bazilion 0.14.2 → 0.16.0

package/dist/worker.js

@@ -2,7 +2,7 @@
 
 // ../daemon/src/runtime/worker/entry.ts
 import { randomUUID as randomUUID20 } from "crypto";
-import { Type as Type3 } from "typebox";
+import { Type as Type5 } from "typebox";
 
 // ../daemon/src/core/agent/delete.ts
 import { randomUUID } from "crypto";
@@ -1128,15 +1128,15 @@ function translatePiEvent(e) {
       const m = e.message;
       if (m.role !== "assistant") return [];
       const out = [];
-      const text = extractAssistantText(m);
-      if (text) out.push({ type: "assistant_message", text });
+      const text2 = extractAssistantText(m);
+      if (text2) out.push({ type: "assistant_message", text: text2 });
       for (const block of m.content ?? []) {
         if (block.type === "toolCall") {
           out.push({
             type: "tool_call",
             id: block.id,
             name: block.name,
-            arguments: JSON.stringify(block.arguments ?? {})
+            arguments: block.name === "ask_user" ? "{}" : JSON.stringify(block.arguments ?? {})
           });
         }
       }
@@ -1148,9 +1148,18 @@ function translatePiEvent(e) {
       return out;
     }
     case "tool_execution_end": {
-      const text = extractToolResultText(e.result);
+      if (e.toolName === "ask_user")
+        return [
+          {
+            type: "tool_result",
+            id: e.toolCallId,
+            name: e.toolName,
+            result: "Question outcome is available through the question card or authorized conversation history."
+          }
+        ];
+      const text2 = extractToolResultText(e.result);
       if (e.isError) {
-        return [{ type: "tool_error", id: e.toolCallId, name: e.toolName, error: text }];
+        return [{ type: "tool_error", id: e.toolCallId, name: e.toolName, error: text2 }];
       }
       const images = extractToolResultImages(e.result);
       return [
@@ -1158,7 +1167,8 @@ function translatePiEvent(e) {
           type: "tool_result",
           id: e.toolCallId,
           name: e.toolName,
-          result: text,
+          result: text2,
+          resultReference: extractResultReference(e.result),
           ...images.length > 0 ? { images } : {}
         }
       ];
@@ -1178,7 +1188,11 @@ function extractAssistantToolCalls(m) {
   const out = [];
   for (const block of m.content ?? []) {
     if (block.type === "toolCall") {
-      out.push({ id: block.id, name: block.name, arguments: JSON.stringify(block.arguments ?? {}) });
+      out.push({
+        id: block.id,
+        name: block.name,
+        arguments: block.name === "ask_user" ? "{}" : JSON.stringify(block.arguments ?? {})
+      });
     }
   }
   return out;
@@ -1215,7 +1229,7 @@ function stringifyContent(content) {
   }
   return out;
 }
-function piMessagesToProviderView(messages) {
+function piMessagesToProviderView(messages, questionResultVisible) {
   const out = [];
   for (const m of messages) {
     switch (m.role) {
@@ -1231,21 +1245,42 @@ function piMessagesToProviderView(messages) {
       }
       case "assistant": {
         const am = m;
-        const text = extractAssistantText(am);
+        const text2 = extractAssistantText(am);
         const toolCalls = extractAssistantToolCalls(am);
-        const msg = { role: "assistant", content: text };
+        const msg = { role: "assistant", content: text2 };
         if (toolCalls.length > 0) msg.toolCalls = toolCalls;
         out.push(msg);
         break;
       }
       case "toolResult": {
         const tr = m;
+        if (["repository_context", "coding_environment", "coding_command", "coding_receipt"].includes(
+          tr.toolName ?? ""
+        )) {
+          out.push({
+            role: "tool",
+            toolCallId: tr.toolCallId,
+            toolName: tr.toolName,
+            content: "Coding context or command evidence retained privately. Captured transport output follows its communication approval; ask the Agent for the relevant result."
+          });
+          break;
+        }
+        if (tr.toolName === "ask_user" && !questionResultVisible?.(m)) {
+          out.push({
+            role: "tool",
+            toolCallId: tr.toolCallId,
+            toolName: "ask_user",
+            content: "Question content has not been released for this view."
+          });
+          break;
+        }
         const images = extractToolResultImages({ content: tr.content });
         out.push({
           role: "tool",
           content: stringifyContent(tr.content),
           toolCallId: tr.toolCallId,
           toolName: tr.toolName,
+          result: extractResultReference(m),
           ...images.length > 0 ? { images } : {}
         });
         break;
@@ -1256,491 +1291,338 @@ function piMessagesToProviderView(messages) {
   }
   return out;
 }
+function extractResultReference(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const details = value.details;
+  const id = details?.result?.resultId;
+  return typeof id === "string" && /^[a-f0-9-]{36}$/.test(id) ? { resultId: id } : void 0;
+}
 
-// ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename3, join as join19 } from "path";
-import {
-  createAssistantMessageEventStream
-} from "@earendil-works/pi-ai";
+// ../daemon/src/lib/result-source.ts
+import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, openSync as openSync2, readSync, realpathSync as realpathSync2 } from "fs";
+import { basename as basename2, join as join13 } from "path";
+function readCanonicalSessionFile(directory, filename, sessionId, minimumEntryOffset = 0) {
+  if (basename2(filename) !== filename) throw new Error("Invalid session filename");
+  if (realpathSync2(directory) !== directory) throw new Error("Result session escaped its owner");
+  const fd = openSync2(
+    join13(directory, filename),
+    constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK
+  );
+  try {
+    const stat2 = fstatSync2(fd);
+    if (!stat2.isFile() || stat2.size > 64 * 1024 * 1024)
+      throw new Error("Result source session is unavailable or too large");
+    const buffer = Buffer.alloc(stat2.size + 1);
+    let count2 = 0;
+    while (count2 < buffer.length) {
+      const n = readSync(fd, buffer, count2, buffer.length - count2, null);
+      if (n === 0) break;
+      count2 += n;
+    }
+    if (count2 !== stat2.size) throw new Error("Result source session changed while reading");
+    const entries = [];
+    let position = 0;
+    for (const line of buffer.subarray(0, count2).toString("utf8").split("\n")) {
+      if (line.trim()) entries.push({ entry: JSON.parse(line), offset: position });
+      position += Buffer.byteLength(line) + 1;
+    }
+    const header = entries[0]?.entry;
+    if (header?.type !== "session" || header.id !== sessionId)
+      throw new Error("Result source session does not match the active Agent session");
+    return entries.filter((row, index) => index === 0 || row.offset >= minimumEntryOffset).map((row) => row.entry);
+  } finally {
+    closeSync2(fd);
+  }
+}
+
+// ../daemon/src/runtime/pi/coding.ts
 import {
-  createAgentSession,
-  DefaultResourceLoader,
-  SessionManager,
-  SettingsManager
+  createLocalBashOperations
 } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
 
-// ../daemon/src/runtime/providers/pi-runtime.ts
-import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
-import { ModelRuntime } from "@earendil-works/pi-coding-agent";
-var PROVIDER_ALIASES = {
-  bedrock: "amazon-bedrock",
-  "azure-openai": "azure-openai-responses"
-};
-var PROTECTED_PROVIDER_NAMES = [
-  "anthropic",
-  "openai",
-  "openai-codex",
-  "google",
-  "google-vertex",
-  "azure-openai",
-  "bedrock",
-  "mistral",
-  "groq",
-  "cerebras",
-  "xai",
-  "zai",
-  "huggingface",
-  "openrouter",
-  "vercel-ai-gateway",
-  "deepseek",
-  "fireworks",
-  "together",
-  "baseten",
-  "moonshotai",
-  "moonshotai-cn",
-  "kimi-coding",
-  "minimax",
-  "minimax-cn",
-  "qwen-token-plan",
-  "qwen-token-plan-cn",
-  "qwen-token-plan-individual",
-  "xiaomi",
-  "xiaomi-token-plan-ams",
-  "xiaomi-token-plan-cn",
-  "xiaomi-token-plan-sgp",
-  "ant-ling",
-  "nvidia",
-  "opencode",
-  "opencode-go",
-  "zai-coding-cn",
-  "github-copilot",
-  "cloudflare-ai-gateway",
-  "cloudflare-workers-ai",
-  "lmstudio",
-  "ollama",
-  "llamacpp"
-];
-var LOCAL_PROVIDERS = {
-  lmstudio: {
-    baseUrl: "http://127.0.0.1:1234/v1",
-    apiKey: "lm-studio",
-    authHeader: false
-  },
-  ollama: { baseUrl: "http://127.0.0.1:11434/v1", apiKey: "ollama", authHeader: false },
-  llamacpp: { baseUrl: "http://127.0.0.1:8080/v1", apiKey: "no-key", authHeader: true }
-};
-var PROVIDER_API_KEY_ENV = {
-  anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
-  openai: ["OPENAI_API_KEY"],
-  google: ["GEMINI_API_KEY"],
-  "azure-openai": ["AZURE_OPENAI_API_KEY"],
-  mistral: ["MISTRAL_API_KEY"],
-  groq: ["GROQ_API_KEY"],
-  cerebras: ["CEREBRAS_API_KEY"],
-  xai: ["XAI_API_KEY"],
-  zai: ["ZAI_API_KEY"],
-  huggingface: ["HF_TOKEN"],
-  openrouter: ["OPENROUTER_API_KEY"],
-  "vercel-ai-gateway": ["AI_GATEWAY_API_KEY"],
-  deepseek: ["DEEPSEEK_API_KEY"],
-  fireworks: ["FIREWORKS_API_KEY"],
-  together: ["TOGETHER_API_KEY"],
-  baseten: ["BASETEN_API_KEY"],
-  moonshotai: ["MOONSHOT_API_KEY"],
-  "moonshotai-cn": ["MOONSHOT_CN_API_KEY"],
-  "kimi-coding": ["KIMI_API_KEY"],
-  minimax: ["MINIMAX_API_KEY"],
-  "minimax-cn": ["MINIMAX_CN_API_KEY"],
-  "qwen-token-plan": ["QWEN_TOKEN_PLAN_API_KEY"],
-  "qwen-token-plan-cn": ["QWEN_TOKEN_PLAN_CN_API_KEY"],
-  "qwen-token-plan-individual": ["QWEN_TOKEN_PLAN_API_KEY"],
-  xiaomi: ["XIAOMI_API_KEY"],
-  "xiaomi-token-plan-ams": ["XIAOMI_TOKEN_PLAN_AMS_API_KEY"],
-  "xiaomi-token-plan-cn": ["XIAOMI_TOKEN_PLAN_CN_API_KEY"],
-  "xiaomi-token-plan-sgp": ["XIAOMI_TOKEN_PLAN_SGP_API_KEY"],
-  "ant-ling": ["ANT_LING_API_KEY"],
-  nvidia: ["NVIDIA_API_KEY"],
-  opencode: ["OPENCODE_API_KEY"],
-  "opencode-go": ["OPENCODE_GO_API_KEY"],
-  "zai-coding-cn": ["ZAI_CODING_CN_API_KEY"],
-  "github-copilot": ["COPILOT_GITHUB_TOKEN"],
-  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY"],
-  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY"],
-  lmstudio: ["LMSTUDIO_API_KEY"],
-  ollama: ["OLLAMA_API_KEY"],
-  llamacpp: ["LLAMACPP_API_KEY"]
-};
-var PROVIDER_CREDENTIAL_ENV = {
-  bedrock: [
-    "AWS_PROFILE",
-    "AWS_BEARER_TOKEN_BEDROCK",
-    "AWS_ACCESS_KEY_ID",
-    "AWS_SECRET_ACCESS_KEY",
-    "AWS_SESSION_TOKEN",
-    "AWS_REGION",
-    "AWS_DEFAULT_REGION"
-  ],
-  "google-vertex": [
-    "GOOGLE_CLOUD_PROJECT",
-    "GOOGLE_CLOUD_LOCATION",
-    "GOOGLE_APPLICATION_CREDENTIALS"
-  ],
-  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_GATEWAY_ID"],
-  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID"]
+// ../daemon/src/core/coding-environment/config.ts
+var CodingEnvironmentValidationError = class extends Error {
+  status = 400;
 };
-function piProviderName(providerName) {
-  return PROVIDER_ALIASES[providerName] ?? providerName;
-}
-function providerApiKey(providerName, env) {
-  for (const name of PROVIDER_API_KEY_ENV[providerName] ?? []) {
-    const value = env[name];
-    if (value) return value;
-  }
-  return LOCAL_PROVIDERS[providerName]?.apiKey;
-}
-function providerBaseUrl(providerName, env) {
-  switch (providerName) {
-    case "lmstudio":
-      return env.LMSTUDIO_URL ?? LOCAL_PROVIDERS.lmstudio?.baseUrl;
-    case "ollama":
-      return env.OLLAMA_URL ?? LOCAL_PROVIDERS.ollama?.baseUrl;
-    case "llamacpp":
-      return env.LLAMACPP_URL ?? LOCAL_PROVIDERS.llamacpp?.baseUrl;
-    case "vercel-ai-gateway":
-      return env.AI_GATEWAY_BASE_URL;
-    default:
-      return void 0;
-  }
-}
-function providerCredentialEnv(providerName, env) {
-  const result = {};
-  for (const name of PROVIDER_CREDENTIAL_ENV[providerName] ?? []) {
-    const value = env[name];
-    if (value !== void 0) result[name] = value;
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-function fallbackApi(providerName) {
-  switch (providerName) {
-    case "anthropic":
-      return "anthropic-messages";
-    case "google":
-      return "google-generative-ai";
-    case "google-vertex":
-      return "google-vertex";
-    case "azure-openai":
-      return "azure-openai-responses";
-    case "bedrock":
-      return "bedrock-converse-stream";
-    case "openai-codex":
-      return "openai-codex-responses";
-    default:
-      return "openai-completions";
-  }
+function invalid(field) {
+  throw new CodingEnvironmentValidationError(`Invalid coding environment ${field}`);
+}
+function object(value, keys2, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) invalid(field);
+  const record = value;
+  if (Object.keys(record).some((key) => !keys2.includes(key))) invalid(field);
+  return record;
+}
+function text(value, max, field) {
+  if (typeof value !== "string" || !value.trim() || Buffer.byteLength(value) > max || Array.from(value).some((char) => {
+    const code = char.charCodeAt(0);
+    return code === 127 || code < 32 && code !== 9 && code !== 10;
+  }))
+    invalid(field);
+  return value;
 }
-function fallbackPiModel(providerName, modelId, baseUrl) {
+function codingRelativePath(value, field = "cwd") {
+  const path = text(value, 4096, field);
+  if (path === ".") return path;
+  const parts = path.split("/");
+  if (parts.length > 16 || path.includes("\\") || Array.from(path).some((char) => char.charCodeAt(0) < 32) || parts.some((part) => !part || part === "." || part === ".." || part === ".git"))
+    invalid(field);
+  return path;
+}
+function validateCodingCommand(input) {
+  const value = object(input, ["command", "cwd", "purpose", "timeoutSeconds"], "command");
+  const command = text(value.command, 4096, "command");
+  if (command.includes("\0")) invalid("command");
+  const cwd = codingRelativePath(value.cwd);
+  if (!["runtime", "dependency", "prepare", "build", "test"].includes(String(value.purpose)))
+    invalid("purpose");
+  if (!Number.isInteger(value.timeoutSeconds) || Number(value.timeoutSeconds) < 1 || Number(value.timeoutSeconds) > 300)
+    invalid("timeout");
   return {
-    id: modelId,
-    name: modelId,
-    api: fallbackApi(providerName),
-    provider: piProviderName(providerName),
-    baseUrl: baseUrl ?? "",
-    reasoning: false,
-    input: ["text"],
-    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    contextWindow: 32768,
-    maxTokens: 4096
+    command,
+    cwd,
+    purpose: value.purpose,
+    timeoutSeconds: value.timeoutSeconds
   };
 }
-async function createBazilionPiRuntime(options) {
-  const providerName = options.providerName;
-  const canonicalName = piProviderName(providerName);
-  const credentials = new InMemoryCredentialStore();
-  const apiKey = options.apiKey ?? providerApiKey(providerName, options.env);
-  const credentialEnv = providerCredentialEnv(providerName, options.env);
-  if (apiKey || credentialEnv) {
-    await credentials.modify(
-      canonicalName,
-      async () => canonicalName === "openai-codex" && apiKey ? {
-        type: "oauth",
-        access: apiKey,
-        // Bazilion owns refresh outside Pi. This deliberately empty value
-        // satisfies Pi's canonical OAuth shape but is never used because
-        // the token is long-lived only inside this one-shot runtime and
-        // mid-turn replacement is supplied through Agent.getApiKey.
-        refresh: "",
-        expires: Number.MAX_SAFE_INTEGER
-      } : {
-        type: "api_key",
-        ...apiKey ? { key: apiKey } : {},
-        ...credentialEnv ? { env: credentialEnv } : {}
+
+// ../daemon/src/lib/coding-environment/diagnostics.ts
+var CODING_OUTPUT_BYTES = 64 * 1024;
+function diagnosticTail(value, limit) {
+  const bytes = Buffer.from(value);
+  if (bytes.length <= limit) return { text: value, truncated: false };
+  let offset = bytes.length - limit;
+  while (offset < bytes.length && ((bytes[offset] ?? 0) & 192) === 128) offset++;
+  return { text: bytes.subarray(offset).toString("utf8"), truncated: true };
+}
+var CodingDiagnostics = class {
+  decoder = new TextDecoder();
+  secrets;
+  lookbehind;
+  pending = "";
+  text = "";
+  truncated = false;
+  finished = false;
+  constructor(secrets) {
+    this.secrets = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+    this.lookbehind = Math.max(1, ...this.secrets.map((secret) => secret.length)) - 1;
+  }
+  append(bytes) {
+    if (this.finished) throw new Error("Coding diagnostics already finalized");
+    for (let offset = 0; offset < bytes.length; offset += 8192) {
+      this.pending += this.decoder.decode(bytes.subarray(offset, offset + 8192), { stream: true });
+      this.flush(false);
+    }
+  }
+  finish() {
+    if (!this.finished) {
+      this.pending += this.decoder.decode();
+      this.flush(true);
+      this.finished = true;
+    }
+    return { diagnostic: this.text, truncated: this.truncated };
+  }
+  flush(final) {
+    let end = final ? this.pending.length : Math.max(0, this.pending.length - this.lookbehind);
+    const last = this.pending.charCodeAt(end - 1);
+    if (!final && last >= 55296 && last <= 56319) end--;
+    let offset = 0;
+    let safe = "";
+    while (offset < end) {
+      const secret = this.secrets.find((value) => this.pending.startsWith(value, offset));
+      if (secret) {
+        safe += "[redacted]";
+        offset += secret.length;
+      } else {
+        const code = this.pending.charCodeAt(offset);
+        const char = this.pending[offset] ?? "";
+        safe += code < 32 && code !== 9 && code !== 10 || code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : char;
+        offset++;
       }
+    }
+    this.pending = this.pending.slice(offset);
+    const tail = diagnosticTail(this.text + safe, CODING_OUTPUT_BYTES);
+    this.text = tail.text;
+    this.truncated ||= tail.truncated;
+  }
+};
+
+// ../daemon/src/runtime/coding-directory.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { join as join15 } from "path";
+
+// ../daemon/src/lib/repository-context/files.ts
+import { createHash as createHash6 } from "crypto";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  fstatSync as fstatSync3,
+  lstatSync as lstatSync2,
+  opendirSync,
+  openSync as openSync3,
+  readSync as readSync2,
+  realpathSync as realpathSync3
+} from "fs";
+import { isAbsolute as isAbsolute2, join as join14 } from "path";
+var hash = (value) => createHash6("sha256").update(value).digest("hex");
+var ContextReadError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+function identity(stat2) {
+  return `${stat2.dev}:${stat2.ino}`;
+}
+function stamp(stat2) {
+  return `${identity(stat2)}:${stat2.size}:${stat2.mtimeMs}:${stat2.ctimeMs}`;
+}
+function relativeParts(target) {
+  if (target.length > 4096 || isAbsolute2(target) || [...target].some(
+    (char) => char === "\\" || char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127
+  ) || target.split("/").some((part) => part === ".." || part === ".git"))
+    throw new ContextReadError("unsafe_target");
+  const parts = target.split("/").filter((part) => part && part !== ".");
+  if (parts.length > 17) throw new ContextReadError("depth_limit");
+  return parts;
+}
+var ContextDirectory = class _ContextDirectory {
+  fd;
+  identity;
+  originalStamp;
+  children = [];
+  listing;
+  observedFiles = /* @__PURE__ */ new Map();
+  registeredPath;
+  label;
+  parent;
+  constructor(registeredPath, label = ".", parent) {
+    this.registeredPath = registeredPath;
+    this.label = label;
+    this.parent = parent;
+    if (process.platform !== "linux") throw new ContextReadError("safe_reads_unavailable");
+    const path = parent ? join14(parent.path, registeredPath) : realpathSync3(registeredPath);
+    this.fd = openSync3(path, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW);
+    const stat2 = fstatSync3(this.fd);
+    this.identity = hash(identity(stat2));
+    this.originalStamp = identity(stat2);
+  }
+  get path() {
+    return `/proc/self/fd/${this.fd}`;
+  }
+  directory(name) {
+    const child = new _ContextDirectory(
+      name,
+      this.label === "." ? name : `${this.label}/${name}`,
+      this
     );
+    this.children.push(child);
+    return child;
   }
-  const runtime = await ModelRuntime.create({ credentials, modelsPath: null });
-  const local = LOCAL_PROVIDERS[providerName];
-  const baseUrl = options.baseUrl ?? providerBaseUrl(providerName, options.env);
-  if (local) {
-    const modelId = options.modelId ?? "model-name";
-    const model = fallbackPiModel(providerName, modelId, baseUrl ?? local.baseUrl);
-    runtime.registerProvider(canonicalName, {
-      baseUrl: baseUrl ?? local.baseUrl,
-      api: "openai-completions",
-      authHeader: local.authHeader,
-      apiKey: apiKey ?? local.apiKey,
-      models: [model]
-    });
-  } else if (baseUrl) {
-    runtime.registerProvider(canonicalName, { baseUrl });
-  }
-  return runtime;
-}
-async function createProtectedPiRuntime(options) {
-  const env = {};
-  for (const field of options.credentialEnv ?? []) env[field.name] = field.value;
-  return createBazilionPiRuntime({
-    providerName: options.providerName,
-    modelId: options.modelId,
-    env,
-    apiKey: options.apiKey,
-    baseUrl: options.baseUrl
-  });
-}
-function resolvePiModel(runtime, providerName, modelId, baseUrl) {
-  const known = runtime.getModel(piProviderName(providerName), modelId);
-  if (known) return baseUrl ? { ...known, baseUrl } : known;
-  return fallbackPiModel(providerName, modelId, baseUrl);
-}
-
-// ../daemon/src/runtime/auth/openai-codex.ts
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-
-// ../daemon/src/runtime/providers/pi-adapter.ts
-import {
-  Type
-} from "@earendil-works/pi-ai";
-
-// ../daemon/src/runtime/session/prompt.ts
-import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
-import { join as join13 } from "path";
-
-// ../daemon/src/runtime/safe-files.ts
-import {
-  closeSync as closeSync2,
-  constants as constants2,
-  fstatSync as fstatSync2,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync5,
-  openSync as openSync2,
-  readFileSync as readFileSync9,
-  realpathSync as realpathSync2
-} from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "path";
-function resolveRealDirectory(path) {
-  const requested = resolve4(path);
-  const entry = lstatSync2(requested);
-  if (entry.isSymbolicLink() || !entry.isDirectory()) {
-    throw new Error("expected a real directory");
+  entry(name) {
+    try {
+      return lstatSync2(join14(this.path, name));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new ContextReadError("unreadable");
+    }
   }
-  return realpathSync2(requested);
-}
-function readRegularFileNoFollow(path) {
-  const entry = lstatSync2(path);
-  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
-  if (!entry.isFile()) throw new Error("target is not a regular file");
-  let fd;
-  try {
-    fd = openSync2(path, constants2.O_RDONLY | noFollowFlag());
-    if (!fstatSync2(fd).isFile()) throw new Error("target is not a regular file");
-    return readFileSync9(fd, "utf8");
-  } finally {
-    if (fd !== void 0) closeSync2(fd);
+  list() {
+    const names = this.listNames();
+    this.listing = JSON.stringify(names);
+    return names;
   }
-}
-function noFollowFlag() {
-  return typeof constants2.O_NOFOLLOW === "number" ? constants2.O_NOFOLLOW : 0;
-}
-
-// ../daemon/src/runtime/session/prompt.ts
-var SANDBOX_SKILLS_DIR = "/skills";
-function loadPromptSkills(skillsDir, attachedNames) {
-  if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
-  const attached = new Set(attachedNames);
-  const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
-  const loaded = [];
-  for (const entry of discovered) {
-    const hostDir = join13(skillsDir, entry.name);
+  listNames() {
+    const handle = opendirSync(this.path);
+    const names = [];
     try {
-      const parsed = parseSkillContent(readRegularFileNoFollow(join13(hostDir, "SKILL.md")));
-      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
-      loaded.push({
-        name: entry.name,
-        description: parsed.frontmatter.description,
-        body: parsed.body.trim(),
-        hostDir,
-        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
-      });
-    } catch {
+      let entry = handle.readSync();
+      while (entry) {
+        if (names.length >= 16384) throw new ContextReadError("directory_entry_limit");
+        names.push(entry.name);
+        entry = handle.readSync();
+      }
+      return names.sort();
+    } finally {
+      handle.closeSync();
     }
   }
-  return loaded;
-}
-var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
-function loadProtectedHomeDocuments(agentDir) {
-  const root = resolveRealDirectory(agentDir);
-  const read = (file) => {
+  read(name, maxBytes) {
+    const entry = this.entry(name);
+    if (!entry) {
+      this.observedFiles.set(name, null);
+      return null;
+    }
+    if (!entry.isFile() || entry.isSymbolicLink()) throw new ContextReadError("unsafe_file");
+    if (entry.size > maxBytes) throw new ContextReadError("byte_limit");
+    let fd;
     try {
-      return readRegularFileNoFollow(join13(root, file));
+      fd = openSync3(
+        join14(this.path, name),
+        constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK
+      );
+      const before = fstatSync3(fd);
+      if (!before.isFile() || stamp(entry) !== stamp(before))
+        throw new ContextReadError("source_changed");
+      const buffer = Buffer.alloc(Math.min(maxBytes + 1, before.size + 1));
+      let size = 0;
+      while (size < buffer.length) {
+        const count2 = readSync2(fd, buffer, size, buffer.length - size, null);
+        if (!count2) break;
+        size += count2;
+      }
+      if (size > maxBytes || size !== before.size || stamp(fstatSync3(fd)) !== stamp(before)) {
+        throw new ContextReadError("source_changed");
+      }
+      this.observedFiles.set(name, stamp(before));
+      return buffer.subarray(0, size);
     } catch (error) {
-      if (error.code === "ENOENT") return null;
-      throw new Error(`private Agent home is unsafe at ${file}`);
+      if (error instanceof ContextReadError) throw error;
+      throw new ContextReadError("unreadable");
+    } finally {
+      if (fd !== void 0) closeSync3(fd);
     }
-  };
-  return {
-    "AGENTS.md": read("AGENTS.md"),
-    "SOUL.md": read("SOUL.md"),
-    "TOOLS.md": read("TOOLS.md"),
-    "IDENTITY.md": read("IDENTITY.md"),
-    "BOOTSTRAP.md": read("BOOTSTRAP.md")
-  };
-}
-function buildSystemPrompt(agent, options = {}) {
-  const parts = [];
-  const homeDocuments = options.homeDocuments ?? loadProtectedHomeDocuments(agent.agent.dir);
-  const contextBlocks = [];
-  for (const file of CONTEXT_FILE_ORDER) {
-    const content = homeDocuments[file]?.trimEnd();
-    if (!content) continue;
-    contextBlocks.push(`## ${file}
-
-${content}`);
-  }
-  if (contextBlocks.length > 0) {
-    parts.push(`# Project Context
-
-${contextBlocks.join("\n\n")}`);
-  }
-  const bootstrap = homeDocuments["BOOTSTRAP.md"]?.trimEnd();
-  if (bootstrap) {
-    parts.push(
-      [
-        "# First-Run Ritual",
-        "",
-        "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
-        "",
-        "## Hard rules",
-        "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
-        "- Each subsequent turn: at most one new question. Wait between turns.",
-        "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
-        "",
-        "## BOOTSTRAP.md",
-        "",
-        bootstrap
-      ].join("\n")
-    );
   }
-  parts.push(
-    [
-      "# Agent Home",
-      "",
-      "Your private home holds who you are \u2014 identity, soul, and behaviour rules. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
-      "",
-      "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
-      "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
-      "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
-      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
-    ].join("\n")
-  );
-  if (agent.skills.length > 0) {
-    const loaded = options.skills ?? [];
-    const loadedNames = new Set(loaded.map((skill) => skill.name));
-    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
-    const skillBlocks = loaded.map((skill) => {
-      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
-      return [
-        `## ${skill.name}`,
-        "",
-        skill.description,
-        "",
-        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
-        "",
-        skill.body
-      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
-    });
-    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
-    parts.push(
-      [
-        "# Available Skills",
-        "",
-        "Use these attached skill instructions when they are relevant to the task.",
-        "",
-        ...skillBlocks,
-        ...unavailableNote ? ["", unavailableNote] : []
-      ].join("\n")
-    );
+  validate(skipGit = false, names) {
+    const currentPath = this.parent ? join14(this.parent.path, this.registeredPath) : realpathSync3(this.registeredPath);
+    const stat2 = lstatSync2(currentPath);
+    if (!stat2.isDirectory() || identity(stat2) !== this.originalStamp)
+      throw new ContextReadError("root_changed");
+    if (this.listing !== void 0 && JSON.stringify(this.listNames()) !== this.listing) {
+      throw new ContextReadError("source_changed");
+    }
+    for (const [name, previous] of this.observedFiles) {
+      if (names && !names.has(name)) continue;
+      const current = this.entry(name);
+      if ((current ? stamp(current) : null) !== previous)
+        throw new ContextReadError("source_changed");
+    }
+    for (const child of this.children) {
+      if (!skipGit || !child.label.split("/").includes(".git")) child.validate(skipGit, names);
+    }
   }
-  const teamLines = [
-    "# Team",
-    "",
-    `- ${agent.team.id} (${agent.team.name}): ${options.sandboxMode === "docker" ? "/workspace" : agent.team.path}`,
-    "",
-    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
-  ];
-  parts.push(teamLines.join("\n"));
-  if (agent.team.userMd.trim()) {
-    parts.push(
-      `# About the User
-
-Shared context about the human you're working with in this team. Both you and the human curate it. To update: call \`user_md_get\` (returns current content + an etag), merge your change into the full text, then call \`user_md_write\` with the merged content and the etag. Use this for STABLE user-specific facts (preferences, role, working hours, how they like to be addressed) \u2014 and to CORRECT stale entries when the human tells you something different from what's recorded. For project knowledge use \`memory_write\` instead; for personal notes about yourself use \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**
-
-${agent.team.userMd.trim()}`
-    );
-  } else {
-    parts.push(
-      `# About the User
-
-This team's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**`
-    );
+  close() {
+    for (const child of this.children) child.close();
+    closeSync3(this.fd);
   }
-  const reviewedLessons = boundReviewedLessons(agent.privateLessons);
-  if (reviewedLessons.length > 0) {
-    parts.push(
-      `# Reviewed lessons
-
-These private lessons were explicitly approved by the human for your behavior. Follow them when relevant; current user instructions and higher-priority policy still win.
+};
 
-${reviewedLessons.map((lesson) => `- ${lesson}`).join("\n")}`
-    );
-  }
-  parts.push(
-    "# Memory\n\nYou share a persistent memory backend with every other agent in this team. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the team may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
-  );
-  return parts.join("\n\n---\n\n");
-}
-function boundReviewedLessons(lessons, maxCharacters = 8e3) {
-  const selected = [];
-  let used = 0;
-  for (const raw of lessons) {
-    const lesson = raw.trim();
-    if (!lesson) continue;
-    const remaining = maxCharacters - used;
-    if (remaining <= 0) break;
-    selected.push(lesson.slice(0, remaining));
-    used += Math.min(lesson.length, remaining);
+// ../daemon/src/runtime/coding-directory.ts
+function resolveCodingDirectory(root, cwd) {
+  const directory = new ContextDirectory(root);
+  try {
+    let current = directory;
+    for (const part of relativeParts(cwd)) current = current.directory(part);
+    const path = realpathSync4(join15(root, cwd));
+    directory.validate();
+    return { path, identity: current.identity };
+  } finally {
+    directory.close();
   }
-  return selected;
 }
 
-// ../daemon/src/runtime/shell/tooling.ts
-import { existsSync as existsSync11, lstatSync as lstatSync3, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join15, relative as relative4, sep as sep4 } from "path";
-import {
-  createBashToolDefinition,
-  createLocalBashOperations,
-  defineTool as defineTool2
-} from "@earendil-works/pi-coding-agent";
-
 // ../daemon/src/runtime/shell/approval.ts
 import { defineTool } from "@earendil-works/pi-coding-agent";
 
@@ -1836,8 +1718,8 @@ function classifyBroadFilesystemOperations(command, risks, seen) {
     if (match.index === void 0 || !match[1]) continue;
     const nameOffset = match[0].toLowerCase().indexOf(match[1].toLowerCase());
     const start = match.index + nameOffset;
-    const text = command.slice(start, match.index + match[0].length).trimEnd();
-    const tokens = shellTokens(text);
+    const text2 = command.slice(start, match.index + match[0].length).trimEnd();
+    const tokens = shellTokens(text2);
     const name = tokens[0]?.toLowerCase();
     const args = tokens.slice(1);
     let risky = false;
@@ -1860,7 +1742,7 @@ function classifyBroadFilesystemOperations(command, risks, seen) {
       code: "broad-destructive-operation",
       message: "Recursively changes or deletes a broad filesystem target.",
       start,
-      end: start + text.length
+      end: start + text2.length
     });
   }
 }
@@ -2076,12 +1958,12 @@ function assertEnvName(name) {
 }
 function buildScrubbedShellEnv(env, allowedKeys = []) {
   const scrubbed = {};
-  const keys = new Set(SAFE_SHELL_ENV_KEYS);
+  const keys2 = new Set(SAFE_SHELL_ENV_KEYS);
   for (const key of allowedKeys) {
     assertEnvName(key);
-    keys.add(key);
+    keys2.add(key);
   }
-  for (const key of keys) {
+  for (const key of keys2) {
     const value = env[key];
     if (value !== void 0) scrubbed[key] = value;
   }
@@ -2098,22 +1980,19 @@ var BashApprovalDeniedError = class extends Error {
     this.risks = risks;
   }
 };
+async function requireBashApproval(command, toolCallId, signal, host) {
+  const risks = classifyBashCommand(command);
+  if (!risks.length) return;
+  const decision = host ? await host.requestApproval({ toolCallId, command, risks, signal }) : "denied";
+  if (decision !== "approved") throw new BashApprovalDeniedError(risks);
+}
 function createApprovalGatedBashTool(base, host) {
   return defineTool({
     ...base,
     description: `${base.description} Commands classified as dangerous require operator approval before execution.`,
     executionMode: "sequential",
     async execute(toolCallId, params, signal, onUpdate, ctx) {
-      const risks = classifyBashCommand(params.command);
-      if (risks.length > 0) {
-        const decision = host ? await host.requestApproval({
-          toolCallId,
-          command: params.command,
-          risks,
-          signal
-        }) : "denied";
-        if (decision !== "approved") throw new BashApprovalDeniedError(risks);
-      }
+      await requireBashApproval(params.command, toolCallId, signal, host);
       return base.execute(toolCallId, params, signal, onUpdate, ctx);
     }
   });
@@ -2122,10 +2001,35 @@ function createApprovalGatedBashTool(base, host) {
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
 import { randomUUID as randomUUID18 } from "crypto";
-import { closeSync as closeSync3, constants as constants3, mkdtempSync as mkdtempSync2, openSync as openSync3, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { closeSync as closeSync4, constants as constants4, mkdtempSync as mkdtempSync2, openSync as openSync4, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
 import { access, lstat, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { delimiter, isAbsolute as isAbsolute3, join as join14, relative as relative3, sep as sep3 } from "path";
+import { delimiter, isAbsolute as isAbsolute3, join as join16, relative as relative2, sep as sep3 } from "path";
+
+// ../daemon/src/runtime/shell/coding.ts
+function validateDockerCodingSelection(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Invalid Docker coding selection");
+  const value = input;
+  if (Object.keys(value).some((key) => !["revision", "cwd", "env"].includes(key)) || !Number.isSafeInteger(value.revision) || value.revision < 0)
+    throw new Error("Invalid Docker coding revision");
+  const cwd = codingRelativePath(value.cwd);
+  if (!value.env || typeof value.env !== "object" || Array.isArray(value.env))
+    throw new Error("Invalid Docker coding environment");
+  const env = {};
+  for (const [key, entry] of Object.entries(value.env)) {
+    if (key === "CI" && (entry === "true" || entry === "false")) env.CI = entry;
+    else if (key === "NO_COLOR" && (entry === "0" || entry === "1")) env.NO_COLOR = entry;
+    else if (key === "TZ" && entry === "UTC") env.TZ = entry;
+    else throw new Error("Invalid Docker coding environment");
+  }
+  return { revision: value.revision, cwd, env };
+}
+function codingContainerCwd(cwd) {
+  return cwd === "." ? "/workspace" : `/workspace/${codingRelativePath(cwd)}`;
+}
+
+// ../daemon/src/runtime/shell/docker.ts
 var CONTAINER_WORKDIR = "/workspace";
 var MAX_TIMEOUT_MS = 2147483647;
 var MAX_STDERR_CHARS = 16 * 1024;
@@ -2133,6 +2037,7 @@ var CLEANUP_TIMEOUT_MS = 650;
 var CLEANUP_RETRY_DELAY_MS = 100;
 var CLEANUP_ATTEMPTS = 3;
 var DOCKER_CONTEXT_TIMEOUT_MS = 2e3;
+var DOCKER_CREATE_TIMEOUT_MS = 5e3;
 var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CONTAINER_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]+$/;
 var DOCKER_CLIENT_ENV_KEYS = [
@@ -2205,7 +2110,7 @@ function buildDockerRunSpec(input) {
     "--entrypoint",
     "/bin/bash",
     "--workdir",
-    CONTAINER_WORKDIR,
+    codingContainerCwd(input.codingCwd ?? "."),
     // A bind mount is read/write unless `readonly` is present. No other mount is added.
     "--mount",
     `type=bind,source=${input.mountSource},target=${CONTAINER_WORKDIR},bind-recursive=disabled`
@@ -2251,7 +2156,7 @@ function buildDockerRunSpec(input) {
 ` } : {}
   };
 }
-function createPreparedDockerBashOperations(runtime) {
+function createPreparedDockerBashOperations(runtime, lifecycle) {
   validatePreparedDockerRuntime(runtime);
   return {
     async exec(command, cwd, { onData, signal, timeout }) {
@@ -2268,9 +2173,10 @@ function createPreparedDockerBashOperations(runtime) {
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       await assertLocalDockerSocket(runtime.endpoint);
       const dockerClientEnv = { DOCKER_HOST: runtime.endpoint };
+      if (runtime.coding) resolveCodingDirectory(workspace.source, runtime.coding.cwd);
       const currentImageId = await inspectSandboxImage(
         runtime.dockerPath,
-        runtime.image,
+        runtime.coding ? runtime.imageId : runtime.image,
         dockerClientEnv
       );
       if (currentImageId !== runtime.imageId) {
@@ -2278,11 +2184,12 @@ function createPreparedDockerBashOperations(runtime) {
       }
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
+      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image: runtime.image,
         resolvedImage: runtime.imageId,
-        env: { ...runtime.containerEnv },
+        env: { ...runtime.containerEnv, ...runtime.coding?.env },
+        codingCwd: runtime.coding?.cwd,
         dockerPath: runtime.dockerPath,
         hostEnv: dockerClientEnv,
         command,
@@ -2292,29 +2199,129 @@ function createPreparedDockerBashOperations(runtime) {
         uid: runtime.uid,
         gid: runtime.gid
       });
-      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+      await lifecycle?.beforeCreate({
+        dockerPath: runtime.dockerPath,
+        executableIdentity: runtime.executableIdentity,
+        endpoint: runtime.endpoint,
+        containerName
+      });
+      try {
+        return await executeRegisteredDockerRun(
+          spec,
+          { onData, signal, timeout, timeoutMs },
+          lifecycle
+        );
+      } finally {
+        await lifecycle?.afterRemove(containerName);
+      }
     }
   };
 }
-async function recheckProtectedMount(mount) {
-  const sourceInfo = await lstat(mount.source);
-  if (sourceInfo.isSymbolicLink() || !sourceInfo.isDirectory()) {
-    throw new Error("Docker sandbox mount no longer matches preflight");
-  }
-  const sourceRoot = await resolveRequiredRoot(mount.sourceRoot);
-  const source = await resolveMountSource(mount.source);
-  if (sourceRoot !== mount.sourceRoot || source !== mount.source || !isWithin(sourceRoot, source)) {
-    throw new Error("Docker sandbox mount no longer matches preflight");
-  }
+function runProtectedContainerCreate(spec, options) {
+  if (options?.signal?.aborted) return Promise.reject(new Error("aborted"));
+  let envFileFd;
+  try {
+    if (spec.envFileContent !== void 0) {
+      envFileFd = openAnonymousEnvFile(spec.envFileContent);
+    }
+  } catch (error) {
+    return Promise.reject(
+      new Error(
+        `Docker sandbox could not prepare its preflight environment: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+  }
+  return new Promise((resolve6, reject) => {
+    let child;
+    try {
+      child = spawn(spec.executable, ["container", "create", ...spec.args.slice(1)], {
+        stdio: ["ignore", "ignore", "pipe", envFileFd ?? "ignore"],
+        windowsHide: true,
+        env: spec.processEnv
+      });
+    } catch (error) {
+      if (envFileFd !== void 0) closeSync4(envFileFd);
+      reject(error instanceof Error ? formatSpawnError(spec.executable, error) : error);
+      return;
+    }
+    if (envFileFd !== void 0) closeSync4(envFileFd);
+    let settled = false;
+    let stderr = "";
+    let timeoutHandle;
+    let killSettleHandle;
+    let termination;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      if (killSettleHandle) clearTimeout(killSettleHandle);
+      options?.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve6();
+    };
+    const commandTimeout = options?.timeoutMs !== void 0 && options.timeoutMs <= DOCKER_CREATE_TIMEOUT_MS;
+    const timeoutError = () => commandTimeout ? new Error(`timeout:${options?.timeout}`) : new Error(
+      `Docker sandbox could not create its protected preflight container within ${DOCKER_CREATE_TIMEOUT_MS}ms`
+    );
+    child.stderr?.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-MAX_STDERR_CHARS);
+    });
+    child.once("error", (error) => finish(formatSpawnError(spec.executable, error)));
+    child.once("close", (code) => {
+      if (termination) finish(termination);
+      else if (code === 0) finish();
+      else finish(formatDockerCreateError(spec, stderr, code));
+    });
+    const terminate = (error) => {
+      if (settled || termination) return;
+      termination = error;
+      child.kill("SIGKILL");
+      killSettleHandle = setTimeout(() => finish(error), CLEANUP_TIMEOUT_MS);
+    };
+    const onAbort = () => terminate(new Error("aborted"));
+    timeoutHandle = setTimeout(
+      () => terminate(timeoutError()),
+      Math.min(options?.timeoutMs ?? DOCKER_CREATE_TIMEOUT_MS, DOCKER_CREATE_TIMEOUT_MS)
+    );
+    options?.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options?.signal?.aborted) onAbort();
+  });
+}
+async function recheckProtectedMount(mount) {
+  const sourceInfo = await lstat(mount.source);
+  if (sourceInfo.isSymbolicLink() || !sourceInfo.isDirectory()) {
+    throw new Error("Docker sandbox mount no longer matches preflight");
+  }
+  const sourceRoot = await resolveRequiredRoot(mount.sourceRoot);
+  const source = await resolveMountSource(mount.source);
+  if (sourceRoot !== mount.sourceRoot || source !== mount.source || !isWithin(sourceRoot, source)) {
+    throw new Error("Docker sandbox mount no longer matches preflight");
+  }
   return { ...mount, source, sourceRoot };
 }
 async function resolveRequiredRoot(root) {
   if (!isAbsolute3(root)) throw new Error("Docker sandbox mount root must be absolute");
   return resolveMountSource(root);
 }
+async function resolveAbsoluteDockerPath(requested, hostEnv) {
+  validateDockerPath(requested);
+  const candidates = isAbsolute3(requested) ? [requested] : (hostEnv.PATH ?? "").split(delimiter).filter(Boolean).map((dir) => join16(dir, requested));
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants4.X_OK);
+      const info = await stat(candidate);
+      if (!info.isFile()) continue;
+      const canonical = await realpath(candidate);
+      if (!isAbsolute3(canonical)) continue;
+      return canonical;
+    } catch {
+    }
+  }
+  throw new Error(`Docker sandbox executable is unavailable: ${requested}`);
+}
 async function inspectDockerExecutableIdentity(dockerPath) {
   try {
-    await access(dockerPath, constants3.X_OK);
+    await access(dockerPath, constants4.X_OK);
     const info = await stat(dockerPath, { bigint: true });
     if (!info.isFile()) throw new Error("not a regular file");
     return {
@@ -2349,12 +2356,13 @@ async function assertLocalDockerSocket(endpoint) {
   try {
     const info = await stat(socketPath);
     if (!info.isSocket()) throw new Error("not a Unix socket");
-    await access(socketPath, constants3.R_OK | constants3.W_OK);
+    await access(socketPath, constants4.R_OK | constants4.W_OK);
   } catch {
     throw new Error("Docker sandbox local Unix socket is unavailable");
   }
 }
 function validatePreparedDockerRuntime(runtime) {
+  if (runtime.coding) validateDockerCodingSelection(runtime.coding);
   if (!isAbsolute3(runtime.dockerPath)) {
     throw new Error("protected Docker executable must be absolute");
   }
@@ -2372,17 +2380,17 @@ function validatePreparedDockerRuntime(runtime) {
     throw new Error("protected Docker container environment does not match policy");
   }
 }
-function validateDockerExecutableIdentity(identity) {
-  if (typeof identity !== "object" || identity === null) {
+function validateDockerExecutableIdentity(identity2) {
+  if (typeof identity2 !== "object" || identity2 === null) {
     throw new Error("protected Docker executable identity is invalid");
   }
   const fields = [
-    identity.device,
-    identity.inode,
-    identity.mode,
-    identity.size,
-    identity.modifiedTimeNs,
-    identity.changedTimeNs
+    identity2.device,
+    identity2.inode,
+    identity2.mode,
+    identity2.size,
+    identity2.modifiedTimeNs,
+    identity2.changedTimeNs
   ];
   if (fields.some((field) => typeof field !== "string" || !/^\d+$/.test(field))) {
     throw new Error("protected Docker executable identity is invalid");
@@ -2417,7 +2425,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
+      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -2431,10 +2439,44 @@ function createDockerBashOperations(options) {
         readOnlyMounts,
         hostEnv: dockerClientEnv
       });
-      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+      if (options.lifecycle) {
+        const absolute = await resolveAbsoluteDockerPath(dockerPath, hostEnv);
+        await options.lifecycle.beforeCreate({
+          dockerPath: absolute,
+          executableIdentity: await inspectDockerExecutableIdentity(absolute),
+          endpoint: dockerClientEnv.DOCKER_HOST,
+          containerName
+        });
+      }
+      try {
+        return await executeRegisteredDockerRun(
+          spec,
+          { onData, signal, timeout, timeoutMs },
+          options.lifecycle
+        );
+      } finally {
+        await options.lifecycle?.afterRemove(containerName);
+      }
     }
   };
 }
+async function executeRegisteredDockerRun(spec, options, lifecycle) {
+  if (!lifecycle) return executeDockerRun(spec, options);
+  const deadline = options.timeoutMs === void 0 ? void 0 : Date.now() + options.timeoutMs;
+  await runProtectedContainerCreate(spec, options);
+  await lifecycle.afterCreate(spec.containerName);
+  if (options.signal?.aborted) throw new Error("aborted");
+  const remaining = deadline === void 0 ? void 0 : deadline - Date.now();
+  if (remaining !== void 0 && remaining <= 0) throw new Error(`timeout:${options.timeout}`);
+  return executeDockerRun(
+    {
+      ...spec,
+      args: ["container", "start", "--attach", spec.containerName],
+      envFileContent: void 0
+    },
+    { ...options, timeoutMs: remaining }
+  );
+}
 function executeDockerRun(spec, options) {
   let envFileFd;
   try {
@@ -2454,7 +2496,7 @@ function executeDockerRun(spec, options) {
       windowsHide: true,
       env: spec.processEnv
     });
-    if (envFileFd !== void 0) closeSync3(envFileFd);
+    if (envFileFd !== void 0) closeSync4(envFileFd);
     let settled = false;
     let termination;
     let timeoutHandle;
@@ -2510,16 +2552,16 @@ function executeDockerRun(spec, options) {
   });
 }
 function openAnonymousEnvFile(content) {
-  const dir = mkdtempSync2(join14(tmpdir2(), "bazilion-docker-env-"));
-  const path = join14(dir, "environment");
+  const dir = mkdtempSync2(join16(tmpdir2(), "bazilion-docker-env-"));
+  const path = join16(dir, "environment");
   let fd;
   try {
     writeFileSync7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
-    fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    fd = openSync4(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
     rmSync10(dir, { recursive: true, force: true });
     return fd;
   } catch (error) {
-    if (fd !== void 0) closeSync3(fd);
+    if (fd !== void 0) closeSync4(fd);
     rmSync10(dir, { recursive: true, force: true });
     throw error;
   }
@@ -2537,7 +2579,7 @@ function resolveTimeoutMs(timeout) {
 }
 async function resolveMountSource(cwd) {
   try {
-    await access(cwd, constants3.F_OK);
+    await access(cwd, constants4.F_OK);
     const info = await stat(cwd);
     if (!info.isDirectory()) {
       throw new Error(`Docker sandbox mount is not a directory: ${cwd}`);
@@ -2762,7 +2804,7 @@ function validateReadOnlyMounts(mounts, workspaceSource) {
   }
 }
 function isWithin(root, candidate) {
-  const rel = relative3(root, candidate);
+  const rel = relative2(root, candidate);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute3(rel);
 }
 function validateHostIdentity(uid, gid) {
@@ -2770,91 +2812,865 @@ function validateHostIdentity(uid, gid) {
     throw new Error(`Docker sandbox received an invalid host uid/gid: ${uid}:${gid}`);
   }
 }
-function formatSpawnError(dockerPath, error) {
-  const code = error.code;
-  if (code === "ENOENT") {
-    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
-  }
-  if (code === "EACCES") {
-    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+function formatSpawnError(dockerPath, error) {
+  const code = error.code;
+  if (code === "ENOENT") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
+  }
+  if (code === "EACCES") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+  }
+  return new Error(`Docker sandbox could not start "${dockerPath}": ${error.message}`);
+}
+function formatDockerRunError(spec, stderr) {
+  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
+  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
+    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  }
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  }
+  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
+}
+function formatDockerCreateError(spec, stderr, exitCode) {
+  const detail3 = stderr.trim() || `Docker exited with ${exitCode === null ? "no status" : `status ${exitCode}`} without an error message`;
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox preflight mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox preflight could not reach the local Docker daemon: ${detail3}`);
+  }
+  return new Error(`Docker sandbox preflight could not create the required container: ${detail3}`);
+}
+async function removeContainer(dockerPath, containerName, processEnv) {
+  const args = ["container", "rm", "--force", containerName];
+  let last;
+  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
+    last = await runCleanupCommand(dockerPath, args, processEnv);
+    if (last.ok) return;
+    if (attempt < CLEANUP_ATTEMPTS - 1) {
+      await new Promise((resolve6) => setTimeout(resolve6, CLEANUP_RETRY_DELAY_MS));
+    }
+  }
+  if (last && !last.missing) {
+    console.warn(
+      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+    );
+  }
+}
+function runCleanupCommand(dockerPath, args, processEnv) {
+  return new Promise((resolve6) => {
+    let done = false;
+    let stderr = "";
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    const finish = (ok, error = "") => {
+      if (done) return;
+      done = true;
+      clearTimeout(timeoutHandle);
+      const detail3 = error || stderr.trim();
+      resolve6({
+        ok,
+        missing: /no such container/i.test(detail3),
+        error: detail3
+      });
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
+    }, CLEANUP_TIMEOUT_MS);
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
+    });
+    child.once("error", (error) => finish(false, error.message));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+
+// ../daemon/src/runtime/pi/coding.ts
+function codingTools(input) {
+  const hostOperations = input.docker ? null : createLocalBashOperations();
+  return [
+    {
+      name: "coding_environment",
+      label: "Inspect coding environment",
+      description: "Read the actual environment admitted to this turn for a Team-relative directory. No commands run. Discover prerequisites during the task; no Team checklist is required. Missing network/tooling is a specific blocker, never permission to change posture.",
+      parameters: Type.Object(
+        { target: Type.String({ default: ".", maxLength: 4096 }) },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const value = await input.host.invoke({
+          action: "environment",
+          target: params.target
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingEnvironment: value }
+        };
+      }
+    },
+    {
+      name: "coding_command",
+      label: "Run coding command",
+      description: "Execute an ad hoc finite runtime/dependency/preparation/build/test command in this turn\u2019s actual environment. Use discovered repository commands, not saved operator checks. Resolve prerequisites and use available offline artifacts within current authority. Share coding-receipt:<id> through send_message if a teammate needs evidence; never wait holding its workspace lease. Success is an observed exit, not proof about later code.",
+      parameters: Type.Object(
+        {
+          command: Type.String({ minLength: 1, maxLength: 4096 }),
+          cwd: Type.String({ maxLength: 4096 }),
+          purpose: Type.Union(
+            ["runtime", "dependency", "prepare", "build", "test"].map(
+              (value) => Type.Literal(value)
+            )
+          ),
+          timeoutSeconds: Type.Integer({ minimum: 1, maximum: 300 })
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(toolCallId, params, signal) {
+        const command = validateCodingCommand(params);
+        const context = await input.context(command.cwd);
+        if (context.instructions.state !== "complete")
+          throw new Error("Coding scope instructions are incomplete");
+        const started = await input.host.invoke({
+          action: "start",
+          toolCallId,
+          input: command
+        });
+        const output = new CodingDiagnostics(input.secrets ?? []);
+        let outcome;
+        try {
+          if (input.approval)
+            await requireBashApproval(command.command, toolCallId, signal, input.approvalHost);
+          signal?.throwIfAborted();
+          const cwd = resolveCodingDirectory(input.root, command.cwd);
+          const operations = input.docker ? createPreparedDockerBashOperations(
+            {
+              ...input.docker,
+              coding: {
+                revision: input.docker.coding?.revision ?? 0,
+                cwd: command.cwd,
+                env: input.docker.coding?.env ?? {}
+              }
+            },
+            input.lifecycle
+          ) : hostOperations;
+          const result = await operations.exec(
+            command.command,
+            input.docker ? input.root : cwd.path,
+            { onData: (bytes) => output.append(bytes), signal, timeout: command.timeoutSeconds }
+          );
+          outcome = {
+            state: result.exitCode === 0 ? "succeeded" : result.exitCode === null ? "interrupted" : "failed",
+            exitCode: result.exitCode,
+            ...output.finish(),
+            reason: result.exitCode === null ? "exit_unavailable" : null
+          };
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Command execution unavailable";
+          const state = signal?.aborted || message === "aborted" ? "cancelled" : message.startsWith("timeout:") ? "timed_out" : error instanceof BashApprovalDeniedError ? "blocked" : /cleanup|teardown/i.test(message) ? "interrupted" : "blocked";
+          outcome = { state, exitCode: null, ...output.finish(), reason: message };
+        }
+        const receipt = await input.host.invoke({
+          action: "finish",
+          id: started.id,
+          outcome
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(receipt) }],
+          details: { codingReceipt: receipt }
+        };
+      }
+    },
+    {
+      name: "coding_receipt",
+      label: "Read coding result",
+      description: "Read a retained command result with current applicability. Your own receipts are private. For a teammate\u2019s receipt, provide the id of its policy-authorized message containing coding-receipt:<id>. Old results are not current verification.",
+      parameters: Type.Object(
+        {
+          id: Type.String({ maxLength: 64 }),
+          messageId: Type.Optional(Type.String({ maxLength: 64 }))
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const value = await input.host.invoke({
+          action: "read",
+          ...params
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingEvidence: value }
+        };
+      }
+    }
+  ];
+}
+
+// ../daemon/src/runtime/pi/repository-context.ts
+import { Type as Type2 } from "typebox";
+
+// ../daemon/src/runtime/pi/repository-context-contract.ts
+var object2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var keys = (value, required, optional = []) => required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+var string = (value, limit = 4096) => typeof value === "string" && value.length <= limit;
+var digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+var count = (value) => Number.isSafeInteger(value) && value >= 0;
+var list3 = (value, limit, check) => Array.isArray(value) && value.length <= limit && value.every(check);
+var issue = (value) => object2(value) && keys(value, ["code", "message"], ["path"]) && string(value.code, 100) && string(value.message, 1024) && (value.path === void 0 || string(value.path));
+function assertRepositoryContext(value, teamId) {
+  if (!object2(value) || !keys(value, [
+    "version",
+    "teamId",
+    "rootIdentity",
+    "target",
+    "capturedAt",
+    "fingerprint",
+    "instructions",
+    "commands",
+    "git"
+  ]) || value.version !== 1 || !string(value.teamId, 256) || teamId !== void 0 && value.teamId !== teamId || value.rootIdentity !== null && !digest(value.rootIdentity) || !string(value.target) || !count(value.capturedAt) || !digest(value.fingerprint) || !object2(value.instructions) || !object2(value.commands) || !object2(value.git) || Buffer.byteLength(JSON.stringify(value)) > 256 * 1024)
+    throw new Error("Invalid repository context report");
+  const instructions = value.instructions;
+  const commands = value.commands;
+  const git = value.git;
+  if (!keys(instructions, ["state", "issues", "files"]) || !keys(commands, ["state", "issues", "sources", "candidates"]) || !keys(git, [
+    "state",
+    "root",
+    "branch",
+    "head",
+    "headState",
+    "staged",
+    "unstaged",
+    "untracked",
+    "conflicted",
+    "issues"
+  ]) || !["complete", "incomplete"].includes(String(instructions.state)) || !list3(instructions.issues, 128, issue) || !list3(
+    instructions.files,
+    17,
+    (file) => object2(file) && keys(file, ["path", "scope", "precedence", "sha256", "content"]) && string(file.path) && string(file.scope) && count(file.precedence) && digest(file.sha256) && string(file.content, 64 * 1024) && Buffer.byteLength(file.content) <= 64 * 1024
+  ) || !["complete", "incomplete"].includes(String(commands.state)) || !list3(commands.issues, 128, issue) || !list3(
+    commands.sources,
+    32,
+    (source) => object2(source) && keys(source, ["path", "sha256"]) && string(source.path) && digest(source.sha256)
+  ) || !list3(
+    commands.candidates,
+    32,
+    (candidate) => object2(candidate) && keys(candidate, [
+      "source",
+      "sha256",
+      "location",
+      "cwd",
+      "command",
+      "kind",
+      "packageManager"
+    ]) && string(candidate.source) && digest(candidate.sha256) && string(candidate.location) && string(candidate.cwd) && string(candidate.command) && ["script", "excerpt"].includes(String(candidate.kind)) && [null, "npm", "pnpm", "yarn"].includes(candidate.packageManager)
+  ) || !["available", "unavailable", "not_repository"].includes(String(git.state)) || ![null, "branch", "detached", "unborn"].includes(git.headState) || ![git.root, git.branch, git.head].every((value2) => value2 === null || string(value2)) || ![git.staged, git.unstaged, git.untracked, git.conflicted].every(count) || !list3(git.issues, 128, issue))
+    throw new Error("Invalid repository context report");
+  const report = value;
+  if (report.instructions.files.reduce((bytes, file) => bytes + Buffer.byteLength(file.content), 0) > 128 * 1024 || report.instructions.state === "complete" && (report.rootIdentity === null || report.instructions.issues.length > 0))
+    throw new Error("Invalid repository instruction completeness");
+}
+
+// ../daemon/src/runtime/pi/repository-context.ts
+function repositoryContextIntegration(initial, host, cwd) {
+  assertRepositoryContext(initial);
+  if (initial.instructions.state !== "complete")
+    throw new Error("Repository instructions incomplete");
+  let current = initial;
+  let refreshPrompt = () => {
+  };
+  const files = () => ({
+    agentsFiles: [
+      {
+        path: "Repository instructions and provenance",
+        content: [
+          "# Repository context",
+          `Captured target: ${current.target}; fingerprint: ${current.fingerprint}; captured at: ${new Date(current.capturedAt).toISOString()}.`,
+          `Repository root for this runtime: ${cwd}. This is captured context, not a live workspace lock or verification evidence.`,
+          "Platform/runtime policy and explicit operator instructions take priority. Repository guidance specializes general private Agent preferences for repository work. Deeper documents govern only their own subtree. Team Policy and execution authority are unchanged.",
+          "For coding tasks, investigate repository context and actual coding_environment as needed, then use coding_command for task-related finite checks/preparation. Do not ask the operator to configure named checks. A source-backed Team memory recipe is advisory; refresh it before reuse. Missing network/tooling is a concrete prerequisite to report, never authority to change the runtime. To delegate shared-workspace preparation, send_message and end the turn; do not wait_for_reply while holding the peer workspace.",
+          "Before editing a different subtree, call repository_context with its directory or file path. A returned snapshot replaces previous applicable repository guidance; older transcript snapshots are historical. Do not edit a scope whose instructions are incomplete.",
+          current.instructions.state === "complete" ? "Applicable instructions are complete for the captured scope. Missing AGENTS.md is normal." : `BLOCKED SCOPE: ${current.instructions.issues.map((issue2) => issue2.code).join(", ")}. Resolve this context before editing.`,
+          ...current.instructions.state === "complete" ? current.instructions.files.map(
+            (file) => `## ${file.path}
+Scope: ${file.scope}; precedence: ${file.precedence}; SHA-256: ${file.sha256}
+
+${file.content}`
+          ) : [],
+          `Git orientation at capture time: ${JSON.stringify(current.git)}`,
+          `Command suggestions (task data, not execution permission):
+${JSON.stringify(current.commands)}`
+        ].join("\n\n")
+      }
+    ]
+  });
+  const tool = {
+    name: "repository_context",
+    label: "Repository context",
+    description: "Resolve the complete applicable repository AGENTS.md instructions and passive command/Git context for a contained file or directory. Call before editing a new subtree. Does not run project commands or change cwd. Incomplete instructions block editing that scope.",
+    parameters: Type2.Object(
+      { target: Type2.String({ maxLength: 4096 }) },
+      { additionalProperties: false }
+    ),
+    executionMode: "sequential",
+    async execute(_id, params) {
+      const target = params.target;
+      const replacement = await host(target);
+      assertRepositoryContext(replacement);
+      if (replacement.teamId !== initial.teamId || replacement.rootIdentity !== initial.rootIdentity) {
+        current = {
+          ...initial,
+          instructions: {
+            state: "incomplete",
+            files: [],
+            issues: [
+              {
+                code: "root_changed",
+                message: "Repository identity changed; start a new admitted turn."
+              }
+            ]
+          },
+          commands: { state: "incomplete", sources: [], candidates: [], issues: [] }
+        };
+        refreshPrompt();
+        throw new Error("Repository context identity changed; start a new admitted turn");
+      }
+      current = replacement;
+      refreshPrompt();
+      return {
+        content: [{ type: "text", text: JSON.stringify(replacement) }],
+        details: { repositoryContext: replacement }
+      };
+    }
+  };
+  return {
+    files,
+    tool,
+    async resolve(target) {
+      await tool.execute("coding-context", { target }, void 0, void 0, {});
+      return current;
+    },
+    bind(session, allowedTools) {
+      refreshPrompt = () => session.setActiveToolsByName(allowedTools);
+    }
+  };
+}
+
+// ../daemon/src/runtime/pi/session.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename4, join as join22 } from "path";
+import {
+  createAssistantMessageEventStream
+} from "@earendil-works/pi-ai";
+import {
+  buildSessionContext,
+  createAgentSession,
+  DefaultResourceLoader,
+  SessionManager,
+  SettingsManager
+} from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/providers/pi-runtime.ts
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+var PROVIDER_ALIASES = {
+  bedrock: "amazon-bedrock",
+  "azure-openai": "azure-openai-responses"
+};
+var PROTECTED_PROVIDER_NAMES = [
+  "anthropic",
+  "openai",
+  "openai-codex",
+  "google",
+  "google-vertex",
+  "azure-openai",
+  "bedrock",
+  "mistral",
+  "groq",
+  "cerebras",
+  "xai",
+  "zai",
+  "huggingface",
+  "openrouter",
+  "vercel-ai-gateway",
+  "deepseek",
+  "fireworks",
+  "together",
+  "baseten",
+  "moonshotai",
+  "moonshotai-cn",
+  "kimi-coding",
+  "minimax",
+  "minimax-cn",
+  "qwen-token-plan",
+  "qwen-token-plan-cn",
+  "qwen-token-plan-individual",
+  "xiaomi",
+  "xiaomi-token-plan-ams",
+  "xiaomi-token-plan-cn",
+  "xiaomi-token-plan-sgp",
+  "ant-ling",
+  "nvidia",
+  "opencode",
+  "opencode-go",
+  "zai-coding-cn",
+  "github-copilot",
+  "cloudflare-ai-gateway",
+  "cloudflare-workers-ai",
+  "lmstudio",
+  "ollama",
+  "llamacpp"
+];
+var LOCAL_PROVIDERS = {
+  lmstudio: {
+    baseUrl: "http://127.0.0.1:1234/v1",
+    apiKey: "lm-studio",
+    authHeader: false
+  },
+  ollama: { baseUrl: "http://127.0.0.1:11434/v1", apiKey: "ollama", authHeader: false },
+  llamacpp: { baseUrl: "http://127.0.0.1:8080/v1", apiKey: "no-key", authHeader: true }
+};
+var PROVIDER_API_KEY_ENV = {
+  anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+  openai: ["OPENAI_API_KEY"],
+  google: ["GEMINI_API_KEY"],
+  "azure-openai": ["AZURE_OPENAI_API_KEY"],
+  mistral: ["MISTRAL_API_KEY"],
+  groq: ["GROQ_API_KEY"],
+  cerebras: ["CEREBRAS_API_KEY"],
+  xai: ["XAI_API_KEY"],
+  zai: ["ZAI_API_KEY"],
+  huggingface: ["HF_TOKEN"],
+  openrouter: ["OPENROUTER_API_KEY"],
+  "vercel-ai-gateway": ["AI_GATEWAY_API_KEY"],
+  deepseek: ["DEEPSEEK_API_KEY"],
+  fireworks: ["FIREWORKS_API_KEY"],
+  together: ["TOGETHER_API_KEY"],
+  baseten: ["BASETEN_API_KEY"],
+  moonshotai: ["MOONSHOT_API_KEY"],
+  "moonshotai-cn": ["MOONSHOT_CN_API_KEY"],
+  "kimi-coding": ["KIMI_API_KEY"],
+  minimax: ["MINIMAX_API_KEY"],
+  "minimax-cn": ["MINIMAX_CN_API_KEY"],
+  "qwen-token-plan": ["QWEN_TOKEN_PLAN_API_KEY"],
+  "qwen-token-plan-cn": ["QWEN_TOKEN_PLAN_CN_API_KEY"],
+  "qwen-token-plan-individual": ["QWEN_TOKEN_PLAN_API_KEY"],
+  xiaomi: ["XIAOMI_API_KEY"],
+  "xiaomi-token-plan-ams": ["XIAOMI_TOKEN_PLAN_AMS_API_KEY"],
+  "xiaomi-token-plan-cn": ["XIAOMI_TOKEN_PLAN_CN_API_KEY"],
+  "xiaomi-token-plan-sgp": ["XIAOMI_TOKEN_PLAN_SGP_API_KEY"],
+  "ant-ling": ["ANT_LING_API_KEY"],
+  nvidia: ["NVIDIA_API_KEY"],
+  opencode: ["OPENCODE_API_KEY"],
+  "opencode-go": ["OPENCODE_GO_API_KEY"],
+  "zai-coding-cn": ["ZAI_CODING_CN_API_KEY"],
+  "github-copilot": ["COPILOT_GITHUB_TOKEN"],
+  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY"],
+  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY"],
+  lmstudio: ["LMSTUDIO_API_KEY"],
+  ollama: ["OLLAMA_API_KEY"],
+  llamacpp: ["LLAMACPP_API_KEY"]
+};
+var PROVIDER_CREDENTIAL_ENV = {
+  bedrock: [
+    "AWS_PROFILE",
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION"
+  ],
+  "google-vertex": [
+    "GOOGLE_CLOUD_PROJECT",
+    "GOOGLE_CLOUD_LOCATION",
+    "GOOGLE_APPLICATION_CREDENTIALS"
+  ],
+  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_GATEWAY_ID"],
+  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID"]
+};
+function piProviderName(providerName) {
+  return PROVIDER_ALIASES[providerName] ?? providerName;
+}
+function providerApiKey(providerName, env) {
+  for (const name of PROVIDER_API_KEY_ENV[providerName] ?? []) {
+    const value = env[name];
+    if (value) return value;
+  }
+  return LOCAL_PROVIDERS[providerName]?.apiKey;
+}
+function providerBaseUrl(providerName, env) {
+  switch (providerName) {
+    case "lmstudio":
+      return env.LMSTUDIO_URL ?? LOCAL_PROVIDERS.lmstudio?.baseUrl;
+    case "ollama":
+      return env.OLLAMA_URL ?? LOCAL_PROVIDERS.ollama?.baseUrl;
+    case "llamacpp":
+      return env.LLAMACPP_URL ?? LOCAL_PROVIDERS.llamacpp?.baseUrl;
+    case "vercel-ai-gateway":
+      return env.AI_GATEWAY_BASE_URL;
+    default:
+      return void 0;
+  }
+}
+function providerCredentialEnv(providerName, env) {
+  const result = {};
+  for (const name of PROVIDER_CREDENTIAL_ENV[providerName] ?? []) {
+    const value = env[name];
+    if (value !== void 0) result[name] = value;
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function fallbackApi(providerName) {
+  switch (providerName) {
+    case "anthropic":
+      return "anthropic-messages";
+    case "google":
+      return "google-generative-ai";
+    case "google-vertex":
+      return "google-vertex";
+    case "azure-openai":
+      return "azure-openai-responses";
+    case "bedrock":
+      return "bedrock-converse-stream";
+    case "openai-codex":
+      return "openai-codex-responses";
+    default:
+      return "openai-completions";
+  }
+}
+function fallbackPiModel(providerName, modelId, baseUrl) {
+  return {
+    id: modelId,
+    name: modelId,
+    api: fallbackApi(providerName),
+    provider: piProviderName(providerName),
+    baseUrl: baseUrl ?? "",
+    reasoning: false,
+    input: ["text"],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 32768,
+    maxTokens: 4096
+  };
+}
+async function createBazilionPiRuntime(options) {
+  const providerName = options.providerName;
+  const canonicalName = piProviderName(providerName);
+  const credentials = new InMemoryCredentialStore();
+  const apiKey = options.apiKey ?? providerApiKey(providerName, options.env);
+  const credentialEnv = providerCredentialEnv(providerName, options.env);
+  if (apiKey || credentialEnv) {
+    await credentials.modify(
+      canonicalName,
+      async () => canonicalName === "openai-codex" && apiKey ? {
+        type: "oauth",
+        access: apiKey,
+        // Bazilion owns refresh outside Pi. This deliberately empty value
+        // satisfies Pi's canonical OAuth shape but is never used because
+        // the token is long-lived only inside this one-shot runtime and
+        // mid-turn replacement is supplied through Agent.getApiKey.
+        refresh: "",
+        expires: Number.MAX_SAFE_INTEGER
+      } : {
+        type: "api_key",
+        ...apiKey ? { key: apiKey } : {},
+        ...credentialEnv ? { env: credentialEnv } : {}
+      }
+    );
+  }
+  const runtime = await ModelRuntime.create({ credentials, modelsPath: null });
+  const local = LOCAL_PROVIDERS[providerName];
+  const baseUrl = options.baseUrl ?? providerBaseUrl(providerName, options.env);
+  if (local) {
+    const modelId = options.modelId ?? "model-name";
+    const model = fallbackPiModel(providerName, modelId, baseUrl ?? local.baseUrl);
+    runtime.registerProvider(canonicalName, {
+      baseUrl: baseUrl ?? local.baseUrl,
+      api: "openai-completions",
+      authHeader: local.authHeader,
+      apiKey: apiKey ?? local.apiKey,
+      models: [model]
+    });
+  } else if (baseUrl) {
+    runtime.registerProvider(canonicalName, { baseUrl });
+  }
+  return runtime;
+}
+async function createProtectedPiRuntime(options) {
+  const env = {};
+  for (const field of options.credentialEnv ?? []) env[field.name] = field.value;
+  return createBazilionPiRuntime({
+    providerName: options.providerName,
+    modelId: options.modelId,
+    env,
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl
+  });
+}
+function resolvePiModel(runtime, providerName, modelId, baseUrl) {
+  const known = runtime.getModel(piProviderName(providerName), modelId);
+  if (known) return baseUrl ? { ...known, baseUrl } : known;
+  return fallbackPiModel(providerName, modelId, baseUrl);
+}
+
+// ../daemon/src/runtime/auth/openai-codex.ts
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+
+// ../daemon/src/runtime/providers/pi-adapter.ts
+import {
+  Type as Type3
+} from "@earendil-works/pi-ai";
+
+// ../daemon/src/runtime/session/prompt.ts
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
+import { join as join17 } from "path";
+
+// ../daemon/src/runtime/safe-files.ts
+import {
+  closeSync as closeSync5,
+  constants as constants5,
+  fstatSync as fstatSync4,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  openSync as openSync5,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync5
+} from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute4, relative as relative3, resolve as resolve4 } from "path";
+function resolveRealDirectory(path) {
+  const requested = resolve4(path);
+  const entry = lstatSync3(requested);
+  if (entry.isSymbolicLink() || !entry.isDirectory()) {
+    throw new Error("expected a real directory");
+  }
+  return realpathSync5(requested);
+}
+function readRegularFileNoFollow(path) {
+  const entry = lstatSync3(path);
+  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
+  if (!entry.isFile()) throw new Error("target is not a regular file");
+  let fd;
+  try {
+    fd = openSync5(path, constants5.O_RDONLY | noFollowFlag());
+    if (!fstatSync4(fd).isFile()) throw new Error("target is not a regular file");
+    return readFileSync9(fd, "utf8");
+  } finally {
+    if (fd !== void 0) closeSync5(fd);
+  }
+}
+function noFollowFlag() {
+  return typeof constants5.O_NOFOLLOW === "number" ? constants5.O_NOFOLLOW : 0;
+}
+
+// ../daemon/src/runtime/session/prompt.ts
+var SANDBOX_SKILLS_DIR = "/skills";
+function loadPromptSkills(skillsDir, attachedNames) {
+  if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
+  const attached = new Set(attachedNames);
+  const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
+  const loaded = [];
+  for (const entry of discovered) {
+    const hostDir = join17(skillsDir, entry.name);
+    try {
+      const parsed = parseSkillContent(readRegularFileNoFollow(join17(hostDir, "SKILL.md")));
+      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
+      loaded.push({
+        name: entry.name,
+        description: parsed.frontmatter.description,
+        body: parsed.body.trim(),
+        hostDir,
+        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
+      });
+    } catch {
+    }
+  }
+  return loaded;
+}
+var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
+function loadProtectedHomeDocuments(agentDir) {
+  const root = resolveRealDirectory(agentDir);
+  const read = (file) => {
+    try {
+      return readRegularFileNoFollow(join17(root, file));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new Error(`private Agent home is unsafe at ${file}`);
+    }
+  };
+  return {
+    "AGENTS.md": read("AGENTS.md"),
+    "SOUL.md": read("SOUL.md"),
+    "TOOLS.md": read("TOOLS.md"),
+    "IDENTITY.md": read("IDENTITY.md"),
+    "BOOTSTRAP.md": read("BOOTSTRAP.md")
+  };
+}
+function buildSystemPrompt(agent, options = {}) {
+  const parts = [];
+  const homeDocuments = options.homeDocuments ?? loadProtectedHomeDocuments(agent.agent.dir);
+  const contextBlocks = [];
+  for (const file of CONTEXT_FILE_ORDER) {
+    const content = homeDocuments[file]?.trimEnd();
+    if (!content) continue;
+    contextBlocks.push(`## ${file}
+
+${content}`);
   }
-  return new Error(`Docker sandbox could not start "${dockerPath}": ${error.message}`);
-}
-function formatDockerRunError(spec, stderr) {
-  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
-  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
-    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  if (contextBlocks.length > 0) {
+    parts.push(`# Agent instructions
+
+${contextBlocks.join("\n\n")}`);
   }
-  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
-    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  const bootstrap = homeDocuments["BOOTSTRAP.md"]?.trimEnd();
+  if (bootstrap) {
+    parts.push(
+      [
+        "# First-Run Ritual",
+        "",
+        "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
+        "",
+        "## Hard rules",
+        "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
+        "- Each subsequent turn: at most one new question. Wait between turns.",
+        "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
+        "",
+        "## BOOTSTRAP.md",
+        "",
+        bootstrap
+      ].join("\n")
+    );
   }
-  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
-    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  parts.push(
+    [
+      "# Agent Home",
+      "",
+      "Your private home holds who you are \u2014 identity, soul, and behaviour rules. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
+      "",
+      "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
+      "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
+      "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
+      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
+    ].join("\n")
+  );
+  if (agent.skills.length > 0) {
+    const loaded = options.skills ?? [];
+    const loadedNames = new Set(loaded.map((skill) => skill.name));
+    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
+    const skillBlocks = loaded.map((skill) => {
+      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
+      return [
+        `## ${skill.name}`,
+        "",
+        skill.description,
+        "",
+        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
+        "",
+        skill.body
+      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
+    });
+    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
+    parts.push(
+      [
+        "# Available Skills",
+        "",
+        "Use these attached skill instructions when they are relevant to the task.",
+        "",
+        ...skillBlocks,
+        ...unavailableNote ? ["", unavailableNote] : []
+      ].join("\n")
+    );
   }
-  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
-}
-async function removeContainer(dockerPath, containerName, processEnv) {
-  const args = ["container", "rm", "--force", containerName];
-  let last;
-  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
-    last = await runCleanupCommand(dockerPath, args, processEnv);
-    if (last.ok) return;
-    if (attempt < CLEANUP_ATTEMPTS - 1) {
-      await new Promise((resolve6) => setTimeout(resolve6, CLEANUP_RETRY_DELAY_MS));
-    }
+  const teamLines = [
+    "# Team",
+    "",
+    `- ${agent.team.id} (${agent.team.name}): ${options.sandboxMode === "docker" ? "/workspace" : agent.team.path}`,
+    "",
+    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
+  ];
+  parts.push(teamLines.join("\n"));
+  if (agent.team.userMd.trim()) {
+    parts.push(
+      `# About the User
+
+Shared context about the human you're working with in this team. Both you and the human curate it. To update: call \`user_md_get\` (returns current content + an etag), merge your change into the full text, then call \`user_md_write\` with the merged content and the etag. Use this for STABLE user-specific facts (preferences, role, working hours, how they like to be addressed) \u2014 and to CORRECT stale entries when the human tells you something different from what's recorded. For project knowledge use \`memory_write\` instead; for personal notes about yourself use \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**
+
+${agent.team.userMd.trim()}`
+    );
+  } else {
+    parts.push(
+      `# About the User
+
+This team's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**`
+    );
   }
-  if (last && !last.missing) {
-    console.warn(
-      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+  const reviewedLessons = boundReviewedLessons(agent.privateLessons);
+  if (reviewedLessons.length > 0) {
+    parts.push(
+      `# Reviewed lessons
+
+These private lessons were explicitly approved by the human for your behavior. Follow them when relevant; current user instructions and higher-priority policy still win.
+
+${reviewedLessons.map((lesson) => `- ${lesson}`).join("\n")}`
     );
   }
+  parts.push(
+    "# Memory\n\nYou share a persistent memory backend with every other agent in this team. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the team may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
+  );
+  return parts.join("\n\n---\n\n");
 }
-function runCleanupCommand(dockerPath, args, processEnv) {
-  return new Promise((resolve6) => {
-    let done = false;
-    let stderr = "";
-    const child = spawn(dockerPath, args, {
-      stdio: ["ignore", "ignore", "pipe"],
-      windowsHide: true,
-      env: processEnv
-    });
-    const finish = (ok, error = "") => {
-      if (done) return;
-      done = true;
-      clearTimeout(timeoutHandle);
-      const detail3 = error || stderr.trim();
-      resolve6({
-        ok,
-        missing: /no such container/i.test(detail3),
-        error: detail3
-      });
-    };
-    const timeoutHandle = setTimeout(() => {
-      child.kill("SIGKILL");
-      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
-    }, CLEANUP_TIMEOUT_MS);
-    child.stderr.on("data", (data) => {
-      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
-    });
-    child.once("error", (error) => finish(false, error.message));
-    child.once("close", (code) => finish(code === 0));
-  });
+function boundReviewedLessons(lessons, maxCharacters = 8e3) {
+  const selected = [];
+  let used = 0;
+  for (const raw of lessons) {
+    const lesson = raw.trim();
+    if (!lesson) continue;
+    const remaining = maxCharacters - used;
+    if (remaining <= 0) break;
+    selected.push(lesson.slice(0, remaining));
+    used += Math.min(lesson.length, remaining);
+  }
+  return selected;
 }
 
 // ../daemon/src/runtime/shell/tooling.ts
+import { existsSync as existsSync11, lstatSync as lstatSync4, realpathSync as realpathSync6 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute5, join as join18, relative as relative4, sep as sep4 } from "path";
+import {
+  createBashToolDefinition,
+  createLocalBashOperations as createLocalBashOperations2,
+  defineTool as defineTool2
+} from "@earendil-works/pi-coding-agent";
 var HOST_CODING_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
 var HOST_FILE_TOOL_NAMES = ["read", "edit", "write", "grep", "find", "ls"];
 var CONTAINER_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var SANDBOX_INPUTS_DIR = "/inputs";
 var SANDBOX_MEMORY_DIR = "/workspace/memory";
-function createProtectedSessionShellTools(cwd, runtime, approvalHost) {
+function createProtectedSessionShellTools(cwd, runtime, approvalHost, lifecycle) {
+  const operations = createPreparedDockerBashOperations(runtime, lifecycle);
+  const modelCwd = codingContainerCwd(runtime.coding?.cwd ?? ".");
   const base = createBashToolDefinition(cwd, {
-    operations: createPreparedDockerBashOperations(runtime)
+    operations: {
+      exec(command, requestedCwd, options) {
+        if (requestedCwd !== modelCwd && requestedCwd !== cwd)
+          throw new Error("Protected command working directory differs from the admitted scope");
+        return operations.exec(command, cwd, options);
+      }
+    }
   });
   const dockerBash = defineTool2({
     ...base,
     label: "bash (protected Docker sandbox)",
-    description: `${base.description} Runs in an ephemeral, network-disabled Docker container with the Team workspace mounted read/write plus only the preflighted read-only memory, skill, and attachment mounts. Host files, host tools, and host credentials are unavailable.`
+    description: `${base.description} Default working directory: ${codingContainerCwd(runtime.coding?.cwd ?? ".")}. Runs in an ephemeral, network-disabled Docker container with the Team workspace mounted read/write plus only the preflighted read-only memory, skill, and attachment mounts. Host files, host tools, and host credentials are unavailable.`
   });
   return {
     config: {
@@ -2880,21 +3696,40 @@ function buildSandboxContainerEnv(env, allowlist) {
 }
 function createSessionShellTools(cwd, env, options = {}) {
   const config = resolveShellSecurityConfig(env);
+  if (options.preparedDocker) {
+    if (config.sandboxMode !== "docker")
+      throw new Error("Prepared coding environment cannot execute on the host");
+    const runtime = options.preparedDocker;
+    const base2 = createBashToolDefinition(cwd, {
+      operations: createPreparedDockerBashOperations(runtime, options.dockerLifecycle)
+    });
+    const tool = defineTool2({
+      ...base2,
+      label: "bash (prepared Docker sandbox)",
+      description: `${base2.description} Default working directory: ${codingContainerCwd(runtime.coding?.cwd ?? ".")}. Fresh network-disabled Docker container with the Team workspace and preflighted read-only mounts.`
+    });
+    return {
+      config: { ...config, sandboxImage: runtime.image, envAllowlist: [] },
+      hostToolNames: [],
+      customBash: config.approvalMode === "dangerous" ? createApprovalGatedBashTool(tool, options.approvalHost) : tool
+    };
+  }
   if (config.sandboxMode === "off" && config.approvalMode === "off") {
     return { config, hostToolNames: HOST_CODING_TOOL_NAMES };
   }
   if (config.sandboxMode === "off") {
     const base2 = createBashToolDefinition(cwd, {
-      operations: createLocalBashOperations()
+      operations: createLocalBashOperations2()
     });
     const customBash2 = createApprovalGatedBashTool(base2, options.approvalHost);
     return { config, hostToolNames: HOST_FILE_TOOL_NAMES, customBash: customBash2 };
   }
   const operations = createDockerBashOperations({
+    lifecycle: options.dockerLifecycle,
     image: config.sandboxImage,
     env: buildSandboxContainerEnv(env, config.envAllowlist),
     readOnlyMounts: [
-      ...existsSync11(join15(cwd, "memory")) ? [safeReadOnlyMount(join15(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
+      ...existsSync11(join18(cwd, "memory")) ? [safeReadOnlyMount(join18(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
       ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname4(options.inputsDir))] : [],
       ...(options.skillMounts ?? []).map(
         (mount) => safeReadOnlyMount(mount.source, mount.target, dirname4(mount.source))
@@ -2911,14 +3746,14 @@ function createSessionShellTools(cwd, env, options = {}) {
   return { config, hostToolNames: [], customBash };
 }
 function safeReadOnlyMount(source, target, expectedRoot) {
-  const info = lstatSync3(source);
+  const info = lstatSync4(source);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
   }
-  const sourceRoot = realpathSync3(expectedRoot);
-  const canonicalSource = realpathSync3(source);
+  const sourceRoot = realpathSync6(expectedRoot);
+  const canonicalSource = realpathSync6(source);
   const rel = relative4(sourceRoot, canonicalSource);
-  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
+  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute5(rel);
   if (!contained) {
     throw new Error(`Docker sandbox read-only mount escaped its configured root: ${source}`);
   }
@@ -2927,18 +3762,18 @@ function safeReadOnlyMount(source, target, expectedRoot) {
 
 // ../daemon/src/runtime/worker/runtime.ts
 import {
-  constants as constants4,
+  constants as constants6,
   existsSync as existsSync12,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync3,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync7,
   rmSync as rmSync11,
   statSync as statSync3
 } from "fs";
 import { access as access2 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { isAbsolute as isAbsolute5, join as join16, relative as relative5, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute6, join as join19, relative as relative5, sep as sep5 } from "path";
 var REDACTED_VALUE = "[REDACTED]";
 var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "off",
@@ -2949,6 +3784,11 @@ var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "xhigh"
 ]);
 var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
+  "containerNamespace",
+  "configuredDocker",
+  "repositoryContext",
+  "questionEnabled",
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2962,6 +3802,8 @@ var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
+  "repositoryContext",
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2971,6 +3813,10 @@ var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var PROTECTED_KEYS = /* @__PURE__ */ new Set([
+  "containerNamespace",
+  "repositoryContext",
+  "questionEnabled",
+  "conversation",
   "kind",
   "agent",
   "message",
@@ -2984,7 +3830,11 @@ var PROTECTED_KEYS = /* @__PURE__ */ new Set([
   "apiKeyRefreshEnabled",
   "scratch"
 ]);
-var PROTECTED_REQUIRED_KEYS = new Set([...PROTECTED_KEYS].filter((key) => key !== "images"));
+var PROTECTED_REQUIRED_KEYS = new Set(
+  [...PROTECTED_KEYS].filter(
+    (key) => key !== "images" && key !== "questionEnabled" && key !== "containerNamespace"
+  )
+);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -3044,14 +3894,27 @@ function validateMinimalWorkerProcessEnv(env, scratch, platform = process.platfo
 function parseWorkerInput(value) {
   const input = objectRecord(value, "worker input");
   const kind = input.kind;
+  if (input.containerNamespace !== void 0 && (typeof input.containerNamespace !== "string" || !/^[a-f0-9-]{36}$/.test(input.containerNamespace)))
+    throw new Error("Invalid container namespace");
+  if (input.questionEnabled !== void 0 && typeof input.questionEnabled !== "boolean")
+    throw new Error("Invalid worker question capability");
   if (kind === "configured_operator_http") {
     assertExactKeys(input, CONFIGURED_KEYS, "configured worker input", CONFIGURED_REQUIRED_KEYS);
     if (!isResolvedAgent(input.agent)) throw new Error("worker: configured input requires an agent");
+    if (input.configuredDocker !== void 0) {
+      const prepared = objectRecord(input.configuredDocker, "configured Docker inputs");
+      const keys2 = /* @__PURE__ */ new Set(["paths", "docker"]);
+      assertExactKeys(prepared, keys2, "configured Docker inputs", keys2);
+      assertProtectedWorkerPaths(prepared.paths, input.agent);
+      assertProtectedDockerRuntime(prepared.docker, prepared.paths);
+    }
+    assertRepositoryContext(input.repositoryContext, input.agent.team.id);
     requireString(input.message, "message");
     if (!Array.isArray(input.enabledProviders) || !input.enabledProviders.every(isString)) {
       throw new Error("worker: configured input requires enabledProviders");
     }
     requireString(input.turnId, "turnId");
+    assertConversationTarget(input.conversation);
     if (input.bashApprovalMode !== "interactive" && input.bashApprovalMode !== "auto_deny") {
       throw new Error("worker: configured input requires a valid bashApprovalMode");
     }
@@ -3071,8 +3934,10 @@ function parseWorkerInput(value) {
   if (kind === "protected") {
     assertExactKeys(input, PROTECTED_KEYS, "protected worker input", PROTECTED_REQUIRED_KEYS);
     if (!isResolvedAgent(input.agent)) throw new Error("worker: protected input requires an agent");
+    assertRepositoryContext(input.repositoryContext, input.agent.team.id);
     requireString(input.message, "message");
     requireString(input.turnId, "turnId");
+    assertConversationTarget(input.conversation);
     if (input.bashApprovalMode !== "auto_deny") {
       throw new Error("worker: protected input requires auto-deny shell approval");
     }
@@ -3202,8 +4067,8 @@ function protectedRuntimeSecrets(runtime) {
     runtime.credentialFile?.content
   ].filter((value) => Boolean(value));
 }
-function redactExactValues(text, values) {
-  let redacted = text;
+function redactExactValues(text2, values) {
+  let redacted = text2;
   for (const value of [...new Set(values)].filter(Boolean).sort((a, b) => b.length - a.length)) {
     redacted = redacted.replaceAll(value, REDACTED_VALUE);
   }
@@ -3312,7 +4177,8 @@ function assertProtectedDockerRuntime(value, paths) {
       "gid",
       "workspace",
       "readOnlyMounts",
-      "containerEnv"
+      "containerEnv",
+      "coding"
     ]),
     "protected Docker runtime",
     /* @__PURE__ */ new Set([
@@ -3352,7 +4218,7 @@ function assertProtectedDockerRuntime(value, paths) {
       throw new Error(`worker: protected Docker executable identity has invalid ${name}`);
     }
   }
-  if (typeof runtime.endpoint !== "string" || !runtime.endpoint.startsWith("unix://") || !isAbsolute5(runtime.endpoint.slice("unix://".length)) || containsUnsafeDockerArgument(runtime.endpoint)) {
+  if (typeof runtime.endpoint !== "string" || !runtime.endpoint.startsWith("unix://") || !isAbsolute6(runtime.endpoint.slice("unix://".length)) || containsUnsafeDockerArgument(runtime.endpoint)) {
     throw new Error("worker: protected Docker endpoint must be a local Unix socket");
   }
   if (!nonEmptyString(runtime.image) || runtime.image.startsWith("-") || runtime.image.includes("\0") || runtime.image.includes("\n") || runtime.image.includes("\r")) {
@@ -3416,6 +4282,7 @@ function assertProtectedDockerRuntime(value, paths) {
     runtime.readOnlyMounts,
     paths
   );
+  if (runtime.coding !== void 0) validateDockerCodingSelection(runtime.coding);
   const containerEnv = objectRecord(runtime.containerEnv, "protected Docker container environment");
   const expectedContainerEnv = {
     PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -3465,11 +4332,11 @@ function containsUnsafeDockerArgument(value) {
 function requireCanonicalRealDirectory(value, name) {
   if (typeof value !== "string") throw new Error(`worker: ${name} must be a path`);
   try {
-    const entry = lstatSync4(value);
+    const entry = lstatSync5(value);
     if (entry.isSymbolicLink() || !entry.isDirectory()) {
       throw new Error("unsafe entry");
     }
-    const canonical = realpathSync4(value);
+    const canonical = realpathSync7(value);
     if (canonical !== value) throw new Error("non-canonical entry");
     return canonical;
   } catch {
@@ -3480,7 +4347,7 @@ function resolveCanonicalDirectory(value, name) {
   try {
     const entry = statSync3(value);
     if (!entry.isDirectory()) throw new Error("not a directory");
-    return realpathSync4(value);
+    return realpathSync7(value);
   } catch {
     throw new Error(`worker: ${name} is unavailable or unsafe`);
   }
@@ -3513,16 +4380,16 @@ function assertMinimalWorkerScratch(value) {
   }
 }
 function requireCanonicalWindowsDirectory(value, name) {
-  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
+  if (!value || !isAbsolute6(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} directory`);
   }
-  return realpathSync4(value);
+  return realpathSync7(value);
 }
 function requireCanonicalWindowsFile(value, name) {
-  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isFile()) {
+  if (!value || !isAbsolute6(value) || !existsSync12(value) || !statSync3(value).isFile()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} executable`);
   }
-  return realpathSync4(value);
+  return realpathSync7(value);
 }
 function objectRecord(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -3557,21 +4424,69 @@ function isString(value) {
   return typeof value === "string";
 }
 function requireAbsolutePath(value, name) {
-  if (typeof value !== "string" || !isAbsolute5(value) || value.includes("\0")) {
+  if (typeof value !== "string" || !isAbsolute6(value) || value.includes("\0")) {
     throw new Error(`worker: ${name} must be an absolute path`);
   }
 }
 function lexicallyWithin(root, candidate) {
   const rel = relative5(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute6(rel);
+}
+function assertConversationTarget(value) {
+  const target = objectRecord(value, "conversation target");
+  assertExactKeys(target, /* @__PURE__ */ new Set(["id", "filename"]), "conversation target");
+  if (typeof target.id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(target.id) || target.filename !== `${target.id}.jsonl`)
+    throw new Error("Invalid worker conversation target");
+}
+
+// ../daemon/src/runtime/tools/ask-user.ts
+function askUserTool(ask) {
+  return {
+    def: {
+      name: "ask_user",
+      description: "Ask the operator one clarification question and wait for an explicit choice, free-text answer, Skip, or a typed no-answer outcome. An answer is information only: it never grants shell or communication permission. Do not ask for credentials. Do not invent a response when no answer is returned.",
+      parameters: {
+        type: "object",
+        additionalProperties: false,
+        required: ["prompt", "choices"],
+        properties: {
+          prompt: { type: "string", minLength: 1, maxLength: 4096 },
+          choices: {
+            type: "array",
+            minItems: 2,
+            maxItems: 4,
+            items: {
+              type: "object",
+              additionalProperties: false,
+              required: ["label"],
+              properties: {
+                label: { type: "string", minLength: 1, maxLength: 120 },
+                description: { type: "string", minLength: 1, maxLength: 500 }
+              }
+            }
+          },
+          recommendedIndex: { type: "integer", minimum: 0, maximum: 3 }
+        }
+      }
+    },
+    async invoke(args, context) {
+      if (!context?.toolCallId) throw new Error("Question requires its actual tool call identity");
+      const { receipt, ...result } = await ask(
+        context.toolCallId,
+        args
+      );
+      const text2 = JSON.stringify(result);
+      return receipt ? { content: [{ type: "text", text: text2 }], questionReceipt: receipt } : text2;
+    }
+  };
 }
 
 // ../daemon/src/runtime/pi/tools.ts
-import { Type as Type2 } from "typebox";
+import { Type as Type4 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
 import { existsSync as existsSync13, rmSync as rmSync12 } from "fs";
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -3580,7 +4495,7 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join17(agentDir, "BOOTSTRAP.md");
+      const path = join20(agentDir, "BOOTSTRAP.md");
       if (existsSync13(path)) {
         rmSync12(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
@@ -3721,15 +4636,15 @@ function browserTools(host, agentId) {
 
 // ../daemon/src/runtime/tools/deliver-file.ts
 import {
-  closeSync as closeSync4,
-  constants as constants5,
-  fstatSync as fstatSync3,
-  openSync as openSync4,
-  readFileSync as readFileSync10,
-  realpathSync as realpathSync5,
+  closeSync as closeSync6,
+  constants as constants7,
+  fstatSync as fstatSync5,
+  openSync as openSync6,
+  readSync as readSync3,
+  realpathSync as realpathSync8,
   statSync as statSync4
 } from "fs";
-import { basename as basename2, extname, isAbsolute as isAbsolute6, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
+import { basename as basename3, extname, isAbsolute as isAbsolute7, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -3747,19 +4662,19 @@ var MIME = {
 };
 function isWithin2(root, candidate) {
   const rel = relative6(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute6(rel);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute7(rel);
 }
-function deliverFileTool(cwd, sink) {
+function deliverFileTool(cwd, sink, sessionId = "") {
   const workspacePath = resolve5(cwd);
   let workspaceRealPath = null;
   try {
-    workspaceRealPath = realpathSync5(workspacePath);
+    workspaceRealPath = realpathSync8(workspacePath);
   } catch {
   }
   return {
     def: {
       name: "deliver_file",
-      description: "Send a file from your workspace to the user so they can download it (web), receive it as a document (Telegram), or save it (CLI). Use this to deliver reports, exports, or any artifact you produced. Max 25 MB.",
+      description: "Send a file from your workspace to the user so they can download it (web), receive it as a document (Telegram), or save it (CLI). Use this to deliver reports, exports, or any artifact you produced. Max 25 MiB. Saved delivery remains subject to Team Policy.",
       parameters: {
         type: "object",
         properties: {
@@ -3772,10 +4687,10 @@ function deliverFileTool(cwd, sink) {
         additionalProperties: false
       }
     },
-    async invoke(args) {
+    async invoke(args, context) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
-      if (isAbsolute6(p)) {
+      if (isAbsolute7(p)) {
         throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
       }
       const abs = resolve5(workspacePath, p);
@@ -3788,7 +4703,7 @@ function deliverFileTool(cwd, sink) {
       let real;
       let expected;
       try {
-        real = realpathSync5(abs);
+        real = realpathSync8(abs);
         expected = statSync4(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
@@ -3798,13 +4713,13 @@ function deliverFileTool(cwd, sink) {
       }
       let fd;
       try {
-        fd = openSync4(real, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
+        fd = openSync6(real, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
       let data;
       try {
-        const stat2 = fstatSync3(fd);
+        const stat2 = fstatSync5(fd);
         if (!stat2.isFile()) {
           throw new Error(`deliver_file: not a regular file: ${p}`);
         }
@@ -3813,7 +4728,7 @@ function deliverFileTool(cwd, sink) {
         }
         let confirmedReal;
         try {
-          confirmedReal = realpathSync5(abs);
+          confirmedReal = realpathSync8(abs);
         } catch {
           throw new Error(`deliver_file: path changed during validation: ${p}`);
         }
@@ -3822,32 +4737,53 @@ function deliverFileTool(cwd, sink) {
         }
         if (stat2.size > MAX_DELIVER_BYTES) {
           throw new Error(
-            `deliver_file: "${basename2(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
+            `deliver_file: "${basename3(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
           );
         }
-        data = readFileSync10(fd).toString("base64");
+        const buffer = Buffer.alloc(MAX_DELIVER_BYTES + 1);
+        let length = 0;
+        while (length < buffer.length) {
+          const count2 = readSync3(fd, buffer, length, buffer.length - length, null);
+          if (count2 === 0) break;
+          length += count2;
+        }
+        if (length > MAX_DELIVER_BYTES) throw new Error("deliver_file: file exceeds 25 MiB");
+        data = buffer.subarray(0, length).toString("base64");
       } finally {
-        closeSync4(fd);
+        closeSync6(fd);
       }
-      const name = basename2(abs);
+      const name = basename3(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
-      sink({ name, mimeType, data });
-      return `Delivered "${name}" (${mimeType}) to the user.`;
+      if (!context?.toolCallId || !sessionId)
+        throw new Error("deliver_file: missing source operation");
+      const result = await sink(
+        { name, mimeType, data },
+        { sessionId, toolCallId: context.toolCallId }
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Saved "${name}" (${mimeType}) as result ${result.resultId}. Delivery is subject to Team Policy.`
+          }
+        ],
+        result
+      };
     }
   };
 }
 
 // ../daemon/src/runtime/tools/home.ts
 import {
-  closeSync as closeSync5,
-  constants as constants6,
-  fstatSync as fstatSync4,
-  lstatSync as lstatSync5,
-  openSync as openSync5,
+  closeSync as closeSync7,
+  constants as constants8,
+  fstatSync as fstatSync6,
+  lstatSync as lstatSync6,
+  openSync as openSync7,
   readdirSync as readdirSync7,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join18 } from "path";
+import { join as join21 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
@@ -3912,18 +4848,18 @@ function homeTools(agentDir) {
         let fd;
         try {
           rejectExistingSymlinkOrNonFile(path);
-          fd = openSync5(
+          fd = openSync7(
             path,
-            constants6.O_WRONLY | constants6.O_CREAT | constants6.O_TRUNC | noFollowFlag(),
+            constants8.O_WRONLY | constants8.O_CREAT | constants8.O_TRUNC | noFollowFlag(),
             384
           );
-          if (!fstatSync4(fd).isFile()) throw new Error("target is not a regular file");
+          if (!fstatSync6(fd).isFile()) throw new Error("target is not a regular file");
           writeFileSync8(fd, content, "utf8");
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           throw new Error(`home_write: could not write ${file}: ${msg}`);
         } finally {
-          if (fd !== void 0) closeSync5(fd);
+          if (fd !== void 0) closeSync7(fd);
         }
         return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
       }
@@ -3939,7 +4875,7 @@ function homeTools(agentDir) {
         for (const file of HOME_FILES_READABLE) {
           const path = privateHomeFile(homeRoot, file);
           try {
-            const s = lstatSync5(path);
+            const s = lstatSync6(path);
             if (s.isSymbolicLink() || !s.isFile()) continue;
             entries.push(`${file} (${s.size}b)`);
           } catch {
@@ -3968,10 +4904,10 @@ function resolvePrivateHomeRoot(agentDir) {
   }
 }
 function privateHomeFile(homeRoot, file) {
-  return join18(homeRoot, file);
+  return join21(homeRoot, file);
 }
 function rejectSymlinkOrNonFile(path) {
-  const entry = lstatSync5(path);
+  const entry = lstatSync6(path);
   if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
   if (!entry.isFile()) throw new Error("target is not a regular file");
 }
@@ -4105,9 +5041,9 @@ function messagingTools(host, fromAgentId) {
       },
       async invoke(args) {
         const to = String(args.to ?? "");
-        const text = String(args.text ?? "");
+        const text2 = String(args.text ?? "");
         if (!to) throw new Error('send_message: "to" is required');
-        if (!text) throw new Error('send_message: "text" is required');
+        if (!text2) throw new Error('send_message: "text" is required');
         if (!await host.agentExists(to)) {
           throw new Error(`send_message: agent not found: ${to}`);
         }
@@ -4115,7 +5051,7 @@ function messagingTools(host, fromAgentId) {
         const { messageId } = await host.sendMessage({
           from: fromAgentId,
           to,
-          payload: JSON.stringify({ text }),
+          payload: JSON.stringify({ text: text2 }),
           replyTo
         });
         return `sent message ${messageId}`;
@@ -4175,7 +5111,7 @@ function messagingTools(host, fromAgentId) {
     {
       def: {
         name: "wait_for_reply",
-        description: "Block until a reply to a message you sent arrives, or until the timeout expires.",
+        description: "Wait for a reply only when the peer does not need your current workspace. For shared-workspace preparation, send_message and end this turn; the inbox reply resumes work after cleanup releases ownership.",
         parameters: {
           type: "object",
           properties: {
@@ -4291,25 +5227,25 @@ function normalizeWhitespace(value) {
 function htmlToMarkdown(html) {
   const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
   const title = titleMatch ? normalizeWhitespace(stripTags(titleMatch[1] ?? "")) : void 0;
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
-  text = text.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
+  let text2 = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
+  text2 = text2.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
     const label = normalizeWhitespace(stripTags(body));
     return label ? `[${label}](${href})` : href;
   });
-  text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
+  text2 = text2.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
     const n = Math.max(1, Math.min(6, Number.parseInt(level, 10)));
     return `
 ${"#".repeat(n)} ${normalizeWhitespace(stripTags(body))}
 `;
   });
-  text = text.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, (_, body) => {
+  text2 = text2.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, (_, body) => {
     const label = normalizeWhitespace(stripTags(body));
     return label ? `
 - ${label}` : "";
   });
-  text = text.replace(/<(br|hr)\s*\/?>/gi, "\n").replace(/<\/(p|div|section|article|tr|ul|ol|table|blockquote)>/gi, "\n");
-  text = stripTags(text);
-  return { text: normalizeWhitespace(text), title };
+  text2 = text2.replace(/<(br|hr)\s*\/?>/gi, "\n").replace(/<\/(p|div|section|article|tr|ul|ol|table|blockquote)>/gi, "\n");
+  text2 = stripTags(text2);
+  return { text: normalizeWhitespace(text2), title };
 }
 function markdownToPlain(md) {
   let t = md;
@@ -4343,8 +5279,8 @@ function extractReadable(html, url, mode) {
     if (!parsed?.content) return fallback();
     const title = parsed.title || void 0;
     if (mode === "text") {
-      const text = normalizeWhitespace(parsed.textContent ?? "");
-      return text ? { text, title } : fallback();
+      const text2 = normalizeWhitespace(parsed.textContent ?? "");
+      return text2 ? { text: text2, title } : fallback();
     }
     const rendered = htmlToMarkdown(parsed.content);
     return { text: rendered.text, title: title ?? rendered.title };
@@ -4655,9 +5591,9 @@ async function readBodyCapped(res, maxBytes) {
   const decoder = new TextDecoder(charset, { fatal: false });
   const reader = res.body?.getReader();
   if (!reader) {
-    const text = await res.text();
-    if (text.length > maxBytes) return { text: text.slice(0, maxBytes), truncated: true };
-    return { text, truncated: false };
+    const text2 = await res.text();
+    if (text2.length > maxBytes) return { text: text2.slice(0, maxBytes), truncated: true };
+    return { text: text2, truncated: false };
   }
   const chunks = [];
   let total = 0;
@@ -4714,8 +5650,8 @@ async function firecrawlScrape(url, mode, env, fetchFn, timeoutMs) {
     if (!body.success || !body.data?.markdown) return null;
     const md = body.data.markdown;
     const title = body.data.metadata?.title;
-    const text = mode === "text" ? markdownToPlain(md) : md;
-    return title ? { text, title } : { text };
+    const text2 = mode === "text" ? markdownToPlain(md) : md;
+    return title ? { text: text2, title } : { text: text2 };
   } catch {
     return null;
   } finally {
@@ -4911,19 +5847,19 @@ function ourToolToPiTool(h) {
     name: h.def.name,
     label: h.def.name,
     description: h.def.description,
-    parameters: Type2.Unsafe(h.def.parameters),
-    async execute(_toolCallId, params) {
-      const out = await h.invoke(params);
+    parameters: Type4.Unsafe(h.def.parameters),
+    async execute(toolCallId, params) {
+      const out = await h.invoke(params, { toolCallId });
       return {
         content: toPiContent(out),
-        details: {}
+        details: typeof out === "object" && !Array.isArray(out) ? "result" in out ? { result: out.result } : { questionReceipt: out.questionReceipt } : {}
       };
     }
   };
 }
 function toPiContent(out) {
   if (typeof out === "string") return [{ type: "text", text: out }];
-  return out.map(
+  return (Array.isArray(out) ? out : out.content).map(
     (p) => p.type === "text" ? { type: "text", text: p.text } : { type: "image", data: p.data, mimeType: p.mimeType }
   );
 }
@@ -4947,8 +5883,9 @@ function createBazilionCustomTools(opts) {
     handlers.push(...mcpProxyTools(opts.mcpHost, opts.mcpTools));
   }
   if (opts.fileSink) {
-    handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink));
+    handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId));
   }
+  if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
 function createProtectedBazilionCustomTools(opts) {
@@ -4959,8 +5896,9 @@ function createProtectedBazilionCustomTools(opts) {
     protectedWebFetchTool(),
     ...messagingTools(opts.messagingHost, opts.agent.agent.id),
     ...userMdTools(opts.userMdHost, opts.agent.team.id),
-    deliverFileTool(opts.agent.team.path, opts.fileSink)
+    deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId)
   ];
+  if (opts.askUser) handlers.push(askUserTool(opts.askUser));
   return handlers.map(ourToolToPiTool);
 }
 
@@ -4984,6 +5922,7 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    askUser,
     bashApprovalHost,
     refreshApiKey,
     restricted
@@ -5005,8 +5944,10 @@ async function createBazilionSession(opts) {
   const cwd = agent.team.path;
   if (!existsSync14(cwd)) mkdirSync7(cwd, { recursive: true });
   const promptSkills = restricted ? [] : loadPromptSkills(paths.skillsDir, agent.skills);
-  const uploadsDir = join19(agent.agent.dir, "uploads");
+  const uploadsDir = join22(agent.agent.dir, "uploads");
   const shellTools = restricted ? null : createSessionShellTools(cwd, env, {
+    preparedDocker: opts.preparedDocker,
+    dockerLifecycle: opts.dockerLifecycle,
     ...existsSync14(uploadsDir) ? { inputsDir: uploadsDir } : {},
     skillMounts: promptSkills.map((skill) => ({
       source: skill.hostDir,
@@ -5014,9 +5955,9 @@ async function createBazilionSession(opts) {
     })),
     approvalHost: bashApprovalHost
   });
-  const sessionDir = restricted?.sessionDir ?? join19(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = restricted?.sessionDir ?? join22(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync7(sessionDir, { recursive: true });
-  const existing = restricted ? null : findMostRecent(sessionDir);
+  const existing = restricted ? null : explicitConversationFile(sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
   const settingsManager = SettingsManager.inMemory({
     compaction: { enabled: false },
@@ -5031,9 +5972,14 @@ async function createBazilionSession(opts) {
     skills: promptSkills,
     sandboxMode: shellTools?.config.sandboxMode ?? "off"
   });
+  const repository = !restricted && opts.repositoryContext && opts.repositoryContextHost ? repositoryContextIntegration(
+    opts.repositoryContext,
+    opts.repositoryContextHost,
+    shellTools?.config.sandboxMode === "docker" ? "/workspace" : cwd
+  ) : void 0;
   const resourceLoader = new DefaultResourceLoader({
     cwd,
-    agentDir: join19(paths.home, "pi"),
+    agentDir: join22(paths.home, "pi"),
     settingsManager,
     noExtensions: true,
     noSkills: true,
@@ -5042,6 +5988,7 @@ async function createBazilionSession(opts) {
     noContextFiles: true,
     appendSystemPrompt: bazilionPrompt ? [bazilionPrompt] : void 0
   });
+  if (repository) resourceLoader.getAgentsFiles = repository.files;
   await resourceLoader.reload();
   const bazilionTools = restricted ? restricted.tools : createBazilionCustomTools({
     agent,
@@ -5052,13 +5999,31 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    askUser,
+    sessionId: sessionManager.getSessionId(),
     env
   });
+  if (repository) bazilionTools.push(repository.tool);
+  if (repository && opts.codingHost && shellTools && shellTools.config.sandboxMode === "docker" && !opts.preparedDocker)
+    throw new Error("Coding commands require the admitted Docker runtime");
+  if (repository && opts.codingHost && shellTools)
+    bazilionTools.push(
+      ...codingTools({
+        host: opts.codingHost,
+        root: cwd,
+        context: repository.resolve,
+        docker: opts.preparedDocker,
+        lifecycle: opts.dockerLifecycle,
+        approval: shellTools.config.approvalMode === "dangerous",
+        approvalHost: bashApprovalHost,
+        secrets: Object.entries(env).filter(([key]) => /KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)).map(([, value]) => value ?? "")
+      })
+    );
   const customTools = shellTools?.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
   const allowedTools = [...shellTools?.hostToolNames ?? [], ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join19(paths.home, "pi"),
+    agentDir: join22(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(restricted?.reasoningLevel ?? agent.reasoningLevel),
     tools: allowedTools,
@@ -5068,6 +6033,7 @@ async function createBazilionSession(opts) {
     modelRuntime,
     resourceLoader
   });
+  repository?.bind(session, allowedTools);
   if (refreshApiKey) {
     session.agent.getApiKey = async (requestedProvider) => {
       if (requestedProvider !== piProviderName(providerName)) return void 0;
@@ -5112,10 +6078,12 @@ async function createProtectedBazilionSession(opts) {
   const shellTools = createProtectedSessionShellTools(
     opts.paths.teamDir,
     opts.docker,
-    opts.bashApprovalHost
+    opts.bashApprovalHost,
+    opts.dockerLifecycle
   );
+  const modelCwd = codingContainerCwd(opts.docker.coding?.cwd ?? ".");
   mkdirSync7(opts.paths.sessionDir, { recursive: true });
-  const existing = findMostRecent(opts.paths.sessionDir);
+  const existing = explicitConversationFile(opts.paths.sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, opts.paths.sessionDir, opts.paths.teamDir) : SessionManager.create(opts.paths.teamDir, opts.paths.sessionDir);
   const settingsManager = createInMemorySettingsManager();
   const bazilionPrompt = redactJsonValue(
@@ -5126,8 +6094,13 @@ async function createProtectedBazilionSession(opts) {
     }),
     protectedRuntimeSecrets(opts.runtime)
   );
+  const repository = opts.repositoryContext && opts.repositoryContextHost ? repositoryContextIntegration(
+    redactJsonValue(opts.repositoryContext, protectedRuntimeSecrets(opts.runtime)),
+    opts.repositoryContextHost,
+    PROTECTED_MODEL_CWD
+  ) : void 0;
   const resourceLoader = new DefaultResourceLoader({
-    cwd: PROTECTED_MODEL_CWD,
+    cwd: modelCwd,
     agentDir: opts.scratch.piAgentDir,
     settingsManager,
     noExtensions: true,
@@ -5138,18 +6111,35 @@ async function createProtectedBazilionSession(opts) {
     systemPrompt: PROTECTED_BASE_SYSTEM_PROMPT,
     appendSystemPrompt: bazilionPrompt ? [bazilionPrompt] : void 0
   });
+  if (repository) resourceLoader.getAgentsFiles = repository.files;
   await resourceLoader.reload();
   const bazilionTools = createProtectedBazilionCustomTools({
     agent: opts.agent,
     memory: opts.memory,
     messagingHost: opts.messagingHost,
     userMdHost: opts.userMdHost,
-    fileSink: opts.fileSink
+    fileSink: opts.fileSink,
+    askUser: opts.askUser,
+    sessionId: sessionManager.getSessionId()
   });
+  if (repository) bazilionTools.push(repository.tool);
+  if (repository && opts.codingHost)
+    bazilionTools.push(
+      ...codingTools({
+        host: opts.codingHost,
+        root: opts.paths.teamDir,
+        context: repository.resolve,
+        docker: opts.docker,
+        lifecycle: opts.dockerLifecycle,
+        approval: true,
+        approvalHost: opts.bashApprovalHost,
+        secrets: protectedRuntimeSecrets(opts.runtime)
+      })
+    );
   if (!shellTools.customBash) throw new Error("protected Docker bash tool is unavailable");
   const customTools = [...bazilionTools, shellTools.customBash];
   const { session } = await createAgentSession({
-    cwd: PROTECTED_MODEL_CWD,
+    cwd: modelCwd,
     agentDir: opts.scratch.piAgentDir,
     model,
     thinkingLevel: toPiThinkingLevel(opts.runtime.reasoningLevel),
@@ -5160,6 +6150,10 @@ async function createProtectedBazilionSession(opts) {
     modelRuntime,
     resourceLoader
   });
+  repository?.bind(
+    session,
+    customTools.map((tool) => tool.name)
+  );
   installProtectedCredentialBoundary(
     session,
     opts.runtime.providerName,
@@ -5222,7 +6216,7 @@ async function createRestrictedReviewSession(opts) {
 function materializeProtectedCredentialFile(runtime, scratch) {
   const fields = [...runtime.credentialEnv ?? []];
   if (runtime.credentialFile) {
-    const path = join19(scratch.tempDir, "provider-credential.json");
+    const path = join22(scratch.tempDir, "provider-credential.json");
     writeFileSync9(path, runtime.credentialFile.content, {
       encoding: "utf8",
       mode: 384,
@@ -5357,19 +6351,12 @@ function toPiThinkingLevel(level) {
       return "medium";
   }
 }
-function findMostRecent(sessionDir) {
-  if (!existsSync14(sessionDir)) return null;
-  let newest = null;
-  for (const entry of readdirSync8(sessionDir)) {
-    if (!entry.endsWith(".jsonl")) continue;
-    const path = join19(sessionDir, entry);
-    try {
-      const s = statSync5(path);
-      if (!newest || s.mtimeMs > newest.mtimeMs) newest = { path, mtimeMs: s.mtimeMs };
-    } catch {
-    }
-  }
-  return newest?.path ?? null;
+function explicitConversationFile(directory, target) {
+  if (!target || !/^[0-9a-f-]{36}$/i.test(target.id) || target.filename !== `${target.id}.jsonl`)
+    throw new Error("Explicit conversation target is required");
+  const file = join22(directory, target.filename);
+  readCanonicalSessionFile(directory, target.filename, target.id);
+  return file;
 }
 
 // ../daemon/src/runtime/worker/api-key-refresh.ts
@@ -5488,6 +6475,21 @@ function createIpcMessagingHost(call) {
     approvalStatus: (agentId, approvalId) => call("approvalStatus", { agentId, approvalId })
   };
 }
+function createIpcDockerLifecycle(namespace, call) {
+  if (!namespace) return void 0;
+  return {
+    name: (kind) => `bazilion-${namespace}-${kind}-${randomUUID20()}`,
+    beforeCreate: async (identity2) => {
+      await call("containerBeforeCreate", { containerName: identity2.containerName });
+    },
+    afterCreate: async (containerName) => {
+      await call("containerAfterCreate", { containerName });
+    },
+    afterRemove: async (containerName) => {
+      await call("containerAfterRemove", { containerName });
+    }
+  };
+}
 function createIpcUserMdHost(call) {
   return {
     get: (teamId) => call("userMdGet", { teamId }),
@@ -5533,13 +6535,13 @@ function createReviewState(evidenceItems) {
       name: "propose_lesson",
       label: "propose_lesson",
       description: "Submit zero to five evidence-backed lesson proposals in one final batch. This is the only available action.",
-      parameters: Type3.Object({
-        proposals: Type3.Array(
-          Type3.Object({
-            scope: Type3.Union([Type3.Literal("private"), Type3.Literal("shared")]),
-            text: Type3.String({ minLength: 1, maxLength: 500 }),
-            evidenceEntryIds: Type3.Array(
-              Type3.Object({ sessionId: Type3.String(), entryOrdinal: Type3.Integer({ minimum: 0 }) }),
+      parameters: Type5.Object({
+        proposals: Type5.Array(
+          Type5.Object({
+            scope: Type5.Union([Type5.Literal("private"), Type5.Literal("shared")]),
+            text: Type5.String({ minLength: 1, maxLength: 500 }),
+            evidenceEntryIds: Type5.Array(
+              Type5.Object({ sessionId: Type5.String(), entryOrdinal: Type5.Integer({ minimum: 0 }) }),
               { minItems: 1 }
             )
           }),
@@ -5551,14 +6553,14 @@ function createReviewState(evidenceItems) {
         const input = params;
         const validated = [];
         for (const candidate of input.proposals) {
-          const text = candidate.text.trim();
-          if (!text || text.length > 500) throw new Error("proposal text must be 1-500 characters");
+          const text2 = candidate.text.trim();
+          if (!text2 || text2.length > 500) throw new Error("proposal text must be 1-500 characters");
           for (const evidence of candidate.evidenceEntryIds) {
             if (!allowedEvidence.has(`${evidence.sessionId}:${evidence.entryOrdinal}`)) {
               throw new Error("proposal cites evidence outside the supplied digest");
             }
           }
-          validated.push({ ...candidate, text });
+          validated.push({ ...candidate, text: text2 });
         }
         proposalBatchSubmitted = true;
         proposals.push(...validated);
@@ -5581,6 +6583,8 @@ function createReviewState(evidenceItems) {
   };
 }
 async function createSessionForInput(input, ipcCall) {
+  if (input.kind !== "restricted_review" && !input.repositoryContext)
+    throw new Error("Coding turn requires daemon-prepared repository context");
   if (input.kind === "configured_operator_http") {
     const paths = resolvePaths();
     const memory2 = qmdBackend(`${input.agent.team.path}/memory`);
@@ -5602,6 +6606,12 @@ async function createSessionForInput(input, ipcCall) {
     }) : void 0;
     const handle2 = await createBazilionSession({
       agent: input.agent,
+      preparedDocker: input.configuredDocker?.docker,
+      dockerLifecycle: createIpcDockerLifecycle(input.containerNamespace, ipcCall),
+      conversation: input.conversation,
+      repositoryContext: input.repositoryContext,
+      repositoryContextHost: (target) => ipcCall("repositoryContext", { target }),
+      codingHost: { invoke: (request) => ipcCall("coding", request) },
       paths,
       env: process.env,
       memory: memory2,
@@ -5614,7 +6624,15 @@ async function createSessionForInput(input, ipcCall) {
       mcpHost,
       mcpTools: input.mcpTools,
       bashApprovalHost: bashApprovalHost2,
-      fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
+      askUser: input.questionEnabled ? (toolCallId, question) => ipcCall("askUser", { toolCallId, question }) : void 0,
+      fileSink: async (file, source) => {
+        const result = await ipcCall(
+          "publishResult",
+          { ...file, ...source }
+        );
+        emit({ kind: "event", event: { type: "file", ...file, result } });
+        return result;
+      }
     });
     return { handle: handle2 };
   }
@@ -5646,16 +6664,29 @@ async function createSessionForInput(input, ipcCall) {
   });
   const handle = await createProtectedBazilionSession({
     agent: input.agent,
+    conversation: input.conversation,
+    repositoryContext: input.repositoryContext,
+    repositoryContextHost: (target) => ipcCall("repositoryContext", { target }),
+    codingHost: { invoke: (request) => ipcCall("coding", request) },
     runtime: input.runtime,
     paths: input.paths,
     scratch: input.scratch,
     docker: input.docker,
+    dockerLifecycle: createIpcDockerLifecycle(input.containerNamespace, ipcCall),
     memory,
     messagingHost,
     userMdHost,
     bashApprovalHost,
+    askUser: input.questionEnabled ? (toolCallId, question) => ipcCall("askUser", { toolCallId, question }) : void 0,
     refreshApiKey,
-    fileSink: (file) => emit({ kind: "event", event: { type: "file", ...file } })
+    fileSink: async (file, source) => {
+      const result = await ipcCall("publishResult", {
+        ...file,
+        ...source
+      });
+      emit({ kind: "event", event: { type: "file", ...file, result } });
+      return result;
+    }
   });
   return { handle };
 }
@@ -5684,7 +6715,30 @@ async function main() {
   const ipcCall = createWorkerIpcCall();
   const { handle, reviewState } = await createSessionForInput(input, ipcCall);
   session = handle.session;
+  const consumptionAcks = /* @__PURE__ */ new Set();
   const unsubscribe = session.subscribe((piEvent) => {
+    if (input.kind !== "restricted_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
+      const message = piEvent.message;
+      const content = message.content[0];
+      if (content?.type === "text") {
+        try {
+          const result = JSON.parse(content.text);
+          if (typeof result.questionId === "string") {
+            const ack = new Promise((resolve6) => setImmediate(resolve6)).then(
+              () => ipcCall("questionConsumed", {
+                questionId: result.questionId,
+                toolCallId: message.toolCallId
+              })
+            ).catch(() => {
+            }).finally(() => {
+              consumptionAcks.delete(ack);
+            });
+            consumptionAcks.add(ack);
+          }
+        } catch {
+        }
+      }
+    }
     if (reviewState && piEvent.type === "tool_execution_end" && piEvent.toolName === "propose_lesson" && piEvent.isError) {
       reviewState.recordValidationFailure();
       if (reviewState.validationFailures() >= 2) void session?.abort();
@@ -5704,6 +6758,7 @@ async function main() {
       promptImages.length > 0 ? { images: promptImages } : void 0
     );
     await session.agent.waitForIdle();
+    await Promise.all(consumptionAcks);
     if (reviewState) {
       if (reviewState.validationFailures() >= 2) {
         throw new Error("review output remained invalid after one schema-repair attempt");