@bendyline/gezel-service 1.0.4 → 1.0.5

package/dist/bin/gezeld.js

@@ -9559,7 +9559,7 @@ __export(bootstrap_exports, {
   reconcileSystemToolsetFromDisk: () => reconcileSystemToolsetFromDisk,
   runSystemBootstrap: () => runSystemBootstrap
 });
-import { createHash as createHash38, randomUUID as randomUUID25 } from "crypto";
+import { createHash as createHash39, randomUUID as randomUUID25 } from "crypto";
 import { existsSync as existsSync23 } from "fs";
 import { mkdir as mkdir51, open as open5, readFile as readFile62, rm as rm34, writeFile as writeFile23 } from "fs/promises";
 import { join as join85 } from "path";
@@ -9955,7 +9955,7 @@ async function downloadWithIntegrity(url, dest, integrity, opts = {}) {
   if (!["sha256", "sha384", "sha512"].includes(algo)) {
     throw new Error(`unsupported integrity algorithm: ${algo}`);
   }
-  const hash = createHash38(algo);
+  const hash = createHash39(algo);
   const request = await fetchBounded(url, DOWNLOAD_TIMEOUT_MS, opts.signal);
   const handle = await open5(dest, "wx", 384);
   try {
@@ -11758,7 +11758,7 @@ var ChatEventBus = class {
 };
 
 // src/chat/manager.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash12, randomUUID as randomUUID7 } from "crypto";
 import { createRequire } from "module";
 import { join as join28 } from "path";
 import {
@@ -27074,7 +27074,12 @@ var LlamaCppSession = class extends StreamingSessionBase {
         if (toolCalls.length > 0) {
           const normalized2 = normalizeMalformedStructuredToolCalls(
             toolCalls,
-            collectKnownToolNames()
+            collectKnownToolNames(),
+            // A malformed write at the output ceiling is not repairable: the
+            // missing JSON tail may also be missing file bytes. Executing the
+            // loose prefix can silently replace a complete file with a
+            // truncated one. Valid, fully parseable calls remain eligible.
+            finishReason !== "length"
           );
           toolCalls = normalized2.toolCalls;
           malformedStructuredCallIds = new Set(normalized2.sanitizedIds);
@@ -27951,7 +27956,7 @@ var ToolCallAccumulator = class {
     }));
   }
 };
-function normalizeMalformedStructuredToolCalls(toolCalls, knownToolNames) {
+function normalizeMalformedStructuredToolCalls(toolCalls, knownToolNames, allowMalformedWriteRepair = true) {
   const repaired = [];
   const sanitized = [];
   const sanitizedIds = [];
@@ -27962,11 +27967,7 @@ function normalizeMalformedStructuredToolCalls(toolCalls, knownToolNames) {
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return call;
     } catch {
     }
-    const repairedArgs = tryRepairMalformedWriteToolArguments(
-      call.function.name,
-      raw,
-      knownToolNames
-    );
+    const repairedArgs = allowMalformedWriteRepair ? tryRepairMalformedWriteToolArguments(call.function.name, raw, knownToolNames) : null;
     if (repairedArgs) {
       repaired.push({
         name: call.function.name,
@@ -32128,6 +32129,7 @@ function buildLlamaCppEngineArgs(input) {
     ggufHasMtp,
     installedDraftModelPath,
     reasoningFormat,
+    reasoningPreserve,
     architecture,
     modelId,
     swaFullAutoFits
@@ -32175,6 +32177,7 @@ function buildLlamaCppEngineArgs(input) {
     if (typeof nMax === "number") args.push("--spec-draft-n-max", String(nMax));
   }
   if (reasoningFormat) args.push("--reasoning-format", reasoningFormat);
+  if (reasoningPreserve) args.push("--reasoning-preserve");
   if (config.llamaCppExtraArgs) {
     for (const [rawKey, value] of Object.entries(config.llamaCppExtraArgs)) {
       if (value === false) continue;
@@ -32495,6 +32498,31 @@ function fitsSwaFullInFastMemory(input) {
   return Number.isFinite(required) && Number.isFinite(available) && required <= available;
 }
 
+// src/providers/llama-cpp/reasoning-launch.ts
+var POSITIVE_INTEGER = /^[1-9]\d*$/;
+function parseReasoningPreserveEnv(raw) {
+  const normalized2 = raw?.trim().toLowerCase();
+  return normalized2 === "1" || normalized2 === "true";
+}
+function parseReasoningBudgetEnv(raw) {
+  const normalized2 = raw?.trim();
+  if (!normalized2) return void 0;
+  if (!POSITIVE_INTEGER.test(normalized2)) {
+    throw new Error("GEZEL_LLAMA_REASONING_BUDGET_TOKENS must be a positive integer");
+  }
+  const parsed = Number(normalized2);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new Error("GEZEL_LLAMA_REASONING_BUDGET_TOKENS exceeds the safe integer range");
+  }
+  return parsed;
+}
+function reasoningLaunchOverridesFromEnv(env = process.env) {
+  return {
+    preserve: parseReasoningPreserveEnv(env.GEZEL_LLAMA_REASONING_PRESERVE),
+    budgetTokens: parseReasoningBudgetEnv(env.GEZEL_LLAMA_REASONING_BUDGET_TOKENS)
+  };
+}
+
 // src/providers/llama-cpp/spec-draft.ts
 async function resolveSpecDraft(input) {
   const { perModel, configSpecType, configDraftModelPath, resolveDraftPath } = input;
@@ -32553,6 +32581,8 @@ async function buildLlamaCppProvider(opts) {
   const { config, affinity, home } = opts;
   const externalBaseUrl = opts.modelOverride ? void 0 : process.env.GEZEL_LLAMA_SERVER_URL ?? config.llamaCppBaseUrl;
   const binary = process.env.GEZEL_LLAMA_SERVER_BIN;
+  const reasoningLaunchOverrides = reasoningLaunchOverridesFromEnv();
+  const reasoningPreserve = reasoningLaunchOverrides.preserve;
   const defaultModelId = opts.modelOverride?.modelId ?? config.defaultModel?.["llama-cpp"];
   const configuredSlots = config.providerConcurrency?.["llama-cpp"];
   const envNumCtx = (() => {
@@ -32575,6 +32605,7 @@ async function buildLlamaCppProvider(opts) {
     // rate for its own default engine — throughput was reachable only by
     // scraping stdout from the eval harness.
     includeUsageInStream: true,
+    replayReasoningContent: reasoningPreserve,
     // External-baseUrl default; the supervised path overrides this with the
     // auto-sized `slots` computed below (after the model resolves).
     concurrency: configuredSlots ?? 2,
@@ -32765,10 +32796,12 @@ async function buildLlamaCppProvider(opts) {
   const slotSavePath = replicaSuffix ? join18(llamaCacheRoot, llamaFingerprint, replicaSuffix) : join18(llamaCacheRoot, llamaFingerprint);
   await mkdirAsync(slotSavePath, { recursive: true }).catch(() => {
   });
-  const reasoningBudgetTokens = opts.catalog ? await resolveCatalogReasoningBudget(
+  const catalogReasoningBudgetTokens = opts.catalog ? await resolveCatalogReasoningBudget(
     opts.catalog,
     opts.modelOverride?.modelId ?? defaultModelId
   ) : void 0;
+  const reasoningBudgetTokens = reasoningLaunchOverrides.budgetTokens ?? catalogReasoningBudgetTokens;
+  const reasoningBudgetSource = reasoningLaunchOverrides.budgetTokens !== void 0 ? "env" : catalogReasoningBudgetTokens !== void 0 ? "catalog" : "unbounded";
   const specDraft = await resolveSpecDraft({
     perModel: manifestEngineConfig,
     configSpecType: config.llamaCppSpecType,
@@ -33158,6 +33191,7 @@ async function buildLlamaCppProvider(opts) {
         // disables llama-server's chat-template output parsing so mangled
         // model output reaches `delta.content` for provider-side salvage.
         reasoningFormat: process.env.GEZEL_LLAMA_REASONING_FORMAT?.trim() || void 0,
+        reasoningPreserve,
         architecture: modelCatalogInfo?.architecture,
         modelId: defaultModelId ?? void 0,
         swaFullAutoFits
@@ -33266,6 +33300,9 @@ async function buildLlamaCppProvider(opts) {
           batchSize: lastArgValue(resolvedAdvancedArgs, "--batch-size") ?? "default",
           ubatchSize: lastArgValue(resolvedAdvancedArgs, "--ubatch-size") ?? "default",
           flashAttention: lastArgValue(resolvedAdvancedArgs, "--flash-attn") ?? "default",
+          reasoningBudgetTokens: reasoningBudgetTokens ?? "unbounded",
+          reasoningBudgetSource,
+          reasoningPreserve,
           cudaGraphs: process.env.GGML_CUDA_DISABLE_GRAPHS ? "disabled-by-env" : "default"
         },
         env: {
@@ -36054,14 +36091,14 @@ async function buildMlxProvider(opts) {
   const cacheBudgetMb = Math.min(config.cacheBudgetMb?.mlx ?? ramAwareDefaultMb, mlxKvHeadroomMb);
   const mlxReplicaSuffix = opts.modelOverride && opts.modelOverride.replicaIdx > 0 ? `replica-${opts.modelOverride.replicaIdx}` : "";
   const cacheRoot = mlxReplicaSuffix ? join21(store.homePath, "engines", "mlx", "cache", mlxReplicaSuffix) : join21(store.homePath, "engines", "mlx", "cache");
-  const { createHash: createHash47 } = await import("crypto");
+  const { createHash: createHash48 } = await import("crypto");
   const fingerprintInput = [
     modelCatalogInfo?.id ?? defaultModelId ?? modelDir,
     modelCatalogInfo?.catalogVersion ?? "",
     modelCatalogInfo?.installedAt ?? "",
     modelDir
   ].join("::");
-  const modelFingerprint = createHash47("sha256").update(fingerprintInput, "utf8").digest("hex").slice(0, 24);
+  const modelFingerprint = createHash48("sha256").update(fingerprintInput, "utf8").digest("hex").slice(0, 24);
   const diskCacheBudgetMb = config.mlxDiskCacheBudgetMb ?? 8192;
   const mlxIdleMs = config.localEngineIdleTimeoutMs ?? DEFAULT_LOCAL_ENGINE_IDLE_TIMEOUT_MS3;
   const mlxFreezeMs = Math.floor(mlxIdleMs / 2);
@@ -46659,10 +46696,12 @@ var ChatManager = class {
    */
   afterSessionIdle = /* @__PURE__ */ new Map();
   /**
-   * One live async file handoff per sender/target/project/path. Models can
+   * One live async file handoff per sender/target/project/path/intent. Models can
    * emit the same `message_gezel` call several times while the sender turn
    * is still active; joining that work prevents a parked-send burst from
-   * replaying the same assignment into the recipient session.
+   * replaying the same assignment into the recipient session. A later
+   * validator repair for a file that was originally missing is distinct work
+   * and must never join the older create request.
    */
   inflightFileHandoffs = /* @__PURE__ */ new Map();
   /** Set once {@link shutdown} starts so deferred watchdogs don't fire into a tearing-down manager. */
@@ -48542,7 +48581,8 @@ ${stepArc}
       args.fromSessionId ?? args.fromGezelId,
       target.id,
       projectId,
-      normalizeExpectedDeliverablePath(requestedFilePath)
+      normalizeExpectedDeliverablePath(requestedFilePath),
+      fileHandoffIntentKey(args.text)
     ].join("\0") : null;
     const pendingHandoff = fileHandoffKey ? this.inflightFileHandoffs.get(fileHandoffKey) : void 0;
     if (pendingHandoff) return { ...pendingHandoff, deduplicated: true };
@@ -48583,7 +48623,7 @@ ${stepArc}
     const seed = `[Message from ${fromName}]: ${args.text}${deliverableAnnotation}`;
     const failureNotice = { sent: false };
     const resolvedFromSessionId = args.fromSessionId ?? (target.id === args.fromGezelId ? null : await this.ensureOrCreateSession({ gezelId: args.fromGezelId, projectId }).then((s) => s.id).catch(() => null));
-    if (resolvedFromSessionId && resolvedFromSessionId !== session.id) {
+    if (!args.suppressReply && resolvedFromSessionId && resolvedFromSessionId !== session.id) {
       this.attachReplyListener({
         targetSessionId: session.id,
         fromSessionId: resolvedFromSessionId,
@@ -50026,20 +50066,36 @@ ${peek.userText}`;
         return this.runFixedFunctionSend(sessionId2, userText, opts);
       }
     }
+    const preflightScope = ffRecord ? {
+      sessionId: sessionId2,
+      gezelId: ffRecord.gezelId,
+      projectId: ffRecord.projectId
+    } : void 0;
+    const coldStartPending = preflightScope && !this.states.get(sessionId2)?.session;
+    if (preflightScope && coldStartPending) {
+      this.events.publish(preflightScope, {
+        type: "user_message_pending",
+        preview: userText.length > 160 ? `${userText.slice(0, 157)}\u2026` : userText
+      });
+    }
     const fail2 = (err) => {
       const message = err instanceof Error ? err.message : String(err);
       log52.error("error:", message);
+      const publish = (event) => {
+        if (preflightScope) this.events.publish(preflightScope, event);
+        else this.events.publishSessionOnly(sessionId2, event);
+      };
       if (inflightTurn.cancelled) {
-        this.events.publishSessionOnly(sessionId2, { type: "cancelled" });
+        publish({ type: "cancelled" });
       } else {
         const detail = describeTurnError(err);
-        this.events.publishSessionOnly(sessionId2, {
+        publish({
           type: "error",
           error: redactCredentials4(message),
           ...detail ? { errorDetail: detail } : {}
         });
       }
-      this.events.publishSessionOnly(sessionId2, { type: "done" });
+      publish({ type: "done" });
       throw err;
     };
     if (ffRecord) {
@@ -56356,6 +56412,14 @@ function messageExpressesModifyIntent(text) {
     )
   );
 }
+function fileHandoffIntentKey(text) {
+  const repair = messageExpressesModifyIntent(text) || /\[scenario check\]|\b(?:specific failure|signals? that (?:didn't|did not) fire|success criteria (?:aren't|are not) met|repeat miss|gate_full_rewrite|rejected)\b/i.test(
+    text
+  );
+  if (!repair) return "create";
+  const normalized2 = text.toLowerCase().replace(/\s+/g, " ").trim();
+  return `repair:${createHash12("sha256").update(normalized2).digest("hex").slice(0, 16)}`;
+}
 function isSubstantiveExistingWorkspaceFile(filePath2, content) {
   const trimmed = content.trim();
   if (!trimmed) return false;
@@ -56852,7 +56916,7 @@ function growthSignature(gezel) {
 
 // src/codex-setup/manager.ts
 init_atomic();
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { realpathSync as realpathSync2 } from "fs";
 import { chmod as chmod4, mkdir as mkdir15, readFile as readFile16, rm as rm6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
@@ -57603,7 +57667,7 @@ function canonicalPath(path2) {
   }
 }
 function sha256(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function catalogModelFor(model) {
   const contextWindow = model.contextWindow ?? 32768;
@@ -58028,7 +58092,7 @@ init_mcp_bridge();
 
 // src/connectors/writer.ts
 init_atomic();
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { mkdir as mkdir16, readFile as readFile17, readdir as readdir9, rm as rm7, stat as stat11 } from "fs/promises";
 import { basename as basename7, join as join30 } from "path";
 import { projectLocalQuarantineDir } from "@bendyline/gezel/paths";
@@ -58301,7 +58365,7 @@ var StaticContentScanner = class {
 var contentScanner = new StaticContentScanner();
 
 // src/connectors/writer.ts
-var sha8 = (s) => createHash13("sha256").update(s).digest("hex").slice(0, 8);
+var sha8 = (s) => createHash14("sha256").update(s).digest("hex").slice(0, 8);
 function slug(input, max = 48) {
   const s = input.normalize("NFKD").replace(/[^\x20-\x7E]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/g, "");
   return s || "x";
@@ -58318,7 +58382,7 @@ function contentHash(record) {
   const attachments = (record.attachments ?? []).map((attachment) => ({
     filename: attachment.filename,
     size: attachment.size ?? attachment.content?.byteLength ?? 0,
-    sha256: attachment.sha256 ?? createHash13("sha256").update(attachment.content).digest("hex")
+    sha256: attachment.sha256 ?? createHash14("sha256").update(attachment.content).digest("hex")
   }));
   return sha8(
     `${JSON.stringify(sortedFrontmatter)}
@@ -59389,10 +59453,10 @@ var SpectralConnectorAdapter = class {
 };
 
 // src/connectors/oauth.ts
-import { createHash as createHash14, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash15, randomBytes as randomBytes3 } from "crypto";
 function createPkce() {
   const verifier = randomBytes3(32).toString("base64url");
-  const challenge = createHash14("sha256").update(verifier).digest("base64url");
+  const challenge = createHash15("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function randomState() {
@@ -64077,7 +64141,7 @@ function registerGitHubPullsAdapters(runtime) {
 }
 
 // src/connectors/natives/github-releases.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { mkdir as mkdir21, mkdtemp as mkdtemp3, open as open2, rm as rm13 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { basename as basename8, join as join35 } from "path";
@@ -64270,7 +64334,7 @@ var GitHubReleasesAdapter = class {
       }
     }
     this.releases = releases;
-    this.fingerprint = createHash15("sha256").update(JSON.stringify(releases)).digest("hex");
+    this.fingerprint = createHash16("sha256").update(JSON.stringify(releases)).digest("hex");
   }
   apiHeaders(accept) {
     return {
@@ -64333,7 +64397,7 @@ var GitHubReleasesAdapter = class {
 };
 async function streamResponseToFile(response, path2) {
   const handle = await open2(path2, "wx");
-  const hash = createHash15("sha256");
+  const hash = createHash16("sha256");
   let size = 0;
   try {
     for await (const raw of response.body) {
@@ -66713,7 +66777,7 @@ var DebugFlag = class {
 
 // src/digest/generator.ts
 init_atomic();
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { readFile as readFile25 } from "fs/promises";
 import { join as join40 } from "path";
 import {
@@ -69862,7 +69926,7 @@ var ProjectDigestGenerator = class {
     if (commits.length === 0 && sessions.length === 0 && events.length < MIN_EVENTS_FOR_DIGEST) {
       return false;
     }
-    const inputHash = createHash16("sha256").update(
+    const inputHash = createHash17("sha256").update(
       [
         week,
         ...commits,
@@ -70019,7 +70083,7 @@ function describe4(err) {
 }
 
 // src/engines/electron-native-reuse.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { createReadStream as createReadStream3 } from "fs";
 import { lstat as lstat2, readdir as readdir13, readlink } from "fs/promises";
 import { basename as basename11, join as join41, posix, relative as relative5, resolve as resolve8, sep as sep5 } from "path";
@@ -71639,7 +71703,7 @@ function enclosingMacApp(path2) {
 var HASH_READ_BUFFER_BYTES = 16 * 1024 * 1024;
 function sha256File2(path2) {
   return new Promise((resolveHash, reject) => {
-    const hash = createHash17("sha256");
+    const hash = createHash18("sha256");
     const stream = createReadStream3(path2, { highWaterMark: HASH_READ_BUFFER_BYTES });
     stream.on("data", (chunk2) => hash.update(chunk2));
     stream.on("error", reject);
@@ -71651,7 +71715,7 @@ function sha256File2(path2) {
 import { createLogger as createLogger69 } from "@bendyline/gezel";
 
 // src/engines/resolver.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 import { createReadStream as createReadStream4, existsSync as existsSync7 } from "fs";
 import { chmod as chmod5, mkdir as mkdir24, readFile as readFile26, rename as rename7, rm as rm16, writeFile as writeFile9 } from "fs/promises";
 import { join as join42 } from "path";
@@ -71775,7 +71839,7 @@ async function* resolveEngine(opts) {
     );
   }
   const sumsBytes = await ghBytes(sumsAsset.url, baseFetch, token);
-  const sumsDigest = createHash18("sha256").update(sumsBytes).digest("hex");
+  const sumsDigest = createHash19("sha256").update(sumsBytes).digest("hex");
   if (!unpinned && sumsDigest !== expectedDigest) {
     yield* fail(
       `SHA256SUMS digest mismatch for ${tag}: this build pins ${expectedDigest.slice(0, 16)}\u2026 but the release served ${sumsDigest.slice(0, 16)}\u2026. Refusing \u2014 the release may have been tampered with or re-cut.`
@@ -72025,7 +72089,7 @@ function parseSums(text) {
 }
 var HASH_READ_BUFFER_BYTES2 = 16 * 1024 * 1024;
 async function sha256File3(path2) {
-  const hash = createHash18("sha256");
+  const hash = createHash19("sha256");
   await new Promise((resolve19, reject) => {
     const stream = createReadStream4(path2, { highWaterMark: HASH_READ_BUFFER_BYTES2 });
     stream.on("data", (chunk2) => hash.update(chunk2));
@@ -72908,7 +72972,7 @@ function safeBasename(name) {
 }
 
 // src/fs/store.ts
-import { createHash as createHash20, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash21, randomUUID as randomUUID10 } from "crypto";
 import {
   appendFile as appendFile4,
   chmod as chmod7,
@@ -73317,7 +73381,7 @@ function countDiffLines(diff) {
 }
 
 // src/workspace/journal.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import { appendFile as appendFile2, mkdir as mkdir27, readFile as readFile29 } from "fs/promises";
 import { dirname as dirname26, join as join43 } from "path";
 import { projectPrivateDir as projectPrivateDir2 } from "@bendyline/gezel/paths";
@@ -73360,7 +73424,7 @@ async function readJournalTail(home, projectId, limit = 100) {
   }
 }
 function sha2562(content) {
-  return createHash19("sha256").update(content).digest("hex");
+  return createHash20("sha256").update(content).digest("hex");
 }
 
 // src/workspace/template.ts
@@ -74227,7 +74291,7 @@ function boekwachterIssueFingerprint(path2, issue) {
     issue.category.trim().toLocaleLowerCase(),
     issue.message.trim().toLocaleLowerCase().replace(/\s+/g, " ")
   ].join("\0");
-  return createHash20("sha256").update(normalized2).digest("hex");
+  return createHash21("sha256").update(normalized2).digest("hex");
 }
 var ConfigCorruptionError = class extends Error {
   code = "CONFIG_CORRUPT";
@@ -79689,7 +79753,7 @@ import { projectCodeReviewsFile } from "@bendyline/gezel/paths";
 import { createLogger as createLogger77, projectAllowsAmbientWork } from "@bendyline/gezel";
 
 // src/tasks/manager.ts
-import { createHash as createHash21, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash22, randomUUID as randomUUID12 } from "crypto";
 import {
   DEFAULT_NIGHT_SHIFT_WINDOW,
   MANAGED_WORKSPACE_WRITE_SETTING_LABEL as MANAGED_WORKSPACE_WRITE_SETTING_LABEL4,
@@ -81541,7 +81605,7 @@ ${paramLines}` : ""}`,
     if (step.advanceWhen?.file) {
       const content = await (step.advanceWhen.artifact ? this.store.readProjectArtifact(projectId, step.advanceWhen.file) : this.store.readProjectWorkspaceFile(projectId, step.advanceWhen.file)).catch(() => null);
       if (content !== null) {
-        contentHash2 = createHash21("sha256").update(content).digest("hex");
+        contentHash2 = createHash22("sha256").update(content).digest("hex");
       }
     }
     if (contentHash2 !== void 0 && step.lastGateReject?.contentHash !== void 0 && step.lastGateReject.contentHash === contentHash2) {
@@ -83208,7 +83272,7 @@ function sumStat(s, key) {
 }
 
 // src/grants/manager.ts
-import { createHash as createHash22, randomBytes as randomBytes5, randomUUID as randomUUID13, timingSafeEqual } from "crypto";
+import { createHash as createHash23, randomBytes as randomBytes5, randomUUID as randomUUID13, timingSafeEqual } from "crypto";
 import { chmod as chmod8 } from "fs/promises";
 import { pendingGrantsFile as defaultPendingGrantsFile } from "@bendyline/gezel/paths";
 var PENDING_GRANT_TTL_MS = 10 * 6e4;
@@ -83280,7 +83344,7 @@ function generateVerificationCode() {
   return `${raw.slice(0, 3)}-${raw.slice(3)}`;
 }
 function hashVerificationCode(salt, normalizedCode) {
-  return createHash22("sha256").update(salt, "base64url").update("\0").update(normalizedCode, "ascii").digest();
+  return createHash23("sha256").update(salt, "base64url").update("\0").update(normalizedCode, "ascii").digest();
 }
 function codeMatches(grant, suppliedCode) {
   const normalized2 = normalizeVerificationCode(suppliedCode);
@@ -85200,7 +85264,7 @@ function tokenize2(question) {
 }
 
 // src/http/cert.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 import { generate as selfsignedGenerate } from "selfsigned";
 var CERT_VALIDITY_DAYS = 90;
 async function generateLoopbackCert() {
@@ -85237,7 +85301,7 @@ async function generateLoopbackCert() {
     ]
   });
   const der = pemToDer(pems.cert);
-  const digest = createHash23("sha256").update(der).digest();
+  const digest = createHash24("sha256").update(der).digest();
   return {
     certPem: pems.cert,
     keyPem: pems.private,
@@ -85251,14 +85315,14 @@ function pemToDer(pem) {
 }
 
 // src/http/codex-bridge-port.ts
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 import { realpathSync as realpathSync3 } from "fs";
 import { resolve as resolve10 } from "path";
 var CODEX_BRIDGE_PORT_RANGE_START = 2e4;
 var CODEX_BRIDGE_PORT_RANGE_END = 49151;
 var CODEX_BRIDGE_PORT_RANGE_SIZE = CODEX_BRIDGE_PORT_RANGE_END - CODEX_BRIDGE_PORT_RANGE_START + 1;
 function codexBridgePortForHome(home) {
-  const digest = createHash24("sha256").update(canonicalPath2(home)).digest();
+  const digest = createHash25("sha256").update(canonicalPath2(home)).digest();
   const bucket = digest.readUInt32BE(0) % CODEX_BRIDGE_PORT_RANGE_SIZE;
   return CODEX_BRIDGE_PORT_RANGE_START + bucket;
 }
@@ -85484,7 +85548,7 @@ async function loadGezelByRef(ref, ctx) {
 import { randomUUID as randomUUID15 } from "crypto";
 
 // src/http/openai-compat/responses-translate.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 import { z as z11 } from "zod";
 
 // src/http/openai-compat/translate.ts
@@ -85923,7 +85987,7 @@ var CUSTOM_TOOL_INPUT_KEY = "input";
 function flattenResponsesNamespaceToolName(namespace, name) {
   const joined = `${namespace}__${name}`;
   if (joined.length <= MAX_LOCAL_TOOL_NAME_LENGTH) return joined;
-  const digest = createHash25("sha256").update(namespace).update("\0").update(name).digest("hex").slice(0, 12);
+  const digest = createHash26("sha256").update(namespace).update("\0").update(name).digest("hex").slice(0, 12);
   const prefixLength = MAX_LOCAL_TOOL_NAME_LENGTH - digest.length - 2;
   return `${joined.slice(0, prefixLength)}__${digest}`;
 }
@@ -87153,7 +87217,7 @@ function mountMachineEngineHints(app) {
 }
 
 // src/http/preview-capability.ts
-import { createHash as createHash26, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash27, randomBytes as randomBytes6 } from "crypto";
 import { posix as posix3 } from "path";
 var DEFAULT_PREVIEW_CAPABILITY_TTL_MS = 10 * 60 * 1e3;
 var DEFAULT_PREVIEW_CAPABILITY_ABSOLUTE_TTL_MS = 2 * 60 * 60 * 1e3;
@@ -87297,7 +87361,7 @@ function pathIsInScope(path2, scopePath) {
   return scopePath === "" || path2 === scopePath || path2.startsWith(`${scopePath}/`);
 }
 function tokenDigest(token) {
-  return createHash26("sha256").update(token).digest("base64url");
+  return createHash27("sha256").update(token).digest("base64url");
 }
 
 // src/http/routes/ai.ts
@@ -87666,6 +87730,15 @@ var KOKORO_HF_REPO = "onnx-community/Kokoro-82M-v1.0-ONNX";
 var KOKORO_APPROX_BYTES_BY_ID = {
   [KOKORO_DEFAULT_MODEL_ID]: 95e6
 };
+function isKokoroRuntimeAvailable(resolveModule = (specifier) => import.meta.resolve(specifier)) {
+  try {
+    resolveModule("kokoro-js");
+    resolveModule("@huggingface/transformers");
+    return true;
+  } catch {
+    return false;
+  }
+}
 var KOKORO_DEFAULT_VOICES = [
   {
     id: "af_heart",
@@ -87995,7 +88068,7 @@ function parseGender(s) {
 }
 
 // src/providers/audio/whisper-cpp.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { createReadStream as createReadStream5 } from "fs";
 import { mkdir as mkdir37, readFile as readFile39, rename as rename11, rm as rm25, writeFile as writeFile14 } from "fs/promises";
 import { basename as basename12, join as join52 } from "path";
@@ -88290,7 +88363,7 @@ async function* downloadWithSha256(fetchImpl, opts) {
       yield { type: "progress", bytesWritten: writtenAll, totalBytes: totalAllBytes };
     }
   }
-  const hasher = createHash27("sha256");
+  const hasher = createHash28("sha256");
   await new Promise((resolve19, reject) => {
     const stream = createReadStream5(tmpPath, { highWaterMark: MODEL_HASH_READ_BUFFER_BYTES });
     stream.on("data", (chunk2) => hasher.update(chunk2));
@@ -88341,6 +88414,41 @@ function machineEngineProxy(ctx, sourcePrefix, targetPrefix, localPaths = [], sh
 
 // src/http/routes/audio.ts
 var log85 = createLogger88("audio");
+function buildAudioCatalog(options = {}) {
+  const kokoroRuntimeAvailable = options.kokoroRuntimeAvailable ?? isKokoroRuntimeAvailable();
+  return {
+    // All Whisper weights ship under MIT (whisper.cpp / OpenAI Whisper);
+    // Kokoro under Apache 2.0. Both are permissive → "Free, open".
+    stt: WHISPER_MODEL_CATALOG.map((m) => ({
+      id: m.id,
+      name: m.name,
+      description: m.description,
+      approxSizeBytes: m.approxSizeBytes,
+      kind: "stt",
+      license: "MIT",
+      licenseClass: "open",
+      licenseShortName: "MIT",
+      licenseUrl: "https://huggingface.co/ggerganov/whisper.cpp",
+      // The Base (English) variant is the recommended STT default: ~140 MB,
+      // realtime on laptop CPUs. Curated recoScore → ★ badge + auto-pick.
+      ...m.id === "whisper-base.en" ? { recoScore: 20 } : {}
+    })),
+    tts: kokoroRuntimeAvailable ? [
+      {
+        id: KOKORO_DEFAULT_MODEL_ID,
+        name: "Kokoro 82M v1.0",
+        description: "Apache 2.0 TTS \u2014 54+ voices, ~80MB quantized, near-realtime on M1 / modern desktop CPUs.",
+        approxSizeBytes: 95e6,
+        kind: "tts",
+        license: "Apache 2.0",
+        licenseClass: "open",
+        licenseShortName: "Apache 2.0",
+        licenseUrl: "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX",
+        recoScore: 20
+      }
+    ] : []
+  };
+}
 function audioRoutes(ctx) {
   const app = new Hono4();
   app.use(
@@ -88462,38 +88570,7 @@ function audioRoutes(ctx) {
     });
   });
   app.get("/catalog", (c) => {
-    return c.json({
-      // All Whisper weights ship under MIT (whisper.cpp / OpenAI Whisper);
-      // Kokoro under Apache 2.0. Both are permissive → "Free, open".
-      stt: WHISPER_MODEL_CATALOG.map((m) => ({
-        id: m.id,
-        name: m.name,
-        description: m.description,
-        approxSizeBytes: m.approxSizeBytes,
-        kind: "stt",
-        license: "MIT",
-        licenseClass: "open",
-        licenseShortName: "MIT",
-        licenseUrl: "https://huggingface.co/ggerganov/whisper.cpp",
-        // The Base (English) variant is the recommended STT default: ~140 MB,
-        // realtime on laptop CPUs. Curated recoScore → ★ badge + auto-pick.
-        ...m.id === "whisper-base.en" ? { recoScore: 20 } : {}
-      })),
-      tts: [
-        {
-          id: KOKORO_DEFAULT_MODEL_ID,
-          name: "Kokoro 82M v1.0",
-          description: "Apache 2.0 TTS \u2014 54+ voices, ~80MB quantized, near-realtime on M1 / modern desktop CPUs.",
-          approxSizeBytes: 95e6,
-          kind: "tts",
-          license: "Apache 2.0",
-          licenseClass: "open",
-          licenseShortName: "Apache 2.0",
-          licenseUrl: "https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX",
-          recoScore: 20
-        }
-      ]
-    });
+    return c.json(buildAudioCatalog());
   });
   app.get("/stt/models", async (c) => {
     const provider = await ctx.stt.current();
@@ -90465,6 +90542,8 @@ function configRoutes(ctx) {
       autoUpdateChecks: config.autoUpdateChecks !== false,
       quitOnClose: config.quitOnClose === true,
       themePref: config.themePref,
+      cliShowThinking: config.cliShowThinking !== false,
+      cliShowWrites: config.cliShowWrites === true,
       documentExportOptions: config.documentExportOptions,
       sidebarSide: config.sidebarSide,
       homeGreetingCollapsed: config.homeGreetingCollapsed === true,
@@ -90811,6 +90890,8 @@ function configRoutes(ctx) {
       autoUpdateChecks: updated.autoUpdateChecks !== false,
       quitOnClose: updated.quitOnClose === true,
       themePref: updated.themePref,
+      cliShowThinking: updated.cliShowThinking !== false,
+      cliShowWrites: updated.cliShowWrites === true,
       documentExportOptions: updated.documentExportOptions,
       sidebarSide: updated.sidebarSide,
       homeGreetingCollapsed: updated.homeGreetingCollapsed === true,
@@ -92200,7 +92281,11 @@ function ds4Routes(ctx) {
     const catalogId = c.req.param("catalogId");
     const skipShaRaw = c.req.query("skipSha");
     const skipSha = skipShaRaw != null && skipShaRaw !== "" && skipShaRaw !== "0" && skipShaRaw !== "false";
-    ctx.chatInstalls.ds4.start(catalogId, { skipSha, includeMmproj: false });
+    ctx.chatInstalls.ds4.start(catalogId, {
+      skipSha,
+      includeMmproj: false,
+      installCompanion: false
+    });
     return streamSSE5(c, (stream) => subscribeToInstallSse(ctx.chatInstalls.ds4, catalogId, stream));
   });
   app.delete("/models/:catalogId/install", (c) => {
@@ -93888,6 +93973,7 @@ function gezelRoutes(ctx) {
         toGezelIdOrName: toId,
         projectId: body.projectId,
         text: body.text,
+        ...body.suppressReply ? { suppressReply: true } : {},
         ...body.expectedDeliverable ? { expectedDeliverable: body.expectedDeliverable } : {}
       });
       return c.json({
@@ -94829,7 +94915,7 @@ import { HandboekRenderModeSchema } from "@bendyline/gezel";
 import { Hono as Hono29 } from "hono";
 
 // src/handboek/narration.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import { existsSync as existsSync14 } from "fs";
 import { mkdir as mkdir42, readFile as readFile43, writeFile as writeFile16 } from "fs/promises";
 import { join as join65 } from "path";
@@ -94845,7 +94931,7 @@ function createHandboekNarrator(deps) {
   const pathFor = (hash) => join65(dir, `${hash}.wav`);
   const metaPathFor = (hash) => join65(dir, `${hash}.json`);
   async function ensureSegment(key, synthesize) {
-    const hash = createHash28("sha256").update(key).digest("hex");
+    const hash = createHash29("sha256").update(key).digest("hex");
     const metaPath = metaPathFor(hash);
     if (existsSync14(pathFor(hash)) && existsSync14(metaPath)) {
       try {
@@ -95845,9 +95931,15 @@ function llamaCppRoutes(ctx) {
     const catalogId = c.req.param("catalogId");
     const skipShaRaw = c.req.query("skipSha");
     const skipSha = skipShaRaw != null && skipShaRaw !== "" && skipShaRaw !== "0" && skipShaRaw !== "false";
+    const skipCompanionRaw = c.req.query("skipCompanion");
+    const skipCompanion = skipCompanionRaw != null && skipCompanionRaw !== "" && skipCompanionRaw !== "0" && skipCompanionRaw !== "false";
     const config = await ctx.store.readConfig().catch(() => null);
     const includeMmproj = config?.nativeVision?.[catalogId] === true;
-    ctx.chatInstalls.llamaCpp.start(catalogId, { skipSha, includeMmproj });
+    ctx.chatInstalls.llamaCpp.start(catalogId, {
+      skipSha,
+      includeMmproj,
+      installCompanion: !skipCompanion
+    });
     return streamSSE9(
       c,
       (stream) => subscribeToInstallSse(ctx.chatInstalls.llamaCpp, catalogId, stream)
@@ -95938,7 +96030,7 @@ function mcpToolRoutes(ctx) {
 import { Hono as Hono36 } from "hono";
 
 // src/meester/status-generator.ts
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 import {
   MEESTER_STATUS_HEADLINE_MAX,
   MeesterStatusModelOutputSchema,
@@ -96250,7 +96342,7 @@ function localDay4(date) {
   return `${y}-${m}-${d}`;
 }
 function actionKey(projectId, title) {
-  return createHash29("sha256").update(`${projectId}
+  return createHash30("sha256").update(`${projectId}
 ${normalizeTitle(title)}`).digest("hex");
 }
 function normalizeTitle(title) {
@@ -96262,7 +96354,7 @@ function hashInput(candidates) {
     ...c.openTasks.map((t) => `${t.ref}:${t.status}`),
     ...c.events.map((e) => e.id)
   ]);
-  return createHash29("sha256").update(lines.join("\n")).digest("hex");
+  return createHash30("sha256").update(lines.join("\n")).digest("hex");
 }
 function parseModelOutput(raw) {
   const fence = raw.match(/```(?:json)?\s*\n([\s\S]*?)\n?```/);
@@ -96555,7 +96647,7 @@ import { Hono as Hono39 } from "hono";
 import { z as z20 } from "zod";
 
 // src/models/gezmodel.ts
-import { createHash as createHash30, randomUUID as randomUUID19 } from "crypto";
+import { createHash as createHash31, randomUUID as randomUUID19 } from "crypto";
 import { createReadStream as createReadStream6, createWriteStream as createWriteStream5 } from "fs";
 import { mkdir as mkdir43, open as open3, readFile as readFile45, readdir as readdir26, rm as rm29, stat as stat26, writeFile as writeFile17 } from "fs/promises";
 import { basename as basename14, dirname as dirname35, extname as extname5, join as join66 } from "path";
@@ -96657,7 +96749,7 @@ var GezmodelManager = class {
       files.push({
         path: path2,
         sizeBytes: content.byteLength,
-        sha256: createHash30("sha256").update(content).digest("hex"),
+        sha256: createHash31("sha256").update(content).digest("hex"),
         role: path2 === "manifests/installed.json" ? "installed-manifest" : path2 === "manifests/catalog.json" ? "catalog-manifest" : "catalog-file"
       });
     }
@@ -96863,7 +96955,7 @@ var GezmodelManager = class {
   }
 };
 async function hashFile(path2) {
-  const hash = createHash30("sha256");
+  const hash = createHash31("sha256");
   const stream = createReadStream6(path2, { highWaterMark: MODEL_HASH_READ_BUFFER_BYTES });
   for await (const chunk2 of stream) hash.update(chunk2);
   return hash.digest("hex");
@@ -97061,7 +97153,7 @@ function extractOne(archivePath, wanted, dest, expected) {
           zip.openReadStream(entry, (streamErr, stream) => {
             if (streamErr || !stream)
               return fail2(streamErr ?? new Error("could not read ZIP entry"));
-            const hash = createHash30("sha256");
+            const hash = createHash31("sha256");
             let bytes = 0;
             const verifier = new Transform({
               transform(chunk2, _encoding, callback) {
@@ -97295,7 +97387,7 @@ import {
 } from "@bendyline/gezel";
 
 // src/providers/mlx/models.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import { createReadStream as createReadStream7 } from "fs";
 import { mkdir as mkdir44, readFile as readFile47, rename as rename12, rm as rm30, stat as stat27, writeFile as writeFile18 } from "fs/promises";
 import { join as join68, resolve as resolvePath2 } from "path";
@@ -97857,7 +97949,7 @@ var MlxModelManager = class {
       }
     }
     push({ type: "verifying", file: file.name });
-    const hasher = createHash31("sha256");
+    const hasher = createHash32("sha256");
     await new Promise((resolve19, reject) => {
       const stream = createReadStream7(tmpPath, { highWaterMark: MODEL_HASH_READ_BUFFER_BYTES });
       stream.on("data", (chunk2) => hasher.update(chunk2));
@@ -99697,7 +99789,7 @@ function describeHostCadence(args) {
 }
 
 // src/project-type/craftbooks.ts
-import { createHash as createHash32 } from "crypto";
+import { createHash as createHash33 } from "crypto";
 import {
   craftbookFromDoc as craftbookFromDoc3,
   createLogger as createLogger109,
@@ -99721,7 +99813,7 @@ function craftbookContentHash(book) {
     command: book.command ?? null,
     requirements: book.requirements ?? null
   };
-  return `sha256:${createHash32("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+  return `sha256:${createHash33("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
 }
 async function resolveTypeCraftbook(catalog, input, id, now) {
   const embedded = await catalog.readItemFile(
@@ -100429,7 +100521,7 @@ function pageInvokeRoutes(ctx) {
 }
 
 // src/http/routes/page-read.ts
-import { createHash as createHash33 } from "crypto";
+import { createHash as createHash34 } from "crypto";
 import { readFile as readFile50, readdir as readdir29, stat as stat28 } from "fs/promises";
 import { PageReadRequestSchema, createLogger as createLogger113 } from "@bendyline/gezel";
 import { Hono as Hono48 } from "hono";
@@ -100438,7 +100530,7 @@ var PAGE_READ_MAX_BYTES = 2 * 1024 * 1024;
 var RATE_WINDOW_MS3 = 6e4;
 var RATE_MAX_READS = 600;
 function etagOf(size, mtimeMs) {
-  return createHash33("sha256").update(`${size}:${Math.trunc(mtimeMs)}`).digest("base64url").slice(0, 16);
+  return createHash34("sha256").update(`${size}:${Math.trunc(mtimeMs)}`).digest("base64url").slice(0, 16);
 }
 function pageReadRoutes(ctx) {
   const app = new Hono48();
@@ -100488,7 +100580,7 @@ function pageReadRoutes(ctx) {
             return `${entry.name}:${entry.isDirectory() ? "dir" : "file"}:${Math.trunc(child?.mtimeMs ?? 0)}`;
           })
         );
-        const digest = createHash33("sha256").update(listed.sort().join("\n")).digest("base64url").slice(0, 16);
+        const digest = createHash34("sha256").update(listed.sort().join("\n")).digest("base64url").slice(0, 16);
         return c.json({ op: "stat", etag: digest, mtime: stats.mtimeMs });
       }
       return c.json({
@@ -100513,7 +100605,7 @@ function pageReadRoutes(ctx) {
           };
         })
       )).filter((entry) => entry !== null);
-      const digest = createHash33("sha256").update(
+      const digest = createHash34("sha256").update(
         listed.map((e) => `${e.name}:${e.kind}:${Math.trunc(e.mtime)}`).sort().join("\n")
       ).digest("base64url").slice(0, 16);
       return c.json({ op: "list", entries: listed, etag: digest, mtime: stats.mtimeMs });
@@ -101227,7 +101319,7 @@ init_ensure();
 init_install();
 
 // src/workspace/instruction-scanner.ts
-import { createHash as createHash34 } from "crypto";
+import { createHash as createHash35 } from "crypto";
 import { readFile as readFile52, stat as stat30 } from "fs/promises";
 import { join as join73 } from "path";
 var MAX_CONTENT_CHARS = 64e3;
@@ -101272,7 +101364,7 @@ ${i.content.trim()}`).join("\n\n---\n\n");
   return { content: chosen.content, sourceFile: chosen.source, hash: chosen.hash };
 }
 function sha2563(s) {
-  return createHash34("sha256").update(s).digest("hex");
+  return createHash35("sha256").update(s).digest("hex");
 }
 
 // src/workspace/skill-script-translator.ts
@@ -103157,7 +103249,7 @@ async function recoverTypedProjectCreations(store) {
 }
 
 // src/project-type/gzl.ts
-import { createHash as createHash35 } from "crypto";
+import { createHash as createHash36 } from "crypto";
 import { mkdir as mkdir48, writeFile as writeFile21 } from "fs/promises";
 import { dirname as dirname40 } from "path";
 import {
@@ -103175,7 +103267,7 @@ function shard(id) {
   return id.slice(0, 2).toLowerCase();
 }
 function hashItemFiles(files) {
-  const hash = createHash35("sha256");
+  const hash = createHash36("sha256");
   for (const { rel, content } of [...files].sort((a, b) => a.rel < b.rel ? -1 : 1)) {
     hash.update(rel);
     hash.update("\0");
@@ -103323,7 +103415,7 @@ async function importGzlBundle(deps, buffer, opts = {}) {
 
 // src/workspace/command-approvals.ts
 init_atomic();
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 import { existsSync as existsSync18 } from "fs";
 import { mkdir as mkdir49, readFile as readFile57 } from "fs/promises";
 import { dirname as dirname41, join as join79 } from "path";
@@ -103331,7 +103423,7 @@ import { projectPrivateDir as projectPrivateDir5 } from "@bendyline/gezel/paths"
 function hashCommandInvocation(body, args, inputFiles = []) {
   const files = [...inputFiles].map(({ path: path2, sha256: sha2565 }) => ({ path: path2, sha256: sha2565 })).sort((a, b) => a.path.localeCompare(b.path) || a.sha256.localeCompare(b.sha256));
   const payload = JSON.stringify({ version: 2, body: body ?? null, args, files });
-  return createHash36("sha256").update("gezel-command-invocation\0").update(payload).digest("hex");
+  return createHash37("sha256").update("gezel-command-invocation\0").update(payload).digest("hex");
 }
 function approvalsPath(home, projectId) {
   return join79(projectPrivateDir5(home, projectId), "command-approvals.json");
@@ -103557,20 +103649,20 @@ import {
 } from "@bendyline/gezel";
 import { projectPrivateDir as projectPrivateDir6 } from "@bendyline/gezel/paths";
 var SHIPPED_ALLOWLIST = [
-  { package: "zod", allowedVersions: ["^3", "^4"] },
-  { package: "chalk", allowedVersions: ["^5"] },
-  { package: "commander", allowedVersions: ["^12", "^13"] },
-  { package: "date-fns", allowedVersions: ["^3", "^4"] },
-  { package: "yaml", allowedVersions: ["^2"] },
-  { package: "cheerio", allowedVersions: ["^1"] },
-  { package: "mime-types", allowedVersions: ["^2", "^3"] },
-  { package: "marked", allowedVersions: ["^12", "^13", "^14", "^15"] },
-  { package: "nanoid", allowedVersions: ["^5"] },
-  { package: "pino", allowedVersions: ["^9"] },
-  { package: "playwright-core", allowedVersions: ["^1"] },
-  { package: "tsx", allowedVersions: ["^4"] },
-  { package: "typescript", allowedVersions: ["^5"] },
-  { package: "undici", allowedVersions: ["^6", "^7"] }
+  { package: "zod", allowedVersions: ["^3", "^4"], defaultVersion: "^4" },
+  { package: "chalk", allowedVersions: ["^5"], defaultVersion: "^5" },
+  { package: "commander", allowedVersions: ["^12", "^13"], defaultVersion: "^13" },
+  { package: "date-fns", allowedVersions: ["^3", "^4"], defaultVersion: "^4" },
+  { package: "yaml", allowedVersions: ["^2"], defaultVersion: "^2" },
+  { package: "cheerio", allowedVersions: ["^1"], defaultVersion: "^1" },
+  { package: "mime-types", allowedVersions: ["^2", "^3"], defaultVersion: "^3" },
+  { package: "marked", allowedVersions: ["^12", "^13", "^14", "^15"], defaultVersion: "^15" },
+  { package: "nanoid", allowedVersions: ["^5"], defaultVersion: "^5" },
+  { package: "pino", allowedVersions: ["^9"], defaultVersion: "^9" },
+  { package: "playwright-core", allowedVersions: ["^1"], defaultVersion: "^1" },
+  { package: "tsx", allowedVersions: ["^4"], defaultVersion: "^4" },
+  { package: "typescript", allowedVersions: ["^5"], defaultVersion: "^5" },
+  { package: "undici", allowedVersions: ["^6", "^7"], defaultVersion: "^7" }
 ];
 function projectAllowlistPath(home, projectId) {
   return join81(projectPrivateDir6(home, projectId), "npm-allowlist.json");
@@ -103601,6 +103693,9 @@ function matchesAllowlist(pkg, version) {
   }
   return false;
 }
+function shippedDefaultVersion(pkg) {
+  return SHIPPED_ALLOWLIST.find((entry) => entry.package === pkg)?.defaultVersion;
+}
 function matchesProjectApproval(allowlist, pkg, version) {
   return allowlist.approved.some((e) => e.package === pkg && e.version === version);
 }
@@ -103730,7 +103825,9 @@ function dedupRequests(raw) {
   const out = [];
   for (const r of raw) {
     const pkg = NpmPackageNameSchema.parse(r.package);
-    const version = NpmRegistryVersionSchema.parse(r.version ?? "latest");
+    const version = NpmRegistryVersionSchema.parse(
+      r.version ?? shippedDefaultVersion(pkg) ?? "latest"
+    );
     const key = keyOf(pkg, version);
     if (seen.has(key)) continue;
     seen.add(key);
@@ -103900,7 +103997,7 @@ import { join as join82 } from "path";
 import { nowIso as nowIso14 } from "@bendyline/gezel";
 
 // src/workspace/command-inputs.ts
-import { createHash as createHash37 } from "crypto";
+import { createHash as createHash38 } from "crypto";
 import { createReadStream as createReadStream8 } from "fs";
 import { readFile as readFile59, realpath as realpath7, stat as stat35 } from "fs/promises";
 import { dirname as dirname43, extname as extname6, isAbsolute as isAbsolute10, relative as relative10, resolve as resolve13, sep as sep9 } from "path";
@@ -103973,7 +104070,7 @@ function portableRelative(root, file) {
   return relative10(root, file).split(sep9).join("/");
 }
 async function sha256File4(file) {
-  const hash = createHash37("sha256");
+  const hash = createHash38("sha256");
   await new Promise((resolveStream, reject) => {
     const stream = createReadStream8(file);
     stream.on("data", (chunk2) => hash.update(chunk2));
@@ -107878,7 +107975,7 @@ async function readProjectScriptRun(home, projectId, runId) {
 }
 
 // src/scripts/sdk.ts
-import { createHash as createHash39 } from "crypto";
+import { createHash as createHash40 } from "crypto";
 import { readFile as readFile67 } from "fs/promises";
 import { dirname as dirname45, join as join87, relative as relative11 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
@@ -107944,7 +108041,7 @@ async function readSdkTypes() {
     });
   } catch {
   }
-  const hash = createHash39("sha256");
+  const hash = createHash40("sha256");
   for (const f of files) hash.update(f.name).update("\0").update(f.content);
   cachedTypes = { version: hash.digest("hex"), files };
   return cachedTypes;
@@ -110758,9 +110855,13 @@ async function grepWorkspace(opts) {
   const plan = normalizePlan(opts);
   const target = await resolveSearchTarget(opts.workspaceDir, opts.path);
   const requestedEngine = opts.engine ?? "auto";
-  const ripgrepPath = requestedEngine === "javascript" ? null : await resolveExecutableOnPath("rg", target.workspaceDir, Math.min(plan.timeoutMs, 2e3));
+  const ripgrepPath = requestedEngine === "javascript" ? null : await resolveRipgrepExecutable(target.workspaceDir, Math.min(plan.timeoutMs, 2e3));
   if (requestedEngine === "ripgrep" && !ripgrepPath) {
-    throw new WorkspaceGrepError("ripgrep is not installed on this machine", 500, "rg-unavailable");
+    throw new WorkspaceGrepError(
+      "ripgrep is unavailable (the bundled platform package is missing and rg is not on PATH)",
+      500,
+      "rg-unavailable"
+    );
   }
   let raw;
   let engine;
@@ -111264,6 +111365,16 @@ async function resolveExecutableOnPath(command, forbiddenRoot, timeoutMs) {
     if (timer) clearTimeout(timer);
   }
 }
+async function resolveRipgrepExecutable(forbiddenRoot, timeoutMs) {
+  const onPath = await resolveExecutableOnPath("rg", forbiddenRoot, timeoutMs);
+  if (onPath) return onPath;
+  try {
+    const { rgPath } = await import("@vscode/ripgrep");
+    return await validateExecutable(rgPath, forbiddenRoot);
+  } catch {
+    return null;
+  }
+}
 async function findExecutableOnPath(command, forbiddenRoot) {
   const pathValue = process.env.PATH;
   if (!pathValue) return null;
@@ -111272,22 +111383,28 @@ async function findExecutableOnPath(command, forbiddenRoot) {
     const entry = rawEntry.replace(/^"|"$/g, "");
     if (!entry || !isAbsolute11(entry)) continue;
     for (const suffix of suffixes) {
-      try {
-        const executable = await realpath10(join89(entry, `${command}${suffix}`));
-        if (pathIsInside(forbiddenRoot, executable)) continue;
-        const executableStat = await stat39(executable);
-        if (!executableStat.isFile()) continue;
-        await access3(
-          executable,
-          process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK
-        );
-        return executable;
-      } catch {
-      }
+      const executable = await validateExecutable(
+        join89(entry, `${command}${suffix}`),
+        forbiddenRoot
+      );
+      if (executable) return executable;
     }
   }
   return null;
 }
+async function validateExecutable(candidate, forbiddenRoot) {
+  if (!isAbsolute11(candidate)) return null;
+  try {
+    const executable = await realpath10(candidate);
+    if (pathIsInside(forbiddenRoot, executable)) return null;
+    const executableStat = await stat39(executable);
+    if (!executableStat.isFile()) return null;
+    await access3(executable, process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK);
+    return executable;
+  } catch {
+    return null;
+  }
+}
 function pathIsInside(root, candidate) {
   const rel = relative12(root, candidate);
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep10}`) && !isAbsolute11(rel);
@@ -118892,7 +119009,7 @@ function indexShadowBody(store, file, body) {
 }
 
 // src/index-store/area-pass.ts
-import { createHash as createHash40 } from "crypto";
+import { createHash as createHash41 } from "crypto";
 var ARCHITECTURE_KEY = "::project";
 var MIN_AREA_FILES = 2;
 var AREA_INPUT_CAP = 6e3;
@@ -118954,7 +119071,7 @@ async function runAreaPass(index, deps) {
   return result;
 }
 function hashLines(lines) {
-  return createHash40("sha256").update([...lines].sort().join("\n")).digest("hex");
+  return createHash41("sha256").update([...lines].sort().join("\n")).digest("hex");
 }
 function buildAreaPrompt(area, entries) {
   let body = "";
@@ -119144,9 +119261,9 @@ function triv(kind) {
 }
 
 // src/index-store/hash.ts
-import { createHash as createHash41 } from "crypto";
+import { createHash as createHash42 } from "crypto";
 function sha2564(data) {
-  return createHash41("sha256").update(data).digest("hex");
+  return createHash42("sha256").update(data).digest("hex");
 }
 
 // src/index-store/artifacts-indexer.ts
@@ -124057,7 +124174,7 @@ ${body}\r
 }
 
 // src/mail/mime.ts
-import { createHash as createHash42 } from "crypto";
+import { createHash as createHash43 } from "crypto";
 import { simpleParser } from "mailparser";
 
 // src/mail/html.ts
@@ -124172,7 +124289,7 @@ function normalizeReferences(refs) {
 }
 function synthesizeMessageId(parsed, ctx) {
   const basis = `${addressText(parsed.from)}|${parsed.subject ?? ""}|${parsed.date?.toISOString() ?? ctx.fallbackDate ?? ""}|${ctx.id}`;
-  return `<${createHash42("sha256").update(basis).digest("hex").slice(0, 32)}@gezel.local>`;
+  return `<${createHash43("sha256").update(basis).digest("hex").slice(0, 32)}@gezel.local>`;
 }
 async function parseRawMessage(raw, ctx) {
   const parsed = await simpleParser(raw);
@@ -124795,7 +124912,7 @@ async function migrateOversightTask(store, num) {
 
 // src/memory/compaction.ts
 init_atomic();
-import { createHash as createHash43 } from "crypto";
+import { createHash as createHash44 } from "crypto";
 import { readFile as readFile77 } from "fs/promises";
 import { join as join101 } from "path";
 import { createLogger as createLogger160, isProactiveAllowed as isProactiveAllowed5 } from "@bendyline/gezel";
@@ -125007,7 +125124,7 @@ var MemoryCompactor = class {
       }
     }
     if (entries.length < minEntries) return false;
-    const inputHash = createHash43("sha256").update(eligibleDays.map((d) => `${d}
+    const inputHash = createHash44("sha256").update(eligibleDays.map((d) => `${d}
 ${dayContents.get(d)}`).join("\n")).digest("hex");
     const state = await this.readState(scope, id);
     if (state.inputHash === inputHash) return false;
@@ -125113,7 +125230,7 @@ ${dayContents.get(d)}`).join("\n")).digest("hex");
     const notes = await this.memory.getRecent("gezel", gezelId, lookbackDays);
     if (!notes.trim()) return;
     const current = await this.store.readMemoryLessons(gezelId);
-    const lessonsInputHash = createHash43("sha256").update(`${notes}
+    const lessonsInputHash = createHash44("sha256").update(`${notes}
 ---
 ${current}`).digest("hex");
     const state = await this.readState("gezel", gezelId);
@@ -125883,6 +126000,7 @@ var LlamaVisionProvider = class {
     await mkdir57(itemDir, { recursive: true });
     const totalAllBytes = spec.files.reduce((n, f) => n + f.approxSizeBytes, 0);
     let writtenAll = 0;
+    const verifiedDigests = {};
     for (const file of spec.files) {
       const result = yield* downloadWithSha256(this.fetchImpl, {
         url: file.downloadUrl,
@@ -125898,8 +126016,9 @@ var LlamaVisionProvider = class {
         return;
       }
       writtenAll = result.writtenAll;
+      verifiedDigests[file.filename] = file.sha256.toLowerCase();
     }
-    const fileSha256 = await hashModelPayloadFiles(itemDir);
+    const fileSha256 = await hashModelPayloadFiles(itemDir, verifiedDigests);
     await writeFile26(
       join104(itemDir, "manifest.json"),
       `${JSON.stringify(
@@ -126319,7 +126438,7 @@ async function* runGgufInstallWithCompanion(catalogId, o, deps) {
     yield event;
   }
   if (!finished) return;
-  yield* companionRecognitionEvents(catalogId, deps);
+  if (o.installCompanion) yield* companionRecognitionEvents(catalogId, deps);
   yield finished;
 }
 async function* companionRecognitionEvents(catalogId, deps) {
@@ -127627,7 +127746,7 @@ function makeActionable(message) {
 }
 
 // src/providers/image/sd-cpp.ts
-import { createHash as createHash44 } from "crypto";
+import { createHash as createHash45 } from "crypto";
 import { createReadStream as createReadStream10 } from "fs";
 import { mkdir as mkdir60, readFile as readFile81, rename as rename15, rm as rm41, writeFile as writeFile29 } from "fs/promises";
 import { join as join110 } from "path";
@@ -127966,7 +128085,7 @@ var StableDiffusionCppProvider = class {
       }
     }
     const partialPath = `${destPath}.partial`;
-    const hasher = createHash44("sha256");
+    const hasher = createHash45("sha256");
     await new Promise((resolve19, reject) => {
       const stream = createReadStream10(partialPath, {
         highWaterMark: MODEL_HASH_READ_BUFFER_BYTES
@@ -128485,7 +128604,7 @@ function isMachineImageProvider(config, env) {
 }
 
 // src/providers/recognition/store.ts
-import { createHash as createHash45 } from "crypto";
+import { createHash as createHash46 } from "crypto";
 import { mkdir as mkdir61, readFile as readFile82, rename as rename16, rm as rm42, writeFile as writeFile30 } from "fs/promises";
 import { join as join112 } from "path";
 import { ImageRecognitionSchema, createLogger as createLogger172 } from "@bendyline/gezel";
@@ -128497,8 +128616,8 @@ var RecognitionCache = class {
     this.root = join112(opts.home, "recognition");
   }
   keyFor(input) {
-    const imageHash = createHash45("sha256").update(input.bytes).digest("hex");
-    return createHash45("sha256").update(`${imageHash}\0${input.mode}\0${input.modelId}\0v${PROMPT_VERSION}`).digest("hex");
+    const imageHash = createHash46("sha256").update(input.bytes).digest("hex");
+    return createHash46("sha256").update(`${imageHash}\0${input.mode}\0${input.modelId}\0v${PROMPT_VERSION}`).digest("hex");
   }
   pathFor(key) {
     return join112(this.root, key.slice(0, 2), `${key}.json`);
@@ -128943,7 +129062,7 @@ var MockVideoProvider = class {
 };
 
 // src/providers/video/models.ts
-import { createHash as createHash46 } from "crypto";
+import { createHash as createHash47 } from "crypto";
 import { createReadStream as createReadStream11 } from "fs";
 import { mkdir as mkdir62, readFile as readFile83, rename as rename17, rm as rm43, writeFile as writeFile31 } from "fs/promises";
 import { dirname as dirname50, join as join113 } from "path";
@@ -129216,7 +129335,7 @@ var VideoModelManager = class {
       }
     }
     push({ type: "verifying", file: file.name });
-    const hasher = createHash46("sha256");
+    const hasher = createHash47("sha256");
     await new Promise((resolve19, reject) => {
       const stream = createReadStream11(tmpPath, { highWaterMark: MODEL_HASH_READ_BUFFER_BYTES });
       stream.on("data", (chunk2) => hasher.update(chunk2));
@@ -133489,11 +133608,18 @@ var TaskRunner = class {
   /** Run one serialized dispatch pass now, sharing the interval's overlap guard. */
   async wake() {
     if (this.tickInFlight) return this.tickInFlight;
-    this.tickInFlight = this.tick().finally(() => {
+    this.tickInFlight = this.tickOnce().finally(() => {
       this.tickInFlight = null;
     });
     return this.tickInFlight;
   }
+  /**
+   * Public test/operator entry point. Keep it serialized with the interval:
+   * callers may drive a real, already-started service whose ticker is active.
+   */
+  async tick() {
+    return this.wake();
+  }
   /**
    * Scan every `active` task and enqueue a handoff for any whose
    * current step has an effective gezel owner. Call on service boot and
@@ -133540,9 +133666,9 @@ var TaskRunner = class {
   /**
    * One dispatch pass. Walks pending in FIFO order; dispatches any
    * whose target provider has a free slot; skips items for tasks
-   * that are no longer active. Public for test-driven ticks.
+   * that are no longer active.
    */
-  async tick() {
+  async tickOnce() {
     await this.pruneActiveDispatches();
     if (this.pending.length === 0) {
       this.holdReason = void 0;
@@ -133554,6 +133680,7 @@ var TaskRunner = class {
       return;
     }
     const snapshot = this.pending.slice();
+    const snapshotIds = new Set(snapshot.map((handoff) => handoff.id));
     const keep = [];
     const inTickDispatches = /* @__PURE__ */ new Map();
     const nightShiftOn = this.isNightShiftActive();
@@ -133642,8 +133769,9 @@ var TaskRunner = class {
         );
       }
     }
+    const enqueuedDuringTick = this.pending.filter((handoff) => !snapshotIds.has(handoff.id));
     this.pending.length = 0;
-    this.pending.push(...keep);
+    this.pending.push(...keep, ...enqueuedDuringTick);
     this.holdReason = keep.some((handoff) => handoff.heldFor === "provider-busy") ? "provider-busy" : void 0;
   }
   async pruneActiveDispatches() {