@bike4mind/cli 0.20.2 → 0.21.0

package/dist/{AgentHistoryStore-T7Oh84Yn.mjs → AgentHistoryStore-ucv6xXVT.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as VoyageAIEmbeddingModel, A as HTTPError, At as resolveHistoryFetchLimit, B as PermissionDeniedError, Bt as isNearLimit, Ct as isRetryableError, D as FIXED_TEMPERATURE_MODELS, Dt as isZodError, E as FIELD_GROUP_OF, Et as isUserInitiatedAbort, F as ModelBackend, Ft as usdToCredits, G as SpeechToTextModels, H as REASONING_SUPPORTED_MODELS, I as NO_TEMPERATURE_MODELS, It as usdToCreditsStochastic, J as TooManyRequestsError, K as SupportedFabFileMimeTypes, L as NotFoundError, Lt as withRetry, M as ImageModels, Mt as settingsMap, N as InternalServerError, Nt as toModelInfo, O as FORMAT_PROMPT_TEMPLATE, Ot as mapMimeTypeToArtifactType, P as MODEL_INFO_FIELD_GROUP_OF, Pt as toModelRecord, Q as VideoModels, R as OllamaEmbeddingModel, Rt as buildRateLimitLogEntry, S as CorruptedFileError, St as isRenderableModelType, Tt as isUnlimitedHistory, U as REFUSAL_FALLBACK_MODELS, V as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Vt as parseRateLimitHeaders, W as RESPONSES_API_TOOL_MODELS, X as UnprocessableEntityError, Y as UnauthorizedError, Z as VIDEO_SIZE_CONSTRAINTS, _ as BadRequestError, _t as isImageServeable, at as getMcpProviderMetadata, bt as isModelDeprecated, ct as isAudioMimeType, et as WORK_ITEM_STATUSES, ft as isFieldGroup, g as BFL_SAFETY_TOLERANCE, gt as isImageAttachment, h as BEDROCK_NO_PROMPT_CACHING_MODELS, ht as isGeminiModelId, it as defaultEmbeddingModelForEnv, j as HttpStatus, jt as secureParameters, k as ForbiddenError, kt as obfuscateApiKey, lt as isChunkRebuildPending, m as ApiKeyType, mt as isGPTImageModel, n as logger, nt as calculateRetryDelay, ot as getQuestErrorCode, p as ARTIFACT_ATTRS_PATTERN, pt as isGPTImage2Model, q as TTS_MAX_INPUT_CHARS, rt as dayjsConfig_default, st as getRetryAfterMs, tt as applyModelPriceCatalog, ut as isConvergencePausedNote, v as BedrockEmbeddingModel, vt as isMediaModelType, w as DEFAULT_UNKNOWN_CONTEXT_WINDOW, wt as isSupportedFabFileMimeType, x as ChatModels, xt as isPlaceholderApiKey, y as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, yt as isModelAccessible, z as OpenAIEmbeddingModel, zt as extractSnippetMeta } from "./ConfigStore-cIyF7hDg.mjs";
+import { $ as SupportedFabFileMimeTypes, $t as buildRateLimitLogEntry, A as HTTPError, At as isRenderableModelType, B as OPENAI_GPT_IMAGE_1_IMAGE_SIZES, Bt as resolveHistoryFetchLimit, Ct as isGeminiModelId, D as FIXED_TEMPERATURE_MODELS, Dt as isModelAccessible, E as FIELD_GROUP_OF, Et as isMediaModelType, F as MODEL_INFO_FIELD_GROUP_OF, Ft as isZodError, G as PermissionDeniedError, Gt as usdToCredits, H as OllamaEmbeddingModel, Ht as settingsMap, I as McpServerName, It as mapMimeTypeToArtifactType, J as REFUSAL_FALLBACK_MODELS, K as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Kt as usdToCreditsStochastic, L as ModelBackend, Lt as obfuscateApiKey, M as IMAGE_SIZE_CONSTRAINTS, Mt as isSupportedFabFileMimeType, N as ImageModels, Nt as isUnlimitedHistory, O as FORMAT_PROMPT_TEMPLATE, Ot as isModelDeprecated, P as InternalServerError, Pt as isUserInitiatedAbort, Q as SpeechToTextModels, R as NO_TEMPERATURE_MODELS, Rt as parseEmbeddingRateLimitHeaders, S as CorruptedFileError, St as isGPTImageModel, Tt as isImageServeable, U as OpenAIEmbeddingModel, Ut as toModelInfo, V as OPENAI_GPT_IMAGE_2_IMAGE_SIZES, Vt as secureParameters, Wt as toModelRecord, Y as RESPONSES_API_TOOL_MODELS, _ as BadRequestError, _t as isChunkRebuildPending, at as VideoModels, bt as isFieldGroup, ct as applyModelPriceCatalog, dt as defaultEmbeddingModelForEnv, en as extractSnippetMeta, et as TTS_MAX_INPUT_CHARS, ft as getMcpProviderMetadata, g as BFL_SAFETY_TOLERANCE, gt as isAudioMimeType, h as BEDROCK_NO_PROMPT_CACHING_MODELS, ht as hasUsableLimits, it as VIDEO_SIZE_CONSTRAINTS, j as HttpStatus, jt as isRetryableError, k as ForbiddenError, kt as isPlaceholderApiKey, lt as calculateRetryDelay, m as ApiKeyType, mt as getRetryAfterMs, n as logger, nn as parseRateLimitHeaders, nt as UnauthorizedError, ot as VoyageAIEmbeddingModel, p as ARTIFACT_ATTRS_PATTERN, pt as getQuestErrorCode, q as REASONING_SUPPORTED_MODELS, qt as withRetry, rt as UnprocessableEntityError, st as WORK_ITEM_STATUSES, tn as isNearLimit, tt as TooManyRequestsError, ut as dayjsConfig_default, v as BedrockEmbeddingModel, vt as isChunkStalledFile, w as DEFAULT_UNKNOWN_CONTEXT_WINDOW, wt as isImageAttachment, x as ChatModels, xt as isGPTImage2Model, y as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, z as NotFoundError, zt as reservationOutputTokens } from "./ConfigStore-CoY0l0gr.mjs";
 import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
 import { n as isTerminalShellStatus, t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
@@ -52,9 +52,9 @@ import mongoose from "mongoose";
 import { parse } from "shell-quote";
 import { homedir as homedir$1 } from "node:os";
 import { EventEmitter } from "events";
+import { CloudWatchClient, PutMetricDataCommand, StandardUnit } from "@aws-sdk/client-cloudwatch";
 import { fileURLToPath } from "url";
 import { Anthropic, RateLimitError } from "@anthropic-ai/sdk";
-import { CloudWatchClient, PutMetricDataCommand, StandardUnit } from "@aws-sdk/client-cloudwatch";
 import { GoogleGenAI } from "@google/genai";
 import pick from "lodash/pick.js";
 import { Stream } from "openai/streaming";
@@ -66,6 +66,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { getDomain } from "tldts";
 import * as dotenv from "dotenv";
+import { createHash as createHash$1 } from "node:crypto";
 import invert from "lodash/invert.js";
 import * as util from "node:util";
 import * as zlib from "node:zlib";
@@ -1836,7 +1837,27 @@ const webFetchTool = {
 	})
 };
 //#endregion
-//#region ../../b4m-core/services/dist/websearch-DpUKKZyj.mjs
+//#region ../../b4m-core/services/dist/websearch-BLmQCbHG.mjs
+/**
+* The coarse recency bucket both providers speak, as the smallest one containing `recencyDays`.
+* Null when there is no constraint, or when the window is wider than the widest bucket - a
+* "within 10 years" filter is not a filter, and sending one would exclude undated pages for nothing.
+*/
+function recencyBucket(recencyDays) {
+	if (typeof recencyDays !== "number" || !Number.isFinite(recencyDays) || recencyDays <= 0) return null;
+	if (recencyDays <= 1) return "day";
+	if (recencyDays <= 7) return "week";
+	if (recencyDays <= 31) return "month";
+	if (recencyDays <= 366) return "year";
+	return null;
+}
+/** SerpAPI spells the buckets `qdr:d|w|m|y` on the `tbs` parameter. */
+const SERPAPI_QDR = {
+	day: "qdr:d",
+	week: "qdr:w",
+	month: "qdr:m",
+	year: "qdr:y"
+};
 const DEFAULT_NUM_RESULTS = 3;
 const SEARCH_TIMEOUT_MS = 6e4;
 /**
@@ -1845,14 +1866,14 @@ const SEARCH_TIMEOUT_MS = 6e4;
 * on a non-OK response so the tool surfaces the failure. Exported (re-exported from index) for the
 * REST endpoint and existing tests.
 */
-async function serpApiSearch(adapters, query, num_results) {
+async function serpApiSearch(adapters, query, num_results, options) {
 	const apiKey = await (0, apiKeyService_exports.getSerperKey)(adapters);
 	const url = new URL("https://serpapi.com/search");
 	if (!apiKey) {
 		Logger.globalInstance.error("❌ WebSearch Tool: No API key configured. Skipping search.");
 		return { organic_results: [] };
 	}
-	url.search = new URLSearchParams({
+	const searchParams = new URLSearchParams({
 		engine: "google",
 		api_key: apiKey,
 		q: query,
@@ -1861,7 +1882,10 @@ async function serpApiSearch(adapters, query, num_results) {
 		gl: "us",
 		hl: "en",
 		num: (num_results || DEFAULT_NUM_RESULTS).toString()
-	}).toString();
+	});
+	const bucket = recencyBucket(options?.recencyDays);
+	if (bucket) searchParams.set("tbs", SERPAPI_QDR[bucket]);
+	url.search = searchParams.toString();
 	const controller = new AbortController();
 	const timeoutId = setTimeout(() => controller.abort(), SEARCH_TIMEOUT_MS);
 	let response;
@@ -1889,8 +1913,8 @@ async function serpApiSearch(adapters, query, num_results) {
 function createSerpApiProvider(adapters) {
 	return {
 		name: "serpapi",
-		async search(query, numResults) {
-			const data = await serpApiSearch(adapters, query, numResults);
+		async search(query, numResults, options) {
+			const data = await serpApiSearch(adapters, query, numResults, options);
 			return (Array.isArray(data.organic_results) ? data.organic_results : []).filter((r) => !!r && typeof r.link === "string").map((r) => ({
 				title: r.title ?? r.link,
 				url: r.link,
@@ -1929,16 +1953,19 @@ function parseSearxngResults(data, numResults) {
 function createSearxngProvider(baseUrl) {
 	return {
 		name: "searxng",
-		async search(query, numResults) {
+		async search(query, numResults, options) {
 			const limit = numResults && numResults > 0 ? numResults : DEFAULT_NUM_RESULTS;
 			const trimmed = baseUrl.replace(/\/+$/, "");
 			const url = new URL(`${trimmed}/search`);
-			url.search = new URLSearchParams({
+			const params = new URLSearchParams({
 				q: query,
 				format: "json",
 				language: "en",
 				safesearch: "1"
-			}).toString();
+			});
+			const bucket = recencyBucket(options?.recencyDays);
+			if (bucket) params.set("time_range", bucket);
+			url.search = params.toString();
 			const controller = new AbortController();
 			const timeoutId = setTimeout(() => controller.abort(), SEARCH_TIMEOUT_MS);
 			try {
@@ -2061,7 +2088,7 @@ const webSearchTool = {
 	})
 };
 //#endregion
-//#region ../../b4m-core/services/dist/toolGenerators-D3QFkvc-.mjs
+//#region ../../b4m-core/services/dist/toolGenerators-hk-Robqc.mjs
 const diceRoll = async (parameters) => {
 	if (!parameters?.sides || !parameters?.times) throw new Error("Tool dice roll: Missing required parameters");
 	return sum(times(parameters.times, () => random(1, parameters.sides))).toString();
@@ -2748,7 +2775,7 @@ const askUserQuestionTool = {
 * re-export them without pulling the full tool graph. `index.ts` re-exports them
 * so the server barrel's public API is unchanged.
 */
-const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
+const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionPreauthorizedLakeIds, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
 	const context = {
 		userId,
 		user,
@@ -2772,6 +2799,7 @@ const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inl
 		fullyInlinedAttachmentIds,
 		suppressLakeArms,
 		sessionRetrievalTags,
+		sessionPreauthorizedLakeIds,
 		codeMinifier,
 		availableModels,
 		onToolLlmUsage,
@@ -4242,7 +4270,7 @@ const latticeAddEntityTool = {
 			};
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					const existingIndex = model.data.entities.findIndex((e) => e.id === entityId);
 					if (existingIndex >= 0) model.data.entities[existingIndex] = entityData;
 					else model.data.entities.push(entityData);
@@ -4252,7 +4280,23 @@ const latticeAddEntityTool = {
 						updatedAt: /* @__PURE__ */ new Date()
 					});
 					context.logger.info(`[Lattice] Added entity ${entityId} to model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "ADD_ENTITY",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "ADD_ENTITY",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist entity to database:`, error);
 			}
@@ -4370,7 +4414,7 @@ const latticeSetValueTool = {
 			const entityId = entityName.toLowerCase().replace(/\s+/g, "_");
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					const entity = model.data.entities.find((e) => e.id === entityId || e.name === entityName);
 					if (entity) {
 						const attrIndex = entity.attributes.findIndex((a) => a.key === attributeKey);
@@ -4390,7 +4434,23 @@ const latticeSetValueTool = {
 						});
 						context.logger.info(`[Lattice] Set ${entityId}.${attributeKey} = ${value} in model ${modelId}`);
 					} else context.logger.warn(`[Lattice] Entity ${entityName} not found in model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "SET_VALUE",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "SET_VALUE",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist value to database:`, error);
 			}
@@ -4489,7 +4549,7 @@ const latticeCreateRuleTool = {
 			let entityCreatedMessage = "";
 			if (context.db.latticeModels && modelId && /^[a-f0-9]{24}$/.test(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
-				if (model) {
+				if (model && model.userId === context.userId) {
 					if (!model.data.entities.some((e) => e.id === outputEntityId || e.name.toLowerCase() === parsedRule.outputEntity.toLowerCase()) && parsedRule.outputEntity !== "unknown") {
 						const now = /* @__PURE__ */ new Date();
 						const newEntity = {
@@ -4526,7 +4586,23 @@ const latticeCreateRuleTool = {
 						updatedAt: /* @__PURE__ */ new Date()
 					});
 					context.logger.info(`[Lattice] Created rule ${ruleId} in model ${modelId}`);
-				} else context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+				} else if (model) {
+					context.logger.warn(`[Lattice] Access denied: caller does not own model ${modelId}`);
+					return JSON.stringify({
+						success: false,
+						action: "CREATE_RULE",
+						modelId,
+						error: `Access denied: you do not have permission to modify model ${modelId}`
+					});
+				} else {
+					context.logger.warn(`[Lattice] Model ${modelId} not found in database`);
+					return JSON.stringify({
+						success: false,
+						action: "CREATE_RULE",
+						modelId,
+						error: `Model ${modelId} not found`
+					});
+				}
 			} catch (error) {
 				context.logger.error(`[Lattice] Failed to persist rule to database:`, error);
 			}
@@ -6413,6 +6489,130 @@ var EmbeddingAuthError = class extends Error {
 		this.provider = provider;
 	}
 };
+/**
+* Passive reporting of embedding-provider rate-limit ceilings.
+*
+* A rate limit belongs to the provider organization behind the key, and every embedding response
+* already carries the ceiling in its headers, so reading them costs no extra request and no extra
+* tokens. Providers that do not report them (Bedrock, Ollama) simply never produce an observation.
+*
+* This module owns the "what did the provider say" half only. It has no opinion about data lakes
+* or about the throughput levers configured against these numbers; interpreting a ceiling against
+* a lever belongs to the layer that knows what the levers are.
+*/
+/**
+* Remaining/limit ratio at or below which the provider counts as under pressure. A bulk re-index
+* draws its window down steadily, so this sits low enough that ordinary throughput does not trip
+* it and only genuine starvation does.
+*/
+const PRESSURE_RATIO = .1;
+/**
+* Pressure lasts as long as the window does, and every call in that window reports it. Throttle to
+* one line per interval so a starved ingest leaves a readable trace instead of flooding the log.
+*/
+const PRESSURE_LOG_INTERVAL_MS = 6e4;
+/**
+* Process-local, and deliberately so: a cold start re-reports what it measures rather than leaving
+* a gap shared storage would have to close. Keyed by provider+model+account, so the map is bounded
+* by the model list times the number of distinct credentials the process serves.
+*/
+const stateByKey = /* @__PURE__ */ new Map();
+/**
+* A broken reporter is indistinguishable from a steady ceiling - both are silence - so the first
+* fault has to be loud. Subsequent ones drop to debug: whatever breaks here breaks on every
+* embedding call, and a bulk re-index would drown the log in it.
+*/
+let hasReportedFailure = false;
+const keyFor = (provider, model, account) => `${provider}:${model}:${account}`;
+const ceilingChanged = (previous, next) => previous.limitTokens !== next.limitTokens || previous.limitRequests !== next.limitRequests;
+const describeCeiling = (snapshot) => `${snapshot.limitTokens ?? "unreported"} tokens/min, ${snapshot.limitRequests ?? "unreported"} requests/min`;
+/** Ratio of the window still available, or null when the provider did not report that dimension. */
+const remainingRatio = (remaining, limit) => {
+	if (remaining === null || limit === null || limit <= 0) return null;
+	return remaining / limit;
+};
+const pressuredDimensions = (snapshot) => {
+	const tokens = remainingRatio(snapshot.remainingTokens, snapshot.limitTokens);
+	const requests = remainingRatio(snapshot.remainingRequests, snapshot.limitRequests);
+	const dimensions = [];
+	if (tokens !== null && tokens <= PRESSURE_RATIO) dimensions.push("tokens");
+	if (requests !== null && requests <= PRESSURE_RATIO) dimensions.push("requests");
+	return dimensions;
+};
+/**
+* Read the rate-limit headers off an embedding response and report the ceiling when it is worth
+* reporting: the first sighting in this process, a change since the last sighting, or the window
+* running down. Returns the observation when the provider reported a usable ceiling, else null.
+*
+* `account` identifies the provider account the reading belongs to and is part of the memo key,
+* not just the log line. The credential is resolved per user - a stored personal key beats the
+* platform key in `getEffectiveLLMApiKeys` - so one process can see several accounts on the same
+* provider+model. Without the discriminator their readings would collapse into one entry that
+* flaps between unrelated ceilings and attributes each figure to whoever reads the log next. The
+* caller supplies it; it must never be key material.
+*
+* Never throws. This hangs off the hot path of every embedding call, and a reporting fault must
+* not be able to fail an embedding that otherwise succeeded.
+*/
+function recordEmbeddingRateLimitHeaders(provider, model, account, headers, now = Date.now()) {
+	try {
+		const snapshot = parseEmbeddingRateLimitHeaders(headers);
+		if (!hasUsableLimits(snapshot)) return null;
+		const key = keyFor(provider, model, account);
+		const previous = stateByKey.get(key);
+		const observation = {
+			provider,
+			model,
+			account,
+			snapshot,
+			observedAt: now
+		};
+		const subject = `${provider} ${model} (account ${account})`;
+		if (!previous) Logger.globalInstance.info(`[embedding-limits] ${subject} ceiling measured: ${describeCeiling(snapshot)}`, {
+			provider,
+			model,
+			account,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests
+		});
+		else if (ceilingChanged(previous.last.snapshot, snapshot)) Logger.globalInstance.warn(`[embedding-limits] ${subject} ceiling CHANGED: was ${describeCeiling(previous.last.snapshot)}, now ${describeCeiling(snapshot)}. Reconcile any throughput lever governed by this account against the new figure.`, {
+			provider,
+			model,
+			account,
+			previousLimitTokens: previous.last.snapshot.limitTokens,
+			previousLimitRequests: previous.last.snapshot.limitRequests,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests
+		});
+		const pressured = pressuredDimensions(snapshot);
+		const dueForPressureLog = previous?.lastPressureLogAt == null || now - previous.lastPressureLogAt >= PRESSURE_LOG_INTERVAL_MS;
+		const logPressure = pressured.length > 0 && dueForPressureLog;
+		if (logPressure) Logger.globalInstance.warn(`[embedding-limits] ${subject} is at or below ${PRESSURE_RATIO * 100}% of its ${pressured.join(" and ")} window`, {
+			provider,
+			model,
+			account,
+			remainingTokens: snapshot.remainingTokens,
+			remainingRequests: snapshot.remainingRequests,
+			limitTokens: snapshot.limitTokens,
+			limitRequests: snapshot.limitRequests,
+			resetTokensMs: snapshot.resetTokensMs,
+			resetRequestsMs: snapshot.resetRequestsMs
+		});
+		stateByKey.set(key, {
+			last: observation,
+			lastPressureLogAt: logPressure ? now : previous?.lastPressureLogAt ?? null
+		});
+		return observation;
+	} catch (error) {
+		const message = `[embedding-limits] failed to record rate-limit headers: ${error}`;
+		if (hasReportedFailure) Logger.globalInstance.debug(message);
+		else {
+			hasReportedFailure = true;
+			Logger.globalInstance.warn(message);
+		}
+		return null;
+	}
+}
 const OPENAI_EMBEDDING_MODEL_MAP = {
 	[OpenAIEmbeddingModel.TEXT_EMBEDDING_3_SMALL]: {
 		provider: "OpenAI",
@@ -6433,34 +6633,72 @@ const OPENAI_EMBEDDING_MODEL_MAP = {
 		dimensions: [1536]
 	}
 };
-var OpenAIEmbeddingService = class OpenAIEmbeddingService {
+/**
+* Non-reversible stand-in for a credential, for use where two accounts have to be told apart in a
+* log. Same construction as the API-key logging hash in the request middleware. Never emit the key.
+*/
+const fingerprintCredential = (apiKey) => `key:${createHash("sha256").update(apiKey).digest("hex").slice(0, 16)}`;
+/**
+* Total by construction. The only caller runs inside processSingleBatch's classifying try, where a
+* throw would be misread as a provider error and re-issue the batch.
+*/
+const headerOrNull = (httpResponse, name) => {
+	try {
+		return httpResponse.headers?.get(name) ?? null;
+	} catch {
+		return null;
+	}
+};
+/**
+* The ceilings `generateEmbeddingBatch` splits on, at module scope and exported because a cost
+* PREFLIGHT has to model the same split before it spends (packages/scripts/retrieval/capturePlan.ts).
+* A second copy of these numbers in a script cannot track a provider change.
+*/
+const OPENAI_MAX_INPUTS_PER_REQUEST = 2048;
+const OPENAI_MAX_TOKENS_PER_INPUT = 8192;
+/**
+* Effective token limit with a 10% safety buffer.
+* The tiktoken fallback (text.length/3) deliberately overestimates to be safe,
+* but DB token counts may have been produced by a different tokenizer (Bedrock, Voyage)
+* that underestimates. The buffer keeps us clear of the hard limit under tokenizer variance.
+*/
+const OPENAI_EFFECTIVE_TOKEN_LIMIT = Math.floor(27e4);
+var OpenAIEmbeddingService = class {
 	client;
 	model;
-	/** Hard limit imposed by OpenAI's embeddings API. */
-	static MAX_TOKENS_PER_REQUEST = 3e5;
-	/**
-	* Effective token limit with a 10% safety buffer.
-	* The tiktoken fallback (text.length/3) deliberately overestimates to be safe,
-	* but DB token counts may have been produced by a different tokenizer (Bedrock, Voyage)
-	* that underestimates. The buffer keeps us clear of the hard limit under tokenizer variance.
-	*/
-	static EFFECTIVE_TOKEN_LIMIT = Math.floor(OpenAIEmbeddingService.MAX_TOKENS_PER_REQUEST * .9);
+	credentialFingerprint;
 	constructor(apiKey, model = OpenAIEmbeddingModel.TEXT_EMBEDDING_ADA_002) {
 		this.client = new OpenAI({ apiKey });
 		this.validateModel(model);
 		this.model = model;
+		this.credentialFingerprint = fingerprintCredential(apiKey);
+	}
+	/**
+	* Report the provider ceiling carried on a response we already received. Covers ingest and
+	* query alike: both reach OpenAI through this class, so neither needs its own sampling point.
+	*
+	* The ceiling belongs to the organization behind the key, and the key is resolved per user
+	* (getEffectiveLLMApiKeys prefers a stored personal key over the platform one), so the reading
+	* has to say whose it is. `openai-organization` is the provider's own answer to that; the
+	* credential fingerprint covers the case where the response omits it, and still keeps two
+	* distinct keys as two readings rather than one that flaps between them.
+	*/
+	recordRateLimit(httpResponse) {
+		const account = headerOrNull(httpResponse, "openai-organization") || this.credentialFingerprint;
+		recordEmbeddingRateLimitHeaders("OpenAI", this.model, account, httpResponse.headers);
 	}
 	validateModel(model) {
 		if (!OPENAI_EMBEDDING_MODEL_MAP[model]) throw new Error(`Invalid OpenAI embedding model: ${model}`);
 	}
 	async generateEmbedding(text) {
-		const response = await this.client.embeddings.create({
+		const { data: body, response: httpResponse } = await this.client.embeddings.create({
 			model: this.model,
 			input: text
-		}).catch((error) => {
+		}).withResponse().catch((error) => {
 			throw this.toActionableAuthError(error);
 		});
-		if (response.data && response.data.length > 0) return response.data[0].embedding;
+		this.recordRateLimit(httpResponse);
+		if (body.data && body.data.length > 0) return body.data[0].embedding;
 		throw new Error("No embedding data received from OpenAI");
 	}
 	/**
@@ -6491,8 +6729,6 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 	*/
 	async generateEmbeddingBatch(texts, tokenCounts) {
 		if (texts.length === 0) return [];
-		const MAX_INPUTS_PER_REQUEST = 2048;
-		const MAX_TOKENS_PER_INPUT = 8192;
 		let tokens;
 		let needsRecalculation = false;
 		if (!tokenCounts || tokenCounts.length !== texts.length) needsRecalculation = true;
@@ -6507,12 +6743,12 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 		let totalTokens = 0;
 		for (let i = 0; i < texts.length; i++) {
 			const tokenCount = tokens[i];
-			if (tokenCount > MAX_TOKENS_PER_INPUT) throw new Error(`Input at index ${i} exceeds ${MAX_TOKENS_PER_INPUT} token limit (${tokenCount} tokens)`);
+			if (tokenCount > 8192) throw new Error(`Input at index ${i} exceeds ${OPENAI_MAX_TOKENS_PER_INPUT} token limit (${tokenCount} tokens)`);
 			totalTokens += tokenCount;
 		}
 		Logger.globalInstance.debug(`[OpenAI] Batch embedding: ${texts.length} inputs, ${totalTokens} total tokens`);
-		const batches = this.createBatches(texts, tokens, MAX_INPUTS_PER_REQUEST, OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT);
-		Logger.globalInstance.debug(`[OpenAI] Split into ${batches.length} batch(es) (effective limit: ${OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT} tokens)`);
+		const batches = this.createBatches(texts, tokens, OPENAI_MAX_INPUTS_PER_REQUEST, OPENAI_EFFECTIVE_TOKEN_LIMIT);
+		Logger.globalInstance.debug(`[OpenAI] Split into ${batches.length} batch(es) (effective limit: ${OPENAI_EFFECTIVE_TOKEN_LIMIT} tokens)`);
 		if (batches.length === 1) return await this.processSingleBatch(batches[0].texts);
 		const allEmbeddings = new Array(texts.length);
 		for (const batch of batches) (await this.processSingleBatch(batch.texts)).forEach((embedding, batchIndex) => {
@@ -6578,8 +6814,8 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 	async processSingleBatch(texts, preCalculatedTokens) {
 		const tokenCounts = preCalculatedTokens || await this.calculateTokenCounts(texts);
 		const batchTokens = tokenCounts.reduce((sum, count) => sum + count, 0);
-		if (batchTokens > OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT) {
-			Logger.globalInstance.warn(`[OpenAI] Batch exceeds effective token limit (${batchTokens}/${OpenAIEmbeddingService.EFFECTIVE_TOKEN_LIMIT} tokens), splitting recursively`);
+		if (batchTokens > 27e4) {
+			Logger.globalInstance.warn(`[OpenAI] Batch exceeds effective token limit (${batchTokens}/${OPENAI_EFFECTIVE_TOKEN_LIMIT} tokens), splitting recursively`);
 			const mid = Math.ceil(texts.length / 2);
 			const firstHalf = texts.slice(0, mid);
 			const secondHalf = texts.slice(mid);
@@ -6588,13 +6824,14 @@ var OpenAIEmbeddingService = class OpenAIEmbeddingService {
 			const [firstEmbeddings, secondEmbeddings] = await Promise.all([this.processSingleBatch(firstHalf, firstTokens), this.processSingleBatch(secondHalf, secondTokens)]);
 			return [...firstEmbeddings, ...secondEmbeddings];
 		}
-		for (let i = 0; i < tokenCounts.length; i++) if (tokenCounts[i] > 8192) throw new Error(`Text at index ${i} exceeds OpenAI's 8192 token limit per input (${tokenCounts[i]} tokens). This indicates a data integrity issue - chunk should have been smaller. This chunk cannot be processed and the entire batch must fail.`);
+		for (let i = 0; i < tokenCounts.length; i++) if (tokenCounts[i] > 8192) throw new Error(`Text at index ${i} exceeds OpenAI's ${OPENAI_MAX_TOKENS_PER_INPUT} token limit per input (${tokenCounts[i]} tokens). This indicates a data integrity issue - chunk should have been smaller. This chunk cannot be processed and the entire batch must fail.`);
 		try {
-			const response = await this.client.embeddings.create({
+			const { data: body, response: httpResponse } = await this.client.embeddings.create({
 				model: this.model,
 				input: texts
-			});
-			if (response.data && response.data.length > 0) return response.data.sort((a, b) => a.index - b.index).map((item) => item.embedding);
+			}).withResponse();
+			this.recordRateLimit(httpResponse);
+			if (body.data && body.data.length > 0) return body.data.sort((a, b) => a.index - b.index).map((item) => item.embedding);
 			else throw new Error("No embedding data received from OpenAI");
 		} catch (error) {
 			if (error instanceof OpenAI.AuthenticationError) throw this.toActionableAuthError(error);
@@ -8116,6 +8353,50 @@ async function fetchWithoutRedirects(url, timeoutMs) {
 		validateStatus: (status) => status >= 200 && status < 300 || status >= 300 && status < 400
 	});
 }
+const BLOCK_LEVEL_SELECTOR = `*:not(${"a, span, em, strong, b, i, u, code, kbd, samp, var, sub, sup, small, abbr, cite, q, time, mark, s, del, ins, bdi, bdo, wbr, ruby, rt, rp".split(", ").join("):not(")}):not(td):not(th)`;
+/**
+* Extract readable text from the WHOLE document, not just `<p>` elements. The single collector
+* this replaced was `<p>`-only and fell back to the raw HTML when it found none: on a page whose
+* content isn't inside `<p>` (an RFC page using `<pre>`) that meant the fallback fired and stored
+* markup verbatim; on a page with real substance in headings, list items, table cells or code
+* blocks alongside its `<p>`s, that content was silently dropped.
+*
+* `head` (title/meta/script/style all live there, and the caller already reads `<title>`
+* separately) plus any stray `script`/`style`/`noscript` outside it are removed before extraction,
+* so none of that reaches what gets embedded. `<pre>` content is pulled out and stashed BEFORE the
+* rest of the document is collapsed, and spliced back in verbatim afterward - it needs to skip the
+* whitespace-collapse below (a code block's leading-space indentation is meaningful, unlike prose
+* whitespace) but still needs to land in the right place relative to everything else. Table cells
+* get a trailing space (still the same row, but no longer jammed into the next cell's word); every
+* other block-level element gets a trailing newline; runs of whitespace and blank lines are then
+* collapsed. Returns `''` when nothing extractable was found, so the caller stores nothing rather
+* than falling back to raw HTML.
+*/
+function extractReadableText($) {
+	$("head, script, style, noscript").remove();
+	$("br").replaceWith("\n");
+	const nonce = Math.random().toString(36).slice(2) + Date.now().toString(36);
+	const markerFor = (index) => `\uE000PRE${nonce}_${index}\uE000`;
+	const markerPattern = new RegExp(`\\uE000PRE${nonce}_(\\d+)\\uE000`, "g");
+	const preBlocks = [];
+	$("pre").each((_index, element) => {
+		const text = $(element).text();
+		if (text) {
+			preBlocks.push(text);
+			$(element).replaceWith(`${markerFor(preBlocks.length - 1)}\n`);
+		} else $(element).remove();
+	});
+	$("td, th").each((_index, cell) => {
+		$(cell).after(" ");
+	});
+	$(BLOCK_LEVEL_SELECTOR).each((_index, element) => {
+		$(element).after("\n");
+	});
+	return $.root().text().split("\n").map((line) => line.replace(/[ \t]+/g, " ").trim()).filter(Boolean).join("\n").replace(markerPattern, (match, indexStr) => {
+		const index = Number(indexStr);
+		return index >= 0 && index < preBlocks.length ? preBlocks[index] : match;
+	});
+}
 async function fetchAndParseURL(url, { logger }) {
 	logger.updateMetadata({ failedUrl: null });
 	try {
@@ -8149,16 +8430,13 @@ async function fetchAndParseURL(url, { logger }) {
 			const htmlContent = body.toString("utf8");
 			const $ = cheerio.load(htmlContent);
 			title = $("title").text() || lastPathSegment(currentUrl);
-			let textContent = "";
-			$("body").find("p").each((index, element) => {
-				textContent += $(element).text() + "\n";
-			});
-			urlContent = textContent || htmlContent;
+			urlContent = extractReadableText($);
 		}
 		const original = redactUrlCredentials(url);
 		const final = redactUrlCredentials(currentUrl);
 		const fetched = original === final ? original : `${original} -> ${final}`;
-		logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${fetched}`);
+		if (urlContent === "") logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${fetched}, but no extractable text was found`);
+		else logger.log(`Fetched ${title} with mimetype ${urlMimeType} and parsed ${fetched}`);
 		return {
 			title,
 			textContent: urlContent,
@@ -12901,10 +13179,117 @@ const vm = require('node:vm');
 const STDOUT_HEAD_BYTES = ${5e3};
 const STDOUT_TAIL_BYTES = ${2e3};
 const HARD_PER_LINE_BYTES = ${5e4};
+const MIRROR_TAIL_FLUSH_MS = ${100};
 
 let stdoutChunks = [];
-let stdoutBytes = 0;
 let truncated = false;
+// --- Mirror state --------------------------------------------------------
+// Mirrors this run's stdout to the main thread as it is produced, in the same
+// head + marker + tail shape collectStdout() produces, so a retired run and a
+// completed one report the same thing by the same rule.
+//
+// The two halves are cost-bounded differently. The head is mirrored line by
+// line, so a chatty loop stops paying per line once the head is full. Past
+// that the tail is kept locally in a rolling window and posted on a timer, so
+// the message rate stops tracking the line rate entirely.
+let currentRunId = null;
+let mirroredHeadBytes = 0;
+let headMirrorFull = false;
+let tailChunks = [];
+let tailBytes = 0;
+let elidedBytes = 0;
+let tailFlushTimer = null;
+
+/**
+ * What the rolling tail may hold: whatever the head did not use of the same
+ * HEAD + TAIL total collectStdout() reports within. A fixed TAIL budget made
+ * the two disagree whenever the head came up short - a single 6KB first line
+ * does not fit the head, so the mirror would have kept 2KB of a run that
+ * collectStdout() reports whole, and called it truncated. mirroredHeadBytes
+ * is frozen once the head is full, so this is stable for the rest of the run.
+ */
+function tailBudget() {
+  return STDOUT_HEAD_BYTES + STDOUT_TAIL_BYTES - mirroredHeadBytes;
+}
+
+function postToMain(msg) {
+  try { parentPort.postMessage(msg); } catch { /* worker being torn down; nothing to preserve */ }
+}
+function cancelTailFlush() {
+  if (tailFlushTimer === null) return;
+  clearTimeout(tailFlushTimer);
+  tailFlushTimer = null;
+}
+function flushTail() {
+  if (currentRunId === null || !headMirrorFull) return;
+  const joined = tailChunks.join('\n');
+  // The rolling window is trimmed line by line, so it can only exceed the
+  // budget by holding ONE line longer than the whole budget. Slice to the
+  // same last-N-chars rule collectStdout() uses, which both matches that
+  // path and keeps the flush payload bounded - a guest printing 50KB lines
+  // would otherwise re-send 50KB on every tick.
+  const overflow = Math.max(0, joined.length - tailBudget());
+  postToMain({
+    type: 'stdoutTail',
+    id: currentRunId,
+    tail: overflow > 0 ? joined.slice(overflow) : joined,
+    // Counted from what was actually DROPPED - lines the rolling window
+    // evicted, plus whatever this payload's own slice cuts - rather than
+    // derived from the byte totals. The derived form read zero on the first
+    // flush by construction (every line was still in the head, so the
+    // subtraction cancelled), which made "truncated" unreportable on exactly
+    // the run the mirror exists for.
+    elidedBytes: elidedBytes + overflow,
+  });
+}
+function scheduleTailFlush() {
+  if (tailFlushTimer !== null) return;
+  tailFlushTimer = setTimeout(() => {
+    tailFlushTimer = null;
+    flushTail();
+  }, MIRROR_TAIL_FLUSH_MS);
+}
+function mirrorLine(capped) {
+  if (currentRunId === null) return;
+  if (!headMirrorFull) {
+    // Does THIS line fit, rather than "is the running total already over".
+    // Both of the orderings tried before this were wrong in one direction
+    // each: gating on the running total let one line of up to
+    // HARD_PER_LINE_BYTES past a 5KB budget (mirrored head ~55KB, disagreeing
+    // with collectStdout's head and with the "~7K chars" codeExecuteTool
+    // advertises to the model), while adding first and checking after moved
+    // the boundary but kept the crossing line in the head - so the tail was
+    // still empty at the immediate flush below and a run killed right there
+    // dropped the last line before the hang and reported itself complete.
+    //
+    // A fit check does both: the head stops at STDOUT_HEAD_BYTES exactly, and
+    // the line that did not fit STARTS the tail, so the flush that fires on
+    // this same call carries it.
+    if (mirroredHeadBytes + capped.length + 1 <= STDOUT_HEAD_BYTES) {
+      mirroredHeadBytes += capped.length + 1;
+      postToMain({ type: 'stdout', id: currentRunId, chunk: capped });
+      return;
+    }
+    headMirrorFull = true;
+    tailChunks.push(capped);
+    tailBytes += capped.length + 1;
+    // Post once immediately: a run killed before the first timed flush would
+    // otherwise report a short mirror as if it were complete.
+    flushTail();
+    return;
+  }
+  tailChunks.push(capped);
+  tailBytes += capped.length + 1;
+  // Never evict the only line held: a line larger than the whole budget is
+  // still the last thing the run printed, which is what the mirror is for.
+  const budget = tailBudget();
+  while (tailBytes > budget && tailChunks.length > 1) {
+    const dropped = tailChunks.shift();
+    tailBytes -= dropped.length + 1;
+    elidedBytes += dropped.length + 1;
+  }
+  scheduleTailFlush();
+}
 function captureLine(args) {
   const line = args.map(a => {
     if (typeof a === 'string') return a;
@@ -12916,7 +13301,7 @@ function captureLine(args) {
     ? line.slice(0, HARD_PER_LINE_BYTES) + ' [...line truncated]'
     : line;
   stdoutChunks.push(capped);
-  stdoutBytes += capped.length + 1;
+  mirrorLine(capped);
 }
 function jsonReplacer(_k, v) {
   if (v instanceof Error) return { name: v.name, message: v.message };
@@ -13017,7 +13402,11 @@ parentPort.on('message', async (msg) => {
   }
   if (msg.type === 'runCode') {
     const t0 = Date.now();
-    stdoutChunks = []; stdoutBytes = 0; truncated = false;
+    stdoutChunks = []; truncated = false;
+    cancelTailFlush();
+    currentRunId = msg.id;
+    mirroredHeadBytes = 0; headMirrorFull = false;
+    tailChunks = []; tailBytes = 0; elidedBytes = 0;
     let error = null;
     const wrapped = '(async () => {\n' + msg.code + '\n})()';
     try {
@@ -13029,6 +13418,11 @@ parentPort.on('message', async (msg) => {
     } catch (e) {
       error = serializeError(e);
     }
+    // Stop mirroring before the authoritative result goes out, so a late
+    // console.log from an abandoned continuation cannot attach to this run,
+    // and a pending tail flush cannot land after it.
+    currentRunId = null;
+    cancelTailFlush();
     parentPort.postMessage({
       type: 'runResult',
       id: msg.id,
@@ -13042,6 +13436,17 @@ parentPort.on('message', async (msg) => {
 });
 `;
 String.raw`
+// Wrapped in an IIFE deliberately. A script's top-level const/let bind into the
+// context's SHARED global lexical scope (and its function declarations become
+// globalThis properties), so without this wrapper every bootstrap-local name is
+// directly referenceable by LLM-authored code run later in the same context:
+// __RealFunction('...')() walks straight around the codegen block below, and
+// __cap.applySync(...) / __cap.release() forges or permanently kills stdout
+// capture. Function scope keeps them unreachable. Note the leak is invisible to
+// listGlobals(), which reads Object.getOwnPropertyNames(globalThis) and never
+// saw the lexical bindings - so RESERVED_GLOBAL_NAMES cannot backstop it either.
+// Anything guest code IS meant to see is assigned onto globalThis explicitly.
+(function () {
 const __cap = _captureLine;
 const __callTool = _callTool;
 delete globalThis._captureLine;
@@ -13049,28 +13454,68 @@ delete globalThis._callTool;
 
 const HARD_PER_LINE_BYTES = ${5e4};
 
+// Every intrinsic the formatter below reaches for is captured HERE, while the
+// context is still pristine. Resolving \`args.map\` / \`.join\` / \`line.slice\`
+// at CALL time walks a prototype chain the guest owns, so one
+// \`Array.prototype.join = () => 'X'\` - deliberate, or an innocent polyfill -
+// forges every stdout line for the rest of the session, and the run still
+// reports error=null / truncated=false. That is the same integrity failure the
+// frozen \`console\` below exists to prevent, one level down: freezing the
+// binding is worthless if the formatter behind it is guest-reachable.
+const __stringify = JSON.stringify;
+const __String = String;
+const __apply = Reflect.apply;
+const __strSlice = String.prototype.slice;
+
 function __jsonReplacer(_k, v) {
   if (v instanceof Error) return { name: v.name, message: v.message };
   if (typeof v === 'bigint') return v.toString() + 'n';
   return v;
 }
+// Indexed loop and \`+=\` rather than map/join: string concatenation is an
+// operator, not a lookup, so there is nothing here for the guest to replace.
+// What a guest CAN still steer is how its own values render - a \`toJSON\` or
+// \`toString\` on the object it passed - which is content it already owns, not
+// the channel.
 function __formatLine(args) {
-  const line = args.map(a => {
-    if (typeof a === 'string') return a;
-    if (a === undefined) return 'undefined';
-    if (a === null) return 'null';
-    try { return JSON.stringify(a, __jsonReplacer, 2); } catch { return String(a); }
-  }).join(' ');
+  let line = '';
+  for (let i = 0; i < args.length; i++) {
+    if (i > 0) line += ' ';
+    const a = args[i];
+    if (typeof a === 'string') { line += a; continue; }
+    if (a === undefined) { line += 'undefined'; continue; }
+    if (a === null) { line += 'null'; continue; }
+    try { line += __stringify(a, __jsonReplacer, 2); } catch { line += __String(a); }
+  }
   return line.length > HARD_PER_LINE_BYTES
-    ? line.slice(0, HARD_PER_LINE_BYTES) + ' [...line truncated]'
+    ? __apply(__strSlice, line, [0, HARD_PER_LINE_BYTES]) + ' [...line truncated]'
     : line;
 }
-globalThis.console = {
+// stdout is the channel the HOST reports back as the run's observation, so its
+// integrity is ours, not the guest's. A plain assignment left \`console\`
+// writable and configurable: guest code could set globalThis.console = {log(){}}
+// (or just reassign console.log) and every later run in the session would come
+// back with stdout="" or forged lines, error=null, and a clean listGlobals().
+// Frozen object + non-writable, non-configurable property: the guest's
+// assignment is a silent no-op in sloppy mode and a TypeError under 'use
+// strict', and either way capture keeps working.
+//
+// The BINDING is what this protects, and the binding is only half of it: a
+// frozen console whose formatter resolved its intrinsics at call time would
+// still hand the guest every line. That half is closed above, where
+// __formatLine captures what it needs.
+const __console = Object.freeze({
   log: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   warn: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   error: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
   info: (...a) => __cap.applySync(undefined, [__formatLine(a)], { arguments: { copy: true } }),
-};
+});
+Object.defineProperty(globalThis, 'console', {
+  value: __console,
+  writable: false,
+  configurable: false,
+  enumerable: true,
+});
 
 // A bare isolate has no structuredClone (it's a host/web API, not a V8
 // intrinsic). The in-process + worker backends expose the *host's* real
@@ -13158,11 +13603,33 @@ for (const __Ctor of [__RealFunction, __AsyncFunction, __GeneratorFunction, __As
 globalThis.eval = __blockCodegen;
 globalThis.Function = __blockCodegen;
 
+// WebAssembly is removed, not stubbed. Its compile/instantiate promises never
+// settle inside an isolated-vm isolate (there is no host task runner to drive
+// them), so \`await WebAssembly.instantiate(...)\` is a one-line way for guest
+// code to park a run until the host deadline fires - and that deadline kills
+// the isolate, costing the whole session its sandbox. Deleting it turns that
+// into an immediate ReferenceError. It is also codegen-from-bytes, so it
+// belongs on the same side of the line as eval / Function anyway.
+delete globalThis.WebAssembly;
+
 // Tool-stub registry. Each registered tool becomes a top-level async
 // function that round-trips through the host dispatcher and re-throws on
 // the { ok:false } envelope.
+//
+// Assigned to globalThis only so the constructor can lift a Reference to it;
+// the constructor deletes the global immediately afterwards and calls it
+// through that Reference forever after. It must NOT stay guest-reachable: a
+// guest could call __registerTools(['console']) to overwrite the frozen
+// console binding with a tool stub, or \`delete\` it and make the host's next
+// setTools() throw.
+//
+// Indexed loop, not for..of, deliberately: the host calls this with a copied
+// array whose iterator comes from the GUEST's Array.prototype, so an
+// overridden Symbol.iterator would let guest code hang or hijack a host-side
+// setTools() call. Indexing touches only the copy's own properties.
 globalThis.__registerTools = function (names) {
-  for (const name of names) {
+  for (let i = 0; i < names.length; i++) {
+    const name = names[i];
     globalThis[name] = async (...args) => {
       const envJson = await __callTool.apply(
         undefined,
@@ -13175,6 +13642,7 @@ globalThis.__registerTools = function (names) {
     };
   }
 };
+})();
 `;
 z$1.object({
 	reflection: z$1.string().min(1),
@@ -15467,6 +15935,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	AnthropicBackend: () => AnthropicBackend,
 	AnthropicBatchService: () => AnthropicBatchService,
 	AnthropicBedrockBackend: () => AnthropicBedrockBackend,
+	BEDROCK_REQUEST_HANDLER: () => BEDROCK_REQUEST_HANDLER,
 	BFLBackend: () => BFLBackend,
 	BaseBedrockBackend: () => BaseBedrockBackend,
 	ChoiceEndReason: () => ChoiceEndReason,
@@ -15524,6 +15993,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	logExpiringModels: () => logExpiringModels,
 	mergeCatalog: () => mergeCatalog,
 	mergeCatalogWithDrops: () => mergeCatalogWithDrops,
+	normalizeToolUseInputs: () => normalizeToolUseInputs,
 	reasonsWithinOutputBudget: () => reasonsWithinOutputBudget,
 	recordDeprecatedModelRequest: () => recordDeprecatedModelRequest,
 	replaceLastToolResultObservationCanonical: () => replaceLastToolResultObservationCanonical,
@@ -15898,27 +16368,112 @@ const stripAllToolBlocks = (messages, logger) => {
 	return result;
 };
 /**
+* Restores `input: {}` on any `tool_use` block that reached us without one.
+*
+* `MessageContentToolUse.input` is non-optional in the type system, so nothing upstream checks it -
+* but a message that round-trips through a persistence or serialization layer can lose it. The
+* known offender is Mongoose's default `minimize`, which deletes empty objects on
+* `toObject()`/`toJSON()`: a zero-argument tool call (`current_datetime`, `mission_status`, ...)
+* stores `input: {}` and reads back with the key gone. Anthropic then rejects the whole request
+* with "messages.N.content.M.tool_use.input: Field required", killing a resumed agent run or a
+* chat turn that replays history.
+*
+* The schema that caused it is fixed at the source (`minimize: false` on AgentExecutionModel), so
+* this is the last line of defense for every other store that replays blocks verbatim -
+* `QuestModel.structuredReplies[].content` is the same Mixed-under-default-minimize shape and is
+* deliberately covered here rather than by widening that hot collection's schema. The cost of a
+* miss is a hard 400, and `{}` is the only value a zero-argument call could have had.
+*
+* Returns the input array unchanged (same reference) when nothing needed repair.
+*/
+const normalizeToolUseInputs = (messages, logger) => {
+	let repaired = 0;
+	const result = messages.map((message) => {
+		if (!Array.isArray(message.content)) return message;
+		let messageChanged = false;
+		const content = message.content.map((block) => {
+			if (block.type !== "tool_use") return block;
+			const toolUse = block;
+			if (toolUse.input !== null && typeof toolUse.input === "object") return block;
+			repaired++;
+			messageChanged = true;
+			return {
+				...toolUse,
+				input: {}
+			};
+		});
+		return messageChanged ? {
+			...message,
+			content
+		} : message;
+	});
+	if (repaired === 0) return messages;
+	logger?.warn(`[Tool Input Repair] Restored empty input on ${repaired} tool_use block(s) that lost it in serialization`);
+	return result;
+};
+/**
+* Anthropic's hard ceiling on `cache_control` markers per request. Exceeding it fails the
+* WHOLE request with `ValidationException: A maximum of 4 blocks with cache_control may be
+* provided`, which is non-retryable - so an over-budget request loses the turn outright,
+* after the user has already waited for it.
+*/
+const MAX_CACHE_CONTROL_BLOCKS = 4;
+/**
+* Does this block already carry a marker? Re-marking one costs no budget.
+*
+* Tests the VALUE, not just key presence: a block carrying an explicit
+* `cache_control: undefined` is not a marker as far as the provider is concerned, and counting
+* it would spend budget on nothing and drop a breakpoint we could have kept.
+*/
+function hasMarker(block) {
+	return !!block && typeof block === "object" && !!block.cache_control;
+}
+/**
+* Markers already on the request. Callers upstream attach their own before this runs -
+* `bedrockBackend/anthropic.ts` marks each system block flagged `cache: true` (the mid-stack
+* shareable-prefix breakpoint) - so this adapter's budget is whatever they left, not the full four.
+*/
+function censusMarkers(params) {
+	const tools = Array.isArray(params.tools) ? params.tools.filter(hasMarker).length : 0;
+	const system = Array.isArray(params.system) ? params.system.filter(hasMarker).length : 0;
+	let messages = 0;
+	if (Array.isArray(params.messages)) for (const message of params.messages) {
+		const content = message?.content;
+		if (Array.isArray(content)) messages += content.filter(hasMarker).length;
+	}
+	return {
+		tools,
+		system,
+		messages,
+		total: tools + system + messages
+	};
+}
+/**
 * Anthropic-specific caching adapter
 * Adds explicit cache_control markers to content blocks
 */
 var AnthropicCachingAdapter = class {
-	applyCaching(apiParams, strategy) {
+	applyCaching(apiParams, strategy, logger) {
 		if (!strategy.enableCaching) return apiParams;
 		const ttl = strategy.cacheTTL ?? "5m";
 		const modifiedParams = { ...apiParams };
-		const tools = modifiedParams.tools;
-		if (strategy.cacheTools && Array.isArray(tools) && tools.length > 0) {
-			const toolsCopy = [...tools];
-			const lastTool = toolsCopy[toolsCopy.length - 1];
-			toolsCopy[toolsCopy.length - 1] = {
-				...lastTool,
-				cache_control: {
-					type: "ephemeral",
-					...ttl === "1h" ? { ttl } : {}
-				}
-			};
-			modifiedParams.tools = toolsCopy;
-		}
+		const cacheControl = {
+			type: "ephemeral",
+			...ttl === "1h" ? { ttl } : {}
+		};
+		const inbound = censusMarkers(modifiedParams);
+		let budget = MAX_CACHE_CONTROL_BLOCKS - inbound.total;
+		const dropped = [];
+		/** Claim one marker slot, or record the miss. Re-marking a marked block is free. */
+		const claim = (name, alreadyMarked) => {
+			if (alreadyMarked) return true;
+			if (budget <= 0) {
+				dropped.push(name);
+				return false;
+			}
+			budget -= 1;
+			return true;
+		};
 		const systemParam = modifiedParams.system;
 		if (strategy.cacheSystemPrompt && systemParam) {
 			const systemArray = Array.isArray(systemParam) ? [...systemParam] : [{
@@ -15927,14 +16482,13 @@ var AnthropicCachingAdapter = class {
 			}];
 			if (systemArray.length > 0) {
 				const lastBlock = systemArray[systemArray.length - 1];
-				systemArray[systemArray.length - 1] = {
-					...lastBlock,
-					cache_control: {
-						type: "ephemeral",
-						...ttl === "1h" ? { ttl } : {}
-					}
-				};
-				modifiedParams.system = systemArray;
+				if (claim("system", hasMarker(lastBlock))) {
+					systemArray[systemArray.length - 1] = {
+						...lastBlock,
+						cache_control: cacheControl
+					};
+					modifiedParams.system = systemArray;
+				}
 			}
 		}
 		const messagesParam = modifiedParams.messages;
@@ -15950,24 +16504,65 @@ var AnthropicCachingAdapter = class {
 					text: msgContent
 				}];
 				else if (Array.isArray(msgContent)) contentArray = [...msgContent];
-				else return modifiedParams;
-				if (contentArray.length > 0) {
+				if (contentArray && contentArray.length > 0) {
 					const lastBlock = contentArray[contentArray.length - 1];
-					contentArray[contentArray.length - 1] = {
-						...lastBlock,
-						cache_control: {
-							type: "ephemeral",
-							...ttl === "1h" ? { ttl } : {}
-						}
-					};
-					messages[anchorIndex] = {
-						...anchorMsg,
-						content: contentArray
-					};
-					modifiedParams.messages = messages;
+					if (claim("history", hasMarker(lastBlock))) {
+						contentArray[contentArray.length - 1] = {
+							...lastBlock,
+							cache_control: cacheControl
+						};
+						messages[anchorIndex] = {
+							...anchorMsg,
+							content: contentArray
+						};
+						modifiedParams.messages = messages;
+					}
 				}
 			}
 		}
+		const tools = modifiedParams.tools;
+		if (strategy.cacheTools && Array.isArray(tools) && tools.length > 0) {
+			const toolsCopy = [...tools];
+			const lastTool = toolsCopy[toolsCopy.length - 1];
+			if (claim("tools", hasMarker(lastTool))) {
+				toolsCopy[toolsCopy.length - 1] = {
+					...lastTool,
+					cache_control: cacheControl
+				};
+				modifiedParams.tools = toolsCopy;
+			}
+		}
+		const outbound = censusMarkers(modifiedParams);
+		const census = {
+			inbound,
+			outbound,
+			limit: MAX_CACHE_CONTROL_BLOCKS
+		};
+		if (outbound.total >= MAX_CACHE_CONTROL_BLOCKS) {
+			const message = "[PromptCache] cache_control census at the ceiling";
+			if (logger) logger.info(message, census);
+			else console.info(message, JSON.stringify(census));
+		} else if (logger) logger.debug("[PromptCache] cache_control census", census);
+		if (outbound.total > MAX_CACHE_CONTROL_BLOCKS) {
+			const message = `[PromptCache] request exceeds the ${MAX_CACHE_CONTROL_BLOCKS}-block cache_control limit on arrival (${outbound.total}); the provider will reject it`;
+			const detail = {
+				inbound,
+				outbound,
+				limit: MAX_CACHE_CONTROL_BLOCKS
+			};
+			if (logger) logger.error(message, detail);
+			else console.error(message, JSON.stringify(detail));
+		} else if (dropped.length > 0) {
+			const message = `[PromptCache] cache_control budget exhausted (limit ${MAX_CACHE_CONTROL_BLOCKS}); skipped breakpoints: ${dropped.join(", ")}`;
+			const detail = {
+				dropped,
+				inbound,
+				outbound,
+				limit: MAX_CACHE_CONTROL_BLOCKS
+			};
+			if (logger) logger.warn(message, detail);
+			else console.warn(message, JSON.stringify(detail));
+		}
 		return modifiedParams;
 	}
 	extractCacheStats(response, model) {
@@ -17095,7 +17690,7 @@ var AnthropicBackend = class {
 			const parts = [this.consolidateSystemMessages(messages), identityReminder].filter(Boolean);
 			system = parts.length > 0 ? parts.join("\n") : void 0;
 		}
-		let filteredMessages = ensureToolPairingIntegrity(this.filterRelevantMessages(cacheStampedMessages), this.logger);
+		let filteredMessages = normalizeToolUseInputs(ensureToolPairingIntegrity(this.filterRelevantMessages(cacheStampedMessages), this.logger), this.logger);
 		const countToolBlocks = (msgs) => {
 			let useCount = 0;
 			let resultCount = 0;
@@ -17195,7 +17790,7 @@ var AnthropicBackend = class {
 		} else this.isThinkingEnabled = false;
 		const cacheStrategy = options.cacheStrategy;
 		if (cacheStrategy?.enableCaching) {
-			const cachedParams = getCachingAdapter(ModelBackend.Anthropic).applyCaching(apiParams, cacheStrategy);
+			const cachedParams = getCachingAdapter(ModelBackend.Anthropic).applyCaching(apiParams, cacheStrategy, this.logger);
 			Object.assign(apiParams, cachedParams);
 			this.logger.debug("[Anthropic] Applying cache control", {
 				cacheSystemPrompt: cacheStrategy.cacheSystemPrompt,
@@ -18219,6 +18814,11 @@ const BEDROCK_RETRY_CONFIG = {
 	maxAttempts: 6,
 	retryMode: "adaptive"
 };
+const BEDROCK_REQUEST_HANDLER = {
+	requestTimeout: 12e4,
+	sessionTimeout: 13e4,
+	disableConcurrentStreams: true
+};
 /**
 * Detect cancellation errors so they propagate past tool-error containment to
 * the outer catch (which has dedicated abort handling). Without this, aborts
@@ -18260,7 +18860,8 @@ var BaseBedrockBackend = class {
 		};
 		this._bedrockRuntime = new BedrockRuntimeClient({
 			region: this._options.region,
-			...BEDROCK_RETRY_CONFIG
+			...BEDROCK_RETRY_CONFIG,
+			requestHandler: BEDROCK_REQUEST_HANDLER
 		});
 	}
 	getRegionForModel(model) {
@@ -18290,12 +18891,31 @@ var BaseBedrockBackend = class {
 	takeReasoningBlocks() {
 		return [];
 	}
+	/**
+	* Whether this adapter's `translateStreamChunk` reports `done: true` ONLY on the provider's
+	* terminal event. When true, complete() treats a stream that produced output but never
+	* reported done as a TRUNCATED response and throws instead of returning the partial text.
+	*
+	* Opt-in rather than the default because "reports done terminally" is a per-adapter contract
+	* the base class cannot infer, and getting it wrong turns every healthy completion into an
+	* error. Three groups exist today:
+	*   - terminal-only, so they override this to true: anthropic, deepseek, llama, jurassicTwo
+	*   - `done: true` on EVERY content chunk, so the check would be inert: titan, moonshot
+	*     (the better fix for those is a stopReason passthrough, as moonshot.ts already does)
+	*   - never report done, incl. the test doubles in this directory: left false
+	*
+	* A new streaming backend must opt in deliberately; silence keeps the old behaviour.
+	*/
+	get signalsStreamTermination() {
+		return false;
+	}
 	updateClientForModel(model) {
 		const requiredRegion = this.getRegionForModel(model);
 		this._options.region = requiredRegion;
 		this._bedrockRuntime = new BedrockRuntimeClient({
 			region: this._options.region,
-			...BEDROCK_RETRY_CONFIG
+			...BEDROCK_RETRY_CONFIG,
+			requestHandler: BEDROCK_REQUEST_HANDLER
 		});
 	}
 	async complete(model, messages, options, callback, toolsUsed = []) {
@@ -18403,9 +19023,11 @@ var BaseBedrockBackend = class {
 				if (!response.body) throw new Error("No response body");
 				const func = [];
 				let emittedTextChars = 0;
+				let sawTerminalEvent = false;
 				for await (const streamEvent of response.body) if (streamEvent.chunk?.bytes) {
 					const json = new TextDecoder().decode(streamEvent.chunk.bytes);
-					const { chunk } = this.translateStreamChunk(model, JSON.parse(json));
+					const { done, chunk } = this.translateStreamChunk(model, JSON.parse(json));
+					sawTerminalEvent ||= done;
 					if (chunk?.stopReason) stopReason = chunk.stopReason;
 					chunk?.choices?.forEach((choice) => {
 						func[choice.index] ||= {};
@@ -18429,6 +19051,7 @@ var BaseBedrockBackend = class {
 					await callback(streamedText, buildCompletionInfo());
 				}
 				if (emittedTextChars === 0 && !func.some((f) => f.name)) throw new Error(`[BaseBedrockBackend] model "${model}" returned an EMPTY response in region ${this._options.region} (no text, no tool call, no output tokens). A "global." cross-region inference profile served from a region that does not host it does exactly this - try the "us." variant, or confirm the model/profile is granted in ${this._options.region}.`);
+				if (this.signalsStreamTermination && !sawTerminalEvent && !options.abortSignal?.aborted) throw new Error(`[BaseBedrockBackend] stream timeout - model "${model}" in region ${this._options.region} ended after ${emittedTextChars} chars without a terminal event, so the response is TRUNCATED. Usually a stalled Bedrock socket cut the stream short; the partial text is withheld deliberately rather than returned as a finished answer.`);
 				if (func.some((f) => f.name)) {
 					for await (const tool of func) {
 						const { id, name, parameters } = tool;
@@ -18733,6 +19356,10 @@ const TEMPERATURE_ONLY_MODELS = [
 	ChatModels.CLAUDE_4_6_OPUS_BEDROCK
 ];
 var AnthropicBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on message_stop (anthropic.ts translateStreamChunk), so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	isInThinkingBlock = false;
 	/**
 	* Reasoning blocks of the assistant turn currently being translated, indexed by the
@@ -19495,6 +20122,10 @@ function isReasoningBlock(block) {
 	return "reasoningContent" in block;
 }
 var DeepSeekBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on event.messageStop, so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	/** Suppresses reasoning/thinking output for summary and title generation calls. */
 	isSpecialTask = false;
 	/** Tracks whether the stream is currently inside a reasoning span, to emit one <think>/</think> pair per span. */
@@ -19839,6 +20470,10 @@ var JurassicTwoBedrockBackend = class extends BaseBedrockBackend {
 	}
 };
 var LlamaBedrockBackend = class extends BaseBedrockBackend {
+	/** Reports done only on response.stop_reason on the terminal chunk, so a missing terminal event means a truncated stream. */
+	get signalsStreamTermination() {
+		return true;
+	}
 	async getModelInfo() {
 		return [
 			{
@@ -20984,7 +21619,7 @@ var GeminiBackend = class {
 				rank: 8,
 				trainingCutoff: "2025-01-31",
 				releaseDate: "2025-06-01",
-				deprecationDate: "2026-10-16",
+				deprecationDate: "2026-09-02",
 				description: "Google's Gemini 2.5 Flash, offering well-rounded price-performance. Best for large scale processing, low-latency, high volume tasks that require thinking, and agentic use cases"
 			},
 			{
@@ -25949,6 +26584,7 @@ const DEPRECATED_MODEL_MAP = {
 	"claude-3-haiku-20240307": "claude-haiku-4-5-20251001",
 	"gpt-5-chat-latest": "gpt-5.5",
 	"gpt-5.1-chat-latest": "gpt-5.5",
+	"gemini-2.5-flash": "gemini-3.1-flash-lite",
 	"grok-3": "grok-4.5",
 	"grok-3-fast": "grok-4.5",
 	"grok-2-1212": "grok-4.5",
@@ -27522,6 +28158,109 @@ async function createSseBackend(input, deps = defaultSseTransportDeps) {
 }
 //#endregion
 //#region ../../b4m-core/mcp/dist/index.mjs
+/**
+* Environment construction for the MCP stdio child process.
+*
+* The child is spawned from a process that also holds platform credentials - provider API keys,
+* database URIs, signing secrets - so what it inherits is a trust decision, not a convenience.
+* Two rules follow:
+*
+* 1. The child environment is built from an allowlist, never spread from `process.env`. The base
+*    layer is the MCP SDK's own `getDefaultEnvironment()`, which the stdio transport merges
+*    underneath whatever we pass (PATH, HOME, SHELL, TERM, USER on POSIX; the equivalent set on
+*    Windows). Everything above that base comes from the table below.
+* 2. A stored variable is provider data, never runtime configuration. The child is a Node
+*    process, so a key like NODE_OPTIONS is applied by the runtime before a single line of
+*    server code loads: `--require /tmp/x.js` would turn a credential field into arbitrary code
+*    execution inside the child. Those keys are refused rather than dropped quietly.
+*
+* MUST STAY IN SYNC with the `process.env` reads under each server directory
+* (`github/config.ts`, `notion/config.ts`, `atlassian/config.ts`, `linkedin/index.ts`). A
+* variable a server reads but this table omits arrives `undefined`, so add it here in the same
+* change. `childEnv.test.ts` pins that both ways.
+*/
+const MCP_SERVER_ENV_KEYS = {
+	[McpServerName.LinkedIn]: ["LINKEDIN_ACCESS_TOKEN", "COMPANY_NAME"],
+	[McpServerName.Github]: ["GITHUB_ACCESS_TOKEN"],
+	[McpServerName.Atlassian]: [
+		"ATLASSIAN_ACCESS_TOKEN",
+		"ATLASSIAN_CLOUD_ID",
+		"ATLASSIAN_SITE_URL"
+	],
+	[McpServerName.Notion]: [
+		"NOTION_ACCESS_TOKEN",
+		"NOTION_WORKSPACE_ID",
+		"NOTION_WRITE_ENABLED",
+		"NOTION_ROOT_PAGE_ID",
+		"NOTION_ACCESS_MODE",
+		"NOTION_ALLOWED_PAGES",
+		"NOTION_EXCLUDED_PAGE_IDS",
+		"NOTION_DEBUG"
+	]
+};
+/**
+* Keys that make the runtime execute caller-chosen code before the server's entry point runs:
+* NODE_OPTIONS can `--require` a file, the loader variables preload a shared object, and
+* ELECTRON_RUN_AS_NODE changes what the binary is. Matching is case-insensitive because Windows
+* environment names are.
+*/
+const CODE_INJECTING_ENV_KEY_PATTERNS = [
+	/^NODE_/i,
+	/^ELECTRON_RUN_AS_NODE$/i,
+	/^LD_/i,
+	/^DYLD_/i
+];
+/**
+* Keys that steer where the child resolves things rather than what it executes: npm_* redirects
+* package resolution, PATH decides which binary a bare command name finds, and the proxy
+* variables redirect outbound traffic.
+*/
+const RESOLUTION_STEERING_ENV_KEY_PATTERNS = [
+	/^npm_/i,
+	/^PATH$/i,
+	/^PATHEXT$/i,
+	/^(HTTP|HTTPS|ALL|NO|FTP)_PROXY$/i,
+	/^GLOBAL_AGENT_/i
+];
+[...CODE_INJECTING_ENV_KEY_PATTERNS, ...RESOLUTION_STEERING_ENV_KEY_PATTERNS];
+const matchesAny = (patterns, key) => {
+	const normalized = key.trim();
+	return patterns.some((pattern) => pattern.test(normalized));
+};
+/** True when `key` would have the runtime load caller-chosen code before the server starts. */
+function isCodeInjectingMcpEnvKey(key) {
+	return matchesAny(CODE_INJECTING_ENV_KEY_PATTERNS, key);
+}
+/**
+* Build the environment for a stdio MCP child.
+*
+* A bundled server gets exactly its declared variables - the allowlist decides, and the denylist
+* above is never consulted.
+*
+* A caller-defined command has no declared contract to check against, so it gets everything
+* except the code-injecting keys. Only the `b4m` CLI config reaches this branch, and that file
+* already lets its owner set `command` and `args` to any binary - so withholding PATH or a proxy
+* variable from them protects nobody while breaking a wrapper script or a corporate proxy, and
+* the warning that says so goes to a stderr the TUI hides. The code-injecting half stays because
+* an env-only `--require` is the one lever that is easy to set by accident.
+*/
+function buildMcpChildEnv({ serverName, envVariables, hasCustomCommand = false }) {
+	const declaredKeys = hasCustomCommand ? void 0 : MCP_SERVER_ENV_KEYS[serverName];
+	const isAllowed = declaredKeys ? (key) => declaredKeys.includes(key) : (key) => !isCodeInjectingMcpEnvKey(key);
+	const env = {};
+	const droppedKeys = [];
+	for (const { key, value } of envVariables) {
+		if (!isAllowed(key)) {
+			droppedKeys.push(key);
+			continue;
+		}
+		env[key] = value;
+	}
+	return {
+		env,
+		droppedKeys
+	};
+}
 var MCPClient = class {
 	mcp;
 	transport = null;
@@ -27565,14 +28304,11 @@ var MCPClient = class {
 				}));
 				return;
 			}
-			const envVarsObject = this.envVariables.reduce((acc, env) => ({
-				...acc,
-				[env.key]: env.value
-			}), {});
 			let command;
 			let args;
-			if (this.customCommand && this.customCommand.trim() !== "") {
-				command = this.customCommand;
+			const customCommand = this.customCommand?.trim() ? this.customCommand : void 0;
+			if (customCommand) {
+				command = customCommand;
 				args = this.customArgs ?? [];
 			} else {
 				const moduleDir = path.dirname(fileURLToPath(import.meta.url));
@@ -27589,13 +28325,16 @@ var MCPClient = class {
 				console.log(`[MCP] Using server: ${this.serverName} at ${serverScriptPath}`);
 			}
 			const stderrMode = this.suppressStderr ? "ignore" : this.onStderrLine ? "pipe" : void 0;
+			const { env, droppedKeys } = buildMcpChildEnv({
+				serverName: this.serverName,
+				envVariables: this.envVariables,
+				hasCustomCommand: Boolean(customCommand)
+			});
+			if (droppedKeys.length > 0) console.warn(`[MCP] Withheld ${droppedKeys.length} undeclared env variable(s) from ${this.serverName}: ${droppedKeys.join(", ")}`);
 			const transportConfig = {
 				command,
 				args,
-				env: {
-					...Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== void 0)),
-					...envVarsObject
-				},
+				env,
 				...stderrMode && { stderr: stderrMode }
 			};
 			const stdioTransport = new StdioClientTransport(transportConfig);
@@ -28023,7 +28762,7 @@ const MODEL_ALIASES = {
 	"o4-mini": ChatModels.O4_MINI,
 	gemini: ChatModels.GEMINI_2_5_PRO,
 	"gemini-pro": ChatModels.GEMINI_2_5_PRO,
-	"gemini-flash": ChatModels.GEMINI_2_5_FLASH,
+	"gemini-flash": ChatModels.GEMINI_3_5_FLASH,
 	"gemini-flash-lite": ChatModels.GEMINI_2_5_FLASH_LITE,
 	"gemini-3": ChatModels.GEMINI_3_PRO_PREVIEW,
 	"gemini-3-pro": ChatModels.GEMINI_3_PRO_PREVIEW,
@@ -28458,7 +29197,7 @@ function buildFilenameMarkerRegex(markers) {
 * of the best-effort DB pre-filter. Fail-closed by design.
 */
 function isRetrievalExcluded(file, opts) {
-	const stalledByConvergence = isConvergencePausedNote(file.notes) || isChunkRebuildPending(file.chunkRebuildRequestedAt);
+	const stalledByConvergence = isChunkStalledFile(file) || isChunkRebuildPending(file.chunkRebuildRequestedAt);
 	if (opts.vectorizedOnly && !file.vectorized && !stalledByConvergence) return true;
 	const re = buildFilenameMarkerRegex(opts.excludeFilenameMarkers);
 	return !!re && re.test((file.fileName ?? "").toLowerCase());
@@ -29042,6 +29781,18 @@ function attachedContentBudgetsAgree(maxSafeInputTokens, systemPromptReserve) {
 var AdminSettingsCache = class AdminSettingsCache {
 	cache = /* @__PURE__ */ new Map();
 	individualCache = /* @__PURE__ */ new Map();
+	/**
+	* Every call through this field is optional-chained (`this.logger.debug?.()`).
+	*
+	* A cache must not throw because it could not log, and this one is exposed to that: it is a
+	* process-wide singleton created with whichever logger happens to reach `getSettingsCache` first.
+	* What each caller then does with a throw varies, and it is mostly NOT a degrade-to-defaults
+	* guard: `getSettingsByNames` has none at all, the scoped resolver guards one layer out in
+	* `resolveAll`, and `resolveSpendLevers` deliberately rethrows to halt spend. So a logger missing
+	* a quieter level could surface as a silent wrong VALUE, as an unhandled rejection, or as a hard
+	* fail-closed, depending on who asked. `ScopedSettingsCache` is built by the same factory pair
+	* and still has one unguarded call - the same hazard, not a solved one.
+	*/
 	logger;
 	cleanupInterval = null;
 	maxCacheSize = 1e3;
@@ -29057,13 +29808,13 @@ var AdminSettingsCache = class AdminSettingsCache {
 	*/
 	startCleanupTimer() {
 		if (process.env.NODE_ENV !== "production" || process.env.VERCEL || process.env.AWS_LAMBDA_FUNCTION_NAME) {
-			this.logger.debug("Skipping cleanup timer in serverless environment");
+			this.logger.debug?.("Skipping cleanup timer in serverless environment");
 			return;
 		}
 		this.cleanupInterval = setInterval(() => {
 			this.performCleanup();
 		}, AdminSettingsCache.CLEANUP_INTERVAL);
-		this.logger.debug("Started cache cleanup timer");
+		this.logger.debug?.("Started cache cleanup timer");
 	}
 	/**
 	* Stop cleanup timer (for graceful shutdown)
@@ -29072,7 +29823,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 		if (this.cleanupInterval) {
 			clearInterval(this.cleanupInterval);
 			this.cleanupInterval = null;
-			this.logger.debug("Stopped cache cleanup timer");
+			this.logger.debug?.("Stopped cache cleanup timer");
 		}
 	}
 	/**
@@ -29097,9 +29848,9 @@ var AdminSettingsCache = class AdminSettingsCache {
 				this.individualCache.delete(entries[i][0]);
 				removedCount++;
 			}
-			this.logger.warn(`Emergency cache cleanup: removed ${toRemove} entries due to size limit`);
+			this.logger.warn?.(`Emergency cache cleanup: removed ${toRemove} entries due to size limit`);
 		}
-		if (removedCount > 0) this.logger.debug(`Cache cleanup removed ${removedCount} expired entries (${beforeSize} → ${this.cache.size + this.individualCache.size})`);
+		if (removedCount > 0) this.logger.debug?.(`Cache cleanup removed ${removedCount} expired entries (${beforeSize} → ${this.cache.size + this.individualCache.size})`);
 	}
 	/**
 	* Get TTL based on environment
@@ -29120,18 +29871,18 @@ var AdminSettingsCache = class AdminSettingsCache {
 		const cacheKey = "all_settings";
 		const cached = this.cache.get(cacheKey);
 		if (cached && this.isValid(cached.timestamp, cached.ttl)) {
-			this.logger.debug("📦 Admin settings cache HIT");
+			this.logger.debug?.("📦 Admin settings cache HIT");
 			return cached.data;
 		}
 		if (cached) this.cache.delete(cacheKey);
-		this.logger.debug("🔍 Admin settings cache MISS - fetching from database");
+		this.logger.debug?.("🔍 Admin settings cache MISS - fetching from database");
 		const fetchStart = Date.now();
 		const settingsMap = (await db.adminSettings.findAll()).reduce((out, s) => {
 			out[s.settingName] = s.settingValue;
 			return out;
 		}, {});
 		const fetchTime = Date.now() - fetchStart;
-		this.logger.info(`📦 Cached ${Object.keys(settingsMap).length} admin settings in ${fetchTime}ms`);
+		this.logger.info?.(`📦 Cached ${Object.keys(settingsMap).length} admin settings in ${fetchTime}ms`);
 		const ttl = this.getTTL();
 		this.cache.set(cacheKey, {
 			data: settingsMap,
@@ -29153,15 +29904,15 @@ var AdminSettingsCache = class AdminSettingsCache {
 	async getSettingByName(settingName, db) {
 		const cached = this.individualCache.get(settingName);
 		if (cached && this.isValid(cached.timestamp, cached.ttl)) {
-			this.logger.debug(`📦 Individual setting '${settingName}' cache HIT`);
+			this.logger.debug?.(`📦 Individual setting '${settingName}' cache HIT`);
 			return cached.value;
 		}
 		if (cached) this.individualCache.delete(settingName);
-		this.logger.debug(`🔍 Individual setting '${settingName}' cache MISS - fetching from database`);
+		this.logger.debug?.(`🔍 Individual setting '${settingName}' cache MISS - fetching from database`);
 		const fetchStart = Date.now();
 		const value = (await db.adminSettings.findBySettingName(settingName))?.settingValue ?? null;
 		const fetchTime = Date.now() - fetchStart;
-		this.logger.debug(`📦 Cached individual setting '${settingName}' in ${fetchTime}ms`);
+		this.logger.debug?.(`📦 Cached individual setting '${settingName}' in ${fetchTime}ms`);
 		this.individualCache.set(settingName, {
 			value,
 			timestamp: Date.now(),
@@ -29185,11 +29936,11 @@ var AdminSettingsCache = class AdminSettingsCache {
 			}
 		}
 		if (uncachedSettings.length > 0) {
-			this.logger.debug(`🔍 Batch fetching ${uncachedSettings.length} uncached settings: ${uncachedSettings.join(", ")}`);
+			this.logger.debug?.(`🔍 Batch fetching ${uncachedSettings.length} uncached settings: ${uncachedSettings.join(", ")}`);
 			const fetchStart = Date.now();
 			const settings = await db.adminSettings.findBySettingNames(uncachedSettings);
 			const fetchTime = Date.now() - fetchStart;
-			this.logger.debug(`📦 Batch fetched ${settings.length} settings in ${fetchTime}ms`);
+			this.logger.debug?.(`📦 Batch fetched ${settings.length} settings in ${fetchTime}ms`);
 			const ttl = this.getTTL();
 			settings.forEach((setting) => {
 				result[setting.settingName] = setting.settingValue;
@@ -29207,7 +29958,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 				});
 			});
 		}
-		this.logger.debug(`📦 Returned ${Object.keys(result).length} settings (${settingNames.length - uncachedSettings.length} from cache, ${uncachedSettings.length} from DB)`);
+		this.logger.debug?.(`📦 Returned ${Object.keys(result).length} settings (${settingNames.length - uncachedSettings.length} from cache, ${uncachedSettings.length} from DB)`);
 		return result;
 	}
 	/**
@@ -29216,7 +29967,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 	invalidateSetting(settingName) {
 		this.individualCache.delete(settingName);
 		this.cache.delete("all_settings");
-		this.logger.info(`🗑️ Invalidated cache for setting: ${settingName}`);
+		this.logger.info?.(`🗑️ Invalidated cache for setting: ${settingName}`);
 	}
 	/**
 	* Invalidate all cached admin settings
@@ -29224,7 +29975,7 @@ var AdminSettingsCache = class AdminSettingsCache {
 	invalidateAll() {
 		this.cache.clear();
 		this.individualCache.clear();
-		this.logger.info("🗑️ Invalidated all admin settings cache");
+		this.logger.info?.("🗑️ Invalidated all admin settings cache");
 	}
 	/**
 	* Get cache statistics for monitoring
@@ -29257,16 +30008,16 @@ var AdminSettingsCache = class AdminSettingsCache {
 	* Warm up the cache by fetching all settings
 	*/
 	async warmUp(db) {
-		this.logger.info("🔥 Warming up admin settings cache...");
+		this.logger.info?.("🔥 Warming up admin settings cache...");
 		await this.getSettingsMap(db);
-		this.logger.info("✅ Admin settings cache warmed up");
+		this.logger.info?.("✅ Admin settings cache warmed up");
 	}
 	/**
 	* Graceful shutdown - cleanup timers
 	*/
 	shutdown() {
 		this.stopCleanupTimer();
-		this.logger.info("🛑 Admin settings cache shutdown complete");
+		this.logger.info?.("🛑 Admin settings cache shutdown complete");
 	}
 };
 /** Address of one cached override, shared by the cache and its callers so lookups are consistent. */
@@ -29615,6 +30366,17 @@ const getFileContent = async (fabFile, { storage, logger }) => {
 	}
 	return content;
 };
+/**
+* Content hash for per-lake FabFile dedup (`findByContentHashesInDataLake`). Shared by every
+* ingest path that needs to hash bytes before creating a FabFile - the Slack attachment path
+* (raw downloaded buffer) and the URL/link path (`fetchAndParseURL`'s extracted `textContent`) -
+* so at least the HASHING ITSELF cannot drift between two copies of the same algorithm.
+*
+* This does NOT make `contentHash` one hash domain: the two callers feed it different inputs
+* (raw bytes vs. extracted text), so the same document added once as an attachment and once as a
+* link produces two different hashes and is not caught as a duplicate by this field.
+*/
+const computeContentHash = (content) => createHash$1("sha256").update(content).digest("hex");
 /** The next 1-based version number given the existing (possibly absent) version history. */
 const nextVersionNumber = (versions) => {
 	if (!versions || versions.length === 0) return 1;
@@ -29825,19 +30587,6 @@ const EDITABLE_IMAGE_KEY_RE = /\.(jpe?g|png|webp|gif)$/i;
 const PREVIEW_CHUNK = 700;
 const CHARS_PER_TOKEN = 3.5;
 /**
-* Chunks per attached file that cosine retrieval feeds to the model. Three starved small embedders: a
-* chunk is the embedding model's context window less a 20% buffer (see SmartChunker), so three chunks
-* is roughly 69k chars on an 8192-token embedder but only 4.3k on a 512-token one, which answers a
-* question about a 200-row table from 43 rows without saying so.
-*
-* 10 is borrowed from rankChunksForFiles' topK default, but note the two caps differ in shape: that
-* one is global across every file in the search, this one is PER FILE, so a multi-file attachment can
-* yield more chunks here. What bounds the payload is the per-file character budget applied to these
-* results (maxChars in processFabFilesServer), not this count - and that budget now derives from the
-* model's input window rather than its output limit; see attachedContentExtractionBudget.
-*/
-const COSINE_SEARCH_TOP_K = 10;
-/**
 * How much of one attached file the cosine scan will read, and in what size pages.
 *
 * Module constants rather than admin settings: unlike a data lake, an attachment is one file the
@@ -30249,14 +30998,28 @@ async function fetchAgentConversationHistory(session, questCount, { db }) {
 		return acc;
 	}, new Array());
 }
-async function fetchAndConvertFabFiles(fabFileIds, { scope }, { db, storage }) {
-	const fabFiles = await db.fabfiles.getAccessibleFiles(fabFileIds, scope);
-	return await Promise.all(fabFiles.map(async (file) => {
+/**
+* Resolves attachment ids to documents, and reports the ones it could NOT resolve. The missing set
+* is the point: `getAccessibleFiles` applies a permission scope and simply omits what it rejects, so
+* an id dropped by the scope filter or by a delete/upload race used to leave no trace anywhere - the
+* turn ran as though the file had never been attached (#2228). Callers report `missingIds` through
+* the same channel as the per-file notices rather than inferring the drop from a shorter array.
+*/
+async function fetchAndConvertFabFiles(fabFileIds, { scope, lakeAccess }, { db, storage, logger }) {
+	const fabFiles = await db.fabfiles.getAccessibleFiles(fabFileIds, scope, lakeAccess);
+	const files = await Promise.all(fabFiles.map(async (file) => {
 		return {
 			...file,
 			userId: file.userId.toString()
 		};
 	}));
+	const returnedIds = new Set(files.map((file) => String(file.id)));
+	const missingIds = Array.from(new Set(fabFileIds)).filter((id) => !returnedIds.has(String(id)));
+	if (missingIds.length > 0) logger?.warn(`[fetchAndConvertFabFiles] ${missingIds.length} of ${fabFileIds.length} requested file id(s) were not returned by getAccessibleFiles and contribute nothing to this turn: ${missingIds.join(", ")}`);
+	return {
+		files,
+		missingIds
+	};
 }
 async function getCachedSignedUrl(filePath, storage, db) {
 	const key = `cachedSignedUrl:${filePath}`;
@@ -30458,7 +31221,7 @@ async function cosineSearch(file, userPromptVector, { db, logger }) {
 		for (const chunk of usable) {
 			const position = scanned;
 			scanned++;
-			if (head.length < COSINE_SEARCH_TOP_K) head.push({
+			if (head.length < 10) head.push({
 				chunkId: chunk.id,
 				content: chunk.text,
 				score: 0
@@ -30479,9 +31242,9 @@ async function cosineSearch(file, userPromptVector, { db, logger }) {
 				position
 			});
 		}
-		if (ranked.length > COSINE_SEARCH_TOP_K) {
+		if (ranked.length > 10) {
 			ranked.sort(compareRankedChunks);
-			ranked.length = COSINE_SEARCH_TOP_K;
+			ranked.length = 10;
 		}
 		if (!moreExist) break;
 	}
@@ -30503,14 +31266,14 @@ const noopResize = async (imageBuffer) => imageBuffer;
 async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, attachedContentTokenBudget, modelInfo, sendStatusUpdate, { logger, storage, db, resizeImageForModel = noopResize }, progressCallback) {
 	if (!fabFiles || fabFiles.length === 0) return {
 		userMessages: [],
-		errorMessages: [],
+		fileNotices: [],
 		deliveredFileIds: [],
 		fullyDeliveredFileIds: []
 	};
 	const fileProcessingStartTime = Date.now();
 	let systemContent = "";
 	const userMessages = [];
-	const errorMessages = [];
+	const fileNotices = [];
 	const deliveredFileIds = /* @__PURE__ */ new Set();
 	const fullyDeliveredFileIds = /* @__PURE__ */ new Set();
 	const contextFiles = [];
@@ -30541,11 +31304,25 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 		try {
 			if (isAudioMimeType(file.mimeType)) {
 				logger.warn(`[processFabFilesServer] Skipping audio file ${file.fileName} — audio is not attachable to an LLM.`);
+				fileNotices.push({
+					fabFileId: file.id,
+					fileName: file.fileName,
+					band: "audio",
+					message: `"${noticeFileName(file.fileName)}" is an audio file and was not sent: no model accepts audio as input.`,
+					delivered: false
+				});
 				return;
 			}
 			if (supportsVision && isImageAttachment(file.mimeType)) {
 				if (!isImageServeable(file)) {
 					logger.warn(`[processFabFilesServer] Skipping image file ${file.fileName} — held pending moderation or blocked (#9776 Q2b).`);
+					fileNotices.push({
+						fabFileId: file.id,
+						fileName: file.fileName,
+						band: "image_not_serveable",
+						message: `Image "${noticeFileName(file.fileName)}" was not sent: it is held pending moderation or has been blocked.`,
+						delivered: false
+					});
 					return;
 				}
 				sendStatusUpdate(`Processing image file ${file.fileName}...`);
@@ -30581,9 +31358,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 								const errorMsg = `⚠️ Image "${file.fileName}" (${fileSizeMB.toFixed(1)}MB) is too large for ${backendName}. Max: ${MAX_IMAGE_SIZE_MB}MB. Please delete this file and re-upload to auto-resize.`;
 								logger.warn(errorMsg);
 								await sendStatusUpdate(errorMsg);
-								errorMessages.push({
-									role: "error",
-									content: errorMsg
+								fileNotices.push({
+									fabFileId: file.id,
+									fileName: file.fileName,
+									band: "image_too_large",
+									message: errorMsg,
+									delivered: false
 								});
 								return;
 							}
@@ -30613,9 +31393,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 								const errorMsg = `⚠️ Image "${file.fileName}" (${encodedMB}MB encoded) is too large for ${modelInfo.name}. Max ~3MB. Please delete this file and re-upload a smaller image.`;
 								logger.warn(errorMsg);
 								await sendStatusUpdate(errorMsg);
-								errorMessages.push({
-									role: "error",
-									content: errorMsg
+								fileNotices.push({
+									fabFileId: file.id,
+									fileName: file.fileName,
+									band: "image_too_large",
+									message: errorMsg,
+									delivered: false
 								});
 								return;
 							}
@@ -30629,7 +31412,16 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 							});
 							delivered = true;
 							fullyDelivered = true;
-						} else logger.warn(`Vision support for the model ${modelInfo.id} is not implemented. Skipping image processing.`);
+						} else {
+							logger.warn(`Vision support for the model ${modelInfo.id} is not implemented. Skipping image processing.`);
+							fileNotices.push({
+								fabFileId: file.id,
+								fileName: file.fileName,
+								band: "vision_unsupported",
+								message: `Image "${noticeFileName(file.fileName)}" was not sent: image input is not implemented for ${modelInfo.name ?? modelInfo.id}.`,
+								delivered: false
+							});
+						}
 						break;
 					case ModelBackend.Ollama: {
 						const imageBuffer = await resizeImageForModel(await storage.download(file.filePath), void 0, logger);
@@ -30658,10 +31450,26 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						fullyDelivered = true;
 						break;
 					}
-					default: logger.error(`Unsupported backend for model ${modelInfo.id} backend ${modelInfo?.backend ?? "undefined"}`);
+					default:
+						logger.error(`Unsupported backend for model ${modelInfo.id} backend ${modelInfo?.backend ?? "undefined"}`);
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "unsupported_backend",
+							message: `Image "${noticeFileName(file.fileName)}" was not sent: this model's backend does not accept image attachments.`,
+							delivered: false
+						});
 				}
-			} else if (!supportsVision && isImageAttachment(file.mimeType)) logger.warn(`File ${file.fileName} is an image but model does not support vision. Skipping...`);
-			else {
+			} else if (!supportsVision && isImageAttachment(file.mimeType)) {
+				logger.warn(`File ${file.fileName} is an image but model does not support vision. Skipping...`);
+				fileNotices.push({
+					fabFileId: file.id,
+					fileName: file.fileName,
+					band: "vision_unsupported",
+					message: `Image "${noticeFileName(file.fileName)}" was not sent: ${modelInfo?.name ?? modelInfo?.id ?? "this model"} cannot read images.`,
+					delivered: false
+				});
+			} else {
 				const embeddingModel = file.embeddingModel ?? OpenAIEmbeddingModel.TEXT_EMBEDDING_ADA_002;
 				const userVector = userVectorPrompt[embeddingModel];
 				const canCosineSearch = file.vectorized && !!userVector && userVector.length > 0;
@@ -30737,9 +31545,12 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						const originalFileSize = fabContent.length;
 						fabContent = fabContent.substring(0, finalMaxFileSize ?? PREVIEW_CHUNK) + CONTENT_TRUNCATION_NOTICE;
 						errorMsg = `Knowledge in the workbench with the fileName ${file.fileName} is ${originalFileSize} long which exceeds ${finalMaxFileSize}. ` + (canCosineSearch ? "None of its vectorized chunks could be searched with this turn's embedding model, so it was sent as raw text and truncated. Re-vectorize it under the current embedding model, or select a model with a higher context window." : "Vectorize your large file or select a model with higher context window.");
-						errorMessages.push({
-							role: "error",
-							content: errorMsg
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "truncated",
+							message: `"${noticeFileName(file.fileName)}" was too large to send whole; only the first ${Math.floor(finalMaxFileSize)} characters of ${originalFileSize} reached this conversation.`,
+							delivered: true
 						});
 					} else errorMsg = null;
 					delivered = true;
@@ -30753,19 +31564,41 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						error: errorMsg
 					});
 				} catch (e) {
-					if (e instanceof BadRequestError && e.message.includes("Unsupported file type")) logger.warn(`Unsupported file type: ${file.fileName}`);
-					else if (isAxiosError(e) && e.response?.status === 404) {
+					if (e instanceof BadRequestError && e.message.includes("Unsupported file type")) {
+						logger.warn(`Unsupported file type: ${file.fileName}`);
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "unsupported_type",
+							message: `"${noticeFileName(file.fileName)}" was not sent: its file type (${file.mimeType}) cannot be read as text.`,
+							delivered: false
+						});
+					} else if (isAxiosError(e) && e.response?.status === 404) {
 						await sendStatusUpdate(`Skipping file ${file.fileName}. File might be corrupted or deleted`);
 						await db.fabfiles.update({
 							id: file.id,
 							error: "This file appears to be corrupted or may have been deleted. Please try uploading the file again."
 						});
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "read_failed",
+							message: `"${noticeFileName(file.fileName)}" could not be read and was not sent: it appears to be corrupted or deleted. Try uploading it again.`,
+							delivered: false
+						});
 					} else if (e instanceof CorruptedFileError) {
 						await sendStatusUpdate(`Skipping corrupted file ${file.fileName}. Please try re-uploading`);
 						await db.fabfiles.update({
 							id: file.id,
 							error: e.message
 						});
+						fileNotices.push({
+							fabFileId: file.id,
+							fileName: file.fileName,
+							band: "read_failed",
+							message: `"${noticeFileName(file.fileName)}" could not be read and was not sent: ${e.message}`,
+							delivered: false
+						});
 					} else {
 						logger.updateMetadata({ filePath: file.filePath });
 						throw e;
@@ -30785,6 +31618,18 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 		processedFiles++;
 		if (progressCallback) await progressCallback(processedFiles, totalFiles);
 	}))));
+	const noticedFileIds = new Set(fileNotices.map((notice) => notice.fabFileId));
+	for (const file of fabFiles) {
+		if (deliveredFileIds.has(file.id) || noticedFileIds.has(file.id)) continue;
+		logger.warn(`[processFabFilesServer] "${file.fileName}" (${file.id}) contributed no content and produced no notice; reporting it as undelivered.`);
+		fileNotices.push({
+			fabFileId: file.id,
+			fileName: file.fileName,
+			band: "no_readable_content",
+			message: `"${noticeFileName(file.fileName)}" was not sent: no readable content could be extracted from it.`,
+			delivered: false
+		});
+	}
 	if (imageContent.length > 0) userMessages.push({
 		role: "user",
 		content: imageContent
@@ -30812,7 +31657,7 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 	logger.info(`📁 File processing completed in ${fileProcessingTime}ms for ${fabFiles.length} files`);
 	return {
 		userMessages,
-		errorMessages,
+		fileNotices,
 		deliveredFileIds: Array.from(deliveredFileIds),
 		fullyDeliveredFileIds: Array.from(fullyDeliveredFileIds)
 	};
@@ -31337,6 +32182,7 @@ var llm_exports = /* @__PURE__ */ __exportAll({
 	ATTACHED_CONTENT_EXTRACTION_SHARE: () => ATTACHED_CONTENT_EXTRACTION_SHARE,
 	ATTACHMENT_DELIVERED_NOTICE: () => ATTACHMENT_DELIVERED_NOTICE,
 	BUILDER_INJECTED_BLOCK_IDS: () => BUILDER_INJECTED_BLOCK_IDS,
+	COSINE_SEARCH_TOP_K: () => 10,
 	DEFAULT_OUTPUT_MAX_TOKENS: () => DEFAULT_OUTPUT_MAX_TOKENS,
 	EXTRACTION_SYSTEM_RESERVE_MAX_SHARE: () => EXTRACTION_SYSTEM_RESERVE_MAX_SHARE,
 	FORMAT_PROMPT_PRIORITY: () => 60,
@@ -32955,6 +33801,7 @@ const OPENAI_IMAGE_CLIENT_OPTS = {
 	maxRetries: 0
 };
 const ALTERNATIVE_IMAGE_MODELS = "Flux Pro, Flux Dev, or Grok";
+const truncatePromptForLog = (prompt) => prompt.length > 100 ? `${prompt.slice(0, 100)}...` : prompt;
 /**
 * Builds a user-friendly error when OpenAI's safety system blocks an image
 * request, guiding the user to rephrase or switch to an alternative model.
@@ -32982,6 +33829,53 @@ function buildModerationBlockedError(error) {
 
 Tip: Switch to an alternative model with different content policies — e.g. ${ALTERNATIVE_IMAGE_MODELS} — which may accept this prompt.\n\nIf you believe this is an error, you can report it to OpenAI with request ID: ${requestId}`);
 }
+/**
+* Splits a WIDTHxHEIGHT size into its two edges, or null when the value is not a
+* pair of non-zero numbers (e.g. 'auto', '', 'wide'). Null means "not a custom
+* resolution" rather than "invalid": generate() has always left such values
+* untouched, and that behaviour is preserved.
+*/
+function parseSizeEdges(size) {
+	if (typeof size !== "string") return null;
+	const [width, height] = size.split("x").map(Number);
+	if (!width || !height) return null;
+	return {
+		width,
+		height
+	};
+}
+/**
+* True when a custom gpt-image-2 resolution meets OpenAI's documented limits.
+* gpt-image-2 accepts any resolution satisfying these, not only the presets in
+* OPENAI_GPT_IMAGE_2_IMAGE_SIZES, so a flat preset check would reject valid
+* custom sizes. Must stay the single source of this rule for generate() and edit().
+*/
+function satisfiesGptImage2Constraints({ width, height }) {
+	const { maxEdge, minTotalPixels, maxTotalPixels, edgeMultiple, maxAspectRatio } = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.constraints;
+	const longEdge = Math.max(width, height);
+	const shortEdge = Math.min(width, height);
+	const totalPixels = width * height;
+	return longEdge <= maxEdge && width % edgeMultiple === 0 && height % edgeMultiple === 0 && longEdge / shortEdge <= maxAspectRatio && totalPixels >= minTotalPixels && totalPixels <= maxTotalPixels;
+}
+/**
+* True when `size` may be forwarded to images.edit for `model`. gpt-image-2 takes
+* its presets (including 'auto') or any custom WIDTHxHEIGHT meeting the same
+* constraints generate() enforces; the gpt-image-1 family is limited to its three
+* fixed sizes. An unsupported size is dropped by the caller so OpenAI applies its
+* own default instead of rejecting the whole request with a 400.
+*
+* GPT-Image tiers only: dall-e-2 has its own size list and passes size through
+* untouched, so do not route that model here.
+*/
+function isSupportedEditSize(model, size) {
+	if (typeof size !== "string") return false;
+	if (isGPTImage2Model(model)) {
+		if (OPENAI_GPT_IMAGE_2_IMAGE_SIZES.includes(size)) return true;
+		const edges = parseSizeEdges(size);
+		return edges !== null && satisfiesGptImage2Constraints(edges);
+	}
+	return OPENAI_GPT_IMAGE_1_IMAGE_SIZES.includes(size);
+}
 var OpenAIImageService = class extends AIImageService {
 	async generate(prompt, options) {
 		const openai = new OpenAI({
@@ -33006,16 +33900,11 @@ var OpenAIImageService = class extends AIImageService {
 				}
 				if (isGPTImage2Model(options.model)) {
 					if (openaiOptions.size && openaiOptions.size !== "auto") {
-						const [w, h] = openaiOptions.size.split("x").map(Number);
-						if (w && h) {
-							const maxEdge = Math.max(w, h);
-							const minEdge = Math.min(w, h);
-							const totalPixels = w * h;
-							if (maxEdge > 3840 || w % 16 !== 0 || h % 16 !== 0 || maxEdge / minEdge > 3 || totalPixels < 655360 || totalPixels > 8294400) {
-								const originalSize = openaiOptions.size;
-								openaiOptions.size = "1024x1024";
-								parameterWarnings.push(`Size '${originalSize}' violates gpt-image-2 constraints, changed to '1024x1024'`);
-							}
+						const edges = parseSizeEdges(openaiOptions.size);
+						if (edges && !satisfiesGptImage2Constraints(edges)) {
+							const originalSize = openaiOptions.size;
+							openaiOptions.size = "1024x1024";
+							parameterWarnings.push(`Size '${originalSize}' violates gpt-image-2 constraints, changed to '1024x1024'`);
 						}
 					} else if (!openaiOptions.size) openaiOptions.size = "auto";
 				} else {
@@ -33068,6 +33957,10 @@ var OpenAIImageService = class extends AIImageService {
 				const imageFile = new File([pngBuffer], "image.png", { type: "image/png" });
 				if (isGPTImageModel(options.model)) {
 					const editModel = options.model || ImageModels.GPT_IMAGE_2;
+					this.logger.log("OpenAI image generation request (edit endpoint, image-to-image):", {
+						model: editModel,
+						prompt: truncatePromptForLog(prompt)
+					});
 					result = await openai.images.edit({
 						model: editModel,
 						image: [imageFile],
@@ -33075,20 +33968,31 @@ var OpenAIImageService = class extends AIImageService {
 					});
 				} else {
 					const { style, quality, model, ...opts } = openaiOptions;
+					const variationSize = [
+						"256x256",
+						"512x512",
+						"1024x1024"
+					].find((s) => s === openaiOptions.size);
+					this.logger.log("OpenAI image generation request (variation endpoint):", {
+						...opts,
+						size: variationSize
+					});
 					result = await openai.images.createVariation({
 						...opts,
 						image: imageFile,
-						size: [
-							"256x256",
-							"512x512",
-							"1024x1024"
-						].find((s) => s === openaiOptions.size)
+						size: variationSize
 					});
 				}
-			} else result = await openai.images.generate({
-				prompt,
-				...openaiOptions
-			});
+			} else {
+				this.logger.log("OpenAI image generation request:", {
+					prompt: truncatePromptForLog(prompt),
+					...openaiOptions
+				});
+				result = await openai.images.generate({
+					prompt,
+					...openaiOptions
+				});
+			}
 			images = this.imageResponseToUrl(result);
 			return images;
 		} catch (error) {
@@ -33145,10 +34049,21 @@ var OpenAIImageService = class extends AIImageService {
 				Logger.globalInstance.debug(`[DEBUG] ⚠️ Edit endpoint doesn't support ${model}, defaulting to gpt-image-2`);
 				editModel = ImageModels.GPT_IMAGE_2;
 			}
+			const forwardSize = isSupportedEditSize(editModel, size);
+			this.logger.log("OpenAI image edit request:", {
+				model: editModel,
+				prompt: truncatePromptForLog(prompt),
+				hasMask: !!maskFile,
+				n,
+				size,
+				response_format
+			});
 			const response = await openai.images.edit(isGPTImageModel(editModel) ? {
 				model: editModel,
 				image: [imageFile],
-				prompt
+				prompt,
+				...forwardSize ? { size } : {},
+				...maskFile ? { mask: maskFile } : {}
 			} : {
 				model: editModel,
 				image: imageFile,
@@ -35175,6 +36090,21 @@ var TiktokenTokenizer = class {
 		return Array.from(encoder.encode_ordinary(text));
 	}
 	/**
+	* Decode token ids back to text through the same encoder encodeTokens used, so an
+	* encode -> slice -> decode round trip yields real text rather than the ids themselves.
+	* @param tokens - Token ids, typically a slice of an encodeTokens result
+	* @param modelId - Model ID to determine encoding (must match the one used to encode)
+	* @returns Promise<string> - The decoded text
+	*
+	* tiktoken's wasm decode() hands back raw UTF-8 bytes. A slice that ends mid-character therefore
+	* decodes to a trailing U+FFFD; callers that sliced are expected to trim it.
+	*/
+	async decodeTokens(tokens, modelId, logger) {
+		if (this.isShuttingDown) throw new Error("TiktokenTokenizer is shutting down");
+		const encoder = await this.getEncoder(modelId, logger);
+		return new TextDecoder().decode(encoder.decode(new Uint32Array(tokens)));
+	}
+	/**
 	* Returns a lightweight ITokenizer proxy that delegates WASM encoder operations
 	* to this instance (preserving the shared encoder cache) but routes log output
 	* through the provided logger. Useful for attaching per-request context (e.g.
@@ -35183,7 +36113,8 @@ var TiktokenTokenizer = class {
 	withLogger(logger) {
 		return {
 			countTokens: (text, modelId) => this.countTokens(text, modelId, logger),
-			encodeTokens: (text, modelId) => this.encodeTokens(text, modelId, logger)
+			encodeTokens: (text, modelId) => this.encodeTokens(text, modelId, logger),
+			decodeTokens: (tokens, modelId) => this.decodeTokens(tokens, modelId, logger)
 		};
 	}
 	/**
@@ -35643,6 +36574,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	BaseStorage: () => BaseStorage,
 	BedrockEmbeddingService: () => BedrockEmbeddingService,
 	CONTENT_TYPE_BY_FORMAT: () => CONTENT_TYPE_BY_FORMAT,
+	COSINE_SEARCH_TOP_K: () => 10,
 	CacheKeys: () => CacheKeys,
 	ChunkSchema: () => ChunkSchema,
 	CircuitBreaker: () => CircuitBreaker,
@@ -35737,6 +36669,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	checkStorageLimit: () => checkStorageLimit,
 	checkStorageLimitForFile: () => checkStorageLimitForFile,
 	cleanMermaidSyntax: () => cleanMermaidSyntax,
+	computeContentHash: () => computeContentHash,
 	computeCosineSimilarity: () => computeCosineSimilarity,
 	computeVerbatimTokenBudget: () => computeVerbatimTokenBudget,
 	convertCodeBlocksToArtifacts: () => convertCodeBlocksToArtifacts,
@@ -35808,6 +36741,7 @@ __reExport(/* @__PURE__ */ __exportAll({
 	registerLambdaErrorHandlers: () => registerLambdaErrorHandlers,
 	registerProcessErrorHandlers: () => registerProcessErrorHandlers,
 	registrableDomain: () => registrableDomain,
+	reservationOutputTokens: () => reservationOutputTokens,
 	resolveEmbeddingConfig: () => resolveEmbeddingConfig,
 	resolveSupportedMimeType: () => resolveSupportedMimeType,
 	safeInputWindow: () => safeInputWindow,