@bike4mind/cli 3.1.0 → 3.2.0

package/dist/{ConfigStore-RHqyXcSS.mjs → ConfigStore-v0wgf0_j.mjs}

@@ -250,6 +250,19 @@ const StorageLimitErrorInfoSchema = z$1.object({
 	requested_bytes: z$1.number().nonnegative().describe("Size of the refused upload, in bytes."),
 	owner: z$1.enum(["user", "org"]).describe("Whose limit was hit: `user` or `org`. Always `user` for `file_too_large`, a platform-wide cap.")
 });
+/**
+* The refusal a caller gets when the limit belongs to someone else (an update-share editor growing
+* another user's file): the code and whose limit, without that owner's byte counts.
+*/
+const RedactedStorageLimitErrorInfoSchema = StorageLimitErrorInfoSchema.pick({
+	errorCode: true,
+	owner: true
+}).extend({
+	used_bytes: z$1.never().optional(),
+	limit_bytes: z$1.never().optional(),
+	requested_bytes: z$1.never().optional()
+});
+z$1.union([StorageLimitErrorInfoSchema, RedactedStorageLimitErrorInfoSchema]);
 function isZodError(err) {
 	return Boolean(err && (err instanceof ZodError || err.name === "ZodError"));
 }
@@ -3643,6 +3656,199 @@ z$1.enum([
 	"investigate_soon",
 	"immediate_action"
 ]);
+const CompletionReasoningEffortSchema = z$1.enum([
+	"none",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+/**
+* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
+* covers wire-format fields (toolFn is server-side). Replaces the historical
+* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
+* at parse time instead of failing silently inside the backend.
+*/
+const CompletionCustomToolSchema = z$1.object({
+	toolSchema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string(),
+		parameters: z$1.object({
+			type: z$1.literal("object"),
+			properties: z$1.record(z$1.string(), z$1.any()).optional(),
+			additionalProperties: z$1.boolean().optional(),
+			required: z$1.array(z$1.string()).optional()
+		}).passthrough(),
+		strict: z$1.boolean().optional(),
+		defer_loading: z$1.boolean().optional().describe("Keep this definition out of the model context until the tool search server tool (or a `tool_reference`) loads it. Honoured only on models served by the direct Anthropic API whose `supports_tool_search` is true; on every other model (including Bedrock-served Claude, for now) it is ignored and the tool is sent as usual. At least one tool, or a `serverTool` entry, must stay non-deferred (`errorCode: \"all_tools_deferred\"`)."),
+		cache_control: z$1.unknown().optional().describe("Accepted for validation only and not forwarded. Rejected on a deferred tool (`errorCode: \"deferred_tool_cache_control\"`).")
+	}),
+	_isMcpTool: z$1.boolean().optional()
+});
+/** Anthropic's tool search server tools; `name` is fixed by `type`. */
+const ToolSearchServerToolSchema = z$1.discriminatedUnion("type", [z$1.object({
+	type: z$1.literal("tool_search_tool_regex_20251119"),
+	name: z$1.literal("tool_search_tool_regex")
+}), z$1.object({
+	type: z$1.literal("tool_search_tool_bm25_20251119"),
+	name: z$1.literal("tool_search_tool_bm25")
+})]);
+const CompletionServerToolSchema = z$1.object({ serverTool: ToolSearchServerToolSchema.describe("A provider-run tool, sent to the provider as `{ type, name }`. Only the Anthropic tool search tools exist today, and only on models served by the direct Anthropic API whose `supports_tool_search` is true; any other model, Bedrock-served Claude included, is refused with `errorCode: \"tool_search_unsupported\"` rather than run without it.") });
+/** One `tools[]` entry: a caller-defined tool, or a provider-run server tool. */
+const CompletionToolSchema = z$1.union([CompletionCustomToolSchema, CompletionServerToolSchema]);
+/**
+* The `errorCode`s of the completions 400s for tool search requests (CONVENTIONS.md section 1).
+* Assigned in services/cliCompletionsToolSearch.ts.
+*/
+const COMPLETION_TOOL_ERROR_CODES = [
+	"tool_search_unsupported",
+	"all_tools_deferred",
+	"deferred_tool_cache_control",
+	"unknown_tool_reference"
+];
+/**
+* JSON Schema definition for structured output. The `schema` field is a full
+* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
+* the caller's contract with the model). `strict: true` is the default, matching
+* OpenAI's strict-mode subset semantics.
+*/
+const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
+	type: z$1.literal("json_schema"),
+	json_schema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string().optional(),
+		schema: z$1.record(z$1.string(), z$1.any()),
+		strict: z$1.boolean().optional().default(true)
+	})
+})]);
+/**
+* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
+* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
+* with the appropriate beta header) and silently ignored by other providers.
+*/
+const CompletionMessageSchema = z$1.object({
+	role: z$1.enum([
+		"user",
+		"assistant",
+		"system"
+	]),
+	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
+	cache: z$1.boolean().optional()
+});
+/**
+* Schema for CLI LLM completion requests
+* Shared between Next.js API route (dev) and Lambda function (production)
+*
+* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
+* accepted at the top level (OpenAI-compatible, matching how every major LLM
+* SDK shapes a completion request) AND nested under `options` (legacy shape).
+* Use `normalizeCompletionRequest()` to collapse both surfaces into the
+* canonical `options.<field>` location before downstream consumption.
+*/
+const CompletionRequestSchema = z$1.object({
+	model: z$1.string().max(256),
+	messages: z$1.array(CompletionMessageSchema),
+	response_format: ResponseFormatSchema.optional(),
+	stream: z$1.boolean().optional(),
+	tools: z$1.array(CompletionToolSchema).optional(),
+	temperature: z$1.number().optional(),
+	max_tokens: z$1.number().optional(),
+	options: z$1.object({
+		temperature: z$1.number().optional(),
+		maxTokens: z$1.number().optional(),
+		stream: z$1.boolean().optional(),
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional(),
+		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
+		thinking: z$1.object({
+			enabled: z$1.boolean(),
+			budget_tokens: z$1.number().int().min(1024).optional()
+		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
+	}).optional()
+});
+const CompletionUsageSchema = z$1.object({
+	inputTokens: z$1.number().optional(),
+	outputTokens: z$1.number().optional(),
+	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
+	cacheReadInputTokens: z$1.number().optional(),
+	cacheCreationInputTokens: z$1.number().optional()
+});
+const CompletionMetaEventSchema = z$1.object({
+	type: z$1.literal("meta"),
+	requestId: z$1.string()
+});
+const CompletionContentEventSchema = z$1.object({
+	type: z$1.enum(["content", "tool_use"]),
+	text: z$1.string(),
+	tools: z$1.array(z$1.object({
+		name: z$1.string(),
+		arguments: z$1.string().optional(),
+		id: z$1.string().optional()
+	})).optional(),
+	usage: CompletionUsageSchema.optional(),
+	credits: z$1.object({
+		used: z$1.number().optional(),
+		usdCost: z$1.number().optional()
+	}).optional(),
+	responseFormatMode: z$1.enum([
+		"native",
+		"tool_use",
+		"best-effort"
+	]).optional(),
+	stopReason: z$1.string().optional(),
+	thinking: z$1.array(z$1.any()).optional(),
+	toolStarted: z$1.object({
+		name: z$1.string(),
+		id: z$1.string().optional()
+	}).optional()
+});
+/**
+* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
+* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
+*/
+const COMPLETION_SSE_ERROR_CODES = [
+	...QUEST_ERROR_CODES,
+	"provider_error",
+	"provider_rejected",
+	"content_blocked"
+];
+/**
+* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
+* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
+* real status instead; see completions.contract.ts.
+*
+* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
+* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
+* model's safety classifier declined the request. Optional; callers must never match on the prose
+* `message`.
+*
+* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
+* and is a published wire shape.
+*/
+const CompletionSseErrorEventSchema = z$1.object({
+	type: z$1.literal("error"),
+	message: z$1.string(),
+	requestId: z$1.string().optional(),
+	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
+});
+/**
+* A provider content block the caller must echo back verbatim, in stream order, in the assistant
+* `messages` content of the next request: today the Anthropic tool search `server_tool_use` and
+* `tool_search_tool_result` blocks. Never executed by the caller and never answered with a tool_result.
+*/
+const CompletionProviderBlockEventSchema = z$1.object({
+	type: z$1.literal("provider_block"),
+	provider: z$1.literal("anthropic"),
+	block: z$1.record(z$1.string(), z$1.unknown())
+});
+/** One `data:` event in the `text/event-stream` completions response. */
+const CompletionStreamEventSchema = z$1.union([
+	CompletionMetaEventSchema,
+	CompletionContentEventSchema,
+	CompletionProviderBlockEventSchema,
+	CompletionSseErrorEventSchema
+]);
 /** Splits on the marker tokens, keeping them in the result so a scan can track nesting depth. */
 const THINK_TAG_TOKENS = /(<think>|<\/think>)/g;
 /**
@@ -3780,8 +3986,8 @@ const invalid = (reason) => ({
 	status: "invalid",
 	reason
 });
-const FENCE_OPEN_LINE = /^[ \t]*(`{3,}|~{3,})(.*)$/;
-const FENCE_CLOSE_LINE = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
+const FENCE_OPEN_LINE$1 = /^[ \t]*(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE_LINE$1 = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
 /**
 * Offset where a slot's visible answer starts: just past its last top-level `</think>`, 0 when it
 * has none, or null while a `<think>` is still open. Depth-tracked to match visibleReplyText in
@@ -3811,7 +4017,7 @@ function findLastChoicesFence(text) {
 		const lineEnd = newline === -1 ? text.length : newline;
 		const line = text.slice(lineStart, lineEnd).replace(/\r$/, "");
 		if (!open) {
-			const match = line.match(FENCE_OPEN_LINE);
+			const match = line.match(FENCE_OPEN_LINE$1);
 			if (match && !(match[1][0] === "`" && match[2].includes("`"))) open = {
 				start: lineStart,
 				bodyStart: newline === -1 ? text.length : newline + 1,
@@ -3819,7 +4025,7 @@ function findLastChoicesFence(text) {
 				isChoices: match[1] === "```" && match[2].trim().toLowerCase() === "choices"
 			};
 		} else {
-			const match = line.match(FENCE_CLOSE_LINE);
+			const match = line.match(FENCE_CLOSE_LINE$1);
 			if (match && match[1][0] === open.marker[0] && match[1].length >= open.marker.length) {
 				if (open.isChoices) last = {
 					start: open.start,
@@ -4826,6 +5032,13 @@ z$1.object({
 		reason: z$1.enum(REPLY_CHOICES_INVALID_REASONS).optional()
 	}).optional(),
 	/**
+	* Set when finalize stripped a tool call the model wrote into its reply as text instead of
+	* calling it (see ../utils/narratedToolCalls.ts). The call never ran; `toolNames` are the
+	* offered tools it named. Absent when nothing was stripped. Consumers read this rather than
+	* matching the reply text, which no longer carries the call.
+	*/
+	narratedToolCall: z$1.object({ toolNames: z$1.array(z$1.string()) }).optional(),
+	/**
 	* Set when an emitted artifact looks voluntarily abbreviated - placeholder comments in
 	* place of real code, or calls into functions that were never defined. The complement to
 	* `finishReason === 'max_tokens'`: truncation is a hard stop the provider reports, elision
@@ -5064,8 +5277,11 @@ const ChatWaitTimeoutErrorSchema = ApiErrorSchema.extend({
 const StorageLimitErrorSchema = ApiErrorSchema.extend(StorageLimitErrorInfoSchema.partial().shape);
 /** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
 const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
-/** 400 for a `model` the caller cannot use; `errorCode` is absent on the other 400s (e.g. malformed JSON). */
-const UnknownModelErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal(UNKNOWN_MODEL_ERROR_CODE).optional() });
+/**
+* 400 for a `model` the caller cannot use, or a refused tool search request; `errorCode` is absent on the
+* other 400s (e.g. malformed JSON).
+*/
+const CompletionsBadRequestErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([UNKNOWN_MODEL_ERROR_CODE, ...COMPLETION_TOOL_ERROR_CODES]).optional() });
 /**
 * Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
 * throws when an API key lacks a route's scopes. It names what the ROUTE requires,
@@ -5989,34 +6205,95 @@ function parseCidr(raw) {
 		prefix: Number(value.slice(slash + 1))
 	};
 }
-function cidrContains(cidr, address) {
-	const target = addressBytes(address);
-	if (!target || target.version !== cidr.version) return false;
-	for (let bit = 0; bit < cidr.prefix; bit++) {
+/**
+* Networks a private-network opt-in never reaches, whatever the operator lists, self-host included.
+* One list for both sides: the settings validator refuses any range that overlaps an entry, and the
+* fetch path (`buildNeverAdmitted` in fab-pipeline's pinnedFetch.ts) refuses these at connect time.
+* IPv4 entries also cover their IPv4-mapped IPv6 forms (`::ffff:0:0/96`) on both sides.
+*/
+const NEVER_ADMITTED_NETWORKS = [
+	{
+		cidr: "0.0.0.0/8",
+		label: "this network"
+	},
+	{
+		cidr: "127.0.0.0/8",
+		label: "loopback"
+	},
+	{
+		cidr: "169.254.0.0/16",
+		label: "link-local, including cloud metadata"
+	},
+	{
+		cidr: "100.100.100.200/32",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "fd00:ec2::254/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "64:ff9b::a9fe:a9fe/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "::/128",
+		label: "unspecified"
+	},
+	{
+		cidr: "::1/128",
+		label: "loopback"
+	},
+	{
+		cidr: "fe80::/10",
+		label: "link-local"
+	}
+];
+const IPV4_MAPPED_PREFIX = [
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	255,
+	255
+];
+/** An IPv4 CIDR in its IPv4-mapped IPv6 form; other CIDRs unchanged. */
+function asIpv6(cidr) {
+	if (cidr.version === 6) return cidr;
+	return {
+		version: 6,
+		bytes: [...IPV4_MAPPED_PREFIX, ...cidr.bytes],
+		prefix: cidr.prefix + 96
+	};
+}
+function cidrsOverlap(a, b) {
+	const [left, right] = a.version === b.version ? [a, b] : [asIpv6(a), asIpv6(b)];
+	const prefix = Math.min(left.prefix, right.prefix);
+	for (let bit = 0; bit < prefix; bit++) {
 		const byte = bit >> 3;
 		const mask = 128 >> (bit & 7);
-		if (((cidr.bytes[byte] ?? 0) & mask) !== ((target.bytes[byte] ?? 0) & mask)) return false;
+		if (((left.bytes[byte] ?? 0) & mask) !== ((right.bytes[byte] ?? 0) & mask)) return false;
 	}
 	return true;
 }
-/**
-* Cloud instance-metadata endpoints, plus the IPv4 one in its IPv4-mapped and NAT64 IPv6 forms.
-* Never reachable through `customMcpAllowPrivateNetworks`, self-host included.
-*/
-const CLOUD_METADATA_ADDRESSES = [
-	"169.254.169.254",
-	"fd00:ec2::254",
-	"::ffff:169.254.169.254",
-	"64:ff9b::169.254.169.254"
-];
+const NEVER_ADMITTED_PARSED = NEVER_ADMITTED_NETWORKS.map((entry) => ({
+	...entry,
+	parsed: parseCidr(entry.cidr)
+}));
 /** Why `raw` may not be allowed as a private network, or null when it may. */
 function customMcpPrivateCidrProblem(raw) {
 	const cidr = parseCidr(raw);
 	if (!cidr) return "Must be a CIDR such as 10.0.0.0/8 or fd12:3456::/32";
 	const minPrefix = CUSTOM_MCP_MIN_CIDR_PREFIX[cidr.version];
 	if (cidr.prefix < minPrefix) return `IPv${cidr.version} ranges must be /${minPrefix} or narrower`;
-	const metadata = CLOUD_METADATA_ADDRESSES.find((address) => cidrContains(cidr, address));
-	if (metadata) return `Range covers the cloud metadata address ${metadata}`;
+	const blocked = NEVER_ADMITTED_PARSED.find((entry) => cidrsOverlap(cidr, entry.parsed));
+	if (blocked) return `Range overlaps ${blocked.cidr} (${blocked.label}), which is never reachable`;
 	return null;
 }
 const CustomMcpPrivateCidrSchema = z$1.string().trim().toLowerCase().superRefine((value, ctx) => {
@@ -7020,8 +7297,8 @@ const CustomMcpPolicySchema = z$1.object({
 const CustomMcpBlockedHostsSchema = z$1.object({ hosts: McpHostPatternListSchema.default([]) });
 /**
 * Self-host only; hosted deployments never reach private networks regardless of this value. Each
-* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never covers a cloud metadata
-* address (see customMcpHosts.ts).
+* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never overlaps a network the fetch
+* path refuses anyway (NEVER_ADMITTED_NETWORKS in customMcpHosts.ts).
 */
 const CustomMcpAllowPrivateNetworksSchema = z$1.object({
 	cidrs: z$1.array(CustomMcpPrivateCidrSchema).max(100).default([]),
@@ -11733,16 +12010,8 @@ const CliCompletionRequestAction = z$1.object({
 		temperature: z$1.number().optional(),
 		maxTokens: z$1.number().optional(),
 		stream: z$1.boolean().optional(),
-		tools: z$1.array(z$1.unknown()).optional(),
-		response_format: z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-			type: z$1.literal("json_schema"),
-			json_schema: z$1.object({
-				name: z$1.string(),
-				description: z$1.string().optional(),
-				schema: z$1.record(z$1.string(), z$1.any()),
-				strict: z$1.boolean().optional().default(true)
-			})
-		})]).optional()
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional()
 	}).optional()
 });
 /**
@@ -12231,7 +12500,7 @@ const VoiceCreditsExhaustedAction = z$1.object({
 const CliCompletionChunkAction = z$1.object({
 	action: z$1.literal("cli_completion_chunk"),
 	requestId: z$1.string(),
-	chunk: z$1.object({
+	chunk: z$1.union([z$1.object({
 		type: z$1.enum(["content", "tool_use"]),
 		text: z$1.string(),
 		toolStarted: z$1.object({
@@ -12244,7 +12513,7 @@ const CliCompletionChunkAction = z$1.object({
 			outputTokens: z$1.number().optional()
 		}).optional(),
 		thinking: z$1.array(z$1.unknown()).optional()
-	})
+	}), CompletionProviderBlockEventSchema])
 });
 /**
 * CLI Completion stream finished successfully
@@ -12261,7 +12530,9 @@ const CliCompletionErrorAction = z$1.object({
 	requestId: z$1.string(),
 	error: z$1.string(),
 	/** Seconds until the caller's rate-limit window reopens; present only on a rate-limit refusal. */
-	retryAfter: z$1.number().optional()
+	retryAfter: z$1.number().optional(),
+	/** Machine-readable reason on a request the caller must fix (a 4xx), e.g. `tool_search_unsupported`. */
+	errorCode: z$1.string().optional()
 });
 /**
 * CLI Tool execution response over WebSocket
@@ -12912,7 +13183,12 @@ const AgentProgressAction = z$1.object({
 	generationJobs: z$1.array(z$1.object({
 		id: z$1.string(),
 		kind: z$1.enum(GENERATION_JOB_KINDS)
-	})).optional()
+	})).optional(),
+	pendingAction: z$1.object({
+		tool: z$1.string(),
+		params: z$1.record(z$1.string(), z$1.unknown()),
+		ts: z$1.number()
+	}).optional()
 });
 const AgentCompletedAction = z$1.object({
 	action: z$1.literal("completed"),
@@ -13376,165 +13652,6 @@ const AgentExecutionStatusResponseSchema = z$1.object({
 });
 /** Path parameter for `GET /api/v1/agent-executions/{id}`. */
 const AgentExecutionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
-const CompletionReasoningEffortSchema = z$1.enum([
-	"none",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-/**
-* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
-* covers wire-format fields (toolFn is server-side). Replaces the historical
-* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
-* at parse time instead of failing silently inside the backend.
-*/
-const CompletionToolSchema = z$1.object({
-	toolSchema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string(),
-		parameters: z$1.object({
-			type: z$1.literal("object"),
-			properties: z$1.record(z$1.string(), z$1.any()).optional(),
-			additionalProperties: z$1.boolean().optional(),
-			required: z$1.array(z$1.string()).optional()
-		}).passthrough(),
-		strict: z$1.boolean().optional()
-	}),
-	_isMcpTool: z$1.boolean().optional()
-});
-/**
-* JSON Schema definition for structured output. The `schema` field is a full
-* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
-* the caller's contract with the model). `strict: true` is the default, matching
-* OpenAI's strict-mode subset semantics.
-*/
-const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-	type: z$1.literal("json_schema"),
-	json_schema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string().optional(),
-		schema: z$1.record(z$1.string(), z$1.any()),
-		strict: z$1.boolean().optional().default(true)
-	})
-})]);
-/**
-* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
-* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
-* with the appropriate beta header) and silently ignored by other providers.
-*/
-const CompletionMessageSchema = z$1.object({
-	role: z$1.enum([
-		"user",
-		"assistant",
-		"system"
-	]),
-	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
-	cache: z$1.boolean().optional()
-});
-/**
-* Schema for CLI LLM completion requests
-* Shared between Next.js API route (dev) and Lambda function (production)
-*
-* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
-* accepted at the top level (OpenAI-compatible, matching how every major LLM
-* SDK shapes a completion request) AND nested under `options` (legacy shape).
-* Use `normalizeCompletionRequest()` to collapse both surfaces into the
-* canonical `options.<field>` location before downstream consumption.
-*/
-const CompletionRequestSchema = z$1.object({
-	model: z$1.string().max(256),
-	messages: z$1.array(CompletionMessageSchema),
-	response_format: ResponseFormatSchema.optional(),
-	stream: z$1.boolean().optional(),
-	tools: z$1.array(CompletionToolSchema).optional(),
-	temperature: z$1.number().optional(),
-	max_tokens: z$1.number().optional(),
-	options: z$1.object({
-		temperature: z$1.number().optional(),
-		maxTokens: z$1.number().optional(),
-		stream: z$1.boolean().optional(),
-		tools: z$1.array(CompletionToolSchema).optional(),
-		response_format: ResponseFormatSchema.optional(),
-		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
-		thinking: z$1.object({
-			enabled: z$1.boolean(),
-			budget_tokens: z$1.number().int().min(1024).optional()
-		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
-	}).optional()
-});
-const CompletionUsageSchema = z$1.object({
-	inputTokens: z$1.number().optional(),
-	outputTokens: z$1.number().optional(),
-	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
-	cacheReadInputTokens: z$1.number().optional(),
-	cacheCreationInputTokens: z$1.number().optional()
-});
-const CompletionMetaEventSchema = z$1.object({
-	type: z$1.literal("meta"),
-	requestId: z$1.string()
-});
-const CompletionContentEventSchema = z$1.object({
-	type: z$1.enum(["content", "tool_use"]),
-	text: z$1.string(),
-	tools: z$1.array(z$1.object({
-		name: z$1.string(),
-		arguments: z$1.string().optional(),
-		id: z$1.string().optional()
-	})).optional(),
-	usage: CompletionUsageSchema.optional(),
-	credits: z$1.object({
-		used: z$1.number().optional(),
-		usdCost: z$1.number().optional()
-	}).optional(),
-	responseFormatMode: z$1.enum([
-		"native",
-		"tool_use",
-		"best-effort"
-	]).optional(),
-	stopReason: z$1.string().optional(),
-	thinking: z$1.array(z$1.any()).optional(),
-	toolStarted: z$1.object({
-		name: z$1.string(),
-		id: z$1.string().optional()
-	}).optional()
-});
-/**
-* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
-* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
-*/
-const COMPLETION_SSE_ERROR_CODES = [
-	...QUEST_ERROR_CODES,
-	"provider_error",
-	"provider_rejected",
-	"content_blocked"
-];
-/**
-* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
-* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
-* real status instead; see completions.contract.ts.
-*
-* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
-* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
-* model's safety classifier declined the request. Optional; callers must never match on the prose
-* `message`.
-*
-* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
-* and is a published wire shape.
-*/
-const CompletionSseErrorEventSchema = z$1.object({
-	type: z$1.literal("error"),
-	message: z$1.string(),
-	requestId: z$1.string().optional(),
-	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
-});
-/** One `data:` event in the `text/event-stream` completions response. */
-const CompletionStreamEventSchema = z$1.union([
-	CompletionMetaEventSchema,
-	CompletionContentEventSchema,
-	CompletionSseErrorEventSchema
-]);
 /**
 * Server-side tool execution schemas for POST /api/ai/v1/tools.
 *
@@ -14943,6 +15060,10 @@ const questMasterPlanResponseSchema = z$2.object(passthroughShape({
 	decisions: true
 }));
 z$2.array(questMasterPlanResponseSchema);
+z$2.object({
+	success: z$2.literal(true),
+	plan: questMasterPlanResponseSchema
+}).extend({ metrics: passthroughField });
 z$1.preprocess((val) => {
 	if (typeof val === "string") {
 		if (val.toLowerCase() === "true") return true;
@@ -16249,8 +16370,8 @@ const ListModelsResponseSchema = paginatedResponseSchema(z$1.object({
 	reasons_within_output_budget: z$1.boolean().describe("Whether reasoning tokens are spent inside `max_output_tokens` on every turn. When true, a small `max_tokens` can be used up by reasoning alone and return an empty reply, so leave room above the answer you expect."),
 	reasoning_efforts: z$1.array(CompletionReasoningEffortSchema).describe("The `reasoningEffort` levels this model acts on, lowest first; empty when it ignores the option. `none` is listed only where it turns reasoning off. Each level is mapped to the nearest one the provider offers. A listed level can still be dropped on one request: some OpenAI models drop it on tool turns, and Claude models with a fixed thinking budget drop it when `max_tokens` leaves no room for the budget plus the answer."),
 	supports_tools: z$1.boolean(),
-	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model only: `/api/ai/v1/completions` does not accept these yet."),
-	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet."),
+	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model: `/api/ai/v1/completions` honours it only for models whose `backend` is `anthropic`. A `bedrock` model with this flag set is not served with tool search there yet: a `serverTool` entry is refused with `errorCode: \"tool_search_unsupported\"` and `defer_loading` is ignored."),
+	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet, and will accept them first for models whose `backend` is `anthropic`."),
 	supports_vision: z$1.boolean(),
 	deprecation_date: z$1.string().nullable().describe("`YYYY-MM-DD`; null when no retirement is scheduled."),
 	replaced_by: z$1.string().nullable().describe("The id of the recommended successor, when there is one."),
@@ -16644,7 +16765,12 @@ z$1.object({
 	* Session-creation input, not a completion parameter, so it is applied only when `sessionId`
 	* is absent; ignored when an existing session is resolved.
 	*/
-	agentIds: z$1.array(z$1.string()).optional()
+	agentIds: z$1.array(z$1.string()).optional(),
+	/**
+	* The subset of `messageFileIds` the user scoped to this message only. Every other notebook-scope
+	* message attachment is pinned to the session so it stays in context on later turns.
+	*/
+	messageOnlyFileIds: z$1.array(z$1.string()).optional()
 });
 /**
 * Response shapes for the public image endpoints (`generateImage` / `editImage`,
@@ -17311,7 +17437,7 @@ defineEndpoint({
 	path: "/api/ai/v1/completions",
 	operationId: "createCompletion",
 	summary: "Create a chat completion",
-	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
+	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nTOOL SEARCH. On a model whose `GET /api/v1/models` row has `supports_tool_search: true` and `backend: \"anthropic\"`, a `tools` entry may set `toolSchema.defer_loading: true`, and a `{ \"serverTool\": { \"type\": \"tool_search_tool_regex_20251119\", \"name\": \"tool_search_tool_regex\" } }` (or the `bm25` pair) entry adds Anthropic's tool search, so deferred definitions load only when the model searches for them. The stream then carries `provider_block` events (`{ type, provider: \"anthropic\", block }`) for the server-run search; echo each block back verbatim, in order, in the assistant `messages` content of the next request, and never answer one with a `tool_result`. When the server-run search loop hits its iteration limit the stream ends with `stopReason: \"pause_turn\"`; continue by re-sending the conversation with that assistant turn's provider blocks echoed. A client-side search may return `{ \"type\": \"tool_reference\", \"tool_name\": \"...\" }` blocks inside a `tool_result`'s content. On every other model, Bedrock-served Claude included, `defer_loading` is ignored (every tool is sent as usual) and a server tool, a `tool_reference` or an echoed tool search block is refused with a `400` rather than run without it.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
 	tags: ["AI"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:chat", "ai:generate"],
@@ -17345,8 +17471,8 @@ defineEndpoint({
 			}
 		},
 		400: {
-			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`.",
-			schema: UnknownModelErrorSchema
+			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`. Tool search requests are refused with: `tool_search_unsupported` (a server tool, `tool_reference` or echoed tool search block on a model that cannot serve tool search here), `all_tools_deferred` (every tool deferred and no server tool), `deferred_tool_cache_control` (`cache_control` on a deferred tool), `unknown_tool_reference` (a `tool_reference` naming a tool not in `tools`, or carrying no string `tool_name`).",
+			schema: CompletionsBadRequestErrorSchema
 		},
 		413: {
 			description: "Request body over 25 MB.",
@@ -21178,7 +21304,7 @@ function scanArtifactOpenTag(text, at, leading, memo) {
 		end: close + 1
 	};
 }
-const OPENER = /<artifact(?=\s)/gi;
+const OPENER$1 = /<artifact(?=\s)/gi;
 const LEADING_WS = /\s+/y;
 const CLOSER = /<\/artifact>/gi;
 const GT = />/g;
@@ -21193,9 +21319,9 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 	const stop = attrsMayCrossLines ? GT : GT_OR_LINE_TERMINATOR;
 	const out = [];
 	let termAt = -1;
-	OPENER.lastIndex = 0;
+	OPENER$1.lastIndex = 0;
 	let opener;
-	while ((opener = OPENER.exec(text)) !== null) {
+	while ((opener = OPENER$1.exec(text)) !== null) {
 		LEADING_WS.lastIndex = opener.index + opener[0].length;
 		LEADING_WS.exec(text);
 		const attrsStart = LEADING_WS.lastIndex;
@@ -21215,7 +21341,7 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 			attrs: text.slice(attrsStart, termAt),
 			body: text.slice(termAt + 1, closer.index)
 		});
-		OPENER.lastIndex = end;
+		OPENER$1.lastIndex = end;
 	}
 	return out;
 }
@@ -23793,111 +23919,273 @@ function getEnvironmentName(configApiConfig) {
 	return "Self-Hosted";
 }
 //#endregion
-//#region src/config/toolSafety.ts
+//#region src/tools/gateway/coreToolDescriptors.ts
+const CORE = { kind: "core" };
+const CLI = { kind: "cli" };
+const pureCompute = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "auto_approve"
+});
+const sessionTool = () => ({
+	source: CLI,
+	effect: "session",
+	approval: "auto_approve"
+});
+const reader = (source = CORE, extra = {}) => ({
+	source,
+	effect: "read",
+	approval: "prompt_default",
+	...extra
+});
+const fileWriter = () => ({
+	source: CORE,
+	effect: "write",
+	approval: "prompt_always",
+	writePathArg: "path"
+});
+const lattice = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "prompt_default"
+});
+/**
+* Descriptors for every tool the CLI builds itself or gets from @bike4mind/services:
+* generateCliTools, buildCliToolList and the subagent-injected tools. A tool missing here
+* resolves to the unknown fallback in toolCatalog.ts; coreToolCompleteness.test.ts
+* fails when a generated tool has no entry.
+*/
+const CORE_TOOL_DESCRIPTORS = new Map(Object.entries({
+	math_evaluate: pureCompute(),
+	current_datetime: pureCompute(),
+	dice_roll: pureCompute(),
+	prompt_enhancement: pureCompute(),
+	find_definition: {
+		source: CLI,
+		effect: "read",
+		approval: "auto_approve"
+	},
+	ask_user_question: {
+		source: CORE,
+		effect: "session",
+		approval: "auto_approve"
+	},
+	agent_delegate: sessionTool(),
+	check_agent_status: sessionTool(),
+	list_background_agents: sessionTool(),
+	cancel_background_agent: sessionTool(),
+	resume_agent: sessionTool(),
+	create_dynamic_agent: sessionTool(),
+	coordinate_task: sessionTool(),
+	decompose_task: sessionTool(),
+	shared_context_read: sessionTool(),
+	shared_context_write: sessionTool(),
+	write_todos: sessionTool(),
+	read_prior_todos: sessionTool(),
+	log_decision: sessionTool(),
+	track_blocker: sessionTool(),
+	resolve_blocker: sessionTool(),
+	request_review_gate: sessionTool(),
+	work_item_create: sessionTool(),
+	work_item_update: sessionTool(),
+	work_item_close: sessionTool(),
+	work_item_ready: sessionTool(),
+	work_item_graph: sessionTool(),
+	tool_search: sessionTool(),
+	create_file: fileWriter(),
+	edit_local_file: fileWriter(),
+	delete_file: fileWriter(),
+	edit_file: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	bash_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true,
+		commandArg: "command"
+	},
+	shell_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	write_shell_stdin: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		commandArg: "chars"
+	},
+	kill_background_shell: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	git_commit: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	git_push: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	skill: {
+		source: CLI,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	weather_info: reader(CORE, { openWorld: true }),
+	web_search: reader(CORE, { openWorld: true }),
+	web_fetch: reader(CORE, { openWorld: true }),
+	deep_research: reader(CORE, { openWorld: true }),
+	check_shell_output: reader(),
+	list_background_shells: reader(),
+	file_read: reader(),
+	grep_search: reader(),
+	glob_files: reader(),
+	get_file_tree: reader(),
+	get_file_structure: reader(CLI),
+	recent_changes: reader(),
+	git_status: reader(),
+	git_diff: reader(),
+	git_log: reader(),
+	git_branch: reader(),
+	lattice_create_model: lattice(),
+	lattice_add_entity: lattice(),
+	lattice_set_value: lattice(),
+	lattice_create_rule: lattice(),
+	lattice_query: lattice(),
+	lattice_explain: lattice()
+}));
+//#endregion
+//#region src/tools/gateway/toolPolicy.ts
 /**
-* Tool safety categories determine when permission is required
+* Every policy decision about a tool, derived from its descriptor. `undefined` is a tool the
+* catalog could not resolve; it keeps the pre-descriptor fallback (prompt_default, read-only)
+* because feature-module and plugin tools do not register descriptors yet.
 */
-const ToolCategorySchema = z$1.enum([
-	"auto_approve",
-	"prompt_always",
-	"prompt_default"
+const UNKNOWN_TOOL_CATEGORY = "prompt_default";
+const READ_ONLY_EFFECTS = /* @__PURE__ */ new Set([
+	"none",
+	"session",
+	"read"
 ]);
-z$1.object({
-	categories: z$1.record(z$1.string(), ToolCategorySchema),
-	trustedTools: z$1.array(z$1.string())
-});
-/**
-* Default tool categories
-*
-* Categories:
-* - auto_approve: Safe tools that don't need permission (math, search, datetime)
-* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
-* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
-*/
-const DEFAULT_TOOL_CATEGORIES = {
-	math_evaluate: "auto_approve",
-	current_datetime: "auto_approve",
-	dice_roll: "auto_approve",
-	prompt_enhancement: "auto_approve",
-	find_definition: "auto_approve",
-	ask_user_question: "auto_approve",
-	weather_info: "prompt_default",
-	agent_delegate: "auto_approve",
-	check_agent_status: "auto_approve",
-	list_background_agents: "auto_approve",
-	cancel_background_agent: "auto_approve",
-	resume_agent: "auto_approve",
-	create_dynamic_agent: "auto_approve",
-	coordinate_task: "auto_approve",
-	decompose_task: "auto_approve",
-	shared_context_read: "auto_approve",
-	shared_context_write: "auto_approve",
-	write_todos: "auto_approve",
-	read_prior_todos: "auto_approve",
-	log_decision: "auto_approve",
-	track_blocker: "auto_approve",
-	resolve_blocker: "auto_approve",
-	request_review_gate: "auto_approve",
-	work_item_create: "auto_approve",
-	work_item_update: "auto_approve",
-	work_item_close: "auto_approve",
-	work_item_ready: "auto_approve",
-	work_item_graph: "auto_approve",
-	tool_search: "auto_approve",
-	edit_file: "prompt_always",
-	edit_local_file: "prompt_always",
-	create_file: "prompt_always",
-	delete_file: "prompt_always",
-	shell_execute: "prompt_always",
-	bash_execute: "prompt_always",
-	write_shell_stdin: "prompt_always",
-	kill_background_shell: "prompt_always",
-	git_commit: "prompt_always",
-	git_push: "prompt_always",
-	skill: "prompt_always",
-	web_search: "prompt_default",
-	check_shell_output: "prompt_default",
-	list_background_shells: "prompt_default",
-	web_fetch: "prompt_default",
-	deep_research: "prompt_default",
-	file_read: "prompt_default",
-	grep_search: "prompt_default",
-	glob_files: "prompt_default",
-	get_file_tree: "prompt_default",
-	get_file_structure: "prompt_default",
-	git_status: "prompt_default",
-	git_diff: "prompt_default",
-	git_log: "prompt_default",
-	git_branch: "prompt_default"
-};
 /**
-* Get the category for a tool
-* Returns 'prompt_default' if tool is not in the default categories
-*/
-function getToolCategory(toolName, customCategories) {
-	if (toolName.startsWith("agent_hook:") || toolName.startsWith("skill_hook:")) return "prompt_always";
-	if (customCategories && toolName in customCategories) return customCategories[toolName];
-	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
-	if (toolName.startsWith("mcp__")) return "prompt_always";
-	return "prompt_default";
+* How far a source's own declarations are believed. Core, cli and builtin-module tools ship in
+* this repo and are reviewed, so their descriptor is taken as written. A plugin is third-party
+* code the user installed and enabled: it can be trusted per tool after a prompt, but cannot
+* skip the first prompt or claim to be read-only. MCP tools and lifecycle hooks always prompt.
+*/
+function categoryCeiling(source) {
+	switch (source.kind) {
+		case "mcp":
+		case "hook": return "prompt_always";
+		case "plugin": return "prompt_default";
+		default: return;
+	}
+}
+function believesDeclaredEffect(source) {
+	return categoryCeiling(source) === void 0;
+}
+function toolCategory(descriptor) {
+	if (!descriptor) return UNKNOWN_TOOL_CATEGORY;
+	const ceiling = categoryCeiling(descriptor.source);
+	if (ceiling === "prompt_always") return ceiling;
+	if (ceiling === "prompt_default" && descriptor.approval === "auto_approve") return ceiling;
+	return descriptor.approval;
+}
+/** Whether a prompt_default trust decision can be persisted for the tool. */
+function canTrustTool(descriptor) {
+	return toolCategory(descriptor) !== "prompt_always";
+}
+/** Read-only tools run in plan mode and in parallel batches; the rest are blocked / sequential. */
+function isReadOnlyTool(descriptor) {
+	if (!descriptor) return true;
+	if (!believesDeclaredEffect(descriptor.source)) return false;
+	return READ_ONLY_EFFECTS.has(descriptor.effect);
+}
+/** The shell command text the risk gate classifies, when the tool has one in `args`. */
+function commandTextOf(descriptor, args) {
+	return stringArg(args, descriptor?.commandArg);
+}
+/** The path a file-writing tool will write, when the tool declares one and `args` carries it. */
+function writePathOf(descriptor, args) {
+	const writePath = stringArg(args, descriptor?.writePathArg);
+	return writePath ? writePath : void 0;
+}
+function stringArg(args, field) {
+	if (!field || args === null || typeof args !== "object") return void 0;
+	const value = args[field];
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+//#region src/tools/gateway/toolCatalog.ts
+const MCP_PREFIX = "mcp__";
+const HOOK_PREFIXES = ["agent_hook:", "skill_hook:"];
+function isHookName(toolName) {
+	return HOOK_PREFIXES.some((prefix) => toolName.startsWith(prefix));
 }
 /**
-* Check if a tool can be trusted (not prompt_always)
-*/
-function canTrustTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
+* Resolve a tool name without a catalog instance: the core table, then the MCP namespace
+* (`mcp__<server>__<tool>`), then the lifecycle-hook namespaces. Undefined means unknown.
+* ToolCatalog.resolve falls back to this after its registered descriptors.
+*/
+function resolveStaticToolDescriptor(toolName) {
+	const core = CORE_TOOL_DESCRIPTORS.get(toolName);
+	if (core) return core;
+	if (toolName.startsWith(MCP_PREFIX)) return {
+		source: {
+			kind: "mcp",
+			server: toolName.slice(5).split("__")[0]
+		},
+		effect: "execute",
+		approval: "prompt_always"
+	};
+	if (isHookName(toolName)) return {
+		source: { kind: "hook" },
+		effect: "execute",
+		approval: "prompt_always"
+	};
 }
 /**
-* Check if a tool is read-only (safe for parallel execution).
-* Write tools (prompt_always category) must always be sequential.
-*
-* @param toolName - Name of the tool to check
-* @param customCategories - Optional custom category overrides
-* @returns true if the tool is read-only, false if it's a write tool
+* Name -> descriptor lookup for one CLI process or ACP stack. Entry points create one and hand
+* it to their PermissionManager, which the permission gateway and the agent's read-only
+* predicate read it through.
 */
-function isReadOnlyTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
-}
+var ToolCatalog = class {
+	constructor() {
+		this.registered = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Add a descriptor for a tool the core table does not know. Core names and the MCP and hook
+	* namespaces are reserved: nothing can re-declare a core tool, or declare itself into a
+	* namespace whose descriptor comes from the name alone, with a lower tier.
+	*/
+	register(toolName, descriptor) {
+		if (toolName.startsWith(MCP_PREFIX) || isHookName(toolName)) throw new Error(`Tool name "${toolName}" is in a reserved namespace and cannot be registered`);
+		if (CORE_TOOL_DESCRIPTORS.has(toolName)) throw new Error(`Tool "${toolName}" is a core tool and already has a descriptor`);
+		if (this.registered.has(toolName)) throw new Error(`Tool "${toolName}" already has a registered descriptor`);
+		this.registered.set(toolName, descriptor);
+	}
+	resolve(toolName) {
+		return this.registered.get(toolName) ?? resolveStaticToolDescriptor(toolName);
+	}
+	category(toolName) {
+		return toolCategory(this.resolve(toolName));
+	}
+	canTrust(toolName) {
+		return canTrustTool(this.resolve(toolName));
+	}
+	isReadOnly(toolName) {
+		return isReadOnlyTool(this.resolve(toolName));
+	}
+};
 const PROJECT_CONTEXT_FILES = [
 	"CLAUDE.local.md",
 	"CLAUDE.md",
@@ -24638,7 +24926,7 @@ function mergeConfigs(global, project, local) {
 		enabled: merged.tools.enabled.filter((t) => !disabledSet.has(t))
 	};
 	const globalTrusted = new Set(global.trustedTools || []);
-	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(t) && !disabledSet.has(t));
+	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(resolveStaticToolDescriptor(t)) && !disabledSet.has(t));
 	return merged;
 }
 /**
@@ -25315,4 +25603,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { SEARCH_RESULT_CARDS_LANGUAGE as $, BRIEFCASE_CATALOG_QUERIES as A, tokenEstimateMultiplier as At, GENERATED_IMAGE_EXTENSION_RE as B, delegationPayloadSchema as Bt, AGENT_QUEST_ID as C, replacePromptVariables as Ct, ARTIFACT_REMOVED_PLACEHOLDER as D, stripDeliveredArtifactBlocks as Dt, ARTIFACT_DELIVERED_PLACEHOLDER as E, splitEquals as Et, ChatModels as F, ACTOR_COLOR_SLOTS as Ft, McpServerName as G, ImagePromptResolutionSchema as H, APP_NAME as Ht, CompletionReasoningEffortSchema as I, DELEGATION_PAYLOAD_SCHEMA_NAME as It, OllamaEmbeddingModel as J, ModelBackend as K, CreateArtifactRequestSchema as L, actorColorIndex as Lt, BriefcasePromptIdSchema as M, ttsRequestSchema as Mt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as N, ttsResponseTooLargeSchema as Nt, ApiKeyType as O, stripToolArtifactMarkup as Ot, CREDIT_DEDUCT_TRANSACTION_TYPES as P, withRetry as Pt, REVIEW_GATE_STATUS_VALUES as Q, DEFAULT_TTS_PROVIDER as R, actorKindMarker as Rt, escapeArtifactBodyJson as S, questReplyText as St, AGENT_QUEST_MCP_URI as T, signImageUrl as Tt, LOCATION_MAP_LANGUAGE as U, WEBSITE_URL as Ut, ImageModels as V, selfClaimedActorKindSchema as Vt, MODEL_INFO_FIELD_GROUP_OF as W, PROMPT_TEXT_MAX as X, OpenAIEmbeddingModel as Y, PermissionDeniedError as Z, logger as _, isPlaceholderImageSigningSecret as _t, getToolCategory as a, WORK_ITEM_STATUSES as at, htmlErrorTitle as b, joinReplySlots as bt, getCreditsUrl as c, createThinkMarkerEscaper as ct, resolveApiEndpoint as d, generatedAudioResponseSchema as dt, SLUG_OWNED_BY_OTHER as et, AuthenticatedApiClient as f, getMcpProviderMetadata as ft, parseApiUrl as g, isEarlyStop as gt, NotAuthenticatedError as h, hasDeliverablePinnedArtifact as ht, canTrustTool as i, VoyageAIEmbeddingModel as it, BedrockEmbeddingModel as j, ttsBase64ResponseSchema as jt, ArtifactTypeSchema as k, supportedVoiceGenerationVendor as kt, getEnvironmentName as l, escapeThinkMarkers as lt, LOCAL_DEV_URL as m, googleMapsSearchUrl as mt, extractCompactInstructions as n, SupportedFabFileMimeTypes as nt, isReadOnlyTool as o, assertAuthOriginMatchesApiKey as ot, DeviceFlowClient as p, getQuestErrorCode as pt, NotFoundError as q, loadContextFiles as r, VisibilitySchema as rt, ApiEndpointUnconfiguredError as s, buildPromptContext as st, ConfigStore as t, SUBQUEST_STATUS_VALUES as tt, requireApiUrl as u, filterToolArtifactMarkup as ut, SESSION_ID_PATTERN as v, isRetryableError as vt, AGENT_QUEST_MANIFEST as w, secureParameters as wt, htmlFirstH1 as x, obfuscateApiKey as xt, isValidSessionId as y, isUserInitiatedAbort as yt, DEGENERATE_FINISH_REASON as z, actorKindSchema as zt };
+export { PermissionDeniedError as $, ApiKeyType as A, stripToolArtifactMarkup as At, DEFAULT_TTS_PROVIDER as B, actorKindMarker as Bt, htmlFirstH1 as C, obfuscateApiKey as Ct, AGENT_QUEST_MCP_URI as D, signImageUrl as Dt, AGENT_QUEST_MANIFEST as E, secureParameters as Et, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as F, ttsResponseTooLargeSchema as Ft, LOCATION_MAP_LANGUAGE as G, WEBSITE_URL as Gt, GENERATED_IMAGE_EXTENSION_RE as H, delegationPayloadSchema as Ht, CREDIT_DEDUCT_TRANSACTION_TYPES as I, withRetry as It, ModelBackend as J, MODEL_INFO_FIELD_GROUP_OF as K, ChatModels as L, ACTOR_COLOR_SLOTS as Lt, BRIEFCASE_CATALOG_QUERIES as M, tokenEstimateMultiplier as Mt, BedrockEmbeddingModel as N, ttsBase64ResponseSchema as Nt, ARTIFACT_DELIVERED_PLACEHOLDER as O, splitEquals as Ot, BriefcasePromptIdSchema as P, ttsRequestSchema as Pt, PROMPT_TEXT_MAX as Q, CompletionReasoningEffortSchema as R, DELEGATION_PAYLOAD_SCHEMA_NAME as Rt, htmlErrorTitle as S, joinReplySlots as St, AGENT_QUEST_ID as T, replacePromptVariables as Tt, ImageModels as U, selfClaimedActorKindSchema as Ut, DEGENERATE_FINISH_REASON as V, actorKindSchema as Vt, ImagePromptResolutionSchema as W, APP_NAME as Wt, OllamaEmbeddingModel as X, NotFoundError as Y, OpenAIEmbeddingModel as Z, NotAuthenticatedError as _, hasDeliverablePinnedArtifact as _t, commandTextOf as a, VisibilitySchema as at, SESSION_ID_PATTERN as b, isRetryableError as bt, writePathOf as c, assertAuthOriginMatchesApiKey as ct, getEnvironmentName as d, escapeThinkMarkers as dt, REVIEW_GATE_STATUS_VALUES as et, requireApiUrl as f, filterToolArtifactMarkup as ft, LOCAL_DEV_URL as g, googleMapsSearchUrl as gt, DeviceFlowClient as h, getQuestErrorCode as ht, ToolCatalog as i, SupportedFabFileMimeTypes as it, ArtifactTypeSchema as j, supportedVoiceGenerationVendor as jt, ARTIFACT_REMOVED_PLACEHOLDER as k, stripDeliveredArtifactBlocks as kt, ApiEndpointUnconfiguredError as l, buildPromptContext as lt, AuthenticatedApiClient as m, getMcpProviderMetadata as mt, extractCompactInstructions as n, SLUG_OWNED_BY_OTHER as nt, isReadOnlyTool as o, VoyageAIEmbeddingModel as ot, resolveApiEndpoint as p, generatedAudioResponseSchema as pt, McpServerName as q, loadContextFiles as r, SUBQUEST_STATUS_VALUES as rt, toolCategory as s, WORK_ITEM_STATUSES as st, ConfigStore as t, SEARCH_RESULT_CARDS_LANGUAGE as tt, getCreditsUrl as u, createThinkMarkerEscaper as ut, parseApiUrl as v, isEarlyStop as vt, escapeArtifactBodyJson as w, questReplyText as wt, isValidSessionId as x, isUserInitiatedAbort as xt, logger as y, isPlaceholderImageSigningSecret as yt, CreateArtifactRequestSchema as z, actorColorIndex as zt };