@bike4mind/cli 1.0.0 → 1.1.0

package/dist/{AgentHistoryStore-CrRb8cMt.mjs → AgentHistoryStore-kT9eNMRO.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as SupportedFabFileMimeTypes, A as HTTPError, At as isModelDeprecated, B as OPENAI_GPT_IMAGE_1_IMAGE_SIZES, Bt as parseEmbeddingRateLimitHeaders, Ct as isGPTImage2Model, D as FIXED_TEMPERATURE_MODELS, Dt as isImageServeable, E as FIELD_GROUP_OF, Et as isImageAttachment, F as MODEL_INFO_FIELD_GROUP_OF, Ft as isUnlimitedHistory, G as PermissionDeniedError, Gt as toModelInfo, H as OllamaEmbeddingModel, Ht as resolveHistoryFetchLimit, I as McpServerName, It as isUserInitiatedAbort, J as REFUSAL_FALLBACK_MODELS, Jt as usdToCreditsStochastic, K as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Kt as toModelRecord, L as ModelBackend, Lt as isZodError, M as IMAGE_SIZE_CONSTRAINTS, Mt as isRenderableModelType, N as ImageModels, Nt as isRetryableError, O as FORMAT_PROMPT_TEMPLATE, Ot as isMediaModelType, P as InternalServerError, Pt as isSupportedFabFileMimeType, Q as SpeechToTextModels, R as NO_TEMPERATURE_MODELS, Rt as mapMimeTypeToArtifactType, S as CorruptedFileError, St as isFieldGroup, Tt as isGeminiModelId, U as OpenAIEmbeddingModel, Ut as secureParameters, V as OPENAI_GPT_IMAGE_2_IMAGE_SIZES, Vt as reservationOutputTokens, Wt as settingsMap, Y as RESPONSES_API_TOOL_MODELS, Yt as withRetry, _ as BadRequestError, _t as hasUsableLimits, at as VideoModels, bt as isChunkStalledFile, ct as applyModelPriceCatalog, dt as dayjsConfig_default, et as TTS_MAX_INPUT_CHARS, ft as defaultEmbeddingModelForEnv, g as BFL_SAFETY_TOLERANCE, gt as hasKeylessCloudEmbedder, h as BEDROCK_NO_PROMPT_CACHING_MODELS, ht as getRetryAfterMs, in as parseRateLimitHeaders, it as VIDEO_SIZE_CONSTRAINTS, j as HttpStatus, jt as isPlaceholderApiKey, k as ForbiddenError, kt as isModelAccessible, lt as calculateRetryDelay, m as ApiKeyType, mt as getQuestErrorCode, n as logger, nn as extractSnippetMeta, nt as UnauthorizedError, ot as VoyageAIEmbeddingModel, p as ARTIFACT_ATTRS_PATTERN, pt as getMcpProviderMetadata, q as REASONING_SUPPORTED_MODELS, qt as usdToCredits, rn as isNearLimit, rt as UnprocessableEntityError, st as WORK_ITEM_STATUSES, tn as buildRateLimitLogEntry, tt as TooManyRequestsError, ut as countCodePoints, v as BedrockEmbeddingModel, vt as isAudioMimeType, w as DEFAULT_UNKNOWN_CONTEXT_WINDOW, wt as isGPTImageModel, x as ChatModels, y as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, yt as isChunkRebuildPending, z as NotFoundError, zt as obfuscateApiKey } from "./ConfigStore-DHNgFdOu.mjs";
-import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-D8tjkQXE-1HwvsuYT.mjs";
+import { $ as RESPONSES_API_TOOL_MODELS, $t as secureParameters, A as DEFAULT_UNKNOWN_CONTEXT_WINDOW, At as isGPTImage2Model, B as InternalServerError, Bt as isRetryableError, C as BadRequestError, Ct as hasUsableLimits, D as ChatModels, Dt as isChunkStalledFile, Et as isChunkRebuildPending, F as ForbiddenError, Ft as isMediaModelType, G as NotFoundError, Gt as isZodError, H as McpServerName, Ht as isSupportedImageSize, I as HTTPError, It as isModelAccessible, Jt as parseEmbeddingRateLimitHeaders, K as OllamaEmbeddingModel, Kt as mapMimeTypeToArtifactType, L as HttpStatus, Lt as isModelDeprecated, M as FIELD_GROUP_OF, Mt as isGeminiModelId, N as FIXED_TEMPERATURE_MODELS, Nt as isImageAttachment, O as CorruptedFileError, P as FORMAT_PROMPT_TEMPLATE, Pt as isImageServeable, Q as REFUSAL_FALLBACK_MODELS, Qt as resolveHistoryFetchLimit, R as IMAGE_SIZE_CONSTRAINTS, Rt as isPlaceholderApiKey, S as BFL_SAFETY_TOLERANCE, St as hasKeylessCloudEmbedder, T as CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS, Tt as isBflUltraImageModel, U as ModelBackend, Ut as isUnlimitedHistory, V as MODEL_INFO_FIELD_GROUP_OF, Vt as isSupportedFabFileMimeType, W as NO_TEMPERATURE_MODELS, Wt as isUserInitiatedAbort, X as REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS, Xt as reservationOutputTokens, Y as PermissionDeniedError, Yt as readZipEntryBounded, Z as REASONING_SUPPORTED_MODELS, Zt as resolveGptImageGenerateSize, _t as defaultEmbeddingModelForEnv, a as canTrustTool, an as usdToCreditsStochastic, at as TooManyRequestsError, b as AudioMimeType, bt as getQuestErrorCode, ct as VIDEO_SIZE_CONSTRAINTS, dt as WORK_ITEM_STATUSES, en as settingsMap, fn as buildRateLimitLogEntry, ft as applyModelPriceCatalog, gt as dayjsConfig_default, hn as parseRateLimitHeaders, ht as countCodePoints, i as loadContextFiles, in as usdToCredits, it as TTS_MAX_INPUT_CHARS, jt as isGPTImageModel, kt as isFieldGroup, lt as VideoModels, mn as isNearLimit, mt as capForParse, n as logger, nn as toModelRecord, nt as SpeechToTextModels, o as getToolCategory, on as withRetry, ot as UnauthorizedError, pn as extractSnippetMeta, pt as calculateRetryDelay, q as OpenAIEmbeddingModel, qt as obfuscateApiKey, rn as toNonWebpOutputFormat, rt as SupportedFabFileMimeTypes, s as isReadOnlyTool, st as UnprocessableEntityError, tn as toModelInfo, ut as VoyageAIEmbeddingModel, v as ARTIFACT_ATTRS_PATTERN, vt as fallbackImageSize, w as BedrockEmbeddingModel, wt as isAudioMimeType, x as BEDROCK_NO_PROMPT_CACHING_MODELS, xt as getRetryAfterMs, y as ApiKeyType, yt as getMcpProviderMetadata, z as ImageModels, zt as isRenderableModelType } from "./ConfigStore-DdHHCH2t.mjs";
+import { n as isPathAllowed, t as assertPathAllowed } from "./pathValidation-BRqf4HFX-CHwtwp3O.mjs";
 import { n as isTerminalShellStatus, t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
 import { execFile, execFileSync, spawn } from "child_process";
 import { createHash, randomBytes } from "crypto";
-import fs, { existsSync, promises, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
+import fs, { existsSync, promises, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
 import os, { homedir } from "os";
 import path, { dirname, join } from "path";
 import { v4 } from "uuid";
@@ -50,7 +50,6 @@ import { diffLines } from "diff";
 import fs$1, { mkdir, readFile, stat, writeFile } from "fs/promises";
 import matter from "gray-matter";
 import { parse } from "shell-quote";
-import { homedir as homedir$1 } from "node:os";
 import { EventEmitter } from "events";
 import { CloudWatchClient, PutMetricDataCommand, StandardUnit } from "@aws-sdk/client-cloudwatch";
 import { fileURLToPath } from "url";
@@ -67,7 +66,6 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { getDomain } from "tldts";
 import * as dotenv from "dotenv";
 import { createHash as createHash$1 } from "node:crypto";
-import invert from "lodash/invert.js";
 import * as util from "node:util";
 import * as zlib from "node:zlib";
 import { SQSClient, SendMessageCommand } from "@aws-sdk/client-sqs";
@@ -165,7 +163,7 @@ function crawlDirectory(projectRoot, maxDepth = 10, maxFiles = 2e4, ig) {
 /**
 * Format file size to human readable format
 */
-function formatFileSize$1(bytes) {
+function formatFileSize(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)} KB`;
 	if (bytes < 1073741824) return `${(bytes / 1048576).toFixed(1)} MB`;
@@ -429,17 +427,17 @@ const COMMANDS = [
 	},
 	{
 		name: "trust",
-		description: "Trust a tool (won't ask permission again)",
-		args: "<tool-name>"
+		description: "Trust a tool, or `folder` to trust this project's repo config/agents/skills/MCP",
+		args: "<tool-name|folder>"
 	},
 	{
 		name: "untrust",
-		description: "Remove tool from trusted list",
-		args: "<tool-name>"
+		description: "Remove a tool from the trusted list, or `folder` to revoke project trust",
+		args: "<tool-name|folder>"
 	},
 	{
 		name: "trusted",
-		description: "List all trusted tools"
+		description: "Show folder-trust status and list all trusted tools"
 	},
 	{
 		name: "usage",
@@ -675,142 +673,6 @@ function searchCommands(query, commands = COMMANDS) {
 	return new Fuse(commands, fuseOptions).search(query).map((result) => result.item);
 }
 //#endregion
-//#region src/utils/constants.ts
-/**
-* Common human name suffixes that should NOT trigger file autocomplete
-* Examples: @john.jr, @mary.phd, @bob.iii
-*/
-const NAME_SUFFIXES = [
-	"jr",
-	"sr",
-	"ii",
-	"iii",
-	"iv",
-	"v",
-	"phd",
-	"md",
-	"esq"
-];
-/**
-* Type-safe check if a string is a name suffix
-*/
-function isNameSuffix(value) {
-	return NAME_SUFFIXES.includes(value);
-}
-//#endregion
-//#region src/utils/processFileReferences.ts
-/**
-* Regular expression to match @path references
-* Matches @ followed by a path-like string (not containing spaces)
-* Only matches @ at start of string or after whitespace
-*/
-const FILE_REFERENCE_REGEX = /(?:^|\s)@([^\s@]+)/g;
-/**
-* Check if a string looks like a file path (not an email or username)
-* A file path contains / or . (file extension) at the end
-*/
-function looksLikeFilePath(ref) {
-	if (ref.includes("/") || ref.includes(path$1.sep)) return true;
-	const extensionMatch = /\.(\w+)$/.exec(ref);
-	if (extensionMatch) {
-		const ext = extensionMatch[1].toLowerCase();
-		if (isNameSuffix(ext)) return false;
-		if (ext.length > 10) return false;
-		return true;
-	}
-	return false;
-}
-/**
-* Extract all file references from a message
-* Only treats @reference as a file if it looks like a path (contains / or has file extension)
-*/
-function extractFileReferences(message) {
-	const references = [];
-	FILE_REFERENCE_REGEX.lastIndex = 0;
-	let match;
-	while ((match = FILE_REFERENCE_REGEX.exec(message)) !== null) {
-		const ref = match[1];
-		if (looksLikeFilePath(ref)) references.push(ref);
-	}
-	return references;
-}
-/**
-* Read file contents safely
-*/
-function readFileContents(filePath) {
-	const cwd = process.cwd();
-	const isAbsolutePath = path$1.isAbsolute(filePath);
-	if (filePath.includes("..")) return { error: `Security: Path traversal detected in "${filePath}"` };
-	const absolutePath = isAbsolutePath ? path$1.normalize(filePath) : path$1.resolve(cwd, filePath);
-	if (!isAbsolutePath && !isPathWithinCwd(filePath)) return { error: `Security: Relative path "${filePath}" escapes the current working directory` };
-	if (!fs$2.existsSync(absolutePath)) return { error: `File not found: "${filePath}"` };
-	const stats = fs$2.statSync(absolutePath);
-	if (stats.isDirectory()) try {
-		return {
-			content: `(Directory with ${fs$2.readdirSync(absolutePath).length} items. Use file tools to explore if needed.)`,
-			size: 0
-		};
-	} catch (err) {
-		return { error: `Cannot read directory "${filePath}": ${err instanceof Error ? err.message : "Unknown error"}` };
-	}
-	if (stats.size > 10485760) return { error: `File too large: "${filePath}" is ${formatFileSize$1(stats.size)} (max ${formatFileSize$1(MAX_FILE_SIZE$4)})` };
-	if (isBinaryFile(filePath)) return { error: `Binary file: "${filePath}" cannot be included as text content` };
-	try {
-		return {
-			content: fs$2.readFileSync(absolutePath, "utf-8"),
-			size: stats.size
-		};
-	} catch (err) {
-		return { error: `Cannot read file "${filePath}": ${err instanceof Error ? err.message : "Unknown error"}` };
-	}
-}
-/**
-* Format file content block for injection
-*/
-function formatFileBlock(filePath, content, size, isDirectory) {
-	if (isDirectory) return `
---- Directory Reference: ${filePath} ---
-${content}
---- End of ${filePath} ---`;
-	return `
---- Referenced File: ${filePath} (${formatFileSize$1(size)}) ---
-${content}
---- End of ${filePath} ---`;
-}
-/**
-* Process file references in a message
-* Extracts @path references and injects file contents
-*/
-async function processFileReferences(message) {
-	const references = extractFileReferences(message);
-	const errors = [];
-	const fileBlocks = [];
-	for (const ref of references) {
-		const result = readFileContents(ref);
-		if ("error" in result) {
-			errors.push(result.error);
-			continue;
-		}
-		const isDirectory = result.size === 0 && result.content.startsWith("(Directory");
-		fileBlocks.push(formatFileBlock(ref, result.content, result.size, isDirectory));
-	}
-	if (fileBlocks.length === 0) return {
-		content: message,
-		errors
-	};
-	return {
-		content: message + "\n" + fileBlocks.join("\n"),
-		errors
-	};
-}
-/**
-* Check if a message contains any file references
-*/
-function hasFileReferences(message) {
-	FILE_REFERENCE_REGEX.lastIndex = 0;
-	return FILE_REFERENCE_REGEX.test(message);
-}
-//#endregion
 //#region ../../b4m-core/services/dist/rolldown-runtime-BBjsoOtd.mjs
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
@@ -992,7 +854,10 @@ const getEffectiveLLMApiKeys = async (userId, adapters, options) => {
 		"voyageApiKey",
 		"ollamaBackend",
 		"EnableOllama"
-	], { adminSettings: db.adminSettings }, { logger })]);
+	], { adminSettings: db.adminSettings }, {
+		logger,
+		skipCache: options?.skipCache
+	})]);
 	const userKeyMap = /* @__PURE__ */ new Map();
 	userApiKeys.forEach((key) => userKeyMap.set(key.type, key));
 	const openaiUserKey = userKeyMap.get(ApiKeyType.openai) || null;
@@ -1128,26 +993,71 @@ var Logger = class Logger {
 	shouldLog(level) {
 		return Logger.LOG_LEVELS[level] >= Logger.LOG_LEVELS[this.minLevel];
 	}
+	static errorReplacer(_key, value) {
+		if (value instanceof Error) return {
+			...value,
+			name: value.name,
+			message: value.message,
+			stack: value.stack
+		};
+		return value;
+	}
 	/**
 	* Safely stringify a value, handling circular references
 	*/
 	safeStringify(value, indent) {
 		try {
-			return JSON.stringify(value, null, indent);
+			return JSON.stringify(value, Logger.errorReplacer, indent);
 		} catch {
 			return "[Circular]";
 		}
 	}
 	/**
-	* Parse log arguments to extract message and optional metadata
+	* An object carrying structured fields, as opposed to a message part
+	* (Errors and arrays stay in the message so their shape survives).
+	*/
+	isMetadataArg(value) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+		try {
+			return !(value instanceof Error);
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Leading-position metadata is held to a stricter bar than trailing: a class
+	* instance (Date, Map, ...) spreads to `{}` in output(), so lifting one out of
+	* the message would erase it rather than structure it.
+	*/
+	isPlainObject(value) {
+		if (!this.isMetadataArg(value)) return false;
+		try {
+			const proto = Object.getPrototypeOf(value);
+			return proto === Object.prototype || proto === null;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Parse log arguments to extract message and optional metadata.
+	* Metadata may be the last argument (`msg, meta`) or, pino-style, the first
+	* (`meta, msg`); a trailing object wins when a call supplies both.
 	*/
 	parseArgs(args, errorAware = false) {
 		if (args.length === 0) return { message: "" };
+		let metadata;
+		let messageArgs = args;
 		const lastArg = args[args.length - 1];
-		const hasMetadata = args.length > 1 && typeof lastArg === "object" && lastArg !== null && !Array.isArray(lastArg) && !(lastArg instanceof Error);
-		const metadata = hasMetadata ? lastArg : void 0;
+		const firstArg = args[0];
+		if (args.length > 1 && this.isMetadataArg(lastArg)) {
+			metadata = lastArg;
+			messageArgs = args.slice(0, -1);
+		} else if (args.length > 1 && this.isPlainObject(firstArg) && args.slice(1).every((a) => a === null || typeof a !== "object")) {
+			metadata = firstArg;
+			messageArgs = args.slice(1);
+		}
 		return {
-			message: (hasMetadata ? args.slice(0, -1) : args).map((a) => {
+			message: messageArgs.map((a) => {
 				if (errorAware && a instanceof Error) return a.stack || a.message;
 				return typeof a === "string" ? a : this.safeStringify(a);
 			}).join(" "),
@@ -1540,8 +1450,8 @@ const headerOrNull = (httpResponse, name) => {
 };
 /**
 * The ceilings `generateEmbeddingBatch` splits on, at module scope and exported because a cost
-* PREFLIGHT has to model the same split before it spends (packages/scripts/retrieval/capturePlan.ts).
-* A second copy of these numbers in a script cannot track a provider change.
+* PREFLIGHT has to model the same split before it spends. A second copy of these numbers in a
+* script cannot track a provider change.
 */
 const OPENAI_MAX_INPUTS_PER_REQUEST = 2048;
 const OPENAI_MAX_TOKENS_PER_INPUT = 8192;
@@ -2223,13 +2133,12 @@ function resolveEmbeddingConfig(provider, keyTable) {
 * admin setting. A caller that must hit one specific vector space MUST keep using
 * `resolveEmbeddingConfig` and fail, because a fallback there would silently compare or write
 * across incompatible spaces:
-*   - V2 mementos are pinned to MEMENTO_EMBEDDING_MODEL at 512 truncated dims (see embedding.ts);
-*   - V1 mementos (mementoEmbedding.ts, getRelevantMementos.ts) read the admin default and so LOOK
-*     free to choose, but neither live write path stamps `Memento.embeddingModel` - only the
-*     reembedMementos backfill does. Their vectors are ranked by in-process cosine with no width
-*     guard and no Atlas index, so a substitution here would drop 1024-dim vectors into a field
-*     holding 1536-dim ones with nothing recording which is which, and nothing able to tell them
-*     apart afterwards. Stamping V1 is the prerequisite for including it, not this helper.
+*   - V1 and V2 mementos are BOTH now pinned to MEMENTO_EMBEDDING_MODEL at 512 truncated dims (see
+*     mementoEmbedding.ts, getRelevantMementos.ts, embedding.ts) - V1 used to read the admin default
+*     instead, which is exactly the substitution this bullet warns against, so this helper must
+*     never be reintroduced on that path. Their vectors are ranked by in-process cosine with no
+*     width guard and no Atlas index, so nothing here would catch a wrong-space substitution before
+*     it silently corrupted the comparison.
 *   - alternateModelAnn embeds one query per model bucket to match each chunk's recorded stamp.
 *
 * Returns the model actually used, so callers stamp what they embedded with rather than what they
@@ -2259,6 +2168,49 @@ function resolveEmbeddingWithKeylessFallback(model, keyTable) {
 		model: BedrockEmbeddingModel.TITAN_TEXT_EMBEDDINGS_V2
 	};
 }
+/**
+* Bounds on PPTX zip extraction. A .pptx is a zip; a crafted one can pack far more slide
+* entries than any real deck, and each entry can inflate ~1000x when decompressed (zip-bomb
+* shape). The slide-count and per-entry caps bound each item, but an attacker controls their
+* PRODUCT, so two aggregate budgets bound the extraction as a whole:
+*
+* - MAX_PPTX_TOTAL_XML_BYTES caps the decompression one upload can drive, letting the per-item
+*   numbers stay generous. 32 MB is ~1,000 slides of real slide XML, which runs tens of KB per
+*   slide (media lives in separate zip entries).
+* - MAX_PPTX_TEXT_CHARS caps the extracted text accumulated across slides. This is NOT implied by
+*   the XML budget: tiktoken traps on a string of that size, so `fullText` has to be bounded on
+*   its own before chunkText tokenizes it. 2M characters is ~500k tokens, orders of magnitude past
+*   any real deck.
+*
+* Crossing either stops the walk with a warning rather than failing the file, so a deck that is
+* merely huge still contributes everything read up to that point.
+*/
+const MAX_PPTX_SLIDES = 5e3;
+const MAX_SLIDE_XML_BYTES = 16777216;
+const MAX_PPTX_TOTAL_XML_BYTES = 33554432;
+const MAX_PPTX_TEXT_CHARS = 2e6;
+const RUN_OPEN_TAG_RE = /<a:t(?:\s[^>]*)?>/g;
+const extractSlideRunTexts = (xml) => {
+	const CLOSE = "</a:t>";
+	const texts = [];
+	let cursor = 0;
+	while (cursor < xml.length) {
+		const open = xml.indexOf("<a:t", cursor);
+		if (open === -1 || open + 4 >= xml.length) break;
+		const afterName = xml[open + 4];
+		if (afterName !== ">" && !/\s/.test(afterName)) {
+			cursor = open + 4;
+			continue;
+		}
+		const openEnd = xml.indexOf(">", open + 4);
+		if (openEnd === -1) break;
+		const close = xml.indexOf(CLOSE, openEnd + 1);
+		if (close === -1) break;
+		texts.push(xml.slice(openEnd + 1, close).replace(RUN_OPEN_TAG_RE, ""));
+		cursor = close + 6;
+	}
+	return texts;
+};
 const ChunkSchema = z$1.object({
 	text: z$1.string(),
 	tokenCount: z$1.number()
@@ -2600,14 +2552,38 @@ var SmartChunker = class {
 	}
 	async chunkPPTX(content) {
 		const zip = await JSZip.loadAsync(content);
-		const slidePaths = Object.keys(zip.files).filter((p) => /^ppt\/slides\/slide\d+\.xml$/.test(p)).sort((a, b) => {
+		const allSlidePaths = Object.keys(zip.files).filter((p) => /^ppt\/slides\/slide\d+\.xml$/.test(p)).sort((a, b) => {
 			return parseInt(a.match(/slide(\d+)\.xml$/)?.[1] ?? "0", 10) - parseInt(b.match(/slide(\d+)\.xml$/)?.[1] ?? "0", 10);
 		});
+		const slidePaths = allSlidePaths.slice(0, MAX_PPTX_SLIDES);
+		if (allSlidePaths.length > slidePaths.length) this.logger.warn(`PPTX declares ${allSlidePaths.length} slides; only the first ${MAX_PPTX_SLIDES} are chunked`);
 		const decodeXmlEntities = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
 		const slideTexts = [];
+		let totalXmlBytes = 0;
+		let totalTextChars = 0;
 		for (let i = 0; i < slidePaths.length; i++) {
-			const text = ((await zip.files[slidePaths[i]].async("string")).match(/<a:t(?:\s[^>]*)?>([\s\S]*?)<\/a:t>/g) ?? []).map((r) => decodeXmlEntities(r.replace(/<a:t(?:\s[^>]*)?>|<\/a:t>/g, ""))).join(" ").replace(/\s+/g, " ").trim();
-			if (text) slideTexts.push(`Slide ${i + 1}: ${text}`);
+			const entry = zip.files[slidePaths[i]];
+			const entryCap = Math.min(MAX_SLIDE_XML_BYTES, MAX_PPTX_TOTAL_XML_BYTES - totalXmlBytes);
+			const read = await readZipEntryBounded(entry, entryCap);
+			if (!read.ok) {
+				if (entryCap < MAX_SLIDE_XML_BYTES) {
+					this.logger.warn(`PPTX slide XML exhausted the ${MAX_PPTX_TOTAL_XML_BYTES}-byte total budget at slide ${i + 1}; remaining slides are not chunked`);
+					break;
+				}
+				this.logger.warn(`Skipping oversized PPTX slide ${i + 1} (over ${MAX_SLIDE_XML_BYTES} bytes decompressed)`);
+				continue;
+			}
+			totalXmlBytes += read.byteLength;
+			const text = extractSlideRunTexts(read.text).map((r) => decodeXmlEntities(r)).join(" ").replace(/\s+/g, " ").trim();
+			if (text) {
+				const kept = text.slice(0, MAX_PPTX_TEXT_CHARS - totalTextChars);
+				slideTexts.push(`Slide ${i + 1}: ${kept}`);
+				totalTextChars += kept.length;
+				if (totalTextChars >= MAX_PPTX_TEXT_CHARS) {
+					this.logger.warn(`PPTX extracted text reached the ${MAX_PPTX_TEXT_CHARS}-character cap at slide ${i + 1}; remaining slides are not chunked`);
+					break;
+				}
+			}
 		}
 		const fullText = slideTexts.join("\n\n");
 		if (!fullText.trim()) {
@@ -3379,12 +3355,321 @@ async function fetchWithoutRedirects(url, timeoutMs) {
 }
 const BLOCK_LEVEL_SELECTOR = `*:not(${"a, span, em, strong, b, i, u, code, kbd, samp, var, sub, sup, small, abbr, cite, q, time, mark, s, del, ins, bdi, bdo, wbr, ruby, rt, rp".split(", ").join("):not(")}):not(td):not(th)`;
 /**
+* Elements that carry UI rather than prose, removed before extraction.
+*
+* Two principles only, deliberately narrow - `nav`/`header`/`footer`/`aside` are NOT here, because
+* pages do put real content in the last two and a full boilerplate pass is a different job:
+*  - `aria-hidden`/`hidden`: the page itself says this is not content to be read. That is what
+*    catches the duplicated tooltip labels modern doc sites render next to every icon button
+*    ("Collapse sidebar", "Search or ask Copilot"), which are plain `<span>`s with no other signal.
+*  - interactive controls, native or via the equivalent ARIA role: a control's label is an
+*    instruction to the reader, not part of the document.
+*/
+const NON_CONTENT_SELECTOR = [
+	"[aria-hidden=\"true\"]",
+	"[hidden]",
+	"button",
+	"input",
+	"select",
+	"textarea",
+	"option",
+	"optgroup",
+	"datalist",
+	"label",
+	"dialog",
+	"template",
+	"svg",
+	"[role=\"button\"]",
+	"[role=\"search\"]",
+	"[role=\"searchbox\"]",
+	"[role=\"combobox\"]",
+	"[role=\"listbox\"]",
+	"[role=\"menu\"]",
+	"[role=\"menubar\"]",
+	"[role=\"tablist\"]",
+	"[role=\"toolbar\"]",
+	"[role=\"dialog\"]",
+	"[role=\"alertdialog\"]",
+	"[role=\"tooltip\"]",
+	"[role=\"radiogroup\"]"
+].join(", ");
+/**
+* What counts as a control when judging a control strip. Broader than `NON_CONTENT_SELECTOR`,
+* because a link is content in prose but a control in a nav bar - `a[href]` is the only reason the
+* strip rule can see an unmarked `<div>` of nav links as chrome at all.
+*/
+const CONTROL_SELECTOR = "a[href], button, input, select, textarea, summary, [role=\"button\"], [role=\"link\"], [role=\"tab\"], [role=\"menuitem\"], [role=\"option\"], [role=\"checkbox\"], [role=\"radio\"], [role=\"switch\"]";
+/**
+* Containers a control strip can be. Headings and `<p>` are excluded: `<h2><a>Title</a></h2>` is
+* content. `<table>`/`<tbody>`/`<tr>` and `<li>` are excluded too: a row of short linked cells is
+* how an ordinary reference table looks, never a nav bar, and a list is judged at the `<ul>`/`<ol>`
+* level as a whole rather than letting one busy `<li>` speak for it.
+*/
+const STRIP_CONTAINER_SELECTOR = "div, span, ul, ol, nav, header, footer, aside, section, form";
+/**
+* Ancestor tags that mark "this element sits inside running prose", not "this element is a
+* standalone block". A `span` wrapping two inline links in the middle of a sentence looks
+* structurally identical to a toolbar to `isControlStrip` - same tag, same two-control shape - but
+* removing it deletes words out of a sentence rather than a block of chrome, which reads as fluent,
+* complete prose with a fact silently missing. A strip candidate found inside one of these is
+* declined outright, before `isControlStrip` ever runs, since content ancestry is a stronger signal
+* than anything the candidate's own subtree can show.
+*/
+const PROSE_ANCESTOR_SELECTOR = "p, h1, h2, h3, h4, h5, h6, li, dt, dd, blockquote, figcaption, caption";
+/**
+* Minimum controls for a `<ul>`/`<ol>` candidate specifically - higher than the general
+* `MIN_STRIP_CONTROLS` below. A bare two-item list is exactly as likely to be two related content
+* links (a "see also" pair) as it is a nav, and unlike a `<nav>`/`<header>`/`<footer>` landmark - which
+* already declares itself as chrome by tag - a plain `<ul>` carries no such signal. Landmark tags and
+* `<div>`/`<span>` keep the lower threshold: a two-item breadcrumb or tab strip ("Home / Docs") is
+* common and short by nature.
+*/
+const MIN_LIST_STRIP_CONTROLS = 3;
+/**
+* Minimum controls for any other strip candidate (`div`, `span`, `nav`, `header`, `footer`, `aside`,
+* `section`, `form`) - what keeps `<div><a>An article title</a></div>` on a card, a single link
+* card being indistinguishable in shape from a one-item nav. `<li>` is not itself a
+* `STRIP_CONTAINER_SELECTOR` tag, so a list item is never a candidate this constant adjudicates at
+* all; a list is judged as a whole at the `<ul>`/`<ol>` level via `MIN_LIST_STRIP_CONTROLS` instead.
+*/
+const MIN_STRIP_CONTROLS = 2;
+/**
+* Longest a single control's label may be before the group stops looking like a control strip.
+* Nav items, tabs and toolbar buttons are a word or three; anything longer is prose in a link.
+*/
+const MAX_CONTROL_LABEL_CHARS = 40;
+/**
+* How much non-control text a strip candidate may still carry before it stops looking like chrome.
+* Requiring exactly zero (the previous rule) let a single stray word - a wordmark, a version
+* string, a bare "Menu" - defeat the whole strip and leak the nav into stored content. Budgeted
+* small and absolute, at wordmark scale rather than sentence scale.
+*
+* Only granted to a candidate matching `LANDMARK_CHROME_SELECTOR` - see there for why a `div`/
+* `span`/`section` candidate does not get this budget at all.
+*/
+const MAX_NON_CONTROL_TEXT_CHARS = 15;
+/**
+* Tags and roles that self-declare as chrome regardless of what they contain - the only
+* candidates `MAX_NON_CONTROL_TEXT_CHARS`'s wordmark-scale budget applies to. A `div`/`span`/
+* `section`/`ul`/`ol`/`form` carries no such signal and is exactly where a CMS renders a short,
+* genuine callout ("Related: <a>X</a> and <a>Y</a>."): granting it the same budget let a
+* self-contained sentence-plus-links block clear `isControlStrip` on its own short lead-in text
+* and get deleted whole, with nothing downstream able to tell it happened. Those tags instead
+* fall back to requiring non-control text be separator punctuation only (see `isControlStrip`),
+* same as every candidate did before this budget existed.
+*/
+const LANDMARK_CHROME_SELECTOR = "nav, header, footer, aside, [role=\"navigation\"], [role=\"banner\"], [role=\"contentinfo\"], [role=\"complementary\"], [role=\"search\"]";
+/**
+* How much of a container's nesting depth (from the document root, so a page with no `<main>`
+* and one that has it are budgeted the same way) the strip check will still climb to evaluate.
+* `isControlStrip` scans a candidate's ENTIRE subtree, so checking every container in a deeply
+* nested document is quadratic in nesting depth - and nesting is entirely up to whatever HTML the
+* fetched URL happens to return. Nesting past this depth stops being checked as a strip candidate
+* rather than being paid for on every level.
+*
+* Sized well clear of real layout nesting - the deepest control group measured live against
+* react.dev, tailwindcss.com and docs.github.com sits at 16 - but a control strip nested deeper
+* than this is a real, deliberate gap: it is never evaluated at all, at any depth from here to its
+* leaves, since every one of its descendants is at least as deep. Closing that gap properly needs
+* either a much higher cap (which reopens the cost problem this constant exists to bound) or
+* skipping only the expensive subtree scan while still descending past the cap - out of scope
+* here; see the boundary test pinning today's behavior instead of leaving it undocumented.
+*/
+const MAX_STRIP_CONTAINER_DEPTH = 32;
+/**
+* How much of the scope's own surviving text has to remain, after chrome pruning, before that
+* pruning is trusted. Below this, pruning is treated as having taken real content down with it -
+* see `pruneChromeFromScope`. Sized between a bare boilerplate remnant (a copyright line, a
+* "Further reading." label - fifteen to twenty characters) and a real one-sentence page ("The
+* chapter itself, in prose." - twenty-nine): short enough that a genuinely tiny real page still
+* survives, long enough that what a footer or a stray label leaves behind on its own doesn't.
+*
+* Known limitation: an absolute count cannot always tell a genuine short sentence from a
+* same-length piece of boilerplate (a copyright line can be as long as an intro sentence) - see
+* `pruneChromeFromScope` for why the alternative (weighing the bar against how much was removed)
+* was tried and reverted.
+*/
+const MIN_SURVIVING_CONTENT_CHARS = 20;
+const squash = (text) => text.replace(/\s+/g, " ").trim();
+/**
+* Nesting depth of `element` below `within`, walking parent pointers directly rather than through
+* cheerio's `.parents()` (which itself re-walks the chain with wrapper allocation at every step) -
+* this runs once per strip candidate, so it has to stay cheap even though `isControlStrip` itself
+* is not.
+*/
+function depthWithin(element, within) {
+	let depth = 0;
+	let current = element.parent;
+	while (current && current !== within) {
+		depth++;
+		current = current.parent;
+	}
+	return depth;
+}
+/**
+* True when `element` has an ancestor (below `boundary`, exclusive) that marks it as sitting inside
+* running prose rather than being a standalone block - see `PROSE_ANCESTOR_SELECTOR`. Walks parent
+* pointers directly for the same reason `depthWithin` does: this runs once per strip candidate.
+*/
+function hasProseAncestor($, element, boundary) {
+	let current = element.parent;
+	while (current && current !== boundary) {
+		if ($(current).is(PROSE_ANCESTOR_SELECTOR)) return true;
+		current = current.parent;
+	}
+	return false;
+}
+/**
+* True when `element` sits directly between two pieces of running text - a non-whitespace text
+* node as its immediately preceding or following sibling. That is the tag-agnostic version of
+* "this element sits inside running prose": `PROSE_ANCESTOR_SELECTOR` only protects a candidate
+* whose ANCESTOR is one of a fixed list of tags (`p`, headings, `li`, ...), so the same inline
+* `<span>` wrapping two links reads as protected prose inside a `<p>` but as a standalone chrome
+* candidate inside a `<div>`, `<section>` or `<td>` - none of which are prose landmarks, but all of
+* which routinely hold hand-written or CMS-rendered sentences. A text-node sibling is the
+* strongest tag-independent signal that removing `element` would leave a dangling sentence rather
+* than delete a block of chrome, regardless of what its parent is called.
+*/
+function hasAdjacentProseText(element) {
+	const node = element;
+	const isNonWhitespaceText = (sibling) => {
+		const candidate = sibling;
+		return !!candidate && candidate.type === "text" && squash(candidate.data ?? "").length > 0;
+	};
+	return isNonWhitespaceText(node.prev) || isNonWhitespaceText(node.next);
+}
+/**
+* True when an element is a group of adjacent controls with no prose of its own - a nav bar, a
+* breadcrumb row, a tab strip, a footer link column, a sandbox toolbar.
+*
+* Needs `MIN_LIST_STRIP_CONTROLS` for a `<ul>`/`<ol>` candidate and `MIN_STRIP_CONTROLS` otherwise -
+* see those constants for why the two differ. It also has to run BEFORE the controls themselves
+* are removed, or the evidence is gone: react.dev's `Fork` link only reads as chrome because the
+* `Reload` and `Clear` buttons share its toolbar.
+*
+* "No prose of its own" tolerates the punctuation sites use to separate items, so a `A | B | C`
+* nav still qualifies, and now also a small budget of non-separator text - see
+* `MAX_NON_CONTROL_TEXT_CHARS`.
+*/
+function isControlStrip($, element) {
+	const $element = $(element);
+	if (!squash($element.text())) return false;
+	const controls = $element.find(CONTROL_SELECTOR);
+	const isList = $element.is("ul, ol");
+	if (controls.length < (isList ? MIN_LIST_STRIP_CONTROLS : MIN_STRIP_CONTROLS)) return false;
+	for (const control of controls.toArray()) {
+		const label = squash($(control).text());
+		if (label.length > MAX_CONTROL_LABEL_CHARS || /[.!?]\s/.test(label)) return false;
+	}
+	const strippedOutsideControls = $element.clone().find(CONTROL_SELECTOR).remove().end().text().replace(/[\s|\u00b7\u2022/,:;-]+/g, "");
+	const budget = $element.is(LANDMARK_CHROME_SELECTOR) ? MAX_NON_CONTROL_TEXT_CHARS : 0;
+	return strippedOutsideControls.length <= budget;
+}
+/**
+* Removes control strips and non-content elements from `scope`, together, with ONE rollback
+* covering both.
+*
+* Both prunings are done via a placeholder swap rather than an outright `remove()`, so either can
+* be undone. They are decided together - not the strip rule with its own guard and the non-content
+* removal with none - because a subtree that is real content by itself can sit entirely inside a
+* `label`/`dialog`/`aria-hidden` wrapper (a client framework's whole-page aria-hidden mount, an
+* article rendered inside a `<dialog>`), and pruning each half separately let the second one erase
+* what the first had just decided to protect.
+*
+* The bar for trusting the prune is "enough of the scope's own text survives"
+* (`MIN_SURVIVING_CONTENT_CHARS`), not "any text survives at all": a page that is mostly a link
+* directory routinely carries a footer copyright line or a "Further reading." label alongside it,
+* and treating either as proof the prune was safe defeats the guard in exactly the case it exists
+* for. Below the bar, everything pruned in this call is restored.
+*
+* A fixed character count cannot fully replace judging whether surviving text is real content or
+* boilerplate (a copyright line and a short genuine sentence can be the same length) - that needs
+* the density/boilerplate pass this ticket explicitly scopes out. It is deliberately NOT relative
+* to how much was pruned either: a legitimate strip removal is very often far larger than the
+* genuine prose sitting next to it (a 40-item nav beside a one-sentence intro, or GitHub's own
+* aria-hidden tooltip spans beside a paragraph), so "survives >= removed" would roll back exactly
+* the pages this function exists to clean.
+*
+* Returns whether the prune was kept, so a caller working scope-by-scope (see `mainContentScope`)
+* knows whether THIS scope still has enough of its own content to be trusted at all.
+*/
+function pruneChromeFromScope($, scope) {
+	const documentRoot = $.root().get(0);
+	const strips = [];
+	scope.find(STRIP_CONTAINER_SELECTOR).each((_index, element) => {
+		if (strips.some((strip) => $.contains(strip, element))) return;
+		if (documentRoot && depthWithin(element, documentRoot) > MAX_STRIP_CONTAINER_DEPTH) return;
+		if (documentRoot && hasProseAncestor($, element, documentRoot)) return;
+		if (hasAdjacentProseText(element)) return;
+		if (isControlStrip($, element)) strips.push(element);
+	});
+	const stripPlaceholders = strips.map((strip) => {
+		const placeholder = $("<div></div>");
+		$(strip).replaceWith(placeholder);
+		return placeholder;
+	});
+	const nonContentEls = scope.find(NON_CONTENT_SELECTOR).toArray();
+	const nonContentPlaceholders = nonContentEls.map((element) => {
+		const placeholder = $("<div></div>");
+		$(element).replaceWith(placeholder);
+		return placeholder;
+	});
+	const survives = squash(scope.text()).length >= MIN_SURVIVING_CONTENT_CHARS;
+	if (survives) {
+		for (const placeholder of stripPlaceholders) placeholder.remove();
+		for (const placeholder of nonContentPlaceholders) placeholder.remove();
+	} else {
+		nonContentPlaceholders.forEach((placeholder, index) => placeholder.replaceWith(nonContentEls[index]));
+		stripPlaceholders.forEach((placeholder, index) => placeholder.replaceWith(strips[index]));
+	}
+	return survives;
+}
+/**
+* The scope to extract from: the document's own main-content landmark when it declares exactly one
+* AND still has enough of its own content once chrome pruning runs against it - otherwise the
+* whole document.
+*
+* This is the half of the fix that handles chrome with no other tell - a sticky sub-header of icon
+* buttons, a site footer carrying a survey and a privacy link. Trusting the page's own `<main>` also
+* answers the "real content in `<aside>`/`<footer>`" case for free, and better than a rule about
+* those tags could: an `<aside>` or `<footer>` INSIDE `main` is kept, one outside it is site chrome
+* by the page's own declaration. A document with no `main` keeps the previous whole-document scope.
+*
+* Checked twice, before AND after pruning. The first check (`main.text().trim()`) only rules out a
+* `<main>` that is LITERALLY empty - a client-rendered app shipping `<main></main>` with its real
+* content elsewhere. It does not rule out a `<main>` that is truthy for the wrong reason: a loading
+* placeholder ("Loading...") with the real article outside it, or a `<main>` whose only content IS
+* a nav bar, so pruning empties it and the real prose living outside `<main>` is never looked at.
+* The second check is `pruneChromeFromScope`'s own return value once it has actually run against
+* the candidate - if pruning leaves `<main>` without enough of its own text, `<main>` is abandoned
+* (its pruning already rolled back by that call) and the whole document is scanned instead, this
+* time seeing everything `<main>` would have hidden from it.
+*/
+function mainContentScope($) {
+	const main = $("main, [role=\"main\"]");
+	if (main.length === 1 && main.text().trim()) {
+		const scope = main;
+		if (pruneChromeFromScope($, scope)) return scope;
+	}
+	const root = $.root();
+	pruneChromeFromScope($, root);
+	return root;
+}
+/**
 * Extract readable text from the WHOLE document, not just `<p>` elements. The single collector
 * this replaced was `<p>`-only and fell back to the raw HTML when it found none: on a page whose
 * content isn't inside `<p>` (an RFC page using `<pre>`) that meant the fallback fired and stored
 * markup verbatim; on a page with real substance in headings, list items, table cells or code
 * blocks alongside its `<p>`s, that content was silently dropped.
 *
+* Because it reads the whole document, page chrome that the `<p>`-only collector dropped by
+* accident now has to be dropped on purpose, or nav bars, search widgets, cookie banners, footer
+* link columns and button labels get chunked and embedded alongside the article. Two rules do
+* that - see `isControlStrip` and `NON_CONTENT_SELECTOR` for why each one is shaped the way it is -
+* applied together by `mainContentScope` (via `pruneChromeFromScope`) against whichever scope it
+* settles on, with its own rollback if pruning went too far. The strip rule MUST run before the
+* control removal, since it recognises a strip by the controls in it.
+*
 * `head` (title/meta/script/style all live there, and the caller already reads `<title>`
 * separately) plus any stray `script`/`style`/`noscript` outside it are removed before extraction,
 * so none of that reaches what gets embedded. `<pre>` content is pulled out and stashed BEFORE the
@@ -3398,25 +3683,26 @@ const BLOCK_LEVEL_SELECTOR = `*:not(${"a, span, em, strong, b, i, u, code, kbd,
 */
 function extractReadableText($) {
 	$("head, script, style, noscript").remove();
-	$("br").replaceWith("\n");
+	const scope = mainContentScope($);
+	scope.find("br").replaceWith("\n");
 	const nonce = Math.random().toString(36).slice(2) + Date.now().toString(36);
 	const markerFor = (index) => `\uE000PRE${nonce}_${index}\uE000`;
 	const markerPattern = new RegExp(`\\uE000PRE${nonce}_(\\d+)\\uE000`, "g");
 	const preBlocks = [];
-	$("pre").each((_index, element) => {
+	scope.find("pre").each((_index, element) => {
 		const text = $(element).text();
 		if (text) {
 			preBlocks.push(text);
 			$(element).replaceWith(`${markerFor(preBlocks.length - 1)}\n`);
 		} else $(element).remove();
 	});
-	$("td, th").each((_index, cell) => {
+	scope.find("td, th").each((_index, cell) => {
 		$(cell).after(" ");
 	});
-	$(BLOCK_LEVEL_SELECTOR).each((_index, element) => {
+	scope.find(BLOCK_LEVEL_SELECTOR).each((_index, element) => {
 		$(element).after("\n");
 	});
-	return $.root().text().split("\n").map((line) => line.replace(/[ \t]+/g, " ").trim()).filter(Boolean).join("\n").replace(markerPattern, (match, indexStr) => {
+	return scope.text().split("\n").map((line) => line.replace(/[ \t]+/g, " ").trim()).filter(Boolean).join("\n").replace(markerPattern, (match, indexStr) => {
 		const index = Number(indexStr);
 		return index >= 0 && index < preBlocks.length ? preBlocks[index] : match;
 	});
@@ -3641,7 +3927,7 @@ new Map([
 	...Object.values(OLLAMA_EMBEDDING_MODEL_MAP)
 ].map((info) => [info.model, info.dimensions[0]]));
 //#endregion
-//#region ../../b4m-core/services/dist/webfetch-Bd1fAkDp.mjs
+//#region ../../b4m-core/services/dist/webfetch-6ldm7GFM.mjs
 const htmlToMarkdown = (html, _isArxiv = false) => {
 	const turndownService = new turndown({
 		headingStyle: "atx",
@@ -4475,7 +4761,7 @@ const weatherTool = {
 	})
 };
 //#endregion
-//#region ../../b4m-core/services/dist/toolGenerators-rEEkksUF.mjs
+//#region ../../b4m-core/services/dist/toolGenerators-DdYxeFQq.mjs
 const diceRoll = async (parameters) => {
 	if (!parameters?.sides || !parameters?.times) throw new Error("Tool dice roll: Missing required parameters");
 	return sum(times(parameters.times, () => random(1, parameters.sides))).toString();
@@ -4670,30 +4956,7 @@ const mathTool = {
 			name: "math_evaluate",
 			description: `Evaluate mathematical expressions using mathjs syntax. Supports arithmetic, algebra, trigonometry, calculus, and statistics. Supports multi-step calculations with semicolon-separated statements sharing a scope (e.g., "x = 5; y = 10; x * y" returns 50). IMPORTANT: Use simple mathematical notation only - no loops or programming constructs.
 
-**LaTeX Rendering Support:**
-When showing mathematical work, equations, or formulas in your response, use LaTeX syntax for professional rendering:
-
-- **Inline math:** Use $equation$ for math within text
-  Example: "The solution is $x = \\frac{-b \\pm \\sqrt{b^2-4ac}}{2a}$ from the quadratic formula."
-
-- **Display math:** Use $$equation$$ for centered block equations
-  Example:
-  $$
-  \\int_0^\\infty e^{-x^2} dx = \\frac{\\sqrt{\\pi}}{2}
-  $$
-
-**Common LaTeX commands:**
-- Fractions: \\frac{numerator}{denominator}
-- Square roots: \\sqrt{x} or \\sqrt[n]{x}
-- Superscripts: x^2 or x^{10}
-- Subscripts: x_i or x_{ij}
-- Greek: \\alpha, \\beta, \\gamma, \\Delta, \\Sigma
-- Integrals: \\int_a^b, \\iint, \\oint
-- Summations: \\sum_{i=1}^n
-- Limits: \\lim_{x \\to \\infty}
-- Matrices: \\begin{bmatrix} a & b \\\\ c & d \\end{bmatrix}
-
-Always use LaTeX for mathematical notation to ensure clear, professional presentation. The LaTeX syntax is part of your response text - no tool call needed for rendering.`,
+Present mathematical work in your response using LaTeX: $...$ inline, $$...$$ for display equations. Inline spans are only rendered as math when they contain a backslash command, so write $\\int_0^3 x^2 dx = 9$ rather than $x^2 = 9$. That rendering is part of your response text, not a tool call.`,
 			parameters: {
 				type: "object",
 				properties: {
@@ -5015,7 +5278,7 @@ const promptEnhancementTool = {
 * NOT usable for artifact ids (`artifact_<...>`), which are matched on a string `id` field rather
 * than `_id` - see `createArtifactId` in @bike4mind/common.
 */
-function isObjectIdShaped(id) {
+function isObjectIdShaped$1(id) {
 	return isObjectIdOrHexString(id);
 }
 let _showUserQuestion = null;
@@ -5137,7 +5400,7 @@ const askUserQuestionTool = {
 * re-export them without pulling the full tool graph. `index.ts` re-exports them
 * so the server barrel's public API is unchanged.
 */
-const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionPreauthorizedLakeIds, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
+const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inlinedAttachmentIds, fullyInlinedAttachmentIds, suppressLakeArms, sessionRetrievalTags, sessionLakeScopeExplicit, sessionPreauthorizedLakeIds, questId, getAbortSignal }, storage, imageGenerateStorage, statusUpdate, onStart, onFinish, llm, config, model, imageProcessorLambdaName, tools, allowedDirectories, entitlementKeys = [], sessionId, codeMinifier, availableModels, onToolLlmUsage) => {
 	const context = {
 		userId,
 		user,
@@ -5161,6 +5424,7 @@ const generateTools = (userId, user, logger, { db, retrievalFilter, kbScope, inl
 		fullyInlinedAttachmentIds,
 		suppressLakeArms,
 		sessionRetrievalTags,
+		sessionLakeScopeExplicit,
 		sessionPreauthorizedLakeIds,
 		codeMinifier,
 		availableModels,
@@ -5306,152 +5570,6 @@ const generateMcpToolsFromCache = (serverName, cachedTools, callTool) => {
 //#endregion
 //#region ../../b4m-core/services/dist/llm/tools/cliTools.mjs
 /**
-* Whitespace-only normalization applied on every minified read (both the AST and
-* fallback paths): normalize line endings, strip trailing whitespace, and collapse
-* runs of blank lines. Never touches non-whitespace bytes, so it can never change
-* program meaning - the safe worst case is "no reduction."
-*/
-function normalizeWhitespace(source) {
-	const lines = source.replace(/\r\n?/g, "\n").split("\n").map((line) => line.replace(/[ \t]+$/, ""));
-	const collapsed = [];
-	let blankRun = 0;
-	for (const line of lines) {
-		if (line === "") {
-			blankRun++;
-			if (blankRun > 1) continue;
-		} else blankRun = 0;
-		collapsed.push(line);
-	}
-	while (collapsed.length && collapsed[0] === "") collapsed.shift();
-	while (collapsed.length && collapsed[collapsed.length - 1] === "") collapsed.pop();
-	return collapsed.join("\n");
-}
-/** Rough token estimate (~4 chars/token) used only to report savings, not for billing. */
-function estimateTokens(text) {
-	return Math.ceil(text.length / 4);
-}
-/**
-* Produce a minified view of `raw`. Tries AST comment-stripping via the injected
-* `codeMinifier` (comments gone) and always finishes with whitespace normalization;
-* if the minifier is absent or declines (unsupported/unparsable language) it falls
-* back to whitespace-only normalization with comments preserved. Never mutates disk.
-*/
-async function minifyFileContent(raw, filePath, codeMinifier) {
-	const ext = path.extname(filePath).toLowerCase();
-	const stripped = codeMinifier ? await codeMinifier(raw, ext).catch(() => null) : null;
-	const content = normalizeWhitespace(stripped ?? raw);
-	const tokensSaved = Math.max(0, estimateTokens(raw) - estimateTokens(content));
-	return {
-		content,
-		strippedComments: stripped !== null,
-		tokensSaved
-	};
-}
-const MAX_FILE_SIZE$3 = 10485760;
-async function readFileContent(params, allowedDirectories, codeMinifier) {
-	const { path: filePath, encoding = "utf-8", offset = 0, limit, minified = false } = params;
-	const resolvedPath = assertPathAllowed(filePath, allowedDirectories, "read");
-	if (!existsSync(resolvedPath)) throw new Error(`File not found: ${filePath}`);
-	const stats = statSync(resolvedPath);
-	if (stats.isDirectory()) throw new Error(`Path is a directory, not a file: ${filePath}`);
-	if (stats.size > MAX_FILE_SIZE$3) throw new Error(`File too large: ${(stats.size / 1024 / 1024).toFixed(2)}MB (max ${MAX_FILE_SIZE$3 / 1024 / 1024}MB)`);
-	if (await checkIfBinary(resolvedPath) && encoding === "utf-8") throw new Error(`File appears to be binary. Use encoding 'base64' to read binary files, or specify a different encoding.`);
-	const content = await promises.readFile(resolvedPath, encoding);
-	if (typeof content === "string" && minified && encoding === "utf-8" && stats.size > 1024) {
-		const { content: minifiedContent, strippedComments, tokensSaved } = await minifyFileContent(content, resolvedPath, codeMinifier);
-		return `${`[Minified view of ${filePath} - ${strippedComments ? "comments and blank-line noise stripped" : "whitespace normalized (comments kept)"}; ~${tokensSaved} tokens saved. No line numbers. Use file_read WITHOUT minified for exact text/comments before editing.]\n`}\n${minifiedContent}`;
-	}
-	if (typeof content === "string") {
-		const lines = content.split("\n");
-		const totalLines = lines.length;
-		if (offset < 0) throw new Error(`Invalid offset: ${offset}. Offset must be 0 or greater.`);
-		if (offset >= totalLines) return `No content to show. File has ${totalLines} lines, but offset is ${offset}.\n(offset is 0-based, so valid range is 0-${Math.max(0, totalLines - 1)})`;
-		if (limit !== void 0 && limit > 0) {
-			const endLine = Math.min(offset + limit, totalLines);
-			const paginatedContent = lines.slice(offset, endLine).join("\n");
-			if (endLine < totalLines) {
-				const nextOffset = endLine;
-				return `${paginatedContent}\n\n... Showing lines ${offset + 1}-${endLine} of ${totalLines} total lines (${stats.size} bytes total).\nTo read more, use offset: ${nextOffset}`;
-			}
-			return `${paginatedContent}\n\n... Showing lines ${offset + 1}-${endLine} of ${totalLines} total lines (${stats.size} bytes total). End of file reached.`;
-		}
-		if (offset > 0) return `${lines.slice(offset).join("\n")}\n\n... Showing lines ${offset + 1}-${totalLines} of ${totalLines} total lines (${stats.size} bytes total).`;
-		return content;
-	}
-	return `[Binary content, ${stats.size} bytes, base64 encoded]\n${content}`;
-}
-/**
-* Simple binary file detection by reading first 8KB and checking for null bytes
-*/
-async function checkIfBinary(filePath) {
-	const buffer = Buffer.alloc(8192);
-	const fd = await promises.open(filePath, "r");
-	try {
-		const { bytesRead } = await fd.read(buffer, 0, 8192, 0);
-		return buffer.slice(0, bytesRead).includes(0);
-	} finally {
-		await fd.close();
-	}
-}
-const fileReadTool = {
-	name: "file_read",
-	implementation: (context) => ({
-		toolFn: async (value) => {
-			const params = value;
-			context.logger.info("📄 FileRead: Reading file", { path: params.path });
-			try {
-				const content = await readFileContent(params, context.allowedDirectories, context.codeMinifier);
-				const { resolvedPath: validatedPath } = isPathAllowed(params.path, context.allowedDirectories);
-				const stats = statSync(validatedPath);
-				context.logger.info("✅ FileRead: Success", {
-					path: params.path,
-					size: stats.size,
-					lines: typeof content === "string" ? content.split("\n").length : "binary"
-				});
-				return content;
-			} catch (error) {
-				context.logger.error("❌ FileRead: Failed", error);
-				return `Error reading file: ${error instanceof Error ? error.message : String(error)}`;
-			}
-		},
-		toolSchema: {
-			name: "file_read",
-			description: "Read the contents of a file from the local filesystem. Supports text files with various encodings. Files are restricted to the current working directory and subdirectories for security. IMPORTANT: Read files completely by default (without offset/limit). Only use offset/limit for extremely large files (thousands of lines) that exceed context limits. Never re-read the same file multiple times - refer to previous reads in conversation history instead.",
-			parameters: {
-				type: "object",
-				properties: {
-					path: {
-						type: "string",
-						description: "Path to the file to read (relative to current working directory or absolute path within working directory)"
-					},
-					encoding: {
-						type: "string",
-						description: "File encoding (default: utf-8). Use base64 for binary files.",
-						enum: [
-							"utf-8",
-							"ascii",
-							"base64"
-						]
-					},
-					offset: {
-						type: "number",
-						description: "OPTIONAL: For text files, the 0-based line number to start reading from. Only use for extremely large files (thousands of lines) that cannot fit in context. Default behavior is to read the entire file, which is preferred for most cases."
-					},
-					limit: {
-						type: "number",
-						description: "OPTIONAL: Maximum number of lines to read from offset. Only use for extremely large files (thousands of lines) that cannot fit in context. Default behavior is to read the entire file, which is preferred for most cases."
-					},
-					minified: {
-						type: "boolean",
-						description: "OPTIONAL (default false): return a token-economy view with comments and blank-line noise stripped (code/logic fully retained). Use ONLY to scan large comment-heavy source cheaply. This view has NO line numbers and is not byte-exact - always re-read WITHOUT minified for exact text, comments, or line numbers, and before editing. Ignored for binary/base64 reads and combined with offset/limit."
-					}
-				},
-				required: ["path"]
-			}
-		}
-	})
-};
-/**
 * Validated fuzzy fallback for `edit_local_file` string matching.
 *
 * This module is pure: no I/O, no `any`. It is invoked ONLY after an exact
@@ -5711,6 +5829,152 @@ function fuzzyMatch(content, oldString, newString) {
 	}
 	return null;
 }
+/**
+* Whitespace-only normalization applied on every minified read (both the AST and
+* fallback paths): normalize line endings, strip trailing whitespace, and collapse
+* runs of blank lines. Never touches non-whitespace bytes, so it can never change
+* program meaning - the safe worst case is "no reduction."
+*/
+function normalizeWhitespace(source) {
+	const lines = source.replace(/\r\n?/g, "\n").split("\n").map((line) => line.replace(/[ \t]+$/, ""));
+	const collapsed = [];
+	let blankRun = 0;
+	for (const line of lines) {
+		if (line === "") {
+			blankRun++;
+			if (blankRun > 1) continue;
+		} else blankRun = 0;
+		collapsed.push(line);
+	}
+	while (collapsed.length && collapsed[0] === "") collapsed.shift();
+	while (collapsed.length && collapsed[collapsed.length - 1] === "") collapsed.pop();
+	return collapsed.join("\n");
+}
+/** Rough token estimate (~4 chars/token) used only to report savings, not for billing. */
+function estimateTokens(text) {
+	return Math.ceil(text.length / 4);
+}
+/**
+* Produce a minified view of `raw`. Tries AST comment-stripping via the injected
+* `codeMinifier` (comments gone) and always finishes with whitespace normalization;
+* if the minifier is absent or declines (unsupported/unparsable language) it falls
+* back to whitespace-only normalization with comments preserved. Never mutates disk.
+*/
+async function minifyFileContent(raw, filePath, codeMinifier) {
+	const ext = path.extname(filePath).toLowerCase();
+	const stripped = codeMinifier ? await codeMinifier(raw, ext).catch(() => null) : null;
+	const content = normalizeWhitespace(stripped ?? raw);
+	const tokensSaved = Math.max(0, estimateTokens(raw) - estimateTokens(content));
+	return {
+		content,
+		strippedComments: stripped !== null,
+		tokensSaved
+	};
+}
+const MAX_FILE_SIZE$3 = 10485760;
+async function readFileContent(params, allowedDirectories, codeMinifier) {
+	const { path: filePath, encoding = "utf-8", offset = 0, limit, minified = false } = params;
+	const resolvedPath = assertPathAllowed(filePath, allowedDirectories, "read");
+	if (!existsSync(resolvedPath)) throw new Error(`File not found: ${filePath}`);
+	const stats = statSync(resolvedPath);
+	if (stats.isDirectory()) throw new Error(`Path is a directory, not a file: ${filePath}`);
+	if (stats.size > MAX_FILE_SIZE$3) throw new Error(`File too large: ${(stats.size / 1024 / 1024).toFixed(2)}MB (max ${MAX_FILE_SIZE$3 / 1024 / 1024}MB)`);
+	if (await checkIfBinary(resolvedPath) && encoding === "utf-8") throw new Error(`File appears to be binary. Use encoding 'base64' to read binary files, or specify a different encoding.`);
+	const content = await promises.readFile(resolvedPath, encoding);
+	if (typeof content === "string" && minified && encoding === "utf-8" && stats.size > 1024) {
+		const { content: minifiedContent, strippedComments, tokensSaved } = await minifyFileContent(content, resolvedPath, codeMinifier);
+		return `${`[Minified view of ${filePath} - ${strippedComments ? "comments and blank-line noise stripped" : "whitespace normalized (comments kept)"}; ~${tokensSaved} tokens saved. No line numbers. Use file_read WITHOUT minified for exact text/comments before editing.]\n`}\n${minifiedContent}`;
+	}
+	if (typeof content === "string") {
+		const lines = content.split("\n");
+		const totalLines = lines.length;
+		if (offset < 0) throw new Error(`Invalid offset: ${offset}. Offset must be 0 or greater.`);
+		if (offset >= totalLines) return `No content to show. File has ${totalLines} lines, but offset is ${offset}.\n(offset is 0-based, so valid range is 0-${Math.max(0, totalLines - 1)})`;
+		if (limit !== void 0 && limit > 0) {
+			const endLine = Math.min(offset + limit, totalLines);
+			const paginatedContent = lines.slice(offset, endLine).join("\n");
+			if (endLine < totalLines) {
+				const nextOffset = endLine;
+				return `${paginatedContent}\n\n... Showing lines ${offset + 1}-${endLine} of ${totalLines} total lines (${stats.size} bytes total).\nTo read more, use offset: ${nextOffset}`;
+			}
+			return `${paginatedContent}\n\n... Showing lines ${offset + 1}-${endLine} of ${totalLines} total lines (${stats.size} bytes total). End of file reached.`;
+		}
+		if (offset > 0) return `${lines.slice(offset).join("\n")}\n\n... Showing lines ${offset + 1}-${totalLines} of ${totalLines} total lines (${stats.size} bytes total).`;
+		return content;
+	}
+	return `[Binary content, ${stats.size} bytes, base64 encoded]\n${content}`;
+}
+/**
+* Simple binary file detection by reading first 8KB and checking for null bytes
+*/
+async function checkIfBinary(filePath) {
+	const buffer = Buffer.alloc(8192);
+	const fd = await promises.open(filePath, "r");
+	try {
+		const { bytesRead } = await fd.read(buffer, 0, 8192, 0);
+		return buffer.slice(0, bytesRead).includes(0);
+	} finally {
+		await fd.close();
+	}
+}
+const fileReadTool = {
+	name: "file_read",
+	implementation: (context) => ({
+		toolFn: async (value) => {
+			const params = value;
+			context.logger.info("📄 FileRead: Reading file", { path: params.path });
+			try {
+				const content = await readFileContent(params, context.allowedDirectories, context.codeMinifier);
+				const { resolvedPath: validatedPath } = isPathAllowed(params.path, context.allowedDirectories);
+				const stats = statSync(validatedPath);
+				context.logger.info("✅ FileRead: Success", {
+					path: params.path,
+					size: stats.size,
+					lines: typeof content === "string" ? content.split("\n").length : "binary"
+				});
+				return content;
+			} catch (error) {
+				context.logger.error("❌ FileRead: Failed", error);
+				return `Error reading file: ${error instanceof Error ? error.message : String(error)}`;
+			}
+		},
+		toolSchema: {
+			name: "file_read",
+			description: "Read the contents of a file from the local filesystem. Supports text files with various encodings. Files are restricted to the current working directory and subdirectories for security. IMPORTANT: Read files completely by default (without offset/limit). Only use offset/limit for extremely large files (thousands of lines) that exceed context limits. Never re-read the same file multiple times - refer to previous reads in conversation history instead.",
+			parameters: {
+				type: "object",
+				properties: {
+					path: {
+						type: "string",
+						description: "Path to the file to read (relative to current working directory or absolute path within working directory)"
+					},
+					encoding: {
+						type: "string",
+						description: "File encoding (default: utf-8). Use base64 for binary files.",
+						enum: [
+							"utf-8",
+							"ascii",
+							"base64"
+						]
+					},
+					offset: {
+						type: "number",
+						description: "OPTIONAL: For text files, the 0-based line number to start reading from. Only use for extremely large files (thousands of lines) that cannot fit in context. Default behavior is to read the entire file, which is preferred for most cases."
+					},
+					limit: {
+						type: "number",
+						description: "OPTIONAL: Maximum number of lines to read from offset. Only use for extremely large files (thousands of lines) that cannot fit in context. Default behavior is to read the entire file, which is preferred for most cases."
+					},
+					minified: {
+						type: "boolean",
+						description: "OPTIONAL (default false): return a token-economy view with comments and blank-line noise stripped (code/logic fully retained). Use ONLY to scan large comment-heavy source cheaply. This view has NO line numbers and is not byte-exact - always re-read WITHOUT minified for exact text, comments, or line numbers, and before editing. Ignored for binary/base64 reads and combined with offset/limit."
+					}
+				},
+				required: ["path"]
+			}
+		}
+	})
+};
 function generateDiff(original, modified) {
 	const differences = diffLines(original, modified);
 	let diffString = "";
@@ -6630,7 +6894,7 @@ const latticeAddEntityTool = {
 				createdAt: /* @__PURE__ */ new Date(),
 				updatedAt: /* @__PURE__ */ new Date()
 			};
-			if (context.db.latticeModels && modelId && isObjectIdShaped(modelId)) try {
+			if (context.db.latticeModels && modelId && isObjectIdShaped$1(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
 				if (model && model.userId === context.userId) {
 					const existingIndex = model.data.entities.findIndex((e) => e.id === entityId);
@@ -6774,7 +7038,7 @@ const latticeSetValueTool = {
 			else if (rawValue.toLowerCase() === "true") value = true;
 			else if (rawValue.toLowerCase() === "false") value = false;
 			const entityId = entityName.toLowerCase().replace(/\s+/g, "_");
-			if (context.db.latticeModels && modelId && isObjectIdShaped(modelId)) try {
+			if (context.db.latticeModels && modelId && isObjectIdShaped$1(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
 				if (model && model.userId === context.userId) {
 					const entity = model.data.entities.find((e) => e.id === entityId || e.name === entityName);
@@ -6909,7 +7173,7 @@ const latticeCreateRuleTool = {
 			};
 			const outputEntityId = parsedRule.outputEntity.toLowerCase().replace(/\s+/g, "_");
 			let entityCreatedMessage = "";
-			if (context.db.latticeModels && modelId && isObjectIdShaped(modelId)) try {
+			if (context.db.latticeModels && modelId && isObjectIdShaped$1(modelId)) try {
 				const model = await context.db.latticeModels.findById(modelId);
 				if (model && model.userId === context.userId) {
 					if (!model.data.entities.some((e) => e.id === outputEntityId || e.name.toLowerCase() === parsedRule.outputEntity.toLowerCase()) && parsedRule.outputEntity !== "unknown") {
@@ -7264,10 +7528,10 @@ const latticeToolDefinitions = {
 */
 const getCliOnlyTools = async () => {
 	const [{ createFileTool }, { globFilesTool }, { grepSearchTool }, { deleteFileTool }, { bashExecuteTool }] = await Promise.all([
-		import("./createFile-DPv180yF-BnWFIxey.mjs"),
-		import("./globFiles-DjfDGaUK-CNR8pMRC.mjs"),
-		import("./grepSearch-BaYUfIYs-n0XKoGnL.mjs"),
-		import("./deleteFile-BdjUwUQF-B3XOJmg3.mjs"),
+		import("./createFile-B8bur5Rb-CVzCarEA.mjs"),
+		import("./globFiles-CwJ8qmYo-BR5b2KvO.mjs"),
+		import("./grepSearch-BgoOOwGe-DtlV8Gn-.mjs"),
+		import("./deleteFile-9B3gW_Nb-DG2sovIl.mjs"),
 		import("./bashExecute-CrdPpBqk-DCATrE-D.mjs")
 	]);
 	return {
@@ -7288,6 +7552,150 @@ const getCliOnlyTools = async () => {
 	};
 };
 //#endregion
+//#region src/utils/constants.ts
+/**
+* Common human name suffixes that should NOT trigger file autocomplete
+* Examples: @john.jr, @mary.phd, @bob.iii
+*/
+const NAME_SUFFIXES = [
+	"jr",
+	"sr",
+	"ii",
+	"iii",
+	"iv",
+	"v",
+	"phd",
+	"md",
+	"esq"
+];
+/**
+* Type-safe check if a string is a name suffix
+*/
+function isNameSuffix(value) {
+	return NAME_SUFFIXES.includes(value);
+}
+//#endregion
+//#region src/utils/processFileReferences.ts
+/**
+* Regular expression to match @path references
+* Matches @ followed by a path-like string (not containing spaces)
+* Only matches @ at start of string or after whitespace
+*/
+const FILE_REFERENCE_REGEX = /(?:^|\s)@([^\s@]+)/g;
+/**
+* Check if a string looks like a file path (not an email or username)
+* A file path contains / or . (file extension) at the end
+*/
+function looksLikeFilePath(ref) {
+	if (ref.includes("/") || ref.includes(path$1.sep)) return true;
+	const extensionMatch = /\.(\w+)$/.exec(ref);
+	if (extensionMatch) {
+		const ext = extensionMatch[1].toLowerCase();
+		if (isNameSuffix(ext)) return false;
+		if (ext.length > 10) return false;
+		return true;
+	}
+	return false;
+}
+/**
+* Extract all file references from a message
+* Only treats @reference as a file if it looks like a path (contains / or has file extension)
+*/
+function extractFileReferences(message) {
+	const references = [];
+	FILE_REFERENCE_REGEX.lastIndex = 0;
+	let match;
+	while ((match = FILE_REFERENCE_REGEX.exec(message)) !== null) {
+		const ref = match[1];
+		if (looksLikeFilePath(ref)) references.push(ref);
+	}
+	return references;
+}
+/**
+* Read file contents safely.
+*
+* When `confineTo` is provided (agent-driven references, e.g. the skill tool
+* expanding `@file` in a model- or repo-authored body), every path - absolute
+* included - is confined through the shared realpath validator against the
+* working directory plus those extra allowed dirs, so `@/etc/passwd` is denied.
+* When it is omitted (a human typing `@path` in the prompt), the legacy
+* cwd-relative check applies and absolute paths the user typed are honored.
+*/
+function readFileContents(filePath, confineTo) {
+	const cwd = process.cwd();
+	const isAbsolutePath = path$1.isAbsolute(filePath);
+	if (filePath.includes("..")) return { error: `Security: Path traversal detected in "${filePath}"` };
+	if (confineTo !== void 0 && !isPathAllowed(filePath, confineTo).allowed) return { error: `Access denied: Cannot read files outside allowed directories: "${filePath}"` };
+	const absolutePath = isAbsolutePath ? path$1.normalize(filePath) : path$1.resolve(cwd, filePath);
+	if (confineTo === void 0 && !isAbsolutePath && !isPathWithinCwd(filePath)) return { error: `Security: Relative path "${filePath}" escapes the current working directory` };
+	if (!fs$2.existsSync(absolutePath)) return { error: `File not found: "${filePath}"` };
+	const stats = fs$2.statSync(absolutePath);
+	if (stats.isDirectory()) try {
+		return {
+			content: `(Directory with ${fs$2.readdirSync(absolutePath).length} items. Use file tools to explore if needed.)`,
+			size: 0
+		};
+	} catch (err) {
+		return { error: `Cannot read directory "${filePath}": ${err instanceof Error ? err.message : "Unknown error"}` };
+	}
+	if (stats.size > 10485760) return { error: `File too large: "${filePath}" is ${formatFileSize(stats.size)} (max ${formatFileSize(MAX_FILE_SIZE$4)})` };
+	if (isBinaryFile(filePath)) return { error: `Binary file: "${filePath}" cannot be included as text content` };
+	try {
+		return {
+			content: fs$2.readFileSync(absolutePath, "utf-8"),
+			size: stats.size
+		};
+	} catch (err) {
+		return { error: `Cannot read file "${filePath}": ${err instanceof Error ? err.message : "Unknown error"}` };
+	}
+}
+/**
+* Format file content block for injection
+*/
+function formatFileBlock(filePath, content, size, isDirectory) {
+	if (isDirectory) return `
+--- Directory Reference: ${filePath} ---
+${content}
+--- End of ${filePath} ---`;
+	return `
+--- Referenced File: ${filePath} (${formatFileSize(size)}) ---
+${content}
+--- End of ${filePath} ---`;
+}
+/**
+* Process file references in a message
+* Extracts @path references and injects file contents
+*/
+async function processFileReferences(message, confineTo) {
+	const references = extractFileReferences(message);
+	const errors = [];
+	const fileBlocks = [];
+	for (const ref of references) {
+		const result = readFileContents(ref, confineTo);
+		if ("error" in result) {
+			errors.push(result.error);
+			continue;
+		}
+		const isDirectory = result.size === 0 && result.content.startsWith("(Directory");
+		fileBlocks.push(formatFileBlock(ref, result.content, result.size, isDirectory));
+	}
+	if (fileBlocks.length === 0) return {
+		content: message,
+		errors
+	};
+	return {
+		content: message + "\n" + fileBlocks.join("\n"),
+		errors
+	};
+}
+/**
+* Check if a message contains any file references
+*/
+function hasFileReferences(message) {
+	FILE_REFERENCE_REGEX.lastIndex = 0;
+	return FILE_REFERENCE_REGEX.test(message);
+}
+//#endregion
 //#region src/storage/SessionStore.ts
 /**
 * Manages conversation sessions stored as JSON files
@@ -7956,6 +8364,7 @@ async function findMarkdownFiles(directory, visitedRealPaths = /* @__PURE__ */ n
 var CustomCommandStore = class {
 	constructor(projectRoot, options = {}) {
 		this.commands = /* @__PURE__ */ new Map();
+		this.projectTrusted = false;
 		this.remoteSource = options.remoteSource;
 		const home = os.homedir();
 		const root = projectRoot || process.cwd();
@@ -7979,7 +8388,7 @@ var CustomCommandStore = class {
 	async loadCommands() {
 		this.commands.clear();
 		for (const dir of this.globalCommandsDirs) await this.loadCommandsFromDirectory(dir, "global");
-		for (const dir of this.projectCommandsDirs) await this.loadCommandsFromDirectory(dir, "project");
+		if (this.projectTrusted) for (const dir of this.projectCommandsDirs) await this.loadCommandsFromDirectory(dir, "project");
 		await this.mergeRemoteCommands();
 	}
 	/**
@@ -7992,6 +8401,13 @@ var CustomCommandStore = class {
 		this.remoteSource = source;
 	}
 	/**
+	* Set whether the project root is trusted. When false, `loadCommands()` skips
+	* the project command/skill directories. Call before `loadCommands()`.
+	*/
+	setProjectTrusted(trusted) {
+		this.projectTrusted = trusted;
+	}
+	/**
 	* Fetch remote skills and merge them into the loaded map under any name
 	* not already taken by a local file. The sole precedence-enforcement path -
 	* `loadCommands()` calls this after the local scans, and the production CLI
@@ -8231,87 +8647,6 @@ var RemoteSkillSource = class {
 	}
 };
 //#endregion
-//#region src/config/toolSafety.ts
-/**
-* Tool safety categories determine when permission is required
-*/
-const ToolCategorySchema = z$1.enum([
-	"auto_approve",
-	"prompt_always",
-	"prompt_default"
-]);
-z$1.object({
-	categories: z$1.record(z$1.string(), ToolCategorySchema),
-	trustedTools: z$1.array(z$1.string())
-});
-/**
-* Default tool categories
-*
-* Categories:
-* - auto_approve: Safe tools that don't need permission (math, search, datetime)
-* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
-* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
-*/
-const DEFAULT_TOOL_CATEGORIES = {
-	math_evaluate: "auto_approve",
-	current_datetime: "auto_approve",
-	dice_roll: "auto_approve",
-	prompt_enhancement: "auto_approve",
-	find_definition: "auto_approve",
-	ask_user_question: "auto_approve",
-	weather_info: "prompt_default",
-	edit_file: "prompt_always",
-	edit_local_file: "prompt_always",
-	create_file: "prompt_always",
-	delete_file: "prompt_always",
-	shell_execute: "prompt_always",
-	bash_execute: "prompt_always",
-	write_shell_stdin: "prompt_always",
-	kill_background_shell: "prompt_always",
-	git_commit: "prompt_always",
-	git_push: "prompt_always",
-	web_search: "prompt_default",
-	check_shell_output: "prompt_default",
-	list_background_shells: "prompt_default",
-	web_fetch: "prompt_default",
-	deep_research: "prompt_default",
-	file_read: "prompt_default",
-	grep_search: "prompt_default",
-	glob_files: "prompt_default",
-	get_file_tree: "prompt_default",
-	get_file_structure: "prompt_default",
-	git_status: "prompt_default",
-	git_diff: "prompt_default",
-	git_log: "prompt_default",
-	git_branch: "prompt_default"
-};
-/**
-* Get the category for a tool
-* Returns 'prompt_default' if tool is not in the default categories
-*/
-function getToolCategory(toolName, customCategories) {
-	if (customCategories && toolName in customCategories) return customCategories[toolName];
-	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
-	return "prompt_default";
-}
-/**
-* Check if a tool can be trusted (not prompt_always)
-*/
-function canTrustTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
-}
-/**
-* Check if a tool is read-only (safe for parallel execution).
-* Write tools (prompt_always category) must always be sequential.
-*
-* @param toolName - Name of the tool to check
-* @param customCategories - Optional custom category overrides
-* @returns true if the tool is read-only, false if it's a write tool
-*/
-function isReadOnlyTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
-}
-//#endregion
 //#region src/core/skillsPrompt.ts
 /**
 * Get the display name for a skill
@@ -8788,10 +9123,30 @@ async function generateFileDiffPreview(args) {
 	}
 }
 /**
-* Generate a preview for edit_local_file (string replacement)
+* Generate a preview for edit_local_file (string replacement).
+*
+* Shows the ACTUAL span edit_local_file will delete and its replacement, not
+* just the model's typed old_string. A block-anchor (fuzzy) match can span more
+* lines than old_string names, so previewing old_string alone would let a wider
+* region be replaced than the user approved. Mirrors the tool's own match order:
+* exact substring first, then the shared fuzzy matcher.
 */
-function generateEditLocalFilePreview(args) {
-	const diffLines = Diff.createPatch(args.path, args.old_string, args.new_string, "Current", "Proposed", { context: 3 }).split("\n").slice(4);
+async function generateEditLocalFilePreview(args) {
+	let deleted = args.old_string;
+	let inserted = args.new_string;
+	try {
+		if (existsSync(args.path)) {
+			const currentContent = await readFile(args.path, "utf-8");
+			if (!currentContent.includes(args.old_string)) {
+				const fuzzy = fuzzyMatch(currentContent, args.old_string, args.new_string);
+				if (fuzzy) {
+					deleted = fuzzy.matchedText;
+					inserted = fuzzy.replacement;
+				}
+			}
+		}
+	} catch {}
+	const diffLines = Diff.createPatch(args.path, deleted, inserted, "Current", "Proposed", { context: 3 }).split("\n").slice(4);
 	return `[Edit in: ${args.path}]\n\n${diffLines.join("\n")}`;
 }
 /**
@@ -9127,252 +9482,12 @@ async function runShellCommand(options) {
 	});
 }
 //#endregion
-//#region src/agents/hookExecutor.ts
-const DEFAULT_HOOK_TIMEOUT_SECONDS = 60;
-/**
-* Execute a single command hook
-*
-* @param hook - Hook definition to execute
-* @param context - Context to pass to the hook
-* @returns Hook execution result
-*/
-async function executeCommandHook(hook, context) {
-	if (!hook.command) return { decision: "allow" };
-	const timeoutSeconds = hook.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS;
-	const result = await runShellCommand({
-		command: hook.command,
-		cwd: context.cwd,
-		timeoutMs: timeoutSeconds * 1e3,
-		env: {
-			...process.env,
-			B4M_PROJECT_DIR: context.cwd,
-			B4M_AGENT_NAME: context.agent_name,
-			B4M_SESSION_ID: context.session_id
-		},
-		stdin: JSON.stringify(context)
-	});
-	if (result.timedOut) return {
-		decision: "deny",
-		reason: `Hook timed out after ${timeoutSeconds}s`
-	};
-	if (result.exitCode === null) {
-		console.warn(`Hook execution error: ${result.stderr}`);
-		return { decision: "allow" };
-	}
-	if (result.exitCode === 2) return {
-		decision: "deny",
-		reason: result.stderr.trim() || "Hook blocked execution"
-	};
-	if (result.exitCode !== 0) {
-		console.warn(`Hook exited with code ${result.exitCode}: ${result.stderr.trim()}`);
-		return { decision: "allow" };
-	}
-	try {
-		const parsed = JSON.parse(result.stdout.trim());
-		return {
-			decision: parsed.decision || "allow",
-			reason: parsed.reason,
-			updatedInput: parsed.updatedInput
-		};
-	} catch {
-		return { decision: "allow" };
-	}
-}
-/**
-* Maximum allowed length for regex patterns to prevent ReDoS attacks
-*/
-const MAX_PATTERN_LENGTH = 200;
-/**
-* Check if a tool name matches a regex pattern.
-*
-* Uses raw regex patterns (e.g. "Edit|Write", "bash_.*"), unlike toolFilter.ts
-* which uses wildcard patterns (e.g. "mcp__github__*"). Regex allows more
-* powerful matching in hook definitions.
-*
-* Security: patterns are length-limited to prevent ReDoS.
-*
-* @param toolName - The tool name to check
-* @param pattern - Regex pattern to match against
-* @returns true if the tool matches the pattern
-*/
-function matchesToolPattern$1(toolName, pattern) {
-	if (pattern.length > MAX_PATTERN_LENGTH) {
-		console.warn(`Hook pattern exceeds max length (${MAX_PATTERN_LENGTH}), skipping: ${pattern.slice(0, 50)}...`);
-		return false;
-	}
-	try {
-		return new RegExp(`^${pattern}$`).test(toolName);
-	} catch {
-		return false;
-	}
-}
-/**
-* Execute all matching hooks for an event
-*
-* @param hooks - Array of hook matchers to evaluate
-* @param context - Context to pass to matching hooks
-* @returns Aggregated hook result
-*/
-async function executeHooks(hooks, context) {
-	if (!hooks || hooks.length === 0) return { decision: "allow" };
-	const matchingHooks = [];
-	for (const matcher of hooks) if (!matcher.matcher || !context.tool_name || matchesToolPattern$1(context.tool_name, matcher.matcher)) matchingHooks.push(...matcher.hooks);
-	if (matchingHooks.length === 0) return { decision: "allow" };
-	const results = await Promise.all(matchingHooks.filter((hook) => hook.type === "command").map((hook) => executeCommandHook(hook, context)));
-	for (const result of results) if (result.decision === "deny" || result.decision === "block") return result;
-	let updatedInput;
-	for (const result of results) if (result.updatedInput) updatedInput = {
-		...updatedInput,
-		...result.updatedInput
-	};
-	return {
-		decision: "allow",
-		updatedInput
-	};
-}
-/**
-* Build hook context from orchestrator state
-*/
-function buildHookContext(params) {
-	return {
-		session_id: params.sessionId,
-		agent_name: params.agentName,
-		cwd: params.cwd,
-		hook_event_name: params.hookEventName,
-		tool_name: params.toolName,
-		tool_input: params.toolInput,
-		tool_use_id: params.toolUseId,
-		tool_result: params.toolResult,
-		error: params.error
-	};
-}
-//#endregion
-//#region src/agents/types.ts
-/**
-* Type definitions for the Unified Markdown-Based Agent System
-*
-* This module defines types for:
-* - Agent definitions parsed from markdown files
-* - Frontmatter schema for agent configuration
-* - Lifecycle hooks for agents
-* - Tool filtering patterns
-*/
-/**
-* Error thrown when a hook blocks tool execution
-*
-* This error is used to stop the agent gracefully when a PreToolUse
-* or PostToolUse hook returns a 'block' decision.
-*/
-var HookBlockedError = class extends Error {
-	constructor(toolName, reason) {
-		super(`Hook blocked execution of ${toolName}: ${reason || "No reason provided"}`);
-		this.name = "HookBlockedError";
-		this.toolName = toolName;
-	}
-};
-/**
-* Tools that are ALWAYS denied for spawned agents
-* Prevents agent chaining and other dangerous patterns
-*/
-const ALWAYS_DENIED_FOR_AGENTS = [
-	"agent_delegate",
-	"create_dynamic_agent",
-	"coordinate_task",
-	"resume_agent"
-];
-/**
-* Default retry configuration for agent execution
-*/
-const DEFAULT_RETRY_CONFIG = {
-	maxRetries: 2,
-	initialDelayMs: 1e3
-};
-/**
-* Schema for a command hook definition
-*/
-const CommandHookSchema = z$1.object({
-	type: z$1.literal("command"),
-	command: z$1.string().min(1, "Command is required for command hooks"),
-	timeout: z$1.number().optional()
-});
-/**
-* Schema for a prompt hook definition
-*/
-const PromptHookSchema = z$1.object({
-	type: z$1.literal("prompt"),
-	prompt: z$1.string().min(1, "Prompt is required for prompt hooks"),
-	timeout: z$1.number().optional()
-});
-/**
-* Schema for a single hook definition (discriminated union)
-* Ensures command hooks require 'command' field and prompt hooks require 'prompt' field
-*/
-const HookDefinitionSchema = z$1.discriminatedUnion("type", [CommandHookSchema, PromptHookSchema]);
-/**
-* Schema for a hook matcher with its hooks
-*/
-const HookMatcherSchema = z$1.object({
-	matcher: z$1.string().optional(),
-	hooks: z$1.array(HookDefinitionSchema)
-});
-/**
-* Schema for agent hooks configuration
-*/
-const AgentHooksSchema = z$1.object({
-	PreToolUse: z$1.array(HookMatcherSchema).optional(),
-	PostToolUse: z$1.array(HookMatcherSchema).optional(),
-	PostToolUseFailure: z$1.array(HookMatcherSchema).optional(),
-	Stop: z$1.array(HookMatcherSchema).optional()
-}).optional();
-/**
-* Schema for validating agent frontmatter
-*/
-const AgentFrontmatterSchema = z$1.object({
-	description: z$1.string().min(1, "Agent description is required"),
-	model: z$1.string().optional(),
-	"allowed-tools": z$1.array(z$1.string()).optional(),
-	"denied-tools": z$1.array(z$1.string()).optional(),
-	skills: z$1.array(z$1.string()).optional(),
-	"max-iterations": z$1.object({
-		quick: z$1.int().positive().optional(),
-		medium: z$1.int().positive().optional(),
-		very_thorough: z$1.int().positive().optional()
-	}).optional(),
-	"default-thoroughness": z$1.enum([
-		"quick",
-		"medium",
-		"very_thorough"
-	]).optional(),
-	variables: z$1.record(z$1.string(), z$1.string()).optional(),
-	hooks: AgentHooksSchema,
-	retry: z$1.object({
-		maxRetries: z$1.int().nonnegative().optional(),
-		initialDelay: z$1.number().positive().optional()
-	}).optional(),
-	"shared-context": z$1.array(z$1.enum(["read", "write"])).optional()
-});
-/**
-* Default iteration limits for agents
-*/
-const DEFAULT_MAX_ITERATIONS = {
-	quick: 4,
-	medium: 10,
-	very_thorough: 20
-};
-/**
-* Default model for agents
-*/
-const DEFAULT_AGENT_MODEL = ChatModels.CLAUDE_4_5_HAIKU;
-/**
-* Default thoroughness level
-*/
-const DEFAULT_THOROUGHNESS = "medium";
-//#endregion
 //#region src/config/commandRisk.ts
 const RISK_ORDER = {
 	low: 0,
-	medium: 1,
-	high: 2
+	unclassified: 1,
+	medium: 2,
+	high: 3
 };
 /**
 * Wrapper programs that execute another program passed as their arguments.
@@ -9839,7 +9954,7 @@ function skipToInnerProgram(args, onPrivEscalation) {
 * into `-c` interpreter code and `eval` arguments.
 */
 function classifySimpleCommand(args, reasons, depth) {
-	let level = "low";
+	let level = "unclassified";
 	const escalatorIndex = args.findIndex((arg) => ESCALATORS_WITH_COMMAND_FLAG.has(programName(arg)));
 	if (escalatorIndex !== -1) {
 		const code = commandFlagValue(args, escalatorIndex);
@@ -10093,6 +10208,285 @@ function writesToBlockDevice(tokens) {
 	return false;
 }
 //#endregion
+//#region src/utils/commandPermission.ts
+/**
+* Gate a hook's shell command through the same permission path as bash_execute,
+* BEFORE the command runs. Hooks are prompt_always-equivalent: they may be
+* allowed once or for the session, but never permanently trusted. Trusting the
+* project folder loads the hook definitions; it does not pre-authorize the shell
+* commands they carry.
+*/
+async function requestShellCommandPermission(toolName, command, cwd, deps) {
+	const { permissionManager, promptFn } = deps;
+	if (!permissionManager.needsPermission(toolName)) return { allowed: true };
+	const risk = classifyCommandRisk(command);
+	const reasons = risk.reasons.length ? `\nReasons: ${risk.reasons.join("; ")}` : "";
+	const preview = `Hook shell command [${risk.level} risk] in ${cwd}:\n${command}${reasons}`;
+	const { action } = await promptFn(toolName, {
+		command,
+		cwd
+	}, preview);
+	switch (action) {
+		case "allow-session":
+			permissionManager.trustToolForSession(toolName);
+			return { allowed: true };
+		case "allow-once":
+		case "allow-always": return { allowed: true };
+		default: return {
+			allowed: false,
+			reason: "Hook command denied by user"
+		};
+	}
+}
+//#endregion
+//#region src/agents/hookExecutor.ts
+const DEFAULT_HOOK_TIMEOUT_SECONDS = 60;
+/**
+* Execute a single command hook
+*
+* @param hook - Hook definition to execute
+* @param context - Context to pass to the hook
+* @returns Hook execution result
+*/
+async function executeCommandHook(hook, context, perm) {
+	if (!hook.command) return { decision: "allow" };
+	if (perm) {
+		const decision = await requestShellCommandPermission(`agent_hook:${context.hook_event_name}`, hook.command, context.cwd, perm);
+		if (!decision.allowed) return {
+			decision: "deny",
+			reason: decision.reason || "Hook command denied"
+		};
+	}
+	const timeoutSeconds = hook.timeout ?? DEFAULT_HOOK_TIMEOUT_SECONDS;
+	const result = await runShellCommand({
+		command: hook.command,
+		cwd: context.cwd,
+		timeoutMs: timeoutSeconds * 1e3,
+		env: {
+			...process.env,
+			B4M_PROJECT_DIR: context.cwd,
+			B4M_AGENT_NAME: context.agent_name,
+			B4M_SESSION_ID: context.session_id
+		},
+		stdin: JSON.stringify(context)
+	});
+	if (result.timedOut) return {
+		decision: "deny",
+		reason: `Hook timed out after ${timeoutSeconds}s`
+	};
+	if (result.exitCode === null) {
+		console.warn(`Hook execution error: ${result.stderr}`);
+		return { decision: "allow" };
+	}
+	if (result.exitCode === 2) return {
+		decision: "deny",
+		reason: result.stderr.trim() || "Hook blocked execution"
+	};
+	if (result.exitCode !== 0) {
+		console.warn(`Hook exited with code ${result.exitCode}: ${result.stderr.trim()}`);
+		return { decision: "allow" };
+	}
+	try {
+		const parsed = JSON.parse(result.stdout.trim());
+		return {
+			decision: parsed.decision || "allow",
+			reason: parsed.reason,
+			updatedInput: parsed.updatedInput
+		};
+	} catch {
+		return { decision: "allow" };
+	}
+}
+/**
+* Maximum allowed length for regex patterns to prevent ReDoS attacks
+*/
+const MAX_PATTERN_LENGTH = 200;
+/**
+* Check if a tool name matches a regex pattern.
+*
+* Uses raw regex patterns (e.g. "Edit|Write", "bash_.*"), unlike toolFilter.ts
+* which uses wildcard patterns (e.g. "mcp__github__*"). Regex allows more
+* powerful matching in hook definitions.
+*
+* Security: patterns are length-limited to prevent ReDoS.
+*
+* @param toolName - The tool name to check
+* @param pattern - Regex pattern to match against
+* @returns true if the tool matches the pattern
+*/
+function matchesToolPattern$1(toolName, pattern) {
+	if (pattern.length > MAX_PATTERN_LENGTH) {
+		console.warn(`Hook pattern exceeds max length (${MAX_PATTERN_LENGTH}), skipping: ${pattern.slice(0, 50)}...`);
+		return false;
+	}
+	try {
+		return new RegExp(`^${pattern}$`).test(toolName);
+	} catch {
+		return false;
+	}
+}
+/**
+* Execute all matching hooks for an event
+*
+* @param hooks - Array of hook matchers to evaluate
+* @param context - Context to pass to matching hooks
+* @returns Aggregated hook result
+*/
+async function executeHooks(hooks, context, perm) {
+	if (!hooks || hooks.length === 0) return { decision: "allow" };
+	const matchingHooks = [];
+	for (const matcher of hooks) if (!matcher.matcher || !context.tool_name || matchesToolPattern$1(context.tool_name, matcher.matcher)) matchingHooks.push(...matcher.hooks);
+	if (matchingHooks.length === 0) return { decision: "allow" };
+	const results = await Promise.all(matchingHooks.filter((hook) => hook.type === "command").map((hook) => executeCommandHook(hook, context, perm)));
+	for (const result of results) if (result.decision === "deny" || result.decision === "block") return result;
+	let updatedInput;
+	for (const result of results) if (result.updatedInput) updatedInput = {
+		...updatedInput,
+		...result.updatedInput
+	};
+	return {
+		decision: "allow",
+		updatedInput
+	};
+}
+/**
+* Build hook context from orchestrator state
+*/
+function buildHookContext(params) {
+	return {
+		session_id: params.sessionId,
+		agent_name: params.agentName,
+		cwd: params.cwd,
+		hook_event_name: params.hookEventName,
+		tool_name: params.toolName,
+		tool_input: params.toolInput,
+		tool_use_id: params.toolUseId,
+		tool_result: params.toolResult,
+		error: params.error
+	};
+}
+//#endregion
+//#region src/agents/types.ts
+/**
+* Type definitions for the Unified Markdown-Based Agent System
+*
+* This module defines types for:
+* - Agent definitions parsed from markdown files
+* - Frontmatter schema for agent configuration
+* - Lifecycle hooks for agents
+* - Tool filtering patterns
+*/
+/**
+* Error thrown when a hook blocks tool execution
+*
+* This error is used to stop the agent gracefully when a PreToolUse
+* or PostToolUse hook returns a 'block' decision.
+*/
+var HookBlockedError = class extends Error {
+	constructor(toolName, reason) {
+		super(`Hook blocked execution of ${toolName}: ${reason || "No reason provided"}`);
+		this.name = "HookBlockedError";
+		this.toolName = toolName;
+	}
+};
+/**
+* Tools that are ALWAYS denied for spawned agents
+* Prevents agent chaining and other dangerous patterns
+*/
+const ALWAYS_DENIED_FOR_AGENTS = [
+	"agent_delegate",
+	"create_dynamic_agent",
+	"coordinate_task",
+	"resume_agent"
+];
+/**
+* Default retry configuration for agent execution
+*/
+const DEFAULT_RETRY_CONFIG = {
+	maxRetries: 2,
+	initialDelayMs: 1e3
+};
+/**
+* Schema for a command hook definition
+*/
+const CommandHookSchema = z$1.object({
+	type: z$1.literal("command"),
+	command: z$1.string().min(1, "Command is required for command hooks"),
+	timeout: z$1.number().optional()
+});
+/**
+* Schema for a prompt hook definition
+*/
+const PromptHookSchema = z$1.object({
+	type: z$1.literal("prompt"),
+	prompt: z$1.string().min(1, "Prompt is required for prompt hooks"),
+	timeout: z$1.number().optional()
+});
+/**
+* Schema for a single hook definition (discriminated union)
+* Ensures command hooks require 'command' field and prompt hooks require 'prompt' field
+*/
+const HookDefinitionSchema = z$1.discriminatedUnion("type", [CommandHookSchema, PromptHookSchema]);
+/**
+* Schema for a hook matcher with its hooks
+*/
+const HookMatcherSchema = z$1.object({
+	matcher: z$1.string().optional(),
+	hooks: z$1.array(HookDefinitionSchema)
+});
+/**
+* Schema for agent hooks configuration
+*/
+const AgentHooksSchema = z$1.object({
+	PreToolUse: z$1.array(HookMatcherSchema).optional(),
+	PostToolUse: z$1.array(HookMatcherSchema).optional(),
+	PostToolUseFailure: z$1.array(HookMatcherSchema).optional(),
+	Stop: z$1.array(HookMatcherSchema).optional()
+}).optional();
+/**
+* Schema for validating agent frontmatter
+*/
+const AgentFrontmatterSchema = z$1.object({
+	description: z$1.string().min(1, "Agent description is required"),
+	model: z$1.string().optional(),
+	"allowed-tools": z$1.array(z$1.string()).optional(),
+	"denied-tools": z$1.array(z$1.string()).optional(),
+	skills: z$1.array(z$1.string()).optional(),
+	"max-iterations": z$1.object({
+		quick: z$1.int().positive().optional(),
+		medium: z$1.int().positive().optional(),
+		very_thorough: z$1.int().positive().optional()
+	}).optional(),
+	"default-thoroughness": z$1.enum([
+		"quick",
+		"medium",
+		"very_thorough"
+	]).optional(),
+	variables: z$1.record(z$1.string(), z$1.string()).optional(),
+	hooks: AgentHooksSchema,
+	retry: z$1.object({
+		maxRetries: z$1.int().nonnegative().optional(),
+		initialDelay: z$1.number().positive().optional()
+	}).optional(),
+	"shared-context": z$1.array(z$1.enum(["read", "write"])).optional()
+});
+/**
+* Default iteration limits for agents
+*/
+const DEFAULT_MAX_ITERATIONS = {
+	quick: 4,
+	medium: 10,
+	very_thorough: 20
+};
+/**
+* Default model for agents
+*/
+const DEFAULT_AGENT_MODEL = ChatModels.CLAUDE_4_5_HAIKU;
+/**
+* Default thoroughness level
+*/
+const DEFAULT_THOROUGHNESS = "medium";
+//#endregion
 //#region src/config/shellCommandFields.ts
 /**
 * Shell-like tools whose free-text command argument must be run through the
@@ -10106,7 +10500,10 @@ function writesToBlockDevice(tokens) {
 * - the interactive/host gate (utils/toolsAdapter.ts), and
 * - the headless protocol's risk classifier (commands/headlessProtocol.ts).
 */
-const SHELL_LIKE_TOOL_COMMAND_FIELDS = { bash_execute: "command" };
+const SHELL_LIKE_TOOL_COMMAND_FIELDS = {
+	bash_execute: "command",
+	write_shell_stdin: "chars"
+};
 //#endregion
 //#region ../../b4m-core/utils/dist/globMatches.mjs
 /**
@@ -10437,7 +10834,7 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
 					if (!isPathAccessDenial(msg)) throw err;
 					result = msg;
 				}
-				cleanupSandboxFiles(effectiveArgs?._sandboxCleanup);
+				cleanupSandboxFiles(isSandboxed ? sandboxedArgs?._sandboxCleanup : void 0);
 				await captureViolations(isSandboxed, result, args?.command, sandboxOrchestrator);
 				result = await retrySandboxFailure(isSandboxed, result, toolName, args, apiClient, originalFn, showPermissionPrompt);
 				result = await retryPathAccessDenial(result, toolName, effectiveArgs, allowedDirectories, configStore, apiClient, originalFn, showPermissionPrompt);
@@ -10486,6 +10883,14 @@ function wrapToolWithPermission(tool, permissionManager, showPermissionPrompt, a
 	};
 }
 /**
+* Route a set of otherwise-raw tools through the permission wrapper. This is the
+* single choke-point every tool the model can call must pass through; anything
+* constructed outside generateCliTools is wrapped here before it reaches the agent.
+*/
+function wrapTools(tools, deps) {
+	return tools.map((tool) => wrapToolWithPermission(tool, deps.permissionManager, deps.showPermissionPrompt, deps.agentContext, deps.configStore, deps.apiClient, deps.sandboxOrchestrator, deps.allowedDirectories, deps.interactionModeOverride));
+}
+/**
 * Detect whether a tool result indicates a sandbox-specific runtime failure.
 * Returns true for errors originating from sandbox-exec (macOS) or bwrap (Linux).
 */
@@ -10541,13 +10946,17 @@ async function retryPathAccessDenial(result, toolName, args, allowedDirectories,
 	if (!allowedDirectories || !isPathAccessDenial(result)) return result;
 	const grantDir = deriveGrantDirectory(toolName, args);
 	if (!grantDir) return result;
-	if (allowedDirectories.includes(grantDir)) return result;
-	const response = await showPermissionPrompt(toolName, args, `🔒 DIRECTORY ACCESS — "${toolName}" needs a path outside the current workspace.\n\n- Grant access to this directory:\n  ${grantDir}\n- "Allow for this session" grants access until the CLI exits.\n- "Always allow" also saves it to your config so it persists across sessions.`);
+	let resolvedGrantDir = grantDir;
+	try {
+		resolvedGrantDir = realpathSync(grantDir);
+	} catch {}
+	if (allowedDirectories.includes(resolvedGrantDir)) return result;
+	const response = await showPermissionPrompt(toolName, args, `🔒 DIRECTORY ACCESS — "${toolName}" needs a path outside the current workspace.\n\n- Grant access to this directory:\n  ${resolvedGrantDir}\n- "Allow for this session" grants access until the CLI exits.\n- "Always allow" also saves it to your config so it persists across sessions.`, "directory-grant");
 	if (response.action === "deny") return result;
 	const oneShot = response.action === "allow-once";
-	allowedDirectories.push(grantDir);
+	allowedDirectories.push(resolvedGrantDir);
 	if (response.action === "allow-always") try {
-		await configStore.addDirectory(grantDir);
+		await configStore.addDirectory(resolvedGrantDir);
 	} catch {}
 	try {
 		return await executeTool(toolName, args, apiClient, originalFn);
@@ -10555,7 +10964,7 @@ async function retryPathAccessDenial(result, toolName, args, allowedDirectories,
 		return err instanceof Error ? err.message : String(err);
 	} finally {
 		if (oneShot) {
-			const idx = allowedDirectories.lastIndexOf(grantDir);
+			const idx = allowedDirectories.lastIndexOf(resolvedGrantDir);
 			if (idx !== -1) allowedDirectories.splice(idx, 1);
 		}
 	}
@@ -10601,7 +11010,7 @@ function prependRiskBanner(basePreview, reasons) {
 */
 async function generateToolPreview(toolName, args, isSandboxed) {
 	try {
-		if (toolName === "edit_local_file" && args?.path && args?.old_string && typeof args?.new_string === "string") return generateEditLocalFilePreview({
+		if (toolName === "edit_local_file" && args?.path && args?.old_string && typeof args?.new_string === "string") return await generateEditLocalFilePreview({
 			path: args.path,
 			old_string: args.old_string,
 			new_string: args.new_string
@@ -10623,20 +11032,25 @@ async function generateToolPreview(toolName, args, isSandboxed) {
 }
 /**
 * Persist an "allow-always" trust decision to project-local or global config.
+*
+* Only writes the repo's project-local layer when the folder is TRUSTED. An
+* untrusted root never re-reads those layers (computeMerged gates on trust), so
+* persisting there would silently lose the decision on the next launch AND drop a
+* .bike4mind/local.json into a repo the user just declined to trust. Untrusted
+* (the default) falls back to the global layer, which is always honored.
 */
 async function persistToolTrust(toolName, permissionManager, configStore) {
 	if (!permissionManager.trustTool(toolName)) return;
-	if (configStore.getProjectConfigDir()) try {
+	if (configStore.getProjectConfigDir() && configStore.isProjectTrusted()) try {
 		await configStore.initProjectConfig();
 		const existingLocal = await configStore.loadRawProjectLocalConfig() || {};
 		await configStore.saveProjectLocalConfig({
 			...existingLocal,
 			trustedTools: [...existingLocal.trustedTools || [], toolName]
 		});
-	} catch {
-		await configStore.trustTool(toolName);
-	}
-	else await configStore.trustTool(toolName);
+		return;
+	} catch {}
+	await configStore.trustTool(toolName);
 }
 /**
 * Wrap a tool with lifecycle hooks (PreToolUse, PostToolUse, PostToolUseFailure).
@@ -10660,7 +11074,7 @@ function wrapToolWithHooks(tool, hooks, hookContext) {
 					hookEventName: "PreToolUse",
 					toolName,
 					toolInput: args
-				}));
+				}), hookContext.permission);
 				if (preResult.decision === "deny") return `Tool execution denied by hook: ${preResult.reason || "No reason provided"}`;
 				if (preResult.decision === "block") throw new HookBlockedError(toolName, preResult.reason);
 				if (preResult.updatedInput) finalArgs = {
@@ -10680,7 +11094,7 @@ function wrapToolWithHooks(tool, hooks, hookContext) {
 						toolName,
 						toolInput: finalArgs,
 						error: error.message
-					}));
+					}), hookContext.permission);
 				}
 				throw err;
 			}
@@ -10691,7 +11105,7 @@ function wrapToolWithHooks(tool, hooks, hookContext) {
 					toolName,
 					toolInput: finalArgs,
 					toolResult: observation
-				}));
+				}), hookContext.permission);
 				if (postResult.decision === "block") throw new HookBlockedError(toolName, postResult.reason);
 			}
 			return observation;
@@ -10870,7 +11284,8 @@ var PermissionManager = class {
 	*   because the sandbox provides the security boundary.
 	*/
 	needsPermission(toolName, options) {
-		const category = getToolCategory(toolName, Object.fromEntries(this.customCategories));
+		const categoryMap = Object.fromEntries(this.customCategories);
+		const category = getToolCategory(toolName, categoryMap);
 		if (this.deniedTools.has(toolName)) return true;
 		if (category === "auto_approve") return false;
 		if (options?.isSandboxed && toolName === "bash_execute" && this.isSandboxAutoAllow()) return false;
@@ -10911,7 +11326,8 @@ var PermissionManager = class {
 	* Get the category for a tool
 	*/
 	getCategory(toolName) {
-		return getToolCategory(toolName, Object.fromEntries(this.customCategories));
+		const categoryMap = Object.fromEntries(this.customCategories);
+		return getToolCategory(toolName, categoryMap);
 	}
 	/**
 	* Check if a tool can be trusted (not in prompt_always category or denied by project)
@@ -10972,124 +11388,6 @@ var PermissionManager = class {
 		};
 	}
 };
-const PROJECT_CONTEXT_FILES = [
-	"CLAUDE.local.md",
-	"CLAUDE.md",
-	"AGENTS.md",
-	"AI.local.md",
-	"AI.md",
-	"INSTRUCTIONS.md"
-];
-const GLOBAL_CONTEXT_FILES = ["AI.local.md", "AI.md"];
-/**
-* Format file size for display
-*/
-function formatFileSize(bytes) {
-	if (bytes < 1024) return `${bytes}B`;
-	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
-	return `${(bytes / 1048576).toFixed(1)}MB`;
-}
-/**
-* Try to read a context file from a directory
-*
-* Security: Only reads regular files (not directories or symlinks) within the specified directory.
-* Files must be under 100KB to prevent abuse. Symlinks are rejected to prevent reading
-* files outside the intended directory.
-*
-* @param dir - The directory to read from (must be a controlled location)
-* @param filename - The filename to read (must not contain path separators)
-* @param source - Whether this is a 'global' or 'project' context file
-* @returns The file result, an error object, or null if file doesn't exist
-*/
-function tryReadContextFile(dir, filename, source) {
-	const filePath = path$1.join(dir, filename);
-	try {
-		const stats = fs$2.lstatSync(filePath);
-		if (stats.isDirectory()) return null;
-		if (stats.isSymbolicLink()) return { error: `${source === "global" ? "Global" : "Project"} ${filename} is a symlink (not allowed for security)` };
-		if (stats.size > 102400) return { error: `${source === "global" ? "Global" : "Project"} ${filename} exceeds 100KB limit (${formatFileSize(stats.size)})` };
-		return {
-			filename,
-			content: fs$2.readFileSync(filePath, "utf-8"),
-			source,
-			path: filePath
-		};
-	} catch (err) {
-		if (err.code === "ENOENT") return null;
-		if (err.code === "EACCES") return { error: `Cannot read ${source} ${filename}: permission denied` };
-		return { error: `Cannot read ${source} ${filename}: ${err instanceof Error ? err.message : "Unknown error"}` };
-	}
-}
-/**
-* Find the first context file in a directory from a list of candidates
-*/
-function findContextFile(dir, candidates, source) {
-	for (const filename of candidates) {
-		const result = tryReadContextFile(dir, filename, source);
-		if (result === null) continue;
-		if ("error" in result) return {
-			result: null,
-			error: result.error
-		};
-		return {
-			result,
-			error: null
-		};
-	}
-	return {
-		result: null,
-		error: null
-	};
-}
-/**
-* Merge global and project context into a single string
-*/
-function mergeContextContent(global, project) {
-	if (global && project) return `${global.content}\n\n---\n\n${project.content}`;
-	if (global) return global.content;
-	if (project) return project.content;
-	return "";
-}
-/**
-* Load context files from global and project directories
-*
-* Global files are loaded from ~/.bike4mind/
-* Project files are loaded from the project directory (or cwd if null)
-*
-* Returns the first matching file from each layer based on priority order
-*/
-async function loadContextFiles(projectDir) {
-	const errors = [];
-	const globalDir = path$1.join(homedir$1(), ".bike4mind");
-	const projectDirectory = projectDir || process.cwd();
-	const [globalResult, projectResult] = await Promise.all([Promise.resolve(findContextFile(globalDir, GLOBAL_CONTEXT_FILES, "global")), Promise.resolve(findContextFile(projectDirectory, PROJECT_CONTEXT_FILES, "project"))]);
-	if (globalResult.error) errors.push(globalResult.error);
-	if (projectResult.error) errors.push(projectResult.error);
-	const mergedContent = mergeContextContent(globalResult.result, projectResult.result);
-	return {
-		globalContext: globalResult.result,
-		projectContext: projectResult.result,
-		mergedContent,
-		errors
-	};
-}
-/**
-* Extract "# Compact Instructions" or "## Compact Instructions" section from CLAUDE.md content
-*
-* This section provides project-specific instructions for how conversations should be
-* summarized when compacting context.
-*
-* @param contextContent - The merged context content from CLAUDE.md files
-* @returns The extracted instructions content, or undefined if not found
-*/
-function extractCompactInstructions(contextContent) {
-	const match = contextContent.match(/^#{1,2}\s*Compact\s*Instructions\s*$/im);
-	if (!match || match.index === void 0) return;
-	const startIndex = match.index + match[0].length;
-	const remainingContent = contextContent.slice(startIndex);
-	const endIndex = remainingContent.match(/^#{1,2}\s+\S/m)?.index ?? remainingContent.length;
-	return remainingContent.slice(0, endIndex).trim() || void 0;
-}
 //#endregion
 //#region ../../b4m-core/agents/dist/index.mjs
 /**
@@ -14688,7 +14986,14 @@ function resolveAgentName(agentType, agentStore) {
 * @param context - Context variables available to the script
 * @returns Output from the script or error message
 */
-async function executeHook(script, context) {
+async function executeHook(script, phase, context, perm) {
+	if (perm) {
+		const decision = await requestShellCommandPermission(`skill_hook:${phase}`, script, process.cwd(), perm);
+		if (!decision.allowed) return {
+			success: false,
+			output: decision.reason || "Hook command denied"
+		};
+	}
 	const result = await runShellCommand({
 		command: script,
 		cwd: process.cwd(),
@@ -14773,6 +15078,10 @@ function parseArguments(argsString) {
 */
 function createSkillTool(deps) {
 	const { customCommandStore } = deps;
+	const hookPerm = deps.permissionManager && deps.promptFn ? {
+		permissionManager: deps.permissionManager,
+		promptFn: deps.promptFn
+	} : void 0;
 	return {
 		toolFn: async (args) => {
 			const params = args;
@@ -14789,16 +15098,16 @@ function createSkillTool(deps) {
 				throw new Error(`skill: "${skillName}" not found. Available skills: ${available || "none"}`);
 			}
 			if (command.hooks?.["pre-invoke"]) {
-				const hookResult = await executeHook(command.hooks["pre-invoke"], {
+				const hookResult = await executeHook(command.hooks["pre-invoke"], "pre-invoke", {
 					skillName,
 					args: argsString
-				});
+				}, hookPerm);
 				if (!hookResult.success) throw new Error(`Pre-invoke hook failed: ${hookResult.output}`);
 			}
 			try {
 				const argsArray = params.args ? parseArguments(params.args) : [];
 				let expandedBody = substituteArguments(command.body, argsArray);
-				const processed = await processFileReferences(expandedBody);
+				const processed = await processFileReferences(expandedBody, deps.allowedDirectories ?? []);
 				expandedBody = processed.content;
 				if (processed.errors.length > 0) expandedBody += `\n\n**File reference errors:**\n${processed.errors.map((e) => `- ${e}`).join("\n")}`;
 				let result;
@@ -14823,22 +15132,22 @@ function createSkillTool(deps) {
 					result = `## Skill Executed: /${skillName} (via ${agentConfig.name} agent)\n\n${agentResult.summary}`;
 				} else result = `## Skill Loaded: /${skillName}\n\n${expandedBody}\n\n---\n*Follow the instructions above. This skill was invoked programmatically.*`;
 				if (command.hooks?.["post-invoke"]) {
-					const hookResult = await executeHook(command.hooks["post-invoke"], {
+					const hookResult = await executeHook(command.hooks["post-invoke"], "post-invoke", {
 						skillName,
 						args: argsString,
 						result
-					});
+					}, hookPerm);
 					if (!hookResult.success) logger.warn(`Post-invoke hook warning: ${hookResult.output}`);
 				}
 				return result;
 			} catch (error) {
 				if (command.hooks?.["on-error"]) {
 					const errorMessage = error instanceof Error ? error.message : String(error);
-					const hookResult = await executeHook(command.hooks["on-error"], {
+					const hookResult = await executeHook(command.hooks["on-error"], "on-error", {
 						skillName,
 						args: argsString,
 						error: errorMessage
-					});
+					}, hookPerm);
 					if (hookResult.output) logger.warn(`On-error hook output: ${hookResult.output}`);
 				}
 				throw error;
@@ -15089,12 +15398,6 @@ async function getRipgrepPath() {
 	cachedRgPath = rgPath;
 	return rgPath;
 }
-function isPathWithinWorkspace(targetPath, baseCwd) {
-	const resolvedTarget = path.resolve(targetPath);
-	const resolvedBase = path.resolve(baseCwd);
-	const relativePath = path.relative(resolvedBase, resolvedTarget);
-	return !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
-}
 /** Escape special regex characters in the symbol name */
 function escapeRegex$1(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -15129,12 +15432,12 @@ function isLikelyDefinition(line) {
 	if (/\b(jest|vi|sinon)\.(mock|stub|spy)\b/.test(trimmed)) return false;
 	return true;
 }
-async function findDefinitions(params) {
+async function findDefinitions(params, allowedDirectories) {
 	const { symbol_name, kind, search_path } = params;
 	if (!symbol_name || !symbol_name.trim()) throw new Error("symbol_name is required");
 	const baseCwd = process.cwd();
-	const targetDir = search_path ? path.resolve(baseCwd, search_path) : baseCwd;
-	if (!isPathWithinWorkspace(targetDir, baseCwd)) throw new Error(`Path validation failed: "${search_path}" resolves outside the allowed workspace directory`);
+	const requestedDir = search_path ? path.resolve(baseCwd, search_path) : baseCwd;
+	const targetDir = assertPathAllowed(requestedDir, allowedDirectories, "search");
 	try {
 		if (!(await stat(targetDir)).isDirectory()) throw new Error(`Path is not a directory: ${search_path}`);
 	} catch (error) {
@@ -15148,6 +15451,7 @@ async function findDefinitions(params) {
 		"50",
 		"--max-filesize",
 		"5M",
+		"--",
 		buildDefinitionPattern(symbol_name.trim(), kind),
 		targetDir
 	];
@@ -15200,10 +15504,10 @@ async function findDefinitions(params) {
 	}
 	return result.trim();
 }
-function createFindDefinitionTool() {
+function createFindDefinitionTool(allowedDirectories) {
 	return {
 		toolFn: async (args) => {
-			return findDefinitions(args);
+			return findDefinitions(args, allowedDirectories);
 		},
 		toolSchema: {
 			name: "find_definition",
@@ -15625,14 +15929,14 @@ function formatSection(lines, title, items, format) {
 //#endregion
 //#region src/tools/getFileStructure/index.ts
 const MAX_FILE_SIZE$1 = 10485760;
-function createGetFileStructureTool() {
+function createGetFileStructureTool(allowedDirectories) {
 	return {
 		toolFn: async (value) => {
 			const params = value;
 			try {
-				const cwd = process.cwd();
-				const resolvedPath = path.resolve(cwd, params.path);
-				if (!resolvedPath.startsWith(cwd)) return "Error: Access denied - cannot read files outside of current working directory";
+				const validation = isPathAllowed(params.path, allowedDirectories);
+				if (!validation.allowed) return "Access denied: Cannot read files outside allowed directories.";
+				const resolvedPath = validation.resolvedPath;
 				if (!existsSync(resolvedPath)) return `Error: File not found: ${params.path}`;
 				const stats = statSync(resolvedPath);
 				if (stats.isDirectory()) return `Error: Path is a directory, not a file: ${params.path}`;
@@ -16135,6 +16439,7 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	DEEPSEEK_MAX_STOP_SEQUENCES: () => 16,
 	DEEPSEEK_MODELS: () => DEEPSEEK_MODELS,
 	DEEPSEEK_THINKING_TOP_P_FLOOR: () => DEEPSEEK_THINKING_TOP_P_FLOOR,
+	DEFAULT_ACQUIRE_TIMEOUT_MS: () => DEFAULT_ACQUIRE_TIMEOUT_MS,
 	DEFAULT_MAX_TOOL_CALLS: () => 10,
 	DEFAULT_REALTIME_VOICE_MODEL: () => DEFAULT_REALTIME_VOICE_MODEL,
 	DEGENERATE_STREAM_MESSAGE: () => DEGENERATE_STREAM_MESSAGE,
@@ -16152,12 +16457,15 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	KimiBackend: () => KimiBackend,
 	LlamaBedrockBackend: () => LlamaBedrockBackend,
 	LocalImageBackend: () => LocalImageBackend,
+	MAX_CONCURRENT_ANTHROPIC_CALLS: () => 15,
+	MAX_QUEUED_PER_TENANT: () => 100,
 	MODEL_SUNSET_NAMESPACE: () => MODEL_SUNSET_NAMESPACE,
 	MoonshotBedrockBackend: () => MoonshotBedrockBackend,
 	OllamaBackend: () => OllamaBackend,
 	OpenAIBackend: () => OpenAIBackend,
 	PipelineTimer: () => PipelineTimer,
 	REALTIME_VOICE_PRICING: () => REALTIME_VOICE_PRICING,
+	SemaphoreBusyError: () => SemaphoreBusyError,
 	THINKING_ANSWER_HEADROOM_TOKENS: () => THINKING_ANSWER_HEADROOM_TOKENS,
 	TitanBedrockBackend: () => TitanBedrockBackend,
 	UndifferentiatedBedrockBackend: () => UndifferentiatedBedrockBackend,
@@ -16210,12 +16518,14 @@ var dist_exports = /* @__PURE__ */ __exportAll$3({
 	setModelCatalogProvider: () => setModelCatalogProvider,
 	setModelPriceRowsProvider: () => setModelPriceRowsProvider,
 	splitCacheInclusiveInput: () => splitCacheInclusiveInput,
+	staticPriceBackends: () => staticPriceBackends,
 	stripAllToolBlocks: () => stripAllToolBlocks,
 	stripToolDependentMessages: () => stripToolDependentMessages,
 	toDeepSeekEffort: () => toDeepSeekEffort,
 	toKimiEffort: () => toKimiEffort,
 	toProviderEndUserId: () => toProviderEndUserId,
-	updateReplacedByOverlay: () => updateReplacedByOverlay
+	updateReplacedByOverlay: () => updateReplacedByOverlay,
+	usableTokenCount: () => usableTokenCount
 });
 /**
 * A tool failure that must end the turn rather than be fed back to the model as a
@@ -17079,6 +17389,58 @@ function systemContentToText(content) {
 	if (!Array.isArray(content)) return "";
 	return content.filter((block) => block?.type === "text").map((block) => block.text ?? "").filter((text) => text.trim() !== "").join("\n");
 }
+/** Data URLs carry the bytes inline; Anthropic wants them as a base64 source, not a url source. */
+const DATA_URL = /^data:([^;,]+)(?:;[^,]*)?;base64,(.+)$/s;
+/**
+* Translate canonical B4M content (see normalizeMultimodalMessages) into Anthropic
+* block params. Only `image_url` needs real work - Anthropic has no such block, so a
+* data URL becomes a base64 source and an http(s) URL becomes a url source. Every
+* other block (text, image, tool_use, tool_result, thinking) is already structurally
+* the SDK's shape and passes through with its `cache_control` stamp intact.
+*
+* An image we cannot translate is dropped with a warning: Anthropic rejects the whole
+* request over one unknown block, which would lose the text too.
+*/
+function toAnthropicContent(content, logger) {
+	if (!Array.isArray(content)) return content;
+	const blocks = [];
+	for (const block of content) {
+		if (!block || block.type !== "image_url") {
+			blocks.push(block);
+			continue;
+		}
+		const { image_url: imageUrl, type: _type, ...rest } = block;
+		const url = imageUrl?.url;
+		if (!url) {
+			logger?.warn("[AnthropicBackend] Dropping image_url block with no url.");
+			continue;
+		}
+		const dataUrl = DATA_URL.exec(url);
+		if (dataUrl) blocks.push({
+			...rest,
+			type: "image",
+			source: {
+				type: "base64",
+				media_type: dataUrl[1],
+				data: dataUrl[2]
+			}
+		});
+		else if (/^https?:\/\//i.test(url)) blocks.push({
+			...rest,
+			type: "image",
+			source: {
+				type: "url",
+				url
+			}
+		});
+		else logger?.warn("[AnthropicBackend] Dropping image_url block; Anthropic accepts only http(s) or base64 data URLs.");
+	}
+	if (blocks.length === 0 && content.length > 0) blocks.push({
+		type: "text",
+		text: "[image omitted: unsupported image format]"
+	});
+	return blocks;
+}
 /**
 * max_tokens floor for adaptive reasoning models (Claude 4.7+/Opus 5). These
 * models self-manage extended thinking *within* max_tokens, which is a ceiling
@@ -17106,6 +17468,10 @@ const THINKING_ANSWER_HEADROOM_TOKENS = 1e3;
 * resolves to that entire cap, which is the only value leaving room for an answer
 * after a long trace.
 *
+* Bedrock DeepSeek R1 is the same shape: its monologue is inlined into `content`
+* (see bedrockBackend/deepseek.ts), it matches no shape check, and its 32K cap
+* becomes the floor for the same reason.
+*
 * DeepSeek Flash and V4 Pro miss every clause for their own set of reasons: no
 * `thinkingStyle` (that field is Anthropic's), absent from the OpenAI-only
 * REASONING_SUPPORTED_MODELS, and DEEPSEEK_PROFILE declares plain `max_tokens`
@@ -17118,6 +17484,7 @@ const THINKING_ANSWER_HEADROOM_TOKENS = 1e3;
 const REASONS_WITHIN_OUTPUT_BUDGET_IDS = /* @__PURE__ */ new Set([
 	ChatModels.KIMI_K2_THINKING_BEDROCK,
 	ChatModels.KIMI_K2_5_BEDROCK,
+	ChatModels.DEEPSEEK_R1_BEDROCK,
 	ChatModels.DEEPSEEK_FLASH,
 	ChatModels.DEEPSEEK_V4_PRO
 ]);
@@ -17155,12 +17522,36 @@ function reasonsWithinOutputBudget(modelInfo) {
 *
 * Models that reason inside the output budget default to
 * ADAPTIVE_THINKING_MAX_TOKENS_FLOOR, clamped to their own cap: a small default can
-* be consumed entirely by reasoning, leaving an empty visible reply.
+* be consumed entirely by reasoning, leaving an empty visible reply. "Their own cap"
+* means a DECLARED one - a cap toModelInfo derived is only a default, and clamping
+* such a model to it reproduces that same starvation, so derivedOutputCeiling stands
+* in for it. Every path that has a usable cap ends in a clamp against it; a model with
+* no usable cap at all (line 138) is a different, deliberate exception - see its comment.
 */
 function resolveOutputMaxTokens({ requested, fallback, modelInfo, modelMaxOutputTokens }) {
-	const preferred = usableTokenCount(requested) ?? (reasonsWithinOutputBudget(modelInfo) ? 64e3 : fallback);
+	const reasonsWithinBudget = reasonsWithinOutputBudget(modelInfo);
+	const preferred = usableTokenCount(requested) ?? (reasonsWithinBudget ? 64e3 : fallback);
 	const cap = usableTokenCount(modelMaxOutputTokens);
-	return cap === void 0 ? preferred : Math.min(preferred, cap);
+	if (cap === void 0) return preferred;
+	if (modelInfo.maxOutputTokensDerived === true && reasonsWithinBudget) return Math.min(preferred, derivedOutputCeiling(modelInfo, cap));
+	return Math.min(preferred, cap);
+}
+/**
+* The ceiling to use in place of a derived cap. Two bounds, whichever is larger:
+*
+* - the derived cap itself, so this can only ever raise a budget, never shrink one; and
+* - the adaptive floor, bounded by half the context window after the safety buffer - the same
+*   split catalogWrite applies to a window that cannot fund the default output reserve.
+*
+* The window share is what keeps this honest: contextWindow is the INPUT+output budget, so handing
+* the whole of it to output would make every non-empty prompt exceed the window and 400 the turn.
+* Half of it leaves the prompt at least as much room as the answer.
+*/
+function derivedOutputCeiling(modelInfo, derivedCap) {
+	const window = usableTokenCount(modelInfo.contextWindow);
+	if (window === void 0) return derivedCap;
+	const windowShare = Math.floor((window - CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS) / 2);
+	return Math.max(derivedCap, Math.min(ADAPTIVE_THINKING_MAX_TOKENS_FLOOR, windowShare));
 }
 /**
 * Token counts reaching this module come from catalog rows and external callers, so they are
@@ -17230,27 +17621,130 @@ var DispatchModel = class {
 		return this.for(model)?.dispatchProfile;
 	}
 };
-let _activeAnthropicCalls = 0;
-const _anthropicWaitQueue = [];
+const DEFAULT_ACQUIRE_TIMEOUT_MS = 3e5;
+const ANON_TENANT = "";
 const _semaphoreLogger = new Logger();
-function acquireSlot() {
-	if (_activeAnthropicCalls < 15) {
-		_activeAnthropicCalls++;
-		return Promise.resolve();
-	}
-	_semaphoreLogger.warn("[AnthropicBackend] Semaphore at capacity, queuing request", {
-		active: _activeAnthropicCalls,
-		queued: _anthropicWaitQueue.length + 1
+/**
+* Thrown when a slot cannot be obtained: the tenant's queue is full, or the wait timed out.
+* Both are transient backpressure on a shared pool rather than a fault in the request, so it
+* carries a 429 that the shared `shouldTriggerFallback` classifier reads (via `getHttpStatus`)
+* and hops the completion onto another model instead of surfacing a hard failure.
+*/
+var SemaphoreBusyError = class extends Error {
+	/** Read by the shared HTTP-status error classifiers; see the class doc. */
+	status = 429;
+	constructor(message) {
+		super(message);
+		this.name = "SemaphoreBusyError";
+	}
+};
+let _totalActive = 0;
+const _activeByTenant = /* @__PURE__ */ new Map();
+const _waiters = [];
+function incActive(key) {
+	_activeByTenant.set(key, (_activeByTenant.get(key) ?? 0) + 1);
+	_totalActive++;
+}
+function decActive(key) {
+	const remaining = (_activeByTenant.get(key) ?? 0) - 1;
+	if (remaining <= 0) _activeByTenant.delete(key);
+	else _activeByTenant.set(key, remaining);
+	_totalActive--;
+}
+function makeRelease(key) {
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		decActive(key);
+		admitNext();
+	};
+}
+/**
+* Index of the waiter whose tenant holds the fewest active slots; arrival order breaks ties.
+* `_waiters` is only ever appended to and spliced from, so it is already in arrival order and
+* the strict `<` keeps the first-encountered (earliest) waiter on a tie - which is what makes
+* this degrade to FIFO within a single tenant.
+*/
+function pickFairWaiterIndex() {
+	let best = -1;
+	let bestActive = Infinity;
+	for (let i = 0; i < _waiters.length; i++) {
+		const active = _activeByTenant.get(_waiters[i].key) ?? 0;
+		if (active < bestActive) {
+			best = i;
+			bestActive = active;
+		}
+	}
+	return best;
+}
+function admitNext() {
+	if (_totalActive >= 15) return;
+	const idx = pickFairWaiterIndex();
+	if (idx === -1) return;
+	const [waiter] = _waiters.splice(idx, 1);
+	waiter.settle();
+	incActive(waiter.key);
+	waiter.resolve(makeRelease(waiter.key));
+}
+function abortError(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	const err = /* @__PURE__ */ new Error("The operation was aborted");
+	err.name = "AbortError";
+	return err;
+}
+/**
+* Acquire a slot for an Anthropic API call, resolving with a release handle once one is
+* available. Rejects with an AbortError if `signal` fires while waiting, or a
+* SemaphoreBusyError if the tenant's queue is full or the wait times out.
+*/
+function acquireSlot(opts = {}) {
+	const key = opts.tenantKey ?? ANON_TENANT;
+	const { signal } = opts;
+	if (signal?.aborted) return Promise.reject(abortError(signal));
+	if (_totalActive < 15 && _waiters.length === 0) {
+		incActive(key);
+		return Promise.resolve(makeRelease(key));
+	}
+	const queuedForTenant = _waiters.reduce((count, w) => w.key === key ? count + 1 : count, 0);
+	if (queuedForTenant >= 100) {
+		_semaphoreLogger.warn("[AnthropicSemaphore] Per-tenant queue cap reached, rejecting request", {
+			active: _totalActive,
+			queued: _waiters.length,
+			tenantQueued: queuedForTenant
+		});
+		return Promise.reject(new SemaphoreBusyError(`Anthropic request queue is full for this tenant (${queuedForTenant} already waiting); try again shortly`));
+	}
+	_semaphoreLogger.warn("[AnthropicSemaphore] At capacity, queuing request", {
+		active: _totalActive,
+		queued: _waiters.length + 1
 	});
-	return new Promise((resolve) => {
-		_anthropicWaitQueue.push(resolve);
+	return new Promise((resolve, reject) => {
+		const timeoutMs = opts.timeoutMs ?? 3e5;
+		const settle = () => {
+			clearTimeout(timer);
+			if (signal) signal.removeEventListener("abort", onAbort);
+		};
+		const removeAndReject = (err) => {
+			const idx = _waiters.indexOf(waiter);
+			if (idx !== -1) _waiters.splice(idx, 1);
+			settle();
+			reject(err);
+		};
+		function onAbort() {
+			removeAndReject(abortError(signal));
+		}
+		const timer = setTimeout(() => removeAndReject(new SemaphoreBusyError(`Timed out after ${timeoutMs}ms waiting for an Anthropic slot`)), timeoutMs);
+		const waiter = {
+			key,
+			resolve,
+			settle
+		};
+		_waiters.push(waiter);
+		if (signal) signal.addEventListener("abort", onAbort, { once: true });
 	});
 }
-function releaseSlot() {
-	const next = _anthropicWaitQueue.shift();
-	if (next) next();
-	else _activeAnthropicCalls--;
-}
 /**
 * Defaults are deliberately conservative: tripping requires a run of >= 2048
 * chars that is periodic on a unit of <= 512 chars repeated >= 25 times. Prose,
@@ -18038,7 +18532,7 @@ var AnthropicBackend = class {
 			}) : options.maxTokens ?? DEFAULT_ANTHROPIC_MAX_TOKENS,
 			messages: filteredMessages.map((m) => ({
 				role: m.role === "user" ? "user" : "assistant",
-				content: m.content
+				content: toAnthropicContent(m.content, this.logger)
 			})),
 			...this.omitsSamplingParams(model) ? {} : { temperature: options.temperature },
 			...TEMPERATURE_ONLY_MODELS$1.includes(model) || this.omitsSamplingParams(model) ? {} : { top_p: options.topP },
@@ -18135,8 +18629,12 @@ var AnthropicBackend = class {
 					let idleTimeoutMsForError = 0;
 					let degenerateVerdict;
 					(async () => {
-						await acquireSlot();
+						let release;
 						try {
+							release = await acquireSlot({
+								tenantKey: this._endUserId,
+								signal: combinedSignal
+							});
 							const payloadForSize = {
 								...apiParams,
 								stream: true
@@ -18407,7 +18905,7 @@ var AnthropicBackend = class {
 							}
 							else reject(error);
 						} finally {
-							releaseSlot();
+							release?.();
 						}
 					})();
 				});
@@ -18590,9 +19088,13 @@ var AnthropicBackend = class {
 					return;
 				}
 			} else {
-				await acquireSlot();
 				let response;
+				let release;
 				try {
+					release = await acquireSlot({
+						tenantKey: this._endUserId,
+						signal: options.abortSignal
+					});
 					response = await withRetry(() => this._api.messages.create(apiParams, {
 						signal: options.abortSignal,
 						...requestExtraHeaders ? { headers: requestExtraHeaders } : {}
@@ -18606,7 +19108,7 @@ var AnthropicBackend = class {
 						abortSignal: options.abortSignal
 					}).then((r) => r.result);
 				} finally {
-					releaseSlot();
+					release?.();
 				}
 				const streamedText = [];
 				if ("content" in response && Array.isArray(response.content)) {
@@ -20094,19 +20596,17 @@ var AnthropicBedrockBackend = class extends BaseBedrockBackend {
 				return m;
 			}
 			if (Array.isArray(m.content)) {
-				const sanitizedContent = m.content.map((block) => {
-					if (isRecord(block) && block.type === "text") {
-						if (!(typeof block.text === "string" ? block.text : "").trim()) return null;
-					}
-					return block;
-				}).filter((block) => block !== null);
-				if (sanitizedContent.length === 0) return {
+				const translatedContent = toAnthropicContent(m.content.filter((block) => {
+					if (isRecord(block) && block.type === "text") return !!(typeof block.text === "string" ? block.text : "").trim();
+					return true;
+				}), Logger.globalInstance);
+				if (translatedContent.length === 0) return {
 					...m,
 					content: ""
 				};
 				return {
 					...m,
-					content: sanitizedContent
+					content: translatedContent
 				};
 			}
 			return {
@@ -20938,11 +21438,49 @@ var LlamaBedrockBackend = class extends BaseBedrockBackend {
 		return messages;
 	}
 };
+/**
+* Kimi (Moonshot) on Bedrock non-deterministically returns tool calls two ways:
+* as structured `tool_calls` deltas (handled directly in the backend), OR as its
+* NATIVE special-token format emitted inline in the content/reasoning stream:
+*
+*   <|tool_calls_section_begin|>
+*     <|tool_call_begin|> functions.<name>:<index> <|tool_call_argument_begin|> {json} <|tool_call_end|>
+*     ...more calls...
+*   <|tool_calls_section_end|>
+*
+* Nothing downstream parses that, so the tokens would leak into the answer as text
+* and the tool would never run. This module extracts the native section and yields
+* structured tool calls, so both provider shapes converge on the same execution path.
+*
+* Verified against live Bedrock captures (moonshot.kimi-k2-thinking, us-east-2):
+* the section is emitted WITHIN the model's reasoning, its markers span content
+* deltas, and a section can carry several parallel calls.
+*/
+const NATIVE_TOOL_SECTION_PARSE_CAP = 32e3;
 const SECTION_BEGIN = "<|tool_calls_section_begin|>";
 const SECTION_END = "<|tool_calls_section_end|>";
+/**
+* Per-call markers. The section wrapper is not always present - a call can arrive bare -
+* so anything that scopes input to the calls has to fall back to these.
+*/
+const CALL_BEGIN = "<|tool_call_begin|>";
+const CALL_END = "<|tool_call_end|>";
 /** Cheap gate: is there any native tool-call marker in this text at all? */
 function hasNativeToolMarker(text) {
-	return text.includes(SECTION_BEGIN) || text.includes("<|tool_call_begin|>");
+	return text.includes("<|tool_calls_section_begin|>") || text.includes("<|tool_call_begin|>");
+}
+/**
+* Offset of the first tool call in `text`, preferring the section wrapper when present,
+* or -1 when there is none.
+*
+* This is how a caller meets parseNativeToolSection's section-scoping contract. It is a
+* function rather than an inline indexOf because the wrapper is optional: scoping only on
+* SECTION_BEGIN leaves the bare shape falling through to the whole message, which is the
+* exact input the cap then truncates.
+*/
+function nativeToolCallsBegin(text) {
+	const section = text.indexOf(SECTION_BEGIN);
+	return section >= 0 ? section : text.indexOf(CALL_BEGIN);
 }
 /** `functions.math_evaluate:0` -> { name: 'math_evaluate', index: 0 }. */
 function splitNativeToolId(rawId, fallbackIndex) {
@@ -20961,10 +21499,18 @@ function splitNativeToolId(rawId, fallbackIndex) {
 	};
 }
 /**
-* Parse the calls out of one section's inner text (between the section markers, or a
-* whole string that contains them - the per-call regex ignores the section markers).
+* Parse the calls out of ONE section's text.
+*
+* Callers must pass text already scoped to the section - `inner.slice(sectionBegin)` at
+* minimum, not a whole message. The cap below is applied to whatever arrives, and this
+* parser's output drives execution: handed a whole message, a long monologue ahead of
+* the section pushes it past the cap and every call silently disappears, or a call
+* straddling the cut leaves a parallel set partly executed. Both callers in this repo
+* (the stream below, and the non-streaming branch in moonshot.ts) slice first.
 */
 function parseNativeToolSection(section) {
+	if (section.length > NATIVE_TOOL_SECTION_PARSE_CAP) console.warn(`[KimiNativeTools] tool-call section is ${section.length} chars, over the ${NATIVE_TOOL_SECTION_PARSE_CAP} parse cap; calls past the cut will not run`);
+	section = capForParse(section, NATIVE_TOOL_SECTION_PARSE_CAP);
 	const calls = [];
 	const re = /<\|tool_call_begin\|>\s*([\s\S]+?)\s*<\|tool_call_argument_begin\|>\s*([\s\S]*?)\s*<\|tool_call_end\|>/g;
 	let match;
@@ -20999,20 +21545,38 @@ function partialMarkerTail(buf, marker) {
 var KimiNativeToolStream = class {
 	buffer = "";
 	inSection = false;
+	/** Inside a bare call (no section wrapper), which ends at CALL_END rather than SECTION_END. */
+	inBareCall = false;
 	push(chunk) {
 		this.buffer += chunk;
 		let text = "";
 		const toolCalls = [];
 		for (;;) {
+			if (this.inBareCall) {
+				const end = this.buffer.indexOf(CALL_END);
+				if (end === -1) break;
+				const through = end + 17;
+				toolCalls.push(...parseNativeToolSection(this.buffer.slice(0, through)));
+				this.buffer = this.buffer.slice(through);
+				this.inBareCall = false;
+				continue;
+			}
 			if (!this.inSection) {
 				const start = this.buffer.indexOf(SECTION_BEGIN);
-				if (start >= 0) {
+				const bare = this.buffer.indexOf(CALL_BEGIN);
+				if (start >= 0 && (bare === -1 || start <= bare)) {
 					text += this.buffer.slice(0, start);
 					this.buffer = this.buffer.slice(start + 28);
 					this.inSection = true;
 					continue;
 				}
-				const hold = partialMarkerTail(this.buffer, SECTION_BEGIN);
+				if (bare >= 0) {
+					text += this.buffer.slice(0, bare);
+					this.buffer = this.buffer.slice(bare);
+					this.inBareCall = true;
+					continue;
+				}
+				const hold = Math.max(partialMarkerTail(this.buffer, SECTION_BEGIN), partialMarkerTail(this.buffer, CALL_BEGIN));
 				text += this.buffer.slice(0, this.buffer.length - hold);
 				this.buffer = hold > 0 ? this.buffer.slice(this.buffer.length - hold) : "";
 				break;
@@ -21032,13 +21596,13 @@ var KimiNativeToolStream = class {
 		};
 	}
 	/**
-	* Surface any held-back tail at end of stream. Non-empty only when a section-begin
+	* Surface any held-back tail at end of stream. Non-empty only when a begin-marker
 	* prefix was held but never completed (i.e. it was ordinary text ending in `<|...`),
-	* so it is safe to emit. A genuinely unterminated section is dropped rather than
-	* leaked.
+	* so it is safe to emit. A genuinely unterminated section or call is dropped rather
+	* than leaked.
 	*/
 	flush() {
-		if (this.inSection) return "";
+		if (this.inSection || this.inBareCall) return "";
 		const remaining = this.buffer;
 		this.buffer = "";
 		return remaining;
@@ -21336,9 +21900,9 @@ var MoonshotBedrockBackend = class extends BaseBedrockBackend {
 			}
 			if (hasNativeToolMarker(content)) {
 				const inner = content.replace(/<\/?reasoning>/g, "");
-				const begin = inner.indexOf("<|tool_calls_section_begin|>");
+				const begin = nativeToolCallsBegin(inner);
 				const before = (begin >= 0 ? inner.slice(0, begin) : inner).trim();
-				const nativeCalls = parseNativeToolSection(inner);
+				const nativeCalls = begin >= 0 ? parseNativeToolSection(inner.slice(begin)) : [];
 				const think = [reasoning, before].filter(Boolean).join(" ").trim();
 				let usageAttached = false;
 				if (think) {
@@ -22439,6 +23003,22 @@ var GeminiBackend = class {
 					data: (message.content?.[0]).source.data
 				} }]
 			};
+			if (!hasToolUse && message.content?.[0].type === "image_url") {
+				const imageUrl = message.content[0].image_url.url;
+				const dataUrlMatch = /^data:([^;,]+)(?:;[^,]*)?;base64,(.+)$/s.exec(imageUrl);
+				if (dataUrlMatch) return {
+					role: mapRole(message.role),
+					parts: [{ inlineData: {
+						mimeType: dataUrlMatch[1],
+						data: dataUrlMatch[2]
+					} }]
+				};
+				if (/^https?:\/\//i.test(imageUrl)) return {
+					role: mapRole(message.role),
+					parts: [{ fileData: { fileUri: imageUrl } }]
+				};
+				return null;
+			}
 			if (hasToolUse) {
 				const toolUseBlocks = message.content.filter((item) => item.type === "tool_use");
 				const textParts = message.content.filter((item) => item.type === "text").map((item) => ({ text: item.text }));
@@ -22889,6 +23469,7 @@ var DeepSeekBackend = class {
 		let outputTokens = 0;
 		if (!(response instanceof Stream)) {
 			const streamedText = [];
+			let sawProse = false;
 			if (!response.choices || response.choices.length === 0) throw new Error("No choices returned from the DeepSeek API");
 			const turnCacheReadTokens = cachedTokensFromUsage(response.usage);
 			for (const c of response.choices) {
@@ -23003,11 +23584,12 @@ var DeepSeekBackend = class {
 						return;
 					}
 				} else {
-					const content = c.message.content || "";
-					streamedText[c.index] = reasoningContent ? `<think>${reasoningContent}</think>${content}` : content;
+					const prose = c.message.content || "";
+					if (prose) sawProse = true;
+					streamedText[c.index] = reasoningContent ? `<think>${reasoningContent}</think>${prose}` : prose;
 				}
 			}
-			if (streamedText.every((text) => !text) && toolsUsed.length === 0) {
+			if (!sawProse && toolsUsed.length === 0) {
 				const finish = response.choices[0]?.finish_reason;
 				throw new Error(finish === "length" ? `DeepSeek returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `DeepSeek returned no content for ${model} (finish_reason: ${finish ?? "unknown"}).`);
 			}
@@ -23033,7 +23615,7 @@ var DeepSeekBackend = class {
 		let streamedReasoning = "";
 		let cachedTokensFromStream = 0;
 		let streamFinishReason;
-		let sawAnyText = false;
+		let sawProse = false;
 		for await (const chunk of response) {
 			const streamedText = [];
 			if (chunk.usage) {
@@ -23055,6 +23637,7 @@ var DeepSeekBackend = class {
 				}
 				if (isInThinkingBlock && c.delta.content) {
 					isInThinkingBlock = false;
+					sawProse = true;
 					streamedText[c.index] = (streamedText[c.index] ?? "") + "</think>" + c.delta.content;
 					return;
 				}
@@ -23066,9 +23649,9 @@ var DeepSeekBackend = class {
 					func[tool.index].parameters += tool.function?.arguments || "";
 				});
 				if (func.length > 0) return;
+				if (c.delta.content) sawProse = true;
 				streamedText[c.index] = c.delta.content || "";
 			});
-			if (streamedText.some((t) => t)) sawAnyText = true;
 			const normalizedFinishReason = normalizeOpenAIFinishReason(streamFinishReason);
 			await callback(streamedText, {
 				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
@@ -23085,7 +23668,7 @@ var DeepSeekBackend = class {
 			});
 			isInThinkingBlock = false;
 		}
-		if (!sawAnyText && func.length === 0 && toolsUsed.length === 0) throw new Error(streamFinishReason === "length" ? `DeepSeek returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `DeepSeek returned no content for ${model} (finish_reason: ${streamFinishReason ?? "unknown"}).`);
+		if (!sawProse && func.length === 0 && toolsUsed.length === 0) throw new Error(streamFinishReason === "length" ? `DeepSeek returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `DeepSeek returned no content for ${model} (finish_reason: ${streamFinishReason ?? "unknown"}).`);
 		let cacheStats;
 		if (cacheStrategy?.enableCaching && inputTokens > 0) {
 			cacheStats = getCachingAdapter(ModelBackend.DeepSeek).extractCacheStats({ usage: {
@@ -23585,6 +24168,7 @@ var KimiBackend = class {
 		let outputTokens = 0;
 		if (!(response instanceof Stream)) {
 			const streamedText = [];
+			let sawProse = false;
 			if (!response.choices || response.choices.length === 0) throw new Error("No choices returned from the Moonshot API");
 			const turnCacheReadTokens = cachedTokensFromUsage(response.usage);
 			for (const c of response.choices) {
@@ -23695,11 +24279,12 @@ var KimiBackend = class {
 						return;
 					}
 				} else {
-					const content = c.message.content || "";
-					streamedText[c.index] = reasoningContent ? `<think>${reasoningContent}</think>${content}` : content;
+					const prose = c.message.content || "";
+					if (prose) sawProse = true;
+					streamedText[c.index] = reasoningContent ? `<think>${reasoningContent}</think>${prose}` : prose;
 				}
 			}
-			if (streamedText.every((text) => !text) && toolsUsed.length === 0) {
+			if (!sawProse && toolsUsed.length === 0) {
 				const finish = response.choices[0]?.finish_reason;
 				throw new Error(finish === "length" ? `Moonshot returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `Moonshot returned no content for ${model} (finish_reason: ${finish ?? "unknown"}).`);
 			}
@@ -23724,7 +24309,7 @@ var KimiBackend = class {
 		let isInThinkingBlock = false;
 		let cachedTokensFromStream = 0;
 		let streamFinishReason;
-		let sawAnyText = false;
+		let sawProse = false;
 		for await (const chunk of response) {
 			const streamedText = [];
 			if (chunk.usage) {
@@ -23745,6 +24330,7 @@ var KimiBackend = class {
 				}
 				if (isInThinkingBlock && c.delta.content) {
 					isInThinkingBlock = false;
+					sawProse = true;
 					streamedText[c.index] = (streamedText[c.index] ?? "") + "</think>" + c.delta.content;
 					return;
 				}
@@ -23756,9 +24342,9 @@ var KimiBackend = class {
 					func[tool.index].parameters += tool.function?.arguments || "";
 				});
 				if (func.length > 0) return;
+				if (c.delta.content) sawProse = true;
 				streamedText[c.index] = c.delta.content || "";
 			});
-			if (streamedText.some((t) => t)) sawAnyText = true;
 			const normalizedFinishReason = normalizeOpenAIFinishReason(streamFinishReason);
 			await callback(streamedText, {
 				...splitCacheInclusiveInput(accumInputTokens + inputTokens, accumCacheReadTokens + cachedTokensFromStream),
@@ -23775,7 +24361,7 @@ var KimiBackend = class {
 			});
 			isInThinkingBlock = false;
 		}
-		if (!sawAnyText && func.length === 0 && toolsUsed.length === 0) throw new Error(streamFinishReason === "length" ? `Moonshot returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `Moonshot returned no content for ${model} (finish_reason: ${streamFinishReason ?? "unknown"}).`);
+		if (!sawProse && func.length === 0 && toolsUsed.length === 0) throw new Error(streamFinishReason === "length" ? `Moonshot returned no content for ${model}: the output budget was exhausted before any answer was produced (finish_reason: length). Raise maxTokens or lower the reasoning effort.` : `Moonshot returned no content for ${model} (finish_reason: ${streamFinishReason ?? "unknown"}).`);
 		let cacheStats;
 		if (cacheStrategy?.enableCaching && inputTokens > 0) {
 			cacheStats = getCachingAdapter(ModelBackend.Kimi).extractCacheStats({ usage: {
@@ -25988,7 +26574,7 @@ var OpenAIBackend = class {
 		});
 		else if (m.role === "user") items.push({
 			role: "user",
-			content: chatContentToString(m.content)
+			content: chatContentToResponsesInput(m.content)
 		});
 		else if (m.role === "assistant") {
 			const text = chatContentToString(m.content);
@@ -26189,8 +26775,9 @@ var OpenAIBackend = class {
 };
 /**
 * Coerce a Chat Completions message `content` (string | content-part array | null)
-* to a plain string for Responses input items. Text parts are concatenated; other
-* parts (images/files) are dropped - the Responses path is used for text+tools turns.
+* to a plain string for Responses input items that accept text only (system,
+* assistant, tool output). Text parts are concatenated; other parts are dropped.
+* User messages go through chatContentToResponsesInput instead, which keeps images.
 */
 function chatContentToString(content) {
 	if (typeof content === "string") return content;
@@ -26202,6 +26789,47 @@ function chatContentToString(content) {
 	return "";
 }
 /**
+* Build a Responses user-message `content` from Chat-Completions-shaped content,
+* keeping image parts as `input_image` items instead of stringifying them away.
+* Returns a plain string when there is nothing but text, so text-only turns keep
+* producing exactly the input they did before.
+*/
+const RESPONSES_IMAGE_DETAIL = /* @__PURE__ */ new Set([
+	"low",
+	"high",
+	"auto",
+	"original"
+]);
+function chatContentToResponsesInput(content) {
+	if (!Array.isArray(content)) return chatContentToString(content);
+	const parts = [];
+	let sawImage = false;
+	for (const part of content) {
+		if (typeof part === "string") {
+			parts.push({
+				type: "input_text",
+				text: part
+			});
+			continue;
+		}
+		if (!part || typeof part !== "object") continue;
+		const typed = part;
+		if (typed.type === "image_url" && typed.image_url?.url) {
+			sawImage = true;
+			const detail = typed.image_url.detail;
+			parts.push({
+				type: "input_image",
+				image_url: typed.image_url.url,
+				detail: RESPONSES_IMAGE_DETAIL.has(detail) ? detail : "auto"
+			});
+		} else if (typeof typed.text === "string") parts.push({
+			type: "input_text",
+			text: typed.text
+		});
+	}
+	return sawImage ? parts : chatContentToString(content);
+}
+/**
 * Map an ICompletionOptions `tool_choice` to the Responses API shape. Strings
 * ('auto' | 'required' | 'none') pass through; the Chat Completions object form
 * `{ type:'function', function:{ name } }` becomes the Responses form
@@ -27625,32 +28253,41 @@ var UndifferentiatedBedrockBackend = class extends BaseBedrockBackend {
 	}
 };
 /**
-* The prices this build ships in code, keyed by model id.
-*
-* Same provenance as packages/database's modelPrices.seed.json - the adapter
-* `getModelInfo()` literals - reachable without a database, which is what the
-* price planner needs: a model's FIRST discovery-written row has no row in force
-* to carry the rates no feed publishes from, and a tier that reaches
-* getTextModelCost without `cache_read` settles cached reads at
-* input * CACHE_READ_MULTIPLIER. On DeepSeek Flash that default is 0.03/1M
-* against a real 0.006/1M. MUST STAY IN SYNC with collectStaticTextModels in
-* packages/database/src/seeds/generateModelPriceSeed.ts: both lists are "every
-* backend whose getModelInfo() is a static table", and Ollama is absent from
-* both because its listing is a live server call.
-*/
-const STATIC_PRICE_BACKENDS = () => [
-	new OpenAIBackend("price-literal"),
-	new AnthropicBackend("price-literal"),
+* Every backend whose `getModelInfo()` is a static table - no network, no real key.
+*
+* The one list both in-code price paths draw from: `adapterPriceTiers` below, and
+* collectStaticTextModels in packages/database/src/seeds/generateModelPriceSeed.ts,
+* which generates modelPrices.seed.json. They were two hand-synced copies, and a
+* backend reaching one but not the other is a silent billing defect on that
+* provider - a model with no carried `cache_read` settles cached reads at
+* input * CACHE_READ_MULTIPLIER (see `adapterPriceTiers`).
+*
+* Ollama is absent because its listing is a live server call; BFL and the image
+* backends publish no text models. The key is a placeholder - a static table needs
+* none, but the constructors take the argument. Both consumers filter to text
+* models, so AWSBackend (speech-to-text only) contributes nothing today.
+*/
+const staticPriceBackends = () => [
+	new OpenAIBackend("static-price-table"),
+	new AnthropicBackend("static-price-table"),
 	new UndifferentiatedBedrockBackend(),
-	new GeminiBackend("price-literal"),
-	new XAIBackend("price-literal"),
-	new KimiBackend("price-literal"),
-	new DeepSeekBackend("price-literal"),
+	new GeminiBackend("static-price-table"),
+	new XAIBackend("static-price-table"),
+	new KimiBackend("static-price-table"),
+	new DeepSeekBackend("static-price-table"),
 	new AWSBackend()
 ];
 let cached;
 /**
-* The lowest-threshold tier of each priced text model's adapter literal.
+* The prices this build ships in code: the lowest-threshold tier of each priced
+* text model's adapter literal, keyed by model id.
+*
+* Same provenance as packages/database's modelPrices.seed.json, but reachable
+* without a database, which is what the price planner needs: a model's FIRST
+* discovery-written row has no row in force to carry the rates no feed publishes
+* from, and a tier that reaches getTextModelCost without `cache_read` settles
+* cached reads at input * CACHE_READ_MULTIPLIER. On DeepSeek Flash that default
+* is 0.03/1M against a real 0.006/1M.
 *
 * Lowest tier on purpose: this is a last-resort carry for rates no feed
 * publishes (cache and audio), and those do not vary by context bracket in any
@@ -27663,7 +28300,7 @@ async function adapterPriceTiers() {
 	return cached;
 }
 async function collect() {
-	const tables = await Promise.all(STATIC_PRICE_BACKENDS().map((backend) => backend.getModelInfo()));
+	const tables = await Promise.all(staticPriceBackends().map((backend) => backend.getModelInfo()));
 	const tiers = /* @__PURE__ */ new Map();
 	for (const model of tables.flat()) {
 		if (model.type !== "text" || model.freeToRun) continue;
@@ -29823,6 +30460,7 @@ var AgentStore = class {
 	*/
 	constructor(builtinDir, projectRoot) {
 		this.agents = /* @__PURE__ */ new Map();
+		this.projectTrusted = false;
 		const root = projectRoot || process.cwd();
 		const home = os.homedir();
 		this.builtinAgentsDir = builtinDir;
@@ -29845,8 +30483,17 @@ var AgentStore = class {
 		await this.loadAgentsFromDirectory(this.builtinAgentsDir, "builtin");
 		await this.loadAgentsFromDirectory(this.globalB4MAgentsDir, "global");
 		await this.loadAgentsFromDirectory(this.globalClaudeAgentsDir, "global");
-		await this.loadAgentsFromDirectory(this.projectB4MAgentsDir, "project");
-		await this.loadAgentsFromDirectory(this.projectClaudeAgentsDir, "project");
+		if (this.projectTrusted) {
+			await this.loadAgentsFromDirectory(this.projectB4MAgentsDir, "project");
+			await this.loadAgentsFromDirectory(this.projectClaudeAgentsDir, "project");
+		}
+	}
+	/**
+	* Set whether the project root is trusted. When false, `loadAgents()` skips
+	* the project agent directories. Call before `loadAgents()`.
+	*/
+	setProjectTrusted(trusted) {
+		this.projectTrusted = trusted;
 	}
 	/**
 	* Recursively load agents from a directory
@@ -30027,6 +30674,31 @@ Describe the expected output format here.
 	}
 };
 //#endregion
+//#region src/bootstrap/projectStores.ts
+/**
+* Build the project AgentStore with the folder-trust gate wired from the
+* ConfigStore, but NOT yet loaded (the caller runs `loadAgents()`).
+*
+* Centralizes the trust wiring so the headless (`b4m -p`) and interactive
+* bootstrap paths can't drift: an untrusted project must contribute no agents
+* in EITHER path. Pairs with `loadProjectContext` below - must stay in sync.
+*/
+function buildProjectAgentStore(builtinAgentsDir, configStore) {
+	const store = new AgentStore(builtinAgentsDir, configStore.getProjectConfigDir() ?? process.cwd());
+	store.setProjectTrusted(configStore.isProjectTrusted());
+	return store;
+}
+/**
+* Load the project + global context files with the folder-trust gate applied:
+* an untrusted project passes `null` so its CLAUDE.md/AGENTS.md is never
+* injected. Same invariant as `buildProjectAgentStore`, shared by the headless
+* and interactive paths.
+*/
+function loadProjectContext(configStore) {
+	const projectDir = configStore.getProjectConfigDir();
+	return loadContextFiles(configStore.isProjectTrusted() ? projectDir : null);
+}
+//#endregion
 //#region ../../b4m-core/utils/dist/rolldown-runtime-BBjsoOtd.mjs
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -30306,12 +30978,53 @@ function parseArtifacts(content) {
 		cleanedContent: cleanedContent.trim()
 	};
 }
+function hasReactComponentLine(code) {
+	const DECLARATIONS = [
+		"function",
+		"const",
+		"class"
+	];
+	const COMPONENT_TOKENS = [
+		"component",
+		"app",
+		"export default"
+	];
+	for (const rawLine of code.split("\n")) {
+		const line = rawLine.toLowerCase();
+		let declStart = Infinity;
+		let declEnd = -1;
+		for (const decl of DECLARATIONS) {
+			const at = line.indexOf(decl);
+			if (at >= 0 && at < declStart) {
+				declStart = at;
+				declEnd = at + decl.length;
+			}
+		}
+		if (declEnd < 0) continue;
+		const afterDecl = line.slice(declEnd);
+		if (COMPONENT_TOKENS.some((token) => afterDecl.includes(token))) return true;
+	}
+	return false;
+}
+function hasFullHtmlDocument(code) {
+	const lower = code.toLowerCase();
+	const doctype = lower.indexOf("<!doctype");
+	if (doctype < 0) return false;
+	return lower.indexOf("</html>", doctype + 9) >= 0;
+}
+function hasCompleteSvg(code) {
+	const lower = code.toLowerCase();
+	const open = lower.indexOf("<svg");
+	if (open < 0) return false;
+	return lower.indexOf("</svg>", open + 4) >= 0;
+}
 /**
 * Post-processes AI responses to detect code blocks that should be artifacts
 * and converts them to proper artifact syntax as a fallback
 */
 function convertCodeBlocksToArtifacts(content) {
-	content = content.replace(/```(?:tsx?|javascript|jsx)\s*((?:.*\n)*?.*(?:function|const|class).*(?:Component|App|export default).*(?:\n.*)*?)```/gi, (match, codeContent) => {
+	content = content.replace(/```(?:tsx?|javascript|jsx)\s*([\s\S]*?)```/gi, (match, codeContent) => {
+		if (!hasReactComponentLine(codeContent)) return match;
 		if (codeContent.includes("useState") || codeContent.includes("useEffect") || codeContent.includes("export default") || codeContent.includes("function") && codeContent.includes("return")) {
 			const componentName = extractComponentName(codeContent) || "component";
 			return `<artifact identifier="${componentName.toLowerCase().replace(/[^a-z0-9]/g, "-")}" type="application/vnd.ant.react" title="${componentName}">
@@ -30320,7 +31033,8 @@ ${codeContent.trim()}
 		}
 		return match;
 	});
-	content = content.replace(/```html\s*((?:.*\n)*?.*<!DOCTYPE.*(?:\n.*)*?.*<\/html>.*(?:\n.*)*?)```/gi, (match, codeContent) => {
+	content = content.replace(/```html\s*([\s\S]*?)```/gi, (match, codeContent) => {
+		if (!hasFullHtmlDocument(codeContent)) return match;
 		const title = extractHTMLTitle(codeContent) || "HTML Page";
 		return `<artifact identifier="${title.toLowerCase().replace(/[^a-z0-9]/g, "-")}" type="text/html" title="${title}">
 ${codeContent.trim()}
@@ -30333,7 +31047,8 @@ ${codeContent.trim()}
 ${codeContent.trim()}
 </artifact>`;
 	});
-	content = content.replace(/```svg\s*((?:.*\n)*?.*<svg.*(?:\n.*)*?.*<\/svg>.*(?:\n.*)*?)```/gi, (match, codeContent) => {
+	content = content.replace(/```svg\s*([\s\S]*?)```/gi, (match, codeContent) => {
+		if (!hasCompleteSvg(codeContent)) return match;
 		return `<artifact identifier="svg-graphic" type="image/svg+xml" title="SVG Graphic">
 ${codeContent.trim()}
 </artifact>`;
@@ -30668,8 +31383,9 @@ function effectiveContextWindow(modelInfo) {
 function safeInputWindow(modelInfo, requestedMaxTokens, safetyBuffer = CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS) {
 	const returnsMedia = isMediaModelType(modelInfo.type);
 	const contextLimit = effectiveContextWindow(modelInfo);
-	const modelMaxOutput = modelInfo.max_tokens ?? 16384;
-	return contextLimit - (returnsMedia ? 0 : Math.min(requestedMaxTokens, modelMaxOutput)) - safetyBuffer;
+	const cap = usableTokenCount(modelInfo.max_tokens);
+	const capClamps = modelInfo.maxOutputTokensDerived !== true;
+	return contextLimit - (returnsMedia ? 0 : capClamps && cap !== void 0 ? Math.min(requestedMaxTokens, cap) : requestedMaxTokens) - safetyBuffer;
 }
 /**
 * Floor for the context-overflow buffer, used when 5% of the context window is under 1000 tokens.
@@ -30761,7 +31477,7 @@ const DEFAULT_OUTPUT_MAX_TOKENS = 4096;
 * turn instead of disabling the trim.
 */
 function computeVerbatimTokenBudget(modelInfo, requestedMaxTokens, opts) {
-	const modelMaxOutput = modelInfo.max_tokens ?? 16384;
+	const modelMaxOutput = modelInfo.max_tokens;
 	const safeMaxTokens = resolveOutputMaxTokens({
 		requested: requestedMaxTokens,
 		fallback: DEFAULT_OUTPUT_MAX_TOKENS,
@@ -31246,7 +31962,7 @@ async function getSettingsByNames(settingNames, db, options) {
 			result[name] = null;
 		});
 		settings.forEach((setting) => {
-			result[setting.settingName] = setting.settingValue;
+			result[setting.settingName] = setting.settingValue ?? null;
 		});
 		return result;
 	}
@@ -31472,12 +32188,9 @@ async function getFileType(buffer, fileName, currentMimeType = "") {
 		ext: fileType.ext,
 		mime: fileType.mime
 	};
-	let ext = getFileExtension(fileName);
-	const mime = currentMimeType || (isPlainText(buffer) ? SupportedFabFileMimeTypes.TXT_PLAIN : "application/octet-stream");
-	ext = ext ?? MIME_TO_EXT[mime] ?? "";
 	return {
-		ext,
-		mime
+		ext: getFileExtension(fileName),
+		mime: currentMimeType || (isPlainText(buffer) ? SupportedFabFileMimeTypes.TXT_PLAIN : "application/octet-stream")
 	};
 }
 /**
@@ -31521,91 +32234,123 @@ function decodeBase64DataUrl(dataUrl) {
 const getFileExtension = (fileName) => {
 	return path.extname(fileName).toLowerCase().slice(1);
 };
+const hasFileExtension = (fileName) => getFileExtension(fileName) !== "";
+const isExtensionlessFileName = (fileName) => !hasFileExtension(fileName) && !fileName.endsWith(".");
 /**
-* Returns the MIME type corresponding to a given file extension.
-* Special handling for configuration files and TypeScript files.
+* Returns the MIME type corresponding to a given file extension, or '' if unresolved.
 */
 const getMimeTypeByExtension = (ext) => {
-	const EXT_TO_MIME = invert(MIME_TO_EXT);
 	const lowerExt = ext.toLowerCase();
-	if ([
-		"ini",
-		"env",
-		"conf"
-	].includes(lowerExt)) return SupportedFabFileMimeTypes.TXT_PLAIN;
-	if (lowerExt === "tsx" || lowerExt === "ts") return SupportedFabFileMimeTypes.TS;
-	if (lowerExt === "mdx") return SupportedFabFileMimeTypes.TXT_MARKDOWN;
-	if (lowerExt === "xls") return SupportedFabFileMimeTypes.XLS;
-	if (lowerExt === "xlsx") return SupportedFabFileMimeTypes.XLSX;
-	if (lowerExt === "docx") return SupportedFabFileMimeTypes.DOCX;
-	if (lowerExt === "pptx") return SupportedFabFileMimeTypes.PPTX;
-	if (lowerExt === "jpeg") return SupportedFabFileMimeTypes.JPG;
 	return EXT_TO_MIME[lowerExt] ?? "";
 };
 /**
-* Resolve the effective, supported MIME type for an uploaded file.
-*
-* Browsers frequently report an empty or generic (`application/octet-stream`)
-* MIME type - even for supported code/text files (e.g. `.py`, `.ts`). We trust
-* a claimed type only if it's already supported; otherwise we derive the type
-* from the file extension. The returned `mimeType` is what should be persisted
-* (so the chunker keys on a type it can actually process), and `supported`
-* gates ingest so unsupported/binary files (e.g. `.exe`) are rejected.
+* Resolve the effective MIME type for an uploaded file: `mimeType` is what to persist (so the
+* chunker keys on a type it can process) and `supported` gates ingest. Under the default
+* `'extension-first'` a name whose extension does not resolve is refused outright, claim or no
+* claim. `'claim-first'` exists for a claim that comes from a trusted server-side source rather
+* than a client (Google Drive's stored metadata), where the user-renamable filename is worth less.
 *
 * @param fileName - Original file name (used to derive the extension).
-* @param claimedMimeType - The browser/client-provided MIME type, if any.
-*/
-function resolveSupportedMimeType(fileName, claimedMimeType) {
-	if (isSupportedFabFileMimeType(claimedMimeType)) return {
+* @param claimedMimeType - The claimed MIME type, if any.
+* @param opts.isAcceptable - Predicate gating both extension- and claim-derived types; defaults
+* to `isSupportedFabFileMimeType`.
+* @param opts.precedence - Which of extension/claim is consulted first; defaults to
+* `'extension-first'`.
+* @param opts.extensionlessFallback - Type for a name carrying no extension at all (`LICENSE`,
+* `.env`) that also carried no claim. Omit it to keep a door strict.
+*/
+function resolveSupportedMimeType(fileName, claimedMimeType, opts = {}) {
+	const { isAcceptable = isSupportedFabFileMimeType, precedence = "extension-first", extensionlessFallback } = opts;
+	const ext = getFileExtension(fileName);
+	const byExtension = getMimeTypeByExtension(ext);
+	const extensionResult = byExtension ? {
+		mimeType: byExtension,
+		supported: isAcceptable(byExtension)
+	} : null;
+	if (!extensionResult && ext !== "" && precedence !== "claim-first") return {
+		mimeType: "",
+		supported: false
+	};
+	const claimResult = claimedMimeType && isAcceptable(claimedMimeType) ? {
 		mimeType: claimedMimeType,
 		supported: true
+	} : null;
+	const resolved = precedence === "claim-first" ? claimResult ?? extensionResult : extensionResult ?? claimResult;
+	if (resolved) return resolved;
+	if (extensionlessFallback && !claimedMimeType && isExtensionlessFileName(fileName)) return {
+		mimeType: extensionlessFallback,
+		supported: isAcceptable(extensionlessFallback)
 	};
-	const byExtension = getMimeTypeByExtension(getFileExtension(fileName));
 	return {
-		mimeType: byExtension,
-		supported: isSupportedFabFileMimeType(byExtension)
+		mimeType: "",
+		supported: false
 	};
 }
-const MIME_TO_EXT = {
-	[SupportedFabFileMimeTypes.TXT_PLAIN]: "txt",
-	[SupportedFabFileMimeTypes.TXT_MARKDOWN]: "md",
-	[SupportedFabFileMimeTypes.TXT_MD_LEGACY]: "md",
-	[SupportedFabFileMimeTypes.HTML]: "html",
-	[SupportedFabFileMimeTypes.CSV]: "csv",
-	[SupportedFabFileMimeTypes.JPG]: "jpg",
-	[SupportedFabFileMimeTypes.PNG]: "png",
-	[SupportedFabFileMimeTypes.GIF]: "gif",
-	[SupportedFabFileMimeTypes.SVG]: "svg",
-	[SupportedFabFileMimeTypes.WEBP]: "webp",
-	[SupportedFabFileMimeTypes.PDF]: "pdf",
-	[SupportedFabFileMimeTypes.JSON]: "json",
-	[SupportedFabFileMimeTypes.XML]: "xml",
-	[SupportedFabFileMimeTypes.DOCX]: "docx",
-	[SupportedFabFileMimeTypes.PPTX]: "pptx",
-	[SupportedFabFileMimeTypes.XLSX]: "xlsx",
-	[SupportedFabFileMimeTypes.XLS]: "xls",
-	[SupportedFabFileMimeTypes.JS]: "js",
-	[SupportedFabFileMimeTypes.JSX]: "jsx",
-	[SupportedFabFileMimeTypes.TS]: "ts",
-	[SupportedFabFileMimeTypes.PY]: "py",
-	[SupportedFabFileMimeTypes.JAVA]: "java",
-	[SupportedFabFileMimeTypes.CPP]: "cpp",
-	[SupportedFabFileMimeTypes.CS]: "cs",
-	[SupportedFabFileMimeTypes.PHP]: "php",
-	[SupportedFabFileMimeTypes.RUBY]: "rb",
-	[SupportedFabFileMimeTypes.GO]: "go",
-	[SupportedFabFileMimeTypes.SWIFT]: "swift",
-	[SupportedFabFileMimeTypes.KOTLIN]: "kt",
-	[SupportedFabFileMimeTypes.RUST]: "rs",
-	[SupportedFabFileMimeTypes.CSS]: "css",
-	[SupportedFabFileMimeTypes.LESS]: "less",
-	[SupportedFabFileMimeTypes.SASS]: "sass",
-	[SupportedFabFileMimeTypes.SCSS]: "scss",
-	[SupportedFabFileMimeTypes.YAML]: "yaml",
-	[SupportedFabFileMimeTypes.TOML]: "toml",
-	[SupportedFabFileMimeTypes.SH]: "sh",
-	[SupportedFabFileMimeTypes.BASH]: "bash"
-};
+const EXT_TO_MIME = Object.assign(Object.create(null), {
+	txt: SupportedFabFileMimeTypes.TXT_PLAIN,
+	ini: SupportedFabFileMimeTypes.TXT_PLAIN,
+	env: SupportedFabFileMimeTypes.TXT_PLAIN,
+	conf: SupportedFabFileMimeTypes.TXT_PLAIN,
+	log: SupportedFabFileMimeTypes.TXT_PLAIN,
+	sql: SupportedFabFileMimeTypes.TXT_PLAIN,
+	text: SupportedFabFileMimeTypes.TXT_PLAIN,
+	md: SupportedFabFileMimeTypes.TXT_MARKDOWN,
+	mdx: SupportedFabFileMimeTypes.TXT_MARKDOWN,
+	html: SupportedFabFileMimeTypes.HTML,
+	htm: SupportedFabFileMimeTypes.HTML,
+	shtml: SupportedFabFileMimeTypes.HTML,
+	csv: SupportedFabFileMimeTypes.CSV,
+	jpg: SupportedFabFileMimeTypes.JPG,
+	jpeg: SupportedFabFileMimeTypes.JPG,
+	jfif: SupportedFabFileMimeTypes.JPG,
+	jpe: SupportedFabFileMimeTypes.JPG,
+	png: SupportedFabFileMimeTypes.PNG,
+	gif: SupportedFabFileMimeTypes.GIF,
+	svg: SupportedFabFileMimeTypes.SVG,
+	webp: SupportedFabFileMimeTypes.WEBP,
+	pdf: SupportedFabFileMimeTypes.PDF,
+	json: SupportedFabFileMimeTypes.JSON,
+	xml: SupportedFabFileMimeTypes.XML,
+	docx: SupportedFabFileMimeTypes.DOCX,
+	pptx: SupportedFabFileMimeTypes.PPTX,
+	xlsx: SupportedFabFileMimeTypes.XLSX,
+	xls: SupportedFabFileMimeTypes.XLS,
+	js: SupportedFabFileMimeTypes.JS,
+	mjs: SupportedFabFileMimeTypes.JS,
+	cjs: SupportedFabFileMimeTypes.JS,
+	jsx: SupportedFabFileMimeTypes.JSX,
+	ts: SupportedFabFileMimeTypes.TS,
+	tsx: SupportedFabFileMimeTypes.TS,
+	py: SupportedFabFileMimeTypes.PY,
+	java: SupportedFabFileMimeTypes.JAVA,
+	cpp: SupportedFabFileMimeTypes.CPP,
+	c: SupportedFabFileMimeTypes.CPP,
+	h: SupportedFabFileMimeTypes.CPP,
+	cs: SupportedFabFileMimeTypes.CS,
+	php: SupportedFabFileMimeTypes.PHP,
+	rb: SupportedFabFileMimeTypes.RUBY,
+	go: SupportedFabFileMimeTypes.GO,
+	swift: SupportedFabFileMimeTypes.SWIFT,
+	kt: SupportedFabFileMimeTypes.KOTLIN,
+	rs: SupportedFabFileMimeTypes.RUST,
+	css: SupportedFabFileMimeTypes.CSS,
+	less: SupportedFabFileMimeTypes.LESS,
+	sass: SupportedFabFileMimeTypes.SASS,
+	scss: SupportedFabFileMimeTypes.SCSS,
+	yaml: SupportedFabFileMimeTypes.YAML,
+	yml: SupportedFabFileMimeTypes.YAML,
+	toml: SupportedFabFileMimeTypes.TOML,
+	sh: SupportedFabFileMimeTypes.SH,
+	bash: SupportedFabFileMimeTypes.BASH,
+	mp3: AudioMimeType.MP3,
+	wav: AudioMimeType.WAV,
+	opus: AudioMimeType.OPUS,
+	aac: AudioMimeType.AAC,
+	flac: AudioMimeType.FLAC,
+	pcm: AudioMimeType.PCM,
+	ogg: AudioMimeType.OGG,
+	webm: AudioMimeType.WEBM
+});
 const MAX_FILE_SIZE = 6e3;
 /** Cap on generated images surfaced to the model for editing (keeps the context note small). */
 const MAX_RECENT_GENERATED_IMAGES = 6;
@@ -32292,6 +33037,24 @@ async function cosineSearch(file, userPromptVector, { db, logger }) {
 }
 /** Passthrough default: no resize when a caller doesn't inject one. */
 const noopResize = async (imageBuffer) => imageBuffer;
+/**
+* Skip an image whose declared canvas is over the decode budget (resizeImageForModel returned
+* null). It is never decoded, so it cannot be downscaled here - only a smaller upload fixes it.
+* Every vision path that drops a file has to push a notice, or the file reaches neither the prompt
+* nor the user (#2228).
+*/
+async function noticeOversizedCanvas(file, fileNotices, logger, sendStatusUpdate) {
+	const message = `\u26a0\ufe0f Image "${file.fileName}" declares too large a canvas to process and was not sent. Please delete this file and re-upload a smaller image.`;
+	logger.warn(message);
+	await sendStatusUpdate(message);
+	fileNotices.push({
+		fabFileId: file.id,
+		fileName: file.fileName,
+		band: "image_too_large",
+		message,
+		delivered: false
+	});
+}
 async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, attachedContentTokenBudget, modelInfo, sendStatusUpdate, { logger, storage, db, resizeImageForModel = noopResize }, progressCallback) {
 	if (!fabFiles || fabFiles.length === 0) return {
 		userMessages: [],
@@ -32398,6 +33161,10 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 								return;
 							}
 							const imageBuffer = await resizeImageForModel(await storage.download(file.filePath), void 0, logger);
+							if (imageBuffer === null) {
+								await noticeOversizedCanvas(file, fileNotices, logger, sendStatusUpdate);
+								return;
+							}
 							const imageData = imageBuffer.toString("base64");
 							const { mime: actualMimeType } = await getFileType(imageBuffer, file.fileName, file.mimeType);
 							imageContent.push({
@@ -32416,6 +33183,10 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 							fullyDelivered = true;
 						} else if (modelInfo.id.startsWith("moonshot")) {
 							const moonshotBuffer = await resizeImageForModel(await storage.download(file.filePath), void 0, logger);
+							if (moonshotBuffer === null) {
+								await noticeOversizedCanvas(file, fileNotices, logger, sendStatusUpdate);
+								return;
+							}
 							const { mime: moonshotMimeType } = await getFileType(moonshotBuffer, file.fileName, file.mimeType);
 							const moonshotBase64 = moonshotBuffer.toString("base64");
 							if (moonshotBase64.length > 3e6) {
@@ -32455,6 +33226,10 @@ async function processFabFilesServer(embeddingFactory, fabFiles, userPrompt, att
 						break;
 					case ModelBackend.Ollama: {
 						const imageBuffer = await resizeImageForModel(await storage.download(file.filePath), void 0, logger);
+						if (imageBuffer === null) {
+							await noticeOversizedCanvas(file, fileNotices, logger, sendStatusUpdate);
+							return;
+						}
 						const { mime: ollamaMimeType } = await getFileType(imageBuffer, file.fileName, file.mimeType);
 						const ollamaBase64 = imageBuffer.toString("base64");
 						const OLLAMA_IMAGE_WARN_MB = 3.5;
@@ -34831,6 +35606,38 @@ const OPENAI_IMAGE_CLIENT_OPTS = {
 	maxRetries: 0
 };
 const ALTERNATIVE_IMAGE_MODELS = "Flux Pro, Flux Dev, or Grok";
+const GPT_IMAGE_QUALITY_VALUES = [
+	"low",
+	"medium",
+	"high",
+	"auto"
+];
+function isGptImageQuality(value) {
+	return typeof value === "string" && GPT_IMAGE_QUALITY_VALUES.includes(value);
+}
+/**
+* Normalizes a requested quality to the tier a GPT-Image model actually accepts, or
+* undefined when it maps to nothing usable. The 'standard'/'hd' translation must stay
+* in step with OpenAIImageCostCalculator.normalizeInput (services) and
+* ImageGeneration's mapQualityForModel, which bill against the mapped tier - if they
+* diverge, the user is charged one tier and rendered another.
+*
+* 'auto' is the one value deliberately forwarded unresolved: OpenAI picks the effort per
+* request, so the services-side calculator prices it at the highest tier it could render
+* rather than pretending to know the tier. Do not "fix" that by pinning 'auto' here without
+* repricing it there. (Named symbols are left out on purpose - services depends on utils, not
+* the reverse, so nothing in this package can import or rename-track them.)
+*
+* An absent quality still maps to undefined here, which drops the parameter and lets OpenAI
+* apply its own 'auto'. On the generation path that state is no longer reachable: both
+* dispatch sites in services pin an omitted tier to the tier they bill before calling in, so
+* the render matches the charge. The edit path does not pin, and is priced separately.
+* Keep this a pure mapper - the pin belongs with the code that also holds the credits.
+*/
+function toGptImageQuality(quality) {
+	const mapped = quality === "standard" ? "medium" : quality === "hd" ? "high" : quality;
+	return isGptImageQuality(mapped) ? mapped : void 0;
+}
 const truncatePromptForLog = (prompt) => prompt.length > 100 ? `${prompt.slice(0, 100)}...` : prompt;
 /**
 * Builds a user-friendly error when OpenAI's safety system blocks an image
@@ -34860,53 +35667,51 @@ function buildModerationBlockedError(error) {
 Tip: Switch to an alternative model with different content policies — e.g. ${ALTERNATIVE_IMAGE_MODELS} — which may accept this prompt.\n\nIf you believe this is an error, you can report it to OpenAI with request ID: ${requestId}`);
 }
 /**
-* Splits a WIDTHxHEIGHT size into its two edges, or null when the value is not a
-* pair of non-zero numbers (e.g. 'auto', '', 'wide'). Null means "not a custom
-* resolution" rather than "invalid": generate() has always left such values
-* untouched, and that behaviour is preserved.
-*/
-function parseSizeEdges(size) {
-	if (typeof size !== "string") return null;
-	const [width, height] = size.split("x").map(Number);
-	if (!width || !height) return null;
-	return {
-		width,
-		height
-	};
-}
-/**
-* True when a custom gpt-image-2 resolution meets OpenAI's documented limits.
-* gpt-image-2 accepts any resolution satisfying these, not only the presets in
-* OPENAI_GPT_IMAGE_2_IMAGE_SIZES, so a flat preset check would reject valid
-* custom sizes. Must stay the single source of this rule for generate() and edit().
-*/
-function satisfiesGptImage2Constraints({ width, height }) {
-	const { maxEdge, minTotalPixels, maxTotalPixels, edgeMultiple, maxAspectRatio } = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.constraints;
-	const longEdge = Math.max(width, height);
-	const shortEdge = Math.min(width, height);
-	const totalPixels = width * height;
-	return longEdge <= maxEdge && width % edgeMultiple === 0 && height % edgeMultiple === 0 && longEdge / shortEdge <= maxAspectRatio && totalPixels >= minTotalPixels && totalPixels <= maxTotalPixels;
-}
-/**
-* True when `size` may be forwarded to images.edit for `model`. gpt-image-2 takes
-* its presets (including 'auto') or any custom WIDTHxHEIGHT meeting the same
-* constraints generate() enforces; the gpt-image-1 family is limited to its three
-* fixed sizes. An unsupported size is dropped by the caller so OpenAI applies its
-* own default instead of rejecting the whole request with a 400.
-*
-* GPT-Image tiers only: dall-e-2 has its own size list and passes size through
-* untouched, so do not route that model here.
-*/
-function isSupportedEditSize(model, size) {
-	if (typeof size !== "string") return false;
-	if (isGPTImage2Model(model)) {
-		if (OPENAI_GPT_IMAGE_2_IMAGE_SIZES.includes(size)) return true;
-		const edges = parseSizeEdges(size);
-		return edges !== null && satisfiesGptImage2Constraints(edges);
+* Resolve the alpha/container pair gpt-image accepts. OpenAI rejects
+* `background: 'transparent'` together with jpeg (no alpha channel), so a transparent
+* request promotes the container to png rather than failing the whole render.
+* gpt-image-2 rejects `background: 'transparent'` outright, so it is dropped there
+* (falling back to OpenAI's own default) with a warning instead of 400-ing the whole
+* request - this is the single backstop for every call site (generate/edit, tool call
+* or queue handler, explicit model selection or default), so `model` must be the
+* fully-resolved model actually sent to OpenAI, not a pre-fallback value.
+* Returns the fields to spread onto the request; absent keys mean "let OpenAI default".
+*/
+function resolveGptImageOutputOptions(background, outputFormat, warnings, model) {
+	const resolved = {};
+	if (background) resolved.background = background;
+	if (outputFormat) resolved.output_format = outputFormat;
+	if (background === "transparent" && isGPTImage2Model(model)) {
+		delete resolved.background;
+		warnings.push("gpt-image-2 does not support background: 'transparent'; background parameter removed");
+	}
+	if (resolved.background === "transparent" && outputFormat === "jpeg") {
+		resolved.output_format = "png";
+		warnings.push("Transparent background requires an alpha-capable format; output_format changed from 'jpeg' to 'png'");
 	}
-	return OPENAI_GPT_IMAGE_1_IMAGE_SIZES.includes(size);
+	return resolved;
 }
 var OpenAIImageService = class extends AIImageService {
+	/**
+	* Fetches an image (URL or data URL) and normalizes it to the PNG-under-4MB form every
+	* OpenAI image endpoint accepts. The 4MB/PNG coercion is dall-e-2's constraint, not
+	* gpt-image's (which takes png/webp/jpg up to 50MB) - kept as-is so this refactor does
+	* not change what reaches the provider.
+	*/
+	async toImageFile(source, fileName) {
+		if (!this.imageProcessorLambdaName) throw new Error("ImageProcessor Lambda name is required for image processing. Please provide it when creating the image service.");
+		const pngBuffer = await invokeImageProcessor(await downloadImageAsBuffer(source), this.imageProcessorLambdaName, 4);
+		return new File([pngBuffer], fileName, { type: "image/png" });
+	}
+	/**
+	* Converts style-anchor sources into files, in the order given. Parallel on purpose: each
+	* source costs a download plus an ImageProcessor Lambda round trip, and serialized those
+	* would eat a meaningful share of the 8-minute client budget (OPENAI_IMAGE_CLIENT_OPTS).
+	*/
+	async toReferenceImageFiles(sources) {
+		if (!sources?.length) return [];
+		return Promise.all(sources.map((source, i) => this.toImageFile(source, `reference-${i + 1}.png`)));
+	}
 	async generate(prompt, options) {
 		const openai = new OpenAI({
 			apiKey: this.apiKey,
@@ -34914,42 +35719,30 @@ var OpenAIImageService = class extends AIImageService {
 		});
 		Logger.log("Generating image... with these params: ", options);
 		try {
-			const { safety_tolerance, prompt_upsampling, seed: bflSeed, output_format, imagePrompt, stream, ...openaiOptions } = options;
+			const { safety_tolerance, prompt_upsampling, seed: bflSeed, output_format, background, imagePrompt, referenceImages, stream, ...openaiOptions } = options;
 			const parameterWarnings = [];
+			let gptImageOutputOptions = {};
+			const modelName = options.model || ImageModels.GPT_IMAGE_1_5;
 			if (isGPTImageModel(options.model)) {
-				const modelName = options.model || ImageModels.GPT_IMAGE_1_5;
 				openaiOptions.model = modelName;
+				gptImageOutputOptions = resolveGptImageOutputOptions(background, output_format, parameterWarnings, modelName);
 				if (openaiOptions.style) {
 					parameterWarnings.push(`Style parameter ('${openaiOptions.style}') is not supported by ${modelName} and was removed`);
 					delete openaiOptions.style;
 				}
 				if (openaiOptions.response_format) delete openaiOptions.response_format;
 				if (openaiOptions.quality) {
-					parameterWarnings.push(`Quality parameter ('${openaiOptions.quality}') is not supported by ${modelName} text-to-image generation and was removed`);
-					delete openaiOptions.quality;
+					const mappedQuality = toGptImageQuality(openaiOptions.quality);
+					if (mappedQuality) openaiOptions.quality = mappedQuality;
+					else {
+						parameterWarnings.push(`Quality parameter ('${openaiOptions.quality}') is not supported by ${modelName} and was removed`);
+						delete openaiOptions.quality;
+					}
 				}
-				if (isGPTImage2Model(options.model)) {
-					if (openaiOptions.size && openaiOptions.size !== "auto") {
-						const edges = parseSizeEdges(openaiOptions.size);
-						if (edges && !satisfiesGptImage2Constraints(edges)) {
-							const originalSize = openaiOptions.size;
-							openaiOptions.size = "1024x1024";
-							parameterWarnings.push(`Size '${originalSize}' violates gpt-image-2 constraints, changed to '1024x1024'`);
-						}
-					} else if (!openaiOptions.size) openaiOptions.size = "auto";
-				} else {
-					const validGPTSizes = [
-						"1024x1024",
-						"1536x1024",
-						"1024x1536"
-					];
-					if (openaiOptions.size) {
-						if (!validGPTSizes.includes(openaiOptions.size)) {
-							const originalSize = openaiOptions.size;
-							openaiOptions.size = "1024x1024";
-							parameterWarnings.push(`Size '${originalSize}' is not supported by ${modelName}, changed to '1024x1024'`);
-						}
-					} else openaiOptions.size = "1024x1024";
+				const resolvedSize = resolveGptImageGenerateSize(modelName, openaiOptions.size);
+				if (resolvedSize !== openaiOptions.size) {
+					if (openaiOptions.size) parameterWarnings.push(`Size '${openaiOptions.size}' is not supported by ${modelName}, changed to '${resolvedSize}'`);
+					openaiOptions.size = resolvedSize;
 				}
 				if ("width" in openaiOptions || "height" in openaiOptions) {
 					const dims = openaiOptions;
@@ -34957,52 +35750,54 @@ var OpenAIImageService = class extends AIImageService {
 					delete dims.height;
 					parameterWarnings.push(`Custom width/height not supported by ${modelName}, using standard sizes`);
 				}
-				if (parameterWarnings.length > 0) Logger.globalInstance.debug(`[DEBUG] ⚠️ ${modelName} parameter adjustments:`, parameterWarnings);
 			} else {
 				openaiOptions.response_format = "url";
+				if (background) parameterWarnings.push(`Background parameter ('${background}') is only supported by gpt-image models and was removed`);
+				if (output_format) parameterWarnings.push(`Output format parameter ('${output_format}') is only supported by gpt-image models and was removed`);
 				if (openaiOptions.quality && !["standard", "hd"].includes(openaiOptions.quality)) {
 					const originalQuality = openaiOptions.quality;
 					openaiOptions.quality = "standard";
 					parameterWarnings.push(`Quality '${originalQuality}' is not supported by legacy models, changed to 'standard'`);
 				}
-				if (openaiOptions.size && ![
-					"256x256",
-					"512x512",
-					"1024x1024",
-					"1792x1024",
-					"1024x1792"
-				].includes(openaiOptions.size)) {
+				if (openaiOptions.size && !isSupportedImageSize(openaiOptions.model, openaiOptions.size)) {
 					const originalSize = openaiOptions.size;
-					openaiOptions.size = "1024x1024";
-					parameterWarnings.push(`Size '${originalSize}' is not supported by legacy models, changed to '1024x1024'`);
+					openaiOptions.size = fallbackImageSize(openaiOptions.model);
+					parameterWarnings.push(`Size '${originalSize}' is not supported by legacy models, changed to '${openaiOptions.size}'`);
 				}
 			}
+			if (parameterWarnings.length > 0) Logger.globalInstance.debug(`[DEBUG] ⚠️ ${modelName} parameter adjustments:`, parameterWarnings);
 			if (bflSeed !== null && bflSeed !== void 0) openaiOptions.seed = bflSeed;
 			let images = [];
 			let result;
 			if (imagePrompt) {
-				const imageBuffer = await downloadImageAsBuffer(imagePrompt);
-				if (!this.imageProcessorLambdaName) throw new Error("ImageProcessor Lambda name is required for image processing. Please provide it when creating the image service.");
-				const pngBuffer = await invokeImageProcessor(imageBuffer, this.imageProcessorLambdaName, 4);
-				const imageFile = new File([pngBuffer], "image.png", { type: "image/png" });
+				const imageFile = await this.toImageFile(imagePrompt, "image.png");
 				if (isGPTImageModel(options.model)) {
 					const editModel = options.model || ImageModels.GPT_IMAGE_2;
+					const editQuality = toGptImageQuality(openaiOptions.quality);
+					const editSize = isSupportedImageSize(editModel, openaiOptions.size) ? openaiOptions.size : void 0;
+					const imageFiles = [imageFile, ...await this.toReferenceImageFiles(referenceImages)];
 					this.logger.log("OpenAI image generation request (edit endpoint, image-to-image):", {
 						model: editModel,
-						prompt: truncatePromptForLog(prompt)
+						prompt: truncatePromptForLog(prompt),
+						quality: editQuality,
+						size: editSize,
+						n: openaiOptions.n,
+						referenceImageCount: imageFiles.length - 1,
+						...gptImageOutputOptions
 					});
 					result = await openai.images.edit({
 						model: editModel,
-						image: [imageFile],
-						prompt
+						image: imageFiles,
+						prompt,
+						...editQuality ? { quality: editQuality } : {},
+						...editSize ? { size: editSize } : {},
+						...openaiOptions.n ? { n: openaiOptions.n } : {},
+						...gptImageOutputOptions
 					});
 				} else {
+					if (referenceImages?.length) Logger.globalInstance.debug(`[DEBUG] Reference images are not supported by ${modelName} and were removed`);
 					const { style, quality, model, ...opts } = openaiOptions;
-					const variationSize = [
-						"256x256",
-						"512x512",
-						"1024x1024"
-					].find((s) => s === openaiOptions.size);
+					const variationSize = IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes.find((s) => s === openaiOptions.size);
 					this.logger.log("OpenAI image generation request (variation endpoint):", {
 						...opts,
 						size: variationSize
@@ -35020,7 +35815,8 @@ var OpenAIImageService = class extends AIImageService {
 				});
 				result = await openai.images.generate({
 					prompt,
-					...openaiOptions
+					...openaiOptions,
+					...gptImageOutputOptions
 				});
 			}
 			images = this.imageResponseToUrl(result);
@@ -35049,13 +35845,14 @@ var OpenAIImageService = class extends AIImageService {
 		}
 	}
 	imageResponseToUrl(response) {
+		const mimeType = `image/${response?.output_format ?? "png"}`;
 		return (response?.data ?? []).map((imageData) => {
-			if (imageData.b64_json) return `data:image/png;base64,${imageData.b64_json}`;
+			if (imageData.b64_json) return `data:${mimeType};base64,${imageData.b64_json}`;
 			if (imageData.url) return imageData.url;
 			throw new Error(`Image response contains neither url nor b64_json: ${JSON.stringify(Object.keys(imageData))}`);
 		});
 	}
-	async edit(image, prompt, { mask = null, model = ImageModels.GPT_IMAGE_2, n = 1, size, response_format = "url", user }) {
+	async edit(image, prompt, { mask = null, model = ImageModels.GPT_IMAGE_2, n = 1, quality, size, response_format = "url", user, background, output_format, referenceImages }) {
 		try {
 			const openai = new OpenAI({
 				apiKey: this.apiKey,
@@ -35079,34 +35876,45 @@ var OpenAIImageService = class extends AIImageService {
 				Logger.globalInstance.debug(`[DEBUG] ⚠️ Edit endpoint doesn't support ${model}, defaulting to gpt-image-2`);
 				editModel = ImageModels.GPT_IMAGE_2;
 			}
-			const forwardSize = isSupportedEditSize(editModel, size);
+			const editModelCarriesReferences = isGPTImageModel(editModel);
+			if (referenceImages?.length && !editModelCarriesReferences) Logger.globalInstance.debug(`[DEBUG] Reference images are not supported by ${editModel} and were removed`);
+			const referenceImageFiles = editModelCarriesReferences ? await this.toReferenceImageFiles(referenceImages) : [];
+			const editWarnings = [];
+			const gptImageOutputOptions = resolveGptImageOutputOptions(background, output_format, editWarnings, editModel);
+			if (editWarnings.length > 0) Logger.globalInstance.debug(`[DEBUG] ⚠️ ${editModel} parameter adjustments:`, editWarnings);
+			const forwardSize = isSupportedImageSize(editModel, size);
+			const editQuality = toGptImageQuality(quality);
 			this.logger.log("OpenAI image edit request:", {
 				model: editModel,
 				prompt: truncatePromptForLog(prompt),
 				hasMask: !!maskFile,
-				n,
+				requestedN: n,
 				size,
+				quality: editQuality,
+				referenceImageCount: referenceImageFiles.length,
 				response_format
 			});
 			const response = await openai.images.edit(isGPTImageModel(editModel) ? {
 				model: editModel,
-				image: [imageFile],
+				image: [imageFile, ...referenceImageFiles],
 				prompt,
 				...forwardSize ? { size } : {},
-				...maskFile ? { mask: maskFile } : {}
+				...maskFile ? { mask: maskFile } : {},
+				...editQuality ? { quality: editQuality } : {},
+				...gptImageOutputOptions
 			} : {
 				model: editModel,
 				image: imageFile,
 				prompt,
 				mask: maskFile,
-				n,
+				n: 1,
 				size,
 				response_format,
 				user
 			});
 			if (response.data && response.data.length > 0) {
 				const result = response.data[0];
-				const dataUrl = result.b64_json ? `data:image/png;base64,${result.b64_json}` : result.url;
+				const dataUrl = result.b64_json ? `data:image/${response.output_format ?? "png"};base64,${result.b64_json}` : result.url;
 				if (!dataUrl) throw new Error(`Image response contains neither url nor b64_json: ${JSON.stringify(Object.keys(result))}`);
 				return {
 					type: "success",
@@ -35194,7 +36002,7 @@ var BFLImageService = class extends AIImageService {
 					...modelSpecificOptions,
 					user
 				};
-				if (model.includes("ultra")) {
+				if (isBflUltraImageModel(model)) {
 					if (aspect_ratio) {
 						requestBody.aspect_ratio = aspect_ratio;
 						Logger.globalInstance.debug(`[DEBUG] Using aspect_ratio: ${aspect_ratio} for Ultra model`);
@@ -35258,7 +36066,7 @@ var BFLImageService = class extends AIImageService {
 				image,
 				mask,
 				guidance: guidance ?? void 0,
-				output_format: output_format || "jpeg"
+				output_format: toNonWebpOutputFormat(output_format) || "jpeg"
 			};
 			const cleanedBody = this.stripNullFields(requestBody);
 			Logger.globalInstance.debug("[DEBUG] BFL Image edit request body:", cleanedBody);
@@ -36417,6 +37225,49 @@ function isAiEditableOfficeMime(mime) {
 * force an unbounded read (the client UI also gates, but that is bypassable). 10 MB.
 */
 const MAX_OFFICE_EDIT_BYTES = 10485760;
+/**
+* Cap on the number of cells a workbook's declared `!ref` ranges may span IN AGGREGATE. A .xlsx
+* can declare a range far larger than its populated cells (the full grid, `A1:XFD1048576`, is
+* ~17e9 cells); extractXlsxText iterates the DECLARED range, so an unbounded `!ref` turns a tiny
+* upload into minutes of event-loop work. The cap has to be a running total rather than per sheet:
+* a worksheet part that declares a huge range and populates nothing is a couple of hundred bytes,
+* so within MAX_OFFICE_EDIT_BYTES an attacker multiplies sheets instead of enlarging one. Well
+* above any human-scale AI-editable workbook.
+*/
+const MAX_XLSX_CELLS = 1e6;
+/**
+* Max decompressed size of a single OOXML zip entry we read into a string (the docx
+* `word/document.xml`). The 10 MB binary cap bounds the compressed upload, not what an entry
+* decompresses to - a small zip can inflate an entry by ~1000x (zip-bomb shape), so the inflate
+* itself is bounded as it runs (see readZipEntryBounded).
+*/
+const MAX_OFFICE_ENTRY_BYTES = 33554432;
+/**
+* Decode a worksheet's declared `!ref`, rejecting it once the workbook's cells cross
+* MAX_XLSX_CELLS in total. Both the read (extractXlsxText, which iterates the range) and write
+* (applyXlsxText) paths take their ranges through here, each threading its own running total, so
+* a crafted `!ref` is bounded before it drives any work.
+*/
+function decodeBoundedRange(XLSX, ref, sheetName, cellsSoFar) {
+	const range = XLSX.utils.decode_range(ref);
+	const total = cellsSoFar + (range.e.r - range.s.r + 1) * (range.e.c - range.s.c + 1);
+	if (total > 1e6) throw new BadRequestError(`Spreadsheet declares ${total.toLocaleString()} cells through sheet "${sheetName}", over the ${MAX_XLSX_CELLS.toLocaleString()}-cell limit`);
+	return {
+		range,
+		cellsSoFar: total
+	};
+}
+/**
+* Read a named zip entry to a string, bounded at `maxBytes` of DECOMPRESSED output. The bound is
+* enforced during the inflate rather than against the entry's self-declared uncompressed size,
+* which is attacker-controlled and which jszip only validates after allocating in full - see
+* readZipEntryBounded in @bike4mind/common.
+*/
+async function readOfficeEntryBounded(entry, maxBytes, label) {
+	const result = await readZipEntryBounded(entry, maxBytes);
+	if (!result.ok) throw new BadRequestError(`${label} is over the ${maxBytes.toLocaleString()}-byte decompressed limit`);
+	return result.text;
+}
 async function extractEditableText(buffer, mime) {
 	if (mime === SupportedFabFileMimeTypes.DOCX) return extractDocxText(buffer);
 	if (mime === SupportedFabFileMimeTypes.XLSX) return extractXlsxText(buffer);
@@ -36469,7 +37320,7 @@ async function loadDocumentXml(buffer) {
 	}
 	const entry = zip.file("word/document.xml");
 	if (!entry) throw new BadRequestError("File is not a valid .docx document (missing word/document.xml)");
-	const xml = await entry.async("string");
+	const xml = await readOfficeEntryBounded(entry, MAX_OFFICE_ENTRY_BYTES, "word/document.xml");
 	return {
 		zip,
 		xml
@@ -36530,12 +37381,15 @@ async function extractXlsxText(buffer) {
 		throw new BadRequestError("File is not a valid .xlsx spreadsheet");
 	}
 	const blocks = [];
+	let cellsSoFar = 0;
 	for (const sheetName of workbook.SheetNames) {
 		const sheet = workbook.Sheets[sheetName];
 		const lines = [`${XLSX_SHEET_HEADER}${sheetName}`];
 		const ref = sheet["!ref"];
 		if (ref) {
-			const range = XLSX.utils.decode_range(ref);
+			const decoded = decodeBoundedRange(XLSX, ref, sheetName, cellsSoFar);
+			cellsSoFar = decoded.cellsSoFar;
+			const range = decoded.range;
 			for (let r = range.s.r; r <= range.e.r; r++) {
 				const row = [];
 				for (let c = range.s.c; c <= range.e.c; c++) {
@@ -36601,6 +37455,7 @@ async function applyXlsxText(originalBuffer, editedText) {
 	} catch {
 		throw new BadRequestError("File is not a valid .xlsx spreadsheet");
 	}
+	let cellsSoFar = 0;
 	for (const { name, csv } of splitXlsxSheets(editedText)) {
 		const rows = parse(csv.replace(/\s+$/, ""), {
 			relax_column_count: true,
@@ -36635,7 +37490,7 @@ async function applyXlsxText(originalBuffer, editedText) {
 			XLSX.utils.book_append_sheet(workbook, created, name);
 			continue;
 		}
-		const existingRef = sheet["!ref"] ? XLSX.utils.decode_range(sheet["!ref"]) : {
+		let existingRef = {
 			s: {
 				r: 0,
 				c: 0
@@ -36645,6 +37500,11 @@ async function applyXlsxText(originalBuffer, editedText) {
 				c: 0
 			}
 		};
+		if (sheet["!ref"]) {
+			const decoded = decodeBoundedRange(XLSX, sheet["!ref"], name, cellsSoFar);
+			cellsSoFar = decoded.cellsSoFar;
+			existingRef = decoded.range;
+		}
 		let maxR = existingRef.e.r;
 		let maxC = existingRef.e.c;
 		for (let r = 0; r < rows.length; r++) {
@@ -36688,7 +37548,10 @@ async function applyXlsxText(originalBuffer, editedText) {
 */
 function getHttpStatus(error) {
 	if (isAxiosError(error)) return error.response?.status;
-	return error.$metadata?.httpStatusCode;
+	const metadata = error.$metadata;
+	if (metadata?.httpStatusCode !== void 0) return metadata.httpStatusCode;
+	const { status } = error;
+	return typeof status === "number" ? status : void 0;
 }
 /**
 * Transient AWS SDK v3 exception names worth retrying/falling back on. These carry the
@@ -36984,7 +37847,8 @@ async function getLlmWithFallback(originalModel, fallbackModelId, availableModel
 	if (!options.forceSwitch && !excludeModelIds?.has(originalModel.id)) {
 		const originalBackend = (0, llm_exports.getLlmByModel)(apiKeyTable, {
 			modelInfo: originalModel,
-			logger
+			logger,
+			endUserId: options.endUserId
 		});
 		if (originalBackend) return {
 			model: originalModel,
@@ -37002,7 +37866,8 @@ async function getLlmWithFallback(originalModel, fallbackModelId, availableModel
 		}
 		const backend = (0, llm_exports.getLlmByModel)(apiKeyTable, {
 			modelInfo: automaticFallback,
-			logger
+			logger,
+			endUserId: options.endUserId
 		});
 		if (backend) {
 			logger.info(`✅ Using automatic fallback: ${automaticFallback.id}`);
@@ -37022,7 +37887,8 @@ async function getLlmWithFallback(originalModel, fallbackModelId, availableModel
 	}
 	const backend = (0, llm_exports.getLlmByModel)(apiKeyTable, {
 		modelInfo: fallbackModel,
-		logger
+		logger,
+		endUserId: options.endUserId
 	});
 	if (backend) {
 		logger.info(`✅ Fallback successful: Using ${fallbackModel.id}`, {
@@ -37639,11 +38505,13 @@ __reExport(/* @__PURE__ */ __exportAll({
 	MAX_DESCRIPTION_LENGTH: () => MAX_DESCRIPTION_LENGTH,
 	MAX_GOAL_LENGTH: () => MAX_GOAL_LENGTH,
 	MAX_OFFICE_EDIT_BYTES: () => MAX_OFFICE_EDIT_BYTES,
+	MAX_OFFICE_ENTRY_BYTES: () => MAX_OFFICE_ENTRY_BYTES,
 	MAX_QUESTS: () => 20,
 	MAX_SUBQUESTS_PER_QUEST: () => 20,
 	MAX_TAGS: () => 10,
 	MAX_TAG_LENGTH: () => 50,
 	MAX_TITLE_LENGTH: () => 200,
+	MAX_XLSX_CELLS: () => MAX_XLSX_CELLS,
 	MIN_ATTACHED_CONTENT_EXTRACTION_SHARE: () => MIN_ATTACHED_CONTENT_EXTRACTION_SHARE,
 	MIN_ATTACHED_CONTENT_TOKEN_ALLOCATION: () => MIN_ATTACHED_CONTENT_TOKEN_ALLOCATION,
 	MIN_PASSAGE_TOKEN_TARGET: () => 64,
@@ -37901,24 +38769,37 @@ var SubagentOrchestrator = class {
 			allowedTools: allowedTools || agentDef.allowedTools,
 			deniedTools: [...agentDef.deniedTools || [], ...ALWAYS_DENIED_FOR_AGENTS]
 		};
-		const { tools: allTools, agentContext: updatedContext } = await generateCliTools(this.deps.userId, this.deps.llm, effectiveModel, this.deps.permissionManager, this.deps.showPermissionPrompt, {
+		const agentContext = {
 			currentAgent: null,
 			observationQueue: []
-		}, this.deps.configStore, this.deps.apiClient, void 0, this.deps.showUserQuestion, this.deps.checkpointStore, void 0, void 0, effectiveInteractionMode);
+		};
+		const { tools: allTools, agentContext: updatedContext } = await generateCliTools(this.deps.userId, this.deps.llm, effectiveModel, this.deps.permissionManager, this.deps.showPermissionPrompt, agentContext, this.deps.configStore, this.deps.apiClient, void 0, this.deps.showUserQuestion, this.deps.checkpointStore, this.deps.sandboxOrchestrator, this.deps.additionalDirectories, effectiveInteractionMode);
 		const filteredTools = filterToolsByPatterns(allTools, toolFilter.allowedTools, toolFilter.deniedTools);
 		if (options.additionalTools) {
 			const safe = options.additionalTools.filter((t) => !ALWAYS_DENIED_FOR_AGENTS.includes(t.toolSchema.name));
 			filteredTools.push(...safe);
 		}
 		if (this.deps.customCommandStore) {
-			const skillTool = createSkillTool({
+			const [skillTool] = wrapTools([createSkillTool({
 				customCommandStore: this.deps.customCommandStore,
 				subagentOrchestrator: this,
 				sessionId: parentSessionId,
 				allowedSkills: agentDef.skills,
 				parentDepth: depth,
 				parentInteractionMode: effectiveInteractionMode,
-				parentModel: effectiveModel
+				parentModel: effectiveModel,
+				permissionManager: this.deps.permissionManager,
+				promptFn: this.deps.showPermissionPrompt,
+				allowedDirectories: this.deps.additionalDirectories
+			})], {
+				permissionManager: this.deps.permissionManager,
+				showPermissionPrompt: this.deps.showPermissionPrompt,
+				agentContext,
+				configStore: this.deps.configStore,
+				apiClient: this.deps.apiClient,
+				sandboxOrchestrator: this.deps.sandboxOrchestrator,
+				allowedDirectories: this.deps.additionalDirectories,
+				interactionModeOverride: effectiveInteractionMode
 			});
 			filteredTools.push(skillTool);
 			const skillsSection = buildSkillsPromptSection(this.deps.customCommandStore.getAllCommands(), agentDef.skills);
@@ -37931,7 +38812,11 @@ var SubagentOrchestrator = class {
 		const hookWrapperContext = {
 			sessionId: parentSessionId,
 			agentName,
-			cwd: process.cwd()
+			cwd: process.cwd(),
+			permission: {
+				permissionManager: this.deps.permissionManager,
+				promptFn: this.deps.showPermissionPrompt
+			}
 		};
 		const hookedTools = filteredTools.map((tool) => wrapToolWithHooks(tool, agentDef.hooks, hookWrapperContext));
 		this.deps.logger.debug(`Spawning "${agentName}" agent with ${hookedTools.length} tools, thoroughness: ${effectiveThoroughness}, max iterations: ${maxIterations}`);
@@ -38006,7 +38891,7 @@ var SubagentOrchestrator = class {
 			const stopResult = await executeHooks(agentDef.hooks.Stop, buildHookContext({
 				...hookWrapperContext,
 				hookEventName: "Stop"
-			}));
+			}), hookWrapperContext.permission);
 			if (stopResult.decision === "block") this.deps.logger.debug(`Stop hook blocked: ${stopResult.reason}`);
 		}
 		this.deps.logger.debug(`Agent "${agentName}" completed in ${duration}ms, ${result.completionInfo.iterations} iterations, ${result.completionInfo.totalTokens} tokens`);
@@ -38583,4 +39468,4 @@ var AgentHistoryStore = class {
 	}
 };
 //#endregion
-export { RemoteSkillSource as $, FallbackLlmBackend as A, classifyCommandRisk as B, createWriteTodosTool as C, createResumeAgentTool as D, createCoordinateTaskTool as E, loadContextFiles as F, DEFAULT_THOROUGHNESS as G, DEFAULT_AGENT_MODEL as H, PermissionManager as I, setWebSocketToolExecutor as J, clearFeatureModuleTools as K, generateCliTools as L, ReActAgent as M, findIterationBoundary as N, createBackgroundAgentTools as O, extractCompactInstructions as P, isReadOnlyTool as Q, getProcessHooks as R, createTodoStore as S, parseAgentConfig as T, DEFAULT_MAX_ITERATIONS as U, ALWAYS_DENIED_FOR_AGENTS as V, DEFAULT_RETRY_CONFIG as W, buildSystemPrompt as X, getPlanModeFilePath as Y, buildSkillsPromptSection as Z, createDecisionStore as _, McpManager as a, searchCommands as at, createWorkItemTools as b, isTransientNetworkError as c, searchFiles as ct, createReviewGateTool as d, DEFAULT_SUBAGENT_HISTORY_TTL_MS as dt, CustomCommandStore as et, formatReviewGatesOutput as f, MAX_PASTE_SIZE as ft, createDecisionLogTool as g, formatBlockersOutput as h, AgentStore as i, processFileReferences as it, substituteArguments as j, createAgentDelegateTool as k, OllamaBackend as l, warmFileCache as lt, createBlockerTools as m, BackgroundAgentManager as n, SessionStore as nt, createSseBackend as o, mergeCommands as ot, createBlockerStore as p, USAGE_CACHE_TTL as pt, registerFeatureModuleTools as q, SubagentOrchestrator as r, hasFileReferences as rt, ServerLlmBackend as s, formatFileSize$1 as st, AgentHistoryStore as t, CheckpointStore as tt, createReviewGateStore as u, COMPACTION_SUMMARY_MARKER as ut, formatDecisionsOutput as v, createSkillTool as w, createFindDefinitionTool as x, createGetFileStructureTool as y, SHELL_LIKE_TOOL_COMMAND_FIELDS as z };
+export { CustomCommandStore as $, createAgentDelegateTool as A, ALWAYS_DENIED_FOR_AGENTS as B, createTodoStore as C, createCoordinateTaskTool as D, parseAgentConfig as E, PermissionManager as F, classifyCommandRisk as G, DEFAULT_MAX_ITERATIONS as H, generateCliTools as I, setWebSocketToolExecutor as J, clearFeatureModuleTools as K, wrapTools as L, substituteArguments as M, ReActAgent as N, createResumeAgentTool as O, findIterationBoundary as P, RemoteSkillSource as Q, getProcessHooks as R, createFindDefinitionTool as S, createSkillTool as T, DEFAULT_RETRY_CONFIG as U, DEFAULT_AGENT_MODEL as V, DEFAULT_THOROUGHNESS as W, buildSystemPrompt as X, getPlanModeFilePath as Y, buildSkillsPromptSection as Z, createDecisionLogTool as _, loadProjectContext as a, mergeCommands as at, createGetFileStructureTool as b, ServerLlmBackend as c, warmFileCache as ct, createReviewGateStore as d, MAX_PASTE_SIZE as dt, CheckpointStore as et, createReviewGateTool as f, USAGE_CACHE_TTL as ft, formatBlockersOutput as g, createBlockerTools as h, buildProjectAgentStore as i, searchCommands as it, FallbackLlmBackend as j, createBackgroundAgentTools as k, isTransientNetworkError as l, COMPACTION_SUMMARY_MARKER as lt, createBlockerStore as m, BackgroundAgentManager as n, hasFileReferences as nt, McpManager as o, formatFileSize as ot, formatReviewGatesOutput as p, registerFeatureModuleTools as q, SubagentOrchestrator as r, processFileReferences as rt, createSseBackend as s, searchFiles as st, AgentHistoryStore as t, SessionStore as tt, OllamaBackend as u, DEFAULT_SUBAGENT_HISTORY_TTL_MS as ut, createDecisionStore as v, createWriteTodosTool as w, createWorkItemTools as x, formatDecisionsOutput as y, SHELL_LIKE_TOOL_COMMAND_FIELDS as z };