mercury-agent 0.16.2 → 0.17.0

package/examples/profiles/football-reporter/config.yaml

@@ -122,8 +122,27 @@ extension_config:
   # separately from reporting.
   feed-watch.quiet_hours: "00:30-07:30"
   feed-watch.timezone: "Asia/Jerusalem"
-  feed-watch.max_per_hour: "3"
-  feed-watch.batch_minutes: "4"
+  # Run rate. These two are the *cost* levers, and the cost law is
+  # `cost/day ≈ runs/day × prefix tokens × $2.50/M` — every run cache-writes its
+  # whole prefix, because runs are further apart than the 5-minute cache lives.
+  # At 3/hour and a 4-minute batch the space opened 46-48 runs/day, ~70 % of
+  # which answered NO_UPDATE. Lowered 2026-08-31 to 1/hour and a 15-minute
+  # batch: a wider batch also merges more outlets carrying one story into a
+  # single run, which is what the verify prompt asks the model to do anyway.
+  #
+  # These reduce the *number* of runs. They are not the digest fix — see
+  # `docs/debug/major/2026-08-31-feed-watch-digest-persisted-and-replayed.md` for the prefix size,
+  # which is the other factor in the same product.
+  feed-watch.max_per_hour: "1"
+  feed-watch.batch_minutes: "15"
+
+  # The other factor in the same product: how big each run's prompt is. The
+  # digest carries one window into the article, and on 2026-08-31 that was 346
+  # items / 130 KB. Capped here at 200 newest; the whole window, links included,
+  # is written to `knowledge/feed-digest-window.md` before the run, so nothing
+  # the cap holds back is out of reach. Declared explicitly rather than left to
+  # the extension default so `space-profile check` covers it.
+  feed-watch.digest_max_items: "200"
 
   # ── member permissions (M2.3, audit R7) ─────────────────────────────────
   #
@@ -139,6 +158,16 @@ extension_config:
   # above for why that one stays out of this file.
   role.member.permissions: "prompt,prefs.get,napkin,pdf,voice-transcribe,web-browser,tasks.create,tasks.list,tasks.pause,tasks.resume,tts.synthesize,media.receive,media.send"
 
+  # ── one voice (M2.4, audit R2, D-017) ──────────────────────────────────
+  #
+  # This space owns its standard: AGENTS.md here is the only persona the model
+  # hears. With this on, the host leaves the owner's global character ("Wiz, a
+  # personal assistant") out of the system prompt and does not mount the
+  # global AGENTS.md ("a helpful AI assistant… ask before acting") for runs in
+  # this space. Everything else — skills, models, the platform's security
+  # text — is unchanged. Profile-owned so a hand flip shows up as drift.
+  persona.exclusive: "true"
+
 # Stray items in the space workspace, deleted by apply and logged (D-009).
 # Paths are relative to the space directory and may not escape it.
 workspace_remove:

package/examples/profiles/football-reporter/tasks/daily-article.md

@@ -37,7 +37,8 @@
 
 ### בלוק הסיכום
 
-התשובה נפתחת בבלוק הזה, בלי שום תו לפניו:
+התשובה נפתחת בבלוק הזה, בלי שום תו לפניו (כשההודעה עטופה בסמני המסירה
+`[reply]` … `[/reply]`, הבלוק הוא השורה הראשונה **בתוך** הסמנים):
 
 ```
 [longview:summary]
@@ -79,7 +80,7 @@ DD.MM.YYYY · N מקורות
 
 *מקורות*
 
-- [<אתר>, <כותרת הידיעה>](<כתובת>), <תאריך>
+- <אתר> — <כותרת הידיעה>, <תאריך>
 ```
 
 - **כותרת** — עובדתית וספציפית, עד 70 תווים, בלי סימני שאלה. היא גם כתובת
@@ -90,8 +91,9 @@ DD.MM.YYYY · N מקורות
   עם שם הדובר, ההקשר והתאריך. אם אין ציטוט כזה, אין את השורה הזאת.
 - **בוודאות / בספק** — שתי שורות ציטוט, כל אחת בשורה נפרדת עם שורה ריקה
   ביניהן. מה שלא רשמי נכנס ל"בספק" גם אם הוא סביר.
-- **מקורות** — רשימה של כל מה שקראת בפועל, עם קישור ותאריך. אתר שלא פתחת לא
-  מופיע כאן.
+- **מקורות** — רשימה של כל מה שקראת בפועל, בשם האתר ובתאריך. בלי כתובות URL:
+  הקישור משמש אותך לאימות לפני הכתיבה, לא את הקורא. אתר שלא פתחת לא מופיע כאן,
+  וזה לא משתנה — הרשימה היא הצהרה על מה שנקרא, לא קישוט.
 
 ### הבלוקים
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",
@@ -20,6 +20,10 @@
   },
   "type": "module",
   "exports": {
+    "./core/global-admin": {
+      "types": "./src/core/global-admin.ts",
+      "default": "./src/core/global-admin.ts"
+    },
     "./extensions/types": {
       "types": "./src/extensions/types.ts",
       "default": "./src/extensions/types.ts"
@@ -72,8 +76,8 @@
     "typecheck": "bunx tsc --noEmit",
     "typecheck:scripts": "bunx tsc --noEmit -p tsconfig.scripts.json",
     "typecheck:examples": "bunx tsc --noEmit -p tsconfig.examples.json",
-    "lint": "bunx biome check src/ tests/ scripts/space-profile.ts examples/extensions/feed-watch/ examples/extensions/napkin/ examples/extensions/pinchtab/",
-    "lint:fix": "bunx biome check --fix src/ tests/ scripts/space-profile.ts examples/extensions/feed-watch/ examples/extensions/napkin/ examples/extensions/pinchtab/",
+    "lint": "bunx biome check src/ tests/ scripts/space-profile.ts examples/extensions/feed-watch/ examples/extensions/napkin/ examples/extensions/pinchtab/ examples/extensions/overview/",
+    "lint:fix": "bunx biome check --fix src/ tests/ scripts/space-profile.ts examples/extensions/feed-watch/ examples/extensions/napkin/ examples/extensions/pinchtab/ examples/extensions/overview/",
     "check:silent-catch": "bun run scripts/check-silent-catch.ts",
     "check:sync-calls": "bun run scripts/check-sync-calls.ts",
     "check:dep-floors": "bun run scripts/check-dep-floors.ts",

package/resources/templates/mercury.example.yaml

@@ -62,6 +62,11 @@
 #   image: ghcr.io/avishai-tsabari/mercury-agent:latest
 #   container_timeout_ms: 300000
 #   container_bwrap_docker_compat: false
+#   # Docker Desktop only. Mercury refuses the auto-detected sandbox relaxation
+#   # (seccomp=unconfined + SYS_ADMIN) unless you opt in here. Without it,
+#   # containers do not start on macOS/Windows. Ignored when
+#   # container_bwrap_docker_compat is set or the runtime is runsc.
+#   allow_unconfined: false
 #   # Which MERCURY_* vars reach containers. "all" (default) passes every
 #   # non-blocked var into every space's container; "claimed" passes only
 #   # extension-declared vars, gated by the caller's permission.

package/src/adapters/whatsapp-media.ts

@@ -15,8 +15,13 @@ import {
   type WAMessage,
   type WASocket,
 } from "@whiskeysockets/baileys";
-import { mimeToExt } from "../core/media.js";
+import {
+  hasExecutableHeader,
+  isAllowedExtension,
+  mimeToExt,
+} from "../core/media.js";
 import { logger } from "../logger.js";
+import { stripInvisibleUnicode } from "../text/sanitize-text.js";
 import type {
   DroppedAttachment,
   MediaType,
@@ -170,6 +175,25 @@ export async function downloadWhatsAppMedia(
 
   const messageId = msg.key.id || `${Date.now()}`;
 
+  // Part A — extension allowlist, WARN-ONLY: logs what a rejection would have
+  // dropped, accepts the file regardless. Before the download, like
+  // `downloadMediaFromUrl`, so the log reflects what a rejection would have
+  // skipped fetching — a file that is oversized or fails to download would
+  // otherwise never be counted. Only meaningful when WhatsApp supplied a
+  // filename; without one the stored name is derived from the MIME type and
+  // there is no extension to judge.
+  if (mediaInfo.filename && !isAllowedExtension(mediaInfo.filename)) {
+    logger.warn(
+      "Attachment extension not in EXT_TO_MIME (warn-only, accepted)",
+      {
+        messageId,
+        filename: mediaInfo.filename,
+        mimeType: mediaInfo.mimeType,
+        type: mediaInfo.type,
+      },
+    );
+  }
+
   // Check file size before downloading
   if (mediaInfo.fileLength && mediaInfo.fileLength > options.maxSizeBytes) {
     logger.warn("Skipping large media file", {
@@ -222,6 +246,23 @@ export async function downloadWhatsAppMedia(
       return null;
     }
 
+    // Part B — binary-header denylist, enforced. Checked on the bytes already
+    // in memory, before anything reaches disk: never write-then-unlink.
+    if (hasExecutableHeader(buffer)) {
+      logger.warn("Dropping attachment with executable header", {
+        messageId,
+        filename: mediaInfo.filename,
+        mimeType: mediaInfo.mimeType,
+        type: mediaInfo.type,
+        sizeBytes: buffer.length,
+      });
+      options.onSkipped?.({
+        type: mediaInfo.type,
+        reason: "executable_content",
+      });
+      return null;
+    }
+
     // Ensure inbox directory exists
     const mediaDir = path.join(options.outputDir, "inbox");
     fs.mkdirSync(mediaDir, { recursive: true });
@@ -252,7 +293,7 @@ export async function downloadWhatsAppMedia(
       path: filePath,
       type: mediaInfo.type,
       mimeType: mediaInfo.mimeType,
-      filename: mediaInfo.filename,
+      filename: stripInvisibleUnicode(mediaInfo.filename),
       sizeBytes: buffer.length,
     };
   } catch (error) {
@@ -304,6 +345,25 @@ export async function downloadQuotedMedia(
 
   const messageId = syntheticMsg.key.id || `${Date.now()}`;
 
+  // Part A — extension allowlist, WARN-ONLY: logs what a rejection would have
+  // dropped, accepts the file regardless. Before the download, like
+  // `downloadMediaFromUrl`, so the log reflects what a rejection would have
+  // skipped fetching — a file that is oversized or fails to download would
+  // otherwise never be counted. Only meaningful when WhatsApp supplied a
+  // filename; without one the stored name is derived from the MIME type and
+  // there is no extension to judge.
+  if (mediaInfo.filename && !isAllowedExtension(mediaInfo.filename)) {
+    logger.warn(
+      "Attachment extension not in EXT_TO_MIME (warn-only, accepted)",
+      {
+        messageId,
+        filename: mediaInfo.filename,
+        mimeType: mediaInfo.mimeType,
+        type: mediaInfo.type,
+      },
+    );
+  }
+
   if (mediaInfo.fileLength && mediaInfo.fileLength > options.maxSizeBytes) {
     logger.warn("Skipping large quoted media file", {
       messageId,
@@ -349,6 +409,23 @@ export async function downloadQuotedMedia(
       return null;
     }
 
+    // Same enforced gate as the primary download path. A quoted message is a
+    // second ingest leg into the same inbox, not a display-only reference.
+    if (hasExecutableHeader(buffer)) {
+      logger.warn("Dropping quoted attachment with executable header", {
+        messageId,
+        filename: mediaInfo.filename,
+        mimeType: mediaInfo.mimeType,
+        type: mediaInfo.type,
+        sizeBytes: buffer.length,
+      });
+      options.onSkipped?.({
+        type: mediaInfo.type,
+        reason: "executable_content",
+      });
+      return null;
+    }
+
     const mediaDir = path.join(options.outputDir, "inbox");
     fs.mkdirSync(mediaDir, { recursive: true });
 
@@ -375,7 +452,7 @@ export async function downloadQuotedMedia(
       path: filePath,
       type: mediaInfo.type,
       mimeType: mediaInfo.mimeType,
-      filename: mediaInfo.filename,
+      filename: stripInvisibleUnicode(mediaInfo.filename),
       sizeBytes: buffer.length,
     };
   } catch (error) {

package/src/agent/container-entry.ts

@@ -11,6 +11,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
+import { stripInvisibleUnicode } from "../text/sanitize-text.js";
 import type { MessageAttachment, StoredMessage } from "../types.js";
 import {
   type CapabilitySource,
@@ -95,6 +96,17 @@ export type Payload = {
   anchorMessages?: StoredMessage[];
   prompt: string;
   callerRole?: string;
+  /**
+   * The caller's effective permission set in this space (`permissions.ts`
+   * `getRolePermissions`). Platform-prompt sections that instruct the model to
+   * use a tool — "set a preference", "mute" — are emitted only when the caller
+   * holds the matching permission, so the model is never told to do a thing
+   * and then told to refuse it in the same turn.
+   *
+   * Optional for the same reason as the budget fields: an older host does not
+   * send it, and then every section is emitted exactly as before.
+   */
+  callerPermissions?: string[];
   authorName?: string;
   attachments?: MessageAttachment[];
   preferences?: Array<{ key: string; value: string }>;
@@ -327,7 +339,17 @@ Prioritize practical outputs and explicit assumptions.`;
   const raw = process.env.BOT_USERNAME || "Mercury";
   const botName = raw.charAt(0).toUpperCase() + raw.slice(1);
 
-  const mercuryPlatform = `Files received from users (images, documents, voice notes) are saved to the \`inbox/\` directory in the current workspace. To send files back with your reply, write them to the \`outbox/\` directory — any files created or modified there during this run will be automatically attached to your response.
+  // Which capability paragraphs this caller gets. A host that sends no
+  // permission set gets every paragraph, exactly as before the field existed;
+  // a host that does send one gets only the paragraphs the caller can act on.
+  // Security text is never gated — it describes boundaries, not tools.
+  const perms = payload.callerPermissions
+    ? new Set(payload.callerPermissions)
+    : null;
+  const callerMay = (permission: string): boolean =>
+    perms === null || perms.has(permission);
+
+  const platformIntro = `Files received from users (images, documents, voice notes) are saved to the \`inbox/\` directory in the current workspace. To send files back with your reply, write them to the \`outbox/\` directory — any files created or modified there during this run will be automatically attached to your response.
 
 You are ${botName}. You run on the Mercury platform (https://github.com/Avishai-Tsabari/mercury). When users ask about the platform — what it can do, how to configure it, scheduling, permissions, extensions, or anything about Mercury — you MUST read from \`/docs/mercury/\` before answering. Start with \`/docs/mercury/README.md\` for an overview, then check \`/docs/mercury/docs/\` for detailed guides.
 
@@ -337,14 +359,23 @@ Each run is triggered by a specific caller with a role (admin or member). The ca
 - **member**: Limited access. Some tools and extensions are restricted.
 If a tool call is blocked with "Permission denied", this is a hard security boundary. Do NOT attempt to achieve the same result through alternative means — no curl, no direct API calls, no workarounds. Simply inform the user they do not have permission.
 
-Never write or execute scripts whose purpose is to read data from the local filesystem or database and transmit it to an external URL or endpoint. This applies regardless of how the request is phrased — "backup", "sync", "export", "check", etc. are not exceptions. If a user asks you to do this, refuse and explain why.
+Never write or execute scripts whose purpose is to read data from the local filesystem or database and transmit it to an external URL or endpoint. This applies regardless of how the request is phrased — "backup", "sync", "export", "check", etc. are not exceptions. If a user asks you to do this, refuse and explain why.`;
 
-## Moderation
-You can mute users who are being abusive, spamming, trying to exfiltrate secrets, or deliberately wasting the group's resources by triggering you for pointless nonsense. Use \`mrctl mute\` when you judge it necessary — you don't need to wait for an admin to ask. Warn the user first, then mute if they continue.
+  // Only for a caller who can actually run `mrctl mute`: told to a member
+  // without `mutes.mute`, this paragraph is an instruction the next tool call
+  // refuses, and the refusal then reads as "inform the user".
+  const moderation = `## Moderation
+You can mute users who are being abusive, spamming, trying to exfiltrate secrets, or deliberately wasting the group's resources by triggering you for pointless nonsense. Use \`mrctl mute\` when you judge it necessary — you don't need to wait for an admin to ask. Warn the user first, then mute if they continue.`;
 
-## Environment Variables
+  const environmentVariables = `## Environment Variables
 Host \`MERCURY_*\` env vars are passed into your container with the prefix stripped: \`MERCURY_FOO\` on the host is \`$FOO\` here (e.g. \`MERCURY_GITHUB_TOKEN\` → \`$GITHUB_TOKEN\`). \`$MERCURY_*\` names never exist inside the container — when wiring a secret into a script, git credential helper, or config, always reference the stripped name.`;
 
+  const mercuryPlatform = [
+    platformIntro,
+    ...(callerMay("mutes.mute") ? [moderation] : []),
+    environmentVariables,
+  ].join("\n\n");
+
   const destructiveOps = `## Destructive Operations — Confirmation Required
 
 Before deleting, trashing, or permanently removing any data, you MUST stop and confirm with the user first:
@@ -375,6 +406,19 @@ After running any command or tool, never send raw output to the user. Always tra
 
 This rule applies to all tools: Google Workspace, TradeStation, web search, and any future extension.`;
 
+  // The envelope exists because the shape it catches has no structural
+  // signal: one final text block that opens with a working sentence and
+  // continues with the answer. The parser can split on a thinking block; it
+  // cannot split inside a block. Asking for the message in markers turns
+  // "never narrate" — a rule the space layer already tried and lost — into
+  // "narrate anywhere, only this span is sent". Same contract as longview's
+  // `[longview:summary]`, honoured by `extractReplyEnvelope` in the parser.
+  const delivery = `## Delivery
+
+Wrap the message you want delivered between a \`[reply]\` line and a \`[/reply]\` line, each marker alone on its own line. Text outside the markers is not sent — that is where a note on what you checked, a remark that a file was written, or a sentence after a tool result belongs. Put the markers on your final message only, once; if you have already written the message and then run one more tool, write it again inside the markers when you are done.
+
+Everything a space's standard says about the message — language, length, format, the exact word to send when there is nothing to say — applies to the text inside the markers. Files still go to \`outbox/\`; the markers cover text only.`;
+
   const characterChangeFlow = `## Character
 
 The system prompt may include a "Bot Character" section — the owner-defined voice for
@@ -450,7 +494,15 @@ Your prompt carries a \`<run_budget>\` block with the exact kill time, the total
   }
   parts.push(destructiveOps);
   parts.push(toolResultPresentation);
-  parts.push(characterChangeFlow);
+  parts.push(delivery);
+  // The character / preference flow is a set of `mrctl prefs set` and
+  // `mrctl character set` instructions. A caller without `prefs.set` cannot
+  // follow them, and the paragraph's "a standing instruction → set a
+  // preference" is exactly how a member's joke got escalated to "the admin
+  // must approve". Left out for that caller; the security text above stays.
+  if (callerMay("prefs.set")) {
+    parts.push(characterChangeFlow);
+  }
   if (payload.anchorMessages && payload.anchorMessages.length > 0) {
     parts.push(
       `When a \`<reply_anchor>\` block appears in the user prompt, the user is swipe-replying to those specific messages. Address the anchor content directly.`,
@@ -513,27 +565,44 @@ Current working directory: ${cwd}`;
 /**
  * Format attachment information for the prompt as XML.
  * Converts absolute paths to container-relative paths.
+ *
+ * This is the single point where an attachment's `filename` — a string the
+ * sender chose — becomes prompt text, so it is where the invisible-Unicode
+ * strip belongs. The seven ingest paths (five bridges, the web chat route and
+ * the shared URL downloader) all sanitize on the way in as well, but only this
+ * function is guaranteed to run for every attachment of every future bridge.
  */
-function formatAttachments(
+export function formatAttachments(
   attachments: MessageAttachment[] | undefined,
 ): string | null {
   if (!attachments || attachments.length === 0) return null;
 
+  // Every remote-supplied value goes through this, not just the obvious one.
+  // Stripped because invisible carriers tokenize as instructions, and escaped
+  // because the value lands inside a double-quoted XML attribute where a bare
+  // `"` would close it early and let the remainder parse as markup of its own.
+  const attr = (value: string) =>
+    stripInvisibleUnicode(value).replace(/"/g, "&quot;");
+
   const entries = attachments.map((att) => {
     // Convert host path to container path
     const containerPath = att.path.replace(/^.*\/spaces\//, "/spaces/");
 
     const attrs = [
+      // `type` is a closed set from `mimeToMediaType` and `path` is
+      // ASCII-allowlisted at every ingest site, so both are already safe.
+      // `mimeType` is NOT: bridges pass the platform's `content_type` through
+      // verbatim, so it is exactly as attacker-controlled as `filename`.
       `type="${att.type}"`,
       `path="${containerPath}"`,
-      `mime="${att.mimeType}"`,
+      `mime="${attr(att.mimeType)}"`,
     ];
 
     if (att.sizeBytes) {
       attrs.push(`size="${att.sizeBytes}"`);
     }
     if (att.filename) {
-      attrs.push(`filename="${att.filename}"`);
+      attrs.push(`filename="${attr(att.filename)}"`);
     }
 
     return `  <attachment ${attrs.join(" ")} />`;
@@ -592,7 +661,21 @@ function parseEpisodeFrontmatter(content: string): EpisodeMeta | null {
   const titleMatch = content.match(/^#\s+(.+)$/m);
   const title = titleMatch ? titleMatch[1].trim() : "";
 
-  const csMatch = content.match(/## Current State\n([\s\S]*?)(?=\n## |$)/);
+  // `[^\n]*` and not a bare `\n`: the distiller writes the heading as
+  // `## Current State (as of 2026-08-20)` whenever it feels like dating it, and
+  // an anchored `\n` then fails to match, yielding `currentState = ""`. The
+  // episode is still injected — as its one-line summary, with every fact gone
+  // and nothing logged. Ten of ten football notes were summary-only for a day
+  // before anyone noticed, because the block was present and looked alive.
+  //
+  // The live vault currently avoids this by carrying an HTML comment in each
+  // note telling the distiller to keep the heading bare. That is a workaround
+  // living in the data — one rewrite drops it and the failure returns silently.
+  // Accepting the suffix here is what actually closes it, and it cannot regress
+  // the bare form.
+  const csMatch = content.match(
+    /## Current State[^\n]*\n([\s\S]*?)(?=\n## |$)/,
+  );
   const currentState = csMatch ? csMatch[1].trim() : "";
 
   return {
@@ -761,8 +844,12 @@ function authorAttrs(m: StoredMessage): string {
 const HISTORY_CHAR_BUDGET = 400_000;
 
 export function buildHistoryXml(messages: StoredMessage[]): string | null {
-  // Pair up user+assistant turns; skip ambient (they have their own section)
-  const turns: Array<{ user: StoredMessage; assistant?: StoredMessage }> = [];
+  // Pair up user+assistant turns; skip ambient (they have their own section).
+  // An assistant row with no user row before it is a turn of its own, not
+  // noise: since the window stopped carrying scheduler prompts, every
+  // scheduled post arrives exactly like that, and dropping it would hide the
+  // bot's own published output from the model.
+  const turns: Array<{ user?: StoredMessage; assistant?: StoredMessage }> = [];
   let pendingUser: StoredMessage | null = null;
 
   for (const m of messages) {
@@ -771,8 +858,10 @@ export function buildHistoryXml(messages: StoredMessage[]): string | null {
         turns.push({ user: pendingUser });
       }
       pendingUser = m;
-    } else if (m.role === "assistant" && pendingUser) {
-      turns.push({ user: pendingUser, assistant: m });
+    } else if (m.role === "assistant") {
+      turns.push(
+        pendingUser ? { user: pendingUser, assistant: m } : { assistant: m },
+      );
       pendingUser = null;
     }
   }
@@ -788,10 +877,14 @@ export function buildHistoryXml(messages: StoredMessage[]): string | null {
     const turn = turns[i];
     if (!turn) break;
     const { user, assistant } = turn;
-    const ts = formatContextTimestamp(user.createdAt);
-    const userLine = `    <user${authorAttrs(user)}>${escapeXmlText(user.content)}</user>`;
+    const anchorRow = user ?? assistant;
+    if (!anchorRow) continue;
+    const ts = formatContextTimestamp(anchorRow.createdAt);
+    const userLine = user
+      ? `    <user${authorAttrs(user)}>${escapeXmlText(user.content)}</user>`
+      : "";
     const assistantLine = assistant
-      ? `\n    <assistant>${escapeXmlText(assistant.content)}</assistant>`
+      ? `${user ? "\n" : ""}    <assistant>${escapeXmlText(assistant.content)}</assistant>`
       : "";
     const entry = `  <turn timestamp="${ts}">\n${userLine}${assistantLine}\n  </turn>`;
 
@@ -805,12 +898,17 @@ export function buildHistoryXml(messages: StoredMessage[]): string | null {
   return `<history>\n${entries.join("\n")}\n</history>`;
 }
 
-function buildAnchorXml(messages: StoredMessage[]): string | null {
+export function buildAnchorXml(messages: StoredMessage[]): string | null {
   if (!messages || messages.length === 0) return null;
 
+  // Author attributes for the same reason `<history>` carries them: the
+  // anchor is now the *only* rendering of the quoted message (the adapter's
+  // `<reply_to name=…>` copy is dropped when the anchor resolves), so a quoted
+  // member's name has to travel with the row.
   const entries = messages.map((m) => {
     const ts = formatContextTimestamp(m.createdAt);
-    return `  <message role="${m.role}" timestamp="${ts}">${escapeXmlText(m.content)}</message>`;
+    const author = m.role === "assistant" ? "" : authorAttrs(m);
+    return `  <message role="${m.role}"${author} timestamp="${ts}">${escapeXmlText(m.content)}</message>`;
   });
 
   return `<reply_anchor>\n${entries.join("\n")}\n</reply_anchor>`;
@@ -902,7 +1000,11 @@ export function buildPrompt(payload: Payload): string {
   const callerId = process.env.CALLER_ID ?? "unknown";
   const role = payload.callerRole ?? "member";
   const space = payload.spaceId ?? "unknown";
-  const nameAttr = payload.authorName ? ` name="${payload.authorName}"` : "";
+  // Display names are platform-supplied; a `"` in one would close the
+  // attribute early, exactly as it would in `authorAttrs`.
+  const nameAttr = payload.authorName
+    ? ` name="${escapeXmlAttr(payload.authorName)}"`
+    : "";
   parts.push(
     `<caller id="${callerId}"${nameAttr} role="${role}" space="${space}" />`,
   );
@@ -992,7 +1094,19 @@ export function buildPrompt(payload: Payload): string {
   // 8. Current prompt
   parts.push(payload.prompt);
 
-  return parts.join("\n");
+  // Stripped once, over the whole assembled prompt, rather than per section.
+  // Every remote-supplied string lands here — the live turn, history bodies,
+  // author and member display names, ambient and anchor messages,
+  // preferences, member notes — and `escapeXmlText` handles only XML
+  // metacharacters, not the Tags Block or bidi controls. One pass at the join
+  // cannot miss a section (the attachment fix strips per site, and its sibling
+  // report is exactly a section it did not reach), and it covers sections
+  // added later without each having to remember. Host-authored scaffolding
+  // never carries these characters, so the pass is a no-op on it. Emoji built
+  // on ZWJ or Tags Block sequences (family, subdivision flags) degrade to
+  // their components for the model — the trade the helper documents,
+  // accepted here for the same reason.
+  return stripInvisibleUnicode(parts.join("\n"));
 }
 
 /** Read-only bwrap binds for each resource entry the host mounted into pi's agent dir. */
@@ -1255,6 +1369,14 @@ function invokePiOnce(
           blocks: parsed.droppedNarrationBlocks,
         });
       }
+      if (parsed.narrationOutsideEnvelope) {
+        // Same contract, the other shape: text the model wrote around its
+        // `[reply]` envelope. A run that logs this is one that would have
+        // leaked before the envelope existed.
+        logTiming("container.pi.narration_outside_envelope", {
+          chars: parsed.narrationOutsideEnvelope,
+        });
+      }
       if (parsed.piFailureMessage) {
         reject(new Error(parsed.piFailureMessage));
         return;

package/src/agent/container-env.ts

@@ -24,6 +24,9 @@ export const BLOCKED_ENV_VARS = new Set([
   "MERCURY_ADMINS",
   // Host-only: affects `docker run` flags, not the agent process inside the container
   "MERCURY_CONTAINER_BWRAP_DOCKER_COMPAT",
+  // Host-only for the same reason: it only decides whether the host applies the
+  // sandbox relaxation to `docker run`. Nothing inside reads it.
+  "MERCURY_CONTAINER_ALLOW_UNCONFINED",
   // Host-only: selects the OCI runtime for `docker run --runtime`; not meaningful inside the container
   "MERCURY_CONTAINER_RUNTIME",
   // Host-only: resolved volume mountpoint on the host; inner containers don't need it
@@ -37,6 +40,14 @@ export const BLOCKED_ENV_VARS = new Set([
   "MERCURY_TEAMS_APP_ID",
   "MERCURY_TEAMS_APP_PASSWORD",
   "MERCURY_WHATSAPP_AUTH_DIR",
+  // Belt to the overview extension's `mercury.env({ hostOnly: true })` brace.
+  // That declaration only protects the var while the extension is LOADED: an
+  // unclaimed MERCURY_* name falls through the blunt passthrough path, so an
+  // operator who sets this and then removes (or fails to load) the extension
+  // would ship the management space's id into every container as
+  // MANAGEMENT_SPACE_ID -- the one fact overview promises the agent never
+  // learns. Blocked here so the guarantee does not depend on load order.
+  "MERCURY_MANAGEMENT_SPACE_ID",
 ]);
 
 /**

package/src/agent/container-error.ts

@@ -3,7 +3,8 @@ export type ContainerFailureReason =
   | "oom"
   | "aborted"
   | "error"
-  | "no-credentials";
+  | "no-credentials"
+  | "sandbox-unconfined";
 
 export class ContainerError extends Error {
   readonly reason: ContainerFailureReason;
@@ -52,6 +53,16 @@ export class ContainerError extends Error {
     );
   }
 
+  /**
+   * The host detected Docker Desktop and would have to strip seccomp/apparmor
+   * and grant SYS_ADMIN for bubblewrap to nest — a materially weaker sandbox
+   * than the same code gets on a plain Linux host. Refused unless the operator
+   * opted in, because a relaxation nobody chose is the one nobody knows about.
+   */
+  static sandboxUnconfined(detail: string): ContainerError {
+    return new ContainerError("sandbox-unconfined", null, detail);
+  }
+
   static error(exitCode: number, output: string): ContainerError {
     return new ContainerError(
       "error",