bazilion 0.16.0 → 0.18.0

package/dist/worker.js

@@ -1108,6 +1108,41 @@ function qmdBackend(root, options = {}) {
   };
 }
 
+// ../daemon/src/lib/coding-environment/receipt-reference.ts
+function codingLogReference(content) {
+  const parsed = objectFrom(textContent(content));
+  if (!parsed) return null;
+  return referenceFrom(parsed) ?? referenceFrom(objectFrom(parsed.receipt));
+}
+function referenceFrom(value) {
+  if (!value) return null;
+  const commandId = value.id;
+  const teamId = value.teamId;
+  if (typeof commandId !== "string" || commandId.length === 0) return null;
+  if (typeof teamId !== "string" || teamId.length === 0) return null;
+  return { commandId, teamId };
+}
+function textContent(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  let out = "";
+  for (const block of content) {
+    if (block && block.type === "text" && typeof block.text === "string") out += block.text;
+  }
+  return out;
+}
+function objectFrom(value) {
+  if (typeof value === "string") {
+    try {
+      return objectFrom(JSON.parse(value));
+    } catch {
+      return null;
+    }
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value;
+}
+
 // ../daemon/src/runtime/pi/events.ts
 function translatePiEvent(e) {
   switch (e.type) {
@@ -1147,6 +1182,22 @@ function translatePiEvent(e) {
       }
       return out;
     }
+    case "tool_execution_update": {
+      if (e.toolName !== "coding_command") return [];
+      const progress = e.partialResult?.details?.codingProgress;
+      if (!progress || typeof progress.id !== "string" || typeof progress.commandId !== "string" || typeof progress.output !== "string" || typeof progress.elapsedMs !== "number")
+        return [];
+      return [
+        {
+          type: "coding_progress",
+          id: progress.id,
+          commandId: progress.commandId,
+          output: progress.output,
+          truncated: progress.truncated === true,
+          elapsedMs: Math.max(0, Math.floor(progress.elapsedMs))
+        }
+      ];
+    }
     case "tool_execution_end": {
       if (e.toolName === "ask_user")
         return [
@@ -1254,14 +1305,22 @@ function piMessagesToProviderView(messages, questionResultVisible) {
       }
       case "toolResult": {
         const tr = m;
-        if (["repository_context", "coding_environment", "coding_command", "coding_receipt"].includes(
-          tr.toolName ?? ""
-        )) {
+        if ([
+          "repository_context",
+          "coding_environment",
+          "coding_command",
+          "coding_receipt",
+          "coding_log",
+          // BAZ-042: a snapshot result names withheld paths, so history must not render it.
+          "source_snapshot"
+        ].includes(tr.toolName ?? "")) {
+          const codingLog = codingLogReference(tr.content);
           out.push({
             role: "tool",
             toolCallId: tr.toolCallId,
             toolName: tr.toolName,
-            content: "Coding context or command evidence retained privately. Captured transport output follows its communication approval; ask the Agent for the relevant result."
+            content: "Coding context or command evidence retained privately. Captured transport output follows its communication approval; ask the Agent for the relevant result.",
+            ...codingLog ? { codingLog } : {}
           });
           break;
         }
@@ -1298,6 +1357,107 @@ function extractResultReference(value) {
   return typeof id === "string" && /^[a-f0-9-]{36}$/.test(id) ? { resultId: id } : void 0;
 }
 
+// ../daemon/src/lib/coding-environment/diagnostics.ts
+var CODING_OUTPUT_BYTES = 64 * 1024;
+var CODING_RETAINED_BYTES = 2 * 1024 * 1024;
+var CODING_LIVE_BYTES = 8 * 1024;
+function diagnosticTail(value, limit) {
+  const bytes = Buffer.from(value);
+  if (bytes.length <= limit) return { text: value, truncated: false };
+  let offset = bytes.length - limit;
+  while (offset < bytes.length && ((bytes[offset] ?? 0) & 192) === 128) offset++;
+  return { text: bytes.subarray(offset).toString("utf8"), truncated: true };
+}
+var CodingDiagnostics = class {
+  decoder = new TextDecoder();
+  secrets;
+  lookbehind;
+  retainBytes;
+  pending = "";
+  text = "";
+  truncated = false;
+  observedBytes = 0;
+  redactions = 0;
+  finished = false;
+  constructor(secrets, retainBytes = CODING_OUTPUT_BYTES) {
+    this.secrets = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+    this.lookbehind = Math.max(1, ...this.secrets.map((secret) => secret.length)) - 1;
+    this.retainBytes = retainBytes;
+  }
+  append(bytes) {
+    if (this.finished) throw new Error("Coding diagnostics already finalized");
+    this.observedBytes += bytes.length;
+    for (let offset = 0; offset < bytes.length; offset += 8192) {
+      this.pending += this.decoder.decode(bytes.subarray(offset, offset + 8192), { stream: true });
+      this.flush(false);
+    }
+  }
+  /**
+   * Redacted cumulative tail for a live update. Unlike `finish()` this does not seal
+   * the diagnostics: more output may follow. It deliberately excludes the trailing
+   * lookbehind bytes so a credential split across chunks cannot leak before the next
+   * chunk resolves it.
+   */
+  preview(limit = CODING_LIVE_BYTES) {
+    return diagnosticTail(this.text, limit);
+  }
+  finish() {
+    if (!this.finished) {
+      this.pending += this.decoder.decode();
+      this.flush(true);
+      this.finished = true;
+    }
+    return {
+      diagnostic: this.text,
+      truncated: this.truncated,
+      observedBytes: this.observedBytes,
+      redacted: this.redactions > 0
+    };
+  }
+  flush(final) {
+    let end = final ? this.pending.length : Math.max(0, this.pending.length - this.lookbehind);
+    const last = this.pending.charCodeAt(end - 1);
+    if (!final && last >= 55296 && last <= 56319) end--;
+    let offset = 0;
+    let safe = "";
+    while (offset < end) {
+      const secret = this.secrets.find((value) => this.pending.startsWith(value, offset));
+      if (secret) {
+        safe += "[redacted]";
+        this.redactions++;
+        offset += secret.length;
+      } else {
+        const code = this.pending.charCodeAt(offset);
+        const char = this.pending[offset] ?? "";
+        safe += code < 32 && code !== 9 && code !== 10 || code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : char;
+        offset++;
+      }
+    }
+    this.pending = this.pending.slice(offset);
+    const tail = diagnosticTail(this.text + safe, this.retainBytes);
+    this.text = tail.text;
+    this.truncated ||= tail.truncated;
+  }
+};
+function codingSecrets(env) {
+  const values = /* @__PURE__ */ new Set();
+  function collect(value, depth = 0) {
+    if (depth > 8) return;
+    if (typeof value === "string" && value.length >= 4) values.add(value);
+    else if (value && typeof value === "object")
+      for (const entry of Object.values(value)) collect(entry, depth + 1);
+  }
+  for (const [key, value] of Object.entries(env)) {
+    if (!value || !/KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)) continue;
+    values.add(value);
+    try {
+      collect(JSON.parse(value));
+    } catch {
+    }
+  }
+  return [...values];
+}
+
 // ../daemon/src/lib/result-source.ts
 import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, openSync as openSync2, readSync, realpathSync as realpathSync2 } from "fs";
 import { basename as basename2, join as join13 } from "path";
@@ -1387,67 +1547,6 @@ function validateCodingCommand(input) {
   };
 }
 
-// ../daemon/src/lib/coding-environment/diagnostics.ts
-var CODING_OUTPUT_BYTES = 64 * 1024;
-function diagnosticTail(value, limit) {
-  const bytes = Buffer.from(value);
-  if (bytes.length <= limit) return { text: value, truncated: false };
-  let offset = bytes.length - limit;
-  while (offset < bytes.length && ((bytes[offset] ?? 0) & 192) === 128) offset++;
-  return { text: bytes.subarray(offset).toString("utf8"), truncated: true };
-}
-var CodingDiagnostics = class {
-  decoder = new TextDecoder();
-  secrets;
-  lookbehind;
-  pending = "";
-  text = "";
-  truncated = false;
-  finished = false;
-  constructor(secrets) {
-    this.secrets = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
-    this.lookbehind = Math.max(1, ...this.secrets.map((secret) => secret.length)) - 1;
-  }
-  append(bytes) {
-    if (this.finished) throw new Error("Coding diagnostics already finalized");
-    for (let offset = 0; offset < bytes.length; offset += 8192) {
-      this.pending += this.decoder.decode(bytes.subarray(offset, offset + 8192), { stream: true });
-      this.flush(false);
-    }
-  }
-  finish() {
-    if (!this.finished) {
-      this.pending += this.decoder.decode();
-      this.flush(true);
-      this.finished = true;
-    }
-    return { diagnostic: this.text, truncated: this.truncated };
-  }
-  flush(final) {
-    let end = final ? this.pending.length : Math.max(0, this.pending.length - this.lookbehind);
-    const last = this.pending.charCodeAt(end - 1);
-    if (!final && last >= 55296 && last <= 56319) end--;
-    let offset = 0;
-    let safe = "";
-    while (offset < end) {
-      const secret = this.secrets.find((value) => this.pending.startsWith(value, offset));
-      if (secret) {
-        safe += "[redacted]";
-        offset += secret.length;
-      } else {
-        const code = this.pending.charCodeAt(offset);
-        const char = this.pending[offset] ?? "";
-        safe += code < 32 && code !== 9 && code !== 10 || code >= 127 && code <= 159 ? `\\u${code.toString(16).padStart(4, "0")}` : char;
-        offset++;
-      }
-    }
-    this.pending = this.pending.slice(offset);
-    const tail = diagnosticTail(this.text + safe, CODING_OUTPUT_BYTES);
-    this.text = tail.text;
-    this.truncated ||= tail.truncated;
-  }
-};
-
 // ../daemon/src/runtime/coding-directory.ts
 import { realpathSync as realpathSync4 } from "fs";
 import { join as join15 } from "path";
@@ -2895,6 +2994,7 @@ function runCleanupCommand(dockerPath, args, processEnv) {
 
 // ../daemon/src/runtime/pi/coding.ts
 function codingTools(input) {
+  const readSecrets = () => typeof input.secrets === "function" ? input.secrets() : input.secrets ?? [];
   const hostOperations = input.docker ? null : createLocalBashOperations();
   return [
     {
@@ -2935,7 +3035,7 @@ function codingTools(input) {
         { additionalProperties: false }
       ),
       executionMode: "sequential",
-      async execute(toolCallId, params, signal) {
+      async execute(toolCallId, params, signal, onUpdate) {
         const command = validateCodingCommand(params);
         const context = await input.context(command.cwd);
         if (context.instructions.state !== "complete")
@@ -2945,7 +3045,27 @@ function codingTools(input) {
           toolCallId,
           input: command
         });
-        const output = new CodingDiagnostics(input.secrets ?? []);
+        const output = new CodingDiagnostics(readSecrets());
+        let lastProgressAt = 0;
+        const emitProgress = (force) => {
+          if (!onUpdate) return;
+          const now = Date.now();
+          if (!force && now - lastProgressAt < 400) return;
+          lastProgressAt = now;
+          const preview = output.preview(CODING_LIVE_BYTES);
+          onUpdate({
+            content: [{ type: "text", text: preview.text }],
+            details: {
+              codingProgress: {
+                id: toolCallId,
+                commandId: started.id,
+                output: preview.text,
+                truncated: preview.truncated,
+                elapsedMs: Math.max(0, now - started.startedAt)
+              }
+            }
+          });
+        };
         let outcome;
         try {
           if (input.approval)
@@ -2966,8 +3086,16 @@ function codingTools(input) {
           const result = await operations.exec(
             command.command,
             input.docker ? input.root : cwd.path,
-            { onData: (bytes) => output.append(bytes), signal, timeout: command.timeoutSeconds }
+            {
+              onData: (bytes) => {
+                output.append(bytes);
+                emitProgress(false);
+              },
+              signal,
+              timeout: command.timeoutSeconds
+            }
           );
+          emitProgress(true);
           outcome = {
             state: result.exitCode === 0 ? "succeeded" : result.exitCode === null ? "interrupted" : "failed",
             exitCode: result.exitCode,
@@ -3012,6 +3140,74 @@ function codingTools(input) {
           details: { codingEvidence: value }
         };
       }
+    },
+    {
+      name: "coding_log",
+      label: "Read retained command output",
+      description: "Read a bounded page of retained diagnostic output for a coding receipt, or search it. Producing Agents may read their own logs; a teammate must pass the id of the policy-authorized message that carried coding-receipt:<id>. Output is bounded and may be truncated, expired, deleted or unavailable \u2014 report that state honestly and do not infer completeness from an exit code.",
+      parameters: Type.Object(
+        {
+          id: Type.String({ maxLength: 64 }),
+          messageId: Type.Optional(Type.String({ maxLength: 64 })),
+          search: Type.Optional(Type.String({ minLength: 1, maxLength: 256 })),
+          offset: Type.Optional(Type.Integer({ minimum: 0 })),
+          limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 65536 }))
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(_id, params) {
+        const values = params;
+        if (values.search !== void 0) {
+          const result = await input.host.invoke({
+            action: "log-search",
+            id: values.id,
+            query: values.search,
+            ...values.messageId !== void 0 ? { messageId: values.messageId } : {}
+          });
+          return {
+            content: [{ type: "text", text: JSON.stringify(result) }],
+            details: { codingLogSearch: result }
+          };
+        }
+        const value = await input.host.invoke({
+          action: "log",
+          id: values.id,
+          ...values.messageId !== void 0 ? { messageId: values.messageId } : {},
+          ...values.offset !== void 0 ? { offset: values.offset } : {},
+          ...values.limit !== void 0 ? { limit: values.limit } : {}
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { codingLog: value }
+        };
+      }
+    },
+    {
+      name: "source_snapshot",
+      label: "Capture the current source state",
+      description: "Capture a bounded snapshot of the repository source you are about to work from, and quote its reference in your summary. Call this once before you start editing: the reference is how a later change or verification is tied to the version it actually applies to. It is read-only and never changes the repository. The result may be incomplete \u2014 when it is, say so, because an incomplete snapshot cannot support a claim that code is unchanged. Untracked file content is never included unless you name each path.",
+      parameters: Type.Object(
+        {
+          includeUntracked: Type.Optional(
+            Type.Array(Type.String({ maxLength: 4096 }), { maxItems: 1e3 })
+          )
+        },
+        { additionalProperties: false }
+      ),
+      executionMode: "sequential",
+      async execute(toolCallId, params) {
+        const values = params;
+        const value = await input.host.invoke({
+          action: "snapshot",
+          toolCallId,
+          ...values.includeUntracked ? { includeUntracked: values.includeUntracked } : {}
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(value) }],
+          details: { sourceSnapshot: value }
+        };
+      }
     }
   ];
 }
@@ -3349,6 +3545,20 @@ function fallbackApi(providerName) {
       return "openai-completions";
   }
 }
+var UnknownModelError = class extends Error {
+  providerName;
+  modelId;
+  // Fields are declared explicitly, not as constructor parameter properties:
+  // worker subprocesses run Node's strip-only TypeScript, which rejects them.
+  constructor(providerName, modelId) {
+    super(
+      `Unknown model "${modelId}" for provider "${providerName}": it is not in that provider's catalog, and no endpoint is configured for it. Choose a catalogued model, or configure an endpoint for a custom one.`
+    );
+    this.name = "UnknownModelError";
+    this.providerName = providerName;
+    this.modelId = modelId;
+  }
+};
 function fallbackPiModel(providerName, modelId, baseUrl) {
   return {
     id: modelId,
@@ -3420,6 +3630,7 @@ async function createProtectedPiRuntime(options) {
 function resolvePiModel(runtime, providerName, modelId, baseUrl) {
   const known = runtime.getModel(piProviderName(providerName), modelId);
   if (known) return baseUrl ? { ...known, baseUrl } : known;
+  if (!baseUrl) throw new UnknownModelError(providerName, modelId);
   return fallbackPiModel(providerName, modelId, baseUrl);
 }
 
@@ -3835,6 +4046,16 @@ var PROTECTED_REQUIRED_KEYS = new Set(
     (key) => key !== "images" && key !== "questionEnabled" && key !== "containerNamespace"
   )
 );
+var VERIFICATION_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "verification",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -3958,6 +4179,27 @@ function parseWorkerInput(value) {
     assertMinimalWorkerScratch(input.scratch);
     return value;
   }
+  if (kind === "specialist_verification") {
+    assertExactKeys(input, VERIFICATION_KEYS, "verification worker input", VERIFICATION_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: verification input requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const verification = objectRecord(input.verification, "verification metadata");
+    assertExactKeys(
+      verification,
+      /* @__PURE__ */ new Set(["requestId", "attemptId"]),
+      "verification metadata",
+      /* @__PURE__ */ new Set(["requestId", "attemptId"])
+    );
+    requireString(verification.requestId, "requestId");
+    requireString(verification.attemptId, "attemptId");
+    return value;
+  }
   if (kind === "restricted_review") {
     assertExactKeys(input, REVIEW_KEYS, "restricted review worker input", REVIEW_KEYS);
     requireString(input.agentId, "agentId");
@@ -6006,6 +6248,7 @@ async function createBazilionSession(opts) {
   if (repository) bazilionTools.push(repository.tool);
   if (repository && opts.codingHost && shellTools && shellTools.config.sandboxMode === "docker" && !opts.preparedDocker)
     throw new Error("Coding commands require the admitted Docker runtime");
+  const redactionSecrets = uniqueSecrets(codingSecrets(env));
   if (repository && opts.codingHost && shellTools)
     bazilionTools.push(
       ...codingTools({
@@ -6016,7 +6259,7 @@ async function createBazilionSession(opts) {
         lifecycle: opts.dockerLifecycle,
         approval: shellTools.config.approvalMode === "dangerous",
         approvalHost: bashApprovalHost,
-        secrets: Object.entries(env).filter(([key]) => /KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)).map(([, value]) => value ?? "")
+        secrets: () => redactionSecrets
       })
     );
   const customTools = shellTools?.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
@@ -6038,7 +6281,9 @@ async function createBazilionSession(opts) {
     session.agent.getApiKey = async (requestedProvider) => {
       if (requestedProvider !== piProviderName(providerName)) return void 0;
       try {
-        return await refreshApiKey(providerName);
+        const token = await refreshApiKey(providerName);
+        if (token && !redactionSecrets.includes(token)) redactionSecrets.push(token);
+        return token;
       } catch {
         return void 0;
       }
@@ -6123,6 +6368,7 @@ async function createProtectedBazilionSession(opts) {
     sessionId: sessionManager.getSessionId()
   });
   if (repository) bazilionTools.push(repository.tool);
+  const redactionSecrets = uniqueSecrets(protectedRuntimeSecrets(opts.runtime));
   if (repository && opts.codingHost)
     bazilionTools.push(
       ...codingTools({
@@ -6133,7 +6379,7 @@ async function createProtectedBazilionSession(opts) {
         lifecycle: opts.dockerLifecycle,
         approval: true,
         approvalHost: opts.bashApprovalHost,
-        secrets: protectedRuntimeSecrets(opts.runtime)
+        secrets: () => redactionSecrets
       })
     );
   if (!shellTools.customBash) throw new Error("protected Docker bash tool is unavailable");
@@ -6157,7 +6403,7 @@ async function createProtectedBazilionSession(opts) {
   installProtectedCredentialBoundary(
     session,
     opts.runtime.providerName,
-    protectedRuntimeSecrets(opts.runtime),
+    redactionSecrets,
     opts.refreshApiKey
   );
   return sessionHandle(session);
@@ -6208,11 +6454,14 @@ async function createRestrictedReviewSession(opts) {
   installProtectedCredentialBoundary(
     session,
     opts.runtime.providerName,
-    protectedRuntimeSecrets(opts.runtime),
+    uniqueSecrets(protectedRuntimeSecrets(opts.runtime)),
     opts.refreshApiKey
   );
   return sessionHandle(session);
 }
+function uniqueSecrets(values) {
+  return [...new Set(values.filter(Boolean))];
+}
 function materializeProtectedCredentialFile(runtime, scratch) {
   const fields = [...runtime.credentialEnv ?? []];
   if (runtime.credentialFile) {
@@ -6237,8 +6486,7 @@ function createInMemorySettingsManager() {
     }
   });
 }
-function installProtectedCredentialBoundary(session, providerName, initialSecrets, refreshApiKey) {
-  const activeTokens = [...new Set(initialSecrets.filter(Boolean))];
+function installProtectedCredentialBoundary(session, providerName, activeTokens, refreshApiKey) {
   session.agent.state.messages = redactJsonValue(session.agent.state.messages, activeTokens);
   const originalStream = session.agent.streamFunction;
   session.agent.streamFunction = async (model, context, options) => {
@@ -6359,6 +6607,111 @@ function explicitConversationFile(directory, target) {
   return file;
 }
 
+// ../daemon/src/runtime/tools/verification.ts
+var VerificationCapabilityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "VerificationCapabilityError";
+  }
+};
+function verificationTools(host) {
+  const attempted = /* @__PURE__ */ new Set();
+  const request = {
+    def: {
+      name: "verification_request",
+      description: "Read the captured verification request: the exact change under verification, the environment the checks were admitted into, and every declared check with its timeout and any outcome so far. A check you were not asked to run cannot be added here \u2014 a different or additional command needs a new request.",
+      parameters: { type: "object", properties: {}, additionalProperties: false }
+    },
+    async invoke() {
+      return renderBrief(await host.read());
+    }
+  };
+  const check = {
+    def: {
+      name: "verification_check",
+      description: "Invoke exactly one declared check, identified by its ordinal from verification_request. Each check runs at most once: a check that already reported its outcome cannot be run again, and you cannot change its command, cwd, timeout or environment. Report what actually happened, including failures, skips and blockers. A successful exit is evidence about the commands that ran, never proof about later code.",
+      parameters: {
+        type: "object",
+        properties: {
+          ordinal: {
+            type: "integer",
+            minimum: 0,
+            description: "Ordinal of a declared check, as listed by verification_request."
+          }
+        },
+        required: ["ordinal"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args, context) {
+      const ordinal = readOrdinal(args);
+      const brief = await host.read();
+      const declared = brief.checks.find((entry) => entry.ordinal === ordinal);
+      if (!declared) {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} was not captured with this request; only ${brief.checks.map((entry) => entry.ordinal).join(", ")} exist`
+        );
+      }
+      if (declared.state !== "not_executed") {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} already reported '${declared.state}' and cannot be run again`
+        );
+      }
+      if (attempted.has(ordinal)) {
+        throw new VerificationCapabilityError(`check ${ordinal} is already running`);
+      }
+      attempted.add(ordinal);
+      try {
+        const run = await host.invoke(ordinal, { toolCallId: context?.toolCallId ?? "" });
+        return renderRun(run);
+      } catch (error) {
+        attempted.delete(ordinal);
+        throw error;
+      }
+    }
+  };
+  return [request, check];
+}
+function readOrdinal(args) {
+  const keys2 = Object.keys(args).sort();
+  if (keys2.length !== 1 || keys2[0] !== "ordinal") {
+    throw new VerificationCapabilityError("verification_check takes only a declared ordinal");
+  }
+  const ordinal = args.ordinal;
+  if (!Number.isInteger(ordinal) || ordinal < 0) {
+    throw new VerificationCapabilityError("ordinal must be a non-negative integer");
+  }
+  return ordinal;
+}
+function renderBrief(brief) {
+  const lines = [
+    `Verification request ${brief.requestId}`,
+    `Change: snapshot ${brief.snapshot.id} (base ${brief.snapshot.baseOid.slice(0, 12)}${brief.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`,
+    `Environment: image ${brief.environment.image}, shell ${brief.environment.sandbox}${brief.environment.cwd ? `, cwd ${brief.environment.cwd}` : ""}`,
+    `Applicability: ${brief.applicability === "identical" ? "unchanged since capture" : brief.applicability}`
+  ];
+  if (brief.summary) lines.push(`Requested by the requester: ${brief.summary}`);
+  if (brief.writablePaths.length > 0) {
+    lines.push(
+      `Declared generated-output paths (where a check is expected to write; this does not confine writes): ${brief.writablePaths.join(", ")}`
+    );
+  }
+  lines.push("", "Captured checks:");
+  for (const entry of brief.checks) {
+    const outcome = entry.state === "not_executed" ? "not run yet" : `${entry.state}${entry.exitCode === null ? "" : ` (exit ${entry.exitCode})`}${entry.commandId ? ` receipt ${entry.commandId}` : ""}`;
+    lines.push(
+      `  [${entry.ordinal}] ${entry.command} (cwd ${entry.cwd}, ${entry.timeoutMs} ms, ${entry.purpose}) \u2014 ${outcome}`
+    );
+  }
+  lines.push("", "Run each captured check with verification_check. Report failures as failures.");
+  return lines.join("\n");
+}
+function renderRun(run) {
+  const head = `Check ${run.ordinal}: ${run.state}${run.exitCode === null ? "" : ` (exit ${run.exitCode})`}${run.commandId ? ` \u2014 receipt ${run.commandId}` : ""}${run.truncated ? " [output truncated]" : ""}`;
+  return run.output.trim() ? `${head}
+${run.output}` : head;
+}
+
 // ../daemon/src/runtime/worker/api-key-refresh.ts
 function createIpcApiKeyRefresher(call, context) {
   return async (providerName) => {
@@ -6582,8 +6935,16 @@ function createReviewState(evidenceItems) {
     tools
   };
 }
+function createIpcVerificationHost(ipcCall, identity2) {
+  return {
+    // The request identity is bound here from the worker's own input, so a tool call cannot address
+    // another request's attempt: only an ordinal travels.
+    read: () => ipcCall("verificationRead", identity2),
+    invoke: (ordinal) => ipcCall("verificationRun", { ...identity2, ordinal })
+  };
+}
 async function createSessionForInput(input, ipcCall) {
-  if (input.kind !== "restricted_review" && !input.repositoryContext)
+  if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && !input.repositoryContext)
     throw new Error("Coding turn requires daemon-prepared repository context");
   if (input.kind === "configured_operator_http") {
     const paths = resolvePaths();
@@ -6641,6 +7002,18 @@ async function createSessionForInput(input, ipcCall) {
     agentId: input.kind === "protected" ? input.agent.agent.id : input.agentId,
     turnId: input.turnId
   });
+  if (input.kind === "specialist_verification") {
+    const handle2 = await createRestrictedReviewSession({
+      runtime: input.runtime,
+      scratch: input.scratch,
+      systemPrompt: VERIFICATION_SYSTEM_PROMPT,
+      tools: verificationTools(createIpcVerificationHost(ipcCall, input.verification)).map(
+        ourToolToPiTool
+      ),
+      refreshApiKey
+    });
+    return { handle: handle2 };
+  }
   if (input.kind === "restricted_review") {
     const reviewState = createReviewState(input.review.evidence);
     const handle2 = await createRestrictedReviewSession({
@@ -6717,7 +7090,7 @@ async function main() {
   session = handle.session;
   const consumptionAcks = /* @__PURE__ */ new Set();
   const unsubscribe = session.subscribe((piEvent) => {
-    if (input.kind !== "restricted_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
+    if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
       const message = piEvent.message;
       const content = message.content[0];
       if (content?.type === "text") {
@@ -6747,8 +7120,8 @@ async function main() {
   });
   try {
     const promptMessage = redactJsonValue(input.message, activeAccessTokens);
-    const sanitizedImages = input.kind === "restricted_review" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
-    const promptImages = input.kind === "restricted_review" ? [] : sanitizedImages.map((image) => ({
+    const sanitizedImages = input.kind === "restricted_review" || input.kind === "specialist_verification" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
+    const promptImages = input.kind === "restricted_review" || input.kind === "specialist_verification" ? [] : sanitizedImages.map((image) => ({
       type: "image",
       data: image.data,
       mimeType: image.mimeType
@@ -6791,6 +7164,24 @@ main().catch((error) => {
   }
   process.exit(1);
 });
+var VERIFICATION_SYSTEM_PROMPT = `You are a restricted verification specialist. You verify one
+captured change against the checks your requester selected. Call verification_request to read the
+request, then verification_check once per declared check, in order.
+
+Boundaries you cannot cross, and must not try to:
+- Only the declared ordinal of a captured check can run, once. You cannot change its command, cwd,
+  timeout or environment, add a check, or retry a check that already reported.
+- You have no shell, no editor, no browser, no network tool and no deployment credential. A missing
+  toolchain, service or approval is an explicit blocker to report, never something to work around.
+- Generated output may only be written to the declared writable paths.
+
+Report what actually happened. A non-zero exit is a failure of that check; say so plainly. An exit
+code is evidence about the commands that ran, never proof about later code, and never a statement
+that the change is ready to merge. Distinguish a failure from a check you did not run, and never
+describe an unrun check as passing.
+
+Finish with a short summary: the snapshot you verified, each check with its outcome and receipt, and
+any blocker or limitation that stopped a check. Do not recommend deployment.`;
 var REVIEW_SYSTEM_PROMPT = `You are a restricted learning reviewer. Analyze only the supplied
 transcript digest and approved-lesson index. You cannot act on the world. Call propose_lesson once
 with zero to five proposals, then stop.