bazilion 0.15.0 → 0.17.0

package/dist/worker.js

@@ -2,7 +2,7 @@
 
 // ../daemon/src/runtime/worker/entry.ts
 import { randomUUID as randomUUID20 } from "crypto";
-import { Type as Type3 } from "typebox";
+import { Type as Type5 } from "typebox";
 
 // ../daemon/src/core/agent/delete.ts
 import { randomUUID } from "crypto";
@@ -1108,6 +1108,41 @@ function qmdBackend(root, options = {}) {
   };
 }
 
+// ../daemon/src/lib/coding-environment/receipt-reference.ts
+function codingLogReference(content) {
+  const parsed = objectFrom(textContent(content));
+  if (!parsed) return null;
+  return referenceFrom(parsed) ?? referenceFrom(objectFrom(parsed.receipt));
+}
+function referenceFrom(value) {
+  if (!value) return null;
+  const commandId = value.id;
+  const teamId = value.teamId;
+  if (typeof commandId !== "string" || commandId.length === 0) return null;
+  if (typeof teamId !== "string" || teamId.length === 0) return null;
+  return { commandId, teamId };
+}
+function textContent(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  let out = "";
+  for (const block of content) {
+    if (block && block.type === "text" && typeof block.text === "string") out += block.text;
+  }
+  return out;
+}
+function objectFrom(value) {
+  if (typeof value === "string") {
+    try {
+      return objectFrom(JSON.parse(value));
+    } catch {
+      return null;
+    }
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value;
+}
+
 // ../daemon/src/runtime/pi/events.ts
 function translatePiEvent(e) {
   switch (e.type) {
@@ -1128,8 +1163,8 @@ function translatePiEvent(e) {
       const m = e.message;
       if (m.role !== "assistant") return [];
       const out = [];
-      const text = extractAssistantText(m);
-      if (text) out.push({ type: "assistant_message", text });
+      const text2 = extractAssistantText(m);
+      if (text2) out.push({ type: "assistant_message", text: text2 });
       for (const block of m.content ?? []) {
         if (block.type === "toolCall") {
           out.push({
@@ -1147,6 +1182,22 @@ function translatePiEvent(e) {
       }
       return out;
     }
+    case "tool_execution_update": {
+      if (e.toolName !== "coding_command") return [];
+      const progress = e.partialResult?.details?.codingProgress;
+      if (!progress || typeof progress.id !== "string" || typeof progress.commandId !== "string" || typeof progress.output !== "string" || typeof progress.elapsedMs !== "number")
+        return [];
+      return [
+        {
+          type: "coding_progress",
+          id: progress.id,
+          commandId: progress.commandId,
+          output: progress.output,
+          truncated: progress.truncated === true,
+          elapsedMs: Math.max(0, Math.floor(progress.elapsedMs))
+        }
+      ];
+    }
     case "tool_execution_end": {
       if (e.toolName === "ask_user")
         return [
@@ -1157,9 +1208,9 @@ function translatePiEvent(e) {
             result: "Question outcome is available through the question card or authorized conversation history."
           }
         ];
-      const text = extractToolResultText(e.result);
+      const text2 = extractToolResultText(e.result);
       if (e.isError) {
-        return [{ type: "tool_error", id: e.toolCallId, name: e.toolName, error: text }];
+        return [{ type: "tool_error", id: e.toolCallId, name: e.toolName, error: text2 }];
       }
       const images = extractToolResultImages(e.result);
       return [
@@ -1167,7 +1218,7 @@ function translatePiEvent(e) {
           type: "tool_result",
           id: e.toolCallId,
           name: e.toolName,
-          result: text,
+          result: text2,
           resultReference: extractResultReference(e.result),
           ...images.length > 0 ? { images } : {}
         }
@@ -1245,15 +1296,34 @@ function piMessagesToProviderView(messages, questionResultVisible) {
       }
       case "assistant": {
         const am = m;
-        const text = extractAssistantText(am);
+        const text2 = extractAssistantText(am);
         const toolCalls = extractAssistantToolCalls(am);
-        const msg = { role: "assistant", content: text };
+        const msg = { role: "assistant", content: text2 };
         if (toolCalls.length > 0) msg.toolCalls = toolCalls;
         out.push(msg);
         break;
       }
       case "toolResult": {
         const tr = m;
+        if ([
+          "repository_context",
+          "coding_environment",
+          "coding_command",
+          "coding_receipt",
+          "coding_log",
+          // BAZ-042: a snapshot result names withheld paths, so history must not render it.
+          "source_snapshot"
+        ].includes(tr.toolName ?? "")) {
+          const codingLog = codingLogReference(tr.content);
+          out.push({
+            role: "tool",
+            toolCallId: tr.toolCallId,
+            toolName: tr.toolName,
+            content: "Coding context or command evidence retained privately. Captured transport output follows its communication approval; ask the Agent for the relevant result.",
+            ...codingLog ? { codingLog } : {}
+          });
+          break;
+        }
         if (tr.toolName === "ask_user" && !questionResultVisible?.(m)) {
           out.push({
             role: "tool",
@@ -1287,6 +1357,107 @@ function extractResultReference(value) {
   return typeof id === "string" && /^[a-f0-9-]{36}$/.test(id) ? { resultId: id } : void 0;
 }
 
+// ../daemon/src/lib/coding-environment/diagnostics.ts
+var CODING_OUTPUT_BYTES = 64 * 1024;
+var CODING_RETAINED_BYTES = 2 * 1024 * 1024;
+var CODING_LIVE_BYTES = 8 * 1024;
+function diagnosticTail(value, limit) {
+  const bytes = Buffer.from(value);
+  if (bytes.length <= limit) return { text: value, truncated: false };
+  let offset = bytes.length - limit;
+  while (offset < bytes.length && ((bytes[offset] ?? 0) & 192) === 128) offset++;
+  return { text: bytes.subarray(offset).toString("utf8"), truncated: true };
+}
+var CodingDiagnostics = class {
+  decoder = new TextDecoder();
+  secrets;
+  lookbehind;
+  retainBytes;
+  pending = "";
+  text = "";
+  truncated = false;
+  observedBytes = 0;
+  redactions = 0;
+  finished = false;
+  constructor(secrets, retainBytes = CODING_OUTPUT_BYTES) {
+    this.secrets = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+    this.lookbehind = Math.max(1, ...this.secrets.map((secret) => secret.length)) - 1;
+    this.retainBytes = retainBytes;
+  }
+  append(bytes) {
+    if (this.finished) throw new Error("Coding diagnostics already finalized");
+    this.observedBytes += bytes.length;
+    for (let offset = 0; offset < bytes.length; offset += 8192) {
+      this.pending += this.decoder.decode(bytes.subarray(offset, offset + 8192), { stream: true });
+      this.flush(false);
+    }
+  }
+  /**
+   * Redacted cumulative tail for a live update. Unlike `finish()` this does not seal
+   * the diagnostics: more output may follow. It deliberately excludes the trailing
+   * lookbehind bytes so a credential split across chunks cannot leak before the next
+   * chunk resolves it.
+   */
+  preview(limit = CODING_LIVE_BYTES) {
+    return diagnosticTail(this.text, limit);
+  }
+  finish() {
+    if (!this.finished) {
+      this.pending += this.decoder.decode();
+      this.flush(true);
+      this.finished = true;
+    }
+    return {
+      diagnostic: this.text,
+      truncated: this.truncated,
+      observedBytes: this.observedBytes,
+      redacted: this.redactions > 0
+    };
+  }
+  flush(final) {
+    let end = final ? this.pending.length : Math.max(0, this.pending.length - this.lookbehind);
+    const last = this.pending.charCodeAt(end - 1);
+    if (!final && last >= 55296 && last <= 56319) end--;
+    let offset = 0;
+    let safe = "";
+    while (offset < end) {
+      const secret = this.secrets.find((value) => this.pending.startsWith(value, offset));
+      if (secret) {
+        safe += "[redacted]";
+        this.redactions++;
+        offset += secret.length;
+      } else {
+        const code = this.pending.charCodeAt(offset);
+        const char = this.pending[offset] ?? "";
+        safe += code < 32 && code !== 9 && code !== 10 || code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : char;
+        offset++;
+      }
+    }
+    this.pending = this.pending.slice(offset);
+    const tail = diagnosticTail(this.text + safe, this.retainBytes);
+    this.text = tail.text;
+    this.truncated ||= tail.truncated;
+  }
+};
+function codingSecrets(env) {
+  const values = /* @__PURE__ */ new Set();
+  function collect(value, depth = 0) {
+    if (depth > 8) return;
+    if (typeof value === "string" && value.length >= 4) values.add(value);
+    else if (value && typeof value === "object")
+      for (const entry of Object.values(value)) collect(entry, depth + 1);
+  }
+  for (const [key, value] of Object.entries(env)) {
+    if (!value || !/KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)) continue;
+    values.add(value);
+    try {
+      collect(JSON.parse(value));
+    } catch {
+    }
+  }
+  return [...values];
+}
+
 // ../daemon/src/lib/result-source.ts
 import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, openSync as openSync2, readSync, realpathSync as realpathSync2 } from "fs";
 import { basename as basename2, join as join13 } from "path";
@@ -1302,16 +1473,16 @@ function readCanonicalSessionFile(directory, filename, sessionId, minimumEntryOf
     if (!stat2.isFile() || stat2.size > 64 * 1024 * 1024)
       throw new Error("Result source session is unavailable or too large");
     const buffer = Buffer.alloc(stat2.size + 1);
-    let count = 0;
-    while (count < buffer.length) {
-      const n = readSync(fd, buffer, count, buffer.length - count, null);
+    let count2 = 0;
+    while (count2 < buffer.length) {
+      const n = readSync(fd, buffer, count2, buffer.length - count2, null);
       if (n === 0) break;
-      count += n;
+      count2 += n;
     }
-    if (count !== stat2.size) throw new Error("Result source session changed while reading");
+    if (count2 !== stat2.size) throw new Error("Result source session changed while reading");
     const entries = [];
     let position = 0;
-    for (const line of buffer.subarray(0, count).toString("utf8").split("\n")) {
+    for (const line of buffer.subarray(0, count2).toString("utf8").split("\n")) {
       if (line.trim()) entries.push({ entry: JSON.parse(line), offset: position });
       position += Buffer.byteLength(line) + 1;
     }
@@ -1324,876 +1495,640 @@ function readCanonicalSessionFile(directory, filename, sessionId, minimumEntryOf
   }
 }
 
-// ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename4, join as join20 } from "path";
+// ../daemon/src/runtime/pi/coding.ts
 import {
-  createAssistantMessageEventStream
-} from "@earendil-works/pi-ai";
-import {
-  buildSessionContext,
-  createAgentSession,
-  DefaultResourceLoader,
-  SessionManager,
-  SettingsManager
+  createLocalBashOperations
 } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
 
-// ../daemon/src/runtime/providers/pi-runtime.ts
-import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
-import { ModelRuntime } from "@earendil-works/pi-coding-agent";
-var PROVIDER_ALIASES = {
-  bedrock: "amazon-bedrock",
-  "azure-openai": "azure-openai-responses"
-};
-var PROTECTED_PROVIDER_NAMES = [
-  "anthropic",
-  "openai",
-  "openai-codex",
-  "google",
-  "google-vertex",
-  "azure-openai",
-  "bedrock",
-  "mistral",
-  "groq",
-  "cerebras",
-  "xai",
-  "zai",
-  "huggingface",
-  "openrouter",
-  "vercel-ai-gateway",
-  "deepseek",
-  "fireworks",
-  "together",
-  "baseten",
-  "moonshotai",
-  "moonshotai-cn",
-  "kimi-coding",
-  "minimax",
-  "minimax-cn",
-  "qwen-token-plan",
-  "qwen-token-plan-cn",
-  "qwen-token-plan-individual",
-  "xiaomi",
-  "xiaomi-token-plan-ams",
-  "xiaomi-token-plan-cn",
-  "xiaomi-token-plan-sgp",
-  "ant-ling",
-  "nvidia",
-  "opencode",
-  "opencode-go",
-  "zai-coding-cn",
-  "github-copilot",
-  "cloudflare-ai-gateway",
-  "cloudflare-workers-ai",
-  "lmstudio",
-  "ollama",
-  "llamacpp"
-];
-var LOCAL_PROVIDERS = {
-  lmstudio: {
-    baseUrl: "http://127.0.0.1:1234/v1",
-    apiKey: "lm-studio",
-    authHeader: false
-  },
-  ollama: { baseUrl: "http://127.0.0.1:11434/v1", apiKey: "ollama", authHeader: false },
-  llamacpp: { baseUrl: "http://127.0.0.1:8080/v1", apiKey: "no-key", authHeader: true }
-};
-var PROVIDER_API_KEY_ENV = {
-  anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
-  openai: ["OPENAI_API_KEY"],
-  google: ["GEMINI_API_KEY"],
-  "azure-openai": ["AZURE_OPENAI_API_KEY"],
-  mistral: ["MISTRAL_API_KEY"],
-  groq: ["GROQ_API_KEY"],
-  cerebras: ["CEREBRAS_API_KEY"],
-  xai: ["XAI_API_KEY"],
-  zai: ["ZAI_API_KEY"],
-  huggingface: ["HF_TOKEN"],
-  openrouter: ["OPENROUTER_API_KEY"],
-  "vercel-ai-gateway": ["AI_GATEWAY_API_KEY"],
-  deepseek: ["DEEPSEEK_API_KEY"],
-  fireworks: ["FIREWORKS_API_KEY"],
-  together: ["TOGETHER_API_KEY"],
-  baseten: ["BASETEN_API_KEY"],
-  moonshotai: ["MOONSHOT_API_KEY"],
-  "moonshotai-cn": ["MOONSHOT_CN_API_KEY"],
-  "kimi-coding": ["KIMI_API_KEY"],
-  minimax: ["MINIMAX_API_KEY"],
-  "minimax-cn": ["MINIMAX_CN_API_KEY"],
-  "qwen-token-plan": ["QWEN_TOKEN_PLAN_API_KEY"],
-  "qwen-token-plan-cn": ["QWEN_TOKEN_PLAN_CN_API_KEY"],
-  "qwen-token-plan-individual": ["QWEN_TOKEN_PLAN_API_KEY"],
-  xiaomi: ["XIAOMI_API_KEY"],
-  "xiaomi-token-plan-ams": ["XIAOMI_TOKEN_PLAN_AMS_API_KEY"],
-  "xiaomi-token-plan-cn": ["XIAOMI_TOKEN_PLAN_CN_API_KEY"],
-  "xiaomi-token-plan-sgp": ["XIAOMI_TOKEN_PLAN_SGP_API_KEY"],
-  "ant-ling": ["ANT_LING_API_KEY"],
-  nvidia: ["NVIDIA_API_KEY"],
-  opencode: ["OPENCODE_API_KEY"],
-  "opencode-go": ["OPENCODE_GO_API_KEY"],
-  "zai-coding-cn": ["ZAI_CODING_CN_API_KEY"],
-  "github-copilot": ["COPILOT_GITHUB_TOKEN"],
-  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY"],
-  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY"],
-  lmstudio: ["LMSTUDIO_API_KEY"],
-  ollama: ["OLLAMA_API_KEY"],
-  llamacpp: ["LLAMACPP_API_KEY"]
-};
-var PROVIDER_CREDENTIAL_ENV = {
-  bedrock: [
-    "AWS_PROFILE",
-    "AWS_BEARER_TOKEN_BEDROCK",
-    "AWS_ACCESS_KEY_ID",
-    "AWS_SECRET_ACCESS_KEY",
-    "AWS_SESSION_TOKEN",
-    "AWS_REGION",
-    "AWS_DEFAULT_REGION"
-  ],
-  "google-vertex": [
-    "GOOGLE_CLOUD_PROJECT",
-    "GOOGLE_CLOUD_LOCATION",
-    "GOOGLE_APPLICATION_CREDENTIALS"
-  ],
-  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_GATEWAY_ID"],
-  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID"]
+// ../daemon/src/core/coding-environment/config.ts
+var CodingEnvironmentValidationError = class extends Error {
+  status = 400;
 };
-function piProviderName(providerName) {
-  return PROVIDER_ALIASES[providerName] ?? providerName;
+function invalid(field) {
+  throw new CodingEnvironmentValidationError(`Invalid coding environment ${field}`);
+}
+function object(value, keys2, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) invalid(field);
+  const record = value;
+  if (Object.keys(record).some((key) => !keys2.includes(key))) invalid(field);
+  return record;
+}
+function text(value, max, field) {
+  if (typeof value !== "string" || !value.trim() || Buffer.byteLength(value) > max || Array.from(value).some((char) => {
+    const code = char.charCodeAt(0);
+    return code === 127 || code < 32 && code !== 9 && code !== 10;
+  }))
+    invalid(field);
+  return value;
 }
-function providerApiKey(providerName, env) {
-  for (const name of PROVIDER_API_KEY_ENV[providerName] ?? []) {
-    const value = env[name];
-    if (value) return value;
-  }
-  return LOCAL_PROVIDERS[providerName]?.apiKey;
+function codingRelativePath(value, field = "cwd") {
+  const path = text(value, 4096, field);
+  if (path === ".") return path;
+  const parts = path.split("/");
+  if (parts.length > 16 || path.includes("\\") || Array.from(path).some((char) => char.charCodeAt(0) < 32) || parts.some((part) => !part || part === "." || part === ".." || part === ".git"))
+    invalid(field);
+  return path;
+}
+function validateCodingCommand(input) {
+  const value = object(input, ["command", "cwd", "purpose", "timeoutSeconds"], "command");
+  const command = text(value.command, 4096, "command");
+  if (command.includes("\0")) invalid("command");
+  const cwd = codingRelativePath(value.cwd);
+  if (!["runtime", "dependency", "prepare", "build", "test"].includes(String(value.purpose)))
+    invalid("purpose");
+  if (!Number.isInteger(value.timeoutSeconds) || Number(value.timeoutSeconds) < 1 || Number(value.timeoutSeconds) > 300)
+    invalid("timeout");
+  return {
+    command,
+    cwd,
+    purpose: value.purpose,
+    timeoutSeconds: value.timeoutSeconds
+  };
 }
-function providerBaseUrl(providerName, env) {
-  switch (providerName) {
-    case "lmstudio":
-      return env.LMSTUDIO_URL ?? LOCAL_PROVIDERS.lmstudio?.baseUrl;
-    case "ollama":
-      return env.OLLAMA_URL ?? LOCAL_PROVIDERS.ollama?.baseUrl;
-    case "llamacpp":
-      return env.LLAMACPP_URL ?? LOCAL_PROVIDERS.llamacpp?.baseUrl;
-    case "vercel-ai-gateway":
-      return env.AI_GATEWAY_BASE_URL;
-    default:
-      return void 0;
+
+// ../daemon/src/runtime/coding-directory.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { join as join15 } from "path";
+
+// ../daemon/src/lib/repository-context/files.ts
+import { createHash as createHash6 } from "crypto";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  fstatSync as fstatSync3,
+  lstatSync as lstatSync2,
+  opendirSync,
+  openSync as openSync3,
+  readSync as readSync2,
+  realpathSync as realpathSync3
+} from "fs";
+import { isAbsolute as isAbsolute2, join as join14 } from "path";
+var hash = (value) => createHash6("sha256").update(value).digest("hex");
+var ContextReadError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
   }
-}
-function providerCredentialEnv(providerName, env) {
-  const result = {};
-  for (const name of PROVIDER_CREDENTIAL_ENV[providerName] ?? []) {
-    const value = env[name];
-    if (value !== void 0) result[name] = value;
+};
+function identity(stat2) {
+  return `${stat2.dev}:${stat2.ino}`;
+}
+function stamp(stat2) {
+  return `${identity(stat2)}:${stat2.size}:${stat2.mtimeMs}:${stat2.ctimeMs}`;
+}
+function relativeParts(target) {
+  if (target.length > 4096 || isAbsolute2(target) || [...target].some(
+    (char) => char === "\\" || char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127
+  ) || target.split("/").some((part) => part === ".." || part === ".git"))
+    throw new ContextReadError("unsafe_target");
+  const parts = target.split("/").filter((part) => part && part !== ".");
+  if (parts.length > 17) throw new ContextReadError("depth_limit");
+  return parts;
+}
+var ContextDirectory = class _ContextDirectory {
+  fd;
+  identity;
+  originalStamp;
+  children = [];
+  listing;
+  observedFiles = /* @__PURE__ */ new Map();
+  registeredPath;
+  label;
+  parent;
+  constructor(registeredPath, label = ".", parent) {
+    this.registeredPath = registeredPath;
+    this.label = label;
+    this.parent = parent;
+    if (process.platform !== "linux") throw new ContextReadError("safe_reads_unavailable");
+    const path = parent ? join14(parent.path, registeredPath) : realpathSync3(registeredPath);
+    this.fd = openSync3(path, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW);
+    const stat2 = fstatSync3(this.fd);
+    this.identity = hash(identity(stat2));
+    this.originalStamp = identity(stat2);
+  }
+  get path() {
+    return `/proc/self/fd/${this.fd}`;
+  }
+  directory(name) {
+    const child = new _ContextDirectory(
+      name,
+      this.label === "." ? name : `${this.label}/${name}`,
+      this
+    );
+    this.children.push(child);
+    return child;
   }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-function fallbackApi(providerName) {
-  switch (providerName) {
-    case "anthropic":
-      return "anthropic-messages";
-    case "google":
-      return "google-generative-ai";
-    case "google-vertex":
-      return "google-vertex";
-    case "azure-openai":
-      return "azure-openai-responses";
-    case "bedrock":
-      return "bedrock-converse-stream";
-    case "openai-codex":
-      return "openai-codex-responses";
-    default:
-      return "openai-completions";
+  entry(name) {
+    try {
+      return lstatSync2(join14(this.path, name));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new ContextReadError("unreadable");
+    }
   }
-}
-function fallbackPiModel(providerName, modelId, baseUrl) {
-  return {
-    id: modelId,
-    name: modelId,
-    api: fallbackApi(providerName),
-    provider: piProviderName(providerName),
-    baseUrl: baseUrl ?? "",
-    reasoning: false,
-    input: ["text"],
-    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    contextWindow: 32768,
-    maxTokens: 4096
-  };
-}
-async function createBazilionPiRuntime(options) {
-  const providerName = options.providerName;
-  const canonicalName = piProviderName(providerName);
-  const credentials = new InMemoryCredentialStore();
-  const apiKey = options.apiKey ?? providerApiKey(providerName, options.env);
-  const credentialEnv = providerCredentialEnv(providerName, options.env);
-  if (apiKey || credentialEnv) {
-    await credentials.modify(
-      canonicalName,
-      async () => canonicalName === "openai-codex" && apiKey ? {
-        type: "oauth",
-        access: apiKey,
-        // Bazilion owns refresh outside Pi. This deliberately empty value
-        // satisfies Pi's canonical OAuth shape but is never used because
-        // the token is long-lived only inside this one-shot runtime and
-        // mid-turn replacement is supplied through Agent.getApiKey.
-        refresh: "",
-        expires: Number.MAX_SAFE_INTEGER
-      } : {
-        type: "api_key",
-        ...apiKey ? { key: apiKey } : {},
-        ...credentialEnv ? { env: credentialEnv } : {}
+  list() {
+    const names = this.listNames();
+    this.listing = JSON.stringify(names);
+    return names;
+  }
+  listNames() {
+    const handle = opendirSync(this.path);
+    const names = [];
+    try {
+      let entry = handle.readSync();
+      while (entry) {
+        if (names.length >= 16384) throw new ContextReadError("directory_entry_limit");
+        names.push(entry.name);
+        entry = handle.readSync();
       }
-    );
+      return names.sort();
+    } finally {
+      handle.closeSync();
+    }
   }
-  const runtime = await ModelRuntime.create({ credentials, modelsPath: null });
-  const local = LOCAL_PROVIDERS[providerName];
-  const baseUrl = options.baseUrl ?? providerBaseUrl(providerName, options.env);
-  if (local) {
-    const modelId = options.modelId ?? "model-name";
-    const model = fallbackPiModel(providerName, modelId, baseUrl ?? local.baseUrl);
-    runtime.registerProvider(canonicalName, {
-      baseUrl: baseUrl ?? local.baseUrl,
-      api: "openai-completions",
-      authHeader: local.authHeader,
-      apiKey: apiKey ?? local.apiKey,
-      models: [model]
-    });
-  } else if (baseUrl) {
-    runtime.registerProvider(canonicalName, { baseUrl });
+  read(name, maxBytes) {
+    const entry = this.entry(name);
+    if (!entry) {
+      this.observedFiles.set(name, null);
+      return null;
+    }
+    if (!entry.isFile() || entry.isSymbolicLink()) throw new ContextReadError("unsafe_file");
+    if (entry.size > maxBytes) throw new ContextReadError("byte_limit");
+    let fd;
+    try {
+      fd = openSync3(
+        join14(this.path, name),
+        constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK
+      );
+      const before = fstatSync3(fd);
+      if (!before.isFile() || stamp(entry) !== stamp(before))
+        throw new ContextReadError("source_changed");
+      const buffer = Buffer.alloc(Math.min(maxBytes + 1, before.size + 1));
+      let size = 0;
+      while (size < buffer.length) {
+        const count2 = readSync2(fd, buffer, size, buffer.length - size, null);
+        if (!count2) break;
+        size += count2;
+      }
+      if (size > maxBytes || size !== before.size || stamp(fstatSync3(fd)) !== stamp(before)) {
+        throw new ContextReadError("source_changed");
+      }
+      this.observedFiles.set(name, stamp(before));
+      return buffer.subarray(0, size);
+    } catch (error) {
+      if (error instanceof ContextReadError) throw error;
+      throw new ContextReadError("unreadable");
+    } finally {
+      if (fd !== void 0) closeSync3(fd);
+    }
   }
-  return runtime;
-}
-async function createProtectedPiRuntime(options) {
-  const env = {};
-  for (const field of options.credentialEnv ?? []) env[field.name] = field.value;
-  return createBazilionPiRuntime({
-    providerName: options.providerName,
-    modelId: options.modelId,
-    env,
-    apiKey: options.apiKey,
-    baseUrl: options.baseUrl
-  });
-}
-function resolvePiModel(runtime, providerName, modelId, baseUrl) {
-  const known = runtime.getModel(piProviderName(providerName), modelId);
-  if (known) return baseUrl ? { ...known, baseUrl } : known;
-  return fallbackPiModel(providerName, modelId, baseUrl);
-}
-
-// ../daemon/src/runtime/auth/openai-codex.ts
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+  validate(skipGit = false, names) {
+    const currentPath = this.parent ? join14(this.parent.path, this.registeredPath) : realpathSync3(this.registeredPath);
+    const stat2 = lstatSync2(currentPath);
+    if (!stat2.isDirectory() || identity(stat2) !== this.originalStamp)
+      throw new ContextReadError("root_changed");
+    if (this.listing !== void 0 && JSON.stringify(this.listNames()) !== this.listing) {
+      throw new ContextReadError("source_changed");
+    }
+    for (const [name, previous] of this.observedFiles) {
+      if (names && !names.has(name)) continue;
+      const current = this.entry(name);
+      if ((current ? stamp(current) : null) !== previous)
+        throw new ContextReadError("source_changed");
+    }
+    for (const child of this.children) {
+      if (!skipGit || !child.label.split("/").includes(".git")) child.validate(skipGit, names);
+    }
+  }
+  close() {
+    for (const child of this.children) child.close();
+    closeSync3(this.fd);
+  }
+};
 
-// ../daemon/src/runtime/providers/pi-adapter.ts
-import {
-  Type
-} from "@earendil-works/pi-ai";
+// ../daemon/src/runtime/coding-directory.ts
+function resolveCodingDirectory(root, cwd) {
+  const directory = new ContextDirectory(root);
+  try {
+    let current = directory;
+    for (const part of relativeParts(cwd)) current = current.directory(part);
+    const path = realpathSync4(join15(root, cwd));
+    directory.validate();
+    return { path, identity: current.identity };
+  } finally {
+    directory.close();
+  }
+}
 
-// ../daemon/src/runtime/session/prompt.ts
-import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
-import { join as join14 } from "path";
+// ../daemon/src/runtime/shell/approval.ts
+import { defineTool } from "@earendil-works/pi-coding-agent";
 
-// ../daemon/src/runtime/safe-files.ts
-import {
-  closeSync as closeSync3,
-  constants as constants3,
-  fstatSync as fstatSync3,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync5,
-  openSync as openSync3,
-  readFileSync as readFileSync9,
-  realpathSync as realpathSync3
-} from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "path";
-function resolveRealDirectory(path) {
-  const requested = resolve4(path);
-  const entry = lstatSync2(requested);
-  if (entry.isSymbolicLink() || !entry.isDirectory()) {
-    throw new Error("expected a real directory");
+// ../daemon/src/runtime/shell/security.ts
+var DEFAULT_BASH_SANDBOX_IMAGE = "debian:bookworm-slim";
+var SAFE_SHELL_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "SHELL",
+  "TMPDIR",
+  "TZ"
+];
+var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var DOCKER_IMAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/;
+var DOCKER_CLIENT_CONTROL_ENV = /* @__PURE__ */ new Set([
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR"
+]);
+var SANDBOX_CONTROL_ENV = /* @__PURE__ */ new Set(["BASH_ENV"]);
+var SENSITIVE_HOME_PATH_RE = /(?:~(?:[A-Za-z0-9_-]+)?|\$(?:HOME|\{HOME\})|\/(?:home|Users)\/[^\s'"`;|&/]+|\/root)\/\.(?:ssh|aws|gnupg)(?:\/[^\s'"`;|&]*)?/gi;
+var SENSITIVE_FILE_RE = /(?:\bauth\.json\b|\bbazilion\.db\b|(?:^|[\s/'"=])\.env(?:\.[A-Za-z0-9_-]+)?(?=$|[\s/'"`;|&])|\/etc\/(?:shadow|sudoers)(?:\.d\/[^\s'"`;|&]+)?)/gim;
+var SENSITIVE_ENV_RE = /\b(?:OPENAI_CODEX_OAUTH|AWS_ACCESS_KEY_ID|AWS_PROFILE|GOOGLE_APPLICATION_CREDENTIALS|BAZILION_TOKEN|(?:[A-Z][A-Z0-9_]*_)?(?:API_KEY|ACCESS_TOKEN|AUTH_TOKEN|OAUTH_TOKEN|CLIENT_SECRET|SECRET_ACCESS_KEY|PRIVATE_KEY))\b/g;
+var REMOTE_PIPE_RE = /(?:^|[;&|(\n])\s*(?:command\s+)?(?:curl|wget)\b[^;&\n]*(?:\|\s*(?:(?:sudo|env)\s+)*(?:[^\s;&|()]+\/)?(?:sh|bash|dash|zsh|fish|node|python(?:3)?|perl|ruby)\b)/gim;
+var COMMAND_BOUNDARY_RE = /[;&|)\n]/;
+var ShellSecurityConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ShellSecurityConfigError";
   }
-  return realpathSync3(requested);
+};
+function isValidEnvName(name) {
+  return ENV_NAME_RE.test(name) && !RESERVED_OBJECT_KEYS.has(name);
 }
-function readRegularFileNoFollow(path) {
-  const entry = lstatSync2(path);
-  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
-  if (!entry.isFile()) throw new Error("target is not a regular file");
-  let fd;
-  try {
-    fd = openSync3(path, constants3.O_RDONLY | noFollowFlag());
-    if (!fstatSync3(fd).isFile()) throw new Error("target is not a regular file");
-    return readFileSync9(fd, "utf8");
-  } finally {
-    if (fd !== void 0) closeSync3(fd);
+function addRisk(command, risks, seen, input) {
+  const start = Math.max(0, input.start);
+  const end = Math.min(command.length, Math.max(start, input.end));
+  const key = `${input.code}:${start}:${end}`;
+  if (seen.has(key)) return;
+  seen.add(key);
+  risks.push({
+    code: input.code,
+    severity: input.severity ?? "danger",
+    message: input.message,
+    matchedText: command.slice(start, end),
+    span: { start, end }
+  });
+}
+function addRegexRisks(command, risks, seen, pattern, code, message) {
+  pattern.lastIndex = 0;
+  for (const match of command.matchAll(pattern)) {
+    if (match.index === void 0) continue;
+    let start = match.index;
+    let matchedText = match[0];
+    const leading = matchedText.match(/^[;&|(\n\s]+/);
+    if (leading) {
+      start += leading[0].length;
+      matchedText = matchedText.slice(leading[0].length);
+    }
+    addRisk(command, risks, seen, {
+      code,
+      message,
+      start,
+      end: start + matchedText.length
+    });
   }
 }
-function noFollowFlag() {
-  return typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
+function shellTokens(fragment) {
+  return Array.from(
+    fragment.matchAll(/"(?:\\.|[^"\\])*"|'[^']*'|[^\s]+/g),
+    (match) => match[0].replace(/^(?:"|')|(?:"|')$/g, "")
+  );
 }
-
-// ../daemon/src/runtime/session/prompt.ts
-var SANDBOX_SKILLS_DIR = "/skills";
-function loadPromptSkills(skillsDir, attachedNames) {
-  if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
-  const attached = new Set(attachedNames);
-  const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
-  const loaded = [];
-  for (const entry of discovered) {
-    const hostDir = join14(skillsDir, entry.name);
-    try {
-      const parsed = parseSkillContent(readRegularFileNoFollow(join14(hostDir, "SKILL.md")));
-      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
-      loaded.push({
-        name: entry.name,
-        description: parsed.frontmatter.description,
-        body: parsed.body.trim(),
-        hostDir,
-        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
-      });
-    } catch {
+function isBroadFilesystemTarget(rawTarget) {
+  const target = rawTarget.replace(/[;,]+$/, "");
+  if (target.startsWith("/")) return true;
+  return /^(?:\.|\.\/\*+|\*+|~(?:\/.*)?|\$(?:HOME|\{HOME\})(?:\/.*)?|\.\.(?:\/.*)?)$/.test(target);
+}
+function classifyBroadFilesystemOperations(command, risks, seen) {
+  const commandRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(rm|find|chmod|chown)\b[^;&|)\n]*/gim;
+  for (const match of command.matchAll(commandRe)) {
+    if (match.index === void 0 || !match[1]) continue;
+    const nameOffset = match[0].toLowerCase().indexOf(match[1].toLowerCase());
+    const start = match.index + nameOffset;
+    const text2 = command.slice(start, match.index + match[0].length).trimEnd();
+    const tokens = shellTokens(text2);
+    const name = tokens[0]?.toLowerCase();
+    const args = tokens.slice(1);
+    let risky = false;
+    if (name === "rm") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /[rR]/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
+    } else if (name === "find") {
+      const target = args.find((arg) => !arg.startsWith("-"));
+      risky = args.includes("-delete") && target !== void 0 && isBroadFilesystemTarget(target);
+    } else if (name === "chmod" || name === "chown") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /R/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
     }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "broad-destructive-operation",
+      message: "Recursively changes or deletes a broad filesystem target.",
+      start,
+      end: start + text2.length
+    });
   }
-  return loaded;
 }
-var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
-function loadProtectedHomeDocuments(agentDir) {
-  const root = resolveRealDirectory(agentDir);
-  const read = (file) => {
+function isLocalHostname(rawHostname) {
+  const hostname = rawHostname.trim().replace(/^.*@/, "").replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "0.0.0.0" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function hasExternalHttpDestination(segment) {
+  const urls = Array.from(segment.matchAll(/https?:\/\/[^\s'"`]+/gi), (match) => match[0]);
+  if (urls.length === 0) return true;
+  return urls.some((rawUrl) => {
     try {
-      return readRegularFileNoFollow(join14(root, file));
-    } catch (error) {
-      if (error.code === "ENOENT") return null;
-      throw new Error(`private Agent home is unsafe at ${file}`);
+      return !isLocalHostname(new URL(rawUrl).hostname);
+    } catch {
+      return true;
     }
-  };
-  return {
-    "AGENTS.md": read("AGENTS.md"),
-    "SOUL.md": read("SOUL.md"),
-    "TOOLS.md": read("TOOLS.md"),
-    "IDENTITY.md": read("IDENTITY.md"),
-    "BOOTSTRAP.md": read("BOOTSTRAP.md")
-  };
+  });
 }
-function buildSystemPrompt(agent, options = {}) {
-  const parts = [];
-  const homeDocuments = options.homeDocuments ?? loadProtectedHomeDocuments(agent.agent.dir);
-  const contextBlocks = [];
-  for (const file of CONTEXT_FILE_ORDER) {
-    const content = homeDocuments[file]?.trimEnd();
-    if (!content) continue;
-    contextBlocks.push(`## ${file}
-
-${content}`);
-  }
-  if (contextBlocks.length > 0) {
-    parts.push(`# Project Context
-
-${contextBlocks.join("\n\n")}`);
+function remoteTransferHosts(segment) {
+  const hosts = [];
+  const uriRe = /(?:sftp|ssh|rsync):\/\/(?:[^@\s/]+@)?(\[[^\]]+\]|[^\s/:]+)(?::\d+)?/gi;
+  for (const match of segment.matchAll(uriRe)) {
+    if (match[1]) hosts.push(match[1]);
   }
-  const bootstrap = homeDocuments["BOOTSTRAP.md"]?.trimEnd();
-  if (bootstrap) {
-    parts.push(
-      [
-        "# First-Run Ritual",
-        "",
-        "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
-        "",
-        "## Hard rules",
-        "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
-        "- Each subsequent turn: at most one new question. Wait between turns.",
-        "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
-        "",
-        "## BOOTSTRAP.md",
-        "",
-        bootstrap
-      ].join("\n")
-    );
+  const scpRe = /(?:^|\s)(?:[^@\s:]+@)?(\[[^\]]+\]|[A-Za-z0-9._-]+):[^\s]+/g;
+  for (const match of segment.matchAll(scpRe)) {
+    if (match[1]) hosts.push(match[1]);
   }
-  parts.push(
-    [
-      "# Agent Home",
-      "",
-      "Your private home holds who you are \u2014 identity, soul, and behaviour rules. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
-      "",
-      "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
-      "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
-      "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
-      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
-    ].join("\n")
-  );
-  if (agent.skills.length > 0) {
-    const loaded = options.skills ?? [];
-    const loadedNames = new Set(loaded.map((skill) => skill.name));
-    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
-    const skillBlocks = loaded.map((skill) => {
-      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
-      return [
-        `## ${skill.name}`,
-        "",
-        skill.description,
-        "",
-        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
-        "",
-        skill.body
-      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
+  return hosts;
+}
+function invocationSegment(command, match, commandName) {
+  if (match.index === void 0) return null;
+  const nameOffset = match[0].toLowerCase().indexOf(commandName.toLowerCase());
+  if (nameOffset < 0) return null;
+  const start = match.index + nameOffset;
+  const boundaryOffset = command.slice(start).search(COMMAND_BOUNDARY_RE);
+  const end = boundaryOffset < 0 ? command.length : start + boundaryOffset;
+  return { start, text: command.slice(start, end).trimEnd() };
+}
+function classifyOutboundExfiltration(command, risks, seen) {
+  const invocationRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(curl|wget|scp|rsync|nc|netcat|sftp)\b/gim;
+  for (const match of command.matchAll(invocationRe)) {
+    const name = match[1]?.toLowerCase();
+    if (!name) continue;
+    const segment = invocationSegment(command, match, name);
+    if (!segment) continue;
+    let risky = false;
+    if (name === "curl") {
+      const uploads = /(?:^|\s)(?:-X\s*POST\b|-[dFT](?:\s|[^\s]))/.test(segment.text) || /(?:^|\s)(?:--request(?:=|\s+)POST\b|--data(?:-[a-z-]+)?(?:=|\s)|--form(?:-string)?(?:=|\s)|--upload-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "wget") {
+      const uploads = /(?:^|\s)(?:--method(?:=|\s+)POST\b|--post-data(?:=|\s)|--post-file(?:=|\s)|--body-data(?:=|\s)|--body-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "scp" || name === "rsync") {
+      const hosts = remoteTransferHosts(segment.text);
+      risky = hosts.some((host) => !isLocalHostname(host)) || hosts.length === 0 && /\$/.test(segment.text);
+    } else if (name === "sftp") {
+      const hosts = remoteTransferHosts(segment.text);
+      if (hosts.length > 0) {
+        risky = hosts.some((host) => !isLocalHostname(host));
+      } else {
+        const destination = shellTokens(segment.text).at(-1);
+        risky = destination !== void 0 && destination !== name && !isLocalHostname(destination);
+      }
+    } else {
+      const tokens = shellTokens(segment.text);
+      const host = tokens.find(
+        (token, index) => index > 0 && !token.startsWith("-") && !/^\d+$/.test(token) && !["tcp", "udp"].includes(token.toLowerCase())
+      );
+      risky = host !== void 0 && !isLocalHostname(host);
+    }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "outbound-exfiltration",
+      message: "Uploads data or opens a transfer connection to a non-local destination.",
+      start: segment.start,
+      end: segment.start + segment.text.length
     });
-    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
-    parts.push(
-      [
-        "# Available Skills",
-        "",
-        "Use these attached skill instructions when they are relevant to the task.",
-        "",
-        ...skillBlocks,
-        ...unavailableNote ? ["", unavailableNote] : []
-      ].join("\n")
-    );
   }
-  const teamLines = [
-    "# Team",
-    "",
-    `- ${agent.team.id} (${agent.team.name}): ${options.sandboxMode === "docker" ? "/workspace" : agent.team.path}`,
-    "",
-    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
+}
+function classifyPrivilegeAndCredentialAccess(command, risks, seen) {
+  const patterns = [
+    /(?:^|[;&|(\n])\s*(?:sudo|su|doas|pkexec)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*security\s+(?:find-(?:generic|internet)-password|dump-keychain)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*gcloud\s+auth\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*aws\s+(?:configure|sso\s+login)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*git\s+credential(?:-[A-Za-z0-9_-]+|\s+(?:fill|approve|reject))?\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:docker|npm|gh)\s+(?:login|auth\s+token)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:pass\s+(?:show|ls)|secret-tool\s+lookup|ssh-add\s+-[Ll])\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:env|printenv|set|export\s+-p)\s*(?=$|[;&|)\n])/gim
   ];
-  parts.push(teamLines.join("\n"));
-  if (agent.team.userMd.trim()) {
-    parts.push(
-      `# About the User
-
-Shared context about the human you're working with in this team. Both you and the human curate it. To update: call \`user_md_get\` (returns current content + an etag), merge your change into the full text, then call \`user_md_write\` with the merged content and the etag. Use this for STABLE user-specific facts (preferences, role, working hours, how they like to be addressed) \u2014 and to CORRECT stale entries when the human tells you something different from what's recorded. For project knowledge use \`memory_write\` instead; for personal notes about yourself use \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**
-
-${agent.team.userMd.trim()}`
-    );
-  } else {
-    parts.push(
-      `# About the User
-
-This team's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**`
-    );
-  }
-  const reviewedLessons = boundReviewedLessons(agent.privateLessons);
-  if (reviewedLessons.length > 0) {
-    parts.push(
-      `# Reviewed lessons
-
-These private lessons were explicitly approved by the human for your behavior. Follow them when relevant; current user instructions and higher-priority policy still win.
-
-${reviewedLessons.map((lesson) => `- ${lesson}`).join("\n")}`
+  for (const pattern of patterns) {
+    addRegexRisks(
+      command,
+      risks,
+      seen,
+      pattern,
+      "privilege-or-credential-access",
+      "Requests elevated privileges or accesses a credential store."
     );
   }
-  parts.push(
-    "# Memory\n\nYou share a persistent memory backend with every other agent in this team. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the team may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
+}
+function classifyBashCommand(command) {
+  const risks = [];
+  const seen = /* @__PURE__ */ new Set();
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_HOME_PATH_RE,
+    "sensitive-path-read",
+    "Accesses a path that commonly contains credentials."
   );
-  return parts.join("\n\n---\n\n");
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_FILE_RE,
+    "sensitive-path-read",
+    "Accesses a sensitive environment, authentication, or database file."
+  );
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_ENV_RE,
+    "sensitive-path-read",
+    "References an environment variable name commonly used for credentials."
+  );
+  classifyBroadFilesystemOperations(command, risks, seen);
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    REMOTE_PIPE_RE,
+    "remote-pipe-execution",
+    "Pipes downloaded content directly into an interpreter."
+  );
+  classifyOutboundExfiltration(command, risks, seen);
+  classifyPrivilegeAndCredentialAccess(command, risks, seen);
+  return risks.sort((a, b) => a.span.start - b.span.start || a.code.localeCompare(b.code));
 }
-function boundReviewedLessons(lessons, maxCharacters = 8e3) {
-  const selected = [];
-  let used = 0;
-  for (const raw of lessons) {
-    const lesson = raw.trim();
-    if (!lesson) continue;
-    const remaining = maxCharacters - used;
-    if (remaining <= 0) break;
-    selected.push(lesson.slice(0, remaining));
-    used += Math.min(lesson.length, remaining);
+function parseEnvAllowlist(raw) {
+  if (raw === void 0 || raw.trim() === "") return [];
+  const values = raw.split(",").map((value) => value.trim());
+  if (values.some((value) => value === "")) {
+    throw new ShellSecurityConfigError(
+      "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains an empty environment variable name"
+    );
   }
-  return selected;
-}
-
-// ../daemon/src/runtime/shell/tooling.ts
-import { existsSync as existsSync11, lstatSync as lstatSync3, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join16, relative as relative4, sep as sep4 } from "path";
-import {
-  createBashToolDefinition,
-  createLocalBashOperations,
-  defineTool as defineTool2
-} from "@earendil-works/pi-coding-agent";
-
-// ../daemon/src/runtime/shell/approval.ts
-import { defineTool } from "@earendil-works/pi-coding-agent";
-
-// ../daemon/src/runtime/shell/security.ts
-var DEFAULT_BASH_SANDBOX_IMAGE = "debian:bookworm-slim";
-var SAFE_SHELL_ENV_KEYS = [
-  "PATH",
-  "HOME",
-  "LANG",
-  "LANGUAGE",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TERM",
-  "SHELL",
-  "TMPDIR",
-  "TZ"
-];
-var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var DOCKER_IMAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/;
-var DOCKER_CLIENT_CONTROL_ENV = /* @__PURE__ */ new Set([
-  "DOCKER_HOST",
-  "DOCKER_CONTEXT",
-  "DOCKER_CONFIG",
-  "DOCKER_CERT_PATH",
-  "DOCKER_TLS_VERIFY",
-  "DOCKER_API_VERSION",
-  "XDG_CONFIG_HOME",
-  "XDG_RUNTIME_DIR"
-]);
-var SANDBOX_CONTROL_ENV = /* @__PURE__ */ new Set(["BASH_ENV"]);
-var SENSITIVE_HOME_PATH_RE = /(?:~(?:[A-Za-z0-9_-]+)?|\$(?:HOME|\{HOME\})|\/(?:home|Users)\/[^\s'"`;|&/]+|\/root)\/\.(?:ssh|aws|gnupg)(?:\/[^\s'"`;|&]*)?/gi;
-var SENSITIVE_FILE_RE = /(?:\bauth\.json\b|\bbazilion\.db\b|(?:^|[\s/'"=])\.env(?:\.[A-Za-z0-9_-]+)?(?=$|[\s/'"`;|&])|\/etc\/(?:shadow|sudoers)(?:\.d\/[^\s'"`;|&]+)?)/gim;
-var SENSITIVE_ENV_RE = /\b(?:OPENAI_CODEX_OAUTH|AWS_ACCESS_KEY_ID|AWS_PROFILE|GOOGLE_APPLICATION_CREDENTIALS|BAZILION_TOKEN|(?:[A-Z][A-Z0-9_]*_)?(?:API_KEY|ACCESS_TOKEN|AUTH_TOKEN|OAUTH_TOKEN|CLIENT_SECRET|SECRET_ACCESS_KEY|PRIVATE_KEY))\b/g;
-var REMOTE_PIPE_RE = /(?:^|[;&|(\n])\s*(?:command\s+)?(?:curl|wget)\b[^;&\n]*(?:\|\s*(?:(?:sudo|env)\s+)*(?:[^\s;&|()]+\/)?(?:sh|bash|dash|zsh|fish|node|python(?:3)?|perl|ruby)\b)/gim;
-var COMMAND_BOUNDARY_RE = /[;&|)\n]/;
-var ShellSecurityConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ShellSecurityConfigError";
-  }
-};
-function isValidEnvName(name) {
-  return ENV_NAME_RE.test(name) && !RESERVED_OBJECT_KEYS.has(name);
-}
-function addRisk(command, risks, seen, input) {
-  const start = Math.max(0, input.start);
-  const end = Math.min(command.length, Math.max(start, input.end));
-  const key = `${input.code}:${start}:${end}`;
-  if (seen.has(key)) return;
-  seen.add(key);
-  risks.push({
-    code: input.code,
-    severity: input.severity ?? "danger",
-    message: input.message,
-    matchedText: command.slice(start, end),
-    span: { start, end }
-  });
-}
-function addRegexRisks(command, risks, seen, pattern, code, message) {
-  pattern.lastIndex = 0;
-  for (const match of command.matchAll(pattern)) {
-    if (match.index === void 0) continue;
-    let start = match.index;
-    let matchedText = match[0];
-    const leading = matchedText.match(/^[;&|(\n\s]+/);
-    if (leading) {
-      start += leading[0].length;
-      matchedText = matchedText.slice(leading[0].length);
+  const unique = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (!isValidEnvName(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains invalid environment variable name: ${value}`
+      );
+    }
+    if (DOCKER_CLIENT_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include Docker client control variable: ${value}`
+      );
+    }
+    if (SANDBOX_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include shell startup control variable: ${value}`
+      );
+    }
+    if (!seen.has(value)) {
+      seen.add(value);
+      unique.push(value);
     }
-    addRisk(command, risks, seen, {
-      code,
-      message,
-      start,
-      end: start + matchedText.length
-    });
   }
+  return unique;
 }
-function shellTokens(fragment) {
-  return Array.from(
-    fragment.matchAll(/"(?:\\.|[^"\\])*"|'[^']*'|[^\s]+/g),
-    (match) => match[0].replace(/^(?:"|')|(?:"|')$/g, "")
-  );
+function resolveShellSecurityConfig(env = process.env) {
+  const rawMode = env.BAZILION_BASH_SANDBOX?.trim() ?? "";
+  if (rawMode !== "" && rawMode !== "off" && rawMode !== "docker") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX must be "off" or "docker", received: ${rawMode}`
+    );
+  }
+  const rawApproval = env.BAZILION_BASH_APPROVAL?.trim() ?? "";
+  if (rawApproval !== "" && rawApproval !== "off" && rawApproval !== "dangerous") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_APPROVAL must be "off" or "dangerous", received: ${rawApproval}`
+    );
+  }
+  const rawImage = env.BAZILION_BASH_SANDBOX_IMAGE?.trim() ?? "";
+  if (rawImage !== "" && !DOCKER_IMAGE_RE.test(rawImage)) {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX_IMAGE is not a valid Docker image reference: ${rawImage}`
+    );
+  }
+  return {
+    sandboxMode: rawMode === "docker" ? "docker" : "off",
+    approvalMode: rawApproval === "dangerous" ? "dangerous" : "off",
+    sandboxImage: rawImage || DEFAULT_BASH_SANDBOX_IMAGE,
+    envAllowlist: parseEnvAllowlist(env.BAZILION_BASH_SANDBOX_ENV_ALLOWLIST)
+  };
 }
-function isBroadFilesystemTarget(rawTarget) {
-  const target = rawTarget.replace(/[;,]+$/, "");
-  if (target.startsWith("/")) return true;
-  return /^(?:\.|\.\/\*+|\*+|~(?:\/.*)?|\$(?:HOME|\{HOME\})(?:\/.*)?|\.\.(?:\/.*)?)$/.test(target);
+function assertEnvName(name) {
+  if (!isValidEnvName(name)) {
+    throw new ShellSecurityConfigError(`invalid shell environment variable name: ${name}`);
+  }
+  if (DOCKER_CLIENT_CONTROL_ENV.has(name) || SANDBOX_CONTROL_ENV.has(name)) {
+    throw new ShellSecurityConfigError(`unsafe shell environment variable name: ${name}`);
+  }
 }
-function classifyBroadFilesystemOperations(command, risks, seen) {
-  const commandRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(rm|find|chmod|chown)\b[^;&|)\n]*/gim;
-  for (const match of command.matchAll(commandRe)) {
-    if (match.index === void 0 || !match[1]) continue;
-    const nameOffset = match[0].toLowerCase().indexOf(match[1].toLowerCase());
-    const start = match.index + nameOffset;
-    const text = command.slice(start, match.index + match[0].length).trimEnd();
-    const tokens = shellTokens(text);
-    const name = tokens[0]?.toLowerCase();
-    const args = tokens.slice(1);
-    let risky = false;
-    if (name === "rm") {
-      const recursive = args.some(
-        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /[rR]/.test(arg)
-      );
-      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
-    } else if (name === "find") {
-      const target = args.find((arg) => !arg.startsWith("-"));
-      risky = args.includes("-delete") && target !== void 0 && isBroadFilesystemTarget(target);
-    } else if (name === "chmod" || name === "chown") {
-      const recursive = args.some(
-        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /R/.test(arg)
-      );
-      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
-    }
-    if (!risky) continue;
-    addRisk(command, risks, seen, {
-      code: "broad-destructive-operation",
-      message: "Recursively changes or deletes a broad filesystem target.",
-      start,
-      end: start + text.length
-    });
+function buildScrubbedShellEnv(env, allowedKeys = []) {
+  const scrubbed = {};
+  const keys2 = new Set(SAFE_SHELL_ENV_KEYS);
+  for (const key of allowedKeys) {
+    assertEnvName(key);
+    keys2.add(key);
   }
+  for (const key of keys2) {
+    const value = env[key];
+    if (value !== void 0) scrubbed[key] = value;
+  }
+  return scrubbed;
 }
-function isLocalHostname(rawHostname) {
-  const hostname = rawHostname.trim().replace(/^.*@/, "").replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
-  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "0.0.0.0" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+
+// ../daemon/src/runtime/shell/approval.ts
+var BashApprovalDeniedError = class extends Error {
+  risks;
+  constructor(risks) {
+    const codes = [...new Set(risks.map((risk) => risk.code))];
+    super(`Dangerous bash command denied (${codes.join(", ")})`);
+    this.name = "BashApprovalDeniedError";
+    this.risks = risks;
+  }
+};
+async function requireBashApproval(command, toolCallId, signal, host) {
+  const risks = classifyBashCommand(command);
+  if (!risks.length) return;
+  const decision = host ? await host.requestApproval({ toolCallId, command, risks, signal }) : "denied";
+  if (decision !== "approved") throw new BashApprovalDeniedError(risks);
 }
-function hasExternalHttpDestination(segment) {
-  const urls = Array.from(segment.matchAll(/https?:\/\/[^\s'"`]+/gi), (match) => match[0]);
-  if (urls.length === 0) return true;
-  return urls.some((rawUrl) => {
-    try {
-      return !isLocalHostname(new URL(rawUrl).hostname);
-    } catch {
-      return true;
+function createApprovalGatedBashTool(base, host) {
+  return defineTool({
+    ...base,
+    description: `${base.description} Commands classified as dangerous require operator approval before execution.`,
+    executionMode: "sequential",
+    async execute(toolCallId, params, signal, onUpdate, ctx) {
+      await requireBashApproval(params.command, toolCallId, signal, host);
+      return base.execute(toolCallId, params, signal, onUpdate, ctx);
     }
   });
 }
-function remoteTransferHosts(segment) {
-  const hosts = [];
-  const uriRe = /(?:sftp|ssh|rsync):\/\/(?:[^@\s/]+@)?(\[[^\]]+\]|[^\s/:]+)(?::\d+)?/gi;
-  for (const match of segment.matchAll(uriRe)) {
-    if (match[1]) hosts.push(match[1]);
-  }
-  const scpRe = /(?:^|\s)(?:[^@\s:]+@)?(\[[^\]]+\]|[A-Za-z0-9._-]+):[^\s]+/g;
-  for (const match of segment.matchAll(scpRe)) {
-    if (match[1]) hosts.push(match[1]);
+
+// ../daemon/src/runtime/shell/docker.ts
+import { spawn } from "child_process";
+import { randomUUID as randomUUID18 } from "crypto";
+import { closeSync as closeSync4, constants as constants4, mkdtempSync as mkdtempSync2, openSync as openSync4, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { access, lstat, realpath, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { delimiter, isAbsolute as isAbsolute3, join as join16, relative as relative2, sep as sep3 } from "path";
+
+// ../daemon/src/runtime/shell/coding.ts
+function validateDockerCodingSelection(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Invalid Docker coding selection");
+  const value = input;
+  if (Object.keys(value).some((key) => !["revision", "cwd", "env"].includes(key)) || !Number.isSafeInteger(value.revision) || value.revision < 0)
+    throw new Error("Invalid Docker coding revision");
+  const cwd = codingRelativePath(value.cwd);
+  if (!value.env || typeof value.env !== "object" || Array.isArray(value.env))
+    throw new Error("Invalid Docker coding environment");
+  const env = {};
+  for (const [key, entry] of Object.entries(value.env)) {
+    if (key === "CI" && (entry === "true" || entry === "false")) env.CI = entry;
+    else if (key === "NO_COLOR" && (entry === "0" || entry === "1")) env.NO_COLOR = entry;
+    else if (key === "TZ" && entry === "UTC") env.TZ = entry;
+    else throw new Error("Invalid Docker coding environment");
   }
-  return hosts;
+  return { revision: value.revision, cwd, env };
 }
-function invocationSegment(command, match, commandName) {
-  if (match.index === void 0) return null;
-  const nameOffset = match[0].toLowerCase().indexOf(commandName.toLowerCase());
-  if (nameOffset < 0) return null;
-  const start = match.index + nameOffset;
-  const boundaryOffset = command.slice(start).search(COMMAND_BOUNDARY_RE);
-  const end = boundaryOffset < 0 ? command.length : start + boundaryOffset;
-  return { start, text: command.slice(start, end).trimEnd() };
-}
-function classifyOutboundExfiltration(command, risks, seen) {
-  const invocationRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(curl|wget|scp|rsync|nc|netcat|sftp)\b/gim;
-  for (const match of command.matchAll(invocationRe)) {
-    const name = match[1]?.toLowerCase();
-    if (!name) continue;
-    const segment = invocationSegment(command, match, name);
-    if (!segment) continue;
-    let risky = false;
-    if (name === "curl") {
-      const uploads = /(?:^|\s)(?:-X\s*POST\b|-[dFT](?:\s|[^\s]))/.test(segment.text) || /(?:^|\s)(?:--request(?:=|\s+)POST\b|--data(?:-[a-z-]+)?(?:=|\s)|--form(?:-string)?(?:=|\s)|--upload-file(?:=|\s))/i.test(
-        segment.text
-      );
-      risky = uploads && hasExternalHttpDestination(segment.text);
-    } else if (name === "wget") {
-      const uploads = /(?:^|\s)(?:--method(?:=|\s+)POST\b|--post-data(?:=|\s)|--post-file(?:=|\s)|--body-data(?:=|\s)|--body-file(?:=|\s))/i.test(
-        segment.text
-      );
-      risky = uploads && hasExternalHttpDestination(segment.text);
-    } else if (name === "scp" || name === "rsync") {
-      const hosts = remoteTransferHosts(segment.text);
-      risky = hosts.some((host) => !isLocalHostname(host)) || hosts.length === 0 && /\$/.test(segment.text);
-    } else if (name === "sftp") {
-      const hosts = remoteTransferHosts(segment.text);
-      if (hosts.length > 0) {
-        risky = hosts.some((host) => !isLocalHostname(host));
-      } else {
-        const destination = shellTokens(segment.text).at(-1);
-        risky = destination !== void 0 && destination !== name && !isLocalHostname(destination);
-      }
-    } else {
-      const tokens = shellTokens(segment.text);
-      const host = tokens.find(
-        (token, index) => index > 0 && !token.startsWith("-") && !/^\d+$/.test(token) && !["tcp", "udp"].includes(token.toLowerCase())
-      );
-      risky = host !== void 0 && !isLocalHostname(host);
-    }
-    if (!risky) continue;
-    addRisk(command, risks, seen, {
-      code: "outbound-exfiltration",
-      message: "Uploads data or opens a transfer connection to a non-local destination.",
-      start: segment.start,
-      end: segment.start + segment.text.length
-    });
-  }
-}
-function classifyPrivilegeAndCredentialAccess(command, risks, seen) {
-  const patterns = [
-    /(?:^|[;&|(\n])\s*(?:sudo|su|doas|pkexec)\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*security\s+(?:find-(?:generic|internet)-password|dump-keychain)\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*gcloud\s+auth\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*aws\s+(?:configure|sso\s+login)\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*git\s+credential(?:-[A-Za-z0-9_-]+|\s+(?:fill|approve|reject))?\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*(?:docker|npm|gh)\s+(?:login|auth\s+token)\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*(?:pass\s+(?:show|ls)|secret-tool\s+lookup|ssh-add\s+-[Ll])\b[^;&|)\n]*/gim,
-    /(?:^|[;&|(\n])\s*(?:env|printenv|set|export\s+-p)\s*(?=$|[;&|)\n])/gim
-  ];
-  for (const pattern of patterns) {
-    addRegexRisks(
-      command,
-      risks,
-      seen,
-      pattern,
-      "privilege-or-credential-access",
-      "Requests elevated privileges or accesses a credential store."
-    );
-  }
-}
-function classifyBashCommand(command) {
-  const risks = [];
-  const seen = /* @__PURE__ */ new Set();
-  addRegexRisks(
-    command,
-    risks,
-    seen,
-    SENSITIVE_HOME_PATH_RE,
-    "sensitive-path-read",
-    "Accesses a path that commonly contains credentials."
-  );
-  addRegexRisks(
-    command,
-    risks,
-    seen,
-    SENSITIVE_FILE_RE,
-    "sensitive-path-read",
-    "Accesses a sensitive environment, authentication, or database file."
-  );
-  addRegexRisks(
-    command,
-    risks,
-    seen,
-    SENSITIVE_ENV_RE,
-    "sensitive-path-read",
-    "References an environment variable name commonly used for credentials."
-  );
-  classifyBroadFilesystemOperations(command, risks, seen);
-  addRegexRisks(
-    command,
-    risks,
-    seen,
-    REMOTE_PIPE_RE,
-    "remote-pipe-execution",
-    "Pipes downloaded content directly into an interpreter."
-  );
-  classifyOutboundExfiltration(command, risks, seen);
-  classifyPrivilegeAndCredentialAccess(command, risks, seen);
-  return risks.sort((a, b) => a.span.start - b.span.start || a.code.localeCompare(b.code));
-}
-function parseEnvAllowlist(raw) {
-  if (raw === void 0 || raw.trim() === "") return [];
-  const values = raw.split(",").map((value) => value.trim());
-  if (values.some((value) => value === "")) {
-    throw new ShellSecurityConfigError(
-      "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains an empty environment variable name"
-    );
-  }
-  const unique = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const value of values) {
-    if (!isValidEnvName(value)) {
-      throw new ShellSecurityConfigError(
-        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains invalid environment variable name: ${value}`
-      );
-    }
-    if (DOCKER_CLIENT_CONTROL_ENV.has(value)) {
-      throw new ShellSecurityConfigError(
-        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include Docker client control variable: ${value}`
-      );
-    }
-    if (SANDBOX_CONTROL_ENV.has(value)) {
-      throw new ShellSecurityConfigError(
-        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include shell startup control variable: ${value}`
-      );
-    }
-    if (!seen.has(value)) {
-      seen.add(value);
-      unique.push(value);
-    }
-  }
-  return unique;
-}
-function resolveShellSecurityConfig(env = process.env) {
-  const rawMode = env.BAZILION_BASH_SANDBOX?.trim() ?? "";
-  if (rawMode !== "" && rawMode !== "off" && rawMode !== "docker") {
-    throw new ShellSecurityConfigError(
-      `BAZILION_BASH_SANDBOX must be "off" or "docker", received: ${rawMode}`
-    );
-  }
-  const rawApproval = env.BAZILION_BASH_APPROVAL?.trim() ?? "";
-  if (rawApproval !== "" && rawApproval !== "off" && rawApproval !== "dangerous") {
-    throw new ShellSecurityConfigError(
-      `BAZILION_BASH_APPROVAL must be "off" or "dangerous", received: ${rawApproval}`
-    );
-  }
-  const rawImage = env.BAZILION_BASH_SANDBOX_IMAGE?.trim() ?? "";
-  if (rawImage !== "" && !DOCKER_IMAGE_RE.test(rawImage)) {
-    throw new ShellSecurityConfigError(
-      `BAZILION_BASH_SANDBOX_IMAGE is not a valid Docker image reference: ${rawImage}`
-    );
-  }
-  return {
-    sandboxMode: rawMode === "docker" ? "docker" : "off",
-    approvalMode: rawApproval === "dangerous" ? "dangerous" : "off",
-    sandboxImage: rawImage || DEFAULT_BASH_SANDBOX_IMAGE,
-    envAllowlist: parseEnvAllowlist(env.BAZILION_BASH_SANDBOX_ENV_ALLOWLIST)
-  };
-}
-function assertEnvName(name) {
-  if (!isValidEnvName(name)) {
-    throw new ShellSecurityConfigError(`invalid shell environment variable name: ${name}`);
-  }
-  if (DOCKER_CLIENT_CONTROL_ENV.has(name) || SANDBOX_CONTROL_ENV.has(name)) {
-    throw new ShellSecurityConfigError(`unsafe shell environment variable name: ${name}`);
-  }
-}
-function buildScrubbedShellEnv(env, allowedKeys = []) {
-  const scrubbed = {};
-  const keys = new Set(SAFE_SHELL_ENV_KEYS);
-  for (const key of allowedKeys) {
-    assertEnvName(key);
-    keys.add(key);
-  }
-  for (const key of keys) {
-    const value = env[key];
-    if (value !== void 0) scrubbed[key] = value;
-  }
-  return scrubbed;
-}
-
-// ../daemon/src/runtime/shell/approval.ts
-var BashApprovalDeniedError = class extends Error {
-  risks;
-  constructor(risks) {
-    const codes = [...new Set(risks.map((risk) => risk.code))];
-    super(`Dangerous bash command denied (${codes.join(", ")})`);
-    this.name = "BashApprovalDeniedError";
-    this.risks = risks;
-  }
-};
-function createApprovalGatedBashTool(base, host) {
-  return defineTool({
-    ...base,
-    description: `${base.description} Commands classified as dangerous require operator approval before execution.`,
-    executionMode: "sequential",
-    async execute(toolCallId, params, signal, onUpdate, ctx) {
-      const risks = classifyBashCommand(params.command);
-      if (risks.length > 0) {
-        const decision = host ? await host.requestApproval({
-          toolCallId,
-          command: params.command,
-          risks,
-          signal
-        }) : "denied";
-        if (decision !== "approved") throw new BashApprovalDeniedError(risks);
-      }
-      return base.execute(toolCallId, params, signal, onUpdate, ctx);
-    }
-  });
+function codingContainerCwd(cwd) {
+  return cwd === "." ? "/workspace" : `/workspace/${codingRelativePath(cwd)}`;
 }
 
 // ../daemon/src/runtime/shell/docker.ts
-import { spawn } from "child_process";
-import { randomUUID as randomUUID18 } from "crypto";
-import { closeSync as closeSync4, constants as constants4, mkdtempSync as mkdtempSync2, openSync as openSync4, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
-import { access, lstat, realpath, stat } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { delimiter, isAbsolute as isAbsolute3, join as join15, relative as relative3, sep as sep3 } from "path";
 var CONTAINER_WORKDIR = "/workspace";
 var MAX_TIMEOUT_MS = 2147483647;
 var MAX_STDERR_CHARS = 16 * 1024;
@@ -2201,6 +2136,7 @@ var CLEANUP_TIMEOUT_MS = 650;
 var CLEANUP_RETRY_DELAY_MS = 100;
 var CLEANUP_ATTEMPTS = 3;
 var DOCKER_CONTEXT_TIMEOUT_MS = 2e3;
+var DOCKER_CREATE_TIMEOUT_MS = 5e3;
 var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CONTAINER_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]+$/;
 var DOCKER_CLIENT_ENV_KEYS = [
@@ -2273,7 +2209,7 @@ function buildDockerRunSpec(input) {
     "--entrypoint",
     "/bin/bash",
     "--workdir",
-    CONTAINER_WORKDIR,
+    codingContainerCwd(input.codingCwd ?? "."),
     // A bind mount is read/write unless `readonly` is present. No other mount is added.
     "--mount",
     `type=bind,source=${input.mountSource},target=${CONTAINER_WORKDIR},bind-recursive=disabled`
@@ -2319,7 +2255,7 @@ function buildDockerRunSpec(input) {
 ` } : {}
   };
 }
-function createPreparedDockerBashOperations(runtime) {
+function createPreparedDockerBashOperations(runtime, lifecycle) {
   validatePreparedDockerRuntime(runtime);
   return {
     async exec(command, cwd, { onData, signal, timeout }) {
@@ -2336,9 +2272,10 @@ function createPreparedDockerBashOperations(runtime) {
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       await assertLocalDockerSocket(runtime.endpoint);
       const dockerClientEnv = { DOCKER_HOST: runtime.endpoint };
+      if (runtime.coding) resolveCodingDirectory(workspace.source, runtime.coding.cwd);
       const currentImageId = await inspectSandboxImage(
         runtime.dockerPath,
-        runtime.image,
+        runtime.coding ? runtime.imageId : runtime.image,
         dockerClientEnv
       );
       if (currentImageId !== runtime.imageId) {
@@ -2346,11 +2283,12 @@ function createPreparedDockerBashOperations(runtime) {
       }
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
+      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image: runtime.image,
         resolvedImage: runtime.imageId,
-        env: { ...runtime.containerEnv },
+        env: { ...runtime.containerEnv, ...runtime.coding?.env },
+        codingCwd: runtime.coding?.cwd,
         dockerPath: runtime.dockerPath,
         hostEnv: dockerClientEnv,
         command,
@@ -2360,10 +2298,94 @@ function createPreparedDockerBashOperations(runtime) {
         uid: runtime.uid,
         gid: runtime.gid
       });
-      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+      await lifecycle?.beforeCreate({
+        dockerPath: runtime.dockerPath,
+        executableIdentity: runtime.executableIdentity,
+        endpoint: runtime.endpoint,
+        containerName
+      });
+      try {
+        return await executeRegisteredDockerRun(
+          spec,
+          { onData, signal, timeout, timeoutMs },
+          lifecycle
+        );
+      } finally {
+        await lifecycle?.afterRemove(containerName);
+      }
     }
   };
 }
+function runProtectedContainerCreate(spec, options) {
+  if (options?.signal?.aborted) return Promise.reject(new Error("aborted"));
+  let envFileFd;
+  try {
+    if (spec.envFileContent !== void 0) {
+      envFileFd = openAnonymousEnvFile(spec.envFileContent);
+    }
+  } catch (error) {
+    return Promise.reject(
+      new Error(
+        `Docker sandbox could not prepare its preflight environment: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+  }
+  return new Promise((resolve6, reject) => {
+    let child;
+    try {
+      child = spawn(spec.executable, ["container", "create", ...spec.args.slice(1)], {
+        stdio: ["ignore", "ignore", "pipe", envFileFd ?? "ignore"],
+        windowsHide: true,
+        env: spec.processEnv
+      });
+    } catch (error) {
+      if (envFileFd !== void 0) closeSync4(envFileFd);
+      reject(error instanceof Error ? formatSpawnError(spec.executable, error) : error);
+      return;
+    }
+    if (envFileFd !== void 0) closeSync4(envFileFd);
+    let settled = false;
+    let stderr = "";
+    let timeoutHandle;
+    let killSettleHandle;
+    let termination;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      if (killSettleHandle) clearTimeout(killSettleHandle);
+      options?.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve6();
+    };
+    const commandTimeout = options?.timeoutMs !== void 0 && options.timeoutMs <= DOCKER_CREATE_TIMEOUT_MS;
+    const timeoutError = () => commandTimeout ? new Error(`timeout:${options?.timeout}`) : new Error(
+      `Docker sandbox could not create its protected preflight container within ${DOCKER_CREATE_TIMEOUT_MS}ms`
+    );
+    child.stderr?.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-MAX_STDERR_CHARS);
+    });
+    child.once("error", (error) => finish(formatSpawnError(spec.executable, error)));
+    child.once("close", (code) => {
+      if (termination) finish(termination);
+      else if (code === 0) finish();
+      else finish(formatDockerCreateError(spec, stderr, code));
+    });
+    const terminate = (error) => {
+      if (settled || termination) return;
+      termination = error;
+      child.kill("SIGKILL");
+      killSettleHandle = setTimeout(() => finish(error), CLEANUP_TIMEOUT_MS);
+    };
+    const onAbort = () => terminate(new Error("aborted"));
+    timeoutHandle = setTimeout(
+      () => terminate(timeoutError()),
+      Math.min(options?.timeoutMs ?? DOCKER_CREATE_TIMEOUT_MS, DOCKER_CREATE_TIMEOUT_MS)
+    );
+    options?.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options?.signal?.aborted) onAbort();
+  });
+}
 async function recheckProtectedMount(mount) {
   const sourceInfo = await lstat(mount.source);
   if (sourceInfo.isSymbolicLink() || !sourceInfo.isDirectory()) {
@@ -2380,6 +2402,22 @@ async function resolveRequiredRoot(root) {
   if (!isAbsolute3(root)) throw new Error("Docker sandbox mount root must be absolute");
   return resolveMountSource(root);
 }
+async function resolveAbsoluteDockerPath(requested, hostEnv) {
+  validateDockerPath(requested);
+  const candidates = isAbsolute3(requested) ? [requested] : (hostEnv.PATH ?? "").split(delimiter).filter(Boolean).map((dir) => join16(dir, requested));
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants4.X_OK);
+      const info = await stat(candidate);
+      if (!info.isFile()) continue;
+      const canonical = await realpath(candidate);
+      if (!isAbsolute3(canonical)) continue;
+      return canonical;
+    } catch {
+    }
+  }
+  throw new Error(`Docker sandbox executable is unavailable: ${requested}`);
+}
 async function inspectDockerExecutableIdentity(dockerPath) {
   try {
     await access(dockerPath, constants4.X_OK);
@@ -2423,6 +2461,7 @@ async function assertLocalDockerSocket(endpoint) {
   }
 }
 function validatePreparedDockerRuntime(runtime) {
+  if (runtime.coding) validateDockerCodingSelection(runtime.coding);
   if (!isAbsolute3(runtime.dockerPath)) {
     throw new Error("protected Docker executable must be absolute");
   }
@@ -2440,17 +2479,17 @@ function validatePreparedDockerRuntime(runtime) {
     throw new Error("protected Docker container environment does not match policy");
   }
 }
-function validateDockerExecutableIdentity(identity) {
-  if (typeof identity !== "object" || identity === null) {
+function validateDockerExecutableIdentity(identity2) {
+  if (typeof identity2 !== "object" || identity2 === null) {
     throw new Error("protected Docker executable identity is invalid");
   }
   const fields = [
-    identity.device,
-    identity.inode,
-    identity.mode,
-    identity.size,
-    identity.modifiedTimeNs,
-    identity.changedTimeNs
+    identity2.device,
+    identity2.inode,
+    identity2.mode,
+    identity2.size,
+    identity2.modifiedTimeNs,
+    identity2.changedTimeNs
   ];
   if (fields.some((field) => typeof field !== "string" || !/^\d+$/.test(field))) {
     throw new Error("protected Docker executable identity is invalid");
@@ -2485,7 +2524,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
+      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID18().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -2499,10 +2538,44 @@ function createDockerBashOperations(options) {
         readOnlyMounts,
         hostEnv: dockerClientEnv
       });
-      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+      if (options.lifecycle) {
+        const absolute = await resolveAbsoluteDockerPath(dockerPath, hostEnv);
+        await options.lifecycle.beforeCreate({
+          dockerPath: absolute,
+          executableIdentity: await inspectDockerExecutableIdentity(absolute),
+          endpoint: dockerClientEnv.DOCKER_HOST,
+          containerName
+        });
+      }
+      try {
+        return await executeRegisteredDockerRun(
+          spec,
+          { onData, signal, timeout, timeoutMs },
+          options.lifecycle
+        );
+      } finally {
+        await options.lifecycle?.afterRemove(containerName);
+      }
     }
   };
 }
+async function executeRegisteredDockerRun(spec, options, lifecycle) {
+  if (!lifecycle) return executeDockerRun(spec, options);
+  const deadline = options.timeoutMs === void 0 ? void 0 : Date.now() + options.timeoutMs;
+  await runProtectedContainerCreate(spec, options);
+  await lifecycle.afterCreate(spec.containerName);
+  if (options.signal?.aborted) throw new Error("aborted");
+  const remaining = deadline === void 0 ? void 0 : deadline - Date.now();
+  if (remaining !== void 0 && remaining <= 0) throw new Error(`timeout:${options.timeout}`);
+  return executeDockerRun(
+    {
+      ...spec,
+      args: ["container", "start", "--attach", spec.containerName],
+      envFileContent: void 0
+    },
+    { ...options, timeoutMs: remaining }
+  );
+}
 function executeDockerRun(spec, options) {
   let envFileFd;
   try {
@@ -2578,8 +2651,8 @@ function executeDockerRun(spec, options) {
   });
 }
 function openAnonymousEnvFile(content) {
-  const dir = mkdtempSync2(join15(tmpdir2(), "bazilion-docker-env-"));
-  const path = join15(dir, "environment");
+  const dir = mkdtempSync2(join16(tmpdir2(), "bazilion-docker-env-"));
+  const path = join16(dir, "environment");
   let fd;
   try {
     writeFileSync7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
@@ -2702,227 +2775,1113 @@ async function inspectSandboxImage(dockerPath, image, processEnv) {
     }
     throw error;
   }
-  const separator = raw.indexOf("	");
-  if (separator < 0) {
-    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  const separator = raw.indexOf("	");
+  if (separator < 0) {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  let id;
+  let volumes;
+  try {
+    id = JSON.parse(raw.slice(0, separator));
+    volumes = JSON.parse(raw.slice(separator + 1));
+  } catch {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  if (typeof id !== "string" || !id.startsWith("sha256:")) {
+    throw new Error(`Docker sandbox received an invalid image id for "${image}"`);
+  }
+  if (volumes !== null && typeof volumes === "object" && Object.keys(volumes).length > 0) {
+    throw new Error(
+      `Docker sandbox image "${image}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
+    );
+  }
+  if (volumes !== null && (typeof volumes !== "object" || Array.isArray(volumes))) {
+    throw new Error(`Docker sandbox received invalid volume metadata for image "${image}"`);
+  }
+  return id;
+}
+function runDockerInspection(dockerPath, args, processEnv, subject) {
+  return new Promise((resolve6, reject) => {
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    let settled = false;
+    let stdout = "";
+    let stderr = "";
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutHandle);
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve6(stdout.trim());
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(
+        new Error(
+          `Docker sandbox could not inspect ${subject} within ${DOCKER_CONTEXT_TIMEOUT_MS}ms`
+        )
+      );
+    }, DOCKER_CONTEXT_TIMEOUT_MS);
+    child.stdout.on("data", (data) => {
+      stdout = `${stdout}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.once("error", (error) => finish(formatSpawnError(dockerPath, error)));
+    child.once("close", (code) => {
+      if (code === 0) finish();
+      else
+        finish(
+          new Error(
+            `Docker sandbox could not inspect ${subject}: ${stderr.trim() || `Docker exited with status ${code}`}`
+          )
+        );
+    });
+  });
+}
+function buildDockerClientEnv(hostEnv) {
+  const env = {};
+  for (const key of DOCKER_CLIENT_ENV_KEYS) {
+    const value = hostEnv[key];
+    if (value !== void 0) env[key] = value;
+  }
+  return env;
+}
+function validateDockerPath(dockerPath) {
+  if (!dockerPath.trim()) throw new Error("Docker sandbox executable path is required");
+  if (dockerPath.includes("\0"))
+    throw new Error("Docker sandbox executable path contains a NUL byte");
+}
+function validateImage(image) {
+  if (!image.trim()) throw new Error("Docker sandbox image is required");
+  if (image.startsWith("-")) {
+    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image)}`);
+  }
+  if (image.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
+}
+function validateContainerName(containerName) {
+  if (!CONTAINER_NAME.test(containerName)) {
+    throw new Error(`Docker sandbox container name is invalid: ${JSON.stringify(containerName)}`);
+  }
+}
+function validateMountArgument(mountSource) {
+  if (!mountSource) throw new Error("Docker sandbox mount path is required");
+  if (mountSource.includes("\0") || mountSource.includes(",")) {
+    throw new Error(
+      `Docker sandbox mount path cannot be represented safely: ${JSON.stringify(mountSource)}`
+    );
+  }
+}
+function validateReadOnlyMounts(mounts, workspaceSource) {
+  const targets = /* @__PURE__ */ new Set([CONTAINER_WORKDIR, "/tmp"]);
+  for (const mount of mounts) {
+    validateMountArgument(mount.source);
+    if (mount.sourceRoot !== void 0 && (!isAbsolute3(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
+      throw new Error(
+        `Docker sandbox read-only mount root is invalid: ${JSON.stringify(mount.sourceRoot)}`
+      );
+    }
+    if (!mount.target.startsWith("/") || mount.target.includes("\0") || mount.target.includes(",") || mount.target.split("/").includes("..")) {
+      throw new Error(
+        `Docker sandbox read-only mount target is invalid: ${JSON.stringify(mount.target)}`
+      );
+    }
+    if (mount.source === workspaceSource) {
+      throw new Error("Docker sandbox cannot mount the writable workspace again as an input");
+    }
+    if (targets.has(mount.target)) {
+      throw new Error(`Docker sandbox mount target is duplicated or reserved: ${mount.target}`);
+    }
+    targets.add(mount.target);
+  }
+}
+function isWithin(root, candidate) {
+  const rel = relative2(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute3(rel);
+}
+function validateHostIdentity(uid, gid) {
+  if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
+    throw new Error(`Docker sandbox received an invalid host uid/gid: ${uid}:${gid}`);
+  }
+}
+function formatSpawnError(dockerPath, error) {
+  const code = error.code;
+  if (code === "ENOENT") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
+  }
+  if (code === "EACCES") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+  }
+  return new Error(`Docker sandbox could not start "${dockerPath}": ${error.message}`);
+}
+function formatDockerRunError(spec, stderr) {
+  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
+  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
+    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  }
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  }
+  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
+}
+function formatDockerCreateError(spec, stderr, exitCode) {
+  const detail3 = stderr.trim() || `Docker exited with ${exitCode === null ? "no status" : `status ${exitCode}`} without an error message`;
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox preflight mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox preflight could not reach the local Docker daemon: ${detail3}`);
+  }
+  return new Error(`Docker sandbox preflight could not create the required container: ${detail3}`);
+}
+async function removeContainer(dockerPath, containerName, processEnv) {
+  const args = ["container", "rm", "--force", containerName];
+  let last;
+  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
+    last = await runCleanupCommand(dockerPath, args, processEnv);
+    if (last.ok) return;
+    if (attempt < CLEANUP_ATTEMPTS - 1) {
+      await new Promise((resolve6) => setTimeout(resolve6, CLEANUP_RETRY_DELAY_MS));
+    }
+  }
+  if (last && !last.missing) {
+    console.warn(
+      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+    );
+  }
+}
+function runCleanupCommand(dockerPath, args, processEnv) {
+  return new Promise((resolve6) => {
+    let done = false;
+    let stderr = "";
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    const finish = (ok, error = "") => {
+      if (done) return;
+      done = true;
+      clearTimeout(timeoutHandle);
+      const detail3 = error || stderr.trim();
+      resolve6({
+        ok,
+        missing: /no such container/i.test(detail3),
+        error: detail3
+      });
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
+    }, CLEANUP_TIMEOUT_MS);
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
+    });
+    child.once("error", (error) => finish(false, error.message));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+
+// ../daemon/src/runtime/pi/coding.ts
+function codingTools(input) {
+  const readSecrets = () => typeof input.secrets === "function" ? input.secrets() : input.secrets ?? [];
+  const hostOperations = input.docker ? null : createLocalBashOperations();
+  return [
+    {
+      name: "coding_environment",
+      label: "Inspect coding environment",
+      description: "Read the actual environment admitted to this turn for a Team-relative directory. No commands run. Discover prerequisites during the task; no Team checklist is required. Missing network/tooling is a specific blocker, never permission to change posture.",
+      parameters: Type.Object(
+        { target: Type.String({ default: ".", maxLength: 4096 }) },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const value = await input.host.invoke({
+          action: "environment",
+          target: params.target
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingEnvironment: value }
+        };
+      }
+    },
+    {
+      name: "coding_command",
+      label: "Run coding command",
+      description: "Execute an ad hoc finite runtime/dependency/preparation/build/test command in this turn\u2019s actual environment. Use discovered repository commands, not saved operator checks. Resolve prerequisites and use available offline artifacts within current authority. Share coding-receipt:<id> through send_message if a teammate needs evidence; never wait holding its workspace lease. Success is an observed exit, not proof about later code.",
+      parameters: Type.Object(
+        {
+          command: Type.String({ minLength: 1, maxLength: 4096 }),
+          cwd: Type.String({ maxLength: 4096 }),
+          purpose: Type.Union(
+            ["runtime", "dependency", "prepare", "build", "test"].map(
+              (value) => Type.Literal(value)
+            )
+          ),
+          timeoutSeconds: Type.Integer({ minimum: 1, maximum: 300 })
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(toolCallId, params, signal, onUpdate) {
+        const command = validateCodingCommand(params);
+        const context = await input.context(command.cwd);
+        if (context.instructions.state !== "complete")
+          throw new Error("Coding scope instructions are incomplete");
+        const started = await input.host.invoke({
+          action: "start",
+          toolCallId,
+          input: command
+        });
+        const output = new CodingDiagnostics(readSecrets());
+        let lastProgressAt = 0;
+        const emitProgress = (force) => {
+          if (!onUpdate) return;
+          const now = Date.now();
+          if (!force && now - lastProgressAt < 400) return;
+          lastProgressAt = now;
+          const preview = output.preview(CODING_LIVE_BYTES);
+          onUpdate({
+            content: [{ type: "text", text: preview.text }],
+            details: {
+              codingProgress: {
+                id: toolCallId,
+                commandId: started.id,
+                output: preview.text,
+                truncated: preview.truncated,
+                elapsedMs: Math.max(0, now - started.startedAt)
+              }
+            }
+          });
+        };
+        let outcome;
+        try {
+          if (input.approval)
+            await requireBashApproval(command.command, toolCallId, signal, input.approvalHost);
+          signal?.throwIfAborted();
+          const cwd = resolveCodingDirectory(input.root, command.cwd);
+          const operations = input.docker ? createPreparedDockerBashOperations(
+            {
+              ...input.docker,
+              coding: {
+                revision: input.docker.coding?.revision ?? 0,
+                cwd: command.cwd,
+                env: input.docker.coding?.env ?? {}
+              }
+            },
+            input.lifecycle
+          ) : hostOperations;
+          const result = await operations.exec(
+            command.command,
+            input.docker ? input.root : cwd.path,
+            {
+              onData: (bytes) => {
+                output.append(bytes);
+                emitProgress(false);
+              },
+              signal,
+              timeout: command.timeoutSeconds
+            }
+          );
+          emitProgress(true);
+          outcome = {
+            state: result.exitCode === 0 ? "succeeded" : result.exitCode === null ? "interrupted" : "failed",
+            exitCode: result.exitCode,
+            ...output.finish(),
+            reason: result.exitCode === null ? "exit_unavailable" : null
+          };
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Command execution unavailable";
+          const state = signal?.aborted || message === "aborted" ? "cancelled" : message.startsWith("timeout:") ? "timed_out" : error instanceof BashApprovalDeniedError ? "blocked" : /cleanup|teardown/i.test(message) ? "interrupted" : "blocked";
+          outcome = { state, exitCode: null, ...output.finish(), reason: message };
+        }
+        const receipt = await input.host.invoke({
+          action: "finish",
+          id: started.id,
+          outcome
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(receipt) }],
+          details: { codingReceipt: receipt }
+        };
+      }
+    },
+    {
+      name: "coding_receipt",
+      label: "Read coding result",
+      description: "Read a retained command result with current applicability. Your own receipts are private. For a teammate\u2019s receipt, provide the id of its policy-authorized message containing coding-receipt:<id>. Old results are not current verification.",
+      parameters: Type.Object(
+        {
+          id: Type.String({ maxLength: 64 }),
+          messageId: Type.Optional(Type.String({ maxLength: 64 }))
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const value = await input.host.invoke({
+          action: "read",
+          ...params
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingEvidence: value }
+        };
+      }
+    },
+    {
+      name: "coding_log",
+      label: "Read retained command output",
+      description: "Read a bounded page of retained diagnostic output for a coding receipt, or search it. Producing Agents may read their own logs; a teammate must pass the id of the policy-authorized message that carried coding-receipt:<id>. Output is bounded and may be truncated, expired, deleted or unavailable \u2014 report that state honestly and do not infer completeness from an exit code.",
+      parameters: Type.Object(
+        {
+          id: Type.String({ maxLength: 64 }),
+          messageId: Type.Optional(Type.String({ maxLength: 64 })),
+          search: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })),
+          offset: Type.Optional(Type.Integer({ minimum: 0 })),
+          limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 65536 }))
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const values = params;
+        if (values.search !== void 0) {
+          const result = await input.host.invoke({
+            action: "log-search",
+            id: values.id,
+            query: values.search,
+            ...values.messageId !== void 0 ? { messageId: values.messageId } : {}
+          });
+          return {
+            content: [{ type: "text", text: JSON.stringify(result) }],
+            details: { codingLogSearch: result }
+          };
+        }
+        const value = await input.host.invoke({
+          action: "log",
+          id: values.id,
+          ...values.messageId !== void 0 ? { messageId: values.messageId } : {},
+          ...values.offset !== void 0 ? { offset: values.offset } : {},
+          ...values.limit !== void 0 ? { limit: values.limit } : {}
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingLog: value }
+        };
+      }
+    },
+    {
+      name: "source_snapshot",
+      label: "Capture the current source state",
+      description: "Capture a bounded snapshot of the repository source you are about to work from, and quote its reference in your summary. Call this once before you start editing: the reference is how a later change or verification is tied to the version it actually applies to. It is read-only and never changes the repository. The result may be incomplete \u2014 when it is, say so, because an incomplete snapshot cannot support a claim that code is unchanged. Untracked file content is never included unless you name each path.",
+      parameters: Type.Object(
+        {
+          includeUntracked: Type.Optional(
+            Type.Array(Type.String({ maxLength: 4096 }), { maxItems: 1e3 })
+          )
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(toolCallId, params) {
+        const values = params;
+        const value = await input.host.invoke({
+          action: "snapshot",
+          toolCallId,
+          ...values.includeUntracked ? { includeUntracked: values.includeUntracked } : {}
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { sourceSnapshot: value }
+        };
+      }
+    }
+  ];
+}
+
+// ../daemon/src/runtime/pi/repository-context.ts
+import { Type as Type2 } from "typebox";
+
+// ../daemon/src/runtime/pi/repository-context-contract.ts
+var object2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var keys = (value, required, optional = []) => required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+var string = (value, limit = 4096) => typeof value === "string" && value.length <= limit;
+var digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+var count = (value) => Number.isSafeInteger(value) && value >= 0;
+var list3 = (value, limit, check) => Array.isArray(value) && value.length <= limit && value.every(check);
+var issue = (value) => object2(value) && keys(value, ["code", "message"], ["path"]) && string(value.code, 100) && string(value.message, 1024) && (value.path === void 0 || string(value.path));
+function assertRepositoryContext(value, teamId) {
+  if (!object2(value) || !keys(value, [
+    "version",
+    "teamId",
+    "rootIdentity",
+    "target",
+    "capturedAt",
+    "fingerprint",
+    "instructions",
+    "commands",
+    "git"
+  ]) || value.version !== 1 || !string(value.teamId, 256) || teamId !== void 0 && value.teamId !== teamId || value.rootIdentity !== null && !digest(value.rootIdentity) || !string(value.target) || !count(value.capturedAt) || !digest(value.fingerprint) || !object2(value.instructions) || !object2(value.commands) || !object2(value.git) || Buffer.byteLength(JSON.stringify(value)) > 256 * 1024)
+    throw new Error("Invalid repository context report");
+  const instructions = value.instructions;
+  const commands = value.commands;
+  const git = value.git;
+  if (!keys(instructions, ["state", "issues", "files"]) || !keys(commands, ["state", "issues", "sources", "candidates"]) || !keys(git, [
+    "state",
+    "root",
+    "branch",
+    "head",
+    "headState",
+    "staged",
+    "unstaged",
+    "untracked",
+    "conflicted",
+    "issues"
+  ]) || !["complete", "incomplete"].includes(String(instructions.state)) || !list3(instructions.issues, 128, issue) || !list3(
+    instructions.files,
+    17,
+    (file) => object2(file) && keys(file, ["path", "scope", "precedence", "sha256", "content"]) && string(file.path) && string(file.scope) && count(file.precedence) && digest(file.sha256) && string(file.content, 64 * 1024) && Buffer.byteLength(file.content) <= 64 * 1024
+  ) || !["complete", "incomplete"].includes(String(commands.state)) || !list3(commands.issues, 128, issue) || !list3(
+    commands.sources,
+    32,
+    (source) => object2(source) && keys(source, ["path", "sha256"]) && string(source.path) && digest(source.sha256)
+  ) || !list3(
+    commands.candidates,
+    32,
+    (candidate) => object2(candidate) && keys(candidate, [
+      "source",
+      "sha256",
+      "location",
+      "cwd",
+      "command",
+      "kind",
+      "packageManager"
+    ]) && string(candidate.source) && digest(candidate.sha256) && string(candidate.location) && string(candidate.cwd) && string(candidate.command) && ["script", "excerpt"].includes(String(candidate.kind)) && [null, "npm", "pnpm", "yarn"].includes(candidate.packageManager)
+  ) || !["available", "unavailable", "not_repository"].includes(String(git.state)) || ![null, "branch", "detached", "unborn"].includes(git.headState) || ![git.root, git.branch, git.head].every((value2) => value2 === null || string(value2)) || ![git.staged, git.unstaged, git.untracked, git.conflicted].every(count) || !list3(git.issues, 128, issue))
+    throw new Error("Invalid repository context report");
+  const report = value;
+  if (report.instructions.files.reduce((bytes, file) => bytes + Buffer.byteLength(file.content), 0) > 128 * 1024 || report.instructions.state === "complete" && (report.rootIdentity === null || report.instructions.issues.length > 0))
+    throw new Error("Invalid repository instruction completeness");
+}
+
+// ../daemon/src/runtime/pi/repository-context.ts
+function repositoryContextIntegration(initial, host, cwd) {
+  assertRepositoryContext(initial);
+  if (initial.instructions.state !== "complete")
+    throw new Error("Repository instructions incomplete");
+  let current = initial;
+  let refreshPrompt = () => {
+  };
+  const files = () => ({
+    agentsFiles: [
+      {
+        path: "Repository instructions and provenance",
+        content: [
+          "# Repository context",
+          `Captured target: ${current.target}; fingerprint: ${current.fingerprint}; captured at: ${new Date(current.capturedAt).toISOString()}.`,
+          `Repository root for this runtime: ${cwd}. This is captured context, not a live workspace lock or verification evidence.`,
+          "Platform/runtime policy and explicit operator instructions take priority. Repository guidance specializes general private Agent preferences for repository work. Deeper documents govern only their own subtree. Team Policy and execution authority are unchanged.",
+          "For coding tasks, investigate repository context and actual coding_environment as needed, then use coding_command for task-related finite checks/preparation. Do not ask the operator to configure named checks. A source-backed Team memory recipe is advisory; refresh it before reuse. Missing network/tooling is a concrete prerequisite to report, never authority to change the runtime. To delegate shared-workspace preparation, send_message and end the turn; do not wait_for_reply while holding the peer workspace.",
+          "Before editing a different subtree, call repository_context with its directory or file path. A returned snapshot replaces previous applicable repository guidance; older transcript snapshots are historical. Do not edit a scope whose instructions are incomplete.",
+          current.instructions.state === "complete" ? "Applicable instructions are complete for the captured scope. Missing AGENTS.md is normal." : `BLOCKED SCOPE: ${current.instructions.issues.map((issue2) => issue2.code).join(", ")}. Resolve this context before editing.`,
+          ...current.instructions.state === "complete" ? current.instructions.files.map(
+            (file) => `## ${file.path}
+Scope: ${file.scope}; precedence: ${file.precedence}; SHA-256: ${file.sha256}
+
+${file.content}`
+          ) : [],
+          `Git orientation at capture time: ${JSON.stringify(current.git)}`,
+          `Command suggestions (task data, not execution permission):
+${JSON.stringify(current.commands)}`
+        ].join("\n\n")
+      }
+    ]
+  });
+  const tool = {
+    name: "repository_context",
+    label: "Repository context",
+    description: "Resolve the complete applicable repository AGENTS.md instructions and passive command/Git context for a contained file or directory. Call before editing a new subtree. Does not run project commands or change cwd. Incomplete instructions block editing that scope.",
+    parameters: Type2.Object(
+      { target: Type2.String({ maxLength: 4096 }) },
+      { additionalProperties: false }
+    ),
+    executionMode: "sequential",
+    async execute(_id, params) {
+      const target = params.target;
+      const replacement = await host(target);
+      assertRepositoryContext(replacement);
+      if (replacement.teamId !== initial.teamId || replacement.rootIdentity !== initial.rootIdentity) {
+        current = {
+          ...initial,
+          instructions: {
+            state: "incomplete",
+            files: [],
+            issues: [
+              {
+                code: "root_changed",
+                message: "Repository identity changed; start a new admitted turn."
+              }
+            ]
+          },
+          commands: { state: "incomplete", sources: [], candidates: [], issues: [] }
+        };
+        refreshPrompt();
+        throw new Error("Repository context identity changed; start a new admitted turn");
+      }
+      current = replacement;
+      refreshPrompt();
+      return {
+        content: [{ type: "text", text: JSON.stringify(replacement) }],
+        details: { repositoryContext: replacement }
+      };
+    }
+  };
+  return {
+    files,
+    tool,
+    async resolve(target) {
+      await tool.execute("coding-context", { target }, void 0, void 0, {});
+      return current;
+    },
+    bind(session, allowedTools) {
+      refreshPrompt = () => session.setActiveToolsByName(allowedTools);
+    }
+  };
+}
+
+// ../daemon/src/runtime/pi/session.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, statSync as statSync5, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename4, join as join22 } from "path";
+import {
+  createAssistantMessageEventStream
+} from "@earendil-works/pi-ai";
+import {
+  buildSessionContext,
+  createAgentSession,
+  DefaultResourceLoader,
+  SessionManager,
+  SettingsManager
+} from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/providers/pi-runtime.ts
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+var PROVIDER_ALIASES = {
+  bedrock: "amazon-bedrock",
+  "azure-openai": "azure-openai-responses"
+};
+var PROTECTED_PROVIDER_NAMES = [
+  "anthropic",
+  "openai",
+  "openai-codex",
+  "google",
+  "google-vertex",
+  "azure-openai",
+  "bedrock",
+  "mistral",
+  "groq",
+  "cerebras",
+  "xai",
+  "zai",
+  "huggingface",
+  "openrouter",
+  "vercel-ai-gateway",
+  "deepseek",
+  "fireworks",
+  "together",
+  "baseten",
+  "moonshotai",
+  "moonshotai-cn",
+  "kimi-coding",
+  "minimax",
+  "minimax-cn",
+  "qwen-token-plan",
+  "qwen-token-plan-cn",
+  "qwen-token-plan-individual",
+  "xiaomi",
+  "xiaomi-token-plan-ams",
+  "xiaomi-token-plan-cn",
+  "xiaomi-token-plan-sgp",
+  "ant-ling",
+  "nvidia",
+  "opencode",
+  "opencode-go",
+  "zai-coding-cn",
+  "github-copilot",
+  "cloudflare-ai-gateway",
+  "cloudflare-workers-ai",
+  "lmstudio",
+  "ollama",
+  "llamacpp"
+];
+var LOCAL_PROVIDERS = {
+  lmstudio: {
+    baseUrl: "http://127.0.0.1:1234/v1",
+    apiKey: "lm-studio",
+    authHeader: false
+  },
+  ollama: { baseUrl: "http://127.0.0.1:11434/v1", apiKey: "ollama", authHeader: false },
+  llamacpp: { baseUrl: "http://127.0.0.1:8080/v1", apiKey: "no-key", authHeader: true }
+};
+var PROVIDER_API_KEY_ENV = {
+  anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+  openai: ["OPENAI_API_KEY"],
+  google: ["GEMINI_API_KEY"],
+  "azure-openai": ["AZURE_OPENAI_API_KEY"],
+  mistral: ["MISTRAL_API_KEY"],
+  groq: ["GROQ_API_KEY"],
+  cerebras: ["CEREBRAS_API_KEY"],
+  xai: ["XAI_API_KEY"],
+  zai: ["ZAI_API_KEY"],
+  huggingface: ["HF_TOKEN"],
+  openrouter: ["OPENROUTER_API_KEY"],
+  "vercel-ai-gateway": ["AI_GATEWAY_API_KEY"],
+  deepseek: ["DEEPSEEK_API_KEY"],
+  fireworks: ["FIREWORKS_API_KEY"],
+  together: ["TOGETHER_API_KEY"],
+  baseten: ["BASETEN_API_KEY"],
+  moonshotai: ["MOONSHOT_API_KEY"],
+  "moonshotai-cn": ["MOONSHOT_CN_API_KEY"],
+  "kimi-coding": ["KIMI_API_KEY"],
+  minimax: ["MINIMAX_API_KEY"],
+  "minimax-cn": ["MINIMAX_CN_API_KEY"],
+  "qwen-token-plan": ["QWEN_TOKEN_PLAN_API_KEY"],
+  "qwen-token-plan-cn": ["QWEN_TOKEN_PLAN_CN_API_KEY"],
+  "qwen-token-plan-individual": ["QWEN_TOKEN_PLAN_API_KEY"],
+  xiaomi: ["XIAOMI_API_KEY"],
+  "xiaomi-token-plan-ams": ["XIAOMI_TOKEN_PLAN_AMS_API_KEY"],
+  "xiaomi-token-plan-cn": ["XIAOMI_TOKEN_PLAN_CN_API_KEY"],
+  "xiaomi-token-plan-sgp": ["XIAOMI_TOKEN_PLAN_SGP_API_KEY"],
+  "ant-ling": ["ANT_LING_API_KEY"],
+  nvidia: ["NVIDIA_API_KEY"],
+  opencode: ["OPENCODE_API_KEY"],
+  "opencode-go": ["OPENCODE_GO_API_KEY"],
+  "zai-coding-cn": ["ZAI_CODING_CN_API_KEY"],
+  "github-copilot": ["COPILOT_GITHUB_TOKEN"],
+  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY"],
+  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY"],
+  lmstudio: ["LMSTUDIO_API_KEY"],
+  ollama: ["OLLAMA_API_KEY"],
+  llamacpp: ["LLAMACPP_API_KEY"]
+};
+var PROVIDER_CREDENTIAL_ENV = {
+  bedrock: [
+    "AWS_PROFILE",
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION"
+  ],
+  "google-vertex": [
+    "GOOGLE_CLOUD_PROJECT",
+    "GOOGLE_CLOUD_LOCATION",
+    "GOOGLE_APPLICATION_CREDENTIALS"
+  ],
+  "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_GATEWAY_ID"],
+  "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID"]
+};
+function piProviderName(providerName) {
+  return PROVIDER_ALIASES[providerName] ?? providerName;
+}
+function providerApiKey(providerName, env) {
+  for (const name of PROVIDER_API_KEY_ENV[providerName] ?? []) {
+    const value = env[name];
+    if (value) return value;
+  }
+  return LOCAL_PROVIDERS[providerName]?.apiKey;
+}
+function providerBaseUrl(providerName, env) {
+  switch (providerName) {
+    case "lmstudio":
+      return env.LMSTUDIO_URL ?? LOCAL_PROVIDERS.lmstudio?.baseUrl;
+    case "ollama":
+      return env.OLLAMA_URL ?? LOCAL_PROVIDERS.ollama?.baseUrl;
+    case "llamacpp":
+      return env.LLAMACPP_URL ?? LOCAL_PROVIDERS.llamacpp?.baseUrl;
+    case "vercel-ai-gateway":
+      return env.AI_GATEWAY_BASE_URL;
+    default:
+      return void 0;
   }
-  let id;
-  let volumes;
-  try {
-    id = JSON.parse(raw.slice(0, separator));
-    volumes = JSON.parse(raw.slice(separator + 1));
-  } catch {
-    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+}
+function providerCredentialEnv(providerName, env) {
+  const result = {};
+  for (const name of PROVIDER_CREDENTIAL_ENV[providerName] ?? []) {
+    const value = env[name];
+    if (value !== void 0) result[name] = value;
   }
-  if (typeof id !== "string" || !id.startsWith("sha256:")) {
-    throw new Error(`Docker sandbox received an invalid image id for "${image}"`);
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function fallbackApi(providerName) {
+  switch (providerName) {
+    case "anthropic":
+      return "anthropic-messages";
+    case "google":
+      return "google-generative-ai";
+    case "google-vertex":
+      return "google-vertex";
+    case "azure-openai":
+      return "azure-openai-responses";
+    case "bedrock":
+      return "bedrock-converse-stream";
+    case "openai-codex":
+      return "openai-codex-responses";
+    default:
+      return "openai-completions";
   }
-  if (volumes !== null && typeof volumes === "object" && Object.keys(volumes).length > 0) {
-    throw new Error(
-      `Docker sandbox image "${image}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
+}
+var UnknownModelError = class extends Error {
+  providerName;
+  modelId;
+  // Fields are declared explicitly, not as constructor parameter properties:
+  // worker subprocesses run Node's strip-only TypeScript, which rejects them.
+  constructor(providerName, modelId) {
+    super(
+      `Unknown model "${modelId}" for provider "${providerName}": it is not in that provider's catalog, and no endpoint is configured for it. Choose a catalogued model, or configure an endpoint for a custom one.`
     );
+    this.name = "UnknownModelError";
+    this.providerName = providerName;
+    this.modelId = modelId;
   }
-  if (volumes !== null && (typeof volumes !== "object" || Array.isArray(volumes))) {
-    throw new Error(`Docker sandbox received invalid volume metadata for image "${image}"`);
-  }
-  return id;
+};
+function fallbackPiModel(providerName, modelId, baseUrl) {
+  return {
+    id: modelId,
+    name: modelId,
+    api: fallbackApi(providerName),
+    provider: piProviderName(providerName),
+    baseUrl: baseUrl ?? "",
+    reasoning: false,
+    input: ["text"],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 32768,
+    maxTokens: 4096
+  };
 }
-function runDockerInspection(dockerPath, args, processEnv, subject) {
-  return new Promise((resolve6, reject) => {
-    const child = spawn(dockerPath, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-      env: processEnv
-    });
-    let settled = false;
-    let stdout = "";
-    let stderr = "";
-    const finish = (error) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timeoutHandle);
-      if (error) {
-        reject(error);
-        return;
+async function createBazilionPiRuntime(options) {
+  const providerName = options.providerName;
+  const canonicalName = piProviderName(providerName);
+  const credentials = new InMemoryCredentialStore();
+  const apiKey = options.apiKey ?? providerApiKey(providerName, options.env);
+  const credentialEnv = providerCredentialEnv(providerName, options.env);
+  if (apiKey || credentialEnv) {
+    await credentials.modify(
+      canonicalName,
+      async () => canonicalName === "openai-codex" && apiKey ? {
+        type: "oauth",
+        access: apiKey,
+        // Bazilion owns refresh outside Pi. This deliberately empty value
+        // satisfies Pi's canonical OAuth shape but is never used because
+        // the token is long-lived only inside this one-shot runtime and
+        // mid-turn replacement is supplied through Agent.getApiKey.
+        refresh: "",
+        expires: Number.MAX_SAFE_INTEGER
+      } : {
+        type: "api_key",
+        ...apiKey ? { key: apiKey } : {},
+        ...credentialEnv ? { env: credentialEnv } : {}
       }
-      resolve6(stdout.trim());
-    };
-    const timeoutHandle = setTimeout(() => {
-      child.kill("SIGKILL");
-      finish(
-        new Error(
-          `Docker sandbox could not inspect ${subject} within ${DOCKER_CONTEXT_TIMEOUT_MS}ms`
-        )
-      );
-    }, DOCKER_CONTEXT_TIMEOUT_MS);
-    child.stdout.on("data", (data) => {
-      stdout = `${stdout}${data.toString("utf8")}`.slice(-4096);
-    });
-    child.stderr.on("data", (data) => {
-      stderr = `${stderr}${data.toString("utf8")}`.slice(-4096);
-    });
-    child.once("error", (error) => finish(formatSpawnError(dockerPath, error)));
-    child.once("close", (code) => {
-      if (code === 0) finish();
-      else
-        finish(
-          new Error(
-            `Docker sandbox could not inspect ${subject}: ${stderr.trim() || `Docker exited with status ${code}`}`
-          )
-        );
+    );
+  }
+  const runtime = await ModelRuntime.create({ credentials, modelsPath: null });
+  const local = LOCAL_PROVIDERS[providerName];
+  const baseUrl = options.baseUrl ?? providerBaseUrl(providerName, options.env);
+  if (local) {
+    const modelId = options.modelId ?? "model-name";
+    const model = fallbackPiModel(providerName, modelId, baseUrl ?? local.baseUrl);
+    runtime.registerProvider(canonicalName, {
+      baseUrl: baseUrl ?? local.baseUrl,
+      api: "openai-completions",
+      authHeader: local.authHeader,
+      apiKey: apiKey ?? local.apiKey,
+      models: [model]
     });
-  });
+  } else if (baseUrl) {
+    runtime.registerProvider(canonicalName, { baseUrl });
+  }
+  return runtime;
 }
-function buildDockerClientEnv(hostEnv) {
+async function createProtectedPiRuntime(options) {
   const env = {};
-  for (const key of DOCKER_CLIENT_ENV_KEYS) {
-    const value = hostEnv[key];
-    if (value !== void 0) env[key] = value;
-  }
-  return env;
+  for (const field of options.credentialEnv ?? []) env[field.name] = field.value;
+  return createBazilionPiRuntime({
+    providerName: options.providerName,
+    modelId: options.modelId,
+    env,
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl
+  });
 }
-function validateDockerPath(dockerPath) {
-  if (!dockerPath.trim()) throw new Error("Docker sandbox executable path is required");
-  if (dockerPath.includes("\0"))
-    throw new Error("Docker sandbox executable path contains a NUL byte");
+function resolvePiModel(runtime, providerName, modelId, baseUrl) {
+  const known = runtime.getModel(piProviderName(providerName), modelId);
+  if (known) return baseUrl ? { ...known, baseUrl } : known;
+  if (!baseUrl) throw new UnknownModelError(providerName, modelId);
+  return fallbackPiModel(providerName, modelId, baseUrl);
 }
-function validateImage(image) {
-  if (!image.trim()) throw new Error("Docker sandbox image is required");
-  if (image.startsWith("-")) {
-    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image)}`);
+
+// ../daemon/src/runtime/auth/openai-codex.ts
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+
+// ../daemon/src/runtime/providers/pi-adapter.ts
+import {
+  Type as Type3
+} from "@earendil-works/pi-ai";
+
+// ../daemon/src/runtime/session/prompt.ts
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
+import { join as join17 } from "path";
+
+// ../daemon/src/runtime/safe-files.ts
+import {
+  closeSync as closeSync5,
+  constants as constants5,
+  fstatSync as fstatSync4,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  openSync as openSync5,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync5
+} from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute4, relative as relative3, resolve as resolve4 } from "path";
+function resolveRealDirectory(path) {
+  const requested = resolve4(path);
+  const entry = lstatSync3(requested);
+  if (entry.isSymbolicLink() || !entry.isDirectory()) {
+    throw new Error("expected a real directory");
   }
-  if (image.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
+  return realpathSync5(requested);
 }
-function validateContainerName(containerName) {
-  if (!CONTAINER_NAME.test(containerName)) {
-    throw new Error(`Docker sandbox container name is invalid: ${JSON.stringify(containerName)}`);
+function readRegularFileNoFollow(path) {
+  const entry = lstatSync3(path);
+  if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
+  if (!entry.isFile()) throw new Error("target is not a regular file");
+  let fd;
+  try {
+    fd = openSync5(path, constants5.O_RDONLY | noFollowFlag());
+    if (!fstatSync4(fd).isFile()) throw new Error("target is not a regular file");
+    return readFileSync9(fd, "utf8");
+  } finally {
+    if (fd !== void 0) closeSync5(fd);
   }
 }
-function validateMountArgument(mountSource) {
-  if (!mountSource) throw new Error("Docker sandbox mount path is required");
-  if (mountSource.includes("\0") || mountSource.includes(",")) {
-    throw new Error(
-      `Docker sandbox mount path cannot be represented safely: ${JSON.stringify(mountSource)}`
-    );
-  }
+function noFollowFlag() {
+  return typeof constants5.O_NOFOLLOW === "number" ? constants5.O_NOFOLLOW : 0;
 }
-function validateReadOnlyMounts(mounts, workspaceSource) {
-  const targets = /* @__PURE__ */ new Set([CONTAINER_WORKDIR, "/tmp"]);
-  for (const mount of mounts) {
-    validateMountArgument(mount.source);
-    if (mount.sourceRoot !== void 0 && (!isAbsolute3(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
-      throw new Error(
-        `Docker sandbox read-only mount root is invalid: ${JSON.stringify(mount.sourceRoot)}`
-      );
-    }
-    if (!mount.target.startsWith("/") || mount.target.includes("\0") || mount.target.includes(",") || mount.target.split("/").includes("..")) {
-      throw new Error(
-        `Docker sandbox read-only mount target is invalid: ${JSON.stringify(mount.target)}`
-      );
-    }
-    if (mount.source === workspaceSource) {
-      throw new Error("Docker sandbox cannot mount the writable workspace again as an input");
-    }
-    if (targets.has(mount.target)) {
-      throw new Error(`Docker sandbox mount target is duplicated or reserved: ${mount.target}`);
+
+// ../daemon/src/runtime/session/prompt.ts
+var SANDBOX_SKILLS_DIR = "/skills";
+function loadPromptSkills(skillsDir, attachedNames) {
+  if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
+  const attached = new Set(attachedNames);
+  const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
+  const loaded = [];
+  for (const entry of discovered) {
+    const hostDir = join17(skillsDir, entry.name);
+    try {
+      const parsed = parseSkillContent(readRegularFileNoFollow(join17(hostDir, "SKILL.md")));
+      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
+      loaded.push({
+        name: entry.name,
+        description: parsed.frontmatter.description,
+        body: parsed.body.trim(),
+        hostDir,
+        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
+      });
+    } catch {
     }
-    targets.add(mount.target);
   }
+  return loaded;
 }
-function isWithin(root, candidate) {
-  const rel = relative3(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute3(rel);
-}
-function validateHostIdentity(uid, gid) {
-  if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
-    throw new Error(`Docker sandbox received an invalid host uid/gid: ${uid}:${gid}`);
-  }
+var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
+function loadProtectedHomeDocuments(agentDir) {
+  const root = resolveRealDirectory(agentDir);
+  const read = (file) => {
+    try {
+      return readRegularFileNoFollow(join17(root, file));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new Error(`private Agent home is unsafe at ${file}`);
+    }
+  };
+  return {
+    "AGENTS.md": read("AGENTS.md"),
+    "SOUL.md": read("SOUL.md"),
+    "TOOLS.md": read("TOOLS.md"),
+    "IDENTITY.md": read("IDENTITY.md"),
+    "BOOTSTRAP.md": read("BOOTSTRAP.md")
+  };
 }
-function formatSpawnError(dockerPath, error) {
-  const code = error.code;
-  if (code === "ENOENT") {
-    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
-  }
-  if (code === "EACCES") {
-    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+function buildSystemPrompt(agent, options = {}) {
+  const parts = [];
+  const homeDocuments = options.homeDocuments ?? loadProtectedHomeDocuments(agent.agent.dir);
+  const contextBlocks = [];
+  for (const file of CONTEXT_FILE_ORDER) {
+    const content = homeDocuments[file]?.trimEnd();
+    if (!content) continue;
+    contextBlocks.push(`## ${file}
+
+${content}`);
   }
-  return new Error(`Docker sandbox could not start "${dockerPath}": ${error.message}`);
-}
-function formatDockerRunError(spec, stderr) {
-  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
-  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
-    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  if (contextBlocks.length > 0) {
+    parts.push(`# Agent instructions
+
+${contextBlocks.join("\n\n")}`);
   }
-  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
-    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  const bootstrap = homeDocuments["BOOTSTRAP.md"]?.trimEnd();
+  if (bootstrap) {
+    parts.push(
+      [
+        "# First-Run Ritual",
+        "",
+        "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
+        "",
+        "## Hard rules",
+        "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
+        "- Each subsequent turn: at most one new question. Wait between turns.",
+        "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
+        "",
+        "## BOOTSTRAP.md",
+        "",
+        bootstrap
+      ].join("\n")
+    );
   }
-  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
-    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  parts.push(
+    [
+      "# Agent Home",
+      "",
+      "Your private home holds who you are \u2014 identity, soul, and behaviour rules. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
+      "",
+      "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
+      "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
+      "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
+      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
+    ].join("\n")
+  );
+  if (agent.skills.length > 0) {
+    const loaded = options.skills ?? [];
+    const loadedNames = new Set(loaded.map((skill) => skill.name));
+    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
+    const skillBlocks = loaded.map((skill) => {
+      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
+      return [
+        `## ${skill.name}`,
+        "",
+        skill.description,
+        "",
+        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
+        "",
+        skill.body
+      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
+    });
+    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
+    parts.push(
+      [
+        "# Available Skills",
+        "",
+        "Use these attached skill instructions when they are relevant to the task.",
+        "",
+        ...skillBlocks,
+        ...unavailableNote ? ["", unavailableNote] : []
+      ].join("\n")
+    );
   }
-  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
-}
-async function removeContainer(dockerPath, containerName, processEnv) {
-  const args = ["container", "rm", "--force", containerName];
-  let last;
-  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
-    last = await runCleanupCommand(dockerPath, args, processEnv);
-    if (last.ok) return;
-    if (attempt < CLEANUP_ATTEMPTS - 1) {
-      await new Promise((resolve6) => setTimeout(resolve6, CLEANUP_RETRY_DELAY_MS));
-    }
+  const teamLines = [
+    "# Team",
+    "",
+    `- ${agent.team.id} (${agent.team.name}): ${options.sandboxMode === "docker" ? "/workspace" : agent.team.path}`,
+    "",
+    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
+  ];
+  parts.push(teamLines.join("\n"));
+  if (agent.team.userMd.trim()) {
+    parts.push(
+      `# About the User
+
+Shared context about the human you're working with in this team. Both you and the human curate it. To update: call \`user_md_get\` (returns current content + an etag), merge your change into the full text, then call \`user_md_write\` with the merged content and the etag. Use this for STABLE user-specific facts (preferences, role, working hours, how they like to be addressed) \u2014 and to CORRECT stale entries when the human tells you something different from what's recorded. For project knowledge use \`memory_write\` instead; for personal notes about yourself use \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**
+
+${agent.team.userMd.trim()}`
+    );
+  } else {
+    parts.push(
+      `# About the User
+
+This team's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**`
+    );
   }
-  if (last && !last.missing) {
-    console.warn(
-      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+  const reviewedLessons = boundReviewedLessons(agent.privateLessons);
+  if (reviewedLessons.length > 0) {
+    parts.push(
+      `# Reviewed lessons
+
+These private lessons were explicitly approved by the human for your behavior. Follow them when relevant; current user instructions and higher-priority policy still win.
+
+${reviewedLessons.map((lesson) => `- ${lesson}`).join("\n")}`
     );
   }
+  parts.push(
+    "# Memory\n\nYou share a persistent memory backend with every other agent in this team. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the team may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
+  );
+  return parts.join("\n\n---\n\n");
 }
-function runCleanupCommand(dockerPath, args, processEnv) {
-  return new Promise((resolve6) => {
-    let done = false;
-    let stderr = "";
-    const child = spawn(dockerPath, args, {
-      stdio: ["ignore", "ignore", "pipe"],
-      windowsHide: true,
-      env: processEnv
-    });
-    const finish = (ok, error = "") => {
-      if (done) return;
-      done = true;
-      clearTimeout(timeoutHandle);
-      const detail3 = error || stderr.trim();
-      resolve6({
-        ok,
-        missing: /no such container/i.test(detail3),
-        error: detail3
-      });
-    };
-    const timeoutHandle = setTimeout(() => {
-      child.kill("SIGKILL");
-      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
-    }, CLEANUP_TIMEOUT_MS);
-    child.stderr.on("data", (data) => {
-      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
-    });
-    child.once("error", (error) => finish(false, error.message));
-    child.once("close", (code) => finish(code === 0));
-  });
+function boundReviewedLessons(lessons, maxCharacters = 8e3) {
+  const selected = [];
+  let used = 0;
+  for (const raw of lessons) {
+    const lesson = raw.trim();
+    if (!lesson) continue;
+    const remaining = maxCharacters - used;
+    if (remaining <= 0) break;
+    selected.push(lesson.slice(0, remaining));
+    used += Math.min(lesson.length, remaining);
+  }
+  return selected;
 }
 
 // ../daemon/src/runtime/shell/tooling.ts
+import { existsSync as existsSync11, lstatSync as lstatSync4, realpathSync as realpathSync6 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute5, join as join18, relative as relative4, sep as sep4 } from "path";
+import {
+  createBashToolDefinition,
+  createLocalBashOperations as createLocalBashOperations2,
+  defineTool as defineTool2
+} from "@earendil-works/pi-coding-agent";
 var HOST_CODING_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
 var HOST_FILE_TOOL_NAMES = ["read", "edit", "write", "grep", "find", "ls"];
 var CONTAINER_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var SANDBOX_INPUTS_DIR = "/inputs";
 var SANDBOX_MEMORY_DIR = "/workspace/memory";
-function createProtectedSessionShellTools(cwd, runtime, approvalHost) {
+function createProtectedSessionShellTools(cwd, runtime, approvalHost, lifecycle) {
+  const operations = createPreparedDockerBashOperations(runtime, lifecycle);
+  const modelCwd = codingContainerCwd(runtime.coding?.cwd ?? ".");
   const base = createBashToolDefinition(cwd, {
-    operations: createPreparedDockerBashOperations(runtime)
+    operations: {
+      exec(command, requestedCwd, options) {
+        if (requestedCwd !== modelCwd && requestedCwd !== cwd)
+          throw new Error("Protected command working directory differs from the admitted scope");
+        return operations.exec(command, cwd, options);
+      }
+    }
   });
   const dockerBash = defineTool2({
     ...base,
     label: "bash (protected Docker sandbox)",
-    description: `${base.description} Runs in an ephemeral, network-disabled Docker container with the Team workspace mounted read/write plus only the preflighted read-only memory, skill, and attachment mounts. Host files, host tools, and host credentials are unavailable.`
+    description: `${base.description} Default working directory: ${codingContainerCwd(runtime.coding?.cwd ?? ".")}. Runs in an ephemeral, network-disabled Docker container with the Team workspace mounted read/write plus only the preflighted read-only memory, skill, and attachment mounts. Host files, host tools, and host credentials are unavailable.`
   });
   return {
     config: {
@@ -2948,21 +3907,40 @@ function buildSandboxContainerEnv(env, allowlist) {
 }
 function createSessionShellTools(cwd, env, options = {}) {
   const config = resolveShellSecurityConfig(env);
+  if (options.preparedDocker) {
+    if (config.sandboxMode !== "docker")
+      throw new Error("Prepared coding environment cannot execute on the host");
+    const runtime = options.preparedDocker;
+    const base2 = createBashToolDefinition(cwd, {
+      operations: createPreparedDockerBashOperations(runtime, options.dockerLifecycle)
+    });
+    const tool = defineTool2({
+      ...base2,
+      label: "bash (prepared Docker sandbox)",
+      description: `${base2.description} Default working directory: ${codingContainerCwd(runtime.coding?.cwd ?? ".")}. Fresh network-disabled Docker container with the Team workspace and preflighted read-only mounts.`
+    });
+    return {
+      config: { ...config, sandboxImage: runtime.image, envAllowlist: [] },
+      hostToolNames: [],
+      customBash: config.approvalMode === "dangerous" ? createApprovalGatedBashTool(tool, options.approvalHost) : tool
+    };
+  }
   if (config.sandboxMode === "off" && config.approvalMode === "off") {
     return { config, hostToolNames: HOST_CODING_TOOL_NAMES };
   }
   if (config.sandboxMode === "off") {
     const base2 = createBashToolDefinition(cwd, {
-      operations: createLocalBashOperations()
+      operations: createLocalBashOperations2()
     });
     const customBash2 = createApprovalGatedBashTool(base2, options.approvalHost);
     return { config, hostToolNames: HOST_FILE_TOOL_NAMES, customBash: customBash2 };
   }
   const operations = createDockerBashOperations({
+    lifecycle: options.dockerLifecycle,
     image: config.sandboxImage,
     env: buildSandboxContainerEnv(env, config.envAllowlist),
     readOnlyMounts: [
-      ...existsSync11(join16(cwd, "memory")) ? [safeReadOnlyMount(join16(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
+      ...existsSync11(join18(cwd, "memory")) ? [safeReadOnlyMount(join18(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
       ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname4(options.inputsDir))] : [],
       ...(options.skillMounts ?? []).map(
         (mount) => safeReadOnlyMount(mount.source, mount.target, dirname4(mount.source))
@@ -2979,14 +3957,14 @@ function createSessionShellTools(cwd, env, options = {}) {
   return { config, hostToolNames: [], customBash };
 }
 function safeReadOnlyMount(source, target, expectedRoot) {
-  const info = lstatSync3(source);
+  const info = lstatSync4(source);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
   }
-  const sourceRoot = realpathSync4(expectedRoot);
-  const canonicalSource = realpathSync4(source);
+  const sourceRoot = realpathSync6(expectedRoot);
+  const canonicalSource = realpathSync6(source);
   const rel = relative4(sourceRoot, canonicalSource);
-  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute4(rel);
+  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute5(rel);
   if (!contained) {
     throw new Error(`Docker sandbox read-only mount escaped its configured root: ${source}`);
   }
@@ -2995,18 +3973,18 @@ function safeReadOnlyMount(source, target, expectedRoot) {
 
 // ../daemon/src/runtime/worker/runtime.ts
 import {
-  constants as constants5,
+  constants as constants6,
   existsSync as existsSync12,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync3,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync7,
   rmSync as rmSync11,
   statSync as statSync3
 } from "fs";
 import { access as access2 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { isAbsolute as isAbsolute5, join as join17, relative as relative5, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute6, join as join19, relative as relative5, sep as sep5 } from "path";
 var REDACTED_VALUE = "[REDACTED]";
 var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "off",
@@ -3017,6 +3995,9 @@ var REASONING_LEVELS = /* @__PURE__ */ new Set([
   "xhigh"
 ]);
 var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
+  "containerNamespace",
+  "configuredDocker",
+  "repositoryContext",
   "questionEnabled",
   "conversation",
   "kind",
@@ -3032,6 +4013,7 @@ var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
+  "repositoryContext",
   "conversation",
   "kind",
   "agent",
@@ -3042,6 +4024,8 @@ var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var PROTECTED_KEYS = /* @__PURE__ */ new Set([
+  "containerNamespace",
+  "repositoryContext",
   "questionEnabled",
   "conversation",
   "kind",
@@ -3058,7 +4042,9 @@ var PROTECTED_KEYS = /* @__PURE__ */ new Set([
   "scratch"
 ]);
 var PROTECTED_REQUIRED_KEYS = new Set(
-  [...PROTECTED_KEYS].filter((key) => key !== "images" && key !== "questionEnabled")
+  [...PROTECTED_KEYS].filter(
+    (key) => key !== "images" && key !== "questionEnabled" && key !== "containerNamespace"
+  )
 );
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
@@ -3119,11 +4105,21 @@ function validateMinimalWorkerProcessEnv(env, scratch, platform = process.platfo
 function parseWorkerInput(value) {
   const input = objectRecord(value, "worker input");
   const kind = input.kind;
+  if (input.containerNamespace !== void 0 && (typeof input.containerNamespace !== "string" || !/^[a-f0-9-]{36}$/.test(input.containerNamespace)))
+    throw new Error("Invalid container namespace");
   if (input.questionEnabled !== void 0 && typeof input.questionEnabled !== "boolean")
     throw new Error("Invalid worker question capability");
   if (kind === "configured_operator_http") {
     assertExactKeys(input, CONFIGURED_KEYS, "configured worker input", CONFIGURED_REQUIRED_KEYS);
     if (!isResolvedAgent(input.agent)) throw new Error("worker: configured input requires an agent");
+    if (input.configuredDocker !== void 0) {
+      const prepared = objectRecord(input.configuredDocker, "configured Docker inputs");
+      const keys2 = /* @__PURE__ */ new Set(["paths", "docker"]);
+      assertExactKeys(prepared, keys2, "configured Docker inputs", keys2);
+      assertProtectedWorkerPaths(prepared.paths, input.agent);
+      assertProtectedDockerRuntime(prepared.docker, prepared.paths);
+    }
+    assertRepositoryContext(input.repositoryContext, input.agent.team.id);
     requireString(input.message, "message");
     if (!Array.isArray(input.enabledProviders) || !input.enabledProviders.every(isString)) {
       throw new Error("worker: configured input requires enabledProviders");
@@ -3149,6 +4145,7 @@ function parseWorkerInput(value) {
   if (kind === "protected") {
     assertExactKeys(input, PROTECTED_KEYS, "protected worker input", PROTECTED_REQUIRED_KEYS);
     if (!isResolvedAgent(input.agent)) throw new Error("worker: protected input requires an agent");
+    assertRepositoryContext(input.repositoryContext, input.agent.team.id);
     requireString(input.message, "message");
     requireString(input.turnId, "turnId");
     assertConversationTarget(input.conversation);
@@ -3281,8 +4278,8 @@ function protectedRuntimeSecrets(runtime) {
     runtime.credentialFile?.content
   ].filter((value) => Boolean(value));
 }
-function redactExactValues(text, values) {
-  let redacted = text;
+function redactExactValues(text2, values) {
+  let redacted = text2;
   for (const value of [...new Set(values)].filter(Boolean).sort((a, b) => b.length - a.length)) {
     redacted = redacted.replaceAll(value, REDACTED_VALUE);
   }
@@ -3391,7 +4388,8 @@ function assertProtectedDockerRuntime(value, paths) {
       "gid",
       "workspace",
       "readOnlyMounts",
-      "containerEnv"
+      "containerEnv",
+      "coding"
     ]),
     "protected Docker runtime",
     /* @__PURE__ */ new Set([
@@ -3431,7 +4429,7 @@ function assertProtectedDockerRuntime(value, paths) {
       throw new Error(`worker: protected Docker executable identity has invalid ${name}`);
     }
   }
-  if (typeof runtime.endpoint !== "string" || !runtime.endpoint.startsWith("unix://") || !isAbsolute5(runtime.endpoint.slice("unix://".length)) || containsUnsafeDockerArgument(runtime.endpoint)) {
+  if (typeof runtime.endpoint !== "string" || !runtime.endpoint.startsWith("unix://") || !isAbsolute6(runtime.endpoint.slice("unix://".length)) || containsUnsafeDockerArgument(runtime.endpoint)) {
     throw new Error("worker: protected Docker endpoint must be a local Unix socket");
   }
   if (!nonEmptyString(runtime.image) || runtime.image.startsWith("-") || runtime.image.includes("\0") || runtime.image.includes("\n") || runtime.image.includes("\r")) {
@@ -3495,6 +4493,7 @@ function assertProtectedDockerRuntime(value, paths) {
     runtime.readOnlyMounts,
     paths
   );
+  if (runtime.coding !== void 0) validateDockerCodingSelection(runtime.coding);
   const containerEnv = objectRecord(runtime.containerEnv, "protected Docker container environment");
   const expectedContainerEnv = {
     PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -3544,11 +4543,11 @@ function containsUnsafeDockerArgument(value) {
 function requireCanonicalRealDirectory(value, name) {
   if (typeof value !== "string") throw new Error(`worker: ${name} must be a path`);
   try {
-    const entry = lstatSync4(value);
+    const entry = lstatSync5(value);
     if (entry.isSymbolicLink() || !entry.isDirectory()) {
       throw new Error("unsafe entry");
     }
-    const canonical = realpathSync5(value);
+    const canonical = realpathSync7(value);
     if (canonical !== value) throw new Error("non-canonical entry");
     return canonical;
   } catch {
@@ -3559,7 +4558,7 @@ function resolveCanonicalDirectory(value, name) {
   try {
     const entry = statSync3(value);
     if (!entry.isDirectory()) throw new Error("not a directory");
-    return realpathSync5(value);
+    return realpathSync7(value);
   } catch {
     throw new Error(`worker: ${name} is unavailable or unsafe`);
   }
@@ -3592,16 +4591,16 @@ function assertMinimalWorkerScratch(value) {
   }
 }
 function requireCanonicalWindowsDirectory(value, name) {
-  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
+  if (!value || !isAbsolute6(value) || !existsSync12(value) || !statSync3(value).isDirectory()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} directory`);
   }
-  return realpathSync5(value);
+  return realpathSync7(value);
 }
 function requireCanonicalWindowsFile(value, name) {
-  if (!value || !isAbsolute5(value) || !existsSync12(value) || !statSync3(value).isFile()) {
+  if (!value || !isAbsolute6(value) || !existsSync12(value) || !statSync3(value).isFile()) {
     throw new Error(`minimal worker bootstrap requires a valid ${name} executable`);
   }
-  return realpathSync5(value);
+  return realpathSync7(value);
 }
 function objectRecord(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -3636,13 +4635,13 @@ function isString(value) {
   return typeof value === "string";
 }
 function requireAbsolutePath(value, name) {
-  if (typeof value !== "string" || !isAbsolute5(value) || value.includes("\0")) {
+  if (typeof value !== "string" || !isAbsolute6(value) || value.includes("\0")) {
     throw new Error(`worker: ${name} must be an absolute path`);
   }
 }
 function lexicallyWithin(root, candidate) {
   const rel = relative5(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute5(rel);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute6(rel);
 }
 function assertConversationTarget(value) {
   const target = objectRecord(value, "conversation target");
@@ -3687,18 +4686,18 @@ function askUserTool(ask) {
         context.toolCallId,
         args
       );
-      const text = JSON.stringify(result);
-      return receipt ? { content: [{ type: "text", text }], questionReceipt: receipt } : text;
+      const text2 = JSON.stringify(result);
+      return receipt ? { content: [{ type: "text", text: text2 }], questionReceipt: receipt } : text2;
     }
   };
 }
 
 // ../daemon/src/runtime/pi/tools.ts
-import { Type as Type2 } from "typebox";
+import { Type as Type4 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
 import { existsSync as existsSync13, rmSync as rmSync12 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -3707,7 +4706,7 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join18(agentDir, "BOOTSTRAP.md");
+      const path = join20(agentDir, "BOOTSTRAP.md");
       if (existsSync13(path)) {
         rmSync12(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
@@ -3848,15 +4847,15 @@ function browserTools(host, agentId) {
 
 // ../daemon/src/runtime/tools/deliver-file.ts
 import {
-  closeSync as closeSync5,
-  constants as constants6,
-  fstatSync as fstatSync4,
-  openSync as openSync5,
-  readSync as readSync2,
-  realpathSync as realpathSync6,
+  closeSync as closeSync6,
+  constants as constants7,
+  fstatSync as fstatSync5,
+  openSync as openSync6,
+  readSync as readSync3,
+  realpathSync as realpathSync8,
   statSync as statSync4
 } from "fs";
-import { basename as basename3, extname, isAbsolute as isAbsolute6, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
+import { basename as basename3, extname, isAbsolute as isAbsolute7, relative as relative6, resolve as resolve5, sep as sep6 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -3874,13 +4873,13 @@ var MIME = {
 };
 function isWithin2(root, candidate) {
   const rel = relative6(root, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute6(rel);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute7(rel);
 }
 function deliverFileTool(cwd, sink, sessionId = "") {
   const workspacePath = resolve5(cwd);
   let workspaceRealPath = null;
   try {
-    workspaceRealPath = realpathSync6(workspacePath);
+    workspaceRealPath = realpathSync8(workspacePath);
   } catch {
   }
   return {
@@ -3902,7 +4901,7 @@ function deliverFileTool(cwd, sink, sessionId = "") {
     async invoke(args, context) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
-      if (isAbsolute6(p)) {
+      if (isAbsolute7(p)) {
         throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
       }
       const abs = resolve5(workspacePath, p);
@@ -3915,7 +4914,7 @@ function deliverFileTool(cwd, sink, sessionId = "") {
       let real;
       let expected;
       try {
-        real = realpathSync6(abs);
+        real = realpathSync8(abs);
         expected = statSync4(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
@@ -3925,13 +4924,13 @@ function deliverFileTool(cwd, sink, sessionId = "") {
       }
       let fd;
       try {
-        fd = openSync5(real, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
+        fd = openSync6(real, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
       let data;
       try {
-        const stat2 = fstatSync4(fd);
+        const stat2 = fstatSync5(fd);
         if (!stat2.isFile()) {
           throw new Error(`deliver_file: not a regular file: ${p}`);
         }
@@ -3940,7 +4939,7 @@ function deliverFileTool(cwd, sink, sessionId = "") {
         }
         let confirmedReal;
         try {
-          confirmedReal = realpathSync6(abs);
+          confirmedReal = realpathSync8(abs);
         } catch {
           throw new Error(`deliver_file: path changed during validation: ${p}`);
         }
@@ -3955,14 +4954,14 @@ function deliverFileTool(cwd, sink, sessionId = "") {
         const buffer = Buffer.alloc(MAX_DELIVER_BYTES + 1);
         let length = 0;
         while (length < buffer.length) {
-          const count = readSync2(fd, buffer, length, buffer.length - length, null);
-          if (count === 0) break;
-          length += count;
+          const count2 = readSync3(fd, buffer, length, buffer.length - length, null);
+          if (count2 === 0) break;
+          length += count2;
         }
         if (length > MAX_DELIVER_BYTES) throw new Error("deliver_file: file exceeds 25 MiB");
         data = buffer.subarray(0, length).toString("base64");
       } finally {
-        closeSync5(fd);
+        closeSync6(fd);
       }
       const name = basename3(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
@@ -3987,15 +4986,15 @@ function deliverFileTool(cwd, sink, sessionId = "") {
 
 // ../daemon/src/runtime/tools/home.ts
 import {
-  closeSync as closeSync6,
-  constants as constants7,
-  fstatSync as fstatSync5,
-  lstatSync as lstatSync5,
-  openSync as openSync6,
+  closeSync as closeSync7,
+  constants as constants8,
+  fstatSync as fstatSync6,
+  lstatSync as lstatSync6,
+  openSync as openSync7,
   readdirSync as readdirSync7,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
@@ -4060,18 +5059,18 @@ function homeTools(agentDir) {
         let fd;
         try {
           rejectExistingSymlinkOrNonFile(path);
-          fd = openSync6(
+          fd = openSync7(
             path,
-            constants7.O_WRONLY | constants7.O_CREAT | constants7.O_TRUNC | noFollowFlag(),
+            constants8.O_WRONLY | constants8.O_CREAT | constants8.O_TRUNC | noFollowFlag(),
             384
           );
-          if (!fstatSync5(fd).isFile()) throw new Error("target is not a regular file");
+          if (!fstatSync6(fd).isFile()) throw new Error("target is not a regular file");
           writeFileSync8(fd, content, "utf8");
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           throw new Error(`home_write: could not write ${file}: ${msg}`);
         } finally {
-          if (fd !== void 0) closeSync6(fd);
+          if (fd !== void 0) closeSync7(fd);
         }
         return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
       }
@@ -4087,7 +5086,7 @@ function homeTools(agentDir) {
         for (const file of HOME_FILES_READABLE) {
           const path = privateHomeFile(homeRoot, file);
           try {
-            const s = lstatSync5(path);
+            const s = lstatSync6(path);
             if (s.isSymbolicLink() || !s.isFile()) continue;
             entries.push(`${file} (${s.size}b)`);
           } catch {
@@ -4116,10 +5115,10 @@ function resolvePrivateHomeRoot(agentDir) {
   }
 }
 function privateHomeFile(homeRoot, file) {
-  return join19(homeRoot, file);
+  return join21(homeRoot, file);
 }
 function rejectSymlinkOrNonFile(path) {
-  const entry = lstatSync5(path);
+  const entry = lstatSync6(path);
   if (entry.isSymbolicLink()) throw new Error("symbolic links are not allowed");
   if (!entry.isFile()) throw new Error("target is not a regular file");
 }
@@ -4253,9 +5252,9 @@ function messagingTools(host, fromAgentId) {
       },
       async invoke(args) {
         const to = String(args.to ?? "");
-        const text = String(args.text ?? "");
+        const text2 = String(args.text ?? "");
         if (!to) throw new Error('send_message: "to" is required');
-        if (!text) throw new Error('send_message: "text" is required');
+        if (!text2) throw new Error('send_message: "text" is required');
         if (!await host.agentExists(to)) {
           throw new Error(`send_message: agent not found: ${to}`);
         }
@@ -4263,7 +5262,7 @@ function messagingTools(host, fromAgentId) {
         const { messageId } = await host.sendMessage({
           from: fromAgentId,
           to,
-          payload: JSON.stringify({ text }),
+          payload: JSON.stringify({ text: text2 }),
           replyTo
         });
         return `sent message ${messageId}`;
@@ -4323,7 +5322,7 @@ function messagingTools(host, fromAgentId) {
     {
       def: {
         name: "wait_for_reply",
-        description: "Block until a reply to a message you sent arrives, or until the timeout expires.",
+        description: "Wait for a reply only when the peer does not need your current workspace. For shared-workspace preparation, send_message and end this turn; the inbox reply resumes work after cleanup releases ownership.",
         parameters: {
           type: "object",
           properties: {
@@ -4439,25 +5438,25 @@ function normalizeWhitespace(value) {
 function htmlToMarkdown(html) {
   const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
   const title = titleMatch ? normalizeWhitespace(stripTags(titleMatch[1] ?? "")) : void 0;
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
-  text = text.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
+  let text2 = html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<noscript[\s\S]*?<\/noscript>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
+  text2 = text2.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
     const label = normalizeWhitespace(stripTags(body));
     return label ? `[${label}](${href})` : href;
   });
-  text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
+  text2 = text2.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
     const n = Math.max(1, Math.min(6, Number.parseInt(level, 10)));
     return `
 ${"#".repeat(n)} ${normalizeWhitespace(stripTags(body))}
 `;
   });
-  text = text.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, (_, body) => {
+  text2 = text2.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, (_, body) => {
     const label = normalizeWhitespace(stripTags(body));
     return label ? `
 - ${label}` : "";
   });
-  text = text.replace(/<(br|hr)\s*\/?>/gi, "\n").replace(/<\/(p|div|section|article|tr|ul|ol|table|blockquote)>/gi, "\n");
-  text = stripTags(text);
-  return { text: normalizeWhitespace(text), title };
+  text2 = text2.replace(/<(br|hr)\s*\/?>/gi, "\n").replace(/<\/(p|div|section|article|tr|ul|ol|table|blockquote)>/gi, "\n");
+  text2 = stripTags(text2);
+  return { text: normalizeWhitespace(text2), title };
 }
 function markdownToPlain(md) {
   let t = md;
@@ -4491,8 +5490,8 @@ function extractReadable(html, url, mode) {
     if (!parsed?.content) return fallback();
     const title = parsed.title || void 0;
     if (mode === "text") {
-      const text = normalizeWhitespace(parsed.textContent ?? "");
-      return text ? { text, title } : fallback();
+      const text2 = normalizeWhitespace(parsed.textContent ?? "");
+      return text2 ? { text: text2, title } : fallback();
     }
     const rendered = htmlToMarkdown(parsed.content);
     return { text: rendered.text, title: title ?? rendered.title };
@@ -4803,9 +5802,9 @@ async function readBodyCapped(res, maxBytes) {
   const decoder = new TextDecoder(charset, { fatal: false });
   const reader = res.body?.getReader();
   if (!reader) {
-    const text = await res.text();
-    if (text.length > maxBytes) return { text: text.slice(0, maxBytes), truncated: true };
-    return { text, truncated: false };
+    const text2 = await res.text();
+    if (text2.length > maxBytes) return { text: text2.slice(0, maxBytes), truncated: true };
+    return { text: text2, truncated: false };
   }
   const chunks = [];
   let total = 0;
@@ -4862,8 +5861,8 @@ async function firecrawlScrape(url, mode, env, fetchFn, timeoutMs) {
     if (!body.success || !body.data?.markdown) return null;
     const md = body.data.markdown;
     const title = body.data.metadata?.title;
-    const text = mode === "text" ? markdownToPlain(md) : md;
-    return title ? { text, title } : { text };
+    const text2 = mode === "text" ? markdownToPlain(md) : md;
+    return title ? { text: text2, title } : { text: text2 };
   } catch {
     return null;
   } finally {
@@ -5059,7 +6058,7 @@ function ourToolToPiTool(h) {
     name: h.def.name,
     label: h.def.name,
     description: h.def.description,
-    parameters: Type2.Unsafe(h.def.parameters),
+    parameters: Type4.Unsafe(h.def.parameters),
     async execute(toolCallId, params) {
       const out = await h.invoke(params, { toolCallId });
       return {
@@ -5156,8 +6155,10 @@ async function createBazilionSession(opts) {
   const cwd = agent.team.path;
   if (!existsSync14(cwd)) mkdirSync7(cwd, { recursive: true });
   const promptSkills = restricted ? [] : loadPromptSkills(paths.skillsDir, agent.skills);
-  const uploadsDir = join20(agent.agent.dir, "uploads");
+  const uploadsDir = join22(agent.agent.dir, "uploads");
   const shellTools = restricted ? null : createSessionShellTools(cwd, env, {
+    preparedDocker: opts.preparedDocker,
+    dockerLifecycle: opts.dockerLifecycle,
     ...existsSync14(uploadsDir) ? { inputsDir: uploadsDir } : {},
     skillMounts: promptSkills.map((skill) => ({
       source: skill.hostDir,
@@ -5165,7 +6166,7 @@ async function createBazilionSession(opts) {
     })),
     approvalHost: bashApprovalHost
   });
-  const sessionDir = restricted?.sessionDir ?? join20(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = restricted?.sessionDir ?? join22(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync7(sessionDir, { recursive: true });
   const existing = restricted ? null : explicitConversationFile(sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
@@ -5182,9 +6183,14 @@ async function createBazilionSession(opts) {
     skills: promptSkills,
     sandboxMode: shellTools?.config.sandboxMode ?? "off"
   });
+  const repository = !restricted && opts.repositoryContext && opts.repositoryContextHost ? repositoryContextIntegration(
+    opts.repositoryContext,
+    opts.repositoryContextHost,
+    shellTools?.config.sandboxMode === "docker" ? "/workspace" : cwd
+  ) : void 0;
   const resourceLoader = new DefaultResourceLoader({
     cwd,
-    agentDir: join20(paths.home, "pi"),
+    agentDir: join22(paths.home, "pi"),
     settingsManager,
     noExtensions: true,
     noSkills: true,
@@ -5193,6 +6199,7 @@ async function createBazilionSession(opts) {
     noContextFiles: true,
     appendSystemPrompt: bazilionPrompt ? [bazilionPrompt] : void 0
   });
+  if (repository) resourceLoader.getAgentsFiles = repository.files;
   await resourceLoader.reload();
   const bazilionTools = restricted ? restricted.tools : createBazilionCustomTools({
     agent,
@@ -5207,11 +6214,28 @@ async function createBazilionSession(opts) {
     sessionId: sessionManager.getSessionId(),
     env
   });
+  if (repository) bazilionTools.push(repository.tool);
+  if (repository && opts.codingHost && shellTools && shellTools.config.sandboxMode === "docker" && !opts.preparedDocker)
+    throw new Error("Coding commands require the admitted Docker runtime");
+  const redactionSecrets = uniqueSecrets(codingSecrets(env));
+  if (repository && opts.codingHost && shellTools)
+    bazilionTools.push(
+      ...codingTools({
+        host: opts.codingHost,
+        root: cwd,
+        context: repository.resolve,
+        docker: opts.preparedDocker,
+        lifecycle: opts.dockerLifecycle,
+        approval: shellTools.config.approvalMode === "dangerous",
+        approvalHost: bashApprovalHost,
+        secrets: () => redactionSecrets
+      })
+    );
   const customTools = shellTools?.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
   const allowedTools = [...shellTools?.hostToolNames ?? [], ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join20(paths.home, "pi"),
+    agentDir: join22(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(restricted?.reasoningLevel ?? agent.reasoningLevel),
     tools: allowedTools,
@@ -5221,11 +6245,14 @@ async function createBazilionSession(opts) {
     modelRuntime,
     resourceLoader
   });
+  repository?.bind(session, allowedTools);
   if (refreshApiKey) {
     session.agent.getApiKey = async (requestedProvider) => {
       if (requestedProvider !== piProviderName(providerName)) return void 0;
       try {
-        return await refreshApiKey(providerName);
+        const token = await refreshApiKey(providerName);
+        if (token && !redactionSecrets.includes(token)) redactionSecrets.push(token);
+        return token;
       } catch {
         return void 0;
       }
@@ -5265,8 +6292,10 @@ async function createProtectedBazilionSession(opts) {
   const shellTools = createProtectedSessionShellTools(
     opts.paths.teamDir,
     opts.docker,
-    opts.bashApprovalHost
+    opts.bashApprovalHost,
+    opts.dockerLifecycle
   );
+  const modelCwd = codingContainerCwd(opts.docker.coding?.cwd ?? ".");
   mkdirSync7(opts.paths.sessionDir, { recursive: true });
   const existing = explicitConversationFile(opts.paths.sessionDir, opts.conversation);
   const sessionManager = existing ? SessionManager.open(existing, opts.paths.sessionDir, opts.paths.teamDir) : SessionManager.create(opts.paths.teamDir, opts.paths.sessionDir);
@@ -5279,8 +6308,13 @@ async function createProtectedBazilionSession(opts) {
     }),
     protectedRuntimeSecrets(opts.runtime)
   );
+  const repository = opts.repositoryContext && opts.repositoryContextHost ? repositoryContextIntegration(
+    redactJsonValue(opts.repositoryContext, protectedRuntimeSecrets(opts.runtime)),
+    opts.repositoryContextHost,
+    PROTECTED_MODEL_CWD
+  ) : void 0;
   const resourceLoader = new DefaultResourceLoader({
-    cwd: PROTECTED_MODEL_CWD,
+    cwd: modelCwd,
     agentDir: opts.scratch.piAgentDir,
     settingsManager,
     noExtensions: true,
@@ -5291,6 +6325,7 @@ async function createProtectedBazilionSession(opts) {
     systemPrompt: PROTECTED_BASE_SYSTEM_PROMPT,
     appendSystemPrompt: bazilionPrompt ? [bazilionPrompt] : void 0
   });
+  if (repository) resourceLoader.getAgentsFiles = repository.files;
   await resourceLoader.reload();
   const bazilionTools = createProtectedBazilionCustomTools({
     agent: opts.agent,
@@ -5301,10 +6336,25 @@ async function createProtectedBazilionSession(opts) {
     askUser: opts.askUser,
     sessionId: sessionManager.getSessionId()
   });
+  if (repository) bazilionTools.push(repository.tool);
+  const redactionSecrets = uniqueSecrets(protectedRuntimeSecrets(opts.runtime));
+  if (repository && opts.codingHost)
+    bazilionTools.push(
+      ...codingTools({
+        host: opts.codingHost,
+        root: opts.paths.teamDir,
+        context: repository.resolve,
+        docker: opts.docker,
+        lifecycle: opts.dockerLifecycle,
+        approval: true,
+        approvalHost: opts.bashApprovalHost,
+        secrets: () => redactionSecrets
+      })
+    );
   if (!shellTools.customBash) throw new Error("protected Docker bash tool is unavailable");
   const customTools = [...bazilionTools, shellTools.customBash];
   const { session } = await createAgentSession({
-    cwd: PROTECTED_MODEL_CWD,
+    cwd: modelCwd,
     agentDir: opts.scratch.piAgentDir,
     model,
     thinkingLevel: toPiThinkingLevel(opts.runtime.reasoningLevel),
@@ -5315,10 +6365,14 @@ async function createProtectedBazilionSession(opts) {
     modelRuntime,
     resourceLoader
   });
+  repository?.bind(
+    session,
+    customTools.map((tool) => tool.name)
+  );
   installProtectedCredentialBoundary(
     session,
     opts.runtime.providerName,
-    protectedRuntimeSecrets(opts.runtime),
+    redactionSecrets,
     opts.refreshApiKey
   );
   return sessionHandle(session);
@@ -5369,15 +6423,18 @@ async function createRestrictedReviewSession(opts) {
   installProtectedCredentialBoundary(
     session,
     opts.runtime.providerName,
-    protectedRuntimeSecrets(opts.runtime),
+    uniqueSecrets(protectedRuntimeSecrets(opts.runtime)),
     opts.refreshApiKey
   );
   return sessionHandle(session);
 }
+function uniqueSecrets(values) {
+  return [...new Set(values.filter(Boolean))];
+}
 function materializeProtectedCredentialFile(runtime, scratch) {
   const fields = [...runtime.credentialEnv ?? []];
   if (runtime.credentialFile) {
-    const path = join20(scratch.tempDir, "provider-credential.json");
+    const path = join22(scratch.tempDir, "provider-credential.json");
     writeFileSync9(path, runtime.credentialFile.content, {
       encoding: "utf8",
       mode: 384,
@@ -5398,8 +6455,7 @@ function createInMemorySettingsManager() {
     }
   });
 }
-function installProtectedCredentialBoundary(session, providerName, initialSecrets, refreshApiKey) {
-  const activeTokens = [...new Set(initialSecrets.filter(Boolean))];
+function installProtectedCredentialBoundary(session, providerName, activeTokens, refreshApiKey) {
   session.agent.state.messages = redactJsonValue(session.agent.state.messages, activeTokens);
   const originalStream = session.agent.streamFunction;
   session.agent.streamFunction = async (model, context, options) => {
@@ -5515,7 +6571,7 @@ function toPiThinkingLevel(level) {
 function explicitConversationFile(directory, target) {
   if (!target || !/^[0-9a-f-]{36}$/i.test(target.id) || target.filename !== `${target.id}.jsonl`)
     throw new Error("Explicit conversation target is required");
-  const file = join20(directory, target.filename);
+  const file = join22(directory, target.filename);
   readCanonicalSessionFile(directory, target.filename, target.id);
   return file;
 }
@@ -5636,6 +6692,21 @@ function createIpcMessagingHost(call) {
     approvalStatus: (agentId, approvalId) => call("approvalStatus", { agentId, approvalId })
   };
 }
+function createIpcDockerLifecycle(namespace, call) {
+  if (!namespace) return void 0;
+  return {
+    name: (kind) => `bazilion-${namespace}-${kind}-${randomUUID20()}`,
+    beforeCreate: async (identity2) => {
+      await call("containerBeforeCreate", { containerName: identity2.containerName });
+    },
+    afterCreate: async (containerName) => {
+      await call("containerAfterCreate", { containerName });
+    },
+    afterRemove: async (containerName) => {
+      await call("containerAfterRemove", { containerName });
+    }
+  };
+}
 function createIpcUserMdHost(call) {
   return {
     get: (teamId) => call("userMdGet", { teamId }),
@@ -5681,13 +6752,13 @@ function createReviewState(evidenceItems) {
       name: "propose_lesson",
       label: "propose_lesson",
       description: "Submit zero to five evidence-backed lesson proposals in one final batch. This is the only available action.",
-      parameters: Type3.Object({
-        proposals: Type3.Array(
-          Type3.Object({
-            scope: Type3.Union([Type3.Literal("private"), Type3.Literal("shared")]),
-            text: Type3.String({ minLength: 1, maxLength: 500 }),
-            evidenceEntryIds: Type3.Array(
-              Type3.Object({ sessionId: Type3.String(), entryOrdinal: Type3.Integer({ minimum: 0 }) }),
+      parameters: Type5.Object({
+        proposals: Type5.Array(
+          Type5.Object({
+            scope: Type5.Union([Type5.Literal("private"), Type5.Literal("shared")]),
+            text: Type5.String({ minLength: 1, maxLength: 500 }),
+            evidenceEntryIds: Type5.Array(
+              Type5.Object({ sessionId: Type5.String(), entryOrdinal: Type5.Integer({ minimum: 0 }) }),
               { minItems: 1 }
             )
           }),
@@ -5699,14 +6770,14 @@ function createReviewState(evidenceItems) {
         const input = params;
         const validated = [];
         for (const candidate of input.proposals) {
-          const text = candidate.text.trim();
-          if (!text || text.length > 500) throw new Error("proposal text must be 1-500 characters");
+          const text2 = candidate.text.trim();
+          if (!text2 || text2.length > 500) throw new Error("proposal text must be 1-500 characters");
           for (const evidence of candidate.evidenceEntryIds) {
             if (!allowedEvidence.has(`${evidence.sessionId}:${evidence.entryOrdinal}`)) {
               throw new Error("proposal cites evidence outside the supplied digest");
             }
           }
-          validated.push({ ...candidate, text });
+          validated.push({ ...candidate, text: text2 });
         }
         proposalBatchSubmitted = true;
         proposals.push(...validated);
@@ -5729,6 +6800,8 @@ function createReviewState(evidenceItems) {
   };
 }
 async function createSessionForInput(input, ipcCall) {
+  if (input.kind !== "restricted_review" && !input.repositoryContext)
+    throw new Error("Coding turn requires daemon-prepared repository context");
   if (input.kind === "configured_operator_http") {
     const paths = resolvePaths();
     const memory2 = qmdBackend(`${input.agent.team.path}/memory`);
@@ -5750,7 +6823,12 @@ async function createSessionForInput(input, ipcCall) {
     }) : void 0;
     const handle2 = await createBazilionSession({
       agent: input.agent,
+      preparedDocker: input.configuredDocker?.docker,
+      dockerLifecycle: createIpcDockerLifecycle(input.containerNamespace, ipcCall),
       conversation: input.conversation,
+      repositoryContext: input.repositoryContext,
+      repositoryContextHost: (target) => ipcCall("repositoryContext", { target }),
+      codingHost: { invoke: (request) => ipcCall("coding", request) },
       paths,
       env: process.env,
       memory: memory2,
@@ -5804,10 +6882,14 @@ async function createSessionForInput(input, ipcCall) {
   const handle = await createProtectedBazilionSession({
     agent: input.agent,
     conversation: input.conversation,
+    repositoryContext: input.repositoryContext,
+    repositoryContextHost: (target) => ipcCall("repositoryContext", { target }),
+    codingHost: { invoke: (request) => ipcCall("coding", request) },
     runtime: input.runtime,
     paths: input.paths,
     scratch: input.scratch,
     docker: input.docker,
+    dockerLifecycle: createIpcDockerLifecycle(input.containerNamespace, ipcCall),
     memory,
     messagingHost,
     userMdHost,