beehaven 0.8.16

package/dist/daemon-omni-pipeline.js

@@ -0,0 +1,251 @@
+/**
+ * Pipeline orchestration (#69) — chain multiple Omni sessions where
+ * each stage's output feeds the next stage's input.
+ *
+ * The simplest treehouse pattern: same model + same SDK, different
+ * system-prompt-appends per stage. User asks for a brief; daemon
+ * runs Draft → Review → Revise; user sees one streamed result that's
+ * actually three turns under the hood.
+ *
+ * Stage events fire as `agent:pipeline-stage` so the FAB can render
+ * "Stage 2/3: Reviewer" indicators if it wants.
+ *
+ * Concurrency model — sequential by design. Pipelines that want
+ * parallel branches use the tree-of-thought pattern (#68) instead.
+ *
+ * Token + cost accounting — each stage is a full SDK turn. A 3-stage
+ * pipeline costs ~3x a normal turn. We don't artificially limit
+ * stages but the FAB should surface the cost before kicking off.
+ */
+import { promptOmni } from './daemon-omni.js';
+/** Common stage presets. Compose freely or use as a starter set. */
+export const STAGE_PRESETS = {
+    drafter: {
+        id: 'drafter',
+        label: 'Drafter',
+        appendSystemPrompt: `You are the DRAFTER in a 3-stage pipeline. Write a first pass — clear, comprehensive, but explicitly UNPOLISHED. Don't worry about wording or organization yet. Capture every relevant idea. The reviewer will critique it; the reviser will polish. Length: long enough to cover the topic, short enough to be skimmable.`,
+    },
+    reviewer: {
+        id: 'reviewer',
+        label: 'Reviewer',
+        appendSystemPrompt: `You are the REVIEWER. The user's original prompt + the drafter's output is below. Critique the draft — what's missing, what's wrong, what's hand-wavy, what could be sharper. Be specific. List 5-10 concrete revisions. Don't rewrite the draft; just enumerate fixes.`,
+        transformInput: (priorOutput, originalPrompt) => `Original request: ${originalPrompt}\n\nDraft to review:\n\n${priorOutput}`,
+    },
+    reviser: {
+        id: 'reviser',
+        label: 'Reviser',
+        appendSystemPrompt: `You are the REVISER. Below: the user's original request, the drafter's first pass, and the reviewer's critique. Produce the FINAL output — incorporate the reviewer's fixes, smooth out the drafter's roughness. This is what the user sees. Match the form the user asked for (doc, list, plan, etc.).`,
+        transformInput: (priorOutput, originalPrompt) => `Original request: ${originalPrompt}\n\nReviewer's critique (apply these fixes):\n\n${priorOutput}\n\nProduce the final version.`,
+    },
+};
+/** Default 3-stage draft → review → revise pipeline. */
+export const DEFAULT_PIPELINE = [
+    STAGE_PRESETS.drafter,
+    STAGE_PRESETS.reviewer,
+    STAGE_PRESETS.reviser,
+];
+/** Run a pipeline. Returns the FINAL stage's output text. Each
+ *  intermediate stage broadcasts its events under its own sessionId,
+ *  so subscribers can see/render the chain.
+ *
+ *  IMPORTANT: this runs sequentially. For parallel ("tree-of-thought")
+ *  fan-out, use the future #68 orchestrator. */
+export async function runPipeline(opts) {
+    let prevOutput = opts.originalPrompt;
+    const stageRecords = [];
+    for (const stage of opts.stages) {
+        const stagePrompt = stage.transformInput
+            ? stage.transformInput(prevOutput, opts.originalPrompt)
+            : prevOutput;
+        const stageSessionId = `${opts.sessionIdBase}-stage-${stage.id}`;
+        // promptOmni is fire-and-forget — to chain, we need the FULL
+        // assistant output text from this stage before starting the next.
+        // We collect it by listening on the subscriber's agent:done event
+        // for this specific sessionId.
+        const finalText = await runOneStageAndWaitForDone({
+            prompt: stagePrompt,
+            sessionId: stageSessionId,
+            userId: opts.userId,
+            model: opts.model,
+            appendSystemPrompt: stage.appendSystemPrompt,
+            compositionId: opts.compositionId,
+            compositionTitle: opts.compositionTitle,
+        });
+        stageRecords.push({ id: stage.id, sessionId: stageSessionId });
+        prevOutput = finalText;
+    }
+    return { finalText: prevOutput, stages: stageRecords };
+}
+/** Default 4-branch tree-of-thought. The same question gets four
+ *  parallel takes; synthesis is up to the caller (often a #106
+ *  consensus pass on top). */
+export const DEFAULT_TREE_BRANCHES = [
+    {
+        id: 'planner',
+        label: 'Planner',
+        appendSystemPrompt: 'You are the PLANNER branch in a parallel deliberation. Answer the question as a 5-step concrete plan. Order by dependency. Skip narrative.',
+    },
+    {
+        id: 'researcher',
+        label: 'Researcher',
+        appendSystemPrompt: 'You are the RESEARCHER branch. Answer the question by gathering relevant facts/sources/precedents. Don\'t plan or implement — just inform.',
+    },
+    {
+        id: 'critic',
+        label: 'Critic',
+        appendSystemPrompt: 'You are the CRITIC branch. Answer the question by enumerating risks, gotchas, and counter-arguments. Be ruthless. Find the worst-case scenarios.',
+    },
+    {
+        id: 'editor',
+        label: 'Editor',
+        appendSystemPrompt: 'You are the EDITOR branch. Answer the question by clarifying what the user is REALLY asking, what context is missing, and what success would look like. Don\'t answer the literal question — interrogate it.',
+    },
+];
+/** Fan out to N branches in parallel. Each branch is its own Omni
+ *  session, runs concurrently with the others, results aggregate.
+ *  Errors in one branch don't kill the others — partial results
+ *  return with a {branch, error} entry for the failed one. */
+export async function runTreeOfThought(opts) {
+    const branches = opts.branches.map((b) => ({
+        branch: b,
+        sessionId: `${opts.sessionIdBase}-branch-${b.id}`,
+    }));
+    // Promise.allSettled lets one branch fail without aborting the rest.
+    // Each branch's text is collected via the same wait-for-done helper
+    // used by the sequential pipeline.
+    const results = await Promise.allSettled(branches.map(async ({ branch, sessionId }) => ({
+        id: branch.id,
+        label: branch.label,
+        sessionId,
+        text: await runOneStageAndWaitForDone({
+            prompt: opts.originalPrompt,
+            sessionId,
+            userId: opts.userId,
+            model: opts.model,
+            appendSystemPrompt: branch.appendSystemPrompt,
+            compositionId: opts.compositionId,
+            compositionTitle: opts.compositionTitle,
+        }),
+    })));
+    return results.map((r, i) => {
+        const { branch, sessionId } = branches[i];
+        if (r.status === 'fulfilled')
+            return r.value;
+        return {
+            id: branch.id,
+            label: branch.label,
+            sessionId,
+            error: r.reason?.message ?? String(r.reason),
+        };
+    });
+}
+/**
+ * Consensus mode (#106) — tree-of-thought + synthesis. Runs the
+ * default 4-branch tree in parallel, then a 5th SYNTHESIZER session
+ * that takes all four outputs + the original question and produces a
+ * single unified answer with disagreements explicitly called out.
+ *
+ * Higher cost than a single turn (~5x), higher signal. Use when the
+ * user wants a thorough deliberation — "give me your most considered
+ * answer on this."
+ */
+export async function runConsensus(opts) {
+    const branches = await runTreeOfThought(opts);
+    // Build the synthesizer prompt: original question + each branch's
+    // output (or error). Synthesizer is told to call out disagreements
+    // explicitly — that's the value vs a single-turn answer.
+    const branchSummaries = branches
+        .map((b) => `### ${b.label}\n${b.text ?? `(error: ${b.error})`}`)
+        .join('\n\n');
+    const synthesizerPrompt = `Original question: ${opts.originalPrompt}\n\nBelow are 4 parallel takes from focused subagents. Synthesize them into one final answer. Where the takes AGREE, state it concisely. Where they DISAGREE, call out the disagreement and explain which side you think is right + why. Don't gloss over conflict — surface it. End with a single recommendation.\n\n${branchSummaries}`;
+    const synthesizerSessionId = `${opts.sessionIdBase}-synthesizer`;
+    const synthesizerSystemPrompt = 'You are the SYNTHESIZER. Below: a question and four parallel subagent takes. Produce ONE final answer that surfaces agreement, names disagreement, and ends with a single recommendation.';
+    const synthesized = await runOneStageAndWaitForDone({
+        prompt: synthesizerPrompt,
+        sessionId: synthesizerSessionId,
+        userId: opts.userId,
+        model: opts.model,
+        appendSystemPrompt: synthesizerSystemPrompt,
+        compositionId: opts.compositionId,
+        compositionTitle: opts.compositionTitle,
+    });
+    return { branches, synthesized, synthesizerSessionId };
+}
+export async function runModelRace(opts) {
+    const started = Date.now();
+    const racers = opts.models.map((model) => ({
+        model,
+        sessionId: `${opts.sessionIdBase}-race-${model}`,
+    }));
+    // Promise.race for the winner, but we also need the OTHER promises
+    // to keep running so we can cache them. Use a different shape: each
+    // racer is a Promise that resolves with {model, text, durationMs};
+    // we track them all + report when ALL settle.
+    const wrapped = racers.map(({ model, sessionId }) => {
+        const branchStart = Date.now();
+        return runOneStageAndWaitForDone({
+            prompt: opts.originalPrompt,
+            sessionId,
+            userId: opts.userId,
+            model,
+            compositionId: opts.compositionId,
+            compositionTitle: opts.compositionTitle,
+        })
+            .then((text) => ({ model, sessionId, text, durationMs: Date.now() - branchStart }))
+            .catch((err) => ({ model, sessionId, error: err?.message ?? String(err), durationMs: Date.now() - branchStart }));
+    });
+    // Winner = first to resolve with a successful text.
+    const allSettled = await Promise.allSettled(wrapped);
+    const results = allSettled.map((s) => (s.status === 'fulfilled' ? s.value : { model: 'unknown', sessionId: '', error: 'wrap-failed' }));
+    const successes = results.filter((r) => 'text' in r && !!r.text);
+    if (successes.length === 0) {
+        throw new Error('All race branches failed');
+    }
+    // Fastest successful branch wins (by durationMs).
+    const winner = successes.reduce((min, r) => (r.durationMs < min.durationMs ? r : min), successes[0]);
+    const alternatives = results.filter((r) => r.sessionId !== winner.sessionId);
+    // Suppress unused-var
+    void started;
+    return { winner, alternatives };
+}
+/** Helper — fires promptOmni and resolves with the assistant text
+ *  when agent:done fires for the matching sessionId. Used internally
+ *  by runPipeline. */
+async function runOneStageAndWaitForDone(input) {
+    const { subscribe } = await import('./daemon-omni.js');
+    return new Promise((resolve, reject) => {
+        let collected = '';
+        const unsubscribe = subscribe((event) => {
+            if (event.sessionId !== input.sessionId)
+                return;
+            if (event.type === 'agent:text-delta') {
+                collected += event.text;
+            }
+            else if (event.type === 'agent:done') {
+                unsubscribe();
+                // Prefer the done event's final text; fall back to delta
+                // accumulation when the SDK doesn't include result.text.
+                resolve(event.result?.text || collected);
+            }
+            else if (event.type === 'agent:error') {
+                unsubscribe();
+                reject(new Error(event.error));
+            }
+        });
+        promptOmni({
+            prompt: input.prompt,
+            sessionId: input.sessionId,
+            userId: input.userId,
+            model: input.model,
+            appendSystemPrompt: input.appendSystemPrompt,
+            compositionId: input.compositionId,
+            compositionTitle: input.compositionTitle,
+            // Pipeline stages are explicit fresh starts — no JSONL resume,
+            // each stage's prompt contains its full context.
+            continueSession: false,
+        }).catch((err) => {
+            unsubscribe();
+            reject(err);
+        });
+    });
+}

package/dist/daemon-omni-policies.js

@@ -0,0 +1,346 @@
+/**
+ * Default tool-gate policies (#60). Registered automatically on daemon
+ * startup. Cover the obvious risks:
+ *
+ *   • Long-running Bash commands (npm install, docker build, webpack,
+ *     find without limits) — Claude tends to invoke these and then
+ *     hang the agent loop for minutes. Refuse with a hint to use
+ *     `runInBackground: true` or to split the work.
+ *   • sudo Bash — refuse outright. The daemon runs as the user; sudo
+ *     elevates beyond Claude's intended scope.
+ *   • WebFetch obvious abuse — refuse known scraping targets when
+ *     called without a User-Agent.
+ *
+ * These are conservative starts. Tighten / loosen as patterns emerge.
+ * Adding a new policy is one `registerToolGatePolicy({...})` call —
+ * no central switch to update.
+ *
+ * Disabling: set BEEHAVEN_OMNI_DISABLE_DEFAULT_POLICIES=1 to skip
+ * registration (useful for tests / debugging where you want raw SDK
+ * behavior).
+ */
+import { registerToolGatePolicy } from './daemon-omni-tool-gate.js';
+/** Bash commands that typically run more than 60 seconds. Not exhaustive;
+ *  these are common offenders that block the agent loop. The check
+ *  matches the start of the command (after `cd ... &&` is stripped). */
+const SLOW_BASH_PATTERNS = [
+    { pattern: /^npm\s+(install|i|ci)(\s|$)/, reason: '`npm install` takes minutes — split into a setup step or run with `run_in_background: true`.' },
+    { pattern: /^yarn\s+(install|add)(\s|$)/, reason: '`yarn install/add` takes minutes — use `run_in_background: true` or split work.' },
+    { pattern: /^pnpm\s+(install|i|add)(\s|$)/, reason: '`pnpm install/add` takes minutes — use `run_in_background: true`.' },
+    { pattern: /^docker\s+build(\s|$)/, reason: '`docker build` can take many minutes — run in background.' },
+    { pattern: /^docker\s+compose\s+(up|build)/, reason: '`docker compose up/build` blocks the agent loop — run in background.' },
+    { pattern: /^webpack(\s|$)/, reason: '`webpack` build is slow — run in background or pipe to a log file.' },
+    { pattern: /^find\s+\/\s/, reason: '`find /` scans the whole filesystem — narrow the path or add `-maxdepth`.' },
+    { pattern: /^find\s+\$HOME\s/, reason: '`find $HOME` scans your entire home — narrow the path or add `-maxdepth`.' },
+    { pattern: /^pytest(\s|$)|^vitest(\s|$)|^jest(\s|$)/, reason: 'Test runs can be slow — use `run_in_background: true` or target specific test files.' },
+    { pattern: /^cargo\s+build(\s|$)/, reason: '`cargo build` is slow — run in background.' },
+    { pattern: /^go\s+test(\s|$)/, reason: '`go test` can be slow — narrow with `-run <pattern>` or background it.' },
+];
+const SUDO_PATTERN = /^\s*sudo(\s|$)/;
+/** Web domains we won't WebFetch — usually because they need auth or
+ *  return wall-of-HTML pages Claude can't reason about productively. */
+const WEBFETCH_BLOCKED_HOSTS = new Set([
+// none yet; framework's wired so future product decisions land here
+]);
+// ── Why free can Write and Bash ─────────────────────────────────────────
+// These tools run through the LOCAL daemon, on the USER'S OWN MACHINE, with
+// the user's OWN inference (BYOK). Write/Edit/Bash cost Clearly nothing —
+// there is no pool, no COGS, no infrastructure being consumed. Gating them by
+// tier was therefore charging for something we do not pay for, and it had a
+// consequence worth stating plainly: 0 of 133 users carry a tier, so EVERY
+// user resolved to `free`, and every user's agent was READ-ONLY. It could not
+// write a file or run a command. An agent that cannot act is not a product
+// anyone can evaluate, let alone buy.
+//
+// So capability is no longer the lever — VOLUME is (TIER_QUOTAS below), which
+// is the lever the earlier entitlement work already concluded was right:
+// deterministic units rather than capability gates. `Task` (subagent
+// spawning) stays team-only because it FANS OUT — one call becomes many, and
+// that is a genuine resource decision rather than a paywall on the basics.
+const AGENT_CORE_TOOLS = [
+    'Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch',
+    // Skill is the meta-tool for invoking specialized skills — keep it open.
+    'Skill',
+    // TodoWrite is local-state only, no risk.
+    'TodoWrite',
+    // Filesystem write + shell, on the user's own machine.
+    'Write', 'Edit', 'NotebookEdit',
+    'Bash', 'BashOutput', 'KillShell',
+];
+/**
+ * The BEEHAVEN surface — first-party, every tier, by name.
+ *
+ * `TIER_ALLOWLIST` is an exact-name allowlist over Claude Code's BUILT-IN
+ * tools, written when the beehaven MCP tools existed only as a design and had
+ * never been mounted. The moment they were, every one of them fell through to
+ * the deny arm — on every tier, including `team` — and the agent was told to
+ * "upgrade to pro" to touch the user's own canvas. A prefix check rather than
+ * ~30 more entries, because the tool list is the hive catalog and grows.
+ *
+ * Why they are not a paid gate, using this file's own reasoning: these run
+ * through the LOCAL daemon against the user's OWN workspace, on their own
+ * inference. Gating `canvas_add_text` by plan charges for something we do not
+ * pay for. Volume is the lever (TIER_QUOTAS); capability is not.
+ *
+ * The anchored `mcp__clearly__` prefix matters — it names OUR server. A bare
+ * `mcp__` test would hand the same free pass to every MCP server the user
+ * happens to have configured, which is exactly the blanket the allowlist
+ * exists to avoid.
+ */
+const FIRST_PARTY_TOOL_PREFIX = 'mcp__clearly__';
+/**
+ * ⚠ `principal` IS EQUALLY FIRST-PARTY, and omitting it silently broke Omni.
+ *
+ * These are the tools that let the agent SPEAK — `reply_to_principal`,
+ * `ask_principal`, the board, design docs. When Omni's tools moved into the
+ * daemon they landed on a second in-process server (`mcp__principal__*`), and
+ * this gate only knew the `clearly` prefix, so the tier check denied every one
+ * of them: "isn't available on the free tier."
+ *
+ * The failure mode is the worst available. `reply_to_principal` is the ONLY
+ * channel to the user, so a denial there is an agent that does its work and then
+ * cannot say anything — the turn completes, the tool call is refused, and the
+ * person sees silence. Caught by calling it, not by reading it.
+ *
+ * Both prefixes name OUR servers. A bare `mcp__` test would hand the same free
+ * pass to every MCP server the user happens to have configured, which is exactly
+ * the blanket the allowlist exists to avoid.
+ */
+const PRINCIPAL_TOOL_PREFIX = 'mcp__principal__';
+function isFirstPartyTool(toolName) {
+    return toolName.startsWith(FIRST_PARTY_TOOL_PREFIX)
+        || toolName.startsWith(PRINCIPAL_TOOL_PREFIX);
+}
+const TIER_ALLOWLIST = {
+    free: new Set([...AGENT_CORE_TOOLS]),
+    pro: new Set([...AGENT_CORE_TOOLS]),
+    team: new Set([
+        ...AGENT_CORE_TOOLS,
+        // Subagent spawning — one call becomes many, so this is a real
+        // resource decision rather than a paywall on the basics.
+        'Task',
+    ]),
+};
+/**
+ * Per-tier DAILY caps — the actual paid lever now that capability is not.
+ *
+ * A tool not listed for a tier is uncapped. Free is generous enough to
+ * evaluate the product properly and finish a real piece of work; it is not
+ * generous enough to run an agent all day, which is the paid behaviour.
+ */
+const TIER_QUOTAS = {
+    free: { Bash: 100, Edit: 100, Write: 50, WebSearch: 50, WebFetch: 50 },
+    pro: { Bash: 500, Edit: 500, Write: 200, WebSearch: 200, WebFetch: 200 },
+    team: { Bash: 2000, Edit: 2000, Write: 1000, WebSearch: 500, WebFetch: 500 },
+};
+/**
+ * Map a Clearly SUBSCRIPTION PLAN onto the three capability buckets the
+ * allowlist above is written in terms of.
+ *
+ * Two different vocabularies meet here: billing sells
+ * free/creator/pro/studio/enterprise (lib/pricing/tiers.ts), while the
+ * tool gate only cares about "read-only", "can touch this machine", and
+ * "can spawn subagents". Keep the translation in ONE place so a new
+ * plan id can't silently land in the `default` branch of some `switch`
+ * somewhere and hand out shell access.
+ *
+ * Unknown plan ⇒ 'free'. We enforce what we can prove.
+ */
+export function planToPolicyTier(plan) {
+    switch (String(plan ?? '').trim().toLowerCase()) {
+        case 'free':
+            return 'free';
+        case 'starter':
+        case 'creator':
+        case 'pro':
+            return 'pro';
+        case 'studio':
+        case 'enterprise':
+        case 'canvas_team':
+        case 'team':
+            return 'team';
+        default:
+            return 'free';
+    }
+}
+/**
+ * Resolve the caller's tier.
+ *
+ * DEFAULT IS DELIBERATELY 'free'. This used to be a stub that returned
+ * `'pro'` unconditionally — and `setTierResolver` was exported but never
+ * called by anything, so that stub WAS the production behaviour. The
+ * `tier-restrict` policy ran on every tool call, resolved 'pro' every
+ * time, and waved through Write/Edit/Bash/NotebookEdit/KillShell for
+ * every user including free ones. The gate looked enforced and enforced
+ * nothing.
+ *
+ * `daemon.ts` installs the real resolver at startup (relay-reported
+ * subscription plan, with the last known plan cached for offline use).
+ * If that wiring is ever removed again, the failure mode is now
+ * restrictive rather than permissive — the safe direction for a gate.
+ *
+ * Override via BEEHAVEN_OMNI_FORCE_TIER=free|pro|team for testing.
+ */
+let _tierResolver = () => {
+    const forced = process.env.BEEHAVEN_OMNI_FORCE_TIER;
+    if (forced === 'free' || forced === 'pro' || forced === 'team')
+        return forced;
+    return 'free';
+};
+/** Last tier a resolver returned successfully — the fallback when a
+ *  later lookup throws, so a transient failure can't downgrade (or
+ *  upgrade) a user mid-session. */
+let _lastKnownTier = null;
+export function setTierResolver(fn) {
+    _tierResolver = fn;
+}
+/* The flat TOOL_QUOTAS map that used to live here is gone — its own comment
+ * asked for "per-tier overrides (free gets lower caps)", and TIER_QUOTAS above
+ * is that. One source of caps, keyed by tier. */
+/** In-memory call counts per (userId, toolName). 24h sliding window. */
+const toolCallCounts = new Map();
+let registered = false;
+export function ensureDefaultPoliciesRegistered() {
+    if (registered)
+        return;
+    if (process.env.BEEHAVEN_OMNI_DISABLE_DEFAULT_POLICIES === '1')
+        return;
+    registered = true;
+    // Bash: cost/latency gate.
+    registerToolGatePolicy({
+        id: 'bash-cost-gate',
+        priority: 10,
+        appliesTo: (toolName) => toolName === 'Bash',
+        decide(_toolName, input) {
+            const command = String(input?.command ?? '');
+            if (!command.trim())
+                return null;
+            // sudo: outright deny. The daemon process runs as the user; sudo
+            // elevates beyond Claude's normal scope.
+            if (SUDO_PATTERN.test(command)) {
+                return {
+                    deny: true,
+                    message: 'sudo commands are disallowed. The daemon runs as your user; if you really need elevated privileges, run the command yourself in a terminal.',
+                };
+            }
+            // Long-runner allowlist with hints. We don't deny if the caller
+            // already opted into background mode — there the long duration
+            // is expected and handled.
+            const runInBackground = input?.run_in_background === true;
+            if (!runInBackground) {
+                // Walk SLOW_BASH_PATTERNS; deny first match.
+                // Strip leading `cd /some/path && ` so the match works on the
+                // actual command being executed.
+                const stripped = command.replace(/^\s*cd\s+\S+\s*&&\s*/, '');
+                for (const { pattern, reason } of SLOW_BASH_PATTERNS) {
+                    if (pattern.test(stripped)) {
+                        return { deny: true, message: reason };
+                    }
+                }
+            }
+            return null;
+        },
+    });
+    // Per-tool quotas (#91). Sliding 24h window of tool-call counts.
+    // Per (userId, toolName). When the daily cap is hit, deny with
+    // a clear message about when the window resets. Counters are
+    // in-memory only — daemon restart resets them, which is fine for
+    // local-machine policy (the cap is "Claude won't WebSearch 500x
+    // accidentally in one chat," not "audit-grade rate-limiting").
+    registerToolGatePolicy({
+        id: 'per-tool-quota',
+        priority: 7,
+        async decide(toolName, _input, ctx) {
+            // Quota is now PER TIER — it is the paid lever, since every tier can
+            // reach every core tool. Resolve the tier the same way tier-restrict
+            // does; a resolver failure falls back to the last known tier rather
+            // than to the most generous one.
+            let tier;
+            try {
+                tier = await _tierResolver({ sessionId: ctx.sessionId, userId: ctx.userId });
+                _lastKnownTier = tier;
+            }
+            catch {
+                tier = _lastKnownTier ?? 'free';
+            }
+            const limit = (TIER_QUOTAS[tier] ?? TIER_QUOTAS.free)[toolName];
+            if (limit == null)
+                return null;
+            const key = `${ctx.userId}::${toolName}`;
+            const now = Date.now();
+            let bucket = toolCallCounts.get(key);
+            if (!bucket || now - bucket.windowStart > 24 * 3_600_000) {
+                bucket = { count: 0, windowStart: now };
+                toolCallCounts.set(key, bucket);
+            }
+            bucket.count += 1;
+            if (bucket.count > limit) {
+                const resetIn = Math.max(0, 24 * 3_600_000 - (now - bucket.windowStart));
+                const resetHrs = Math.ceil(resetIn / 3_600_000);
+                return {
+                    deny: true,
+                    message: `Daily ${toolName} quota reached (${limit}/day on the ${tier} plan). Resets in ~${resetHrs}h.`,
+                };
+            }
+            return null;
+        },
+    });
+    // Per-tier tool palette gate (#61). Runs first (priority 5) so an
+    // out-of-tier tool gets blocked before any cost/policy checks even
+    // run. Sibling tools (canUseTool framework) can still mutate input
+    // for tools that ARE in tier — order matters but is independent of
+    // tier from this point on.
+    registerToolGatePolicy({
+        id: 'tier-restrict',
+        priority: 5,
+        async decide(toolName, _input, ctx) {
+            let tier;
+            try {
+                tier = await _tierResolver({ sessionId: ctx.sessionId, userId: ctx.userId });
+            }
+            catch {
+                // Resolver failed. This used to fail-open to 'pro' — so any error
+                // in tier lookup granted shell + filesystem write. Fall back to
+                // the LAST KNOWN plan instead (cached on the last successful
+                // relay handshake), and only to 'free' when we've never known
+                // one. A paid user working offline keeps their tools; an unknown
+                // user does not silently acquire them.
+                tier = _lastKnownTier ?? 'free';
+            }
+            // Remember the last successfully-resolved tier for the branch above.
+            if (tier)
+                _lastKnownTier = tier;
+            const allowlist = TIER_ALLOWLIST[tier] ?? TIER_ALLOWLIST.pro;
+            if (allowlist.has(toolName) || isFirstPartyTool(toolName))
+                return null;
+            // Out of tier. Hint the upgrade path.
+            const nextTier = tier === 'free' ? 'pro' : 'team';
+            return {
+                deny: true,
+                message: `Tool '${toolName}' isn't available on the ${tier} tier. Upgrade to ${nextTier} to unlock it.`,
+            };
+        },
+    });
+    // WebFetch: block hosts on the deny list (currently empty — placeholder
+    // for product decisions like "no scraping facebook.com without UA").
+    if (WEBFETCH_BLOCKED_HOSTS.size > 0) {
+        registerToolGatePolicy({
+            id: 'webfetch-host-gate',
+            priority: 10,
+            appliesTo: (toolName) => toolName === 'WebFetch',
+            decide(_toolName, input) {
+                const url = String(input?.url ?? '');
+                if (!url)
+                    return null;
+                try {
+                    const host = new URL(url).hostname;
+                    if (WEBFETCH_BLOCKED_HOSTS.has(host)) {
+                        return { deny: true, message: `${host} is on the daemon's WebFetch deny list. Use your browser or ask the user to paste the content.` };
+                    }
+                }
+                catch { /* malformed URL — let the SDK reject downstream */ }
+                return null;
+            },
+        });
+    }
+}