nodal-agents 0.7.2 → 0.7.5

package/runner.js

@@ -294,6 +294,10 @@ var init_job = __esm({
       task: z7.string().min(1),
       original_task: z7.string().nullable(),
       chat_id: z7.string().nullable(),
+      // Groups jobs from the same conversational thread (migration 0059) — see
+      // apps/runner/src/job/conversation-id.ts for the stamping rule. Null for
+      // non-conversational jobs (cron/schedule/webhook with no parent).
+      conversation_id: z7.string().guid().nullable(),
       system_prompt: z7.string().nullable(),
       messages: z7.array(z7.record(z7.string(), z7.unknown())),
       tools_used: z7.array(z7.string()),
@@ -334,6 +338,7 @@ var init_job = __esm({
       status: JobStatusSchema.default("pending"),
       original_task: z7.string().nullable().optional(),
       chat_id: z7.string().nullable().optional(),
+      conversation_id: z7.string().guid().nullable().optional(),
       system_prompt: z7.string().nullable().optional(),
       request_id: z7.string().nullable().optional(),
       parent_job_id: z7.string().guid().nullable().optional()
@@ -341,6 +346,38 @@ var init_job = __esm({
   }
 });
 
+// ../../packages/shared/src/entities/job-classification.ts
+var CHAT_DELIVERY_TOOLS, CHAT_CONTEXT_READ_TOOLS, CHAT_ALLOWED_TOOLS;
+var init_job_classification = __esm({
+  "../../packages/shared/src/entities/job-classification.ts"() {
+    "use strict";
+    CHAT_DELIVERY_TOOLS = [
+      "telegram_send_message",
+      "send_image",
+      "send_file",
+      "send_video",
+      "send_audio",
+      "send_voice",
+      "return_result",
+      "dashboard_publish"
+    ];
+    CHAT_CONTEXT_READ_TOOLS = [
+      "query_memory",
+      "search_history",
+      "skill_view",
+      "list_models",
+      "list_schedules",
+      "file_read",
+      "file_list",
+      "file_search"
+    ];
+    CHAT_ALLOWED_TOOLS = /* @__PURE__ */ new Set([
+      ...CHAT_DELIVERY_TOOLS,
+      ...CHAT_CONTEXT_READ_TOOLS
+    ]);
+  }
+});
+
 // ../../packages/shared/src/entities/task.ts
 import { z as z8 } from "zod";
 var TaskDescriptionSchema, TaskTitleSchema, AgentTaskSchema, AgentTaskInsertSchema;
@@ -446,7 +483,9 @@ var init_connector = __esm({
       name: z10.string().min(1).max(120),
       slug: z10.string().min(1).max(80).regex(/^[a-z0-9-]+$/),
       base_url: z10.string().nullable(),
-      // api_key stored encrypted in DB (pgp_sym_encrypt); raw value never returned
+      // audit#2026-07-07 SEC-5: this comment used to claim pgp_sym_encrypt (pgcrypto),
+      // which is not used anywhere. Real encryption is application-level AES-256-GCM
+      // via @nodal-agents/secrets before the value ever reaches the DB; raw value never returned.
       api_key: z10.string().nullable(),
       active: z10.boolean(),
       auth_type: ConnectorAuthTypeSchema,
@@ -968,7 +1007,7 @@ function parseRootGrants(raw) {
     autonomy
   };
 }
-var AutonomyLevelSchema, RootGrantsSchema, DEFAULT_ROOT_GRANTS, INITIAL_AUTO_ROOT_GRANTS, META_TOOL_BY_GRANT;
+var AutonomyLevelSchema, RootGrantsSchema, DEFAULT_ROOT_GRANTS, INITIAL_AUTO_ROOT_GRANTS, META_TOOL_BY_GRANT, META_TOOL_NAMES;
 var init_root_agent = __esm({
   "../../packages/shared/src/root-agent.ts"() {
     "use strict";
@@ -1028,6 +1067,26 @@ var init_root_agent = __esm({
       attachConnector: ["attach_connector", "detach_connector"],
       manageSchedules: ["create_schedule", "update_schedule", "toggle_schedule", "run_schedule"]
     };
+    META_TOOL_NAMES = [
+      "create_agent",
+      "update_agent",
+      "attach_agent",
+      "detach_agent",
+      "create_skill",
+      "update_skill",
+      "attach_skill",
+      "detach_skill",
+      "create_mcp",
+      "attach_mcp",
+      "detach_mcp",
+      "create_connector",
+      "attach_connector",
+      "detach_connector",
+      "create_schedule",
+      "update_schedule",
+      "toggle_schedule",
+      "run_schedule"
+    ];
   }
 });
 
@@ -1149,8 +1208,13 @@ function modelCanSeeImages(modelId) {
 function findModelCatalogEntry(provider, modelId) {
   return MODEL_CATALOG[provider]?.find((e) => e.modelId === modelId);
 }
-function modelContextWindow(provider, modelId) {
-  return findModelCatalogEntry(provider, modelId)?.contextWindow ?? DEFAULT_CONTEXT_WINDOW;
+function modelContextWindow(provider, modelId, storedWindow) {
+  const catalogued = findModelCatalogEntry(provider, modelId)?.contextWindow;
+  if (catalogued !== void 0) return catalogued;
+  if (typeof storedWindow === "number" && Number.isFinite(storedWindow) && storedWindow > 0) {
+    return storedWindow;
+  }
+  return DEFAULT_CONTEXT_WINDOW;
 }
 function estimateModelCostUsd(provider, modelId, inputTokens, outputTokens) {
   const pricing = findModelCatalogEntry(provider, modelId)?.pricing;
@@ -1503,6 +1567,284 @@ var init_timezone = __esm({
   }
 });
 
+// ../../packages/shared/src/redact-secrets.ts
+function redactSecretsForAudit(value) {
+  if (Array.isArray(value)) return value.map(redactSecretsForAudit);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (SECRET_FIELD_RE.test(k)) {
+        out[k] = v == null ? v : REDACTED;
+      } else if (k.toLowerCase() === "env" && v !== null && typeof v === "object" && !Array.isArray(v)) {
+        const envOut = {};
+        for (const ek of Object.keys(v)) envOut[ek] = REDACTED;
+        out[k] = envOut;
+      } else {
+        out[k] = redactSecretsForAudit(v);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+var REDACTED, SECRET_FIELD_RE;
+var init_redact_secrets = __esm({
+  "../../packages/shared/src/redact-secrets.ts"() {
+    "use strict";
+    REDACTED = "***";
+    SECRET_FIELD_RE = /^(api[_-]?key|api[_-]?token|access[_-]?token|refresh[_-]?token|client[_-]?secret|secret|password|token|credential)$/i;
+  }
+});
+
+// ../../packages/shared/src/catastrophic-command.ts
+function stripQuotes(token) {
+  return token.replace(/^["']|["']$/g, "");
+}
+function normalizeSlashes(s) {
+  return s.replace(/\/{2,}/g, "/").replace(/\\{2,}/g, "\\");
+}
+function stripWrapperPrefix(tokens) {
+  let i = 0;
+  while (i < tokens.length && WRAPPER_LEADER.has((tokens[i] ?? "").toLowerCase())) {
+    i += 1;
+    if (i < tokens.length && /^[-/]/.test(tokens[i] ?? "")) {
+      i += 1;
+    }
+  }
+  return tokens.slice(i);
+}
+function interpreterBasename(token) {
+  const t = stripQuotes(token);
+  const base = t.split(/[\\/]/).pop() ?? t;
+  return base.replace(/\.(exe|com)$/i, "").toLowerCase();
+}
+function skipPassthroughLeaders(tokens) {
+  let i = 0;
+  while (i < tokens.length && PASSTHROUGH_LEADERS.has(interpreterBasename(tokens[i] ?? ""))) {
+    i += 1;
+    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i] ?? "")) i += 1;
+    if (i < tokens.length && /^[-/]/.test(tokens[i] ?? "")) i += 1;
+  }
+  return tokens.slice(i);
+}
+function interpreterKind(name) {
+  if (name === "py" || /^python[0-9.]*$/.test(name)) return "python";
+  if (/^node(js)?$/.test(name)) return "node";
+  if (/^perl[0-9.]*$/.test(name)) return "perl";
+  if (/^ruby[0-9.]*$/.test(name)) return "ruby";
+  if (/^php[0-9.]*$/.test(name)) return "php";
+  if (["sh", "bash", "zsh", "ksh", "dash", "ash"].includes(name)) return "shell";
+  if (name === "powershell" || name === "pwsh") return "powershell";
+  return null;
+}
+function isInlineEvalFlag(kind, flag) {
+  switch (kind) {
+    case "python":
+      return flag === "-c";
+    case "node":
+      return flag === "-e" || flag === "--eval" || flag === "-p" || flag === "--print";
+    case "perl":
+    case "ruby":
+      return flag === "-e";
+    case "php":
+      return flag === "-r";
+    case "shell":
+      return flag === "-c";
+    case "powershell":
+      return /^-com/.test(flag) || /^-enc/.test(flag);
+    default:
+      return false;
+  }
+}
+function hasInlineInterpreterEval(tokens) {
+  const rest = skipPassthroughLeaders(tokens);
+  if (rest.length === 0) return false;
+  const kind = interpreterKind(interpreterBasename(rest[0] ?? ""));
+  if (!kind) return false;
+  return rest.slice(1).some((t) => isInlineEvalFlag(kind, stripQuotes(t).toLowerCase()));
+}
+function hasPipeIntoBareInterpreter(c) {
+  const parts = c.split("|");
+  for (let i = 1; i < parts.length; i++) {
+    const toks = (parts[i] ?? "").trim().split(/\s+/).map(stripQuotes).filter((t) => t.length > 0);
+    const rest = skipPassthroughLeaders(toks);
+    if (rest.length === 0) continue;
+    if (!interpreterKind(interpreterBasename(rest[0] ?? ""))) continue;
+    const hasScriptArg = rest.slice(1).some((t) => !t.startsWith("-"));
+    if (!hasScriptArg) return true;
+  }
+  return false;
+}
+function isWindowsRootOrWildcardTarget(token) {
+  const t = stripQuotes(token);
+  if (t === "*" || t === "\\" || t === "/") return true;
+  if (/^[a-z]:\\?\*?$/i.test(t)) return true;
+  if (/^%(systemdrive|systemroot|userprofile)%\\?\*?$/i.test(t)) return true;
+  if (/^\$env:(systemdrive|systemroot|userprofile)\\?\*?$/i.test(t)) return true;
+  return false;
+}
+function isCatastrophicCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim() === "") return false;
+  const c = normalizeSlashes(cmd.trim());
+  if (FORK_BOMB.test(c) || MKFS.test(c) || DD_TO_DEVICE.test(c) || POWER_STATE.test(c) || INIT_RUNLEVEL.test(c) || OVERWRITE_DEVICE.test(c) || DISKPART.test(c) || DISK_CMDLET.test(c)) {
+    return true;
+  }
+  for (const seg of c.split(/[;&|\n\r]+/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const tokens = s.split(/\s+/).map(stripQuotes);
+    const cmdTokens = stripWrapperPrefix(tokens);
+    const cmdWord = cmdTokens[0] ?? "";
+    if (/^rm$/i.test(cmdWord)) {
+      const recursive = /\s-\S*r/i.test(s) || /\s--recursive\b/i.test(s);
+      const force = /\s-\S*f/i.test(s) || /\s--force\b/i.test(s);
+      if (recursive && force) {
+        if (/\s--no-preserve-root\b/i.test(s)) return true;
+        if (/(\s|=)(\/|\/\*|~|~\/\*?|\$HOME\/?\*?|\*)(\s|$|"|')/.test(s)) return true;
+        if (tokens.some((t) => isWindowsRootOrWildcardTarget(t))) return true;
+      }
+    }
+    if (/^format(\.(com|exe))?$/i.test(cmdWord) && cmdTokens.slice(1).some((d) => /^[a-z]:([\\/]\*?)?$/i.test(d))) {
+      return true;
+    }
+    if (/^(ri|remove-item|del|erase|rd|rmdir)$/i.test(cmdWord)) {
+      const psRecursiveForce = /(^|\s)-r(ecurse)?\b/i.test(s) && /(^|\s)-f(orce)?\b/i.test(s);
+      const cmdRecursiveForce = /\/s\b/i.test(s) && /\/q\b/i.test(s);
+      if (psRecursiveForce || cmdRecursiveForce) {
+        if (tokens.some((t) => isWindowsRootOrWildcardTarget(t))) return true;
+      }
+    }
+  }
+  return false;
+}
+function isInlineInterpreterEvalCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim() === "") return false;
+  const c = normalizeSlashes(cmd.trim());
+  if (AWK_CODE_EXEC.test(c) || hasPipeIntoBareInterpreter(c)) return true;
+  for (const seg of c.split(/[;&|\n\r]+/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const tokens = s.split(/\s+/).map(stripQuotes);
+    if (hasInlineInterpreterEval(tokens)) return true;
+  }
+  return false;
+}
+function isDestructiveOrHeavyCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim() === "") return false;
+  if (isCatastrophicCommand(cmd) || isInlineInterpreterEvalCommand(cmd)) return true;
+  const c = normalizeSlashes(cmd.trim());
+  return DESTRUCTIVE_PATTERNS.some((re) => re.test(c));
+}
+var FORK_BOMB, MKFS, DD_TO_DEVICE, POWER_STATE, INIT_RUNLEVEL, OVERWRITE_DEVICE, DISKPART, DISK_CMDLET, AWK_CODE_EXEC, WRAPPER_LEADER, PASSTHROUGH_LEADERS, DESTRUCTIVE_PATTERNS;
+var init_catastrophic_command = __esm({
+  "../../packages/shared/src/catastrophic-command.ts"() {
+    "use strict";
+    FORK_BOMB = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:?\s*&\s*\}\s*;\s*:/;
+    MKFS = /\bmkfs(\.\w+)?\b/i;
+    DD_TO_DEVICE = /\bdd\b[\s\S]*?\bof=\/dev\/[a-z]/i;
+    POWER_STATE = /\b(shutdown|reboot|halt|poweroff|stop-computer|restart-computer)\b/i;
+    INIT_RUNLEVEL = /\binit\s+[06]\b/;
+    OVERWRITE_DEVICE = />\s*\/dev\/(sd[a-z]|nvme\d|disk\d|hd[a-z])/i;
+    DISKPART = /\bdiskpart\b/i;
+    DISK_CMDLET = /\b(format-volume|clear-disk|initialize-disk)\b/i;
+    AWK_CODE_EXEC = /\bawk\b[\s\S]*?(\bsystem\s*\(|\bgetline\b[^;]*\||["'][^"']*\|\s*["']?\s*(?:sh|bash|cmd))/i;
+    WRAPPER_LEADER = /* @__PURE__ */ new Set([
+      "cmd",
+      "cmd.exe",
+      "powershell",
+      "powershell.exe",
+      "pwsh",
+      "pwsh.exe",
+      "sh",
+      "bash",
+      "sudo"
+    ]);
+    PASSTHROUGH_LEADERS = /* @__PURE__ */ new Set(["sudo", "env", "cmd", "cmd.exe"]);
+    DESTRUCTIVE_PATTERNS = [
+      /\b(rm|rmdir|unlink|shred)\b/i,
+      // delete (unix)
+      /\bdel\s|\bRemove-Item\b|\brd\s+\/s/i,
+      // delete (windows/ps)
+      /\bfind\b[^\n]*-delete\b/i,
+      // find … -delete
+      /\b(pip3?|npm|pnpm|yarn|apt|apt-get|yum|dnf|brew|pacman|choco|winget|uvx|pipx|cargo|gem|conda|comfy)\b[^\n]*\binstall\b/i,
+      // pkg install
+      /\bgo\s+install\b|\bcomfy\b[^\n]*\bmodel\s+download\b|\bpip3?\b[^\n]*\bdownload\b/i,
+      // go install / model dl
+      /\bwget\b|\bgit\s+clone\b|\bcurl\b[^\n]*\s-[oO]\b|\bInvoke-WebRequest\b|\biwr\b[^\n]*-OutFile/i,
+      // large download / clone
+      /\b(kill|pkill|killall|taskkill)\b|\bStop-Process\b|\bStop-Service\b/i,
+      // process kill
+      /\bsystemctl\b|\bsc\s+(stop|delete)\b|\bservice\b[^\n]*\b(stop|restart)\b/i,
+      // service control
+      /\bmkfs(\.\w+)?\b|\bdd\b[^\n]*\bof=|\b(format|fdisk|parted|diskpart)\b/i,
+      // disk ops
+      /\bchmod\s+-\S*R|\bchown\s+-\S*R|\bicacls\b/i,
+      // recursive perms/ownership
+      /\bgit\s+push\b[^\n]*(--force|-f\b)|\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-\S*f|\bgit\s+branch\s+-D\b/i
+      // destructive VCS
+    ];
+  }
+});
+
+// ../../packages/shared/src/approval-impact.ts
+function commandBinaries(cmd) {
+  const names = [];
+  for (const segment of cmd.split(/\||&&|\|\||;/)) {
+    const tokens = segment.trim().match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    let head = "";
+    for (const t of tokens) {
+      if (t === "" || t === "sudo" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) continue;
+      head = t;
+      break;
+    }
+    if (!head) continue;
+    const base = head.replace(/^["']|["']$/g, "").split(/[\\/]/).pop();
+    if (base) names.push(base.replace(/\.(exe|cmd|bat)$/i, ""));
+    if (names.length >= 3) break;
+  }
+  return names;
+}
+function describeCommandImpact(cmd) {
+  const bins = commandBinaries(cmd);
+  const ran = bins.length > 0 ? `Runs \`${bins.join("` \u2192 `")}\`` : "Runs a shell command";
+  if (isCatastrophicCommand(cmd)) {
+    return `${ran} \u2014 MACHINE-WIDE DESTRUCTIVE: refused even if approved (hardline floor).`;
+  }
+  if (isInlineInterpreterEvalCommand(cmd)) {
+    return `${ran} \u2014 executes arbitrary inline code through an interpreter.`;
+  }
+  if (isDestructiveOrHeavyCommand(cmd)) {
+    return `${ran} \u2014 destructive or heavy: deletes/moves files, installs software, or changes system state.`;
+  }
+  return `${ran} \u2014 no destructive pattern detected (likely read/inspect).`;
+}
+function computeApprovalImpactLine(toolName, toolInput) {
+  const input = toolInput ?? {};
+  const str = (v) => typeof v === "string" && v.length > 0 ? v : "?";
+  switch (toolName) {
+    case "file_write":
+    case "file_edit":
+      return `Overwrites the existing file "${str(input["path"])}" in the shared workspace.`;
+    case "run_command": {
+      const cmd = input["command"];
+      return typeof cmd === "string" && cmd.trim().length > 0 ? describeCommandImpact(cmd) : "Runs a shell command on the host.";
+    }
+    case "run_skill_script":
+      return `Runs script "${str(input["script"])}" from skill "${str(input["skill"])}".`;
+    case "skill_file_write":
+      return `Writes a file into skill "${str(input["skill"])}"'s bundle.`;
+    default:
+      return `${toolName}: irreversible or destructive action.`;
+  }
+}
+var init_approval_impact = __esm({
+  "../../packages/shared/src/approval-impact.ts"() {
+    "use strict";
+    init_catastrophic_command();
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var init_src = __esm({
   "../../packages/shared/src/index.ts"() {
@@ -1513,6 +1855,7 @@ var init_src = __esm({
     init_user();
     init_agent();
     init_job();
+    init_job_classification();
     init_task();
     init_credential();
     init_connector();
@@ -1532,6 +1875,9 @@ var init_src = __esm({
     init_model_catalog();
     init_mcp_catalog();
     init_timezone();
+    init_redact_secrets();
+    init_approval_impact();
+    init_catastrophic_command();
   }
 });
 
@@ -1672,7 +2018,7 @@ var init_entities = __esm({
 });
 
 // ../../packages/db/src/schema/llm_keys.ts
-import { pgTable as pgTable3, text as text3, uuid as uuid3, boolean as boolean3, timestamp as timestamp3, index as index2 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable3, text as text3, uuid as uuid3, boolean as boolean3, integer, timestamp as timestamp3, index as index2 } from "drizzle-orm/pg-core";
 var entityLlmKeys;
 var init_llm_keys = __esm({
   "../../packages/db/src/schema/llm_keys.ts"() {
@@ -1693,6 +2039,11 @@ var init_llm_keys = __esm({
         apiKeyLast4: text3("api_key_last4").notNull().default(""),
         baseUrl: text3("base_url"),
         nickname: text3("nickname"),
+        // Real context window (tokens) for a custom/local model the catalog can't
+        // know (É-3). Auto-detected from the endpoint at save time or set by the
+        // user; NULL ⇒ fall back to the catalogued value or DEFAULT_CONTEXT_WINDOW.
+        // Used window-relative to trigger compaction before the model overflows.
+        contextWindow: integer("context_window"),
         isActive: boolean3("is_active").notNull().default(true),
         createdAt: timestamp3("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp3("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -1708,7 +2059,7 @@ import {
   text as text4,
   uuid as uuid4,
   boolean as boolean4,
-  integer,
+  integer as integer2,
   bigint,
   timestamp as timestamp4,
   jsonb as jsonb2,
@@ -1758,16 +2109,16 @@ var init_agents = __esm({
         taskContextTemplate: text4("task_context_template"),
         avatarUrl: text4("avatar_url"),
         systemAgent: boolean4("system_agent").default(false),
-        maxTokensPerJob: integer("max_tokens_per_job").default(0).notNull(),
+        maxTokensPerJob: integer2("max_tokens_per_job").default(0).notNull(),
         // Cap on characters of agent_memory injected into the system prompt per job
         // (Memory Sprint 2). Pure char budget — token estimation done at call site
         // (length/4). 1500 chars ≈ ~375 tokens, similar to Hermes' 2200+1375 split.
-        memoryTokenBudget: integer("memory_token_budget").default(1500).notNull(),
+        memoryTokenBudget: integer2("memory_token_budget").default(1500).notNull(),
         // User-controlled order on the /agents page (Brique A, migration 0019).
         // Default 0 — ties are broken by `name ASC` in the list query. Newly
         // created agents land at the front of their group by default; the user
         // can adjust via the ↑/↓ buttons in the UI.
-        position: integer("position").default(0).notNull(),
+        position: integer2("position").default(0).notNull(),
         createdAt: timestamp4("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp4("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -1823,9 +2174,9 @@ var init_agents = __esm({
         entityId: uuid4("entity_id").references(() => entities.id, { onDelete: "cascade" }),
         dailyTokenLimit: bigint("daily_token_limit", { mode: "number" }).default(0),
         monthlyTokenLimit: bigint("monthly_token_limit", { mode: "number" }).default(0),
-        alertThresholdPct: integer("alert_threshold_pct").default(80),
+        alertThresholdPct: integer2("alert_threshold_pct").default(80),
         autoPause: boolean4("auto_pause").default(false),
-        maxJobTokens: integer("max_job_tokens").default(15e4),
+        maxJobTokens: integer2("max_job_tokens").default(15e4),
         createdAt: timestamp4("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp4("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -1845,7 +2196,7 @@ import {
   pgTable as pgTable5,
   text as text5,
   uuid as uuid5,
-  integer as integer2,
+  integer as integer3,
   real,
   jsonb as jsonb3,
   timestamp as timestamp5,
@@ -1870,6 +2221,18 @@ var init_jobs = __esm({
         task: text5("task").notNull(),
         originalTask: text5("original_task"),
         chatId: text5("chat_id"),
+        /**
+         * Groups jobs from the same conversational thread for the Jobs page UI
+         * (migration 0059). Purely a reporting/grouping concern — the runtime
+         * execution path (delegation, cron, task-board) never reads this column.
+         * NULL for non-conversational jobs (cron/schedule/webhook with no parent).
+         * Stamped at creation by apps/runner/src/job/conversation-id.ts, reusing
+         * the exact idle-reset session boundary thread-history.ts already uses
+         * for chat continuity — see that file for the gap rule. Delegated/
+         * task-board children inherit their creator's value; nothing else
+         * mutates it after insert.
+         */
+        conversationId: uuid5("conversation_id"),
         systemPrompt: text5("system_prompt"),
         messages: jsonb3("messages").default(sql3`'[]'::jsonb`),
         /**
@@ -1881,16 +2244,16 @@ var init_jobs = __esm({
          */
         searchText: text5("search_text"),
         toolsUsed: text5("tools_used").array().default(sql3`'{}'::text[]`),
-        turn: integer2("turn").default(0),
+        turn: integer3("turn").default(0),
         result: text5("result"),
         error: text5("error"),
-        chainCount: integer2("chain_count").default(0),
+        chainCount: integer3("chain_count").default(0),
         requestId: text5("request_id"),
         parentJobId: uuid5("parent_job_id"),
         parentRequestId: text5("parent_request_id"),
-        totalDurationMs: integer2("total_duration_ms").default(0),
-        inputTokens: integer2("input_tokens").default(0),
-        outputTokens: integer2("output_tokens").default(0),
+        totalDurationMs: integer3("total_duration_ms").default(0),
+        inputTokens: integer3("input_tokens").default(0),
+        outputTokens: integer3("output_tokens").default(0),
         /**
          * Cumulative EFFECTIVE (non-cached) input tokens = Σ(inputTokens −
          * cachedInputTokens) per turn. The token budget (Guard 1a) measures this,
@@ -1899,7 +2262,7 @@ var init_jobs = __esm({
          * Persisted alongside input_tokens so the budget stays cumulative across
          * self-chain resumes.
          */
-        effectiveInputTokens: integer2("effective_input_tokens").default(0),
+        effectiveInputTokens: integer3("effective_input_tokens").default(0),
         /**
          * Cumulative real dollar cost billed to the provider across all turns of
          * this job (sum of per-call costs reported by the provider). Populated only
@@ -1922,7 +2285,7 @@ var init_jobs = __esm({
          * identity (Anthropic, Ollama, etc.) or when the field was absent.
          */
         servedProvider: text5("served_provider"),
-        delegationDepth: integer2("delegation_depth").default(0),
+        delegationDepth: integer3("delegation_depth").default(0),
         /**
          * The slug of the last delegated child that failed on this parent job.
          * Set by `resumeDelegated` when a child returns `{status:'failed'}`, cleared
@@ -1952,6 +2315,9 @@ var init_jobs = __esm({
           sql3`${table.createdAt} DESC`
         ),
         index4("idx_agent_jobs_parent_job_id").on(table.parentJobId),
+        // Migration 0059: the Jobs page groups conversational jobs by
+        // (entity_id, conversation_id) — this index serves that lookup directly.
+        index4("idx_agent_jobs_entity_conversation").on(table.entityId, table.conversationId),
         // idx_jobs_parent (F-20, audit #2) was an exact duplicate of
         // idx_agent_jobs_parent_job_id above — same column, same order, both from
         // migration 0000. Dropped in migration 0054; kept this one (matches the
@@ -1983,7 +2349,7 @@ import {
   pgTable as pgTable6,
   text as text6,
   uuid as uuid6,
-  integer as integer3,
+  integer as integer4,
   jsonb as jsonb4,
   timestamp as timestamp6,
   numeric,
@@ -2016,8 +2382,8 @@ var init_tasks = __esm({
         assignedAgentId: uuid6("assigned_agent_id").references(() => agents.id, {
           onDelete: "cascade"
         }),
-        inputTokens: integer3("input_tokens").default(0),
-        outputTokens: integer3("output_tokens").default(0),
+        inputTokens: integer4("input_tokens").default(0),
+        outputTokens: integer4("output_tokens").default(0),
         costUsd: numeric("cost_usd", { precision: 10, scale: 6 }).default("0"),
         dependsOn: uuid6("depends_on").array().default(sql4`'{}'::uuid[]`),
         context: jsonb4("context").default(sql4`'{}'::jsonb`),
@@ -2105,7 +2471,10 @@ var init_connectors = __esm({
         name: text8("name").notNull(),
         slug: text8("slug").notNull(),
         baseUrl: text8("base_url"),
-        // Encrypted with pgp_sym_encrypt in DB — raw value never returned in select
+        // audit#2026-07-07 SEC-5: this comment used to claim pgp_sym_encrypt (pgcrypto),
+        // which is not used anywhere. Real encryption is application-level AES-256-GCM
+        // via @nodal-agents/secrets before the value ever reaches this column — the DB
+        // column itself just holds ciphertext as opaque text. Raw value never returned in select.
         apiKey: text8("api_key"),
         active: boolean5("active").default(true),
         authType: text8("auth_type").notNull().default("api_key"),
@@ -2132,7 +2501,7 @@ var init_connectors = __esm({
 });
 
 // ../../packages/db/src/schema/tool_calls.ts
-import { pgTable as pgTable9, text as text9, uuid as uuid9, integer as integer4, jsonb as jsonb5, timestamp as timestamp9, index as index8 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable9, text as text9, uuid as uuid9, integer as integer5, jsonb as jsonb5, timestamp as timestamp9, index as index8 } from "drizzle-orm/pg-core";
 import { sql as sql7 } from "drizzle-orm";
 var toolCalls;
 var init_tool_calls = __esm({
@@ -2149,8 +2518,8 @@ var init_tool_calls = __esm({
         toolName: text9("tool_name").notNull(),
         toolInput: jsonb5("tool_input"),
         toolOutput: text9("tool_output"),
-        durationMs: integer4("duration_ms"),
-        turn: integer4("turn"),
+        durationMs: integer5("duration_ms"),
+        turn: integer5("turn"),
         createdAt: timestamp9("created_at", { withTimezone: true }).defaultNow()
       },
       (table) => [
@@ -2245,7 +2614,7 @@ import {
   pgTable as pgTable11,
   text as text11,
   uuid as uuid11,
-  integer as integer5,
+  integer as integer6,
   boolean as boolean6,
   timestamp as timestamp11,
   customType,
@@ -2288,7 +2657,7 @@ var init_memory2 = __esm({
          */
         fact: text11("fact").notNull(),
         category: text11("category").default("context"),
-        importance: integer5("importance").default(3),
+        importance: integer6("importance").default(3),
         source: text11("source").default("agent"),
         skillTags: text11("skill_tags").array().default(sql9`'{}'::text[]`),
         memoryLayer: text11("memory_layer"),
@@ -2304,7 +2673,7 @@ var init_memory2 = __esm({
          */
         importanceLocked: boolean6("importance_locked").notNull().default(false),
         lastAccessedAt: timestamp11("last_accessed_at", { withTimezone: true }).defaultNow(),
-        accessCount: integer5("access_count").default(0),
+        accessCount: integer6("access_count").default(0),
         createdAt: timestamp11("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp11("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -2332,7 +2701,7 @@ var init_memory2 = __esm({
 });
 
 // ../../packages/db/src/schema/webhooks.ts
-import { pgTable as pgTable12, text as text12, uuid as uuid12, boolean as boolean7, integer as integer6, timestamp as timestamp12, index as index11 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable12, text as text12, uuid as uuid12, boolean as boolean7, integer as integer7, timestamp as timestamp12, index as index11 } from "drizzle-orm/pg-core";
 var webhookTriggers;
 var init_webhooks = __esm({
   "../../packages/db/src/schema/webhooks.ts"() {
@@ -2352,7 +2721,7 @@ var init_webhooks = __esm({
         // default: random 32-char hex (generated in app layer for Nodal-Agents)
         secret: text12("secret"),
         lastTriggeredAt: timestamp12("last_triggered_at", { withTimezone: true }),
-        triggerCount: integer6("trigger_count").default(0),
+        triggerCount: integer7("trigger_count").default(0),
         createdAt: timestamp12("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp12("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -2367,7 +2736,7 @@ import {
   text as text13,
   uuid as uuid13,
   boolean as boolean8,
-  integer as integer7,
+  integer as integer8,
   jsonb as jsonb7,
   timestamp as timestamp13,
   index as index12,
@@ -2419,7 +2788,7 @@ var init_skills = __esm({
         }),
         state: text13("state").notNull().default("active"),
         lastUsedAt: timestamp13("last_used_at", { withTimezone: true }),
-        patchCount: integer7("patch_count").notNull().default(0),
+        patchCount: integer8("patch_count").notNull().default(0),
         archivedAt: timestamp13("archived_at", { withTimezone: true }),
         createdAt: timestamp13("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp13("updated_at", { withTimezone: true }).defaultNow()
@@ -2449,7 +2818,7 @@ var init_skills = __esm({
         id: uuid13("id").primaryKey().defaultRandom(),
         entityId: uuid13("entity_id").references(() => entities.id, { onDelete: "cascade" }),
         skillId: uuid13("skill_id").references(() => agentSkills.id, { onDelete: "cascade" }),
-        version: integer7("version").notNull(),
+        version: integer8("version").notNull(),
         content: text13("content").notNull(),
         name: text13("name").notNull(),
         createdAt: timestamp13("created_at", { withTimezone: true }).defaultNow()
@@ -2664,7 +3033,7 @@ import {
   text as text16,
   uuid as uuid16,
   boolean as boolean11,
-  integer as integer8,
+  integer as integer9,
   jsonb as jsonb9,
   timestamp as timestamp16,
   index as index15,
@@ -2686,7 +3055,7 @@ var init_misc = __esm({
         agentId: uuid16("agent_id").references(() => agents.id, { onDelete: "cascade" }),
         messages: jsonb9("messages").notNull().default(sql13`'[]'::jsonb`),
         status: text16("status").notNull().default("active"),
-        turnCount: integer8("turn_count").notNull().default(0),
+        turnCount: integer9("turn_count").notNull().default(0),
         createdAt: timestamp16("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp16("updated_at", { withTimezone: true }).notNull().defaultNow()
       },
@@ -2731,7 +3100,7 @@ var init_misc = __esm({
     );
     rateLimits = pgTable16("rate_limits", {
       key: text16("key").primaryKey(),
-      count: integer8("count").default(1),
+      count: integer9("count").default(1),
       windowStart: timestamp16("window_start", { withTimezone: true }).defaultNow()
     });
   }
@@ -2811,7 +3180,7 @@ var init_agent_connector_assignments = __esm({
 });
 
 // ../../packages/db/src/schema/agent-workspaces.ts
-import { pgTable as pgTable19, text as text19, uuid as uuid19, integer as integer9, timestamp as timestamp19, uniqueIndex as uniqueIndex3, index as index17 } from "drizzle-orm/pg-core";
+import { pgTable as pgTable19, text as text19, uuid as uuid19, integer as integer10, timestamp as timestamp19, uniqueIndex as uniqueIndex3, index as index17 } from "drizzle-orm/pg-core";
 var agentWorkspaces;
 var init_agent_workspaces = __esm({
   "../../packages/db/src/schema/agent-workspaces.ts"() {
@@ -2833,7 +3202,7 @@ var init_agent_workspaces = __esm({
         // Absolute filesystem path — validated to be absolute at write time.
         path: text19("path").notNull(),
         // UI display order; lower = appears first. Default 0.
-        position: integer9("position").default(0).notNull(),
+        position: integer10("position").default(0).notNull(),
         createdAt: timestamp19("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp19("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -5307,8 +5676,8 @@ var require_lib2 = __commonJS({
         return this;
       }
       var p = this.constructor;
-      return this.then(resolve3, reject2);
-      function resolve3(value) {
+      return this.then(resolve4, reject2);
+      function resolve4(value) {
         function yes() {
           return value;
         }
@@ -5461,8 +5830,8 @@ var require_lib2 = __commonJS({
       }
       return out;
     }
-    Promise2.resolve = resolve2;
-    function resolve2(value) {
+    Promise2.resolve = resolve3;
+    function resolve3(value) {
       if (value instanceof this) {
         return value;
       }
@@ -5993,10 +6362,10 @@ var require_utils = __commonJS({
       var promise = external.Promise.resolve(inputData).then(function(data) {
         var isBlob = support.blob && (data instanceof Blob || ["[object File]", "[object Blob]"].indexOf(Object.prototype.toString.call(data)) !== -1);
         if (isBlob && typeof FileReader !== "undefined") {
-          return new external.Promise(function(resolve2, reject) {
+          return new external.Promise(function(resolve3, reject) {
             var reader = new FileReader();
             reader.onload = function(e) {
-              resolve2(e.target.result);
+              resolve3(e.target.result);
             };
             reader.onerror = function(e) {
               reject(e.target.error);
@@ -6551,7 +6920,7 @@ var require_StreamHelper = __commonJS({
       }
     }
     function accumulate(helper, updateCallback) {
-      return new external.Promise(function(resolve2, reject) {
+      return new external.Promise(function(resolve3, reject) {
         var dataArray = [];
         var chunkType = helper._internalType, resultType = helper._outputType, mimeType = helper._mimeType;
         helper.on("data", function(data, meta) {
@@ -6565,7 +6934,7 @@ var require_StreamHelper = __commonJS({
         }).on("end", function() {
           try {
             var result = transformZipOutput(resultType, concat(chunkType, dataArray), mimeType);
-            resolve2(result);
+            resolve3(result);
           } catch (e) {
             reject(e);
           }
@@ -12678,7 +13047,7 @@ var require_load = __commonJS({
     var Crc32Probe = require_Crc32Probe();
     var nodejsUtils = require_nodejsUtils();
     function checkEntryCRC32(zipEntry) {
-      return new external.Promise(function(resolve2, reject) {
+      return new external.Promise(function(resolve3, reject) {
         var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe());
         worker.on("error", function(e) {
           reject(e);
@@ -12686,7 +13055,7 @@ var require_load = __commonJS({
           if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) {
             reject(new Error("Corrupted zip : CRC32 mismatch"));
           } else {
-            resolve2();
+            resolve3();
           }
         }).resume();
       });
@@ -15794,7 +16163,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve2.call(this, root, ref);
+      let _sch = resolve3.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -15821,7 +16190,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve2(root, ref) {
+    function resolve3(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -16452,7 +16821,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve2(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -16710,7 +17079,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve2,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize,
@@ -19793,12 +20162,12 @@ var require_isexe = __commonJS({
         if (typeof Promise !== "function") {
           throw new TypeError("callback not provided");
         }
-        return new Promise(function(resolve2, reject) {
+        return new Promise(function(resolve3, reject) {
           isexe(path, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
-              resolve2(is);
+              resolve3(is);
             }
           });
         });
@@ -19864,27 +20233,27 @@ var require_which = __commonJS({
         opt = {};
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
       const found = [];
-      const step = (i) => new Promise((resolve2, reject) => {
+      const step = (i) => new Promise((resolve3, reject) => {
         if (i === pathEnv.length)
-          return opt.all && found.length ? resolve2(found) : reject(getNotFoundError(cmd));
+          return opt.all && found.length ? resolve3(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
         const pCmd = path.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
-        resolve2(subStep(p, i, 0));
+        resolve3(subStep(p, i, 0));
       });
-      const subStep = (p, i, ii) => new Promise((resolve2, reject) => {
+      const subStep = (p, i, ii) => new Promise((resolve3, reject) => {
         if (ii === pathExt.length)
-          return resolve2(step(i + 1));
+          return resolve3(step(i + 1));
         const ext = pathExt[ii];
         isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
           if (!er && is) {
             if (opt.all)
               found.push(p + ext);
             else
-              return resolve2(p + ext);
+              return resolve3(p + ext);
           }
-          return resolve2(subStep(p, i, ii + 1));
+          return resolve3(subStep(p, i, ii + 1));
         });
       });
       return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
@@ -27653,7 +28022,17 @@ var envSchema = z.object({
   //
   // Set this ONLY if you explicitly want to cap DB growth. Deleting job history is
   // irreversible. Start with a large value (e.g. 90) and reduce over time.
-  RETENTION_DAYS: z.coerce.number().default(0)
+  RETENTION_DAYS: z.coerce.number().default(0),
+  // ─── Approval grace window (Lot A1) ───────────────────────────────────────────
+  // A gated tool normally suspends the job to `awaiting_approval` the instant it
+  // fires — resuming later pays a full executeJob restart (~80-105s measured:
+  // agent/skill/tool reload, thread history, system prompt). A human watching
+  // the screen typically approves in 5-30s, so that whole restart is wasted. This
+  // caps an in-process wait (poll approval_requests) BEFORE actually suspending:
+  // if the decision lands inside the window, the runner executes it inline and
+  // keeps looping — no suspend, no restart. 0 = disabled (suspend immediately,
+  // the pre-existing behavior).
+  NODALAI_APPROVAL_GRACE_MS: z.coerce.number().min(0).default(12e4)
 });
 var _env;
 function parseEnv(raw = process.env) {
@@ -27723,8 +28102,22 @@ import { eq, sql as sql16 } from "drizzle-orm";
 // ../../packages/secrets/src/index.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+function restrictFileToOwner(path) {
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  if (process.platform !== "win32") return;
+  const user = process.env["USERNAME"] || process.env["USER"];
+  if (!user) return;
+  try {
+    execFileSync("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { stdio: "ignore" });
+  } catch {
+  }
+}
 var VERSION = "v1";
 var ALGO = "aes-256-gcm";
 var KEY_BYTES = 32;
@@ -27750,10 +28143,7 @@ function loadOrCreateMasterKey(path = masterKeyPath()) {
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   const buf = randomBytes(KEY_BYTES);
   writeFileSync(path, buf.toString("base64"), { mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
+  restrictFileToOwner(path);
   cachedMasterKey = buf;
   return buf;
 }
@@ -27931,6 +28321,8 @@ async function getDecryptedCredentialById(db, credentialId) {
 // ../../packages/db/src/queries/master-key-guard.ts
 init_credentials();
 init_llm_keys();
+init_connectors();
+init_mcp();
 
 // ../../packages/db/src/repos/agents.ts
 init_src();
@@ -28321,6 +28713,11 @@ var ProviderConfigError = class extends Error {
   detail;
   code = "provider_config_error";
 };
+function isContextOverflowError(err) {
+  const msg = (err instanceof Error ? err.message : String(err ?? "")).toLowerCase();
+  if (!msg) return false;
+  return msg.includes("context length") || msg.includes("context window") || msg.includes("context_length_exceeded") || msg.includes("maximum context") || msg.includes("exceed context") || msg.includes("exceeds context") || msg.includes("prompt is too long") || msg.includes("too many tokens") || msg.includes("reduce") && msg.includes("length") && msg.includes("token");
+}
 
 // ../../packages/llm/src/client.ts
 import { generateText, streamText, generateObject } from "ai";
@@ -28616,7 +29013,7 @@ function logAttempt({
   console.warn(`[llm-attempt-failed] ${parts.join(" ")}`);
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 
 // ../../packages/llm/src/tool-choice-floor.ts
@@ -29658,192 +30055,8 @@ function createToolRegistry() {
   };
 }
 
-// ../../packages/tools/src/catastrophic-command.ts
-var FORK_BOMB = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:?\s*&\s*\}\s*;\s*:/;
-var MKFS = /\bmkfs(\.\w+)?\b/i;
-var DD_TO_DEVICE = /\bdd\b[\s\S]*?\bof=\/dev\/[a-z]/i;
-var POWER_STATE = /\b(shutdown|reboot|halt|poweroff|stop-computer|restart-computer)\b/i;
-var INIT_RUNLEVEL = /\binit\s+[06]\b/;
-var OVERWRITE_DEVICE = />\s*\/dev\/(sd[a-z]|nvme\d|disk\d|hd[a-z])/i;
-var DISKPART = /\bdiskpart\b/i;
-var DISK_CMDLET = /\b(format-volume|clear-disk|initialize-disk)\b/i;
-var AWK_CODE_EXEC = /\bawk\b[\s\S]*?(\bsystem\s*\(|\bgetline\b[^;]*\||["'][^"']*\|\s*["']?\s*(?:sh|bash|cmd))/i;
-function stripQuotes(token) {
-  return token.replace(/^["']|["']$/g, "");
-}
-function normalizeSlashes(s) {
-  return s.replace(/\/{2,}/g, "/").replace(/\\{2,}/g, "\\");
-}
-var WRAPPER_LEADER = /* @__PURE__ */ new Set([
-  "cmd",
-  "cmd.exe",
-  "powershell",
-  "powershell.exe",
-  "pwsh",
-  "pwsh.exe",
-  "sh",
-  "bash",
-  "sudo"
-]);
-function stripWrapperPrefix(tokens) {
-  let i = 0;
-  while (i < tokens.length && WRAPPER_LEADER.has((tokens[i] ?? "").toLowerCase())) {
-    i += 1;
-    if (i < tokens.length && /^[-/]/.test(tokens[i] ?? "")) {
-      i += 1;
-    }
-  }
-  return tokens.slice(i);
-}
-var PASSTHROUGH_LEADERS = /* @__PURE__ */ new Set(["sudo", "env", "cmd", "cmd.exe"]);
-function interpreterBasename(token) {
-  const t = stripQuotes(token);
-  const base = t.split(/[\\/]/).pop() ?? t;
-  return base.replace(/\.(exe|com)$/i, "").toLowerCase();
-}
-function skipPassthroughLeaders(tokens) {
-  let i = 0;
-  while (i < tokens.length && PASSTHROUGH_LEADERS.has(interpreterBasename(tokens[i] ?? ""))) {
-    i += 1;
-    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i] ?? "")) i += 1;
-    if (i < tokens.length && /^[-/]/.test(tokens[i] ?? "")) i += 1;
-  }
-  return tokens.slice(i);
-}
-function interpreterKind(name) {
-  if (name === "py" || /^python[0-9.]*$/.test(name)) return "python";
-  if (/^node(js)?$/.test(name)) return "node";
-  if (/^perl[0-9.]*$/.test(name)) return "perl";
-  if (/^ruby[0-9.]*$/.test(name)) return "ruby";
-  if (/^php[0-9.]*$/.test(name)) return "php";
-  if (["sh", "bash", "zsh", "ksh", "dash", "ash"].includes(name)) return "shell";
-  if (name === "powershell" || name === "pwsh") return "powershell";
-  return null;
-}
-function isInlineEvalFlag(kind, flag) {
-  switch (kind) {
-    case "python":
-      return flag === "-c";
-    case "node":
-      return flag === "-e" || flag === "--eval" || flag === "-p" || flag === "--print";
-    case "perl":
-    case "ruby":
-      return flag === "-e";
-    case "php":
-      return flag === "-r";
-    case "shell":
-      return flag === "-c";
-    case "powershell":
-      return /^-com/.test(flag) || /^-enc/.test(flag);
-    default:
-      return false;
-  }
-}
-function hasInlineInterpreterEval(tokens) {
-  const rest = skipPassthroughLeaders(tokens);
-  if (rest.length === 0) return false;
-  const kind = interpreterKind(interpreterBasename(rest[0] ?? ""));
-  if (!kind) return false;
-  return rest.slice(1).some((t) => isInlineEvalFlag(kind, stripQuotes(t).toLowerCase()));
-}
-function hasPipeIntoBareInterpreter(c) {
-  const parts = c.split("|");
-  for (let i = 1; i < parts.length; i++) {
-    const toks = (parts[i] ?? "").trim().split(/\s+/).map(stripQuotes).filter((t) => t.length > 0);
-    const rest = skipPassthroughLeaders(toks);
-    if (rest.length === 0) continue;
-    if (!interpreterKind(interpreterBasename(rest[0] ?? ""))) continue;
-    const hasScriptArg = rest.slice(1).some((t) => !t.startsWith("-"));
-    if (!hasScriptArg) return true;
-  }
-  return false;
-}
-function isWindowsRootOrWildcardTarget(token) {
-  const t = stripQuotes(token);
-  if (t === "*" || t === "\\" || t === "/") return true;
-  if (/^[a-z]:\\?\*?$/i.test(t)) return true;
-  if (/^%(systemdrive|systemroot|userprofile)%\\?\*?$/i.test(t)) return true;
-  if (/^\$env:(systemdrive|systemroot|userprofile)\\?\*?$/i.test(t)) return true;
-  return false;
-}
-function isCatastrophicCommand(cmd) {
-  if (typeof cmd !== "string" || cmd.trim() === "") return false;
-  const c = normalizeSlashes(cmd.trim());
-  if (FORK_BOMB.test(c) || MKFS.test(c) || DD_TO_DEVICE.test(c) || POWER_STATE.test(c) || INIT_RUNLEVEL.test(c) || OVERWRITE_DEVICE.test(c) || DISKPART.test(c) || DISK_CMDLET.test(c) || AWK_CODE_EXEC.test(c) || hasPipeIntoBareInterpreter(c)) {
-    return true;
-  }
-  for (const seg of c.split(/[;&|\n\r]+/)) {
-    const s = seg.trim();
-    if (!s) continue;
-    const tokens = s.split(/\s+/).map(stripQuotes);
-    if (hasInlineInterpreterEval(tokens)) return true;
-    const cmdTokens = stripWrapperPrefix(tokens);
-    const cmdWord = cmdTokens[0] ?? "";
-    if (/^rm$/i.test(cmdWord)) {
-      const recursive = /\s-\S*r/i.test(s) || /\s--recursive\b/i.test(s);
-      const force = /\s-\S*f/i.test(s) || /\s--force\b/i.test(s);
-      if (recursive && force) {
-        if (/\s--no-preserve-root\b/i.test(s)) return true;
-        if (/(\s|=)(\/|\/\*|~|~\/\*?|\$HOME\/?\*?|\*)(\s|$|"|')/.test(s)) return true;
-        if (tokens.some((t) => isWindowsRootOrWildcardTarget(t))) return true;
-      }
-    }
-    if (/^format(\.(com|exe))?$/i.test(cmdWord) && cmdTokens.slice(1).some((d) => /^[a-z]:([\\/]\*?)?$/i.test(d))) {
-      return true;
-    }
-    if (/^(ri|remove-item|del|erase|rd|rmdir)$/i.test(cmdWord)) {
-      const psRecursiveForce = /(^|\s)-r(ecurse)?\b/i.test(s) && /(^|\s)-f(orce)?\b/i.test(s);
-      const cmdRecursiveForce = /\/s\b/i.test(s) && /\/q\b/i.test(s);
-      if (psRecursiveForce || cmdRecursiveForce) {
-        if (tokens.some((t) => isWindowsRootOrWildcardTarget(t))) return true;
-      }
-    }
-  }
-  return false;
-}
-function isInlineInterpreterEvalCommand(cmd) {
-  if (typeof cmd !== "string" || cmd.trim() === "") return false;
-  const c = normalizeSlashes(cmd.trim());
-  for (const seg of c.split(/[;&|\n\r]+/)) {
-    const s = seg.trim();
-    if (!s) continue;
-    const tokens = s.split(/\s+/).map(stripQuotes);
-    if (hasInlineInterpreterEval(tokens)) return true;
-  }
-  return false;
-}
-var DESTRUCTIVE_PATTERNS = [
-  /\b(rm|rmdir|unlink|shred)\b/i,
-  // delete (unix)
-  /\bdel\s|\bRemove-Item\b|\brd\s+\/s/i,
-  // delete (windows/ps)
-  /\bfind\b[^\n]*-delete\b/i,
-  // find … -delete
-  /\b(pip3?|npm|pnpm|yarn|apt|apt-get|yum|dnf|brew|pacman|choco|winget|uvx|pipx|cargo|gem|conda|comfy)\b[^\n]*\binstall\b/i,
-  // pkg install
-  /\bgo\s+install\b|\bcomfy\b[^\n]*\bmodel\s+download\b|\bpip3?\b[^\n]*\bdownload\b/i,
-  // go install / model dl
-  /\bwget\b|\bgit\s+clone\b|\bcurl\b[^\n]*\s-[oO]\b|\bInvoke-WebRequest\b|\biwr\b[^\n]*-OutFile/i,
-  // large download / clone
-  /\b(kill|pkill|killall|taskkill)\b|\bStop-Process\b|\bStop-Service\b/i,
-  // process kill
-  /\bsystemctl\b|\bsc\s+(stop|delete)\b|\bservice\b[^\n]*\b(stop|restart)\b/i,
-  // service control
-  /\bmkfs(\.\w+)?\b|\bdd\b[^\n]*\bof=|\b(format|fdisk|parted|diskpart)\b/i,
-  // disk ops
-  /\bchmod\s+-\S*R|\bchown\s+-\S*R|\bicacls\b/i,
-  // recursive perms/ownership
-  /\bgit\s+push\b[^\n]*(--force|-f\b)|\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-\S*f|\bgit\s+branch\s+-D\b/i
-  // destructive VCS
-];
-function isDestructiveOrHeavyCommand(cmd) {
-  if (typeof cmd !== "string" || cmd.trim() === "") return false;
-  if (isCatastrophicCommand(cmd)) return true;
-  const c = normalizeSlashes(cmd.trim());
-  return DESTRUCTIVE_PATTERNS.some((re) => re.test(c));
-}
-
 // ../../packages/tools/src/execute.ts
+init_src();
 async function executeTool(tool, rawInput, ctx, opts) {
   const startMs = Date.now();
   const parsed = tool.inputSchema.safeParse(rawInput);
@@ -29864,12 +30077,18 @@ async function executeTool(tool, rawInput, ctx, opts) {
       effectiveAction = "auto_approve";
     } else if (opts.autonomy === "destructive_gate") {
       const command = String(validatedInput?.command ?? "");
+      const mcpTransport = String(validatedInput?.transport ?? "");
       let isHeavy;
       if (tool.name === "run_command") isHeavy = isDestructiveOrHeavyCommand(command);
+      else if (tool.name === "create_mcp" && mcpTransport === "stdio") isHeavy = true;
       else isHeavy = tool.riskLevel === "destructive";
       if (!isHeavy) effectiveAction = "auto_approve";
     }
   }
+  if (!matchedRule && effectiveAction !== "block" && effectiveAction !== "require_approval" && tool.computeApproval && opts.autonomy !== "fully_autonomous") {
+    const dynamic = await tool.computeApproval(validatedInput, ctx);
+    if (dynamic === "require_approval") effectiveAction = "require_approval";
+  }
   if (tool.name === "run_command" && effectiveAction !== "block" && effectiveAction !== "require_approval" && isCatastrophicCommand(String(validatedInput?.command ?? ""))) {
     effectiveAction = "require_approval";
   }
@@ -29890,6 +30109,13 @@ async function executeTool(tool, rawInput, ctx, opts) {
       jobId: ctx.jobId,
       agentId: ctx.agentId,
       toolName: tool.name,
+      // NOUVEAU-1: unlike tool_calls, this column is NOT redacted at rest —
+      // the approval re-exec path (apps/runner/src/job/execute.ts) reads it
+      // back verbatim to re-run the approved call, so a redacted apiKey here
+      // would store '***' as the real secret. Instead, every DISPLAY of this
+      // row is redacted at load (web approvals loader + Telegram notify).
+      // Encrypting the secret fields at rest here (and decrypting on re-exec)
+      // is the tracked follow-up.
       toolInput: validatedInput,
       status: "pending"
     }).returning();
@@ -29970,7 +30196,12 @@ async function _writeToolCall(ctx, toolName, input, output, durationMs) {
       entityId: ctx.entityId,
       jobId: ctx.jobId,
       toolName,
-      toolInput: input,
+      // NOUVEAU-1: the audit trail is never re-executed, so we store a
+      // secret-redacted copy — create_connector/create_mcp API keys and stdio
+      // env values must not sit in cleartext in tool_calls or render to the
+      // logs dashboard (LogsTable). The real value already reached the tool's
+      // execute() above; only this copy is masked.
+      toolInput: redactSecretsForAudit(input),
       toolOutput: output,
       durationMs
     });
@@ -29978,6 +30209,9 @@ async function _writeToolCall(ctx, toolName, input, output, durationMs) {
   }
 }
 
+// ../../packages/tools/src/index.ts
+init_src();
+
 // ../../packages/tools/src/tool-choice.ts
 function computeToolChoice(cfg) {
   const { isOrchestrator, turn, hasAdapterTools, modelSupportsForcedToolChoice = true } = cfg;
@@ -30309,7 +30543,7 @@ async function backfillEmbeddings(db, embeddingClient) {
       console.warn(`[memory] backfill: row ${row.id} failed (will retry next run):`, err);
     }
     if ((i + 1) % BATCH_SIZE === 0 && i + 1 < rows.length) {
-      await new Promise((resolve2) => setTimeout(resolve2, BATCH_PAUSE_MS));
+      await new Promise((resolve3) => setTimeout(resolve3, BATCH_PAUSE_MS));
     }
   }
   return { candidates: rows.length, embedded };
@@ -30533,20 +30767,28 @@ async function selectMemoriesForInjection(db, opts) {
   );
   const rawQuery = opts.query ?? "";
   const tokens = tokenizeQuery(rawQuery);
+  let packed;
   if (tokens.length > 0) {
     const tsv = sql20`"agent_memory"."search_tsv"`;
-    const tsq = sql20`plainto_tsquery('english', ${rawQuery})`;
-    const candidates2 = await db.select().from(agentMemory).where(baseConditions).orderBy(
+    const tsq = sql20`to_tsquery('english', ${tokens.join(" | ")})`;
+    const candidates = await db.select().from(agentMemory).where(baseConditions).orderBy(
       sql20`ts_rank(${tsv}, ${tsq}) DESC`,
       desc(agentMemory.importance),
       desc(agentMemory.lastAccessedAt)
     ).limit(MAX_CANDIDATES);
-    const memories2 = candidates2.map((row) => rowToMemory(row));
-    return packUnderBudget(memories2, opts.maxChars);
+    const memories = candidates.map((row) => rowToMemory(row));
+    packed = packUnderBudget(memories, opts.maxChars);
+  } else {
+    const candidates = await db.select().from(agentMemory).where(baseConditions).orderBy(desc(agentMemory.importance), desc(agentMemory.lastAccessedAt)).limit(MAX_CANDIDATES);
+    const memories = candidates.map((row) => rowToMemory(row));
+    packed = selectMemoriesUnderBudget(memories, opts.maxChars, opts.query);
   }
-  const candidates = await db.select().from(agentMemory).where(baseConditions).orderBy(desc(agentMemory.importance), desc(agentMemory.lastAccessedAt)).limit(MAX_CANDIDATES);
-  const memories = candidates.map((row) => rowToMemory(row));
-  return selectMemoriesUnderBudget(memories, opts.maxChars, opts.query);
+  await touchMemories(
+    db,
+    packed.map((m) => m.id),
+    opts.entityId
+  );
+  return packed;
 }
 
 // ../../packages/memory/src/find.ts
@@ -31067,6 +31309,28 @@ function getWorkspaceRootForDisplay(ctx, relativeOrLabeledPath) {
   }
   return list[0].path;
 }
+async function isPathInSharedWorkspace(ctx, resolvedPath) {
+  const shared = ctx.workspaces?.find((ws) => ws.label === SHARED_WORKSPACE_LABEL);
+  if (!shared) return false;
+  const realShared = await realpath(shared.path).catch(() => void 0);
+  if (!realShared) return false;
+  const rootWithSep = realShared.endsWith(sep) ? realShared : realShared + sep;
+  return resolvedPath === realShared || resolvedPath.startsWith(rootWithSep);
+}
+async function computeSharedOverwriteApproval(ctx, requestedPath) {
+  let resolved;
+  try {
+    resolved = await resolveAndCheckPath(ctx, requestedPath);
+  } catch {
+    return void 0;
+  }
+  if (!await isPathInSharedWorkspace(ctx, resolved)) return void 0;
+  const exists = await stat(resolved).then(
+    () => true,
+    () => false
+  );
+  return exists ? "require_approval" : void 0;
+}
 
 // ../../packages/tools/src/builtin/file-ops/read-lines.ts
 import { createReadStream } from "node:fs";
@@ -31210,13 +31474,20 @@ import { z as z28 } from "zod";
 var FileWriteInputSchema = z28.object({
   path: z28.string().min(1).describe("Path to the file, relative to the agent workspace root. Created if missing."),
   content: z28.string().describe("Full file contents to write. Overwrites any existing file."),
-  create_dirs: z28.boolean().optional().default(false).describe("If true, create missing parent directories.")
+  create_dirs: z28.boolean().optional().default(false).describe("If true, create missing parent directories."),
+  purpose: z28.string().optional().describe(
+    "OPTIONAL. One short sentence on WHY this write is needed. Shown first on the approval card when this call requires human review (e.g. overwriting an existing file in the shared workspace) \u2014 say why in plain language, not what you already say in `path`/`content`."
+  )
 });
 var fileWriteTool = {
   name: "file_write",
   description: "Write (or overwrite) a file in the agent workspace. Atomic: writes to a tempfile then renames over the target, so partial-write failures never corrupt the original. Use `file_edit` instead when you only need to change part of an existing file \u2014 it preserves lines you do not touch. Max 1 MiB per write.",
   inputSchema: FileWriteInputSchema,
   riskLevel: "write",
+  // D1: gate ONLY the destructive case — overwriting a file that already
+  // exists in the entity-wide SHARED workspace. A brand-new file, or a write
+  // into an attached/private workspace, never gates (see computeSharedOverwriteApproval).
+  computeApproval: (input, ctx) => computeSharedOverwriteApproval(ctx, input.path),
   execute: async (input, ctx) => {
     try {
       const bytes = Buffer.byteLength(input.content, "utf8");
@@ -31265,13 +31536,20 @@ var FileEditInputSchema = z29.object({
     "Exact substring to replace. Must appear in the file verbatim \u2014 whitespace and line endings count. Must be unique unless replace_all:true."
   ),
   new_string: z29.string().describe('Replacement text. Pass "" to delete the matched substring.'),
-  replace_all: z29.boolean().optional().default(false).describe("Replace every occurrence (default false: require exactly one match).")
+  replace_all: z29.boolean().optional().default(false).describe("Replace every occurrence (default false: require exactly one match)."),
+  purpose: z29.string().optional().describe(
+    "OPTIONAL. One short sentence on WHY this edit is needed. Shown first on the approval card when this call requires human review (e.g. editing a file in the shared workspace) \u2014 say why in plain language, not what you already say in `path`."
+  )
 });
 var fileEditTool = {
   name: "file_edit",
   description: "Edit an existing file by replacing an exact substring. Quote the chunk to change verbatim (including whitespace). Fails loud when the substring is missing (you misquoted) or matches multiple places (ambiguous \u2014 narrow the quote, or pass replace_all:true). Use this instead of file_write when you only want to change part of a file \u2014 preserves untouched lines.",
   inputSchema: FileEditInputSchema,
   riskLevel: "write",
+  // D1: an edit always targets an EXISTING file (file_edit fails loud on a
+  // missing one — see execute() below), so the only thing left to check is
+  // whether that file lives in the shared workspace. Same gate as file_write.
+  computeApproval: (input, ctx) => computeSharedOverwriteApproval(ctx, input.path),
   execute: async (input, ctx) => {
     try {
       const path = await resolveAndCheckPath(ctx, input.path);
@@ -31595,7 +31873,9 @@ async function validateOfficeZipBomb(buf, maxInflatedBytes = MAX_OFFICE_INFLATED
         nodeStream.on("error", (err) => {
           if (settled) return;
           settled = true;
-          reject(new Error(`Corrupt entry "${entry.name}" inside the Office archive: ${err.message}`));
+          reject(
+            new Error(`Corrupt entry "${entry.name}" inside the Office archive: ${err.message}`)
+          );
         });
       });
       if (violation) return { ok: false, reason: violation };
@@ -34428,7 +34708,10 @@ async function resolveSkillId(db, entityId, slugOrName) {
   const [row] = await db.select({ id: agentSkills.id }).from(agentSkills).where(
     and4(
       eq5(agentSkills.entityId, entityId),
-      or3(eq5(agentSkills.slug, slugOrName), ilike2(agentSkills.name, escapeLikePattern(slugOrName)))
+      or3(
+        eq5(agentSkills.slug, slugOrName),
+        ilike2(agentSkills.name, escapeLikePattern(slugOrName))
+      )
     )
   ).limit(1);
   return row?.id ?? null;
@@ -35503,7 +35786,7 @@ var runCommandTool = {
   }
 };
 function runInShell(command, cwd, timeoutMs) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const isWindows = process.platform === "win32";
     const child = spawn(command, {
       cwd,
@@ -35566,7 +35849,7 @@ function runInShell(command, cwd, timeoutMs) {
       settled = true;
       clearTimeout(timer);
       if (graceTimer) clearTimeout(graceTimer);
-      resolve2({ exitCode, stdout, stderr, timedOut, truncated, cwd });
+      resolve3({ exitCode, stdout, stderr, timedOut, truncated, cwd });
     };
     const timer = setTimeout(() => {
       timedOut = true;
@@ -35655,7 +35938,7 @@ var runSkillScriptTool = {
   }
 };
 function runScript(interpreter, argv, cwd, timeoutMs, scriptLabel) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const isWindows = process.platform === "win32";
     const child = spawn2(interpreter, argv, {
       cwd,
@@ -35715,7 +35998,7 @@ function runScript(interpreter, argv, cwd, timeoutMs, scriptLabel) {
       settled = true;
       clearTimeout(timer);
       if (graceTimer) clearTimeout(graceTimer);
-      resolve2({ exitCode, stdout, stderr, timedOut, truncated, interpreter, script: scriptLabel });
+      resolve3({ exitCode, stdout, stderr, timedOut, truncated, interpreter, script: scriptLabel });
     };
     const timer = setTimeout(() => {
       timedOut = true;
@@ -35983,7 +36266,7 @@ ${line}` : line;
   return chunks;
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 var MAX_RATE_LIMIT_RETRIES = 3;
 var DEFAULT_RATE_LIMIT_BACKOFF_MS = 1e3;
@@ -36461,8 +36744,11 @@ Fail conditions:
         err.name = "telegram_no_recipient";
         throw err;
       }
-      const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
-      const botToken = agentRows[0]?.telegramBotToken;
+      let botToken = ctx.resolvedTelegramBotToken;
+      if (botToken === void 0) {
+        const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
+        botToken = agentRows[0]?.telegramBotToken ?? void 0;
+      }
       if (!botToken) {
         const err = new Error("telegram_no_bot_token");
         err.name = "telegram_no_bot_token";
@@ -36527,8 +36813,11 @@ Fail conditions:
         err.name = "no_recipient";
         throw err;
       }
-      const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
-      const botToken = agentRows[0]?.telegramBotToken;
+      let botToken = ctx.resolvedTelegramBotToken;
+      if (botToken === void 0) {
+        const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
+        botToken = agentRows[0]?.telegramBotToken ?? void 0;
+      }
       if (!botToken) {
         const err = new Error("no_bot_token");
         err.name = "no_bot_token";
@@ -36638,8 +36927,11 @@ Fail conditions:
         err.name = "no_recipient";
         throw err;
       }
-      const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
-      const botToken = agentRows[0]?.telegramBotToken;
+      let botToken = ctx.resolvedTelegramBotToken;
+      if (botToken === void 0) {
+        const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
+        botToken = agentRows[0]?.telegramBotToken ?? void 0;
+      }
       if (!botToken) {
         const err = new Error("no_bot_token");
         err.name = "no_bot_token";
@@ -36725,8 +37017,11 @@ function makeSendMediaTool(spec) {
         err.name = "no_recipient";
         throw err;
       }
-      const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
-      const botToken = agentRows[0]?.telegramBotToken;
+      let botToken = ctx.resolvedTelegramBotToken;
+      if (botToken === void 0) {
+        const agentRows = await ctx.db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, ctx.agentId)).limit(1);
+        botToken = agentRows[0]?.telegramBotToken ?? void 0;
+      }
       if (!botToken) {
         const err = new Error("no_bot_token");
         err.name = "no_bot_token";
@@ -36847,6 +37142,16 @@ Size cap: 50 MB \u2192 throws \`voice_too_large\`. Other failures: \`no_recipien
   });
 }
 
+// ../../packages/tools/src/communication/index.ts
+var DELIVERY_TOOL_NAMES = [
+  "telegram_send_message",
+  "send_image",
+  "send_file",
+  "send_video",
+  "send_audio",
+  "send_voice"
+];
+
 // ../../packages/auth/src/types.ts
 var AuthError = class extends Error {
   code = "AUTH_REQUIRED";
@@ -36981,7 +37286,8 @@ async function healthRoute(c, deps) {
     await deps.db.execute(sql20`SELECT 1`);
     result.db = "ok";
   } catch (err) {
-    result.dbError = err instanceof Error ? err.message : String(err);
+    console.error("[health] DB ping failed:", err instanceof Error ? err.message : err);
+    result.dbError = "unavailable";
   }
   result.ok = result.db === "ok";
   return c.json(result, result.ok ? 200 : 503);
@@ -37040,14 +37346,16 @@ async function agentRoute(c, deps, runnerEnv) {
     ).limit(1);
     agentId = defaultAgentRows[0]?.id ?? null;
   }
+  let conversationId = null;
   if (parentJobId) {
-    const [parentJob] = await deps.db.select({ entityId: agentJobs.entityId }).from(agentJobs).where(eq5(agentJobs.id, parentJobId)).limit(1);
+    const [parentJob] = await deps.db.select({ entityId: agentJobs.entityId, conversationId: agentJobs.conversationId }).from(agentJobs).where(eq5(agentJobs.id, parentJobId)).limit(1);
     if (!parentJob) {
       return c.json({ error: "parent_job_not_found" }, 400);
     }
     if (entityId && parentJob.entityId !== entityId) {
       return c.json({ error: "parent_job_entity_mismatch" }, 403);
     }
+    conversationId = parentJob.conversationId;
   }
   const [job] = await deps.db.insert(agentJobs).values({
     entityId: entityId ?? void 0,
@@ -37056,6 +37364,7 @@ async function agentRoute(c, deps, runnerEnv) {
     task,
     chatId: chatId ?? void 0,
     parentJobId: parentJobId ?? void 0,
+    conversationId: conversationId ?? void 0,
     status: "pending",
     messages: [{ role: "user", content: task }]
   }).returning({ id: agentJobs.id });
@@ -38492,7 +38801,7 @@ var MAX_RATE_LIMIT_RETRIES2 = 3;
 var DEFAULT_RATE_LIMIT_BACKOFF_MS2 = 1e3;
 var MAX_RETRY_AFTER_MS2 = 6e4;
 function sleep3(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function createAirtableClient(getAccessToken, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
@@ -38946,13 +39255,14 @@ function createAirtableTools(opts) {
 
 // ../../packages/adapters/google-drive/src/client.ts
 import { google } from "googleapis";
+var DEFAULT_TIMEOUT_MS2 = 3e4;
 function createDriveClient(getAccessToken) {
   const auth2 = new google.auth.OAuth2();
   auth2.refreshHandler = async () => ({
     access_token: await getAccessToken(),
     expiry_date: Date.now() - 1
   });
-  return google.drive({ version: "v3", auth: auth2 });
+  return google.drive({ version: "v3", auth: auth2, timeout: DEFAULT_TIMEOUT_MS2 });
 }
 
 // ../../packages/adapters/google-drive/src/tools/list-files.ts
@@ -39772,13 +40082,14 @@ function createDriveTools(opts) {
 
 // ../../packages/adapters/gmail/src/client.ts
 import { google as google2 } from "googleapis";
+var DEFAULT_TIMEOUT_MS3 = 3e4;
 function createGmailClient(getAccessToken) {
   const auth2 = new google2.auth.OAuth2();
   auth2.refreshHandler = async () => ({
     access_token: await getAccessToken(),
     expiry_date: Date.now() - 1
   });
-  return google2.gmail({ version: "v1", auth: auth2 });
+  return google2.gmail({ version: "v1", auth: auth2, timeout: DEFAULT_TIMEOUT_MS3 });
 }
 
 // ../../packages/adapters/gmail/src/tools/messages.ts
@@ -39854,6 +40165,19 @@ async function paginateGmail(fetcher, pageSize = 100, maxItems = 100) {
   return items.slice(0, cappedMax);
 }
 
+// ../../packages/adapters/gmail/src/helpers/concurrency.ts
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  for (let start = 0; start < items.length; start += limit) {
+    const chunk = items.slice(start, start + limit);
+    const chunkResults = await Promise.all(chunk.map((item, i) => fn(item, start + i)));
+    for (let i = 0; i < chunkResults.length; i++) {
+      results[start + i] = chunkResults[i];
+    }
+  }
+  return results;
+}
+
 // ../../packages/adapters/gmail/src/helpers/parse-payload.ts
 function decodeBase64Url(encoded) {
   if (!encoded) return "";
@@ -39933,6 +40257,7 @@ function parseGmailHeaders(payload) {
 }
 
 // ../../packages/adapters/gmail/src/helpers/rfc2822.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
 var MIME_OVERRIDES = {
   ".html": "text/html",
   ".htm": "text/html",
@@ -39953,6 +40278,14 @@ function inferMimeType(filename) {
   const ext = filename.includes(".") ? "." + filename.split(".").pop().toLowerCase() : "";
   return MIME_OVERRIDES[ext] ?? "application/octet-stream";
 }
+function assertNoHeaderInjection(fieldName, value) {
+  if (/[\r\n]/.test(value)) {
+    throw new GmailAdapterError(
+      "gmail_validation_error",
+      `'${fieldName}' contains a line break (CR/LF), which is not allowed in an email header.`
+    );
+  }
+}
 function encodeHeader(value) {
   const hasNonAscii = [...value].some((ch) => ch.charCodeAt(0) > 127);
   if (!hasNonAscii) return value;
@@ -39960,10 +40293,21 @@ function encodeHeader(value) {
   return `=?utf-8?B?${encoded}?=`;
 }
 function makeBoundary() {
-  return `nodalai_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`;
+  return `nodalai_${Date.now().toString(36)}_${randomBytes5(12).toString("hex")}`;
 }
 function buildRfc2822Message(opts) {
   const { to, subject, body, from, cc, bcc, replyTo, inReplyTo, references, attachments } = opts;
+  assertNoHeaderInjection("to", to);
+  assertNoHeaderInjection("subject", subject);
+  if (from) assertNoHeaderInjection("from", from);
+  if (cc) assertNoHeaderInjection("cc", cc);
+  if (bcc) assertNoHeaderInjection("bcc", bcc);
+  if (replyTo) assertNoHeaderInjection("replyTo", replyTo);
+  if (inReplyTo) assertNoHeaderInjection("inReplyTo", inReplyTo);
+  if (references) assertNoHeaderInjection("references", references);
+  for (const att of attachments ?? []) {
+    assertNoHeaderInjection("attachment.filename", att.filename);
+  }
   const hasAttachments = attachments && attachments.length > 0;
   const isHtml = body.includes("<") && body.includes(">") && /<[a-zA-Z][^>]*>/.test(body);
   let rawMessage;
@@ -40039,6 +40383,7 @@ function buildRfc2822Message(opts) {
 
 // ../../packages/adapters/gmail/src/tools/messages.ts
 var BODY_CHAR_CAP = 1e4;
+var HYDRATE_CONCURRENCY = 15;
 var AttachmentItemSchema = z82.object({
   filename: z82.string().describe("File name shown in the email, e.g. 'report.html'."),
   content: z82.string().describe("File content as a string (plain text by default, or base64 if encoding is base64)."),
@@ -40122,39 +40467,39 @@ function createListMessagesTool(gmail) {
           Math.min(maxResults, 100),
           maxResults
         );
-        const detailed = await Promise.all(
-          messages.map(async (stub) => {
-            try {
-              const res = await gmail.users.messages.get({
-                userId: "me",
-                id: stub.id,
-                format: "metadata",
-                metadataHeaders: ["Subject", "From", "Date"]
-              });
-              const headers = parseGmailHeaders(res.data.payload ?? void 0);
-              return {
-                messageId: res.data.id ?? stub.id ?? "",
-                threadId: res.data.threadId ?? stub.threadId ?? "",
-                from: headers["from"] ?? "",
-                subject: headers["subject"] ?? "",
-                date: headers["date"] ?? "",
-                snippet: res.data.snippet ?? "",
-                labelIds: res.data.labelIds ?? []
-              };
-            } catch {
-              return {
-                messageId: stub.id ?? "",
-                threadId: stub.threadId ?? "",
-                from: "",
-                subject: "",
-                date: "",
-                snippet: "",
-                labelIds: []
-              };
-            }
-          })
-        );
-        return { total: detailed.length, messages: detailed };
+        const detailed = await mapWithConcurrency(messages, HYDRATE_CONCURRENCY, async (stub) => {
+          try {
+            const res = await gmail.users.messages.get({
+              userId: "me",
+              id: stub.id,
+              format: "metadata",
+              metadataHeaders: ["Subject", "From", "Date"]
+            });
+            const headers = parseGmailHeaders(res.data.payload ?? void 0);
+            return {
+              messageId: res.data.id ?? stub.id ?? "",
+              threadId: res.data.threadId ?? stub.threadId ?? "",
+              from: headers["from"] ?? "",
+              subject: headers["subject"] ?? "",
+              date: headers["date"] ?? "",
+              snippet: res.data.snippet ?? "",
+              labelIds: res.data.labelIds ?? []
+            };
+          } catch (err) {
+            return {
+              messageId: stub.id ?? "",
+              threadId: stub.threadId ?? "",
+              from: "",
+              subject: "",
+              date: "",
+              snippet: "",
+              labelIds: [],
+              error: err instanceof Error ? err.message : "gmail_get_message_failed"
+            };
+          }
+        });
+        const errors = detailed.filter((m) => m.error !== void 0).length;
+        return { total: detailed.length, errors, messages: detailed };
       } catch (err) {
         throw mapGmailError(err);
       }
@@ -40424,6 +40769,7 @@ function createDeleteMessageTool(gmail) {
 // ../../packages/adapters/gmail/src/tools/threads.ts
 import { z as z83 } from "zod";
 var BODY_CHAR_CAP2 = 5e3;
+var MAX_MESSAGES_PER_THREAD = 50;
 var ListThreadsInput = z83.object({
   query: z83.string().optional().describe("Gmail search query. Examples: 'is:unread', 'from:alice@example.com label:work'."),
   max_results: z83.number().int().min(1).max(500).optional().describe("Max threads to return (1\u2013500, default 20)."),
@@ -40476,7 +40822,7 @@ var GetThreadInput = z83.object({
 function createGetThreadTool(gmail) {
   return {
     name: "gmail_get_thread",
-    description: "Fetch a full Gmail conversation thread with all messages, decoded bodies and headers.",
+    description: `Fetch a full Gmail conversation thread with all messages, decoded bodies and headers. Capped at ${MAX_MESSAGES_PER_THREAD} messages (oldest first) \u2014 see the truncated flag.`,
     inputSchema: GetThreadInput,
     riskLevel: "read",
     async execute(input) {
@@ -40487,7 +40833,9 @@ function createGetThreadTool(gmail) {
           format: "full"
         });
         const thread = res.data;
-        const messages = (thread.messages ?? []).map((msg) => {
+        const allMessages = thread.messages ?? [];
+        const truncated = allMessages.length > MAX_MESSAGES_PER_THREAD;
+        const messages = allMessages.slice(0, MAX_MESSAGES_PER_THREAD).map((msg) => {
           const payload = msg.payload ?? void 0;
           const headers = parseGmailHeaders(payload);
           let body = extractTextFromPayload(payload).trim();
@@ -40505,7 +40853,7 @@ function createGetThreadTool(gmail) {
             labelIds: msg.labelIds ?? []
           };
         });
-        return { threadId: thread.id ?? "", messages };
+        return { threadId: thread.id ?? "", messages, truncated };
       } catch (err) {
         throw mapGmailError(err);
       }
@@ -40715,6 +41063,7 @@ function createDeleteLabelTool(gmail) {
 
 // ../../packages/adapters/gmail/src/tools/drafts.ts
 import { z as z85 } from "zod";
+var HYDRATE_CONCURRENCY2 = 15;
 var AttachmentItemSchema2 = z85.object({
   filename: z85.string().describe("File name shown in the email, e.g. 'report.html'."),
   content: z85.string().describe("File content as a string (plain text by default)."),
@@ -40751,36 +41100,36 @@ function createListDraftsTool(gmail) {
           Math.min(maxResults, 100),
           maxResults
         );
-        const drafts = await Promise.all(
-          draftStubs.map(async (stub) => {
-            const draftId = stub.id ?? "";
-            try {
-              const res = await gmail.users.drafts.get({
-                userId: "me",
-                id: draftId,
-                format: "metadata"
-              });
-              const msg = res.data.message ?? {};
-              const headers = parseGmailHeaders(msg.payload ?? void 0);
-              return {
-                draftId,
-                messageId: msg.id ?? "",
-                to: headers["to"] ?? "",
-                subject: headers["subject"] ?? "",
-                snippet: msg.snippet ?? ""
-              };
-            } catch {
-              return {
-                draftId,
-                messageId: stub.message?.id ?? "",
-                to: "",
-                subject: "",
-                snippet: ""
-              };
-            }
-          })
-        );
-        return { total: drafts.length, drafts };
+        const drafts = await mapWithConcurrency(draftStubs, HYDRATE_CONCURRENCY2, async (stub) => {
+          const draftId = stub.id ?? "";
+          try {
+            const res = await gmail.users.drafts.get({
+              userId: "me",
+              id: draftId,
+              format: "metadata"
+            });
+            const msg = res.data.message ?? {};
+            const headers = parseGmailHeaders(msg.payload ?? void 0);
+            return {
+              draftId,
+              messageId: msg.id ?? "",
+              to: headers["to"] ?? "",
+              subject: headers["subject"] ?? "",
+              snippet: msg.snippet ?? ""
+            };
+          } catch (err) {
+            return {
+              draftId,
+              messageId: stub.message?.id ?? "",
+              to: "",
+              subject: "",
+              snippet: "",
+              error: err instanceof Error ? err.message : "gmail_get_draft_failed"
+            };
+          }
+        });
+        const errors = drafts.filter((d) => d.error !== void 0).length;
+        return { total: drafts.length, errors, drafts };
       } catch (err) {
         throw mapGmailError(err);
       }
@@ -41264,13 +41613,14 @@ function createGmailTools(opts) {
 
 // ../../packages/adapters/google-calendar/src/client.ts
 import { google as google3 } from "googleapis";
+var DEFAULT_TIMEOUT_MS4 = 3e4;
 function createGoogleCalendarClient(getAccessToken) {
   const auth2 = new google3.auth.OAuth2();
   auth2.refreshHandler = async () => ({
     access_token: await getAccessToken(),
     expiry_date: Date.now() - 1
   });
-  return google3.calendar({ version: "v3", auth: auth2 });
+  return google3.calendar({ version: "v3", auth: auth2, timeout: DEFAULT_TIMEOUT_MS4 });
 }
 
 // ../../packages/adapters/google-calendar/src/tools/events.ts
@@ -41661,13 +42011,14 @@ function createGoogleCalendarTools(opts) {
 
 // ../../packages/adapters/google-sheets/src/client.ts
 import { google as google4 } from "googleapis";
+var DEFAULT_TIMEOUT_MS5 = 3e4;
 function createSheetsClient(getAccessToken) {
   const auth2 = new google4.auth.OAuth2();
   auth2.refreshHandler = async () => ({
     access_token: await getAccessToken(),
     expiry_date: Date.now() - 1
   });
-  return google4.sheets({ version: "v4", auth: auth2 });
+  return google4.sheets({ version: "v4", auth: auth2, timeout: DEFAULT_TIMEOUT_MS5 });
 }
 
 // ../../packages/adapters/google-sheets/src/tools/values.ts
@@ -41783,9 +42134,36 @@ function parseRange(range) {
   }
   return { sheetName, cellRange, canonical };
 }
+function estimateRowSpan(cellRange) {
+  const parts = cellRange.split(":");
+  if (parts.length > 2) return null;
+  const rowOf = (part) => {
+    const m = /^\$?[A-Za-z]*\$?(\d+)$/.exec(part);
+    return m?.[1] !== void 0 ? Number(m[1]) : null;
+  };
+  const first = parts[0] ?? "";
+  const second = parts[1];
+  if (second === void 0) {
+    const row = rowOf(first);
+    return row !== null ? 1 : null;
+  }
+  const startRow = rowOf(first);
+  const endRow = rowOf(second);
+  if (startRow === null || endRow === null) return null;
+  return Math.abs(endRow - startRow) + 1;
+}
 
 // ../../packages/adapters/google-sheets/src/tools/values.ts
 var ROW_CAP = 1e4;
+function rejectIfObviouslyTooLarge(cellRange, fullRange) {
+  const span = estimateRowSpan(cellRange);
+  if (span !== null && span > ROW_CAP) {
+    throw new SheetsAdapterError(
+      "sheets_range_too_large",
+      `Range '${fullRange}' spans ${span} rows which exceeds the ${ROW_CAP}-row cap. Use a smaller range.`
+    );
+  }
+}
 var ReadRangeInput = z90.object({
   spreadsheet_id: z90.string().describe("The spreadsheet ID from the URL (between /d/ and /edit)."),
   range: z90.string().describe("A1-notation range, e.g. 'Sheet1!A1:D10' or 'A:A' for a full column."),
@@ -41801,7 +42179,8 @@ function createReadRangeTool(sheets) {
     riskLevel: "read",
     async execute(input) {
       try {
-        parseRange(input.range);
+        const parsed = parseRange(input.range);
+        rejectIfObviouslyTooLarge(parsed.cellRange, input.range);
         const res = await sheets.spreadsheets.values.get({
           spreadsheetId: input.spreadsheet_id,
           range: input.range,
@@ -41831,7 +42210,12 @@ var ReadAllInput = z90.object({
 function createReadAllTool(sheets) {
   return {
     name: "sheets_read_all",
-    description: "Read all values from a sheet tab. Returns the full 2D array. Capped at 10,000 rows \u2014 use sheets_read_range for partial reads on large sheets.",
+    // audit#2026-07-07 F10: unlike sheets_read_range, this always targets the
+    // whole sheet tab — there is no explicit numeric row bound to check
+    // up front (estimateRowSpan has nothing to work with), so the ROW_CAP
+    // check below necessarily runs AFTER the full sheet has been fetched.
+    // Prefer sheets_read_range with an explicit bounded range on large sheets.
+    description: "Read all values from a sheet tab. Returns the full 2D array. Capped at 10,000 rows \u2014 use sheets_read_range for partial reads on large sheets. Note: because this reads a whole tab, the cap is only enforced AFTER the full sheet is fetched \u2014 prefer sheets_read_range with an explicit row-bounded range for very large sheets.",
     inputSchema: ReadAllInput,
     riskLevel: "read",
     async execute(input) {
@@ -42928,13 +43312,14 @@ function createSheetsTools(opts) {
 
 // ../../packages/adapters/google-docs/src/client.ts
 import { google as google5 } from "googleapis";
+var DEFAULT_TIMEOUT_MS6 = 3e4;
 function createDocsClient(getAccessToken) {
   const auth2 = new google5.auth.OAuth2();
   auth2.refreshHandler = async () => ({
     access_token: await getAccessToken(),
     expiry_date: Date.now() - 1
   });
-  return google5.docs({ version: "v1", auth: auth2 });
+  return google5.docs({ version: "v1", auth: auth2, timeout: DEFAULT_TIMEOUT_MS6 });
 }
 
 // ../../packages/adapters/google-docs/src/tools/lifecycle.ts
@@ -43127,6 +43512,7 @@ function buildUpdateTextStyleRequest(startIndex, endIndex, textStyle, fields) {
 
 // ../../packages/adapters/google-docs/src/tools/lifecycle.ts
 var CHAR_CAP3 = 1e5;
+var BODY_JSON_CHAR_CAP = 5e5;
 var CreateDocInput = z94.object({
   title: z94.string().describe("Title for the new document."),
   content: z94.string().optional().describe("Optional initial text content to insert into the document body.")
@@ -43188,6 +43574,13 @@ function createGetDocTool(docs) {
               `Document body contains ${text23.length} characters which exceeds the ${CHAR_CAP3}-character cap.`
             );
           }
+          const bodyJsonLength = JSON.stringify(doc.body).length;
+          if (bodyJsonLength > BODY_JSON_CHAR_CAP) {
+            throw new DocsAdapterError(
+              "docs_document_too_large",
+              `Document body JSON is ${bodyJsonLength} characters which exceeds the ${BODY_JSON_CHAR_CAP}-character raw-JSON cap (docs_get returns the full Google Docs JSON structure, which can be much heavier than its flattened text \u2014 use docs_get_text instead).`
+            );
+          }
         }
         const headers = Object.entries(doc.headers ?? {}).map(([id, h]) => ({
           headerId: id,
@@ -44025,6 +44418,7 @@ function makeFirecrawlSearchTool(client) {
 
 // ../../packages/adapters/firecrawl/src/tools/crawl.ts
 import { z as z99 } from "zod";
+var MAX_CRAWL_DOCS_PER_CALL = 50;
 var CrawlStartInput = z99.object({
   url: z99.string().url().describe("The root URL to crawl."),
   limit: z99.number().int().min(1).max(100).optional().describe("Maximum number of pages to crawl (1\u2013100).")
@@ -44056,18 +44450,20 @@ var CrawlStatusInput = z99.object({
 function makeFirecrawlCrawlStatusTool(client) {
   return {
     name: "firecrawl_crawl_status",
-    description: 'Get the current status and partial results of a Firecrawl crawl job. Poll this until status is "completed", "failed", or "cancelled".',
+    description: `Get the current status and partial results of a Firecrawl crawl job. Poll this until status is "completed", "failed", or "cancelled". Capped at ${MAX_CRAWL_DOCS_PER_CALL} documents per call \u2014 see the dataTruncated flag.`,
     inputSchema: CrawlStatusInput,
     riskLevel: "read",
     async execute(input) {
       try {
         const job = await client.getCrawlStatus(input.id);
+        const rawData = job.data ?? [];
+        const dataTruncated = rawData.length > MAX_CRAWL_DOCS_PER_CALL;
         return {
           id: job.id,
           status: job.status,
           total: job.total,
           completed: job.completed,
-          data: (job.data ?? []).map((doc) => {
+          data: rawData.slice(0, MAX_CRAWL_DOCS_PER_CALL).map((doc) => {
             const md = capField(doc.markdown);
             const html = capField(doc.html);
             return {
@@ -44076,7 +44472,8 @@ function makeFirecrawlCrawlStatusTool(client) {
               ...html.content !== void 0 && { html: html.content },
               truncated: md.truncated || html.truncated
             };
-          })
+          }),
+          dataTruncated
         };
       } catch (err) {
         throw wrapFirecrawlError(err);
@@ -44158,6 +44555,8 @@ var WebBrowseInput = z100.object({
     "For a search query, how many results to return (default 3). Ignored for a single URL."
   )
 });
+var WEB_BROWSE_WAIT_SECS = 120;
+var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["SUCCEEDED", "FAILED", "ABORTED", "TIMED-OUT"]);
 function sanitizeScraped(s) {
   return Array.from(s).filter((ch) => {
     const x = ch.charCodeAt(0);
@@ -44184,17 +44583,22 @@ function makeApifyWebBrowseTool(client) {
     riskLevel: "read",
     async execute(input) {
       try {
-        const run = await client.actor("apify/rag-web-browser").call({
-          query: input.query,
-          // `text` is the proven, lighter output the legacy skill used. Markdown is
-          // heavier and special-char-dense — an unnecessary deviation that changed
-          // the request/response load profile. Stay on the format that always worked.
-          outputFormats: ["text"],
-          maxResults: input.maxResults ?? 3
-        });
+        const run = await client.actor("apify/rag-web-browser").call(
+          {
+            query: input.query,
+            // `text` is the proven, lighter output the legacy skill used. Markdown is
+            // heavier and special-char-dense — an unnecessary deviation that changed
+            // the request/response load profile. Stay on the format that always worked.
+            outputFormats: ["text"],
+            maxResults: input.maxResults ?? 3
+          },
+          // audit#2026-07-07 F1: bound the wait — see WEB_BROWSE_WAIT_SECS above.
+          { waitSecs: WEB_BROWSE_WAIT_SECS }
+        );
         const dataset = await client.dataset(run.defaultDatasetId).listItems({ clean: true });
         const results = (dataset.items ?? []).map(normalizeBrowseItem).filter((r) => r.content);
-        return { query: input.query, count: results.length, results };
+        const timedOut = !TERMINAL_RUN_STATUSES.has(run.status);
+        return { query: input.query, count: results.length, results, timedOut };
       } catch (err) {
         throw wrapApifyError(err);
       }
@@ -44271,6 +44675,19 @@ function makeApifyGetRunTool(client) {
 // ../../packages/adapters/apify/src/tools/datasets.ts
 init_errors();
 import { z as z101 } from "zod";
+var ITEM_CHAR_CAP = 15e3;
+function capItem(item) {
+  const json = JSON.stringify(item) ?? "";
+  if (json.length <= ITEM_CHAR_CAP) return { item, truncated: false };
+  return {
+    item: {
+      __truncated: true,
+      preview: json.slice(0, ITEM_CHAR_CAP),
+      originalCharCount: json.length
+    },
+    truncated: true
+  };
+}
 var ListDatasetsInput = z101.object({
   limit: z101.number().int().min(1).max(1e3).optional().default(100).describe("Maximum number of datasets to return (default 100, max 1000)."),
   offset: z101.number().int().min(0).optional().default(0).describe("Number of datasets to skip (for pagination). Default 0.")
@@ -44315,7 +44732,7 @@ var GetDatasetItemsInput = z101.object({
 function makeApifyGetDatasetItemsTool(client) {
   return {
     name: "apify_get_dataset_items",
-    description: "Retrieve items from an Apify dataset. Use the datasetId returned by apify_run_actor or from apify_list_datasets. Supports limit/offset pagination (max 1000 items per call).",
+    description: `Retrieve items from an Apify dataset. Use the datasetId returned by apify_run_actor or from apify_list_datasets. Supports limit/offset pagination (max 1000 items per call). Each item is capped at ${ITEM_CHAR_CAP} chars of JSON \u2014 see the truncated flag.`,
     inputSchema: GetDatasetItemsInput,
     riskLevel: "read",
     async execute(input) {
@@ -44324,11 +44741,13 @@ function makeApifyGetDatasetItemsTool(client) {
           limit: input.limit ?? 100,
           offset: input.offset ?? 0
         });
+        const capped = result.items.map(capItem);
         return {
-          items: result.items,
+          items: capped.map((c) => c.item),
           total: result.total,
           count: result.count,
-          offset: result.offset
+          offset: result.offset,
+          truncated: capped.some((c) => c.truncated)
         };
       } catch (err) {
         throw wrapApifyError(err);
@@ -44668,7 +45087,7 @@ function wrapPoyoError(err) {
 
 // ../../packages/adapters/poyo/src/client.ts
 var DEFAULT_BASE_URL = "https://api.poyo.ai";
-var DEFAULT_TIMEOUT_MS2 = 3e4;
+var DEFAULT_TIMEOUT_MS7 = 3e4;
 async function fetchWithTimeout(doFetch, url2, init, timeoutMs) {
   try {
     return await doFetch(url2, { ...init, signal: AbortSignal.timeout(timeoutMs) });
@@ -44685,7 +45104,7 @@ async function fetchWithTimeout(doFetch, url2, init, timeoutMs) {
 function createPoyoClient(accessToken, options = {}) {
   const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
   const doFetch = options.fetchImpl ?? fetch;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS7;
   const authHeader = { Authorization: `Bearer ${accessToken}` };
   return {
     async submit(model, input) {
@@ -44756,7 +45175,7 @@ var GenerateImageInput = z103.object({
   ),
   size: z103.string().min(1).optional().describe('Aspect ratio of the image, e.g. "1:1", "16:9", "9:16", "4:3". Default "1:1".')
 });
-var sleep4 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var sleep4 = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function makePoyoGenerateImageTool(client, poll = DEFAULT_POLL) {
   return {
     name: "poyo_generate_image",
@@ -44907,6 +45326,10 @@ var ADAPTER_REGISTRY = {
   }
 };
 
+// ../../packages/adapters/mcp/src/client.ts
+import { lookup as dnsLookupCb } from "node:dns";
+import { promisify } from "node:util";
+
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 import * as z3rt from "zod/v3";
 import * as z4mini from "zod/v4-mini";
@@ -47034,7 +47457,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error) {
@@ -47051,7 +47474,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error) => {
         reject(error);
       };
@@ -47129,7 +47552,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve2(parseResult.data);
+            resolve3(parseResult.data);
           }
         } catch (error) {
           reject(error);
@@ -47390,12 +47813,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve2, interval);
+      const timeoutId = setTimeout(resolve3, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -48305,8 +48728,8 @@ async function random(size) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result = "";
   while (result.length < size) {
-    const randomBytes5 = await getRandomValues(size - result.length);
-    for (const randomByte of randomBytes5) {
+    const randomBytes6 = await getRandomValues(size - result.length);
+    for (const randomByte of randomBytes6) {
       if (randomByte < evenDistCutoff) {
         result += mask[randomByte % mask.length];
       }
@@ -49802,7 +50225,7 @@ var StdioClientTransport = class {
     if (this._process) {
       throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
         // merge default env with server env because mcp server needs some env vars
         env: {
@@ -49819,7 +50242,7 @@ var StdioClientTransport = class {
         this.onerror?.(error);
       });
       this._process.on("spawn", () => {
-        resolve2();
+        resolve3();
       });
       this._process.on("close", (_code) => {
         this._process = void 0;
@@ -49878,22 +50301,22 @@ var StdioClientTransport = class {
     if (this._process) {
       const processToClose = this._process;
       this._process = void 0;
-      const closePromise = new Promise((resolve2) => {
+      const closePromise = new Promise((resolve3) => {
         processToClose.once("close", () => {
-          resolve2();
+          resolve3();
         });
       });
       try {
         processToClose.stdin?.end();
       } catch {
       }
-      await Promise.race([closePromise, new Promise((resolve2) => setTimeout(resolve2, 2e3).unref())]);
+      await Promise.race([closePromise, new Promise((resolve3) => setTimeout(resolve3, 2e3).unref())]);
       if (processToClose.exitCode === null) {
         try {
           processToClose.kill("SIGTERM");
         } catch {
         }
-        await Promise.race([closePromise, new Promise((resolve2) => setTimeout(resolve2, 2e3).unref())]);
+        await Promise.race([closePromise, new Promise((resolve3) => setTimeout(resolve3, 2e3).unref())]);
       }
       if (processToClose.exitCode === null) {
         try {
@@ -49905,21 +50328,54 @@ var StdioClientTransport = class {
     this._readBuffer.clear();
   }
   send(message) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       if (!this._process?.stdin) {
         throw new Error("Not connected");
       }
       const json = serializeMessage(message);
       if (this._process.stdin.write(json)) {
-        resolve2();
+        resolve3();
       } else {
-        this._process.stdin.once("drain", resolve2);
+        this._process.stdin.once("drain", resolve3);
       }
     });
   }
 };
 
 // ../../packages/adapters/mcp/src/client.ts
+var dnsLookup = promisify(dnsLookupCb);
+var BLOCKED_MCP_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+function isBlockedMcpAddress(addr) {
+  const a = addr.toLowerCase();
+  if (/^169\.254\./.test(a)) return true;
+  if (a === "100.100.100.100") return true;
+  if (a.startsWith("fe80:")) return true;
+  if (a === "fd00:ec2::254") return true;
+  return false;
+}
+function isIpLiteral(host) {
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":");
+}
+async function assertMcpHttpUrlSafe(url2) {
+  const hostname = url2.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (BLOCKED_MCP_HOSTNAMES.has(hostname) || isBlockedMcpAddress(hostname)) {
+    throw new Error(`MCP URL blocked: "${hostname}" is a link-local / cloud-metadata endpoint.`);
+  }
+  if (isIpLiteral(hostname)) return;
+  let resolved;
+  try {
+    resolved = await dnsLookup(hostname, { all: true });
+  } catch {
+    return;
+  }
+  for (const { address } of resolved) {
+    if (isBlockedMcpAddress(address)) {
+      throw new Error(
+        `MCP URL blocked: "${hostname}" resolves to a link-local / cloud-metadata address.`
+      );
+    }
+  }
+}
 var DEFAULT_CONNECT_TIMEOUT_MS = 12e4;
 function resolveConnectTimeoutMs() {
   const raw = process.env["MCP_CONNECT_TIMEOUT_MS"];
@@ -49974,6 +50430,7 @@ async function connectMcp(opts) {
   const connectTimeoutMs = resolveConnectTimeoutMs();
   if (opts.transport === "http") {
     const target = buildMcpRequest(opts);
+    await assertMcpHttpUrlSafe(target.url);
     const transport = new StreamableHTTPClientTransport(target.url, {
       requestInit: { headers: target.headers }
     });
@@ -49984,14 +50441,14 @@ async function connectMcp(opts) {
       () => safeCloseTransport(transport)
     );
   } else {
-    const baseEnv = {};
-    for (const [k, v] of Object.entries(process.env)) {
-      if (typeof v === "string") baseEnv[k] = v;
+    const scrubbedEnv = {};
+    for (const [k, v] of Object.entries(buildChildEnv(process.env))) {
+      if (typeof v === "string") scrubbedEnv[k] = v;
     }
     const transport = new StdioClientTransport({
       command: opts.command,
       args: opts.args,
-      env: { ...baseEnv, ...opts.env }
+      env: { ...scrubbedEnv, ...opts.env }
     });
     await withTimeout(
       client.connect(transport),
@@ -50082,6 +50539,22 @@ function describe(zodType, schema) {
 
 // ../../packages/adapters/mcp/src/tools.ts
 var MCP_CALL_TIMEOUT_MS = Number(process.env.MCP_CALL_TIMEOUT_MS) || 18e4;
+var MCP_RESULT_CHAR_CAP = Number(process.env.MCP_RESULT_CHAR_CAP) || 5e4;
+function capMcpResult(value) {
+  if (typeof value === "string") {
+    if (value.length <= MCP_RESULT_CHAR_CAP) return value;
+    return value.slice(0, MCP_RESULT_CHAR_CAP) + `
+
+[...truncated at ${MCP_RESULT_CHAR_CAP} chars \u2014 MCP tool result was larger]`;
+  }
+  const serialized = JSON.stringify(value) ?? "";
+  if (serialized.length <= MCP_RESULT_CHAR_CAP) return value;
+  return {
+    truncated: true,
+    originalLength: serialized.length,
+    preview: serialized.slice(0, MCP_RESULT_CHAR_CAP)
+  };
+}
 function slugToPrefix2(slug) {
   return slug.replace(/[^a-z0-9]+/gi, "_").toLowerCase();
 }
@@ -50096,7 +50569,29 @@ function extractText(content) {
     (c) => typeof c === "object" && c !== null && c.type === "text" && typeof c.text === "string"
   ).map((c) => c.text).join("\n");
 }
-function mcpToolToToolDefinition(client, mcpTool, slug) {
+async function callMcpTool(client, originalName, input) {
+  const result = await client.callTool(
+    { name: originalName, arguments: input },
+    // Default result schema (CallToolResultSchema).
+    void 0,
+    // The MCP SDK's default per-request timeout is 60s — too short for heavy
+    // tools (a Blender/KeyShot render, a long scrape). Raise it and reset the
+    // clock whenever the server reports progress, so progress-streaming
+    // servers can run even longer. Overridable via MCP_CALL_TIMEOUT_MS.
+    { timeout: MCP_CALL_TIMEOUT_MS, resetTimeoutOnProgress: true }
+  );
+  if (result.isError === true) {
+    const detail = extractText(result.content);
+    throw new Error(`MCP tool ${originalName} failed: ${detail || "unknown error"}`);
+  }
+  if (result.structuredContent != null) return capMcpResult(result.structuredContent);
+  const content = result.content ?? [];
+  if (Array.isArray(content) && content.length > 0 && content.every((c) => c.type === "text")) {
+    return capMcpResult(extractText(content));
+  }
+  return capMcpResult(content);
+}
+function buildMcpToolDefinition(mcpTool, slug, getClient) {
   const originalName = mcpTool.name;
   return {
     name: `${slugToPrefix2(slug)}__${originalName}`,
@@ -50104,38 +50599,66 @@ function mcpToolToToolDefinition(client, mcpTool, slug) {
     inputSchema: jsonSchemaToZod(mcpTool.inputSchema),
     riskLevel: riskFromAnnotations(mcpTool.annotations),
     async execute(input) {
-      const result = await client.callTool(
-        {
-          name: originalName,
-          arguments: input ?? {}
-        },
-        // Default result schema (CallToolResultSchema).
-        void 0,
-        // The MCP SDK's default per-request timeout is 60s — too short for heavy
-        // tools (a Blender/KeyShot render, a long scrape). Raise it and reset the
-        // clock whenever the server reports progress, so progress-streaming
-        // servers can run even longer. Overridable via MCP_CALL_TIMEOUT_MS.
-        { timeout: MCP_CALL_TIMEOUT_MS, resetTimeoutOnProgress: true }
-      );
-      if (result.isError === true) {
-        const detail = extractText(result.content);
-        throw new Error(`MCP tool ${originalName} failed: ${detail || "unknown error"}`);
-      }
-      if (result.structuredContent != null) return result.structuredContent;
-      const content = result.content ?? [];
-      if (Array.isArray(content) && content.length > 0 && content.every((c) => c.type === "text")) {
-        return extractText(content);
-      }
-      return content;
+      const client = await getClient();
+      return callMcpTool(client, originalName, input ?? {});
     }
   };
 }
+function mcpToolToToolDefinition(client, mcpTool, slug) {
+  return buildMcpToolDefinition(mcpTool, slug, () => Promise.resolve(client));
+}
+function mcpToolToLazyToolDefinition(getClient, mcpTool, slug) {
+  return buildMcpToolDefinition(mcpTool, slug, getClient);
+}
 
 // ../../packages/adapters/mcp/src/index.ts
 async function createMcpTools(opts) {
   const conn = await connectMcp(opts);
   const tools = conn.tools.map((t) => mcpToolToToolDefinition(conn.client, t, opts.slug));
-  return { tools, close: conn.close };
+  return { tools, descriptors: conn.tools, close: conn.close };
+}
+function createLazyMcpTools(opts, cachedDescriptors, lazyOpts = {}) {
+  let connectPromise = null;
+  function ensureConnected() {
+    if (!connectPromise) {
+      connectPromise = connectMcp(opts).then((conn) => {
+        if (lazyOpts.onConnected) {
+          Promise.resolve(lazyOpts.onConnected(conn.tools)).catch((err) => {
+            console.error(
+              `[adapter-mcp] onConnected cache-refresh hook failed for '${opts.slug}':`,
+              err instanceof Error ? err.message : err
+            );
+          });
+        }
+        return conn;
+      }).catch((err) => {
+        connectPromise = null;
+        throw err;
+      });
+    }
+    return connectPromise.then((conn) => conn.client);
+  }
+  const tools = cachedDescriptors.map(
+    (d) => mcpToolToLazyToolDefinition(ensureConnected, d, opts.slug)
+  );
+  return {
+    tools,
+    descriptors: cachedDescriptors,
+    close: async () => {
+      const pending = connectPromise;
+      if (!pending) return;
+      const conn = await pending.catch(() => null);
+      if (conn) await conn.close();
+    }
+  };
+}
+
+// src/job/mcp-tool-cache.ts
+function isUsableMcpToolCache(availableTools) {
+  if (!Array.isArray(availableTools) || availableTools.length === 0) return false;
+  return availableTools.every(
+    (t) => typeof t === "object" && t !== null && typeof t.name === "string" && t.inputSchema !== void 0
+  );
 }
 
 // src/job/resolve-llm.ts
@@ -50174,7 +50697,10 @@ async function resolveAgentLlmClient(db, agent, onSkip) {
         provider: row.provider,
         model,
         apiKey: plaintextKey || void 0,
-        baseURL: row.baseUrl ?? void 0
+        baseURL: row.baseUrl ?? void 0,
+        // É-3: per-model context window for a custom/local endpoint the catalog
+        // can't know — used as a fallback in modelContextWindow (catalog wins).
+        contextWindow: row.contextWindow ?? void 0
       });
     }
     if (configs.length === 0) return { ok: false, reason: "agent_no_llm_configured" };
@@ -50563,6 +51089,83 @@ async function generateAssignTools(parentAgentId, db) {
   return tools;
 }
 
+// ../../packages/orchestration/src/router/tool-availability.ts
+init_src();
+var KNOWN_FIXED_TOOL_NAMES = /* @__PURE__ */ new Set([
+  ...ALWAYS_ON_TOOLS,
+  ...DELIVERY_TOOL_NAMES,
+  ...META_TOOL_NAMES,
+  "run_skill_script",
+  "skill_file_write"
+]);
+var KNOWN_CONNECTOR_TOOL_NAMES = new Set(
+  Object.values(ADAPTER_REGISTRY).flatMap((entry) => entry.operations.map((o) => o.slug))
+);
+var KNOWN_TOOL_NAME_UNIVERSE = /* @__PURE__ */ new Set([
+  ...KNOWN_FIXED_TOOL_NAMES,
+  ...KNOWN_CONNECTOR_TOOL_NAMES
+]);
+async function computeAgentToolNames(agentId, entityId, db, opts) {
+  const names = new Set(ALWAYS_ON_TOOLS);
+  const [agentRow] = await db.select({ telegramBotToken: agents.telegramBotToken }).from(agents).where(eq5(agents.id, agentId)).limit(1);
+  if (opts.hasDeliveryRecipient) {
+    let deliveryToken = agentRow?.telegramBotToken ?? null;
+    if (!deliveryToken) {
+      const [rootRow] = await db.select({ telegramBotToken: agents.telegramBotToken }).from(entities).innerJoin(agents, eq5(agents.id, entities.rootAgentId)).where(eq5(entities.id, entityId)).limit(1);
+      deliveryToken = rootRow?.telegramBotToken ?? null;
+    }
+    if (deliveryToken) {
+      for (const n of DELIVERY_TOOL_NAMES) names.add(n);
+    }
+  }
+  const skillRows = await db.select({
+    requiredBuiltins: agentSkills.requiredBuiltins,
+    scriptsAuthorized: agentSkillAssignments.scriptsAuthorized,
+    filesWritable: agentSkillAssignments.filesWritable
+  }).from(agentSkillAssignments).innerJoin(agentSkills, eq5(agentSkills.id, agentSkillAssignments.skillId)).where(eq5(agentSkillAssignments.agentId, agentId));
+  for (const r of skillRows) {
+    for (const n of r.requiredBuiltins ?? []) names.add(n);
+    if (r.scriptsAuthorized) names.add("run_skill_script");
+    if (r.filesWritable) names.add("skill_file_write");
+  }
+  const connectorRows = await db.select({
+    slug: connectors.slug,
+    enabledOperations: agentConnectorAssignments.enabledOperations
+  }).from(agentConnectorAssignments).innerJoin(connectors, eq5(connectors.id, agentConnectorAssignments.connectorId)).where(eq5(agentConnectorAssignments.agentId, agentId));
+  for (const r of connectorRows) {
+    const entry = ADAPTER_REGISTRY[r.slug];
+    if (!entry) continue;
+    const allToolNames = entry.operations.map((o) => o.slug);
+    const kept = r.enabledOperations === null ? allToolNames : allToolNames.filter((n) => r.enabledOperations.includes(n));
+    for (const n of kept) names.add(n);
+  }
+  const mcpRows = await db.select({
+    serverSlug: mcpServers.slug,
+    enabledTools: agentMcpServers.enabledTools,
+    availableTools: mcpServers.availableTools
+  }).from(agentMcpServers).innerJoin(mcpServers, eq5(mcpServers.id, agentMcpServers.mcpServerId)).where(eq5(agentMcpServers.agentId, agentId));
+  for (const r of mcpRows) {
+    const prefix = r.serverSlug.replace(/-/g, "_");
+    const available = Array.isArray(r.availableTools) ? r.availableTools.map((t) => t && typeof t.name === "string" ? t.name : null).filter((n) => n !== null) : [];
+    const enabled = Array.isArray(r.enabledTools) ? new Set(r.enabledTools.filter((n) => typeof n === "string")) : null;
+    const kept = enabled === null ? available : available.filter((n) => enabled.has(n));
+    for (const n of kept) names.add(`${prefix}__${n}`);
+  }
+  const [entityRow] = await db.select({ rootAgentId: entities.rootAgentId, rootGrants: entities.rootGrants }).from(entities).where(eq5(entities.id, entityId)).limit(1);
+  if (entityRow?.rootAgentId === agentId) {
+    for (const n of enabledMetaTools(parseRootGrants(entityRow.rootGrants))) names.add(n);
+  }
+  return names;
+}
+function findUnavailableToolMentions(briefText, availableToolNames) {
+  const words = briefText.match(/\b[a-z][a-z0-9]*(?:_[a-z0-9]+)+\b/g) ?? [];
+  const missing = /* @__PURE__ */ new Set();
+  for (const w of words) {
+    if (KNOWN_TOOL_NAME_UNIVERSE.has(w) && !availableToolNames.has(w)) missing.add(w);
+  }
+  return [...missing];
+}
+
 // ../../packages/orchestration/src/router/delegate.ts
 var TERMINAL_JOB_STATUSES = ["completed", "failed", "cancelled"];
 async function handleDelegation(parentJob, childSlug, toolUseId, taskInput, sideToolResults, db) {
@@ -50594,6 +51197,9 @@ ${taskInput.data}` : taskInput.task;
     status: "pending",
     parentJobId: parentJob.id,
     delegationDepth: childDepth,
+    // Jobs page grouping (migration 0059): a delegated child is the SAME
+    // conversation as its parent, not a new one.
+    conversationId: parentJob.conversationId ?? void 0,
     messages: [{ role: "user", content: childContent }]
   }).returning();
   if (!childJob) {
@@ -50907,6 +51513,20 @@ function generateTaskTools(orchestratorAgentId, db) {
         const agentRows = await db.select({ id: agents.id }).from(agents).where(and4(eq5(agents.slug, input.assigned_to), eq5(agents.entityId, ctx.entityId))).limit(1);
         assignedAgentId = agentRows[0]?.id ?? null;
       }
+      let warning;
+      if (assignedAgentId) {
+        const briefText = `${input.title} ${input.description ?? ""}`;
+        const availableToolNames = await computeAgentToolNames(
+          assignedAgentId,
+          ctx.entityId,
+          db,
+          { hasDeliveryRecipient: false }
+        );
+        const missing = findUnavailableToolMentions(briefText, availableToolNames);
+        if (missing.length > 0) {
+          warning = `warning: le brief mentionne l'outil '${missing[0]}' que l'agent cible '${input.assigned_to}' n'aura pas \u2014 prescris le r\xE9sultat attendu plut\xF4t que l'outil, ou retire la mention`;
+        }
+      }
       const dependsOn = input.depends_on ?? [];
       const newTaskId = randomUUID2();
       await validateDependencies(newTaskId, dependsOn, ctx.entityId, db);
@@ -50927,7 +51547,7 @@ function generateTaskTools(orchestratorAgentId, db) {
       if (!task) {
         throw new Error("task_board_error: failed to insert task");
       }
-      return { taskId: task.id, title: task.title };
+      return { taskId: task.id, title: task.title, ...warning ? { warning } : {} };
     }
   };
   const listTasksTool = {
@@ -51146,13 +51766,29 @@ init_src();
 // ../../packages/orchestration/src/agent-baseline.ts
 var NEEDS_FIRMER_VERIFY = /deepseek|minimax|qwen|glm|gemma|kimi|mistral|llama/i;
 var contentOfKind = (kind) => systemSkills.filter((s) => skillKind(s) === kind).map((s) => s.content.trim());
-function buildBaselineBlock(model) {
+var MEMORY_DISCIPLINE_BLOCK = `## Memory discipline
+
+### Correct what's wrong
+
+If a fact from your Persistent memory block turns out to be false in practice \u2014 a file path that doesn't exist, an invalid ID, a procedure that fails the way the memory said it wouldn't \u2014 you MUST call \`mark_memory_outdated\` on it with the reason, then \`save_memory\` the corrected fact once you have verified it. Never silently keep reusing a fact you just found to be wrong.
+
+### What's worth saving
+
+A fact you save via \`save_memory\` must describe something VERIFIED \u2014 an exact path you confirmed, a real ID, a preference the user stated, a procedure that actually worked. Never save a micromanagement rule for another agent, and never save a discovery ban (e.g. "don't search for X", "don't explore Y") \u2014 every agent stays free to check things for itself when what it was given turns out to be wrong.`;
+var WORKER_DISCOVERY_BLOCK = `## Capitalize what you learn
+
+When you discover something durable while working a task \u2014 the real path of a file or workflow, parameters that worked, a convention \u2014 save it via \`save_memory\` before you finish. One fact per call, short and verified.`;
+var DELEGATION_DISCIPLINE_BLOCK = `## Delegation discipline
+
+When you delegate: (1) pass the PARAMETERS in the brief (paths, prompts, values) \u2014 do not do the prep work yourself that the worker can do with its own tools; (2) NEVER edit a shared or template file to encode a run's parameters \u2014 templates are immutable, values are passed as arguments; (3) only name a specific tool in a brief if you know the target agent has it \u2014 otherwise state the expected RESULT (the worker returns it via \`return_result\`) and deliver it yourself once it comes back; (4) a brief states the goal, the parameters, and the constraints \u2014 not a step-by-step procedure that forbids the worker from adapting.`;
+function buildBaselineBlock(model, opts = {}) {
   const parts = contentOfKind("baseline");
-  if (parts.length === 0) return "";
-  const reinforcement = NEEDS_FIRMER_VERIFY.test(model) ? "\n\n**Especially you \u2014 execution discipline:** Actually run or check your work before you say a task is done, and never write tool output you did not really get back. Be decisive: once a check passes (e.g. dependencies report ready), DO the action \u2014 do not keep re-verifying, re-listing, or running diagnostic commands. Use the tools, scripts, and exact file paths you were given (a skill loaded with skill_view ships run_skill_script and ready-made workflows/templates) instead of writing your own helper or conversion scripts, or rebuilding what already exists. Take the fewest steps that finish the task, then deliver the result with its output path." : "";
-  return `## How you work (always)
+  const reinforcement = parts.length > 0 && NEEDS_FIRMER_VERIFY.test(model) ? "\n\n**Especially you \u2014 execution discipline:** Actually run or check your work before you say a task is done, and never write tool output you did not really get back. Be decisive: once a check passes (e.g. dependencies report ready), DO the action \u2014 do not keep re-verifying, re-listing, or running diagnostic commands. Use the tools, scripts, and exact file paths you were given (a skill loaded with skill_view ships run_skill_script and ready-made workflows/templates) instead of writing your own helper or conversion scripts, or rebuilding what already exists. Take the fewest steps that finish the task, then deliver the result with its output path." : "";
+  const catalogBlock = parts.length > 0 ? `## How you work (always)
 
-${parts.join("\n\n")}${reinforcement}`;
+${parts.join("\n\n")}${reinforcement}` : "";
+  const roleBlock = opts.role === "orchestrator" ? DELEGATION_DISCIPLINE_BLOCK : WORKER_DISCOVERY_BLOCK;
+  return [catalogBlock, MEMORY_DISCIPLINE_BLOCK, roleBlock].filter(Boolean).join("\n\n");
 }
 function buildChannelBlock(opts) {
   const onTelegram = opts.channel === "telegram" || opts.telegram === true;
@@ -51359,7 +51995,7 @@ ${skillIndex}` : "";
   }) : [];
   const memoryBlock = buildPersistentMemoryBlock(memoryRows);
   const jobContextBlock = jobContext ? buildJobContextBlock(jobContext) : "";
-  const baselineBlock = buildBaselineBlock(agent.model);
+  const baselineBlock = buildBaselineBlock(agent.model, { role: agent.role });
   const channelBlock = buildChannelBlock({
     channel: jobContext?.origin,
     telegram: Boolean(jobContext?.telegramChatId)
@@ -51792,6 +52428,7 @@ import { mkdirSync as mkdirSync2 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
 
 // src/approvals/notify.ts
+init_src();
 var APPROVAL_CALLBACK_PREFIX = "apr";
 function approvalCallbackData(approvalRequestId, decision) {
   return `${APPROVAL_CALLBACK_PREFIX}:${approvalRequestId}:${decision}`;
@@ -51818,7 +52455,7 @@ async function resolveTelegramDeliveryTarget(db, jobId) {
   return null;
 }
 function describeGatedAction(toolName, toolInput) {
-  const input = toolInput ?? {};
+  const input = redactSecretsForAudit(toolInput ?? {});
   const str = (v) => typeof v === "string" ? v : JSON.stringify(v ?? null);
   switch (toolName) {
     case "run_command":
@@ -51843,15 +52480,14 @@ async function notifyApprovalCreated(deps, req) {
     const who = agent?.name ?? "An agent";
     const input = req.toolInput ?? {};
     const purpose = typeof input["purpose"] === "string" ? input["purpose"].trim() : "";
-    const impact = typeof input["impact"] === "string" ? input["impact"].trim() : "";
+    const impact = computeApprovalImpactLine(req.toolName, req.toolInput);
     const detail = describeGatedAction(req.toolName, req.toolInput);
     const detailShort = detail.length > 500 ? detail.slice(0, 500) + "\n\u2026 (full detail on the dashboard)" : detail;
     const text23 = `\u23F3 Approval needed \u2014 ${who}
 
-` + (purpose ? `\u27A4 ${purpose}
-` : `${who} wants to run an action.
-`) + (impact ? `\u26A0\uFE0F Impact: ${impact}
-` : "") + `
+\u27A4 ${purpose || "Purpose not specified by the agent."}
+\u26A0\uFE0F ${impact}
+
 Details:
 ${detailShort}
 
@@ -51876,7 +52512,7 @@ import { join as join9 } from "node:path";
 
 // src/skills/install.ts
 import { cp, rm as rm2, mkdir as mkdir4, readFile as readFile10 } from "node:fs/promises";
-import { dirname as dirname7, join as join8, basename as basename5, sep as sep5 } from "node:path";
+import { dirname as dirname7, join as join8, basename as basename5, sep as sep5, resolve as resolve2 } from "node:path";
 
 // src/skills/source.ts
 var SkillSourceError = class extends Error {
@@ -51887,6 +52523,11 @@ var SkillSourceError = class extends Error {
 };
 var SEGMENT = "[A-Za-z0-9._-]+";
 var OWNER_REPO = new RegExp(`^(${SEGMENT})/(${SEGMENT})$`);
+var SEGMENT_RE = new RegExp(`^${SEGMENT}$`);
+function isSafeSubdir(subdir) {
+  if (subdir.startsWith("/") || subdir.includes("\\")) return false;
+  return !subdir.split("/").includes("..");
+}
 var ALLOWED_HOSTS = /* @__PURE__ */ new Set([
   "github.com",
   "www.github.com",
@@ -52010,12 +52651,22 @@ function parseSkillSource(input) {
     });
   }
   const segs = raw.split("/").filter(Boolean);
-  if (segs.length >= 2 && new RegExp(`^${SEGMENT}$`).test(segs[0])) {
+  if (segs.length >= 2 && SEGMENT_RE.test(segs[0])) {
+    const repo = stripGitSuffix(segs[1]);
+    if (!SEGMENT_RE.test(repo)) {
+      throw new SkillSourceError(`Invalid repository name in "${raw}".`);
+    }
+    const subdir = segs.slice(2).join("/") || null;
+    if (subdir !== null && !isSafeSubdir(subdir)) {
+      throw new SkillSourceError(
+        `Unsafe path in skill source "${raw}": must not contain ".." or an absolute/backslash path.`
+      );
+    }
     return github({
       owner: segs[0],
-      repo: stripGitSuffix(segs[1]),
+      repo,
       ref: null,
-      subdir: segs.slice(2).join("/") || null,
+      subdir,
       skillName: null,
       raw
     });
@@ -52090,7 +52741,8 @@ async function fetchAllowlisted(url2, headers) {
     const res = await fetch(current, { redirect: "manual", headers });
     if (res.status >= 300 && res.status < 400) {
       const location = res.headers.get("location");
-      if (!location) throw new SkillFetchError(`Redirect response (${res.status}) missing Location.`);
+      if (!location)
+        throw new SkillFetchError(`Redirect response (${res.status}) missing Location.`);
       current = new URL(location, current).toString();
       continue;
     }
@@ -52152,7 +52804,9 @@ async function unzipBufferTo(buf, destDir) {
       }
       if (final && !violation) {
         const fileData = Buffer.concat(chunks);
-        pendingWrites.push(mkdir3(dirname6(abs), { recursive: true }).then(() => writeFile5(abs, fileData)));
+        pendingWrites.push(
+          mkdir3(dirname6(abs), { recursive: true }).then(() => writeFile5(abs, fileData))
+        );
       }
     };
     file.start();
@@ -52614,7 +53268,13 @@ function buildContent(slug, body, scripts) {
 async function pickManifest(extractRoot, subdir, skillName) {
   if (subdir) {
     const rel = `${subdir.replace(/\/+$/, "")}/SKILL.md`;
-    if (await isFile(join8(extractRoot, rel))) return rel;
+    const rootResolved = resolve2(extractRoot);
+    const rootWithSep = rootResolved.endsWith(sep5) ? rootResolved : rootResolved + sep5;
+    const abs = resolve2(join8(extractRoot, rel));
+    if (abs !== rootResolved && !abs.startsWith(rootWithSep)) {
+      throw new SkillInstallError(`Unsafe skill path: "${subdir}" escapes the repository.`);
+    }
+    if (await isFile(abs)) return rel;
     throw new SkillInstallError(`No SKILL.md at "${subdir}" in the repository.`);
   }
   const manifests = await findSkillManifests(extractRoot);
@@ -53232,23 +53892,11 @@ async function resolveSearchBackend(db, agentId) {
   }
   return void 0;
 }
-var DELIVERY_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "telegram_send_message",
-  "send_image",
-  "send_file",
-  "send_video",
-  "send_audio",
-  "send_voice"
-]);
+var DELIVERY_TOOL_NAMES2 = new Set(DELIVERY_TOOL_NAMES);
 var DELIVERY_OR_TERMINAL_TOOL_NAMES = /* @__PURE__ */ new Set([
   "return_result",
   "dashboard_publish",
-  "telegram_send_message",
-  "send_image",
-  "send_file",
-  "send_video",
-  "send_audio",
-  "send_voice"
+  ...DELIVERY_TOOL_NAMES
 ]);
 var TOOL_ONLY_DELIVERY_CHANNELS = /* @__PURE__ */ new Set(["telegram"]);
 function truncateForContext(value) {
@@ -53412,6 +54060,15 @@ async function maybeResumeParent(childJobId, outcome, deps, runnerEnv) {
     void triggerWorker(parentJobId, runnerEnv);
   }
 }
+async function reviveJobIfApprovalResolvedDuringSuspend(db, jobId, runnerEnv) {
+  const openRows = await db.select({ status: approvalRequests.status }).from(approvalRequests).where(and4(eq5(approvalRequests.jobId, jobId), isNull(approvalRequests.executedAt)));
+  const hasResolved = openRows.some((r) => r.status === "approved" || r.status === "rejected");
+  if (!hasResolved) return;
+  const flipped = await db.update(agentJobs).set({ status: "pending", updatedAt: /* @__PURE__ */ new Date() }).where(and4(eq5(agentJobs.id, jobId), eq5(agentJobs.status, "awaiting_approval"))).returning({ id: agentJobs.id });
+  if (flipped.length > 0 && runnerEnv) {
+    void triggerWorker(jobId, runnerEnv);
+  }
+}
 async function runJob(jobId, deps, runnerEnv, opts) {
   const { db, registry } = deps;
   let llmClient;
@@ -53487,8 +54144,8 @@ async function runJob(jobId, deps, runnerEnv, opts) {
     const sharedPath = join10(homedir3(), ".nodalai", "workspaces", job.entityId, "shared");
     try {
       mkdirSync2(sharedPath, { recursive: true });
-      if (!agentWorkspacesList.some((w) => w.label === "shared")) {
-        agentWorkspacesList.push({ label: "shared", path: sharedPath });
+      if (!agentWorkspacesList.some((w) => w.label === SHARED_WORKSPACE_LABEL)) {
+        agentWorkspacesList.push({ label: SHARED_WORKSPACE_LABEL, path: sharedPath });
       }
     } catch {
     }
@@ -53555,7 +54212,13 @@ async function runJob(jobId, deps, runnerEnv, opts) {
   const fileWriteToolNames = fileWritableSkillSlugs.length > 0 ? ["skill_file_write"] : [];
   const fileWriteToolDefs = fileWriteToolNames.map((n) => registry.get(n)).filter((t) => t !== void 0);
   const capabilityTools = [];
-  if (agentRow.telegramBotToken && job.chatId) {
+  let inheritedRootBotToken = null;
+  if (!agentRow.telegramBotToken && job.parentJobId && job.chatId) {
+    const [rootAgentTokenRow] = await db.select({ telegramBotToken: agents.telegramBotToken }).from(entities).innerJoin(agents, eq5(agents.id, entities.rootAgentId)).where(eq5(entities.id, job.entityId ?? "")).limit(1);
+    inheritedRootBotToken = rootAgentTokenRow?.telegramBotToken ?? null;
+  }
+  const deliveryBotToken = agentRow.telegramBotToken ?? inheritedRootBotToken;
+  if (deliveryBotToken && job.chatId) {
     capabilityTools.push(createTelegramSendMessageTool());
     capabilityTools.push(createSendImageTool());
     capabilityTools.push(createSendFileTool());
@@ -53645,6 +54308,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
         capabilityTools.push(...filtered);
       }
       const mcpAssignments = await db.select({
+        id: mcpServers.id,
         slug: mcpServers.slug,
         transport: mcpServers.transport,
         url: mcpServers.url,
@@ -53654,10 +54318,21 @@ async function runJob(jobId, deps, runnerEnv, opts) {
         command: mcpServers.command,
         args: mcpServers.args,
         envVars: mcpServers.envVars,
+        availableTools: mcpServers.availableTools,
         enabledTools: agentMcpServers.enabledTools
       }).from(agentMcpServers).innerJoin(mcpServers, eq5(mcpServers.id, agentMcpServers.mcpServerId)).where(eq5(agentMcpServers.agentId, agentRow.id));
+      const refreshMcpToolCache = async (mcpServerId, liveTools) => {
+        try {
+          await db.update(mcpServers).set({ availableTools: liveTools }).where(eq5(mcpServers.id, mcpServerId));
+        } catch (err) {
+          console.error(
+            `[execute] failed to refresh available_tools cache for MCP server '${mcpServerId}': ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      };
       for (const ms of mcpAssignments) {
         try {
+          const availableTools = ms.availableTools;
           let toolset;
           if (ms.transport === "stdio") {
             if (!ms.command) continue;
@@ -53670,13 +54345,23 @@ async function runJob(jobId, deps, runnerEnv, opts) {
             } catch {
               continue;
             }
-            toolset = await createMcpTools({
+            const connectOpts = {
               transport: "stdio",
               slug: ms.slug,
               command: ms.command,
               args: ms.args ?? [],
               env: decryptedEnv
-            });
+            };
+            if (isUsableMcpToolCache(availableTools)) {
+              toolset = createLazyMcpTools(connectOpts, availableTools, {
+                onConnected: (liveTools) => refreshMcpToolCache(ms.id, liveTools)
+              });
+            } else {
+              toolset = await createMcpTools(connectOpts);
+              if (toolset.descriptors?.length) {
+                await refreshMcpToolCache(ms.id, toolset.descriptors);
+              }
+            }
           } else {
             if (!ms.url || !ms.apiKey || !ms.authScheme || !ms.authParamName) continue;
             let decryptedKey;
@@ -53688,14 +54373,24 @@ async function runJob(jobId, deps, runnerEnv, opts) {
               );
               continue;
             }
-            toolset = await createMcpTools({
+            const connectOpts = {
               transport: "http",
               slug: ms.slug,
               url: ms.url,
               apiKey: decryptedKey,
               authScheme: ms.authScheme,
               authParamName: ms.authParamName
-            });
+            };
+            if (isUsableMcpToolCache(availableTools)) {
+              toolset = createLazyMcpTools(connectOpts, availableTools, {
+                onConnected: (liveTools) => refreshMcpToolCache(ms.id, liveTools)
+              });
+            } else {
+              toolset = await createMcpTools(connectOpts);
+              if (toolset.descriptors?.length) {
+                await refreshMcpToolCache(ms.id, toolset.descriptors);
+              }
+            }
           }
           mcpClosers.push(toolset.close);
           const enabled = ms.enabledTools;
@@ -53744,7 +54439,13 @@ async function runJob(jobId, deps, runnerEnv, opts) {
   }));
   const authMode = runnerEnv?.AUTH_MODE ?? process.env["AUTH_MODE"] ?? "local-trust";
   if (authMode !== "local-trust") {
-    const CODE_EXECUTION_TOOLS = ["run_command", "run_skill_script", "skill_file_write"];
+    const CODE_EXECUTION_TOOLS = [
+      "run_command",
+      "run_skill_script",
+      "skill_file_write",
+      "create_mcp",
+      "attach_mcp"
+    ];
     const [yoloEntityRow] = await db.select({ lanCommandYolo: entities.lanCommandYolo }).from(entities).where(eq5(entities.id, job.entityId ?? "")).limit(1);
     if (!yoloEntityRow?.lanCommandYolo) {
       for (const codeTool of CODE_EXECUTION_TOOLS) {
@@ -53805,102 +54506,109 @@ async function runJob(jobId, deps, runnerEnv, opts) {
     if (serialized.length <= MAX_TOOL_RESULT_CHARS) return { type: "json", value: json };
     return { type: "text", value: truncateForContext(serialized) };
   };
-  {
-    const pendingExecRows = await db.select().from(approvalRequests).where(and4(eq5(approvalRequests.jobId, jobId), isNull(approvalRequests.executedAt))).orderBy(approvalRequests.requestedAt);
-    const resolvedRows = pendingExecRows.filter(
-      (r) => r.status === "approved" || r.status === "rejected"
-    );
+  const executeResolvedApprovals = async (resolvedRows, msgsIn) => {
+    let msgs = msgsIn;
     let catastrophicRefusalMessage = null;
-    if (resolvedRows.length > 0) {
-      for (const req of resolvedRows) {
-        let replacementOutput;
-        if (req.status === "approved") {
-          const resumeCommand = String(
-            req.toolInput?.command ?? ""
-          );
-          const isCatastrophicResume = req.toolName === "run_command" && isCatastrophicCommand(resumeCommand);
-          if (isCatastrophicResume) {
-            catastrophicRefusalMessage = isInlineInterpreterEvalCommand(resumeCommand) ? "Cette commande ex\xE9cute du code en ligne via un interpr\xE9teur (python -c, node -e, sh -c, \u2026). Son contenu ne peut pas \xEAtre v\xE9rifi\xE9 automatiquement, donc elle est bloqu\xE9e par s\xE9curit\xE9 et reste refus\xE9e m\xEAme apr\xE8s approbation. Elle n'a pas \xE9t\xE9 ex\xE9cut\xE9e. Pour lancer un script, passez par un FICHIER (ex. `python mon_script.py`) plut\xF4t que par du code en ligne." : "Cette commande est jug\xE9e catastrophique (destruction machine-wide) et reste refus\xE9e m\xEAme apr\xE8s approbation, par s\xE9curit\xE9. Elle n'a pas \xE9t\xE9 ex\xE9cut\xE9e.";
-            replacementOutput = toResultOutput({ error: catastrophicRefusalMessage });
-            trace("resume_catastrophic_command_refused", { toolName: req.toolName });
+    for (const req of resolvedRows) {
+      let replacementOutput;
+      if (req.status === "approved") {
+        const resumeCommand = String(
+          req.toolInput?.command ?? ""
+        );
+        const isCatastrophicResume = req.toolName === "run_command" && isCatastrophicCommand(resumeCommand);
+        if (isCatastrophicResume) {
+          catastrophicRefusalMessage = "Cette commande est jug\xE9e catastrophique (destruction machine-wide : rm -rf /, mkfs, shutdown\u2026) et reste refus\xE9e m\xEAme apr\xE8s approbation, par s\xE9curit\xE9. Elle n'a pas \xE9t\xE9 ex\xE9cut\xE9e.";
+          replacementOutput = toResultOutput({ error: catastrophicRefusalMessage });
+          trace("resume_catastrophic_command_refused", { toolName: req.toolName });
+        } else {
+          const toolDef = toolMap.get(req.toolName);
+          if (!toolDef) {
+            replacementOutput = toResultOutput({
+              error: `approved_tool_not_found:${req.toolName}`
+            });
           } else {
-            const toolDef = toolMap.get(req.toolName);
-            if (!toolDef) {
-              replacementOutput = toResultOutput({
-                error: `approved_tool_not_found:${req.toolName}`
-              });
-            } else {
-              const resumeApprovalRules = [
-                {
-                  id: "resume-bypass",
-                  entityId: job.entityId ?? "",
-                  agentId: null,
-                  toolName: req.toolName,
-                  action: "auto_approve"
-                }
-              ];
-              const execResult = await executeTool(
-                toolDef,
-                req.toolInput,
-                {
-                  jobId,
-                  agentId: agentRow.id,
-                  entityId: job.entityId ?? "",
-                  db,
-                  jobChatId: job.chatId ?? null,
-                  embeddingClient: deps.embeddingClient,
-                  workspaces: agentWorkspacesList,
-                  skillStoreDir: skillStore,
-                  assignedSkillSlugs,
-                  scriptAuthorizedSkillSlugs,
-                  fileWritableSkillSlugs,
-                  provisioning: TOOL_PROVISIONING,
-                  searchBackend
-                },
-                {
-                  approvalRules: resumeApprovalRules,
-                  autonomy: workspaceAutonomy,
-                  onApprovalRequired: (req2) => notifyApprovalCreated(deps, req2)
-                }
-              );
-              if (execResult.outcome === "success") {
-                replacementOutput = toResultOutput(execResult.output);
-              } else if (execResult.outcome === "error") {
-                replacementOutput = toResultOutput({ error: execResult.error });
-              } else {
-                replacementOutput = toResultOutput({ error: "unexpected_gate_on_approved_tool" });
+            const resumeApprovalRules = [
+              {
+                id: "resume-bypass",
+                entityId: job.entityId ?? "",
+                agentId: null,
+                toolName: req.toolName,
+                action: "auto_approve"
+              }
+            ];
+            const execResult = await executeTool(
+              toolDef,
+              req.toolInput,
+              {
+                jobId,
+                agentId: agentRow.id,
+                entityId: job.entityId ?? "",
+                db,
+                jobChatId: job.chatId ?? null,
+                resolvedTelegramBotToken: inheritedRootBotToken ?? void 0,
+                embeddingClient: deps.embeddingClient,
+                workspaces: agentWorkspacesList,
+                skillStoreDir: skillStore,
+                assignedSkillSlugs,
+                scriptAuthorizedSkillSlugs,
+                fileWritableSkillSlugs,
+                provisioning: TOOL_PROVISIONING,
+                searchBackend
+              },
+              {
+                approvalRules: resumeApprovalRules,
+                autonomy: workspaceAutonomy,
+                onApprovalRequired: (r) => notifyApprovalCreated(deps, r)
               }
+            );
+            if (execResult.outcome === "success") {
+              replacementOutput = toResultOutput(execResult.output);
+            } else if (execResult.outcome === "error") {
+              replacementOutput = toResultOutput({ error: execResult.error });
+            } else {
+              replacementOutput = toResultOutput({ error: "unexpected_gate_on_approved_tool" });
             }
           }
-          trace("resume_approved_tool_executed", { toolName: req.toolName });
-        } else {
-          const reason = req.notes ?? "no reason provided";
-          replacementOutput = toResultOutput(
-            `[REJECTED] Human reviewer rejected this action. Reason: ${reason}. Adapt your approach.`
-          );
-          trace("resume_rejected_tool_marker_replaced", { toolName: req.toolName });
         }
-        messages = messages.map((msg) => {
-          if (typeof msg !== "object" || msg === null || msg.role !== "tool") {
-            return msg;
-          }
-          const toolMsg = msg;
-          if (!Array.isArray(toolMsg.content)) return msg;
-          const updatedContent = toolMsg.content.map((block) => {
-            if (typeof block !== "object" || block === null || block.type !== "tool-result") {
-              return block;
-            }
-            const tb = block;
-            if (tb.toolName !== req.toolName) return block;
-            const outputText = tb.output.type === "text" ? tb.output.value : JSON.stringify(tb.output.value);
-            if (!outputText.includes("[AWAITING_APPROVAL]")) return block;
-            return { ...tb, output: replacementOutput };
-          });
-          return { ...toolMsg, content: updatedContent };
+        trace("resume_approved_tool_executed", { toolName: req.toolName });
+      } else {
+        const reason = req.notes ?? "no reason provided";
+        replacementOutput = toResultOutput(
+          `[REJECTED] Human reviewer rejected this action. Reason: ${reason}. Adapt your approach.`
+        );
+        trace("resume_rejected_tool_marker_replaced", { toolName: req.toolName });
+      }
+      msgs = msgs.map((msg) => {
+        if (typeof msg !== "object" || msg === null || msg.role !== "tool") {
+          return msg;
+        }
+        const toolMsg = msg;
+        if (!Array.isArray(toolMsg.content)) return msg;
+        const updatedContent = toolMsg.content.map((block) => {
+          if (typeof block !== "object" || block === null || block.type !== "tool-result") {
+            return block;
+          }
+          const tb = block;
+          if (tb.toolName !== req.toolName) return block;
+          const outputText = tb.output.type === "text" ? tb.output.value : JSON.stringify(tb.output.value);
+          if (!outputText.includes("[AWAITING_APPROVAL]")) return block;
+          return { ...tb, output: replacementOutput };
         });
-        await db.update(approvalRequests).set({ executedAt: /* @__PURE__ */ new Date() }).where(eq5(approvalRequests.id, req.id));
-      }
-      if (catastrophicRefusalMessage !== null) {
+        return { ...toolMsg, content: updatedContent };
+      });
+      await db.update(approvalRequests).set({ executedAt: /* @__PURE__ */ new Date() }).where(eq5(approvalRequests.id, req.id));
+    }
+    return { messages: msgs, catastrophicRefusalMessage };
+  };
+  {
+    const pendingExecRows = await db.select().from(approvalRequests).where(and4(eq5(approvalRequests.jobId, jobId), isNull(approvalRequests.executedAt))).orderBy(approvalRequests.requestedAt);
+    const resolvedRows = pendingExecRows.filter(
+      (r) => r.status === "approved" || r.status === "rejected"
+    );
+    if (resolvedRows.length > 0) {
+      const executed = await executeResolvedApprovals(resolvedRows, messages);
+      messages = executed.messages;
+      if (executed.catastrophicRefusalMessage !== null) {
         trace("resume_catastrophic_command_failed_job");
         await failJob(
           db,
@@ -53908,12 +54616,12 @@ async function runJob(jobId, deps, runnerEnv, opts) {
           "catastrophic_command_refused",
           runStats(),
           messages,
-          catastrophicRefusalMessage
+          executed.catastrophicRefusalMessage
         );
         return {
           status: "failed",
           error: "catastrophic_command_refused",
-          result: catastrophicRefusalMessage
+          result: executed.catastrophicRefusalMessage
         };
       }
       await saveCheckpoint(db, jobId, {
@@ -53942,10 +54650,67 @@ async function runJob(jobId, deps, runnerEnv, opts) {
   const MAX_TELEGRAM_REDELIVERY_NUDGES = 2;
   let telegramRedeliveryNudges = 0;
   let telegramDelivered = false;
+  let deliveredViaToolName = null;
   const deliveryNudge = "[syst\xE8me] Tu es sur Telegram. Tu n'as pas encore livr\xE9 ta r\xE9ponse \xE0 l'utilisateur. Appelle `telegram_send_message` avec ta r\xE9ponse, PUIS `return_result`. Ne r\xE9ponds pas en texte simple \u2014 sur Telegram, seul un message envoy\xE9 via `telegram_send_message` est visible par l'utilisateur.";
+  const withDeliveryNotice = (resultText) => {
+    if (!job.parentJobId || !deliveredViaToolName) return resultText;
+    const notice = `[livraison effectu\xE9e : ${deliveredViaToolName}${job.chatId ? ` \u2192 chat ${job.chatId}` : ""}]`;
+    return resultText ? `${resultText}
+
+${notice}` : notice;
+  };
   let approvalPending = false;
   const approvalNudge = "[syst\xE8me] Tu es sur Telegram et une de tes actions vient de cr\xE9er une demande d'approbation : elle attend la validation de l'utilisateur avant de s'ex\xE9cuter. Avant que le job se mette en pause, appelle `telegram_send_message` pour dire \xE0 l'utilisateur, avec tes propres mots, quelle action tu as lanc\xE9e et que tu attends son approbation (il pourra valider directement depuis Telegram via les boutons \u2705/\u274C, ou depuis le dashboard). N'appelle PAS `return_result` \u2014 la mise en pause est automatique.";
+  const approvalGraceMsRaw = runnerEnv?.NODALAI_APPROVAL_GRACE_MS ?? Number(process.env["NODALAI_APPROVAL_GRACE_MS"]);
+  const approvalGraceMs = Number.isFinite(approvalGraceMsRaw) && approvalGraceMsRaw >= 0 ? approvalGraceMsRaw : 12e4;
   const suspendForApproval = async () => {
+    if (approvalGraceMs > 0) {
+      const pollIntervalMs = Math.max(1, Math.min(2e3, Math.floor(approvalGraceMs / 4)));
+      const deadline = Date.now() + approvalGraceMs;
+      const graceHbInterval = setInterval(() => {
+        void touchJob(db, jobId).catch(() => {
+        });
+      }, 6e4);
+      try {
+        while (Date.now() < deadline) {
+          await new Promise((resolve3) => setTimeout(resolve3, pollIntervalMs));
+          const [statusRow] = await db.select({ status: agentJobs.status }).from(agentJobs).where(eq5(agentJobs.id, jobId));
+          if (statusRow?.status === "cancelled") {
+            trace("grace_window_cancelled");
+            await cancelJob(db, jobId, runStats(), messages);
+            return { status: "cancelled" };
+          }
+          const openRows = await db.select().from(approvalRequests).where(
+            and4(eq5(approvalRequests.jobId, jobId), isNull(approvalRequests.executedAt))
+          ).orderBy(approvalRequests.requestedAt);
+          if (openRows.length === 0 || openRows.some((r) => r.status === "pending")) {
+            continue;
+          }
+          trace("grace_window_resolved_inline", { count: openRows.length });
+          const executed = await executeResolvedApprovals(openRows, messages);
+          messages = executed.messages;
+          if (executed.catastrophicRefusalMessage !== null) {
+            trace("resume_catastrophic_command_failed_job");
+            await failJob(
+              db,
+              jobId,
+              "catastrophic_command_refused",
+              runStats(),
+              messages,
+              executed.catastrophicRefusalMessage
+            );
+            return {
+              status: "failed",
+              error: "catastrophic_command_refused",
+              result: executed.catastrophicRefusalMessage
+            };
+          }
+          return "resumed_inline";
+        }
+      } finally {
+        clearInterval(graceHbInterval);
+      }
+    }
     await saveCheckpoint(db, jobId, {
       messages,
       turn,
@@ -53958,6 +54723,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
       servedProvider
     });
     await setJobStatus(db, jobId, "awaiting_approval");
+    await reviveJobIfApprovalResolvedDuringSuspend(db, jobId, runnerEnv);
     return { status: "awaiting_approval" };
   };
   const maxTotalTokensPerJob = (() => {
@@ -53971,7 +54737,11 @@ async function runJob(jobId, deps, runnerEnv, opts) {
     return Number.isFinite(n) && n > 0 ? n : DEFAULT_LIMITS.maxCostPerJobUsd;
   })();
   const compactionThreshold = (() => {
-    const ctxWindow = modelContextWindow(llmClient.config.provider, llmClient.config.model);
+    const ctxWindow = modelContextWindow(
+      llmClient.config.provider,
+      llmClient.config.model,
+      llmClient.config.contextWindow
+    );
     const fracRaw = Number(process.env["LLM_COMPACTION_FRACTION"]);
     const frac = Number.isFinite(fracRaw) && fracRaw > 0 && fracRaw < 1 ? fracRaw : 0.7;
     const absRaw = Number(process.env["LLM_COMPACTION_TOKENS"]);
@@ -54167,7 +54937,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
         },
         ...servedProvider ? { servedProvider } : {}
       });
-      const isDeliveryOnlyTurn = rawToolCalls.length > 0 && rawToolCalls.every((tc) => DELIVERY_TOOL_NAMES.has(tc.toolName));
+      const isDeliveryOnlyTurn = rawToolCalls.length > 0 && rawToolCalls.every((tc) => DELIVERY_TOOL_NAMES2.has(tc.toolName));
       consecutiveDeliveryOnlyTurns = isDeliveryOnlyTurn ? consecutiveDeliveryOnlyTurns + 1 : 0;
       if (consecutiveDeliveryOnlyTurns > DEFAULT_LIMITS.maxConsecutiveDeliveryTurns) {
         trace("delivery_spam_guard", { turn, consecutiveDeliveryOnlyTurns });
@@ -54197,7 +54967,12 @@ async function runJob(jobId, deps, runnerEnv, opts) {
       if (rawToolCalls.length === 0) {
         trace("no_tool_calls_branch", { turn, hasText: Boolean(response.text) });
         if (approvalPending) {
-          return await suspendForApproval();
+          const suspended = await suspendForApproval();
+          if (suspended === "resumed_inline") {
+            approvalPending = false;
+            continue;
+          }
+          return suspended;
         }
         const textContent = response.text ?? "";
         if (textContent) {
@@ -54240,7 +55015,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
               runnerEnv
             ).catch((e) => console.warn("[reflection]", e));
           }
-          return { status: "completed", result: textContent };
+          return { status: "completed", result: withDeliveryNotice(textContent) };
         }
         if (emptyTurnRetries < MAX_EMPTY_TURN_RETRIES) {
           emptyTurnRetries += 1;
@@ -54286,6 +55061,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
         entityId: job.entityId ?? "",
         db,
         jobChatId: job.chatId ?? null,
+        resolvedTelegramBotToken: inheritedRootBotToken ?? void 0,
         embeddingClient: deps.embeddingClient,
         workspaces: agentWorkspacesList,
         skillStoreDir: skillStore,
@@ -54451,6 +55227,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
                 entityId: job.entityId ?? "",
                 db,
                 jobChatId: job.chatId ?? null,
+                resolvedTelegramBotToken: inheritedRootBotToken ?? void 0,
                 embeddingClient: deps.embeddingClient,
                 workspaces: agentWorkspacesList,
                 skillStoreDir: skillStore,
@@ -54493,7 +55270,11 @@ async function runJob(jobId, deps, runnerEnv, opts) {
                 parentJobId: job.parentJobId ?? null,
                 task: job.task,
                 channel: job.channel,
-                chatId: job.chatId
+                chatId: job.chatId,
+                // Lot E (conversations) : le child délégué hérite du fil de
+                // conversation du parent — sans ça, la page Jobs rattacherait
+                // le sous-job à aucune conversation.
+                conversationId: job.conversationId ?? null
               };
               const preAssignSideResults = toolResultBlocks.map((b) => ({
                 type: "tool_result",
@@ -54567,8 +55348,9 @@ async function runJob(jobId, deps, runnerEnv, opts) {
           awaitingApproval = true;
           continue;
         }
-        if (toolResult.outcome === "success" && DELIVERY_TOOL_NAMES.has(call.name)) {
+        if (toolResult.outcome === "success" && DELIVERY_TOOL_NAMES2.has(call.name)) {
           telegramDelivered = true;
+          deliveredViaToolName = call.name;
         }
         if (toolResult.outcome === "success") {
           unresolvedToolFailures.delete(call.name);
@@ -54605,7 +55387,13 @@ async function runJob(jobId, deps, runnerEnv, opts) {
           messages = [...messages, { role: "user", content: approvalNudge }];
           continue;
         }
-        return await suspendForApproval();
+        const suspended = await suspendForApproval();
+        if (suspended === "resumed_inline") {
+          awaitingApproval = false;
+          approvalPending = false;
+          continue;
+        }
+        return suspended;
       }
       const isToolErrorBlock = (block) => {
         if (block.toolName === "return_result") return false;
@@ -54799,7 +55587,7 @@ async function runJob(jobId, deps, runnerEnv, opts) {
         trace("exit_completed_via_return_result", {
           propagatedResultLen: propagatedResult.length
         });
-        return { status: "completed", result: propagatedResult };
+        return { status: "completed", result: withDeliveryNotice(propagatedResult) };
       }
       if (toolResultBlocks.length > 0) {
         messages = [...messages, { role: "tool", content: toolResultBlocks }];
@@ -54914,6 +55702,16 @@ async function runJob(jobId, deps, runnerEnv, opts) {
       );
       return { status: "failed", error: `message_structure_invalid:${err.code}` };
     }
+    if (isContextOverflowError(err)) {
+      const win = modelContextWindow(
+        llmClient.config.provider,
+        llmClient.config.model,
+        llmClient.config.contextWindow
+      );
+      const code = `context_window_exceeded:${llmClient.config.model} (configured ~${win} tokens \u2014 set the model's real context window in LLM providers)`;
+      await failJob(db, jobId, code, runStats(), messages);
+      return { status: "failed", error: code };
+    }
     if (err instanceof Error) {
       const unavailableMatch = err.message.match(
         /Model tried to call unavailable tool ['"`]([^'"`]+)['"`]/i
@@ -55018,6 +55816,15 @@ async function resolveApprovalDecision(deps, runnerEnv, input) {
   const resumed = await deps.db.update(agentJobs).set({ status: "pending", updatedAt: /* @__PURE__ */ new Date() }).where(and4(eq5(agentJobs.id, jobId), eq5(agentJobs.status, "awaiting_approval"))).returning({ id: agentJobs.id });
   if (resumed.length === 0) {
     const [current] = await deps.db.select({ status: agentJobs.status }).from(agentJobs).where(eq5(agentJobs.id, jobId)).limit(1);
+    if (current?.status === "processing" || current?.status === "pending") {
+      return {
+        ok: true,
+        jobId,
+        decision: input.decision,
+        chatId: job.chatId ?? null,
+        resumed: "in_process"
+      };
+    }
     return { ok: false, code: "job_not_resumable", status: current?.status ?? null };
   }
   void triggerWorker(jobId, runnerEnv);
@@ -55025,7 +55832,8 @@ async function resolveApprovalDecision(deps, runnerEnv, input) {
     ok: true,
     jobId,
     decision: input.decision,
-    chatId: job.chatId ?? null
+    chatId: job.chatId ?? null,
+    resumed: "worker"
   };
 }
 
@@ -55055,7 +55863,8 @@ async function approveRoute(c, deps, runnerEnv) {
     if (result.code === "job_not_found") return c.json({ error: "job_not_found" }, 404);
     return c.json({ error: "approval_already_resolved", status: result.status }, 400);
   }
-  return c.json({ ok: true, jobId: result.jobId, status: "pending", decision }, 200);
+  const status = result.resumed === "in_process" ? "processing" : "pending";
+  return c.json({ ok: true, jobId: result.jobId, status, decision }, 200);
 }
 
 // src/cron/reset-orphans.ts
@@ -55347,13 +56156,19 @@ async function executeReadyTasks(db, deps, max2 = 5) {
     const runMemory = task.rootJobId ? await loadRunMemory(db, task.rootJobId, task.id, explicitDepIds) : "";
     const taskText = buildTaskText(task, runMemory);
     let childDepth = 0;
+    let childConversationId = null;
     if (task.rootJobId) {
-      const [creatorRow] = await db.select({ delegationDepth: agentJobs.delegationDepth, status: agentJobs.status }).from(agentJobs).where(eq5(agentJobs.id, task.rootJobId)).limit(1);
+      const [creatorRow] = await db.select({
+        delegationDepth: agentJobs.delegationDepth,
+        status: agentJobs.status,
+        conversationId: agentJobs.conversationId
+      }).from(agentJobs).where(eq5(agentJobs.id, task.rootJobId)).limit(1);
       if (creatorRow && CANCELLED_OR_TERMINAL.has(creatorRow.status ?? "")) {
         await db.update(agentTasks).set({ status: "cancelled", result: "root job cancelled", updatedAt: /* @__PURE__ */ new Date() }).where(eq5(agentTasks.id, task.id));
         continue;
       }
       childDepth = (creatorRow?.delegationDepth ?? 0) + 1;
+      childConversationId = creatorRow?.conversationId ?? null;
     }
     const jobRows = await db.insert(agentJobs).values({
       entityId: task.entityId,
@@ -55362,6 +56177,7 @@ async function executeReadyTasks(db, deps, max2 = 5) {
       task: taskText,
       parentJobId: task.rootJobId ?? void 0,
       delegationDepth: childDepth,
+      conversationId: childConversationId ?? void 0,
       status: "pending",
       messages: [{ role: "user", content: taskText }]
     }).returning({ id: agentJobs.id });
@@ -55592,8 +56408,15 @@ async function runScheduleTick(db, deps, max2 = 5) {
 }
 
 // src/cron/deliver-results.ts
+var TERMINAL_ROOT_STATUSES = ["cancelled", "completed", "failed"];
 async function findUndeliveredRootJobIds(db) {
-  const rows = await db.selectDistinct({ rootJobId: agentTasks.rootJobId }).from(agentTasks).innerJoin(agentJobs, eq5(agentJobs.id, agentTasks.rootJobId)).where(and4(isNotNull(agentTasks.rootJobId), isNull(agentJobs.completedAt)));
+  const rows = await db.selectDistinct({ rootJobId: agentTasks.rootJobId }).from(agentTasks).innerJoin(agentJobs, eq5(agentJobs.id, agentTasks.rootJobId)).where(
+    and4(
+      isNotNull(agentTasks.rootJobId),
+      isNull(agentJobs.completedAt),
+      notInArray(agentJobs.status, TERMINAL_ROOT_STATUSES)
+    )
+  );
   return rows.map((r) => r.rootJobId);
 }
 async function deliverCompletedRoots(db) {
@@ -55614,6 +56437,7 @@ async function deliverCompletedRoots(db) {
     const rootJob = rootJobRows[0];
     if (!rootJob) continue;
     if (rootJob.completedAt !== null) continue;
+    if (TERMINAL_ROOT_STATUSES.includes(rootJob.status ?? "")) continue;
     const complete = await checkRootJobComplete(rootJobId, db);
     if (!complete) continue;
     const taskRows = await db.select({
@@ -55636,8 +56460,10 @@ async function deliverCompletedRoots(db) {
     }).where(
       and4(
         eq5(agentJobs.id, rootJobId),
-        isNull(agentJobs.completedAt)
+        isNull(agentJobs.completedAt),
         // gate: only one tick wins
+        notInArray(agentJobs.status, TERMINAL_ROOT_STATUSES)
+        // gate: never resurrect a cancelled/terminal root
       )
     ).returning({ id: agentJobs.id });
     if (claimed.length === 0) {
@@ -56366,10 +57192,10 @@ async function runCronTickGuarded(deps, maxTasksPerTick = 5, maxTickMs = 30 * 6e
   }).finally(() => {
     if (watchdogFired) outstandingAbandoned--;
   });
-  const watchdog = new Promise((resolve2) => {
+  const watchdog = new Promise((resolve3) => {
     const timer = setTimeout(() => {
       watchdogFired = true;
-      resolve2("timeout");
+      resolve3("timeout");
     }, maxTickMs);
     if (typeof timer.unref === "function") timer.unref();
   });
@@ -56593,6 +57419,10 @@ ${message}` : instruction;
       status: "pending",
       channel: "dashboard",
       task: instruction,
+      // Jobs page grouping (migration 0059): this channel already has a
+      // real conversation entity (the dashboard sidebar thread) — stamp
+      // that id directly rather than re-deriving it from a gap heuristic.
+      conversationId,
       messages: [{ role: "user", content: workerContent }]
     }).returning({ id: agentJobs.id });
     const reply = text23;
@@ -56788,6 +57618,32 @@ function startCronTicker(deps, opts = {}) {
 import { writeFile as writeFile6, mkdir as mkdir5, readdir as readdir8, stat as stat9, unlink as unlink4 } from "node:fs/promises";
 import { join as join11 } from "node:path";
 import { homedir as homedir4 } from "node:os";
+
+// src/job/conversation-id.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+async function resolveConversationId(opts) {
+  const [prior] = await opts.db.select({
+    conversationId: agentJobs.conversationId,
+    createdAt: agentJobs.createdAt,
+    completedAt: agentJobs.completedAt
+  }).from(agentJobs).where(
+    and4(
+      eq5(agentJobs.entityId, opts.entityId),
+      eq5(agentJobs.agentId, opts.agentId),
+      eq5(agentJobs.channel, opts.channel),
+      eq5(agentJobs.chatId, opts.chatId)
+    )
+  ).orderBy(desc(agentJobs.createdAt)).limit(1);
+  if (prior?.conversationId) {
+    const deliveredAt = prior.completedAt ? new Date(prior.completedAt).getTime() : new Date(prior.createdAt).getTime();
+    if (Date.now() - deliveredAt < IDLE_RESET_MS) {
+      return prior.conversationId;
+    }
+  }
+  return randomUUID3();
+}
+
+// src/telegram/handler.ts
 async function handleTelegramUpdate(args) {
   const { update, receivingAgentId, receivingAgentEntityId, receivingAgentBotUsername, tx } = args;
   const message = update.message;
@@ -56889,12 +57745,20 @@ async function handleTelegramUpdate(args) {
   if (!taskText.trim() && hasPhoto) {
     taskText = "Image envoy\xE9e (sans l\xE9gende).";
   }
+  const conversationId = await resolveConversationId({
+    db: tx,
+    entityId: receivingAgentEntityId,
+    agentId: targetAgentId,
+    channel: "telegram",
+    chatId: String(chatId)
+  });
   const [job] = await tx.insert(agentJobs).values({
     entityId: receivingAgentEntityId,
     agentId: targetAgentId,
     channel: "telegram",
     task: taskText,
     chatId: String(chatId),
+    conversationId,
     status: "pending",
     // Text-only at insert; when there's a photo the poller upgrades this to a
     // multimodal [text + image] message after downloading the file.
@@ -57442,15 +58306,15 @@ async function sendAuthConfirmation(botToken, pending) {
 }
 function sleepWithAbort(ms, signal) {
   if (signal.aborted) return Promise.resolve();
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve3();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve3();
     };
     signal.addEventListener("abort", onAbort, { once: true });
   });