bazilion 0.9.0 → 0.11.0

package/dist/worker.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // ../daemon/src/runtime/worker/entry.ts
-import { randomUUID as randomUUID14 } from "crypto";
-import { join as join17 } from "path";
+import { randomUUID as randomUUID17 } from "crypto";
+import { join as join19 } from "path";
 
 // ../daemon/src/core/agent/delete.ts
 import { randomUUID } from "crypto";
@@ -44,7 +44,7 @@ import { existsSync as existsSync5, readdirSync } from "fs";
 import { join as join6 } from "path";
 
 // ../daemon/src/core/db/client.ts
-import { DatabaseSync } from "node:sqlite";
+import { backup, DatabaseSync } from "node:sqlite";
 
 // ../daemon/src/core/db/migrate.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
@@ -495,12 +495,49 @@ var SERVICES = [
       }
     ]
   },
+  {
+    id: "shell-security",
+    displayName: "Agent Shell Security",
+    category: "service",
+    team: "Agent Runtime",
+    hint: "Optional dangerous-command approval and Docker isolation. Disabled by default.",
+    fields: [
+      {
+        envVar: "BAZILION_BASH_APPROVAL",
+        kind: "config",
+        label: "Dangerous-command approval",
+        placeholder: "off",
+        description: "Use off (current behavior) or dangerous (classified bash commands require per-call approval before execution)."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX",
+        kind: "config",
+        label: "Sandbox mode",
+        placeholder: "off",
+        description: "Use off (current host tools) or docker (containerized bash only; host-backed coding tools are hidden)."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX_IMAGE",
+        kind: "config",
+        label: "Docker image",
+        placeholder: "debian:bookworm-slim",
+        description: "Local image with /bin/bash and /usr/bin/env and no VOLUME declarations. Bazilion never falls back to host execution if it is unavailable or incompatible."
+      },
+      {
+        envVar: "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST",
+        kind: "config",
+        label: "Extra environment allowlist",
+        placeholder: "MY_SAFE_VARIABLE,ANOTHER_SAFE_VARIABLE",
+        description: "Optional comma-separated variable names copied into the container. Provider credentials remain excluded unless explicitly named."
+      }
+    ]
+  },
   {
     id: "browser",
     displayName: "Browser Automation",
     category: "service",
     team: "Browser",
-    hint: "Playwright-driven browser tools (navigate, snapshot, click, screenshot). Run `pnpm exec playwright install chromium` once.",
+    hint: "Playwright-driven browser tools (navigate, snapshot, click, screenshot). Chromium is installed with Bazilion.",
     fields: [
       {
         envVar: "BROWSER_ENABLED",
@@ -605,11 +642,14 @@ import { randomUUID as randomUUID6 } from "crypto";
 // ../daemon/src/core/repos/secrets.ts
 import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from "crypto";
 
-// ../daemon/src/core/repos/triggers.ts
+// ../daemon/src/core/repos/triggerDispatches.ts
 import { randomUUID as randomUUID7 } from "crypto";
 
+// ../daemon/src/core/repos/triggers.ts
+import { randomUUID as randomUUID8 } from "crypto";
+
 // ../daemon/src/core/repos/webTokens.ts
-import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID9 } from "crypto";
 
 // ../daemon/src/core/secrets.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
@@ -623,22 +663,52 @@ import AdmZip from "adm-zip";
 // ../daemon/src/core/skills/parse.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { parse as parseYaml } from "yaml";
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseSkillContent(raw) {
+  const m = raw.match(FRONTMATTER_RE);
+  if (!m) {
+    throw new Error('SKILL.md missing YAML frontmatter (expected leading "---")');
+  }
+  const yamlBlock = m[1] ?? "";
+  const body = m[2] ?? "";
+  let fm;
+  try {
+    fm = parseYaml(yamlBlock);
+  } catch (err) {
+    throw new Error(`SKILL.md frontmatter is not valid YAML: ${err.message}`);
+  }
+  if (!fm || typeof fm !== "object" || Array.isArray(fm)) {
+    throw new Error("SKILL.md frontmatter must be a YAML object");
+  }
+  const fmObj = fm;
+  if (typeof fmObj.name !== "string" || fmObj.name.length === 0) {
+    throw new Error('SKILL.md frontmatter missing required "name"');
+  }
+  if (typeof fmObj.description !== "string" || fmObj.description.length === 0) {
+    throw new Error('SKILL.md frontmatter missing required "description"');
+  }
+  return { frontmatter: fmObj, body, raw };
+}
+function parseSkillFile(path) {
+  const raw = readFileSync7(path, "utf8");
+  return parseSkillContent(raw);
+}
 
 // ../daemon/src/core/team/delete.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { existsSync as existsSync9, renameSync as renameSync2, rmSync as rmSync6 } from "fs";
 
 // ../daemon/src/core/team-policy/adopt.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 
 // ../daemon/src/core/team-policy/authorization.ts
-import { createHash as createHash3, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID12 } from "crypto";
 
 // ../daemon/src/core/team-policy/source.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 
 // ../daemon/src/core/team-policy/spawn.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 import { readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
 
 // ../daemon/src/core/team-policy/rm-with-retry.ts
@@ -646,15 +716,19 @@ import { rmSync as rmSync7 } from "fs";
 
 // ../daemon/src/runtime/memory/qmd.ts
 import {
-  existsSync as existsSync10,
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
   mkdirSync as mkdirSync4,
+  openSync,
   readdirSync as readdirSync5,
   readFileSync as readFileSync8,
+  realpathSync,
   rmSync as rmSync9,
-  statSync as statSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname2, join as join12 } from "path";
+import { dirname as dirname2, isAbsolute, join as join12, relative, resolve as resolve3, sep as sep2 } from "path";
 import { createStore, extractSnippet } from "@tobilu/qmd";
 var INDEX_FILENAME = ".qmd-index.sqlite";
 var COLLECTION_NAME = "memory";
@@ -675,61 +749,222 @@ function getStore(dir) {
   }
   return p;
 }
+function unsafeMemoryPath(path, reason) {
+  return new Error(`unsafe memory path "${path}": ${reason}`);
+}
+function lstatIfPresent(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function isContained(root, candidate) {
+  const rel = relative(root, candidate);
+  return rel === "" || !isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
+}
+function assertContained(root, candidate) {
+  if (!isContained(root, candidate)) {
+    throw unsafeMemoryPath(candidate, `resolved outside memory root "${root}"`);
+  }
+}
+function initializeSafeRoot(root) {
+  mkdirSync4(root, { recursive: true });
+  const info = lstatSync(root);
+  if (info.isSymbolicLink()) {
+    throw unsafeMemoryPath(root, "memory root must not be a symbolic link");
+  }
+  if (!info.isDirectory()) {
+    throw unsafeMemoryPath(root, "memory root is not a directory");
+  }
+  return realpathSync(root);
+}
+function assertRootUnchanged(root, canonicalRoot) {
+  const info = lstatIfPresent(root);
+  if (!info) throw unsafeMemoryPath(root, "memory root disappeared");
+  if (info.isSymbolicLink()) {
+    throw unsafeMemoryPath(root, "memory root must not be a symbolic link");
+  }
+  if (!info.isDirectory()) {
+    throw unsafeMemoryPath(root, "memory root is not a directory");
+  }
+  const current = realpathSync(root);
+  if (relative(canonicalRoot, current) !== "" || relative(current, canonicalRoot) !== "") {
+    throw unsafeMemoryPath(root, "memory root changed after initialization");
+  }
+}
 function safeKey(root, key) {
-  if (key.includes("..") || key.startsWith("/") || key.includes("\0")) {
+  const segments = key.split(/[\\/]/);
+  if (key.length === 0 || key.includes("\0") || isAbsolute(key) || /^[A-Za-z]:[\\/]/.test(key) || key.startsWith("\\\\") || segments.includes("..")) {
     throw new Error(`unsafe memory key: ${key}`);
   }
-  return join12(root, key);
-}
-function walkMd(dir, prefix, out) {
-  if (!existsSync10(dir)) return;
-  for (const e of readdirSync5(dir, { withFileTypes: true })) {
-    if (e.name.startsWith(".")) continue;
-    const full = join12(dir, e.name);
-    const key = prefix ? `${prefix}/${e.name}` : e.name;
-    if (e.isDirectory()) {
-      walkMd(full, key, out);
-    } else if (e.isFile() && e.name.endsWith(".md")) {
-      const stats = statSync3(full);
-      out.push({
-        key,
-        content: readFileSync8(full, "utf8"),
-        updatedAt: stats.mtimeMs
-      });
+  const candidate = resolve3(root, key);
+  if (candidate === root) throw new Error(`unsafe memory key: ${key}`);
+  assertContained(root, candidate);
+  return candidate;
+}
+function inspectSafePath(root, path) {
+  assertContained(root, path);
+  const rel = relative(root, path);
+  let current = root;
+  const components = rel.split(sep2).filter(Boolean);
+  for (let index = 0; index < components.length; index += 1) {
+    current = join12(current, components[index]);
+    const info = lstatIfPresent(current);
+    if (!info) return void 0;
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(current, "symbolic links are not allowed");
+    }
+    if (index < components.length - 1 && !info.isDirectory()) {
+      throw unsafeMemoryPath(current, "path ancestor is not a directory");
+    }
+    assertContained(root, realpathSync(current));
+  }
+  return lstatIfPresent(path);
+}
+function ensureSafeParentDirectories(root, path) {
+  const parent = dirname2(path);
+  assertContained(root, parent);
+  const rel = relative(root, parent);
+  let current = root;
+  for (const component of rel.split(sep2).filter(Boolean)) {
+    current = join12(current, component);
+    let info = lstatIfPresent(current);
+    if (!info) {
+      mkdirSync4(current);
+      info = lstatSync(current);
+    }
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(current, "symbolic-link ancestors are not allowed");
+    }
+    if (!info.isDirectory()) {
+      throw unsafeMemoryPath(current, "path ancestor is not a directory");
+    }
+    assertContained(root, realpathSync(current));
+  }
+}
+function readSafeFile(root, path) {
+  const info = inspectSafePath(root, path);
+  if (!info) throw new Error(`memory entry not found: ${relative(root, path)}`);
+  if (!info.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+    return { content: readFileSync8(fd, "utf8"), stats };
+  } catch (error) {
+    if (error.code === "ELOOP") {
+      throw unsafeMemoryPath(path, "symbolic links are not allowed");
+    }
+    throw error;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function writeSafeFile(root, path, content) {
+  ensureSafeParentDirectories(root, path);
+  const existing = inspectSafePath(root, path);
+  if (existing?.isSymbolicLink()) {
+    throw unsafeMemoryPath(path, "symbolic links are not allowed");
+  }
+  if (existing && !existing.isFile()) {
+    throw unsafeMemoryPath(path, "memory entry is not a regular file");
+  }
+  let fd;
+  try {
+    fd = openSync(
+      path,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW,
+      438
+    );
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+    writeFileSync6(fd, content);
+    return fstatSync(fd);
+  } catch (error) {
+    if (error.code === "ELOOP") {
+      throw unsafeMemoryPath(path, "symbolic links are not allowed");
+    }
+    throw error;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function assertSafeTree(root, dir = root) {
+  assertContained(root, realpathSync(dir));
+  for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+    const full = join12(dir, entry.name);
+    const info = lstatSync(full);
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(full, "symbolic links are not allowed in memory storage");
+    }
+    if (info.isDirectory()) {
+      assertSafeTree(root, full);
+    } else if (!info.isFile()) {
+      throw unsafeMemoryPath(full, "special files are not allowed in memory storage");
+    }
+  }
+}
+function walkMd(root, dir, prefix, out) {
+  for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+    const full = join12(dir, entry.name);
+    const info = lstatSync(full);
+    if (info.isSymbolicLink()) {
+      throw unsafeMemoryPath(full, "symbolic links are not allowed in memory storage");
+    }
+    if (entry.name.startsWith(".")) continue;
+    const key = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (info.isDirectory()) {
+      walkMd(root, full, key, out);
+    } else if (info.isFile() && entry.name.endsWith(".md")) {
+      const { content, stats } = readSafeFile(root, full);
+      out.push({ key, content, updatedAt: stats.mtimeMs });
+    } else if (!info.isFile()) {
+      throw unsafeMemoryPath(full, "special files are not allowed in memory storage");
     }
   }
 }
 function qmdBackend(root) {
+  let canonicalRoot;
+  const safeRoot = () => {
+    if (!canonicalRoot) canonicalRoot = initializeSafeRoot(root);
+    else assertRootUnchanged(root, canonicalRoot);
+    return canonicalRoot;
+  };
   return {
     async init() {
-      mkdirSync4(root, { recursive: true });
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
     },
     async read(key) {
-      const path = safeKey(root, key);
-      if (!existsSync10(path)) {
-        throw new Error(`memory entry not found: ${key}`);
-      }
-      const stats = statSync3(path);
+      const safe = safeRoot();
+      const path = safeKey(safe, key);
+      const { content, stats } = readSafeFile(safe, path);
       return {
         key,
-        content: readFileSync8(path, "utf8"),
+        content,
         updatedAt: stats.mtimeMs
       };
     },
     async write(key, content) {
-      const path = safeKey(root, key);
-      mkdirSync4(dirname2(path), { recursive: true });
-      writeFileSync6(path, content);
-      const stats = statSync3(path);
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const path = safeKey(safe, key);
+      const stats = writeSafeFile(safe, path, content);
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
       return { key, content, updatedAt: stats.mtimeMs };
     },
     async search(query, opts) {
       const limit = opts?.limit ?? 10;
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       const results = await store.searchLex(query, {
         limit,
         collection: COLLECTION_NAME
@@ -738,13 +973,13 @@ function qmdBackend(root) {
       for (const r of results) {
         const prefix = `${COLLECTION_NAME}/`;
         const key = r.displayPath.startsWith(prefix) ? r.displayPath.slice(prefix.length) : r.displayPath;
+        const path = safeKey(safe, key);
+        const info = inspectSafePath(safe, path);
+        if (!info) continue;
+        if (!info.isFile()) throw unsafeMemoryPath(path, "search result is not a regular file");
         let content = r.body ?? "";
         if (!content) {
-          try {
-            content = readFileSync8(join12(root, key), "utf8");
-          } catch {
-            content = "";
-          }
+          content = readSafeFile(safe, path).content;
         }
         const snippet = extractSnippet(content, query).snippet;
         hits.push({ key, snippet, score: r.score });
@@ -752,14 +987,23 @@ function qmdBackend(root) {
       return hits;
     },
     async list() {
+      const safe = safeRoot();
+      assertSafeTree(safe);
       const out = [];
-      walkMd(root, "", out);
+      walkMd(safe, safe, "", out);
       return out.sort((a, b) => a.key.localeCompare(b.key));
     },
     async remove(key) {
-      const path = safeKey(root, key);
-      if (existsSync10(path)) rmSync9(path);
-      const store = await getStore(root);
+      const safe = safeRoot();
+      assertSafeTree(safe);
+      const path = safeKey(safe, key);
+      const info = inspectSafePath(safe, path);
+      if (info) {
+        if (!info.isFile()) throw unsafeMemoryPath(path, "memory entry is not a regular file");
+        rmSync9(path);
+      }
+      assertSafeTree(safe);
+      const store = await getStore(safe);
       await store.update();
     }
   };
@@ -915,8 +1159,8 @@ function piMessagesToProviderView(messages) {
 }
 
 // ../daemon/src/runtime/pi/session.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
-import { basename as basename3, join as join16 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
+import { basename as basename3, join as join18 } from "path";
 import {
   AuthStorage,
   createAgentSession,
@@ -976,21 +1220,38 @@ function resolveModel(cfg, modelId) {
 import { loginOpenAICodex, refreshOpenAICodexToken } from "@earendil-works/pi-ai/oauth";
 
 // ../daemon/src/runtime/session/prompt.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
 import { join as join13 } from "path";
-var CONTEXT_FILE_ORDER = [
-  "AGENTS.md",
-  "SOUL.md",
-  "TOOLS.md",
-  "IDENTITY.md",
-  "HEARTBEAT.md"
-];
-function buildSystemPrompt(agent) {
+var SANDBOX_SKILLS_DIR = "/skills";
+function loadPromptSkills(skillsDir, attachedNames) {
+  if (!existsSync10(skillsDir) || attachedNames.length === 0) return [];
+  const attached = new Set(attachedNames);
+  const discovered = readdirSync6(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && attached.has(entry.name)).sort((a, b) => a.name.localeCompare(b.name));
+  const loaded = [];
+  for (const entry of discovered) {
+    const hostDir = join13(skillsDir, entry.name);
+    try {
+      const parsed = parseSkillFile(join13(hostDir, "SKILL.md"));
+      const safeLabel = entry.name.replace(/[^A-Za-z0-9._-]/g, "_") || "skill";
+      loaded.push({
+        name: entry.name,
+        description: parsed.frontmatter.description,
+        body: parsed.body.trim(),
+        hostDir,
+        sandboxDir: `${SANDBOX_SKILLS_DIR}/${loaded.length}-${safeLabel}`
+      });
+    } catch {
+    }
+  }
+  return loaded;
+}
+var CONTEXT_FILE_ORDER = ["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"];
+function buildSystemPrompt(agent, options = {}) {
   const parts = [];
   const contextBlocks = [];
   for (const file of CONTEXT_FILE_ORDER) {
     const path = join13(agent.agent.dir, file);
-    if (!existsSync11(path)) continue;
+    if (!existsSync10(path)) continue;
     const content = readFileSync9(path, "utf8").trimEnd();
     if (!content) continue;
     contextBlocks.push(`## ${file}
@@ -1003,7 +1264,7 @@ ${content}`);
 ${contextBlocks.join("\n\n")}`);
   }
   const bootstrapPath = join13(agent.agent.dir, "BOOTSTRAP.md");
-  if (existsSync11(bootstrapPath)) {
+  if (existsSync10(bootstrapPath)) {
     const bootstrap = readFileSync9(bootstrapPath, "utf8").trimEnd();
     if (bootstrap) {
       parts.push(
@@ -1028,19 +1289,40 @@ ${contextBlocks.join("\n\n")}`);
     [
       "# Agent Home",
       "",
-      "Your private home holds who you are \u2014 identity, soul, behaviour rules, wake-up routine. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md, HEARTBEAT.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
+      "Your private home holds who you are \u2014 identity, soul, and behaviour rules. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
       "",
       "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
       "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
       "- To remember facts the user told you or things you learned: use `memory_write` \u2014 NOT `home_write`.",
-      "- To produce work output (code, docs, artefacts): use `write` / `edit` \u2014 those land in your workspace, not your home."
+      "- To produce work output (code, docs, artefacts): use the workspace tools currently exposed to you \u2014 those operate on your team workspace, not your private home."
     ].join("\n")
   );
   if (agent.skills.length > 0) {
+    const loaded = options.skills ?? [];
+    const loadedNames = new Set(loaded.map((skill) => skill.name));
+    const unavailable = agent.skills.filter((name) => !loadedNames.has(name));
+    const skillBlocks = loaded.map((skill) => {
+      const runtimeDir = options.sandboxMode === "docker" ? skill.sandboxDir : skill.hostDir;
+      return [
+        `## ${skill.name}`,
+        "",
+        skill.description,
+        "",
+        `Runtime directory: \`${runtimeDir}\`. Resolve any relative scripts or assets mentioned by this skill from that directory.`,
+        "",
+        skill.body
+      ].filter((line, index, lines) => line !== "" || lines[index - 1] !== "").join("\n").trimEnd();
+    });
+    const unavailableNote = unavailable.length > 0 ? `Attached but unavailable or invalid: ${unavailable.join(", ")}.` : "";
     parts.push(
-      `# Available Skills
-
-You have access to the following skills: ${agent.skills.join(", ")}.`
+      [
+        "# Available Skills",
+        "",
+        "Use these attached skill instructions when they are relevant to the task.",
+        "",
+        ...skillBlocks,
+        ...unavailableNote ? ["", unavailableNote] : []
+      ].join("\n")
     );
   }
   const teamLines = [
@@ -1048,7 +1330,7 @@ You have access to the following skills: ${agent.skills.join(", ")}.`
     "",
     `- ${agent.team.id} (${agent.team.name}): ${agent.team.path}`,
     "",
-    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Your coding tools (`read`, `bash`, `edit`, `write`, `grep`, `find`, `ls`) are rooted at the team directory. Never use these tools to edit your identity/soul/behaviour files \u2014 those live in your home and are reached via `home_write` / `home_read`."
+    "Your team is where work product lives \u2014 code, docs, artefacts, shared scratch. It may be shared with other agents in the same team. Use the workspace tools currently exposed to work there. Never use workspace tools to edit your identity/soul/behaviour files \u2014 those live in your private home and are reached via `home_write` / `home_read`."
   ];
   parts.push(teamLines.join("\n"));
   if (agent.team.userMd.trim()) {
@@ -1072,12 +1354,1040 @@ This team's USER.md is empty. As you learn STABLE facts about the human (prefere
   return parts.join("\n\n---\n\n");
 }
 
+// ../daemon/src/runtime/shell/tooling.ts
+import { existsSync as existsSync11, lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join15, relative as relative3, sep as sep4 } from "path";
+import {
+  createBashToolDefinition,
+  createLocalBashOperations,
+  defineTool as defineTool2
+} from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/shell/approval.ts
+import { defineTool } from "@earendil-works/pi-coding-agent";
+
+// ../daemon/src/runtime/shell/security.ts
+var DEFAULT_BASH_SANDBOX_IMAGE = "debian:bookworm-slim";
+var SAFE_SHELL_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "SHELL",
+  "TMPDIR",
+  "TZ"
+];
+var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RESERVED_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var DOCKER_IMAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/;
+var DOCKER_CLIENT_CONTROL_ENV = /* @__PURE__ */ new Set([
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR"
+]);
+var SANDBOX_CONTROL_ENV = /* @__PURE__ */ new Set(["BASH_ENV"]);
+var SENSITIVE_HOME_PATH_RE = /(?:~(?:[A-Za-z0-9_-]+)?|\$(?:HOME|\{HOME\})|\/(?:home|Users)\/[^\s'"`;|&/]+|\/root)\/\.(?:ssh|aws|gnupg)(?:\/[^\s'"`;|&]*)?/gi;
+var SENSITIVE_FILE_RE = /(?:\bauth\.json\b|\bbazilion\.db\b|(?:^|[\s/'"=])\.env(?:\.[A-Za-z0-9_-]+)?(?=$|[\s/'"`;|&])|\/etc\/(?:shadow|sudoers)(?:\.d\/[^\s'"`;|&]+)?)/gim;
+var SENSITIVE_ENV_RE = /\b(?:OPENAI_CODEX_OAUTH|AWS_ACCESS_KEY_ID|AWS_PROFILE|GOOGLE_APPLICATION_CREDENTIALS|BAZILION_TOKEN|(?:[A-Z][A-Z0-9_]*_)?(?:API_KEY|ACCESS_TOKEN|AUTH_TOKEN|OAUTH_TOKEN|CLIENT_SECRET|SECRET_ACCESS_KEY|PRIVATE_KEY))\b/g;
+var REMOTE_PIPE_RE = /(?:^|[;&|(\n])\s*(?:command\s+)?(?:curl|wget)\b[^;&\n]*(?:\|\s*(?:(?:sudo|env)\s+)*(?:[^\s;&|()]+\/)?(?:sh|bash|dash|zsh|fish|node|python(?:3)?|perl|ruby)\b)/gim;
+var COMMAND_BOUNDARY_RE = /[;&|)\n]/;
+var ShellSecurityConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ShellSecurityConfigError";
+  }
+};
+function isValidEnvName(name) {
+  return ENV_NAME_RE.test(name) && !RESERVED_OBJECT_KEYS.has(name);
+}
+function addRisk(command, risks, seen, input) {
+  const start = Math.max(0, input.start);
+  const end = Math.min(command.length, Math.max(start, input.end));
+  const key = `${input.code}:${start}:${end}`;
+  if (seen.has(key)) return;
+  seen.add(key);
+  risks.push({
+    code: input.code,
+    severity: input.severity ?? "danger",
+    message: input.message,
+    matchedText: command.slice(start, end),
+    span: { start, end }
+  });
+}
+function addRegexRisks(command, risks, seen, pattern, code, message) {
+  pattern.lastIndex = 0;
+  for (const match of command.matchAll(pattern)) {
+    if (match.index === void 0) continue;
+    let start = match.index;
+    let matchedText = match[0];
+    const leading = matchedText.match(/^[;&|(\n\s]+/);
+    if (leading) {
+      start += leading[0].length;
+      matchedText = matchedText.slice(leading[0].length);
+    }
+    addRisk(command, risks, seen, {
+      code,
+      message,
+      start,
+      end: start + matchedText.length
+    });
+  }
+}
+function shellTokens(fragment) {
+  return Array.from(
+    fragment.matchAll(/"(?:\\.|[^"\\])*"|'[^']*'|[^\s]+/g),
+    (match) => match[0].replace(/^(?:"|')|(?:"|')$/g, "")
+  );
+}
+function isBroadFilesystemTarget(rawTarget) {
+  const target = rawTarget.replace(/[;,]+$/, "");
+  if (target.startsWith("/")) return true;
+  return /^(?:\.|\.\/\*+|\*+|~(?:\/.*)?|\$(?:HOME|\{HOME\})(?:\/.*)?|\.\.(?:\/.*)?)$/.test(target);
+}
+function classifyBroadFilesystemOperations(command, risks, seen) {
+  const commandRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(rm|find|chmod|chown)\b[^;&|)\n]*/gim;
+  for (const match of command.matchAll(commandRe)) {
+    if (match.index === void 0 || !match[1]) continue;
+    const nameOffset = match[0].toLowerCase().indexOf(match[1].toLowerCase());
+    const start = match.index + nameOffset;
+    const text = command.slice(start, match.index + match[0].length).trimEnd();
+    const tokens = shellTokens(text);
+    const name = tokens[0]?.toLowerCase();
+    const args = tokens.slice(1);
+    let risky = false;
+    if (name === "rm") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /[rR]/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
+    } else if (name === "find") {
+      const target = args.find((arg) => !arg.startsWith("-"));
+      risky = args.includes("-delete") && target !== void 0 && isBroadFilesystemTarget(target);
+    } else if (name === "chmod" || name === "chown") {
+      const recursive = args.some(
+        (arg) => arg === "--recursive" || /^-[^-]+$/.test(arg) && /R/.test(arg)
+      );
+      risky = recursive && args.some((arg) => !arg.startsWith("-") && isBroadFilesystemTarget(arg));
+    }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "broad-destructive-operation",
+      message: "Recursively changes or deletes a broad filesystem target.",
+      start,
+      end: start + text.length
+    });
+  }
+}
+function isLocalHostname(rawHostname) {
+  const hostname = rawHostname.trim().replace(/^.*@/, "").replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "0.0.0.0" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function hasExternalHttpDestination(segment) {
+  const urls = Array.from(segment.matchAll(/https?:\/\/[^\s'"`]+/gi), (match) => match[0]);
+  if (urls.length === 0) return true;
+  return urls.some((rawUrl) => {
+    try {
+      return !isLocalHostname(new URL(rawUrl).hostname);
+    } catch {
+      return true;
+    }
+  });
+}
+function remoteTransferHosts(segment) {
+  const hosts = [];
+  const uriRe = /(?:sftp|ssh|rsync):\/\/(?:[^@\s/]+@)?(\[[^\]]+\]|[^\s/:]+)(?::\d+)?/gi;
+  for (const match of segment.matchAll(uriRe)) {
+    if (match[1]) hosts.push(match[1]);
+  }
+  const scpRe = /(?:^|\s)(?:[^@\s:]+@)?(\[[^\]]+\]|[A-Za-z0-9._-]+):[^\s]+/g;
+  for (const match of segment.matchAll(scpRe)) {
+    if (match[1]) hosts.push(match[1]);
+  }
+  return hosts;
+}
+function invocationSegment(command, match, commandName) {
+  if (match.index === void 0) return null;
+  const nameOffset = match[0].toLowerCase().indexOf(commandName.toLowerCase());
+  if (nameOffset < 0) return null;
+  const start = match.index + nameOffset;
+  const boundaryOffset = command.slice(start).search(COMMAND_BOUNDARY_RE);
+  const end = boundaryOffset < 0 ? command.length : start + boundaryOffset;
+  return { start, text: command.slice(start, end).trimEnd() };
+}
+function classifyOutboundExfiltration(command, risks, seen) {
+  const invocationRe = /(?:^|[;&|(\n])\s*(?:command\s+)?(curl|wget|scp|rsync|nc|netcat|sftp)\b/gim;
+  for (const match of command.matchAll(invocationRe)) {
+    const name = match[1]?.toLowerCase();
+    if (!name) continue;
+    const segment = invocationSegment(command, match, name);
+    if (!segment) continue;
+    let risky = false;
+    if (name === "curl") {
+      const uploads = /(?:^|\s)(?:-X\s*POST\b|-[dFT](?:\s|[^\s]))/.test(segment.text) || /(?:^|\s)(?:--request(?:=|\s+)POST\b|--data(?:-[a-z-]+)?(?:=|\s)|--form(?:-string)?(?:=|\s)|--upload-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "wget") {
+      const uploads = /(?:^|\s)(?:--method(?:=|\s+)POST\b|--post-data(?:=|\s)|--post-file(?:=|\s)|--body-data(?:=|\s)|--body-file(?:=|\s))/i.test(
+        segment.text
+      );
+      risky = uploads && hasExternalHttpDestination(segment.text);
+    } else if (name === "scp" || name === "rsync") {
+      const hosts = remoteTransferHosts(segment.text);
+      risky = hosts.some((host) => !isLocalHostname(host)) || hosts.length === 0 && /\$/.test(segment.text);
+    } else if (name === "sftp") {
+      const hosts = remoteTransferHosts(segment.text);
+      if (hosts.length > 0) {
+        risky = hosts.some((host) => !isLocalHostname(host));
+      } else {
+        const destination = shellTokens(segment.text).at(-1);
+        risky = destination !== void 0 && destination !== name && !isLocalHostname(destination);
+      }
+    } else {
+      const tokens = shellTokens(segment.text);
+      const host = tokens.find(
+        (token, index) => index > 0 && !token.startsWith("-") && !/^\d+$/.test(token) && !["tcp", "udp"].includes(token.toLowerCase())
+      );
+      risky = host !== void 0 && !isLocalHostname(host);
+    }
+    if (!risky) continue;
+    addRisk(command, risks, seen, {
+      code: "outbound-exfiltration",
+      message: "Uploads data or opens a transfer connection to a non-local destination.",
+      start: segment.start,
+      end: segment.start + segment.text.length
+    });
+  }
+}
+function classifyPrivilegeAndCredentialAccess(command, risks, seen) {
+  const patterns = [
+    /(?:^|[;&|(\n])\s*(?:sudo|su|doas|pkexec)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*security\s+(?:find-(?:generic|internet)-password|dump-keychain)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*gcloud\s+auth\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*aws\s+(?:configure|sso\s+login)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*git\s+credential(?:-[A-Za-z0-9_-]+|\s+(?:fill|approve|reject))?\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:docker|npm|gh)\s+(?:login|auth\s+token)\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:pass\s+(?:show|ls)|secret-tool\s+lookup|ssh-add\s+-[Ll])\b[^;&|)\n]*/gim,
+    /(?:^|[;&|(\n])\s*(?:env|printenv|set|export\s+-p)\s*(?=$|[;&|)\n])/gim
+  ];
+  for (const pattern of patterns) {
+    addRegexRisks(
+      command,
+      risks,
+      seen,
+      pattern,
+      "privilege-or-credential-access",
+      "Requests elevated privileges or accesses a credential store."
+    );
+  }
+}
+function classifyBashCommand(command) {
+  const risks = [];
+  const seen = /* @__PURE__ */ new Set();
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_HOME_PATH_RE,
+    "sensitive-path-read",
+    "Accesses a path that commonly contains credentials."
+  );
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_FILE_RE,
+    "sensitive-path-read",
+    "Accesses a sensitive environment, authentication, or database file."
+  );
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    SENSITIVE_ENV_RE,
+    "sensitive-path-read",
+    "References an environment variable name commonly used for credentials."
+  );
+  classifyBroadFilesystemOperations(command, risks, seen);
+  addRegexRisks(
+    command,
+    risks,
+    seen,
+    REMOTE_PIPE_RE,
+    "remote-pipe-execution",
+    "Pipes downloaded content directly into an interpreter."
+  );
+  classifyOutboundExfiltration(command, risks, seen);
+  classifyPrivilegeAndCredentialAccess(command, risks, seen);
+  return risks.sort((a, b) => a.span.start - b.span.start || a.code.localeCompare(b.code));
+}
+function parseEnvAllowlist(raw) {
+  if (raw === void 0 || raw.trim() === "") return [];
+  const values = raw.split(",").map((value) => value.trim());
+  if (values.some((value) => value === "")) {
+    throw new ShellSecurityConfigError(
+      "BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains an empty environment variable name"
+    );
+  }
+  const unique = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (!isValidEnvName(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST contains invalid environment variable name: ${value}`
+      );
+    }
+    if (DOCKER_CLIENT_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include Docker client control variable: ${value}`
+      );
+    }
+    if (SANDBOX_CONTROL_ENV.has(value)) {
+      throw new ShellSecurityConfigError(
+        `BAZILION_BASH_SANDBOX_ENV_ALLOWLIST cannot include shell startup control variable: ${value}`
+      );
+    }
+    if (!seen.has(value)) {
+      seen.add(value);
+      unique.push(value);
+    }
+  }
+  return unique;
+}
+function resolveShellSecurityConfig(env = process.env) {
+  const rawMode = env.BAZILION_BASH_SANDBOX?.trim() ?? "";
+  if (rawMode !== "" && rawMode !== "off" && rawMode !== "docker") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX must be "off" or "docker", received: ${rawMode}`
+    );
+  }
+  const rawApproval = env.BAZILION_BASH_APPROVAL?.trim() ?? "";
+  if (rawApproval !== "" && rawApproval !== "off" && rawApproval !== "dangerous") {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_APPROVAL must be "off" or "dangerous", received: ${rawApproval}`
+    );
+  }
+  const rawImage = env.BAZILION_BASH_SANDBOX_IMAGE?.trim() ?? "";
+  if (rawImage !== "" && !DOCKER_IMAGE_RE.test(rawImage)) {
+    throw new ShellSecurityConfigError(
+      `BAZILION_BASH_SANDBOX_IMAGE is not a valid Docker image reference: ${rawImage}`
+    );
+  }
+  return {
+    sandboxMode: rawMode === "docker" ? "docker" : "off",
+    approvalMode: rawApproval === "dangerous" ? "dangerous" : "off",
+    sandboxImage: rawImage || DEFAULT_BASH_SANDBOX_IMAGE,
+    envAllowlist: parseEnvAllowlist(env.BAZILION_BASH_SANDBOX_ENV_ALLOWLIST)
+  };
+}
+function assertEnvName(name) {
+  if (!isValidEnvName(name)) {
+    throw new ShellSecurityConfigError(`invalid shell environment variable name: ${name}`);
+  }
+  if (DOCKER_CLIENT_CONTROL_ENV.has(name) || SANDBOX_CONTROL_ENV.has(name)) {
+    throw new ShellSecurityConfigError(`unsafe shell environment variable name: ${name}`);
+  }
+}
+function buildScrubbedShellEnv(env, allowedKeys = []) {
+  const scrubbed = {};
+  const keys = new Set(SAFE_SHELL_ENV_KEYS);
+  for (const key of allowedKeys) {
+    assertEnvName(key);
+    keys.add(key);
+  }
+  for (const key of keys) {
+    const value = env[key];
+    if (value !== void 0) scrubbed[key] = value;
+  }
+  return scrubbed;
+}
+
+// ../daemon/src/runtime/shell/approval.ts
+var BashApprovalDeniedError = class extends Error {
+  risks;
+  constructor(risks) {
+    const codes = [...new Set(risks.map((risk) => risk.code))];
+    super(`Dangerous bash command denied (${codes.join(", ")})`);
+    this.name = "BashApprovalDeniedError";
+    this.risks = risks;
+  }
+};
+function createApprovalGatedBashTool(base, host) {
+  return defineTool({
+    ...base,
+    description: `${base.description} Commands classified as dangerous require operator approval before execution.`,
+    executionMode: "sequential",
+    async execute(toolCallId, params, signal, onUpdate, ctx) {
+      const risks = classifyBashCommand(params.command);
+      if (risks.length > 0) {
+        const decision = host ? await host.requestApproval({
+          toolCallId,
+          command: params.command,
+          risks,
+          signal
+        }) : "denied";
+        if (decision !== "approved") throw new BashApprovalDeniedError(risks);
+      }
+      return base.execute(toolCallId, params, signal, onUpdate, ctx);
+    }
+  });
+}
+
+// ../daemon/src/runtime/shell/docker.ts
+import { spawn } from "child_process";
+import { randomUUID as randomUUID15 } from "crypto";
+import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import { access, realpath, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { isAbsolute as isAbsolute2, join as join14, relative as relative2, sep as sep3 } from "path";
+var CONTAINER_WORKDIR = "/workspace";
+var MAX_TIMEOUT_MS = 2147483647;
+var MAX_STDERR_CHARS = 16 * 1024;
+var CLEANUP_TIMEOUT_MS = 650;
+var CLEANUP_RETRY_DELAY_MS = 100;
+var CLEANUP_ATTEMPTS = 3;
+var DOCKER_CONTEXT_TIMEOUT_MS = 2e3;
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONTAINER_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]+$/;
+var DOCKER_CLIENT_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_CONFIG",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR"
+];
+var DOCKER_CLIENT_CONTROL_ENV2 = new Set(DOCKER_CLIENT_ENV_KEYS);
+var SANDBOX_CONTROL_ENV2 = /* @__PURE__ */ new Set(["BASH_ENV"]);
+var CONTAINER_LITERAL_ENV_KEYS = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "SHELL",
+  "TMPDIR",
+  "TZ"
+]);
+function buildDockerRunSpec(input) {
+  const executable = input.dockerPath ?? "docker";
+  validateDockerPath(executable);
+  validateImage(input.image);
+  if (input.resolvedImage !== void 0) validateImage(input.resolvedImage);
+  validateContainerName(input.containerName);
+  validateMountArgument(input.mountSource);
+  const readOnlyMounts = input.readOnlyMounts ?? [];
+  validateReadOnlyMounts(readOnlyMounts, input.mountSource);
+  validateHostIdentity(input.uid, input.gid);
+  if (input.command.includes("\0")) {
+    throw new Error("Docker sandbox command cannot contain a NUL byte");
+  }
+  const args = [
+    "run",
+    "--rm",
+    "--pull",
+    "never",
+    "--name",
+    input.containerName,
+    "--network",
+    "none",
+    "--read-only",
+    "--tmpfs",
+    "/tmp:rw,nosuid,nodev,size=64m,mode=1777",
+    "--user",
+    `${input.uid}:${input.gid}`,
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges=true",
+    "--pids-limit",
+    "256",
+    "--entrypoint",
+    "/bin/bash",
+    "--workdir",
+    CONTAINER_WORKDIR,
+    // A bind mount is read/write unless `readonly` is present. No other mount is added.
+    "--mount",
+    `type=bind,source=${input.mountSource},target=${CONTAINER_WORKDIR},bind-recursive=disabled`
+  ];
+  for (const mount of readOnlyMounts) {
+    args.push(
+      "--mount",
+      `type=bind,source=${mount.source},target=${mount.target},readonly,bind-recursive=disabled`
+    );
+  }
+  const processEnv = buildDockerClientEnv(input.hostEnv ?? process.env);
+  const envFileLines = [];
+  const containerEnvNames = [];
+  for (const [name, value] of sortedEnvironment(input.env)) {
+    containerEnvNames.push(name);
+    if (CONTAINER_LITERAL_ENV_KEYS.has(name)) {
+      args.push("--env", `${name}=${value}`);
+    } else {
+      envFileLines.push(`${name}=${value}`);
+    }
+  }
+  if (envFileLines.length > 0) args.push("--env-file", "/dev/fd/3");
+  args.push("--env", "BASH_ENV=");
+  const cleanAssignments = containerEnvNames.map((name) => `${name}="$${name}"`).join(" ");
+  const cleanEnvironmentCommand = `exec /usr/bin/env -i${cleanAssignments ? ` ${cleanAssignments}` : ""} /bin/bash --noprofile --norc -c "$1"`;
+  args.push(
+    input.resolvedImage ?? input.image,
+    "--noprofile",
+    "--norc",
+    "-c",
+    cleanEnvironmentCommand,
+    "bazilion-sandbox",
+    input.command
+  );
+  return {
+    executable,
+    args,
+    containerName: input.containerName,
+    image: input.image,
+    mountSource: input.mountSource,
+    processEnv,
+    ...envFileLines.length > 0 ? { envFileContent: `${envFileLines.join("\n")}
+` } : {}
+  };
+}
+function createDockerBashOperations(options) {
+  const image = options.image;
+  const env = { ...options.env };
+  const dockerPath = options.dockerPath ?? "docker";
+  const configuredReadOnlyMounts = options.readOnlyMounts ?? [];
+  const hostEnv = { ...options.hostEnv ?? process.env };
+  validateDockerPath(dockerPath);
+  validateImage(image);
+  return {
+    async exec(command, cwd, { onData, signal, timeout }) {
+      const timeoutMs = resolveTimeoutMs(timeout);
+      if (signal?.aborted) throw new Error("aborted");
+      const mountSource = await resolveMountSource(cwd);
+      const readOnlyMounts = await Promise.all(
+        configuredReadOnlyMounts.map(async (mount) => {
+          const source = await resolveMountSource(mount.source);
+          if (mount.sourceRoot && !isWithin(mount.sourceRoot, source)) {
+            throw new Error(
+              `Docker sandbox read-only mount escaped its configured root: ${mount.source}`
+            );
+          }
+          return { source, target: mount.target };
+        })
+      );
+      if (signal?.aborted) throw new Error("aborted");
+      const { uid, gid } = hostIdentity();
+      const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
+      const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
+      if (signal?.aborted) throw new Error("aborted");
+      const containerName = `bazilion-bash-${process.pid}-${randomUUID15().replaceAll("-", "")}`;
+      const spec = buildDockerRunSpec({
+        image,
+        env,
+        dockerPath,
+        command,
+        mountSource,
+        containerName,
+        uid,
+        gid,
+        resolvedImage,
+        readOnlyMounts,
+        hostEnv: dockerClientEnv
+      });
+      return executeDockerRun(spec, { onData, signal, timeout, timeoutMs });
+    }
+  };
+}
+function executeDockerRun(spec, options) {
+  let envFileFd;
+  try {
+    if (spec.envFileContent !== void 0) {
+      envFileFd = openAnonymousEnvFile(spec.envFileContent);
+    }
+  } catch (error) {
+    return Promise.reject(
+      new Error(
+        `Docker sandbox could not prepare its environment: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+  }
+  return new Promise((resolve5, reject) => {
+    const child = spawn(spec.executable, spec.args, {
+      stdio: ["ignore", "pipe", "pipe", envFileFd ?? "ignore"],
+      windowsHide: true,
+      env: spec.processEnv
+    });
+    if (envFileFd !== void 0) closeSync2(envFileFd);
+    let settled = false;
+    let termination;
+    let timeoutHandle;
+    let stderr = "";
+    const requestTermination = (reason) => {
+      termination ??= reason;
+      child.kill("SIGKILL");
+    };
+    const onAbort = () => requestTermination("aborted");
+    const finish = async (exitCode, spawnError) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      options.signal?.removeEventListener("abort", onAbort);
+      if (!termination && options.signal?.aborted) termination = "aborted";
+      if (termination) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(
+          termination === "aborted" ? new Error("aborted") : new Error(`timeout:${options.timeout}`)
+        );
+        return;
+      }
+      if (spawnError) {
+        reject(formatSpawnError(spec.executable, spawnError));
+        return;
+      }
+      if (exitCode === 125) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(formatDockerRunError(spec, stderr));
+        return;
+      }
+      if (exitCode === null) {
+        await removeContainer(spec.executable, spec.containerName, spec.processEnv);
+        reject(new Error(`Docker sandbox CLI for container "${spec.containerName}" was killed`));
+        return;
+      }
+      resolve5({ exitCode });
+    };
+    child.stdout?.on("data", options.onData);
+    child.stderr?.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-MAX_STDERR_CHARS);
+      options.onData(data);
+    });
+    child.once("error", (error) => void finish(null, error));
+    child.once("close", (exitCode) => void finish(exitCode));
+    if (options.timeoutMs !== void 0) {
+      timeoutHandle = setTimeout(() => requestTermination("timeout"), options.timeoutMs);
+    }
+    if (options.signal) {
+      options.signal.addEventListener("abort", onAbort, { once: true });
+      if (options.signal.aborted) onAbort();
+    }
+  });
+}
+function openAnonymousEnvFile(content) {
+  const dir = mkdtempSync2(join14(tmpdir2(), "bazilion-docker-env-"));
+  const path = join14(dir, "environment");
+  let fd;
+  try {
+    writeFileSync7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    rmSync10(dir, { recursive: true, force: true });
+    return fd;
+  } catch (error) {
+    if (fd !== void 0) closeSync2(fd);
+    rmSync10(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function resolveTimeoutMs(timeout) {
+  if (timeout === void 0) return void 0;
+  if (!Number.isFinite(timeout) || timeout <= 0) {
+    throw new Error("Invalid timeout: must be a finite number of seconds");
+  }
+  const timeoutMs = timeout * 1e3;
+  if (timeoutMs > MAX_TIMEOUT_MS) {
+    throw new Error(`Invalid timeout: maximum is ${MAX_TIMEOUT_MS / 1e3} seconds`);
+  }
+  return timeoutMs;
+}
+async function resolveMountSource(cwd) {
+  try {
+    await access(cwd, constants2.F_OK);
+    const info = await stat(cwd);
+    if (!info.isDirectory()) {
+      throw new Error(`Docker sandbox mount is not a directory: ${cwd}`);
+    }
+    return await realpath(cwd);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Docker sandbox mount is not")) {
+      throw error;
+    }
+    const code = error.code;
+    if (code === "ENOENT") {
+      throw new Error(`Docker sandbox mount does not exist: ${cwd}`);
+    }
+    throw new Error(
+      `Docker sandbox cannot access mount "${cwd}": ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function hostIdentity() {
+  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
+    throw new Error("Docker sandbox requires a host platform with numeric uid/gid support");
+  }
+  return { uid: process.getuid(), gid: process.getgid() };
+}
+function sortedEnvironment(env) {
+  const entries = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (value === void 0) continue;
+    if (!ENV_NAME.test(name)) {
+      throw new Error(
+        `Docker sandbox environment variable name is invalid: ${JSON.stringify(name)}`
+      );
+    }
+    if (DOCKER_CLIENT_CONTROL_ENV2.has(name) && !CONTAINER_LITERAL_ENV_KEYS.has(name)) {
+      throw new Error(`Docker sandbox cannot pass Docker client control variable: ${name}`);
+    }
+    if (SANDBOX_CONTROL_ENV2.has(name)) {
+      throw new Error(`Docker sandbox cannot pass shell startup control variable: ${name}`);
+    }
+    if (value.includes("\0")) {
+      throw new Error(`Docker sandbox environment variable ${name} contains a NUL byte`);
+    }
+    if (value.includes("\n") || value.includes("\r")) {
+      throw new Error(`Docker sandbox environment variable ${name} cannot contain a line break`);
+    }
+    entries.push([name, value]);
+  }
+  return entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+async function resolveLocalDockerClientEnv(dockerPath, hostEnv) {
+  const discoveryEnv = buildDockerClientEnv(hostEnv);
+  const endpoint = await inspectDockerEndpoint(dockerPath, discoveryEnv);
+  const prefix = "unix://";
+  if (!endpoint.startsWith(prefix) || !isAbsolute2(endpoint.slice(prefix.length))) {
+    throw new Error(
+      `Docker sandbox requires a local Unix-socket context; active endpoint is ${JSON.stringify(endpoint)}`
+    );
+  }
+  const pinned = { DOCKER_HOST: endpoint };
+  if (hostEnv.PATH !== void 0) pinned.PATH = hostEnv.PATH;
+  if (hostEnv.HOME !== void 0) pinned.HOME = hostEnv.HOME;
+  return pinned;
+}
+async function inspectDockerEndpoint(dockerPath, processEnv) {
+  const raw = await runDockerInspection(
+    dockerPath,
+    ["context", "inspect", "--format", "{{json .Endpoints.docker.Host}}"],
+    processEnv,
+    "the active context"
+  );
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "string" || parsed.length === 0) throw new Error("empty endpoint");
+    return parsed;
+  } catch {
+    throw new Error(
+      `Docker sandbox could not resolve the active Docker endpoint: ${raw || "empty context response"}`
+    );
+  }
+}
+async function inspectSandboxImage(dockerPath, image, processEnv) {
+  let raw;
+  try {
+    raw = await runDockerInspection(
+      dockerPath,
+      ["image", "inspect", "--format", '{{json .Id}}	{{json (index .Config "Volumes")}}', image],
+      processEnv,
+      `local image ${JSON.stringify(image)}`
+    );
+  } catch (error) {
+    const detail3 = error instanceof Error ? error.message : String(error);
+    if (/no such image|unable to find image|manifest unknown/i.test(detail3)) {
+      throw new Error(`Docker sandbox image "${image}" is unavailable: ${detail3}`);
+    }
+    throw error;
+  }
+  const separator = raw.indexOf("	");
+  if (separator < 0) {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  let id;
+  let volumes;
+  try {
+    id = JSON.parse(raw.slice(0, separator));
+    volumes = JSON.parse(raw.slice(separator + 1));
+  } catch {
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+  }
+  if (typeof id !== "string" || !id.startsWith("sha256:")) {
+    throw new Error(`Docker sandbox received an invalid image id for "${image}"`);
+  }
+  if (volumes !== null && typeof volumes === "object" && Object.keys(volumes).length > 0) {
+    throw new Error(
+      `Docker sandbox image "${image}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
+    );
+  }
+  if (volumes !== null && (typeof volumes !== "object" || Array.isArray(volumes))) {
+    throw new Error(`Docker sandbox received invalid volume metadata for image "${image}"`);
+  }
+  return id;
+}
+function runDockerInspection(dockerPath, args, processEnv, subject) {
+  return new Promise((resolve5, reject) => {
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    let settled = false;
+    let stdout = "";
+    let stderr = "";
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutHandle);
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve5(stdout.trim());
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(
+        new Error(
+          `Docker sandbox could not inspect ${subject} within ${DOCKER_CONTEXT_TIMEOUT_MS}ms`
+        )
+      );
+    }, DOCKER_CONTEXT_TIMEOUT_MS);
+    child.stdout.on("data", (data) => {
+      stdout = `${stdout}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-4096);
+    });
+    child.once("error", (error) => finish(formatSpawnError(dockerPath, error)));
+    child.once("close", (code) => {
+      if (code === 0) finish();
+      else
+        finish(
+          new Error(
+            `Docker sandbox could not inspect ${subject}: ${stderr.trim() || `Docker exited with status ${code}`}`
+          )
+        );
+    });
+  });
+}
+function buildDockerClientEnv(hostEnv) {
+  const env = {};
+  for (const key of DOCKER_CLIENT_ENV_KEYS) {
+    const value = hostEnv[key];
+    if (value !== void 0) env[key] = value;
+  }
+  return env;
+}
+function validateDockerPath(dockerPath) {
+  if (!dockerPath.trim()) throw new Error("Docker sandbox executable path is required");
+  if (dockerPath.includes("\0"))
+    throw new Error("Docker sandbox executable path contains a NUL byte");
+}
+function validateImage(image) {
+  if (!image.trim()) throw new Error("Docker sandbox image is required");
+  if (image.startsWith("-")) {
+    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image)}`);
+  }
+  if (image.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
+}
+function validateContainerName(containerName) {
+  if (!CONTAINER_NAME.test(containerName)) {
+    throw new Error(`Docker sandbox container name is invalid: ${JSON.stringify(containerName)}`);
+  }
+}
+function validateMountArgument(mountSource) {
+  if (!mountSource) throw new Error("Docker sandbox mount path is required");
+  if (mountSource.includes("\0") || mountSource.includes(",")) {
+    throw new Error(
+      `Docker sandbox mount path cannot be represented safely: ${JSON.stringify(mountSource)}`
+    );
+  }
+}
+function validateReadOnlyMounts(mounts, workspaceSource) {
+  const targets = /* @__PURE__ */ new Set([CONTAINER_WORKDIR, "/tmp"]);
+  for (const mount of mounts) {
+    validateMountArgument(mount.source);
+    if (mount.sourceRoot !== void 0 && (!isAbsolute2(mount.sourceRoot) || mount.sourceRoot.includes("\0") || mount.sourceRoot.includes(","))) {
+      throw new Error(
+        `Docker sandbox read-only mount root is invalid: ${JSON.stringify(mount.sourceRoot)}`
+      );
+    }
+    if (!mount.target.startsWith("/") || mount.target.includes("\0") || mount.target.includes(",") || mount.target.split("/").includes("..")) {
+      throw new Error(
+        `Docker sandbox read-only mount target is invalid: ${JSON.stringify(mount.target)}`
+      );
+    }
+    if (mount.source === workspaceSource) {
+      throw new Error("Docker sandbox cannot mount the writable workspace again as an input");
+    }
+    if (targets.has(mount.target)) {
+      throw new Error(`Docker sandbox mount target is duplicated or reserved: ${mount.target}`);
+    }
+    targets.add(mount.target);
+  }
+}
+function isWithin(root, candidate) {
+  const rel = relative2(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute2(rel);
+}
+function validateHostIdentity(uid, gid) {
+  if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
+    throw new Error(`Docker sandbox received an invalid host uid/gid: ${uid}:${gid}`);
+  }
+}
+function formatSpawnError(dockerPath, error) {
+  const code = error.code;
+  if (code === "ENOENT") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" was not found`);
+  }
+  if (code === "EACCES") {
+    return new Error(`Docker sandbox unavailable: executable "${dockerPath}" is not executable`);
+  }
+  return new Error(`Docker sandbox could not start "${dockerPath}": ${error.message}`);
+}
+function formatDockerRunError(spec, stderr) {
+  const detail3 = stderr.trim() || "Docker exited with status 125 without an error message";
+  if (/no such image|unable to find image|manifest unknown|pull access denied/i.test(detail3)) {
+    return new Error(`Docker sandbox image "${spec.image}" is unavailable: ${detail3}`);
+  }
+  if (/mounts denied|invalid mount config|bind source path does not exist|mount.*failed/i.test(detail3)) {
+    return new Error(`Docker sandbox mount failed for "${spec.mountSource}": ${detail3}`);
+  }
+  if (/cannot connect to the docker daemon|is the docker daemon running/i.test(detail3)) {
+    return new Error(`Docker sandbox unavailable: ${detail3}`);
+  }
+  return new Error(`Docker sandbox failed to start container "${spec.containerName}": ${detail3}`);
+}
+async function removeContainer(dockerPath, containerName, processEnv) {
+  const args = ["container", "rm", "--force", containerName];
+  let last;
+  for (let attempt = 0; attempt < CLEANUP_ATTEMPTS; attempt += 1) {
+    last = await runCleanupCommand(dockerPath, args, processEnv);
+    if (last.ok) return;
+    if (attempt < CLEANUP_ATTEMPTS - 1) {
+      await new Promise((resolve5) => setTimeout(resolve5, CLEANUP_RETRY_DELAY_MS));
+    }
+  }
+  if (last && !last.missing) {
+    console.warn(
+      `Docker sandbox could not confirm cleanup of container "${containerName}": ${last.error || "cleanup command failed"}`
+    );
+  }
+}
+function runCleanupCommand(dockerPath, args, processEnv) {
+  return new Promise((resolve5) => {
+    let done = false;
+    let stderr = "";
+    const child = spawn(dockerPath, args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      windowsHide: true,
+      env: processEnv
+    });
+    const finish = (ok, error = "") => {
+      if (done) return;
+      done = true;
+      clearTimeout(timeoutHandle);
+      const detail3 = error || stderr.trim();
+      resolve5({
+        ok,
+        missing: /no such container/i.test(detail3),
+        error: detail3
+      });
+    };
+    const timeoutHandle = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(false, `cleanup timed out after ${CLEANUP_TIMEOUT_MS}ms`);
+    }, CLEANUP_TIMEOUT_MS);
+    child.stderr.on("data", (data) => {
+      stderr = `${stderr}${data.toString("utf8")}`.slice(-2048);
+    });
+    child.once("error", (error) => finish(false, error.message));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+
+// ../daemon/src/runtime/shell/tooling.ts
+var HOST_CODING_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
+var HOST_FILE_TOOL_NAMES = ["read", "edit", "write", "grep", "find", "ls"];
+var CONTAINER_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var SANDBOX_INPUTS_DIR = "/inputs";
+var SANDBOX_MEMORY_DIR = "/workspace/memory";
+function buildSandboxContainerEnv(env, allowlist) {
+  return {
+    ...buildScrubbedShellEnv(env, allowlist),
+    PATH: CONTAINER_PATH,
+    HOME: "/tmp",
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    SHELL: "/bin/bash",
+    TMPDIR: "/tmp"
+  };
+}
+function createSessionShellTools(cwd, env, options = {}) {
+  const config = resolveShellSecurityConfig(env);
+  if (config.sandboxMode === "off" && config.approvalMode === "off") {
+    return { config, hostToolNames: HOST_CODING_TOOL_NAMES };
+  }
+  if (config.sandboxMode === "off") {
+    const base2 = createBashToolDefinition(cwd, {
+      operations: createLocalBashOperations()
+    });
+    const customBash2 = createApprovalGatedBashTool(base2, options.approvalHost);
+    return { config, hostToolNames: HOST_FILE_TOOL_NAMES, customBash: customBash2 };
+  }
+  const operations = createDockerBashOperations({
+    image: config.sandboxImage,
+    env: buildSandboxContainerEnv(env, config.envAllowlist),
+    readOnlyMounts: [
+      ...existsSync11(join15(cwd, "memory")) ? [safeReadOnlyMount(join15(cwd, "memory"), SANDBOX_MEMORY_DIR, cwd)] : [],
+      ...options.inputsDir ? [safeReadOnlyMount(options.inputsDir, SANDBOX_INPUTS_DIR, dirname3(options.inputsDir))] : [],
+      ...(options.skillMounts ?? []).map(
+        (mount) => safeReadOnlyMount(mount.source, mount.target, dirname3(mount.source))
+      )
+    ]
+  });
+  const base = createBashToolDefinition(cwd, { operations });
+  const dockerBash = defineTool2({
+    ...base,
+    label: "bash (Docker sandbox)",
+    description: `${base.description} Runs in an ephemeral, network-disabled Docker container with the team workspace mounted read/write plus only bounded read-only memory, skill, and attachment mounts. Other host files and host credentials are unavailable.`
+  });
+  const customBash = config.approvalMode === "dangerous" ? createApprovalGatedBashTool(dockerBash, options.approvalHost) : dockerBash;
+  return { config, hostToolNames: [], customBash };
+}
+function safeReadOnlyMount(source, target, expectedRoot) {
+  const info = lstatSync2(source);
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    throw new Error(`Docker sandbox read-only mount must be a real directory: ${source}`);
+  }
+  const sourceRoot = realpathSync2(expectedRoot);
+  const canonicalSource = realpathSync2(source);
+  const rel = relative3(sourceRoot, canonicalSource);
+  const contained = rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute3(rel);
+  if (!contained) {
+    throw new Error(`Docker sandbox read-only mount escaped its configured root: ${source}`);
+  }
+  return { source: canonicalSource, target, sourceRoot };
+}
+
 // ../daemon/src/runtime/pi/tools.ts
 import { Type as Type2 } from "typebox";
 
 // ../daemon/src/runtime/tools/bootstrap.ts
-import { existsSync as existsSync12, rmSync as rmSync10 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync12, rmSync as rmSync11 } from "fs";
+import { join as join16 } from "path";
 function bootstrapTool(agentDir) {
   return {
     def: {
@@ -1086,9 +2396,9 @@ function bootstrapTool(agentDir) {
       parameters: { type: "object", properties: {} }
     },
     async invoke() {
-      const path = join14(agentDir, "BOOTSTRAP.md");
+      const path = join16(agentDir, "BOOTSTRAP.md");
       if (existsSync12(path)) {
-        rmSync10(path);
+        rmSync11(path);
         return "BOOTSTRAP.md removed. Bootstrap is complete.";
       }
       return "BOOTSTRAP.md was already removed.";
@@ -1226,8 +2536,16 @@ function browserTools(host, agentId) {
 }
 
 // ../daemon/src/runtime/tools/deliver-file.ts
-import { readFileSync as readFileSync10, statSync as statSync4 } from "fs";
-import { basename as basename2, extname, isAbsolute, resolve as resolve3 } from "path";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  fstatSync as fstatSync2,
+  openSync as openSync3,
+  readFileSync as readFileSync10,
+  realpathSync as realpathSync3,
+  statSync as statSync3
+} from "fs";
+import { basename as basename2, extname, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4, sep as sep5 } from "path";
 var MAX_DELIVER_BYTES = 25 * 1024 * 1024;
 var MIME = {
   ".pdf": "application/pdf",
@@ -1243,7 +2561,17 @@ var MIME = {
   ".gif": "image/gif",
   ".webp": "image/webp"
 };
+function isWithin2(root, candidate) {
+  const rel = relative4(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep5}`) && !isAbsolute4(rel);
+}
 function deliverFileTool(cwd, sink) {
+  const workspacePath = resolve4(cwd);
+  let workspaceRealPath = null;
+  try {
+    workspaceRealPath = realpathSync3(workspacePath);
+  } catch {
+  }
   return {
     def: {
       name: "deliver_file",
@@ -1253,7 +2581,7 @@ function deliverFileTool(cwd, sink) {
         properties: {
           path: {
             type: "string",
-            description: "Path to the file, relative to your workspace or absolute."
+            description: "Path to a file, relative to your workspace."
           }
         },
         required: ["path"],
@@ -1263,44 +2591,79 @@ function deliverFileTool(cwd, sink) {
     async invoke(args) {
       const p = String(args.path ?? "");
       if (!p) throw new Error("deliver_file: path is required");
-      const abs = isAbsolute(p) ? p : resolve3(cwd, p);
-      let size;
+      if (isAbsolute4(p)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      const abs = resolve4(workspacePath, p);
+      if (!isWithin2(workspacePath, abs)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      if (!workspaceRealPath) {
+        throw new Error("deliver_file: workspace is unavailable");
+      }
+      let real;
+      let expected;
       try {
-        size = statSync4(abs).size;
+        real = realpathSync3(abs);
+        expected = statSync3(real);
       } catch {
         throw new Error(`deliver_file: no such file: ${p}`);
       }
-      if (size > MAX_DELIVER_BYTES) {
-        throw new Error(
-          `deliver_file: "${basename2(abs)}" is too large (${(size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
-        );
+      if (!isWithin2(workspaceRealPath, real)) {
+        throw new Error(`deliver_file: path must stay within the workspace: ${p}`);
+      }
+      let fd;
+      try {
+        fd = openSync3(real, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+      } catch {
+        throw new Error(`deliver_file: no such file: ${p}`);
+      }
+      let data;
+      try {
+        const stat2 = fstatSync2(fd);
+        if (!stat2.isFile()) {
+          throw new Error(`deliver_file: not a regular file: ${p}`);
+        }
+        if (stat2.dev !== expected.dev || stat2.ino !== expected.ino) {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        let confirmedReal;
+        try {
+          confirmedReal = realpathSync3(abs);
+        } catch {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        if (confirmedReal !== real) {
+          throw new Error(`deliver_file: path changed during validation: ${p}`);
+        }
+        if (stat2.size > MAX_DELIVER_BYTES) {
+          throw new Error(
+            `deliver_file: "${basename2(abs)}" is too large (${(stat2.size / 1024 / 1024).toFixed(1)} MB > 25 MB)`
+          );
+        }
+        data = readFileSync10(fd).toString("base64");
+      } finally {
+        closeSync3(fd);
       }
       const name = basename2(abs);
       const mimeType = MIME[extname(abs).toLowerCase()] ?? "application/octet-stream";
-      sink({ name, mimeType, data: readFileSync10(abs).toString("base64") });
+      sink({ name, mimeType, data });
       return `Delivered "${name}" (${mimeType}) to the user.`;
     }
   };
 }
 
 // ../daemon/src/runtime/tools/home.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync4, writeFileSync as writeFileSync8 } from "fs";
+import { join as join17 } from "path";
 var HOME_FILES_READABLE = [
   "IDENTITY.md",
   "SOUL.md",
   "BOOTSTRAP.md",
   "AGENTS.md",
-  "TOOLS.md",
-  "HEARTBEAT.md"
-];
-var HOME_FILES_WRITABLE = [
-  "IDENTITY.md",
-  "SOUL.md",
-  "AGENTS.md",
-  "TOOLS.md",
-  "HEARTBEAT.md"
+  "TOOLS.md"
 ];
+var HOME_FILES_WRITABLE = ["IDENTITY.md", "SOUL.md", "AGENTS.md", "TOOLS.md"];
 function homeTools(agentDir) {
   return [
     {
@@ -1322,7 +2685,7 @@ function homeTools(agentDir) {
             `home_read: "file" must be one of ${HOME_FILES_READABLE.join(", ")}; got "${file}"`
           );
         }
-        const path = join15(agentDir, file);
+        const path = join17(agentDir, file);
         try {
           return readFileSync11(path, "utf8");
         } catch (err) {
@@ -1352,8 +2715,8 @@ function homeTools(agentDir) {
           );
         }
         const content = typeof args.content === "string" ? args.content : "";
-        const path = join15(agentDir, file);
-        writeFileSync7(path, content, "utf8");
+        const path = join17(agentDir, file);
+        writeFileSync8(path, content, "utf8");
         return `wrote ${file} (${Buffer.byteLength(content, "utf8")} bytes)`;
       }
     },
@@ -1366,9 +2729,9 @@ function homeTools(agentDir) {
       async invoke() {
         const entries = [];
         for (const file of HOME_FILES_READABLE) {
-          const path = join15(agentDir, file);
+          const path = join17(agentDir, file);
           try {
-            const s = statSync5(path);
+            const s = statSync4(path);
             entries.push(`${file} (${s.size}b)`);
           } catch {
           }
@@ -1376,7 +2739,7 @@ function homeTools(agentDir) {
         if (entries.length === 0) {
           const dirEntries = (() => {
             try {
-              return readdirSync6(agentDir);
+              return readdirSync7(agentDir);
             } catch {
               return [];
             }
@@ -2291,7 +3654,6 @@ function createBazilionCustomTools(opts) {
 }
 
 // ../daemon/src/runtime/pi/session.ts
-var BUILTIN_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
 async function createBazilionSession(opts) {
   const {
     agent,
@@ -2305,6 +3667,7 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    bashApprovalHost,
     refreshApiKey
   } = opts;
   const { providerName, modelId } = splitModelString(agent.model);
@@ -2337,7 +3700,17 @@ async function createBazilionSession(opts) {
   }
   const cwd = agent.team.path;
   if (!existsSync13(cwd)) mkdirSync5(cwd, { recursive: true });
-  const sessionDir = join16(paths.agentDir(agent.agent.id), "sessions");
+  const promptSkills = loadPromptSkills(paths.skillsDir, agent.skills);
+  const uploadsDir = join18(agent.agent.dir, "uploads");
+  const shellTools = createSessionShellTools(cwd, env, {
+    ...existsSync13(uploadsDir) ? { inputsDir: uploadsDir } : {},
+    skillMounts: promptSkills.map((skill) => ({
+      source: skill.hostDir,
+      target: skill.sandboxDir
+    })),
+    approvalHost: bashApprovalHost
+  });
+  const sessionDir = join18(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync5(sessionDir, { recursive: true });
   const existing = findMostRecent(sessionDir);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
@@ -2350,10 +3723,13 @@ async function createBazilionSession(opts) {
       provider: { maxRetryDelayMs: 8e3 }
     }
   });
-  const bazilionPrompt = buildSystemPrompt(agent);
+  const bazilionPrompt = buildSystemPrompt(agent, {
+    skills: promptSkills,
+    sandboxMode: shellTools.config.sandboxMode
+  });
   const resourceLoader = createBazilionResourceLoader(bazilionPrompt);
   await resourceLoader.reload();
-  const customTools = createBazilionCustomTools({
+  const bazilionTools = createBazilionCustomTools({
     agent,
     memory,
     messagingHost,
@@ -2364,10 +3740,11 @@ async function createBazilionSession(opts) {
     fileSink,
     env
   });
-  const allowedTools = [...BUILTIN_TOOL_NAMES, ...customTools.map((t) => t.name)];
+  const customTools = shellTools.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
+  const allowedTools = [...shellTools.hostToolNames, ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
-    agentDir: join16(paths.home, "pi"),
+    agentDir: join18(paths.home, "pi"),
     model,
     thinkingLevel: toPiThinkingLevel(agent.reasoningLevel),
     tools: allowedTools,
@@ -2495,11 +3872,11 @@ function createBazilionResourceLoader(appendSystemPrompt) {
 function findMostRecent(sessionDir) {
   if (!existsSync13(sessionDir)) return null;
   let newest = null;
-  for (const entry of readdirSync7(sessionDir)) {
+  for (const entry of readdirSync8(sessionDir)) {
     if (!entry.endsWith(".jsonl")) continue;
-    const path = join16(sessionDir, entry);
+    const path = join18(sessionDir, entry);
     try {
-      const s = statSync6(path);
+      const s = statSync5(path);
       if (!newest || s.mtimeMs > newest.mtimeMs) newest = { path, mtimeMs: s.mtimeMs };
     } catch {
     }
@@ -2507,53 +3884,96 @@ function findMostRecent(sessionDir) {
   return newest?.path ?? null;
 }
 
-// ../daemon/src/runtime/worker/entry.ts
-function emit(frame) {
-  process.stdout.write(`${JSON.stringify(frame)}
-`);
+// ../daemon/src/runtime/worker/api-key-refresh.ts
+function createIpcApiKeyRefresher(call, context) {
+  return async (providerName) => {
+    assertOpenAICodexProvider(providerName, context.providerName);
+    return call("refreshApiKey", {
+      providerName,
+      agentId: context.agentId,
+      turnId: context.turnId
+    });
+  };
 }
-async function readInput() {
-  const chunks = [];
-  for await (const c of process.stdin) chunks.push(c);
-  const raw = Buffer.concat(chunks).toString("utf8").trim();
-  if (!raw) throw new Error("worker: empty stdin input");
-  const parsed = JSON.parse(raw);
-  if (!parsed.agent || typeof parsed.message !== "string" || !Array.isArray(parsed.enabledProviders)) {
-    throw new Error("worker: stdin must be {agent, message, enabledProviders}");
+function assertOpenAICodexProvider(requested, expected) {
+  if (expected !== "openai-codex" || requested !== expected) {
+    throw new Error("unexpected API key refresh provider");
   }
-  return parsed;
 }
-function createIpcClient() {
+
+// ../daemon/src/runtime/worker/ipc-client.ts
+import { randomUUID as randomUUID16 } from "crypto";
+function createIpcClient(channel) {
   const pending = /* @__PURE__ */ new Map();
-  process.on("message", (msg) => {
-    if (!isIpcReply(msg)) return;
-    const entry = pending.get(msg.id);
+  let disconnected = false;
+  channel.onMessage((message) => {
+    if (!isIpcReply(message)) return;
+    const entry = pending.get(message.id);
     if (!entry) return;
-    pending.delete(msg.id);
-    if (msg.ok) entry.resolve(msg.result);
-    else entry.reject(new Error(msg.error));
+    pending.delete(message.id);
+    if (message.ok) entry.resolve(message.result);
+    else entry.reject(new Error(message.error));
   });
-  process.on("disconnect", () => {
-    for (const [, entry] of pending) entry.reject(new Error("worker IPC channel disconnected"));
+  channel.onDisconnect(() => {
+    disconnected = true;
+    for (const entry of pending.values()) {
+      entry.reject(new Error("worker IPC channel disconnected"));
+    }
     pending.clear();
   });
   return (method, args) => {
-    if (!process.send) {
+    if (disconnected) {
+      return Promise.reject(new Error("worker IPC channel disconnected"));
+    }
+    const send = channel.send;
+    if (!send) {
       return Promise.reject(new Error("worker: no IPC channel \u2014 daemon must spawn with stdio:ipc"));
     }
-    const id = randomUUID14();
+    const id = randomUUID16();
     const message = { type: "rpc", id, method, args };
-    return new Promise((resolve4, reject) => {
-      pending.set(id, { resolve: (v) => resolve4(v), reject });
-      process.send?.(message, void 0, void 0, (err) => {
-        if (err) {
+    return new Promise((resolve5, reject) => {
+      pending.set(id, { resolve: (value) => resolve5(value), reject });
+      try {
+        send(message, (error) => {
+          if (!error) return;
           pending.delete(id);
-          reject(err);
-        }
-      });
+          reject(error);
+        });
+      } catch (error) {
+        pending.delete(id);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
     });
   };
 }
+function isIpcReply(message) {
+  if (!message || typeof message !== "object") return false;
+  const candidate = message;
+  return candidate.type === "rpc-reply" && typeof candidate.id === "string" && typeof candidate.ok === "boolean";
+}
+
+// ../daemon/src/runtime/worker/entry.ts
+function emit(frame) {
+  process.stdout.write(`${JSON.stringify(frame)}
+`);
+}
+async function readInput() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  const raw = Buffer.concat(chunks).toString("utf8").trim();
+  if (!raw) throw new Error("worker: empty stdin input");
+  const parsed = JSON.parse(raw);
+  if (!parsed.agent || typeof parsed.message !== "string" || !Array.isArray(parsed.enabledProviders) || typeof parsed.turnId !== "string" || parsed.apiKeyRefreshEnabled !== void 0 && typeof parsed.apiKeyRefreshEnabled !== "boolean" || parsed.bashApprovalMode !== "interactive" && parsed.bashApprovalMode !== "auto_deny") {
+    throw new Error(
+      "worker: stdin must include {agent, message, enabledProviders, turnId, bashApprovalMode}"
+    );
+  }
+  const providerName = parsed.agent.model.split(":", 1)[0] ?? "";
+  if (parsed.apiKeyRefreshEnabled && (providerName !== "openai-codex" || typeof parsed.apiKey !== "string")) {
+    throw new Error("worker: API key refresh requires an openai-codex turn with an initial token");
+  }
+  return parsed;
+}
 function createIpcMessagingHost(call) {
   return {
     agentExists: (agentId) => call("agentExists", { agentId }),
@@ -2582,10 +4002,22 @@ function createIpcMcpHost(call) {
     invoke: (serverId, toolName, args) => call("mcpInvoke", { serverId, toolName, args })
   };
 }
-function isIpcReply(msg) {
-  if (!msg || typeof msg !== "object") return false;
-  const m = msg;
-  return m.type === "rpc-reply" && typeof m.id === "string" && typeof m.ok === "boolean";
+function createIpcBashApprovalHost(call, input) {
+  return {
+    async requestApproval(request) {
+      const result = await call("bashApproval", {
+        id: randomUUID17(),
+        turnId: input.turnId,
+        toolCallId: request.toolCallId,
+        agentId: input.agent.agent.id,
+        teamId: input.agent.team.id,
+        command: request.command,
+        risks: [...request.risks],
+        mode: input.bashApprovalMode
+      });
+      return result.decision === "allow" ? "approved" : "denied";
+    }
+  };
 }
 async function main() {
   let aborted = false;
@@ -2604,15 +4036,42 @@ async function main() {
   };
   process.on("SIGTERM", onSignal);
   process.on("SIGINT", onSignal);
-  const { agent, message, enabledProviders, apiKey, browserEnabled, mcpTools, images } = await readInput();
+  const {
+    agent,
+    message,
+    enabledProviders,
+    apiKey,
+    apiKeyRefreshEnabled,
+    browserEnabled,
+    mcpTools,
+    images,
+    turnId,
+    bashApprovalMode
+  } = await readInput();
   const paths = resolvePaths();
-  const memory = qmdBackend(join17(agent.team.path, "memory"));
+  const memory = qmdBackend(join19(agent.team.path, "memory"));
   await memory.init();
-  const ipcCall = createIpcClient();
+  const ipcCall = createIpcClient({
+    send: process.send ? (ipcMessage, done) => {
+      process.send?.(ipcMessage, void 0, void 0, done);
+    } : void 0,
+    onMessage: (listener) => process.on("message", listener),
+    onDisconnect: (listener) => process.on("disconnect", listener)
+  });
+  const refreshApiKey = apiKeyRefreshEnabled ? createIpcApiKeyRefresher(ipcCall, {
+    providerName: agent.model.split(":", 1)[0] ?? "",
+    agentId: agent.agent.id,
+    turnId
+  }) : void 0;
   const messagingHost = createIpcMessagingHost(ipcCall);
   const userMdHost = createIpcUserMdHost(ipcCall);
   const browserHost = browserEnabled ? createIpcBrowserHost(ipcCall) : void 0;
   const mcpHost = mcpTools && mcpTools.length > 0 ? createIpcMcpHost(ipcCall) : void 0;
+  const bashApprovalHost = createIpcBashApprovalHost(ipcCall, {
+    agent,
+    turnId,
+    bashApprovalMode
+  });
   const { session, dispose } = await createBazilionSession({
     agent,
     paths,
@@ -2622,9 +4081,11 @@ async function main() {
     messagingHost,
     userMdHost,
     apiKey,
+    refreshApiKey,
     browserHost,
     mcpHost,
     mcpTools,
+    bashApprovalHost,
     // deliver_file emits a `file` event straight onto our stdout frame stream.
     fileSink: (f) => emit({ kind: "event", event: { type: "file", ...f } })
   });