+function privateHomeFile(homeRoot, file) {
+  return join18(homeRoot, file);
+}
+function rejectSymlinkOrNonFile(path) {
+  const entry = lstatSync5(path);
+  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
+  if (!entry.isFile()) throw new Error("target is not a regular file");
+}
+function rejectExistingSymlinkOrNonFile(path) {
+  try {
+    rejectSymlinkOrNonFile(path);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT") return;
+    throw error;
+  }
+}
 
 // ../daemon/src/runtime/tools/mcp.ts
 function mcpProxyTools(host, tools) {
@@ -3306,6 +4311,7 @@ function extractReadable(html, url, mode) {
 // ../daemon/src/runtime/tools/web-ssrf.ts
 import { lookup as dnsLookupCb } from "dns";
 import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { Agent, fetch as undiciFetch } from "undici";
 var SsrFBlockedError = class extends Error {
   constructor(message) {
@@ -3314,7 +4320,6 @@ var SsrFBlockedError = class extends Error {
   }
 };
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata.google.internal"]);
-var PRIVATE_IPV6_PREFIXES = ["fe80:", "fec0:", "fc", "fd"];
 function normalizeHostname(hostname) {
   let h = hostname.trim().toLowerCase().replace(/\.$/, "");
   if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
@@ -3322,11 +4327,32 @@ function normalizeHostname(hostname) {
 }
 function parseIpv4(address) {
   const parts = address.split(".");
-  if (parts.length !== 4) return null;
-  const nums = parts.map((p) => Number.parseInt(p, 10));
+  if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part))) return null;
+  const nums = parts.map(Number);
   if (nums.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return null;
   return nums;
 }
+function parseIpv6(address) {
+  const zoneIndex = address.indexOf("%");
+  let source = zoneIndex === -1 ? address : address.slice(0, zoneIndex);
+  if (isIP(source) !== 6) return null;
+  if (source.includes(".")) {
+    const separator = source.lastIndexOf(":");
+    const ipv4 = parseIpv4(source.slice(separator + 1));
+    if (separator === -1 || !ipv4) return null;
+    const [a, b, c, d] = ipv4;
+    source = `${source.slice(0, separator)}:${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = source.split("::");
+  if (halves.length > 2) return null;
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves[1] ? halves[1].split(":") : [];
+  const omitted = 8 - left.length - right.length;
+  if (halves.length === 1 && omitted !== 0 || halves.length === 2 && omitted < 1) return null;
+  return [...left, ...Array.from({ length: omitted }, () => "0"), ...right].map(
+    (word) => Number.parseInt(word, 16)
+  );
+}
 function isPrivateIpv4(parts) {
   const [a, b] = parts;
   if (a === 0 || a === 10 || a === 127) return true;
@@ -3336,21 +4362,38 @@ function isPrivateIpv4(parts) {
   if (a === 100 && b >= 64 && b <= 127) return true;
   return false;
 }
+function embeddedIpv4(words) {
+  const [a, b, c, d, e, f, g, h] = words;
+  const low32 = [g >> 8, g & 255, h >> 8, h & 255];
+  if (a === 0 && b === 0 && c === 0 && d === 0 && e === 0 && f === 0 || a === 0 && b === 0 && c === 0 && d === 0 && e === 0 && f === 65535 || a === 0 && b === 0 && c === 0 && d === 0 && e === 65535 && f === 0) {
+    return low32;
+  }
+  if (a === 100 && b === 65435 && c === 0 && d === 0 && e === 0 && f === 0) {
+    return low32;
+  }
+  if (a === 100 && b === 65435 && c === 1 && e >> 8 === 0) {
+    return [d >> 8, d & 255, e & 255, f >> 8];
+  }
+  if (a === 8194) return [b >> 8, b & 255, c >> 8, c & 255];
+  return null;
+}
 function isPrivateIpAddress(address) {
   let norm = address.trim().toLowerCase();
   if (norm.startsWith("[") && norm.endsWith("]")) norm = norm.slice(1, -1);
   if (!norm) return false;
-  if (norm.startsWith("::ffff:")) {
-    const mapped = norm.slice("::ffff:".length);
-    const ipv42 = parseIpv4(mapped);
-    if (ipv42) return isPrivateIpv4(ipv42);
-  }
-  if (norm.includes(":")) {
-    if (norm === "::" || norm === "::1") return true;
-    return PRIVATE_IPV6_PREFIXES.some((p) => norm.startsWith(p));
-  }
   const ipv4 = parseIpv4(norm);
-  return ipv4 ? isPrivateIpv4(ipv4) : false;
+  if (ipv4) return isPrivateIpv4(ipv4);
+  const words = parseIpv6(norm);
+  if (!words) return false;
+  const [first] = words;
+  if (words.every((word) => word === 0)) return true;
+  if (words.slice(0, 7).every((word) => word === 0) && words[7] === 1) return true;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  if ((first & 65472) === 65216) return true;
+  if ((first & 65280) === 65280) return true;
+  const embedded = embeddedIpv4(words);
+  return embedded ? isPrivateIpv4(embedded) : false;
 }
 function isBlockedHostname(hostname) {
   const h = normalizeHostname(hostname);
@@ -3407,6 +4450,14 @@ async function resolveAndCheck(hostname) {
 function isRedirectStatus(s) {
   return s === 301 || s === 302 || s === 303 || s === 307 || s === 308;
 }
+function withoutCrossOriginCredentials(headersInit) {
+  if (!headersInit) return void 0;
+  const headers = new Headers(headersInit);
+  headers.delete("authorization");
+  headers.delete("cookie");
+  headers.delete("proxy-authorization");
+  return headers;
+}
 async function closeDispatcher(d) {
   if (!d) return;
   try {
@@ -3427,6 +4478,7 @@ async function guardedFetch(opts) {
       });
   }
   let current = opts.url;
+  let requestInit = { ...opts.init ?? {} };
   const visited = /* @__PURE__ */ new Set();
   let redirects = 0;
   let dispatcher = null;
@@ -3454,7 +4506,7 @@ async function guardedFetch(opts) {
       dispatcher = canPin ? new Agent({ connect: { lookup: createPinnedLookup(parsed.hostname, addrs) } }) : null;
     }
     const init = {
-      ...opts.init ?? {},
+      ...requestInit,
       redirect: "manual",
       signal: abortController.signal
     };
@@ -3484,6 +4536,12 @@ async function guardedFetch(opts) {
       }
       visited.add(next);
       void res.body?.cancel();
+      if (new URL(next).origin !== parsed.origin) {
+        requestInit = {
+          ...requestInit,
+          headers: withoutCrossOriginCredentials(requestInit.headers)
+        };
+      }
       current = next;
       continue;
     }
@@ -3639,6 +4697,17 @@ function cacheSet(cache, key, value, ttlMs, maxEntries) {
   }
 }
 function webTools(opts) {
+  return buildWebTools(opts, true);
+}
+function protectedWebFetchTool(opts) {
+  const tool = buildWebTools(
+    { ...opts, env: {}, allowPrivate: false, firecrawlDisabled: true },
+    false
+  )[0];
+  if (!tool) throw new Error("protected web_fetch tool construction failed");
+  return tool;
+}
+function buildWebTools(opts, includeSearch) {
   const fetchFn = opts?.fetchImpl ?? undiciFetch2;
   const env = opts?.env ?? process.env;
   const allowPrivate = opts?.allowPrivate ?? false;
@@ -3648,8 +4717,9 @@ function webTools(opts) {
   const maxBodyBytes = opts?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
   const firecrawlDisabled = opts?.firecrawlDisabled ?? false;
   const cache = /* @__PURE__ */ new Map();
-  return [
-    {
+  const tools = [];
+  if (includeSearch) {
+    tools.push({
       def: {
         name: "web_search",
         description: "Search the internet. Returns a list of titles, URLs, and snippets. Requires BRAVE_API_KEY or SEARXNG_URL to be configured.",
@@ -3680,99 +4750,100 @@ function webTools(opts) {
           "web_search: no search backend configured. Set BRAVE_API_KEY (free at https://brave.com/search/api/) or SEARXNG_URL."
         );
       }
-    },
-    {
-      def: {
-        name: "web_fetch",
-        description: "Fetch a URL and return its readable content. HTML is extracted via Readability and converted to markdown. When the primary extraction returns near-empty content from a 2xx HTML page (typical of JS-only shells), the tool automatically retries via Firecrawl if FIRECRAWL_API_KEY is configured. Results are cached for 15 minutes.",
-        parameters: {
-          type: "object",
-          properties: {
-            url: { type: "string", description: "The URL to fetch (http or https)" },
-            max_length: {
-              type: "number",
-              description: "Max characters to return (default 20000)"
-            },
-            extract_mode: {
-              type: "string",
-              enum: ["markdown", "text"],
-              description: 'Output format for HTML pages. Default "markdown".'
-            }
+    });
+  }
+  tools.push({
+    def: {
+      name: "web_fetch",
+      description: firecrawlDisabled ? "Fetch a public HTTP or HTTPS URL and return its readable content. Private, loopback, link-local, metadata, and DNS-rebinding targets are blocked. HTML is extracted via Readability and converted to markdown. Results are cached for 15 minutes." : "Fetch a URL and return its readable content. HTML is extracted via Readability and converted to markdown. When the primary extraction returns near-empty content from a 2xx HTML page (typical of JS-only shells), the tool automatically retries via Firecrawl if FIRECRAWL_API_KEY is configured. Results are cached for 15 minutes.",
+      parameters: {
+        type: "object",
+        properties: {
+          url: { type: "string", description: "The URL to fetch (http or https)" },
+          max_length: {
+            type: "number",
+            description: "Max characters to return (default 20000)"
           },
-          required: ["url"]
-        }
-      },
-      async invoke(args) {
-        const url = String(args.url ?? "");
-        if (!url) throw new Error("web_fetch: url is required");
-        const maxLen = typeof args.max_length === "number" ? args.max_length : DEFAULT_MAX_LENGTH;
-        const mode = args.extract_mode === "text" ? "text" : "markdown";
-        const cacheKey = `${mode}|${url}`;
-        const cached = cacheGet(cache, cacheKey);
-        if (cached) return formatOutput(cached, maxLen);
-        let result = null;
-        try {
-          result = await guardedFetch({
-            url,
-            fetchImpl: opts?.fetchImpl,
-            allowPrivate,
-            timeoutMs,
-            init: {
-              headers: {
-                "user-agent": DEFAULT_USER_AGENT,
-                accept: "text/html,application/xhtml+xml,application/json,text/plain,*/*",
-                "accept-language": "en-US,en;q=0.9"
-              }
-            }
-          });
-          if (!result.response.ok) {
-            throw new Error(`${result.response.status} ${result.response.statusText}`);
+          extract_mode: {
+            type: "string",
+            enum: ["markdown", "text"],
+            description: 'Output format for HTML pages. Default "markdown".'
           }
-          const ct = result.response.headers.get("content-type") ?? "";
-          const isHtml = ct.includes("text/html") || ct.includes("xhtml");
-          const { text: body, truncated } = await readBodyCapped(result.response, maxBodyBytes);
-          let extracted;
-          if (isHtml) {
-            extracted = extractReadable(body, result.finalUrl, mode);
-          } else if (ct.includes("application/json")) {
-            try {
-              extracted = { text: JSON.stringify(JSON.parse(body), null, 2) };
-            } catch {
-              extracted = { text: body };
+        },
+        required: ["url"]
+      }
+    },
+    async invoke(args) {
+      const url = String(args.url ?? "");
+      if (!url) throw new Error("web_fetch: url is required");
+      const maxLen = typeof args.max_length === "number" ? args.max_length : DEFAULT_MAX_LENGTH;
+      const mode = args.extract_mode === "text" ? "text" : "markdown";
+      const cacheKey = `${mode}|${url}`;
+      const cached = cacheGet(cache, cacheKey);
+      if (cached) return formatOutput(cached, maxLen);
+      let result = null;
+      try {
+        result = await guardedFetch({
+          url,
+          fetchImpl: opts?.fetchImpl,
+          allowPrivate,
+          timeoutMs,
+          init: {
+            headers: {
+              "user-agent": DEFAULT_USER_AGENT,
+              accept: "text/html,application/xhtml+xml,application/json,text/plain,*/*",
+              "accept-language": "en-US,en;q=0.9"
             }
-          } else {
+          }
+        });
+        if (!result.response.ok) {
+          throw new Error(`${result.response.status} ${result.response.statusText}`);
+        }
+        const ct = result.response.headers.get("content-type") ?? "";
+        const isHtml = ct.includes("text/html") || ct.includes("xhtml");
+        const { text: body, truncated } = await readBodyCapped(result.response, maxBodyBytes);
+        let extracted;
+        if (isHtml) {
+          extracted = extractReadable(body, result.finalUrl, mode);
+        } else if (ct.includes("application/json")) {
+          try {
+            extracted = { text: JSON.stringify(JSON.parse(body), null, 2) };
+          } catch {
             extracted = { text: body };
           }
-          if (isHtml && !firecrawlDisabled && extracted.text.length < FIRECRAWL_FALLBACK_THRESHOLD) {
-            const rescued = await firecrawlScrape(result.finalUrl, mode, env, fetchFn, timeoutMs);
-            if (rescued) {
-              extracted = {
-                ...rescued,
-                text: `${rescued.text}
+        } else {
+          extracted = { text: body };
+        }
+        if (isHtml && !firecrawlDisabled && extracted.text.length < FIRECRAWL_FALLBACK_THRESHOLD) {
+          const rescued = await firecrawlScrape(result.finalUrl, mode, env, fetchFn, timeoutMs);
+          if (rescued) {
+            extracted = {
+              ...rescued,
+              text: `${rescued.text}
 
 [content rendered via Firecrawl fallback \u2014 primary extraction returned ${extracted.text.length} chars]`
-              };
-            }
+            };
           }
-          if (truncated) {
-            extracted = {
-              ...extracted,
-              text: `${extracted.text}
+        }
+        if (truncated) {
+          extracted = {
+            ...extracted,
+            text: `${extracted.text}
 
 [raw body truncated at ${maxBodyBytes} bytes before extraction \u2014 page exceeded the size cap]`
-            };
-          }
-          cacheSet(cache, cacheKey, extracted, cacheTtlMs, cacheMax);
-          return formatOutput(extracted, maxLen);
-        } catch (err) {
-          if (err instanceof SsrFBlockedError) throw new Error(`web_fetch: ${err.message}`);
-          throw new Error(`web_fetch: ${describeError(err)}`);
-        } finally {
-          if (result) await result.release();
+          };
         }
+        cacheSet(cache, cacheKey, extracted, cacheTtlMs, cacheMax);
+        return formatOutput(extracted, maxLen);
+      } catch (err) {
+        if (err instanceof SsrFBlockedError) throw new Error(`web_fetch: ${err.message}`);
+        throw new Error(`web_fetch: ${describeError(err)}`);
+      } finally {
+        if (result) await result.release();
       }
     }
-  ];
+  });
+  return tools;
 }
 function formatOutput(r, maxLen) {
   const body = r.title ? `# ${r.title}
@@ -3835,8 +4906,26 @@ function createBazilionCustomTools(opts) {
   }
   return handlers.map(ourToolToPiTool);
 }
+function createProtectedBazilionCustomTools(opts) {
+  const handlers = [
+    ...memoryTools(opts.memory),
+    ...homeTools(opts.agent.agent.dir),
+    bootstrapTool(opts.agent.agent.dir),
+    protectedWebFetchTool(),
+    ...messagingTools(opts.messagingHost, opts.agent.agent.id),
+    ...userMdTools(opts.userMdHost, opts.agent.team.id),
+    deliverFileTool(opts.agent.team.path, opts.fileSink)
+  ];
+  return handlers.map(ourToolToPiTool);
+}
 
 // ../daemon/src/runtime/pi/session.ts
+var PROTECTED_MODEL_CWD = "/workspace";
+var REVIEW_MODEL_CWD = "/review";
+var PROTECTED_BASE_SYSTEM_PROMPT = `You are an assistant operating inside Bazilion's protected
+Agent runtime. Use only the tools exposed for this turn. Coding commands execute in an ephemeral,
+network-disabled Docker container whose Team workspace is /workspace. Host paths and host tools are
+not available. Be concise and show container paths clearly when working with files.`;
 async function createBazilionSession(opts) {
   const {
     agent,
@@ -3869,19 +4958,19 @@ async function createBazilionSession(opts) {
   });
   const model = resolvePiModel(modelRuntime, providerName, modelId, baseUrl);
   const cwd = agent.team.path;
-  if (!existsSync13(cwd)) mkdirSync5(cwd, { recursive: true });
+  if (!existsSync14(cwd)) mkdirSync7(cwd, { recursive: true });
   const promptSkills = restricted ? [] : loadPromptSkills(paths.skillsDir, agent.skills);
-  const uploadsDir = join18(agent.agent.dir, "uploads");
+  const uploadsDir = join19(agent.agent.dir, "uploads");
   const shellTools = restricted ? null : createSessionShellTools(cwd, env, {
-    ...existsSync13(uploadsDir) ? { inputsDir: uploadsDir } : {},
+    ...existsSync14(uploadsDir) ? { inputsDir: uploadsDir } : {},
     skillMounts: promptSkills.map((skill) => ({
       source: skill.hostDir,
       target: skill.sandboxDir
     })),
     approvalHost: bashApprovalHost
   });
-  const sessionDir = restricted?.sessionDir ?? join18(paths.agentDir(agent.agent.id), "sessions");
-  mkdirSync5(sessionDir, { recursive: true });
+  const sessionDir = restricted?.sessionDir ?? join19(paths.agentDir(agent.agent.id), "sessions");
+  mkdirSync7(sessionDir, { recursive: true });
   const existing = restricted ? null : findMostRecent(sessionDir);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
   const settingsManager = SettingsManager.inMemory({
@@ -3899,7 +4988,7 @@ async function createBazilionSession(opts) {
   });
   const resourceLoader = new DefaultResourceLoader({
     cwd,
-    agentDir: join18(paths.home, "pi"),
+    agentDir: join19(paths.home, "pi"),
     settingsManager,
     noExtensions: true,
     noSkills: true,
@@ -3924,7 +5013,7 @@ async function createBazilionSession(opts) {
   const allowedTools = [...shellTools?.hostToolNames ?? [], ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join18(paths.home, "pi"),
+    agentDir: join19(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(restricted?.reasoningLevel ?? agent.reasoningLevel),
     tools: allowedTools,
@@ -3951,6 +5040,258 @@ async function createBazilionSession(opts) {
     }
   };
 }
+async function createProtectedBazilionSession(opts) {
+  const { providerName, modelId } = splitModelString(opts.agent.model);
+  if (providerName !== opts.runtime.providerName || modelId !== opts.runtime.modelId) {
+    throw new Error("protected Agent model does not match the prepared provider runtime");
+  }
+  if (opts.agent.agent.dir !== opts.paths.agentDir || opts.agent.team.path !== opts.paths.teamDir) {
+    throw new Error("protected session paths do not match the resolved Agent");
+  }
+  if (!existsSync14(opts.paths.teamDir)) {
+    throw new Error("protected Team workspace is unavailable");
+  }
+  const modelRuntime = await createProtectedPiRuntime({
+    providerName: opts.runtime.providerName,
+    modelId: opts.runtime.modelId,
+    apiKey: opts.runtime.apiKey,
+    baseUrl: opts.runtime.baseUrl,
+    credentialEnv: materializeProtectedCredentialFile(opts.runtime, opts.scratch)
+  });
+  const model = resolvePiModel(
+    modelRuntime,
+    opts.runtime.providerName,
+    opts.runtime.modelId,
+    opts.runtime.baseUrl
+  );
+  const shellTools = createProtectedSessionShellTools(
+    opts.paths.teamDir,
+    opts.docker,
+    opts.bashApprovalHost
+  );
+  mkdirSync7(opts.paths.sessionDir, { recursive: true });
+  const existing = findMostRecent(opts.paths.sessionDir);
+  const sessionManager = existing ? SessionManager.open(existing, opts.paths.sessionDir, opts.paths.teamDir) : SessionManager.create(opts.paths.teamDir, opts.paths.sessionDir);
+  const settingsManager = createInMemorySettingsManager();
+  const bazilionPrompt = redactJsonValue(
+    buildSystemPrompt(opts.agent, {
+      skills: opts.paths.skills,
+      sandboxMode: "docker",
+      homeDocuments: opts.paths.homeDocuments
+    }),
+    protectedRuntimeSecrets(opts.runtime)
+  );
+  const resourceLoader = new DefaultResourceLoader({
+    cwd: PROTECTED_MODEL_CWD,
+    agentDir: opts.scratch.piAgentDir,
+    settingsManager,
+    noExtensions: true,
+    noSkills: true,
+    noPromptTemplates: true,
+    noThemes: true,
+    noContextFiles: true,
+    systemPrompt: PROTECTED_BASE_SYSTEM_PROMPT,
+    appendSystemPrompt: bazilionPrompt ? [bazilionPrompt] : void 0
+  });
+  await resourceLoader.reload();
+  const bazilionTools = createProtectedBazilionCustomTools({
+    agent: opts.agent,
+    memory: opts.memory,
+    messagingHost: opts.messagingHost,
+    userMdHost: opts.userMdHost,
+    fileSink: opts.fileSink
+  });
+  if (!shellTools.customBash) throw new Error("protected Docker bash tool is unavailable");
+  const customTools = [...bazilionTools, shellTools.customBash];
+  const { session } = await createAgentSession({
+    cwd: PROTECTED_MODEL_CWD,
+    agentDir: opts.scratch.piAgentDir,
+    model,
+    thinkingLevel: toPiThinkingLevel(opts.runtime.reasoningLevel),
+    tools: customTools.map((tool) => tool.name),
+    customTools,
+    sessionManager,
+    settingsManager,
+    modelRuntime,
+    resourceLoader
+  });
+  installProtectedCredentialBoundary(
+    session,
+    opts.runtime.providerName,
+    protectedRuntimeSecrets(opts.runtime),
+    opts.refreshApiKey
+  );
+  return sessionHandle(session);
+}
+async function createRestrictedReviewSession(opts) {
+  const modelRuntime = await createProtectedPiRuntime({
+    providerName: opts.runtime.providerName,
+    modelId: opts.runtime.modelId,
+    apiKey: opts.runtime.apiKey,
+    baseUrl: opts.runtime.baseUrl,
+    credentialEnv: materializeProtectedCredentialFile(opts.runtime, opts.scratch)
+  });
+  const model = resolvePiModel(
+    modelRuntime,
+    opts.runtime.providerName,
+    opts.runtime.modelId,
+    opts.runtime.baseUrl
+  );
+  const settingsManager = createInMemorySettingsManager();
+  const sessionManager = SessionManager.create(
+    opts.scratch.reviewCwd,
+    opts.scratch.reviewSessionDir
+  );
+  const resourceLoader = new DefaultResourceLoader({
+    cwd: REVIEW_MODEL_CWD,
+    agentDir: opts.scratch.piAgentDir,
+    settingsManager,
+    noExtensions: true,
+    noSkills: true,
+    noPromptTemplates: true,
+    noThemes: true,
+    noContextFiles: true,
+    systemPrompt: opts.systemPrompt
+  });
+  await resourceLoader.reload();
+  const { session } = await createAgentSession({
+    cwd: REVIEW_MODEL_CWD,
+    agentDir: opts.scratch.piAgentDir,
+    model,
+    thinkingLevel: toPiThinkingLevel(opts.runtime.reasoningLevel),
+    tools: opts.tools.map((tool) => tool.name),
+    customTools: opts.tools,
+    sessionManager,
+    settingsManager,
+    modelRuntime,
+    resourceLoader
+  });
+  installProtectedCredentialBoundary(
+    session,
+    opts.runtime.providerName,
+    protectedRuntimeSecrets(opts.runtime),
+    opts.refreshApiKey
+  );
+  return sessionHandle(session);
+}
+function materializeProtectedCredentialFile(runtime, scratch) {
+  const fields = [...runtime.credentialEnv ?? []];
+  if (runtime.credentialFile) {
+    const path = join19(scratch.tempDir, "provider-credential.json");
+    writeFileSync9(path, runtime.credentialFile.content, {
+      encoding: "utf8",
+      mode: 384,
+      flag: "wx"
+    });
+    fields.push({ name: runtime.credentialFile.envName, value: path });
+  }
+  return fields.length > 0 ? fields : void 0;
+}
+function createInMemorySettingsManager() {
+  return SettingsManager.inMemory({
+    compaction: { enabled: false },
+    retry: {
+      enabled: true,
+      maxRetries: 2,
+      baseDelayMs: 500,
+      provider: { maxRetryDelayMs: 8e3 }
+    }
+  });
+}
+function installProtectedCredentialBoundary(session, providerName, initialSecrets, refreshApiKey) {
+  const activeTokens = [...new Set(initialSecrets.filter(Boolean))];
+  session.agent.state.messages = redactJsonValue(session.agent.state.messages, activeTokens);
+  const originalStream = session.agent.streamFunction;
+  session.agent.streamFunction = async (model, context, options) => {
+    let upstream;
+    try {
+      upstream = await originalStream(model, context, options);
+    } catch (error) {
+      throw credentialSafeError(error, activeTokens);
+    }
+    const sanitized = createAssistantMessageEventStream();
+    void (async () => {
+      let latestPartial;
+      try {
+        for await (const event of upstream) {
+          const safeEvent = redactJsonValue(event, activeTokens);
+          if ("partial" in safeEvent) latestPartial = safeEvent.partial;
+          sanitized.push(safeEvent);
+        }
+      } catch (error) {
+        const safeError = credentialSafeError(error, activeTokens);
+        sanitized.push({
+          type: "error",
+          reason: "error",
+          error: credentialSafeAssistantError(model, latestPartial, safeError, activeTokens)
+        });
+      } finally {
+        sanitized.end();
+      }
+    })();
+    return sanitized;
+  };
+  const originalAfterToolCall = session.agent.afterToolCall;
+  session.agent.afterToolCall = async (context, signal) => {
+    let prior;
+    try {
+      prior = await originalAfterToolCall?.(context, signal);
+    } catch (error) {
+      throw credentialSafeError(error, activeTokens);
+    }
+    return {
+      ...prior,
+      content: redactJsonValue(prior?.content ?? context.result.content, activeTokens),
+      details: redactJsonValue(prior?.details ?? context.result.details, activeTokens)
+    };
+  };
+  session.agent.getApiKey = async (requestedProvider) => {
+    if (requestedProvider !== providerName) return void 0;
+    try {
+      const token = await refreshApiKey(providerName);
+      if (token && !activeTokens.includes(token)) activeTokens.push(token);
+      return token || void 0;
+    } catch {
+      return void 0;
+    }
+  };
+}
+function credentialSafeError(error, activeTokens) {
+  const message = error instanceof Error ? error.message : String(error);
+  return new Error(redactJsonValue(message, activeTokens));
+}
+function credentialSafeAssistantError(model, latestPartial, error, activeTokens) {
+  const safePartial = latestPartial ? redactJsonValue(latestPartial, activeTokens) : {
+    role: "assistant",
+    content: [],
+    api: model.api,
+    provider: model.provider,
+    model: model.id,
+    usage: {
+      input: 0,
+      output: 0,
+      cacheRead: 0,
+      cacheWrite: 0,
+      totalTokens: 0,
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 }
+    },
+    timestamp: Date.now()
+  };
+  return {
+    ...safePartial,
+    stopReason: "error",
+    errorMessage: error.message,
+    timestamp: Date.now()
+  };
+}
+function sessionHandle(session) {
+  return {
+    session,
+    dispose() {
+      session.dispose();
+    }
+  };
+}
 function splitModelString(s) {
   const idx = s.indexOf(":");
   if (idx === -1) {
@@ -3972,11 +5313,11 @@ function toPiThinkingLevel(level) {
   }
 }
 function findMostRecent(sessionDir) {
-  if (!existsSync13(sessionDir)) return null;
+  if (!existsSync14(sessionDir)) return null;
   let newest = null;
   for (const entry of readdirSync8(sessionDir)) {
     if (!entry.endsWith(".jsonl")) continue;
-    const path = join18(sessionDir, entry);
+    const path = join19(sessionDir, entry);
     try {
       const s = statSync5(path);
       if (!newest || s.mtimeMs > newest.mtimeMs) newest = { path, mtimeMs: s.mtimeMs };
@@ -3989,7 +5330,7 @@ function findMostRecent(sessionDir) {
 // ../daemon/src/runtime/worker/api-key-refresh.ts
 function createIpcApiKeyRefresher(call, context) {
   return async (providerName) => {
-    assertOpenAICodexProvider(providerName, context.providerName);
+    assertSelectedProvider(providerName, context.providerName);
     return call("refreshApiKey", {
       providerName,
       agentId: context.agentId,
@@ -3997,14 +5338,14 @@ function createIpcApiKeyRefresher(call, context) {
     });
   };
 }
-function assertOpenAICodexProvider(requested, expected) {
-  if (expected !== "openai-codex" || requested !== expected) {
+function assertSelectedProvider(requested, expected) {
+  if (!expected || requested !== expected) {
     throw new Error("unexpected API key refresh provider");
   }
 }
 
 // ../daemon/src/runtime/worker/ipc-client.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 function createIpcClient(channel) {
   const pending = /* @__PURE__ */ new Map();
   let disconnected = false;
@@ -4031,10 +5372,10 @@ function createIpcClient(channel) {
     if (!send) {
       return Promise.reject(new Error("worker: no IPC channel \u2014 daemon must spawn with stdio:ipc"));
     }
-    const id = randomUUID18();
+    const id = randomUUID19();
     const message = { type: "rpc", id, method, args };
-    return new Promise((resolve5, reject) => {
-      pending.set(id, { resolve: (value) => resolve5(value), reject });
+    return new Promise((resolve6, reject) => {
+      pending.set(id, { resolve: (value) => resolve6(value), reject });
       try {
         send(message, (error) => {
           if (!error) return;
@@ -4055,29 +5396,40 @@ function isIpcReply(message) {
 }
 
 // ../daemon/src/runtime/worker/entry.ts
+var activeAccessTokens = [];
 function emit(frame) {
-  process.stdout.write(`${JSON.stringify(frame)}
+  process.stdout.write(`${JSON.stringify(redactJsonValue(frame, activeAccessTokens))}
 `);
 }
 async function readInput() {
   const chunks = [];
-  for await (const c of process.stdin) chunks.push(c);
+  for await (const chunk of process.stdin) chunks.push(chunk);
   const raw = Buffer.concat(chunks).toString("utf8").trim();
   if (!raw) throw new Error("worker: empty stdin input");
-  const parsed = JSON.parse(raw);
-  if (!parsed.agent || typeof parsed.message !== "string" || !Array.isArray(parsed.enabledProviders) || typeof parsed.turnId !== "string" || parsed.apiKeyRefreshEnabled !== void 0 && typeof parsed.apiKeyRefreshEnabled !== "boolean" || parsed.bashApprovalMode !== "interactive" && parsed.bashApprovalMode !== "auto_deny") {
-    throw new Error(
-      "worker: stdin must include {agent, message, enabledProviders, turnId, bashApprovalMode}"
-    );
-  }
-  if (parsed.mode === "review" && !parsed.review?.reviewId) {
-    throw new Error("worker: review mode requires review metadata");
-  }
-  const providerName = parsed.agent.model.split(":", 1)[0] ?? "";
-  if (parsed.apiKeyRefreshEnabled && (providerName !== "openai-codex" || typeof parsed.apiKey !== "string")) {
-    throw new Error("worker: API key refresh requires an openai-codex turn with an initial token");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("worker: stdin is not valid JSON");
   }
-  return parsed;
+  return parseWorkerInput(parsed);
+}
+function createWorkerIpcCall() {
+  return createIpcClient({
+    send: process.send ? (ipcMessage, done) => {
+      process.send?.(ipcMessage, void 0, void 0, done);
+    } : void 0,
+    onMessage: (listener) => process.on("message", listener),
+    onDisconnect: (listener) => process.on("disconnect", listener)
+  });
+}
+function createTrackedIpcApiKeyRefresher(call, context) {
+  const refresh = createIpcApiKeyRefresher(call, context);
+  return async (providerName) => {
+    const token = await refresh(providerName);
+    if (token && !activeAccessTokens.includes(token)) activeAccessTokens.push(token);
+    return token;
+  };
 }
 function createIpcMessagingHost(call) {
   return {
@@ -4111,81 +5463,27 @@ function createIpcBashApprovalHost(call, input) {
   return {
     async requestApproval(request) {
       const result = await call("bashApproval", {
-        id: randomUUID19(),
+        id: randomUUID20(),
         turnId: input.turnId,
         toolCallId: request.toolCallId,
-        agentId: input.agent.agent.id,
-        teamId: input.agent.team.id,
+        agentId: input.agentId,
+        teamId: input.teamId,
         command: request.command,
         risks: [...request.risks],
-        mode: input.bashApprovalMode
+        mode: input.mode
       });
       return result.decision === "allow" ? "approved" : "denied";
     }
   };
 }
-async function main() {
-  let aborted = false;
-  let abortSession = null;
-  const onSignal = () => {
-    aborted = true;
-    if (abortSession) {
-      abortSession();
-    } else {
-      try {
-        emit({ kind: "event", event: { type: "error", error: "cancelled" } });
-      } catch {
-      }
-      process.exit(0);
-    }
-  };
-  process.on("SIGTERM", onSignal);
-  process.on("SIGINT", onSignal);
-  const {
-    agent,
-    message,
-    enabledProviders,
-    apiKey,
-    apiKeyRefreshEnabled,
-    browserEnabled,
-    mcpTools,
-    images,
-    turnId,
-    bashApprovalMode,
-    mode = "chat",
-    review
-  } = await readInput();
-  const paths = resolvePaths();
-  const memory = qmdBackend(join19(agent.team.path, "memory"));
-  await memory.init();
-  const ipcCall = createIpcClient({
-    send: process.send ? (ipcMessage, done) => {
-      process.send?.(ipcMessage, void 0, void 0, done);
-    } : void 0,
-    onMessage: (listener) => process.on("message", listener),
-    onDisconnect: (listener) => process.on("disconnect", listener)
-  });
-  const refreshApiKey = apiKeyRefreshEnabled ? createIpcApiKeyRefresher(ipcCall, {
-    providerName: agent.model.split(":", 1)[0] ?? "",
-    agentId: agent.agent.id,
-    turnId
-  }) : void 0;
-  const messagingHost = createIpcMessagingHost(ipcCall);
-  const userMdHost = createIpcUserMdHost(ipcCall);
-  const browserHost = browserEnabled ? createIpcBrowserHost(ipcCall) : void 0;
-  const mcpHost = mcpTools && mcpTools.length > 0 ? createIpcMcpHost(ipcCall) : void 0;
-  const bashApprovalHost = createIpcBashApprovalHost(ipcCall, {
-    agent,
-    turnId,
-    bashApprovalMode
-  });
-  const reviewSessionDir = mode === "review" ? mkdtempSync3(join19(paths.logsDir, "review-session-")) : null;
+function createReviewState(evidenceItems) {
   const proposals = [];
   let proposalBatchSubmitted = false;
+  let reviewValidationFailures = 0;
   const allowedEvidence = new Set(
-    (review?.evidence ?? []).map((item) => `${item.sessionId}:${item.entryOrdinal}`)
+    evidenceItems.map((item) => `${item.sessionId}:${item.entryOrdinal}`)
   );
-  const reviewTools = [
+  const tools = [
     {
       name: "propose_lesson",
       label: "propose_lesson",
@@ -4205,8 +5503,8 @@ async function main() {
       }),
       async execute(_toolCallId, params) {
         if (proposalBatchSubmitted) throw new Error("propose_lesson may be called only once");
-        proposalBatchSubmitted = true;
         const input = params;
+        const validated = [];
         for (const candidate of input.proposals) {
           const text = candidate.text.trim();
           if (!text || text.length > 500) throw new Error("proposal text must be 1-500 characters");
@@ -4215,8 +5513,10 @@ async function main() {
               throw new Error("proposal cites evidence outside the supplied digest");
             }
           }
-          proposals.push({ ...candidate, text });
+          validated.push({ ...candidate, text });
         }
+        proposalBatchSubmitted = true;
+        proposals.push(...validated);
         return {
           content: [{ type: "text", text: `accepted ${proposals.length} proposals` }],
           details: {},
@@ -4225,86 +5525,168 @@ async function main() {
       }
     }
   ];
-  const { session, dispose } = await createBazilionSession({
-    agent,
-    paths,
-    env: process.env,
+  return {
+    proposals,
+    submitted: () => proposalBatchSubmitted,
+    validationFailures: () => reviewValidationFailures,
+    recordValidationFailure: () => {
+      reviewValidationFailures += 1;
+    },
+    tools
+  };
+}
+async function createSessionForInput(input, ipcCall) {
+  if (input.kind === "configured_operator_http") {
+    const paths = resolvePaths();
+    const memory2 = qmdBackend(`${input.agent.team.path}/memory`);
+    await memory2.init();
+    const messagingHost2 = createIpcMessagingHost(ipcCall);
+    const userMdHost2 = createIpcUserMdHost(ipcCall);
+    const browserHost = input.browserEnabled ? createIpcBrowserHost(ipcCall) : void 0;
+    const mcpHost = input.mcpTools?.length ? createIpcMcpHost(ipcCall) : void 0;
+    const bashApprovalHost2 = createIpcBashApprovalHost(ipcCall, {
+      agentId: input.agent.agent.id,
+      teamId: input.agent.team.id,
+      turnId: input.turnId,
+      mode: input.bashApprovalMode
+    });
+    const refreshApiKey2 = input.apiKeyRefreshEnabled ? createTrackedIpcApiKeyRefresher(ipcCall, {
+      providerName: input.agent.model.split(":", 1)[0] ?? "",
+      agentId: input.agent.agent.id,
+      turnId: input.turnId
+    }) : void 0;
+    const handle2 = await createBazilionSession({
+      agent: input.agent,
+      paths,
+      env: process.env,
+      memory: memory2,
+      enabledProviders: new Set(input.enabledProviders),
+      messagingHost: messagingHost2,
+      userMdHost: userMdHost2,
+      apiKey: input.apiKey,
+      refreshApiKey: refreshApiKey2,
+      browserHost,
+      mcpHost,
+      mcpTools: input.mcpTools,
+      bashApprovalHost: bashApprovalHost2,
+      fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
+    });
+    return { handle: handle2 };
+  }
+  const refreshApiKey = createTrackedIpcApiKeyRefresher(ipcCall, {
+    providerName: input.runtime.providerName,
+    agentId: input.kind === "protected" ? input.agent.agent.id : input.agentId,
+    turnId: input.turnId
+  });
+  if (input.kind === "restricted_review") {
+    const reviewState = createReviewState(input.review.evidence);
+    const handle2 = await createRestrictedReviewSession({
+      runtime: input.runtime,
+      scratch: input.scratch,
+      systemPrompt: REVIEW_SYSTEM_PROMPT,
+      tools: reviewState.tools,
+      refreshApiKey
+    });
+    return { handle: handle2, reviewState };
+  }
+  const memory = qmdBackend(input.paths.memoryDir);
+  await memory.init();
+  const messagingHost = createIpcMessagingHost(ipcCall);
+  const userMdHost = createIpcUserMdHost(ipcCall);
+  const bashApprovalHost = createIpcBashApprovalHost(ipcCall, {
+    agentId: input.agent.agent.id,
+    teamId: input.agent.team.id,
+    turnId: input.turnId,
+    mode: "auto_deny"
+  });
+  const handle = await createProtectedBazilionSession({
+    agent: input.agent,
+    runtime: input.runtime,
+    paths: input.paths,
+    scratch: input.scratch,
+    docker: input.docker,
     memory,
-    enabledProviders: new Set(enabledProviders),
     messagingHost,
     userMdHost,
-    apiKey,
-    refreshApiKey,
-    browserHost,
-    mcpHost,
-    mcpTools,
     bashApprovalHost,
-    // deliver_file emits a `file` event straight onto our stdout frame stream.
-    fileSink: (f) => emit({ kind: "event", event: { type: "file", ...f } }),
-    ...mode === "review" && reviewSessionDir ? {
-      restricted: {
-        systemPrompt: REVIEW_SYSTEM_PROMPT,
-        tools: reviewTools,
-        sessionDir: reviewSessionDir,
-        reasoningLevel: agent.agent.reviewReasoningLevel
-      }
-    } : {}
+    refreshApiKey,
+    fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
   });
-  abortSession = () => {
-    void session.abort();
+  return { handle };
+}
+async function main() {
+  let aborted = false;
+  let session = null;
+  const onSignal = () => {
+    aborted = true;
+    if (session) void session.abort();
+    else {
+      try {
+        emit({ kind: "event", event: { type: "error", error: "cancelled" } });
+      } catch {
+      }
+      process.exit(0);
+    }
   };
-  let reviewValidationFailures = 0;
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+  const input = await readInput();
+  if (input.kind !== "configured_operator_http") {
+    validateMinimalWorkerProcessEnv(process.env, input.scratch);
+  }
+  const initialAccessTokens = input.kind === "configured_operator_http" ? input.apiKey ? [input.apiKey] : [] : protectedRuntimeSecrets(input.runtime);
+  activeAccessTokens.push(...initialAccessTokens.filter(Boolean));
+  const ipcCall = createWorkerIpcCall();
+  const { handle, reviewState } = await createSessionForInput(input, ipcCall);
+  session = handle.session;
   const unsubscribe = session.subscribe((piEvent) => {
-    if (mode === "review" && piEvent.type === "tool_execution_end" && piEvent.toolName === "propose_lesson" && piEvent.isError) {
-      reviewValidationFailures += 1;
-      if (reviewValidationFailures >= 2) void session.abort();
-    }
-    for (const ev of translatePiEvent(piEvent)) {
-      emit({ kind: "event", event: ev });
+    if (reviewState && piEvent.type === "tool_execution_end" && piEvent.toolName === "propose_lesson" && piEvent.isError) {
+      reviewState.recordValidationFailure();
+      if (reviewState.validationFailures() >= 2) void session?.abort();
     }
+    for (const event of translatePiEvent(piEvent)) emit({ kind: "event", event });
   });
   try {
-    const promptImages = (images ?? []).map((img) => ({
+    const promptMessage = redactJsonValue(input.message, activeAccessTokens);
+    const sanitizedImages = input.kind === "restricted_review" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
+    const promptImages = input.kind === "restricted_review" ? [] : sanitizedImages.map((image) => ({
       type: "image",
-      data: img.data,
-      mimeType: img.mimeType
+      data: image.data,
+      mimeType: image.mimeType
     }));
-    await session.prompt(message, promptImages.length > 0 ? { images: promptImages } : void 0);
+    await session.prompt(
+      promptMessage,
+      promptImages.length > 0 ? { images: promptImages } : void 0
+    );
     await session.agent.waitForIdle();
-    if (mode === "review" && reviewValidationFailures >= 2) {
-      throw new Error("review output remained invalid after one schema-repair attempt");
-    }
-    if (mode === "review" && !proposalBatchSubmitted) {
-      throw new Error("review output did not submit a proposal batch");
-    }
-    if (mode === "review") emit({ kind: "review_result", proposals });
-    else {
-      emit({
-        kind: "done",
-        messages: piMessagesToProviderView(session.agent.state.messages)
-      });
-    }
-  } catch (err) {
-    if (!aborted) {
-      emit({ kind: "event", event: { type: "error", error: err.message } });
+    if (reviewState) {
+      if (reviewState.validationFailures() >= 2) {
+        throw new Error("review output remained invalid after one schema-repair attempt");
+      }
+      if (!reviewState.submitted()) throw new Error("review output did not submit a proposal batch");
+      emit({ kind: "review_result", proposals: reviewState.proposals });
+    } else {
+      emit({ kind: "done", messages: piMessagesToProviderView(session.agent.state.messages) });
     }
-    emit({ kind: "fatal", error: err.message });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!aborted) emit({ kind: "event", event: { type: "error", error: message } });
+    emit({ kind: "fatal", error: message });
     process.exitCode = 1;
   } finally {
     unsubscribe();
     process.off("SIGTERM", onSignal);
     process.off("SIGINT", onSignal);
-    dispose();
-    if (reviewSessionDir) rmSync12(reviewSessionDir, { recursive: true, force: true });
+    handle.dispose();
     try {
       process.disconnect?.();
     } catch {
     }
   }
 }
-main().catch((err) => {
+main().catch((error) => {
   try {
-    emit({ kind: "fatal", error: err?.message ?? String(err) });
+    emit({ kind: "fatal", error: error instanceof Error ? error.message : String(error) });
   } catch {
   }
   process.exit(1);