privateer-agent 0.11.0 → 0.12.0

package/src/config/moatManifest.ts

@@ -0,0 +1,71 @@
+// The moat's extension inventory, read from moatManifest.json — one list, four consumers.
+//
+// WHY A MANIFEST. Shipping an extension used to mean four edits in three files that
+// nothing connects: bin/privateer-launch.mjs's MANAGED array (removes the stale shim),
+// its shim() call (installs the new one), extensionsControl's RESERVED set (stops the
+// app managing it as a user package), and the profile's extensionFactories list. Miss
+// one and the failure is silent in a different way each time — a lingering shim pointing
+// at a deleted file, an extension that never loads, or a moat package the app offers to
+// uninstall. The launcher-vs-MANAGED pair had a test (tests/extensionLoad.test.ts) purely
+// to catch the omission; the RESERVED half had none, and had already drifted —
+// privateer-models and privateer-connect were shimmed but never reserved. Deriving all
+// four from one file makes the drift unrepresentable rather than tested-for.
+//
+// WHY JSON. bin/privateer-launch.mjs reads this too, and it runs BEFORE the pi patches
+// are applied, with no bundler and no dependencies — it can parse JSON and nothing else.
+// A .ts manifest would need the launcher to load tsx, which is exactly the ordering the
+// launcher exists to avoid.
+//
+// IMPORT-SAFETY: no Pi imports, no side effects — safe to load from anywhere, including
+// pre-boot and from a jiti-loaded extension (the readFileSync + import.meta.url pattern
+// is the one extensions/privateer-brand.ts already proves under Pi's loader).
+
+import { readFileSync } from "node:fs";
+
+/**
+ * One shipped extension. `entry` is a repo-relative path to a first-party extension;
+ * `dep` is a node_modules specifier as [packageName, ...pathSegments], resolved through
+ * the node_modules chain at launch (npm hoists, so a fixed path would miss). Exactly one
+ * of the two is set.
+ */
+export interface MoatShim {
+  name: string;
+  entry?: string;
+  dep?: string[];
+  note?: string;
+}
+
+interface Manifest {
+  shims: MoatShim[];
+  // Names we no longer install but still SWEEP from the agent dir on every launch, so a
+  // shim written by an older version can't linger and load a package we've since dropped.
+  retired: string[];
+  // Extra npm names the app must not manage: the scoped published names of packages we
+  // shim under a bare alias. A user hand-adding "@juicesharp/rpiv-web-tools" to settings
+  // "packages" would otherwise load a second copy alongside the launcher's shim.
+  reservedAliases: string[];
+}
+
+const manifest: Manifest = JSON.parse(
+  readFileSync(new URL("./moatManifest.json", import.meta.url), "utf8"),
+);
+
+/** Every extension the launcher installs a shim for, in load order. */
+export const MOAT_SHIMS: readonly MoatShim[] = Object.freeze(manifest.shims);
+
+/**
+ * Names the launcher clears from the agent dir's extensions/ before installing: everything
+ * we ship plus everything we used to ship. The launcher reads the JSON directly (it cannot
+ * import TS), so this is the TS-side mirror — tests/extensionLoad.test.ts asserts they agree.
+ */
+export function managedNames(): string[] {
+  return [...manifest.shims.map((s) => s.name), ...manifest.retired];
+}
+
+/**
+ * Names the app's extension manager must refuse to add or remove. A superset of the
+ * managed names: also the scoped npm names behind our bare aliases.
+ */
+export function reservedNames(): string[] {
+  return [...managedNames(), ...manifest.reservedAliases];
+}

package/src/harbor/index.ts

@@ -13,11 +13,9 @@ import {
 import { agentDir, configPath } from "../config/paths.ts";
 import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
-import { makePermissionGate, type GateController } from "../ext/permissionGate.ts";
-import { makePiPrivacyExtension } from "pi-privacy";
+import { type GateController } from "../ext/permissionGate.ts";
+import { moatResourceOptions } from "../config/moat.ts";
 import {
-  makeAccountProvider,
-  privateerChannel,
   rememberAccountCredential,
   dropPersistedAccountCredential,
 } from "../providers/account.ts";
@@ -33,10 +31,10 @@ import type { Workflow, Step } from "../workflows/schema.ts";
 import { readRunningPlatforms } from "../channels/status.ts";
 import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
 import { openJsonFromApp } from "../crypto/terminalUnseal.ts";
-import { verifyChannelSave, verifyOutboxKey } from "../crypto/accountVerify.ts";
+import { verifyChannelSave } from "../crypto/accountVerify.ts";
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
 import { authorizeControl } from "../remote/controlAuth.ts";
-import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke, defaultDeviceLabel } from "../auth/privateer.ts";
+import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke } from "../auth/privateer.ts";
 import {
   loadRoutines,
   upsertRoutine,
@@ -56,14 +54,14 @@ import { triggerError, computeNextRun, advanceAfterRun } from "../routines/trigg
 import { splitRoutineTools } from "../routines/toolSelect.ts";
 import { resolveMcpSelection, readMcpInventory, type ResolvedMcpTools } from "../mcp/toolNames.ts";
 import { deliver, type RelayPusher, type CloudPusher } from "../routines/delivery.ts";
-import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
+import { postOutbox as sealToOutbox } from "../outbox/cloudOutbox.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, sendToHarbor, describeRelay, formatDuration, HarborAlreadyRunningError, type IpcRequest, type IpcResponse, type RelayStatus } from "./ipc.ts";
 import { serializeBuild } from "./buildLock.ts";
-import { isHosted, publishRelayPub, webEnabled } from "../config/hosted.ts";
-import { markHarborDaemon } from "../config/harborDaemon.ts";
-import { markInlineMoat } from "../config/inlineMoat.ts";
-import { makeWebTools, WEB_TOOL_NAMES } from "../tools/web.ts";
+import { isHosted, publishRelayPub, webEnabled, mediaEnabled } from "../config/hosted.ts";
+import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
+import { COMPOSE_TOOL_NAMES } from "../tools/videoCompose.ts";
 
 // The safe, read-only toolset for unattended runs — Pi builtins with no
 // write/edit/bash, so a routine firing with nobody watching can't mutate the
@@ -79,23 +77,43 @@ const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 // the user hand-write an allow-list for it was the whole friction.
 const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
 
-// Resolve a run's builtin allow-list. An explicit list wins, minus any web tools when
-// web access is off — a routine saved while it was on must not silently reference a
-// tool that no longer registers.
+// Media generation (src/tools/media.ts) plus local composition (videoCompose.ts).
+//
+// Unlike the web tools these are deliberately NOT in the default allow-list, even with
+// the switch on. Generation writes files and spends real credit — cents an image, up to
+// a dollar a video clip — so an unattended routine gets them only by NAMING them, which
+// makes "this routine can bill me for video" a decision someone made rather than a
+// default they inherited. `media_capabilities` is free and read-only but stays with its
+// siblings: on its own it would be a tool that only ever reports what the run can't do.
+// Composition (video_compose) is deliberately NOT in this list: it is local ffmpeg work
+// with no account, no network and no spend, so it stays grantable even with generation
+// switched off — finishing the clips a previous run produced is exactly when that
+// matters. See MEDIA_ALL for what actually gets registered.
+const MEDIA_GEN_TOOLS: string[] = [...MEDIA_TOOL_NAMES];
+const MEDIA_ALL: string[] = [...MEDIA_TOOL_NAMES, ...COMPOSE_TOOL_NAMES];
+
+// Resolve a run's builtin allow-list. An explicit list wins, minus any web or media
+// tools whose switch is off — a routine saved while one was on must not silently
+// reference a tool that no longer registers.
 function builtinToolsFor(explicit: string[]): string[] {
   const web = webEnabled();
+  const media = mediaEnabled();
   if (explicit.length > 0) {
-    return web ? explicit : explicit.filter((t) => !WEB_TOOLS.includes(t));
+    return explicit.filter((t) => (web || !WEB_TOOLS.includes(t)) && (media || !MEDIA_GEN_TOOLS.includes(t)));
   }
   return web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS];
 }
 
+/** Every media tool name a routine may name, for the app's tool picker / docs. */
+export function mediaToolNames(): string[] {
+  return mediaEnabled() ? [...MEDIA_ALL] : [...COMPOSE_TOOL_NAMES];
+}
+
 const TICK_MS = 60_000; // scan for due routines once a minute
 // Harbor hosted mode (isHosted): suspend after this much idle time with no work,
 // and stay up if a routine is due within the lead window (avoids suspend→wake churn).
 const HOSTED_IDLE_MS = Number(process.env.HARBOR_IDLE_MS) || 5 * 60_000;
 const HOSTED_SUSPEND_MIN_LEAD_MS = Number(process.env.HARBOR_SUSPEND_MIN_LEAD_MS) || 2 * 60_000;
-const MAX_CLOUD_PLAINTEXT = 45_000;
 // How long a workflow `human_gate` (or a script-approval prompt) waits for the app to
 // answer before it fail-closes to "no response" (the runner then defers the run). Bounds
 // a stuck graph from pinning a `running` slot forever when the controller wanders off.
@@ -266,8 +284,6 @@ export class Harbor {
     return "queued";
   };
 
-  private outboxPub?: Uint8Array;
-
   private readonly pushCloud: CloudPusher = async (routine, content, status) => {
     const at = new Date().toISOString();
     if (await this.postOutbox(routine.name, at, status, content)) return "sent";
@@ -276,16 +292,6 @@ export class Harbor {
   };
 
   async start(): Promise<void> {
-    // Mark the process before anything can create a session: the shipped TUI extensions
-    // are auto-discovered from the shared agent dir into every session we run, and the
-    // gate one has to stand its relay file tools down here so a live task's own pair
-    // (bound to that task's live relay) isn't shadowed. See config/harborDaemon.ts.
-    markHarborDaemon();
-    // Same reason, one step further: every session this process builds (routines,
-    // workflows, submitted tasks, live spawns) wires its own makePermissionGate, so
-    // the discovered gate must not install a second one on top of it. See
-    // config/inlineMoat.ts for what that collision costs.
-    markInlineMoat();
     // Single-instance lock FIRST, before any other side effect: binding the IPC
     // socket is the machine's mutex. If a live harbor already holds it this throws
     // HarborAlreadyRunningError — two harbors under one ~/.privateer share a single
@@ -566,55 +572,13 @@ export class Harbor {
   }
 
   // ── Cloud outbox (sealed store-and-forward) ────────────────────────────────
-
-  private async ensureOutboxPub(): Promise<Uint8Array | undefined> {
-    if (this.outboxPub) return this.outboxPub;
-    try {
-      const res = await apiRequest("/api/outbox/pubkey");
-      if (!res.ok) return undefined;
-      const data = (await res.json()) as { outboxPublicKey?: string | null; outboxPublicKeySig?: string | null };
-      if (!data.outboxPublicKey || !data.outboxPublicKeySig) return undefined;
-      // The key comes from the UNTRUSTED server. Verify the account's signature over it
-      // against the account signing key we pinned at link — otherwise a malicious server
-      // could substitute a key it controls and read every result we seal. Fail closed
-      // (no pin, missing sig, or bad sig ⇒ don't seal): the `cloud` channel then falls
-      // back to a local notice, so the result is deferred/kept, never leaked.
-      const accountPub = loadAccountSignKey();
-      if (!accountPub) return undefined;
-      if (!verifyOutboxKey(accountPub, data.outboxPublicKey, data.outboxPublicKeySig)) return undefined;
-      this.outboxPub = decodeAccountPublicKey(data.outboxPublicKey);
-      return this.outboxPub;
-    } catch {
-      return undefined;
-    }
-  }
-
-  // This machine's origin tag, embedded (E2EE) in every sealed result so the app can
-  // show WHICH box/environment produced it — the outbox record itself is account-only,
-  // so attribution can only live inside the sealed blob (where hostnames are allowed;
-  // the server never sees it). `id` is this install's stable relay id; `label` is the
-  // hostname-based device name. Cached — it never changes for the process lifetime.
-  private originCache?: { id: string; label: string };
-  private machineOrigin(): { id: string; label: string } {
-    if (!this.originCache) this.originCache = { id: routineRelayId(), label: defaultDeviceLabel() };
-    return this.originCache;
-  }
+  // The sealing itself now lives in ../outbox/cloudOutbox.ts — an interactive
+  // remote-drive session needs the same path when the app isn't there to receive a
+  // finished turn, and two copies of an E2EE wire format is one too many. Same
+  // caches, same fail-closed key verification; this is just the harbor's caller.
 
   private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: OutboxKind = "routine"): Promise<boolean> {
-    const pub = await this.ensureOutboxPub();
-    if (!pub) return false;
-    const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
-    const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body, origin: this.machineOrigin() });
-    try {
-      const res = await apiRequest("/api/outbox", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ sealed }),
-      });
-      return res.ok;
-    } catch {
-      return false;
-    }
+    return sealToOutbox(name, at, status, content, kind);
   }
 
   private async flushPendingCloud(): Promise<void> {
@@ -790,50 +754,22 @@ export class Harbor {
           return "deny";
         },
       };
-      // MCP adapter (Phase 5): registers the tools from the shared agent/mcp.json — the
-      // same projection the app's MCP manager (mcpControl) writes over the relay. No
-      // servers configured → a no-op. Dynamically imported so it loads only when a
-      // session actually runs (Pi is already booted by here). The specifier is a
-      // variable so tsc treats it as Promise<any> and doesn't pull the third-party
-      // adapter's own .ts into our typecheck — same intent as the desktop's agentImport.
-      const mcpAdapterSpec = "pi-mcp-adapter";
-      const { default: mcpAdapter } = await import(mcpAdapterSpec);
+      // Every extension this session gets, in the one canonical order — including the MCP
+      // adapter (Phase 5), the web/media capability shaping, and the filter that ignores
+      // any moat shim an older release left in the shared agent dir (releases up to 0.11
+      // installed one per extension; the launcher sweeps them, but a daemon can outlive
+      // the launch that would have). See config/moat.ts.
+      const moat = await moatResourceOptions({ kind: "harbor-session", gate });
+      // MCP_DIRECT_TOOLS is read by the adapter when its factory RUNS, inside
+      // createAgentSessionServices — so it has to wrap the session creation, not the
+      // moatResourceOptions() call that imported it.
       const prevDirect = process.env.MCP_DIRECT_TOOLS;
       process.env.MCP_DIRECT_TOOLS = directTools.length > 0 ? directTools.join(",") : "__none__";
       try {
         return await createAgentSessionServices({
           cwd,
           agentDir: agentDir(),
-          resourceLoaderOptions: {
-            extensionFactories: [
-              makePermissionGate(gate),
-              // Per-model verified-TEE capability for pi-privacy's /models picker: show
-              // Privateer's TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE"
-              // when logged in; ZDR-channel models stay at their honest floor. The live
-              // verdict still comes from accountPosture on select — this only lifts the label.
-              //
-              // ORDER MATTERS: pi-privacy's own catalog registers a `privateer`
-              // provider (its PUBLIC developer-key channel, one seed model), and Pi's
-              // registerProvider REPLACES a provider's models and request config. It
-              // must stay ABOVE makeAccountProvider() so the ACCOUNT channel lands last
-              // — otherwise the default model stops resolving and requests go to
-              // api.privateer.pro/v1 instead of /api/agent/v1. (The TUI hits this
-              // through extension discovery, where the order isn't ours to choose;
-              // extensions/privateer-privacy.ts re-asserts the account registration
-              // there. See registerAccountModels.)
-              makePiPrivacyExtension({
-                privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-              }),
-              makeAccountProvider(),
-              // Web access (src/tools/web.ts), when the agent is allowed it. Registered
-              // here rather than picked up from extensions/ because the harbor never
-              // installs the launcher's shims. Omitting the factory — not just dropping
-              // the names from the allow-list — is what makes "web off" mean the tools
-              // don't exist for this run at all.
-              ...(webEnabled() ? [makeWebTools()] : []),
-              mcpAdapter,
-            ] as any,
-          },
+          resourceLoaderOptions: moat as any,
         });
       } finally {
         if (prevDirect === undefined) delete process.env.MCP_DIRECT_TOOLS;

package/src/outbox/cloudOutbox.ts

@@ -0,0 +1,95 @@
+// The cloud outbox sender — sealed E2EE store-and-forward from this machine to
+// the account's app.
+//
+// Lifted out of the harbor (which owned it privately) because it is no longer only
+// the harbor's: an INTERACTIVE remote-drive session needs it too. When the app is
+// closed — or its socket is simply gone — a driven turn still finishes, and until
+// now its answer went nowhere: the relay drops frames with no controller attached,
+// so the reply was written to a socket nobody was reading. Sealing it here puts it
+// in the account's Inbox instead (see src/cli/chat.ts → deliverUnwatchedTurn).
+//
+// The terminal holds NO account key material: it seals TO the account's published
+// X25519 public key and can never open what it (or any other terminal) wrote. That
+// key comes from the UNTRUSTED server, so it is only used once the account's Ed25519
+// signature over it verifies against the key pinned at link time. Fail closed: no
+// pin, no signature, or a bad signature ⇒ we don't seal at all, and the caller falls
+// back to its own durable channel (a queue, a file, a notice).
+//
+// Module-level caches (pubkey, machine origin) — one per process, exactly like the
+// per-instance caches this replaced.
+
+import { apiRequest, defaultDeviceLabel } from "../auth/privateer.ts";
+import { loadAccountSignKey } from "../crypto/accountTrust.ts";
+import { verifyOutboxKey } from "../crypto/accountVerify.ts";
+import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
+import { routineRelayId, type OutboxKind } from "../routines/store.ts";
+
+export type { OutboxKind };
+
+// Plaintext cap per sealed item. The server rejects anything over ~128 KB of
+// base64; this keeps us well inside that with room for the envelope, and matches
+// the mailbox's purpose — summaries and answers, not transcripts.
+export const MAX_CLOUD_PLAINTEXT = 45_000;
+
+let outboxPub: Uint8Array | undefined;
+let originCache: { id: string; label: string } | undefined;
+
+/** Fetch + verify the account's outbox public key (cached for the process). */
+export async function ensureOutboxPub(): Promise<Uint8Array | undefined> {
+  if (outboxPub) return outboxPub;
+  try {
+    const res = await apiRequest("/api/outbox/pubkey");
+    if (!res.ok) return undefined;
+    const data = (await res.json()) as { outboxPublicKey?: string | null; outboxPublicKeySig?: string | null };
+    if (!data.outboxPublicKey || !data.outboxPublicKeySig) return undefined;
+    // Verify the account's signature over the key against the signing key pinned at
+    // link — otherwise a malicious server could substitute a key it controls and read
+    // every result we seal.
+    const accountPub = loadAccountSignKey();
+    if (!accountPub) return undefined;
+    if (!verifyOutboxKey(accountPub, data.outboxPublicKey, data.outboxPublicKeySig)) return undefined;
+    outboxPub = decodeAccountPublicKey(data.outboxPublicKey);
+    return outboxPub;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * This machine's origin tag, embedded (E2EE) in every sealed result so the app can
+ * show WHICH box produced it. The outbox record itself is account-only, so attribution
+ * can only live inside the sealed blob — where a hostname is allowed, since the server
+ * never sees it. `id` is this install's stable relay id; `label` the device name.
+ */
+export function machineOrigin(): { id: string; label: string } {
+  if (!originCache) originCache = { id: routineRelayId(), label: defaultDeviceLabel() };
+  return originCache;
+}
+
+/**
+ * Seal one result to the account outbox and POST the ciphertext. Returns whether the
+ * server accepted it; false covers every failure (no verified key, offline, rejected)
+ * and means the caller must fall back to its own durable channel.
+ */
+export async function postOutbox(
+  name: string,
+  at: string,
+  status: "ok" | "error",
+  content: string,
+  kind: OutboxKind = "routine",
+): Promise<boolean> {
+  const pub = await ensureOutboxPub();
+  if (!pub) return false;
+  const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
+  const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body, origin: machineOrigin() });
+  try {
+    const res = await apiRequest("/api/outbox", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ sealed }),
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}

package/src/permissions/classify.ts

@@ -160,6 +160,42 @@ const EDIT_TOOLS = new Set(["edit", "edit_file", "str_replace", "str_replace_edi
 const WRITE_TOOLS = new Set(["write", "write_file", "create_file", "create", "save_attachment"]);
 const BASH_TOOLS = new Set(["bash", "shell", "run", "exec", "sh"]);
 
+// Media tools (src/tools/media.ts, src/tools/videoCompose.ts). See the block in
+// classifyToolCall — they are writes against a named output file, and the generation
+// ones cost real money, which is what the title says out loud.
+const MEDIA_TOOLS = new Set([
+  "generate_image",
+  "generate_video",
+  "generate_speech",
+  "generate_music",
+  "media_capabilities",
+  "video_compose",
+]);
+// The generation tools egress model-chosen text (and any input file bytes) to
+// Privateer's servers and onward to a provider — generate_music to one with no
+// zero-retention endpoint — and each spends the account's credit. That egress +
+// irreversible spend must never be auto-approved: classified as a plain `write`
+// they were swallowed by acceptEdits (mode.ts:45) and by bypass/no-quarter, so a
+// single injected call could leak context and bill the account with no dialog.
+// `alwaysAsk` sits ABOVE bypass/acceptEdits/allowlist (mode.ts:37) and is never
+// remembered, so every generation is a fresh human decision. video_compose is
+// excluded on purpose — it is local ffmpeg, no egress and no spend — and
+// media_capabilities is a read.
+const MEDIA_GEN_TOOLS = new Set([
+  "generate_image",
+  "generate_video",
+  "generate_speech",
+  "generate_music",
+]);
+const MEDIA_TITLES: Record<string, string> = {
+  generate_image: "Generate an image (billed to your Privateer account)",
+  generate_video: "Generate a video (billed to your Privateer account)",
+  generate_speech: "Generate speech (billed to your Privateer account)",
+  generate_music: "Generate music (billed; music prompts have no zero-retention option)",
+  video_compose: "Compose video/audio locally",
+  media_capabilities: "Read media capabilities",
+};
+
 export function classifyToolCall(
   toolName: string,
   input: unknown,
@@ -189,6 +225,83 @@ export function classifyToolCall(
     };
   }
 
+  // Media generation (src/tools/media.ts) and local composition (videoCompose.ts).
+  //
+  // Left to the unknown-tool branch at the bottom these classify as bash-kind, which
+  // prompts with a JSON blob nobody can read and — worse — DENIES outright in plan and
+  // readonly mode, where a media call is exactly as legitimate as any other write.
+  // They are writes: each produces one named file, and the generation ones also spend
+  // the account's credit, so the prompt should name the file and the cost.
+  //
+  // `outside` covers BOTH directions. The output is the obvious one. The inputs matter
+  // just as much for the generation tools: `images: ["~/.ssh/id_rsa.png"]` would upload
+  // a file from outside scope to our servers, so an out-of-scope INPUT has to prompt
+  // even when the output lands neatly in cwd.
+  if (MEDIA_TOOLS.has(name)) {
+    const compose = name === "video_compose";
+    const inputs = [
+      ...(Array.isArray(obj.inputs) ? (obj.inputs as unknown[]).map(str) : []),
+      str(obj.input),
+      str(obj.audio),
+      ...(Array.isArray(obj.images) ? (obj.images as unknown[]).map(str) : []),
+      str(obj.firstFrame),
+      str(obj.lastFrame),
+    ].filter(Boolean);
+    // Resolve each input once, then flag the two ways an input is sensitive: it leaves
+    // the working directory, or it is a guarded file (.env, keys, credentials, …). The
+    // generation tools base64 every input up to our servers, so a PROTECTED input is a
+    // credential-exfil risk even when the output lands neatly in cwd — and the human
+    // approving what looks like a thumbnail has to see which file is being read. Both
+    // therefore feed `protected`/`outside` and are named in the prompt detail below.
+    const resolvedInputs = inputs.map((p) => resolveInCwd(scope.cwd, p));
+    const outsideInputs = resolvedInputs.filter((a) => isOutsideScope(scope, a));
+    const protectedInputs = resolvedInputs.filter((a) => isProtectedPath(a));
+
+    const outPath = str(obj.path ?? obj.output);
+    // `probe` reads and writes nothing; so does any composition call with no output
+    // (which the tool itself rejects). Gate those only when they touch a sensitive input.
+    if (!outPath) {
+      if (compose || name === "media_capabilities") {
+        const flagged = protectedInputs[0] ?? outsideInputs[0];
+        if (!flagged) return null;
+        return {
+          tool: toolName,
+          kind: "read",
+          title: protectedInputs.length > 0 ? "Read a protected file" : "Read outside working directory",
+          detail: flagged,
+          protected: protectedInputs.length > 0,
+          outside: outsideInputs.length > 0,
+          path: flagged,
+        };
+      }
+      return unknownTarget(toolName, "write"); // a generation call with no destination
+    }
+
+    const absOut = resolveInCwd(scope.cwd, outPath);
+    const outputOutside = isOutsideScope(scope, absOut);
+    const outside = outputOutside || outsideInputs.length > 0;
+    // Name the sensitive input in the prompt — protected first (the more dangerous
+    // disclosure), then outside-scope. Base target is the output, absolute when it
+    // itself leaves cwd, else the path the caller wrote.
+    const inputNote = protectedInputs.length > 0
+      ? ` (reads protected file ${protectedInputs[0]}${protectedInputs.length > 1 ? ` +${protectedInputs.length - 1} more` : ""})`
+      : outsideInputs.length > 0
+        ? ` (reads ${outsideInputs[0]}, outside the working directory)`
+        : "";
+    return {
+      tool: toolName,
+      kind: "write",
+      title: outside
+        ? `${MEDIA_TITLES[name]} outside working directory`
+        : MEDIA_TITLES[name],
+      detail: `${outputOutside ? absOut : outPath}${inputNote}`,
+      protected: isProtectedPath(absOut) || protectedInputs.length > 0,
+      outside,
+      alwaysAsk: MEDIA_GEN_TOOLS.has(name),
+      path: absOut,
+    };
+  }
+
   // Shell — the whole command is the detail (danger scanning runs on it).
   if (BASH_TOOLS.has(name)) {
     const command = str(obj.command ?? obj.cmd ?? obj.script);