@bike4mind/cli 0.20.1 → 0.21.0

package/dist/{AgentHistoryStore-BQiATPsQ.mjs → AgentHistoryStore-ucv6xXVT.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as WORK_ITEM_STATUSES, A as HttpStatus, At as usdToCredits, B as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Ct as mapMimeTypeToArtifactType, D as FORMAT_PROMPT_TEMPLATE, Dt as settingsMap, E as FIXED_TEMPERATURE_MODELS, Et as secureParameters, F as NO_TEMPERATURE_MODELS, Ft as isNearLimit, G as SupportedFabFileMimeTypes, H as REFUSAL_FALLBACK_MODELS, I as NotFoundError, It as parseRateLimitHeaders, J as UnauthorizedError, K as TTS_MAX_INPUT_CHARS, L as OllamaEmbeddingModel, M as InternalServerError, Mt as withRetry, N as MODEL_INFO_FIELD_GROUP_OF, Nt as buildRateLimitLogEntry, O as ForbiddenError, Ot as toModelInfo, P as ModelBackend, Pt as extractSnippetMeta, Q as VoyageAIEmbeddingModel, R as OpenAIEmbeddingModel, S as CorruptedFileError, St as isZodError, T as FIELD_GROUP_OF, Tt as resolveHistoryFetchLimit, U as RESPONSES_API_TOOL_MODELS, V as REASONING_SUPPORTED_MODELS, W as SpeechToTextModels, X as VIDEO_SIZE_CONSTRAINTS, Y as UnprocessableEntityError, Z as VideoModels, _ as BadRequestError, _t as isRenderableModelType, at as getQuestErrorCode, bt as isUnlimitedHistory, ct as isFieldGroup, dt as isImageAttachment, et as applyModelPriceCatalog, ft as isImageServeable, g as BFL_SAFETY_TOLERANCE, gt as isPlaceholderApiKey, h as BEDROCK_NO_PROMPT_CACHING_MODELS, ht as isModelDeprecated, it as getMcpProviderMetadata, j as ImageModels, jt as usdToCreditsStochastic, k as HTTPError, kt as toModelRecord, lt as isGPTImage2Model, m as ApiKeyType, mt as isModelAccessible, n as logger, nt as dayjsConfig_default, ot as getRetryAfterMs, p as ARTIFACT_ATTRS_PATTERN, pt as isMediaModelType, q as TooManyRequestsError, rt as defaultEmbeddingModelForEnv, st as isAudioMimeType, tt as calculateRetryDelay, ut as isGPTImageModel, v as BedrockEmbeddingModel, vt as isRetryableError, w as DEFAULT_UNKNOWN_CONTEXT_WINDOW, wt as obfuscateApiKey, x as ChatModels, xt as isUserInitiatedAbort, y as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, yt as isSupportedFabFileMimeType, z as PermissionDeniedError } from "./ConfigStore-CNfbeaJf.mjs";
+import { $ as SupportedFabFileMimeTypes, $t as buildRateLimitLogEntry, A as HTTPError, At as isRenderableModelType, B as OPENAI_GPT_IMAGE_1_IMAGE_SIZES, Bt as resolveHistoryFetchLimit, Ct as isGeminiModelId, D as FIXED_TEMPERATURE_MODELS, Dt as isModelAccessible, E as FIELD_GROUP_OF, Et as isMediaModelType, F as MODEL_INFO_FIELD_GROUP_OF, Ft as isZodError, G as PermissionDeniedError, Gt as usdToCredits, H as OllamaEmbeddingModel, Ht as settingsMap, I as McpServerName, It as mapMimeTypeToArtifactType, J as REFUSAL_FALLBACK_MODELS, K as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Kt as usdToCreditsStochastic, L as ModelBackend, Lt as obfuscateApiKey, M as IMAGE_SIZE_CONSTRAINTS, Mt as isSupportedFabFileMimeType, N as ImageModels, Nt as isUnlimitedHistory, O as FORMAT_PROMPT_TEMPLATE, Ot as isModelDeprecated, P as InternalServerError, Pt as isUserInitiatedAbort, Q as SpeechToTextModels, R as NO_TEMPERATURE_MODELS, Rt as parseEmbeddingRateLimitHeaders, S as CorruptedFileError, St as isGPTImageModel, Tt as isImageServeable, U as OpenAIEmbeddingModel, Ut as toModelInfo, V as OPENAI_GPT_IMAGE_2_IMAGE_SIZES, Vt as secureParameters, Wt as toModelRecord, Y as RESPONSES_API_TOOL_MODELS, _ as BadRequestError, _t as isChunkRebuildPending, at as VideoModels, bt as isFieldGroup, ct as applyModelPriceCatalog, dt as defaultEmbeddingModelForEnv, en as extractSnippetMeta, et as TTS_MAX_INPUT_CHARS, ft as getMcpProviderMetadata, g as BFL_SAFETY_TOLERANCE, gt as isAudioMimeType, h as BEDROCK_NO_PROMPT_CACHING_MODELS, ht as hasUsableLimits, it as VIDEO_SIZE_CONSTRAINTS, j as HttpStatus, jt as isRetryableError, k as ForbiddenError, kt as isPlaceholderApiKey, lt as calculateRetryDelay, m as ApiKeyType, mt as getRetryAfterMs, n as logger, nn as parseRateLimitHeaders, nt as UnauthorizedError, ot as VoyageAIEmbeddingModel, p as ARTIFACT_ATTRS_PATTERN, pt as getQuestErrorCode, q as REASONING_SUPPORTED_MODELS, qt as withRetry, rt as UnprocessableEntityError, st as WORK_ITEM_STATUSES, tn as isNearLimit, tt as TooManyRequestsError, ut as dayjsConfig_default, v as BedrockEmbeddingModel, vt as isChunkStalledFile, w as DEFAULT_UNKNOWN_CONTEXT_WINDOW, wt as isImageAttachment, x as ChatModels, xt as isGPTImage2Model, y as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, z as NotFoundError, zt as reservationOutputTokens } from "./ConfigStore-CoY0l0gr.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
 import { n as isTerminalShellStatus, t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
@@ -37,13 +37,14 @@ import OpenAI from "openai";
 import { VoyageAIClient } from "voyageai";
 import mime from "mime-types";
 import dns from "dns";
+import http from "http";
+import https, { Agent } from "https";
 import { promisify } from "util";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { Readable } from "stream";
 import { fileTypeFromBuffer } from "file-type";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
-import { Agent } from "https";
 import "@opensearch-project/opensearch";
 import "@aws-sdk/credential-provider-node";
 import "@opensearch-project/opensearch/aws-v3";
@@ -51,9 +52,9 @@ import mongoose from "mongoose";
 import { parse } from "shell-quote";
 import { homedir as homedir$1 } from "node:os";
 import { EventEmitter } from "events";
+import { CloudWatchClient, PutMetricDataCommand, StandardUnit } from "@aws-sdk/client-cloudwatch";
 import { fileURLToPath } from "url";
 import { Anthropic, RateLimitError } from "@anthropic-ai/sdk";
-import { CloudWatchClient, PutMetricDataCommand, StandardUnit } from "@aws-sdk/client-cloudwatch";
 import { GoogleGenAI } from "@google/genai";
 import pick from "lodash/pick.js";
 import { Stream } from "openai/streaming";
@@ -65,6 +66,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { getDomain } from "tldts";
 import * as dotenv from "dotenv";
+import { createHash as createHash$1 } from "node:crypto";
 import invert from "lodash/invert.js";
 import * as util from "node:util";
 import * as zlib from "node:zlib";
@@ -110,6 +112,18 @@ const COMPACTION_SUMMARY_MARKER = "[Previous conversation summary]";
 //#endregion
 //#region src/utils/fileSearch.ts
 /**
+* stat() that yields null instead of throwing. Following a symlink is best-effort here:
+* a dangling link, or one pointing somewhere unreadable, must not take down a whole
+* directory listing.
+*/
+function statOrNull(targetPath) {
+	try {
+		return fs$2.statSync(targetPath);
+	} catch {
+		return null;
+	}
+}
+/**
 * Load gitignore rules from project root
 */
 function loadIgnoreRules(projectRoot) {
@@ -200,13 +214,17 @@ function listAbsoluteDirectory(absolutePath, filterQuery) {
 		}
 		return filteredEntries.slice(0, 15).map((entry) => {
 			const fullPath = path$1.join(normalizedPath, entry.name);
+			const target = entry.isSymbolicLink() ? statOrNull(fullPath) : null;
+			const isDirectory = target ? target.isDirectory() : entry.isDirectory();
+			const isFile = target ? target.isFile() : entry.isFile();
 			const result = {
 				path: fullPath,
-				isDirectory: entry.isDirectory()
+				isDirectory
 			};
-			if (entry.isFile()) try {
-				result.size = fs$2.statSync(fullPath).size;
-			} catch {}
+			if (isFile) {
+				const fileStats = target ?? statOrNull(fullPath);
+				if (fileStats) result.size = fileStats.size;
+			}
 			return result;
 		});
 	} catch {
@@ -1555,7 +1573,7 @@ function webFetchBody(result) {
 	if (result.extractedChars === 0 && result.offset > 0) return `[web_fetch: offset ${result.offset} is at or beyond the end of the content (~${result.originalChars} chars); nothing further to read.]`;
 	return result.truncated ? result.markdown + truncationMarker(result) : result.markdown;
 }
-function isPdfUrl(url) {
+function isPdfUrl$2(url) {
 	try {
 		const { pathname } = new URL(url);
 		return pathname.toLowerCase().endsWith(".pdf");
@@ -1615,7 +1633,7 @@ async function probeLlmsTxt(pageUrl) {
 */
 async function firecrawlFetch(adapters, url, options) {
 	if (!/^https?:\/\/.+/i.test(url)) throw new Error(`Invalid URL format: ${url}. URL must start with http:// or https://`);
-	const isPdf = isPdfUrl(url);
+	const isPdf = isPdfUrl$2(url);
 	const desiredTimeout = isPdf ? PDF_TIMEOUT_MS : DEFAULT_TIMEOUT_MS;
 	const timeoutMs = options?.maxTimeoutMs ? Math.min(desiredTimeout, options.maxTimeoutMs) : desiredTimeout;
 	const app = createFirecrawlApp(await (0, apiKeyService_exports.getFirecrawlConfig)(adapters));
@@ -1819,7 +1837,27 @@ const webFetchTool = {
 	})
 };
 //#endregion
-//#region ../../b4m-core/services/dist/websearch-DpUKKZyj.mjs
+//#region ../../b4m-core/services/dist/websearch-BLmQCbHG.mjs
+/**
+* The coarse recency bucket both providers speak, as the smallest one containing `recencyDays`.
+* Null when there is no constraint, or when the window is wider than the widest bucket - a
+* "within 10 years" filter is not a filter, and sending one would exclude undated pages for nothing.
+*/
+function recencyBucket(recencyDays) {
+	if (typeof recencyDays !== "number" || !Number.isFinite(recencyDays) || recencyDays <= 0) return null;
+	if (recencyDays <= 1) return "day";
+	if (recencyDays <= 7) return "week";
+	if (recencyDays <= 31) return "month";
+	if (recencyDays <= 366) return "year";
+	return null;
+}
+/** SerpAPI spells the buckets `qdr:d|w|m|y` on the `tbs` parameter. */
+const SERPAPI_QDR = {
+	day: "qdr:d",
+	week: "qdr:w",
+	month: "qdr:m",
+	year: "qdr:y"
+};
 const DEFAULT_NUM_RESULTS = 3;
 const SEARCH_TIMEOUT_MS = 6e4;
 /**
@@ -1828,14 +1866,14 @@ const SEARCH_TIMEOUT_MS = 6e4;
 * on a non-OK response so the tool surfaces the failure. Exported (re-exported from index) for the
 * REST endpoint and existing tests.
 */
-async function serpApiSearch(adapters, query, num_results) {
+async function serpApiSearch(adapters, query, num_results, options) {
 	const apiKey = await (0, apiKeyService_exports.getSerperKey)(adapters);
 	const url = new URL("https://serpapi.com/search");
 	if (!apiKey) {
 		Logger.globalInstance.error("❌ WebSearch Tool: No API key configured. Skipping search.");
 		return { organic_results: [] };
 	}
-	url.search = new URLSearchParams({
+	const searchParams = new URLSearchParams({
 		engine: "google",
 		api_key: apiKey,
 		q: query,
@@ -1844,7 +1882,10 @@ async function serpApiSearch(adapters, query, num_results) {
 		gl: "us",
 		hl: "en",
 		num: (num_results || DEFAULT_NUM_RESULTS).toString()
-	}).toString();
+	});
+	const bucket = recencyBucket(options?.recencyDays);
+	if (bucket) searchParams.set("tbs", SERPAPI_QDR[bucket]);
+	url.search = searchParams.toString();
 	const controller = new AbortController();
 	const timeoutId = setTimeout(() => controller.abort(), SEARCH_TIMEOUT_MS);
 	let response;
@@ -1872,8 +1913,8 @@ async function serpApiSearch(adapters, query, num_results) {
 function createSerpApiProvider(adapters) {
 	return {
 		name: "serpapi",
-		async search(query, numResults) {
-			const data = await serpApiSearch(adapters, query, numResults);
+		async search(query, numResults, options) {
+			const data = await serpApiSearch(adapters, query, numResults, options);
 			return (Array.isArray(data.organic_results) ? data.organic_results : []).filter((r) => !!r && typeof r.link === "string").map((r) => ({
 				title: r.title ?? r.link,
 				url: r.link,
@@ -1912,16 +1953,19 @@ function parseSearxngResults(data, numResults) {
 function createSearxngProvider(baseUrl) {
 	return {
 		name: "searxng",
-		async search(query, numResults) {
+		async search(query, numResults, options) {
 			const limit = numResults && numResults > 0 ? numResults : DEFAULT_NUM_RESULTS;
 			const trimmed = baseUrl.replace(/\/+$/, "");
 			const url = new URL(`${trimmed}/search`);
-			url.search = new URLSearchParams({
+			const params = new URLSearchParams({
 				q: query,
 				format: "json",
 				language: "en",
 				safesearch: "1"
-			}).toString();
+			});
+			const bucket = recencyBucket(options?.recencyDays);
+			if (bucket) params.set("time_range", bucket);
+			url.search = params.toString();
 			const controller = new AbortController();
 			const timeoutId = setTimeout(() => controller.abort(), SEARCH_TIMEOUT_MS);
 			try {
@@ -2044,7 +2088,7 @@ const webSearchTool = {
 	})
 };
 //#endregion
-//#region ../../b4m-core/services/dist/toolGenerators-BVUZiwqE.mjs
+//#region ../../b4m-core/services/dist/toolGenerators-hk-Robqc.mjs
 const diceRoll = async (parameters) => {
 	if (!parameters?.sides || !parameters?.times) throw new Error("Tool dice roll: Missing required parameters");
 	return sum(times(parameters.times, () => random(1, parameters.sides))).toString();
@@ -2731,11 +2775,12 @@ const askUserQuestionTool = {
 * re-export them without pulling the full tool graph. `index.ts` re-exports them
 * so the server barrel's public API is unchanged.
 */
-const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
+const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionPreauthorizedLakeIds, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
 	const context = {
 		userId,
 		user,
 		sessionId,
+		questId,
 		logger,
 		db,
 		storage,
@@ -2752,9 +2797,13 @@ const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inl
 		kbScope,
 		inlinedAttachmentIds,
 		fullyInlinedAttachmentIds,
+		suppressLakeArms,
+		sessionRetrievalTags,
+		sessionPreauthorizedLakeIds,
 		codeMinifier,
 		availableModels,
-		onToolLlmUsage
+		onToolLlmUsage,
+		getAbortSignal
 	};
 	return Object.entries(tools).reduce((acc, [key, tool]) => ({
 		...acc,
@@ -4221,7 +4270,7 @@ const latticeAddEntityTool = {
 			};
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					const existingIndex = model.data.entities.findIndex((e) => e.id === entityId);
 					if (existingIndex >= 0) model.data.entities[existingIndex] = entityData;
 					else model.data.entities.push(entityData);
@@ -4231,7 +4280,23 @@ const latticeAddEntityTool = {
 						updatedAt: /* @__PURE__ */ new Date()
 					});
 					context.logger.info(`[Lattice] Added entity ${entityId} to model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "ADD_ENTITY",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "ADD_ENTITY",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist entity to database:`, error);
 			}
@@ -4349,7 +4414,7 @@ const latticeSetValueTool = {
 			const entityId = entityName.toLowerCase().replace(/\s+/g, "_");
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					const entity = model.data.entities.find((e) => e.id === entityId || e.name === entityName);
 					if (entity) {
 						const attrIndex = entity.attributes.findIndex((a) => a.key === attributeKey);
@@ -4369,7 +4434,23 @@ const latticeSetValueTool = {
 						});
 						context.logger.info(`[Lattice] Set ${entityId}.${attributeKey} = ${value} in model ${modelId}`);
 					} else context.logger.warn(`[Lattice] Entity ${entityName} not found in model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "SET_VALUE",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "SET_VALUE",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist value to database:`, error);
 			}
@@ -4468,7 +4549,7 @@ const latticeCreateRuleTool = {
 			let entityCreatedMessage = "";
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					if (!model.data.entities.some((e) => e.id === outputEntityId || e.name.toLowerCase() === parsedRule.outputEntity.toLowerCase()) && parsedRule.outputEntity !== "unknown") {
 						const now = /* @__PURE__ */ new Date();
 						const newEntity = {
@@ -4505,7 +4586,23 @@ const latticeCreateRuleTool = {
 						updatedAt: /* @__PURE__ */ new Date()
 					});
 					context.logger.info(`[Lattice] Created rule ${ruleId} in model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "CREATE_RULE",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "CREATE_RULE",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist rule to database:`, error);
 			}
@@ -5438,6 +5535,61 @@ function extractCommandName(filename) {
 	return name;
 }
 //#endregion
+//#region src/utils/findMarkdownFiles.ts
+/**
+* Classify a directory entry, resolving symlinks by their target.
+*
+* `fs.readdir(withFileTypes)` builds each Dirent from the entry itself, never
+* the link target, so a symlink reports `isFile() === false` AND
+* `isDirectory() === false`. A walk keyed off those two predicates alone skips
+* every symlinked entry.
+*/
+async function classifyEntry(fullPath, entry) {
+	if (!entry.isSymbolicLink()) {
+		if (entry.isDirectory()) return "directory";
+		return entry.isFile() ? "file" : "other";
+	}
+	try {
+		const stats = await fs$1.stat(fullPath);
+		if (stats.isDirectory()) return "directory";
+		return stats.isFile() ? "file" : "other";
+	} catch {
+		return "other";
+	}
+}
+/**
+* Recursively collect every `.md` file under `directory`, following symlinks.
+*
+* Symlink support is load-bearing, not a nicety: dotfile managers (nix
+* home-manager, chezmoi, a plain dotfiles repo) materialize
+* `~/.claude/skills/<name>/SKILL.md` as a symlink into an immutable store, so a
+* walk that only accepts real files finds zero global skills on those machines.
+*
+* Directories are deduped by realpath so a cyclic link cannot spin forever.
+*/
+async function findMarkdownFiles(directory, visitedRealPaths = /* @__PURE__ */ new Set()) {
+	const files = [];
+	try {
+		const realDirectory = await fs$1.realpath(directory);
+		if (visitedRealPaths.has(realDirectory)) return files;
+		visitedRealPaths.add(realDirectory);
+	} catch {}
+	let entries;
+	try {
+		entries = await fs$1.readdir(directory, { withFileTypes: true });
+	} catch (error) {
+		console.warn(`Error reading directory ${directory}:`, error instanceof Error ? error.message : String(error));
+		return files;
+	}
+	for (const entry of entries) {
+		const fullPath = path.join(directory, entry.name);
+		const kind = await classifyEntry(fullPath, entry);
+		if (kind === "directory") files.push(...await findMarkdownFiles(fullPath, visitedRealPaths));
+		else if (kind === "file" && entry.name.endsWith(".md")) files.push(fullPath);
+	}
+	return files;
+}
+//#endregion
 //#region src/storage/CustomCommandStore.ts
 var CustomCommandStore = class {
 	constructor(projectRoot, options = {}) {
@@ -5515,7 +5667,7 @@ var CustomCommandStore = class {
 	async loadCommandsFromDirectory(directory, source) {
 		try {
 			if (!(await fs$1.stat(directory)).isDirectory()) return;
-			const commandFiles = await this.findCommandFiles(directory);
+			const commandFiles = await findMarkdownFiles(directory);
 			for (const filePath of commandFiles) try {
 				await this.loadCommandFile(filePath, source);
 			} catch (error) {
@@ -5526,28 +5678,6 @@ var CustomCommandStore = class {
 		}
 	}
 	/**
-	* Recursively finds all .md files in a directory
-	*
-	* @param directory - Directory to search
-	* @returns Array of full file paths to .md files
-	*/
-	async findCommandFiles(directory) {
-		const files = [];
-		try {
-			const entries = await fs$1.readdir(directory, { withFileTypes: true });
-			for (const entry of entries) {
-				const fullPath = path.join(directory, entry.name);
-				if (entry.isDirectory()) {
-					const subFiles = await this.findCommandFiles(fullPath);
-					files.push(...subFiles);
-				} else if (entry.isFile() && entry.name.endsWith(".md")) files.push(fullPath);
-			}
-		} catch (error) {
-			console.warn(`Error reading directory ${directory}:`, error instanceof Error ? error.message : String(error));
-		}
-		return files;
-	}
-	/**
 	* Loads a single command file
 	*
 	* @param filePath - Full path to the command file
@@ -6359,6 +6489,130 @@ var EmbeddingAuthError = class extends Error {
 		this.provider = provider;
 	}
 };
+/**
+* Passive reporting of embedding-provider rate-limit ceilings.
+*
+* A rate limit belongs to the provider organization behind the key, and every embedding response
+* already carries the ceiling in its headers, so reading them costs no extra request and no extra
+* tokens. Providers that do not report them (Bedrock, Ollama) simply never produce an observation.
+*
+* This module owns the "what did the provider say" half only. It has no opinion about data lakes
+* or about the throughput levers configured against these numbers; interpreting a ceiling against
+* a lever belongs to the layer that knows what the levers are.
+*/
+/**
+* Remaining/limit ratio at or below which the provider counts as under pressure. A bulk re-index
+* draws its window down steadily, so this sits low enough that ordinary throughput does not trip
+* it and only genuine starvation does.
+*/
+const PRESSURE_RATIO = .1;
+/**
+* Pressure lasts as long as the window does, and every call in that window reports it. Throttle to
+* one line per interval so a starved ingest leaves a readable trace instead of flooding the log.
+*/
+const PRESSURE_LOG_INTERVAL_MS = 6e4;
+/**
+* Process-local, and deliberately so: a cold start re-reports what it measures rather than leaving
+* a gap shared storage would have to close. Keyed by provider+model+account, so the map is bounded
+* by the model list times the number of distinct credentials the process serves.
+*/
+const stateByKey = /* @__PURE__ */ new Map();
+/**
+* A broken reporter is indistinguishable from a steady ceiling - both are silence - so the first
+* fault has to be loud. Subsequent ones drop to debug: whatever breaks here breaks on every
+* embedding call, and a bulk re-index would drown the log in it.
+*/
+let hasReportedFailure = false;
+const keyFor = (provider, model, account) => `${provider}:${model}:${account}`;
+const ceilingChanged = (previous, next) => previous.limitTokens !== next.limitTokens || previous.limitRequests !== next.limitRequests;
+const describeCeiling = (snapshot) => `${snapshot.limitTokens ?? "unreported"} tokens/min, ${snapshot.limitRequests ?? "unreported"} requests/min`;
+/** Ratio of the window still available, or null when the provider did not report that dimension. */
+const remainingRatio = (remaining, limit) => {
+	if (remaining === null || limit === null || limit <= 0) return null;
+	return remaining / limit;
+};
+const pressuredDimensions = (snapshot) => {
+	const tokens = remainingRatio(snapshot.remainingTokens, snapshot.limitTokens);
+	const requests = remainingRatio(snapshot.remainingRequests, snapshot.limitRequests);
+	const dimensions = [];
+	if (tokens !== null && tokens <= PRESSURE_RATIO) dimensions.push("tokens");
+	if (requests !== null && requests <= PRESSURE_RATIO) dimensions.push("requests");
+	return dimensions;
+};
+/**
+* Read the rate-limit headers off an embedding response and report the ceiling when it is worth
+* reporting: the first sighting in this process, a change since the last sighting, or the window
+* running down. Returns the observation when the provider reported a usable ceiling, else null.
+*
+* `account` identifies the provider account the reading belongs to and is part of the memo key,
+* not just the log line. The credential is resolved per user - a stored personal key beats the
+* platform key in `getEffectiveLLMApiKeys` - so one process can see several accounts on the same
+* provider+model. Without the discriminator their readings would collapse into one entry that
+* flaps between unrelated ceilings and attributes each figure to whoever reads the log next. The
+* caller supplies it; it must never be key material.
+*
+* Never throws. This hangs off the hot path of every embedding call, and a reporting fault must
+* not be able to fail an embedding that otherwise succeeded.
+*/
+function recordEmbeddingRateLimitHeaders(provider, model, account, headers, now = Date.now()) {
+	try {
+		const snapshot = parseEmbeddingRateLimitHeaders(headers);
+		if (!hasUsableLimits(snapshot)) return null;
+		const key = keyFor(provider, model, account);
+		const previous = stateByKey.get(key);
+		const observation = {
+			provider,
+			model,
+			account,
+			snapshot,
+			observedAt: now
+		};
+		const subject = `${provider} ${model} (account ${account})`;
+		if (!previous) Logger.globalInstance.info(`[embedding-limits] ${subject} ceiling measured: ${describeCeiling(snapshot)}`, {
+			provider,
+			model,
+			account,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests
+		});
+		else if (ceilingChanged(previous.last.snapshot, snapshot)) Logger.globalInstance.warn(`[embedding-limits] ${subject} ceiling CHANGED: was ${describeCeiling(previous.last.snapshot)}, now ${describeCeiling(snapshot)}. Reconcile any throughput lever governed by this account against the new figure.`, {
+			provider,
+			model,
+			account,
+			previousLimitTokens: previous.last.snapshot.limitTokens,
+			previousLimitRequests: previous.last.snapshot.limitRequests,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests
+		});
+		const pressured = pressuredDimensions(snapshot);
+		const dueForPressureLog = previous?.lastPressureLogAt == null || now - previous.lastPressureLogAt >= PRESSURE_LOG_INTERVAL_MS;
+		const logPressure = pressured.length > 0 && dueForPressureLog;
+		if (logPressure) Logger.globalInstance.warn(`[embedding-limits] ${subject} is at or below ${PRESSURE_RATIO * 100}% of its ${pressured.join(" and ")} window`, {
+			provider,
+			model,
+			account,
+			remainingTokens: snapshot.remainingTokens,
+			remainingRequests: snapshot.remainingRequests,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests,
+			resetTokensMs: snapshot.resetTokensMs,
+			resetRequestsMs: snapshot.resetRequestsMs
+		});
+		stateByKey.set(key, {
+			last: observation,
+			lastPressureLogAt: logPressure ? now : previous?.lastPressureLogAt ?? null
+		});
+		return observation;
+	} catch (error) {
+		const message = `[embedding-limits] failed to record rate-limit headers: ${error}`;
+		if (hasReportedFailure) Logger.globalInstance.debug(message);
+		else {
+			hasReportedFailure = true;
+			Logger.globalInstance.warn(message);
+		}
+		return null;
+	}
+}
 const OPENAI_EMBEDDING_MODEL_MAP = {
 	[OpenAIEmbeddingModel.TEXT_EMBEDDING_3_SMALL]: {
 		provider: "OpenAI",
@@ -6379,34 +6633,72 @@ const OPENAI_EMBEDDING_MODEL_MAP = {
 		dimensions: [1536]
 	}
 };
-var OpenAIEmbeddingService = class OpenAIEmbeddingService {
+/**
+* Non-reversible stand-in for a credential, for use where two accounts have to be told apart in a
+* log. Same construction as the API-key logging hash in the request middleware. Never emit the key.
+*/
+const fingerprintCredential = (apiKey) => `key:${createHash("sha256").update(apiKey).digest("hex").slice(0, 16)}`;
+/**
+* Total by construction. The only caller runs inside processSingleBatch's classifying try, where a
+* throw would be misread as a provider error and re-issue the batch.
+*/
+const headerOrNull = (httpResponse, name) => {
+	try {
+		return httpResponse.headers?.get(name) ?? null;
+	} catch {
+		return null;
+	}
+};
+/**
+* The ceilings `generateEmbeddingBatch` splits on, at module scope and exported because a cost
+* PREFLIGHT has to model the same split before it spends (packages/scripts/retrieval/capturePlan.ts).
+* A second copy of these numbers in a script cannot track a provider change.
+*/
+const OPENAI_MAX_INPUTS_PER_REQUEST = 2048;
+const OPENAI_MAX_TOKENS_PER_INPUT = 8192;
+/**
+* Effective token limit with a 10% safety buffer.
+* The tiktoken fallback (text.length/3) deliberately overestimates to be safe,
+* but DB token counts may have been produced by a different tokenizer (Bedrock, Voyage)
+* that underestimates. The buffer keeps us clear of the hard limit under tokenizer variance.
+*/
+const OPENAI_EFFECTIVE_TOKEN_LIMIT = Math.floor(27e4);
+var OpenAIEmbeddingService = class {
 	client;
 	model;
-	/** Hard limit imposed by OpenAI's embeddings API. */
-	static MAX_TOKENS_PER_REQUEST = 3e5;
-	/**
-	* Effective token limit with a 10% safety buffer.
-	* The tiktoken fallback (text.length/3) deliberately overestimates to be safe,
-	* but DB token counts may have been produced by a different tokenizer (Bedrock, Voyage)
-	* that underestimates. The buffer keeps us clear of the hard limit under tokenizer variance.
-	*/
-	static EFFECTIVE_TOKEN_LIMIT = Math.floor(OpenAIEmbeddingService.MAX_TOKENS_PER_REQUEST * .9);
+	credentialFingerprint;
 	constructor(apiKey, model = OpenAIEmbeddingModel.TEXT_EMBEDDING_ADA_002) {
 		this.client = new OpenAI({ apiKey });
 		this.validateModel(model);
 		this.model = model;
+		this.credentialFingerprint = fingerprintCredential(apiKey);
+	}
+	/**
+	* Report the provider ceiling carried on a response we already received. Covers ingest and
+	* query alike: both reach OpenAI through this class, so neither needs its own sampling point.
+	*
+	* The ceiling belongs to the organization behind the key, and the key is resolved per user
+	* (getEffectiveLLMApiKeys prefers a stored personal key over the platform one), so the reading
+	* has to say whose it is. `openai-organization` is the provider's own answer to that; the
+	* credential fingerprint covers the case where the response omits it, and still keeps two
+	* distinct keys as two readings rather than one that flaps between them.
+	*/
+	recordRateLimit(httpResponse) {
+		const account = headerOrNull(httpResponse, "openai-organization") || this.credentialFingerprint;
+		recordEmbeddingRateLimitHeaders("OpenAI", this.model, account, httpResponse.headers);
 	}
 	validateModel(model) {
 		if (!OPENAI_EMBEDDING_MODEL_MAP[model]) throw new Error(`Invalid OpenAI embedding model: ${model}`);
 	}
 	async generateEmbedding(text) {
-		const response = await this.client.embeddings.create({
+		const { data: body, response: httpResponse } = await this.client.embeddings.create({
 			model: this.model,
 			input: text
-		}).catch((error) => {
+		}).withResponse().catch((error) => {
 			throw this.toActionableAuthError(error);
 		});
-		if (response.data && response.data.length > 0) return response.data[0].embedding;
+		this.recordRateLimit(httpResponse);
+		if (body.data && body.data.length > 0) return body.data[0].embedding;
 		throw new Error("No embedding data received from OpenAI");
 	}
 	/**
@@ -6437,8 +6729,6 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 	*/
 	async generateEmbeddingBatch(texts, tokenCounts) {
 		if (texts.length === 0) return [];
-		const MAX_INPUTS_PER_REQUEST = 2048;
-		const MAX_TOKENS_PER_INPUT = 8192;
 		let tokens;
 		let needsRecalculation = false;
 		if (!tokenCounts || tokenCounts.length !== texts.length) needsRecalculation = true;
@@ -6453,12 +6743,12 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 		let totalTokens = 0;
 		for (let i = 0; i < texts.length; i++) {
 			const tokenCount = tokens[i];
-			if (tokenCount > MAX_TOKENS_PER_INPUT) throw new Error(`Input at index ${i} exceeds ${MAX_TOKENS_PER_INPUT} token limit (${tokenCount} tokens)`);
+			if (tokenCount > 8192) throw new Error(`Input at index ${i} exceeds ${OPENAI_MAX_TOKENS_PER_INPUT} token limit (${tokenCount} tokens)`);
 			totalTokens += tokenCount;
 		}
 		Logger.globalInstance.debug(`[OpenAI] Batch embedding: ${texts.length} inputs, ${totalTokens} total tokens`);
-		const batches = this.createBatches(texts, tokens, MAX_INPUTS_PER_REQUEST, OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT);
-		Logger.globalInstance.debug(`[OpenAI] Split into ${batches.length} batch(es) (effective limit: ${OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT} tokens)`);
+		const batches = this.createBatches(texts, tokens, OPENAI_MAX_INPUTS_PER_REQUEST, OPENAI_EFFECTIVE_TOKEN_LIMIT);
+		Logger.globalInstance.debug(`[OpenAI] Split into ${batches.length} batch(es) (effective limit: ${OPENAI_EFFECTIVE_TOKEN_LIMIT} tokens)`);
 		if (batches.length === 1) return await this.processSingleBatch(batches[0].texts);
 		const allEmbeddings = new Array(texts.length);
 		for (const batch of batches) (await this.processSingleBatch(batch.texts)).forEach((embedding, batchIndex) => {
@@ -6524,8 +6814,8 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 	async processSingleBatch(texts, preCalculatedTokens) {
 		const tokenCounts = preCalculatedTokens || await this.calculateTokenCounts(texts);
 		const batchTokens = tokenCounts.reduce((sum, count) => sum + count, 0);
-		if (batchTokens > OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT) {
-			Logger.globalInstance.warn(`[OpenAI] Batch exceeds effective token limit (${batchTokens}/${OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT} tokens), splitting recursively`);
+		if (batchTokens > 27e4) {
+			Logger.globalInstance.warn(`[OpenAI] Batch exceeds effective token limit (${batchTokens}/${OPENAI_EFFECTIVE_TOKEN_LIMIT} tokens), splitting recursively`);
 			const mid = Math.ceil(texts.length / 2);
 			const firstHalf = texts.slice(0, mid);
 			const secondHalf = texts.slice(mid);
@@ -6534,13 +6824,14 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 			const [firstEmbeddings, secondEmbeddings] = await Promise.all([this.processSingleBatch(firstHalf, firstTokens), this.processSingleBatch(secondHalf, secondTokens)]);
 			return [...firstEmbeddings, ...secondEmbeddings];
 		}
-		for (let i = 0; i < tokenCounts.length; i++) if (tokenCounts[i] > 8192) throw new Error(`Text at index ${i} exceeds OpenAI's 8192 token limit per input (${tokenCounts[i]} tokens). This indicates a data integrity issue - chunk should have been smaller. This chunk cannot be processed and the entire batch must fail.`);
+		for (let i = 0; i < tokenCounts.length; i++) if (tokenCounts[i] > 8192) throw new Error(`Text at index ${i} exceeds OpenAI's ${OPENAI_MAX_TOKENS_PER_INPUT} token limit per input (${tokenCounts[i]} tokens). This indicates a data integrity issue - chunk should have been smaller. This chunk cannot be processed and the entire batch must fail.`);
 		try {
-			const response = await this.client.embeddings.create({
+			const { data: body, response: httpResponse } = await this.client.embeddings.create({
 				model: this.model,
 				input: texts
-			});
-			if (response.data && response.data.length > 0) return response.data.sort((a, b) => a.index - b.index).map((item) => item.embedding);
+			}).withResponse();
+			this.recordRateLimit(httpResponse);
+			if (body.data && body.data.length > 0) return body.data.sort((a, b) => a.index - b.index).map((item) => item.embedding);
 			else throw new Error("No embedding data received from OpenAI");
 		} catch (error) {
 			if (error instanceof OpenAI.AuthenticationError) throw this.toActionableAuthError(error);
@@ -7045,6 +7336,7 @@ var SmartChunker = class {
 	encoder;
 	storage;
 	bufferPercentOrValue;
+	lastExtractedText;
 	/**
 	* @param model - The embedding model name
 	* @param storage - Storage instance for file content
@@ -7098,6 +7390,13 @@ var SmartChunker = class {
 			this.encoder = void 0;
 		}
 	}
+	/**
+	* The canonical extracted text from the most recent chunkFile() call - policy-independent, unlike
+	* the returned chunks. Undefined when the file yielded no extractable text. See lastExtractedText.
+	*/
+	getExtractedText() {
+		return this.lastExtractedText;
+	}
 	async chunkFile(fileOrContent, mimeType) {
 		let content;
 		if (Buffer.isBuffer(fileOrContent)) content = fileOrContent;
@@ -7107,6 +7406,7 @@ var SmartChunker = class {
 		}
 		this.logger.updateMetadata({ mimeType });
 		this.logger.log(`Chunking file with type: ${mimeType}`);
+		this.lastExtractedText = void 0;
 		if (isAudioMimeType(mimeType)) {
 			this.logger.log(`Skipping chunking for audio file type: ${mimeType}`);
 			return [];
@@ -7144,12 +7444,17 @@ var SmartChunker = class {
 			case SupportedFabFileMimeTypes.PHP:
 			case SupportedFabFileMimeTypes.RUBY:
 			case SupportedFabFileMimeTypes.SH:
-			case SupportedFabFileMimeTypes.BASH:
-				chunks = await this.chunkText(content.toString());
+			case SupportedFabFileMimeTypes.BASH: {
+				const textContent = content.toString();
+				this.lastExtractedText = textContent;
+				chunks = await this.chunkText(textContent);
 				break;
+			}
 			default:
 				if (mimeType && mimeType.startsWith("text/")) {
-					chunks = await this.chunkText(content.toString());
+					const textContent = content.toString();
+					this.lastExtractedText = textContent;
+					chunks = await this.chunkText(textContent);
 					break;
 				}
 				this.logger.error(`Unsupported file type: ${mimeType}`);
@@ -7161,7 +7466,9 @@ var SmartChunker = class {
 		return await this.storage.getContentAsBuffer(file.filePath);
 	}
 	async chunkCSV(content) {
-		const rows = content.toString("utf8").split(/\r?\n/).filter((row) => row.trim().length > 0);
+		const csvString = content.toString("utf8");
+		this.lastExtractedText = csvString;
+		const rows = csvString.split(/\r?\n/).filter((row) => row.trim().length > 0);
 		const chunks = [];
 		let currentChunk = [];
 		let currentTokens = 0;
@@ -7214,6 +7521,7 @@ var SmartChunker = class {
 	async chunkPDF(content) {
 		const pdf = await getDocumentProxy(new Uint8Array(content));
 		const { text } = await extractText(pdf);
+		this.lastExtractedText = Array.isArray(text) ? text.join("\n") : text;
 		if (typeof text === "string") return this.chunkText(text);
 		const chunks = [];
 		let currentChunk = "";
@@ -7245,7 +7553,9 @@ var SmartChunker = class {
 		return chunks;
 	}
 	async chunkJSON(content) {
-		const json = JSON.parse(content.toString());
+		const jsonString = content.toString();
+		this.lastExtractedText = jsonString;
+		const json = JSON.parse(jsonString);
 		return this.chunkObject(json);
 	}
 	async chunkObject(obj) {
@@ -7312,6 +7622,7 @@ var SmartChunker = class {
 	}
 	async chunkDOCX(content) {
 		const result = await mammoth.extractRawText({ buffer: content });
+		this.lastExtractedText = result.value;
 		return this.chunkText(result.value);
 	}
 	async chunkPPTX(content) {
@@ -7330,6 +7641,7 @@ var SmartChunker = class {
 			this.logger.warn("PPTX contained no extractable slide text");
 			return [];
 		}
+		this.lastExtractedText = fullText;
 		return this.chunkText(fullText);
 	}
 	async chunkText(content) {
@@ -7404,6 +7716,9 @@ var SmartChunker = class {
 	async chunkExcel(content) {
 		const { read, utils } = await import("xlsx");
 		const workbook = read(content, { type: "buffer" });
+		this.lastExtractedText = workbook.SheetNames.map((sheetName) => {
+			return `--- Sheet: ${sheetName} ---\n${utils.sheet_to_json(workbook.Sheets[sheetName], { header: 1 }).filter(Array.isArray).map((row) => JSON.stringify(row)).join("\n")}\n--- End of Sheet: ${sheetName} ---`;
+		}).join("\n");
 		const chunks = [];
 		let currentChunk = "";
 		let currentTokens = 0;
@@ -7623,6 +7938,8 @@ const dnsResolve6 = promisify(dns.resolve6);
 * Check if an IPv4 address is in a private/internal range.
 */
 function isPrivateIPv4(ip) {
+	const nonCanonical = ip.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+	if (nonCanonical && nonCanonical.slice(1).some((octet) => octet.length > 1 && octet.startsWith("0"))) return true;
 	const ipv4Match = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
 	if (!ipv4Match) return false;
 	const [, a, b, c] = ipv4Match.map(Number);
@@ -7643,44 +7960,153 @@ function isPrivateIPv4(ip) {
 /**
 * Check if an IPv6 address is in a private/internal range.
 */
+/**
+* Strip the brackets WHATWG URL keeps on an IPv6 hostname: `new URL('http://[::1]/').hostname` is
+* `'[::1]'`, not `'::1'`. Every literal check below compares against unbracketed forms, so without
+* this a bracketed address matched nothing and fell through as safe.
+*
+* Same treatment as the sibling guards in this repo - `ssrfGuard.ts` and `external-image.ts` both
+* strip brackets before their literal checks.
+*/
+function stripIpv6Brackets(hostname) {
+	const h = hostname.toLowerCase();
+	return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+}
+/**
+* Canonicalize an IPv6 literal to the RFC 5952 form - leading zeros dropped per hextet, longest run of
+* two or more zero hextets compressed to `::`. That is the shape both feeders already hand this module
+* (WHATWG `URL.hostname` at the `validateUrlForFetch` call site, and getaddrinfo answers via
+* `ssrfSafeLookup`), so it is the shape every prefix arm in `isPrivateIPv6` was written against.
+* Canonicalizing once here is what lets those arms cover a family instead of enumerating its legal
+* spellings: `0:0:0:0:0:ffff:127.0.0.1` arrives as `::ffff:127.0.0.1` instead of matching nothing.
+*
+* A dotted IPv4 tail is deliberately kept dotted, unlike WHATWG which hexifies it. The mapped branch
+* below decodes a dotted tail exactly through `isPrivateIPv4` and only blanket-refuses when the tail is
+* hex, so hexifying here would turn `::ffff:8.8.8.8` into an over-block.
+*
+* This cannot over-block: dropping leading zeros only shortens hextets below 0x1000, and every
+* globally routable address is inside 2000::/3 (first hextet 0x2000-0x3fff), which never carries one.
+* Input that does not parse as IPv6 is returned untouched, so it keeps whatever verdict it has today -
+* which is also why the redundant zero-padded arms further down (`2001:0db8:`, `2001:0000:`,
+* `0064:ff9b:`, `0100::`) are left in place rather than deleted.
+*/
+function normalizeIpv6(ip) {
+	const ported = ip.match(/^(\[[^\]]*\]):\d+$/);
+	const bare = stripIpv6Brackets(ported ? ported[1] : ip).replace(/%.*$/, "");
+	const halves = bare.split("::");
+	if (halves.length > 2) return bare;
+	if (halves.length === 2 && halves[0].includes(".")) return bare;
+	const tokens = halves.flatMap((half) => half === "" ? [] : half.split(":"));
+	const dotted = tokens.length > 0 && tokens[tokens.length - 1].includes(".") ? tokens.pop() : void 0;
+	if (!tokens.every((token) => /^[0-9a-f]{1,4}$/.test(token))) return bare;
+	const compressed = halves.length === 2;
+	const width = tokens.length + (dotted ? 2 : 0);
+	if (compressed ? width > 8 : width !== 8) return bare;
+	const hextets = tokens.map((token) => token.replace(/^0+(?=.)/, ""));
+	if (compressed) {
+		const headWidth = halves[0] === "" ? 0 : halves[0].split(":").length;
+		hextets.splice(headWidth, 0, ...new Array(8 - width).fill("0"));
+	}
+	const run = {
+		start: -1,
+		length: 0
+	};
+	for (let i = 0; i < hextets.length; i++) {
+		if (hextets[i] !== "0") continue;
+		let end = i;
+		while (end < hextets.length && hextets[end] === "0") end++;
+		if (end - i > run.length) {
+			run.start = i;
+			run.length = end - i;
+		}
+		i = end;
+	}
+	const body = run.length >= 2 ? `${hextets.slice(0, run.start).join(":")}::${hextets.slice(run.start + run.length).join(":")}` : hextets.join(":");
+	if (dotted === void 0) return body;
+	return body.endsWith(":") ? `${body}${dotted}` : `${body}:${dotted}`;
+}
 function isPrivateIPv6(ip) {
-	const normalized = ip.toLowerCase();
+	const normalized = normalizeIpv6(ip);
+	if (!normalized.includes(":")) return false;
+	if (/[[\]]/.test(normalized)) return true;
+	if (!/^[0-9a-f:.]+$/.test(normalized)) return false;
+	if (normalized.includes(".") && !/^::(ffff:)?\d+\.\d+\.\d+\.\d+$/.test(normalized)) return true;
 	if (normalized === "::1" || normalized === "0:0:0:0:0:0:0:1") return true;
 	if (normalized === "::" || normalized === "0:0:0:0:0:0:0:0") return true;
-	if (normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb")) return true;
+	if (normalized.startsWith("fe")) return true;
 	if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
 	if (normalized.startsWith("ff")) return true;
-	const ipv4MappedMatch = normalized.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-	if (ipv4MappedMatch) return isPrivateIPv4(ipv4MappedMatch[1]);
+	if (normalized.startsWith("::ffff:")) {
+		const tail = normalized.slice(7);
+		return /^\d+\.\d+\.\d+\.\d+$/.test(tail) ? isPrivateIPv4(tail) : true;
+	}
+	if (normalized.startsWith("::")) {
+		const tail = normalized.slice(2);
+		return /^\d+\.\d+\.\d+\.\d+$/.test(tail) ? isPrivateIPv4(tail) : true;
+	}
+	if (normalized.startsWith("0:")) return true;
+	if (normalized.startsWith("5f00:")) return true;
+	if (normalized.startsWith("3fff:")) {
+		const rest = normalized.slice(5);
+		if ((rest.startsWith(":") ? 0 : parseInt(rest.split(":")[0], 16)) <= 4095) return true;
+	}
 	if (normalized.startsWith("2001:db8:") || normalized.startsWith("2001:0db8:")) return true;
+	if (normalized.startsWith("2002:")) return true;
+	if (normalized.startsWith("2001:0:") || normalized.startsWith("2001:0000:") || normalized.startsWith("2001::")) return true;
 	if (normalized.startsWith("100::") || normalized.startsWith("0100::")) return true;
 	if (normalized.startsWith("64:ff9b:") || normalized.startsWith("0064:ff9b:")) return true;
 	return false;
 }
 /**
+* Strip what belongs to the interface or the transport rather than to the address: a zone index
+* (`fe80::1%eth0`) and, for an IPv4 literal, a trailing port (`8.8.8.8:443`).
+*
+* MUST be shared by every exported entry point. `isPrivateIP` and `isPrivateOrInternalHostname` each carry
+* their own family gate, and the comment on those gates says why they are kept identical: three gates
+* disagreeing about what counts as IPv4 is how the bracketed-IPv6 hole happened. Stripping in one of them
+* only reproduced exactly that - `8.8.8.8:443` came back public from one export and private from the other,
+* because the second missed its IPv4 branch and was then caught by the misplaced-quad arm.
+*
+* Only a DOTTED port is stripped. An unbracketed `ipv6:port` is genuinely ambiguous - a bare IPv6 address is
+* mostly colons - so it stays refused, and the bracketed spelling is what `normalizeIpv6` handles.
+*/
+function stripZoneAndIpv4Port(host) {
+	const head = host.split("%")[0];
+	const zoneless = head.includes(":") || /^(\d+\.){3}\d+$/.test(head) ? head : host;
+	return zoneless.match(/^((?:\d+\.){3}\d+):\d+$/)?.[1] ?? zoneless;
+}
+/**
 * Check if an IP address (IPv4 or IPv6) is in a private/internal range.
 */
 function isPrivateIP(ip) {
-	if (/^(\d{1,3}\.){3}\d{1,3}$/.test(ip)) return isPrivateIPv4(ip);
-	return isPrivateIPv6(ip);
+	const address = stripZoneAndIpv4Port(ip);
+	if (/^(\d+\.){3}\d+$/.test(address)) return isPrivateIPv4(address);
+	return isPrivateIPv6(address);
 }
 /**
 * Check if a hostname is known to be private/internal.
 * This catches obvious cases before DNS resolution.
 */
 function isPrivateOrInternalHostname(hostname) {
-	const normalized = hostname.toLowerCase();
+	const normalized = stripZoneAndIpv4Port(stripIpv6Brackets(hostname));
 	if (normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "0.0.0.0" || normalized.endsWith(".localhost") || normalized.endsWith(".local")) return true;
 	if (normalized === "169.254.169.254" || normalized === "instance-data" || normalized === "metadata.google.internal" || normalized === "metadata.internal") return true;
 	if (normalized.endsWith(".cluster.local") || normalized.endsWith(".svc.cluster.local") || normalized.endsWith(".pod.cluster.local")) return true;
-	if (/^(\d{1,3}\.){3}\d{1,3}$/.test(normalized)) return isPrivateIPv4(normalized);
+	if (/^(\d+\.){3}\d+$/.test(normalized)) return isPrivateIPv4(normalized);
 	if (normalized.includes(":")) return isPrivateIPv6(normalized);
 	return false;
 }
 /**
 * Validate a URL before fetching.
 * Blocks internal/private networks to prevent SSRF attacks.
-* Resolves DNS and validates resolved IPs to prevent DNS rebinding attacks.
+*
+* Resolves DNS and rejects the URL if any resolved IP is private. This is a PRE-FLIGHT check, and on
+* its own it does NOT stop DNS rebinding: the address it validates is not the address the eventual
+* socket dials, because the HTTP client resolves the hostname again when it connects. A name that
+* answers with a public IP here and a private one microseconds later passes this check and still
+* reaches the internal destination. `ssrfSafeLookup` below is what closes that window; this function
+* exists to fail fast, to produce a specific user-facing error, and to check the things a connect-time
+* hook cannot see - the scheme, and the literal address the caller actually typed.
 *
 * @param url - The URL to validate
 * @returns Object with valid flag and optional error message
@@ -7692,15 +8118,16 @@ async function validateUrlForFetch(url) {
 			valid: false,
 			error: "URL must use HTTP or HTTPS protocol"
 		};
-		if (isPrivateOrInternalHostname(parsed.hostname)) return {
+		const hostname = stripIpv6Brackets(parsed.hostname);
+		if (isPrivateOrInternalHostname(hostname)) return {
 			valid: false,
 			error: "URL points to a private or internal network"
 		};
-		const isIPv4Address = /^(\d{1,3}\.){3}\d{1,3}$/.test(parsed.hostname);
-		const isIPv6Address = parsed.hostname.includes(":");
+		const isIPv4Address = /^(\d+\.){3}\d+$/.test(hostname);
+		const isIPv6Address = hostname.includes(":");
 		if (!isIPv4Address && !isIPv6Address) try {
-			const ipv4Addresses = await dnsResolve4(parsed.hostname).catch(() => []);
-			const ipv6Addresses = await dnsResolve6(parsed.hostname).catch(() => []);
+			const ipv4Addresses = await dnsResolve4(hostname).catch(() => []);
+			const ipv6Addresses = await dnsResolve6(hostname).catch(() => []);
 			const allAddresses = [...ipv4Addresses, ...ipv6Addresses];
 			if (allAddresses.length === 0) return {
 				valid: false,
@@ -7724,6 +8151,93 @@ async function validateUrlForFetch(url) {
 		};
 	}
 }
+/** Marks a refusal that came from the connect-time hook, so callers can tell it from a DNS failure. */
+const SSRF_BLOCKED_CODE = "ERR_SSRF_BLOCKED_ADDRESS";
+/**
+* DNS lookup that re-validates at CONNECT time. THIS is the check that stops DNS rebinding.
+*
+* The pre-flight in `validateUrlForFetch` resolves the hostname and then hands the NAME to the HTTP
+* client, which resolves it a second time before opening the socket. Those are two different
+* resolutions, so an attacker who controls the authoritative server can answer the first with a
+* public address and the second with `169.254.169.254` - a textbook TOCTOU, and the reason the old
+* "this prevents DNS rebinding attacks" comment on that function was false.
+*
+* Installing this as the agent's `lookup` removes the gap rather than narrowing it: Node passes the
+* address this function returns straight to `net.connect`, so the IP that gets validated is by
+* construction the IP the socket dials. There is no third resolution in between for a rebind to win.
+*
+* Refuses if ANY resolved address is private, matching `validateUrlForFetch` - a dual-stack host must
+* not become reachable just because Node happened to prefer the healthy family this time.
+*
+* The two match in POLICY but deliberately differ in RESOLVER: `validateUrlForFetch` uses
+* `dns.resolve4`/`resolve6` (c-ares, straight to DNS) while this uses `dns.lookup` (getaddrinfo, which
+* also reads `/etc/hosts` and the OS cache). They can therefore legitimately disagree - an
+* `/etc/hosts` entry passes the pre-flight and is refused here. That is fail-closed and the right way
+* round, but it means "the URL validated and then the connection was blocked" is reachable in normal
+* operation and is NOT evidence that the pin is broken.
+*/
+const ssrfSafeLookup = (hostname, options, callback) => {
+	const resolveOptions = {
+		...options,
+		all: true
+	};
+	dns.lookup(hostname, resolveOptions, (err, addresses) => {
+		if (err) {
+			callback(err, "", 0);
+			return;
+		}
+		if (!addresses || addresses.length === 0) {
+			const empty = /* @__PURE__ */ new Error(`No addresses resolved for hostname ${hostname}`);
+			empty.code = "ENOTFOUND";
+			callback(empty, "", 0);
+			return;
+		}
+		const privateHit = addresses.find((entry) => isPrivateIP(entry.address));
+		if (privateHit) {
+			const blocked = /* @__PURE__ */ new Error(`Blocked connection to private IP address (${privateHit.address}) for hostname ${hostname}`);
+			blocked.code = SSRF_BLOCKED_CODE;
+			callback(blocked, "", 0);
+			return;
+		}
+		if (options.all) {
+			callback(null, addresses);
+			return;
+		}
+		callback(null, addresses[0].address, addresses[0].family);
+	});
+};
+/**
+* Agents that pin every connection through `ssrfSafeLookup`.
+*
+* Module-level singletons so sockets and their validation are shared, and deliberately WITHOUT
+* `keepAlive`: a pooled socket outlives the lookup that approved it, and reusing one would skip the
+* connect-time check on every request after the first.
+*
+* Any caller fetching an attacker-influenced URL should pass BOTH - the scheme is not known until
+* after redirects, and an https URL that 302s to http would otherwise slip past a single agent.
+*
+* SCOPE - these protect callers that fetch through Node's http/https stack, which today means
+* `fetchAndParseURL` in `ingest.ts` and nothing else. That does NOT mean other fetchers are unpinned:
+* the webfetch LLM tool (`services/src/llm/tools/implementation/webfetch/plainFetch.ts`) reaches the
+* same guarantee by a different route, and a reader should not go looking for a gap there that is
+* already closed. It vets via `ssrfGuard.ts`, then for http rewrites the URL's hostname to the vetted
+* IP while preserving `Host`, and sets `redirect: 'error'` so a public origin cannot 302-pivot at all.
+* That is connect-by-IP under global `fetch` - so the technique IS available there, and an
+* undici `Agent` with a validating `connect` is not required to pin.
+*
+* The honest residual over there is narrower: https keeps the hostname and leans on TLS validation, so
+* what is left is an SYN-level probe oracle rather than a rebind to a private target. The reason to
+* use the agents here instead is that axios drives a manual redirect chain over an arbitrary number of
+* hops and schemes, where per-request agent selection is the tractable place to enforce this.
+*/
+const ssrfSafeHttpAgent = new http.Agent({
+	lookup: ssrfSafeLookup,
+	keepAlive: false
+});
+const ssrfSafeHttpsAgent = new https.Agent({
+	lookup: ssrfSafeLookup,
+	keepAlive: false
+});
 const URL_REGEX = /https?:\/\/(?:[-\w.])+(?:\:[0-9]+)?(?:\/(?:[\w\/_.])*(?:\?(?:[\w&=%.])*)?(?:\#(?:[\w.])*)?)?/gi;
 function detectURLs(string) {
 	return string.match(URL_REGEX) || [];
@@ -7735,36 +8249,194 @@ function urlExists(stringWithPossibleUrl) {
 	return detectURLs(stringWithPossibleUrl.replace(/\n/g, " ").replace(/,/g, " "));
 }
 const URL_FETCH_TIMEOUT_MS = 1e4;
+/**
+* Redirect hops followed before giving up. Deliberately far below axios's own default of 21: every
+* hop costs a DNS resolution plus a request, and no legitimate document needs more than a couple.
+*/
+const MAX_REDIRECTS = 5;
+/**
+* Hard ceiling on a fetched body. A SAFETY NET against an unbounded response, not a policy limit -
+* `createFabFile` still enforces the `MaxFileSize` admin setting afterwards. Set generously (the
+* same 50MB as the Slack attachment ceiling) so it can never refuse something the app would accept;
+* without it axios defaults to `maxContentLength: -1`, i.e. buffer whatever the server sends, and
+* `@datalake add <link>` takes URLs from anyone who can type in a Slack channel.
+*/
+const URL_MAX_RESPONSE_BYTES = 52428800;
+/**
+* PDF test against the URL's PATH only. The previous form (`url.split('.').pop().startsWith('pdf')`)
+* also matched a query string, so `?doc=report.pdf` on an HTML page was fetched as a PDF.
+*/
+function isPdfUrl(url) {
+	return new URL(url).pathname.toLowerCase().endsWith(".pdf");
+}
+/**
+* True when the body opens with the PDF signature.
+*
+* Closes the door `isPdfUrl` cannot reach: a download endpoint with no `.pdf` in its path, served as
+* `application/octet-stream`, produced neither a Content-Type signal nor an extension signal and was
+* decoded as text - the same `toString('utf8')` corruption the Content-Type fallback exists to
+* prevent, arriving through the one remaining door. `/download?id=123` and `Content-Disposition`
+* attachment links are exactly this shape.
+*
+* Checked at offset 0 only. The PDF spec tolerates leading bytes before the header and readers scan
+* ahead for it, but scanning here would mean sniffing arbitrary attacker-supplied content to
+* RE-CLASSIFY it, and a false positive sends a real text document into the PDF parser. The strict
+* check costs nothing on well-formed files, which is every file this has been observed to affect.
+*
+* Deliberately consulted ONLY on the generic-binary branch, never to override a server that stated a
+* type. A server declaring `text/html` while sending PDF bytes is a different (and unobserved) bug,
+* and overriding an explicit Content-Type is a wider behaviour change than this fix needs.
+*/
+function hasPdfMagicBytes(body) {
+	return body.subarray(0, 5).toString("latin1") === "%PDF-";
+}
+/**
+* Strip embedded credentials before a URL is written to a log.
+*
+* `https://user:pass@host/doc` is a legitimate paste, and this function is reached from the Slack
+* `@datalake add` path and the LLM URL-fetch path - both of which take URLs from whoever can type in
+* a channel or a chat. The FETCH still uses the original URL; only what is recorded is redacted, and a
+* log line outlives the message that produced it.
+*
+* MUST STAY IN SYNC with `sanitizeUrlForRecord` in `apps/client/server/slack/dataLakeLinkIngest.ts`,
+* which does the same job for the PERSISTED provenance record. Deliberately duplicated rather than
+* shared: exporting this would change `fab-pipeline`'s public surface, which its own `index.test.ts`
+* pins as an explicit list of names.
+*/
+function redactUrlCredentials(raw) {
+	try {
+		const parsed = new URL(raw);
+		if (!parsed.username && !parsed.password) return raw;
+		parsed.username = "";
+		parsed.password = "";
+		return parsed.toString();
+	} catch {
+		return "[unparseable url]";
+	}
+}
+/** Last path segment, used only as a display-name fallback when a page has no `<title>`. */
+function lastPathSegment(url) {
+	try {
+		return new URL(url).pathname.split("/").filter(Boolean).pop() ?? url;
+	} catch {
+		return url.split("/")?.pop() ?? url;
+	}
+}
+/**
+* Fetch one URL without following redirects, so the caller can SSRF-validate each hop itself.
+*
+* SECURITY: this is why `maxRedirects: 0` is set rather than left at axios's default. Validating
+* only the URL the user supplied is not enough - axios would follow the redirect chain internally,
+* so any public host could answer `302 Location: http://169.254.169.254/latest/meta-data/` and the
+* guard would never see the address actually fetched.
+*
+* SECURITY: the agents are the OTHER half, and the two guard different attacks. Per-hop
+* `validateUrlForFetch` judges each address the chain names; the agents' `ssrfSafeLookup` judges the
+* IP each socket actually dials. Without the agents a hostname that passes validation and then
+* re-resolves to a private address on connect - DNS rebinding - reaches the internal destination with
+* every URL-level check having passed. Both are needed: the pre-flight sees the scheme and the typed
+* literal, the lookup sees the truth at connect time.
+*
+* `timeoutMs` is the budget REMAINING for the whole operation, not a fresh per-hop allowance - see
+* the deadline in `fetchAndParseURL`.
+*/
+async function fetchWithoutRedirects(url, timeoutMs) {
+	return axios.get(url, {
+		httpAgent: ssrfSafeHttpAgent,
+		httpsAgent: ssrfSafeHttpsAgent,
+		proxy: false,
+		responseType: "arraybuffer",
+		timeout: timeoutMs,
+		maxRedirects: 0,
+		maxContentLength: URL_MAX_RESPONSE_BYTES,
+		maxBodyLength: URL_MAX_RESPONSE_BYTES,
+		validateStatus: (status) => status >= 200 && status < 300 || status >= 300 && status < 400
+	});
+}
+const BLOCK_LEVEL_SELECTOR = `*:not(${"a, span, em, strong, b, i, u, code, kbd, samp, var, sub, sup, small, abbr, cite, q, time, mark, s, del, ins, bdi, bdo, wbr, ruby, rt, rp".split(", ").join("):not(")}):not(td):not(th)`;
+/**
+* Extract readable text from the WHOLE document, not just `<p>` elements. The single collector
+* this replaced was `<p>`-only and fell back to the raw HTML when it found none: on a page whose
+* content isn't inside `<p>` (an RFC page using `<pre>`) that meant the fallback fired and stored
+* markup verbatim; on a page with real substance in headings, list items, table cells or code
+* blocks alongside its `<p>`s, that content was silently dropped.
+*
+* `head` (title/meta/script/style all live there, and the caller already reads `<title>`
+* separately) plus any stray `script`/`style`/`noscript` outside it are removed before extraction,
+* so none of that reaches what gets embedded. `<pre>` content is pulled out and stashed BEFORE the
+* rest of the document is collapsed, and spliced back in verbatim afterward - it needs to skip the
+* whitespace-collapse below (a code block's leading-space indentation is meaningful, unlike prose
+* whitespace) but still needs to land in the right place relative to everything else. Table cells
+* get a trailing space (still the same row, but no longer jammed into the next cell's word); every
+* other block-level element gets a trailing newline; runs of whitespace and blank lines are then
+* collapsed. Returns `''` when nothing extractable was found, so the caller stores nothing rather
+* than falling back to raw HTML.
+*/
+function extractReadableText($) {
+	$("head, script, style, noscript").remove();
+	$("br").replaceWith("\n");
+	const nonce = Math.random().toString(36).slice(2) + Date.now().toString(36);
+	const markerFor = (index) => `\uE000PRE${nonce}_${index}\uE000`;
+	const markerPattern = new RegExp(`\\uE000PRE${nonce}_(\\d+)\\uE000`, "g");
+	const preBlocks = [];
+	$("pre").each((_index, element) => {
+		const text = $(element).text();
+		if (text) {
+			preBlocks.push(text);
+			$(element).replaceWith(`${markerFor(preBlocks.length - 1)}\n`);
+		} else $(element).remove();
+	});
+	$("td, th").each((_index, cell) => {
+		$(cell).after(" ");
+	});
+	$(BLOCK_LEVEL_SELECTOR).each((_index, element) => {
+		$(element).after("\n");
+	});
+	return $.root().text().split("\n").map((line) => line.replace(/[ \t]+/g, " ").trim()).filter(Boolean).join("\n").replace(markerPattern, (match, indexStr) => {
+		const index = Number(indexStr);
+		return index >= 0 && index < preBlocks.length ? preBlocks[index] : match;
+	});
+}
 async function fetchAndParseURL(url, { logger }) {
 	logger.updateMetadata({ failedUrl: null });
 	try {
-		const ssrfValidation = await validateUrlForFetch(url);
-		if (!ssrfValidation.valid) throw new Error(`URL blocked for security reasons: ${ssrfValidation.error}`);
-		let urlMimeType = "text/plain";
-		if (url.split(".")?.pop()?.startsWith("pdf")) urlMimeType = "application/pdf";
-		const response = await axios.get(url, {
-			responseType: ["application/pdf"].includes(urlMimeType) ? "arraybuffer" : "text",
-			timeout: URL_FETCH_TIMEOUT_MS
-		});
-		const cheerio = await import("cheerio");
-		const htmlContent = response.data;
-		const $ = cheerio.load(htmlContent);
-		const title = $("title").text() || url.split("/")?.pop();
-		let urlContent = null;
-		switch (urlMimeType) {
-			case "application/pdf":
-				urlContent = Buffer.from(response.data);
-				break;
-			default: {
-				let textContent = "";
-				$("body").find("p").each((index, element) => {
-					textContent += $(element).text() + "\n";
-				});
-				urlContent = textContent || htmlContent;
-				break;
-			}
-		}
-		logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${url}`);
+		let currentUrl = url;
+		let response = null;
+		const deadline = Date.now() + URL_FETCH_TIMEOUT_MS;
+		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+			const ssrfValidation = await validateUrlForFetch(currentUrl);
+			if (!ssrfValidation.valid) throw new Error(`URL blocked for security reasons: ${ssrfValidation.error}`);
+			const remainingMs = deadline - Date.now();
+			if (remainingMs <= 0) throw new Error("Timed out while following redirects for URL");
+			response = await fetchWithoutRedirects(currentUrl, remainingMs);
+			if (!(response.status >= 300 && response.status < 400)) break;
+			const location = response.headers?.location;
+			if (typeof location !== "string" || location.length === 0) break;
+			if (hop === MAX_REDIRECTS) throw new Error(`Too many redirects (more than ${MAX_REDIRECTS}) while fetching URL`);
+			currentUrl = new URL(location, currentUrl).toString();
+		}
+		if (!response) throw new Error("URL fetch produced no response");
+		const body = Buffer.isBuffer(response.data) ? response.data : Buffer.from(response.data);
+		const contentType = String(response.headers?.["content-type"] ?? "").toLowerCase();
+		const isGenericBinary = !contentType || contentType.includes("application/octet-stream") || contentType.includes("binary/octet-stream");
+		const urlMimeType = contentType.includes("application/pdf") || isGenericBinary && (isPdfUrl(currentUrl) || hasPdfMagicBytes(body)) ? "application/pdf" : "text/plain";
+		let title;
+		let urlContent;
+		if (urlMimeType === "application/pdf") {
+			urlContent = body;
+			title = lastPathSegment(currentUrl);
+		} else {
+			const cheerio = await import("cheerio");
+			const htmlContent = body.toString("utf8");
+			const $ = cheerio.load(htmlContent);
+			title = $("title").text() || lastPathSegment(currentUrl);
+			urlContent = extractReadableText($);
+		}
+		const original = redactUrlCredentials(url);
+		const final = redactUrlCredentials(currentUrl);
+		const fetched = original === final ? original : `${original} -> ${final}`;
+		if (urlContent === "") logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${fetched}, but no extractable text was found`);
+		else logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${fetched}`);
 		return {
 			title,
 			textContent: urlContent,
@@ -7772,7 +8444,7 @@ async function fetchAndParseURL(url, { logger }) {
 			ext: mime.extension(urlMimeType) || null
 		};
 	} catch (error) {
-		logger.updateMetadata({ failedUrl: url });
+		logger.updateMetadata({ failedUrl: redactUrlCredentials(url) });
 		logger.debug("Error fetching or parsing URL:", error);
 		throw error;
 	}
@@ -10730,7 +11402,6 @@ var ReActAgent = class extends EventEmitter {
 		this.context = {
 			...context,
 			maxIterations: context.maxIterations ?? 50,
-			maxTokens: context.maxTokens ?? 4096,
 			temperature: context.temperature ?? .7
 		};
 		this.repeatedCallGuard = new RepeatedCallGuard(context.repeatedCallGuard);
@@ -10775,7 +11446,7 @@ var ReActAgent = class extends EventEmitter {
 	*/
 	async completeText(prompt, options = {}) {
 		const model = options.model ?? this.context.model;
-		const maxTokens = options.maxTokens ?? this.context.maxTokens ?? 4096;
+		const maxTokens = options.maxTokens ?? this.context.maxTokens;
 		const temperature = options.temperature ?? this.context.temperature ?? .7;
 		let text = "";
 		await this.context.llm.complete(model, [{
@@ -10816,7 +11487,7 @@ var ReActAgent = class extends EventEmitter {
 		this.isReadOnlyToolFn = options.isReadOnlyTool ?? defaultIsReadOnlyTool;
 		const maxIterations = options.maxIterations ?? this.context.maxIterations ?? 50;
 		const temperature = options.temperature ?? this.context.temperature ?? .7;
-		const maxTokens = options.maxTokens ?? this.context.maxTokens ?? 4096;
+		const maxTokens = options.maxTokens ?? this.context.maxTokens;
 		const maxTotalTokens = options.maxTotalTokens ?? this.context.maxTotalTokens;
 		const maxHistoryIterations = options.maxHistoryIterations ?? 4;
 		let iterations = 0;
@@ -10857,7 +11528,8 @@ var ReActAgent = class extends EventEmitter {
 							totalCacheWriteTokens: this.totalCacheWriteTokens > 0 ? this.totalCacheWriteTokens : void 0,
 							iterations,
 							toolCalls: this.toolCallCount,
-							reachedMaxIterations: false
+							reachedMaxIterations: false,
+							finishReason: this.lastStopReason
 						}
 					};
 					this.emit("complete", result);
@@ -11091,6 +11763,7 @@ var ReActAgent = class extends EventEmitter {
 					toolCalls: this.toolCallCount,
 					reachedMaxIterations,
 					reachedMaxTotalTokens: reachedMaxTotalTokens || void 0,
+					finishReason: this.lastStopReason,
 					averageConfidence: avgConfidence,
 					minConfidence,
 					confidenceLog: this.confidenceLog.length > 0 ? this.confidenceLog : void 0
@@ -11322,7 +11995,7 @@ Remember: You are an autonomous AGENT. Act independently and solve problems proa
 	async runIteration(query, options = {}) {
 		const maxIterations = options.maxIterations ?? this.context.maxIterations ?? 50;
 		const temperature = options.temperature ?? this.context.temperature ?? .7;
-		const maxTokens = options.maxTokens ?? this.context.maxTokens ?? 4096;
+		const maxTokens = options.maxTokens ?? this.context.maxTokens;
 		const maxTotalTokens = options.maxTotalTokens ?? this.context.maxTotalTokens;
 		if (!this.iterationInitialized) {
 			if (!query) throw new Error("query is required on the first call to runIteration(). Pass the user query, or call fromCheckpoint() first to resume.");
@@ -12506,10 +13179,117 @@ const vm = require('node:vm');
 const STDOUT_HEAD_BYTES = ${5e3};
 const STDOUT_TAIL_BYTES = ${2e3};
 const HARD_PER_LINE_BYTES = ${5e4};
+const MIRROR_TAIL_FLUSH_MS = ${100};
 
 let stdoutChunks = [];
-let stdoutBytes = 0;
 let truncated = false;
+// --- Mirror state --------------------------------------------------------
+// Mirrors this run's stdout to the main thread as it is produced, in the same
+// head + marker + tail shape collectStdout() produces, so a retired run and a
+// completed one report the same thing by the same rule.
+//
+// The two halves are cost-bounded differently. The head is mirrored line by
+// line, so a chatty loop stops paying per line once the head is full. Past
+// that the tail is kept locally in a rolling window and posted on a timer, so
+// the message rate stops tracking the line rate entirely.
+let currentRunId = null;
+let mirroredHeadBytes = 0;
+let headMirrorFull = false;
+let tailChunks = [];
+let tailBytes = 0;
+let elidedBytes = 0;
+let tailFlushTimer = null;
+
+/**
+ * What the rolling tail may hold: whatever the head did not use of the same
+ * HEAD + TAIL total collectStdout() reports within. A fixed TAIL budget made
+ * the two disagree whenever the head came up short - a single 6KB first line
+ * does not fit the head, so the mirror would have kept 2KB of a run that
+ * collectStdout() reports whole, and called it truncated. mirroredHeadBytes
+ * is frozen once the head is full, so this is stable for the rest of the run.
+ */
+function tailBudget() {
+  return STDOUT_HEAD_BYTES + STDOUT_TAIL_BYTES - mirroredHeadBytes;
+}
+
+function postToMain(msg) {
+  try { parentPort.postMessage(msg); } catch { /* worker being torn down; nothing to preserve */ }
+}
+function cancelTailFlush() {
+  if (tailFlushTimer === null) return;
+  clearTimeout(tailFlushTimer);
+  tailFlushTimer = null;
+}
+function flushTail() {
+  if (currentRunId === null || !headMirrorFull) return;
+  const joined = tailChunks.join('\n');
+  // The rolling window is trimmed line by line, so it can only exceed the
+  // budget by holding ONE line longer than the whole budget. Slice to the
+  // same last-N-chars rule collectStdout() uses, which both matches that
+  // path and keeps the flush payload bounded - a guest printing 50KB lines
+  // would otherwise re-send 50KB on every tick.
+  const overflow = Math.max(0, joined.length - tailBudget());
+  postToMain({
+    type: 'stdoutTail',
+    id: currentRunId,
+    tail: overflow > 0 ? joined.slice(overflow) : joined,
+    // Counted from what was actually DROPPED - lines the rolling window
+    // evicted, plus whatever this payload's own slice cuts - rather than
+    // derived from the byte totals. The derived form read zero on the first
+    // flush by construction (every line was still in the head, so the
+    // subtraction cancelled), which made "truncated" unreportable on exactly
+    // the run the mirror exists for.
+    elidedBytes: elidedBytes + overflow,
+  });
+}
+function scheduleTailFlush() {
+  if (tailFlushTimer !== null) return;
+  tailFlushTimer = setTimeout(() => {
+    tailFlushTimer = null;
+    flushTail();
+  }, MIRROR_TAIL_FLUSH_MS);
+}
+function mirrorLine(capped) {
+  if (currentRunId === null) return;
+  if (!headMirrorFull) {
+    // Does THIS line fit, rather than "is the running total already over".
+    // Both of the orderings tried before this were wrong in one direction
+    // each: gating on the running total let one line of up to
+    // HARD_PER_LINE_BYTES past a 5KB budget (mirrored head ~55KB, disagreeing
+    // with collectStdout's head and with the "~7K chars" codeExecuteTool
+    // advertises to the model), while adding first and checking after moved
+    // the boundary but kept the crossing line in the head - so the tail was
+    // still empty at the immediate flush below and a run killed right there
+    // dropped the last line before the hang and reported itself complete.
+    //
+    // A fit check does both: the head stops at STDOUT_HEAD_BYTES exactly, and
+    // the line that did not fit STARTS the tail, so the flush that fires on
+    // this same call carries it.
+    if (mirroredHeadBytes + capped.length + 1 <= STDOUT_HEAD_BYTES) {
+      mirroredHeadBytes += capped.length + 1;
+      postToMain({ type: 'stdout', id: currentRunId, chunk: capped });
+      return;
+    }
+    headMirrorFull = true;
+    tailChunks.push(capped);
+    tailBytes += capped.length + 1;
+    // Post once immediately: a run killed before the first timed flush would
+    // otherwise report a short mirror as if it were complete.
+    flushTail();
+    return;
+  }
+  tailChunks.push(capped);
+  tailBytes += capped.length + 1;
+  // Never evict the only line held: a line larger than the whole budget is
+  // still the last thing the run printed, which is what the mirror is for.
+  const budget = tailBudget();
+  while (tailBytes > budget && tailChunks.length > 1) {
+    const dropped = tailChunks.shift();
+    tailBytes -= dropped.length + 1;
+    elidedBytes += dropped.length + 1;
+  }
+  scheduleTailFlush();
+}
 function captureLine(args) {
   const line = args.map(a => {
     if (typeof a === 'string') return a;
@@ -12521,7 +13301,7 @@ function captureLine(args) {
     ? line.slice(0, HARD_PER_LINE_BYTES) + ' [...line truncated]'
     : line;
   stdoutChunks.push(capped);
-  stdoutBytes += capped.length + 1;
+  mirrorLine(capped);
 }
 function jsonReplacer(_k, v) {
   if (v instanceof Error) return { name: v.name, message: v.message };
@@ -12622,7 +13402,11 @@ parentPort.on('message', async (msg) => {
   }
   if (msg.type === 'runCode') {
     const t0 = Date.now();
-    stdoutChunks = []; stdoutBytes = 0; truncated = false;
+    stdoutChunks = []; truncated = false;
+    cancelTailFlush();
+    currentRunId = msg.id;
+    mirroredHeadBytes = 0; headMirrorFull = false;
+    tailChunks = []; tailBytes = 0; elidedBytes = 0;
     let error = null;
     const wrapped = '(async () => {\n' + msg.code + '\n})()';
     try {
@@ -12634,6 +13418,11 @@ parentPort.on('message', async (msg) => {
     } catch (e) {
       error = serializeError(e);
     }
+    // Stop mirroring before the authoritative result goes out, so a late
+    // console.log from an abandoned continuation cannot attach to this run,
+    // and a pending tail flush cannot land after it.
+    currentRunId = null;
+    cancelTailFlush();
     parentPort.postMessage({
       type: 'runResult',
       id: msg.id,
@@ -12647,6 +13436,17 @@ parentPort.on('message', async (msg) => {
 });
 `;
 String.raw`
+// Wrapped in an IIFE deliberately. A script's top-level const/let bind into the
+// context's SHARED global lexical scope (and its function declarations become
+// globalThis properties), so without this wrapper every bootstrap-local name is
+// directly referenceable by LLM-authored code run later in the same context:
+// __RealFunction('...')() walks straight around the codegen block below, and
+// __cap.applySync(...) / __cap.release() forges or permanently kills stdout
+// capture. Function scope keeps them unreachable. Note the leak is invisible to
+// listGlobals(), which reads Object.getOwnPropertyNames(globalThis) and never
+// saw the lexical bindings - so RESERVED_GLOBAL_NAMES cannot backstop it either.
+// Anything guest code IS meant to see is assigned onto globalThis explicitly.
+(function () {
 const __cap = _captureLine;
 const __callTool = _callTool;
 delete globalThis._captureLine;
@@ -12654,28 +13454,68 @@ delete globalThis._callTool;
 
 const HARD_PER_LINE_BYTES = ${5e4};
 
+// Every intrinsic the formatter below reaches for is captured HERE, while the
+// context is still pristine. Resolving \`args.map\` / \`.join\` / \`line.slice\`
+// at CALL time walks a prototype chain the guest owns, so one
+// \`Array.prototype.join = () => 'X'\` - deliberate, or an innocent polyfill -
+// forges every stdout line for the rest of the session, and the run still
+// reports error=null / truncated=false. That is the same integrity failure the
+// frozen \`console\` below exists to prevent, one level down: freezing the
+// binding is worthless if the formatter behind it is guest-reachable.
+const __stringify = JSON.stringify;
+const __String = String;
+const __apply = Reflect.apply;
+const __strSlice = String.prototype.slice;
+
 function __jsonReplacer(_k, v) {
   if (v instanceof Error) return { name: v.name, message: v.message };
   if (typeof v === 'bigint') return v.toString() + 'n';
   return v;
 }
+// Indexed loop and \`+=\` rather than map/join: string concatenation is an
+// operator, not a lookup, so there is nothing here for the guest to replace.
+// What a guest CAN still steer is how its own values render - a \`toJSON\` or
+// \`toString\` on the object it passed - which is content it already owns, not
+// the channel.
 function __formatLine(args) {
-  const line = args.map(a => {
-    if (typeof a === 'string') return a;
-    if (a === undefined) return 'undefined';
-    if (a === null) return 'null';
-    try { return JSON.stringify(a, __jsonReplacer, 2); } catch { return String(a); }
-  }).join(' ');
+  let line = '';
+  for (let i = 0; i < args.length; i++) {
+    if (i > 0) line += ' ';
+    const a = args[i];
+    if (typeof a === 'string') { line += a; continue; }
+    if (a === undefined) { line += 'undefined'; continue; }
+    if (a === null) { line += 'null'; continue; }
+    try { line += __stringify(a, __jsonReplacer, 2); } catch { line += __String(a); }
+  }
   return line.length > HARD_PER_LINE_BYTES
-    ? line.slice(0, HARD_PER_LINE_BYTES) + ' [...line truncated]'
+    ? __apply(__strSlice, line, [0, HARD_PER_LINE_BYTES]) + ' [...line truncated]'
     : line;
 }
-globalThis.console = {
+// stdout is the channel the HOST reports back as the run's observation, so its
+// integrity is ours, not the guest's. A plain assignment left \`console\`
+// writable and configurable: guest code could set globalThis.console = {log(){}}
+// (or just reassign console.log) and every later run in the session would come
+// back with stdout="" or forged lines, error=null, and a clean listGlobals().
+// Frozen object + non-writable, non-configurable property: the guest's
+// assignment is a silent no-op in sloppy mode and a TypeError under 'use
+// strict', and either way capture keeps working.
+//
+// The BINDING is what this protects, and the binding is only half of it: a
+// frozen console whose formatter resolved its intrinsics at call time would
+// still hand the guest every line. That half is closed above, where
+// __formatLine captures what it needs.
+const __console = Object.freeze({
   log: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   warn: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   error: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   info: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
-};
+});
+Object.defineProperty(globalThis, 'console', {
+  value: __console,
+  writable: false,
+  configurable: false,
+  enumerable: true,
+});
 
 // A bare isolate has no structuredClone (it's a host/web API, not a V8
 // intrinsic). The in-process + worker backends expose the *host's* real
@@ -12763,11 +13603,33 @@ for (const __Ctor of [__RealFunction, __AsyncFunction, __GeneratorFunction, __As
 globalThis.eval = __blockCodegen;
 globalThis.Function = __blockCodegen;
 
+// WebAssembly is removed, not stubbed. Its compile/instantiate promises never
+// settle inside an isolated-vm isolate (there is no host task runner to drive
+// them), so \`await WebAssembly.instantiate(...)\` is a one-line way for guest
+// code to park a run until the host deadline fires - and that deadline kills
+// the isolate, costing the whole session its sandbox. Deleting it turns that
+// into an immediate ReferenceError. It is also codegen-from-bytes, so it
+// belongs on the same side of the line as eval / Function anyway.
+delete globalThis.WebAssembly;
+
 // Tool-stub registry. Each registered tool becomes a top-level async
 // function that round-trips through the host dispatcher and re-throws on
 // the { ok:false } envelope.
+//
+// Assigned to globalThis only so the constructor can lift a Reference to it;
+// the constructor deletes the global immediately afterwards and calls it
+// through that Reference forever after. It must NOT stay guest-reachable: a
+// guest could call __registerTools(['console']) to overwrite the frozen
+// console binding with a tool stub, or \`delete\` it and make the host's next
+// setTools() throw.
+//
+// Indexed loop, not for..of, deliberately: the host calls this with a copied
+// array whose iterator comes from the GUEST's Array.prototype, so an
+// overridden Symbol.iterator would let guest code hang or hijack a host-side
+// setTools() call. Indexing touches only the copy's own properties.
 globalThis.__registerTools = function (names) {
-  for (const name of names) {
+  for (let i = 0; i < names.length; i++) {
+    const name = names[i];
     globalThis[name] = async (...args) => {
       const envJson = await __callTool.apply(
         undefined,
@@ -12780,6 +13642,7 @@ globalThis.__registerTools = function (names) {
     };
   }
 };
+})();
 `;
 z$1.object({
 	reflection: z$1.string().min(1),
@@ -15072,6 +15935,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	AnthropicBackend: () => AnthropicBackend,
 	AnthropicBatchService: () => AnthropicBatchService,
 	AnthropicBedrockBackend: () => AnthropicBedrockBackend,
+	BEDROCK_REQUEST_HANDLER: () => BEDROCK_REQUEST_HANDLER,
 	BFLBackend: () => BFLBackend,
 	BaseBedrockBackend: () => BaseBedrockBackend,
 	ChoiceEndReason: () => ChoiceEndReason,
@@ -15107,6 +15971,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	buildApiKeyTable: () => buildApiKeyTable,
 	buildSupersededIndex: () => buildSupersededIndex,
 	buildThinkingParams: () => buildThinkingParams,
+	cachedTokensFromUsage: () => cachedTokensFromUsage,
 	catalogLifecycles: () => catalogLifecycles,
 	catalogSuccessors: () => catalogSuccessors,
 	checkStaleModelReferences: () => checkStaleModelReferences,
@@ -15128,6 +15993,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	logExpiringModels: () => logExpiringModels,
 	mergeCatalog: () => mergeCatalog,
 	mergeCatalogWithDrops: () => mergeCatalogWithDrops,
+	normalizeToolUseInputs: () => normalizeToolUseInputs,
 	reasonsWithinOutputBudget: () => reasonsWithinOutputBudget,
 	recordDeprecatedModelRequest: () => recordDeprecatedModelRequest,
 	replaceLastToolResultObservationCanonical: () => replaceLastToolResultObservationCanonical,
@@ -15142,6 +16008,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	resolveSuccessorChain: () => resolveSuccessorChain,
 	setModelCatalogProvider: () => setModelCatalogProvider,
 	setModelPriceRowsProvider: () => setModelPriceRowsProvider,
+	splitCacheInclusiveInput: () => splitCacheInclusiveInput,
 	stripAllToolBlocks: () => stripAllToolBlocks,
 	stripToolDependentMessages: () => stripToolDependentMessages,
 	toKimiEffort: () => toKimiEffort,
@@ -15227,6 +16094,44 @@ async function runWithConcurrency(tasks, limit) {
 	return results;
 }
 /**
+* Attaches a tool call's outcome onto its `toolsUsed` entry so it survives into
+* `promptMeta.functionCalls.returnValue`/`.success` (see ChatCompletionProcess.ts's mapper
+* and utils.ts's `replayableToolCalls`, which gates a whole replay path on at least one
+* recorded `returnValue`). Every backend pushes a `toolsUsed` entry before executing the
+* tool and only learns the real outcome a few lines later - this is the merge-back.
+*/
+/**
+* Cap applied to a persisted `returnValue` before it reaches Mongo (chars, not bytes). Also the
+* cap on what a later turn replays back to the model for this call (utils.ts's Priority 2
+* reconstruction reads the same persisted, already-truncated value) - this is not a
+* persistence-only limit, it is what a continued conversation sees of an older tool result too.
+*/
+const MAX_RECORDED_TOOL_RESULT_CHARS = 8e3;
+const TOOL_RESULT_TRUNCATION_NOTICE = "\n[tool result truncated]";
+function truncateToolResult(observation) {
+	if (observation.length <= 8e3) return observation;
+	return observation.slice(0, MAX_RECORDED_TOOL_RESULT_CHARS) + TOOL_RESULT_TRUNCATION_NOTICE;
+}
+/**
+* Finds the NOT-YET-STAMPED `toolsUsed` entry for this call (id-first, falling back to the
+* first unstamped entry with the same name when a provider omitted an id) and attaches the
+* truncated result. The "not yet stamped" filter (`success === undefined`) is what keeps this
+* safe across recursive tool-call turns: `toolsUsed` accumulates across rounds, so a later
+* turn's call to the same tool must not overwrite an earlier turn's already-recorded entry.
+* Never throws - a call with no matching entry (e.g. one filtered out before execution) is a
+* silent no-op, matching the tolerance the existing normalize-by-id sites already have.
+*/
+function recordToolResult(toolsUsed, call, observation, success) {
+	const wantId = call.id || void 0;
+	const entry = toolsUsed.find((t) => t.success === void 0 && t.name === call.name && (wantId === void 0 || t.id === wantId));
+	if (!entry) {
+		Logger.globalInstance.debug(`[recordToolResult] no unstamped toolsUsed entry matched name=${call.name} id=${call.id ?? "(none)"} - result not recorded`);
+		return;
+	}
+	entry.returnValue = truncateToolResult(String(observation));
+	entry.success = success;
+}
+/**
 * Helper function to handle tool result streaming for artifact-generating tools
 * This ensures tools like recharts that generate artifacts are streamed immediately
 * rather than waiting for recursive completion calls.
@@ -15463,27 +16368,112 @@ const stripAllToolBlocks = (messages, logger) => {
 	return result;
 };
 /**
+* Restores `input: {}` on any `tool_use` block that reached us without one.
+*
+* `MessageContentToolUse.input` is non-optional in the type system, so nothing upstream checks it -
+* but a message that round-trips through a persistence or serialization layer can lose it. The
+* known offender is Mongoose's default `minimize`, which deletes empty objects on
+* `toObject()`/`toJSON()`: a zero-argument tool call (`current_datetime`, `mission_status`, ...)
+* stores `input: {}` and reads back with the key gone. Anthropic then rejects the whole request
+* with "messages.N.content.M.tool_use.input: Field required", killing a resumed agent run or a
+* chat turn that replays history.
+*
+* The schema that caused it is fixed at the source (`minimize: false` on AgentExecutionModel), so
+* this is the last line of defense for every other store that replays blocks verbatim -
+* `QuestModel.structuredReplies[].content` is the same Mixed-under-default-minimize shape and is
+* deliberately covered here rather than by widening that hot collection's schema. The cost of a
+* miss is a hard 400, and `{}` is the only value a zero-argument call could have had.
+*
+* Returns the input array unchanged (same reference) when nothing needed repair.
+*/
+const normalizeToolUseInputs = (messages, logger) => {
+	let repaired = 0;
+	const result = messages.map((message) => {
+		if (!Array.isArray(message.content)) return message;
+		let messageChanged = false;
+		const content = message.content.map((block) => {
+			if (block.type !== "tool_use") return block;
+			const toolUse = block;
+			if (toolUse.input !== null && typeof toolUse.input === "object") return block;
+			repaired++;
+			messageChanged = true;
+			return {
+				...toolUse,
+				input: {}
+			};
+		});
+		return messageChanged ? {
+			...message,
+			content
+		} : message;
+	});
+	if (repaired === 0) return messages;
+	logger?.warn(`[Tool Input Repair] Restored empty input on ${repaired} tool_use block(s) that lost it in serialization`);
+	return result;
+};
+/**
+* Anthropic's hard ceiling on `cache_control` markers per request. Exceeding it fails the
+* WHOLE request with `ValidationException: A maximum of 4 blocks with cache_control may be
+* provided`, which is non-retryable - so an over-budget request loses the turn outright,
+* after the user has already waited for it.
+*/
+const MAX_CACHE_CONTROL_BLOCKS = 4;
+/**
+* Does this block already carry a marker? Re-marking one costs no budget.
+*
+* Tests the VALUE, not just key presence: a block carrying an explicit
+* `cache_control: undefined` is not a marker as far as the provider is concerned, and counting
+* it would spend budget on nothing and drop a breakpoint we could have kept.
+*/
+function hasMarker(block) {
+	return !!block && typeof block === "object" && !!block.cache_control;
+}
+/**
+* Markers already on the request. Callers upstream attach their own before this runs -
+* `bedrockBackend/anthropic.ts` marks each system block flagged `cache: true` (the mid-stack
+* shareable-prefix breakpoint) - so this adapter's budget is whatever they left, not the full four.
+*/
+function censusMarkers(params) {
+	const tools = Array.isArray(params.tools) ? params.tools.filter(hasMarker).length : 0;
+	const system = Array.isArray(params.system) ? params.system.filter(hasMarker).length : 0;
+	let messages = 0;
+	if (Array.isArray(params.messages)) for (const message of params.messages) {
+		const content = message?.content;
+		if (Array.isArray(content)) messages += content.filter(hasMarker).length;
+	}
+	return {
+		tools,
+		system,
+		messages,
+		total: tools + system + messages
+	};
+}
+/**
 * Anthropic-specific caching adapter
 * Adds explicit cache_control markers to content blocks
 */
 var AnthropicCachingAdapter = class {
-	applyCaching(apiParams, strategy) {
+	applyCaching(apiParams, strategy, logger) {
 		if (!strategy.enableCaching) return apiParams;
 		const ttl = strategy.cacheTTL ?? "5m";
 		const modifiedParams = { ...apiParams };
-		const tools = modifiedParams.tools;
-		if (strategy.cacheTools && Array.isArray(tools) && tools.length > 0) {
-			const toolsCopy = [...tools];
-			const lastTool = toolsCopy[toolsCopy.length - 1];
-			toolsCopy[toolsCopy.length - 1] = {
-				...lastTool,
-				cache_control: {
-					type: "ephemeral",
-					...ttl === "1h" ? { ttl } : {}
-				}
-			};
-			modifiedParams.tools = toolsCopy;
-		}
+		const cacheControl = {
+			type: "ephemeral",
+			...ttl === "1h" ? { ttl } : {}
+		};
+		const inbound = censusMarkers(modifiedParams);
+		let budget = MAX_CACHE_CONTROL_BLOCKS - inbound.total;
+		const dropped = [];
+		/** Claim one marker slot, or record the miss. Re-marking a marked block is free. */
+		const claim = (name, alreadyMarked) => {
+			if (alreadyMarked) return true;
+			if (budget <= 0) {
+				dropped.push(name);
+				return false;
+			}
+			budget -= 1;
+			return true;
+		};
 		const systemParam = modifiedParams.system;
 		if (strategy.cacheSystemPrompt && systemParam) {
 			const systemArray = Array.isArray(systemParam) ? [...systemParam] : [{
@@ -15492,14 +16482,13 @@ var AnthropicCachingAdapter = class {
 			}];
 			if (systemArray.length > 0) {
 				const lastBlock = systemArray[systemArray.length - 1];
-				systemArray[systemArray.length - 1] = {
-					...lastBlock,
-					cache_control: {
-						type: "ephemeral",
-						...ttl === "1h" ? { ttl } : {}
-					}
-				};
-				modifiedParams.system = systemArray;
+				if (claim("system", hasMarker(lastBlock))) {
+					systemArray[systemArray.length - 1] = {
+						...lastBlock,
+						cache_control: cacheControl
+					};
+					modifiedParams.system = systemArray;
+				}
 			}
 		}
 		const messagesParam = modifiedParams.messages;
@@ -15515,24 +16504,65 @@ var AnthropicCachingAdapter = class {
 					text: msgContent
 				}];
 				else if (Array.isArray(msgContent)) contentArray = [...msgContent];
-				else return modifiedParams;
-				if (contentArray.length > 0) {
+				if (contentArray && contentArray.length > 0) {
 					const lastBlock = contentArray[contentArray.length - 1];
-					contentArray[contentArray.length - 1] = {
-						...lastBlock,
-						cache_control: {
-							type: "ephemeral",
-							...ttl === "1h" ? { ttl } : {}
-						}
-					};
-					messages[anchorIndex] = {
-						...anchorMsg,
-						content: contentArray
-					};
-					modifiedParams.messages = messages;
+					if (claim("history", hasMarker(lastBlock))) {
+						contentArray[contentArray.length - 1] = {
+							...lastBlock,
+							cache_control: cacheControl
+						};
+						messages[anchorIndex] = {
+							...anchorMsg,
+							content: contentArray
+						};
+						modifiedParams.messages = messages;
+					}
 				}
 			}
 		}
+		const tools = modifiedParams.tools;
+		if (strategy.cacheTools && Array.isArray(tools) && tools.length > 0) {
+			const toolsCopy = [...tools];
+			const lastTool = toolsCopy[toolsCopy.length - 1];
+			if (claim("tools", hasMarker(lastTool))) {
+				toolsCopy[toolsCopy.length - 1] = {
+					...lastTool,
+					cache_control: cacheControl
+				};
+				modifiedParams.tools = toolsCopy;
+			}
+		}
+		const outbound = censusMarkers(modifiedParams);
+		const census = {
+			inbound,
+			outbound,
+			limit: MAX_CACHE_CONTROL_BLOCKS
+		};
+		if (outbound.total >= MAX_CACHE_CONTROL_BLOCKS) {
+			const message = "[PromptCache] cache_control census at the ceiling";
+			if (logger) logger.info(message, census);
+			else console.info(message, JSON.stringify(census));
+		} else if (logger) logger.debug("[PromptCache] cache_control census", census);
+		if (outbound.total > MAX_CACHE_CONTROL_BLOCKS) {
+			const message = `[PromptCache] request exceeds the ${MAX_CACHE_CONTROL_BLOCKS}-block cache_control limit on arrival (${outbound.total}); the provider will reject it`;
+			const detail = {
+				inbound,
+				outbound,
+				limit: MAX_CACHE_CONTROL_BLOCKS
+			};
+			if (logger) logger.error(message, detail);
+			else console.error(message, JSON.stringify(detail));
+		} else if (dropped.length > 0) {
+			const message = `[PromptCache] cache_control budget exhausted (limit ${MAX_CACHE_CONTROL_BLOCKS}); skipped breakpoints: ${dropped.join(", ")}`;
+			const detail = {
+				dropped,
+				inbound,
+				outbound,
+				limit: MAX_CACHE_CONTROL_BLOCKS
+			};
+			if (logger) logger.warn(message, detail);
+			else console.warn(message, JSON.stringify(detail));
+		}
 		return modifiedParams;
 	}
 	extractCacheStats(response, model) {
@@ -15742,6 +16772,25 @@ function getCachingAdapter(backend) {
 	return ADAPTERS[backend] || new NoOpCachingAdapter();
 }
 /**
+* Flatten a system message's content to the plain text a provider should receive.
+*
+* System content is usually a string, but the assembly pipeline can hand back an
+* array of content blocks. Both Anthropic-family adapters previously coerced that
+* array with `JSON.stringify` (or bare `String()`), which sent the model literal
+* JSON syntax - escaped quotes and `type`/`text` keys - in place of the prompt.
+*
+* Only `text` blocks are read: Anthropic's `system` accepts text only, so an image
+* or tool block there is already invalid and is dropped rather than serialized into
+* the prompt. Blocks are joined on a newline, matching how separate system messages
+* are joined by the callers.
+*/
+function systemContentToText(content) {
+	if (content === void 0 || content === null) return "";
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	return content.filter((block) => block?.type === "text").map((block) => block.text ?? "").filter((text) => text.trim() !== "").join("\n");
+}
+/**
 * max_tokens floor for adaptive reasoning models (Claude 4.7+/Opus 5). These
 * models self-manage extended thinking *within* max_tokens, which is a ceiling
 * (they stop at end_turn), not a target - so a larger floor costs nothing on
@@ -15805,8 +16854,17 @@ function reasonsWithinOutputBudget(modelInfo) {
 * be consumed entirely by reasoning, leaving an empty visible reply.
 */
 function resolveOutputMaxTokens({ requested, fallback, modelInfo, modelMaxOutputTokens }) {
-	const preferred = requested ?? (reasonsWithinOutputBudget(modelInfo) ? 64e3 : fallback);
-	return Math.min(preferred, modelMaxOutputTokens);
+	const preferred = usableTokenCount(requested) ?? (reasonsWithinOutputBudget(modelInfo) ? 64e3 : fallback);
+	const cap = usableTokenCount(modelMaxOutputTokens);
+	return cap === void 0 ? preferred : Math.min(preferred, cap);
+}
+/**
+* Token counts reaching this module come from catalog rows and external callers, so they are
+* only trustworthy when finite and positive - a zero or negative cap would clamp the budget
+* to an unsendable value just as surely as NaN poisons it.
+*/
+function usableTokenCount(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
 /**
 * Builds the correct thinking parameters for an Anthropic API call based on
@@ -15995,6 +17053,12 @@ const SLOW_MODEL_REQUEST_TIMEOUT_MS = 12e4;
 */
 const ANTHROPIC_NONSTREAMING_MAX_TOKENS = 21e3;
 /**
+* Output budget used when the caller names none. Only applies to models that do NOT spend
+* reasoning inside the output budget - resolveOutputMaxTokens sizes the rest for the model,
+* so this value stays the historical one and non-reasoning behavior is unchanged.
+*/
+const DEFAULT_ANTHROPIC_MAX_TOKENS = 4096;
+/**
 * Accumulated multi-turn cache token total. Undefined when zero so turns
 * without cache activity keep the pre-cache callback shape.
 */
@@ -16605,7 +17669,8 @@ var AnthropicBackend = class {
 			const systemMessages = messages.filter((m) => m.role === "system");
 			const blocks = [];
 			for (const sm of systemMessages) {
-				const text = typeof sm.content === "string" ? sm.content : JSON.stringify(sm.content);
+				const text = systemContentToText(sm.content);
+				if (text.trim() === "") continue;
 				if (sm.cache === true) blocks.push({
 					type: "text",
 					text,
@@ -16625,7 +17690,7 @@ var AnthropicBackend = class {
 			const parts = [this.consolidateSystemMessages(messages), identityReminder].filter(Boolean);
 			system = parts.length > 0 ? parts.join("\n") : void 0;
 		}
-		let filteredMessages = ensureToolPairingIntegrity(this.filterRelevantMessages(cacheStampedMessages), this.logger);
+		let filteredMessages = normalizeToolUseInputs(ensureToolPairingIntegrity(this.filterRelevantMessages(cacheStampedMessages), this.logger), this.logger);
 		const countToolBlocks = (msgs) => {
 			let useCount = 0;
 			let resultCount = 0;
@@ -16644,7 +17709,11 @@ var AnthropicBackend = class {
 		let { useCount: toolUseCount, resultCount: toolResultCount } = countToolBlocks(filteredMessages);
 		if (toolUseCount > 0 || toolResultCount > 0) {
 			this.logger.debug(`[Pre-API #6181] Sending ${filteredMessages.length} messages with ${toolUseCount} tool_use and ${toolResultCount} tool_result blocks`);
-			if (toolUseCount !== toolResultCount) {
+			if (!options.tools?.length) {
+				this.logger.warn(`[Pre-API #6181] Tool blocks present (tool_use: ${toolUseCount}, tool_result: ${toolResultCount}) but no tools offered this turn. Stripping all tool blocks.`);
+				filteredMessages = stripAllToolBlocks(filteredMessages, this.logger);
+				({useCount: toolUseCount, resultCount: toolResultCount} = countToolBlocks(filteredMessages));
+			} else if (toolUseCount !== toolResultCount) {
 				this.logger.warn(`[Pre-API #6181] Tool block mismatch! tool_use: ${toolUseCount}, tool_result: ${toolResultCount}. Attempting auto-repair...`);
 				filteredMessages = ensureToolPairingIntegrity(filteredMessages, this.logger);
 				({useCount: toolUseCount, resultCount: toolResultCount} = countToolBlocks(filteredMessages));
@@ -16654,9 +17723,15 @@ var AnthropicBackend = class {
 				}
 			}
 		}
+		const currentModelInfo = this.modelRecordFor(model);
 		const apiParams = {
 			model,
-			max_tokens: options.maxTokens ?? 4096,
+			max_tokens: currentModelInfo ? resolveOutputMaxTokens({
+				requested: options.maxTokens,
+				fallback: DEFAULT_ANTHROPIC_MAX_TOKENS,
+				modelInfo: currentModelInfo,
+				modelMaxOutputTokens: currentModelInfo.max_tokens
+			}) : options.maxTokens ?? DEFAULT_ANTHROPIC_MAX_TOKENS,
 			messages: filteredMessages.map((m) => ({
 				role: m.role === "user" ? "user" : "assistant",
 				content: m.content
@@ -16696,7 +17771,6 @@ var AnthropicBackend = class {
 			}
 		}
 		const requestExtraHeaders = anyMessageCacheControlled ? { "anthropic-beta": "prompt-caching-2024-07-31" } : void 0;
-		const currentModelInfo = this.modelRecordFor(model);
 		if (currentModelInfo?.can_think) {
 			const thinkingOptions = options;
 			const isQuestMaster = thinkingOptions.questMaster === true;
@@ -16716,7 +17790,7 @@ var AnthropicBackend = class {
 		} else this.isThinkingEnabled = false;
 		const cacheStrategy = options.cacheStrategy;
 		if (cacheStrategy?.enableCaching) {
-			const cachedParams = getCachingAdapter(ModelBackend.Anthropic).applyCaching(apiParams, cacheStrategy);
+			const cachedParams = getCachingAdapter(ModelBackend.Anthropic).applyCaching(apiParams, cacheStrategy, this.logger);
 			Object.assign(apiParams, cachedParams);
 			this.logger.debug("[Anthropic] Applying cache control", {
 				cacheSystemPrompt: cacheStrategy.cacheSystemPrompt,
@@ -17077,6 +18151,10 @@ var AnthropicBackend = class {
 							if (!parsedParams) {
 								const entry = toolsUsed.find((t) => t.name === name && t.id === id);
 								if (entry) entry.arguments = "{}";
+								recordToolResult(toolsUsed, {
+									id,
+									name
+								}, "Error: Tool parameters were corrupted due to a stream interruption. Please retry.", false);
 								continue;
 							}
 							resolvedTools.push({
@@ -17144,6 +18222,10 @@ var AnthropicBackend = class {
 										toolsUsed
 									});
 								});
+								recordToolResult(toolsUsed, {
+									id: outcome.id,
+									name: outcome.name
+								}, resultStr, true);
 								this.pushToolMessages(messages, {
 									id: toolId,
 									name: outcome.name,
@@ -17151,16 +18233,22 @@ var AnthropicBackend = class {
 								}, resultStr);
 							} else {
 								if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+								const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
 								this.logger.error("[Tool Execution] Tool failed", {
 									model,
 									toolName: outcome.name,
-									error: outcome.error instanceof Error ? outcome.error.message : "Unknown error"
+									error: errorMessage
 								});
+								const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+								recordToolResult(toolsUsed, {
+									id: outcome.id,
+									name: outcome.name
+								}, observation, false);
 								this.pushToolMessages(messages, {
 									id: toolId,
 									name: outcome.name,
 									parameters: outcome.parameters
-								}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+								}, observation);
 							}
 						}
 						await cb(["\n\n"], { toolsUsed });
@@ -17297,7 +18385,13 @@ var AnthropicBackend = class {
 								isMcpTool,
 								streaming: false
 							}, messages);
-							if (!parsedParams) continue;
+							if (!parsedParams) {
+								recordToolResult(toolsUsed, {
+									id,
+									name
+								}, "Error: Tool parameters were corrupted due to a stream interruption. Please retry.", false);
+								continue;
+							}
 							resolvedTools.push({
 								id: id ?? "",
 								name,
@@ -17359,6 +18453,10 @@ var AnthropicBackend = class {
 								await handleToolResultStreaming(outcome.name, outcome.result, async (results) => {
 									await cb(results, { toolsUsed });
 								});
+								recordToolResult(toolsUsed, {
+									id: outcome.id,
+									name: outcome.name
+								}, resultStr, true);
 								this.pushToolMessages(messages, {
 									id: toolId,
 									name: outcome.name,
@@ -17366,16 +18464,22 @@ var AnthropicBackend = class {
 								}, resultStr);
 							} else {
 								if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+								const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
 								this.logger.error("[Tool Execution] Tool failed (non-streaming)", {
 									model,
 									toolName: outcome.name,
-									error: outcome.error instanceof Error ? outcome.error.message : "Unknown error"
+									error: errorMessage
 								});
+								const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+								recordToolResult(toolsUsed, {
+									id: outcome.id,
+									name: outcome.name
+								}, observation, false);
 								this.pushToolMessages(messages, {
 									id: toolId,
 									name: outcome.name,
 									parameters: outcome.parameters
-								}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+								}, observation);
 							}
 						}
 						this.logger.info("[Tool Execution] Making recursive call after tool execution (non-streaming)", {
@@ -17629,7 +18733,7 @@ var AnthropicBackend = class {
 	consolidateSystemMessages(messages) {
 		const systemMessages = messages.filter((m) => m.role === "system");
 		if (systemMessages.length === 0) return void 0;
-		return systemMessages.map((m) => m.content).join("\n");
+		return systemMessages.map((m) => systemContentToText(m.content)).filter((text) => text.trim() !== "").join("\n");
 	}
 	isToolUseEvent(event) {
 		return typeof event === "object" && event !== null && "type" in event && event.type === "tool_use" && "name" in event && "input" in event && "id" in event;
@@ -17710,6 +18814,11 @@ const BEDROCK_RETRY_CONFIG = {
 	maxAttempts: 6,
 	retryMode: "adaptive"
 };
+const BEDROCK_REQUEST_HANDLER = {
+	requestTimeout: 12e4,
+	sessionTimeout: 13e4,
+	disableConcurrentStreams: true
+};
 /**
 * Detect cancellation errors so they propagate past tool-error containment to
 * the outer catch (which has dedicated abort handling). Without this, aborts
@@ -17751,7 +18860,8 @@ var BaseBedrockBackend = class {
 		};
 		this._bedrockRuntime = new BedrockRuntimeClient({
 			region: this._options.region,
-			...BEDROCK_RETRY_CONFIG
+			...BEDROCK_RETRY_CONFIG,
+			requestHandler: BEDROCK_REQUEST_HANDLER
 		});
 	}
 	getRegionForModel(model) {
@@ -17772,12 +18882,40 @@ var BaseBedrockBackend = class {
 		const command = new InvokeModelWithResponseStreamCommand(input);
 		return this._bedrockRuntime.send(command, { abortSignal });
 	}
+	/**
+	* The reasoning blocks the just-translated assistant turn produced, cleared as they are
+	* taken. A backend whose provider signs thinking blocks overrides this so the tool loop
+	* below can replay them onto the assistant turns it rebuilds; providers that sign nothing
+	* keep the default. @see AnthropicBedrockBackend.takeReasoningBlocks
+	*/
+	takeReasoningBlocks() {
+		return [];
+	}
+	/**
+	* Whether this adapter's `translateStreamChunk` reports `done: true` ONLY on the provider's
+	* terminal event. When true, complete() treats a stream that produced output but never
+	* reported done as a TRUNCATED response and throws instead of returning the partial text.
+	*
+	* Opt-in rather than the default because "reports done terminally" is a per-adapter contract
+	* the base class cannot infer, and getting it wrong turns every healthy completion into an
+	* error. Three groups exist today:
+	*   - terminal-only, so they override this to true: anthropic, deepseek, llama, jurassicTwo
+	*   - `done: true` on EVERY content chunk, so the check would be inert: titan, moonshot
+	*     (the better fix for those is a stopReason passthrough, as moonshot.ts already does)
+	*   - never report done, incl. the test doubles in this directory: left false
+	*
+	* A new streaming backend must opt in deliberately; silence keeps the old behaviour.
+	*/
+	get signalsStreamTermination() {
+		return false;
+	}
 	updateClientForModel(model) {
 		const requiredRegion = this.getRegionForModel(model);
 		this._options.region = requiredRegion;
 		this._bedrockRuntime = new BedrockRuntimeClient({
 			region: this._options.region,
-			...BEDROCK_RETRY_CONFIG
+			...BEDROCK_RETRY_CONFIG,
+			requestHandler: BEDROCK_REQUEST_HANDLER
 		});
 	}
 	async complete(model, messages, options, callback, toolsUsed = []) {
@@ -17797,8 +18935,14 @@ var BaseBedrockBackend = class {
 			}, callback, toolsUsed);
 			return;
 		}
-		const messagesWithFormat = injectJsonSchemaInstruction(messages, options.responseFormat);
+		let messagesWithFormat = injectJsonSchemaInstruction(messages, options.responseFormat);
 		const bestEffortFormat = isBestEffortJsonSchema(options.responseFormat);
+		if (!options.tools?.length) {
+			if (messagesWithFormat.some((m) => Array.isArray(m.content) && m.content.some((b) => b.type === "tool_use" || b.type === "tool_result"))) {
+				Logger.globalInstance.warn("[BaseBedrockBackend Pre-API #6181] Tool blocks present but no tools offered this turn. Stripping all tool blocks.");
+				messagesWithFormat = stripAllToolBlocks(messagesWithFormat, Logger.globalInstance);
+			}
+		}
 		let formattedMessages = this.formatMessages(messagesWithFormat);
 		let input = this.getPayload(model, formattedMessages, options);
 		const contextWindow = this.getModelContextWindow(model);
@@ -17879,9 +19023,11 @@ var BaseBedrockBackend = class {
 				if (!response.body) throw new Error("No response body");
 				const func = [];
 				let emittedTextChars = 0;
+				let sawTerminalEvent = false;
 				for await (const streamEvent of response.body) if (streamEvent.chunk?.bytes) {
 					const json = new TextDecoder().decode(streamEvent.chunk.bytes);
-					const { chunk } = this.translateStreamChunk(model, JSON.parse(json));
+					const { done, chunk } = this.translateStreamChunk(model, JSON.parse(json));
+					sawTerminalEvent ||= done;
 					if (chunk?.stopReason) stopReason = chunk.stopReason;
 					chunk?.choices?.forEach((choice) => {
 						func[choice.index] ||= {};
@@ -17905,6 +19051,7 @@ var BaseBedrockBackend = class {
 					await callback(streamedText, buildCompletionInfo());
 				}
 				if (emittedTextChars === 0 && !func.some((f) => f.name)) throw new Error(`[BaseBedrockBackend] model "${model}" returned an EMPTY response in region ${this._options.region} (no text, no tool call, no output tokens). A "global." cross-region inference profile served from a region that does not host it does exactly this - try the "us." variant, or confirm the model/profile is granted in ${this._options.region}.`);
+				if (this.signalsStreamTermination && !sawTerminalEvent && !options.abortSignal?.aborted) throw new Error(`[BaseBedrockBackend] stream timeout - model "${model}" in region ${this._options.region} ended after ${emittedTextChars} chars without a terminal event, so the response is TRUNCATED. Usually a stalled Bedrock socket cut the stream short; the partial text is withheld deliberately rather than returned as a finished answer.`);
 				if (func.some((f) => f.name)) {
 					for await (const tool of func) {
 						const { id, name, parameters } = tool;
@@ -17932,6 +19079,12 @@ var BaseBedrockBackend = class {
 								});
 							} catch {
 								Logger.globalInstance.warn("[BaseBedrockBackend] Tool parameter parse error, skipping tool:", name);
+								const entry = toolsUsed.find((t) => t.name === name && t.id === id);
+								if (entry) entry.arguments = "{}";
+								recordToolResult(toolsUsed, {
+									id,
+									name
+								}, "Error: Tool arguments were malformed and could not be parsed.", false);
 							}
 						}
 						const parallelEnabled = options.parallelToolExecution !== false;
@@ -17959,32 +19112,40 @@ var BaseBedrockBackend = class {
 							parameters: resolvedTools[i].parameters,
 							error: outcome.error
 						});
+						const roundReasoningBlocks = this.takeReasoningBlocks();
 						for (const outcome of outcomes) if (outcome.ok) {
 							await handleToolResultStreaming(outcome.name, outcome.result, async (results) => {
 								await callback(results, buildCompletionInfo());
 							});
+							const resultStr = outcome.result.toString();
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, resultStr, true);
 							this.pushToolMessages(messages, {
 								id: outcome.id,
 								name: outcome.name,
 								parameters: outcome.parameters
-							}, outcome.result.toString());
+							}, resultStr, roundReasoningBlocks);
 						} else {
 							if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 							if (isAbortError(outcome.error)) throw outcome.error;
 							Logger.globalInstance.error(`[BaseBedrockBackend] Tool ${outcome.name} failed:`, outcome.error instanceof Error ? outcome.error.message : String(outcome.error));
+							const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
+							const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, observation, false);
 							this.pushToolMessages(messages, {
 								id: outcome.id,
 								name: outcome.name,
 								parameters: outcome.parameters
-							}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+							}, observation, roundReasoningBlocks);
 						}
 						await callback(["\n\n"], buildCompletionInfo());
 						await this.complete(model, messages, {
 							...options,
-							thinking: {
-								enabled: false,
-								budget_tokens: 0
-							},
 							tool_choice: "auto",
 							_internal: {
 								...options._internal,
@@ -18028,35 +19189,38 @@ var BaseBedrockBackend = class {
 					if (options.executeTools !== false) {
 						const executable = toolChoices.map((tc) => tc.tool).filter((tool) => tool.id && tool.name && options.tools?.some((o) => o.toolSchema.name === tool.name));
 						if (executable.length > 0) {
+							const roundReasoningBlocks = this.takeReasoningBlocks();
 							for (const { id, name, parameters } of executable) {
 								const toolFn = options.tools?.find((o) => o.toolSchema.name === name)?.toolFn;
 								if (!toolFn) continue;
 								const safeParameters = parameters || "{}";
 								let result;
+								let succeeded = true;
 								try {
 									result = await toolFn(JSON.parse(safeParameters));
 								} catch (err) {
 									if (err instanceof PermissionDeniedError) throw err;
 									if (isAbortError(err)) throw err;
 									Logger.globalInstance.error(`[BaseBedrockBackend] Tool ${name} failed:`, err instanceof Error ? err.message : String(err));
+									succeeded = false;
 									result = `Error processing ${name} tool: ${err instanceof Error ? err.message : "Unknown error"}`;
 								}
 								await handleToolResultStreaming(name, result, async (results) => {
 									await callback(results, buildCompletionInfo());
 								});
+								recordToolResult(toolsUsed, {
+									id,
+									name
+								}, result.toString(), succeeded);
 								this.pushToolMessages(messages, {
 									id,
 									name,
 									parameters
-								}, result.toString());
+								}, result.toString(), roundReasoningBlocks);
 							}
 							await callback(["\n\n"], buildCompletionInfo());
 							await this.complete(model, messages, {
 								...options,
-								thinking: {
-									enabled: false,
-									budget_tokens: 0
-								},
 								tool_choice: "auto",
 								_internal: {
 									...options._internal,
@@ -18151,6 +19315,9 @@ function isToolUseContentBlock(content_block) {
 function isThinkingContentBlock(content_block) {
 	return isRecord(content_block) && content_block.type === "thinking";
 }
+function isRedactedThinkingContentBlock(content_block) {
+	return isRecord(content_block) && content_block.type === "redacted_thinking";
+}
 function isTextDelta(delta) {
 	return isRecord(delta) && delta.type === "text_delta" && "text" in delta;
 }
@@ -18160,6 +19327,9 @@ function isInputJsonDelta(delta) {
 function isThinkingDelta(delta) {
 	return isRecord(delta) && delta.type === "thinking_delta" && "thinking" in delta;
 }
+function isSignatureDelta(delta) {
+	return isRecord(delta) && delta.type === "signature_delta" && "signature" in delta;
+}
 function isMessageStart(chunk) {
 	return isRecord(chunk) && chunk.type === "message_start";
 }
@@ -18186,13 +19356,40 @@ const TEMPERATURE_ONLY_MODELS = [
 	ChatModels.CLAUDE_4_6_OPUS_BEDROCK
 ];
 var AnthropicBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on message_stop (anthropic.ts translateStreamChunk), so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	isInThinkingBlock = false;
+	/**
+	* Reasoning blocks of the assistant turn currently being translated, indexed by the
+	* stream's content-block index. Reset at `message_start` and consumed by
+	* `takeReasoningBlocks` when that turn is rebuilt for a tool continuation.
+	*/
+	assistantReasoningBlocks = [];
 	/** Catalog view of the model being completed; see DispatchModel. */
 	_dispatch = new DispatchModel();
 	setDispatchModel(info) {
 		this._dispatch.set(info);
 	}
 	/**
+	* The reasoning blocks the last translated assistant turn produced, cleared as they
+	* are taken. Anthropic requires a `tool_use` assistant turn to replay its own signed
+	* thinking blocks whenever extended thinking is active on the turn, and an adaptive
+	* model thinks on every turn whether or not the request asked it to - so dropping
+	* them is what makes the synthesis round of a multi-round tool turn come back empty.
+	*
+	* Taken once per provider turn. base.ts takes them before its tool loop and hands the
+	* same array to every assistant message it rebuilds for that round, because a parallel
+	* round splits one provider turn across several synthetic turns and each of them has to
+	* carry the reasoning.
+	*/
+	takeReasoningBlocks() {
+		const blocks = this.assistantReasoningBlocks.filter((b) => b != null);
+		this.assistantReasoningBlocks = [];
+		return blocks;
+	}
+	/**
 	* The record the payload is shaped from: the adapter table first, then the
 	* catalog for a model the table never listed. Table-first keeps every
 	* currently-dispatched Bedrock id on exactly today's payload.
@@ -18609,11 +19806,13 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 				content: ""
 			};
 		}).filter((m) => m.content !== "" && (Array.isArray(m.content) ? m.content.length > 0 : true));
-		let systemMessage = messages.filter((m) => m.role === "system" && m.content).map((m) => typeof m.content === "string" ? m.content : JSON.stringify(m.content)).join("\n");
-		if (!options.omitIdentityReminder) {
-			const modelIdentity = `IMPORTANT! Only when someone asks, remember that you are specifically the ${model} model.`;
-			systemMessage = systemMessage ? `${systemMessage}\n${modelIdentity}` : modelIdentity;
-		}
+		const systemBlocks = messages.filter((m) => m.role === "system" && m.content).map((m) => ({
+			text: systemContentToText(m.content),
+			cache: m.cache === true
+		})).filter((block) => block.text.trim() !== "");
+		const identityReminder = options.omitIdentityReminder ? null : `IMPORTANT! Only when someone asks, remember that you are specifically the ${model} model.`;
+		let systemMessage = systemBlocks.map((block) => block.text).join("\n");
+		if (identityReminder) systemMessage = systemMessage ? `${systemMessage}\n${identityReminder}` : identityReminder;
 		const modelId = model.includes(":") || model.startsWith("global.") || model.startsWith("us.") || model.startsWith("anthropic.") ? model : `anthropic.${model}`;
 		const maxTokens = typeof options.maxTokens === "number" ? options.maxTokens : 4096;
 		const body = {
@@ -18621,7 +19820,27 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 			max_tokens: maxTokens,
 			messages: filteredMessages
 		};
-		if (systemMessage) body.system = systemMessage;
+		const cacheStrategy = options.cacheStrategy;
+		const modelSupportsCaching = !BEDROCK_NO_PROMPT_CACHING_MODELS.has(modelId);
+		if (Boolean(cacheStrategy?.enableCaching) && modelSupportsCaching && systemBlocks.some((block) => block.cache)) {
+			const cacheControl = {
+				type: "ephemeral",
+				...cacheStrategy?.cacheTTL === "1h" ? { ttl: cacheStrategy.cacheTTL } : {}
+			};
+			const blocks = systemBlocks.map((block) => block.cache ? {
+				type: "text",
+				text: block.text,
+				cache_control: cacheControl
+			} : {
+				type: "text",
+				text: block.text
+			});
+			if (identityReminder) blocks.push({
+				type: "text",
+				text: identityReminder
+			});
+			body.system = blocks;
+		} else if (systemMessage) body.system = systemMessage;
 		if (options.tools?.length) body.tools = this.formatTools(options.tools);
 		if (typeof options.temperature === "number" && !this.omitsSamplingParams(model)) body.temperature = options.temperature;
 		if (typeof options.topP === "number" && !TEMPERATURE_ONLY_MODELS.includes(model) && !this.omitsSamplingParams(model)) body.top_p = options.topP;
@@ -18649,8 +19868,6 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 				topP: options.topP
 			}
 		}, null, 2)}`);
-		const cacheStrategy = options.cacheStrategy;
-		const modelSupportsCaching = !BEDROCK_NO_PROMPT_CACHING_MODELS.has(modelId);
 		if (cacheStrategy?.enableCaching && modelSupportsCaching) {
 			const cachedBody = getCachingAdapter(ModelBackend.Bedrock).applyCaching(body, cacheStrategy);
 			Object.assign(body, cachedBody);
@@ -18674,9 +19891,11 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 	formatMessages(messages) {
 		return messages.reduce((cur, value) => {
 			const previousMessage = cur[cur.length - 1];
-			if (previousMessage && value.role === previousMessage.role) {
-				if (previousMessage.content === value.content) return cur;
-				else if (!Array.isArray(previousMessage.content)) {
+			if (previousMessage && value.role === previousMessage.role && previousMessage.cache !== true) {
+				if (previousMessage.content === value.content) {
+					if (value.cache === true) previousMessage.cache = true;
+					return cur;
+				} else if (!Array.isArray(previousMessage.content)) {
 					const lastIndex = cur.length - 1;
 					const prevContent = typeof cur[lastIndex].content === "string" ? cur[lastIndex].content : "";
 					const currContent = typeof value.content === "string" ? value.content : "";
@@ -18696,6 +19915,7 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 						});
 						if (contentArray.length > 0) cur[lastIndex].content = contentArray;
 					}
+					if (value.cache === true) cur[lastIndex].cache = true;
 				} else {
 					if (typeof value.content !== "string") {
 						cur.push(value);
@@ -18707,6 +19927,7 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 						type: "text",
 						text: textContent
 					}];
+					if (value.cache === true) previousMessage.cache = true;
 				}
 				return cur;
 			}
@@ -18717,11 +19938,8 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 	translateChunk(model, chunk) {
 		try {
 			const response = chunk;
-			const thinkingBlocks = response.content.filter((c) => c.type === "thinking");
-			if (thinkingBlocks.length > 0) console.warn(`[AnthropicBedrockBackend] Unexpected thinking blocks in response`, {
-				thinkingBlockCount: thinkingBlocks.length,
-				thinkingLengths: thinkingBlocks.map((b) => b.thinking?.length || 0)
-			});
+			this.assistantReasoningBlocks = response.content.filter((c) => c.type === "thinking" || c.type === "redacted_thinking");
+			if (this.assistantReasoningBlocks.length > 0) console.log(`[AnthropicBedrockBackend] Captured ${this.assistantReasoningBlocks.length} reasoning block(s) for tool continuation`);
 			const textContent = response.content.filter((item) => item.type === "text").map((item) => item.text || "").join("");
 			const toolUseBlocks = response.content.filter((item) => item.type === "tool_use");
 			let choice;
@@ -18775,6 +19993,7 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 		try {
 			if (isMessageStart(chunk)) {
 				this.isInThinkingBlock = false;
+				this.assistantReasoningBlocks = [];
 				choice = {
 					chunkText: "",
 					usage: {
@@ -18796,8 +20015,12 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 				};
 				else if (isThinkingContentBlock(contentBlock)) {
 					this.isInThinkingBlock = true;
+					this.assistantReasoningBlocks[chunk.index] = {
+						...contentBlock,
+						thinking: contentBlock.thinking ?? ""
+					};
 					choice.chunkText = "<think>";
-				}
+				} else if (isRedactedThinkingContentBlock(contentBlock)) this.assistantReasoningBlocks[chunk.index] = { ...contentBlock };
 			} else if (isContentBlockDelta(chunk)) {
 				choice = {
 					status: "stream",
@@ -18807,7 +20030,14 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 				const delta = chunk.delta;
 				if (isTextDelta(delta)) choice.chunkText = delta.text;
 				else if (isInputJsonDelta(delta)) choice.chunkText = delta.partial_json;
-				else if (isThinkingDelta(delta)) choice.chunkText = delta.thinking;
+				else if (isThinkingDelta(delta)) {
+					choice.chunkText = delta.thinking;
+					const block = this.assistantReasoningBlocks[chunk.index];
+					if (block?.type === "thinking") block.thinking += delta.thinking;
+				} else if (isSignatureDelta(delta)) {
+					const block = this.assistantReasoningBlocks[chunk.index];
+					if (block?.type === "thinking") block.signature = delta.signature;
+				}
 			} else if (isContentBlockStop(chunk)) {
 				choice = {
 					status: "stream",
@@ -18866,7 +20096,8 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 			name: tool.name,
 			input: JSON.parse(tool.parameters || "{}")
 		};
-		const assistantContent = thinkingBlocks && thinkingBlocks.length > 0 ? [...thinkingBlocks, toolUseBlock] : [toolUseBlock];
+		const reasoningBlocks = thinkingBlocks?.length ? thinkingBlocks : this.takeReasoningBlocks();
+		const assistantContent = reasoningBlocks.length > 0 ? [...reasoningBlocks, toolUseBlock] : [toolUseBlock];
 		messages.push({
 			role: "assistant",
 			content: assistantContent
@@ -18891,6 +20122,10 @@ function isReasoningBlock(block) {
 	return "reasoningContent" in block;
 }
 var DeepSeekBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on event.messageStop, so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	/** Suppresses reasoning/thinking output for summary and title generation calls. */
 	isSpecialTask = false;
 	/** Tracks whether the stream is currently inside a reasoning span, to emit one <think>/</think> pair per span. */
@@ -19235,6 +20470,10 @@ var JurassicTwoBedrockBackend = class extends BaseBedrockBackend {
 	}
 };
 var LlamaBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on response.stop_reason on the terminal chunk, so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	async getModelInfo() {
 		return [
 			{
@@ -19998,7 +21237,7 @@ var BFLBackend = class {
 					input: 400,
 					output: 400
 				} },
-				description: "FLUX Kontext Pro - Advanced image-to-image transformation with high-quality output and versatile editing capabilities.",
+				description: "FLUX Pro 1.1 - Professional quality image generation with strong prompt adherence and fast turnaround.",
 				supportsSafetyTolerance: true,
 				rank: 1
 			},
@@ -20064,7 +21303,7 @@ var BFLBackend = class {
 					input: 350,
 					output: 350
 				} },
-				description: "FLUX Kontext Max - Premium image-to-image transformation with maximum quality and advanced editing capabilities.",
+				description: "FLUX Kontext Pro - Advanced image-to-image transformation with high-quality output and versatile editing capabilities.",
 				supportsSafetyTolerance: true,
 				rank: 4
 			},
@@ -20080,7 +21319,7 @@ var BFLBackend = class {
 					input: 450,
 					output: 450
 				} },
-				description: "BlackForest Labs FLUX Kontext Max - Premium image-to-image transformation with maximum quality and capabilities",
+				description: "FLUX Kontext Max - Premium image-to-image transformation with maximum quality and capabilities.",
 				supportsSafetyTolerance: true,
 				rank: 5
 			}
@@ -20380,7 +21619,7 @@ var GeminiBackend = class {
 				rank: 8,
 				trainingCutoff: "2025-01-31",
 				releaseDate: "2025-06-01",
-				deprecationDate: "2026-10-16",
+				deprecationDate: "2026-09-02",
 				description: "Google's Gemini 2.5 Flash, offering well-rounded price-performance. Best for large scale processing, low-latency, high volume tasks that require thinking, and agentic use cases"
 			},
 			{
@@ -20538,6 +21777,7 @@ var GeminiBackend = class {
 		const toolCallCount = options._internal?.toolCallCount ?? 0;
 		const accumInputTokens = options._internal?.accumInputTokens ?? 0;
 		const accumOutputTokens = options._internal?.accumOutputTokens ?? 0;
+		const liveToolUseIds = new Set(options._internal?.liveToolUseIds ?? []);
 		const maxToolCalls = options._internal?.maxToolCalls ?? 10;
 		if (toolCallCount >= maxToolCalls && options.tools?.length) {
 			this.logger.warn(`[Gemini] Max tool calls limit (${maxToolCalls}) reached. Disabling tools to prevent infinite loops.`);
@@ -20552,7 +21792,7 @@ var GeminiBackend = class {
 		const bestEffortFormat = isBestEffortJsonSchema(options.responseFormat);
 		const systemInstruction = messagesWithFormat.filter((message) => message.role === "system").map((message) => message.content).join("\n");
 		const nonsystemMessages = messagesWithFormat.filter((message) => message.role !== "system");
-		const contents = this.formatMessagesIntoGeminiContent(nonsystemMessages);
+		const contents = this.formatMessagesIntoGeminiContent(nonsystemMessages, liveToolUseIds);
 		const generationConfig = this.getGenerationConfig(modelInfo, options);
 		const tools = !options.tools?.length ? void 0 : [{ functionDeclarations: options.tools.map((tool) => {
 			const params = pick(tool.toolSchema.parameters, "type", "properties", "required");
@@ -20679,22 +21919,32 @@ var GeminiBackend = class {
 						await handleToolResultStreaming(outcome.toolCall.name, outcome.result, async (results) => {
 							await callback(results, { toolsUsed });
 						});
+						const resultContent = JSON.stringify({ result: outcome.result });
+						recordToolResult(toolsUsed, {
+							id: outcome.toolCall.id,
+							name: outcome.toolCall.name
+						}, resultContent, true);
 						messages.push({
 							role: "tool",
 							content: [{
 								type: "tool_result",
-								content: JSON.stringify({ result: outcome.result }),
+								content: resultContent,
 								tool_use_id: outcome.toolCall.id
 							}]
 						});
 					} else {
 						if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 						this.logger.error(`[Gemini] Error executing tool ${outcome.toolCall.name}:`, outcome.error);
+						const errorContent = JSON.stringify({ error: outcome.error instanceof Error ? outcome.error.message : "Unknown error" });
+						recordToolResult(toolsUsed, {
+							id: outcome.toolCall.id,
+							name: outcome.toolCall.name
+						}, errorContent, false);
 						messages.push({
 							role: "tool",
 							content: [{
 								type: "tool_result",
-								content: JSON.stringify({ error: outcome.error instanceof Error ? outcome.error.message : "Unknown error" }),
+								content: errorContent,
 								tool_use_id: outcome.toolCall.id
 							}]
 						});
@@ -20706,7 +21956,8 @@ var GeminiBackend = class {
 							...options._internal,
 							toolCallCount: toolCallCount + 1,
 							accumInputTokens: accumInputTokens + turnInputTokens,
-							accumOutputTokens: accumOutputTokens + turnOutputTokens
+							accumOutputTokens: accumOutputTokens + turnOutputTokens,
+							liveToolUseIds: [...liveToolUseIds, ...toolCalls.map((tc) => tc.id)]
 						}
 					}, callback, toolsUsed);
 				} else {
@@ -20805,22 +22056,32 @@ var GeminiBackend = class {
 					await handleToolResultStreaming(outcome.toolCall.name, outcome.result, async (results) => {
 						await callback(results, { toolsUsed });
 					});
+					const resultContent = JSON.stringify({ result: outcome.result });
+					recordToolResult(toolsUsed, {
+						id: outcome.toolCall.id,
+						name: outcome.toolCall.name
+					}, resultContent, true);
 					messages.push({
 						role: "tool",
 						content: [{
 							type: "tool_result",
-							content: JSON.stringify({ result: outcome.result }),
+							content: resultContent,
 							tool_use_id: outcome.toolCall.id
 						}]
 					});
 				} else {
 					if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 					this.logger.error(`[Gemini] Error executing tool ${outcome.toolCall.name}:`, outcome.error);
+					const errorContent = JSON.stringify({ error: outcome.error instanceof Error ? outcome.error.message : "Unknown error" });
+					recordToolResult(toolsUsed, {
+						id: outcome.toolCall.id,
+						name: outcome.toolCall.name
+					}, errorContent, false);
 					messages.push({
 						role: "tool",
 						content: [{
 							type: "tool_result",
-							content: JSON.stringify({ error: outcome.error instanceof Error ? outcome.error.message : "Unknown error" }),
+							content: errorContent,
 							tool_use_id: outcome.toolCall.id
 						}]
 					});
@@ -20832,7 +22093,8 @@ var GeminiBackend = class {
 						...options._internal,
 						toolCallCount: toolCallCount + 1,
 						accumInputTokens: accumInputTokens + turnInputTokens,
-						accumOutputTokens: accumOutputTokens + turnOutputTokens
+						accumOutputTokens: accumOutputTokens + turnOutputTokens,
+						liveToolUseIds: [...liveToolUseIds, ...toolCalls.map((tc) => tc.id)]
 					}
 				}, callback, toolsUsed);
 			} else {
@@ -20841,8 +22103,9 @@ var GeminiBackend = class {
 			}
 		}
 	}
-	formatMessagesIntoGeminiContent(messages) {
+	formatMessagesIntoGeminiContent(messages, liveToolUseIds) {
 		const toolUseIdToName = /* @__PURE__ */ new Map();
+		const droppedToolUseIds = /* @__PURE__ */ new Set();
 		return messages.map((message) => {
 			const mapRole = (role) => {
 				switch (role) {
@@ -20856,25 +22119,41 @@ var GeminiBackend = class {
 				role: mapRole(message.role),
 				parts: [{ text: message.content }]
 			};
-			if (message.content?.[0].type === "text") return {
+			const hasToolUse = Array.isArray(message.content) && message.content.some((item) => item.type === "tool_use");
+			if (!hasToolUse && message.content?.[0].type === "text") return {
 				role: mapRole(message.role),
 				parts: [{ text: (message.content?.[0]).text }]
 			};
-			if (message.content?.[0].type === "image") return {
+			if (!hasToolUse && message.content?.[0].type === "image") return {
 				role: mapRole(message.role),
 				parts: [{ inlineData: {
 					mimeType: (message.content?.[0]).source.media_type,
 					data: (message.content?.[0]).source.data
 				} }]
 			};
-			if (message.content?.[0].type === "tool_use") {
-				const parts = message.content.filter((item) => item.type === "tool_use").map((toolUse, index) => {
+			if (hasToolUse) {
+				const toolUseBlocks = message.content.filter((item) => item.type === "tool_use");
+				const textParts = message.content.filter((item) => item.type === "text").map((item) => ({ text: item.text }));
+				if (!toolUseBlocks.some((t) => liveToolUseIds.has(t.id)) && /^gemini-3(\D|$)/.test(this.currentModel) && !toolUseBlocks[0]?.thought_signature) {
+					this.logger.warn("[Gemini] Dropping replayed tool_use block(s) with no thought_signature on the first call:", {
+						names: toolUseBlocks.map((t) => t.name),
+						messageRole: message.role
+					});
+					toolUseBlocks.forEach((t) => droppedToolUseIds.add(t.id));
+					if (textParts.length === 0) return null;
+					return {
+						role: mapRole(message.role),
+						parts: textParts
+					};
+				}
+				const parts = [...textParts];
+				parts.push(...toolUseBlocks.map((toolUse, index) => {
 					toolUseIdToName.set(toolUse.id, toolUse.name);
 					const part = { functionCall: {
 						name: toolUse.name,
 						args: toolUse.input
 					} };
-					if (index === 0 && toolUse.thought_signature) {
+					if (index === 0) if (toolUse.thought_signature) {
 						part.thoughtSignature = toolUse.thought_signature;
 						part.thought_signature = toolUse.thought_signature;
 						this.logger.debug("[Gemini] Including thought_signature in request (both formats):", {
@@ -20882,29 +22161,26 @@ var GeminiBackend = class {
 							id: toolUse.id,
 							position: "first"
 						});
-					} else if (index === 0 && !toolUse.thought_signature) {
-						this.logger.warn("[Gemini] Missing thought_signature for first function call:", {
-							name: toolUse.name,
-							id: toolUse.id,
-							messageRole: message.role
-						});
-						this.logger.warn("[Gemini] This may cause a 400 error with Gemini 3 Pro");
-					}
+					} else this.logger.warn("[Gemini] Missing thought_signature for first function call:", {
+						name: toolUse.name,
+						id: toolUse.id
+					});
 					return part;
-				});
+				}));
 				return {
 					role: mapRole(message.role),
 					parts
 				};
 			}
 			if (message.content?.[0].type === "tool_result") {
-				const toolResult = message.content[0];
+				const parts = message.content.filter((item) => item.type === "tool_result").filter((toolResult) => !droppedToolUseIds.has(toolResult.tool_use_id)).map((toolResult) => ({ functionResponse: {
+					name: toolUseIdToName.get(toolResult.tool_use_id) ?? toolResult.tool_use_id,
+					response: { result: toolResult.content }
+				} }));
+				if (parts.length === 0) return null;
 				return {
 					role: mapRole(message.role),
-					parts: [{ functionResponse: {
-						name: toolUseIdToName.get(toolResult.tool_use_id) ?? toolResult.tool_use_id,
-						response: { result: (message.content?.[0]).content }
-					} }]
+					parts
 				};
 			}
 			return null;
@@ -20991,6 +22267,54 @@ var GeminiBackend = class {
 	}
 };
 /**
+* The cache-inclusive-to-cache-exclusive conversion, shared by every adapter whose
+* provider reports cached tokens as a SUBSET of the prompt count.
+*
+* getTextModelCost expects Anthropic's convention: `inputTokens` counts only uncached
+* tokens and cache reads bill separately at their own (much cheaper) rate. Anthropic
+* and Claude-on-Bedrock deliver that natively. OpenAI and Moonshot do not - their
+* prompt total already CONTAINS the cached tokens - so those adapters must subtract
+* here before forwarding, or settlement double-bills the cached portion.
+*
+* Must stay in sync with the disjoint-fields assumption documented at the settlement
+* site in ChatCompletionProcess.
+*/
+/**
+* Split a cache-INCLUSIVE prompt total into the disjoint pair CompletionInfo carries.
+*
+* Forwarding the cached count without subtracting double-bills it; forwarding nothing
+* charges the full input rate on tokens the provider billed at a fraction of it.
+* Subtracting is the only split that bills what the provider actually charged.
+*
+* Clamped at zero: if a feed ever reports more cached than prompt tokens, a negative
+* input count would silently credit the user.
+*/
+function splitCacheInclusiveInput(totalPromptTokens, cacheReadTokens) {
+	if (cacheReadTokens <= 0) return { inputTokens: totalPromptTokens };
+	const cached = Math.min(cacheReadTokens, totalPromptTokens);
+	return {
+		inputTokens: Math.max(0, totalPromptTokens - cached),
+		cacheReadInputTokens: cached
+	};
+}
+/**
+* Cached prompt tokens from a raw provider usage object, across every spelling in use:
+* OpenAI Chat Completions nests them under `prompt_tokens_details`, the OpenAI
+* Responses API under `input_tokens_details`, and Moonshot publishes a flat
+* `cached_tokens` alongside the OpenAI-shaped nesting. Reading only one spelling
+* silently bills every cache hit on the other transports at the full input rate.
+*/
+function cachedTokensFromUsage(usage) {
+	if (!usage) return 0;
+	const candidates = [
+		usage.cached_tokens,
+		usage.prompt_tokens_details?.cached_tokens,
+		usage.input_tokens_details?.cached_tokens
+	];
+	for (const value of candidates) if (typeof value === "number" && Number.isFinite(value) && value > 0) return value;
+	return 0;
+}
+/**
 * Request shaping for Moonshot's Kimi models. Kept separate from kimiBackend's
 * transport so every "which parameter does this id accept" rule is one pure
 * function with a test, rather than a conditional buried in a 400-line complete().
@@ -21379,7 +22703,7 @@ var KimiBackend = class {
 		if (!(response instanceof Stream)) {
 			const streamedText = [];
 			if (!response.choices || response.choices.length === 0) throw new Error("No choices returned from the Moonshot API");
-			const turnCacheReadTokens = this.cachedTokensOf(response.usage);
+			const turnCacheReadTokens = cachedTokensFromUsage(response.usage);
 			for (const c of response.choices) {
 				if (!c.message) continue;
 				const reasoningContent = c.message.reasoning_content;
@@ -21411,6 +22735,10 @@ var KimiBackend = class {
 								this.logger.warn(`JSON parse error for ${toolCall.function.name} arguments`);
 								const entry = toolsUsed.find((t) => t.name === toolCall.function.name && t.id === toolCall.id);
 								if (entry) entry.arguments = "{}";
+								recordToolResult(toolsUsed, {
+									id: toolCall.id,
+									name: toolCall.function.name
+								}, "Error: Tool arguments were malformed and could not be parsed.", false);
 							}
 						}
 						const parallelEnabled = options.parallelToolExecution !== false;
@@ -21438,18 +22766,30 @@ var KimiBackend = class {
 							parameters: resolvedTools[i].parameters,
 							error: outcome.error
 						});
-						for (const outcome of outcomes) if (outcome.ok) this.pushToolMessages(messages, {
-							id: outcome.id,
-							name: outcome.name,
-							parameters: outcome.parameters
-						}, outcome.result.toString());
-						else {
+						for (const outcome of outcomes) if (outcome.ok) {
+							const resultStr = outcome.result.toString();
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, resultStr, true);
+							this.pushToolMessages(messages, {
+								id: outcome.id,
+								name: outcome.name,
+								parameters: outcome.parameters
+							}, resultStr);
+						} else {
 							if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+							const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
+							const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, observation, false);
 							this.pushToolMessages(messages, {
 								id: outcome.id,
 								name: outcome.name,
 								parameters: outcome.parameters
-							}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+							}, observation);
 						}
 						await this.complete(model, messages, {
 							...options,
@@ -21465,7 +22805,7 @@ var KimiBackend = class {
 					} else {
 						this.logger.debug(`[Tool Execution] executeTools=false, passing tool calls to callback`);
 						await callback([null], {
-							...this.splitCachedInput(accumInputTokens + (response.usage?.prompt_tokens || 0), accumCacheReadTokens + turnCacheReadTokens),
+							...splitCacheInclusiveInput(accumInputTokens + (response.usage?.prompt_tokens || 0), accumCacheReadTokens + turnCacheReadTokens),
 							outputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0),
 							toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 						});
@@ -21488,7 +22828,7 @@ var KimiBackend = class {
 			const finishReason = normalizeOpenAIFinishReason(response.choices[0]?.finish_reason);
 			const totalCacheReadTokens = accumCacheReadTokens + turnCacheReadTokens;
 			await callback(streamedText, {
-				...this.splitCachedInput(accumInputTokens + (response.usage?.prompt_tokens || 0), totalCacheReadTokens),
+				...splitCacheInclusiveInput(accumInputTokens + (response.usage?.prompt_tokens || 0), totalCacheReadTokens),
 				outputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0),
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 				cacheStats,
@@ -21507,7 +22847,7 @@ var KimiBackend = class {
 			if (chunk.usage) {
 				inputTokens = Math.max(inputTokens, chunk.usage?.prompt_tokens || 0);
 				outputTokens += chunk.usage?.completion_tokens || 0;
-				const chunkCached = this.cachedTokensOf(chunk.usage);
+				const chunkCached = cachedTokensFromUsage(chunk.usage);
 				if (chunkCached > 0) cachedTokensFromStream = chunkCached;
 			}
 			chunk?.choices.forEach((c) => {
@@ -21537,7 +22877,7 @@ var KimiBackend = class {
 			if (streamedText.some((t) => t)) sawAnyText = true;
 			const normalizedFinishReason = normalizeOpenAIFinishReason(streamFinishReason);
 			await callback(streamedText, {
-				...this.splitCachedInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
+				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 				outputTokens: accumOutputTokens + outputTokens,
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 				...normalizedFinishReason ? { stopReason: normalizedFinishReason } : {}
@@ -21545,7 +22885,7 @@ var KimiBackend = class {
 		}
 		if (isInThinkingBlock) {
 			await callback(["</think>"], {
-				...this.splitCachedInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
+				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 				outputTokens: accumOutputTokens + outputTokens,
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 			});
@@ -21562,7 +22902,7 @@ var KimiBackend = class {
 			if (cacheStats) logCacheStats(this.logger, cacheStats, { streaming: true });
 		}
 		if (nativeFormat && func.length === 0) await callback([], {
-			...this.splitCachedInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
+			...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 			outputTokens: accumOutputTokens + outputTokens,
 			toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 			responseFormatMode: "native",
@@ -21598,6 +22938,10 @@ var KimiBackend = class {
 						this.logger.warn(`JSON parse error for ${name} arguments (streaming)`);
 						const entry = toolsUsed.find((t) => t.name === name && t.id === id);
 						if (entry) entry.arguments = "{}";
+						recordToolResult(toolsUsed, {
+							id,
+							name
+						}, "Error: Tool arguments were malformed and could not be parsed.", false);
 					}
 				}
 				const parallelEnabled = options.parallelToolExecution !== false;
@@ -21625,18 +22969,30 @@ var KimiBackend = class {
 					parameters: resolvedTools[i].parameters,
 					error: outcome.error
 				});
-				for (const outcome of outcomes) if (outcome.ok) this.pushToolMessages(messages, {
-					id: outcome.id,
-					name: outcome.name,
-					parameters: outcome.parameters
-				}, outcome.result.toString());
-				else {
+				for (const outcome of outcomes) if (outcome.ok) {
+					const resultStr = outcome.result.toString();
+					recordToolResult(toolsUsed, {
+						id: outcome.id,
+						name: outcome.name
+					}, resultStr, true);
+					this.pushToolMessages(messages, {
+						id: outcome.id,
+						name: outcome.name,
+						parameters: outcome.parameters
+					}, resultStr);
+				} else {
 					if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+					const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
+					const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+					recordToolResult(toolsUsed, {
+						id: outcome.id,
+						name: outcome.name
+					}, observation, false);
 					this.pushToolMessages(messages, {
 						id: outcome.id,
 						name: outcome.name,
 						parameters: outcome.parameters
-					}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+					}, observation);
 				}
 				await this.complete(model, messages, {
 					...options,
@@ -21651,52 +23007,13 @@ var KimiBackend = class {
 			} else {
 				this.logger.debug(`[Tool Execution] executeTools=false, passing tool calls to callback`);
 				await callback([null], {
-					...this.splitCachedInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
+					...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 					outputTokens: accumOutputTokens + outputTokens,
 					toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 				});
 			}
 		}
 	}
-	/**
-	* Convert Moonshot's CACHE-INCLUSIVE `prompt_tokens` into the cache-EXCLUSIVE
-	* convention getTextModelCost expects, which is Anthropic's: `inputTokens`
-	* counts only uncached tokens and cache reads are billed separately at their
-	* own (much cheaper) rate.
-	*
-	* Verified live 2026-07-28: a repeated 1220-token prompt returned
-	* `prompt_tokens: 1220` WITH `cached_tokens: 1220` - the same tokens, reported
-	* twice, not 1220 fresh plus 1220 cached. So passing prompt_tokens through as
-	* inputTokens while also forwarding cacheReadInputTokens would bill the cached
-	* portion twice; passing it through and forwarding NOTHING (the previous
-	* behavior) charges the full input rate on tokens Moonshot billed at roughly a
-	* sixth of it - on k2.6, $0.95/MTok against $0.16. Subtracting is the only
-	* split that bills what the provider actually charged.
-	*
-	* Clamped at zero: if a feed ever reports more cached than prompt tokens, a
-	* negative input count would silently credit the user.
-	*/
-	splitCachedInput(totalPromptTokens, cacheReadTokens) {
-		if (cacheReadTokens <= 0) return { inputTokens: totalPromptTokens };
-		const cached = Math.min(cacheReadTokens, totalPromptTokens);
-		return {
-			inputTokens: Math.max(0, totalPromptTokens - cached),
-			cacheReadInputTokens: cached
-		};
-	}
-	/**
-	* Cached prompt tokens from a usage object. Moonshot publishes BOTH a flat
-	* `usage.cached_tokens` and the nested OpenAI `prompt_tokens_details.cached_tokens`
-	* - confirmed live, both present with the same value - so either spelling is
-	* accepted and reading neither would bill every hit at the full input rate.
-	*/
-	cachedTokensOf(usage) {
-		if (!usage) return 0;
-		const flat = usage.cached_tokens;
-		if (typeof flat === "number" && Number.isFinite(flat) && flat >= 0) return flat;
-		const nested = usage.prompt_tokens_details?.cached_tokens;
-		return typeof nested === "number" && Number.isFinite(nested) && nested >= 0 ? nested : 0;
-	}
 	formatMessages(messages) {
 		return convertMessagesToOpenAIFormat(messages);
 	}
@@ -22001,7 +23318,7 @@ var OllamaBackend = class OllamaBackend {
 				name: tc.name,
 				parameters: tc.arguments || "{}"
 			}, `Error: tool "${tc.name}" is not available. Do not call it again; answer directly or use a listed tool.`);
-			(await executeToolsBatch(resolved.map(({ tc, toolFn }) => async () => {
+			const outcomes = await executeToolsBatch(resolved.map(({ tc, toolFn }) => async () => {
 				let params = {};
 				try {
 					params = JSON.parse(tc.arguments || "{}");
@@ -22011,17 +23328,22 @@ var OllamaBackend = class OllamaBackend {
 			}), {
 				parallel: options.parallelToolExecution !== false,
 				maxConcurrency: options.maxParallelTools
-			})).forEach((outcome, i) => {
+			});
+			const observations = [];
+			outcomes.forEach((outcome, i) => {
 				const { tc } = resolved[i];
 				const params = tc.arguments || "{}";
-				if (outcome.ok) this.pushToolMessages(messages, {
-					id: tc.id,
-					name: tc.name,
-					parameters: params
-				}, outcome.result);
-				else {
+				if (outcome.ok) {
+					observations[i] = outcome.result;
+					this.pushToolMessages(messages, {
+						id: tc.id,
+						name: tc.name,
+						parameters: params
+					}, outcome.result);
+				} else {
 					if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 					const errorMsg = `Error running ${tc.name}: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`;
+					observations[i] = errorMsg;
 					this.pushToolMessages(messages, {
 						id: tc.id,
 						name: tc.name,
@@ -22029,10 +23351,12 @@ var OllamaBackend = class OllamaBackend {
 					}, errorMsg);
 				}
 			});
-			const executedToolsUsed = [...priorToolsUsed, ...resolved.map(({ tc }) => ({
+			const executedToolsUsed = [...priorToolsUsed, ...resolved.map(({ tc }, i) => ({
 				name: tc.name,
 				arguments: tc.arguments,
-				id: tc.id
+				id: tc.id,
+				returnValue: truncateToolResult(String(observations[i])),
+				success: outcomes[i].ok
 			}))];
 			if (options.abortSignal?.aborted) {
 				await callback([""], {
@@ -22140,12 +23464,21 @@ var OllamaBackend = class OllamaBackend {
 			}
 		};
 	}
-	/** Normalize Ollama's native tool_calls into the shared NormalizedToolCall shape. */
+	/**
+	* Normalize Ollama's native tool_calls into the shared NormalizedToolCall shape.
+	*
+	* Ids are real uuids, not a position-derived string. A prior version keyed ids off
+	* `accumulated-count + round-local-index`, but the accumulated count is measured AFTER
+	* hallucinated calls are filtered out while the round-local index is assigned BEFORE that
+	* filter runs, so the two can drift and mint the same id for two different real calls across
+	* rounds - replayableToolCalls dedupes by id and silently drops the later one. A uuid makes
+	* the whole collision class unrepresentable, matching how the other backends already mint ids.
+	*/
 	normalizeToolCalls(toolCalls) {
-		return toolCalls.map((tc, i) => ({
+		return toolCalls.map((tc) => ({
 			name: tc.function.name,
 			arguments: JSON.stringify(tc.function.arguments ?? {}),
-			id: `ollama-tool-${i}-${tc.function.name}`
+			id: `ollama-tool-${v4()}`
 		}));
 	}
 	/**
@@ -22183,7 +23516,7 @@ var OllamaBackend = class OllamaBackend {
 			seen.add(key);
 			calls.push({
 				...call,
-				id: `ollama-content-tool-${calls.length}-${call.name}`
+				id: `ollama-content-tool-${v4()}`
 			});
 		}
 		return calls;
@@ -22432,7 +23765,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 1047576: {
 					input: 2 / 1e6,
-					output: 8 / 1e6
+					output: 8 / 1e6,
+					cache_read: .5 / 1e6
 				} },
 				supportsVision: true,
 				supportsTools: true,
@@ -22452,7 +23786,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 1047576: {
 					input: .4 / 1e6,
-					output: 1.6 / 1e6
+					output: 1.6 / 1e6,
+					cache_read: .1 / 1e6
 				} },
 				supportsVision: true,
 				supportsTools: true,
@@ -22472,7 +23807,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 1047576: {
 					input: .1 / 1e6,
-					output: .4 / 1e6
+					output: .4 / 1e6,
+					cache_read: .025 / 1e6
 				} },
 				supportsVision: true,
 				supportsTools: true,
@@ -22535,7 +23871,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 2e5: {
 					input: 2 / 1e6,
-					output: 8 / 1e6
+					output: 8 / 1e6,
+					cache_read: .5 / 1e6
 				} },
 				supportsVision: true,
 				supportsTools: true,
@@ -22621,7 +23958,8 @@ var OpenAIBackend = class {
 				can_think: true,
 				pricing: { 2e5: {
 					input: 1.1 / 1e6,
-					output: 4.4 / 1e6
+					output: 4.4 / 1e6,
+					cache_read: .275 / 1e6
 				} },
 				supportsVision: true,
 				supportsImageVariation: false,
@@ -22997,7 +24335,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 8e3: {
 					input: 2.5 / 1e6,
-					output: 10 / 1e6
+					output: 10 / 1e6,
+					cache_read: 1.25 / 1e6
 				} },
 				supportsVision: true,
 				supportsImageVariation: false,
@@ -23016,7 +24355,8 @@ var OpenAIBackend = class {
 				can_stream: true,
 				pricing: { 8e3: {
 					input: .15 / 1e6,
-					output: .6 / 1e6
+					output: .6 / 1e6,
+					cache_read: .075 / 1e6
 				} },
 				supportsVision: true,
 				supportsImageVariation: false,
@@ -23207,6 +24547,7 @@ var OpenAIBackend = class {
 		const toolCallCount = options._internal?.toolCallCount ?? 0;
 		const accumInputTokens = options._internal?.accumInputTokens ?? 0;
 		const accumOutputTokens = options._internal?.accumOutputTokens ?? 0;
+		const accumCacheReadTokens = options._internal?.accumCacheReadTokens ?? 0;
 		const maxToolCalls = options._internal?.maxToolCalls ?? 10;
 		if (toolCallCount >= maxToolCalls && options.tools?.length) {
 			this.logger.warn(`⚠️ Max tool calls limit (${maxToolCalls}) reached. Disabling tools to prevent infinite loops.`);
@@ -23296,6 +24637,7 @@ var OpenAIBackend = class {
 		let outputTokens = 0;
 		if (!(response instanceof Stream)) {
 			const streamedText = [];
+			const totalCacheReadTokens = accumCacheReadTokens + cachedTokensFromUsage(response.usage);
 			if (!response.choices || response.choices.length === 0) throw new Error("No choices returned from OpenAI API");
 			for (const c of response.choices) {
 				if (!c.message) continue;
@@ -23329,6 +24671,10 @@ var OpenAIBackend = class {
 								this.logger.warn(`JSON parse error for ${toolCall.function.name} arguments`);
 								const entry = toolsUsed.find((t) => t.name === toolCall.function.name && t.id === toolCall.id);
 								if (entry) entry.arguments = "{}";
+								recordToolResult(toolsUsed, {
+									id: toolCall.id,
+									name: toolCall.function.name
+								}, "Error: Tool arguments were malformed and could not be parsed.", false);
 							}
 						}
 						const parallelEnabled = options.parallelToolExecution !== false;
@@ -23365,6 +24711,10 @@ var OpenAIBackend = class {
 								if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 								const errorMsg = `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`;
 								streamedText[c.index] = errorMsg;
+								recordToolResult(toolsUsed, {
+									id: outcome.id,
+									name: outcome.name
+								}, errorMsg, false);
 								this.pushToolMessages(messages, {
 									id: outcome.id,
 									name: outcome.name,
@@ -23385,6 +24735,10 @@ var OpenAIBackend = class {
 								});
 							});
 							const sanitizedResult = thisToolHadArtifact ? resultStr.replace(/<artifact(?:\s[^>]*)?>[\s\S]*?<\/artifact>/gi, "[Artifact rendered and delivered to user]") : resultStr;
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, sanitizedResult, true);
 							this.pushToolMessages(messages, {
 								id: outcome.id,
 								name: outcome.name,
@@ -23408,7 +24762,8 @@ var OpenAIBackend = class {
 								...options._internal,
 								toolCallCount: toolCallCount + 1,
 								accumInputTokens: accumInputTokens + (response.usage?.prompt_tokens || 0),
-								accumOutputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0)
+								accumOutputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0),
+								accumCacheReadTokens: totalCacheReadTokens
 							}
 						}, recursiveCallback, toolsUsed);
 						if (anyArtifactWasStreamed && recursiveBuffer) {
@@ -23419,7 +24774,7 @@ var OpenAIBackend = class {
 					} else {
 						this.logger.debug(`[Tool Execution] executeTools=false, passing tool calls to callback`);
 						await callback([null], {
-							inputTokens: accumInputTokens + (response.usage?.prompt_tokens || 0),
+							...splitCacheInclusiveInput(accumInputTokens + (response.usage?.prompt_tokens || 0), totalCacheReadTokens),
 							outputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0),
 							toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 						});
@@ -23435,7 +24790,7 @@ var OpenAIBackend = class {
 			}
 			const finishReason = normalizeOpenAIFinishReason(response.choices[0]?.finish_reason);
 			await callback(streamedText, {
-				inputTokens: accumInputTokens + (response.usage?.prompt_tokens || 0),
+				...splitCacheInclusiveInput(accumInputTokens + (response.usage?.prompt_tokens || 0), totalCacheReadTokens),
 				outputTokens: accumOutputTokens + (response.usage?.completion_tokens || 0),
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 				cacheStats,
@@ -23463,7 +24818,7 @@ var OpenAIBackend = class {
 				inputTokens = Math.max(inputTokens, chunk.usage?.prompt_tokens || 0);
 				outputTokens += chunk.usage?.completion_tokens || 0;
 				if (chunk.usage.prompt_tokens_details?.cached_tokens !== void 0) {
-					cachedTokensFromStream = chunk.usage.prompt_tokens_details.cached_tokens;
+					cachedTokensFromStream = Math.max(cachedTokensFromStream, chunk.usage.prompt_tokens_details.cached_tokens);
 					if (cachedTokensFromStream > 0) this.logger.debug("[OpenAI] Captured cached tokens", { cachedTokens: cachedTokensFromStream });
 					else this.logger.debug("[OpenAI] No cached tokens in chunk", { note: "possible cache miss or first request" });
 				}
@@ -23480,7 +24835,7 @@ var OpenAIBackend = class {
 			});
 			const normalizedFinishReason = normalizeOpenAIFinishReason(streamFinishReason);
 			await callback(streamedText, {
-				inputTokens: accumInputTokens + inputTokens,
+				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 				outputTokens: accumOutputTokens + outputTokens,
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 				...normalizedFinishReason ? { stopReason: normalizedFinishReason } : {}
@@ -23510,7 +24865,7 @@ var OpenAIBackend = class {
 			if (cacheStats) logCacheStats(this.logger, cacheStats, { streaming: true });
 		}
 		if ((isO1Model || func.length === 0) && options.responseFormat?.type === "json_schema") await callback([], {
-			inputTokens: accumInputTokens + inputTokens,
+			...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 			outputTokens: accumOutputTokens + outputTokens,
 			toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 			cacheStats,
@@ -23548,6 +24903,10 @@ var OpenAIBackend = class {
 						});
 						const entry = toolsUsed.find((t) => t.name === name && t.id === id);
 						if (entry) entry.arguments = "{}";
+						recordToolResult(toolsUsed, {
+							id,
+							name
+						}, "Error: Tool arguments were malformed and could not be parsed.", false);
 					}
 				}
 				const parallelEnabled = options.parallelToolExecution !== false;
@@ -23582,11 +24941,16 @@ var OpenAIBackend = class {
 				for (const outcome of outcomes) {
 					if (!outcome.ok) {
 						if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+						const errorMsg = `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`;
+						recordToolResult(toolsUsed, {
+							id: outcome.id,
+							name: outcome.name
+						}, errorMsg, false);
 						this.pushToolMessages(messages, {
 							id: outcome.id,
 							name: outcome.name,
 							parameters: outcome.parameters
-						}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+						}, errorMsg);
 						continue;
 					}
 					const resultStr = outcome.result.toString();
@@ -23596,13 +24960,17 @@ var OpenAIBackend = class {
 						thisToolHadArtifact = true;
 						anyArtifactWasStreamed = true;
 						await callback(results, {
-							inputTokens: accumInputTokens + inputTokens,
+							...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 							outputTokens: accumOutputTokens + outputTokens,
 							toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 							cacheStats
 						});
 					});
 					const sanitizedResult = thisToolHadArtifact ? resultStr.replace(/<artifact(?:\s[^>]*)?>[\s\S]*?<\/artifact>/gi, "[Artifact rendered and delivered to user]") : resultStr;
+					recordToolResult(toolsUsed, {
+						id: outcome.id,
+						name: outcome.name
+					}, sanitizedResult, true);
 					this.pushToolMessages(messages, {
 						id: outcome.id,
 						name: outcome.name,
@@ -23623,7 +24991,8 @@ var OpenAIBackend = class {
 							...options._internal,
 							toolCallCount: toolCallCount + 1,
 							accumInputTokens: accumInputTokens + inputTokens,
-							accumOutputTokens: accumOutputTokens + outputTokens
+							accumOutputTokens: accumOutputTokens + outputTokens,
+							accumCacheReadTokens: accumCacheReadTokens + cachedTokensFromStream
 						}
 					}, async (results, meta) => {
 						for (const r of results) if (r != null) recursiveBuffer += r;
@@ -23639,13 +25008,14 @@ var OpenAIBackend = class {
 						...options._internal,
 						toolCallCount: toolCallCount + 1,
 						accumInputTokens: accumInputTokens + inputTokens,
-						accumOutputTokens: accumOutputTokens + outputTokens
+						accumOutputTokens: accumOutputTokens + outputTokens,
+						accumCacheReadTokens: accumCacheReadTokens + cachedTokensFromStream
 					}
 				}, callback, toolsUsed);
 			} else {
 				this.logger.debug(`[Tool Execution] executeTools=false, passing tool calls to callback`);
 				await callback([null], {
-					inputTokens: accumInputTokens + inputTokens,
+					...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 					outputTokens: accumOutputTokens + outputTokens,
 					toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 					cacheStats
@@ -23787,6 +25157,7 @@ var OpenAIBackend = class {
 		const toolCallCount = options._internal?.toolCallCount ?? 0;
 		const accumInputTokens = options._internal?.accumInputTokens ?? 0;
 		const accumOutputTokens = options._internal?.accumOutputTokens ?? 0;
+		const accumCacheReadTokens = options._internal?.accumCacheReadTokens ?? 0;
 		const chatMessages = this.formatMessages(messages, false, model, options);
 		const input = this.toResponsesInput(chatMessages);
 		const reasoningEffort = this.resolveReasoningEffort(model, options);
@@ -23813,8 +25184,9 @@ var OpenAIBackend = class {
 		let finalResponse;
 		let inputTokens = 0;
 		let outputTokens = 0;
+		let cachedTokensFromStream = 0;
 		for await (const event of stream) if (event.type === "response.output_text.delta") await callback([event.delta], {
-			inputTokens: accumInputTokens + inputTokens,
+			...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 			outputTokens: accumOutputTokens + outputTokens,
 			toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 		});
@@ -23824,11 +25196,12 @@ var OpenAIBackend = class {
 		if (!finalResponse) throw new Error(`OpenAI Responses stream for ${model} ended without a terminal response event`);
 		inputTokens = finalResponse.usage?.input_tokens ?? 0;
 		outputTokens = finalResponse.usage?.output_tokens ?? 0;
+		cachedTokensFromStream = cachedTokensFromUsage(finalResponse.usage);
 		const functionCalls = finalResponse.output.filter((item) => item.type === "function_call");
 		if (functionCalls.length === 0) {
 			const stopReason = normalizeOpenAIResponsesStopReason(finalResponse.incomplete_details?.reason);
 			await callback([], {
-				inputTokens: accumInputTokens + inputTokens,
+				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 				outputTokens: accumOutputTokens + outputTokens,
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0,
 				...stopReason ? { stopReason } : {}
@@ -23842,7 +25215,7 @@ var OpenAIBackend = class {
 		});
 		if (options.executeTools === false) {
 			await callback([null], {
-				inputTokens: accumInputTokens + inputTokens,
+				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
 				outputTokens: accumOutputTokens + outputTokens,
 				toolsUsed: toolsUsed.length > 0 ? toolsUsed : void 0
 			});
@@ -23863,6 +25236,10 @@ var OpenAIBackend = class {
 				});
 			} catch {
 				this.logger.warn(`JSON parse error for ${fc.name} arguments (Responses path)`);
+				recordToolResult(toolsUsed, {
+					id: fc.call_id,
+					name: fc.name
+				}, "Error: Tool arguments were malformed and could not be parsed.", false);
 			}
 		}
 		const parallelEnabled = options.parallelToolExecution !== false;
@@ -23886,14 +25263,24 @@ var OpenAIBackend = class {
 		for (let i = 0; i < batchOutcomes.length; i++) {
 			const outcome = batchOutcomes[i];
 			const r = resolved[i];
-			if (outcome.ok) this.pushToolMessages(messages, {
-				id: r.callId,
-				name: r.name,
-				parameters: r.args
-			}, outcome.result.result.toString());
-			else {
+			if (outcome.ok) {
+				const resultStr = outcome.result.result.toString();
+				recordToolResult(toolsUsed, {
+					id: r.callId,
+					name: r.name
+				}, resultStr, true);
+				this.pushToolMessages(messages, {
+					id: r.callId,
+					name: r.name,
+					parameters: r.args
+				}, resultStr);
+			} else {
 				if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
 				const errorMsg = `Error processing ${r.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`;
+				recordToolResult(toolsUsed, {
+					id: r.callId,
+					name: r.name
+				}, errorMsg, false);
 				this.pushToolMessages(messages, {
 					id: r.callId,
 					name: r.name,
@@ -23910,7 +25297,8 @@ var OpenAIBackend = class {
 				...options._internal,
 				toolCallCount: toolCallCount + 1,
 				accumInputTokens: accumInputTokens + inputTokens,
-				accumOutputTokens: accumOutputTokens + outputTokens
+				accumOutputTokens: accumOutputTokens + outputTokens,
+				accumCacheReadTokens: accumCacheReadTokens + cachedTokensFromStream
 			}
 		}, callback, toolsUsed);
 	}
@@ -24268,6 +25656,10 @@ var XAIBackend = class {
 								this.logger.warn(`JSON parse error for ${toolCall.function.name} arguments`);
 								const entry = toolsUsed.find((t) => t.name === toolCall.function.name && t.id === toolCall.id);
 								if (entry) entry.arguments = "{}";
+								recordToolResult(toolsUsed, {
+									id: toolCall.id,
+									name: toolCall.function.name
+								}, "Error: Tool arguments were malformed and could not be parsed.", false);
 							}
 						}
 						const parallelEnabled = options.parallelToolExecution !== false;
@@ -24295,18 +25687,30 @@ var XAIBackend = class {
 							parameters: resolvedTools[i].parameters,
 							error: outcome.error
 						});
-						for (const outcome of outcomes) if (outcome.ok) this.pushToolMessages(messages, {
-							id: outcome.id,
-							name: outcome.name,
-							parameters: outcome.parameters
-						}, outcome.result.toString());
-						else {
+						for (const outcome of outcomes) if (outcome.ok) {
+							const resultStr = outcome.result.toString();
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, resultStr, true);
+							this.pushToolMessages(messages, {
+								id: outcome.id,
+								name: outcome.name,
+								parameters: outcome.parameters
+							}, resultStr);
+						} else {
 							if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+							const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
+							const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+							recordToolResult(toolsUsed, {
+								id: outcome.id,
+								name: outcome.name
+							}, observation, false);
 							this.pushToolMessages(messages, {
 								id: outcome.id,
 								name: outcome.name,
 								parameters: outcome.parameters
-							}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+							}, observation);
 						}
 						await this.complete(model, messages, {
 							...options,
@@ -24436,6 +25840,10 @@ var XAIBackend = class {
 						this.logger.warn(`JSON parse error for ${name} arguments (streaming)`);
 						const entry = toolsUsed.find((t) => t.name === name && t.id === id);
 						if (entry) entry.arguments = "{}";
+						recordToolResult(toolsUsed, {
+							id,
+							name
+						}, "Error: Tool arguments were malformed and could not be parsed.", false);
 					}
 				}
 				const parallelEnabled = options.parallelToolExecution !== false;
@@ -24463,18 +25871,30 @@ var XAIBackend = class {
 					parameters: resolvedTools[i].parameters,
 					error: outcome.error
 				});
-				for (const outcome of outcomes) if (outcome.ok) this.pushToolMessages(messages, {
-					id: outcome.id,
-					name: outcome.name,
-					parameters: outcome.parameters
-				}, outcome.result.toString());
-				else {
+				for (const outcome of outcomes) if (outcome.ok) {
+					const resultStr = outcome.result.toString();
+					recordToolResult(toolsUsed, {
+						id: outcome.id,
+						name: outcome.name
+					}, resultStr, true);
+					this.pushToolMessages(messages, {
+						id: outcome.id,
+						name: outcome.name,
+						parameters: outcome.parameters
+					}, resultStr);
+				} else {
 					if (outcome.error instanceof PermissionDeniedError) throw outcome.error;
+					const errorMessage = outcome.error instanceof Error ? outcome.error.message : "Unknown error";
+					const observation = `Error processing ${outcome.name} tool: ${errorMessage}`;
+					recordToolResult(toolsUsed, {
+						id: outcome.id,
+						name: outcome.name
+					}, observation, false);
 					this.pushToolMessages(messages, {
 						id: outcome.id,
 						name: outcome.name,
 						parameters: outcome.parameters
-					}, `Error processing ${outcome.name} tool: ${outcome.error instanceof Error ? outcome.error.message : "Unknown error"}`);
+					}, observation);
 				}
 				await this.complete(model, messages, {
 					...options,
@@ -25164,6 +26584,7 @@ const DEPRECATED_MODEL_MAP = {
 	"claude-3-haiku-20240307": "claude-haiku-4-5-20251001",
 	"gpt-5-chat-latest": "gpt-5.5",
 	"gpt-5.1-chat-latest": "gpt-5.5",
+	"gemini-2.5-flash": "gemini-3.1-flash-lite",
 	"grok-3": "grok-4.5",
 	"grok-3-fast": "grok-4.5",
 	"grok-2-1212": "grok-4.5",
@@ -25635,6 +27056,10 @@ function checkStaleModelReferences(input) {
 		for (const referencedId of chain) check("fallback-chain", chainKey, referencedId);
 	}
 	for (const referencedId of input.defaultChain ?? []) check("fallback-default", "default", referencedId);
+	for (const [agentName, decl] of Object.entries(input.agentModels ?? {})) {
+		if (decl.model) check("agent-model", agentName, decl.model);
+		for (const referencedId of decl.fallbackModels ?? []) check("agent-fallback", agentName, referencedId);
+	}
 	for (const [source, target] of Object.entries(DEPRECATED_MODEL_MAP)) check("deprecated-model-map", source, target);
 	for (const [source, target] of replacedByOverlayEntries()) check("replaced-by-overlay", source, target);
 	return found.sort((a, b) => a.surface.localeCompare(b.surface) || a.key.localeCompare(b.key) || a.referencedId.localeCompare(b.referencedId));
@@ -26099,13 +27524,19 @@ const toolUseSchema = z$1.object({
 * Discriminated union of streaming events. `thinking` blocks are opaque
 * provider-shaped objects (Anthropic extended thinking) replayed verbatim into
 * the next request, so they stay `unknown[]` rather than being modeled.
+*
+* `stopReason` must be declared to survive: this schema strips unknown keys, so a
+* field absent here is dropped at the boundary no matter what the server sends.
+* 'max_tokens' is the one value with user-visible consequences - it means the reply
+* was cut off rather than finished.
 */
 const streamEventSchema = z$1.discriminatedUnion("type", [
 	z$1.object({
 		type: z$1.literal("content"),
 		text: z$1.string().optional(),
 		usage: usageSchema.optional(),
-		credits: creditsSchema.optional()
+		credits: creditsSchema.optional(),
+		stopReason: z$1.string().optional()
 	}),
 	z$1.object({
 		type: z$1.literal("tool_use"),
@@ -26113,7 +27544,8 @@ const streamEventSchema = z$1.discriminatedUnion("type", [
 		tools: z$1.array(toolUseSchema).optional(),
 		thinking: z$1.array(z$1.unknown()).optional(),
 		usage: usageSchema.optional(),
-		credits: creditsSchema.optional()
+		credits: creditsSchema.optional(),
+		stopReason: z$1.string().optional()
 	}),
 	z$1.object({
 		type: z$1.literal("error"),
@@ -26182,12 +27614,14 @@ var StreamAccumulator = class {
 			case "content":
 				this.accumulatedText += event.text ?? "";
 				if (event.usage || event.credits) this.lastUsageInfo = extractUsageInfo(event);
+				if (event.stopReason) this.stopReason = event.stopReason;
 				break;
 			case "tool_use":
 				if (event.text) this.accumulatedText += event.text;
 				if (event.tools && event.tools.length > 0) this.toolsUsed = event.tools;
 				if (event.thinking && event.thinking.length > 0) this.thinkingBlocks = event.thinking;
 				if (event.usage || event.credits) this.lastUsageInfo = extractUsageInfo(event);
+				if (event.stopReason) this.stopReason = event.stopReason;
 		}
 	}
 	/** True when neither text nor tools have been accumulated (stream produced nothing useful). */
@@ -26214,10 +27648,14 @@ var StreamAccumulator = class {
 			const info = {
 				toolsUsed: this.toolsUsed,
 				thinking: this.thinkingBlocks.length > 0 ? this.thinkingBlocks : void 0,
-				...this.lastUsageInfo
+				...this.lastUsageInfo,
+				stopReason: this.stopReason
 			};
 			await callback([cleanedText], info);
-		} else if (cleanedText) await callback([cleanedText], this.lastUsageInfo);
+		} else if (cleanedText) await callback([cleanedText], {
+			...this.lastUsageInfo,
+			stopReason: this.stopReason
+		});
 	}
 };
 //#endregion
@@ -26720,6 +28158,109 @@ async function createSseBackend(input, deps = defaultSseTransportDeps) {
 }
 //#endregion
 //#region ../../b4m-core/mcp/dist/index.mjs
+/**
+* Environment construction for the MCP stdio child process.
+*
+* The child is spawned from a process that also holds platform credentials - provider API keys,
+* database URIs, signing secrets - so what it inherits is a trust decision, not a convenience.
+* Two rules follow:
+*
+* 1. The child environment is built from an allowlist, never spread from `process.env`. The base
+*    layer is the MCP SDK's own `getDefaultEnvironment()`, which the stdio transport merges
+*    underneath whatever we pass (PATH, HOME, SHELL, TERM, USER on POSIX; the equivalent set on
+*    Windows). Everything above that base comes from the table below.
+* 2. A stored variable is provider data, never runtime configuration. The child is a Node
+*    process, so a key like NODE_OPTIONS is applied by the runtime before a single line of
+*    server code loads: `--require /tmp/x.js` would turn a credential field into arbitrary code
+*    execution inside the child. Those keys are refused rather than dropped quietly.
+*
+* MUST STAY IN SYNC with the `process.env` reads under each server directory
+* (`github/config.ts`, `notion/config.ts`, `atlassian/config.ts`, `linkedin/index.ts`). A
+* variable a server reads but this table omits arrives `undefined`, so add it here in the same
+* change. `childEnv.test.ts` pins that both ways.
+*/
+const MCP_SERVER_ENV_KEYS = {
+	[McpServerName.LinkedIn]: ["LINKEDIN_ACCESS_TOKEN", "COMPANY_NAME"],
+	[McpServerName.Github]: ["GITHUB_ACCESS_TOKEN"],
+	[McpServerName.Atlassian]: [
+		"ATLASSIAN_ACCESS_TOKEN",
+		"ATLASSIAN_CLOUD_ID",
+		"ATLASSIAN_SITE_URL"
+	],
+	[McpServerName.Notion]: [
+		"NOTION_ACCESS_TOKEN",
+		"NOTION_WORKSPACE_ID",
+		"NOTION_WRITE_ENABLED",
+		"NOTION_ROOT_PAGE_ID",
+		"NOTION_ACCESS_MODE",
+		"NOTION_ALLOWED_PAGES",
+		"NOTION_EXCLUDED_PAGE_IDS",
+		"NOTION_DEBUG"
+	]
+};
+/**
+* Keys that make the runtime execute caller-chosen code before the server's entry point runs:
+* NODE_OPTIONS can `--require` a file, the loader variables preload a shared object, and
+* ELECTRON_RUN_AS_NODE changes what the binary is. Matching is case-insensitive because Windows
+* environment names are.
+*/
+const CODE_INJECTING_ENV_KEY_PATTERNS = [
+	/^NODE_/i,
+	/^ELECTRON_RUN_AS_NODE$/i,
+	/^LD_/i,
+	/^DYLD_/i
+];
+/**
+* Keys that steer where the child resolves things rather than what it executes: npm_* redirects
+* package resolution, PATH decides which binary a bare command name finds, and the proxy
+* variables redirect outbound traffic.
+*/
+const RESOLUTION_STEERING_ENV_KEY_PATTERNS = [
+	/^npm_/i,
+	/^PATH$/i,
+	/^PATHEXT$/i,
+	/^(HTTP|HTTPS|ALL|NO|FTP)_PROXY$/i,
+	/^GLOBAL_AGENT_/i
+];
+[...CODE_INJECTING_ENV_KEY_PATTERNS, ...RESOLUTION_STEERING_ENV_KEY_PATTERNS];
+const matchesAny = (patterns, key) => {
+	const normalized = key.trim();
+	return patterns.some((pattern) => pattern.test(normalized));
+};
+/** True when `key` would have the runtime load caller-chosen code before the server starts. */
+function isCodeInjectingMcpEnvKey(key) {
+	return matchesAny(CODE_INJECTING_ENV_KEY_PATTERNS, key);
+}
+/**
+* Build the environment for a stdio MCP child.
+*
+* A bundled server gets exactly its declared variables - the allowlist decides, and the denylist
+* above is never consulted.
+*
+* A caller-defined command has no declared contract to check against, so it gets everything
+* except the code-injecting keys. Only the `b4m` CLI config reaches this branch, and that file
+* already lets its owner set `command` and `args` to any binary - so withholding PATH or a proxy
+* variable from them protects nobody while breaking a wrapper script or a corporate proxy, and
+* the warning that says so goes to a stderr the TUI hides. The code-injecting half stays because
+* an env-only `--require` is the one lever that is easy to set by accident.
+*/
+function buildMcpChildEnv({ serverName, envVariables, hasCustomCommand = false }) {
+	const declaredKeys = hasCustomCommand ? void 0 : MCP_SERVER_ENV_KEYS[serverName];
+	const isAllowed = declaredKeys ? (key) => declaredKeys.includes(key) : (key) => !isCodeInjectingMcpEnvKey(key);
+	const env = {};
+	const droppedKeys = [];
+	for (const { key, value } of envVariables) {
+		if (!isAllowed(key)) {
+			droppedKeys.push(key);
+			continue;
+		}
+		env[key] = value;
+	}
+	return {
+		env,
+		droppedKeys
+	};
+}
 var MCPClient = class {
 	mcp;
 	transport = null;
@@ -26763,14 +28304,11 @@ var MCPClient = class {
 				}));
 				return;
 			}
-			const envVarsObject = this.envVariables.reduce((acc, env) => ({
-				...acc,
-				[env.key]: env.value
-			}), {});
 			let command;
 			let args;
-			if (this.customCommand && this.customCommand.trim() !== "") {
-				command = this.customCommand;
+			const customCommand = this.customCommand?.trim() ? this.customCommand : void 0;
+			if (customCommand) {
+				command = customCommand;
 				args = this.customArgs ?? [];
 			} else {
 				const moduleDir = path.dirname(fileURLToPath(import.meta.url));
@@ -26787,13 +28325,16 @@ var MCPClient = class {
 				console.log(`[MCP] Using server: ${this.serverName} at ${serverScriptPath}`);
 			}
 			const stderrMode = this.suppressStderr ? "ignore" : this.onStderrLine ? "pipe" : void 0;
+			const { env, droppedKeys } = buildMcpChildEnv({
+				serverName: this.serverName,
+				envVariables: this.envVariables,
+				hasCustomCommand: Boolean(customCommand)
+			});
+			if (droppedKeys.length > 0) console.warn(`[MCP] Withheld ${droppedKeys.length} undeclared env variable(s) from ${this.serverName}: ${droppedKeys.join(", ")}`);
 			const transportConfig = {
 				command,
 				args,
-				env: {
-					...Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== void 0)),
-					...envVarsObject
-				},
+				env,
 				...stderrMode && { stderr: stderrMode }
 			};
 			const stdioTransport = new StdioClientTransport(transportConfig);
@@ -27221,7 +28762,7 @@ const MODEL_ALIASES = {
 	"o4-mini": ChatModels.O4_MINI,
 	gemini: ChatModels.GEMINI_2_5_PRO,
 	"gemini-pro": ChatModels.GEMINI_2_5_PRO,
-	"gemini-flash": ChatModels.GEMINI_2_5_FLASH,
+	"gemini-flash": ChatModels.GEMINI_3_5_FLASH,
 	"gemini-flash-lite": ChatModels.GEMINI_2_5_FLASH_LITE,
 	"gemini-3": ChatModels.GEMINI_3_PRO_PREVIEW,
 	"gemini-3-pro": ChatModels.GEMINI_3_PRO_PREVIEW,
@@ -27328,7 +28869,7 @@ var AgentStore = class {
 	async loadAgentsFromDirectory(directory, source) {
 		try {
 			if (!(await fs$1.stat(directory)).isDirectory()) return;
-			const files = await this.findAgentFiles(directory);
+			const files = await findMarkdownFiles(directory);
 			for (const filePath of files) try {
 				const agent = await this.parseAgentFile(filePath, source);
 				this.agents.set(agent.name, agent);
@@ -27340,25 +28881,6 @@ var AgentStore = class {
 		}
 	}
 	/**
-	* Recursively find all .md files in directory
-	*/
-	async findAgentFiles(directory) {
-		const files = [];
-		try {
-			const entries = await fs$1.readdir(directory, { withFileTypes: true });
-			for (const entry of entries) {
-				const fullPath = path.join(directory, entry.name);
-				if (entry.isDirectory()) {
-					const subFiles = await this.findAgentFiles(fullPath);
-					files.push(...subFiles);
-				} else if (entry.isFile() && entry.name.endsWith(".md")) files.push(fullPath);
-			}
-		} catch (error) {
-			console.warn(`Error reading directory ${directory}:`, error instanceof Error ? error.message : String(error));
-		}
-		return files;
-	}
-	/**
 	* Parse a single agent markdown file
 	*/
 	async parseAgentFile(filePath, source) {
@@ -27675,7 +29197,8 @@ function buildFilenameMarkerRegex(markers) {
 * of the best-effort DB pre-filter. Fail-closed by design.
 */
 function isRetrievalExcluded(file, opts) {
-	if (opts.vectorizedOnly && !file.vectorized) return true;
+	const stalledByConvergence = isChunkStalledFile(file) || isChunkRebuildPending(file.chunkRebuildRequestedAt);
+	if (opts.vectorizedOnly && !file.vectorized && !stalledByConvergence) return true;
 	const re = buildFilenameMarkerRegex(opts.excludeFilenameMarkers);
 	return !!re && re.test((file.fileName ?? "").toLowerCase());
 }
@@ -28185,6 +29708,41 @@ function attachedContentExtractionBudget(maxSafeInputTokens, systemPromptReserve
 	const boundedReserve = Math.min(systemPromptReserve, Math.floor(maxSafeInputTokens * EXTRACTION_SYSTEM_RESERVE_MAX_SHARE));
 	return Math.max(0, Math.max(Math.floor(maxSafeInputTokens * MIN_ATTACHED_CONTENT_EXTRACTION_SHARE), Math.floor((maxSafeInputTokens - boundedReserve) * ATTACHED_CONTENT_EXTRACTION_SHARE)));
 }
+/**
+* Output budget used when a caller supplies no max_tokens. Within supported output limits for
+* every configured non-reasoning model; models that reason inside the output budget default to
+* ADAPTIVE_THINKING_MAX_TOKENS_FLOOR instead, since their reasoning would otherwise consume this
+* whole budget (see resolveOutputMaxTokens/reasonsWithinOutputBudget for which those are).
+* Distinct from the catalog's DEFAULT_MAX_OUTPUT_TOKENS, which fills in a model's *capability*
+* when its record omits one.
+*/
+const DEFAULT_OUTPUT_MAX_TOKENS = 4096;
+/**
+* Verbatim-history token budget shared by every caller that sizes one: how much of the model's
+* safe input window recent conversation turns may claim before older ones fall out to
+* contextSummary. Pulled into one place because ChatCompletionProcess.ts and
+* ChatCompletionFeatures.ts (QuestMaster) both need it and must not drift apart - the first
+* version of the QuestMaster call site hand-copied the formula and got the window wrong for
+* every model below the unknown-model floor.
+*
+* Always returns at least 1, even on a window so small or a message so long that the raw
+* subtraction goes to zero or negative: `Math.max(0, budget) && budget > 0` downstream treats a
+* falsy budget as "no budget given" and skips trimming entirely, which is the exact unbounded
+* history this function exists to prevent. A budget of 1 still trims to the single most recent
+* turn instead of disabling the trim.
+*/
+function computeVerbatimTokenBudget(modelInfo, requestedMaxTokens, opts) {
+	const modelMaxOutput = modelInfo.max_tokens ?? 16384;
+	const safeMaxTokens = resolveOutputMaxTokens({
+		requested: requestedMaxTokens,
+		fallback: DEFAULT_OUTPUT_MAX_TOKENS,
+		modelInfo,
+		modelMaxOutputTokens: modelMaxOutput
+	});
+	const safeInputTokens = Math.max(0, safeInputWindow(modelInfo, safeMaxTokens));
+	const availableForVerbatim = Math.max(0, safeInputTokens - opts.nonHistoryOverheadTokens);
+	return Math.max(1, Math.floor(availableForVerbatim * opts.verbatimWindowFraction));
+}
 /** The buffer buildAndSortMessages holds back before dividing the input window. */
 function assemblyTokenBuffer(maxInputTokens) {
 	return Math.max(MIN_TOKEN_BUFFER, Math.floor(maxInputTokens * TOKEN_BUFFER_PERCENTAGE));
@@ -28223,6 +29781,18 @@ function attachedContentBudgetsAgree(maxSafeInputTokens, systemPromptReserve) {
 var AdminSettingsCache = class AdminSettingsCache {
 	cache = /* @__PURE__ */ new Map();
 	individualCache = /* @__PURE__ */ new Map();
+	/**
+	* Every call through this field is optional-chained (`this.logger.debug?.()`).
+	*
+	* A cache must not throw because it could not log, and this one is exposed to that: it is a
+	* process-wide singleton created with whichever logger happens to reach `getSettingsCache` first.
+	* What each caller then does with a throw varies, and it is mostly NOT a degrade-to-defaults
+	* guard: `getSettingsByNames` has none at all, the scoped resolver guards one layer out in
+	* `resolveAll`, and `resolveSpendLevers` deliberately rethrows to halt spend. So a logger missing
+	* a quieter level could surface as a silent wrong VALUE, as an unhandled rejection, or as a hard
+	* fail-closed, depending on who asked. `ScopedSettingsCache` is built by the same factory pair
+	* and still has one unguarded call - the same hazard, not a solved one.
+	*/
 	logger;
 	cleanupInterval = null;
 	maxCacheSize = 1e3;
@@ -28238,13 +29808,13 @@ var AdminSettingsCache = class AdminSettingsCache {
 	*/
 	startCleanupTimer() {
 		if (process.env.NODE_ENV !== "production" || process.env.VERCEL || process.env.AWS_LAMBDA_FUNCTION_NAME) {
-			this.logger.debug("Skipping cleanup timer in serverless environment");
+			this.logger.debug?.("Skipping cleanup timer in serverless environment");
 			return;
 		}
 		this.cleanupInterval = setInterval(() => {
 			this.performCleanup();
 		}, AdminSettingsCache.CLEANUP_INTERVAL);
-		this.logger.debug("Started cache cleanup timer");
+		this.logger.debug?.("Started cache cleanup timer");
 	}
 	/**
 	* Stop cleanup timer (for graceful shutdown)
@@ -28253,7 +29823,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 		if (this.cleanupInterval) {
 			clearInterval(this.cleanupInterval);
 			this.cleanupInterval = null;
-			this.logger.debug("Stopped cache cleanup timer");
+			this.logger.debug?.("Stopped cache cleanup timer");
 		}
 	}
 	/**
@@ -28278,9 +29848,9 @@ var AdminSettingsCache = class AdminSettingsCache {
 				this.individualCache.delete(entries[i][0]);
 				removedCount++;
 			}
-			this.logger.warn(`Emergency cache cleanup: removed ${toRemove} entries due to size limit`);
+			this.logger.warn?.(`Emergency cache cleanup: removed ${toRemove} entries due to size limit`);
 		}
-		if (removedCount > 0) this.logger.debug(`Cache cleanup removed ${removedCount} expired entries (${beforeSize} → ${this.cache.size + this.individualCache.size})`);
+		if (removedCount > 0) this.logger.debug?.(`Cache cleanup removed ${removedCount} expired entries (${beforeSize} → ${this.cache.size + this.individualCache.size})`);
 	}
 	/**
 	* Get TTL based on environment
@@ -28301,18 +29871,18 @@ var AdminSettingsCache = class AdminSettingsCache {
 		const cacheKey = "all_settings";
 		const cached = this.cache.get(cacheKey);
 		if (cached && this.isValid(cached.timestamp, cached.ttl)) {
-			this.logger.debug("📦 Admin settings cache HIT");
+			this.logger.debug?.("📦 Admin settings cache HIT");
 			return cached.data;
 		}
 		if (cached) this.cache.delete(cacheKey);
-		this.logger.debug("🔍 Admin settings cache MISS - fetching from database");
+		this.logger.debug?.("🔍 Admin settings cache MISS - fetching from database");
 		const fetchStart = Date.now();
 		const settingsMap = (await db.adminSettings.findAll()).reduce((out, s) => {
 			out[s.settingName] = s.settingValue;
 			return out;
 		}, {});
 		const fetchTime = Date.now() - fetchStart;
-		this.logger.info(`📦 Cached ${Object.keys(settingsMap).length} admin settings in ${fetchTime}ms`);
+		this.logger.info?.(`📦 Cached ${Object.keys(settingsMap).length} admin settings in ${fetchTime}ms`);
 		const ttl = this.getTTL();
 		this.cache.set(cacheKey, {
 			data: settingsMap,
@@ -28334,15 +29904,15 @@ var AdminSettingsCache = class AdminSettingsCache {
 	async getSettingByName(settingName, db) {
 		const cached = this.individualCache.get(settingName);
 		if (cached && this.isValid(cached.timestamp, cached.ttl)) {
-			this.logger.debug(`📦 Individual setting '${settingName}' cache HIT`);
+			this.logger.debug?.(`📦 Individual setting '${settingName}' cache HIT`);
 			return cached.value;
 		}
 		if (cached) this.individualCache.delete(settingName);
-		this.logger.debug(`🔍 Individual setting '${settingName}' cache MISS - fetching from database`);
+		this.logger.debug?.(`🔍 Individual setting '${settingName}' cache MISS - fetching from database`);
 		const fetchStart = Date.now();
 		const value = (await db.adminSettings.findBySettingName(settingName))?.settingValue ?? null;
 		const fetchTime = Date.now() - fetchStart;
-		this.logger.debug(`📦 Cached individual setting '${settingName}' in ${fetchTime}ms`);
+		this.logger.debug?.(`📦 Cached individual setting '${settingName}' in ${fetchTime}ms`);
 		this.individualCache.set(settingName, {
 			value,
 			timestamp: Date.now(),
@@ -28366,11 +29936,11 @@ var AdminSettingsCache = class AdminSettingsCache {
 			}
 		}
 		if (uncachedSettings.length > 0) {
-			this.logger.debug(`🔍 Batch fetching ${uncachedSettings.length} uncached settings: ${uncachedSettings.join(", ")}`);
+			this.logger.debug?.(`🔍 Batch fetching ${uncachedSettings.length} uncached settings: ${uncachedSettings.join(", ")}`);
 			const fetchStart = Date.now();
 			const settings = await db.adminSettings.findBySettingNames(uncachedSettings);
 			const fetchTime = Date.now() - fetchStart;
-			this.logger.debug(`📦 Batch fetched ${settings.length} settings in ${fetchTime}ms`);
+			this.logger.debug?.(`📦 Batch fetched ${settings.length} settings in ${fetchTime}ms`);
 			const ttl = this.getTTL();
 			settings.forEach((setting) => {
 				result[setting.settingName] = setting.settingValue;
@@ -28388,7 +29958,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 				});
 			});
 		}
-		this.logger.debug(`📦 Returned ${Object.keys(result).length} settings (${settingNames.length - uncachedSettings.length} from cache, ${uncachedSettings.length} from DB)`);
+		this.logger.debug?.(`📦 Returned ${Object.keys(result).length} settings (${settingNames.length - uncachedSettings.length} from cache, ${uncachedSettings.length} from DB)`);
 		return result;
 	}
 	/**
@@ -28397,7 +29967,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 	invalidateSetting(settingName) {
 		this.individualCache.delete(settingName);
 		this.cache.delete("all_settings");
-		this.logger.info(`🗑️ Invalidated cache for setting: ${settingName}`);
+		this.logger.info?.(`🗑️ Invalidated cache for setting: ${settingName}`);
 	}
 	/**
 	* Invalidate all cached admin settings
@@ -28405,7 +29975,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 	invalidateAll() {
 		this.cache.clear();
 		this.individualCache.clear();
-		this.logger.info("🗑️ Invalidated all admin settings cache");
+		this.logger.info?.("🗑️ Invalidated all admin settings cache");
 	}
 	/**
 	* Get cache statistics for monitoring
@@ -28438,16 +30008,16 @@ var AdminSettingsCache = class AdminSettingsCache {
 	* Warm up the cache by fetching all settings
 	*/
 	async warmUp(db) {
-		this.logger.info("🔥 Warming up admin settings cache...");
+		this.logger.info?.("🔥 Warming up admin settings cache...");
 		await this.getSettingsMap(db);
-		this.logger.info("✅ Admin settings cache warmed up");
+		this.logger.info?.("✅ Admin settings cache warmed up");
 	}
 	/**
 	* Graceful shutdown - cleanup timers
 	*/
 	shutdown() {
 		this.stopCleanupTimer();
-		this.logger.info("🛑 Admin settings cache shutdown complete");
+		this.logger.info?.("🛑 Admin settings cache shutdown complete");
 	}
 };
 /** Address of one cached override, shared by the cache and its callers so lookups are consistent. */
@@ -28796,6 +30366,17 @@ const getFileContent = async (fabFile, { storage, logger }) => {
 	}
 	return content;
 };
+/**
+* Content hash for per-lake FabFile dedup (`findByContentHashesInDataLake`). Shared by every
+* ingest path that needs to hash bytes before creating a FabFile - the Slack attachment path
+* (raw downloaded buffer) and the URL/link path (`fetchAndParseURL`'s extracted `textContent`) -
+* so at least the HASHING ITSELF cannot drift between two copies of the same algorithm.
+*
+* This does NOT make `contentHash` one hash domain: the two callers feed it different inputs
+* (raw bytes vs. extracted text), so the same document added once as an attachment and once as a
+* link produces two different hashes and is not caught as a duplicate by this field.
+*/
+const computeContentHash = (content) => createHash$1("sha256").update(content).digest("hex");
 /** The next 1-based version number given the existing (possibly absent) version history. */
 const nextVersionNumber = (versions) => {
 	if (!versions || versions.length === 0) return 1;
@@ -29006,19 +30587,6 @@ const EDITABLE_IMAGE_KEY_RE = /\.(jpe?g|png|webp|gif)$/i;
 const PREVIEW_CHUNK = 700;
 const CHARS_PER_TOKEN = 3.5;
 /**
-* Chunks per attached file that cosine retrieval feeds to the model. Three starved small embedders: a
-* chunk is the embedding model's context window less a 20% buffer (see SmartChunker), so three chunks
-* is roughly 69k chars on an 8192-token embedder but only 4.3k on a 512-token one, which answers a
-* question about a 200-row table from 43 rows without saying so.
-*
-* 10 is borrowed from rankChunksForFiles' topK default, but note the two caps differ in shape: that
-* one is global across every file in the search, this one is PER FILE, so a multi-file attachment can
-* yield more chunks here. What bounds the payload is the per-file character budget applied to these
-* results (maxChars in processFabFilesServer), not this count - and that budget now derives from the
-* model's input window rather than its output limit; see attachedContentExtractionBudget.
-*/
-const COSINE_SEARCH_TOP_K = 10;
-/**
 * How much of one attached file the cosine scan will read, and in what size pages.
 *
 * Module constants rather than admin settings: unlike a data lake, an attachment is one file the
@@ -29191,12 +30759,12 @@ const estimateMessagesTokens = (messages) => messages.reduce((sum, message) => s
 * staying synchronous (no N async tokenizer calls over a long history). Mirrors
 * the fields the conversion below actually emits into the prompt.
 */
-function estimateQuestTokenLength(item) {
+function estimateQuestTokenLength(item, disableToolReplay = false) {
 	const parts = [item.prompt ?? ""];
 	if (item.structuredReplies?.length) parts.push(JSON.stringify(item.structuredReplies));
 	else if (item.replies?.length) parts.push(item.replies.join("\n"));
 	if (item.toolResults?.length) parts.push(JSON.stringify(item.toolResults));
-	if (!item.structuredReplies?.length) {
+	if (!item.structuredReplies?.length && !disableToolReplay) {
 		const toolCalls = replayableToolCalls(item.promptMeta?.functionCalls);
 		if (toolCalls.length) parts.push(JSON.stringify(toolCalls));
 	}
@@ -29276,20 +30844,21 @@ async function generateSafeEmbedding(embeddingService, text, logger) {
 * history at all, and UNLIMITED_HISTORY_COUNT means no window (which still pages, since the
 * fetch needs some limit).
 */
-async function fetchAndProcessPreviousMessages(session, historyCount = null, { db, verbatimTokenBudget }) {
+async function fetchAndProcessPreviousMessages(session, historyCount = null, { db, verbatimTokenBudget, excludeCurrentPrompt = false, model }) {
 	if (!isUnlimitedHistory(historyCount) && historyCount !== null && historyCount <= 0) return [
 		[],
 		0,
 		{ cacheHit: false }
 	];
 	const limit = resolveHistoryFetchLimit(historyCount);
+	const disableToolReplay = !!model && isGeminiModelId(model);
 	const startTime = Date.now();
 	const chatHistoryItems = await db.quests.getMostRecentChatHistory(session.id, limit + 1);
 	const fetchTime = Date.now() - startTime;
 	const cacheIndicator = fetchTime < 50 ? "CACHE_HIT" : "CACHE_MISS";
 	Logger.globalInstance.log(`⚡ Message History ${cacheIndicator}: ${fetchTime}ms for session ${session.id.slice(-8)} (${chatHistoryItems.length} items)`);
 	chatHistoryItems.reverse();
-	if (chatHistoryItems.length > 1) chatHistoryItems.pop();
+	if (chatHistoryItems.length > 1 || excludeCurrentPrompt) chatHistoryItems.pop();
 	if (session.contextSummaryUpToQuestId) {
 		const boundary = session.contextSummaryUpToQuestId;
 		const filtered = chatHistoryItems.filter((item) => item.id > boundary);
@@ -29300,7 +30869,7 @@ async function fetchAndProcessPreviousMessages(session, historyCount = null, { d
 		let usedTokens = 0;
 		let keepFromIndex = 0;
 		for (let i = chatHistoryItems.length - 1; i >= 0; i--) {
-			usedTokens += estimateQuestTokenLength(chatHistoryItems[i]);
+			usedTokens += estimateQuestTokenLength(chatHistoryItems[i], disableToolReplay);
 			if (usedTokens > verbatimTokenBudget && i < chatHistoryItems.length - 1) {
 				keepFromIndex = i + 1;
 				break;
@@ -29332,7 +30901,7 @@ async function fetchAndProcessPreviousMessages(session, historyCount = null, { d
 					is_error: tr.is_error
 				}))
 			});
-		} else if (toolCalls.length > 0) {
+		} else if (toolCalls.length > 0 && !disableToolReplay) {
 			const textReply = cur.replies?.find((reply) => !reply.trim().startsWith("<think>")) || "";
 			const assistantContent = [];
 			if (textReply) assistantContent.push({
@@ -29429,14 +30998,28 @@ async function fetchAgentConversationHistory(session, questCount, { db }) {
 		return acc;
 	}, new Array());
 }
-async function fetchAndConvertFabFiles(fabFileIds, { scope }, { db, storage }) {
-	const fabFiles = await db.fabfiles.getAccessibleFiles(fabFileIds, scope);
-	return await Promise.all(fabFiles.map(async (file) => {
+/**
+* Resolves attachment ids to documents, and reports the ones it could NOT resolve. The missing set
+* is the point: `getAccessibleFiles` applies a permission scope and simply omits what it rejects, so
+* an id dropped by the scope filter or by a delete/upload race used to leave no trace anywhere - the
+* turn ran as though the file had never been attached (#2228). Callers report `missingIds` through
+* the same channel as the per-file notices rather than inferring the drop from a shorter array.
+*/
+async function fetchAndConvertFabFiles(fabFileIds, { scope, lakeAccess }, { db, storage, logger }) {
+	const fabFiles = await db.fabfiles.getAccessibleFiles(fabFileIds, scope, lakeAccess);
+	const files = await Promise.all(fabFiles.map(async (file) => {
 		return {
 			...file,
 			userId: file.userId.toString()
 		};
 	}));
+	const returnedIds = new Set(files.map((file) => String(file.id)));
+	const missingIds = Array.from(new Set(fabFileIds)).filter((id) => !returnedIds.has(String(id)));
+	if (missingIds.length > 0) logger?.warn(`[fetchAndConvertFabFiles] ${missingIds.length} of ${fabFileIds.length} requested file id(s) were not returned by getAccessibleFiles and contribute nothing to this turn: ${missingIds.join(", ")}`);
+	return {
+		files,
+		missingIds
+	};
 }
 async function getCachedSignedUrl(filePath, storage, db) {
 	const key = `cachedSignedUrl:${filePath}`;
@@ -29638,7 +31221,7 @@ async function cosineSearch(file, userPromptVector, { db, logger }) {
 		for (const chunk of usable) {
 			const position = scanned;
 			scanned++;
-			if (head.length < COSINE_SEARCH_TOP_K) head.push({
+			if (head.length < 10) head.push({
 				chunkId: chunk.id,
 				content: chunk.text,
 				score: 0
@@ -29659,9 +31242,9 @@ async function cosineSearch(file, userPromptVector, { db, logger }) {
 				position
 			});
 		}
-		if (ranked.length > COSINE_SEARCH_TOP_K) {
+		if (ranked.length > 10) {
 			ranked.sort(compareRankedChunks);
-			ranked.length = COSINE_SEARCH_TOP_K;
+			ranked.length = 10;
 		}
 		if (!moreExist) break;
 	}
@@ -29683,14 +31266,14 @@ const noopResize = async (imageBuffer) => imageBuffer;
 async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, attachedContentTokenBudget, modelInfo, sendStatusUpdate, { logger, storage, db, resizeImageForModel = noopResize }, progressCallback) {
 	if (!fabFiles || fabFiles.length === 0) return {
 		userMessages: [],
-		errorMessages: [],
+		fileNotices: [],
 		deliveredFileIds: [],
 		fullyDeliveredFileIds: []
 	};
 	const fileProcessingStartTime = Date.now();
 	let systemContent = "";
 	const userMessages = [];
-	const errorMessages = [];
+	const fileNotices = [];
 	const deliveredFileIds = /* @__PURE__ */ new Set();
 	const fullyDeliveredFileIds = /* @__PURE__ */ new Set();
 	const contextFiles = [];
@@ -29721,11 +31304,25 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 		try {
 			if (isAudioMimeType(file.mimeType)) {
 				logger.warn(`[processFabFilesServer] Skipping audio file ${file.fileName} — audio is not attachable to an LLM.`);
+				fileNotices.push({
+					fabFileId: file.id,
+					fileName: file.fileName,
+					band: "audio",
+					message: `"${noticeFileName(file.fileName)}" is an audio file and was not sent: no model accepts audio as input.`,
+					delivered: false
+				});
 				return;
 			}
 			if (supportsVision && isImageAttachment(file.mimeType)) {
 				if (!isImageServeable(file)) {
 					logger.warn(`[processFabFilesServer] Skipping image file ${file.fileName} — held pending moderation or blocked (#9776 Q2b).`);
+					fileNotices.push({
+						fabFileId: file.id,
+						fileName: file.fileName,
+						band: "image_not_serveable",
+						message: `Image "${noticeFileName(file.fileName)}" was not sent: it is held pending moderation or has been blocked.`,
+						delivered: false
+					});
 					return;
 				}
 				sendStatusUpdate(`Processing image file ${file.fileName}...`);
@@ -29761,9 +31358,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 								const errorMsg = `⚠️ Image "${file.fileName}" (${fileSizeMB.toFixed(1)}MB) is too large for ${backendName}. Max: ${MAX_IMAGE_SIZE_MB}MB. Please delete this file and re-upload to auto-resize.`;
 								logger.warn(errorMsg);
 								await sendStatusUpdate(errorMsg);
-								errorMessages.push({
-									role: "error",
-									content: errorMsg
+								fileNotices.push({
+									fabFileId: file.id,
+									fileName: file.fileName,
+									band: "image_too_large",
+									message: errorMsg,
+									delivered: false
 								});
 								return;
 							}
@@ -29793,9 +31393,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 								const errorMsg = `⚠️ Image "${file.fileName}" (${encodedMB}MB encoded) is too large for ${modelInfo.name}. Max ~3MB. Please delete this file and re-upload a smaller image.`;
 								logger.warn(errorMsg);
 								await sendStatusUpdate(errorMsg);
-								errorMessages.push({
-									role: "error",
-									content: errorMsg
+								fileNotices.push({
+									fabFileId: file.id,
+									fileName: file.fileName,
+									band: "image_too_large",
+									message: errorMsg,
+									delivered: false
 								});
 								return;
 							}
@@ -29809,7 +31412,16 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 							});
 							delivered = true;
 							fullyDelivered = true;
-						} else logger.warn(`Vision support for the model ${modelInfo.id} is not implemented. Skipping image processing.`);
+						} else {
+							logger.warn(`Vision support for the model ${modelInfo.id} is not implemented. Skipping image processing.`);
+							fileNotices.push({
+								fabFileId: file.id,
+								fileName: file.fileName,
+								band: "vision_unsupported",
+								message: `Image "${noticeFileName(file.fileName)}" was not sent: image input is not implemented for ${modelInfo.name ?? modelInfo.id}.`,
+								delivered: false
+							});
+						}
 						break;
 					case ModelBackend.Ollama: {
 						const imageBuffer = await resizeImageForModel(await storage.download(file.filePath), void 0, logger);
@@ -29838,10 +31450,26 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						fullyDelivered = true;
 						break;
 					}
-					default: logger.error(`Unsupported backend for model ${modelInfo.id} backend ${modelInfo?.backend ?? "undefined"}`);
+					default:
+						logger.error(`Unsupported backend for model ${modelInfo.id} backend ${modelInfo?.backend ?? "undefined"}`);
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "unsupported_backend",
+							message: `Image "${noticeFileName(file.fileName)}" was not sent: this model's backend does not accept image attachments.`,
+							delivered: false
+						});
 				}
-			} else if (!supportsVision && isImageAttachment(file.mimeType)) logger.warn(`File ${file.fileName} is an image but model does not support vision. Skipping...`);
-			else {
+			} else if (!supportsVision && isImageAttachment(file.mimeType)) {
+				logger.warn(`File ${file.fileName} is an image but model does not support vision. Skipping...`);
+				fileNotices.push({
+					fabFileId: file.id,
+					fileName: file.fileName,
+					band: "vision_unsupported",
+					message: `Image "${noticeFileName(file.fileName)}" was not sent: ${modelInfo?.name ?? modelInfo?.id ?? "this model"} cannot read images.`,
+					delivered: false
+				});
+			} else {
 				const embeddingModel = file.embeddingModel ?? OpenAIEmbeddingModel.TEXT_EMBEDDING_ADA_002;
 				const userVector = userVectorPrompt[embeddingModel];
 				const canCosineSearch = file.vectorized && !!userVector && userVector.length > 0;
@@ -29917,9 +31545,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						const originalFileSize = fabContent.length;
 						fabContent = fabContent.substring(0, finalMaxFileSize ?? PREVIEW_CHUNK) + CONTENT_TRUNCATION_NOTICE;
 						errorMsg = `Knowledge in the workbench with the fileName ${file.fileName} is ${originalFileSize} long which exceeds ${finalMaxFileSize}. ` + (canCosineSearch ? "None of its vectorized chunks could be searched with this turn's embedding model, so it was sent as raw text and truncated. Re-vectorize it under the current embedding model, or select a model with a higher context window." : "Vectorize your large file or select a model with higher context window.");
-						errorMessages.push({
-							role: "error",
-							content: errorMsg
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "truncated",
+							message: `"${noticeFileName(file.fileName)}" was too large to send whole; only the first ${Math.floor(finalMaxFileSize)} characters of ${originalFileSize} reached this conversation.`,
+							delivered: true
 						});
 					} else errorMsg = null;
 					delivered = true;
@@ -29933,19 +31564,41 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						error: errorMsg
 					});
 				} catch (e) {
-					if (e instanceof BadRequestError && e.message.includes("Unsupported file type")) logger.warn(`Unsupported file type: ${file.fileName}`);
-					else if (isAxiosError(e) && e.response?.status === 404) {
+					if (e instanceof BadRequestError && e.message.includes("Unsupported file type")) {
+						logger.warn(`Unsupported file type: ${file.fileName}`);
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "unsupported_type",
+							message: `"${noticeFileName(file.fileName)}" was not sent: its file type (${file.mimeType}) cannot be read as text.`,
+							delivered: false
+						});
+					} else if (isAxiosError(e) && e.response?.status === 404) {
 						await sendStatusUpdate(`Skipping file ${file.fileName}. File might be corrupted or deleted`);
 						await db.fabfiles.update({
 							id: file.id,
 							error: "This file appears to be corrupted or may have been deleted. Please try uploading the file again."
 						});
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "read_failed",
+							message: `"${noticeFileName(file.fileName)}" could not be read and was not sent: it appears to be corrupted or deleted. Try uploading it again.`,
+							delivered: false
+						});
 					} else if (e instanceof CorruptedFileError) {
 						await sendStatusUpdate(`Skipping corrupted file ${file.fileName}. Please try re-uploading`);
 						await db.fabfiles.update({
 							id: file.id,
 							error: e.message
 						});
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "read_failed",
+							message: `"${noticeFileName(file.fileName)}" could not be read and was not sent: ${e.message}`,
+							delivered: false
+						});
 					} else {
 						logger.updateMetadata({ filePath: file.filePath });
 						throw e;
@@ -29965,6 +31618,18 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 		processedFiles++;
 		if (progressCallback) await progressCallback(processedFiles, totalFiles);
 	}))));
+	const noticedFileIds = new Set(fileNotices.map((notice) => notice.fabFileId));
+	for (const file of fabFiles) {
+		if (deliveredFileIds.has(file.id) || noticedFileIds.has(file.id)) continue;
+		logger.warn(`[processFabFilesServer] "${file.fileName}" (${file.id}) contributed no content and produced no notice; reporting it as undelivered.`);
+		fileNotices.push({
+			fabFileId: file.id,
+			fileName: file.fileName,
+			band: "no_readable_content",
+			message: `"${noticeFileName(file.fileName)}" was not sent: no readable content could be extracted from it.`,
+			delivered: false
+		});
+	}
 	if (imageContent.length > 0) userMessages.push({
 		role: "user",
 		content: imageContent
@@ -29992,7 +31657,7 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 	logger.info(`📁 File processing completed in ${fileProcessingTime}ms for ${fabFiles.length} files`);
 	return {
 		userMessages,
-		errorMessages,
+		fileNotices,
 		deliveredFileIds: Array.from(deliveredFileIds),
 		fullyDeliveredFileIds: Array.from(fullyDeliveredFileIds)
 	};
@@ -30517,6 +32182,8 @@ var llm_exports = /* @__PURE__ */ __exportAll({
 	ATTACHED_CONTENT_EXTRACTION_SHARE: () => ATTACHED_CONTENT_EXTRACTION_SHARE,
 	ATTACHMENT_DELIVERED_NOTICE: () => ATTACHMENT_DELIVERED_NOTICE,
 	BUILDER_INJECTED_BLOCK_IDS: () => BUILDER_INJECTED_BLOCK_IDS,
+	COSINE_SEARCH_TOP_K: () => 10,
+	DEFAULT_OUTPUT_MAX_TOKENS: () => DEFAULT_OUTPUT_MAX_TOKENS,
 	EXTRACTION_SYSTEM_RESERVE_MAX_SHARE: () => EXTRACTION_SYSTEM_RESERVE_MAX_SHARE,
 	FORMAT_PROMPT_PRIORITY: () => 60,
 	IMAGE_PROMPT_PRIORITY: () => 50,
@@ -30532,6 +32199,7 @@ var llm_exports = /* @__PURE__ */ __exportAll({
 	buildAndSortMessages: () => buildAndSortMessages,
 	calculateTotalTokenLength: () => calculateTotalTokenLength,
 	computeCosineSimilarity: () => computeCosineSimilarity,
+	computeVerbatimTokenBudget: () => computeVerbatimTokenBudget,
 	effectiveContextWindow: () => effectiveContextWindow,
 	fetchAgentConversationHistory: () => fetchAgentConversationHistory,
 	fetchAndConvertFabFiles: () => fetchAndConvertFabFiles,
@@ -32133,6 +33801,7 @@ const OPENAI_IMAGE_CLIENT_OPTS = {
 	maxRetries: 0
 };
 const ALTERNATIVE_IMAGE_MODELS = "Flux Pro, Flux Dev, or Grok";
+const truncatePromptForLog = (prompt) => prompt.length > 100 ? `${prompt.slice(0, 100)}...` : prompt;
 /**
 * Builds a user-friendly error when OpenAI's safety system blocks an image
 * request, guiding the user to rephrase or switch to an alternative model.
@@ -32160,6 +33829,53 @@ function buildModerationBlockedError(error) {
 
 Tip: Switch to an alternative model with different content policies — e.g. ${ALTERNATIVE_IMAGE_MODELS} — which may accept this prompt.\n\nIf you believe this is an error, you can report it to OpenAI with request ID: ${requestId}`);
 }
+/**
+* Splits a WIDTHxHEIGHT size into its two edges, or null when the value is not a
+* pair of non-zero numbers (e.g. 'auto', '', 'wide'). Null means "not a custom
+* resolution" rather than "invalid": generate() has always left such values
+* untouched, and that behaviour is preserved.
+*/
+function parseSizeEdges(size) {
+	if (typeof size !== "string") return null;
+	const [width, height] = size.split("x").map(Number);
+	if (!width || !height) return null;
+	return {
+		width,
+		height
+	};
+}
+/**
+* True when a custom gpt-image-2 resolution meets OpenAI's documented limits.
+* gpt-image-2 accepts any resolution satisfying these, not only the presets in
+* OPENAI_GPT_IMAGE_2_IMAGE_SIZES, so a flat preset check would reject valid
+* custom sizes. Must stay the single source of this rule for generate() and edit().
+*/
+function satisfiesGptImage2Constraints({ width, height }) {
+	const { maxEdge, minTotalPixels, maxTotalPixels, edgeMultiple, maxAspectRatio } = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.constraints;
+	const longEdge = Math.max(width, height);
+	const shortEdge = Math.min(width, height);
+	const totalPixels = width * height;
+	return longEdge <= maxEdge && width % edgeMultiple === 0 && height % edgeMultiple === 0 && longEdge / shortEdge <= maxAspectRatio && totalPixels >= minTotalPixels && totalPixels <= maxTotalPixels;
+}
+/**
+* True when `size` may be forwarded to images.edit for `model`. gpt-image-2 takes
+* its presets (including 'auto') or any custom WIDTHxHEIGHT meeting the same
+* constraints generate() enforces; the gpt-image-1 family is limited to its three
+* fixed sizes. An unsupported size is dropped by the caller so OpenAI applies its
+* own default instead of rejecting the whole request with a 400.
+*
+* GPT-Image tiers only: dall-e-2 has its own size list and passes size through
+* untouched, so do not route that model here.
+*/
+function isSupportedEditSize(model, size) {
+	if (typeof size !== "string") return false;
+	if (isGPTImage2Model(model)) {
+		if (OPENAI_GPT_IMAGE_2_IMAGE_SIZES.includes(size)) return true;
+		const edges = parseSizeEdges(size);
+		return edges !== null && satisfiesGptImage2Constraints(edges);
+	}
+	return OPENAI_GPT_IMAGE_1_IMAGE_SIZES.includes(size);
+}
 var OpenAIImageService = class extends AIImageService {
 	async generate(prompt, options) {
 		const openai = new OpenAI({
@@ -32184,16 +33900,11 @@ var OpenAIImageService = class extends AIImageService {
 				}
 				if (isGPTImage2Model(options.model)) {
 					if (openaiOptions.size && openaiOptions.size !== "auto") {
-						const [w, h] = openaiOptions.size.split("x").map(Number);
-						if (w && h) {
-							const maxEdge = Math.max(w, h);
-							const minEdge = Math.min(w, h);
-							const totalPixels = w * h;
-							if (maxEdge > 3840 || w % 16 !== 0 || h % 16 !== 0 || maxEdge / minEdge > 3 || totalPixels < 655360 || totalPixels > 8294400) {
-								const originalSize = openaiOptions.size;
-								openaiOptions.size = "1024x1024";
-								parameterWarnings.push(`Size '${originalSize}' violates gpt-image-2 constraints, changed to '1024x1024'`);
-							}
+						const edges = parseSizeEdges(openaiOptions.size);
+						if (edges && !satisfiesGptImage2Constraints(edges)) {
+							const originalSize = openaiOptions.size;
+							openaiOptions.size = "1024x1024";
+							parameterWarnings.push(`Size '${originalSize}' violates gpt-image-2 constraints, changed to '1024x1024'`);
 						}
 					} else if (!openaiOptions.size) openaiOptions.size = "auto";
 				} else {
@@ -32246,6 +33957,10 @@ var OpenAIImageService = class extends AIImageService {
 				const imageFile = new File([pngBuffer], "image.png", { type: "image/png" });
 				if (isGPTImageModel(options.model)) {
 					const editModel = options.model || ImageModels.GPT_IMAGE_2;
+					this.logger.log("OpenAI image generation request (edit endpoint, image-to-image):", {
+						model: editModel,
+						prompt: truncatePromptForLog(prompt)
+					});
 					result = await openai.images.edit({
 						model: editModel,
 						image: [imageFile],
@@ -32253,20 +33968,31 @@ var OpenAIImageService = class extends AIImageService {
 					});
 				} else {
 					const { style, quality, model, ...opts } = openaiOptions;
+					const variationSize = [
+						"256x256",
+						"512x512",
+						"1024x1024"
+					].find((s) => s === openaiOptions.size);
+					this.logger.log("OpenAI image generation request (variation endpoint):", {
+						...opts,
+						size: variationSize
+					});
 					result = await openai.images.createVariation({
 						...opts,
 						image: imageFile,
-						size: [
-							"256x256",
-							"512x512",
-							"1024x1024"
-						].find((s) => s === openaiOptions.size)
+						size: variationSize
 					});
 				}
-			} else result = await openai.images.generate({
-				prompt,
-				...openaiOptions
-			});
+			} else {
+				this.logger.log("OpenAI image generation request:", {
+					prompt: truncatePromptForLog(prompt),
+					...openaiOptions
+				});
+				result = await openai.images.generate({
+					prompt,
+					...openaiOptions
+				});
+			}
 			images = this.imageResponseToUrl(result);
 			return images;
 		} catch (error) {
@@ -32323,10 +34049,21 @@ var OpenAIImageService = class extends AIImageService {
 				Logger.globalInstance.debug(`[DEBUG] ⚠️ Edit endpoint doesn't support ${model}, defaulting to gpt-image-2`);
 				editModel = ImageModels.GPT_IMAGE_2;
 			}
+			const forwardSize = isSupportedEditSize(editModel, size);
+			this.logger.log("OpenAI image edit request:", {
+				model: editModel,
+				prompt: truncatePromptForLog(prompt),
+				hasMask: !!maskFile,
+				n,
+				size,
+				response_format
+			});
 			const response = await openai.images.edit(isGPTImageModel(editModel) ? {
 				model: editModel,
 				image: [imageFile],
-				prompt
+				prompt,
+				...forwardSize ? { size } : {},
+				...maskFile ? { mask: maskFile } : {}
 			} : {
 				model: editModel,
 				image: imageFile,
@@ -32437,7 +34174,12 @@ var BFLImageService = class extends AIImageService {
 					if (height) requestBody.height = height;
 				}
 				const cleanedBody = this.stripNullFields(requestBody);
-				Logger.globalInstance.debug("[DEBUG] BFL Image generation request body:", cleanedBody);
+				const safeRequestBody = {
+					...cleanedBody,
+					prompt: prompt.length > 100 ? `${prompt.slice(0, 100)}...` : prompt,
+					...cleanedBody.image_prompt ? { image_prompt: `[BASE64_DATA_${cleanedBody.image_prompt.length}_CHARS]` } : {}
+				};
+				Logger.globalInstance.log("BFL Image generation request body:", safeRequestBody);
 				const submitResponse = await axios.post(`${this.baseUrl}/${model}`, cleanedBody, { headers: {
 					accept: "application/json",
 					"x-key": this.apiKey,
@@ -32450,7 +34192,7 @@ var BFLImageService = class extends AIImageService {
 					pollingUrl,
 					responseData: submitResponse.data,
 					endpoint: `${this.baseUrl}/${model}`,
-					requestBody
+					requestBody: safeRequestBody
 				});
 				const imageUrl = await this.pollForResult(requestId, pollingUrl);
 				Logger.globalInstance.debug("[DEBUG] Received BFL image URL:", {
@@ -32859,8 +34601,6 @@ var GeminiImageService = class extends AIImageService {
 		const aspectRatio = this.resolveAspectRatio(options);
 		if (aspectRatio) config.aspectRatio = aspectRatio;
 		if (options.guidance !== null && options.guidance !== void 0) config.guidanceScale = options.guidance;
-		if (options.prompt_upsampling !== void 0) config.enhancePrompt = options.prompt_upsampling;
-		if (options.seed !== null && options.seed !== void 0) config.seed = options.seed;
 		const outputMimeType = this.resolveMimeType(options.output_format);
 		if (outputMimeType) config.outputMimeType = outputMimeType;
 		return config;
@@ -34171,11 +35911,11 @@ const DEFAULT_FALLBACK_CHAIN = [
 */
 function findAutomaticFallback(originalModel, availableModels, apiKeyTable, logger, excludeModelIds, preferUntriedBackend) {
 	logger.info(`🔍 Finding automatic fallback for ${originalModel.id}`);
-	const hasValidKey = (m) => !!apiKeyTable[m.backend] && apiKeyTable[m.backend] !== "expired";
+	const hasValidKey = (m) => !m.disabled && !!apiKeyTable[m.backend] && apiKeyTable[m.backend] !== "expired";
 	const preferences = [...FALLBACK_PREFERENCES[originalModel.id] ?? []];
 	if (preferences.length === 0) preferences.push(...DEFAULT_FALLBACK_CHAIN);
 	if (preferUntriedBackend) {
-		const triedBackends = /* @__PURE__ */ new Set([originalModel.backend]);
+		const triedBackends = new Set(originalModel.backend ? [originalModel.backend] : []);
 		for (const id of excludeModelIds ?? []) {
 			const tried = availableModels.find((m) => m.id === id);
 			if (tried) triedBackends.add(tried.backend);
@@ -34202,7 +35942,7 @@ function findAutomaticFallback(originalModel, availableModels, apiKeyTable, logg
 			return model;
 		}
 	}
-	logger.error("❌ No suitable automatic fallback model found");
+	logger.warn("⚠️ No suitable automatic fallback model found");
 	return null;
 }
 /**
@@ -34272,6 +36012,39 @@ async function getLlmWithFallback(originalModel, fallbackModelId, availableModel
 	return null;
 }
 /**
+* Pick a runnable substitute for a model id that is NOT in `availableModels` at all -
+* a sunset id a catalog lifecycle row has hidden, or one disabled since whatever
+* persisted it (a session pin, a stored mapping row) was written.
+*
+* `getLlmWithFallback` cannot serve this case: its `originalModel` is a `ModelInfo`,
+* which by definition does not exist here. This walks the same
+* `FALLBACK_PREFERENCES` -> `DEFAULT_FALLBACK_CHAIN` -> any-keyed-model selection
+* through the same `findAutomaticFallback`, so the substitute a hidden id lands on
+* cannot diverge from the one a listed-but-failing id would.
+*
+* Callers should run `resolveDeprecatedModelId` first: a sunset id with a known
+* successor should be forwarded to it (and counted as a `[model-sunset]`) rather
+* than treated as a model with no answer.
+*/
+function findFallbackForMissingModel(missingModelId, availableModels, apiKeyTable, logger, endUserId) {
+	const fallbackModel = findAutomaticFallback({ id: missingModelId }, availableModels, apiKeyTable, logger);
+	if (!fallbackModel) return null;
+	const backend = (0, llm_exports.getLlmByModel)(apiKeyTable, {
+		modelInfo: fallbackModel,
+		logger,
+		endUserId
+	});
+	if (!backend) {
+		logger.warn(`⚠️ Fallback for unavailable model ${missingModelId} failed to initialize: ${fallbackModel.id}`);
+		return null;
+	}
+	return {
+		model: fallbackModel,
+		backend,
+		attempt: 1
+	};
+}
+/**
 * Tiktoken-based implementation of the tokenizer interface
 * Provides caching for performance and configurable logging
 *
@@ -34317,6 +36090,21 @@ var TiktokenTokenizer = class {
 		return Array.from(encoder.encode_ordinary(text));
 	}
 	/**
+	* Decode token ids back to text through the same encoder encodeTokens used, so an
+	* encode -> slice -> decode round trip yields real text rather than the ids themselves.
+	* @param tokens - Token ids, typically a slice of an encodeTokens result
+	* @param modelId - Model ID to determine encoding (must match the one used to encode)
+	* @returns Promise<string> - The decoded text
+	*
+	* tiktoken's wasm decode() hands back raw UTF-8 bytes. A slice that ends mid-character therefore
+	* decodes to a trailing U+FFFD; callers that sliced are expected to trim it.
+	*/
+	async decodeTokens(tokens, modelId, logger) {
+		if (this.isShuttingDown) throw new Error("TiktokenTokenizer is shutting down");
+		const encoder = await this.getEncoder(modelId, logger);
+		return new TextDecoder().decode(encoder.decode(new Uint32Array(tokens)));
+	}
+	/**
 	* Returns a lightweight ITokenizer proxy that delegates WASM encoder operations
 	* to this instance (preserving the shared encoder cache) but routes log output
 	* through the provided logger. Useful for attaching per-request context (e.g.
@@ -34325,7 +36113,8 @@ var TiktokenTokenizer = class {
 	withLogger(logger) {
 		return {
 			countTokens: (text, modelId) => this.countTokens(text, modelId, logger),
-			encodeTokens: (text, modelId) => this.encodeTokens(text, modelId, logger)
+			encodeTokens: (text, modelId) => this.encodeTokens(text, modelId, logger),
+			decodeTokens: (tokens, modelId) => this.decodeTokens(tokens, modelId, logger)
 		};
 	}
 	/**
@@ -34785,6 +36574,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	BaseStorage: () => BaseStorage,
 	BedrockEmbeddingService: () => BedrockEmbeddingService,
 	CONTENT_TYPE_BY_FORMAT: () => CONTENT_TYPE_BY_FORMAT,
+	COSINE_SEARCH_TOP_K: () => 10,
 	CacheKeys: () => CacheKeys,
 	ChunkSchema: () => ChunkSchema,
 	CircuitBreaker: () => CircuitBreaker,
@@ -34792,6 +36582,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	ClientMessageSender: () => ClientMessageSender,
 	CorruptedFileError: () => CorruptedFileError,
 	DEFAULT_FALLBACK_CHAIN: () => DEFAULT_FALLBACK_CHAIN,
+	DEFAULT_OUTPUT_MAX_TOKENS: () => DEFAULT_OUTPUT_MAX_TOKENS,
 	DEFAULT_PASSAGE_TOKEN_TARGET: () => 512,
 	EXTRACTION_SYSTEM_RESERVE_MAX_SHARE: () => EXTRACTION_SYSTEM_RESERVE_MAX_SHARE,
 	ElevenLabsMusicGenerator: () => ElevenLabsMusicGenerator,
@@ -34878,7 +36669,9 @@ __reExport(/* @__PURE__ */ __exportAll({
 	checkStorageLimit: () => checkStorageLimit,
 	checkStorageLimitForFile: () => checkStorageLimitForFile,
 	cleanMermaidSyntax: () => cleanMermaidSyntax,
+	computeContentHash: () => computeContentHash,
 	computeCosineSimilarity: () => computeCosineSimilarity,
+	computeVerbatimTokenBudget: () => computeVerbatimTokenBudget,
 	convertCodeBlocksToArtifacts: () => convertCodeBlocksToArtifacts,
 	createQuestPlanToolSchema: () => createQuestPlanToolSchema,
 	createTokenizer: () => createTokenizer,
@@ -34894,6 +36687,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	fetchAndParseURL: () => fetchAndParseURL,
 	fetchAndProcessPreviousMessages: () => fetchAndProcessPreviousMessages,
 	filterRetrievalExcluded: () => filterRetrievalExcluded,
+	findFallbackForMissingModel: () => findFallbackForMissingModel,
 	formatVoiceHistory: () => formatVoiceHistory,
 	generateSafeEmbedding: () => generateSafeEmbedding,
 	getCachedSignedUrl: () => getCachedSignedUrl,
@@ -34947,6 +36741,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	registerLambdaErrorHandlers: () => registerLambdaErrorHandlers,
 	registerProcessErrorHandlers: () => registerProcessErrorHandlers,
 	registrableDomain: () => registrableDomain,
+	reservationOutputTokens: () => reservationOutputTokens,
 	resolveEmbeddingConfig: () => resolveEmbeddingConfig,
 	resolveSupportedMimeType: () => resolveSupportedMimeType,
 	safeInputWindow: () => safeInputWindow,