@codeworksh/harness 0.0.1-dev.20260925163524 → 0.1.0-canary.1.1.gc0ff5572

package/effect.mjs

@@ -1,34 +1,39 @@
 import { n as __reExport, t as __exportAll } from "./rolldown-runtime-B4FMCO8f.mjs";
 import { a as io_exports, i as errors_exports, n as shell_exports, o as instance_exports, r as filesystem_exports, s as posix } from "./resource-DFZh0e-s.mjs";
-import "./daytona-BAurx6Gp.mjs";
-import "./vercel-C0v5nh20.mjs";
+import "./daytona-ByTHZelc.mjs";
+import "./vercel-3GouQSJI.mjs";
+import { a as decode, n as dimensionNote, o as load$4, r as resize } from "./resize-Dwv5dCgY.mjs";
 import { createRequire, registerHooks } from "node:module";
-import { Cause, Clock, Config, Context, Crypto, DateTime, Deferred, Duration, Effect, Encoding, Exit, Fiber, FiberSet, FileSystem, Layer, LayerMap, Option, Path, Predicate, PubSub, Queue, Ref, Result, Schedule, Schema, SchemaIssue, Scope, Semaphore, Stream, String as String$1 } from "effect";
+import { Cause, Clock, Config, Context, Crypto, DateTime, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, LayerMap, Option, Path, Predicate, PubSub, Queue, Random, Ref, Result, Schedule, Schema, SchemaIssue, Scope, Semaphore, Stream, String as String$1 } from "effect";
+import { Message, Model, getEnvApiKey, llm, normalizeOptionalNulls, stream } from "@codeworksh/aikit";
 import { MessageID as ID, SessionID as ID$1 } from "@codeworksh/plugin/ids";
-import { Migrator, SqlClient, SqlClient as SqlClient$1, SqlError, SqlSchema, SqlSchema as SqlSchema$1 } from "effect/unstable/sql";
+import { Migrator, SqlClient, SqlClient as SqlClient$1, SqlError, SqlSchema, SqlSchema as SqlSchema$1 } from "effect/sql";
 import { uuidv7 } from "uuidv7";
 import { SqliteClient, SqliteMigrator } from "@effect/sql-sqlite-node";
 import * as os from "node:os";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { NodeChildProcessSpawner, NodeCrypto, NodeFileSystem, NodePath } from "@effect/platform-node";
-import { Model, VariantSchema } from "effect/unstable/schema";
-import { Message, Model as Model$1, llm, stream } from "@codeworksh/aikit";
+import { Model as Model$1, VariantSchema } from "effect/schema";
+import { Hex } from "effect/encoding";
 import { MemoryProvider, RealFSProvider, SqliteProvider, create } from "@platformatic/vfs";
 import fs, { statSync } from "node:fs";
-import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { Bash } from "just-bash";
-import { DirectoryNotFoundError, DirectoryNotFoundError as DirectoryNotFoundError$1, Info, Info as Info$1, NotDirectoryError, NotDirectoryError as NotDirectoryError$1, Ref as Ref$2, Service, Service as Service$8 } from "@codeworksh/plugin/location";
+import { DirectoryNotFoundError, DirectoryNotFoundError as DirectoryNotFoundError$1, Info, Info as Info$1, NotDirectoryError, NotDirectoryError as NotDirectoryError$1, Service, Service as Service$8 } from "@codeworksh/plugin/location";
 import { generateModels } from "@codeworksh/aikit/modelgen";
+import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworksh/aikit/oauth/github/copilot";
+import { JsonOpenAICodexAuthStorage, getOpenAICodexApiKey } from "@codeworksh/aikit/oauth/openai/codex";
+import { parse, printParseErrorCode } from "jsonc-parser";
+import * as Section from "@codeworksh/plugin/plugin/section";
+import * as Diff from "diff";
+import { FetchHttpClient, HttpClient } from "effect/http";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
 import { Script, constants } from "node:vm";
 import npa from "npm-package-arg";
 import * as AikitFailure from "@codeworksh/aikit/failure";
-import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworksh/aikit/oauth/github/copilot";
-import { JsonOpenAICodexAuthStorage, getOpenAICodexApiKey } from "@codeworksh/aikit/oauth/openai/codex";
 import "@codeworksh/plugin/tool/error";
-import { parse, printParseErrorCode } from "jsonc-parser";
 //#region src/schema.ts
 var schema_exports$9 = /* @__PURE__ */ __exportAll({});
 import * as import__codeworksh_plugin_schema from "@codeworksh/plugin/schema";
@@ -38,15 +43,46 @@ __reExport(schema_exports$9, import__codeworksh_plugin_schema);
 var schema_exports$8 = /* @__PURE__ */ __exportAll({
 	AssistantEnvelopeUsage: () => AssistantEnvelopeUsage,
 	CompactionData: () => CompactionData,
+	Config: () => Config$1,
+	DEFAULT_TITLE: () => DEFAULT_TITLE,
 	ID: () => ID$1,
 	IDFromDb: () => IDFromDb,
 	InterruptReason: () => InterruptReason,
 	JsonObject: () => JsonObject,
 	MessageEnvelopeIdentity: () => MessageEnvelopeIdentity,
 	SessionSchema: () => schema_exports$8,
-	Usage: () => Usage
+	TITLE_MAX_LENGTH: () => 48,
+	ThinkingLevel: () => ThinkingLevel,
+	Usage: () => Usage,
+	titleFrom: () => titleFrom
 });
 const IDFromDb = Schema.String.pipe(Schema.brand("Session.ID"));
+/** The title of a session created without one; its first prompt replaces it. */
+const DEFAULT_TITLE = "Session";
+/**
+* A title from a prompt: its first non-empty line, whitespace collapsed, cut on a word boundary
+* to {@link TITLE_MAX_LENGTH} characters including the ellipsis. `undefined` for a blank prompt.
+*/
+const titleFrom = (text) => {
+	const line = text.split("\n").map((one) => one.replace(/\s+/g, " ").trim()).find((one) => one.length > 0);
+	if (line === void 0 || line.length <= 48) return line;
+	const cut = line.slice(0, 47);
+	const space = cut.lastIndexOf(" ");
+	return `${(space > 0 ? cut.slice(0, space) : cut).trimEnd()}…`;
+};
+const ThinkingLevel = Schema.Literals(Object.values(Model.ThinkingLevelEnum));
+/**
+* The model and thinking level chosen for a session, over its settings. Every key is optional:
+* an absent one means the session follows its settings. `session.config.changed` carries only the
+* keys it changes, and the `session.config` column holds them merged.
+*/
+const Config$1 = Schema.Struct({
+	model: (0, schema_exports$9.optional)(Schema.Struct({
+		provider: Schema.String,
+		id: Schema.String
+	})),
+	thinkingLevel: (0, schema_exports$9.optional)(ThinkingLevel)
+});
 /**
 * Why an execution stopped. Supplied by whoever asked for the interruption --
 * a stop the user asked for and a stop the process imposed on shutdown are
@@ -101,12 +137,12 @@ var global_exports = /* @__PURE__ */ __exportAll({
 	app: () => app,
 	appConfigDir: () => appConfigDir,
 	authFile: () => authFile,
-	defaultLayer: () => defaultLayer$4,
+	defaultLayer: () => defaultLayer$2,
 	homeConfig: () => homeConfig,
 	layer: () => layer$27,
-	layerWith: () => layerWith$1,
+	layerWith: () => layerWith,
 	make: () => make$18,
-	resolve: () => resolve$3
+	resolve: () => resolve$4
 });
 const appConfigDir = ".codework";
 const app = "codework";
@@ -120,7 +156,8 @@ function make$18(input = {}) {
 		home,
 		cache: input.cache ?? posix.join(home, "cache"),
 		data: input.data ?? posix.join(home, "data"),
-		log: input.log ?? posix.join(home, "log")
+		log: input.log ?? posix.join(home, "log"),
+		bin: input.bin ?? posix.join(home, "bin")
 	};
 }
 /**
@@ -133,7 +170,7 @@ function make$18(input = {}) {
 * would be invisible to the other.
 */
 const authFile = (home) => home === void 0 ? void 0 : posix.join(home, "aikit", "auth.json");
-const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
+const resolve$4 = Effect.fn("Global.resolve")(function* (input = {}) {
 	const home = input.home === void 0 ? yield* homeConfig : expandHome(input.home);
 	return make$18({
 		...input,
@@ -141,7 +178,7 @@ const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
 	});
 });
 const build = (input) => Effect.gen(function* () {
-	const paths = yield* resolve$3(input);
+	const paths = yield* resolve$4(input);
 	yield* Effect.all([
 		fileSystem.makeDirectory(paths.cache, { recursive: true }),
 		fileSystem.makeDirectory(paths.data, { recursive: true }),
@@ -150,8 +187,8 @@ const build = (input) => Effect.gen(function* () {
 	return Service$17.of(paths);
 });
 const layer$27 = Layer.effect(Service$17, build({}));
-const defaultLayer$4 = layer$27;
-const layerWith$1 = (input) => Layer.effect(Service$17, build(input));
+const defaultLayer$2 = layer$27;
+const layerWith = (input) => Layer.effect(Service$17, build(input));
 //#endregion
 //#region src/db/migrations.ts
 const migrations = {
@@ -329,6 +366,9 @@ const migrations = {
 	}),
 	"202609190001_session_host_dir": Effect.gen(function* () {
 		yield* (yield* SqlClient.SqlClient)`ALTER TABLE session ADD COLUMN host_dir TEXT`;
+	}),
+	"202609290001_session_config": Effect.gen(function* () {
+		yield* (yield* SqlClient.SqlClient)`ALTER TABLE session ADD COLUMN config TEXT`;
 	})
 };
 //#endregion
@@ -337,10 +377,10 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	Database: () => db_exports,
 	SqlClient: () => SqlClient$1,
 	SqlSchema: () => SqlSchema$1,
-	defaultLayer: () => defaultLayer$3,
+	defaultLayer: () => defaultLayer$1,
 	layer: () => layer$26,
 	locationConfig: () => locationConfig,
-	path: () => path$1,
+	path: () => path$2,
 	resolveDatabaseLocation: () => resolveDatabaseLocation
 });
 const setup = Effect.gen(function* () {
@@ -367,11 +407,11 @@ function resolveDatabaseLocation(configured, data) {
 	if (configured === ":memory:" || posix.isAbsolute(configured)) return configured;
 	return posix.join(data, configured);
 }
-const path$1 = Effect.fn("Database.path")(function* (data) {
-	const directory = data ?? (yield* resolve$3()).data;
+const path$2 = Effect.fn("Database.path")(function* (data) {
+	const directory = data ?? (yield* resolve$4()).data;
 	return resolveDatabaseLocation(yield* locationConfig, directory);
 });
-const defaultLayer$3 = Layer.unwrap(path$1().pipe(Effect.map(layer$26)));
+const defaultLayer$1 = Layer.unwrap(path$2().pipe(Effect.map(layer$26)));
 //#endregion
 //#region src/event/schema.ts
 var schema_exports$7 = /* @__PURE__ */ __exportAll({});
@@ -386,13 +426,54 @@ __reExport(schema_exports$6, import__codeworksh_plugin_project);
 //#region src/session/prompt/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
 	Delivery: () => Delivery,
+	IMAGE_MAX_BASE64: () => IMAGE_MAX_BASE64,
+	IMAGE_TYPES: () => IMAGE_TYPES,
+	ImagePart: () => ImagePart,
+	InvalidPromptError: () => InvalidPromptError,
+	Part: () => Part,
 	Prompt: () => Prompt,
-	PromptSchema: () => schema_exports
+	PromptSchema: () => schema_exports,
+	TextPart: () => TextPart,
+	imageProblem: () => imageProblem
+});
+const IMAGE_TYPES = [
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp"
+];
+const IMAGE_MAX_BASE64 = 4718592;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+const imageProblem = (image) => {
+	if (!IMAGE_TYPES.includes(image.mimeType)) return `Unsupported image type ${image.mimeType}; use ${IMAGE_TYPES.join(", ")}`;
+	if (image.data.length > 4718592) return `Image exceeds the ${IMAGE_MAX_BASE64 / 1024 / 1024} MB limit of base64`;
+	if (image.data.length === 0 || image.data.length % 4 !== 0 || !BASE64.test(image.data)) return "Image data is not base64";
+};
+const TextPart = Schema.Struct({
+	type: Schema.Literal("text"),
+	text: Schema.String
 });
-const Prompt = Schema.Struct({ text: Schema.String }).annotate({ identifier: "Prompt" }).pipe((0, schema_exports$9.withStatics)((schema) => ({
+/** aikit's image content: base64 `data` and its `mimeType`. */
+const ImagePart = Schema.Struct({
+	type: Schema.Literal("image"),
+	data: Schema.String,
+	mimeType: Schema.String
+}).check(Schema.makeFilter(imageProblem));
+const Part = Schema.Union([TextPart, ImagePart]);
+/** A user prompt: aikit user-message parts, in the order they were written. */
+const Prompt = Schema.Struct({ parts: Schema.Array(Part).check(Schema.isMinLength(1)) }).annotate({ identifier: "Prompt" }).pipe((0, schema_exports$9.withStatics)((schema) => ({
 	equivalence: Schema.toEquivalence(schema),
-	fromUserMessage: (input) => schema.make({ text: input.text })
+	fromText: (text) => schema.make({ parts: [{
+		type: "text",
+		text
+	}] }),
+	text: (prompt) => prompt.parts.flatMap((part) => part.type === "text" ? [part.text] : []).join("\n\n")
 })));
+var InvalidPromptError = class extends Schema.TaggedError()("InvalidPromptError", { reason: Schema.String }) {
+	get message() {
+		return this.reason;
+	}
+};
 const Delivery = Schema.Literals(["steer", "followUp"]);
 //#endregion
 //#region src/space/schema.ts
@@ -402,8 +483,8 @@ __reExport(schema_exports$5, import__codeworksh_plugin_space);
 //#endregion
 //#region src/db/schema.sql.ts
 const Timestamps = {
-	createdAt: Model.DateTimeInsertFromNumber,
-	updatedAt: Model.DateTimeUpdateFromNumber
+	createdAt: Model$1.DateTimeInsertFromNumber,
+	updatedAt: Model$1.DateTimeUpdateFromNumber
 };
 const Metadata = Schema.Record(Schema.String, Schema.String);
 const entryTypes = [
@@ -441,19 +522,19 @@ const toolStatuses = [
 ];
 const inputDeliveries = ["steer", "followUp"];
 const EventData = Schema.Record(Schema.String, Schema.Unknown);
-Model.Class("EventSequenceRow")({
+Model$1.Class("EventSequenceRow")({
 	aggregateId: Schema.String,
 	seq: Schema.Natural,
-	ownerId: Model.FieldOption(Schema.String)
+	ownerId: Model$1.FieldOption(Schema.String)
 });
-var EventRow = class extends Model.Class("EventRow")({
+var EventRow = class extends Model$1.Class("EventRow")({
 	id: schema_exports$7.EventSchema.ID,
 	aggregateId: Schema.String,
 	seq: Schema.Natural,
 	type: Schema.String,
-	data: Model.JsonFromString(EventData)
+	data: Model$1.JsonFromString(EventData)
 }) {};
-var ProjectRow = class extends Model.Class("ProjectRow")({
+var ProjectRow = class extends Model$1.Class("ProjectRow")({
 	id: Schema.String,
 	name: Schema.String,
 	status: schema_exports$6.ProjectSchema.Status,
@@ -467,81 +548,82 @@ var ProjectRow = class extends Model.Class("ProjectRow")({
 * The host has no row: `local` is reserved and `NULL` is its storage form, so
 * this table only ever holds namespaces something had to provision.
 */
-var SandboxInstanceRow = class extends Model.Class("SandboxInstanceRow")({
+var SandboxInstanceRow = class extends Model$1.Class("SandboxInstanceRow")({
 	id: instance_exports.SandboxInstance.ID,
 	driver: Schema.String,
 	kind: instance_exports.SandboxInstance.Kind,
-	providerResourceId: Model.FieldOption(Schema.String),
-	runtimeConfig: Model.FieldOption(Schema.String),
+	providerResourceId: Model$1.FieldOption(Schema.String),
+	runtimeConfig: Model$1.FieldOption(Schema.String),
 	ownership: instance_exports.SandboxInstance.Ownership,
 	status: instance_exports.SandboxInstance.Status,
-	providerStatus: Model.FieldOption(Schema.String),
-	stateObservedAt: Model.DateTimeFromNumberWithNow,
-	metadata: Model.FieldOption(Model.JsonFromString(Metadata)),
-	lastError: Model.FieldOption(Model.JsonFromString(instance_exports.SandboxInstance.PersistedError)),
-	lastMountedAt: Model.FieldOption(Schema.DateTimeUtcFromMillis),
-	lastUnmountedAt: Model.FieldOption(Schema.DateTimeUtcFromMillis),
-	lastUsedAt: Model.FieldOption(Schema.DateTimeUtcFromMillis),
-	removedAt: Model.FieldOption(Schema.DateTimeUtcFromMillis),
+	providerStatus: Model$1.FieldOption(Schema.String),
+	stateObservedAt: Model$1.DateTimeFromNumberWithNow,
+	metadata: Model$1.FieldOption(Model$1.JsonFromString(Metadata)),
+	lastError: Model$1.FieldOption(Model$1.JsonFromString(instance_exports.SandboxInstance.PersistedError)),
+	lastMountedAt: Model$1.FieldOption(Schema.DateTimeUtcFromMillis),
+	lastUnmountedAt: Model$1.FieldOption(Schema.DateTimeUtcFromMillis),
+	lastUsedAt: Model$1.FieldOption(Schema.DateTimeUtcFromMillis),
+	removedAt: Model$1.FieldOption(Schema.DateTimeUtcFromMillis),
 	...Timestamps
 }) {};
-var SpaceRow = class extends Model.Class("SpaceRow")({
+var SpaceRow = class extends Model$1.Class("SpaceRow")({
 	id: Schema.String,
 	projectId: Schema.String,
 	location: schema_exports$9.AbsolutePath,
 	kind: schema_exports$5.SpaceSchema.Kind,
-	env: Model.FieldOption(instance_exports.SandboxInstance.ID),
+	env: Model$1.FieldOption(instance_exports.SandboxInstance.ID),
 	status: schema_exports$5.SpaceSchema.Status,
 	...Timestamps
 }) {};
-var SessionRow = class extends Model.Class("SessionRow")({
+var SessionRow = class extends Model$1.Class("SessionRow")({
 	id: IDFromDb,
 	spaceId: Schema.String,
-	parentId: Model.FieldOption(IDFromDb),
+	parentId: Model$1.FieldOption(IDFromDb),
 	slug: Schema.String,
 	directory: schema_exports$9.AbsolutePath,
-	hostDir: Model.FieldOption(schema_exports$9.AbsolutePath),
+	hostDir: Model$1.FieldOption(schema_exports$9.AbsolutePath),
+	config: Model$1.FieldOption(Model$1.JsonFromString(Config$1)),
 	title: Schema.String,
-	tag: Model.FieldOption(Schema.String),
-	metadata: Model.FieldOption(Model.JsonFromString(Metadata)),
-	leafEntryId: Model.FieldOption(Schema.String),
-	cost: Model.GeneratedByDb(Schema.Finite),
-	tokensInput: Model.GeneratedByDb(Schema.Int),
-	tokensOutput: Model.GeneratedByDb(Schema.Int),
-	tokensCacheRead: Model.GeneratedByDb(Schema.Int),
-	tokensCacheWrite: Model.GeneratedByDb(Schema.Int),
+	tag: Model$1.FieldOption(Schema.String),
+	metadata: Model$1.FieldOption(Model$1.JsonFromString(Metadata)),
+	leafEntryId: Model$1.FieldOption(Schema.String),
+	cost: Model$1.GeneratedByDb(Schema.Finite),
+	tokensInput: Model$1.GeneratedByDb(Schema.Int),
+	tokensOutput: Model$1.GeneratedByDb(Schema.Int),
+	tokensCacheRead: Model$1.GeneratedByDb(Schema.Int),
+	tokensCacheWrite: Model$1.GeneratedByDb(Schema.Int),
 	...Timestamps
 }) {};
-var SessionInputRow = class extends Model.Class("SessionInputRow")({
+var SessionInputRow = class extends Model$1.Class("SessionInputRow")({
 	id: Schema.String,
 	sessionId: IDFromDb,
-	prompt: Model.JsonFromString(Prompt),
+	prompt: Model$1.JsonFromString(Prompt),
 	delivery: Schema.Literals(inputDeliveries),
 	admittedSeq: Schema.Int,
-	promotedSeq: Model.FieldOption(Schema.Int),
-	createdAt: Model.DateTimeInsertFromNumber
+	promotedSeq: Model$1.FieldOption(Schema.Int),
+	createdAt: Model$1.DateTimeInsertFromNumber
 }) {};
-var SessionEntryRow = class extends Model.Class("SessionEntryRow")({
+var SessionEntryRow = class extends Model$1.Class("SessionEntryRow")({
 	id: Schema.String,
 	sessionId: IDFromDb,
-	parentId: Model.FieldOption(Schema.String),
+	parentId: Model$1.FieldOption(Schema.String),
 	seq: schema_exports$9.NonNegativeInt,
 	type: Schema.Literals(entryTypes),
 	state: Schema.Literals(entryStates),
 	data: Schema.String,
-	label: Model.FieldOption(Schema.String),
-	metadata: Model.FieldOption(Model.JsonFromString(Metadata)),
+	label: Model$1.FieldOption(Schema.String),
+	metadata: Model$1.FieldOption(Model$1.JsonFromString(Metadata)),
 	...Timestamps
 }) {};
-var SessionEntryPartRow = class extends Model.Class("SessionEntryPartRow")({
+var SessionEntryPartRow = class extends Model$1.Class("SessionEntryPartRow")({
 	id: Schema.String,
 	entryId: Schema.String,
 	sessionId: IDFromDb,
 	partIndex: Schema.Int,
 	type: Schema.Literals(partTypes),
-	status: Model.FieldOption(Schema.Literals(toolStatuses)),
-	callId: Model.FieldOption(Schema.String),
-	toolName: Model.FieldOption(Schema.String),
+	status: Model$1.FieldOption(Schema.Literals(toolStatuses)),
+	callId: Model$1.FieldOption(Schema.String),
+	toolName: Model$1.FieldOption(Schema.String),
 	data: Schema.String,
 	...Timestamps
 }) {};
@@ -631,6 +713,7 @@ var schema_exports$4 = /* @__PURE__ */ __exportAll({
 //#endregion
 //#region src/event/list.ts
 var list_exports = /* @__PURE__ */ __exportAll({
+	ConfigChanged: () => ConfigChanged,
 	Definitions: () => Definitions,
 	DurableDefinitions: () => DurableDefinitions,
 	EventList: () => list_exports,
@@ -651,6 +734,8 @@ var list_exports = /* @__PURE__ */ __exportAll({
 	PromptAdmitted: () => PromptAdmitted,
 	Prompted: () => Prompted,
 	PublicDefinitions: () => PublicDefinitions,
+	RetryFinished: () => RetryFinished,
+	RetryScheduled: () => RetryScheduled,
 	SessionForked: () => SessionForked,
 	ToolProgress: () => ToolProgress$2,
 	ToolSettled: () => ToolSettled,
@@ -684,6 +769,14 @@ const Prompted = schema_exports$7.EventSchema.define({
 	...durableOptions,
 	schema: PromptFields
 });
+const ConfigChanged = schema_exports$7.EventSchema.define({
+	type: "session.config.changed",
+	...durableOptions,
+	schema: {
+		...baseOptions,
+		...Config$1.fields
+	}
+});
 const LLMFields = {
 	...baseOptions,
 	messageId: ID
@@ -713,6 +806,30 @@ const TurnAborted = schema_exports$7.EventSchema.define({
 		cause: TurnAbortCause
 	}
 });
+/**
+* A failed provider request will be repeated after `delayMs`. `attempt` counts retries from 1, so
+* the request that failed was attempt `attempt - 1`; the failed draft is already settled.
+*/
+const RetryScheduled = schema_exports$7.EventSchema.define({
+	type: "session.retry.scheduled",
+	schema: {
+		...baseOptions,
+		attempt: schema_exports$9.NonNegativeInt,
+		maxRetries: schema_exports$9.NonNegativeInt,
+		delayMs: schema_exports$9.NonNegativeInt,
+		message: Schema.String
+	}
+});
+/** Once per turn that retried: whether a retry succeeded, after how many. */
+const RetryFinished = schema_exports$7.EventSchema.define({
+	type: "session.retry.finished",
+	schema: {
+		...baseOptions,
+		attempt: schema_exports$9.NonNegativeInt,
+		success: Schema.Boolean,
+		message: (0, schema_exports$9.optional)(Schema.String)
+	}
+});
 /** Durable insertion of the request's draft assistant placeholder. */
 const LLMStarted = schema_exports$7.EventSchema.define({
 	type: "session.llm.started",
@@ -787,7 +904,10 @@ const ToolStarted = schema_exports$7.EventSchema.define({
 	schema: {
 		...LLMFields,
 		callID: Schema.String,
-		name: Schema.String
+		name: Schema.String,
+		/** The tool's display label, when its definition declares one. */
+		label: (0, schema_exports$9.optional)(Schema.String),
+		arguments: Schema.Record(Schema.String, Schema.Json)
 	}
 });
 const ToolProgress$2 = schema_exports$7.EventSchema.define({
@@ -883,14 +1003,14 @@ const PluginUpdated = schema_exports$7.EventSchema.define({
 * Everything the kernel can publish. `PublicDefinitions` is the narrower set
 * that reaches clients -- adding an event here does not publish it.
 */
-const Definitions = schema_exports$7.EventSchema.inventory(ExecutionStarted, ExecutionSucceeded, ExecutionFailed, ExecutionInterrupted, PromptAdmitted, Prompted, SessionForked, TurnStarted, TurnEnded, TurnAborted, LLMStarted, LLMTextStart, LLMTextDelta, LLMTextEnd, LLMThinkingStart, LLMThinkingDelta, LLMThinkingEnd, LLMEnded, LLMFailed, ToolStarted, ToolProgress$2, ToolSettled, PluginUpdated);
+const Definitions = schema_exports$7.EventSchema.inventory(ExecutionStarted, ExecutionSucceeded, ExecutionFailed, ExecutionInterrupted, PromptAdmitted, Prompted, ConfigChanged, SessionForked, TurnStarted, TurnEnded, TurnAborted, RetryScheduled, RetryFinished, LLMStarted, LLMTextStart, LLMTextDelta, LLMTextEnd, LLMThinkingStart, LLMThinkingDelta, LLMThinkingEnd, LLMEnded, LLMFailed, ToolStarted, ToolProgress$2, ToolSettled, PluginUpdated);
 /**
 * The wire contract: what a client is allowed to receive. Identical to
 * `Definitions` today, and separate so that adding a kernel event is not by
 * itself a decision to publish it.
 */
 const PublicDefinitions = Definitions;
-const DurableDefinitions = schema_exports$7.EventSchema.inventory(PromptAdmitted, Prompted, SessionForked, TurnEnded, LLMStarted, LLMEnded, LLMFailed, ToolSettled);
+const DurableDefinitions = schema_exports$7.EventSchema.inventory(PromptAdmitted, Prompted, ConfigChanged, SessionForked, TurnEnded, LLMStarted, LLMEnded, LLMFailed, ToolSettled);
 const Manifest$2 = {
 	definitions: schema_exports$7.EventSchema.durable([...DurableDefinitions]),
 	schema: Schema.Union([...DurableDefinitions], { mode: "oneOf" }).pipe(Schema.toTaggedUnion("type"))
@@ -1235,7 +1355,7 @@ const layer$25 = Layer.effect(Service$16, Effect.gen(function* () {
 const encoder = new TextEncoder();
 function fast(input) {
 	const data = typeof input === "string" ? encoder.encode(input) : input;
-	return Encoding.encodeHex(Effect.runSync(crypto.digest("SHA-1", data)));
+	return Hex.encode(Effect.runSync(crypto.digest("SHA-1", data)));
 }
 //#endregion
 //#region src/space/space.ts
@@ -1377,6 +1497,77 @@ const layer$24 = Layer.effect(Service$15, Effect.gen(function* () {
 	});
 }));
 //#endregion
+//#region src/util/slug.ts
+const PREFIXES = [
+	"binary",
+	"protocol",
+	"astromech",
+	"thermal",
+	"ionic",
+	"encrypted",
+	"holonet",
+	"hyperspace",
+	"magnetic",
+	"logic",
+	"plasma",
+	"vector",
+	"optical",
+	"quantum",
+	"mechanical",
+	"servo",
+	"fusion",
+	"flux",
+	"sychro",
+	"static"
+];
+const HARDWARE = [
+	"core",
+	"unit",
+	"node",
+	"array",
+	"link",
+	"processor",
+	"module",
+	"uplink",
+	"interface",
+	"splicer",
+	"matrix",
+	"buffer",
+	"relay",
+	"circuit",
+	"sensor",
+	"driver",
+	"bridge",
+	"manifold",
+	"oscillator",
+	"terminal"
+];
+const SECTORS = [
+	"kuat",
+	"corellia",
+	"coruscant",
+	"bespin",
+	"kamino",
+	"mustafar",
+	"fondor",
+	"hosnian",
+	"lothal",
+	"scarif",
+	"sub-level",
+	"deep-space",
+	"outer-rim",
+	"mid-rim",
+	"sector-7"
+];
+const CONNECTORS = [
+	"at",
+	"of",
+	"in"
+];
+const create$3 = Effect.fnUntraced(function* (id) {
+	return `${yield* Random.choice(PREFIXES)}-${yield* Random.choice(HARDWARE)}-${yield* Random.choice(CONNECTORS)}-${yield* Random.choice(SECTORS)}-${id.slice(-8)}`;
+});
+//#endregion
 //#region src/session/session.ts
 var session_exports$1 = /* @__PURE__ */ __exportAll({
 	EntryNotFoundError: () => EntryNotFoundError,
@@ -1391,7 +1582,7 @@ var session_exports$1 = /* @__PURE__ */ __exportAll({
 	SessionNotLinkedError: () => SessionNotLinkedError,
 	SessionRow: () => SessionRow,
 	ToolCallNotFoundError: () => ToolCallNotFoundError,
-	defaultLayer: () => defaultLayer$2,
+	defaultLayer: () => defaultLayer,
 	entryStates: () => entryStates,
 	entryTypes: () => entryTypes,
 	layer: () => layer$23,
@@ -1603,9 +1794,10 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 			id,
 			spaceId: input.spaceId,
 			parentId: Option.fromUndefinedOr(input.parentId),
-			slug: input.slug,
+			slug: yield* create$3(id),
 			directory: input.directory,
 			hostDir: Option.fromUndefinedOr(input.hostDir),
+			config: Option.none(),
 			title: input.title,
 			tag: Option.fromUndefinedOr(input.tag),
 			metadata: Option.fromUndefinedOr(input.metadata),
@@ -1948,9 +2140,10 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 				id: newSessionId,
 				spaceId: source.value.spaceId,
 				parentId: Option.some(source.value.id),
-				slug: input.slug,
+				slug: yield* create$3(newSessionId),
 				directory: source.value.directory,
 				hostDir: source.value.hostDir,
+				config: source.value.config,
 				title: input.title ?? source.value.title,
 				tag: input.tag === void 0 ? source.value.tag : Option.some(input.tag),
 				metadata: source.value.metadata,
@@ -2045,6 +2238,21 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 		if (Option.isNone(updated)) return yield* Effect.die(/* @__PURE__ */ new Error("session link did not persist"));
 		return updated.value;
 	});
+	const retitle = Effect.fn("Session.retitle")(function* (sessionId, title) {
+		return (yield* sql`
+				UPDATE session SET title = ${title}
+				WHERE id = ${sessionId} AND title = ${DEFAULT_TITLE}
+				RETURNING id
+			`.pipe(Effect.orDie)).length > 0;
+	});
+	const encodeConfig = Schema.encodeEffect(Schema.fromJsonString(Config$1));
+	const configure = Effect.fn("Session.configure")(function* (sessionId, config) {
+		const patch = yield* encodeConfig(config);
+		yield* sql`
+				UPDATE session SET config = json_patch(COALESCE(config, '{}'), ${patch})
+				WHERE id = ${sessionId}
+			`;
+	}, Effect.orDie);
 	const relink = Effect.fn("Session.relink")(function* (input) {
 		const reject = (reason) => new RelinkError({
 			sessionId: input.sessionId,
@@ -2104,6 +2312,8 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 	return Service$14.of({
 		create,
 		link,
+		retitle,
+		configure,
 		get,
 		space,
 		list,
@@ -2122,7 +2332,7 @@ const layer$23 = Layer.effect(Service$14, Effect.gen(function* () {
 		setLabel
 	});
 }));
-const defaultLayer$2 = layer$23.pipe(Layer.provide(defaultLayer$3));
+const defaultLayer = layer$23.pipe(Layer.provide(defaultLayer$1));
 //#endregion
 //#region src/context/errors.ts
 var ContextDecodeError = class extends Schema.TaggedError()("ContextDecodeError", {
@@ -2459,6 +2669,7 @@ const toFileStat = (stats) => ({
 	size: stats.size,
 	mtime: stats.mtime
 });
+const SCAN_CHUNK = 65536;
 const bytes = (content) => typeof content === "string" ? Buffer$1.from(content, "utf8") : Buffer$1.from(content);
 /**
 * Provider factory method that implements the SandboxFileSytem
@@ -2470,6 +2681,8 @@ const make$17 = (vfs) => {
 		await vfs.promises.writeFile(path, bytes(content));
 	};
 	const readdir = async (path) => vfs.promises.readdir(path);
+	const open = (path) => new Promise((resolve, reject) => vfs.open(path, "r", (error, value) => error ? reject(error) : resolve(value)));
+	const close = (fd) => new Promise((resolve) => vfs.close(fd, () => resolve()));
 	const rm = async (path, options) => {
 		let stats;
 		try {
@@ -2509,7 +2722,36 @@ const make$17 = (vfs) => {
 			await vfs.promises.mkdir(path, options);
 		},
 		rm,
-		realpath: (path) => vfs.promises.realpath(path)
+		realpath: (path) => vfs.promises.realpath(path),
+		readBytes: async (path, offset, length) => {
+			const fd = await open(path);
+			try {
+				const buffer = Buffer$1.alloc(length);
+				const read = await new Promise((resolve, reject) => vfs.read(fd, buffer, 0, length, offset, (error, bytesRead) => error ? reject(error) : resolve(bytesRead)));
+				return new Uint8Array(buffer.subarray(0, read));
+			} finally {
+				await close(fd);
+			}
+		},
+		scanLines: async (path, options) => {
+			const scanner = new filesystem_exports.SandboxFileSystem.Scan.LineScanner(options);
+			const { size } = await vfs.promises.stat(path);
+			if (size === 0) return scanner.finish();
+			const fd = await open(path);
+			try {
+				const buffer = Buffer$1.alloc(Math.min(SCAN_CHUNK, size));
+				for (let position = 0; position < size;) {
+					const length = Math.min(buffer.length, size - position);
+					const read = await new Promise((resolve, reject) => vfs.read(fd, buffer, 0, length, position, (error, bytesRead) => error ? reject(error) : resolve(bytesRead)));
+					if (read === 0) break;
+					scanner.push(buffer.subarray(0, read));
+					position += read;
+				}
+			} finally {
+				await close(fd);
+			}
+			return scanner.finish();
+		}
 	};
 };
 /** The `SandboxFileSystem.Service` backed by the local {@link Vfs}. */
@@ -2637,10 +2879,12 @@ const layer$19 = (...drivers) => Layer.effect(Registry, make$16(drivers));
 //#endregion
 //#region src/sandbox/shell/host.ts
 const DEFAULT_SHELL = "sh";
+const DEFAULT_FORCE_KILL_AFTER = Duration.seconds(1);
 const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
-		const handle = yield* spawner.spawn(ChildProcess.make(file, [...args], {
+	const forceKillAfter = options.forceKillAfter ?? DEFAULT_FORCE_KILL_AFTER;
+	const spawn = (file, args, opts) => Effect.gen(function* () {
+		const spawned = yield* spawner.spawn(ChildProcess.make(file, [...args], {
 			cwd: opts?.cwd,
 			env: {
 				...options.env,
@@ -2651,6 +2895,32 @@ const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(
 			stdout: "pipe",
 			stderr: "pipe"
 		}));
+		let openPipes = 2;
+		const track = (stream) => stream.pipe(Stream.ensuring(Effect.sync(() => openPipes--)));
+		const output = {
+			stdout: track(spawned.stdout),
+			stderr: track(spawned.stderr)
+		};
+		yield* Effect.addFinalizer((exit) => Exit.isSuccess(exit) ? Effect.void : Effect.gen(function* () {
+			const running = yield* spawned.isRunning.pipe(Effect.orElseSucceed(() => false));
+			if (!running && openPipes === 0) return;
+			if (running) yield* spawned.kill({ killSignal: "SIGTERM" }).pipe(Effect.timeoutOption(forceKillAfter), Effect.flatMap(Option.match({
+				onSome: () => Effect.void,
+				onNone: () => spawned.kill({ killSignal: "SIGKILL" })
+			})), Effect.ignore);
+			yield* Effect.sync(() => {
+				try {
+					process.kill(-Number(spawned.pid), "SIGKILL");
+				} catch {}
+			});
+		}));
+		return {
+			exitCode: spawned.exitCode,
+			...output
+		};
+	});
+	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawn(file, args, opts);
 		return yield* Effect.all({
 			exitCode: handle.exitCode,
 			stdout: handle.stdout.pipe(Stream.decodeText(), Stream.mkString),
@@ -2665,9 +2935,23 @@ const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(
 		command: "",
 		cause: /* @__PURE__ */ new Error("execArgv requires a program")
 	})) : run(argv.join(" "), argv[0], argv.slice(1), opts));
+	const stream = (command, opts) => Stream.unwrap(Effect.map(spawn(options.shell ?? DEFAULT_SHELL, ["-c", command], opts), (handle) => Stream.concat(Stream.merge(handle.stdout.pipe(Stream.map((bytes) => ({
+		_tag: "stdout",
+		bytes
+	}))), handle.stderr.pipe(Stream.map((bytes) => ({
+		_tag: "stderr",
+		bytes
+	})))), Stream.fromEffect(Effect.map(handle.exitCode, (exitCode) => ({
+		_tag: "exit",
+		exitCode
+	})))))).pipe(Stream.mapError((cause) => new shell_exports.ShellError({
+		command,
+		cause
+	})));
 	return shell_exports.Shell.of({
 		exec,
-		execArgv
+		execArgv,
+		stream
 	});
 }));
 //#endregion
@@ -3052,7 +3336,8 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 			id,
 			driver: driver_exports.SandboxDriver.Name.make("local"),
 			kind: "local",
-			cwd: io_exports.SandboxIO.resolveMountCwd(hostDefaultCwd, mountOptions.cwd)
+			cwd: io_exports.SandboxIO.resolveMountCwd(hostDefaultCwd, mountOptions.cwd),
+			spillPath: io_exports.SandboxIO.DEFAULT_SPILL_PATH
 		};
 		else {
 			const row = yield* requireRow(id);
@@ -3074,7 +3359,8 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 				id,
 				driver: attached.driver.name,
 				kind: row.kind,
-				cwd: io_exports.SandboxIO.resolveMountCwd(attached.input.runtimeConfig.defaultCwd, mountOptions.cwd)
+				cwd: io_exports.SandboxIO.resolveMountCwd(attached.input.runtimeConfig.defaultCwd, mountOptions.cwd),
+				spillPath: attached.input.runtimeConfig.spillPath ?? io_exports.SandboxIO.DEFAULT_SPILL_PATH
 			};
 			const wasIdle = lease.held ? false : yield* gate.withPermits(1)(Effect.gen(function* () {
 				const latest = yield* requireRow(id);
@@ -3121,7 +3407,7 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 						WHERE id = ${id}
 					`.pipe(Effect.orDie);
 		}
-		return Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.Current, identity), Layer.succeed(io_exports.SandboxIO.FileSystem, filesystem_exports.SandboxFileSystem.withCwd(fs, identity.cwd)), Layer.succeed(io_exports.SandboxIO.Shell, (0, shell_exports.withCwd)(shell, identity.cwd)));
+		return Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.Current, identity), Layer.succeed(io_exports.SandboxIO.FileSystem, filesystem_exports.SandboxFileSystem.withCwd(fs, identity.cwd)), Layer.succeed(io_exports.SandboxIO.Shell, (0, shell_exports.withCwd)(shell, identity.cwd))).pipe(io_exports.SandboxIO.withMutation);
 	}));
 	const mount = (id, mountOptions) => mountLayer(id, mountOptions);
 	const withMount = (id, use, mountOptions) => use.pipe(Effect.provide(mount(id, mountOptions)), Effect.scoped);
@@ -3857,17 +4143,6 @@ const make$9 = () => {
 	}) };
 };
 //#endregion
-//#region src/sandbox/sandbox.ts
-/**
-* Assemble a local backend into a sandbox with a **real host shell** — the
-* right choice whenever commands must invoke actual binaries (`git`, package
-* managers). For a sandbox whose shell should stay inside the VFS, use
-* `EnvBash.services` instead, which wires just-bash over the same tree.
-*/
-const services = (backend, identity) => Layer.provideMerge(io_exports.SandboxIO.mount(identity), Layer.provideMerge(Layer.merge(layer$21, layer$18()), backend));
-/** Default sandbox: the real OS filesystem and processes, mounted at `cwd`. */
-const defaultLayer$1 = (cwd) => services(layer$20(), io_exports.SandboxIO.host(cwd));
-//#endregion
 //#region src/git/git.ts
 var AppProcessError = class extends Schema.TaggedError()("AppProcessError", {
 	command: Schema.String,
@@ -4082,7 +4357,7 @@ var Service$11 = class extends Context.Service()("@codeworksh/harness/repo/repo/
 * `.git` suffix and surrounding slashes stripped, scp form accepted.
 * `file:` urls and empty input yield undefined.
 */
-function normalize$2(url) {
+function normalize$3(url) {
 	const value = url.trim();
 	if (!value) return void 0;
 	try {
@@ -4124,7 +4399,7 @@ const layer$14 = Layer.effect(Service$11, Effect.gen(function* () {
 		const marker = posix.join(repo.store, MARKER$1);
 		const pinned = (yield* readFileSafe(fs, marker))?.trim() || void 0;
 		const url = yield* git.remote(repo.directory);
-		const normalized = url === void 0 ? void 0 : normalize$2(url);
+		const normalized = url === void 0 ? void 0 : normalize$3(url);
 		const remote = normalized === void 0 ? void 0 : {
 			id: fast(`git:${normalized}`),
 			name: posix.basename(normalized)
@@ -4351,16 +4626,13 @@ var location_exports = /* @__PURE__ */ __exportAll({
 	Info: () => Info$1,
 	Location: () => location_exports,
 	NotDirectoryError: () => NotDirectoryError,
-	Ref: () => Ref$2,
 	Service: () => Service$8,
-	defaultLayer: () => defaultLayer,
 	layer: () => layer$11,
-	layerMounted: () => layerMounted,
-	layerWith: () => layerWith
+	layerMounted: () => layerMounted
 });
-const layer$11 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
+const layer$11 = () => Layer.effect(Service, Effect.gen(function* () {
 	const instance = yield* io_exports.SandboxIO.Current;
-	const directory = schema_exports$9.AbsolutePath.make(ref.directory ?? instance.cwd);
+	const directory = schema_exports$9.AbsolutePath.make(instance.cwd);
 	const resolved = yield* (yield* Service$9).resolveOrCreate(directory);
 	return Service.of(new Info({
 		directory: resolved.directory,
@@ -4373,9 +4645,7 @@ const layer$11 = (ref = {}) => Layer.effect(Service, Effect.gen(function* () {
 * folded in. What remains is exactly the mount and the database — for callers
 * that already hold both, such as the runner and `Session.create`.
 */
-const layerMounted = (ref = {}) => layer$11(ref).pipe(Layer.provide(layer$12.pipe(Layer.provide(Layer.mergeAll(layer$14, layer$13, layer$24)), Layer.provide(layer$15))));
-const layerWith = (ref, sandbox) => layerMounted(ref).pipe(Layer.provide(sandbox), Layer.provide(defaultLayer$3));
-const defaultLayer = (ref, path) => layerWith(ref, defaultLayer$1(path));
+const layerMounted = () => layer$11().pipe(Layer.provide(layer$12.pipe(Layer.provide(Layer.mergeAll(layer$14, layer$13, layer$24)), Layer.provide(layer$15))));
 //#endregion
 //#region src/runner/run.ts
 var run_exports = /* @__PURE__ */ __exportAll({
@@ -4870,78 +5140,327 @@ const layer$9 = (definitions = Definitions) => Layer.sync(Service$4, () => {
 	});
 });
 //#endregion
-//#region src/model/catalog.ts
-var catalog_exports = /* @__PURE__ */ __exportAll({
-	ModelCatalog: () => catalog_exports,
-	RefreshError: () => RefreshError,
-	filename: () => filename,
+//#region src/settings/schema.ts
+var schema_exports$3 = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
+__reExport(schema_exports$3, import__codeworksh_plugin_settings);
+//#endregion
+//#region src/settings/merge.ts
+/**
+* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
+* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
+* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
+*/
+const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const copy = (value) => {
+	if (Array.isArray(value)) return value.map(copy);
+	return isRecord$1(value) ? merge({}, value) : value;
+};
+/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
+function merge(base, ...patches) {
+	const result = /* @__PURE__ */ new Map();
+	for (const patch of [base, ...patches]) {
+		if (patch === void 0) continue;
+		for (const [key, value] of Object.entries(patch)) {
+			if (value === null || value === void 0) continue;
+			const previous = result.get(key);
+			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
+		}
+	}
+	return Object.fromEntries(result);
+}
+/** Normalize nullable properties before schema validation, without changing array positions. */
+const normalize$2 = copy;
+//#endregion
+//#region src/settings/settings.ts
+var settings_exports = /* @__PURE__ */ __exportAll({
+	Service: () => Service$3,
+	Settings: () => settings_exports,
+	SettingsError: () => SettingsError,
+	defaults: () => schema_exports$3.defaults,
 	layer: () => layer$8,
-	loadError: () => loadError,
-	models: () => models,
-	providers: () => providers,
-	refresh: () => refresh$1,
-	sync: () => sync,
-	ttlConfig: () => ttlConfig
+	load: () => load$3,
+	modules: () => modules,
+	parse: () => parse$4,
+	paths: () => paths,
+	projectRoot: () => projectRoot,
+	userConfigDir: () => userConfigDir
 });
-const filename = "models.gen.json";
-/** How old the catalog may get before a check downloads a new one. */
-const ttlConfig = Config.Duration("CODEWORK_MODELS_TTL").pipe(Config.withDefault(Duration.minutes(15)));
-/** How often a server looks at the file. A look is a `stat`; only a stale file costs a download. */
-const checkEvery = Duration.minutes(1);
-var RefreshError = class extends Schema.TaggedError()("ModelCatalog.RefreshError", {
+/**
+* An app-level `--user-config-dir` as the absolute directory it names: `~` is the user's home, and
+* a relative spelling is relative to `hostCwd` -- never to a session's `hostDir`, which is not
+* where the flag was typed.
+*/
+const userConfigDir = (raw, hostCwd) => hostPath.resolve(hostCwd, expandTilde(raw, hostPath));
+/** The settings files a directory may hold, in the order it is searched. */
+const settingsIn = (directory) => [hostPath.join(directory, "settings.jsonc"), hostPath.join(directory, "settings.json")];
+/** A directory and every ancestor above it, nearest first. */
+const ancestors$1 = (from) => {
+	const chain = [];
+	for (let directory = from;; directory = hostPath.dirname(directory)) {
+		chain.push(directory);
+		if (hostPath.dirname(directory) === directory) return chain;
+	}
+};
+const isDirectory = (path) => fileSystem.stat(path).pipe(Effect.map((info) => info.type === "Directory"), Effect.orElseSucceed(() => false));
+/**
+* The project a directory is in: the nearest ancestor holding a `.codework` **directory**.
+*
+* This is git's rule. `~/workspace/app/.codework` makes `~/workspace/app` a project, and
+* `~/workspace/app/packages/fubar` is inside it. Nearest wins outright -- the walk stops at the
+* first marker, so an inner project is never merged with an outer one.
+*
+* The marker is the directory, not a file in it. An empty `.codework/` is still a project root,
+* which is the point: creating the directory is how a person says "a project begins here", and it
+* has to mean that before any settings exist. It also makes the question one `stat` per ancestor
+* whose answer does not change as files come and go inside.
+*
+* `<home>` is skipped. `~/.codework` is the user layer, not a project; without this, running
+* anywhere under `$HOME` would find it as one and read the user layer twice -- and since plugin
+* entries accumulate across layers, every user plugin would load twice.
+*/
+const projectRoot = Effect.fn("Settings.projectRoot")(function* (from, home) {
+	const userConfig = hostPath.resolve(home);
+	for (const directory of ancestors$1(hostPath.resolve(from))) {
+		const marker = hostPath.join(directory, appConfigDir);
+		if (hostPath.resolve(marker) === userConfig) continue;
+		if (yield* isDirectory(marker)) return directory;
+	}
+});
+/**
+* Ordered layers, each a group of candidates where the first file that exists is selected -- a
+* group never contributes more than one file.
+*
+* `.jsonc` is the canonical spelling: these files are written by hand and read as JSONC, so the
+* extension says what the file is and an editor validates it as such. `.json` remains a fallback
+* everywhere, tried second, because the parser reads either and a file already named that must
+* keep working.
+*
+* `root` is an already-discovered project root ({@link projectRoot}), not a directory to search
+* from: the walk is a `stat` per ancestor and belongs with the other I/O. `undefined` contributes
+* no project layer at all, which is what a session with no host directory gets.
+*/
+function paths(input) {
+	return [settingsIn(input.userConfigDir ?? input.home), input.root === void 0 ? [] : settingsIn(hostPath.join(input.root, appConfigDir))];
+}
+var SettingsError = class extends Schema.TaggedError()("SettingsError", {
 	path: Schema.String,
+	reason: Schema.Literals([
+		"read",
+		"parse",
+		"decode"
+	]),
 	detail: Schema.String
 }) {
 	get message() {
-		return `failed to refresh the model catalog at ${this.path}: ${this.detail}`;
+		return `${this.path}: ${this.reason}: ${this.detail}`;
 	}
 };
-/** Point aikit at `<home>/models.gen.json`, which `CODEWORK_MODELS_FILE` overrides. */
-const use = (home) => {
-	const own = hostPath.resolve(home, filename);
-	Model$1.configureCatalog(own);
-	const path = Model$1.catalogPath();
-	return {
-		path,
-		pinned: path !== own
-	};
+/** `line:column`, 1-based, for a parser offset into the source. */
+const at = (source, offset) => {
+	const before = source.slice(0, offset).split("\n");
+	return `${before.length}:${(before.at(-1)?.length ?? 0) + 1}`;
 };
-const modified = (path) => fileSystem.stat(path).pipe(Effect.map((info) => Option.map(info.mtime, (date) => date.getTime())), Effect.orElseSucceed(() => Option.none()));
-const stale = Effect.fn("ModelCatalog.stale")(function* (path) {
-	const mtime = yield* modified(path);
-	if (Option.isNone(mtime)) return true;
-	const ttl = yield* ttlConfig;
-	return (yield* Clock.currentTimeMillis) - mtime.value >= Duration.toMillis(ttl);
-});
-const download$1 = (path) => Effect.tryPromise({
-	try: () => generateModels({ path }),
-	catch: (cause) => new RefreshError({
-		path,
-		detail: cause instanceof Error ? cause.message : String(cause)
-	})
-});
-/** Download a new catalog for the home when it is missing, older than the TTL, or `force` asks. */
-const refresh$1 = Effect.fn("ModelCatalog.refresh")(function* (home, options = {}) {
-	const { path } = use(home);
-	if (options.force !== true && !(yield* stale(path))) return {
+/**
+* Decode failures name the field, and explain it only with a message a schema check wrote. Effect's
+* defaults quote the rejected value, and in a settings file that value can be a secret, so any
+* other failure reads "invalid value".
+*/
+const decodeFormatter = SchemaIssue.makeFormatterStandardSchemaV1({ leafHook: (issue) => {
+	const message = "annotations" in issue ? issue.annotations?.message : void 0;
+	return typeof message === "string" ? message.replaceAll(/\s*\n\s*/g, " ") : "invalid value";
+} });
+const parse$4 = Effect.fn("Settings.parse")(function* (path, source) {
+	const errors = [];
+	const json = parse(source, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	const first = errors[0];
+	if (first !== void 0) return yield* new SettingsError({
 		path,
-		refreshed: false
-	};
-	yield* download$1(path);
-	return {
+		reason: "parse",
+		detail: `${printParseErrorCode(first.error)} at ${at(source, first.offset)}`
+	});
+	const document = normalize$2(json);
+	if (Predicate.isObject(document) && Predicate.isObject(json) && "plugins" in json) Object.assign(document, { plugins: json.plugins });
+	return yield* Schema.decodeUnknownEffect(schema_exports$3.Patch)(document).pipe(Effect.mapError((error) => new SettingsError({
 		path,
-		refreshed: true
-	};
+		reason: "decode",
+		detail: decodeFormatter(error.issue).issues.map((issue) => `${issue.path?.map((part) => typeof part === "object" ? String(part.key) : part).join(".") ?? "settings"}: ${issue.message}`).join("; ")
+	})));
 });
+var Service$3 = class extends Context.Service()("@codeworksh/harness/settings/settings/Service") {};
 /**
-* The automatic check: refresh a stale catalog unless it is pinned, and never fail. A failed
-* download leaves the old file in place; a missing one surfaces later as a
-* `Runner.ModelCatalogError` from whatever needed it.
-*/
-const check$1 = Effect.fn("ModelCatalog.check")(function* ({ path, pinned }) {
-	if (pinned || !(yield* stale(path))) return;
-	yield* download$1(path);
-});
+* Anchor relative plugin entries to the file that declared them.
+*
+* A reference is otherwise resolved against the host startup directory, which is right for
+* a project file sitting in it and meaningless for `~/.codework/settings.json`, where
+* `./plugins/x.ts` would name a different file in every project the process is started in.
+* `file:` URLs, package specs and package names are left exactly as written, and a `plugin`
+* key is an ID rather than a location. A configuration entry's `package` is anchored like a
+* module entry, so a relative path names the same module in both spellings.
+*/
+const anchored = (entry, file) => {
+	const directory = hostPath.dirname(file);
+	const resolve = (reference) => reference.startsWith("./") || reference.startsWith("../") ? hostPath.resolve(directory, reference) : reference;
+	if (typeof entry === "string") return resolve(entry);
+	return "package" in entry ? {
+		...entry,
+		package: resolve(entry.package)
+	} : entry;
+};
+const anchor$1 = (patch, file) => patch.plugins === void 0 ? patch : {
+	...patch,
+	plugins: patch.plugins.map((entry) => anchored(entry, file))
+};
+const attempt = (path) => fileSystem.readFileString(path).pipe(Effect.mapError((error) => new SettingsError({
+	path,
+	reason: "read",
+	detail: error.reason._tag
+})), Effect.flatMap((source) => parse$4(path, source)));
+/**
+* One read of every layer. Exported for the harness constructor, which needs the plugin
+* selection before any layer is built; everything else goes through `Service`.
+*/
+const load$3 = Effect.fn("Settings.load")(function* (options) {
+	const root = options.hostDir === void 0 ? void 0 : yield* projectRoot(options.hostDir, options.home);
+	const files = paths({
+		home: options.home,
+		root,
+		...options.userConfigDir === void 0 ? {} : { userConfigDir: options.userConfigDir }
+	});
+	let settings = merge(schema_exports$3.defaults);
+	let declared = schema_exports$3.defaults.declared;
+	let models = schema_exports$3.defaults.models;
+	for (const group of files) for (const path of group) {
+		const result = yield* Effect.result(attempt(path));
+		if (Result.isSuccess(result)) {
+			const { models: entries, ...patch } = anchor$1(result.success, path);
+			settings = merge(settings, patch);
+			if (entries !== void 0) models = [...models, ...entries.map((entry) => ({
+				entry,
+				file: path
+			}))];
+			if (result.success.plugins !== void 0) declared = [...declared, ...result.success.plugins.map((written) => ({
+				written,
+				entry: anchored(written, path),
+				file: path
+			}))];
+			break;
+		}
+		const error = result.failure;
+		if (error.reason === "read" && error.detail === "NotFound") continue;
+		return yield* error;
+	}
+	return {
+		...settings,
+		plugins: declared.map((one) => one.entry),
+		declared,
+		models
+	};
+});
+/**
+* Each module reference once, owned by the **last** file to declare it (D6).
+*
+* The owner is not bookkeeping: its `.npmrc` chain keys the store artifact. The CLI that installs
+* a reference and the runtime that loads it must pick the same owner, or `plugin update` refreshes
+* an artifact the runtime never reads. Only a string entry loads a module, so only a string entry
+* owns one -- a `{ package }` patch in another file configures it and must not move its registry.
+* A reference keeps the position of its first declaration.
+*/
+const modules = (declared) => {
+	const owners = /* @__PURE__ */ new Map();
+	for (const one of declared) if (typeof one.entry === "string") owners.set(one.entry, one);
+	return owners;
+};
+const layer$8 = (options = {}) => Layer.effect(Service$3, Effect.gen(function* () {
+	const global = yield* Service$17;
+	return Service$3.of({ load: (hostDir) => load$3({
+		...options,
+		home: global.home,
+		hostDir
+	}) });
+}));
+//#endregion
+//#region src/model/catalog.ts
+var catalog_exports = /* @__PURE__ */ __exportAll({
+	Credentials: () => Credentials,
+	ModelCatalog: () => catalog_exports,
+	RefreshError: () => RefreshError,
+	available: () => available$1,
+	effective: () => effective,
+	entry: () => entry,
+	filename: () => filename,
+	fromSettings: () => fromSettings,
+	layer: () => layer$7,
+	loadError: () => loadError,
+	models: () => models,
+	oauthStorage: () => oauthStorage,
+	providers: () => providers,
+	refresh: () => refresh$1,
+	sync: () => sync,
+	ttlConfig: () => ttlConfig
+});
+const filename = "models.gen.json";
+/** How old the catalog may get before a check downloads a new one. */
+const ttlConfig = Config.Duration("CODEWORK_MODELS_TTL").pipe(Config.withDefault(Duration.minutes(15)));
+/** How often a server looks at the file. A look is a `stat`; only a stale file costs a download. */
+const checkEvery = Duration.minutes(1);
+var RefreshError = class extends Schema.TaggedError()("ModelCatalog.RefreshError", {
+	path: Schema.String,
+	detail: Schema.String
+}) {
+	get message() {
+		return `failed to refresh the model catalog at ${this.path}: ${this.detail}`;
+	}
+};
+/** Point aikit at `<home>/models.gen.json`, which `CODEWORK_MODELS_FILE` overrides. */
+const use = (home) => {
+	const own = hostPath.resolve(home, filename);
+	Model.configureCatalog(own);
+	const path = Model.catalogPath();
+	return {
+		path,
+		pinned: path !== own
+	};
+};
+const modified = (path) => fileSystem.stat(path).pipe(Effect.map((info) => Option.map(info.mtime, (date) => date.getTime())), Effect.orElseSucceed(() => Option.none()));
+const stale = Effect.fn("ModelCatalog.stale")(function* (path) {
+	const mtime = yield* modified(path);
+	if (Option.isNone(mtime)) return true;
+	const ttl = yield* ttlConfig;
+	return (yield* Clock.currentTimeMillis) - mtime.value >= Duration.toMillis(ttl);
+});
+const download$1 = (path) => Effect.tryPromise({
+	try: () => generateModels({ path }),
+	catch: (cause) => new RefreshError({
+		path,
+		detail: cause instanceof Error ? cause.message : String(cause)
+	})
+});
+/** Download a new catalog for the home when it is missing, older than the TTL, or `force` asks. */
+const refresh$1 = Effect.fn("ModelCatalog.refresh")(function* (home, options = {}) {
+	const { path } = use(home);
+	if (options.force !== true && !(yield* stale(path))) return {
+		path,
+		refreshed: false
+	};
+	yield* download$1(path);
+	return {
+		path,
+		refreshed: true
+	};
+});
+/**
+* The automatic check: refresh a stale catalog unless it is pinned, and never fail. A failed
+* download leaves the old file in place; a missing one surfaces later as a
+* `Runner.ModelCatalogError` from whatever needed it.
+*/
+const check$1 = Effect.fn("ModelCatalog.check")(function* ({ path, pinned }) {
+	if (pinned || !(yield* stale(path))) return;
+	yield* download$1(path);
+});
 const quietly = (effect) => effect.pipe(Effect.asVoid, Effect.catch((error) => Effect.logWarning(`model catalog: ${error.message}`)));
 /** Check the home's catalog once, for a command that runs and exits; returns the file aikit reads. */
 const sync = Effect.fn("ModelCatalog.sync")(function* (home) {
@@ -4954,7 +5473,7 @@ const sync = Effect.fn("ModelCatalog.sync")(function* (home) {
 * moved -- refreshed here, by `codework models refresh`, or by hand -- is reloaded, so the
 * process never serves a catalog older than what is on disk.
 */
-const layer$8 = (options) => Layer.effectDiscard(Effect.gen(function* () {
+const layer$7 = (options) => Layer.effectDiscard(Effect.gen(function* () {
 	const target = use(options.home);
 	yield* quietly(check$1(target));
 	if (!options.watch) return;
@@ -4963,7 +5482,7 @@ const layer$8 = (options) => Layer.effectDiscard(Effect.gen(function* () {
 	const tick = Effect.gen(function* () {
 		yield* quietly(check$1(target));
 		const mtime = yield* current;
-		if (mtime !== (yield* Ref.getAndSet(seen, mtime))) Model$1.reloadCatalog();
+		if (mtime !== (yield* Ref.getAndSet(seen, mtime))) Model.reloadCatalog();
 	});
 	yield* Effect.forkScoped(tick.pipe(Effect.repeat(Schedule.spaced(checkEvery))));
 }));
@@ -4980,79 +5499,112 @@ const loadError = (cause) => {
 	});
 };
 const catalogError = (cause) => loadError(cause) ?? new ModelCatalogError({
-	path: Model$1.catalogPath(),
+	path: Model.catalogPath(),
 	reason: "unreadable",
 	detail: cause instanceof Error ? cause.message : "failed to load the model catalog"
 });
 const models = Effect.tryPromise({
-	try: () => Model$1.getBuiltInModels(),
+	try: () => Model.getBuiltInModels(),
 	catch: catalogError
 });
 const providers = Effect.tryPromise({
-	try: () => Model$1.getProviders(),
+	try: () => Model.getProviders(),
 	catch: catalogError
 });
-//#endregion
-//#region src/plugin/plugin.ts
-var plugin_exports$1 = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
-__reExport(plugin_exports$1, import__codeworksh_plugin_plugin);
-//#endregion
-//#region src/plugin/builtin/prompt/default.ts
-/** The default coding-agent foundation, used unless `promptCustom` replaces it. */
-const foundation = `You are an expert coding assistant operating inside codework, a coding agent harness.`;
 /**
-* Guidelines that hold regardless of which tools are registered.
-*
-* Kept short on purpose. Every line here is spent on every request, so a line
-* earns its place only if a model measurably behaves worse without it.
+* Where this process reads OAuth logins: `<home>/aikit/auth.json` when a home was chosen,
+* otherwise `undefined`, which lets aikit resolve it (`CODEWORK_CREDENTIALS`, then the default home).
+* One value, so the model calls and {@link available} can never read different files.
 */
-const standingGuidelines = [
-	"Be concise. Report what you did and what you found, not what you are about to do.",
-	"Quote exact paths and command output rather than paraphrasing them.",
-	"If a command fails, read the error before retrying."
-];
-/** Collapse whitespace so two spellings of one guideline dedupe against each other. */
-const normalize$1 = (value) => value.trim().replace(/\s+/g, " ");
+var Credentials = class extends Context.Service()("@codeworksh/harness/model/catalog/Credentials") {};
+/** The storage options an aikit OAuth store takes for {@link Credentials.authFile}. */
+const oauthStorage = (authFile) => authFile === void 0 ? {} : { path: authFile };
+/** Whether an OAuth login is stored for the protocol. Reads the file; never refreshes a token. */
+const loggedIn = (protocol, authFile) => {
+	const storage = oauthStorage(authFile);
+	const store = protocol === "openai-codex" ? new JsonOpenAICodexAuthStorage(storage) : protocol === "github-copilot" ? new JsonGitHubCopilotAuthStorage(storage) : void 0;
+	if (store === void 0) return Effect.succeed(false);
+	return Effect.tryPromise(() => store.get()).pipe(Effect.map((stored) => stored !== void 0), Effect.orElseSucceed(() => false));
+};
 /**
-* Tool-contributed guidelines followed by the standing ones, normalized and
-* deduplicated with first occurrence winning.
-*
-* Tool order is bucket order, which is the same order the index renders in and the
-* same order the provider receives definitions in -- one ordering, not three.
+* A settings entry as the catalog reads it. Settings entries are read exactly like generated ones;
+* the one difference is `provider.key`, written `"${NAME}"`, which becomes the variable name aikit
+* looks up when it calls the model.
 */
-const guidelines = (tools) => {
-	const seen = /* @__PURE__ */ new Set();
-	const collected = [];
-	for (const line of [...tools.flatMap((tool) => tool.promptGuidelines ?? []), ...standingGuidelines]) {
-		const normalized = normalize$1(line);
-		if (normalized.length === 0 || seen.has(normalized)) continue;
-		seen.add(normalized);
-		collected.push(normalized);
-	}
-	return collected;
+const fromSettings = (entry) => entry.provider.key === void 0 ? entry : {
+	...entry,
+	provider: {
+		...entry.provider,
+		key: (0, schema_exports$3.keyName)(entry.provider.key)
+	}
+};
+/** The settings entry for a model, if one declares it: the last declaration wins. */
+const entry = (declared, provider, id) => {
+	const found = declared.findLast((one) => one.entry.provider.id === provider && one.entry.id === id);
+	return found === void 0 ? void 0 : fromSettings(found.entry);
 };
 /**
-* The rendered tool index.
+* The generated catalog with settings entries appended in layer order: a new provider or model is
+* added, and an entry for an existing one replaces it, as a later entry in a generated file would.
+*/
+const effective = Effect.fn("ModelCatalog.effective")(function* (declared) {
+	const catalog = { ...yield* models };
+	for (const { entry: one } of declared) catalog[one.provider.id] = {
+		...catalog[one.provider.id],
+		[one.id]: fromSettings(one)
+	};
+	return catalog;
+});
+const oauthProtocols = /* @__PURE__ */ new Set(["openai-codex", "github-copilot"]);
+/**
+* The effective catalog's providers this process has credentials for, optionally only those
+* credentialed one way. `hostDir` selects the project whose settings entries apply; without it,
+* only the user's.
 *
-* `(none)` rather than an omitted section: a model told it has no tools behaves
-* better than one left to infer it from silence.
+* `apiKey`: the provider's `key` or `env` names are set in the host environment (they include the
+* OAuth providers' env tokens). `oauth`: a login is stored in the {@link Credentials} file. `none`:
+* the provider names no key and isn't an OAuth provider. A provider with a key and a login reports
+* `apiKey`, the one a model call uses first.
+*
+* Presence, not validity: nothing is sent over the network, so a revoked key still counts. A
+* client showing a model picker should still add the session's current model.
 */
-const toolIndex = (tools) => {
-	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
-	if (listed.length === 0) return "(none)";
-	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
-};
-const assemble = (input) => {
-	const sections = [input.promptCustom ?? foundation];
-	sections.push(`Available tools:\n${toolIndex(input.tools)}`);
-	const lines = guidelines(input.tools);
-	if (lines.length > 0) sections.push(`Guidelines:\n${lines.map((line) => `- ${line}`).join("\n")}`);
-	const append = input.promptSystemAppend?.trim();
-	if (append !== void 0 && append.length > 0) sections.push(append);
-	sections.push(`Current working directory: ${input.directory}`);
-	return sections.join("\n\n");
-};
+const available$1 = Effect.fn("ModelCatalog.available")(function* (filter = {}) {
+	const { authFile } = yield* Credentials;
+	const settings = yield* Service$3;
+	const catalog = yield* effective((yield* settings.load(filter.hostDir)).models);
+	const usable = [];
+	for (const [id, entries] of Object.entries(catalog)) {
+		const first = entries === void 0 ? void 0 : Object.values(entries)[0];
+		if (entries === void 0 || first === void 0) continue;
+		const keyless = first.provider.key === void 0 && first.provider.env.length === 0 && !oauthProtocols.has(first.protocol);
+		const credential = getEnvApiKey(first.provider) !== void 0 ? "apiKey" : (yield* loggedIn(first.protocol, authFile)) ? "oauth" : keyless ? "none" : void 0;
+		if (credential === void 0 || filter.credential !== void 0 && filter.credential !== credential) continue;
+		usable.push({
+			id,
+			credential,
+			models: entries
+		});
+	}
+	return usable;
+});
+//#endregion
+//#region src/plugin/plugin.ts
+var plugin_exports$1 = /* @__PURE__ */ __exportAll({});
+import * as import__codeworksh_plugin_plugin from "@codeworksh/plugin/plugin";
+__reExport(plugin_exports$1, import__codeworksh_plugin_plugin);
+//#endregion
+//#region src/plugin/builtin/prompt/default.ts
+/** The default prompt foundation, used unless `promptCustom` replaces it. */
+const foundation = "You are an expert coding assistant operating inside codework, a coding agent harness. You help users by reading files, executing commands, editing code, and writing new files.";
+/** Every line here is spent on every request; keep it short. */
+const standingRules = ["Be concise in your responses", "Show file paths clearly when working with files"];
+/** Bash stands in for file tools only until dedicated ones are registered. */
+const toolRules = (names) => names.has("bash") && ![
+	"grep",
+	"find",
+	"ls"
+].some((name) => names.has(name)) ? ["Use bash for file operations like ls, rg, find"] : [];
 /**
 * A caller slot, awaited lazily. A throw or rejection fails the snapshot, which the
 * host attributes to this plugin's id.
@@ -5063,13 +5615,92 @@ const defaultPromptPlugin = (0, plugin_exports$1.define)({
 	kind: "prompt",
 	setup: Effect.fn("DefaultPromptPlugin.setup")(function* (ctx) {
 		const custom = yield* slot(ctx, ctx.config.promptCustom);
-		const append = yield* slot(ctx, ctx.config.promptSystemAppend);
-		ctx.plugin.prompt.set(assemble({
-			tools: ctx.plugin.tools.list(),
-			directory: ctx.location.directory,
-			...custom === void 0 ? {} : { promptCustom: custom },
-			...append === void 0 ? {} : { promptSystemAppend: append }
-		}));
+		const append = (yield* slot(ctx, ctx.config.promptSystemAppend))?.trim();
+		const prompt = ctx.plugin.prompt;
+		prompt.foundation.set(custom ?? foundation);
+		const names = new Set(ctx.plugin.tools.list().map((tool) => tool.name));
+		for (const rule of [...toolRules(names), ...standingRules]) prompt.sections.append(Section.Rules, rule);
+		if (append !== void 0 && append.length > 0) prompt.sections.append(Section.Addendum, append);
+	})
+});
+//#endregion
+//#region src/plugin/builtin/prompt/instruction.ts
+/** First readable match per directory wins. */
+const names = [
+	"AGENTS.override.md",
+	"CLAUDE.override.md",
+	"AGENTS.md",
+	"AGENTS.MD",
+	"CLAUDE.md",
+	"CLAUDE.MD"
+];
+const content = (raw) => {
+	const text = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
+	return text.trim().length === 0 ? void 0 : text;
+};
+/** `directory` and every ancestor up to the sandbox root, closest first. */
+const ancestors = (directory) => {
+	const chain = [];
+	for (let current = directory;; current = posix.dirname(current)) {
+		chain.push(current);
+		if (posix.dirname(current) === current) return chain;
+	}
+};
+/**
+* Which of `paths` are files. Absence is the expected answer and stays silent; any other failure
+* (permissions, a remote blip) is logged so a dropped file is not a mystery, then counts as absent.
+*/
+const present$1 = (fs, paths) => Effect.forEach(paths, (path) => fs.stat(path).pipe(Effect.map((stat) => stat.isFile), Effect.catch((error) => filesystem_exports.SandboxFileSystem.isNotFoundError(error.cause) ? Effect.succeed(false) : Effect.logWarning(`could not stat instruction file ${path}`, error.cause).pipe(Effect.as(false)))), { concurrency: "unbounded" }).pipe(Effect.map((hits) => new Set(paths.filter((_, index) => hits[index]))));
+/** A file that stats but does not read falls through to the next candidate. */
+const first = Effect.fnUntraced(function* (fs, directory, files) {
+	for (const name of names) {
+		const path = posix.join(directory, name);
+		if (!files.has(path)) continue;
+		const raw = yield* fs.readFile(path).pipe(Effect.tapError((error) => Effect.logWarning(`could not read instruction file ${path}`, error.cause)), Effect.option);
+		if (Option.isSome(raw)) return {
+			name,
+			path,
+			content: content(raw.value)
+		};
+	}
+});
+/** Only the path is escaped; file content goes in verbatim. */
+const attribute = (value) => value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;");
+/**
+* The main checkout's directory when the cwd is in a linked worktree nested inside it (e.g.
+* `repo/.claude/worktrees/x`), so its same-named file is not applied twice. Sibling worktrees,
+* bare layouts and submodules are never shadowed.
+*/
+const shadowing = (location) => {
+	const store = location.project.vcs?.store;
+	if (location.space.kind !== "linked" || store === void 0 || posix.basename(store) !== ".git") return void 0;
+	const main = posix.dirname(store);
+	return location.space.location.startsWith(`${main}/`) ? main : void 0;
+};
+/** One file per directory from the sandbox root down to the cwd, closest last so it has the final word. */
+const discover = Effect.fnUntraced(function* (fs, location) {
+	const chain = ancestors(location.directory);
+	const files = yield* present$1(fs, chain.flatMap((directory) => names.map((name) => posix.join(directory, name))));
+	const found = yield* Effect.forEach(chain, (directory) => first(fs, directory, files), { concurrency: "unbounded" });
+	const main = shadowing(location);
+	const worktree = main === void 0 ? void 0 : found[chain.indexOf(location.space.location)];
+	const walked = [];
+	for (const [index, here] of found.entries()) {
+		const shadowed = chain[index] === main && worktree !== void 0 && here?.name === worktree.name;
+		if (here !== void 0 && !shadowed) walked.push(here);
+	}
+	return walked.reverse();
+});
+const instructionPlugin = (0, plugin_exports$1.define)({
+	id: "codework.prompt.instruction",
+	kind: "prompt",
+	setup: Effect.fn("InstructionPlugin.setup")(function* (ctx) {
+		const fs = yield* io_exports.SandboxIO.FileSystem;
+		const files = (yield* discover(fs, ctx.location)).filter((file) => file.content !== void 0);
+		if (files.length === 0) return;
+		const prompt = ctx.plugin.prompt;
+		prompt.sections.append(Section.ProjectContext, "Project-Specific Instructions & Guidelines:");
+		for (const file of files) prompt.sections.append(Section.ProjectContext, `<project_instructions path="${attribute(file.path)}">\n${file.content}\n</project_instructions>`);
 	})
 });
 //#endregion
@@ -5086,6 +5717,17 @@ const defaultPromptPlugin = (0, plugin_exports$1.define)({
 */
 const DEFAULT_MAX_LINES = 2e3;
 const DEFAULT_MAX_BYTES = 51200;
+/** Cut one line to `maxChars`, marking the cut. */
+function truncateLine(line, maxChars = 500) {
+	if (line.length <= maxChars) return {
+		text: line,
+		wasTruncated: false
+	};
+	return {
+		text: `${line.slice(0, maxChars)}... [truncated]`,
+		wasTruncated: true
+	};
+}
 function splitLinesForCounting(content) {
 	if (content.length === 0) return [];
 	const lines = content.split("\n");
@@ -5099,6 +5741,74 @@ function formatSize(bytes) {
 	return `${(bytes / 1048576).toFixed(1)}MB`;
 }
 /**
+* Truncate content from the head (keep the first N lines/bytes). Suitable for
+* file reads where the beginning matters. Never returns partial lines; if the
+* first line alone exceeds the byte limit, returns empty content with
+* `firstLineExceedsLimit = true`.
+*/
+function truncateHead(content, options = {}) {
+	const maxLines = options.maxLines ?? 2e3;
+	const maxBytes = options.maxBytes ?? 51200;
+	const totalBytes = Buffer.byteLength(content, "utf-8");
+	const lines = splitLinesForCounting(content);
+	const totalLines = lines.length;
+	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
+		content,
+		truncated: false,
+		truncatedBy: null,
+		totalLines,
+		totalBytes,
+		outputLines: totalLines,
+		outputBytes: totalBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+	if (Buffer.byteLength(lines[0] ?? "", "utf-8") > maxBytes) return {
+		content: "",
+		truncated: true,
+		truncatedBy: "bytes",
+		totalLines,
+		totalBytes,
+		outputLines: 0,
+		outputBytes: 0,
+		lastLinePartial: false,
+		firstLineExceedsLimit: true,
+		maxLines,
+		maxBytes
+	};
+	const outputLinesArr = [];
+	let outputBytesCount = 0;
+	let truncatedBy = "lines";
+	for (let i = 0; i < lines.length && i < maxLines; i++) {
+		const line = lines[i] ?? "";
+		const lineBytes = Buffer.byteLength(line, "utf-8") + (i > 0 ? 1 : 0);
+		if (outputBytesCount + lineBytes > maxBytes) {
+			truncatedBy = "bytes";
+			break;
+		}
+		outputLinesArr.push(line);
+		outputBytesCount += lineBytes;
+	}
+	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
+	const outputContent = outputLinesArr.join("\n");
+	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
+	return {
+		content: outputContent,
+		truncated: true,
+		truncatedBy,
+		totalLines,
+		totalBytes,
+		outputLines: outputLinesArr.length,
+		outputBytes: finalOutputBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+}
+/**
 * Truncate content from the tail (keep the last N lines/bytes). Suitable for
 * bash output where the end matters (errors, final results). May return a
 * partial first line if the last line of the original content exceeds the byte
@@ -5173,9 +5883,6 @@ function truncateStringToBytesFromEnd(str, maxBytes) {
 }
 //#endregion
 //#region src/tool/accumulator.ts
-function defaultTempFilePath(prefix, suffix) {
-	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
-}
 function byteLength(text) {
 	return Buffer.byteLength(text, "utf-8");
 }
@@ -5183,9 +5890,7 @@ var Accumulator = class {
 	maxLines;
 	maxBytes;
 	maxRollingBytes;
-	tempFilePrefix;
 	decoder = new TextDecoder();
-	rawChunks = [];
 	tailText = "";
 	tailBytes = 0;
 	tailStartsAtLineBoundary = true;
@@ -5196,45 +5901,43 @@ var Accumulator = class {
 	currentLineBytes = 0;
 	hasOpenLine = false;
 	finished = false;
-	tempFilePath;
-	tempFile;
 	constructor(options = {}) {
 		this.maxLines = options.maxLines ?? 2e3;
 		this.maxBytes = options.maxBytes ?? 51200;
 		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
-		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
-	}
-	append(data) {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
-			this.totalRawBytes += data.length;
-			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
-			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
-				yield* this.ensureTempFile();
-				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
-			});
-			if (data.length > 0) this.rawChunks.push(data);
-			return Effect.void;
-		});
+	}
+	/** `rawBytes` is what `data` measured before a backend decoded it, when that differs. */
+	append(data, rawBytes = data.length) {
+		if (this.finished) throw new Error("cannot append to a finished output accumulator");
+		this.totalRawBytes += rawBytes;
+		this.appendDecodedText(this.decoder.decode(data, { stream: true }));
+	}
+	/**
+	* Count output that was produced but not delivered — the start of the output,
+	* before anything is appended. Unless it is known to end a line, the first
+	* appended line is treated as partial and left out of snapshots.
+	*/
+	skip(bytes, newlines, endsLine) {
+		if (bytes <= 0) return;
+		this.totalRawBytes += bytes;
+		this.totalDecodedBytes += bytes;
+		this.completedLines += newlines;
+		this.totalLines = this.completedLines;
+		this.tailStartsAtLineBoundary = endsLine;
 	}
 	finish() {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.void;
-			this.finished = true;
-			this.appendDecodedText(this.decoder.decode());
-			return Effect.gen({ self: this }, function* () {
-				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
-				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
-			});
-		});
+		if (this.finished) return;
+		this.finished = true;
+		this.appendDecodedText(this.decoder.decode());
 	}
 	snapshot() {
 		const tailTruncation = truncateTail(this.getSnapshotText(), {
 			maxLines: this.maxLines,
 			maxBytes: this.maxBytes
 		});
-		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
-		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
+		const beyondLimits = this.totalLines > this.maxLines || this.totalRawBytes > this.maxBytes;
+		const truncated = beyondLimits || tailTruncation.truncated;
+		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalRawBytes > this.maxBytes ? "bytes" : "lines") : null;
 		const truncation = {
 			...tailTruncation,
 			truncated,
@@ -5247,7 +5950,7 @@ var Accumulator = class {
 		return {
 			content: truncation.content,
 			truncation,
-			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
+			beyondLimits
 		};
 	}
 	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
@@ -5293,23 +5996,111 @@ var Accumulator = class {
 	getSnapshotText() {
 		if (this.tailStartsAtLineBoundary) return this.tailText;
 		const firstNewline = this.tailText.indexOf("\n");
-		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
-	}
-	shouldUseTempFile() {
-		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
-	}
-	ensureTempFile() {
-		if (this.tempFile !== void 0) return Effect.void;
-		return Effect.gen({ self: this }, function* () {
-			const suffix = Encoding.encodeHex(yield* crypto.randomBytes(8));
-			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
-			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
-			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
-			this.rawChunks = [];
-		}).pipe(Effect.orDie);
+		return firstNewline === -1 || firstNewline === this.tailText.length - 1 ? this.tailText : this.tailText.slice(firstNewline + 1);
 	}
 };
 //#endregion
+//#region src/tool/output.ts
+/** A new, unused output file path under `spillPath`. */
+const path$1 = (spillPath, prefix) => crypto.randomBytes(8).pipe(Effect.map((bytes) => posix.join(spillPath, `${prefix}-${Hex.encode(bytes)}.log`)), Effect.orDie);
+/** First line printed when the output file cannot be created; the command then runs unsaved. */
+const unsaved = (file) => `codework: output not saved, cannot create ${file}`;
+const HEADER = "codework-output";
+/** Twice the byte limit leaves room to find where the shown lines start. */
+const windowBytes = (limits) => limits.maxBytes * 2;
+/**
+* The wrapper. The command's combined output goes through `pipeline` into the
+* file; the file's size then decides whether it is kept, and `report` lines run
+* before an unkept file is removed.
+*/
+const script = (command, file, limits, pipeline, report) => [
+	`f=${(0, shell_exports.quote)(file)}`,
+	"run() (",
+	command,
+	")",
+	`if mkdir -p ${(0, shell_exports.quote)(posix.dirname(file))} 2>/dev/null && (umask 077 2>/dev/null; set -C && : > "$f" && : > "$f.rc" && : > "$f.pid") 2>/dev/null; then`,
+	"	echo \"$$ $(ps -o pgid= -p $$ 2>/dev/null)\" > \"$f.pid\"",
+	`\t${pipeline("{ run 2>&1; echo $? > \"$f.rc\"; }")}`,
+	"	rc=$(cat \"$f.rc\" 2>/dev/null); rm -f \"$f.rc\"",
+	`\tb=$(wc -c "$f" | awk '{ print $1 }'); n=$(wc -l "$f" | awk '{ print $1 }'); l=$n`,
+	`\t[ -s "$f" ] && [ "$(tail -c 1 "$f" | wc -l | awk '{ print $1 }')" = 0 ] && l=$((l + 1))`,
+	`\tkeep=0; { [ "$b" -gt ${limits.maxBytes} ] || [ "$l" -gt ${limits.maxLines} ]; } && keep=1`,
+	...report.map((line) => `\t${line}`),
+	"	[ \"$keep\" = 1 ] || rm -f \"$f\"",
+	"	rm -f \"$f.pid\"; exit \"${rc:-1}\"",
+	"fi",
+	"rm -f \"$f\" \"$f.rc\" \"$f.pid\" 2>/dev/null",
+	`printf '%s\\n' ${(0, shell_exports.quote)(unsaved(file))}`,
+	"run 2>&1"
+].join("\n");
+const header = new RegExp(`^${HEADER} (\\d+) (\\d+) ([01])(?: (\\d+))?$`, "m");
+const parse$3 = (match) => ({
+	bytes: Number(match[1]),
+	newlines: Number(match[2]),
+	kept: match[3] === "1"
+});
+/**
+* For a backend that streams: all output still flows back as it is produced, and
+* a copy lands in the file. The report rides on stderr, the wrapper's own channel
+* since the command's is folded into stdout.
+*/
+const streaming = (command, file, limits) => script(command, file, limits, (source) => `${source} | tee -a "$f"`, [`printf '${HEADER} %s %s %s\\n' "$b" "$n" "$keep" >&2`]);
+/** Read {@link streaming}'s stderr: the report, if it got that far, and anything else the wrapper said. */
+const report = (stderr) => {
+	const match = header.exec(stderr);
+	if (match === null) return {
+		report: void 0,
+		rest: stderr
+	};
+	return {
+		report: parse$3(match),
+		rest: stderr.slice(0, match.index) + stderr.slice(match.index + match[0].length).replace(/^\n/, "")
+	};
+};
+/**
+* For a backend that returns output only at the end: the output goes to the
+* file, and only a header — the report plus the window's raw size — and a tail
+* window come back. The bytes before the window are skipped, and counted.
+*/
+const buffered = (command, file, limits) => {
+	const tail = `tail -n ${limits.maxLines} "$f" | tail -c ${windowBytes(limits)}`;
+	return script(command, file, limits, (source) => `{ ${source} | cat; } >> "$f"`, [
+		`w=$(${tail} | wc -c | awk '{ print $1 }')`,
+		`printf '${HEADER} %s %s %s %s\\n' "$b" "$n" "$keep" "$w"`,
+		tail
+	]);
+};
+/** Read {@link buffered}'s result; `undefined` when the output was not saved and came back whole. */
+const window = (stdout) => {
+	const newline = stdout.indexOf("\n");
+	const match = header.exec(newline === -1 ? stdout : stdout.slice(0, newline));
+	if (match === null || match[4] === void 0) return void 0;
+	return {
+		...parse$3(match),
+		text: stdout.slice(newline + 1),
+		textBytes: Number(match[4])
+	};
+};
+/**
+* After a deadline or an interrupt the wrapper never reaches its own cleanup.
+* Kill what it started — its process group when it led one, else its process
+* tree, whole while the wrapper itself still runs — and remove the side files,
+* and the output file unless `keep`.
+*/
+const cleanup = (file, keep) => [
+	`f=${(0, shell_exports.quote)(file)}`,
+	"set -- $(cat \"$f.pid\" 2>/dev/null)",
+	`tree() { echo "$1"; for c in $(ps -A -o pid= -o ppid= 2>/dev/null | awk -v p="$1" '$2 == p { print $1 }'); do tree "$c"; done; }`,
+	"if [ -n \"${1:-}\" ]; then",
+	"	pids=$(tree \"$1\")",
+	"	[ \"${2:-$1}\" = \"$1\" ] && kill -s KILL -- \"-$1\" 2>/dev/null",
+	"	kill -9 $pids 2>/dev/null",
+	"fi",
+	`rm -f -- ${keep ? "\"$f.rc\" \"$f.pid\"" : "\"$f\" \"$f.rc\" \"$f.pid\""}`
+].join("\n");
+/** Remove an output file that {@link cleanup} kept. */
+const remove$1 = (file) => `rm -f -- ${(0, shell_exports.quote)(file)}`;
+//#endregion
 //#region src/tool/progress.ts
 var progress_exports = /* @__PURE__ */ __exportAll({});
 import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
@@ -5319,16 +6110,11 @@ __reExport(progress_exports, import__codeworksh_plugin_tool_progress);
 /**
 * `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
 *
-* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
-* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
-* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
-* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
-* to the timeout where it does not (Daytona) — "kill where it's easy".
-*
-* Two modes, and Local has two variants:
-*   - Local / full OS shell  → {@link local} (default)
-*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
-*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
+* It deliberately does **not** reuse `sandbox/Shell` directly: `sandbox/Shell`
+* models no timeout, and `ToolShell` makes it part of the contract. Every
+* backend reaches it through {@link fromSandboxShell}; the process dies
+* mid-flight where the backend can kill it (host, Vercel) and the call returns
+* at the deadline either way.
 */
 /** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
 var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
@@ -5383,6 +6169,7 @@ const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
 		exitCode: chunk.exitCode
 	} : {
 		_tag: "Output",
+		channel: chunk._tag,
 		bytes: chunk.bytes
 	}), Stream.mapError((cause) => new ToolShellError({
 		command,
@@ -5393,7 +6180,6 @@ const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
 		stream
 	} : { exec });
 }));
-Duration.seconds(1);
 //#endregion
 //#region src/tool/tool.ts
 var tool_exports = /* @__PURE__ */ __exportAll({});
@@ -5403,28 +6189,32 @@ __reExport(tool_exports, import__codeworksh_plugin_tool);
 //#region src/plugin/builtin/tool/bash.ts
 /**
 * The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
-* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
-* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
-* swapped by changing the provided Layer with no change to the tool.
+* the handler depends only on {@link ToolShell} / {@link ToolProgress} and the mount's
+* {@link SandboxIO.Current}, never `sandbox/Shell`, so the backend (host / just-bash / remote
+* provider) is swapped by changing the provided Layer with no change to the tool.
 *
-* Two execution paths, picked by capability:
-*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
-*     truncated once after completion.
-*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
-*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
-*     and is reported live via {@link ToolProgress}; on timeout the partial output
-*     produced so far is preserved.
+* The command runs wrapped (`Output`) so its full output is written to a file inside the sandbox,
+* kept only when it exceeds the display limits. Two paths, picked by capability:
+*   - **variant A (buffered)** otherwise: the sandbox returns only the tail of the output with its
+*     size, so a huge output never crosses to the harness.
+*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output flows through
+*     an {@link Accumulator} (bounded memory) and is reported live via {@link ToolProgress}; on
+*     timeout the partial output produced so far is preserved.
 *
 * Success and failure carry the *same* structured shape
 * (`output`, `exitCode`, `truncated`, `fullOutputPath`)
 * — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
 */
+const limits = {
+	maxLines: DEFAULT_MAX_LINES,
+	maxBytes: DEFAULT_MAX_BYTES
+};
 const BashParams = Schema.Struct({
 	command: Schema.String.annotate({ description: "The bash command to execute." }),
 	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
 });
 const outputFields = {
-	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
+	/** Combined stdout + stderr, truncated for display (full output is in the sandbox when `truncated`). */
 	output: Schema.String,
 	truncated: Schema.Boolean,
 	fullOutputPath: Schema.optional(Schema.String)
@@ -5444,175 +6234,1574 @@ var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
 	timeoutSeconds: Schema.Finite
 }) {};
 const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
+/** The reason for a failure, after any output: the model sees nothing else of `details`. */
+const withStatus = (failure) => {
+	const status = failure._tag === "BashTimedOut" ? `Command timed out after ${failure.timeoutSeconds} seconds` : failure.exitCode === -1 ? "Command terminated without an exit code" : `Command exited with code ${failure.exitCode}`;
+	return failure.output ? `${failure.output.replace(/\n$/, "")}\n\n${status}` : status;
+};
 const bashDef = tool_exports.define({
 	name: "bash",
 	label: "bash",
 	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
-	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
+	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${formatSize(DEFAULT_MAX_BYTES)} (whichever is hit first); when truncated, a note says which lines are shown and gives the path of a file holding the full output when one was saved. A non-zero exit code is reported as an error carrying the captured output.`,
 	parameters: BashParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
 	success: BashSuccess,
 	failure: BashFailure,
 	encodeContent: (success) => [{
 		type: "text",
-		text: success.output
+		text: success.output || "(no output)"
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: withStatus(failure)
+	}]
+});
+/** Combine stdout and stderr into one stream of text, stderr after stdout. */
+const combineOutput = (stdout, stderr) => {
+	if (stderr.length === 0) return stdout;
+	if (stdout.length === 0) return stderr;
+	return `${stdout}\n${stderr}`;
+};
+/** One-line footer appended to truncated, model-facing output. */
+const footer = (t, fullOutputPath, lastLineBytes) => {
+	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
+	const startLine = t.totalLines - t.outputLines + 1;
+	if (t.lastLinePartial) {
+		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
+		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+	}
+	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
+	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
+};
+/** Present a snapshot; `saved` is the output file, when the sandbox kept one. */
+const present = (snap, lastLineBytes, saved) => {
+	if (!snap.truncation.truncated) return {
+		output: snap.content,
+		truncated: false
+	};
+	return {
+		output: snap.content.replace(/\n$/, "") + footer(snap.truncation, saved, lastLineBytes),
+		truncated: true,
+		...saved !== void 0 ? { fullOutputPath: saved } : {}
+	};
+};
+const utf8 = new TextEncoder();
+/**
+* A command cut off by its deadline never reached the wrapper's own cleanup: kill
+* what is left of it and remove its side files, keeping the output file only when
+* the result points at it.
+*/
+const cleanUp = (shell, file, presented) => sweep(shell, cleanup(file, presented.fullOutputPath !== void 0));
+/** Best-effort housekeeping script: bounded, and never a failure of the tool. */
+const sweep = (shell, script) => shell.exec(script, { timeout: Duration.seconds(5) }).pipe(Effect.ignore);
+/** Variant A — buffered: one `exec` that returns the tail of the output and its size. No live progress. */
+const runBuffered = (shell, params, file) => Effect.gen(function* () {
+	const result = yield* shell.exec(buffered(params.command, file, limits), params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
+		ToolShellTimeout: (timeout) => cleanUp(shell, file, {
+			output: "",
+			truncated: false
+		}).pipe(Effect.andThen(Effect.fail(new BashTimedOut({
+			timeoutSeconds: timeout.timeoutMillis / 1e3,
+			output: "",
+			truncated: false
+		})))),
+		ToolShellError: (cause) => Effect.die(cause)
+	}));
+	const acc = new Accumulator(limits);
+	const combined = combineOutput(result.stdout, result.stderr);
+	const window$1 = window(combined);
+	if (window$1 === void 0) acc.append(utf8.encode(combined));
+	else {
+		acc.skip(window$1.bytes - window$1.textBytes, window$1.newlines - countNewlines(window$1.text), window$1.textBytes < windowBytes(limits));
+		acc.append(utf8.encode(window$1.text), window$1.textBytes);
+	}
+	acc.finish();
+	const presented = present(acc.snapshot(), acc.getLastLineBytes(), window$1?.kept === true ? file : void 0);
+	if (result.exitCode !== 0) return yield* new BashFailed({
+		exitCode: result.exitCode,
+		...presented
+	});
+	return {
+		exitCode: result.exitCode,
+		...presented
+	};
+});
+const countNewlines = (text) => {
+	let count = 0;
+	for (let index = text.indexOf("\n"); index !== -1; index = text.indexOf("\n", index + 1)) count++;
+	return count;
+};
+/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
+const runStreaming = (shell, stream, params, file) => Effect.gen(function* () {
+	const acc = new Accumulator(limits);
+	const progress = yield* progress_exports.ToolProgress;
+	const exitCode = yield* Ref.make(null);
+	const notice = unsaved(file);
+	let head = "";
+	const control = new TextDecoder();
+	let said = "";
+	const consume = stream(streaming(params.command, file, limits)).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : event.channel === "stderr" ? Effect.sync(() => {
+		said += control.decode(event.bytes, { stream: true });
+	}) : Effect.gen(function* () {
+		if (head.length < notice.length) head += new TextDecoder().decode(event.bytes.slice(0, notice.length));
+		acc.append(event.bytes);
+		yield* progress.report({ content: [{
+			type: "text",
+			text: acc.snapshot().content
+		}] });
+	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
+	let timedOutAfter;
+	if (params.timeout !== void 0) {
+		const fiber = yield* Effect.forkChild(consume);
+		const finished = yield* Fiber.await(fiber).pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
+		if (Option.isSome(finished)) yield* Fiber.join(fiber);
+		else {
+			timedOutAfter = params.timeout;
+			yield* sweep(shell, cleanup(file, true));
+			yield* Fiber.interrupt(fiber);
+		}
+	} else yield* consume;
+	const { report: report$1, rest } = report(said + control.decode());
+	if (rest.length > 0) acc.append(utf8.encode(rest));
+	acc.finish();
+	const snapshot = acc.snapshot();
+	const kept = report$1 !== void 0 ? report$1.kept : snapshot.beyondLimits && !head.startsWith(notice);
+	const presented = present(snapshot, acc.getLastLineBytes(), kept ? file : void 0);
+	if (timedOutAfter !== void 0) {
+		if (!kept) yield* sweep(shell, remove$1(file));
+		return yield* new BashTimedOut({
+			timeoutSeconds: timedOutAfter,
+			...presented
+		});
+	}
+	const code = yield* Ref.get(exitCode);
+	if (code === null || code !== 0) return yield* new BashFailed({
+		exitCode: code ?? -1,
+		...presented
+	});
+	return {
+		exitCode: code,
+		...presented
+	};
+});
+const bashHandler = (params) => Effect.gen(function* () {
+	const shell = yield* ToolShell;
+	const file = yield* path$1((yield* io_exports.SandboxIO.Current).spillPath, "codework-bash");
+	return yield* (shell.stream !== void 0 ? runStreaming(shell, shell.stream, params, file) : runBuffered(shell, params, file)).pipe(Effect.onInterrupt(() => cleanUp(shell, file, {
+		output: "",
+		truncated: false
+	})));
+});
+/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
+const bashTool = tool_exports.implement(bashDef, bashHandler);
+const bashPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.bash",
+	kind: "tool",
+	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
+		const shell = yield* io_exports.SandboxIO.Shell;
+		const current = yield* io_exports.SandboxIO.Current;
+		const mounted = Layer.merge(fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell))), Layer.succeed(io_exports.SandboxIO.Current, current));
+		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
+	})
+});
+//#endregion
+//#region src/tool/diff.ts
+const detectLineEnding = (content) => {
+	const crlfIdx = content.indexOf("\r\n");
+	const lfIdx = content.indexOf("\n");
+	if (lfIdx === -1 || crlfIdx === -1) return "\n";
+	return crlfIdx < lfIdx ? "\r\n" : "\n";
+};
+const normalizeToLF = (text) => text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+const restoreLineEndings = (text, ending) => ending === "\r\n" ? text.replace(/\n/g, "\r\n") : text;
+/** Strip a UTF-8 BOM if present; the BOM is written back after editing. */
+const stripBom = (content) => content.startsWith("") ? {
+	bom: "",
+	text: content.slice(1)
+} : {
+	bom: "",
+	text: content
+};
+/**
+* The form both sides are compared in when the exact text is not found:
+* NFKC, no trailing whitespace per line, ASCII quotes, dashes and spaces.
+*/
+const normalizeForFuzzyMatch = (text) => text.normalize("NFKC").split("\n").map((line) => line.trimEnd()).join("\n").replace(/[‘’‚‛]/g, "'").replace(/[“”„‟]/g, "\"").replace(/[‐‑‒–—―−]/g, "-").replace(/[  -   　]/g, " ");
+const splitLinesWithEndings = (content) => content.match(/[^\n]*\n|[^\n]+/g) ?? [];
+const getLineSpans = (content) => {
+	let offset = 0;
+	return splitLinesWithEndings(content).map((line) => {
+		const span = {
+			start: offset,
+			end: offset + line.length
+		};
+		offset = span.end;
+		return span;
+	});
+};
+const getReplacementLineRange = (lines, replacement) => {
+	const replacementStart = replacement.matchIndex;
+	const replacementEnd = replacement.matchIndex + replacement.matchLength;
+	const startLine = lines.findIndex((line) => replacementStart >= line.start && replacementStart < line.end);
+	if (startLine === -1) throw new Error("Replacement range is outside the base content.");
+	let endLine = startLine;
+	while (endLine < lines.length && lines[endLine].end < replacementEnd) endLine++;
+	if (endLine >= lines.length) throw new Error("Replacement range is outside the base content.");
+	return {
+		startLine,
+		endLine: endLine + 1
+	};
+};
+const applyReplacements = (content, replacements, offset = 0) => {
+	let result = content;
+	for (let i = replacements.length - 1; i >= 0; i--) {
+		const replacement = replacements[i];
+		const matchIndex = replacement.matchIndex - offset;
+		result = result.substring(0, matchIndex) + replacement.newText + result.substring(matchIndex + replacement.matchLength);
+	}
+	return result;
+};
+/**
+* Apply replacements matched against `baseContent`, a normalized view of
+* `originalContent`: the lines a replacement touches are rewritten from the
+* normalized base, every other line is copied back from the original. The
+* replacement ranges drive this, so duplicate normalized lines cannot be
+* aligned to the wrong occurrence.
+*/
+const applyReplacementsPreservingUnchangedLines = (originalContent, baseContent, replacements) => {
+	const originalLines = splitLinesWithEndings(originalContent);
+	const baseLines = getLineSpans(baseContent);
+	if (originalLines.length !== baseLines.length) throw new Error("Cannot preserve unchanged lines because the base content has a different line count.");
+	const groups = [];
+	for (const replacement of [...replacements].sort((a, b) => a.matchIndex - b.matchIndex)) {
+		const range = getReplacementLineRange(baseLines, replacement);
+		const current = groups[groups.length - 1];
+		if (current && range.startLine < current.endLine) {
+			current.endLine = Math.max(current.endLine, range.endLine);
+			current.replacements.push(replacement);
+			continue;
+		}
+		groups.push({
+			...range,
+			replacements: [replacement]
+		});
+	}
+	let originalLineIndex = 0;
+	let result = "";
+	for (const group of groups) {
+		result += originalLines.slice(originalLineIndex, group.startLine).join("");
+		const groupStartOffset = baseLines[group.startLine].start;
+		const groupEndOffset = baseLines[group.endLine - 1].end;
+		result += applyReplacements(baseContent.slice(groupStartOffset, groupEndOffset), group.replacements, groupStartOffset);
+		originalLineIndex = group.endLine;
+	}
+	return result + originalLines.slice(originalLineIndex).join("");
+};
+/** Find `oldText`, exactly first, then in fuzzy-normalized space. */
+const fuzzyFindText = (content, oldText) => {
+	const exactIndex = content.indexOf(oldText);
+	if (exactIndex !== -1) return {
+		found: true,
+		index: exactIndex,
+		matchLength: oldText.length,
+		usedFuzzyMatch: false,
+		contentForReplacement: content
+	};
+	const fuzzyContent = normalizeForFuzzyMatch(content);
+	const fuzzyOldText = normalizeForFuzzyMatch(oldText);
+	const fuzzyIndex = fuzzyContent.indexOf(fuzzyOldText);
+	if (fuzzyIndex === -1) return {
+		found: false,
+		index: -1,
+		matchLength: 0,
+		usedFuzzyMatch: false,
+		contentForReplacement: content
+	};
+	return {
+		found: true,
+		index: fuzzyIndex,
+		matchLength: fuzzyOldText.length,
+		usedFuzzyMatch: true,
+		contentForReplacement: fuzzyContent
+	};
+};
+const countOccurrences = (content, oldText) => normalizeForFuzzyMatch(content).split(normalizeForFuzzyMatch(oldText)).length - 1;
+const notFound$1 = (path, editIndex, totalEdits) => totalEdits === 1 ? `Could not find the exact text in ${path}. The old text must match exactly including all whitespace and newlines.` : `Could not find edits[${editIndex}] in ${path}. The oldText must match exactly including all whitespace and newlines.`;
+const duplicate = (path, editIndex, totalEdits, occurrences) => totalEdits === 1 ? `Found ${occurrences} occurrences of the text in ${path}. The text must be unique. Please provide more context to make it unique.` : `Found ${occurrences} occurrences of edits[${editIndex}] in ${path}. Each oldText must be unique. Please provide more context to make it unique.`;
+const emptyOldText = (path, editIndex, totalEdits) => totalEdits === 1 ? `oldText must not be empty in ${path}.` : `edits[${editIndex}].oldText must not be empty in ${path}.`;
+const noChange = (path, totalEdits) => totalEdits === 1 ? `No changes made to ${path}. The replacement produced identical content. This might indicate an issue with special characters or the text not existing as expected.` : `No changes made to ${path}. The replacements produced identical content.`;
+/**
+* Apply exact-text replacements to LF-normalized content. Every edit is matched
+* against the same original, then applied last to first so offsets stay valid.
+* If any edit needs fuzzy matching, all run in fuzzy space and only the touched
+* lines are written from it. Throws, with the message the model reads, when an
+* edit is empty, missing, ambiguous, overlapping, or changes nothing.
+*/
+const applyEditsToNormalizedContent = (normalizedContent, edits, path) => {
+	const normalizedEdits = edits.map((edit) => ({
+		oldText: normalizeToLF(edit.oldText),
+		newText: normalizeToLF(edit.newText)
+	}));
+	normalizedEdits.forEach((edit, i) => {
+		if (edit.oldText.length === 0) throw new Error(emptyOldText(path, i, normalizedEdits.length));
+	});
+	const usedFuzzyMatch = normalizedEdits.some((edit) => fuzzyFindText(normalizedContent, edit.oldText).usedFuzzyMatch);
+	const replacementBaseContent = usedFuzzyMatch ? normalizeForFuzzyMatch(normalizedContent) : normalizedContent;
+	const matchedEdits = normalizedEdits.map((edit, i) => {
+		const match = fuzzyFindText(replacementBaseContent, edit.oldText);
+		if (!match.found) throw new Error(notFound$1(path, i, normalizedEdits.length));
+		const occurrences = countOccurrences(replacementBaseContent, edit.oldText);
+		if (occurrences > 1) throw new Error(duplicate(path, i, normalizedEdits.length, occurrences));
+		return {
+			editIndex: i,
+			matchIndex: match.index,
+			matchLength: match.matchLength,
+			newText: edit.newText
+		};
+	});
+	matchedEdits.sort((a, b) => a.matchIndex - b.matchIndex);
+	for (let i = 1; i < matchedEdits.length; i++) {
+		const previous = matchedEdits[i - 1];
+		const current = matchedEdits[i];
+		if (previous.matchIndex + previous.matchLength > current.matchIndex) throw new Error(`edits[${previous.editIndex}] and edits[${current.editIndex}] overlap in ${path}. Merge them into one edit or target disjoint regions.`);
+	}
+	const newContent = usedFuzzyMatch ? applyReplacementsPreservingUnchangedLines(normalizedContent, replacementBaseContent, matchedEdits) : applyReplacements(replacementBaseContent, matchedEdits);
+	if (normalizedContent === newContent) throw new Error(noChange(path, normalizedEdits.length));
+	return {
+		baseContent: normalizedContent,
+		newContent
+	};
+};
+/** A standard unified patch. */
+const generateUnifiedPatch = (path, oldContent, newContent, contextLines = 4) => Diff.createTwoFilesPatch(path, path, oldContent, newContent, void 0, void 0, {
+	context: contextLines,
+	headerOptions: Diff.FILE_HEADERS_ONLY
+});
+/**
+* A display diff with line numbers and `contextLines` of context around each
+* change, plus the first changed line in the new file.
+*/
+const generateDiffString = (oldContent, newContent, contextLines = 4) => {
+	const parts = Diff.diffLines(oldContent, newContent);
+	const output = [];
+	const lineNumWidth = String(Math.max(oldContent.split("\n").length, newContent.split("\n").length)).length;
+	const numbered = (prefix, lineNum, line) => `${prefix}${String(lineNum).padStart(lineNumWidth, " ")} ${line}`;
+	const ellipsis = ` ${"".padStart(lineNumWidth, " ")} ...`;
+	let oldLineNum = 1;
+	let newLineNum = 1;
+	let lastWasChange = false;
+	let firstChangedLine;
+	parts.forEach((part, i) => {
+		const raw = part.value.split("\n");
+		if (raw[raw.length - 1] === "") raw.pop();
+		if (part.added || part.removed) {
+			firstChangedLine ??= newLineNum;
+			for (const line of raw) if (part.added) output.push(numbered("+", newLineNum++, line));
+			else output.push(numbered("-", oldLineNum++, line));
+			lastWasChange = true;
+			return;
+		}
+		const context = (lines) => {
+			for (const line of lines) {
+				output.push(numbered(" ", oldLineNum, line));
+				oldLineNum++;
+				newLineNum++;
+			}
+		};
+		const skip = (count) => {
+			output.push(ellipsis);
+			oldLineNum += count;
+			newLineNum += count;
+		};
+		const next = parts[i + 1];
+		const hasTrailingChange = next !== void 0 && (next.added || next.removed);
+		if (lastWasChange && hasTrailingChange) {
+			if (raw.length <= contextLines * 2) context(raw);
+			else {
+				context(raw.slice(0, contextLines));
+				skip(raw.length - contextLines * 2);
+				context(raw.slice(raw.length - contextLines));
+			}
+		} else if (lastWasChange) {
+			context(raw.slice(0, contextLines));
+			if (raw.length > contextLines) skip(raw.length - contextLines);
+		} else if (hasTrailingChange) {
+			const skipped = Math.max(0, raw.length - contextLines);
+			if (skipped > 0) skip(skipped);
+			context(raw.slice(skipped));
+		} else {
+			oldLineNum += raw.length;
+			newLineNum += raw.length;
+		}
+		lastWasChange = false;
+	});
+	return {
+		diff: output.join("\n"),
+		firstChangedLine
+	};
+};
+//#endregion
+//#region src/tool/path.ts
+/**
+* How file tools read the path a model wrote. Models copy paths out of prose and
+* terminals, so a path arrives with Unicode spaces or an `@` mention prefix the
+* file never had. Relative paths stay relative: the mount resolves them.
+*/
+const UNICODE_SPACES = /[  -   　]/g;
+const NARROW_NO_BREAK_SPACE = " ";
+/** The path a file tool acts on. */
+const normalize$1 = (path) => {
+	const normalized = path.replace(UNICODE_SPACES, " ");
+	return normalized.startsWith("@") ? normalized.slice(1) : normalized;
+};
+/**
+* The path to read: {@link normalize}d, or the first existing spelling the model
+* could not have typed — macOS screenshot names use a narrow no-break space
+* before AM/PM, decomposed (NFD) accents, and curly apostrophes. Falls back to
+* the normalized path, so a missing file is reported under the name asked for.
+*/
+const resolveRead = (fs, path) => Effect.gen(function* () {
+	const normalized = normalize$1(path);
+	const variants = /* @__PURE__ */ new Set([
+		normalized,
+		normalized.replace(/ (AM|PM)\./gi, `${NARROW_NO_BREAK_SPACE}$1.`),
+		normalized.normalize("NFD"),
+		normalized.replace(/'/g, "’"),
+		normalized.normalize("NFD").replace(/'/g, "’")
+	]);
+	for (const variant of variants) if (yield* fs.exists(variant)) return variant;
+	return normalized;
+});
+//#endregion
+//#region src/plugin/builtin/tool/edit.ts
+/**
+* The built-in edit plugin: exact-text replacements, all matched against the
+* original file, under the file's mutation lock for the whole read → match →
+* write. The model reads a one-line summary; `details` carries the diff.
+*/
+const ReplaceEdit = Schema.Struct({
+	oldText: Schema.String.annotate({ description: "Exact text for one targeted replacement. It must be unique in the original file and must not overlap with any other edits[].oldText in the same call." }),
+	newText: Schema.String.annotate({ description: "Replacement text for this targeted edit." })
+});
+const EditParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to edit (relative or absolute)" }),
+	edits: Schema.Array(ReplaceEdit).annotate({ description: "One or more targeted replacements. Each edit is matched against the original file, not incrementally. Do not include overlapping or nested edits. If two changes touch the same block or nearby lines, merge them into one edit instead." })
+});
+const EditSuccess = Schema.Struct({
+	path: Schema.String,
+	replaced: Schema.Finite,
+	diff: Schema.String,
+	patch: Schema.String,
+	firstChangedLine: Schema.optional(Schema.Finite)
+});
+var EditFailed = class extends Schema.TaggedError()("EditFailed", { message: Schema.String }) {};
+const isSingleEdit = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const edit = value;
+	return typeof edit.oldText === "string" && typeof edit.newText === "string";
+};
+/**
+* Repair shapes models commonly send: `edits` as a JSON string or as a single
+* edit object, and a top-level `oldText`/`newText` pair. Works on a copy; the
+* call's arguments stay unchanged.
+*/
+const prepareEditArguments = (input) => {
+	if (!input || typeof input !== "object" || Array.isArray(input)) return input;
+	const args = { ...input };
+	if (typeof args.edits === "string") try {
+		const parsed = JSON.parse(args.edits);
+		if (Array.isArray(parsed)) args.edits = parsed;
+		else if (isSingleEdit(parsed)) args.edits = [parsed];
+	} catch {}
+	else if (isSingleEdit(args.edits)) args.edits = [args.edits];
+	if (typeof args.oldText !== "string" || typeof args.newText !== "string") return args;
+	const edits = Array.isArray(args.edits) ? [...args.edits] : [];
+	edits.push({
+		oldText: args.oldText,
+		newText: args.newText
+	});
+	const { oldText: _oldText, newText: _newText, ...rest } = args;
+	return {
+		...rest,
+		edits
+	};
+};
+const editDef = tool_exports.define({
+	name: "edit",
+	label: "edit",
+	description: "Edit a single file using exact text replacement. Every edits[].oldText must match a unique, non-overlapping region of the original file. If two changes affect the same block or nearby lines, merge them into one edit instead of emitting overlapping edits. Do not include large unchanged regions just to connect distant changes.",
+	promptSnippet: "Make precise file edits with exact text replacement, including multiple disjoint edits in one call",
+	promptGuidelines: [
+		"Use edit for precise changes (edits[].oldText must match exactly)",
+		"When changing multiple separate locations in one file, use one edit call with multiple entries in edits[] instead of multiple edit calls",
+		"Each edits[].oldText is matched against the original file, not after earlier edits are applied. Do not emit overlapping or nested edits. Merge nearby changes into one edit.",
+		"Keep edits[].oldText as small as possible while still being unique in the file. Do not pad with large unchanged regions."
+	],
+	prepareArguments: prepareEditArguments,
+	parameters: EditParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: EditSuccess,
+	failure: EditFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: `Successfully replaced ${success.replaced} block(s) in ${success.path}.`
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: ({ diff, patch, firstChangedLine }) => ({
+		diff,
+		patch,
+		...firstChangedLine === void 0 ? {} : { firstChangedLine }
+	})
+});
+const fail$4 = (message) => Effect.fail(new EditFailed({ message }));
+/** Filesystem failures name the backend's error code, as Pi's do. */
+const accessFailure = (path) => (error) => {
+	const code = error.cause?.code;
+	return fail$4(`Could not edit file: ${path}. Error code: ${typeof code === "string" ? code : "unknown"}.`);
+};
+const editHandler = (params) => Effect.gen(function* () {
+	const { path, edits } = params;
+	if (edits.length === 0) return yield* fail$4("Edit tool input is invalid. edits must contain at least one replacement.");
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const mutation = yield* io_exports.SandboxIO.Mutation;
+	const resolved = normalize$1(path);
+	return yield* mutation.withFile(resolved, Effect.gen(function* () {
+		if (!(yield* fs.stat(resolved)).isFile) return yield* fail$4(`Could not edit file: ${path}. Path is not a file.`);
+		const { bom, text: content } = stripBom(yield* fs.readFile(resolved));
+		const originalEnding = detectLineEnding(content);
+		const { baseContent, newContent } = yield* Effect.try({
+			try: () => applyEditsToNormalizedContent(normalizeToLF(content), edits, path),
+			catch: (cause) => new EditFailed({ message: cause instanceof Error ? cause.message : String(cause) })
+		});
+		yield* fs.writeFile(resolved, bom + restoreLineEndings(newContent, originalEnding));
+		const { diff, firstChangedLine } = generateDiffString(baseContent, newContent);
+		return {
+			path,
+			replaced: edits.length,
+			diff,
+			patch: generateUnifiedPatch(path, baseContent, newContent),
+			...firstChangedLine === void 0 ? {} : { firstChangedLine }
+		};
+	}));
+}).pipe(Effect.catchTag("SandboxFileSystemError", accessFailure(params.path)));
+/** The edit tool: definition + handler, wired the testable (def/exec split) way. */
+const editTool = tool_exports.implement(editDef, editHandler);
+const editPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.edit",
+	kind: "tool",
+	setup: Effect.fn("EditPlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Mutation, yield* io_exports.SandboxIO.Mutation));
+		ctx.plugin.tools.add(tool_exports.provide(editTool, mounted));
+	})
+});
+//#endregion
+//#region src/tool/binary.ts
+/** `<home>/bin` on the host, where binaries for `local` mounts are installed. */
+var HostBin = class extends Context.Service()("@codeworksh/harness/tool/binary/HostBin") {};
+const specs = {
+	rg: {
+		label: "ripgrep (rg)",
+		repo: "BurntSushi/ripgrep",
+		tagPrefix: "",
+		commands: ["rg"],
+		asset: (version, os, arch) => `ripgrep-${version}-${arch}-${os === "darwin" ? "apple-darwin" : "unknown-linux-musl"}.tar.gz`
+	},
+	fd: {
+		label: "fd",
+		repo: "sharkdp/fd",
+		tagPrefix: "v",
+		commands: ["fd", "fdfind"],
+		asset: (version, os, arch) => `fd-v${version}-${arch}-${os === "darwin" ? "apple-darwin" : "unknown-linux-musl"}.tar.gz`
+	}
+};
+const NETWORK_TIMEOUT = Duration.seconds(10);
+const DOWNLOAD_TIMEOUT = Duration.seconds(120);
+/** Why a missing binary could not be installed; the model reads the message. */
+var InstallError$1 = class extends Schema.TaggedError()("InstallError", { message: Schema.String }) {};
+const installError = (message) => new InstallError$1({ message });
+const available = /* @__PURE__ */ new Map();
+const keyOf = (sandbox, name) => `${sandbox.id}\0${name}`;
+const run$2 = (shell, command) => shell.exec(command).pipe(Effect.orElseSucceed(() => ({
+	stdout: "",
+	stderr: "",
+	exitCode: 127
+})));
+const works = (shell, command) => Effect.map(run$2(shell, `${(0, shell_exports.quote)(command)} --version`), (result) => result.exitCode === 0);
+/** A GET whose `read` of the response, body included, finishes within `timeout`. */
+const get$2 = (url, timeout, read, init = {}) => HttpClient.get(url).pipe(Effect.flatMap(read), Effect.timeout(timeout), Effect.mapError((cause) => Schema.is(InstallError$1)(cause) ? cause : installError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`)), Effect.provide(FetchHttpClient.layer), Effect.provideService(FetchHttpClient.RequestInit, init));
+/** The latest release, read from the redirect of the release page; the API endpoint is rate limited. */
+const latestVersion = (repo) => Effect.gen(function* () {
+	const response = yield* get$2(`https://github.com/${repo}/releases/latest`, NETWORK_TIMEOUT, Effect.succeed, { redirect: "manual" });
+	const location = response.headers["location"] ?? "";
+	const tag = new URL(location, "https://github.com").pathname.split("/").pop();
+	if (!location.includes("/releases/tag/") || !tag) return yield* installError(`Failed to resolve latest ${repo} release: HTTP ${response.status}`);
+	return decodeURIComponent(tag).replace(/^v/, "");
+});
+const platformOf = (shell) => Effect.gen(function* () {
+	const [os, arch] = (yield* run$2(shell, "uname -sm")).stdout.trim().toLowerCase().split(/\s+/);
+	const mappedOs = os === "darwin" || os === "linux" ? os : void 0;
+	const mappedArch = arch === "x86_64" || arch === "amd64" ? "x86_64" : arch === "aarch64" || arch === "arm64" ? "aarch64" : void 0;
+	if (mappedOs === void 0 || mappedArch === void 0) return yield* installError(`Unsupported platform: ${os ?? "unknown"}/${arch ?? "unknown"}`);
+	return {
+		os: mappedOs,
+		arch: mappedArch
+	};
+});
+/** Unpacks with the sandbox's own `tar`, as Pi does on its host; the archive layout varies by release. */
+const unpack = [
+	"set -e",
+	"dir=$1; archive=$2; name=$3; tmp=\"$dir/.extract-$name-$$\"",
+	"trap 'rm -rf \"$tmp\" \"$archive\"' EXIT",
+	"mkdir -p \"$tmp\"",
+	"tar -xzf \"$archive\" -C \"$tmp\"",
+	"found=$(find \"$tmp\" -type f -name \"$name\" | head -n 1)",
+	"[ -n \"$found\" ] || { echo \"binary $name not found in archive\" >&2; exit 1; }",
+	"mv \"$found\" \"$dir/$name\"",
+	"chmod 755 \"$dir/$name\""
+].join("\n");
+const install$1 = (name, shell, fs, dir) => Effect.gen(function* () {
+	const spec = specs[name];
+	const { os, arch } = yield* platformOf(shell);
+	const version = name === "fd" && os === "darwin" && arch === "x86_64" ? "10.3.0" : yield* latestVersion(spec.repo);
+	const asset = spec.asset(version, os, arch);
+	const url = `https://github.com/${spec.repo}/releases/download/${spec.tagPrefix}${version}/${asset}`;
+	const bytes = new Uint8Array(yield* get$2(url, DOWNLOAD_TIMEOUT, (response) => response.status === 200 ? response.arrayBuffer : Effect.fail(installError(`Download failed with HTTP ${response.status}: ${url}`))));
+	const archive = posix.join(dir, `.${asset}`);
+	yield* fs.writeFile(archive, bytes).pipe(Effect.mapError((error) => installError(`Cannot write ${archive}: ${error.cause instanceof Error ? error.cause.message : error.message}`)));
+	const result = yield* run$2(shell, `sh -c ${(0, shell_exports.quote)(unpack)} _ ${(0, shell_exports.quoteArgv)([
+		dir,
+		archive,
+		name
+	])}`);
+	if (result.exitCode !== 0) return yield* installError(`Failed to unpack ${asset}: ${(result.stderr || result.stdout).trim()}`);
+	return posix.join(dir, name);
+});
+/** Where `kind` keeps installed binaries. */
+const binDir = (sandbox, shell) => Effect.gen(function* () {
+	if (sandbox.kind === "local") return yield* HostBin;
+	const home = (yield* run$2(shell, "printf %s \"$HOME\"")).stdout.trim();
+	return posix.join(home || "/tmp", ".codework", "bin");
+});
+const resolve$3 = (name, sandbox, shell, fs) => Effect.gen(function* () {
+	const dir = yield* binDir(sandbox, shell);
+	for (const command of [posix.join(dir, name), ...specs[name].commands]) if (yield* works(shell, command)) return {
+		_tag: "Available",
+		command
+	};
+	const installed = yield* install$1(name, shell, fs, dir).pipe(Effect.result);
+	if (installed._tag === "Success" && (yield* works(shell, installed.success))) return {
+		_tag: "Available",
+		command: installed.success
+	};
+	const reason = installed._tag === "Failure" ? `: ${installed.failure.message}` : "";
+	return {
+		_tag: "Unavailable",
+		message: `${specs[name].label} is not available in this sandbox and could not be installed${reason}`
+	};
+});
+const virtual = (name) => name === "rg" ? {
+	_tag: "Available",
+	command: "rg"
+} : {
+	_tag: "Unavailable",
+	message: `${specs[name].label} is not available in this sandbox`
+};
+/**
+* The shared probe for `name` in this sandbox, started when none is remembered.
+* It runs detached, so cancelling the call that started it cannot cancel it for
+* the others waiting on it; an unavailable result is not remembered, so the next
+* call tries again.
+*/
+const probe$1 = (name, sandbox, shell, fs) => Effect.gen(function* () {
+	const key = keyOf(sandbox, name);
+	const existing = available.get(key);
+	if (existing !== void 0) return existing;
+	const deferred = Deferred.makeUnsafe();
+	available.set(key, deferred);
+	yield* resolve$3(name, sandbox, shell, fs).pipe(Effect.onExit((exit) => Effect.sync(() => {
+		if ((exit._tag === "Failure" || exit.value._tag === "Unavailable") && available.get(key) === deferred) available.delete(key);
+	})), Effect.onExit((exit) => Deferred.done(deferred, exit)), Effect.forkDetach);
+	return deferred;
+});
+/**
+* Run `use` with the command for `name`. When the run reports the binary gone
+* (`exitCode` 127, e.g. a sandbox reset to a fresh image), the remembered probe is
+* dropped and the run is tried once more with a fresh one. Only the probe that
+* gave the stale command is dropped, so concurrent retries share one new probe.
+*/
+const withCommand = (name, sandbox, shell, fs, use) => Effect.gen(function* () {
+	if (sandbox.kind === "virtual") {
+		const resolved = virtual(name);
+		return resolved._tag === "Unavailable" ? resolved : yield* use(resolved.command);
+	}
+	for (let attempt = 0;; attempt++) {
+		const deferred = yield* probe$1(name, sandbox, shell, fs);
+		const resolved = yield* Deferred.await(deferred);
+		if (resolved._tag === "Unavailable") return resolved;
+		const result = yield* use(resolved.command);
+		if (result.exitCode !== 127 || attempt > 0) return result;
+		const key = keyOf(sandbox, name);
+		if (available.get(key) === deferred) available.delete(key);
+	}
+});
+//#endregion
+//#region src/plugin/builtin/tool/find.ts
+/**
+* The built-in find plugin: fd in the mounted sandbox. A virtual mount has no fd,
+* and the tool says so rather than emulating it.
+*/
+const FindParams = Schema.Struct({
+	pattern: Schema.String.annotate({ description: "Glob pattern to match files, e.g. '*.ts', '**/*.json', or 'src/**/*.spec.ts'" }),
+	path: Schema.optional(Schema.String.annotate({ description: "Directory to search in (default: current directory)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of results (default: 1000)" }))
+});
+const FindDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	resultLimitReached: Schema.optional(Schema.Finite)
+});
+const FindSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(FindDetails)
+});
+var FindFailed = class extends Schema.TaggedError()("FindFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT$2 = 1e3;
+const FD_ERROR = "[fd error]:";
+const findDef = tool_exports.define({
+	name: "find",
+	label: "find",
+	description: `Search for files by glob pattern. Returns matching file paths relative to the search directory. Respects .gitignore. Output is truncated to ${DEFAULT_LIMIT$2} results or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first).`,
+	promptSnippet: "Find files by glob pattern (respects .gitignore)",
+	parameters: FindParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: FindSuccess,
+	failure: FindFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
+});
+const fail$3 = (message) => Effect.fail(new FindFailed({ message }));
+/** Relative to the search root, keeping a directory's trailing slash. */
+const relativize = (result, searchPath) => {
+	const relative = posix.isAbsolute(result) ? posix.relative(searchPath, result) : result;
+	return result.endsWith("/") && !relative.endsWith("/") ? `${relative}/` : relative;
+};
+const insideGitRepo = (fs, searchPath) => Effect.gen(function* () {
+	for (let current = searchPath;; current = posix.dirname(current)) {
+		if (yield* fs.exists(posix.join(current, ".git")).pipe(Effect.orElseSucceed(() => false))) return true;
+		if (posix.dirname(current) === current) return false;
+	}
+});
+const findHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const shell = yield* io_exports.SandboxIO.Shell;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const searchPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const limit = Math.max(1, Math.trunc(params.limit ?? DEFAULT_LIMIT$2));
+	if (!(yield* fs.exists(searchPath).pipe(Effect.orElseSucceed(() => false)))) return yield* fail$3(`Path not found: ${searchPath}`);
+	const argv = [
+		"--glob",
+		"--color=never",
+		"--hidden",
+		...(yield* insideGitRepo(fs, searchPath)) ? [] : ["--no-require-git"]
+	];
+	argv.push("--max-results", String(limit));
+	let pattern = params.pattern;
+	if (pattern.includes("/")) {
+		argv.push("--full-path");
+		if (!pattern.startsWith("/") && !pattern.startsWith("**/") && pattern !== "**") pattern = `**/${pattern}`;
+	}
+	argv.push("--", pattern, searchPath);
+	const run = yield* withCommand("fd", sandbox, shell, fs, (command) => shell.exec((0, shell_exports.quoteArgv)([command, ...argv])));
+	if ("_tag" in run) return yield* fail$3(run.message);
+	const output = run.stdout.split("\n").map((line) => line.replace(/\r$/, "").trim()).filter((line) => line.length > 0);
+	const lines = output.filter((line) => !line.startsWith(FD_ERROR));
+	const errors = [run.stderr.trim(), ...output.filter((line) => line.startsWith(FD_ERROR))].filter((text) => text.length > 0).join("\n");
+	if (run.exitCode !== 0 && lines.length === 0) return yield* fail$3(errors || `fd exited with code ${run.exitCode}`);
+	if (lines.length === 0) return { text: "No files found matching pattern" };
+	const results = lines.map((line) => relativize(line, searchPath)).sort();
+	const resultLimitReached = results.length >= limit;
+	const truncation = truncateHead(results.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (resultLimitReached) {
+		notices.push(`${limit} results limit reached. Use limit=${limit * 2} for more, or refine pattern`);
+		details.resultLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+}).pipe(Effect.catchTag("ShellError", (error) => Effect.die(error)));
+/** The find tool: definition + handler, wired the testable (def/exec split) way. */
+const findTool = tool_exports.implement(findDef, findHandler);
+const findPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.find",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("FindPlugin.setup")(function* (ctx) {
+		const mounted = Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Shell, yield* io_exports.SandboxIO.Shell), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current), Layer.succeed(HostBin, ctx.paths.bin));
+		ctx.plugin.tools.add(tool_exports.provide(findTool, mounted));
+	})
+});
+//#endregion
+//#region src/plugin/builtin/tool/grep.ts
+/**
+* The built-in grep plugin: ripgrep in the mounted sandbox — the host's or the
+* remote's own binary, or just-bash's built-in `rg` on a virtual mount. Only the
+* first `limit` match events leave the sandbox; context lines are read through
+* `scanLines`, so only their window crosses.
+*/
+const GrepParams = Schema.Struct({
+	pattern: Schema.String.annotate({ description: "Search pattern (regex or literal string)" }),
+	path: Schema.optional(Schema.String.annotate({ description: "Directory or file to search (default: current directory)" })),
+	glob: Schema.optional(Schema.String.annotate({ description: "Filter files by glob pattern, e.g. '*.ts' or '**/*.spec.ts'" })),
+	ignoreCase: Schema.optional(Schema.Boolean.annotate({ description: "Case-insensitive search (default: false)" })),
+	literal: Schema.optional(Schema.Boolean.annotate({ description: "Treat pattern as literal string instead of regex (default: false)" })),
+	context: Schema.optional(Schema.Finite.annotate({ description: "Number of lines to show before and after each match (default: 0)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of matches to return (default: 100)" }))
+});
+const GrepDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	matchLimitReached: Schema.optional(Schema.Finite),
+	linesTruncated: Schema.optional(Schema.Boolean)
+});
+const GrepSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(GrepDetails)
+});
+var GrepFailed = class extends Schema.TaggedError()("GrepFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT$1 = 100;
+const grepDef = tool_exports.define({
+	name: "grep",
+	label: "grep",
+	description: `Search file contents for a pattern. Returns matching lines with file paths and line numbers. Respects .gitignore. Output is truncated to ${DEFAULT_LIMIT$1} matches or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). Long lines are truncated to 500 chars.`,
+	promptSnippet: "Search file contents for patterns (respects .gitignore)",
+	parameters: GrepParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: GrepSuccess,
+	failure: GrepFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
 	}],
 	encodeFailureContent: (failure) => [{
 		type: "text",
-		text: failure.output
-	}]
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
 });
-/** Combine stdout and stderr into one stream of text, stderr after stdout. */
-const combineOutput = (stdout, stderr) => {
-	if (stderr.length === 0) return stdout;
-	if (stdout.length === 0) return stderr;
-	return `${stdout}\n${stderr}`;
+const fail$2 = (message) => Effect.fail(new GrepFailed({ message }));
+/** One `--json` match event; anything else (begin/end/summary, a non-UTF-8 path) is skipped. */
+const parseMatch = (line) => {
+	try {
+		const event = JSON.parse(line);
+		const path = event.data?.path?.text;
+		const number = event.data?.line_number;
+		const text = event.data?.lines?.text;
+		if (event.type !== "match" || typeof path !== "string" || typeof number !== "number") return void 0;
+		return {
+			path,
+			line: number,
+			text: typeof text === "string" ? text : ""
+		};
+	} catch {
+		return;
+	}
 };
-/** One-line footer appended to truncated, model-facing output. */
-const footer = (t, fullOutputPath, lastLineBytes) => {
-	const where = fullOutputPath ? ` Full output: ${fullOutputPath}` : "";
-	const startLine = t.totalLines - t.outputLines + 1;
-	if (t.lastLinePartial) {
-		const lineSize = lastLineBytes !== void 0 ? ` (line is ${formatSize(lastLineBytes)})` : "";
-		return `\n\n[showing last ${formatSize(t.outputBytes)} of line ${t.totalLines}${lineSize}.${where}]`;
+/**
+* The search runs as one pipeline so a broad pattern never ships its whole result:
+* only match events pass, and `head` stops ripgrep at the limit. Some backends
+* merge stderr into stdout, so nothing relies on the two staying apart: ripgrep's
+* status rides the pipe as a last event, and its stderr waits in `errors` until the
+* pipeline is done, where it can no longer land inside a match.
+*/
+const pipeline = (argv, limit, errors) => [
+	`mkdir -p ${(0, shell_exports.quote)(posix.dirname(errors))} 2>/dev/null`,
+	`{ : > ${(0, shell_exports.quote)(errors)}; } 2>/dev/null || { echo ${(0, shell_exports.quote)(`cannot write ${errors}`)} >&2; exit 2; }`,
+	`{ ${(0, shell_exports.quoteArgv)(argv)} 2>${(0, shell_exports.quote)(errors)}; echo '{"type":"rc","code":'"$?"'}'; } | grep -E '^\\{"type":"(match|rc)"' | head -n ${limit}`,
+	`cat ${(0, shell_exports.quote)(errors)} >&2 2>/dev/null`,
+	`rm -f ${(0, shell_exports.quote)(errors)}`
+].join("; ");
+const STATUS = /^\{"type":"rc","code":(\d+)\}$/;
+/** The pipeline's output: match events, ripgrep's status, and anything else, which is its stderr. */
+const parse$2 = (stdout, stderr) => {
+	const matches = [];
+	const errors = [];
+	let status;
+	for (const line of stdout.split("\n")) {
+		const rc = STATUS.exec(line);
+		if (rc !== null) status ??= Number(rc[1]);
+		else if (line.startsWith("{\"type\":\"match\"")) {
+			const match = parseMatch(line);
+			if (match !== void 0) matches.push(match);
+		} else if (line.trim().length > 0) errors.push(line);
 	}
-	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
-	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
+	return {
+		matches,
+		status,
+		errors: [stderr.trim(), ...errors].filter((text) => text.length > 0).join("\n")
+	};
 };
-/** Write full output to a host temp file (best-effort; undefined on failure). */
-const spillToTempFile = (content) => Effect.gen(function* () {
-	const suffix = Encoding.encodeHex(yield* crypto.randomBytes(6));
-	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
-	yield* fileSystem.writeFileString(path, content);
-	return path;
-}).pipe(Effect.orElseSucceed(() => void 0));
-/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
-const presentBuffered = (combined) => Effect.gen(function* () {
-	const t = truncateTail(combined);
-	if (!t.truncated) return {
-		output: t.content,
+/** A line as shown: no line ending, cut to {@link GREP_MAX_LINE_LENGTH}. */
+const shown = (line) => truncateLine(line.replace(/\r\n/g, "\n").replace(/\r/g, "").replace(/\n$/, ""));
+/**
+* The match with its context lines. The window is read in one bounded scan; a
+* line it could not fit is read on its own, and a line too long even for that is
+* marked rather than shown blank. The match line itself is ripgrep's.
+*/
+const contextBlock = (fs, match, context, label) => Effect.gen(function* () {
+	const startLine = Math.max(0, match.line - 1 - context);
+	const scan = yield* fs.scanLines(match.path, {
+		startLine,
+		endLine: match.line + context,
+		maxBytes: DEFAULT_MAX_BYTES
+	}).pipe(Effect.option);
+	if (scan._tag === "None" || scan.value.totalLines === 0) return {
+		lines: [`${label}:${match.line}: (unable to read file)`],
 		truncated: false
 	};
-	const fullOutputPath = yield* spillToTempFile(combined);
+	const window = scan.value.lines === 0 ? [] : scan.value.text.split("\n");
+	const lineAt = (index) => index - startLine < window.length ? Effect.succeed(window[index - startLine]) : fs.scanLines(match.path, {
+		startLine: index,
+		endLine: index + 1,
+		maxBytes: DEFAULT_MAX_BYTES
+	}).pipe(Effect.map((one) => one.lines === 1 ? one.text : void 0), Effect.orElseSucceed(() => void 0));
+	const end = Math.min(scan.value.totalLines, match.line + context);
+	const block = [];
+	let truncated = false;
+	for (let current = startLine + 1; current <= end; current++) {
+		const line = current === match.line ? match.text : yield* lineAt(current - 1);
+		const { text, wasTruncated } = line === void 0 ? {
+			text: "... [truncated]",
+			wasTruncated: true
+		} : shown(line);
+		if (wasTruncated) truncated = true;
+		block.push(current === match.line ? `${label}:${current}: ${text}` : `${label}-${current}- ${text}`);
+	}
 	return {
-		output: t.content + footer(t, fullOutputPath),
-		truncated: true,
-		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
+		lines: block,
+		truncated
 	};
 });
-/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
-const presentSnapshot = (snap, lastLineBytes) => {
-	if (!snap.truncation.truncated) return {
-		output: snap.content,
-		truncated: false
+const grepHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const shell = yield* io_exports.SandboxIO.Shell;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const searchPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const stat = yield* fs.stat(searchPath).pipe(Effect.option);
+	if (stat._tag === "None") return yield* fail$2(`Path not found: ${searchPath}`);
+	const isDirectory = stat.value.isDirectory;
+	const context = params.context && params.context > 0 ? Math.trunc(params.context) : 0;
+	const limit = Math.max(1, Math.trunc(params.limit ?? DEFAULT_LIMIT$1));
+	const errors = yield* path$1(sandbox.spillPath, "codework-grep");
+	const run = yield* withCommand("rg", sandbox, shell, fs, (command) => Effect.gen(function* () {
+		const argv = [
+			command,
+			"--json",
+			"--line-number",
+			"--hidden",
+			"--sort",
+			"path"
+		];
+		argv.push(params.ignoreCase ? "--ignore-case" : "-s");
+		if (params.literal) argv.push("--fixed-strings");
+		if (params.glob) argv.push("--glob", params.glob);
+		argv.push("-e", params.pattern, searchPath);
+		const result = yield* shell.exec(pipeline(argv, limit, errors));
+		const parsed = parse$2(result.stdout, result.stderr);
+		return {
+			...parsed,
+			exitCode: parsed.status ?? result.exitCode
+		};
+	}));
+	if ("_tag" in run) return yield* fail$2(run.message);
+	const { matches } = run;
+	const matchLimitReached = matches.length >= limit;
+	if (!matchLimitReached && run.exitCode !== 0 && run.exitCode !== 1) return yield* fail$2(run.errors || `ripgrep exited with code ${run.exitCode}`);
+	if (matches.length === 0) return { text: "No matches found" };
+	const label = (path) => {
+		if (isDirectory) {
+			const relative = posix.relative(searchPath, path);
+			if (relative && !relative.startsWith("..")) return relative;
+		}
+		return posix.basename(path);
+	};
+	const output = [];
+	let linesTruncated = false;
+	for (const match of matches) if (context === 0) {
+		const { text, wasTruncated } = shown(match.text);
+		if (wasTruncated) linesTruncated = true;
+		output.push(`${label(match.path)}:${match.line}: ${text}`);
+	} else {
+		const block = yield* contextBlock(fs, match, context, label(match.path));
+		if (block.truncated) linesTruncated = true;
+		output.push(...block.lines);
+	}
+	const truncation = truncateHead(output.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (matchLimitReached) {
+		notices.push(`${limit} matches limit reached. Use limit=${limit * 2} for more, or refine pattern`);
+		details.matchLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	if (linesTruncated) {
+		notices.push(`Some lines truncated to 500 chars. Use read tool to see full lines`);
+		details.linesTruncated = true;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+}).pipe(Effect.catchTag("ShellError", (error) => Effect.die(error)));
+/** The grep tool: definition + handler, wired the testable (def/exec split) way. */
+const grepTool = tool_exports.implement(grepDef, grepHandler);
+const grepPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.grep",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("GrepPlugin.setup")(function* (ctx) {
+		const mounted = Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Shell, yield* io_exports.SandboxIO.Shell), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current), Layer.succeed(HostBin, ctx.paths.bin));
+		ctx.plugin.tools.add(tool_exports.provide(grepTool, mounted));
+	})
+});
+//#endregion
+//#region src/plugin/builtin/tool/ls.ts
+/** The built-in ls plugin: one directory through the sandbox filesystem, no binaries involved. */
+const LsParams = Schema.Struct({
+	path: Schema.optional(Schema.String.annotate({ description: "Directory to list (default: current directory)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of entries to return (default: 500)" }))
+});
+const LsDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	entryLimitReached: Schema.optional(Schema.Finite)
+});
+const LsSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(LsDetails)
+});
+var LsFailed = class extends Schema.TaggedError()("LsFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT = 500;
+const lsDef = tool_exports.define({
+	name: "ls",
+	label: "ls",
+	description: `List directory contents. Returns entries sorted alphabetically, with '/' suffix for directories. Includes dotfiles. Output is truncated to ${DEFAULT_LIMIT} entries or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first).`,
+	promptSnippet: "List directory contents",
+	parameters: LsParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: LsSuccess,
+	failure: LsFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
+});
+const fail$1 = (message) => Effect.fail(new LsFailed({ message }));
+const lsHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const dirPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const limit = params.limit ?? DEFAULT_LIMIT;
+	const stat = yield* fs.stat(dirPath).pipe(Effect.option);
+	if (stat._tag === "None") return yield* fail$1(`Path not found: ${dirPath}`);
+	if (!stat.value.isDirectory) return yield* fail$1(`Not a directory: ${dirPath}`);
+	const read = yield* fs.readdir(dirPath).pipe(Effect.result);
+	if (read._tag === "Failure") {
+		const cause = read.failure.cause;
+		return yield* fail$1(`Cannot read directory: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	const entries = [...read.success].sort((a, b) => a.toLowerCase().localeCompare(b.toLowerCase()));
+	const results = [];
+	let entryLimitReached = false;
+	for (const entry of entries) {
+		if (results.length >= limit) {
+			entryLimitReached = true;
+			break;
+		}
+		const entryStat = yield* fs.stat(posix.join(dirPath, entry)).pipe(Effect.option);
+		if (entryStat._tag === "None") continue;
+		results.push(entryStat.value.isDirectory ? `${entry}/` : entry);
+	}
+	if (results.length === 0) return { text: "(empty directory)" };
+	const truncation = truncateHead(results.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (entryLimitReached) {
+		notices.push(`${limit} entries limit reached. Use limit=${limit * 2} for more`);
+		details.entryLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+});
+/** The ls tool: definition + handler, wired the testable (def/exec split) way. */
+const lsTool = tool_exports.implement(lsDef, lsHandler);
+const lsPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.ls",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("LsPlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current));
+		ctx.plugin.tools.add(tool_exports.provide(lsTool, mounted));
+	})
+});
+//#endregion
+//#region src/tool/image/mime.ts
+/**
+* Image formats a model takes inline, told apart by their bytes, never by the
+* file name: a text file that starts with `GIF` is still text.
+*/
+const PNG_SIGNATURE = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+/** Bytes every check except the APNG chunk walk needs: BMP reads up to offset 29. */
+const HEADER_BYTES = 32;
+const BLOCK_BYTES = 65536;
+/**
+* The image MIME type of a whole file, reading only its header and, for PNG, the
+* chunk headers up to the first `acTL` or `IDAT`. Animated PNGs are not images
+* here: a model would see only their first frame.
+*/
+const detectOf = (source) => Effect.gen(function* () {
+	const header = yield* source.read(0, HEADER_BYTES);
+	if (!startsWith(header, PNG_SIGNATURE)) return detect(header);
+	return isPng(header) && !(yield* isAnimatedPngOf(source)) ? "image/png" : void 0;
+});
+const isAnimatedPngOf = (source) => Effect.gen(function* () {
+	let block = /* @__PURE__ */ new Uint8Array(0);
+	let blockStart = 0;
+	let offset = PNG_SIGNATURE.length;
+	while (offset + 8 <= source.size) {
+		if (offset < blockStart || offset + 8 > blockStart + block.length) {
+			blockStart = offset;
+			block = yield* source.read(offset, BLOCK_BYTES);
+		}
+		const chunkHeader = block.subarray(offset - blockStart, offset - blockStart + 8);
+		if (chunkHeader.length < 8) return false;
+		if (startsWithAscii(chunkHeader, 4, "acTL")) return true;
+		if (startsWithAscii(chunkHeader, 4, "IDAT")) return false;
+		const nextOffset = offset + 8 + readUint32BE(chunkHeader, 0) + 4;
+		if (nextOffset <= offset || nextOffset > source.size) return false;
+		offset = nextOffset;
+	}
+	return false;
+});
+/** The image MIME type of a header; a PNG still needs {@link isAnimatedPngOf}. */
+const detect = (buffer) => {
+	if (startsWith(buffer, [
+		255,
+		216,
+		255
+	])) return buffer[3] === 247 ? void 0 : "image/jpeg";
+	if (startsWith(buffer, PNG_SIGNATURE)) return isPng(buffer) ? "image/png" : void 0;
+	if (startsWithAscii(buffer, 0, "GIF87a") || startsWithAscii(buffer, 0, "GIF89a")) return "image/gif";
+	if (startsWithAscii(buffer, 0, "RIFF") && startsWithAscii(buffer, 8, "WEBP")) return "image/webp";
+	if (startsWithAscii(buffer, 0, "BM") && isBmp(buffer)) return "image/bmp";
+};
+const isPng = (buffer) => buffer.length >= 16 && readUint32BE(buffer, PNG_SIGNATURE.length) === 13 && startsWithAscii(buffer, 12, "IHDR");
+const isBmp = (buffer) => {
+	if (buffer.length < 26) return false;
+	const declaredFileSize = readUint32LE(buffer, 2);
+	const pixelDataOffset = readUint32LE(buffer, 10);
+	const dibHeaderSize = readUint32LE(buffer, 14);
+	if (declaredFileSize !== 0 && declaredFileSize < 26) return false;
+	if (pixelDataOffset < 14 + dibHeaderSize) return false;
+	if (declaredFileSize !== 0 && pixelDataOffset >= declaredFileSize) return false;
+	let colorPlanes;
+	let bitsPerPixel;
+	if (dibHeaderSize === 12) {
+		colorPlanes = readUint16LE(buffer, 22);
+		bitsPerPixel = readUint16LE(buffer, 24);
+	} else if (dibHeaderSize >= 40 && dibHeaderSize <= 124) {
+		if (buffer.length < 30) return false;
+		colorPlanes = readUint16LE(buffer, 26);
+		bitsPerPixel = readUint16LE(buffer, 28);
+	} else return false;
+	return colorPlanes === 1 && [
+		1,
+		4,
+		8,
+		16,
+		24,
+		32
+	].includes(bitsPerPixel);
+};
+const readUint16LE = (buffer, offset) => (buffer[offset] ?? 0) + ((buffer[offset + 1] ?? 0) << 8);
+const readUint32BE = (buffer, offset) => (buffer[offset] ?? 0) * 16777216 + ((buffer[offset + 1] ?? 0) << 16) + ((buffer[offset + 2] ?? 0) << 8) + (buffer[offset + 3] ?? 0);
+const readUint32LE = (buffer, offset) => (buffer[offset] ?? 0) + ((buffer[offset + 1] ?? 0) << 8) + ((buffer[offset + 2] ?? 0) << 16) + (buffer[offset + 3] ?? 0) * 16777216;
+const startsWith = (buffer, bytes) => buffer.length >= bytes.length && bytes.every((byte, index) => buffer[index] === byte);
+const startsWithAscii = (buffer, offset, text) => {
+	if (buffer.length < offset + text.length) return false;
+	for (let index = 0; index < text.length; index++) if (buffer[offset + index] !== text.charCodeAt(index)) return false;
+	return true;
+};
+//#endregion
+//#region src/tool/image/index.ts
+const INLINE = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp"
+]);
+const toPng = (bytes) => load$4.pipe(Effect.map((photon) => {
+	if (photon === void 0) return void 0;
+	try {
+		const image = decode(photon, bytes);
+		try {
+			return new Uint8Array(image.get_bytes());
+		} finally {
+			image.free();
+		}
+	} catch {
+		return;
+	}
+}));
+/**
+* Turn an image file into what a model takes inline: a supported format, within
+* the provider's dimension and size limits. A failure is a note for the model,
+* never an error — the read itself succeeded.
+*/
+const inline = Effect.fn("Image.inline")(function* (bytes, mimeType) {
+	let source = {
+		bytes,
+		mimeType,
+		convertedFrom: void 0
+	};
+	if (!INLINE.has(mimeType)) {
+		const png = yield* toPng(bytes);
+		if (png === void 0) return {
+			ok: false,
+			message: "[Image omitted: could not be converted to a supported inline image format.]"
+		};
+		source = {
+			bytes: png,
+			mimeType: "image/png",
+			convertedFrom: mimeType
+		};
+	}
+	const resized = yield* resize(source.bytes, source.mimeType);
+	if (resized === null) return {
+		ok: false,
+		message: "[Image omitted: could not be resized below the inline image size limit.]"
 	};
+	const hints = [];
+	if (source.convertedFrom !== void 0 && source.convertedFrom !== resized.mimeType) hints.push(`[Image converted from ${source.convertedFrom} to ${resized.mimeType}.]`);
+	const note = dimensionNote(resized);
+	if (note !== void 0) hints.push(note);
 	return {
-		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
-		truncated: true,
-		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
+		ok: true,
+		data: resized.data,
+		mimeType: resized.mimeType,
+		hints
+	};
+});
+//#endregion
+//#region src/plugin/builtin/tool/read.ts
+/**
+* The built-in read plugin. Text is read through `scanLines`, so only the shown
+* window crosses from the sandbox; images, told apart by their bytes, go to the
+* model as attachments. Continuation notices are part of the text the model
+* reads; `details` keeps only how the text was cut.
+*/
+const ReadParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to read (relative or absolute)" }),
+	offset: Schema.optional(Schema.Finite.annotate({ description: "Line number to start reading from (1-indexed)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of lines to read" }))
+});
+/** How the shown text was cut. */
+const Truncation = Schema.Struct({
+	truncated: Schema.Boolean,
+	truncatedBy: Schema.NullOr(Schema.Literals(["lines", "bytes"])),
+	/** Lines selected by `offset`/`limit`, before the limits. */
+	totalLines: Schema.Finite,
+	outputLines: Schema.Finite,
+	outputBytes: Schema.Finite,
+	firstLineExceedsLimit: Schema.Boolean,
+	maxLines: Schema.Finite,
+	maxBytes: Schema.Finite
+});
+const ReadText = Schema.Struct({
+	type: Schema.Literal("text"),
+	text: Schema.String,
+	truncation: Schema.optional(Truncation)
+});
+const ReadImage = Schema.Struct({
+	type: Schema.Literal("image"),
+	/** What the model reads with the image: its type and any conversion/resize hints. */
+	note: Schema.String,
+	image: Schema.optional(Schema.Struct({
+		data: Schema.String,
+		mimeType: Schema.String
+	}))
+});
+const ReadSuccess = Schema.Union([ReadText, ReadImage]);
+var ReadFailed = class extends Schema.TaggedError()("ReadFailed", { message: Schema.String }) {};
+const BINARY_PROBE_BYTES = 8e3;
+const readDef = tool_exports.define({
+	name: "read",
+	label: "read",
+	description: `Read the contents of a file. Supports text files and images (jpg, png, gif, webp, bmp). Images are sent as attachments. For text files, output is truncated to ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). Use offset/limit for large files. When you need the full file, continue with offset until complete.`,
+	promptSnippet: "Read file contents",
+	promptGuidelines: ["Use read to examine files instead of cat or sed."],
+	parameters: ReadParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: ReadSuccess,
+	failure: ReadFailed,
+	encodeContent: (success) => success.type === "text" ? [{
+		type: "text",
+		text: success.text
+	}] : [{
+		type: "text",
+		text: success.note
+	}, ...success.image === void 0 ? [] : [{
+		type: "image",
+		...success.image
+	}]],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.type === "text" && success.truncation !== void 0 ? { truncation: success.truncation } : void 0
+});
+const fail = (message) => Effect.fail(new ReadFailed({ message }));
+/**
+* Filesystem failures are the model's to see, as Pi shows them: a missing path in
+* one wording on every backend, anything else (EACCES, …) as the backend reported it.
+*/
+const fsFailure$1 = (path) => (error) => fail(filesystem_exports.SandboxFileSystem.isNotFoundError(error.cause) ? `ENOENT: no such file or directory, open '${path}'` : error.cause instanceof Error ? error.cause.message : `Could not read file: ${path}`);
+const readImage = (fs, resolved, mimeType) => Effect.gen(function* () {
+	const bytes = yield* fs.readFileBuffer(resolved);
+	const inline$1 = yield* inline(bytes, mimeType);
+	if (!inline$1.ok) return {
+		type: "image",
+		note: `Read image file [${mimeType}]\n${inline$1.message}`
 	};
-};
-/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
-const runBuffered = (shell, params) => Effect.gen(function* () {
-	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
-		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
-			timeoutSeconds: timeout.timeoutMillis / 1e3,
-			output: "",
-			truncated: false
-		})),
-		ToolShellError: (cause) => Effect.die(cause)
-	}));
-	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
-	if (result.exitCode !== 0) return yield* new BashFailed({
-		exitCode: result.exitCode,
-		...present
-	});
 	return {
-		exitCode: result.exitCode,
-		...present
+		type: "image",
+		note: [`Read image file [${inline$1.mimeType}]`, ...inline$1.hints].join("\n"),
+		image: {
+			data: inline$1.data,
+			mimeType: inline$1.mimeType
+		}
 	};
 });
-/** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
-const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
-	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
-	const progress = yield* progress_exports.ToolProgress;
-	const exitCode = yield* Ref.make(null);
-	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
-		yield* acc.append(Buffer.from(event.bytes));
-		yield* progress.report({ content: [{
+const readText = (fs, resolved, params) => Effect.gen(function* () {
+	const { path, offset } = params;
+	const startLine = offset ? Math.max(0, Math.trunc(offset) - 1) : 0;
+	const limit = params.limit === void 0 ? void 0 : Math.max(1, Math.trunc(params.limit));
+	const endLine = startLine + Math.min(limit ?? 2e3, DEFAULT_MAX_LINES);
+	const scan = yield* fs.scanLines(resolved, Number.isSafeInteger(endLine) ? {
+		startLine,
+		endLine,
+		maxBytes: DEFAULT_MAX_BYTES
+	} : {
+		startLine: 0,
+		endLine: 1,
+		maxBytes: DEFAULT_MAX_BYTES
+	});
+	if (startLine >= Math.max(scan.totalLines, 1)) return yield* fail(`Offset ${offset} is beyond end of file (${scan.totalLines} lines total)`);
+	const grown = Buffer.byteLength(scan.text, "utf8") > 51200 ? truncateHead(scan.text) : void 0;
+	const firstLineBytes = grown?.firstLineExceedsLimit ? Buffer.byteLength(scan.text.split("\n", 1)[0] ?? "", "utf8") : scan.firstLineBytes;
+	const shown = grown === void 0 ? scan : {
+		text: grown.content,
+		lines: grown.outputLines
+	};
+	const first = startLine + 1;
+	const selected = Math.min(scan.totalLines, limit === void 0 ? Infinity : startLine + limit) - startLine;
+	const truncation = (truncatedBy, firstLineExceedsLimit) => ({
+		truncated: true,
+		truncatedBy,
+		totalLines: selected,
+		outputLines: shown.lines,
+		outputBytes: Buffer.byteLength(shown.text, "utf8"),
+		firstLineExceedsLimit,
+		maxLines: DEFAULT_MAX_LINES,
+		maxBytes: DEFAULT_MAX_BYTES
+	});
+	if (firstLineBytes > 51200) return {
+		type: "text",
+		text: `[Line ${first} is ${formatSize(firstLineBytes)}, exceeds ${formatSize(DEFAULT_MAX_BYTES)} limit. Use bash: sed -n '${first}p' ${path} | head -c ${DEFAULT_MAX_BYTES}]`,
+		truncation: {
+			...truncation("bytes", true),
+			outputLines: 0,
+			outputBytes: 0
+		}
+	};
+	if (shown.lines < selected) {
+		const last = startLine + shown.lines;
+		const truncatedBy = shown.lines < Math.min(selected, 2e3) ? "bytes" : "lines";
+		const limitText = truncatedBy === "bytes" ? ` (${formatSize(DEFAULT_MAX_BYTES)} limit)` : "";
+		return {
 			type: "text",
-			text: acc.snapshot().content
-		}] });
-	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
-	let timedOutAfter;
-	if (params.timeout !== void 0) {
-		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
-		if (Option.isNone(finished)) timedOutAfter = params.timeout;
-	} else yield* consume;
-	yield* acc.finish();
-	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
-	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
-		timeoutSeconds: timedOutAfter,
-		...present
-	});
-	const code = yield* Ref.get(exitCode);
-	if (code === null || code !== 0) return yield* new BashFailed({
-		exitCode: code ?? -1,
-		...present
-	});
+			text: `${shown.text}\n\n[Showing lines ${first}-${last} of ${scan.totalLines}${limitText}. Use offset=${last + 1} to continue.]`,
+			truncation: truncation(truncatedBy, false)
+		};
+	}
+	if (limit !== void 0 && startLine + limit < scan.totalLines) {
+		const remaining = scan.totalLines - (startLine + limit);
+		return {
+			type: "text",
+			text: `${shown.text}\n\n[${remaining} more lines in file. Use offset=${startLine + limit + 1} to continue.]`
+		};
+	}
 	return {
-		exitCode: code,
-		...present
+		type: "text",
+		text: shown.text
 	};
-}));
-const bashHandler = (params) => Effect.gen(function* () {
-	const shell = yield* ToolShell;
-	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
 });
-/** The bash tool: definition + handler, wired the testable (def/exec split) way. */
-const bashTool = tool_exports.implement(bashDef, bashHandler);
-const bashPlugin = (0, plugin_exports$1.define)({
-	id: "codework.tool.bash",
+const readHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const resolved = yield* resolveRead(fs, params.path);
+	const stat = yield* fs.stat(resolved);
+	if (stat.isDirectory) return yield* fail("EISDIR: illegal operation on a directory, read");
+	if (!stat.isFile) return yield* fail("Not a regular file");
+	const head = yield* fs.readBytes(resolved, 0, BINARY_PROBE_BYTES);
+	const mimeType = yield* detectOf({
+		size: stat.size ?? Infinity,
+		read: (offset, length) => offset + length <= head.length ? Effect.succeed(head.subarray(offset, offset + length)) : fs.readBytes(resolved, offset, length)
+	});
+	if (mimeType !== void 0) return yield* readImage(fs, resolved, mimeType);
+	if (head.includes(0)) return yield* fail(`Unsupported read ${params.path}: binary file.`);
+	return yield* readText(fs, resolved, params);
+}).pipe(Effect.catchTag("SandboxFileSystemError", fsFailure$1(params.path)));
+/** The read tool: definition + handler, wired the testable (def/exec split) way. */
+const readTool = tool_exports.implement(readDef, readHandler);
+const readPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.read",
 	kind: "tool",
-	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
-		const shell = yield* io_exports.SandboxIO.Shell;
-		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
-		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
+	setup: Effect.fn("ReadPlugin.setup")(function* (ctx) {
+		const fs = yield* io_exports.SandboxIO.FileSystem;
+		ctx.plugin.tools.add(tool_exports.provide(readTool, Layer.succeed(io_exports.SandboxIO.FileSystem, fs)));
 	})
 });
 //#endregion
-//#region src/plugin/builtin.ts
+//#region src/plugin/builtin/tool/write.ts
 /**
-* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
-* contributors come first so the Prompt plugin that indexes them runs after they registered.
+* The built-in write plugin. The whole write holds the file's mutation lock, so
+* it never interleaves with an `edit` of the same file; the filesystem creates
+* missing parent directories on every backend.
 */
-const builtins = Object.freeze([bashPlugin, defaultPromptPlugin]);
+const WriteParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to write (relative or absolute)" }),
+	content: Schema.String.annotate({ description: "Content to write to the file" })
+});
+var WriteFailed = class extends Schema.TaggedError()("WriteFailed", { message: Schema.String }) {};
+const writeDef = tool_exports.define({
+	name: "write",
+	label: "write",
+	description: "Write content to a file. Creates the file if it doesn't exist, overwrites if it does. Automatically creates parent directories.",
+	promptSnippet: "Create or overwrite files",
+	promptGuidelines: ["Use write only for new files or complete rewrites."],
+	parameters: WriteParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: Schema.Struct({ path: Schema.String }),
+	failure: WriteFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: `Successfully wrote to ${success.path}`
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: () => void 0
+});
+/** Filesystem failures are the model's to see, as the backend reported them. */
+const fsFailure = (path) => (error) => Effect.fail(new WriteFailed({ message: error.cause instanceof Error ? error.cause.message : `Could not write file: ${path}` }));
+const writeHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const mutation = yield* io_exports.SandboxIO.Mutation;
+	const path = normalize$1(params.path);
+	yield* mutation.withFile(path, fs.writeFile(path, params.content));
+	return { path: params.path };
+}).pipe(Effect.catchTag("SandboxFileSystemError", fsFailure(params.path)));
+/** The write tool: definition + handler, wired the testable (def/exec split) way. */
+const writeTool = tool_exports.implement(writeDef, writeHandler);
+const writePlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.write",
+	kind: "tool",
+	setup: Effect.fn("WritePlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Mutation, yield* io_exports.SandboxIO.Mutation));
+		ctx.plugin.tools.add(tool_exports.provide(writeTool, mounted));
+	})
+});
 //#endregion
-//#region src/settings/merge.ts
+//#region src/plugin/builtin.ts
 /**
-* A plain string-keyed record: what a settings patch merges, and what a plugin's `options` block
-* has to be. A Map, a typed array or a class instance is an object to `typeof` and not one of
-* these — `Object.freeze` alone does not tell them apart, and it throws on some of them.
+* Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
+* contributors come first; within the prompt domain, declaration order is run order. The search
+* tools (grep, find, ls) are `optIn`, as Pi ships them off: settings turn each on with
+* `{ "plugin": "codework.tool.grep", "enabled": true }`.
 */
-const isRecord$1 = (value) => Predicate.isObject(value) && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-const copy = (value) => {
-	if (Array.isArray(value)) return value.map(copy);
-	return isRecord$1(value) ? merge({}, value) : value;
-};
-/** Null/undefined properties are absent, objects merge, and arrays replace. Never mutates inputs. */
-function merge(base, ...patches) {
-	const result = /* @__PURE__ */ new Map();
-	for (const patch of [base, ...patches]) {
-		if (patch === void 0) continue;
-		for (const [key, value] of Object.entries(patch)) {
-			if (value === null || value === void 0) continue;
-			const previous = result.get(key);
-			result.set(key, isRecord$1(previous) && isRecord$1(value) ? merge(previous, value) : copy(value));
-		}
-	}
-	return Object.fromEntries(result);
-}
-/** Normalize nullable properties before schema validation, without changing array positions. */
-const normalize = copy;
+const builtins = Object.freeze([
+	bashPlugin,
+	readPlugin,
+	writePlugin,
+	editPlugin,
+	grepPlugin,
+	findPlugin,
+	lsPlugin,
+	defaultPromptPlugin,
+	instructionPlugin
+]);
 //#endregion
 //#region src/util/module.ts
 /*!
@@ -6169,7 +8358,7 @@ const isPath = (reference) => reference.startsWith("file:") || reference.startsW
 * - a **CLI argument** anchors to the process's startup directory, because that is where the
 *   person typed it.
 */
-const parse$2 = (reference, from) => Effect.gen(function* () {
+const parse$1 = (reference, from) => Effect.gen(function* () {
 	const fail = (reason, message) => new SourceError({
 		reason,
 		reference,
@@ -6386,7 +8575,7 @@ const slugOf = (target) => target.kind === "git" ? target.slug : canonical$1(tar
 */
 const digest = Effect.fn("PluginStore.digest")(function* (target, cache, from) {
 	const source = target.kind === "registry" ? `${yield* registry(target, cache, from)}\0${target.spec}` : target.spec;
-	return Encoding.encodeHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
+	return Hex.encode(yield* crypto.digest("SHA-256", new TextEncoder().encode(source)));
 });
 const entryDir = Effect.fn("PluginStore.entryDir")(function* (target, cache, from) {
 	const key = yield* digest(target, cache, from);
@@ -6691,6 +8880,7 @@ const Definition = Schema.Struct({
 	id: Id,
 	kind: Schema.Literals(Object.keys(plugin_exports$1.domains)),
 	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
+	optIn: Schema.optional(Schema.Boolean),
 	setup: Schema.declare((value) => Predicate.isFunction(value))
 });
 /** Every plugin failure says which file to go and edit, when there is one. */
@@ -6790,7 +8980,7 @@ const localUrl = Effect.fn("PluginLoader.localUrl")(function* (location, origin)
 */
 const install = Effect.fn("PluginLoader.install")(function* (target, cache, origin, options) {
 	const added = yield* add(target, cache, {
-		from: anchor$1(origin.file, options.hostDir),
+		from: anchor(origin.file, options.hostDir),
 		validate: (fetched) => imported(url(fetched.entrypoint), origin, options.import)
 	});
 	return {
@@ -6806,13 +8996,13 @@ const install = Effect.fn("PluginLoader.install")(function* (target, cache, orig
 * package boundary discovered upward from the chain's start -- the root itself -- so anchoring at
 * the file's own directory would miss it. Absent a declaring file the host context stands in.
 */
-const anchor$1 = (file, fallback) => {
+const anchor = (file, fallback) => {
 	if (file === void 0) return fallback;
 	const directory = hostPath.dirname(file);
 	return hostPath.basename(directory) === ".codework" ? hostPath.dirname(directory) : directory;
 };
 /** The default installer, or the one the caller injected. */
-const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor$1(origin.file, options.hostDir));
+const installer = (target, origin, options) => options.install === void 0 ? install(target, options.cache, origin, options) : options.install(target, options.cache, anchor(origin.file, options.hostDir));
 /** Import a module and confirm it default-exports a plugin. */
 const imported = Effect.fn("PluginLoader.imported")(function* (url, origin, load) {
 	const module = yield* Effect.tryPromise({
@@ -6844,15 +9034,15 @@ const inspect = Effect.fn("PluginLoader.inspect")(function* (reference, options)
 		reference,
 		file: options.file
 	};
-	const target = yield* parse$2(reference, options.hostDir);
-	const loaded = yield* load$3(target, origin, options);
+	const target = yield* parse$1(reference, options.hostDir);
+	const loaded = yield* load$2(target, origin, options);
 	return {
 		id: loaded.plugin.id,
 		...loaded.version === void 0 ? {} : { version: loaded.version },
 		...loaded.name === void 0 ? {} : { name: loaded.name }
 	};
 });
-const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
+const load$2 = Effect.fn("PluginLoader.load")(function* (target, origin, options) {
 	const installed = yield* target.kind === "local" ? localUrl(target.path, origin).pipe(Effect.mapError((cause) => sourceFailure(origin, cause))) : installer(target, origin, options).pipe(Effect.mapError((cause) => origin.file === void 0 ? cause : declaredIn(cause, origin.file)));
 	const address = target.kind === "local" && options.reload !== void 0 && options.reload > 0 ? `${installed.url}?reload=${options.reload}` : installed.url;
 	return {
@@ -6870,7 +9060,7 @@ const load$3 = Effect.fn("PluginLoader.load")(function* (target, origin, options
 * are one package, and `./plugins/x.ts` is the file it resolves to from the directory that
 * declared it. Pure -- nothing is installed, imported or read.
 */
-const canonical = (reference, hostDir) => Effect.map(parse$2(reference, hostDir), canonical$1);
+const canonical = (reference, hostDir) => Effect.map(parse$1(reference, hostDir), canonical$1);
 //#endregion
 //#region src/plugin/catalog.ts
 /**
@@ -6897,7 +9087,7 @@ const isPatch = (reference) => Predicate.isObject(reference) && !Predicate.isFun
 *
 * Loading is keyed by what a reference resolves to, so naming one module twice imports it once.
 */
-const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
+const load$1 = Effect.fn("PluginCatalog.load")(function* (references, options) {
 	const plugins = /* @__PURE__ */ new Map();
 	const aliases = /* @__PURE__ */ new Map();
 	const versions = /* @__PURE__ */ new Map();
@@ -6932,14 +9122,14 @@ const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
 			remember(plugin, []);
 			continue;
 		}
-		const target = yield* parse$2(reference, options.hostDir);
+		const target = yield* parse$1(reference, options.hostDir);
 		const key = target.kind === "local" ? target.path : target.spec;
 		const already = seen.get(key);
 		if (already !== void 0) {
 			aliases.set(reference, already);
 			continue;
 		}
-		const definition = yield* load$3(target, origin, options);
+		const definition = yield* load$2(target, origin, options);
 		yield* note(definition.plugin, definition.version === void 0 ? key : `${key}@${definition.version}`);
 		const names = target.kind === "local" ? [target.path, ...definition.name === void 0 ? [] : [definition.name]] : [canonical$1(target), target.spec];
 		remember(definition.plugin, [reference, ...names], {
@@ -6976,11 +9166,14 @@ const load$2 = Effect.fn("PluginCatalog.load")(function* (references, options) {
 const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
 	const operations = /* @__PURE__ */ new Map();
 	const missing = [];
-	const choose = (id, index) => operations.set(id, {
-		enabled: true,
-		index,
-		options: operations.get(id)?.options ?? {}
-	});
+	const choose = (id, index) => {
+		const previous = operations.get(id);
+		operations.set(id, {
+			enabled: pool.plugins.get(id)?.optIn === true ? previous?.enabled ?? false : true,
+			index,
+			options: previous?.options ?? {}
+		});
+	};
 	for (const [index, reference] of references.entries()) {
 		if (isPatch(reference)) {
 			const named = reference.plugin ?? reference.package;
@@ -7061,12 +9254,12 @@ const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, op
 	for (const reference of references) {
 		if (typeof reference !== "string") continue;
 		const owner = options.declared?.get(reference);
-		const from = anchor$1(owner, options.hostDir);
+		const from = anchor(owner, options.hostDir);
 		const id = pool.aliases.get(reference);
 		if (id !== void 0) {
 			const origin = pool.origins.get(id);
 			if (owner === void 0 || origin?.reference !== reference) continue;
-			if (anchor$1(origin.file, options.hostDir) === from) continue;
+			if (anchor(origin.file, options.hostDir) === from) continue;
 		}
 		if (Option.isSome(yield* filed(reference, from))) {
 			moved = true;
@@ -7075,7 +9268,7 @@ const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, op
 	}
 	if (!moved) for (const origin of pool.origins.values()) {
 		if (origin.generation === void 0) continue;
-		const current = yield* filed(origin.reference, anchor$1(origin.file, options.hostDir));
+		const current = yield* filed(origin.reference, anchor(origin.file, options.hostDir));
 		if (Option.isSome(current) && current.value.generation !== void 0 && current.value.generation > origin.generation) {
 			moved = true;
 			break;
@@ -7084,7 +9277,7 @@ const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, op
 	if (!moved) return Option.none();
 	const retained = [];
 	for (const origin of pool.origins.values()) {
-		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, options.hostDir)))) {
+		if (references.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor(origin.file, options.hostDir)))) {
 			retained.push(origin);
 			continue;
 		}
@@ -7094,13 +9287,13 @@ const follow = Effect.fn("PluginCatalog.follow")(function* (references, pool, op
 	const known = /* @__PURE__ */ new Map();
 	for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
 	for (const [reference, file] of options.declared ?? /* @__PURE__ */ new Map()) known.set(reference, file);
-	return Option.some(yield* load$2(accumulated, {
+	return Option.some(yield* load$1(accumulated, {
 		...options,
 		declared: known
 	}));
 });
 Effect.fn("PluginCatalog.prepare")(function* (references, options) {
-	const pool = yield* load$2(references, options);
+	const pool = yield* load$1(references, options);
 	return (yield* select(references, pool)).selection;
 });
 //#endregion
@@ -7178,7 +9371,7 @@ const make$7 = (options) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/runner/execute.ts
-const layer$7 = Layer.effect(Service$6, Effect.gen(function* () {
+const layer$6 = Layer.effect(Service$6, Effect.gen(function* () {
 	const store = yield* Service$14;
 	const sandbox = yield* Controller;
 	const sql = yield* SqlClient.SqlClient;
@@ -7244,11 +9437,6 @@ const layer$7 = Layer.effect(Service$6, Effect.gen(function* () {
 	});
 }));
 //#endregion
-//#region src/settings/schema.ts
-var schema_exports$3 = /* @__PURE__ */ __exportAll({});
-import * as import__codeworksh_plugin_settings from "@codeworksh/plugin/settings";
-__reExport(schema_exports$3, import__codeworksh_plugin_settings);
-//#endregion
 //#region src/settings/resolve.ts
 const patternMatches = (pattern, id) => new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(id);
 function collect(settings, provider, id) {
@@ -7287,11 +9475,12 @@ function resolveRequest(block, model) {
 		"toolExecution",
 		"contextWindow",
 		"protocol",
+		"apiKey",
 		"extras"
 	].includes(key)));
 	return {
 		...resolveOptions(block),
-		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model$1.optionsKey(model)]: bag } }
+		...Object.keys(bag).length === 0 ? {} : { providerOptions: { [Model.optionsKey(model)]: bag } }
 	};
 }
 /**
@@ -7299,7 +9488,8 @@ function resolveRequest(block, model) {
 *
 * Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
 * think, how to schedule tool calls -- rather than the request body. Runtime bindings
-* outrank a matched block, which outranks the file's top level.
+* outrank a matched block, which outranks the file's top level. The thinking level is the
+* requested one; State clamps it to the model once the catalog lookup is in hand.
 */
 const resolveControls = (settings, block, runtime) => ({
 	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
@@ -7320,6 +9510,25 @@ function compose(settings, options = {}, session = {}) {
 	};
 }
 //#endregion
+//#region src/runner/attribution.ts
+const OPENROUTER_HOST = "openrouter.ai";
+const isOpenRouter = (model) => model.provider.id === "openrouter" || (model.api?.url ?? model.baseUrl).includes(OPENROUTER_HOST);
+const defaults = (model) => isOpenRouter(model) ? {
+	"HTTP-Referer": "https://codework.sh",
+	"X-OpenRouter-Title": "CodeWork",
+	"X-OpenRouter-Categories": "cli-agent,personal-agent"
+} : void 0;
+const withAttribution = (model) => {
+	const headers = defaults(model);
+	return headers === void 0 ? model : {
+		...model,
+		headers: {
+			...headers,
+			...model.headers
+		}
+	};
+};
+//#endregion
 //#region src/runner/event.ts
 const make$6 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	const events = yield* Service$16;
@@ -7525,15 +9734,27 @@ const messageFailure = (message) => {
 };
 /** Resolve once before exchange setup; execution reuses this exact instance. */
 const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
-	const model = yield* Effect.tryPromise({
-		try: () => llm(input.provider, input.model, resolveOverrides(input.settings ?? {})),
+	const overrides = resolveOverrides(input.settings ?? {});
+	const declared = entry(input.models ?? [], input.provider, input.model);
+	const model = declared !== void 0 ? {
+		...declared,
+		...overrides
+	} : yield* Effect.tryPromise({
+		try: () => llm(input.provider, input.model, overrides),
 		catch: (cause) => loadError(cause) ?? providerErrorFromUnknown(input, cause)
 	});
 	if (model === void 0) return yield* new ModelNotFoundError({
 		provider: input.provider,
 		model: input.model
 	});
-	return model;
+	const apiKey = input.settings?.apiKey;
+	return apiKey === void 0 ? model : {
+		...model,
+		provider: {
+			...model.provider,
+			key: (0, schema_exports$3.keyName)(apiKey)
+		}
+	};
 });
 /**
 * Fill in what an OAuth provider needs and the model catalog cannot carry: the
@@ -7542,7 +9763,7 @@ const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
 * with no stored login resolves to `{}` so aikit reports the missing key.
 */
 const oauthCredentials = async (protocol, options) => {
-	const storage = options.authFile === void 0 ? {} : { path: options.authFile };
+	const storage = oauthStorage(options.authFile);
 	if (protocol === "openai-codex") {
 		const apiKey = await getOpenAICodexApiKey({ storage: new JsonOpenAICodexAuthStorage(storage) });
 		return apiKey === void 0 ? {} : { apiKey };
@@ -7562,7 +9783,7 @@ const oauthCredentials = async (protocol, options) => {
 };
 /** Start a provider stream using the model pinned by State. */
 const openWith = (options = {}) => Effect.fn("LLM.open")(function* (input, signal) {
-	const model = input.resolvedModel;
+	const model = withAttribution(input.resolvedModel);
 	const configured = runtimeOptions(input, model, signal);
 	const resolved = configured.apiKey === void 0 ? yield* Effect.tryPromise({
 		try: () => oauthCredentials(model.protocol, options),
@@ -7695,8 +9916,9 @@ const encodeOutcome = (def, call, exit, latest) => Effect.gen(function* () {
 	if (Exit.isSuccess(exit)) {
 		const encoded = yield* Schema.encodeUnknownEffect(asCodec(def.success))(exit.value).pipe(Effect.orDie);
 		const content = def.encodeContent ? def.encodeContent(exit.value) : [yield* jsonText(encoded)];
+		const details = def.encodeDetails ? def.encodeDetails(exit.value) : encoded;
 		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-		return completed(call, content, now, encoded);
+		return completed(call, content, now, details);
 	}
 	const cause = exit.cause;
 	if (Cause.hasInterrupts(cause)) {
@@ -7761,6 +9983,15 @@ const make$4 = (tools) => {
 		impls.set(name, entry);
 	}
 	const wire = [...impls.values()].map(({ tool }) => (0, tool_exports.toAikitTool)(tool.definition));
+	const decoders = new Map(wire.map((tool) => {
+		const decode = Schema.decodeUnknownEffect(Schema.toCodecJson(asCodec(impls.get(tool.name).tool.definition.parameters)));
+		const parse = (args) => {
+			const normalized = structuredClone(args);
+			normalizeOptionalNulls(normalized, tool.parameters);
+			return decode(normalized);
+		};
+		return [tool.name, parse];
+	}));
 	const handle = (call, options) => Effect.gen(function* () {
 		const entry = impls.get(call.name);
 		if (entry === void 0) {
@@ -7772,7 +10003,18 @@ const make$4 = (tools) => {
 		}
 		const { tool: impl, hooks } = entry;
 		const def = impl.definition;
-		const decoded = yield* Effect.result(Schema.decodeEffect(asCodec(def.parameters))(call.arguments));
+		const prepared = yield* Effect.result(Effect.try({
+			try: () => def.prepareArguments ? def.prepareArguments(call.arguments) : call.arguments,
+			catch: (cause) => cause instanceof Error ? cause.message : String(cause)
+		}));
+		if (Result.isFailure(prepared)) {
+			const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+			return errored(call, [text(`Invalid arguments for ${call.name}: ${prepared.failure}`)], now, {
+				error: "invalid_arguments",
+				name: call.name
+			});
+		}
+		const decoded = yield* Effect.result(decoders.get(call.name)(prepared.success));
 		if (Result.isFailure(decoded)) {
 			const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
 			return errored(call, [text(`Invalid arguments for ${call.name}: ${decoded.failure.message}`)], now, {
@@ -7915,20 +10157,109 @@ const make$3 = (tools) => {
 Context.Service()("@codeworksh/harness/tool/registry/ToolRegistry");
 const make$2 = () => {
 	let open = true;
-	let value;
+	let foundation;
+	const sections = /* @__PURE__ */ new Map();
+	const writable = () => {
+		if (!open) throw new Error("prompt registry is closed");
+	};
+	const slot = (section) => {
+		writable();
+		const reason = Section.invalid(section.name);
+		if (reason !== void 0) throw new Error(reason);
+		if (!Section.isFormat(section.format)) throw new Error(`prompt section ${section.name} has an unknown format: ${JSON.stringify(section.format)}`);
+		const builtin = Section.builtins.find((candidate) => candidate.name === section.name);
+		if (builtin !== void 0 && builtin.format !== section.format) throw new Error(`prompt section ${section.name} is built in as "${builtin.format}"`);
+		const existing = sections.get(section.name);
+		if (existing === void 0) {
+			const opened = {
+				format: section.format,
+				entries: []
+			};
+			sections.set(section.name, opened);
+			return opened;
+		}
+		if (existing.format !== section.format) throw new Error(`prompt section ${section.name} is "${existing.format}"; a write as "${section.format}" cannot merge into it`);
+		return existing;
+	};
 	return {
 		registry: Object.freeze({
-			set: (prompt) => {
-				if (!open) throw new Error("prompt registry is closed");
-				value = prompt;
-			},
-			get: () => value
+			foundation: Object.freeze({
+				set: (text) => {
+					writable();
+					foundation = text;
+				},
+				get: () => foundation
+			}),
+			sections: Object.freeze({
+				append: (section, entry) => {
+					slot(section).entries.push(entry);
+				},
+				set: (section, entries) => {
+					slot(section).entries = [...entries];
+				},
+				remove: (section) => {
+					writable();
+					sections.delete(section.name);
+				},
+				get: (section) => {
+					const found = sections.get(section.name);
+					return found === void 0 ? void 0 : Object.freeze([...found.entries]);
+				}
+			})
 		}),
 		close: () => {
 			open = false;
 		},
-		value: () => value
+		snapshot: () => ({
+			foundation,
+			sections: new Map(Array.from(sections, ([name, { format, entries }]) => [name, {
+				format,
+				entries: [...entries]
+			}]))
+		})
+	};
+};
+//#endregion
+//#region src/plugin/prompt/render.ts
+const tag = (name, body) => `<${name}>\n${body}\n</${name}>`;
+/** Two spellings of one list entry dedupe against each other. */
+const normalize = (value) => value.trim().replace(/\s+/g, " ");
+const body = ({ format, entries }) => {
+	if (format === "text") {
+		const kept = entries.filter((entry) => entry.trim().length > 0);
+		return kept.length === 0 ? void 0 : kept.join("\n\n");
+	}
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const normalized = normalize(entry);
+		if (normalized.length > 0) seen.add(normalized);
+	}
+	return seen.size === 0 ? void 0 : Array.from(seen, (line) => `- ${line}`).join("\n");
+};
+/** `(none)` rather than no section: a model told it has no tools behaves better than one left guessing. */
+const toolIndex = (tools) => {
+	const listed = tools.filter((tool) => tool.promptSnippet !== void 0 && tool.promptSnippet.length > 0);
+	if (listed.length === 0) return "(none)";
+	return listed.map((tool) => `- ${tool.name}: ${tool.promptSnippet}`).join("\n");
+};
+const render = (input) => {
+	const written = new Map(input.prompt.sections);
+	const guidelines = input.tools.flatMap((tool) => tool.promptGuidelines ?? []);
+	written.set(Section.Rules.name, {
+		format: Section.Rules.format,
+		entries: [...guidelines, ...written.get(Section.Rules.name)?.entries ?? []]
+	});
+	const parts = [input.prompt.foundation ?? "You are an expert coding assistant operating inside codework, a coding agent harness.", tag("tools", toolIndex(input.tools))];
+	const push = (name) => {
+		const section = written.get(name);
+		const rendered = section === void 0 ? void 0 : body(section);
+		if (rendered !== void 0) parts.push(tag(name, rendered));
+		written.delete(name);
 	};
+	for (const section of Section.builtins) push(section.name);
+	parts.push(tag("cwd", input.directory));
+	for (const name of Array.from(written.keys())) push(name);
+	return parts.join("\n\n");
 };
 //#endregion
 //#region src/plugin/tool/registry.ts
@@ -7954,6 +10285,8 @@ const assertTool = (tool) => {
 	if (def.failure !== void 0 && !Schema.isSchema(def.failure)) throw new Error(`Tool ${name}: failure must be an Effect Schema`);
 	if (def.encodeContent !== void 0 && !Predicate.isFunction(def.encodeContent)) throw new Error(`Tool ${name}: encodeContent must be a function`);
 	if (def.encodeFailureContent !== void 0 && !Predicate.isFunction(def.encodeFailureContent)) throw new Error(`Tool ${name}: encodeFailureContent must be a function`);
+	if (def.prepareArguments !== void 0 && !Predicate.isFunction(def.prepareArguments)) throw new Error(`Tool ${name}: prepareArguments must be a function`);
+	if (def.encodeDetails !== void 0 && !Predicate.isFunction(def.encodeDetails)) throw new Error(`Tool ${name}: encodeDetails must be a function`);
 	if (!Predicate.isFunction(tool.handler)) throw new Error(`Tool ${name}: handler must be a function`);
 };
 const assertHooks = (name, hooks) => {
@@ -8020,11 +10353,16 @@ const make = () => {
 			prompt: prompt.registry
 		}),
 		close,
-		freeze: () => {
+		freeze: (directory) => {
 			close();
+			const resolved = make$3(tools.entries()).resolve();
 			return {
-				tools: make$3(tools.entries()).resolve(),
-				systemPrompt: prompt.value() ?? "You are an AI agent for CodeWork. CodeWork is the best agent harness for code & work."
+				tools: resolved,
+				systemPrompt: render({
+					prompt: prompt.snapshot(),
+					tools: resolved.defs,
+					directory
+				})
 			};
 		}
 	};
@@ -8069,7 +10407,7 @@ const run = Effect.fn("PluginHost.run")(function* (selection, input) {
 			}));
 		}));
 		return yield* Effect.try({
-			try: buckets.freeze,
+			try: () => buckets.freeze(input.location.directory),
 			catch: (cause) => new SetupError({
 				message: `plugin snapshot freeze failed: ${cause instanceof Error ? cause.message : String(cause)}`,
 				cause
@@ -8079,8 +10417,8 @@ const run = Effect.fn("PluginHost.run")(function* (selection, input) {
 });
 //#endregion
 //#region src/session/runtime.ts
-var Service$3 = class extends Context.Service()("@codeworksh/harness/session/runtime/Service") {};
-const layer$6 = Layer.effect(Service$3, Effect.gen(function* () {
+var Service$2 = class extends Context.Service()("@codeworksh/harness/session/runtime/Service") {};
+const layer$5 = Layer.effect(Service$2, Effect.gen(function* () {
 	const bindings = yield* Ref.make(/* @__PURE__ */ new Map());
 	const get = (sessionId) => Ref.get(bindings).pipe(Effect.map((entries) => Option.fromUndefinedOr(entries.get(sessionId))));
 	const set = (sessionId, value) => Ref.update(bindings, (entries) => {
@@ -8101,7 +10439,7 @@ const layer$6 = Layer.effect(Service$3, Effect.gen(function* () {
 		next.delete(sessionId);
 		return next;
 	});
-	return Service$3.of({
+	return Service$2.of({
 		get,
 		set,
 		update,
@@ -8109,202 +10447,6 @@ const layer$6 = Layer.effect(Service$3, Effect.gen(function* () {
 	});
 }));
 //#endregion
-//#region src/settings/settings.ts
-var settings_exports = /* @__PURE__ */ __exportAll({
-	Service: () => Service$2,
-	Settings: () => settings_exports,
-	SettingsError: () => SettingsError,
-	defaults: () => schema_exports$3.defaults,
-	layer: () => layer$5,
-	load: () => load$1,
-	modules: () => modules,
-	parse: () => parse$1,
-	paths: () => paths,
-	projectRoot: () => projectRoot,
-	userConfigDir: () => userConfigDir
-});
-/**
-* An app-level `--user-config-dir` as the absolute directory it names: `~` is the user's home, and
-* a relative spelling is relative to `hostCwd` -- never to a session's `hostDir`, which is not
-* where the flag was typed.
-*/
-const userConfigDir = (raw, hostCwd) => hostPath.resolve(hostCwd, expandTilde(raw, hostPath));
-/** The settings files a directory may hold, in the order it is searched. */
-const settingsIn = (directory) => [hostPath.join(directory, "settings.jsonc"), hostPath.join(directory, "settings.json")];
-/** A directory and every ancestor above it, nearest first. */
-const ancestors = (from) => {
-	const chain = [];
-	for (let directory = from;; directory = hostPath.dirname(directory)) {
-		chain.push(directory);
-		if (hostPath.dirname(directory) === directory) return chain;
-	}
-};
-const isDirectory = (path) => fileSystem.stat(path).pipe(Effect.map((info) => info.type === "Directory"), Effect.orElseSucceed(() => false));
-/**
-* The project a directory is in: the nearest ancestor holding a `.codework` **directory**.
-*
-* This is git's rule. `~/workspace/app/.codework` makes `~/workspace/app` a project, and
-* `~/workspace/app/packages/fubar` is inside it. Nearest wins outright -- the walk stops at the
-* first marker, so an inner project is never merged with an outer one.
-*
-* The marker is the directory, not a file in it. An empty `.codework/` is still a project root,
-* which is the point: creating the directory is how a person says "a project begins here", and it
-* has to mean that before any settings exist. It also makes the question one `stat` per ancestor
-* whose answer does not change as files come and go inside.
-*
-* `<home>` is skipped. `~/.codework` is the user layer, not a project; without this, running
-* anywhere under `$HOME` would find it as one and read the user layer twice -- and since plugin
-* entries accumulate across layers, every user plugin would load twice.
-*/
-const projectRoot = Effect.fn("Settings.projectRoot")(function* (from, home) {
-	const userConfig = hostPath.resolve(home);
-	for (const directory of ancestors(hostPath.resolve(from))) {
-		const marker = hostPath.join(directory, appConfigDir);
-		if (hostPath.resolve(marker) === userConfig) continue;
-		if (yield* isDirectory(marker)) return directory;
-	}
-});
-/**
-* Ordered layers, each a group of candidates where the first file that exists is selected -- a
-* group never contributes more than one file.
-*
-* `.jsonc` is the canonical spelling: these files are written by hand and read as JSONC, so the
-* extension says what the file is and an editor validates it as such. `.json` remains a fallback
-* everywhere, tried second, because the parser reads either and a file already named that must
-* keep working.
-*
-* `root` is an already-discovered project root ({@link projectRoot}), not a directory to search
-* from: the walk is a `stat` per ancestor and belongs with the other I/O. `undefined` contributes
-* no project layer at all, which is what a session with no host directory gets.
-*/
-function paths(input) {
-	return [settingsIn(input.userConfigDir ?? input.home), input.root === void 0 ? [] : settingsIn(hostPath.join(input.root, appConfigDir))];
-}
-var SettingsError = class extends Schema.TaggedError()("SettingsError", {
-	path: Schema.String,
-	reason: Schema.Literals([
-		"read",
-		"parse",
-		"decode"
-	]),
-	detail: Schema.String
-}) {
-	get message() {
-		return `${this.path}: ${this.reason}: ${this.detail}`;
-	}
-};
-/** `line:column`, 1-based, for a parser offset into the source. */
-const at = (source, offset) => {
-	const before = source.slice(0, offset).split("\n");
-	return `${before.length}:${(before.at(-1)?.length ?? 0) + 1}`;
-};
-const parse$1 = Effect.fn("Settings.parse")(function* (path, source) {
-	const errors = [];
-	const json = parse(source, errors, {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	const first = errors[0];
-	if (first !== void 0) return yield* new SettingsError({
-		path,
-		reason: "parse",
-		detail: `${printParseErrorCode(first.error)} at ${at(source, first.offset)}`
-	});
-	const document = normalize(json);
-	if (Predicate.isObject(document) && Predicate.isObject(json) && "plugins" in json) Object.assign(document, { plugins: json.plugins });
-	return yield* Schema.decodeUnknownEffect(schema_exports$3.Patch)(document).pipe(Effect.mapError((error) => new SettingsError({
-		path,
-		reason: "decode",
-		detail: SchemaIssue.makeFormatterStandardSchemaV1()(error.issue).issues.map((issue) => `${issue.path?.map((part) => typeof part === "object" ? String(part.key) : part).join(".") ?? "settings"}: invalid value`).join("; ")
-	})));
-});
-var Service$2 = class extends Context.Service()("@codeworksh/harness/settings/settings/Service") {};
-/**
-* Anchor relative plugin entries to the file that declared them.
-*
-* A reference is otherwise resolved against the host startup directory, which is right for
-* a project file sitting in it and meaningless for `~/.codework/settings.json`, where
-* `./plugins/x.ts` would name a different file in every project the process is started in.
-* `file:` URLs, package specs and package names are left exactly as written, and a `plugin`
-* key is an ID rather than a location. A configuration entry's `package` is anchored like a
-* module entry, so a relative path names the same module in both spellings.
-*/
-const anchored = (entry, file) => {
-	const directory = hostPath.dirname(file);
-	const resolve = (reference) => reference.startsWith("./") || reference.startsWith("../") ? hostPath.resolve(directory, reference) : reference;
-	if (typeof entry === "string") return resolve(entry);
-	return "package" in entry ? {
-		...entry,
-		package: resolve(entry.package)
-	} : entry;
-};
-const anchor = (patch, file) => patch.plugins === void 0 ? patch : {
-	...patch,
-	plugins: patch.plugins.map((entry) => anchored(entry, file))
-};
-const attempt = (path) => fileSystem.readFileString(path).pipe(Effect.mapError((error) => new SettingsError({
-	path,
-	reason: "read",
-	detail: error.reason._tag
-})), Effect.flatMap((source) => parse$1(path, source)));
-/**
-* One read of every layer. Exported for the harness constructor, which needs the plugin
-* selection before any layer is built; everything else goes through `Service`.
-*/
-const load$1 = Effect.fn("Settings.load")(function* (options) {
-	const root = options.hostDir === void 0 ? void 0 : yield* projectRoot(options.hostDir, options.home);
-	const files = paths({
-		home: options.home,
-		root,
-		...options.userConfigDir === void 0 ? {} : { userConfigDir: options.userConfigDir }
-	});
-	let settings = merge(schema_exports$3.defaults);
-	let declared = schema_exports$3.defaults.declared;
-	for (const group of files) for (const path of group) {
-		const result = yield* Effect.result(attempt(path));
-		if (Result.isSuccess(result)) {
-			const patch = anchor(result.success, path);
-			settings = merge(settings, patch);
-			if (result.success.plugins !== void 0) declared = [...declared, ...result.success.plugins.map((written) => ({
-				written,
-				entry: anchored(written, path),
-				file: path
-			}))];
-			break;
-		}
-		const error = result.failure;
-		if (error.reason === "read" && error.detail === "NotFound") continue;
-		return yield* error;
-	}
-	return {
-		...settings,
-		plugins: declared.map((one) => one.entry),
-		declared
-	};
-});
-/**
-* Each module reference once, owned by the **last** file to declare it (D6).
-*
-* The owner is not bookkeeping: its `.npmrc` chain keys the store artifact. The CLI that installs
-* a reference and the runtime that loads it must pick the same owner, or `plugin update` refreshes
-* an artifact the runtime never reads. Only a string entry loads a module, so only a string entry
-* owns one -- a `{ package }` patch in another file configures it and must not move its registry.
-* A reference keeps the position of its first declaration.
-*/
-const modules = (declared) => {
-	const owners = /* @__PURE__ */ new Map();
-	for (const one of declared) if (typeof one.entry === "string") owners.set(one.entry, one);
-	return owners;
-};
-const layer$5 = (options = {}) => Layer.effect(Service$2, Effect.gen(function* () {
-	const global = yield* Service$17;
-	return Service$2.of({ load: (hostDir) => load$1({
-		...options,
-		home: global.home,
-		hostDir
-	}) });
-}));
-//#endregion
 //#region src/state/state.ts
 var state_exports = /* @__PURE__ */ __exportAll({
 	Service: () => Service$1,
@@ -8354,12 +10496,13 @@ const resolver = (input) => typeof input === "string" ? () => input : input;
 */
 const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effect.undefined) => {
 	return Layer.effect(Service$1, Effect.gen(function* () {
-		const runtime = yield* Service$3;
+		const runtime = yield* Service$2;
 		const sessions = yield* Service$14;
-		const settings = yield* Service$2;
+		const settings = yield* Service$3;
 		const eventRegistry = yield* Service$4;
 		const eventService = yield* Service$16;
 		const events = makeEvents(eventService);
+		const global = yield* Service$17;
 		const loading = yield* Semaphore.make(1);
 		const updated = (origin, id, status) => eventService.publish(PluginUpdated, {
 			status,
@@ -8409,6 +10552,38 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 			..."reference" in cause && typeof cause.reference === "string" ? { reference: cause.reference } : {},
 			...sessionId === void 0 ? {} : { sessionId }
 		});
+		/** Settings and composed configuration for a session's next exchange. */
+		const configure = Effect.fnUntraced(function* (sessionId) {
+			const session = Option.getOrUndefined(yield* sessions.get(sessionId));
+			const hostDir = session === void 0 ? void 0 : Option.getOrUndefined(session.hostDir);
+			const chosen = session === void 0 ? {} : Option.getOrElse(session.config, () => ({}));
+			const sessionOptions = {
+				...chosen.model === void 0 ? {} : {
+					provider: chosen.model.provider,
+					model: chosen.model.id
+				},
+				...chosen.thinkingLevel === void 0 ? {} : { thinkingLevel: chosen.thinkingLevel },
+				...Option.getOrElse(yield* runtime.get(sessionId), () => ({}))
+			};
+			const loadedSettings = yield* settings.load(hostDir);
+			const composed = compose(loadedSettings, options, sessionOptions);
+			const resolvedModel = yield* resolve$1({
+				provider: composed.provider,
+				model: composed.model,
+				settings: composed.block,
+				models: loadedSettings.models
+			});
+			const thinkingLevel = Model.clampThinkingLevel(resolvedModel, composed.thinkingLevel);
+			return {
+				hostDir,
+				loadedSettings,
+				configured: {
+					...composed,
+					resolvedModel,
+					thinkingLevel
+				}
+			};
+		});
 		return Service$1.of({
 			reload: Effect.gen(function* () {
 				const failures = /* @__PURE__ */ new Map();
@@ -8427,22 +10602,21 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 					failure: first
 				};
 			}),
+			configuration: Effect.fn("State.configuration")(function* (sessionId) {
+				const { configured } = yield* configure(sessionId);
+				return {
+					provider: configured.provider,
+					model: configured.model,
+					thinkingLevel: configured.thinkingLevel
+				};
+			}),
 			snapshot: Effect.fn("State.snapshot")(function* (sessionId) {
-				const sessionOptions = Option.getOrElse(yield* runtime.get(sessionId), () => ({}));
-				const session = yield* sessions.get(sessionId);
-				const hostDir = Option.isNone(session) ? void 0 : Option.getOrUndefined(session.value.hostDir);
-				const loadedSettings = yield* settings.load(hostDir);
-				const configured = compose(loadedSettings, options, sessionOptions);
+				const { hostDir, loadedSettings, configured } = yield* configure(sessionId);
 				const { promptCustom, promptSystemAppend, provider: _provider, model: _model, thinkingLevel: _thinkingLevel, toolExecution: _toolExecution, ...rest } = configured.runtime;
-				const { provider, model, thinkingLevel, toolExecution } = configured;
+				const { provider, model, resolvedModel, thinkingLevel, toolExecution } = configured;
 				const request = merge(resolveOptions(configured.block), rest);
 				const sandbox = yield* io_exports.SandboxIO.Current;
 				const location = yield* Service$8;
-				const resolvedModel = yield* resolve$1({
-					provider,
-					model,
-					settings: configured.block
-				});
 				const refs = references(loadedSettings);
 				const failed = (cause) => new SnapshotError({
 					sessionId,
@@ -8460,7 +10634,15 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 				const chosen = yield* select(refs, loaded).pipe(Effect.mapError(failed));
 				for (const reference of chosen.missing) {
 					const where = loadedSettings.declared.find((one) => typeof one.entry === "string" ? one.entry === reference : "package" in one.entry && one.entry.package === reference);
-					yield* Effect.logWarning(`plugin ${reference} is configured but not loaded — run \`codework plugin install\`${where === void 0 ? "" : ` (declared in ${where.file})`}`);
+					const error = `plugin ${reference} is configured but not loaded — run \`codework plugin install\`${where === void 0 ? "" : ` (declared in ${where.file})`}`;
+					yield* Effect.logWarning(error);
+					yield* eventService.publish(PluginUpdated, {
+						status: "failed",
+						reference,
+						error,
+						...where === void 0 ? {} : { file: where.file },
+						sessionId
+					});
 				}
 				return {
 					sessionId,
@@ -8469,6 +10651,7 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 					...yield* run(chosen.selection, {
 						sessionId,
 						sandbox,
+						paths: global,
 						location,
 						settings: loadedSettings,
 						model: resolvedModel,
@@ -8488,13 +10671,34 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 					thinkingLevel,
 					request,
 					settings: configured.block,
-					toolExecution
+					toolExecution,
+					retry: loadedSettings.retry
 				};
 			})
 		});
 	}));
 };
 //#endregion
+//#region src/runner/retry.ts
+/**
+* Milliseconds to wait before retry `attempt` (1-based), or `undefined` to give up.
+*
+* Only a provider failure the provider itself calls transient is retried. A quota error is
+* excluded even though it often arrives as a retryable 429: waiting does not refill a quota.
+* Context overflow is a non-retryable 400 and is left to compaction.
+*
+* A server-sent `retry-after` raises the delay, never lowers it. One longer than `maxDelayMs`
+* gives up rather than retrying early into the same rejection.
+*/
+const delay = (policy, attempt, error) => {
+	if (attempt > policy.maxRetries) return void 0;
+	if (!Schema.is(ProviderError)(error) || !error.isRetryable) return void 0;
+	if (error.reason._tag === "Runner.ProviderQuotaError") return void 0;
+	const backoff = Math.min(policy.baseDelayMs * 2 ** (attempt - 1), policy.maxDelayMs);
+	const requested = error.reason.retryAfter === void 0 ? 0 : Duration.toMillis(error.reason.retryAfter);
+	return requested > policy.maxDelayMs ? void 0 : Math.max(backoff, Math.ceil(requested));
+};
+//#endregion
 //#region src/runner/loop.ts
 const terminalResult = (text) => ({
 	content: [{
@@ -8614,7 +10818,9 @@ const layer$3 = (options = {}) => Layer.effect(Service$7, Effect.gen(function* (
 					sessionId: snapshot.sessionId,
 					messageId,
 					callID: call.callID,
-					name: call.name
+					name: call.name,
+					label: snapshot.tools.defs.find((def) => def.name === call.name)?.label,
+					arguments: call.arguments
 				});
 				const handled = yield* snapshot.tools.handle(call, {
 					sessionId: snapshot.sessionId,
@@ -8661,11 +10867,14 @@ const layer$3 = (options = {}) => Layer.effect(Service$7, Effect.gen(function* (
 		if (leaf !== void 0 && (leaf.stopReason === "stop" || leaf.stopReason === "length")) return { needsContinuation: false };
 		let publisher;
 		let committed = false;
-		return yield* Effect.gen(function* () {
-			yield* events.publish(TurnStarted, {
-				timestamp: yield* DateTime.now,
-				sessionId
-			});
+		let retries = 0;
+		/** Abort the latest attempt's draft, unless its own terminal event already did. */
+		const settleDraft = (cause) => Effect.gen(function* () {
+			if (publisher?.startedMessageId === void 0) return;
+			const stored = yield* sessions.entry(publisher.startedMessageId);
+			if (Option.isSome(stored) && stored.value.entry.state === "draft") yield* publishFailure(stored.value, cause);
+		});
+		const attempt = Effect.gen(function* () {
 			publisher = yield* make$6({ sessionId }).pipe(Effect.provideService(Service$16, events));
 			const terminal = yield* requestLLM({
 				sessionId,
@@ -8689,6 +10898,43 @@ const layer$3 = (options = {}) => Layer.effect(Service$7, Effect.gen(function* (
 					model: snapshot.model
 				}, messageFailure(terminal.message));
 			}
+			return terminal;
+		});
+		const request = () => attempt.pipe(Effect.catch((error) => {
+			const delayMs = delay(snapshot.retry, retries + 1, error);
+			if (delayMs === void 0) return Effect.fail(error);
+			return Effect.gen(function* () {
+				retries += 1;
+				yield* Effect.uninterruptible(settleDraft({
+					_tag: "error",
+					message: error.message
+				}));
+				yield* events.publish(RetryScheduled, {
+					timestamp: yield* DateTime.now,
+					sessionId,
+					attempt: retries,
+					maxRetries: snapshot.retry.maxRetries,
+					delayMs,
+					message: error.message
+				});
+				yield* Effect.sleep(Duration.millis(delayMs));
+				return yield* request();
+			});
+		}));
+		return yield* Effect.gen(function* () {
+			yield* events.publish(TurnStarted, {
+				timestamp: yield* DateTime.now,
+				sessionId
+			});
+			const terminal = yield* request().pipe(Effect.onExit((exit) => retries === 0 ? Effect.void : Effect.gen(function* () {
+				yield* events.publish(RetryFinished, {
+					timestamp: yield* DateTime.now,
+					sessionId,
+					attempt: retries,
+					success: Exit.isSuccess(exit),
+					...Exit.isSuccess(exit) ? {} : { message: Cause.hasInterrupts(exit.cause) ? "interrupted" : errorMessage(exit.cause) }
+				});
+			})));
 			const interrupted = yield* settleTools(snapshot, terminal.message, terminal.reason, () => {
 				committed = true;
 			});
@@ -8697,24 +10943,20 @@ const layer$3 = (options = {}) => Layer.effect(Service$7, Effect.gen(function* (
 				needsContinuation: terminal.reason === "toolUse",
 				messageId: terminal.message.messageId
 			};
-		}).pipe(Effect.catchCause((cause) => {
-			if (committed) return Effect.failCause(cause);
+		}).pipe(Effect.onError((cause) => {
+			if (committed) return Effect.void;
 			const turnCause = Cause.hasInterrupts(cause) ? { _tag: "interrupted" } : {
 				_tag: "error",
 				message: errorMessage(cause)
 			};
-			const record = Effect.gen(function* () {
-				if (publisher?.startedMessageId !== void 0) {
-					const stored = yield* sessions.entry(publisher.startedMessageId);
-					if (Option.isSome(stored) && stored.value.entry.state === "draft") yield* publishFailure(stored.value, turnCause);
-				}
+			return Effect.gen(function* () {
+				yield* settleDraft(turnCause);
 				yield* events.publish(TurnAborted, {
 					timestamp: yield* DateTime.now,
 					sessionId,
 					cause: turnCause
 				});
 			});
-			return Effect.uninterruptible(record).pipe(Effect.andThen(Effect.failCause(cause)));
 		}));
 	});
 	const runTurn = Effect.fn("Loop.runTurn")(function* (promotion, snapshot) {
@@ -8868,10 +11110,7 @@ const layer$2 = Layer.effectDiscard(Effect.gen(function* () {
 			messageId: event.data.messageId,
 			role: "user",
 			time: { created: DateTime.toEpochMillis(event.data.timestamp) },
-			parts: [{
-				type: "text",
-				text: event.data.prompt.text
-			}]
+			parts: [...event.data.prompt.parts]
 		})).pipe(Effect.orDie);
 		yield* sessions.append({
 			id: event.data.messageId,
@@ -8881,7 +11120,13 @@ const layer$2 = Layer.effectDiscard(Effect.gen(function* () {
 			...encoded,
 			...event.metadata === void 0 ? {} : { metadata: event.metadata }
 		}).pipe(Effect.orDie);
+		const title = titleFrom(Prompt.text(event.data.prompt));
+		if (title !== void 0) yield* sessions.retitle(event.data.sessionId, title);
 	}));
+	yield* events.project(ConfigChanged, (event) => {
+		const { sessionId, timestamp: _timestamp, ...config } = event.data;
+		return sessions.configure(sessionId, config);
+	});
 	yield* events.project(LLMStarted, (event) => Effect.gen(function* () {
 		if (event.durable === void 0) return yield* Effect.die("LLMStarted is missing its aggregate sequence");
 		const encoded = yield* encodeAssistant({
@@ -8949,10 +11194,10 @@ var harness_exports = /* @__PURE__ */ __exportAll({
 });
 const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	const hostCwd = options.hostCwd ?? process.cwd();
-	const paths = yield* resolve$3(options.home === void 0 ? {} : { home: hostPath.resolve(hostCwd, expandTilde(options.home, hostPath)) });
-	const global = layerWith$1(paths);
+	const paths = yield* resolve$4(options.home === void 0 ? {} : { home: hostPath.resolve(hostCwd, expandTilde(options.home, hostPath)) });
+	const global = layerWith(paths);
 	const settingsOptions = options.userConfigDir === void 0 ? {} : { userConfigDir: userConfigDir(options.userConfigDir, hostCwd) };
-	const config = yield* load$1({
+	const config = yield* load$3({
 		...settingsOptions,
 		home: paths.home
 	});
@@ -8969,12 +11214,12 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	* `hostDir` led to; only the process view falls back to `hostCwd`.
 	*/
 	const hostDirOf = (root) => root ?? hostCwd;
-	const filed = (reference, from) => parse$2(reference, from).pipe(Effect.flatMap((target) => target.kind === "local" ? fileSystem.exists(target.path).pipe(Effect.map((there) => there ? Option.some({}) : Option.none())) : resolve$2(target, paths.cache, from).pipe(Effect.map((entry) => Option.fromUndefinedOr(entry)))), Effect.orElseSucceed(() => Option.none()));
+	const filed = (reference, from) => parse$1(reference, from).pipe(Effect.flatMap((target) => target.kind === "local" ? fileSystem.exists(target.path).pipe(Effect.map((there) => there ? Option.some({}) : Option.none())) : resolve$2(target, paths.cache, from).pipe(Effect.map((entry) => Option.fromUndefinedOr(entry)))), Effect.orElseSucceed(() => Option.none()));
 	const resolveOnly = {
 		...catalogOptions,
 		install: required
 	};
-	const pool = yield* Ref.make(yield* load$2(references(config), {
+	const pool = yield* Ref.make(yield* load$1(references(config), {
 		...resolveOnly,
 		declared: declaredIn(config)
 	}));
@@ -8988,7 +11233,7 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	let reloads = 0;
 	const rebuild = (root, loaded) => Effect.gen(function* () {
 		reloads += 1;
-		const current = yield* load$1({
+		const current = yield* load$3({
 			...settingsOptions,
 			home: paths.home,
 			...root === void 0 ? {} : { hostDir: root }
@@ -8996,7 +11241,7 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 		const retained = [];
 		const configured = references(current);
 		for (const origin of loaded.origins.values()) {
-			if (configured.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor$1(origin.file, hostDirOf(root))))) {
+			if (configured.includes(origin.reference) || Option.isSome(yield* filed(origin.reference, anchor(origin.file, hostDirOf(root))))) {
 				retained.push(origin);
 				continue;
 			}
@@ -9006,7 +11251,7 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 		const known = /* @__PURE__ */ new Map();
 		for (const origin of retained) if (origin.file !== void 0) known.set(origin.reference, origin.file);
 		for (const [reference, file] of declaredIn(current)) known.set(reference, file);
-		return yield* load$2(accumulated, {
+		return yield* load$1(accumulated, {
 			...resolveOnly,
 			hostDir: hostDirOf(root),
 			declared: known,
@@ -9021,10 +11266,10 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	const authFile$1 = authFile(options.home === void 0 ? void 0 : paths.home);
 	const open = options.llm ?? openWith(authFile$1 === void 0 ? {} : { authFile: authFile$1 });
 	const loop = layer$3({ request: make$5(open) });
-	return layer$10.pipe(Layer.provideMerge(layer$7.pipe(Layer.provide(loop))), Layer.provideMerge(layer$4({}, pool, references, followStore, rebuild, viewOf)), Layer.provideMerge(layer$5(settingsOptions)), Layer.provideMerge(layer$6), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$22), Layer.provideMerge(layer$1), Layer.provideMerge(layer$25), Layer.provideMerge(layer$9(definitions)), Layer.provideMerge(database), Layer.provideMerge(global), Layer.provideMerge(layer$8({
+	return layer$10.pipe(Layer.provideMerge(layer$6.pipe(Layer.provide(loop))), Layer.provideMerge(layer$4({}, pool, references, followStore, rebuild, viewOf)), Layer.provideMerge(layer$8(settingsOptions)), Layer.provideMerge(layer$5), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$22), Layer.provideMerge(layer$1), Layer.provideMerge(layer$25), Layer.provideMerge(layer$9(definitions)), Layer.provideMerge(database), Layer.provideMerge(global), Layer.provideMerge(layer$7({
 		home: paths.home,
 		watch: options.watchModels ?? false
-	})));
+	})), Layer.provideMerge(Layer.succeed(Credentials, { authFile: authFile$1 })));
 }));
 //#endregion
 //#region src/effect/sandbox.ts
@@ -9151,30 +11396,54 @@ var session_exports = /* @__PURE__ */ __exportAll({
 	SessionMessageSchema: () => schema_exports$4,
 	SessionSchema: () => schema_exports$8,
 	attach: () => attach,
+	configuration: () => configuration,
 	create: () => create$1,
 	get: () => get,
 	link: () => link,
 	relink: () => relink
 });
+/** What stays in this process. The model and thinking level are the session's {@link chosen} config. */
 const runtimeBindings = (input) => ({
 	...input.model?.options,
-	...input.model === void 0 ? {} : {
-		provider: input.model.provider,
-		model: input.model.id
-	},
-	...input.thinkingLevel === void 0 ? {} : { thinkingLevel: input.thinkingLevel },
 	...input.tools?.execution === void 0 ? {} : { toolExecution: input.tools.execution },
 	...input.systemPrompt?.custom === void 0 ? {} : { promptCustom: input.systemPrompt.custom },
 	...input.systemPrompt?.append === void 0 ? {} : { promptSystemAppend: input.systemPrompt.append }
 });
-const promptInput = (input) => {
+/** The keys of the session's durable config this input names. */
+const chosen = (input) => ({
+	...input.model === void 0 ? {} : { model: {
+		provider: input.model.provider,
+		id: input.model.id
+	} },
+	...input.thinkingLevel === void 0 ? {} : { thinkingLevel: input.thinkingLevel }
+});
+/** Records a config choice; the projector merges it into the session row in the same commit. */
+const choose = Effect.fn("Session.choose")(function* (sessionId, input) {
+	const config = chosen(input);
+	if (Object.keys(config).length === 0) return;
+	yield* (yield* Service$16).publish(ConfigChanged, {
+		sessionId,
+		timestamp: yield* DateTime.now,
+		...config
+	});
+});
+const promptInput = Effect.fnUntraced(function* (input) {
 	const value = typeof input === "string" ? { text: input } : input;
+	const parts = "parts" in value ? value.parts : [{
+		type: "text",
+		text: value.text
+	}];
+	if (parts.length === 0) return yield* new InvalidPromptError({ reason: "A prompt needs at least one part" });
+	for (const part of parts) {
+		const problem = part.type === "image" ? imageProblem(part) : void 0;
+		if (problem !== void 0) return yield* new InvalidPromptError({ reason: problem });
+	}
 	return {
-		prompt: Prompt.make({ text: value.text }),
+		prompt: Prompt.make({ parts }),
 		...value.delivery === void 0 ? {} : { delivery: value.delivery },
 		...value.id === void 0 ? {} : { id: value.id }
 	};
-};
+});
 const makeHandle = Effect.fn("Session.makeHandle")(function* (id) {
 	const sessions = yield* Service$14;
 	const control = yield* Service$5;
@@ -9200,14 +11469,14 @@ const makeHandle = Effect.fn("Session.makeHandle")(function* (id) {
 		id,
 		active: control.active.pipe(Effect.map((active) => active.has(id))),
 		info,
-		prompt: (input) => control.prompt({
+		prompt: (input) => promptInput(input).pipe(Effect.flatMap((prompt) => control.prompt({
 			sessionId: id,
-			...promptInput(input)
-		}),
-		run: (input) => control.run({
+			...prompt
+		}))),
+		run: (input) => promptInput(input).pipe(Effect.flatMap((prompt) => control.run({
 			sessionId: id,
-			...promptInput(input)
-		}),
+			...prompt
+		}))),
 		wait: () => control.wait(id),
 		resume: () => control.resume(id),
 		interrupt: () => control.interrupt(id, { awaitSettlement: true }),
@@ -9217,7 +11486,7 @@ const makeHandle = Effect.fn("Session.makeHandle")(function* (id) {
 });
 const create$1 = Effect.fn("Session.create")(function* (input = {}) {
 	const sessions = yield* Service$14;
-	const runtime = yield* Service$3;
+	const runtime = yield* Service$2;
 	const sandboxes = yield* Controller;
 	const id = ID$1.create();
 	const sandboxId = input.sandbox?.id ?? instance_exports.SandboxInstance.ID.local;
@@ -9226,11 +11495,11 @@ const create$1 = Effect.fn("Session.create")(function* (input = {}) {
 		id,
 		spaceId: location.space.id,
 		directory: location.directory,
-		slug: id,
 		title: input.title ?? "Session",
 		...input.hostDir === void 0 ? {} : { hostDir: declaredHostDir(input.hostDir) }
 	});
 	yield* runtime.set(id, runtimeBindings(input));
+	yield* choose(id, input);
 	return yield* makeHandle(id);
 });
 /**
@@ -9296,9 +11565,20 @@ const get = Effect.fn("Session.get")(function* (sessionId) {
 const attach = Effect.fn("Session.attach")(function* (input) {
 	const found = yield* get(input.sessionId);
 	if (Option.isNone(found)) return yield* new SessionNotFoundError({ sessionId: input.sessionId });
-	yield* (yield* Service$3).update(input.sessionId, runtimeBindings(input));
+	yield* (yield* Service$2).update(input.sessionId, runtimeBindings(input));
+	yield* choose(input.sessionId, input);
 	return found.value;
 });
+/**
+* The model and thinking level the session's next exchange runs with. A choice made through
+* {@link create} or {@link attach} is saved with the session and outlives the process; without
+* one, the session follows its settings.
+*/
+const configuration = Effect.fn("Session.configuration")(function* (sessionId) {
+	const sessions = yield* Service$14;
+	if (Option.isNone(yield* sessions.get(sessionId))) return yield* new SessionNotFoundError({ sessionId });
+	return yield* Service$1.use((state) => state.configuration(sessionId));
+});
 //#endregion
 //#region src/plugin/prompt/schema.ts
 var schema_exports$1 = /* @__PURE__ */ __exportAll({});
@@ -9310,11 +11590,12 @@ var plugin_exports = /* @__PURE__ */ __exportAll({
 	InstallError: () => InstallError,
 	LoadError: () => LoadError,
 	Prompt: () => schema_exports$1,
+	Section: () => Section,
 	SetupError: () => SetupError,
 	SourceError: () => SourceError,
 	StoreError: () => StoreError,
 	Tool: () => schema_exports$2,
-	anchor: () => anchor$1,
+	anchor: () => anchor,
 	canonical: () => canonical,
 	check: () => check,
 	define: () => plugin_exports$1.define,
@@ -9322,7 +11603,7 @@ var plugin_exports = /* @__PURE__ */ __exportAll({
 	identity: () => digest,
 	inspect: () => inspect,
 	localName: () => localName,
-	parse: () => parse$2,
+	parse: () => parse$1,
 	probe: () => probe,
 	resolve: () => resolve$2,
 	resolveCached: () => required,