bazilion 0.14.2 → 0.15.0

package/dist/worker.js

@@ -1136,7 +1136,7 @@ function translatePiEvent(e) {
             type: "tool_call",
             id: block.id,
             name: block.name,
-            arguments: JSON.stringify(block.arguments ?? {})
+            arguments: block.name === "ask_user" ? "{}" : JSON.stringify(block.arguments ?? {})
           });
         }
       }
@@ -1148,6 +1148,15 @@ function translatePiEvent(e) {
       return out;
     }
     case "tool_execution_end": {
+      if (e.toolName === "ask_user")
+        return [
+          {
+            type: "tool_result",
+            id: e.toolCallId,
+            name: e.toolName,
+            result: "Question outcome is available through the question card or authorized conversation history."
+          }
+        ];
       const text = extractToolResultText(e.result);
       if (e.isError) {
         return [{ type: "tool_error", id: e.toolCallId, name: e.toolName, error: text }];
@@ -1159,6 +1168,7 @@ function translatePiEvent(e) {
           id: e.toolCallId,
           name: e.toolName,
           result: text,
+          resultReference: extractResultReference(e.result),
           ...images.length > 0 ? { images } : {}
         }
       ];
@@ -1178,7 +1188,11 @@ function extractAssistantToolCalls(m) {
   const out = [];
   for (const block of m.content ?? []) {
     if (block.type === "toolCall") {
-      out.push({ id: block.id, name: block.name, arguments: JSON.stringify(block.arguments ?? {}) });
+      out.push({
+        id: block.id,
+        name: block.name,
+        arguments: block.name === "ask_user" ? "{}" : JSON.stringify(block.arguments ?? {})
+      });
     }
   }
   return out;
@@ -1215,7 +1229,7 @@ function stringifyContent(content) {
   }
   return out;
 }
-function piMessagesToProviderView(messages) {
+function piMessagesToProviderView(messages, questionResultVisible) {
   const out = [];
   for (const m of messages) {
     switch (m.role) {
@@ -1240,12 +1254,22 @@ function piMessagesToProviderView(messages) {
       }
       case "toolResult": {
         const tr = m;
+        if (tr.toolName === "ask_user" && !questionResultVisible?.(m)) {
+          out.push({
+            role: "tool",
+            toolCallId: tr.toolCallId,
+            toolName: "ask_user",
+            content: "Question content has not been released for this view."
+          });
+          break;
+        }
         const images = extractToolResultImages({ content: tr.content });
         out.push({
           role: "tool",
           content: stringifyContent(tr.content),
           toolCallId: tr.toolCallId,
           toolName: tr.toolName,
+          result: extractResultReference(m),
           ...images.length > 0 ? { images } : {}
         });
         break;
@@ -1256,14 +1280,58 @@ function piMessagesToProviderView(messages) {
   }
   return out;
 }
+function extractResultReference(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const details = value.details;
+  const id = details?.result?.resultId;
+  return typeof id === "string" && /^[a-f0-9-]{36}$/.test(id) ? { resultId: id } : void 0;
+}
+
+// ../daemon/src/lib/result-source.ts
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, openSync as openSync2, readSync, realpathSync as realpathSync2 } from "fs";
+import { basename as basename2, join as join13 } from "path";
+function readCanonicalSessionFile(directory, filename, sessionId, minimumEntryOffset = 0) {
+  if (basename2(filename) !== filename) throw new Error("Invalid session filename");
+  if (realpathSync2(directory) !== directory) throw new Error("Result session escaped its owner");
+  const fd = openSync2(
+    join13(directory, filename),
+    constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK
+  );
+  try {
+    const stat2 = fstatSync2(fd);
+    if (!stat2.isFile() || stat2.size > 64 * 1024 * 1024)
+      throw new Error("Result source session is unavailable or too large");
+    const buffer = Buffer.alloc(stat2.size + 1);
+    let count = 0;
+    while (count < buffer.length) {
+      const n = readSync(fd, buffer, count, buffer.length - count, null);
+      if (n === 0) break;
+      count += n;
+    }
+    if (count !== stat2.size) throw new Error("Result source session changed while reading");
+    const entries = [];
+    let position = 0;
+    for (const line of buffer.subarray(0, count).toString("utf8").split("\n")) {
+      if (line.trim()) entries.push({ entry: JSON.parse(line), offset: position });
+      position += Buffer.byteLength(line) + 1;
+    }
+    const header = entries[0]?.entry;
+    if (header?.type !== "session" || header.id !== sessionId)
+      throw new Error("Result source session does not match the active Agent session");
+    return entries.filter((row, index) => index === 0 || row.offset >= minimumEntryOffset).map((row) => row.entry);
+  } finally {
+    closeSync2(fd);
+  }
+}
 
 // ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename3, join as join19 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename4, join as join20 } from "path";
 import {
   createAssistantMessageEventStream
 } from "@earendil-works/pi-ai";
 import {
+  buildSessionContext,
   createAgentSession,
   DefaultResourceLoader,
   SessionManager,
@@ -1523,18 +1591,18 @@ import {
 
 // ../daemon/src/runtime/session/prompt.ts
 import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // ../daemon/src/runtime/safe-files.ts
 import {
-  closeSync as closeSync2,
-  constants as constants2,
-  fstatSync as fstatSync2,
+  closeSync as closeSync3,
+  constants as constants3,
+  fstatSync as fstatSync3,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync5,
-  openSync as openSync2,
+  openSync as openSync3,
   readFileSync as readFileSync9,
-  realpathSync as realpathSync2
+  realpathSync as realpathSync3
 } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "path";
 function resolveRealDirectory(path) {
@@ -1543,7 +1611,7 @@ function resolveRealDirectory(path) {
   if (entry.isSymbolicLink() || !entry.isDirectory()) {
     throw new Error("expected a real directory");
   }
-  return realpathSync2(requested);
+  return realpathSync3(requested);
 }
 function readRegularFileNoFollow(path) {
   const entry = lstatSync2(path);
@@ -1551,15 +1619,15 @@ function readRegularFileNoFollow(path) {
   if (!entry.isFile()) throw new Error("target is not a regular file");
   let fd;
   try {
-    fd = openSync2(path, constants2.O_RDONLY | noFollowFlag());
-    if (!fstatSync2(fd).isFile()) throw new Error("target is not a regular file");
+    fd = openSync3(path, constants3.O_RDONLY | noFollowFlag());
+    if (!fstatSync3(fd).isFile()) throw new Error("target is not a regular file");
     return readFileSync9(fd, "utf8");
   } finally {
-    if (fd !== void 0) closeSync2(fd);
+    if (fd !== void 0) closeSync3(fd);
   }
 }
 function noFollowFlag() {
-  return typeof constants2.O_NOFOLLOW === "number" ? constants2.O_NOFOLLOW : 0;
+  return typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
 }
 
 // ../daemon/src/runtime/session/prompt.ts
@@ -1570,9 +1638,9 @@ function loadPromptSkills(skillsDir, attachedNames) {
   const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
   const loaded = [];
   for (const entry of discovered) {
-    const hostDir = join13(skillsDir, entry.name);
+    const hostDir = join14(skillsDir, entry.name);
     try {
-      const parsed = parseSkillContent(readRegularFileNoFollow(join13(hostDir, "SKILL.md")));
+      const parsed = parseSkillContent(readRegularFileNoFollow(join14(hostDir, "SKILL.md")));
       const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
       loaded.push({
         name: entry.name,
@@ -1591,7 +1659,7 @@ function loadProtectedHomeDocuments(agentDir) {
   const root = resolveRealDirectory(agentDir);
   const read = (file) => {
     try {
-      return readRegularFileNoFollow(join13(root, file));
+      return readRegularFileNoFollow(join14(root, file));
     } catch (error) {
       if (error.code === "ENOENT") return null;
       throw new Error(`private Agent home is unsafe at ${file}`);
@@ -1733,8 +1801,8 @@ function boundReviewedLessons(lessons, maxCharacters = 8e3) {
 }
 
 // ../daemon/src/runtime/shell/tooling.ts
-import { existsSync as existsSync11, lstatSync as lstatSync3, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join15, relative as relative4, sep as sep4 } from "path";
+import { existsSync as existsSync11, lstatSync as lstatSync3, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join16, relative as relative4, sep as sep4 } from "path";
 import {
   createBashToolDefinition,
   createLocalBashOperations,
@@ -2122,10 +2190,10 @@ function createApprovalGatedBashTool(base, host) {
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
 import { randomUUID as randomUUID18 } from "crypto";
-import { closeSync as closeSync3, constants as constants3, mkdtempSync as mkdtempSync2, openSync as openSync3, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { closeSync as closeSync4, constants as constants4, mkdtempSync as mkdtempSync2, openSync as openSync4, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
 import { access, lstat, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { delimiter, isAbsolute as isAbsolute3, join as join14, relative as relative3, sep as sep3 } from "path";
+import { delimiter, isAbsolute as isAbsolute3, join as join15, relative as relative3, sep as sep3 } from "path";
 var CONTAINER_WORKDIR = "/workspace";
 var MAX_TIMEOUT_MS = 2147483647;
 var MAX_STDERR_CHARS = 16 * 1024;
@@ -2314,7 +2382,7 @@ async function resolveRequiredRoot(root) {
 }
 async function inspectDockerExecutableIdentity(dockerPath) {
   try {
-    await access(dockerPath, constants3.X_OK);
+    await access(dockerPath, constants4.X_OK);
     const info = await stat(dockerPath, { bigint: true });
     if (!info.isFile()) throw new Error("not a regular file");
     return {
@@ -2349,7 +2417,7 @@ async function assertLocalDockerSocket(endpoint) {
   try {
     const info = await stat(socketPath);
     if (!info.isSocket()) throw new Error("not a Unix socket");
-    await access(socketPath, constants3.R_OK | constants3.W_OK);
+    await access(socketPath, constants4.R_OK | constants4.W_OK);
   } catch {
     throw new Error("Docker sandbox local Unix socket is unavailable");
   }
@@ -2454,7 +2522,7 @@ function executeDockerRun(spec, options) {
       windowsHide: true,
       env: spec.processEnv
     });
-    if (envFileFd !== void 0) closeSync3(envFileFd);
+    if (envFileFd !== void 0) closeSync4(envFileFd);
     let settled = false;
     let termination;
     let timeoutHandle;
@@ -2510,16 +2578,16 @@ function executeDockerRun(spec, options) {
   });
 }
 function openAnonymousEnvFile(content) {
-  const dir = mkdtempSync2(join14(tmpdir2(), "bazilion-docker-env-"));
-  const path = join14(dir, "environment");
+  const dir = mkdtempSync2(join15(tmpdir2(), "bazilion-docker-env-"));
+  const path = join15(dir, "environment");
   let fd;
   try {
     writeFileSync7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
-    fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    fd = openSync4(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
     rmSync10(dir, { recursive: true, force: true });
     return fd;
   } catch (error) {
-    if (fd !== void 0) closeSync3(fd);
+    if (fd !== void 0) closeSync4(fd);
     rmSync10(dir, { recursive: true, force: true });
     throw error;
   }
@@ -2537,7 +2605,7 @@ function resolveTimeoutMs(timeout) {
 }
 async function resolveMountSource(cwd) {
   try {
-    await access(cwd, constants3.F_OK);
+    await access(cwd, constants4.F_OK);
     const info = await stat(cwd);
     if (!info.isDirectory()) {
       throw new Error(`Docker sandbox mount is not a directory: ${cwd}`);
@@ -2894,7 +2962,7 @@ function createSessionShellTools(cwd, env, options = {}) {
     image: config.sandboxImage,
     env: buildSandboxContainerEnv(env, config.envAllowlist),
     readOnlyMounts: [
-      ...existsSync11(join15(cwd, "memory")) ? [safeReadOnlyMount(join15(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
+      ...existsSync11(join16(cwd, "memory")) ? [safeReadOnlyMount(join16(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
       ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname4(options.inputsDir))] : [],
       ...(options.skillMounts ?? []).map(
         (mount) => safeReadOnlyMount(mount.source, mount.target, dirname4(mount.source))
@@ -2915,8 +2983,8 @@ function safeReadOnlyMount(source, target, expectedRoot) {
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
   }
-  const sourceRoot = realpathSync3(expectedRoot);
-  const canonicalSource = realpathSync3(source);
+  const sourceRoot = realpathSync4(expectedRoot);
+  const canonicalSource = realpathSync4(source);
   const rel = relative4(sourceRoot, canonicalSource);
   const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
   if (!contained) {
@@ -2927,18 +2995,18 @@ function safeReadOnlyMount(source, target, expectedRoot) {
 
 // ../daemon/src/runtime/worker/runtime.ts
 import {
-  constants as constants4,
+  constants as constants5,
   existsSync as existsSync12,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync3,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync5,
   rmSync as rmSync11,
   statSync as statSync3
 } from "fs";
 import { access as access2 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { isAbsolute as isAbsolute5, join as join16, relative as relative5, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute5, join as join17, relative as relative5, sep as sep5 } from "path";
 var REDACTED_VALUE = "[REDACTED]";
 var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "off",
@@ -2949,6 +3017,8 @@ var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "xhigh"
 ]);
 var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
+  "questionEnabled",
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2962,6 +3032,7 @@ var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2971,6 +3042,8 @@ var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var PROTECTED_KEYS = /* @__PURE__ */ new Set([
+  "questionEnabled",
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2984,7 +3057,9 @@ var PROTECTED_KEYS = /* @__PURE__ */ new Set([
   "apiKeyRefreshEnabled",
   "scratch"
 ]);
-var PROTECTED_REQUIRED_KEYS = new Set([...PROTECTED_KEYS].filter((key) => key !== "images"));
+var PROTECTED_REQUIRED_KEYS = new Set(
+  [...PROTECTED_KEYS].filter((key) => key !== "images" && key !== "questionEnabled")
+);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -3044,6 +3119,8 @@ function validateMinimalWorkerProcessEnv(env, scratch, platform = process.platfo
 function parseWorkerInput(value) {
   const input = objectRecord(value, "worker input");
   const kind = input.kind;
+  if (input.questionEnabled !== void 0 && typeof input.questionEnabled !== "boolean")
+    throw new Error("Invalid worker question capability");
   if (kind === "configured_operator_http") {
     assertExactKeys(input, CONFIGURED_KEYS, "configured worker input", CONFIGURED_REQUIRED_KEYS);
     if (!isResolvedAgent(input.agent)) throw new Error("worker: configured input requires an agent");
@@ -3052,6 +3129,7 @@ function parseWorkerInput(value) {
       throw new Error("worker: configured input requires enabledProviders");
     }
     requireString(input.turnId, "turnId");
+    assertConversationTarget(input.conversation);
     if (input.bashApprovalMode !== "interactive" && input.bashApprovalMode !== "auto_deny") {
       throw new Error("worker: configured input requires a valid bashApprovalMode");
     }
@@ -3073,6 +3151,7 @@ function parseWorkerInput(value) {
     if (!isResolvedAgent(input.agent)) throw new Error("worker: protected input requires an agent");
     requireString(input.message, "message");
     requireString(input.turnId, "turnId");
+    assertConversationTarget(input.conversation);
     if (input.bashApprovalMode !== "auto_deny") {
       throw new Error("worker: protected input requires auto-deny shell approval");
     }
@@ -3469,7 +3548,7 @@ function requireCanonicalRealDirectory(value, name) {
     if (entry.isSymbolicLink() || !entry.isDirectory()) {
       throw new Error("unsafe entry");
     }
-    const canonical = realpathSync4(value);
+    const canonical = realpathSync5(value);
     if (canonical !== value) throw new Error("non-canonical entry");
     return canonical;
   } catch {
@@ -3480,7 +3559,7 @@ function resolveCanonicalDirectory(value, name) {
   try {
     const entry = statSync3(value);
     if (!entry.isDirectory()) throw new Error("not a directory");
-    return realpathSync4(value);
+    return realpathSync5(value);
   } catch {
     throw new Error(`worker: ${name} is unavailable or unsafe`);
   }
@@ -3516,13 +3595,13 @@ function requireCanonicalWindowsDirectory(value, name) {
   if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} directory`);
   }
-  return realpathSync4(value);
+  return realpathSync5(value);
 }
 function requireCanonicalWindowsFile(value, name) {
   if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isFile()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} executable`);
   }
-  return realpathSync4(value);
+  return realpathSync5(value);
 }
 function objectRecord(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -3565,13 +3644,61 @@ function lexicallyWithin(root, candidate) {
   const rel = relative5(root, candidate);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
 }
+function assertConversationTarget(value) {
+  const target = objectRecord(value, "conversation target");
+  assertExactKeys(target, /* @__PURE__ */ new Set(["id", "filename"]), "conversation target");
+  if (typeof target.id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(target.id) || target.filename !== `${target.id}.jsonl`)
+    throw new Error("Invalid worker conversation target");
+}
+
+// ../daemon/src/runtime/tools/ask-user.ts
+function askUserTool(ask) {
+  return {
+    def: {
+      name: "ask_user",
+      description: "Ask the operator one clarification question and wait for an explicit choice, free-text answer, Skip, or a typed no-answer outcome. An answer is information only: it never grants shell or communication permission. Do not ask for credentials. Do not invent a response when no answer is returned.",
+      parameters: {
+        type: "object",
+        additionalProperties: false,
+        required: ["prompt", "choices"],
+        properties: {
+          prompt: { type: "string", minLength: 1, maxLength: 4096 },
+          choices: {
+            type: "array",
+            minItems: 2,
+            maxItems: 4,
+            items: {
+              type: "object",
+              additionalProperties: false,
+              required: ["label"],
+              properties: {
+                label: { type: "string", minLength: 1, maxLength: 120 },
+                description: { type: "string", minLength: 1, maxLength: 500 }
+              }
+            }
+          },
+          recommendedIndex: { type: "integer", minimum: 0, maximum: 3 }
+        }
+      }
+    },
+    async invoke(args, context) {
+      if (!context?.toolCallId) throw new Error("Question requires its actual tool call identity");
+      const { receipt, ...result } = await ask(
+        context.toolCallId,
+        args
+      );
+      const text = JSON.stringify(result);
+      return receipt ? { content: [{ type: "text", text }], questionReceipt: receipt } : text;
+    }
+  };
+}
 
 // ../daemon/src/runtime/pi/tools.ts
 import { Type as Type2 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
 import { existsSync as existsSync13, rmSync as rmSync12 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -3580,7 +3707,7 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join17(agentDir, "BOOTSTRAP.md");
+      const path = join18(agentDir, "BOOTSTRAP.md");
       if (existsSync13(path)) {
         rmSync12(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
@@ -3721,15 +3848,15 @@ function browserTools(host, agentId) {
 
 // ../daemon/src/runtime/tools/deliver-file.ts
 import {
-  closeSync as closeSync4,
-  constants as constants5,
-  fstatSync as fstatSync3,
-  openSync as openSync4,
-  readFileSync as readFileSync10,
-  realpathSync as realpathSync5,
+  closeSync as closeSync5,
+  constants as constants6,
+  fstatSync as fstatSync4,
+  openSync as openSync5,
+  readSync as readSync2,
+  realpathSync as realpathSync6,
   statSync as statSync4
 } from "fs";
-import { basename as basename2, extname, isAbsolute as isAbsolute6, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
+import { basename as basename3, extname, isAbsolute as isAbsolute6, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -3749,17 +3876,17 @@ function isWithin2(root, candidate) {
   const rel = relative6(root, candidate);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute6(rel);
 }
-function deliverFileTool(cwd, sink) {
+function deliverFileTool(cwd, sink, sessionId = "") {
   const workspacePath = resolve5(cwd);
   let workspaceRealPath = null;
   try {
-    workspaceRealPath = realpathSync5(workspacePath);
+    workspaceRealPath = realpathSync6(workspacePath);
   } catch {
   }
   return {
     def: {
       name: "deliver_file",
-      description: "Send a file from your workspace to the user so they can download it (web), receive it as a document (Telegram), or save it (CLI). Use this to deliver reports, exports, or any artifact you produced. Max 25 MB.",
+      description: "Send a file from your workspace to the user so they can download it (web), receive it as a document (Telegram), or save it (CLI). Use this to deliver reports, exports, or any artifact you produced. Max 25 MiB. Saved delivery remains subject to Team Policy.",
       parameters: {
         type: "object",
         properties: {
@@ -3772,7 +3899,7 @@ function deliverFileTool(cwd, sink) {
         additionalProperties: false
       }
     },
-    async invoke(args) {
+    async invoke(args, context) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
       if (isAbsolute6(p)) {
@@ -3788,7 +3915,7 @@ function deliverFileTool(cwd, sink) {
       let real;
       let expected;
       try {
-        real = realpathSync5(abs);
+        real = realpathSync6(abs);
         expected = statSync4(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
@@ -3798,13 +3925,13 @@ function deliverFileTool(cwd, sink) {
       }
       let fd;
       try {
-        fd = openSync4(real, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
+        fd = openSync5(real, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
       let data;
       try {
-        const stat2 = fstatSync3(fd);
+        const stat2 = fstatSync4(fd);
         if (!stat2.isFile()) {
           throw new Error(`deliver_file: not a regular file: ${p}`);
         }
@@ -3813,7 +3940,7 @@ function deliverFileTool(cwd, sink) {
         }
         let confirmedReal;
         try {
-          confirmedReal = realpathSync5(abs);
+          confirmedReal = realpathSync6(abs);
         } catch {
           throw new Error(`deliver_file: path changed during validation: ${p}`);
         }
@@ -3822,32 +3949,53 @@ function deliverFileTool(cwd, sink) {
         }
         if (stat2.size > MAX_DELIVER_BYTES) {
           throw new Error(
-            `deliver_file: "${basename2(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
+            `deliver_file: "${basename3(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
           );
         }
-        data = readFileSync10(fd).toString("base64");
+        const buffer = Buffer.alloc(MAX_DELIVER_BYTES + 1);
+        let length = 0;
+        while (length < buffer.length) {
+          const count = readSync2(fd, buffer, length, buffer.length - length, null);
+          if (count === 0) break;
+          length += count;
+        }
+        if (length > MAX_DELIVER_BYTES) throw new Error("deliver_file: file exceeds 25 MiB");
+        data = buffer.subarray(0, length).toString("base64");
       } finally {
-        closeSync4(fd);
+        closeSync5(fd);
       }
-      const name = basename2(abs);
+      const name = basename3(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
-      sink({ name, mimeType, data });
-      return `Delivered "${name}" (${mimeType}) to the user.`;
+      if (!context?.toolCallId || !sessionId)
+        throw new Error("deliver_file: missing source operation");
+      const result = await sink(
+        { name, mimeType, data },
+        { sessionId, toolCallId: context.toolCallId }
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Saved "${name}" (${mimeType}) as result ${result.resultId}. Delivery is subject to Team Policy.`
+          }
+        ],
+        result
+      };
     }
   };
 }
 
 // ../daemon/src/runtime/tools/home.ts
 import {
-  closeSync as closeSync5,
-  constants as constants6,
-  fstatSync as fstatSync4,
+  closeSync as closeSync6,
+  constants as constants7,
+  fstatSync as fstatSync5,
   lstatSync as lstatSync5,
-  openSync as openSync5,
+  openSync as openSync6,
   readdirSync as readdirSync7,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
@@ -3912,18 +4060,18 @@ function homeTools(agentDir) {
         let fd;
         try {
           rejectExistingSymlinkOrNonFile(path);
-          fd = openSync5(
+          fd = openSync6(
             path,
-            constants6.O_WRONLY | constants6.O_CREAT | constants6.O_TRUNC | noFollowFlag(),
+            constants7.O_WRONLY | constants7.O_CREAT | constants7.O_TRUNC | noFollowFlag(),
             384
           );
-          if (!fstatSync4(fd).isFile()) throw new Error("target is not a regular file");
+          if (!fstatSync5(fd).isFile()) throw new Error("target is not a regular file");
           writeFileSync8(fd, content, "utf8");
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           throw new Error(`home_write: could not write ${file}: ${msg}`);
         } finally {
-          if (fd !== void 0) closeSync5(fd);
+          if (fd !== void 0) closeSync6(fd);
         }
         return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
       }
@@ -3968,7 +4116,7 @@ function resolvePrivateHomeRoot(agentDir) {
   }
 }
 function privateHomeFile(homeRoot, file) {
-  return join18(homeRoot, file);
+  return join19(homeRoot, file);
 }
 function rejectSymlinkOrNonFile(path) {
   const entry = lstatSync5(path);
@@ -4912,18 +5060,18 @@ function ourToolToPiTool(h) {
     label: h.def.name,
     description: h.def.description,
     parameters: Type2.Unsafe(h.def.parameters),
-    async execute(_toolCallId, params) {
-      const out = await h.invoke(params);
+    async execute(toolCallId, params) {
+      const out = await h.invoke(params, { toolCallId });
       return {
         content: toPiContent(out),
-        details: {}
+        details: typeof out === "object" && !Array.isArray(out) ? "result" in out ? { result: out.result } : { questionReceipt: out.questionReceipt } : {}
       };
     }
   };
 }
 function toPiContent(out) {
   if (typeof out === "string") return [{ type: "text", text: out }];
-  return out.map(
+  return (Array.isArray(out) ? out : out.content).map(
     (p) => p.type === "text" ? { type: "text", text: p.text } : { type: "image", data: p.data, mimeType: p.mimeType }
   );
 }
@@ -4947,8 +5095,9 @@ function createBazilionCustomTools(opts) {
     handlers.push(...mcpProxyTools(opts.mcpHost, opts.mcpTools));
   }
   if (opts.fileSink) {
-    handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink));
+    handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId));
   }
+  if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
 function createProtectedBazilionCustomTools(opts) {
@@ -4959,8 +5108,9 @@ function createProtectedBazilionCustomTools(opts) {
     protectedWebFetchTool(),
     ...messagingTools(opts.messagingHost, opts.agent.agent.id),
     ...userMdTools(opts.userMdHost, opts.agent.team.id),
-    deliverFileTool(opts.agent.team.path, opts.fileSink)
+    deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId)
   ];
+  if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
 
@@ -4984,6 +5134,7 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    askUser,
     bashApprovalHost,
     refreshApiKey,
     restricted
@@ -5005,7 +5156,7 @@ async function createBazilionSession(opts) {
   const cwd = agent.team.path;
   if (!existsSync14(cwd)) mkdirSync7(cwd, { recursive: true });
   const promptSkills = restricted ? [] : loadPromptSkills(paths.skillsDir, agent.skills);
-  const uploadsDir = join19(agent.agent.dir, "uploads");
+  const uploadsDir = join20(agent.agent.dir, "uploads");
   const shellTools = restricted ? null : createSessionShellTools(cwd, env, {
     ...existsSync14(uploadsDir) ? { inputsDir: uploadsDir } : {},
     skillMounts: promptSkills.map((skill) => ({
@@ -5014,9 +5165,9 @@ async function createBazilionSession(opts) {
     })),
     approvalHost: bashApprovalHost
   });
-  const sessionDir = restricted?.sessionDir ?? join19(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = restricted?.sessionDir ?? join20(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync7(sessionDir, { recursive: true });
-  const existing = restricted ? null : findMostRecent(sessionDir);
+  const existing = restricted ? null : explicitConversationFile(sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
   const settingsManager = SettingsManager.inMemory({
     compaction: { enabled: false },
@@ -5033,7 +5184,7 @@ async function createBazilionSession(opts) {
   });
   const resourceLoader = new DefaultResourceLoader({
     cwd,
-    agentDir: join19(paths.home, "pi"),
+    agentDir: join20(paths.home, "pi"),
     settingsManager,
     noExtensions: true,
     noSkills: true,
@@ -5052,13 +5203,15 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    askUser,
+    sessionId: sessionManager.getSessionId(),
     env
   });
   const customTools = shellTools?.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
   const allowedTools = [...shellTools?.hostToolNames ?? [], ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join19(paths.home, "pi"),
+    agentDir: join20(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(restricted?.reasoningLevel ?? agent.reasoningLevel),
     tools: allowedTools,
@@ -5115,7 +5268,7 @@ async function createProtectedBazilionSession(opts) {
     opts.bashApprovalHost
   );
   mkdirSync7(opts.paths.sessionDir, { recursive: true });
-  const existing = findMostRecent(opts.paths.sessionDir);
+  const existing = explicitConversationFile(opts.paths.sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, opts.paths.sessionDir, opts.paths.teamDir) : SessionManager.create(opts.paths.teamDir, opts.paths.sessionDir);
   const settingsManager = createInMemorySettingsManager();
   const bazilionPrompt = redactJsonValue(
@@ -5144,7 +5297,9 @@ async function createProtectedBazilionSession(opts) {
     memory: opts.memory,
     messagingHost: opts.messagingHost,
     userMdHost: opts.userMdHost,
-    fileSink: opts.fileSink
+    fileSink: opts.fileSink,
+    askUser: opts.askUser,
+    sessionId: sessionManager.getSessionId()
   });
   if (!shellTools.customBash) throw new Error("protected Docker bash tool is unavailable");
   const customTools = [...bazilionTools, shellTools.customBash];
@@ -5222,7 +5377,7 @@ async function createRestrictedReviewSession(opts) {
 function materializeProtectedCredentialFile(runtime, scratch) {
   const fields = [...runtime.credentialEnv ?? []];
   if (runtime.credentialFile) {
-    const path = join19(scratch.tempDir, "provider-credential.json");
+    const path = join20(scratch.tempDir, "provider-credential.json");
     writeFileSync9(path, runtime.credentialFile.content, {
       encoding: "utf8",
       mode: 384,
@@ -5357,19 +5512,12 @@ function toPiThinkingLevel(level) {
       return "medium";
   }
 }
-function findMostRecent(sessionDir) {
-  if (!existsSync14(sessionDir)) return null;
-  let newest = null;
-  for (const entry of readdirSync8(sessionDir)) {
-    if (!entry.endsWith(".jsonl")) continue;
-    const path = join19(sessionDir, entry);
-    try {
-      const s = statSync5(path);
-      if (!newest || s.mtimeMs > newest.mtimeMs) newest = { path, mtimeMs: s.mtimeMs };
-    } catch {
-    }
-  }
-  return newest?.path ?? null;
+function explicitConversationFile(directory, target) {
+  if (!target || !/^[0-9a-f-]{36}$/i.test(target.id) || target.filename !== `${target.id}.jsonl`)
+    throw new Error("Explicit conversation target is required");
+  const file = join20(directory, target.filename);
+  readCanonicalSessionFile(directory, target.filename, target.id);
+  return file;
 }
 
 // ../daemon/src/runtime/worker/api-key-refresh.ts
@@ -5602,6 +5750,7 @@ async function createSessionForInput(input, ipcCall) {
     }) : void 0;
     const handle2 = await createBazilionSession({
       agent: input.agent,
+      conversation: input.conversation,
       paths,
       env: process.env,
       memory: memory2,
@@ -5614,7 +5763,15 @@ async function createSessionForInput(input, ipcCall) {
       mcpHost,
       mcpTools: input.mcpTools,
       bashApprovalHost: bashApprovalHost2,
-      fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
+      askUser: input.questionEnabled ? (toolCallId, question) => ipcCall("askUser", { toolCallId, question }) : void 0,
+      fileSink: async (file, source) => {
+        const result = await ipcCall(
+          "publishResult",
+          { ...file, ...source }
+        );
+        emit({ kind: "event", event: { type: "file", ...file, result } });
+        return result;
+      }
     });
     return { handle: handle2 };
   }
@@ -5646,6 +5803,7 @@ async function createSessionForInput(input, ipcCall) {
   });
   const handle = await createProtectedBazilionSession({
     agent: input.agent,
+    conversation: input.conversation,
     runtime: input.runtime,
     paths: input.paths,
     scratch: input.scratch,
@@ -5654,8 +5812,16 @@ async function createSessionForInput(input, ipcCall) {
     messagingHost,
     userMdHost,
     bashApprovalHost,
+    askUser: input.questionEnabled ? (toolCallId, question) => ipcCall("askUser", { toolCallId, question }) : void 0,
     refreshApiKey,
-    fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
+    fileSink: async (file, source) => {
+      const result = await ipcCall("publishResult", {
+        ...file,
+        ...source
+      });
+      emit({ kind: "event", event: { type: "file", ...file, result } });
+      return result;
+    }
   });
   return { handle };
 }
@@ -5684,7 +5850,30 @@ async function main() {
   const ipcCall = createWorkerIpcCall();
   const { handle, reviewState } = await createSessionForInput(input, ipcCall);
   session = handle.session;
+  const consumptionAcks = /* @__PURE__ */ new Set();
   const unsubscribe = session.subscribe((piEvent) => {
+    if (input.kind !== "restricted_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
+      const message = piEvent.message;
+      const content = message.content[0];
+      if (content?.type === "text") {
+        try {
+          const result = JSON.parse(content.text);
+          if (typeof result.questionId === "string") {
+            const ack = new Promise((resolve6) => setImmediate(resolve6)).then(
+              () => ipcCall("questionConsumed", {
+                questionId: result.questionId,
+                toolCallId: message.toolCallId
+              })
+            ).catch(() => {
+            }).finally(() => {
+              consumptionAcks.delete(ack);
+            });
+            consumptionAcks.add(ack);
+          }
+        } catch {
+        }
+      }
+    }
     if (reviewState && piEvent.type === "tool_execution_end" && piEvent.toolName === "propose_lesson" && piEvent.isError) {
       reviewState.recordValidationFailure();
       if (reviewState.validationFailures() >= 2) void session?.abort();
@@ -5704,6 +5893,7 @@ async function main() {
       promptImages.length > 0 ? { images: promptImages } : void 0
     );
     await session.agent.waitForIdle();
+    await Promise.all(consumptionAcks);
     if (reviewState) {
       if (reviewState.validationFailures() >= 2) {
         throw new Error("review output remained invalid after one schema-repair attempt");