@codeworksh/harness 0.1.0-dev.20261007133219 → 0.2.0-canary.10.1.g462f34f6

package/effect.mjs

@@ -1,16 +1,17 @@
 import { n as __reExport, t as __exportAll } from "./rolldown-runtime-B4FMCO8f.mjs";
 import { a as io_exports, i as errors_exports, n as shell_exports, o as instance_exports, r as filesystem_exports, s as posix } from "./resource-DFZh0e-s.mjs";
-import "./daytona-BAurx6Gp.mjs";
-import "./vercel-C0v5nh20.mjs";
+import "./daytona-ByTHZelc.mjs";
+import "./vercel-3GouQSJI.mjs";
+import { a as decode, n as dimensionNote, o as load$4, r as resize } from "./resize-Dwv5dCgY.mjs";
 import { createRequire, registerHooks } from "node:module";
 import { Cause, Clock, Config, Context, Crypto, DateTime, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, LayerMap, Option, Path, Predicate, PubSub, Queue, Random, Ref, Result, Schedule, Schema, SchemaIssue, Scope, Semaphore, Stream, String as String$1 } from "effect";
-import { Message, Model, getEnvApiKey, llm, stream } from "@codeworksh/aikit";
+import { Message, Model, getEnvApiKey, llm, normalizeOptionalNulls, stream } from "@codeworksh/aikit";
 import { MessageID as ID, SessionID as ID$1 } from "@codeworksh/plugin/ids";
 import { Migrator, SqlClient, SqlClient as SqlClient$1, SqlError, SqlSchema, SqlSchema as SqlSchema$1 } from "effect/sql";
 import { uuidv7 } from "uuidv7";
 import { SqliteClient, SqliteMigrator } from "@effect/sql-sqlite-node";
 import * as os from "node:os";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { NodeChildProcessSpawner, NodeCrypto, NodeFileSystem, NodePath } from "@effect/platform-node";
 import { Model as Model$1, VariantSchema } from "effect/schema";
 import { Hex } from "effect/encoding";
@@ -25,6 +26,8 @@ import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworks
 import { JsonOpenAICodexAuthStorage, getOpenAICodexApiKey } from "@codeworksh/aikit/oauth/openai/codex";
 import { parse, printParseErrorCode } from "jsonc-parser";
 import * as Section from "@codeworksh/plugin/plugin/section";
+import * as Diff from "diff";
+import { FetchHttpClient, HttpClient } from "effect/http";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
 import { Script, constants } from "node:vm";
@@ -139,7 +142,7 @@ var global_exports = /* @__PURE__ */ __exportAll({
 	layer: () => layer$27,
 	layerWith: () => layerWith,
 	make: () => make$18,
-	resolve: () => resolve$3
+	resolve: () => resolve$4
 });
 const appConfigDir = ".codework";
 const app = "codework";
@@ -153,7 +156,8 @@ function make$18(input = {}) {
 		home,
 		cache: input.cache ?? posix.join(home, "cache"),
 		data: input.data ?? posix.join(home, "data"),
-		log: input.log ?? posix.join(home, "log")
+		log: input.log ?? posix.join(home, "log"),
+		bin: input.bin ?? posix.join(home, "bin")
 	};
 }
 /**
@@ -166,7 +170,7 @@ function make$18(input = {}) {
 * would be invisible to the other.
 */
 const authFile = (home) => home === void 0 ? void 0 : posix.join(home, "aikit", "auth.json");
-const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
+const resolve$4 = Effect.fn("Global.resolve")(function* (input = {}) {
 	const home = input.home === void 0 ? yield* homeConfig : expandHome(input.home);
 	return make$18({
 		...input,
@@ -174,7 +178,7 @@ const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
 	});
 });
 const build = (input) => Effect.gen(function* () {
-	const paths = yield* resolve$3(input);
+	const paths = yield* resolve$4(input);
 	yield* Effect.all([
 		fileSystem.makeDirectory(paths.cache, { recursive: true }),
 		fileSystem.makeDirectory(paths.data, { recursive: true }),
@@ -376,7 +380,7 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	defaultLayer: () => defaultLayer$1,
 	layer: () => layer$26,
 	locationConfig: () => locationConfig,
-	path: () => path$1,
+	path: () => path$2,
 	resolveDatabaseLocation: () => resolveDatabaseLocation
 });
 const setup = Effect.gen(function* () {
@@ -403,11 +407,11 @@ function resolveDatabaseLocation(configured, data) {
 	if (configured === ":memory:" || posix.isAbsolute(configured)) return configured;
 	return posix.join(data, configured);
 }
-const path$1 = Effect.fn("Database.path")(function* (data) {
-	const directory = data ?? (yield* resolve$3()).data;
+const path$2 = Effect.fn("Database.path")(function* (data) {
+	const directory = data ?? (yield* resolve$4()).data;
 	return resolveDatabaseLocation(yield* locationConfig, directory);
 });
-const defaultLayer$1 = Layer.unwrap(path$1().pipe(Effect.map(layer$26)));
+const defaultLayer$1 = Layer.unwrap(path$2().pipe(Effect.map(layer$26)));
 //#endregion
 //#region src/event/schema.ts
 var schema_exports$7 = /* @__PURE__ */ __exportAll({});
@@ -2665,6 +2669,7 @@ const toFileStat = (stats) => ({
 	size: stats.size,
 	mtime: stats.mtime
 });
+const SCAN_CHUNK = 65536;
 const bytes = (content) => typeof content === "string" ? Buffer$1.from(content, "utf8") : Buffer$1.from(content);
 /**
 * Provider factory method that implements the SandboxFileSytem
@@ -2676,6 +2681,8 @@ const make$17 = (vfs) => {
 		await vfs.promises.writeFile(path, bytes(content));
 	};
 	const readdir = async (path) => vfs.promises.readdir(path);
+	const open = (path) => new Promise((resolve, reject) => vfs.open(path, "r", (error, value) => error ? reject(error) : resolve(value)));
+	const close = (fd) => new Promise((resolve) => vfs.close(fd, () => resolve()));
 	const rm = async (path, options) => {
 		let stats;
 		try {
@@ -2715,7 +2722,36 @@ const make$17 = (vfs) => {
 			await vfs.promises.mkdir(path, options);
 		},
 		rm,
-		realpath: (path) => vfs.promises.realpath(path)
+		realpath: (path) => vfs.promises.realpath(path),
+		readBytes: async (path, offset, length) => {
+			const fd = await open(path);
+			try {
+				const buffer = Buffer$1.alloc(length);
+				const read = await new Promise((resolve, reject) => vfs.read(fd, buffer, 0, length, offset, (error, bytesRead) => error ? reject(error) : resolve(bytesRead)));
+				return new Uint8Array(buffer.subarray(0, read));
+			} finally {
+				await close(fd);
+			}
+		},
+		scanLines: async (path, options) => {
+			const scanner = new filesystem_exports.SandboxFileSystem.Scan.LineScanner(options);
+			const { size } = await vfs.promises.stat(path);
+			if (size === 0) return scanner.finish();
+			const fd = await open(path);
+			try {
+				const buffer = Buffer$1.alloc(Math.min(SCAN_CHUNK, size));
+				for (let position = 0; position < size;) {
+					const length = Math.min(buffer.length, size - position);
+					const read = await new Promise((resolve, reject) => vfs.read(fd, buffer, 0, length, position, (error, bytesRead) => error ? reject(error) : resolve(bytesRead)));
+					if (read === 0) break;
+					scanner.push(buffer.subarray(0, read));
+					position += read;
+				}
+			} finally {
+				await close(fd);
+			}
+			return scanner.finish();
+		}
 	};
 };
 /** The `SandboxFileSystem.Service` backed by the local {@link Vfs}. */
@@ -2843,10 +2879,12 @@ const layer$19 = (...drivers) => Layer.effect(Registry, make$16(drivers));
 //#endregion
 //#region src/sandbox/shell/host.ts
 const DEFAULT_SHELL = "sh";
+const DEFAULT_FORCE_KILL_AFTER = Duration.seconds(1);
 const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
-		const handle = yield* spawner.spawn(ChildProcess.make(file, [...args], {
+	const forceKillAfter = options.forceKillAfter ?? DEFAULT_FORCE_KILL_AFTER;
+	const spawn = (file, args, opts) => Effect.gen(function* () {
+		const spawned = yield* spawner.spawn(ChildProcess.make(file, [...args], {
 			cwd: opts?.cwd,
 			env: {
 				...options.env,
@@ -2857,6 +2895,32 @@ const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(
 			stdout: "pipe",
 			stderr: "pipe"
 		}));
+		let openPipes = 2;
+		const track = (stream) => stream.pipe(Stream.ensuring(Effect.sync(() => openPipes--)));
+		const output = {
+			stdout: track(spawned.stdout),
+			stderr: track(spawned.stderr)
+		};
+		yield* Effect.addFinalizer((exit) => Exit.isSuccess(exit) ? Effect.void : Effect.gen(function* () {
+			const running = yield* spawned.isRunning.pipe(Effect.orElseSucceed(() => false));
+			if (!running && openPipes === 0) return;
+			if (running) yield* spawned.kill({ killSignal: "SIGTERM" }).pipe(Effect.timeoutOption(forceKillAfter), Effect.flatMap(Option.match({
+				onSome: () => Effect.void,
+				onNone: () => spawned.kill({ killSignal: "SIGKILL" })
+			})), Effect.ignore);
+			yield* Effect.sync(() => {
+				try {
+					process.kill(-Number(spawned.pid), "SIGKILL");
+				} catch {}
+			});
+		}));
+		return {
+			exitCode: spawned.exitCode,
+			...output
+		};
+	});
+	const run = (label, file, args, opts) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawn(file, args, opts);
 		return yield* Effect.all({
 			exitCode: handle.exitCode,
 			stdout: handle.stdout.pipe(Stream.decodeText(), Stream.mkString),
@@ -2871,9 +2935,23 @@ const layer$18 = (options = {}) => Layer.effect(shell_exports.Shell, Effect.gen(
 		command: "",
 		cause: /* @__PURE__ */ new Error("execArgv requires a program")
 	})) : run(argv.join(" "), argv[0], argv.slice(1), opts));
+	const stream = (command, opts) => Stream.unwrap(Effect.map(spawn(options.shell ?? DEFAULT_SHELL, ["-c", command], opts), (handle) => Stream.concat(Stream.merge(handle.stdout.pipe(Stream.map((bytes) => ({
+		_tag: "stdout",
+		bytes
+	}))), handle.stderr.pipe(Stream.map((bytes) => ({
+		_tag: "stderr",
+		bytes
+	})))), Stream.fromEffect(Effect.map(handle.exitCode, (exitCode) => ({
+		_tag: "exit",
+		exitCode
+	})))))).pipe(Stream.mapError((cause) => new shell_exports.ShellError({
+		command,
+		cause
+	})));
 	return shell_exports.Shell.of({
 		exec,
-		execArgv
+		execArgv,
+		stream
 	});
 }));
 //#endregion
@@ -3258,7 +3336,8 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 			id,
 			driver: driver_exports.SandboxDriver.Name.make("local"),
 			kind: "local",
-			cwd: io_exports.SandboxIO.resolveMountCwd(hostDefaultCwd, mountOptions.cwd)
+			cwd: io_exports.SandboxIO.resolveMountCwd(hostDefaultCwd, mountOptions.cwd),
+			spillPath: io_exports.SandboxIO.DEFAULT_SPILL_PATH
 		};
 		else {
 			const row = yield* requireRow(id);
@@ -3280,7 +3359,8 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 				id,
 				driver: attached.driver.name,
 				kind: row.kind,
-				cwd: io_exports.SandboxIO.resolveMountCwd(attached.input.runtimeConfig.defaultCwd, mountOptions.cwd)
+				cwd: io_exports.SandboxIO.resolveMountCwd(attached.input.runtimeConfig.defaultCwd, mountOptions.cwd),
+				spillPath: attached.input.runtimeConfig.spillPath ?? io_exports.SandboxIO.DEFAULT_SPILL_PATH
 			};
 			const wasIdle = lease.held ? false : yield* gate.withPermits(1)(Effect.gen(function* () {
 				const latest = yield* requireRow(id);
@@ -3327,7 +3407,7 @@ const make$14 = Effect.fn("Sandbox.Controller.make")(function* (options) {
 						WHERE id = ${id}
 					`.pipe(Effect.orDie);
 		}
-		return Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.Current, identity), Layer.succeed(io_exports.SandboxIO.FileSystem, filesystem_exports.SandboxFileSystem.withCwd(fs, identity.cwd)), Layer.succeed(io_exports.SandboxIO.Shell, (0, shell_exports.withCwd)(shell, identity.cwd)));
+		return Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.Current, identity), Layer.succeed(io_exports.SandboxIO.FileSystem, filesystem_exports.SandboxFileSystem.withCwd(fs, identity.cwd)), Layer.succeed(io_exports.SandboxIO.Shell, (0, shell_exports.withCwd)(shell, identity.cwd))).pipe(io_exports.SandboxIO.withMutation);
 	}));
 	const mount = (id, mountOptions) => mountLayer(id, mountOptions);
 	const withMount = (id, use, mountOptions) => use.pipe(Effect.provide(mount(id, mountOptions)), Effect.scoped);
@@ -4277,7 +4357,7 @@ var Service$11 = class extends Context.Service()("@codeworksh/harness/repo/repo/
 * `.git` suffix and surrounding slashes stripped, scp form accepted.
 * `file:` urls and empty input yield undefined.
 */
-function normalize$2(url) {
+function normalize$3(url) {
 	const value = url.trim();
 	if (!value) return void 0;
 	try {
@@ -4319,7 +4399,7 @@ const layer$14 = Layer.effect(Service$11, Effect.gen(function* () {
 		const marker = posix.join(repo.store, MARKER$1);
 		const pinned = (yield* readFileSafe(fs, marker))?.trim() || void 0;
 		const url = yield* git.remote(repo.directory);
-		const normalized = url === void 0 ? void 0 : normalize$2(url);
+		const normalized = url === void 0 ? void 0 : normalize$3(url);
 		const remote = normalized === void 0 ? void 0 : {
 			id: fast(`git:${normalized}`),
 			name: posix.basename(normalized)
@@ -5090,7 +5170,7 @@ function merge(base, ...patches) {
 	return Object.fromEntries(result);
 }
 /** Normalize nullable properties before schema validation, without changing array positions. */
-const normalize$1 = copy;
+const normalize$2 = copy;
 //#endregion
 //#region src/settings/settings.ts
 var settings_exports = /* @__PURE__ */ __exportAll({
@@ -5101,7 +5181,7 @@ var settings_exports = /* @__PURE__ */ __exportAll({
 	layer: () => layer$8,
 	load: () => load$3,
 	modules: () => modules,
-	parse: () => parse$2,
+	parse: () => parse$4,
 	paths: () => paths,
 	projectRoot: () => projectRoot,
 	userConfigDir: () => userConfigDir
@@ -5115,7 +5195,7 @@ const userConfigDir = (raw, hostCwd) => hostPath.resolve(hostCwd, expandTilde(ra
 /** The settings files a directory may hold, in the order it is searched. */
 const settingsIn = (directory) => [hostPath.join(directory, "settings.jsonc"), hostPath.join(directory, "settings.json")];
 /** A directory and every ancestor above it, nearest first. */
-const ancestors = (from) => {
+const ancestors$1 = (from) => {
 	const chain = [];
 	for (let directory = from;; directory = hostPath.dirname(directory)) {
 		chain.push(directory);
@@ -5141,7 +5221,7 @@ const isDirectory = (path) => fileSystem.stat(path).pipe(Effect.map((info) => in
 */
 const projectRoot = Effect.fn("Settings.projectRoot")(function* (from, home) {
 	const userConfig = hostPath.resolve(home);
-	for (const directory of ancestors(hostPath.resolve(from))) {
+	for (const directory of ancestors$1(hostPath.resolve(from))) {
 		const marker = hostPath.join(directory, appConfigDir);
 		if (hostPath.resolve(marker) === userConfig) continue;
 		if (yield* isDirectory(marker)) return directory;
@@ -5190,7 +5270,7 @@ const decodeFormatter = SchemaIssue.makeFormatterStandardSchemaV1({ leafHook: (i
 	const message = "annotations" in issue ? issue.annotations?.message : void 0;
 	return typeof message === "string" ? message.replaceAll(/\s*\n\s*/g, " ") : "invalid value";
 } });
-const parse$2 = Effect.fn("Settings.parse")(function* (path, source) {
+const parse$4 = Effect.fn("Settings.parse")(function* (path, source) {
 	const errors = [];
 	const json = parse(source, errors, {
 		allowTrailingComma: true,
@@ -5202,7 +5282,7 @@ const parse$2 = Effect.fn("Settings.parse")(function* (path, source) {
 		reason: "parse",
 		detail: `${printParseErrorCode(first.error)} at ${at(source, first.offset)}`
 	});
-	const document = normalize$1(json);
+	const document = normalize$2(json);
 	if (Predicate.isObject(document) && Predicate.isObject(json) && "plugins" in json) Object.assign(document, { plugins: json.plugins });
 	return yield* Schema.decodeUnknownEffect(schema_exports$3.Patch)(document).pipe(Effect.mapError((error) => new SettingsError({
 		path,
@@ -5238,7 +5318,7 @@ const attempt = (path) => fileSystem.readFileString(path).pipe(Effect.mapError((
 	path,
 	reason: "read",
 	detail: error.reason._tag
-})), Effect.flatMap((source) => parse$2(path, source)));
+})), Effect.flatMap((source) => parse$4(path, source)));
 /**
 * One read of every layer. Exported for the harness constructor, which needs the plugin
 * selection before any layer is built; everything else goes through `Service`.
@@ -5308,7 +5388,7 @@ var catalog_exports = /* @__PURE__ */ __exportAll({
 	Credentials: () => Credentials,
 	ModelCatalog: () => catalog_exports,
 	RefreshError: () => RefreshError,
-	available: () => available,
+	available: () => available$1,
 	effective: () => effective,
 	entry: () => entry,
 	filename: () => filename,
@@ -5489,7 +5569,7 @@ const oauthProtocols = /* @__PURE__ */ new Set(["openai-codex", "github-copilot"
 * Presence, not validity: nothing is sent over the network, so a revoked key still counts. A
 * client showing a model picker should still add the session's current model.
 */
-const available = Effect.fn("ModelCatalog.available")(function* (filter = {}) {
+const available$1 = Effect.fn("ModelCatalog.available")(function* (filter = {}) {
 	const { authFile } = yield* Credentials;
 	const settings = yield* Service$3;
 	const catalog = yield* effective((yield* settings.load(filter.hostDir)).models);
@@ -5558,11 +5638,25 @@ const content = (raw) => {
 	const text = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
 	return text.trim().length === 0 ? void 0 : text;
 };
-const first = Effect.fnUntraced(function* (fs, directory) {
+/** `directory` and every ancestor up to the sandbox root, closest first. */
+const ancestors = (directory) => {
+	const chain = [];
+	for (let current = directory;; current = posix.dirname(current)) {
+		chain.push(current);
+		if (posix.dirname(current) === current) return chain;
+	}
+};
+/**
+* Which of `paths` are files. Absence is the expected answer and stays silent; any other failure
+* (permissions, a remote blip) is logged so a dropped file is not a mystery, then counts as absent.
+*/
+const present$1 = (fs, paths) => Effect.forEach(paths, (path) => fs.stat(path).pipe(Effect.map((stat) => stat.isFile), Effect.catch((error) => filesystem_exports.SandboxFileSystem.isNotFoundError(error.cause) ? Effect.succeed(false) : Effect.logWarning(`could not stat instruction file ${path}`, error.cause).pipe(Effect.as(false)))), { concurrency: "unbounded" }).pipe(Effect.map((hits) => new Set(paths.filter((_, index) => hits[index]))));
+/** A file that stats but does not read falls through to the next candidate. */
+const first = Effect.fnUntraced(function* (fs, directory, files) {
 	for (const name of names) {
 		const path = posix.join(directory, name);
-		if (!(yield* fs.stat(path).pipe(Effect.map((stat) => stat.isFile), Effect.orElseSucceed(() => false)))) continue;
-		const raw = yield* fs.readFile(path).pipe(Effect.tapError((cause) => Effect.logWarning(`could not read instruction file ${path}`, cause)), Effect.option);
+		if (!files.has(path)) continue;
+		const raw = yield* fs.readFile(path).pipe(Effect.tapError((error) => Effect.logWarning(`could not read instruction file ${path}`, error.cause)), Effect.option);
 		if (Option.isSome(raw)) return {
 			name,
 			path,
@@ -5583,29 +5677,26 @@ const shadowing = (location) => {
 	const main = posix.dirname(store);
 	return location.space.location.startsWith(`${main}/`) ? main : void 0;
 };
+/** One file per directory from the sandbox root down to the cwd, closest last so it has the final word. */
+const discover = Effect.fnUntraced(function* (fs, location) {
+	const chain = ancestors(location.directory);
+	const files = yield* present$1(fs, chain.flatMap((directory) => names.map((name) => posix.join(directory, name))));
+	const found = yield* Effect.forEach(chain, (directory) => first(fs, directory, files), { concurrency: "unbounded" });
+	const main = shadowing(location);
+	const worktree = main === void 0 ? void 0 : found[chain.indexOf(location.space.location)];
+	const walked = [];
+	for (const [index, here] of found.entries()) {
+		const shadowed = chain[index] === main && worktree !== void 0 && here?.name === worktree.name;
+		if (here !== void 0 && !shadowed) walked.push(here);
+	}
+	return walked.reverse();
+});
 const instructionPlugin = (0, plugin_exports$1.define)({
 	id: "codework.prompt.instruction",
 	kind: "prompt",
 	setup: Effect.fn("InstructionPlugin.setup")(function* (ctx) {
 		const fs = yield* io_exports.SandboxIO.FileSystem;
-		const probed = /* @__PURE__ */ new Map();
-		const at = Effect.fnUntraced(function* (directory) {
-			if (!probed.has(directory)) probed.set(directory, yield* first(fs, directory));
-			return probed.get(directory);
-		});
-		const walked = [];
-		const main = shadowing(ctx.location);
-		const worktree = main === void 0 ? void 0 : yield* at(ctx.location.space.location);
-		let current = ctx.location.directory;
-		while (true) {
-			const here = yield* at(current);
-			const shadowed = current === main && worktree !== void 0 && here?.name === worktree.name;
-			if (here !== void 0 && !shadowed) walked.push(here);
-			const parent = posix.dirname(current);
-			if (parent === current) break;
-			current = parent;
-		}
-		const files = walked.reverse().filter((file) => file.content !== void 0);
+		const files = (yield* discover(fs, ctx.location)).filter((file) => file.content !== void 0);
 		if (files.length === 0) return;
 		const prompt = ctx.plugin.prompt;
 		prompt.sections.append(Section.ProjectContext, "Project-Specific Instructions & Guidelines:");
@@ -5626,6 +5717,17 @@ const instructionPlugin = (0, plugin_exports$1.define)({
 */
 const DEFAULT_MAX_LINES = 2e3;
 const DEFAULT_MAX_BYTES = 51200;
+/** Cut one line to `maxChars`, marking the cut. */
+function truncateLine(line, maxChars = 500) {
+	if (line.length <= maxChars) return {
+		text: line,
+		wasTruncated: false
+	};
+	return {
+		text: `${line.slice(0, maxChars)}... [truncated]`,
+		wasTruncated: true
+	};
+}
 function splitLinesForCounting(content) {
 	if (content.length === 0) return [];
 	const lines = content.split("\n");
@@ -5639,6 +5741,74 @@ function formatSize(bytes) {
 	return `${(bytes / 1048576).toFixed(1)}MB`;
 }
 /**
+* Truncate content from the head (keep the first N lines/bytes). Suitable for
+* file reads where the beginning matters. Never returns partial lines; if the
+* first line alone exceeds the byte limit, returns empty content with
+* `firstLineExceedsLimit = true`.
+*/
+function truncateHead(content, options = {}) {
+	const maxLines = options.maxLines ?? 2e3;
+	const maxBytes = options.maxBytes ?? 51200;
+	const totalBytes = Buffer.byteLength(content, "utf-8");
+	const lines = splitLinesForCounting(content);
+	const totalLines = lines.length;
+	if (totalLines <= maxLines && totalBytes <= maxBytes) return {
+		content,
+		truncated: false,
+		truncatedBy: null,
+		totalLines,
+		totalBytes,
+		outputLines: totalLines,
+		outputBytes: totalBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+	if (Buffer.byteLength(lines[0] ?? "", "utf-8") > maxBytes) return {
+		content: "",
+		truncated: true,
+		truncatedBy: "bytes",
+		totalLines,
+		totalBytes,
+		outputLines: 0,
+		outputBytes: 0,
+		lastLinePartial: false,
+		firstLineExceedsLimit: true,
+		maxLines,
+		maxBytes
+	};
+	const outputLinesArr = [];
+	let outputBytesCount = 0;
+	let truncatedBy = "lines";
+	for (let i = 0; i < lines.length && i < maxLines; i++) {
+		const line = lines[i] ?? "";
+		const lineBytes = Buffer.byteLength(line, "utf-8") + (i > 0 ? 1 : 0);
+		if (outputBytesCount + lineBytes > maxBytes) {
+			truncatedBy = "bytes";
+			break;
+		}
+		outputLinesArr.push(line);
+		outputBytesCount += lineBytes;
+	}
+	if (outputLinesArr.length >= maxLines && outputBytesCount <= maxBytes) truncatedBy = "lines";
+	const outputContent = outputLinesArr.join("\n");
+	const finalOutputBytes = Buffer.byteLength(outputContent, "utf-8");
+	return {
+		content: outputContent,
+		truncated: true,
+		truncatedBy,
+		totalLines,
+		totalBytes,
+		outputLines: outputLinesArr.length,
+		outputBytes: finalOutputBytes,
+		lastLinePartial: false,
+		firstLineExceedsLimit: false,
+		maxLines,
+		maxBytes
+	};
+}
+/**
 * Truncate content from the tail (keep the last N lines/bytes). Suitable for
 * bash output where the end matters (errors, final results). May return a
 * partial first line if the last line of the original content exceeds the byte
@@ -5713,9 +5883,6 @@ function truncateStringToBytesFromEnd(str, maxBytes) {
 }
 //#endregion
 //#region src/tool/accumulator.ts
-function defaultTempFilePath(prefix, suffix) {
-	return posix.join(tmpdir(), `${prefix}-${suffix}.log`);
-}
 function byteLength(text) {
 	return Buffer.byteLength(text, "utf-8");
 }
@@ -5723,9 +5890,7 @@ var Accumulator = class {
 	maxLines;
 	maxBytes;
 	maxRollingBytes;
-	tempFilePrefix;
 	decoder = new TextDecoder();
-	rawChunks = [];
 	tailText = "";
 	tailBytes = 0;
 	tailStartsAtLineBoundary = true;
@@ -5736,45 +5901,43 @@ var Accumulator = class {
 	currentLineBytes = 0;
 	hasOpenLine = false;
 	finished = false;
-	tempFilePath;
-	tempFile;
 	constructor(options = {}) {
 		this.maxLines = options.maxLines ?? 2e3;
 		this.maxBytes = options.maxBytes ?? 51200;
 		this.maxRollingBytes = Math.max(this.maxBytes * 2, 1);
-		this.tempFilePrefix = options.tempFilePrefix ?? "codework-output";
-	}
-	append(data) {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.die(/* @__PURE__ */ new Error("cannot append to a finished output accumulator"));
-			this.totalRawBytes += data.length;
-			this.appendDecodedText(this.decoder.decode(data, { stream: true }));
-			if (this.tempFile !== void 0 || this.shouldUseTempFile()) return Effect.gen({ self: this }, function* () {
-				yield* this.ensureTempFile();
-				yield* this.tempFile.writeAll(data).pipe(Effect.orDie);
-			});
-			if (data.length > 0) this.rawChunks.push(data);
-			return Effect.void;
-		});
+	}
+	/** `rawBytes` is what `data` measured before a backend decoded it, when that differs. */
+	append(data, rawBytes = data.length) {
+		if (this.finished) throw new Error("cannot append to a finished output accumulator");
+		this.totalRawBytes += rawBytes;
+		this.appendDecodedText(this.decoder.decode(data, { stream: true }));
+	}
+	/**
+	* Count output that was produced but not delivered — the start of the output,
+	* before anything is appended. Unless it is known to end a line, the first
+	* appended line is treated as partial and left out of snapshots.
+	*/
+	skip(bytes, newlines, endsLine) {
+		if (bytes <= 0) return;
+		this.totalRawBytes += bytes;
+		this.totalDecodedBytes += bytes;
+		this.completedLines += newlines;
+		this.totalLines = this.completedLines;
+		this.tailStartsAtLineBoundary = endsLine;
 	}
 	finish() {
-		return Effect.suspend(() => {
-			if (this.finished) return Effect.void;
-			this.finished = true;
-			this.appendDecodedText(this.decoder.decode());
-			return Effect.gen({ self: this }, function* () {
-				if (this.shouldUseTempFile()) yield* this.ensureTempFile();
-				if (this.tempFile !== void 0) yield* this.tempFile.sync.pipe(Effect.orDie);
-			});
-		});
+		if (this.finished) return;
+		this.finished = true;
+		this.appendDecodedText(this.decoder.decode());
 	}
 	snapshot() {
 		const tailTruncation = truncateTail(this.getSnapshotText(), {
 			maxLines: this.maxLines,
 			maxBytes: this.maxBytes
 		});
-		const truncated = this.totalLines > this.maxLines || this.totalDecodedBytes > this.maxBytes;
-		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalDecodedBytes > this.maxBytes ? "bytes" : "lines") : null;
+		const beyondLimits = this.totalLines > this.maxLines || this.totalRawBytes > this.maxBytes;
+		const truncated = beyondLimits || tailTruncation.truncated;
+		const truncatedBy = truncated ? tailTruncation.truncatedBy ?? (this.totalRawBytes > this.maxBytes ? "bytes" : "lines") : null;
 		const truncation = {
 			...tailTruncation,
 			truncated,
@@ -5787,7 +5950,7 @@ var Accumulator = class {
 		return {
 			content: truncation.content,
 			truncation,
-			...this.tempFilePath === void 0 ? {} : { fullOutputPath: this.tempFilePath }
+			beyondLimits
 		};
 	}
 	/** Bytes in the final (possibly unterminated) line — for the partial-line footer. */
@@ -5833,23 +5996,111 @@ var Accumulator = class {
 	getSnapshotText() {
 		if (this.tailStartsAtLineBoundary) return this.tailText;
 		const firstNewline = this.tailText.indexOf("\n");
-		return firstNewline === -1 ? this.tailText : this.tailText.slice(firstNewline + 1);
-	}
-	shouldUseTempFile() {
-		return this.totalRawBytes > this.maxBytes || this.totalDecodedBytes > this.maxBytes || this.totalLines > this.maxLines;
-	}
-	ensureTempFile() {
-		if (this.tempFile !== void 0) return Effect.void;
-		return Effect.gen({ self: this }, function* () {
-			const suffix = Hex.encode(yield* crypto.randomBytes(8));
-			this.tempFilePath = defaultTempFilePath(this.tempFilePrefix, suffix);
-			this.tempFile = yield* fileSystem.open(this.tempFilePath, { flag: "w" });
-			for (const chunk of this.rawChunks) yield* this.tempFile.writeAll(chunk);
-			this.rawChunks = [];
-		}).pipe(Effect.orDie);
+		return firstNewline === -1 || firstNewline === this.tailText.length - 1 ? this.tailText : this.tailText.slice(firstNewline + 1);
 	}
 };
 //#endregion
+//#region src/tool/output.ts
+/** A new, unused output file path under `spillPath`. */
+const path$1 = (spillPath, prefix) => crypto.randomBytes(8).pipe(Effect.map((bytes) => posix.join(spillPath, `${prefix}-${Hex.encode(bytes)}.log`)), Effect.orDie);
+/** First line printed when the output file cannot be created; the command then runs unsaved. */
+const unsaved = (file) => `codework: output not saved, cannot create ${file}`;
+const HEADER = "codework-output";
+/** Twice the byte limit leaves room to find where the shown lines start. */
+const windowBytes = (limits) => limits.maxBytes * 2;
+/**
+* The wrapper. The command's combined output goes through `pipeline` into the
+* file; the file's size then decides whether it is kept, and `report` lines run
+* before an unkept file is removed.
+*/
+const script = (command, file, limits, pipeline, report) => [
+	`f=${(0, shell_exports.quote)(file)}`,
+	"run() (",
+	command,
+	")",
+	`if mkdir -p ${(0, shell_exports.quote)(posix.dirname(file))} 2>/dev/null && (umask 077 2>/dev/null; set -C && : > "$f" && : > "$f.rc" && : > "$f.pid") 2>/dev/null; then`,
+	"	echo \"$$ $(ps -o pgid= -p $$ 2>/dev/null)\" > \"$f.pid\"",
+	`\t${pipeline("{ run 2>&1; echo $? > \"$f.rc\"; }")}`,
+	"	rc=$(cat \"$f.rc\" 2>/dev/null); rm -f \"$f.rc\"",
+	`\tb=$(wc -c "$f" | awk '{ print $1 }'); n=$(wc -l "$f" | awk '{ print $1 }'); l=$n`,
+	`\t[ -s "$f" ] && [ "$(tail -c 1 "$f" | wc -l | awk '{ print $1 }')" = 0 ] && l=$((l + 1))`,
+	`\tkeep=0; { [ "$b" -gt ${limits.maxBytes} ] || [ "$l" -gt ${limits.maxLines} ]; } && keep=1`,
+	...report.map((line) => `\t${line}`),
+	"	[ \"$keep\" = 1 ] || rm -f \"$f\"",
+	"	rm -f \"$f.pid\"; exit \"${rc:-1}\"",
+	"fi",
+	"rm -f \"$f\" \"$f.rc\" \"$f.pid\" 2>/dev/null",
+	`printf '%s\\n' ${(0, shell_exports.quote)(unsaved(file))}`,
+	"run 2>&1"
+].join("\n");
+const header = new RegExp(`^${HEADER} (\\d+) (\\d+) ([01])(?: (\\d+))?$`, "m");
+const parse$3 = (match) => ({
+	bytes: Number(match[1]),
+	newlines: Number(match[2]),
+	kept: match[3] === "1"
+});
+/**
+* For a backend that streams: all output still flows back as it is produced, and
+* a copy lands in the file. The report rides on stderr, the wrapper's own channel
+* since the command's is folded into stdout.
+*/
+const streaming = (command, file, limits) => script(command, file, limits, (source) => `${source} | tee -a "$f"`, [`printf '${HEADER} %s %s %s\\n' "$b" "$n" "$keep" >&2`]);
+/** Read {@link streaming}'s stderr: the report, if it got that far, and anything else the wrapper said. */
+const report = (stderr) => {
+	const match = header.exec(stderr);
+	if (match === null) return {
+		report: void 0,
+		rest: stderr
+	};
+	return {
+		report: parse$3(match),
+		rest: stderr.slice(0, match.index) + stderr.slice(match.index + match[0].length).replace(/^\n/, "")
+	};
+};
+/**
+* For a backend that returns output only at the end: the output goes to the
+* file, and only a header — the report plus the window's raw size — and a tail
+* window come back. The bytes before the window are skipped, and counted.
+*/
+const buffered = (command, file, limits) => {
+	const tail = `tail -n ${limits.maxLines} "$f" | tail -c ${windowBytes(limits)}`;
+	return script(command, file, limits, (source) => `{ ${source} | cat; } >> "$f"`, [
+		`w=$(${tail} | wc -c | awk '{ print $1 }')`,
+		`printf '${HEADER} %s %s %s %s\\n' "$b" "$n" "$keep" "$w"`,
+		tail
+	]);
+};
+/** Read {@link buffered}'s result; `undefined` when the output was not saved and came back whole. */
+const window = (stdout) => {
+	const newline = stdout.indexOf("\n");
+	const match = header.exec(newline === -1 ? stdout : stdout.slice(0, newline));
+	if (match === null || match[4] === void 0) return void 0;
+	return {
+		...parse$3(match),
+		text: stdout.slice(newline + 1),
+		textBytes: Number(match[4])
+	};
+};
+/**
+* After a deadline or an interrupt the wrapper never reaches its own cleanup.
+* Kill what it started — its process group when it led one, else its process
+* tree, whole while the wrapper itself still runs — and remove the side files,
+* and the output file unless `keep`.
+*/
+const cleanup = (file, keep) => [
+	`f=${(0, shell_exports.quote)(file)}`,
+	"set -- $(cat \"$f.pid\" 2>/dev/null)",
+	`tree() { echo "$1"; for c in $(ps -A -o pid= -o ppid= 2>/dev/null | awk -v p="$1" '$2 == p { print $1 }'); do tree "$c"; done; }`,
+	"if [ -n \"${1:-}\" ]; then",
+	"	pids=$(tree \"$1\")",
+	"	[ \"${2:-$1}\" = \"$1\" ] && kill -s KILL -- \"-$1\" 2>/dev/null",
+	"	kill -9 $pids 2>/dev/null",
+	"fi",
+	`rm -f -- ${keep ? "\"$f.rc\" \"$f.pid\"" : "\"$f\" \"$f.rc\" \"$f.pid\""}`
+].join("\n");
+/** Remove an output file that {@link cleanup} kept. */
+const remove$1 = (file) => `rm -f -- ${(0, shell_exports.quote)(file)}`;
+//#endregion
 //#region src/tool/progress.ts
 var progress_exports = /* @__PURE__ */ __exportAll({});
 import * as import__codeworksh_plugin_tool_progress from "@codeworksh/plugin/tool/progress";
@@ -5859,16 +6110,11 @@ __reExport(progress_exports, import__codeworksh_plugin_tool_progress);
 /**
 * `ToolShell` — the tool-owned, cancellable command-execution capability the bash tool depends on.
 *
-* It deliberately does **not** reuse `sandbox/Shell` directly: the local OS path
-* provides no `Shell` at all, and `sandbox/Shell` models neither cancellation
-* nor a timeout. `ToolShell` makes both part of the contract. Adapters honor the
-* mid-flight process kill where the SDK allows it (local, Vercel) and fall back
-* to the timeout where it does not (Daytona) — "kill where it's easy".
-*
-* Two modes, and Local has two variants:
-*   - Local / full OS shell  → {@link local} (default)
-*   - Local / just-bash      → {@link fromSandboxShell} over `EnvBash`
-*   - Remote / provider      → {@link fromSandboxShell} over `EnvDaytona` / `EnvVercel`
+* It deliberately does **not** reuse `sandbox/Shell` directly: `sandbox/Shell`
+* models no timeout, and `ToolShell` makes it part of the contract. Every
+* backend reaches it through {@link fromSandboxShell}; the process dies
+* mid-flight where the backend can kill it (host, Vercel) and the call returns
+* at the deadline either way.
 */
 /** Infra/spawn failure — not model-actionable; handlers should treat it as a defect. */
 var ToolShellError = class extends Schema.TaggedError()("ToolShellError", {
@@ -5923,6 +6169,7 @@ const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
 		exitCode: chunk.exitCode
 	} : {
 		_tag: "Output",
+		channel: chunk._tag,
 		bytes: chunk.bytes
 	}), Stream.mapError((cause) => new ToolShellError({
 		command,
@@ -5933,7 +6180,6 @@ const fromSandboxShell = Layer.effect(ToolShell, Effect.gen(function* () {
 		stream
 	} : { exec });
 }));
-Duration.seconds(1);
 //#endregion
 //#region src/tool/tool.ts
 var tool_exports = /* @__PURE__ */ __exportAll({});
@@ -5943,28 +6189,32 @@ __reExport(tool_exports, import__codeworksh_plugin_tool);
 //#region src/plugin/builtin/tool/bash.ts
 /**
 * The self-contained bash plugin — a worked example for tool plugins. The definition is pure data;
-* the handler depends only on {@link ToolShell} / {@link ToolProgress}, never
-* `sandbox/Shell`, so the backend (local OS / just-bash / remote provider) is
-* swapped by changing the provided Layer with no change to the tool.
+* the handler depends only on {@link ToolShell} / {@link ToolProgress} and the mount's
+* {@link SandboxIO.Current}, never `sandbox/Shell`, so the backend (host / just-bash / remote
+* provider) is swapped by changing the provided Layer with no change to the tool.
 *
-* Two execution paths, picked by capability:
-*   - **variant A (buffered)** otherwise: `ToolShell.exec` returns the full output,
-*     truncated once after completion.
-*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output
-*     flows through an {@link Accumulator} (bounded memory + temp-file spill)
-*     and is reported live via {@link ToolProgress}; on timeout the partial output
-*     produced so far is preserved.
+* The command runs wrapped (`Output`) so its full output is written to a file inside the sandbox,
+* kept only when it exceeds the display limits. Two paths, picked by capability:
+*   - **variant A (buffered)** otherwise: the sandbox returns only the tail of the output with its
+*     size, so a huge output never crosses to the harness.
+*   - **variant B (streaming)** when the backend offers `ToolShell.stream`: output flows through
+*     an {@link Accumulator} (bounded memory) and is reported live via {@link ToolProgress}; on
+*     timeout the partial output produced so far is preserved.
 *
 * Success and failure carry the *same* structured shape
 * (`output`, `exitCode`, `truncated`, `fullOutputPath`)
 * — a non-zero exit is just `exitCode !== 0`, not a different kind of result.
 */
+const limits = {
+	maxLines: DEFAULT_MAX_LINES,
+	maxBytes: DEFAULT_MAX_BYTES
+};
 const BashParams = Schema.Struct({
 	command: Schema.String.annotate({ description: "The bash command to execute." }),
 	timeout: Schema.optional(Schema.Finite.check(Schema.isGreaterThan(0)).annotate({ description: "Optional timeout in seconds (must be greater than 0)." }))
 });
 const outputFields = {
-	/** Combined stdout + stderr, truncated for display (full output is on disk when `truncated`). */
+	/** Combined stdout + stderr, truncated for display (full output is in the sandbox when `truncated`). */
 	output: Schema.String,
 	truncated: Schema.Boolean,
 	fullOutputPath: Schema.optional(Schema.String)
@@ -5984,21 +6234,30 @@ var BashTimedOut = class extends Schema.TaggedError()("BashTimedOut", {
 	timeoutSeconds: Schema.Finite
 }) {};
 const BashFailure = Schema.Union([BashFailed, BashTimedOut]);
+/** The reason for a failure, after any output: the model sees nothing else of `details`. */
+const withStatus = (failure) => {
+	const status = failure._tag === "BashTimedOut" ? `Command timed out after ${failure.timeoutSeconds} seconds` : failure.exitCode === -1 ? "Command terminated without an exit code" : `Command exited with code ${failure.exitCode}`;
+	return failure.output ? `${failure.output.replace(/\n$/, "")}\n\n${status}` : status;
+};
 const bashDef = tool_exports.define({
 	name: "bash",
 	label: "bash",
 	promptSnippet: "Execute bash commands (ls, grep, find, etc.).",
-	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES}KB (whichever is hit first); when truncated, the full output is saved to a temp file. A non-zero exit code is reported as an error carrying the captured output.`,
+	description: `Execute a bash command in the working directory and return its combined stdout/stderr output. Output is truncated to the last ${DEFAULT_MAX_LINES} lines or ${formatSize(DEFAULT_MAX_BYTES)} (whichever is hit first); when truncated, a note says which lines are shown and gives the path of a file holding the full output when one was saved. A non-zero exit code is reported as an error carrying the captured output.`,
 	parameters: BashParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
 	success: BashSuccess,
 	failure: BashFailure,
 	encodeContent: (success) => [{
 		type: "text",
-		text: success.output
+		text: success.output || "(no output)"
 	}],
 	encodeFailureContent: (failure) => [{
 		type: "text",
-		text: failure.output
+		text: withStatus(failure)
 	}]
 });
 /** Combine stdout and stderr into one stream of text, stderr after stdout. */
@@ -6018,66 +6277,78 @@ const footer = (t, fullOutputPath, lastLineBytes) => {
 	if (t.truncatedBy === "lines") return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines}.${where}]`;
 	return `\n\n[showing lines ${startLine}-${t.totalLines} of ${t.totalLines} (${formatSize(t.maxBytes)} limit).${where}]`;
 };
-/** Write full output to a host temp file (best-effort; undefined on failure). */
-const spillToTempFile = (content) => Effect.gen(function* () {
-	const suffix = Hex.encode(yield* crypto.randomBytes(6));
-	const path = posix.join(tmpdir(), `codework-bash-${suffix}.log`);
-	yield* fileSystem.writeFileString(path, content);
-	return path;
-}).pipe(Effect.orElseSucceed(() => void 0));
-/** Variant A: truncate the buffered output once, spilling the full output if truncated. */
-const presentBuffered = (combined) => Effect.gen(function* () {
-	const t = truncateTail(combined);
-	if (!t.truncated) return {
-		output: t.content,
-		truncated: false
-	};
-	const fullOutputPath = yield* spillToTempFile(combined);
-	return {
-		output: t.content + footer(t, fullOutputPath),
-		truncated: true,
-		...fullOutputPath !== void 0 ? { fullOutputPath } : {}
-	};
-});
-/** Variant B: present an accumulator snapshot (the temp file is spilled incrementally). */
-const presentSnapshot = (snap, lastLineBytes) => {
+/** Present a snapshot; `saved` is the output file, when the sandbox kept one. */
+const present = (snap, lastLineBytes, saved) => {
 	if (!snap.truncation.truncated) return {
 		output: snap.content,
 		truncated: false
 	};
 	return {
-		output: snap.content + footer(snap.truncation, snap.fullOutputPath, lastLineBytes),
+		output: snap.content.replace(/\n$/, "") + footer(snap.truncation, saved, lastLineBytes),
 		truncated: true,
-		...snap.fullOutputPath !== void 0 ? { fullOutputPath: snap.fullOutputPath } : {}
+		...saved !== void 0 ? { fullOutputPath: saved } : {}
 	};
 };
-/** Variant A — buffered: one `exec`, truncate after completion. No live progress. */
-const runBuffered = (shell, params) => Effect.gen(function* () {
-	const result = yield* shell.exec(params.command, params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
-		ToolShellTimeout: (timeout) => Effect.fail(new BashTimedOut({
+const utf8 = new TextEncoder();
+/**
+* A command cut off by its deadline never reached the wrapper's own cleanup: kill
+* what is left of it and remove its side files, keeping the output file only when
+* the result points at it.
+*/
+const cleanUp = (shell, file, presented) => sweep(shell, cleanup(file, presented.fullOutputPath !== void 0));
+/** Best-effort housekeeping script: bounded, and never a failure of the tool. */
+const sweep = (shell, script) => shell.exec(script, { timeout: Duration.seconds(5) }).pipe(Effect.ignore);
+/** Variant A — buffered: one `exec` that returns the tail of the output and its size. No live progress. */
+const runBuffered = (shell, params, file) => Effect.gen(function* () {
+	const result = yield* shell.exec(buffered(params.command, file, limits), params.timeout !== void 0 ? { timeout: Duration.seconds(params.timeout) } : void 0).pipe(Effect.catchTags({
+		ToolShellTimeout: (timeout) => cleanUp(shell, file, {
+			output: "",
+			truncated: false
+		}).pipe(Effect.andThen(Effect.fail(new BashTimedOut({
 			timeoutSeconds: timeout.timeoutMillis / 1e3,
 			output: "",
 			truncated: false
-		})),
+		})))),
 		ToolShellError: (cause) => Effect.die(cause)
 	}));
-	const present = yield* presentBuffered(combineOutput(result.stdout, result.stderr));
+	const acc = new Accumulator(limits);
+	const combined = combineOutput(result.stdout, result.stderr);
+	const window$1 = window(combined);
+	if (window$1 === void 0) acc.append(utf8.encode(combined));
+	else {
+		acc.skip(window$1.bytes - window$1.textBytes, window$1.newlines - countNewlines(window$1.text), window$1.textBytes < windowBytes(limits));
+		acc.append(utf8.encode(window$1.text), window$1.textBytes);
+	}
+	acc.finish();
+	const presented = present(acc.snapshot(), acc.getLastLineBytes(), window$1?.kept === true ? file : void 0);
 	if (result.exitCode !== 0) return yield* new BashFailed({
 		exitCode: result.exitCode,
-		...present
+		...presented
 	});
 	return {
 		exitCode: result.exitCode,
-		...present
+		...presented
 	};
 });
+const countNewlines = (text) => {
+	let count = 0;
+	for (let index = text.indexOf("\n"); index !== -1; index = text.indexOf("\n", index + 1)) count++;
+	return count;
+};
 /** Variant B — streaming: accumulate output, report progress, keep partial output on timeout. */
-const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
-	const acc = new Accumulator({ tempFilePrefix: "codework-bash" });
+const runStreaming = (shell, stream, params, file) => Effect.gen(function* () {
+	const acc = new Accumulator(limits);
 	const progress = yield* progress_exports.ToolProgress;
 	const exitCode = yield* Ref.make(null);
-	const consume = stream(params.command).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : Effect.gen(function* () {
-		yield* acc.append(Buffer.from(event.bytes));
+	const notice = unsaved(file);
+	let head = "";
+	const control = new TextDecoder();
+	let said = "";
+	const consume = stream(streaming(params.command, file, limits)).pipe(Stream.runForEach((event) => event._tag === "Exit" ? Ref.set(exitCode, event.exitCode) : event.channel === "stderr" ? Effect.sync(() => {
+		said += control.decode(event.bytes, { stream: true });
+	}) : Effect.gen(function* () {
+		if (head.length < notice.length) head += new TextDecoder().decode(event.bytes.slice(0, notice.length));
+		acc.append(event.bytes);
 		yield* progress.report({ content: [{
 			type: "text",
 			text: acc.snapshot().content
@@ -6085,28 +6356,45 @@ const runStreaming = (stream, params) => Effect.scoped(Effect.gen(function* () {
 	})), Effect.catchTag("ToolShellError", (cause) => Effect.die(cause)));
 	let timedOutAfter;
 	if (params.timeout !== void 0) {
-		const finished = yield* consume.pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
-		if (Option.isNone(finished)) timedOutAfter = params.timeout;
+		const fiber = yield* Effect.forkChild(consume);
+		const finished = yield* Fiber.await(fiber).pipe(Effect.timeoutOption(Duration.seconds(params.timeout)));
+		if (Option.isSome(finished)) yield* Fiber.join(fiber);
+		else {
+			timedOutAfter = params.timeout;
+			yield* sweep(shell, cleanup(file, true));
+			yield* Fiber.interrupt(fiber);
+		}
 	} else yield* consume;
-	yield* acc.finish();
-	const present = presentSnapshot(acc.snapshot(), acc.getLastLineBytes());
-	if (timedOutAfter !== void 0) return yield* new BashTimedOut({
-		timeoutSeconds: timedOutAfter,
-		...present
-	});
+	const { report: report$1, rest } = report(said + control.decode());
+	if (rest.length > 0) acc.append(utf8.encode(rest));
+	acc.finish();
+	const snapshot = acc.snapshot();
+	const kept = report$1 !== void 0 ? report$1.kept : snapshot.beyondLimits && !head.startsWith(notice);
+	const presented = present(snapshot, acc.getLastLineBytes(), kept ? file : void 0);
+	if (timedOutAfter !== void 0) {
+		if (!kept) yield* sweep(shell, remove$1(file));
+		return yield* new BashTimedOut({
+			timeoutSeconds: timedOutAfter,
+			...presented
+		});
+	}
 	const code = yield* Ref.get(exitCode);
 	if (code === null || code !== 0) return yield* new BashFailed({
 		exitCode: code ?? -1,
-		...present
+		...presented
 	});
 	return {
 		exitCode: code,
-		...present
+		...presented
 	};
-}));
+});
 const bashHandler = (params) => Effect.gen(function* () {
 	const shell = yield* ToolShell;
-	return shell.stream !== void 0 ? yield* runStreaming(shell.stream, params) : yield* runBuffered(shell, params);
+	const file = yield* path$1((yield* io_exports.SandboxIO.Current).spillPath, "codework-bash");
+	return yield* (shell.stream !== void 0 ? runStreaming(shell, shell.stream, params, file) : runBuffered(shell, params, file)).pipe(Effect.onInterrupt(() => cleanUp(shell, file, {
+		output: "",
+		truncated: false
+	})));
 });
 /** The bash tool: definition + handler, wired the testable (def/exec split) way. */
 const bashTool = tool_exports.implement(bashDef, bashHandler);
@@ -6115,18 +6403,1402 @@ const bashPlugin = (0, plugin_exports$1.define)({
 	kind: "tool",
 	setup: Effect.fn("BashPlugin.setup")(function* (ctx) {
 		const shell = yield* io_exports.SandboxIO.Shell;
-		const mounted = fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell)));
+		const current = yield* io_exports.SandboxIO.Current;
+		const mounted = Layer.merge(fromSandboxShell.pipe(Layer.provide(Layer.succeed(io_exports.SandboxIO.Shell, shell))), Layer.succeed(io_exports.SandboxIO.Current, current));
 		ctx.plugin.tools.add(tool_exports.provide(bashTool, mounted));
 	})
 });
 //#endregion
+//#region src/tool/diff.ts
+const detectLineEnding = (content) => {
+	const crlfIdx = content.indexOf("\r\n");
+	const lfIdx = content.indexOf("\n");
+	if (lfIdx === -1 || crlfIdx === -1) return "\n";
+	return crlfIdx < lfIdx ? "\r\n" : "\n";
+};
+const normalizeToLF = (text) => text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+const restoreLineEndings = (text, ending) => ending === "\r\n" ? text.replace(/\n/g, "\r\n") : text;
+/** Strip a UTF-8 BOM if present; the BOM is written back after editing. */
+const stripBom = (content) => content.startsWith("") ? {
+	bom: "",
+	text: content.slice(1)
+} : {
+	bom: "",
+	text: content
+};
+/**
+* The form both sides are compared in when the exact text is not found:
+* NFKC, no trailing whitespace per line, ASCII quotes, dashes and spaces.
+*/
+const normalizeForFuzzyMatch = (text) => text.normalize("NFKC").split("\n").map((line) => line.trimEnd()).join("\n").replace(/[‘’‚‛]/g, "'").replace(/[“”„‟]/g, "\"").replace(/[‐‑‒–—―−]/g, "-").replace(/[  -   　]/g, " ");
+const splitLinesWithEndings = (content) => content.match(/[^\n]*\n|[^\n]+/g) ?? [];
+const getLineSpans = (content) => {
+	let offset = 0;
+	return splitLinesWithEndings(content).map((line) => {
+		const span = {
+			start: offset,
+			end: offset + line.length
+		};
+		offset = span.end;
+		return span;
+	});
+};
+const getReplacementLineRange = (lines, replacement) => {
+	const replacementStart = replacement.matchIndex;
+	const replacementEnd = replacement.matchIndex + replacement.matchLength;
+	const startLine = lines.findIndex((line) => replacementStart >= line.start && replacementStart < line.end);
+	if (startLine === -1) throw new Error("Replacement range is outside the base content.");
+	let endLine = startLine;
+	while (endLine < lines.length && lines[endLine].end < replacementEnd) endLine++;
+	if (endLine >= lines.length) throw new Error("Replacement range is outside the base content.");
+	return {
+		startLine,
+		endLine: endLine + 1
+	};
+};
+const applyReplacements = (content, replacements, offset = 0) => {
+	let result = content;
+	for (let i = replacements.length - 1; i >= 0; i--) {
+		const replacement = replacements[i];
+		const matchIndex = replacement.matchIndex - offset;
+		result = result.substring(0, matchIndex) + replacement.newText + result.substring(matchIndex + replacement.matchLength);
+	}
+	return result;
+};
+/**
+* Apply replacements matched against `baseContent`, a normalized view of
+* `originalContent`: the lines a replacement touches are rewritten from the
+* normalized base, every other line is copied back from the original. The
+* replacement ranges drive this, so duplicate normalized lines cannot be
+* aligned to the wrong occurrence.
+*/
+const applyReplacementsPreservingUnchangedLines = (originalContent, baseContent, replacements) => {
+	const originalLines = splitLinesWithEndings(originalContent);
+	const baseLines = getLineSpans(baseContent);
+	if (originalLines.length !== baseLines.length) throw new Error("Cannot preserve unchanged lines because the base content has a different line count.");
+	const groups = [];
+	for (const replacement of [...replacements].sort((a, b) => a.matchIndex - b.matchIndex)) {
+		const range = getReplacementLineRange(baseLines, replacement);
+		const current = groups[groups.length - 1];
+		if (current && range.startLine < current.endLine) {
+			current.endLine = Math.max(current.endLine, range.endLine);
+			current.replacements.push(replacement);
+			continue;
+		}
+		groups.push({
+			...range,
+			replacements: [replacement]
+		});
+	}
+	let originalLineIndex = 0;
+	let result = "";
+	for (const group of groups) {
+		result += originalLines.slice(originalLineIndex, group.startLine).join("");
+		const groupStartOffset = baseLines[group.startLine].start;
+		const groupEndOffset = baseLines[group.endLine - 1].end;
+		result += applyReplacements(baseContent.slice(groupStartOffset, groupEndOffset), group.replacements, groupStartOffset);
+		originalLineIndex = group.endLine;
+	}
+	return result + originalLines.slice(originalLineIndex).join("");
+};
+/** Find `oldText`, exactly first, then in fuzzy-normalized space. */
+const fuzzyFindText = (content, oldText) => {
+	const exactIndex = content.indexOf(oldText);
+	if (exactIndex !== -1) return {
+		found: true,
+		index: exactIndex,
+		matchLength: oldText.length,
+		usedFuzzyMatch: false,
+		contentForReplacement: content
+	};
+	const fuzzyContent = normalizeForFuzzyMatch(content);
+	const fuzzyOldText = normalizeForFuzzyMatch(oldText);
+	const fuzzyIndex = fuzzyContent.indexOf(fuzzyOldText);
+	if (fuzzyIndex === -1) return {
+		found: false,
+		index: -1,
+		matchLength: 0,
+		usedFuzzyMatch: false,
+		contentForReplacement: content
+	};
+	return {
+		found: true,
+		index: fuzzyIndex,
+		matchLength: fuzzyOldText.length,
+		usedFuzzyMatch: true,
+		contentForReplacement: fuzzyContent
+	};
+};
+const countOccurrences = (content, oldText) => normalizeForFuzzyMatch(content).split(normalizeForFuzzyMatch(oldText)).length - 1;
+const notFound$1 = (path, editIndex, totalEdits) => totalEdits === 1 ? `Could not find the exact text in ${path}. The old text must match exactly including all whitespace and newlines.` : `Could not find edits[${editIndex}] in ${path}. The oldText must match exactly including all whitespace and newlines.`;
+const duplicate = (path, editIndex, totalEdits, occurrences) => totalEdits === 1 ? `Found ${occurrences} occurrences of the text in ${path}. The text must be unique. Please provide more context to make it unique.` : `Found ${occurrences} occurrences of edits[${editIndex}] in ${path}. Each oldText must be unique. Please provide more context to make it unique.`;
+const emptyOldText = (path, editIndex, totalEdits) => totalEdits === 1 ? `oldText must not be empty in ${path}.` : `edits[${editIndex}].oldText must not be empty in ${path}.`;
+const noChange = (path, totalEdits) => totalEdits === 1 ? `No changes made to ${path}. The replacement produced identical content. This might indicate an issue with special characters or the text not existing as expected.` : `No changes made to ${path}. The replacements produced identical content.`;
+/**
+* Apply exact-text replacements to LF-normalized content. Every edit is matched
+* against the same original, then applied last to first so offsets stay valid.
+* If any edit needs fuzzy matching, all run in fuzzy space and only the touched
+* lines are written from it. Throws, with the message the model reads, when an
+* edit is empty, missing, ambiguous, overlapping, or changes nothing.
+*/
+const applyEditsToNormalizedContent = (normalizedContent, edits, path) => {
+	const normalizedEdits = edits.map((edit) => ({
+		oldText: normalizeToLF(edit.oldText),
+		newText: normalizeToLF(edit.newText)
+	}));
+	normalizedEdits.forEach((edit, i) => {
+		if (edit.oldText.length === 0) throw new Error(emptyOldText(path, i, normalizedEdits.length));
+	});
+	const usedFuzzyMatch = normalizedEdits.some((edit) => fuzzyFindText(normalizedContent, edit.oldText).usedFuzzyMatch);
+	const replacementBaseContent = usedFuzzyMatch ? normalizeForFuzzyMatch(normalizedContent) : normalizedContent;
+	const matchedEdits = normalizedEdits.map((edit, i) => {
+		const match = fuzzyFindText(replacementBaseContent, edit.oldText);
+		if (!match.found) throw new Error(notFound$1(path, i, normalizedEdits.length));
+		const occurrences = countOccurrences(replacementBaseContent, edit.oldText);
+		if (occurrences > 1) throw new Error(duplicate(path, i, normalizedEdits.length, occurrences));
+		return {
+			editIndex: i,
+			matchIndex: match.index,
+			matchLength: match.matchLength,
+			newText: edit.newText
+		};
+	});
+	matchedEdits.sort((a, b) => a.matchIndex - b.matchIndex);
+	for (let i = 1; i < matchedEdits.length; i++) {
+		const previous = matchedEdits[i - 1];
+		const current = matchedEdits[i];
+		if (previous.matchIndex + previous.matchLength > current.matchIndex) throw new Error(`edits[${previous.editIndex}] and edits[${current.editIndex}] overlap in ${path}. Merge them into one edit or target disjoint regions.`);
+	}
+	const newContent = usedFuzzyMatch ? applyReplacementsPreservingUnchangedLines(normalizedContent, replacementBaseContent, matchedEdits) : applyReplacements(replacementBaseContent, matchedEdits);
+	if (normalizedContent === newContent) throw new Error(noChange(path, normalizedEdits.length));
+	return {
+		baseContent: normalizedContent,
+		newContent
+	};
+};
+/** A standard unified patch. */
+const generateUnifiedPatch = (path, oldContent, newContent, contextLines = 4) => Diff.createTwoFilesPatch(path, path, oldContent, newContent, void 0, void 0, {
+	context: contextLines,
+	headerOptions: Diff.FILE_HEADERS_ONLY
+});
+/**
+* A display diff with line numbers and `contextLines` of context around each
+* change, plus the first changed line in the new file.
+*/
+const generateDiffString = (oldContent, newContent, contextLines = 4) => {
+	const parts = Diff.diffLines(oldContent, newContent);
+	const output = [];
+	const lineNumWidth = String(Math.max(oldContent.split("\n").length, newContent.split("\n").length)).length;
+	const numbered = (prefix, lineNum, line) => `${prefix}${String(lineNum).padStart(lineNumWidth, " ")} ${line}`;
+	const ellipsis = ` ${"".padStart(lineNumWidth, " ")} ...`;
+	let oldLineNum = 1;
+	let newLineNum = 1;
+	let lastWasChange = false;
+	let firstChangedLine;
+	parts.forEach((part, i) => {
+		const raw = part.value.split("\n");
+		if (raw[raw.length - 1] === "") raw.pop();
+		if (part.added || part.removed) {
+			firstChangedLine ??= newLineNum;
+			for (const line of raw) if (part.added) output.push(numbered("+", newLineNum++, line));
+			else output.push(numbered("-", oldLineNum++, line));
+			lastWasChange = true;
+			return;
+		}
+		const context = (lines) => {
+			for (const line of lines) {
+				output.push(numbered(" ", oldLineNum, line));
+				oldLineNum++;
+				newLineNum++;
+			}
+		};
+		const skip = (count) => {
+			output.push(ellipsis);
+			oldLineNum += count;
+			newLineNum += count;
+		};
+		const next = parts[i + 1];
+		const hasTrailingChange = next !== void 0 && (next.added || next.removed);
+		if (lastWasChange && hasTrailingChange) {
+			if (raw.length <= contextLines * 2) context(raw);
+			else {
+				context(raw.slice(0, contextLines));
+				skip(raw.length - contextLines * 2);
+				context(raw.slice(raw.length - contextLines));
+			}
+		} else if (lastWasChange) {
+			context(raw.slice(0, contextLines));
+			if (raw.length > contextLines) skip(raw.length - contextLines);
+		} else if (hasTrailingChange) {
+			const skipped = Math.max(0, raw.length - contextLines);
+			if (skipped > 0) skip(skipped);
+			context(raw.slice(skipped));
+		} else {
+			oldLineNum += raw.length;
+			newLineNum += raw.length;
+		}
+		lastWasChange = false;
+	});
+	return {
+		diff: output.join("\n"),
+		firstChangedLine
+	};
+};
+//#endregion
+//#region src/tool/path.ts
+/**
+* How file tools read the path a model wrote. Models copy paths out of prose and
+* terminals, so a path arrives with Unicode spaces or an `@` mention prefix the
+* file never had. Relative paths stay relative: the mount resolves them.
+*/
+const UNICODE_SPACES = /[  -   　]/g;
+const NARROW_NO_BREAK_SPACE = " ";
+/** The path a file tool acts on. */
+const normalize$1 = (path) => {
+	const normalized = path.replace(UNICODE_SPACES, " ");
+	return normalized.startsWith("@") ? normalized.slice(1) : normalized;
+};
+/**
+* The path to read: {@link normalize}d, or the first existing spelling the model
+* could not have typed — macOS screenshot names use a narrow no-break space
+* before AM/PM, decomposed (NFD) accents, and curly apostrophes. Falls back to
+* the normalized path, so a missing file is reported under the name asked for.
+*/
+const resolveRead = (fs, path) => Effect.gen(function* () {
+	const normalized = normalize$1(path);
+	const variants = /* @__PURE__ */ new Set([
+		normalized,
+		normalized.replace(/ (AM|PM)\./gi, `${NARROW_NO_BREAK_SPACE}$1.`),
+		normalized.normalize("NFD"),
+		normalized.replace(/'/g, "’"),
+		normalized.normalize("NFD").replace(/'/g, "’")
+	]);
+	for (const variant of variants) if (yield* fs.exists(variant)) return variant;
+	return normalized;
+});
+//#endregion
+//#region src/plugin/builtin/tool/edit.ts
+/**
+* The built-in edit plugin: exact-text replacements, all matched against the
+* original file, under the file's mutation lock for the whole read → match →
+* write. The model reads a one-line summary; `details` carries the diff.
+*/
+const ReplaceEdit = Schema.Struct({
+	oldText: Schema.String.annotate({ description: "Exact text for one targeted replacement. It must be unique in the original file and must not overlap with any other edits[].oldText in the same call." }),
+	newText: Schema.String.annotate({ description: "Replacement text for this targeted edit." })
+});
+const EditParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to edit (relative or absolute)" }),
+	edits: Schema.Array(ReplaceEdit).annotate({ description: "One or more targeted replacements. Each edit is matched against the original file, not incrementally. Do not include overlapping or nested edits. If two changes touch the same block or nearby lines, merge them into one edit instead." })
+});
+const EditSuccess = Schema.Struct({
+	path: Schema.String,
+	replaced: Schema.Finite,
+	diff: Schema.String,
+	patch: Schema.String,
+	firstChangedLine: Schema.optional(Schema.Finite)
+});
+var EditFailed = class extends Schema.TaggedError()("EditFailed", { message: Schema.String }) {};
+const isSingleEdit = (value) => {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const edit = value;
+	return typeof edit.oldText === "string" && typeof edit.newText === "string";
+};
+/**
+* Repair shapes models commonly send: `edits` as a JSON string or as a single
+* edit object, and a top-level `oldText`/`newText` pair. Works on a copy; the
+* call's arguments stay unchanged.
+*/
+const prepareEditArguments = (input) => {
+	if (!input || typeof input !== "object" || Array.isArray(input)) return input;
+	const args = { ...input };
+	if (typeof args.edits === "string") try {
+		const parsed = JSON.parse(args.edits);
+		if (Array.isArray(parsed)) args.edits = parsed;
+		else if (isSingleEdit(parsed)) args.edits = [parsed];
+	} catch {}
+	else if (isSingleEdit(args.edits)) args.edits = [args.edits];
+	if (typeof args.oldText !== "string" || typeof args.newText !== "string") return args;
+	const edits = Array.isArray(args.edits) ? [...args.edits] : [];
+	edits.push({
+		oldText: args.oldText,
+		newText: args.newText
+	});
+	const { oldText: _oldText, newText: _newText, ...rest } = args;
+	return {
+		...rest,
+		edits
+	};
+};
+const editDef = tool_exports.define({
+	name: "edit",
+	label: "edit",
+	description: "Edit a single file using exact text replacement. Every edits[].oldText must match a unique, non-overlapping region of the original file. If two changes affect the same block or nearby lines, merge them into one edit instead of emitting overlapping edits. Do not include large unchanged regions just to connect distant changes.",
+	promptSnippet: "Make precise file edits with exact text replacement, including multiple disjoint edits in one call",
+	promptGuidelines: [
+		"Use edit for precise changes (edits[].oldText must match exactly)",
+		"When changing multiple separate locations in one file, use one edit call with multiple entries in edits[] instead of multiple edit calls",
+		"Each edits[].oldText is matched against the original file, not after earlier edits are applied. Do not emit overlapping or nested edits. Merge nearby changes into one edit.",
+		"Keep edits[].oldText as small as possible while still being unique in the file. Do not pad with large unchanged regions."
+	],
+	prepareArguments: prepareEditArguments,
+	parameters: EditParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: EditSuccess,
+	failure: EditFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: `Successfully replaced ${success.replaced} block(s) in ${success.path}.`
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: ({ diff, patch, firstChangedLine }) => ({
+		diff,
+		patch,
+		...firstChangedLine === void 0 ? {} : { firstChangedLine }
+	})
+});
+const fail$4 = (message) => Effect.fail(new EditFailed({ message }));
+/** Filesystem failures name the backend's error code, as Pi's do. */
+const accessFailure = (path) => (error) => {
+	const code = error.cause?.code;
+	return fail$4(`Could not edit file: ${path}. Error code: ${typeof code === "string" ? code : "unknown"}.`);
+};
+const editHandler = (params) => Effect.gen(function* () {
+	const { path, edits } = params;
+	if (edits.length === 0) return yield* fail$4("Edit tool input is invalid. edits must contain at least one replacement.");
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const mutation = yield* io_exports.SandboxIO.Mutation;
+	const resolved = normalize$1(path);
+	return yield* mutation.withFile(resolved, Effect.gen(function* () {
+		if (!(yield* fs.stat(resolved)).isFile) return yield* fail$4(`Could not edit file: ${path}. Path is not a file.`);
+		const { bom, text: content } = stripBom(yield* fs.readFile(resolved));
+		const originalEnding = detectLineEnding(content);
+		const { baseContent, newContent } = yield* Effect.try({
+			try: () => applyEditsToNormalizedContent(normalizeToLF(content), edits, path),
+			catch: (cause) => new EditFailed({ message: cause instanceof Error ? cause.message : String(cause) })
+		});
+		yield* fs.writeFile(resolved, bom + restoreLineEndings(newContent, originalEnding));
+		const { diff, firstChangedLine } = generateDiffString(baseContent, newContent);
+		return {
+			path,
+			replaced: edits.length,
+			diff,
+			patch: generateUnifiedPatch(path, baseContent, newContent),
+			...firstChangedLine === void 0 ? {} : { firstChangedLine }
+		};
+	}));
+}).pipe(Effect.catchTag("SandboxFileSystemError", accessFailure(params.path)));
+/** The edit tool: definition + handler, wired the testable (def/exec split) way. */
+const editTool = tool_exports.implement(editDef, editHandler);
+const editPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.edit",
+	kind: "tool",
+	setup: Effect.fn("EditPlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Mutation, yield* io_exports.SandboxIO.Mutation));
+		ctx.plugin.tools.add(tool_exports.provide(editTool, mounted));
+	})
+});
+//#endregion
+//#region src/tool/binary.ts
+/** `<home>/bin` on the host, where binaries for `local` mounts are installed. */
+var HostBin = class extends Context.Service()("@codeworksh/harness/tool/binary/HostBin") {};
+const specs = {
+	rg: {
+		label: "ripgrep (rg)",
+		repo: "BurntSushi/ripgrep",
+		tagPrefix: "",
+		commands: ["rg"],
+		asset: (version, os, arch) => `ripgrep-${version}-${arch}-${os === "darwin" ? "apple-darwin" : "unknown-linux-musl"}.tar.gz`
+	},
+	fd: {
+		label: "fd",
+		repo: "sharkdp/fd",
+		tagPrefix: "v",
+		commands: ["fd", "fdfind"],
+		asset: (version, os, arch) => `fd-v${version}-${arch}-${os === "darwin" ? "apple-darwin" : "unknown-linux-musl"}.tar.gz`
+	}
+};
+const NETWORK_TIMEOUT = Duration.seconds(10);
+const DOWNLOAD_TIMEOUT = Duration.seconds(120);
+/** Why a missing binary could not be installed; the model reads the message. */
+var InstallError$1 = class extends Schema.TaggedError()("InstallError", { message: Schema.String }) {};
+const installError = (message) => new InstallError$1({ message });
+const available = /* @__PURE__ */ new Map();
+const keyOf = (sandbox, name) => `${sandbox.id}\0${name}`;
+const run$2 = (shell, command) => shell.exec(command).pipe(Effect.orElseSucceed(() => ({
+	stdout: "",
+	stderr: "",
+	exitCode: 127
+})));
+const works = (shell, command) => Effect.map(run$2(shell, `${(0, shell_exports.quote)(command)} --version`), (result) => result.exitCode === 0);
+/** A GET whose `read` of the response, body included, finishes within `timeout`. */
+const get$2 = (url, timeout, read, init = {}) => HttpClient.get(url).pipe(Effect.flatMap(read), Effect.timeout(timeout), Effect.mapError((cause) => Schema.is(InstallError$1)(cause) ? cause : installError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`)), Effect.provide(FetchHttpClient.layer), Effect.provideService(FetchHttpClient.RequestInit, init));
+/** The latest release, read from the redirect of the release page; the API endpoint is rate limited. */
+const latestVersion = (repo) => Effect.gen(function* () {
+	const response = yield* get$2(`https://github.com/${repo}/releases/latest`, NETWORK_TIMEOUT, Effect.succeed, { redirect: "manual" });
+	const location = response.headers["location"] ?? "";
+	const tag = new URL(location, "https://github.com").pathname.split("/").pop();
+	if (!location.includes("/releases/tag/") || !tag) return yield* installError(`Failed to resolve latest ${repo} release: HTTP ${response.status}`);
+	return decodeURIComponent(tag).replace(/^v/, "");
+});
+const platformOf = (shell) => Effect.gen(function* () {
+	const [os, arch] = (yield* run$2(shell, "uname -sm")).stdout.trim().toLowerCase().split(/\s+/);
+	const mappedOs = os === "darwin" || os === "linux" ? os : void 0;
+	const mappedArch = arch === "x86_64" || arch === "amd64" ? "x86_64" : arch === "aarch64" || arch === "arm64" ? "aarch64" : void 0;
+	if (mappedOs === void 0 || mappedArch === void 0) return yield* installError(`Unsupported platform: ${os ?? "unknown"}/${arch ?? "unknown"}`);
+	return {
+		os: mappedOs,
+		arch: mappedArch
+	};
+});
+/** Unpacks with the sandbox's own `tar`, as Pi does on its host; the archive layout varies by release. */
+const unpack = [
+	"set -e",
+	"dir=$1; archive=$2; name=$3; tmp=\"$dir/.extract-$name-$$\"",
+	"trap 'rm -rf \"$tmp\" \"$archive\"' EXIT",
+	"mkdir -p \"$tmp\"",
+	"tar -xzf \"$archive\" -C \"$tmp\"",
+	"found=$(find \"$tmp\" -type f -name \"$name\" | head -n 1)",
+	"[ -n \"$found\" ] || { echo \"binary $name not found in archive\" >&2; exit 1; }",
+	"mv \"$found\" \"$dir/$name\"",
+	"chmod 755 \"$dir/$name\""
+].join("\n");
+const install$1 = (name, shell, fs, dir) => Effect.gen(function* () {
+	const spec = specs[name];
+	const { os, arch } = yield* platformOf(shell);
+	const version = name === "fd" && os === "darwin" && arch === "x86_64" ? "10.3.0" : yield* latestVersion(spec.repo);
+	const asset = spec.asset(version, os, arch);
+	const url = `https://github.com/${spec.repo}/releases/download/${spec.tagPrefix}${version}/${asset}`;
+	const bytes = new Uint8Array(yield* get$2(url, DOWNLOAD_TIMEOUT, (response) => response.status === 200 ? response.arrayBuffer : Effect.fail(installError(`Download failed with HTTP ${response.status}: ${url}`))));
+	const archive = posix.join(dir, `.${asset}`);
+	yield* fs.writeFile(archive, bytes).pipe(Effect.mapError((error) => installError(`Cannot write ${archive}: ${error.cause instanceof Error ? error.cause.message : error.message}`)));
+	const result = yield* run$2(shell, `sh -c ${(0, shell_exports.quote)(unpack)} _ ${(0, shell_exports.quoteArgv)([
+		dir,
+		archive,
+		name
+	])}`);
+	if (result.exitCode !== 0) return yield* installError(`Failed to unpack ${asset}: ${(result.stderr || result.stdout).trim()}`);
+	return posix.join(dir, name);
+});
+/** Where `kind` keeps installed binaries. */
+const binDir = (sandbox, shell) => Effect.gen(function* () {
+	if (sandbox.kind === "local") return yield* HostBin;
+	const home = (yield* run$2(shell, "printf %s \"$HOME\"")).stdout.trim();
+	return posix.join(home || "/tmp", ".codework", "bin");
+});
+const resolve$3 = (name, sandbox, shell, fs) => Effect.gen(function* () {
+	const dir = yield* binDir(sandbox, shell);
+	for (const command of [posix.join(dir, name), ...specs[name].commands]) if (yield* works(shell, command)) return {
+		_tag: "Available",
+		command
+	};
+	const installed = yield* install$1(name, shell, fs, dir).pipe(Effect.result);
+	if (installed._tag === "Success" && (yield* works(shell, installed.success))) return {
+		_tag: "Available",
+		command: installed.success
+	};
+	const reason = installed._tag === "Failure" ? `: ${installed.failure.message}` : "";
+	return {
+		_tag: "Unavailable",
+		message: `${specs[name].label} is not available in this sandbox and could not be installed${reason}`
+	};
+});
+const virtual = (name) => name === "rg" ? {
+	_tag: "Available",
+	command: "rg"
+} : {
+	_tag: "Unavailable",
+	message: `${specs[name].label} is not available in this sandbox`
+};
+/**
+* The shared probe for `name` in this sandbox, started when none is remembered.
+* It runs detached, so cancelling the call that started it cannot cancel it for
+* the others waiting on it; an unavailable result is not remembered, so the next
+* call tries again.
+*/
+const probe$1 = (name, sandbox, shell, fs) => Effect.gen(function* () {
+	const key = keyOf(sandbox, name);
+	const existing = available.get(key);
+	if (existing !== void 0) return existing;
+	const deferred = Deferred.makeUnsafe();
+	available.set(key, deferred);
+	yield* resolve$3(name, sandbox, shell, fs).pipe(Effect.onExit((exit) => Effect.sync(() => {
+		if ((exit._tag === "Failure" || exit.value._tag === "Unavailable") && available.get(key) === deferred) available.delete(key);
+	})), Effect.onExit((exit) => Deferred.done(deferred, exit)), Effect.forkDetach);
+	return deferred;
+});
+/**
+* Run `use` with the command for `name`. When the run reports the binary gone
+* (`exitCode` 127, e.g. a sandbox reset to a fresh image), the remembered probe is
+* dropped and the run is tried once more with a fresh one. Only the probe that
+* gave the stale command is dropped, so concurrent retries share one new probe.
+*/
+const withCommand = (name, sandbox, shell, fs, use) => Effect.gen(function* () {
+	if (sandbox.kind === "virtual") {
+		const resolved = virtual(name);
+		return resolved._tag === "Unavailable" ? resolved : yield* use(resolved.command);
+	}
+	for (let attempt = 0;; attempt++) {
+		const deferred = yield* probe$1(name, sandbox, shell, fs);
+		const resolved = yield* Deferred.await(deferred);
+		if (resolved._tag === "Unavailable") return resolved;
+		const result = yield* use(resolved.command);
+		if (result.exitCode !== 127 || attempt > 0) return result;
+		const key = keyOf(sandbox, name);
+		if (available.get(key) === deferred) available.delete(key);
+	}
+});
+//#endregion
+//#region src/plugin/builtin/tool/find.ts
+/**
+* The built-in find plugin: fd in the mounted sandbox. A virtual mount has no fd,
+* and the tool says so rather than emulating it.
+*/
+const FindParams = Schema.Struct({
+	pattern: Schema.String.annotate({ description: "Glob pattern to match files, e.g. '*.ts', '**/*.json', or 'src/**/*.spec.ts'" }),
+	path: Schema.optional(Schema.String.annotate({ description: "Directory to search in (default: current directory)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of results (default: 1000)" }))
+});
+const FindDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	resultLimitReached: Schema.optional(Schema.Finite)
+});
+const FindSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(FindDetails)
+});
+var FindFailed = class extends Schema.TaggedError()("FindFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT$2 = 1e3;
+const FD_ERROR = "[fd error]:";
+const findDef = tool_exports.define({
+	name: "find",
+	label: "find",
+	description: `Search for files by glob pattern. Returns matching file paths relative to the search directory. Respects .gitignore. Output is truncated to ${DEFAULT_LIMIT$2} results or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first).`,
+	promptSnippet: "Find files by glob pattern (respects .gitignore)",
+	parameters: FindParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: FindSuccess,
+	failure: FindFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
+});
+const fail$3 = (message) => Effect.fail(new FindFailed({ message }));
+/** Relative to the search root, keeping a directory's trailing slash. */
+const relativize = (result, searchPath) => {
+	const relative = posix.isAbsolute(result) ? posix.relative(searchPath, result) : result;
+	return result.endsWith("/") && !relative.endsWith("/") ? `${relative}/` : relative;
+};
+const insideGitRepo = (fs, searchPath) => Effect.gen(function* () {
+	for (let current = searchPath;; current = posix.dirname(current)) {
+		if (yield* fs.exists(posix.join(current, ".git")).pipe(Effect.orElseSucceed(() => false))) return true;
+		if (posix.dirname(current) === current) return false;
+	}
+});
+const findHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const shell = yield* io_exports.SandboxIO.Shell;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const searchPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const limit = Math.max(1, Math.trunc(params.limit ?? DEFAULT_LIMIT$2));
+	if (!(yield* fs.exists(searchPath).pipe(Effect.orElseSucceed(() => false)))) return yield* fail$3(`Path not found: ${searchPath}`);
+	const argv = [
+		"--glob",
+		"--color=never",
+		"--hidden",
+		...(yield* insideGitRepo(fs, searchPath)) ? [] : ["--no-require-git"]
+	];
+	argv.push("--max-results", String(limit));
+	let pattern = params.pattern;
+	if (pattern.includes("/")) {
+		argv.push("--full-path");
+		if (!pattern.startsWith("/") && !pattern.startsWith("**/") && pattern !== "**") pattern = `**/${pattern}`;
+	}
+	argv.push("--", pattern, searchPath);
+	const run = yield* withCommand("fd", sandbox, shell, fs, (command) => shell.exec((0, shell_exports.quoteArgv)([command, ...argv])));
+	if ("_tag" in run) return yield* fail$3(run.message);
+	const output = run.stdout.split("\n").map((line) => line.replace(/\r$/, "").trim()).filter((line) => line.length > 0);
+	const lines = output.filter((line) => !line.startsWith(FD_ERROR));
+	const errors = [run.stderr.trim(), ...output.filter((line) => line.startsWith(FD_ERROR))].filter((text) => text.length > 0).join("\n");
+	if (run.exitCode !== 0 && lines.length === 0) return yield* fail$3(errors || `fd exited with code ${run.exitCode}`);
+	if (lines.length === 0) return { text: "No files found matching pattern" };
+	const results = lines.map((line) => relativize(line, searchPath)).sort();
+	const resultLimitReached = results.length >= limit;
+	const truncation = truncateHead(results.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (resultLimitReached) {
+		notices.push(`${limit} results limit reached. Use limit=${limit * 2} for more, or refine pattern`);
+		details.resultLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+}).pipe(Effect.catchTag("ShellError", (error) => Effect.die(error)));
+/** The find tool: definition + handler, wired the testable (def/exec split) way. */
+const findTool = tool_exports.implement(findDef, findHandler);
+const findPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.find",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("FindPlugin.setup")(function* (ctx) {
+		const mounted = Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Shell, yield* io_exports.SandboxIO.Shell), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current), Layer.succeed(HostBin, ctx.paths.bin));
+		ctx.plugin.tools.add(tool_exports.provide(findTool, mounted));
+	})
+});
+//#endregion
+//#region src/plugin/builtin/tool/grep.ts
+/**
+* The built-in grep plugin: ripgrep in the mounted sandbox — the host's or the
+* remote's own binary, or just-bash's built-in `rg` on a virtual mount. Only the
+* first `limit` match events leave the sandbox; context lines are read through
+* `scanLines`, so only their window crosses.
+*/
+const GrepParams = Schema.Struct({
+	pattern: Schema.String.annotate({ description: "Search pattern (regex or literal string)" }),
+	path: Schema.optional(Schema.String.annotate({ description: "Directory or file to search (default: current directory)" })),
+	glob: Schema.optional(Schema.String.annotate({ description: "Filter files by glob pattern, e.g. '*.ts' or '**/*.spec.ts'" })),
+	ignoreCase: Schema.optional(Schema.Boolean.annotate({ description: "Case-insensitive search (default: false)" })),
+	literal: Schema.optional(Schema.Boolean.annotate({ description: "Treat pattern as literal string instead of regex (default: false)" })),
+	context: Schema.optional(Schema.Finite.annotate({ description: "Number of lines to show before and after each match (default: 0)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of matches to return (default: 100)" }))
+});
+const GrepDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	matchLimitReached: Schema.optional(Schema.Finite),
+	linesTruncated: Schema.optional(Schema.Boolean)
+});
+const GrepSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(GrepDetails)
+});
+var GrepFailed = class extends Schema.TaggedError()("GrepFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT$1 = 100;
+const grepDef = tool_exports.define({
+	name: "grep",
+	label: "grep",
+	description: `Search file contents for a pattern. Returns matching lines with file paths and line numbers. Respects .gitignore. Output is truncated to ${DEFAULT_LIMIT$1} matches or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). Long lines are truncated to 500 chars.`,
+	promptSnippet: "Search file contents for patterns (respects .gitignore)",
+	parameters: GrepParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: GrepSuccess,
+	failure: GrepFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
+});
+const fail$2 = (message) => Effect.fail(new GrepFailed({ message }));
+/** One `--json` match event; anything else (begin/end/summary, a non-UTF-8 path) is skipped. */
+const parseMatch = (line) => {
+	try {
+		const event = JSON.parse(line);
+		const path = event.data?.path?.text;
+		const number = event.data?.line_number;
+		const text = event.data?.lines?.text;
+		if (event.type !== "match" || typeof path !== "string" || typeof number !== "number") return void 0;
+		return {
+			path,
+			line: number,
+			text: typeof text === "string" ? text : ""
+		};
+	} catch {
+		return;
+	}
+};
+/**
+* The search runs as one pipeline so a broad pattern never ships its whole result:
+* only match events pass, and `head` stops ripgrep at the limit. Some backends
+* merge stderr into stdout, so nothing relies on the two staying apart: ripgrep's
+* status rides the pipe as a last event, and its stderr waits in `errors` until the
+* pipeline is done, where it can no longer land inside a match.
+*/
+const pipeline = (argv, limit, errors) => [
+	`mkdir -p ${(0, shell_exports.quote)(posix.dirname(errors))} 2>/dev/null`,
+	`{ : > ${(0, shell_exports.quote)(errors)}; } 2>/dev/null || { echo ${(0, shell_exports.quote)(`cannot write ${errors}`)} >&2; exit 2; }`,
+	`{ ${(0, shell_exports.quoteArgv)(argv)} 2>${(0, shell_exports.quote)(errors)}; echo '{"type":"rc","code":'"$?"'}'; } | grep -E '^\\{"type":"(match|rc)"' | head -n ${limit}`,
+	`cat ${(0, shell_exports.quote)(errors)} >&2 2>/dev/null`,
+	`rm -f ${(0, shell_exports.quote)(errors)}`
+].join("; ");
+const STATUS = /^\{"type":"rc","code":(\d+)\}$/;
+/** The pipeline's output: match events, ripgrep's status, and anything else, which is its stderr. */
+const parse$2 = (stdout, stderr) => {
+	const matches = [];
+	const errors = [];
+	let status;
+	for (const line of stdout.split("\n")) {
+		const rc = STATUS.exec(line);
+		if (rc !== null) status ??= Number(rc[1]);
+		else if (line.startsWith("{\"type\":\"match\"")) {
+			const match = parseMatch(line);
+			if (match !== void 0) matches.push(match);
+		} else if (line.trim().length > 0) errors.push(line);
+	}
+	return {
+		matches,
+		status,
+		errors: [stderr.trim(), ...errors].filter((text) => text.length > 0).join("\n")
+	};
+};
+/** A line as shown: no line ending, cut to {@link GREP_MAX_LINE_LENGTH}. */
+const shown = (line) => truncateLine(line.replace(/\r\n/g, "\n").replace(/\r/g, "").replace(/\n$/, ""));
+/**
+* The match with its context lines. The window is read in one bounded scan; a
+* line it could not fit is read on its own, and a line too long even for that is
+* marked rather than shown blank. The match line itself is ripgrep's.
+*/
+const contextBlock = (fs, match, context, label) => Effect.gen(function* () {
+	const startLine = Math.max(0, match.line - 1 - context);
+	const scan = yield* fs.scanLines(match.path, {
+		startLine,
+		endLine: match.line + context,
+		maxBytes: DEFAULT_MAX_BYTES
+	}).pipe(Effect.option);
+	if (scan._tag === "None" || scan.value.totalLines === 0) return {
+		lines: [`${label}:${match.line}: (unable to read file)`],
+		truncated: false
+	};
+	const window = scan.value.lines === 0 ? [] : scan.value.text.split("\n");
+	const lineAt = (index) => index - startLine < window.length ? Effect.succeed(window[index - startLine]) : fs.scanLines(match.path, {
+		startLine: index,
+		endLine: index + 1,
+		maxBytes: DEFAULT_MAX_BYTES
+	}).pipe(Effect.map((one) => one.lines === 1 ? one.text : void 0), Effect.orElseSucceed(() => void 0));
+	const end = Math.min(scan.value.totalLines, match.line + context);
+	const block = [];
+	let truncated = false;
+	for (let current = startLine + 1; current <= end; current++) {
+		const line = current === match.line ? match.text : yield* lineAt(current - 1);
+		const { text, wasTruncated } = line === void 0 ? {
+			text: "... [truncated]",
+			wasTruncated: true
+		} : shown(line);
+		if (wasTruncated) truncated = true;
+		block.push(current === match.line ? `${label}:${current}: ${text}` : `${label}-${current}- ${text}`);
+	}
+	return {
+		lines: block,
+		truncated
+	};
+});
+const grepHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const shell = yield* io_exports.SandboxIO.Shell;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const searchPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const stat = yield* fs.stat(searchPath).pipe(Effect.option);
+	if (stat._tag === "None") return yield* fail$2(`Path not found: ${searchPath}`);
+	const isDirectory = stat.value.isDirectory;
+	const context = params.context && params.context > 0 ? Math.trunc(params.context) : 0;
+	const limit = Math.max(1, Math.trunc(params.limit ?? DEFAULT_LIMIT$1));
+	const errors = yield* path$1(sandbox.spillPath, "codework-grep");
+	const run = yield* withCommand("rg", sandbox, shell, fs, (command) => Effect.gen(function* () {
+		const argv = [
+			command,
+			"--json",
+			"--line-number",
+			"--hidden",
+			"--sort",
+			"path"
+		];
+		argv.push(params.ignoreCase ? "--ignore-case" : "-s");
+		if (params.literal) argv.push("--fixed-strings");
+		if (params.glob) argv.push("--glob", params.glob);
+		argv.push("-e", params.pattern, searchPath);
+		const result = yield* shell.exec(pipeline(argv, limit, errors));
+		const parsed = parse$2(result.stdout, result.stderr);
+		return {
+			...parsed,
+			exitCode: parsed.status ?? result.exitCode
+		};
+	}));
+	if ("_tag" in run) return yield* fail$2(run.message);
+	const { matches } = run;
+	const matchLimitReached = matches.length >= limit;
+	if (!matchLimitReached && run.exitCode !== 0 && run.exitCode !== 1) return yield* fail$2(run.errors || `ripgrep exited with code ${run.exitCode}`);
+	if (matches.length === 0) return { text: "No matches found" };
+	const label = (path) => {
+		if (isDirectory) {
+			const relative = posix.relative(searchPath, path);
+			if (relative && !relative.startsWith("..")) return relative;
+		}
+		return posix.basename(path);
+	};
+	const output = [];
+	let linesTruncated = false;
+	for (const match of matches) if (context === 0) {
+		const { text, wasTruncated } = shown(match.text);
+		if (wasTruncated) linesTruncated = true;
+		output.push(`${label(match.path)}:${match.line}: ${text}`);
+	} else {
+		const block = yield* contextBlock(fs, match, context, label(match.path));
+		if (block.truncated) linesTruncated = true;
+		output.push(...block.lines);
+	}
+	const truncation = truncateHead(output.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (matchLimitReached) {
+		notices.push(`${limit} matches limit reached. Use limit=${limit * 2} for more, or refine pattern`);
+		details.matchLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	if (linesTruncated) {
+		notices.push(`Some lines truncated to 500 chars. Use read tool to see full lines`);
+		details.linesTruncated = true;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+}).pipe(Effect.catchTag("ShellError", (error) => Effect.die(error)));
+/** The grep tool: definition + handler, wired the testable (def/exec split) way. */
+const grepTool = tool_exports.implement(grepDef, grepHandler);
+const grepPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.grep",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("GrepPlugin.setup")(function* (ctx) {
+		const mounted = Layer.mergeAll(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Shell, yield* io_exports.SandboxIO.Shell), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current), Layer.succeed(HostBin, ctx.paths.bin));
+		ctx.plugin.tools.add(tool_exports.provide(grepTool, mounted));
+	})
+});
+//#endregion
+//#region src/plugin/builtin/tool/ls.ts
+/** The built-in ls plugin: one directory through the sandbox filesystem, no binaries involved. */
+const LsParams = Schema.Struct({
+	path: Schema.optional(Schema.String.annotate({ description: "Directory to list (default: current directory)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of entries to return (default: 500)" }))
+});
+const LsDetails = Schema.Struct({
+	truncation: Schema.optional(Schema.Unknown),
+	entryLimitReached: Schema.optional(Schema.Finite)
+});
+const LsSuccess = Schema.Struct({
+	text: Schema.String,
+	details: Schema.optional(LsDetails)
+});
+var LsFailed = class extends Schema.TaggedError()("LsFailed", { message: Schema.String }) {};
+const DEFAULT_LIMIT = 500;
+const lsDef = tool_exports.define({
+	name: "ls",
+	label: "ls",
+	description: `List directory contents. Returns entries sorted alphabetically, with '/' suffix for directories. Includes dotfiles. Output is truncated to ${DEFAULT_LIMIT} entries or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first).`,
+	promptSnippet: "List directory contents",
+	parameters: LsParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: LsSuccess,
+	failure: LsFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: success.text
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.details
+});
+const fail$1 = (message) => Effect.fail(new LsFailed({ message }));
+const lsHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const sandbox = yield* io_exports.SandboxIO.Current;
+	const dirPath = posix.resolve(sandbox.cwd, normalize$1(params.path || "."));
+	const limit = params.limit ?? DEFAULT_LIMIT;
+	const stat = yield* fs.stat(dirPath).pipe(Effect.option);
+	if (stat._tag === "None") return yield* fail$1(`Path not found: ${dirPath}`);
+	if (!stat.value.isDirectory) return yield* fail$1(`Not a directory: ${dirPath}`);
+	const read = yield* fs.readdir(dirPath).pipe(Effect.result);
+	if (read._tag === "Failure") {
+		const cause = read.failure.cause;
+		return yield* fail$1(`Cannot read directory: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	const entries = [...read.success].sort((a, b) => a.toLowerCase().localeCompare(b.toLowerCase()));
+	const results = [];
+	let entryLimitReached = false;
+	for (const entry of entries) {
+		if (results.length >= limit) {
+			entryLimitReached = true;
+			break;
+		}
+		const entryStat = yield* fs.stat(posix.join(dirPath, entry)).pipe(Effect.option);
+		if (entryStat._tag === "None") continue;
+		results.push(entryStat.value.isDirectory ? `${entry}/` : entry);
+	}
+	if (results.length === 0) return { text: "(empty directory)" };
+	const truncation = truncateHead(results.join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
+	const notices = [];
+	const details = {};
+	if (entryLimitReached) {
+		notices.push(`${limit} entries limit reached. Use limit=${limit * 2} for more`);
+		details.entryLimitReached = limit;
+	}
+	if (truncation.truncated) {
+		notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
+		details.truncation = truncation;
+	}
+	const text = notices.length > 0 ? `${truncation.content}\n\n[${notices.join(". ")}]` : truncation.content;
+	return Object.keys(details).length > 0 ? {
+		text,
+		details
+	} : { text };
+});
+/** The ls tool: definition + handler, wired the testable (def/exec split) way. */
+const lsTool = tool_exports.implement(lsDef, lsHandler);
+const lsPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.ls",
+	kind: "tool",
+	optIn: true,
+	setup: Effect.fn("LsPlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Current, yield* io_exports.SandboxIO.Current));
+		ctx.plugin.tools.add(tool_exports.provide(lsTool, mounted));
+	})
+});
+//#endregion
+//#region src/tool/image/mime.ts
+/**
+* Image formats a model takes inline, told apart by their bytes, never by the
+* file name: a text file that starts with `GIF` is still text.
+*/
+const PNG_SIGNATURE = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+/** Bytes every check except the APNG chunk walk needs: BMP reads up to offset 29. */
+const HEADER_BYTES = 32;
+const BLOCK_BYTES = 65536;
+/**
+* The image MIME type of a whole file, reading only its header and, for PNG, the
+* chunk headers up to the first `acTL` or `IDAT`. Animated PNGs are not images
+* here: a model would see only their first frame.
+*/
+const detectOf = (source) => Effect.gen(function* () {
+	const header = yield* source.read(0, HEADER_BYTES);
+	if (!startsWith(header, PNG_SIGNATURE)) return detect(header);
+	return isPng(header) && !(yield* isAnimatedPngOf(source)) ? "image/png" : void 0;
+});
+const isAnimatedPngOf = (source) => Effect.gen(function* () {
+	let block = /* @__PURE__ */ new Uint8Array(0);
+	let blockStart = 0;
+	let offset = PNG_SIGNATURE.length;
+	while (offset + 8 <= source.size) {
+		if (offset < blockStart || offset + 8 > blockStart + block.length) {
+			blockStart = offset;
+			block = yield* source.read(offset, BLOCK_BYTES);
+		}
+		const chunkHeader = block.subarray(offset - blockStart, offset - blockStart + 8);
+		if (chunkHeader.length < 8) return false;
+		if (startsWithAscii(chunkHeader, 4, "acTL")) return true;
+		if (startsWithAscii(chunkHeader, 4, "IDAT")) return false;
+		const nextOffset = offset + 8 + readUint32BE(chunkHeader, 0) + 4;
+		if (nextOffset <= offset || nextOffset > source.size) return false;
+		offset = nextOffset;
+	}
+	return false;
+});
+/** The image MIME type of a header; a PNG still needs {@link isAnimatedPngOf}. */
+const detect = (buffer) => {
+	if (startsWith(buffer, [
+		255,
+		216,
+		255
+	])) return buffer[3] === 247 ? void 0 : "image/jpeg";
+	if (startsWith(buffer, PNG_SIGNATURE)) return isPng(buffer) ? "image/png" : void 0;
+	if (startsWithAscii(buffer, 0, "GIF87a") || startsWithAscii(buffer, 0, "GIF89a")) return "image/gif";
+	if (startsWithAscii(buffer, 0, "RIFF") && startsWithAscii(buffer, 8, "WEBP")) return "image/webp";
+	if (startsWithAscii(buffer, 0, "BM") && isBmp(buffer)) return "image/bmp";
+};
+const isPng = (buffer) => buffer.length >= 16 && readUint32BE(buffer, PNG_SIGNATURE.length) === 13 && startsWithAscii(buffer, 12, "IHDR");
+const isBmp = (buffer) => {
+	if (buffer.length < 26) return false;
+	const declaredFileSize = readUint32LE(buffer, 2);
+	const pixelDataOffset = readUint32LE(buffer, 10);
+	const dibHeaderSize = readUint32LE(buffer, 14);
+	if (declaredFileSize !== 0 && declaredFileSize < 26) return false;
+	if (pixelDataOffset < 14 + dibHeaderSize) return false;
+	if (declaredFileSize !== 0 && pixelDataOffset >= declaredFileSize) return false;
+	let colorPlanes;
+	let bitsPerPixel;
+	if (dibHeaderSize === 12) {
+		colorPlanes = readUint16LE(buffer, 22);
+		bitsPerPixel = readUint16LE(buffer, 24);
+	} else if (dibHeaderSize >= 40 && dibHeaderSize <= 124) {
+		if (buffer.length < 30) return false;
+		colorPlanes = readUint16LE(buffer, 26);
+		bitsPerPixel = readUint16LE(buffer, 28);
+	} else return false;
+	return colorPlanes === 1 && [
+		1,
+		4,
+		8,
+		16,
+		24,
+		32
+	].includes(bitsPerPixel);
+};
+const readUint16LE = (buffer, offset) => (buffer[offset] ?? 0) + ((buffer[offset + 1] ?? 0) << 8);
+const readUint32BE = (buffer, offset) => (buffer[offset] ?? 0) * 16777216 + ((buffer[offset + 1] ?? 0) << 16) + ((buffer[offset + 2] ?? 0) << 8) + (buffer[offset + 3] ?? 0);
+const readUint32LE = (buffer, offset) => (buffer[offset] ?? 0) + ((buffer[offset + 1] ?? 0) << 8) + ((buffer[offset + 2] ?? 0) << 16) + (buffer[offset + 3] ?? 0) * 16777216;
+const startsWith = (buffer, bytes) => buffer.length >= bytes.length && bytes.every((byte, index) => buffer[index] === byte);
+const startsWithAscii = (buffer, offset, text) => {
+	if (buffer.length < offset + text.length) return false;
+	for (let index = 0; index < text.length; index++) if (buffer[offset + index] !== text.charCodeAt(index)) return false;
+	return true;
+};
+//#endregion
+//#region src/tool/image/index.ts
+const INLINE = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp"
+]);
+const toPng = (bytes) => load$4.pipe(Effect.map((photon) => {
+	if (photon === void 0) return void 0;
+	try {
+		const image = decode(photon, bytes);
+		try {
+			return new Uint8Array(image.get_bytes());
+		} finally {
+			image.free();
+		}
+	} catch {
+		return;
+	}
+}));
+/**
+* Turn an image file into what a model takes inline: a supported format, within
+* the provider's dimension and size limits. A failure is a note for the model,
+* never an error — the read itself succeeded.
+*/
+const inline = Effect.fn("Image.inline")(function* (bytes, mimeType) {
+	let source = {
+		bytes,
+		mimeType,
+		convertedFrom: void 0
+	};
+	if (!INLINE.has(mimeType)) {
+		const png = yield* toPng(bytes);
+		if (png === void 0) return {
+			ok: false,
+			message: "[Image omitted: could not be converted to a supported inline image format.]"
+		};
+		source = {
+			bytes: png,
+			mimeType: "image/png",
+			convertedFrom: mimeType
+		};
+	}
+	const resized = yield* resize(source.bytes, source.mimeType);
+	if (resized === null) return {
+		ok: false,
+		message: "[Image omitted: could not be resized below the inline image size limit.]"
+	};
+	const hints = [];
+	if (source.convertedFrom !== void 0 && source.convertedFrom !== resized.mimeType) hints.push(`[Image converted from ${source.convertedFrom} to ${resized.mimeType}.]`);
+	const note = dimensionNote(resized);
+	if (note !== void 0) hints.push(note);
+	return {
+		ok: true,
+		data: resized.data,
+		mimeType: resized.mimeType,
+		hints
+	};
+});
+//#endregion
+//#region src/plugin/builtin/tool/read.ts
+/**
+* The built-in read plugin. Text is read through `scanLines`, so only the shown
+* window crosses from the sandbox; images, told apart by their bytes, go to the
+* model as attachments. Continuation notices are part of the text the model
+* reads; `details` keeps only how the text was cut.
+*/
+const ReadParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to read (relative or absolute)" }),
+	offset: Schema.optional(Schema.Finite.annotate({ description: "Line number to start reading from (1-indexed)" })),
+	limit: Schema.optional(Schema.Finite.annotate({ description: "Maximum number of lines to read" }))
+});
+/** How the shown text was cut. */
+const Truncation = Schema.Struct({
+	truncated: Schema.Boolean,
+	truncatedBy: Schema.NullOr(Schema.Literals(["lines", "bytes"])),
+	/** Lines selected by `offset`/`limit`, before the limits. */
+	totalLines: Schema.Finite,
+	outputLines: Schema.Finite,
+	outputBytes: Schema.Finite,
+	firstLineExceedsLimit: Schema.Boolean,
+	maxLines: Schema.Finite,
+	maxBytes: Schema.Finite
+});
+const ReadText = Schema.Struct({
+	type: Schema.Literal("text"),
+	text: Schema.String,
+	truncation: Schema.optional(Truncation)
+});
+const ReadImage = Schema.Struct({
+	type: Schema.Literal("image"),
+	/** What the model reads with the image: its type and any conversion/resize hints. */
+	note: Schema.String,
+	image: Schema.optional(Schema.Struct({
+		data: Schema.String,
+		mimeType: Schema.String
+	}))
+});
+const ReadSuccess = Schema.Union([ReadText, ReadImage]);
+var ReadFailed = class extends Schema.TaggedError()("ReadFailed", { message: Schema.String }) {};
+const BINARY_PROBE_BYTES = 8e3;
+const readDef = tool_exports.define({
+	name: "read",
+	label: "read",
+	description: `Read the contents of a file. Supports text files and images (jpg, png, gif, webp, bmp). Images are sent as attachments. For text files, output is truncated to ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). Use offset/limit for large files. When you need the full file, continue with offset until complete.`,
+	promptSnippet: "Read file contents",
+	promptGuidelines: ["Use read to examine files instead of cat or sed."],
+	parameters: ReadParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: ReadSuccess,
+	failure: ReadFailed,
+	encodeContent: (success) => success.type === "text" ? [{
+		type: "text",
+		text: success.text
+	}] : [{
+		type: "text",
+		text: success.note
+	}, ...success.image === void 0 ? [] : [{
+		type: "image",
+		...success.image
+	}]],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: (success) => success.type === "text" && success.truncation !== void 0 ? { truncation: success.truncation } : void 0
+});
+const fail = (message) => Effect.fail(new ReadFailed({ message }));
+/**
+* Filesystem failures are the model's to see, as Pi shows them: a missing path in
+* one wording on every backend, anything else (EACCES, …) as the backend reported it.
+*/
+const fsFailure$1 = (path) => (error) => fail(filesystem_exports.SandboxFileSystem.isNotFoundError(error.cause) ? `ENOENT: no such file or directory, open '${path}'` : error.cause instanceof Error ? error.cause.message : `Could not read file: ${path}`);
+const readImage = (fs, resolved, mimeType) => Effect.gen(function* () {
+	const bytes = yield* fs.readFileBuffer(resolved);
+	const inline$1 = yield* inline(bytes, mimeType);
+	if (!inline$1.ok) return {
+		type: "image",
+		note: `Read image file [${mimeType}]\n${inline$1.message}`
+	};
+	return {
+		type: "image",
+		note: [`Read image file [${inline$1.mimeType}]`, ...inline$1.hints].join("\n"),
+		image: {
+			data: inline$1.data,
+			mimeType: inline$1.mimeType
+		}
+	};
+});
+const readText = (fs, resolved, params) => Effect.gen(function* () {
+	const { path, offset } = params;
+	const startLine = offset ? Math.max(0, Math.trunc(offset) - 1) : 0;
+	const limit = params.limit === void 0 ? void 0 : Math.max(1, Math.trunc(params.limit));
+	const endLine = startLine + Math.min(limit ?? 2e3, DEFAULT_MAX_LINES);
+	const scan = yield* fs.scanLines(resolved, Number.isSafeInteger(endLine) ? {
+		startLine,
+		endLine,
+		maxBytes: DEFAULT_MAX_BYTES
+	} : {
+		startLine: 0,
+		endLine: 1,
+		maxBytes: DEFAULT_MAX_BYTES
+	});
+	if (startLine >= Math.max(scan.totalLines, 1)) return yield* fail(`Offset ${offset} is beyond end of file (${scan.totalLines} lines total)`);
+	const grown = Buffer.byteLength(scan.text, "utf8") > 51200 ? truncateHead(scan.text) : void 0;
+	const firstLineBytes = grown?.firstLineExceedsLimit ? Buffer.byteLength(scan.text.split("\n", 1)[0] ?? "", "utf8") : scan.firstLineBytes;
+	const shown = grown === void 0 ? scan : {
+		text: grown.content,
+		lines: grown.outputLines
+	};
+	const first = startLine + 1;
+	const selected = Math.min(scan.totalLines, limit === void 0 ? Infinity : startLine + limit) - startLine;
+	const truncation = (truncatedBy, firstLineExceedsLimit) => ({
+		truncated: true,
+		truncatedBy,
+		totalLines: selected,
+		outputLines: shown.lines,
+		outputBytes: Buffer.byteLength(shown.text, "utf8"),
+		firstLineExceedsLimit,
+		maxLines: DEFAULT_MAX_LINES,
+		maxBytes: DEFAULT_MAX_BYTES
+	});
+	if (firstLineBytes > 51200) return {
+		type: "text",
+		text: `[Line ${first} is ${formatSize(firstLineBytes)}, exceeds ${formatSize(DEFAULT_MAX_BYTES)} limit. Use bash: sed -n '${first}p' ${path} | head -c ${DEFAULT_MAX_BYTES}]`,
+		truncation: {
+			...truncation("bytes", true),
+			outputLines: 0,
+			outputBytes: 0
+		}
+	};
+	if (shown.lines < selected) {
+		const last = startLine + shown.lines;
+		const truncatedBy = shown.lines < Math.min(selected, 2e3) ? "bytes" : "lines";
+		const limitText = truncatedBy === "bytes" ? ` (${formatSize(DEFAULT_MAX_BYTES)} limit)` : "";
+		return {
+			type: "text",
+			text: `${shown.text}\n\n[Showing lines ${first}-${last} of ${scan.totalLines}${limitText}. Use offset=${last + 1} to continue.]`,
+			truncation: truncation(truncatedBy, false)
+		};
+	}
+	if (limit !== void 0 && startLine + limit < scan.totalLines) {
+		const remaining = scan.totalLines - (startLine + limit);
+		return {
+			type: "text",
+			text: `${shown.text}\n\n[${remaining} more lines in file. Use offset=${startLine + limit + 1} to continue.]`
+		};
+	}
+	return {
+		type: "text",
+		text: shown.text
+	};
+});
+const readHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const resolved = yield* resolveRead(fs, params.path);
+	const stat = yield* fs.stat(resolved);
+	if (stat.isDirectory) return yield* fail("EISDIR: illegal operation on a directory, read");
+	if (!stat.isFile) return yield* fail("Not a regular file");
+	const head = yield* fs.readBytes(resolved, 0, BINARY_PROBE_BYTES);
+	const mimeType = yield* detectOf({
+		size: stat.size ?? Infinity,
+		read: (offset, length) => offset + length <= head.length ? Effect.succeed(head.subarray(offset, offset + length)) : fs.readBytes(resolved, offset, length)
+	});
+	if (mimeType !== void 0) return yield* readImage(fs, resolved, mimeType);
+	if (head.includes(0)) return yield* fail(`Unsupported read ${params.path}: binary file.`);
+	return yield* readText(fs, resolved, params);
+}).pipe(Effect.catchTag("SandboxFileSystemError", fsFailure$1(params.path)));
+/** The read tool: definition + handler, wired the testable (def/exec split) way. */
+const readTool = tool_exports.implement(readDef, readHandler);
+const readPlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.read",
+	kind: "tool",
+	setup: Effect.fn("ReadPlugin.setup")(function* (ctx) {
+		const fs = yield* io_exports.SandboxIO.FileSystem;
+		ctx.plugin.tools.add(tool_exports.provide(readTool, Layer.succeed(io_exports.SandboxIO.FileSystem, fs)));
+	})
+});
+//#endregion
+//#region src/plugin/builtin/tool/write.ts
+/**
+* The built-in write plugin. The whole write holds the file's mutation lock, so
+* it never interleaves with an `edit` of the same file; the filesystem creates
+* missing parent directories on every backend.
+*/
+const WriteParams = Schema.Struct({
+	path: Schema.String.annotate({ description: "Path to the file to write (relative or absolute)" }),
+	content: Schema.String.annotate({ description: "Content to write to the file" })
+});
+var WriteFailed = class extends Schema.TaggedError()("WriteFailed", { message: Schema.String }) {};
+const writeDef = tool_exports.define({
+	name: "write",
+	label: "write",
+	description: "Write content to a file. Creates the file if it doesn't exist, overwrites if it does. Automatically creates parent directories.",
+	promptSnippet: "Create or overwrite files",
+	promptGuidelines: ["Use write only for new files or complete rewrites."],
+	parameters: WriteParams,
+	constrainedSampling: {
+		type: "json_schema",
+		strict: "prefer"
+	},
+	success: Schema.Struct({ path: Schema.String }),
+	failure: WriteFailed,
+	encodeContent: (success) => [{
+		type: "text",
+		text: `Successfully wrote to ${success.path}`
+	}],
+	encodeFailureContent: (failure) => [{
+		type: "text",
+		text: failure.message
+	}],
+	encodeDetails: () => void 0
+});
+/** Filesystem failures are the model's to see, as the backend reported them. */
+const fsFailure = (path) => (error) => Effect.fail(new WriteFailed({ message: error.cause instanceof Error ? error.cause.message : `Could not write file: ${path}` }));
+const writeHandler = (params) => Effect.gen(function* () {
+	const fs = yield* io_exports.SandboxIO.FileSystem;
+	const mutation = yield* io_exports.SandboxIO.Mutation;
+	const path = normalize$1(params.path);
+	yield* mutation.withFile(path, fs.writeFile(path, params.content));
+	return { path: params.path };
+}).pipe(Effect.catchTag("SandboxFileSystemError", fsFailure(params.path)));
+/** The write tool: definition + handler, wired the testable (def/exec split) way. */
+const writeTool = tool_exports.implement(writeDef, writeHandler);
+const writePlugin = (0, plugin_exports$1.define)({
+	id: "codework.tool.write",
+	kind: "tool",
+	setup: Effect.fn("WritePlugin.setup")(function* (ctx) {
+		const mounted = Layer.merge(Layer.succeed(io_exports.SandboxIO.FileSystem, yield* io_exports.SandboxIO.FileSystem), Layer.succeed(io_exports.SandboxIO.Mutation, yield* io_exports.SandboxIO.Mutation));
+		ctx.plugin.tools.add(tool_exports.provide(writeTool, mounted));
+	})
+});
+//#endregion
 //#region src/plugin/builtin.ts
 /**
 * Every plugin the harness ships, and the selection a caller who passes no `plugins` gets. Tool
-* contributors come first; within the prompt domain, declaration order is run order.
+* contributors come first; within the prompt domain, declaration order is run order. The search
+* tools (grep, find, ls) are `optIn`, as Pi ships them off: settings turn each on with
+* `{ "plugin": "codework.tool.grep", "enabled": true }`.
 */
 const builtins = Object.freeze([
 	bashPlugin,
+	readPlugin,
+	writePlugin,
+	editPlugin,
+	grepPlugin,
+	findPlugin,
+	lsPlugin,
 	defaultPromptPlugin,
 	instructionPlugin
 ]);
@@ -7208,6 +8880,7 @@ const Definition = Schema.Struct({
 	id: Id,
 	kind: Schema.Literals(Object.keys(plugin_exports$1.domains)),
 	events: Schema.optional(Schema.Array(Schema.declare((value) => Predicate.hasProperty(value, "type") && Predicate.isString(value.type)))),
+	optIn: Schema.optional(Schema.Boolean),
 	setup: Schema.declare((value) => Predicate.isFunction(value))
 });
 /** Every plugin failure says which file to go and edit, when there is one. */
@@ -7493,11 +9166,14 @@ const load$1 = Effect.fn("PluginCatalog.load")(function* (references, options) {
 const select = Effect.fn("PluginCatalog.select")(function* (references, pool) {
 	const operations = /* @__PURE__ */ new Map();
 	const missing = [];
-	const choose = (id, index) => operations.set(id, {
-		enabled: true,
-		index,
-		options: operations.get(id)?.options ?? {}
-	});
+	const choose = (id, index) => {
+		const previous = operations.get(id);
+		operations.set(id, {
+			enabled: pool.plugins.get(id)?.optIn === true ? previous?.enabled ?? false : true,
+			index,
+			options: previous?.options ?? {}
+		});
+	};
 	for (const [index, reference] of references.entries()) {
 		if (isPatch(reference)) {
 			const named = reference.plugin ?? reference.package;
@@ -7812,7 +9488,8 @@ function resolveRequest(block, model) {
 *
 * Separate from {@link resolveRequest} because these steer the loop itself -- how hard to
 * think, how to schedule tool calls -- rather than the request body. Runtime bindings
-* outrank a matched block, which outranks the file's top level.
+* outrank a matched block, which outranks the file's top level. The thinking level is the
+* requested one; State clamps it to the model once the catalog lookup is in hand.
 */
 const resolveControls = (settings, block, runtime) => ({
 	thinkingLevel: runtime.thinkingLevel ?? block.thinkingLevel ?? settings.model.thinkingLevel,
@@ -7833,6 +9510,25 @@ function compose(settings, options = {}, session = {}) {
 	};
 }
 //#endregion
+//#region src/runner/attribution.ts
+const OPENROUTER_HOST = "openrouter.ai";
+const isOpenRouter = (model) => model.provider.id === "openrouter" || (model.api?.url ?? model.baseUrl).includes(OPENROUTER_HOST);
+const defaults = (model) => isOpenRouter(model) ? {
+	"HTTP-Referer": "https://codework.sh",
+	"X-OpenRouter-Title": "CodeWork",
+	"X-OpenRouter-Categories": "cli-agent,personal-agent"
+} : void 0;
+const withAttribution = (model) => {
+	const headers = defaults(model);
+	return headers === void 0 ? model : {
+		...model,
+		headers: {
+			...headers,
+			...model.headers
+		}
+	};
+};
+//#endregion
 //#region src/runner/event.ts
 const make$6 = Effect.fn("LLMEventPublisher.make")(function* (input) {
 	const events = yield* Service$16;
@@ -8087,7 +9783,7 @@ const oauthCredentials = async (protocol, options) => {
 };
 /** Start a provider stream using the model pinned by State. */
 const openWith = (options = {}) => Effect.fn("LLM.open")(function* (input, signal) {
-	const model = input.resolvedModel;
+	const model = withAttribution(input.resolvedModel);
 	const configured = runtimeOptions(input, model, signal);
 	const resolved = configured.apiKey === void 0 ? yield* Effect.tryPromise({
 		try: () => oauthCredentials(model.protocol, options),
@@ -8220,8 +9916,9 @@ const encodeOutcome = (def, call, exit, latest) => Effect.gen(function* () {
 	if (Exit.isSuccess(exit)) {
 		const encoded = yield* Schema.encodeUnknownEffect(asCodec(def.success))(exit.value).pipe(Effect.orDie);
 		const content = def.encodeContent ? def.encodeContent(exit.value) : [yield* jsonText(encoded)];
+		const details = def.encodeDetails ? def.encodeDetails(exit.value) : encoded;
 		const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
-		return completed(call, content, now, encoded);
+		return completed(call, content, now, details);
 	}
 	const cause = exit.cause;
 	if (Cause.hasInterrupts(cause)) {
@@ -8286,6 +9983,15 @@ const make$4 = (tools) => {
 		impls.set(name, entry);
 	}
 	const wire = [...impls.values()].map(({ tool }) => (0, tool_exports.toAikitTool)(tool.definition));
+	const decoders = new Map(wire.map((tool) => {
+		const decode = Schema.decodeUnknownEffect(Schema.toCodecJson(asCodec(impls.get(tool.name).tool.definition.parameters)));
+		const parse = (args) => {
+			const normalized = structuredClone(args);
+			normalizeOptionalNulls(normalized, tool.parameters);
+			return decode(normalized);
+		};
+		return [tool.name, parse];
+	}));
 	const handle = (call, options) => Effect.gen(function* () {
 		const entry = impls.get(call.name);
 		if (entry === void 0) {
@@ -8297,7 +10003,18 @@ const make$4 = (tools) => {
 		}
 		const { tool: impl, hooks } = entry;
 		const def = impl.definition;
-		const decoded = yield* Effect.result(Schema.decodeEffect(asCodec(def.parameters))(call.arguments));
+		const prepared = yield* Effect.result(Effect.try({
+			try: () => def.prepareArguments ? def.prepareArguments(call.arguments) : call.arguments,
+			catch: (cause) => cause instanceof Error ? cause.message : String(cause)
+		}));
+		if (Result.isFailure(prepared)) {
+			const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+			return errored(call, [text(`Invalid arguments for ${call.name}: ${prepared.failure}`)], now, {
+				error: "invalid_arguments",
+				name: call.name
+			});
+		}
+		const decoded = yield* Effect.result(decoders.get(call.name)(prepared.success));
 		if (Result.isFailure(decoded)) {
 			const now = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
 			return errored(call, [text(`Invalid arguments for ${call.name}: ${decoded.failure.message}`)], now, {
@@ -8568,6 +10285,8 @@ const assertTool = (tool) => {
 	if (def.failure !== void 0 && !Schema.isSchema(def.failure)) throw new Error(`Tool ${name}: failure must be an Effect Schema`);
 	if (def.encodeContent !== void 0 && !Predicate.isFunction(def.encodeContent)) throw new Error(`Tool ${name}: encodeContent must be a function`);
 	if (def.encodeFailureContent !== void 0 && !Predicate.isFunction(def.encodeFailureContent)) throw new Error(`Tool ${name}: encodeFailureContent must be a function`);
+	if (def.prepareArguments !== void 0 && !Predicate.isFunction(def.prepareArguments)) throw new Error(`Tool ${name}: prepareArguments must be a function`);
+	if (def.encodeDetails !== void 0 && !Predicate.isFunction(def.encodeDetails)) throw new Error(`Tool ${name}: encodeDetails must be a function`);
 	if (!Predicate.isFunction(tool.handler)) throw new Error(`Tool ${name}: handler must be a function`);
 };
 const assertHooks = (name, hooks) => {
@@ -8783,6 +10502,7 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 		const eventRegistry = yield* Service$4;
 		const eventService = yield* Service$16;
 		const events = makeEvents(eventService);
+		const global = yield* Service$17;
 		const loading = yield* Semaphore.make(1);
 		const updated = (origin, id, status) => eventService.publish(PluginUpdated, {
 			status,
@@ -8846,10 +10566,22 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 				...Option.getOrElse(yield* runtime.get(sessionId), () => ({}))
 			};
 			const loadedSettings = yield* settings.load(hostDir);
+			const composed = compose(loadedSettings, options, sessionOptions);
+			const resolvedModel = yield* resolve$1({
+				provider: composed.provider,
+				model: composed.model,
+				settings: composed.block,
+				models: loadedSettings.models
+			});
+			const thinkingLevel = Model.clampThinkingLevel(resolvedModel, composed.thinkingLevel);
 			return {
 				hostDir,
 				loadedSettings,
-				configured: compose(loadedSettings, options, sessionOptions)
+				configured: {
+					...composed,
+					resolvedModel,
+					thinkingLevel
+				}
 			};
 		});
 		return Service$1.of({
@@ -8881,16 +10613,10 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 			snapshot: Effect.fn("State.snapshot")(function* (sessionId) {
 				const { hostDir, loadedSettings, configured } = yield* configure(sessionId);
 				const { promptCustom, promptSystemAppend, provider: _provider, model: _model, thinkingLevel: _thinkingLevel, toolExecution: _toolExecution, ...rest } = configured.runtime;
-				const { provider, model, thinkingLevel, toolExecution } = configured;
+				const { provider, model, resolvedModel, thinkingLevel, toolExecution } = configured;
 				const request = merge(resolveOptions(configured.block), rest);
 				const sandbox = yield* io_exports.SandboxIO.Current;
 				const location = yield* Service$8;
-				const resolvedModel = yield* resolve$1({
-					provider,
-					model,
-					settings: configured.block,
-					models: loadedSettings.models
-				});
 				const refs = references(loadedSettings);
 				const failed = (cause) => new SnapshotError({
 					sessionId,
@@ -8925,6 +10651,7 @@ const layer$4 = (options, pool, references, follow, rebuild, viewOf = () => Effe
 					...yield* run(chosen.selection, {
 						sessionId,
 						sandbox,
+						paths: global,
 						location,
 						settings: loadedSettings,
 						model: resolvedModel,
@@ -9467,7 +11194,7 @@ var harness_exports = /* @__PURE__ */ __exportAll({
 });
 const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	const hostCwd = options.hostCwd ?? process.cwd();
-	const paths = yield* resolve$3(options.home === void 0 ? {} : { home: hostPath.resolve(hostCwd, expandTilde(options.home, hostPath)) });
+	const paths = yield* resolve$4(options.home === void 0 ? {} : { home: hostPath.resolve(hostCwd, expandTilde(options.home, hostPath)) });
 	const global = layerWith(paths);
 	const settingsOptions = options.userConfigDir === void 0 ? {} : { userConfigDir: userConfigDir(options.userConfigDir, hostCwd) };
 	const config = yield* load$3({