@cryer/star-cli 0.3.2 → 0.3.4

package/dist/{chunk-BV4PLM6X.js → chunk-K3R42LOX.js}

@@ -1,15 +1,134 @@
 #!/usr/bin/env node
 import {
   computeRetryDelayMs,
+  gitTreesDir,
   isRetryableStreamError,
+  responseBodyOf,
   starHome,
   summarizeStreamError,
   userMemoryPath
-} from "./chunk-LADQCYKL.js";
+} from "./chunk-B6P4VUBE.js";
 
 // src/agent/loop.ts
 import { tool as aiTool, generateText as generateText3 } from "ai";
 
+// src/config/schema.ts
+import { z } from "zod";
+var ProviderConfigSchema = z.object({
+  name: z.string(),
+  // openai-responses talks to the Responses API (/responses) instead of chat
+  // completions — the wire format codex uses, and the native API of
+  // reasoning-model relays that otherwise hide reasoning behind empty chat
+  // completions. streamChat sends strictSchemas:false + store:false with it.
+  protocol: z.enum(["openai-compatible", "anthropic", "openai-responses"]).default("openai-compatible"),
+  baseURL: z.string(),
+  apiKeyEnv: z.string().optional(),
+  apiKey: z.string().optional(),
+  headers: z.record(z.string()).optional()
+});
+var ModelConfigSchema = z.object({
+  name: z.string(),
+  provider: z.string(),
+  model: z.string(),
+  maxTokens: z.number().int().positive().optional(),
+  // Per-model context window; overrides the top-level contextMaxTokens for
+  // compaction and the status bar when set.
+  contextMaxTokens: z.number().int().positive().optional(),
+  // Cost estimation needs BOTH prices (USD per 1M tokens); with only one set
+  // the model is treated as unpriced.
+  promptPrice: z.number().nonnegative().optional(),
+  completionPrice: z.number().nonnegative().optional(),
+  // Optional price (USD per 1M tokens) for cache-read prompt tokens. When
+  // unset, OpenAI-style cached tokens bill at promptPrice and Anthropic-style
+  // cache reads are not billed — set this for accurate cache pricing.
+  cacheReadPrice: z.number().nonnegative().optional()
+});
+var PermissionsConfigSchema = z.object({
+  allow: z.array(z.string()).default([]),
+  deny: z.array(z.string()).default([])
+});
+var HookConfigSchema = z.object({
+  event: z.enum(["PreToolUse", "PostToolUse", "Stop"]),
+  matcher: z.string().refine(
+    (pattern) => {
+      try {
+        new RegExp(pattern);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    { message: "invalid regular expression" }
+  ).optional(),
+  command: z.string().min(1),
+  timeoutSec: z.number().positive().default(30)
+});
+var ConfigSchema = z.object({
+  defaultModel: z.string().default(""),
+  permissionMode: z.enum(["auto", "ask", "readonly", "yolo", "plan"]).default("ask"),
+  providers: z.array(ProviderConfigSchema).default([]),
+  models: z.array(ModelConfigSchema).default([]),
+  maxSteps: z.number().int().positive().default(50),
+  contextMaxTokens: z.number().int().positive().default(1e5),
+  // Token threshold at which the agent loop auto-compacts the history.
+  // Defaults to the effective context window (compact only when full); set a
+  // lower value to compact earlier and keep headroom. Manual /compact ignores
+  // this — it always compacts.
+  compactThresholdTokens: z.number().int().positive().optional(),
+  // Seconds without any stream part before a stalled response is ended
+  // gracefully (some relays never send the terminal chunks). Applies once
+  // streaming has started; the first part gets a longer, fixed allowance.
+  streamIdleTimeoutSec: z.number().positive().default(20),
+  // Seconds to wait for the very first stream part before giving up; slow
+  // thinking-model relays can buffer for minutes before sending anything.
+  streamFirstChunkTimeoutSec: z.number().positive().default(300),
+  // Extra attempts per model request when a stream fails transiently
+  // (network error, 429/5xx, idle watchdog cutoff) or comes back empty, so a
+  // relay hiccup does not silently end a half-finished turn. 0 disables.
+  // The wait between attempts honors Retry-After headers and otherwise backs
+  // off exponentially with jitter (llm/retry.ts); retries after a
+  // timeout/empty failure also scale both stream timeouts up (attempt number
+  // ×, capped at 3x) since the relay is likely overloaded. Default 5 matches
+  // opencode/Codex retry budgets and rides out flaky relays (中转站) better
+  // than a minimal budget.
+  streamMaxRetries: z.number().int().min(0).default(5),
+  // How many consecutive unproductive replies may be nudged before the turn
+  // is handed back: a text-only reply that announces pending work ("我将…",
+  // "I will…") or answers a nudge with more words, or an empty reply that
+  // survived the stream retry budget (steered with a nudge — a changed
+  // request — since identical resends already failed). Tool calls reset the
+  // count, so a productive task keeps going; exhaustion surfaces a notice
+  // instead of stopping silently. Never fires in plan mode. 0 disables.
+  maxAutoContinues: z.number().int().min(0).default(2),
+  contextCompaction: z.enum(["summary", "truncate"]).default("summary"),
+  // Optional per-session dollar budget; when set, the REPL stops the session
+  // once the estimated cost for the session reaches this amount.
+  sessionBudgetUsd: z.number().positive().optional(),
+  // Terminal bell (REPL only): ring when a turn takes longer than
+  // notifyBellThresholdSec, and when a background task finishes.
+  // STAR_NO_NOTIFY=1 disables without touching the config.
+  notifyBell: z.boolean().default(true),
+  notifyBellThresholdSec: z.number().positive().default(10),
+  permissions: PermissionsConfigSchema.default({ allow: [], deny: [] }),
+  hooks: z.array(HookConfigSchema).default([]),
+  // Consecutive identical tool calls (same tool + same arguments) allowed
+  // before the loop refuses to execute the repeat and tells the model to
+  // change approach — a guard against agents stuck retrying a failing call
+  // (opencode's doom_loop). 0 disables.
+  doomLoopThreshold: z.number().int().min(0).default(3),
+  // Track the whole working tree with an internal git repo (outside the
+  // user's .git) at every turn boundary, so /undo and /redo can restore
+  // changes made by ANY tool (bash included), not just write_file/edit_file.
+  // Falls back silently to per-file snapshots when git is unavailable.
+  gitSnapshots: z.boolean().default(true)
+});
+function contextWindowTokens(config, modelName) {
+  return config.models.find((m) => m.name === modelName)?.contextMaxTokens ?? config.contextMaxTokens;
+}
+function resolveCompactThreshold(config, windowTokens) {
+  return Math.min(config.compactThresholdTokens ?? windowTokens, windowTokens);
+}
+
 // src/context/compaction.ts
 import { generateText } from "ai";
 
@@ -89,19 +208,24 @@ function serializeMessage(message) {
   });
   return `${message.role}: ${parts.join("\n")}`;
 }
-async function summarizeMessages(messages, model) {
+async function summarizeMessages(messages, model, signal) {
   const transcript = messages.map(serializeMessage).join("\n");
   const { text } = await generateText({
     model,
     system: SUMMARY_SYSTEM_PROMPT,
     prompt: `Summarize this conversation so far:
 
-${transcript}`
+${transcript}`,
+    // A hung relay must not stall the whole turn on the summary: cap it at
+    // 60s and let the caller's abort (Esc) cut it short as well; the caller
+    // falls back to the truncation placeholder on any failure.
+    abortSignal: signal ? AbortSignal.any([signal, AbortSignal.timeout(6e4)]) : AbortSignal.timeout(6e4)
   });
   return text.trim();
 }
-function compactMessages(messages, maxTokens) {
-  if (estimateTokens(messages) <= maxTokens) {
+function compactMessages(messages, maxTokens, opts = {}) {
+  const limit = opts.force ? 0 : maxTokens;
+  if (estimateTokens(messages) <= limit) {
     return { messages, compacted: false, droppedCount: 0 };
   }
   const first = messages[0];
@@ -127,7 +251,7 @@ function compactMessages(messages, maxTokens) {
     droppedCount += turn.length;
     turnIndex += 1;
     const candidate = [...head, placeholderMessage(droppedCount), ...rest.slice(droppedCount)];
-    if (estimateTokens(candidate) <= maxTokens) {
+    if (estimateTokens(candidate) <= limit) {
       break;
     }
   }
@@ -172,6 +296,16 @@ function getGitSummary(cwd) {
   const log = runGit(["log", "--oneline", "-3"], cwd) ?? "";
   return { branch, dirtyCount, recentCommits: log === "" ? [] : log.split("\n") };
 }
+var GIT_SUMMARY_CACHE_TTL_MS = 15e3;
+var gitSummaryCache = /* @__PURE__ */ new Map();
+function getGitSummaryCached(cwd) {
+  const now = Date.now();
+  const hit = gitSummaryCache.get(cwd);
+  if (hit && now - hit.at < GIT_SUMMARY_CACHE_TTL_MS) return hit.summary;
+  const summary = getGitSummary(cwd);
+  gitSummaryCache.set(cwd, { at: now, summary });
+  return summary;
+}
 function formatGitSummary(summary) {
   const lines = [
     "Git context for the working directory (refreshed each turn):",
@@ -332,7 +466,8 @@ var IMAGE_SIZE_KEYWORDS = /too[\s-]*(large|big)|exceeds?|dimensions?|resolution|
 function isOversizedImageError(error) {
   const status = error.statusCode;
   if (typeof status !== "number" || status < 400 || status >= 500) return false;
-  return /image/i.test(error.message) && IMAGE_SIZE_KEYWORDS.test(error.message);
+  const text = [error.message, responseBodyOf(error)].filter((part) => typeof part === "string").join("\n");
+  return /image/i.test(text) && IMAGE_SIZE_KEYWORDS.test(text);
 }
 function imagePartBytes(image) {
   if (typeof image === "string") {
@@ -541,8 +676,50 @@ async function runHooks(event, hooks2, ctx) {
 }
 
 // src/permissions/gate.ts
+import fs from "fs";
 import path from "path";
 
+// src/core/sensitive.ts
+var SENSITIVE_BASENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  ".npmrc",
+  ".netrc",
+  ".pgpass"
+]);
+var SENSITIVE_SUFFIXES = [".pem", ".key", ".p12", ".pfx"];
+var SENSITIVE_ENV_EXEMPTIONS = /* @__PURE__ */ new Set([".env.example", ".env.sample", ".env.template"]);
+function pathSegments(p) {
+  return p.replace(/\\/g, "/").split("/").filter(Boolean).map((s) => s.toLowerCase());
+}
+function isSensitivePath(p) {
+  const segments = pathSegments(p);
+  const base = segments[segments.length - 1] ?? "";
+  if (SENSITIVE_ENV_EXEMPTIONS.has(base)) {
+    return false;
+  }
+  if (base === ".env" || base.startsWith(".env.")) {
+    return true;
+  }
+  if (SENSITIVE_BASENAMES.has(base)) {
+    return true;
+  }
+  if (SENSITIVE_SUFFIXES.some((suffix) => base.endsWith(suffix))) {
+    return true;
+  }
+  const dir = segments[segments.length - 2] ?? "";
+  if (dir === ".aws" && base === "credentials") {
+    return true;
+  }
+  if (dir === ".kube" && base === "config") {
+    return true;
+  }
+  return false;
+}
+
 // src/permissions/allow.ts
 function parseAllowRule(rule) {
   const match = /^([\w-]+)(?:\((.*)\))?$/.exec(rule.trim());
@@ -566,11 +743,32 @@ function matchAllowRule(rule, req) {
   const target = requestTarget(req);
   return target !== void 0 && globMatch(rule.pattern, target);
 }
+function splitCommandChain(command) {
+  if (command.includes("$(") || command.includes("`")) return null;
+  return command.split(/&&|\|\||[;|\n]/).map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+}
+function withCommand(req, command) {
+  return {
+    ...req,
+    args: { ...req.args ?? {}, command }
+  };
+}
 function isAllowedByRules(rules, req) {
-  return matchesAnyRule(rules, req);
+  if (req.toolName !== "bash") return matchesAnyRule(rules, req);
+  const command = requestTarget(req);
+  if (command === void 0) return matchesAnyRule(rules, req);
+  const segments = splitCommandChain(command);
+  if (segments === null) return false;
+  if (segments.length === 0) return matchesAnyRule(rules, req);
+  return segments.every((segment) => matchesAnyRule(rules, withCommand(req, segment)));
 }
 function isDeniedByRules(rules, req) {
-  return matchesAnyRule(rules, req);
+  if (req.toolName !== "bash") return matchesAnyRule(rules, req);
+  const command = requestTarget(req);
+  if (command === void 0) return matchesAnyRule(rules, req);
+  const segments = splitCommandChain(command);
+  if (segments === null || segments.length === 0) return matchesAnyRule(rules, req);
+  return segments.some((segment) => matchesAnyRule(rules, withCommand(req, segment)));
 }
 function matchesAnyRule(rules, req) {
   return rules.some((raw) => {
@@ -584,10 +782,17 @@ function buildAllowRule(req) {
 }
 
 // src/permissions/gate.ts
-var FILE_TOOLS = /* @__PURE__ */ new Set(["write_file", "edit_file", "read_file"]);
+var FILE_TOOLS = /* @__PURE__ */ new Set(["write_file", "edit_file", "read_file", "grep", "glob"]);
 var DANGEROUS_COMMAND_PATTERNS = [
   /rm\s+-rf\s+\/(?:\s|$|;|&)/i,
   /rm\s+-rf\s+~(?:\s|\/|$|;|&)/i,
+  /rm\s+-rf\s+\.\/?(?:\s|$|;|&)/i,
+  /rm\s+-rf\s+\*(?:\s|$|;|&)/i,
+  /\bsudo\s+rm\b/i,
+  /\bdel\s+\/s\b/i,
+  /\brd\s+\/s\b/i,
+  /\bformat\s+[a-z]:/i,
+  /\bdiskpart\b/i,
   /:\(\)\s*\{\s*:\|:&\s*\}\s*;:/,
   /\bmkfs\b/i,
   /dd\s+[^|;]*\bif=/i,
@@ -617,12 +822,30 @@ function isOutsideCwd(p, cwd) {
   const base = normalizeAbsolute(cwd, cwd);
   return abs !== base && !abs.startsWith(`${base}/`);
 }
-function isSensitivePath(p) {
-  const base = p.replace(/\\/g, "/").split("/").pop()?.toLowerCase() ?? "";
-  if (base === ".env.example" || base === ".env.sample" || base === ".env.template") {
-    return false;
+function resolveRealPath(p, cwd) {
+  let current = path.isAbsolute(p) ? path.normalize(p) : path.resolve(cwd, p);
+  const missing = [];
+  for (; ; ) {
+    try {
+      return path.join(fs.realpathSync(current), ...missing.reverse());
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return null;
+      missing.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+function isOutsideForWrite(p, cwd) {
+  const resolved = resolveRealPath(p, cwd);
+  if (resolved === null) return isOutsideCwd(p, cwd);
+  let realCwd;
+  try {
+    realCwd = fs.realpathSync(cwd);
+  } catch {
+    return isOutsideCwd(p, cwd);
   }
-  return base === ".env" || base.startsWith(".env.") || base === "id_rsa" || base.endsWith(".pem");
+  return isOutsideCwd(resolved, realCwd);
 }
 function checkPermission(mode, req, ctx, allowRules = [], denyRules = []) {
   if (mode === "yolo") {
@@ -634,10 +857,12 @@ function checkPermission(mode, req, ctx, allowRules = [], denyRules = []) {
     return "deny";
   }
   if (FILE_TOOLS.has(req.toolName) && filePath !== void 0) {
-    if ((req.toolName === "write_file" || req.toolName === "edit_file") && isSensitivePath(filePath)) {
+    const isWriteTool = req.toolName === "write_file" || req.toolName === "edit_file";
+    if (isWriteTool && isSensitivePath(filePath)) {
       return "deny";
     }
-    if (isOutsideCwd(filePath, ctx.cwd)) {
+    const outside = isWriteTool ? isOutsideForWrite(filePath, ctx.cwd) : isOutsideCwd(filePath, ctx.cwd);
+    if (outside) {
       if (mode === "ask" && req.level === "read") {
         return "ask";
       }
@@ -708,10 +933,93 @@ function scheduleSessionTitle(store, userText, model) {
   });
 }
 
-// src/tools/fs/snapshots.ts
-import { mkdir, readFile, rm, writeFile } from "fs/promises";
+// src/snapshot/git-tree.ts
+import { execFile } from "child_process";
+import { existsSync } from "fs";
+import { mkdir } from "fs/promises";
+import os from "os";
 import path2 from "path";
+var GIT_TIMEOUT_MS2 = 1e4;
+var GIT_MAX_BUFFER2 = 8 * 1024 * 1024;
+function runGit2(args) {
+  return new Promise((resolve) => {
+    execFile(
+      "git",
+      args,
+      { timeout: GIT_TIMEOUT_MS2, maxBuffer: GIT_MAX_BUFFER2, encoding: "utf8" },
+      (error, stdout) => {
+        resolve(error ? null : stdout.trim());
+      }
+    );
+  });
+}
+var gitAvailable = null;
+async function isGitAvailable() {
+  if (gitAvailable === null) {
+    gitAvailable = await runGit2(["--version"]) !== null;
+  }
+  return gitAvailable;
+}
+function treeRepoDir(cwd) {
+  const key = Buffer.from(path2.resolve(cwd), "utf8").toString("base64url");
+  return path2.join(gitTreesDir(), key);
+}
+function isGuardedDir(cwd) {
+  const resolved = path2.resolve(cwd);
+  const home = path2.resolve(os.homedir());
+  const same = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+  return same(resolved, home) || same(resolved, path2.parse(resolved).root);
+}
+async function ensureTreeRepo(cwd) {
+  const dir = treeRepoDir(cwd);
+  if (existsSync(path2.join(dir, "HEAD"))) return dir;
+  await mkdir(path2.dirname(dir), { recursive: true });
+  const out = await runGit2(["init", "--bare", dir]);
+  return out === null ? null : dir;
+}
+function repoArgs(dir, cwd) {
+  return [`--git-dir=${dir}`, `--work-tree=${cwd}`];
+}
+async function trackTree(cwd) {
+  if (isGuardedDir(cwd)) return null;
+  if (!await isGitAvailable()) return null;
+  const dir = await ensureTreeRepo(cwd);
+  if (!dir) return null;
+  const base = repoArgs(dir, cwd);
+  if (await runGit2([...base, "add", "-A"]) === null) return null;
+  return runGit2([...base, "write-tree"]);
+}
+async function restoreTree(cwd, hash) {
+  if (isGuardedDir(cwd)) return false;
+  if (!await isGitAvailable()) return false;
+  const dir = treeRepoDir(cwd);
+  if (!existsSync(path2.join(dir, "HEAD"))) return false;
+  const base = repoArgs(dir, cwd);
+  if (await runGit2([...base, "read-tree", hash]) === null) return false;
+  if (await runGit2([...base, "checkout-index", "-f", "-a"]) === null) return false;
+  if (await runGit2([...base, "clean", "-fd"]) === null) return false;
+  return true;
+}
+async function diffTreeNames(cwd, hash) {
+  if (!await isGitAvailable()) return null;
+  const dir = treeRepoDir(cwd);
+  if (!existsSync(path2.join(dir, "HEAD"))) return null;
+  const base = repoArgs(dir, cwd);
+  const changed = await runGit2([...base, "diff", "--name-only", hash]);
+  const untracked = await runGit2([...base, "ls-files", "--others", "--exclude-standard"]);
+  if (changed === null || untracked === null) return null;
+  const names = /* @__PURE__ */ new Set();
+  for (const line of [...changed.split("\n"), ...untracked.split("\n")]) {
+    if (line !== "") names.add(line);
+  }
+  return [...names];
+}
+
+// src/tools/fs/snapshots.ts
+import { mkdir as mkdir2, readFile, rm, stat, writeFile } from "fs/promises";
+import path3 from "path";
 var MAX_SNAPSHOTS = 50;
+var MAX_SNAPSHOT_CONTENT_BYTES = 5 * 1024 * 1024;
 var stack = [];
 var activeTurn = 0;
 var activeTurnMessageIndex = -1;
@@ -733,28 +1041,48 @@ function currentTurnSeq() {
 function currentTurnMessageIndex() {
   return activeTurnMessageIndex;
 }
-async function captureSnapshot(filePath, toolName) {
+function ownerOf(snapshot) {
+  return snapshot.owner ?? "root";
+}
+async function captureSnapshot(filePath, toolName, snapshotContext) {
   let content = null;
   let existed = false;
-  try {
-    content = await readFile(filePath, "utf8");
+  let contentTooLarge = false;
+  const st = await stat(filePath).catch(() => null);
+  if (st?.isFile()) {
     existed = true;
-  } catch {
+    if (st.size > MAX_SNAPSHOT_CONTENT_BYTES) {
+      contentTooLarge = true;
+    } else {
+      try {
+        content = await readFile(filePath, "utf8");
+      } catch {
+        existed = false;
+      }
+    }
   }
   return {
     id: nextSnapshotId(),
     path: filePath,
     existed,
     content,
+    contentTooLarge: contentTooLarge || void 0,
     toolName,
     timestamp: Date.now(),
-    turn: activeTurn,
-    messageIndex: activeTurnMessageIndex
+    turn: snapshotContext?.turn ?? activeTurn,
+    messageIndex: snapshotContext?.messageIndex ?? activeTurnMessageIndex,
+    owner: snapshotContext?.owner ?? "root"
   };
 }
 async function pushSnapshot(snapshot) {
   stack.push(snapshot);
-  await hooks?.onPush?.(snapshot);
+  try {
+    await hooks?.onPush?.(snapshot);
+  } catch (err) {
+    if (process.env.STAR_DEBUG) {
+      console.error("[star] failed to persist snapshot checkpoint:", err);
+    }
+  }
   if (stack.length > MAX_SNAPSHOTS) {
     const evicted = stack.splice(0, stack.length - MAX_SNAPSHOTS);
     await removeFromStore(evicted.map((s) => s.id));
@@ -787,191 +1115,156 @@ async function resolveContent(snapshot) {
 }
 async function revert(snapshot) {
   if (snapshot.existed) {
+    if (snapshot.contentTooLarge) {
+      return `Skipped ${snapshot.path}: content too large, not restored.`;
+    }
     const content = await resolveContent(snapshot);
     if (content === null) {
       return `Skipped ${snapshot.path}: the snapshot content is no longer available.`;
     }
-    await mkdir(path2.dirname(snapshot.path), { recursive: true });
+    await mkdir2(path3.dirname(snapshot.path), { recursive: true });
     await writeFile(snapshot.path, content, "utf8");
     return `Restored ${snapshot.path} to its state before ${snapshot.toolName}.`;
   }
   await rm(snapshot.path, { force: true });
   return `Deleted ${snapshot.path} (it did not exist before ${snapshot.toolName}).`;
 }
-function listTurnSnapshots(turn) {
-  return stack.filter((snapshot) => snapshot.turn === turn).reverse();
+function listTurnSnapshots(turn, includeSubagent = false) {
+  return stack.filter(
+    (snapshot) => snapshot.turn === turn && (includeSubagent || ownerOf(snapshot) === "root")
+  ).reverse();
 }
 function resolveSnapshotContent(snapshot) {
   return resolveContent(snapshot);
 }
-async function undoTurnSnapshots(turn) {
+async function undoTurnSnapshots(turn, includeSubagent = false) {
   const matches = [];
   for (let i = stack.length - 1; i >= 0; i--) {
     const snapshot = stack[i];
-    if (snapshot && snapshot.turn === turn) {
+    if (snapshot && snapshot.turn === turn && (includeSubagent || ownerOf(snapshot) === "root")) {
       matches.push(snapshot);
-      stack.splice(i, 1);
     }
   }
-  await removeFromStore(matches.map((s) => s.id));
   const messages = [];
+  const revertedIds = [];
   for (const snapshot of matches) {
-    messages.push(await revert(snapshot));
+    try {
+      messages.push(await revert(snapshot));
+      const idx = stack.indexOf(snapshot);
+      if (idx >= 0) stack.splice(idx, 1);
+      revertedIds.push(snapshot.id);
+    } catch (err) {
+      messages.push(
+        `Failed to revert ${snapshot.path}: ${err.message} (checkpoint kept)`
+      );
+    }
   }
+  await removeFromStore(revertedIds);
   return messages;
 }
-async function rewindToSnapshot(id) {
+async function dropTurnSnapshots(turn, includeSubagent = false) {
+  const dropped = [];
+  for (let i = stack.length - 1; i >= 0; i--) {
+    const snapshot = stack[i];
+    if (snapshot && snapshot.turn === turn && (includeSubagent || ownerOf(snapshot) === "root")) {
+      dropped.push(snapshot.id);
+      stack.splice(i, 1);
+    }
+  }
+  await removeFromStore(dropped);
+  return dropped.length;
+}
+async function rewindToSnapshot(id, includeSubagent = false) {
   if (!stack.some((snapshot) => snapshot.id === id)) return null;
   const matches = [];
   for (let i = stack.length - 1; i >= 0; i--) {
     const snapshot = stack[i];
-    if (snapshot && snapshot.id >= id) {
+    if (snapshot && snapshot.id >= id && (includeSubagent || ownerOf(snapshot) === "root")) {
       matches.push(snapshot);
-      stack.splice(i, 1);
     }
   }
-  await removeFromStore(matches.map((s) => s.id));
   const reverted = [];
+  const revertedIds = [];
   let messageIndex = null;
   for (const snapshot of matches) {
-    reverted.push(await revert(snapshot));
-    if (snapshot.messageIndex >= 0) {
-      messageIndex = messageIndex === null ? snapshot.messageIndex : Math.min(messageIndex, snapshot.messageIndex);
-    }
-  }
-  return { reverted, messageIndex };
-}
-
-// src/tools/todo.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import path3 from "path";
-import { z } from "zod";
-var todoItemSchema = z.object({
-  id: z.number().int(),
-  title: z.string(),
-  status: z.enum(["pending", "in_progress", "done"])
-});
-var writeSchema = z.object({
-  todos: z.array(todoItemSchema).describe("The full todo list, replacing the current one")
-});
-var readSchema = z.object({});
-function fileFor(cwd) {
-  return path3.join(cwd, ".star", "todos.json");
-}
-var TodoStore = class {
-  items = /* @__PURE__ */ new Map();
-  list() {
-    return [...this.items.values()];
-  }
-  replace(items) {
-    this.items.clear();
-    for (const item of items) {
-      this.items.set(item.id, item);
-    }
-  }
-  async load(cwd) {
-    let raw;
-    try {
-      raw = await readFile2(fileFor(cwd), "utf8");
-    } catch {
-      return;
-    }
     try {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        this.replace(parsed.filter((it) => todoItemSchema.safeParse(it).success));
+      reverted.push(await revert(snapshot));
+      const idx = stack.indexOf(snapshot);
+      if (idx >= 0) stack.splice(idx, 1);
+      revertedIds.push(snapshot.id);
+      if (snapshot.messageIndex >= 0) {
+        messageIndex = messageIndex === null ? snapshot.messageIndex : Math.min(messageIndex, snapshot.messageIndex);
       }
-    } catch {
+    } catch (err) {
+      reverted.push(
+        `Failed to revert ${snapshot.path}: ${err.message} (checkpoint kept)`
+      );
     }
   }
-  async save(cwd) {
-    await mkdir2(path3.join(cwd, ".star"), { recursive: true });
-    await writeFile2(fileFor(cwd), `${JSON.stringify(this.list(), null, 2)}
-`);
-  }
-};
-var SYMBOLS = {
-  pending: "[ ]",
-  in_progress: "[~]",
-  done: "[x]"
-};
-function formatTodos(items) {
-  if (items.length === 0) {
-    return "No todos.";
-  }
-  const lines = items.map((it) => `${SYMBOLS[it.status]} ${it.id}. ${it.title}`);
-  const width = Math.max(...lines.map((l) => l.length));
-  return lines.map((line, i) => {
-    const status = items[i]?.status;
-    return status === "pending" ? line : `${line.padEnd(width + 4)}(${status})`;
-  }).join("\n");
-}
-var defaultStore = new TodoStore();
-function parseTodoArgs(args) {
-  const parsed = writeSchema.safeParse(args);
-  return parsed.success ? parsed.data.todos : null;
-}
-function pendingTodoTitles(args) {
-  return (parseTodoArgs(args) ?? []).filter((t) => t.status !== "done").map((t) => t.title);
-}
-async function loadTodos(cwd) {
-  await defaultStore.load(cwd);
-  return defaultStore.list();
-}
-function resetTodos() {
-  defaultStore.replace([]);
-}
-function createTodoTools(store = defaultStore) {
-  const todoWrite = {
-    name: "todo_write",
-    description: "Replace the current todo list with the given items. Each item has an id, title, and status (pending, in_progress, done).",
-    permission: "read",
-    parameters: writeSchema,
-    async execute(args, ctx) {
-      const parsed = writeSchema.safeParse(args);
-      if (!parsed.success) {
-        return { content: `Invalid todos: ${parsed.error.message}`, isError: true };
-      }
-      store.replace(parsed.data.todos);
-      await store.save(ctx.cwd);
-      const items = store.list();
-      const done = items.filter((it) => it.status === "done").length;
-      return { content: `Todo list updated (${done}/${items.length} done).` };
-    }
-  };
-  const todoRead = {
-    name: "todo_read",
-    description: "Read the current todo list.",
-    permission: "read",
-    parameters: readSchema,
-    async execute() {
-      return { content: formatTodos(store.list()) };
-    }
-  };
-  return [todoWrite, todoRead];
+  await removeFromStore(revertedIds);
+  return { reverted, messageIndex };
 }
 
-// src/agent/agent-tasks.ts
+// src/tools/bash.ts
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import path4 from "path";
+import { z as z2 } from "zod";
+
+// src/tasks/manager.ts
+import { spawn as spawn2 } from "child_process";
 import { EventEmitter } from "events";
-var AgentTaskManager = class extends EventEmitter {
+var MAX_TASK_OUTPUT = 1e5;
+var DEFAULT_TASK_TIMEOUT = 3600;
+var MAX_FINISHED_RECORDS = 50;
+var TRUNCATED_PREFIX = "[... earlier output truncated ...]\n";
+var TaskManager = class extends EventEmitter {
   records = /* @__PURE__ */ new Map();
-  counter = 0;
-  start(run, meta) {
-    const id = `agent-${++this.counter}`;
+  seq = 0;
+  start(opts) {
+    const id = `task-${++this.seq}`;
+    const spec = resolveShell();
+    const child = spawn2(spec.shell, spec.wrap(opts.command), {
+      cwd: opts.cwd,
+      windowsHide: true,
+      // POSIX: the child leads its own process group so killTree can SIGKILL
+      // the whole tree with a negative pid (Windows uses taskkill /t).
+      detached: process.platform !== "win32"
+    });
     const rec = {
       id,
-      prompt: meta.prompt,
-      description: meta.description,
+      command: opts.command,
+      description: opts.description,
       status: "running",
       startedAt: Date.now(),
-      result: "",
-      controller: new AbortController(),
-      notified: false
+      output: "",
+      truncated: false,
+      child
     };
     this.records.set(id, rec);
-    void run(rec.controller.signal).then((result) => this.finish(rec, "completed", result)).catch(
-      (error) => this.finish(rec, "failed", error instanceof Error ? error.message : String(error))
-    );
+    const append = (d) => {
+      rec.output += d.toString("utf8");
+      if (rec.output.length > MAX_TASK_OUTPUT) {
+        rec.output = rec.output.slice(-MAX_TASK_OUTPUT);
+        rec.truncated = true;
+      }
+    };
+    child.stdout.on("data", append);
+    child.stderr.on("data", append);
+    child.on("error", (err) => {
+      append(Buffer.from(`Failed to start shell '${spec.label}': ${err.message}
+`));
+      if (rec.status === "running") {
+        this.finish(rec, "failed", null);
+      }
+    });
+    child.on("close", (code) => {
+      if (rec.status !== "running") return;
+      this.finish(rec, code === 0 ? "completed" : "failed", code);
+    });
+    const timeoutSeconds = opts.timeoutSeconds ?? DEFAULT_TASK_TIMEOUT;
+    rec.timer = setTimeout(() => this.terminate(rec, "timed_out"), timeoutSeconds * 1e3);
+    rec.timer.unref();
     this.emitUpdate(rec);
     return this.snapshot(rec);
   }
@@ -992,312 +1285,39 @@ var AgentTaskManager = class extends EventEmitter {
   kill(id) {
     const rec = this.records.get(id);
     if (!rec || rec.status !== "running") return void 0;
-    rec.controller.abort();
-    this.finish(rec, "stopped", rec.result || "Stopped by user.");
+    this.terminate(rec, "stopped");
     return this.snapshot(rec);
   }
   cleanup() {
     const killed = [];
     for (const rec of this.records.values()) {
       if (rec.status === "running") {
-        rec.controller.abort();
-        this.finish(rec, "stopped", rec.result || "Stopped on shutdown.");
+        this.terminate(rec, "stopped");
         killed.push(this.snapshot(rec));
       }
     }
     return killed;
   }
-  // Finished tasks whose result has not yet been handed to the parent loop.
-  drainNotifications() {
-    const drained = [];
-    for (const rec of this.records.values()) {
-      if (rec.status !== "running" && !rec.notified) {
-        rec.notified = true;
-        drained.push(this.snapshot(rec));
-      }
-    }
-    return drained;
-  }
-  finish(rec, status, result) {
-    if (rec.status !== "running") return;
-    rec.status = status;
-    rec.result = result;
-    rec.endedAt = Date.now();
-    this.emitUpdate(rec);
-  }
-  emitUpdate(rec) {
-    this.emit("update", this.snapshot(rec));
-  }
-  snapshot(rec) {
-    return {
-      id: rec.id,
-      prompt: rec.prompt,
-      description: rec.description,
-      status: rec.status,
-      startedAt: rec.startedAt,
-      endedAt: rec.endedAt,
-      result: rec.result
-    };
-  }
-};
-var defaultAgentTasks = new AgentTaskManager();
-
-// src/agent/project-memory.ts
-import { readFileSync, statSync } from "fs";
-import path4 from "path";
-var PROJECT_MEMORY_FILE = "AGENTS.md";
-var PROJECT_MEMORY_MAX_CHARS = 32 * 1024;
-var cache = /* @__PURE__ */ new Map();
-function readProjectMemory(cwd) {
-  const file = path4.join(cwd, PROJECT_MEMORY_FILE);
-  let mtimeMs;
-  try {
-    mtimeMs = statSync(file).mtimeMs;
-  } catch {
-    return null;
-  }
-  const hit = cache.get(file);
-  if (hit && hit.mtimeMs === mtimeMs) return hit.block;
-  let block = null;
-  try {
-    let body = readFileSync(file, "utf8").trim();
-    if (body) {
-      if (body.length > PROJECT_MEMORY_MAX_CHARS) {
-        body = `${body.slice(0, PROJECT_MEMORY_MAX_CHARS)}
-
-[AGENTS.md truncated to ${PROJECT_MEMORY_MAX_CHARS} characters]`;
-      }
-      block = `# Project instructions (AGENTS.md)
-${body}`;
-    }
-  } catch {
-    block = null;
-  }
-  cache.set(file, { mtimeMs, block });
-  return block;
-}
-
-// src/agent/skills.ts
-import { readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "fs";
-import path5 from "path";
-import { z as z2 } from "zod";
-var SKILL_FILE = "SKILL.md";
-var SKILL_MAX_CHARS = 32 * 1024;
-var NAME_PATTERN = /^[a-z0-9-]+$/;
-function parseFrontmatter(raw) {
-  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
-  if (!match) return null;
-  const meta = {};
-  for (const line of (match[1] ?? "").split(/\r?\n/)) {
-    const kv = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
-    if (kv?.[1]) meta[kv[1]] = (kv[2] ?? "").trim();
-  }
-  return { meta, body: raw.slice(match[0].length).trim() };
-}
-var cache2 = /* @__PURE__ */ new Map();
-function parseSkillFile(filePath, dirName, scope) {
-  let mtimeMs;
-  try {
-    mtimeMs = statSync2(filePath).mtimeMs;
-  } catch {
-    return null;
-  }
-  const hit = cache2.get(filePath);
-  if (hit && hit.mtimeMs === mtimeMs) return hit.skill;
-  let skill = null;
-  try {
-    const parsed = parseFrontmatter(readFileSync2(filePath, "utf8"));
-    const name = parsed?.meta.name || dirName;
-    const description = parsed?.meta.description;
-    if (parsed && NAME_PATTERN.test(name) && description) {
-      skill = { name, description, filePath, dir: path5.dirname(filePath), scope };
-    }
-  } catch {
-    skill = null;
-  }
-  cache2.set(filePath, { mtimeMs, skill });
-  return skill;
-}
-function scanDir(base, scope, into) {
-  let entries;
-  try {
-    entries = readdirSync(base);
-  } catch {
-    return;
-  }
-  for (const entry of entries.sort()) {
-    if (!NAME_PATTERN.test(entry)) continue;
-    const parsed = parseSkillFile(path5.join(base, entry, SKILL_FILE), entry, scope);
-    if (parsed) into.set(parsed.name, parsed);
-  }
-}
-function discoverSkills(cwd, home = starHome()) {
-  const byName = /* @__PURE__ */ new Map();
-  scanDir(path5.join(home, "skills"), "user", byName);
-  scanDir(path5.join(cwd, ".star", "skills"), "project", byName);
-  return [...byName.values()];
-}
-function formatSkillsBlock(skills) {
-  const lines = skills.map((s) => `- ${s.name}: ${s.description}`);
-  return [
-    "# Available skills",
-    "When the user's request matches one of these skills, call the skill tool with its name to load the full instructions before proceeding:",
-    ...lines
-  ].join("\n");
-}
-function loadSkillBody(skill) {
-  let parsed = null;
-  try {
-    parsed = parseFrontmatter(readFileSync2(skill.filePath, "utf8"));
-  } catch {
-    return null;
-  }
-  if (!parsed?.body) return null;
-  if (parsed.body.length > SKILL_MAX_CHARS) {
-    return `${parsed.body.slice(0, SKILL_MAX_CHARS)}
-
-[skill truncated to ${SKILL_MAX_CHARS} characters]`;
-  }
-  return parsed.body;
-}
-function createSkillTool(deps) {
-  return {
-    name: "skill",
-    description: "Load the full instructions of a skill by name. Available skills are listed in the system prompt when present; call this before starting work that matches one of them.",
-    permission: "read",
-    parameters: z2.object({
-      name: z2.string().describe("Name of the skill to load, as listed in the system prompt.")
-    }),
-    async execute(args) {
-      const skills = discoverSkills(deps.cwd, deps.home);
-      const skill = skills.find((s) => s.name === args.name);
-      if (!skill) {
-        const available = skills.map((s) => s.name).join(", ") || "none";
-        return {
-          content: `Unknown skill: "${args.name}". Available skills: ${available}`,
-          isError: true
-        };
-      }
-      const body = loadSkillBody(skill);
-      if (!body) {
-        return { content: `Skill "${skill.name}" is empty or unreadable.`, isError: true };
-      }
-      return {
-        content: [
-          `# Skill: ${skill.name}`,
-          "",
-          body,
-          "",
-          `Base directory for relative file references in this skill: ${skill.dir}`
-        ].join("\n")
-      };
-    }
-  };
-}
-
-// src/agent/subagent.ts
-import { z as z12 } from "zod";
-
-// src/tools/bash.ts
-import { spawn as spawn3 } from "child_process";
-import { existsSync } from "fs";
-import path6 from "path";
-import { z as z3 } from "zod";
-
-// src/tasks/manager.ts
-import { spawn as spawn2 } from "child_process";
-import { EventEmitter as EventEmitter2 } from "events";
-var MAX_TASK_OUTPUT = 1e5;
-var DEFAULT_TASK_TIMEOUT = 3600;
-var TRUNCATED_PREFIX = "[... earlier output truncated ...]\n";
-var TaskManager = class extends EventEmitter2 {
-  records = /* @__PURE__ */ new Map();
-  seq = 0;
-  start(opts) {
-    const id = `task-${++this.seq}`;
-    const spec = resolveShell();
-    const child = spawn2(spec.shell, spec.wrap(opts.command), {
-      cwd: opts.cwd,
-      windowsHide: true
-    });
-    const rec = {
-      id,
-      command: opts.command,
-      description: opts.description,
-      status: "running",
-      startedAt: Date.now(),
-      output: "",
-      truncated: false,
-      child
-    };
-    this.records.set(id, rec);
-    const append = (d) => {
-      rec.output += d.toString("utf8");
-      if (rec.output.length > MAX_TASK_OUTPUT) {
-        rec.output = rec.output.slice(-MAX_TASK_OUTPUT);
-        rec.truncated = true;
-      }
-    };
-    child.stdout.on("data", append);
-    child.stderr.on("data", append);
-    child.on("error", (err) => {
-      append(Buffer.from(`Failed to start shell '${spec.label}': ${err.message}
-`));
-      if (rec.status === "running") {
-        this.finish(rec, "failed", null);
-      }
-    });
-    child.on("close", (code) => {
-      if (rec.status !== "running") return;
-      this.finish(rec, code === 0 ? "completed" : "failed", code);
-    });
-    const timeoutSeconds = opts.timeoutSeconds ?? DEFAULT_TASK_TIMEOUT;
-    rec.timer = setTimeout(() => this.terminate(rec, "timed_out"), timeoutSeconds * 1e3);
-    rec.timer.unref();
-    this.emitUpdate(rec);
-    return this.snapshot(rec);
-  }
-  get(id) {
-    const rec = this.records.get(id);
-    return rec ? this.snapshot(rec) : void 0;
-  }
-  list() {
-    return [...this.records.values()].map((rec) => this.snapshot(rec));
-  }
-  runningCount() {
-    let count = 0;
-    for (const rec of this.records.values()) {
-      if (rec.status === "running") count += 1;
-    }
-    return count;
-  }
-  kill(id) {
-    const rec = this.records.get(id);
-    if (!rec || rec.status !== "running") return void 0;
-    this.terminate(rec, "stopped");
-    return this.snapshot(rec);
-  }
-  cleanup() {
-    const killed = [];
-    for (const rec of this.records.values()) {
-      if (rec.status === "running") {
-        this.terminate(rec, "stopped");
-        killed.push(this.snapshot(rec));
-      }
-    }
-    return killed;
-  }
-  terminate(rec, status) {
-    killTree2(rec.child);
-    this.finish(rec, status, null);
+  terminate(rec, status) {
+    killTree2(rec.child);
+    this.finish(rec, status, null);
   }
   finish(rec, status, exitCode) {
     if (rec.timer) clearTimeout(rec.timer);
     rec.status = status;
     rec.exitCode = exitCode;
     rec.endedAt = Date.now();
+    this.pruneFinished();
     this.emitUpdate(rec);
   }
+  pruneFinished() {
+    const finished = [...this.records.values()].filter((rec) => rec.status !== "running");
+    if (finished.length <= MAX_FINISHED_RECORDS) return;
+    finished.sort((a, b) => (a.endedAt ?? 0) - (b.endedAt ?? 0));
+    for (const rec of finished.slice(0, finished.length - MAX_FINISHED_RECORDS)) {
+      this.records.delete(rec.id);
+    }
+  }
   emitUpdate(rec) {
     this.emit("update", this.snapshot(rec));
   }
@@ -1318,21 +1338,22 @@ var defaultTaskManager = new TaskManager();
 
 // src/tools/bash.ts
 var MAX_OUTPUT = 3e4;
+var HALF_OUTPUT = MAX_OUTPUT / 2;
 var DEFAULT_TIMEOUT = 120;
 var MAX_TIMEOUT = 600;
 function findOnPath(exe, exclude) {
-  for (const dir of (process.env.PATH ?? "").split(path6.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path4.delimiter)) {
     if (!dir || exclude?.(dir)) {
       continue;
     }
-    const full = path6.join(dir, exe);
-    if (existsSync(full)) {
+    const full = path4.join(dir, exe);
+    if (existsSync2(full)) {
       return full;
     }
   }
   return null;
 }
-function resolveShell() {
+function resolveShellUncached() {
   if (process.platform !== "win32") {
     return { shell: "sh", wrap: (c) => ["-c", c], label: "sh" };
   }
@@ -1343,8 +1364,8 @@ function resolveShell() {
   }
   const gitExe = findOnPath("git.exe");
   if (gitExe) {
-    const sibling = path6.join(path6.dirname(path6.dirname(gitExe)), "bin", "bash.exe");
-    if (existsSync(sibling)) {
+    const sibling = path4.join(path4.dirname(path4.dirname(gitExe)), "bin", "bash.exe");
+    if (existsSync2(sibling)) {
       return { shell: sibling, wrap: (c) => ["-c", c], label: "bash" };
     }
   }
@@ -1353,42 +1374,82 @@ function resolveShell() {
     "C:\\Program Files (x86)\\Git\\bin\\bash.exe",
     "D:\\Git\\bin\\bash.exe"
   ]) {
-    if (existsSync(candidate)) {
+    if (existsSync2(candidate)) {
       return { shell: candidate, wrap: (c) => ["-c", c], label: "bash" };
     }
   }
   const comspec = process.env.ComSpec ?? "cmd.exe";
   return { shell: comspec, wrap: (c) => ["/d", "/s", "/c", c], label: "cmd" };
 }
-var schema = z3.object({
-  command: z3.string().describe("Shell command to execute"),
-  timeout: z3.number().positive().max(MAX_TIMEOUT).optional().describe("Timeout in seconds (default 120, max 600)"),
-  description: z3.string().optional().describe("Short description of what the command does"),
-  run_in_background: z3.boolean().optional().describe(
+var cachedSpec = null;
+function resolveShell() {
+  if (!cachedSpec) {
+    cachedSpec = resolveShellUncached();
+  }
+  return cachedSpec;
+}
+var schema = z2.object({
+  command: z2.string().describe("Shell command to execute"),
+  timeout: z2.number().positive().max(MAX_TIMEOUT).optional().describe("Timeout in seconds (default 120, max 600)"),
+  description: z2.string().optional().describe("Short description of what the command does"),
+  run_in_background: z2.boolean().optional().describe(
     "Run the command in the background and return a task id immediately (default false). Use task_output/task_kill to inspect or stop it."
   )
 });
 function killTree2(child) {
-  if (process.platform === "win32" && child.pid) {
-    spawn3("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
-      windowsHide: true,
-      stdio: "ignore"
-    }).unref();
+  if (process.platform === "win32") {
+    if (child.pid) {
+      spawn3("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+        windowsHide: true,
+        stdio: "ignore"
+      }).unref();
+    }
     return;
   }
-  child.kill("SIGKILL");
-}
-function truncateMiddle(s) {
-  if (s.length <= MAX_OUTPUT) {
-    return s;
+  if (child.pid) {
+    try {
+      process.kill(-child.pid, "SIGKILL");
+      return;
+    } catch {
+    }
+  }
+  child.kill("SIGKILL");
+}
+var BoundedOutput = class {
+  head = "";
+  tail = "";
+  dropped = 0;
+  overflow = false;
+  append(text) {
+    if (!this.overflow) {
+      this.head += text;
+      if (this.head.length <= MAX_OUTPUT) {
+        return;
+      }
+      this.overflow = true;
+      this.tail = this.head.slice(HALF_OUTPUT);
+      this.head = this.head.slice(0, HALF_OUTPUT);
+      if (this.tail.length > HALF_OUTPUT) {
+        this.dropped = this.tail.length - HALF_OUTPUT;
+        this.tail = this.tail.slice(-HALF_OUTPUT);
+      }
+      return;
+    }
+    this.tail += text;
+    if (this.tail.length > HALF_OUTPUT) {
+      this.dropped += this.tail.length - HALF_OUTPUT;
+      this.tail = this.tail.slice(-HALF_OUTPUT);
+    }
+  }
+  toString() {
+    if (!this.overflow) {
+      return this.head;
+    }
+    return `${this.head}
+... [${this.dropped} characters truncated] ...
+${this.tail}`;
   }
-  const half = Math.floor(MAX_OUTPUT / 2);
-  const head = s.slice(0, half);
-  const tail = s.slice(-half);
-  return `${head}
-... [${s.length - MAX_OUTPUT} characters truncated] ...
-${tail}`;
-}
+};
 var bashTool = {
   name: "bash",
   description: "Execute a shell command (Git Bash on Windows when available, otherwise cmd; sh elsewhere). Stdout and stderr are merged. Output is truncated to 30000 characters. Set run_in_background for long-running commands; it returns a task id for task_list/task_output/task_kill.",
@@ -1413,9 +1474,10 @@ description: ${args.description ?? "(none)"}`
     return new Promise((resolve) => {
       const child = spawn3(spec.shell, spec.wrap(args.command), {
         cwd: ctx.cwd,
-        windowsHide: true
+        windowsHide: true,
+        detached: process.platform !== "win32"
       });
-      let output = "";
+      const output = new BoundedOutput();
       let settled = false;
       const finish = (result) => {
         if (settled) {
@@ -1428,36 +1490,32 @@ description: ${args.description ?? "(none)"}`
       };
       const onAbort = () => {
         killTree2(child);
-        finish({ content: `${truncateMiddle(output)}
+        finish({ content: `${output}
 Command aborted`, isError: true });
       };
       const timer = setTimeout(() => {
         killTree2(child);
         finish({
-          content: `${truncateMiddle(output)}
+          content: `${output}
 Command timed out after ${timeoutSeconds}s`,
           isError: true
         });
       }, timeoutSeconds * 1e3);
-      child.stdout.on("data", (d) => {
-        output += d.toString("utf8");
-      });
-      child.stderr.on("data", (d) => {
-        output += d.toString("utf8");
-      });
+      timer.unref();
+      child.stdout.on("data", (d) => output.append(d.toString("utf8")));
+      child.stderr.on("data", (d) => output.append(d.toString("utf8")));
       child.on("error", (err) => {
         finish({ content: `Failed to start shell '${spec.label}': ${err.message}`, isError: true });
       });
       ctx.abortSignal?.addEventListener("abort", onAbort);
       child.on("close", (code) => {
-        const trimmed = output.replace(/\s+$/, "");
+        const trimmed = output.toString().replace(/\s+$/, "");
         if (code === 0) {
-          finish({ content: truncateMiddle(trimmed) || "(no output)" });
+          finish({ content: trimmed || "(no output)" });
           return;
         }
-        const body = truncateMiddle(trimmed);
         finish({
-          content: `${body}${body ? "\n" : ""}Exit code: ${code ?? "unknown"}`,
+          content: `${trimmed}${trimmed ? "\n" : ""}Exit code: ${code ?? "unknown"}`,
           isError: true
         });
       });
@@ -1466,14 +1524,14 @@ Command timed out after ${timeoutSeconds}s`,
 };
 
 // src/tools/fs/edit.ts
-import { readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import path7 from "path";
-import { z as z4 } from "zod";
-var schema2 = z4.object({
-  path: z4.string().describe("File path, absolute or relative to the working directory"),
-  old_string: z4.string().min(1).describe("Exact text to replace"),
-  new_string: z4.string().describe("Replacement text"),
-  replace_all: z4.boolean().optional().describe("Replace every occurrence instead of requiring a unique match")
+import { readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import path5 from "path";
+import { z as z3 } from "zod";
+var schema2 = z3.object({
+  path: z3.string().describe("File path, absolute or relative to the working directory"),
+  old_string: z3.string().min(1).describe("Exact text to replace"),
+  new_string: z3.string().describe("Replacement text"),
+  replace_all: z3.boolean().optional().describe("Replace every occurrence instead of requiring a unique match")
 });
 var editFileTool = {
   name: "edit_file",
@@ -1481,10 +1539,12 @@ var editFileTool = {
   permission: "write",
   parameters: schema2,
   async execute(args, ctx) {
-    const filePath = path7.resolve(ctx.cwd, args.path);
+    const filePath = path5.resolve(ctx.cwd, args.path);
     let content;
+    let readMtimeMs;
     try {
-      content = await readFile3(filePath, "utf8");
+      content = await readFile2(filePath, "utf8");
+      readMtimeMs = (await stat2(filePath)).mtimeMs;
     } catch (err) {
       return { content: `Failed to read ${args.path}: ${err.message}`, isError: true };
     }
@@ -1503,34 +1563,44 @@ var editFileTool = {
         isError: true
       };
     }
-    const updated = args.replace_all ? content.split(args.old_string).join(args.new_string) : content.replace(args.old_string, args.new_string);
+    const updated = args.replace_all ? content.split(args.old_string).join(args.new_string) : content.replace(args.old_string, () => args.new_string);
     try {
-      await writeFile3(filePath, updated, "utf8");
+      const now = await stat2(filePath).catch(() => null);
+      if (!now || now.mtimeMs !== readMtimeMs) {
+        return {
+          content: `Failed to edit ${args.path}: file changed since it was read; re-read and retry`,
+          isError: true
+        };
+      }
+      await writeFile2(filePath, updated, "utf8");
     } catch (err) {
       return { content: `Failed to write ${args.path}: ${err.message}`, isError: true };
     }
+    const contentTooLarge = Buffer.byteLength(content, "utf8") > MAX_SNAPSHOT_CONTENT_BYTES;
     await pushSnapshot({
       id: nextSnapshotId(),
       path: filePath,
       existed: true,
-      content,
+      content: contentTooLarge ? null : content,
+      contentTooLarge: contentTooLarge || void 0,
       toolName: "edit_file",
       timestamp: Date.now(),
-      turn: currentTurnSeq(),
-      messageIndex: currentTurnMessageIndex()
+      turn: ctx.snapshotContext?.turn ?? currentTurnSeq(),
+      messageIndex: ctx.snapshotContext?.messageIndex ?? currentTurnMessageIndex(),
+      owner: ctx.snapshotContext?.owner ?? "root"
     });
     return { content: `Edited ${args.path}: ${count} replacement${count > 1 ? "s" : ""}` };
   }
 };
 
 // src/tools/fs/glob.ts
-import path9 from "path";
-import { z as z5 } from "zod";
+import path7 from "path";
+import { z as z4 } from "zod";
 
 // src/tools/fs/util.ts
-import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
-import { readdir, stat } from "fs/promises";
-import path8 from "path";
+import { readFileSync, statSync } from "fs";
+import { readdir, stat as stat3 } from "fs/promises";
+import path6 from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist"]);
 async function walkFiles(root, skipDirs = SKIP_DIRS, options = {}) {
   const out = [];
@@ -1540,7 +1610,7 @@ async function walkFiles(root, skipDirs = SKIP_DIRS, options = {}) {
       return;
     }
     for (const entry of entries) {
-      const abs = path8.join(dir, entry.name);
+      const abs = path6.join(dir, entry.name);
       const rel = relBase ? `${relBase}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (skipDirs.has(entry.name) || options.ignore?.(abs, true)) {
@@ -1551,8 +1621,12 @@ async function walkFiles(root, skipDirs = SKIP_DIRS, options = {}) {
         if (options.ignore?.(abs, false)) {
           continue;
         }
+        if (options.withMtime === false) {
+          out.push({ abs, rel, mtimeMs: 0 });
+          continue;
+        }
         try {
-          const st = await stat(abs);
+          const st = await stat3(abs);
           out.push({ abs, rel, mtimeMs: st.mtimeMs });
         } catch {
         }
@@ -1563,32 +1637,107 @@ async function walkFiles(root, skipDirs = SKIP_DIRS, options = {}) {
   return out;
 }
 var REGEX_SPECIALS = /[.+^${}()|[\]\\]/g;
+function escapeRe(c) {
+  return c.replace(REGEX_SPECIALS, "\\$&");
+}
 function globToRegExp(pattern) {
-  let re = "";
   let i = 0;
-  while (i < pattern.length) {
-    const c = pattern.charAt(i);
-    if (c === "*") {
-      if (pattern.charAt(i + 1) === "*") {
-        i += 2;
-        if (pattern.charAt(i) === "/") {
-          i += 1;
-          re += "(?:[^/]+/)*";
+  function parseClass() {
+    let j = i + 1;
+    let negate = false;
+    if (pattern.charAt(j) === "!") {
+      negate = true;
+      j += 1;
+    }
+    let body = "";
+    if (pattern.charAt(j) === "]") {
+      body += "\\]";
+      j += 1;
+    }
+    while (j < pattern.length && pattern.charAt(j) !== "]") {
+      const ch = pattern.charAt(j);
+      body += ch === "\\" ? "\\\\" : ch;
+      j += 1;
+    }
+    if (j < pattern.length) {
+      i = j + 1;
+      if (body.startsWith("^")) body = `\\${body}`;
+      return `[${negate ? "^" : ""}${body}]`;
+    }
+    i += 1;
+    return "\\[";
+  }
+  function parseSegment(depth) {
+    let re2 = "";
+    while (i < pattern.length) {
+      const c = pattern.charAt(i);
+      if (depth > 0 && (c === "," || c === "}")) {
+        return { re: re2, end: c };
+      }
+      if (c === "*") {
+        if (pattern.charAt(i + 1) === "*") {
+          i += 2;
+          if (pattern.charAt(i) === "/") {
+            i += 1;
+            re2 += "(?:[^/]+/)*";
+            while (pattern.startsWith("**/", i)) {
+              i += 3;
+            }
+          } else {
+            re2 += ".*";
+          }
         } else {
-          re += ".*";
+          re2 += "[^/]*";
+          i += 1;
         }
-      } else {
-        re += "[^/]*";
+        continue;
+      }
+      if (c === "?") {
+        re2 += "[^/]";
         i += 1;
+        continue;
       }
-    } else if (c === "?") {
-      re += "[^/]";
-      i += 1;
-    } else {
-      re += c.replace(REGEX_SPECIALS, "\\$&");
+      if (c === "[") {
+        re2 += parseClass();
+        continue;
+      }
+      if (c === "{" && depth < 2) {
+        const close = braceEnd(i);
+        if (close === -1) {
+          re2 += "\\{";
+          i += 1;
+          continue;
+        }
+        i += 1;
+        const alts = [];
+        for (; ; ) {
+          const part = parseSegment(depth + 1);
+          alts.push(part.re);
+          if (part.end !== ",") break;
+          i += 1;
+        }
+        i += 1;
+        re2 += `(?:${alts.join("|")})`;
+        continue;
+      }
+      re2 += escapeRe(c);
       i += 1;
     }
+    return { re: re2, end: "" };
+  }
+  function braceEnd(from) {
+    let depth = 0;
+    for (let j = from; j < pattern.length; j++) {
+      const ch = pattern.charAt(j);
+      if (ch === "{") depth += 1;
+      else if (ch === "}") {
+        depth -= 1;
+        if (depth === 0) return j;
+      }
+    }
+    return -1;
   }
+  const { re } = parseSegment(0);
   return new RegExp(`^${re}$`);
 }
 function matchesGlob(pattern, relPath) {
@@ -1620,10 +1769,10 @@ function parseIgnorePatterns(body) {
   return out;
 }
 function loadIgnorePatterns(dir) {
-  const file = path8.join(dir, IGNORE_FILE);
+  const file = path6.join(dir, IGNORE_FILE);
   let mtimeMs;
   try {
-    mtimeMs = statSync3(file).mtimeMs;
+    mtimeMs = statSync(file).mtimeMs;
   } catch {
     return [];
   }
@@ -1633,7 +1782,7 @@ function loadIgnorePatterns(dir) {
   }
   let patterns = [];
   try {
-    patterns = parseIgnorePatterns(readFileSync3(file, "utf8"));
+    patterns = parseIgnorePatterns(readFileSync(file, "utf8"));
   } catch {
     patterns = [];
   }
@@ -1645,9 +1794,9 @@ function createIgnorePredicate(cwd) {
   if (patterns.length === 0) {
     return void 0;
   }
-  const root = path8.resolve(cwd);
+  const root = path6.resolve(cwd);
   return (absPath, isDir) => {
-    const rel = path8.relative(root, absPath).split(path8.sep).join("/");
+    const rel = path6.relative(root, absPath).split(path6.sep).join("/");
     if (!rel || rel.startsWith("..")) {
       return false;
     }
@@ -1662,27 +1811,26 @@ function createIgnorePredicate(cwd) {
     return false;
   };
 }
-function isSensitivePath2(filePath) {
-  const base = path8.basename(filePath);
-  if (base === ".env.example" || base === ".env.sample" || base === ".env.template") {
-    return false;
-  }
-  if (base === ".env" || base.startsWith(".env.")) {
-    return true;
-  }
-  if (base === "id_rsa" || base.endsWith(".pem")) {
-    return true;
-  }
-  return false;
-}
 
 // src/tools/fs/glob.ts
 var MAX_RESULTS = 100;
-var schema3 = z5.object({
-  pattern: z5.string().describe(
-    "Glob pattern, e.g. 'src/**/*.ts'. Supports **, * and ?. A bare pattern like '*.ts' matches basenames recursively."
+var GLOB_MAGIC = /[*?[{]/;
+function literalDirPrefix(pattern) {
+  const segments = pattern.replace(/\\/g, "/").split("/").slice(0, -1);
+  const out = [];
+  for (const segment of segments) {
+    if (segment === "" || GLOB_MAGIC.test(segment)) {
+      break;
+    }
+    out.push(segment);
+  }
+  return out;
+}
+var schema3 = z4.object({
+  pattern: z4.string().describe(
+    "Glob pattern, e.g. 'src/**/*.ts'. Supports **, *, ?, {a,b} braces and [abc] character classes. A bare pattern like '*.ts' matches basenames recursively."
   ),
-  path: z5.string().optional().describe("Directory to search, defaults to the working directory")
+  path: z4.string().optional().describe("Directory to search, defaults to the working directory")
 });
 var globTool = {
   name: "glob",
@@ -1690,47 +1838,72 @@ var globTool = {
   permission: "read",
   parameters: schema3,
   async execute(args, ctx) {
-    const root = path9.resolve(ctx.cwd, args.path ?? ".");
-    const files = await walkFiles(root, void 0, { ignore: createIgnorePredicate(ctx.cwd) });
-    const matched = files.filter((f) => matchesGlob(args.pattern, f.rel)).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, MAX_RESULTS);
+    const root = path7.resolve(ctx.cwd, args.path ?? ".");
+    const prefixSegments = literalDirPrefix(args.pattern);
+    const walkRoot = prefixSegments.length > 0 ? path7.join(root, ...prefixSegments) : root;
+    const prefix = prefixSegments.length > 0 ? `${prefixSegments.join("/")}/` : "";
+    const files = await walkFiles(walkRoot, void 0, { ignore: createIgnorePredicate(ctx.cwd) });
+    const matched = files.filter((f) => matchesGlob(args.pattern, `${prefix}${f.rel}`)).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, MAX_RESULTS);
     if (matched.length === 0) {
       return { content: `No files matched pattern: ${args.pattern}` };
     }
-    return { content: matched.map((f) => f.rel).join("\n") };
+    return { content: matched.map((f) => `${prefix}${f.rel}`).join("\n") };
   }
 };
 
 // src/tools/fs/grep.ts
-import { readFile as readFile4, stat as stat2 } from "fs/promises";
-import path10 from "path";
-import { z as z6 } from "zod";
+import { readFile as readFile3, stat as stat4 } from "fs/promises";
+import path8 from "path";
+import { z as z5 } from "zod";
 var MAX_MATCHES = 250;
-var schema4 = z6.object({
-  pattern: z6.string().describe("Regular expression to search for"),
-  path: z6.string().optional().describe("File or directory to search, defaults to the working directory"),
-  glob: z6.string().optional().describe("Glob pattern to filter which files are searched, e.g. '*.ts'"),
-  ignoreCase: z6.boolean().optional().describe("Case-insensitive matching")
+var MAX_LINE_CHARS = 500;
+var MAX_PATTERN_CHARS = 200;
+var MAX_FILE_BYTES = 5 * 1024 * 1024;
+function isTooComplexPattern(pattern) {
+  return pattern.length > MAX_PATTERN_CHARS || /\)[+*]/.test(pattern) || /\)\{\d+(,\d*)?\}/.test(pattern);
+}
+var schema4 = z5.object({
+  pattern: z5.string().describe("Regular expression to search for"),
+  path: z5.string().optional().describe("File or directory to search, defaults to the working directory"),
+  glob: z5.string().optional().describe("Glob pattern to filter which files are searched, e.g. '*.ts'"),
+  ignoreCase: z5.boolean().optional().describe("Case-insensitive matching")
 });
 var grepTool = {
   name: "grep",
-  description: "Search file contents with a regular expression. Outputs 'file:line:content', up to 250 matches. Skips binary files, node_modules and .git.",
+  description: "Search file contents with a regular expression. Outputs 'file:line:content', up to 250 matches. Skips binary files, files over 5MB, sensitive files, node_modules and .git.",
   permission: "read",
   parameters: schema4,
   async execute(args, ctx) {
+    if (isTooComplexPattern(args.pattern)) {
+      return {
+        content: `pattern too complex: keep it under ${MAX_PATTERN_CHARS} characters and avoid quantified groups like (a+)+`,
+        isError: true
+      };
+    }
     let re;
     try {
       re = new RegExp(args.pattern, args.ignoreCase ? "i" : "");
     } catch (err) {
       return { content: `Invalid regular expression: ${err.message}`, isError: true };
     }
-    const root = path10.resolve(ctx.cwd, args.path ?? ".");
+    const root = path8.resolve(ctx.cwd, args.path ?? ".");
     let files;
     try {
-      const st = await stat2(root);
+      const st = await stat4(root);
       if (st.isFile()) {
-        files = [{ abs: root, rel: path10.basename(root), mtimeMs: st.mtimeMs }];
+        if (isSensitivePath(root)) {
+          return {
+            content: `Refused to grep sensitive file: ${args.path ?? "."}`,
+            isError: true
+          };
+        }
+        files = [{ abs: root, rel: path8.basename(root), mtimeMs: st.mtimeMs }];
       } else {
-        files = await walkFiles(root, void 0, { ignore: createIgnorePredicate(ctx.cwd) });
+        const walked = await walkFiles(root, void 0, {
+          ignore: createIgnorePredicate(ctx.cwd),
+          withMtime: false
+        });
+        files = walked.filter((f) => !isSensitivePath(f.abs));
       }
     } catch {
       return { content: `Path not found: ${args.path ?? "."}`, isError: true };
@@ -1741,10 +1914,19 @@ var grepTool = {
     }
     const out = [];
     let truncated = false;
+    let skippedLarge = 0;
     outer: for (const file of files) {
+      const st = await stat4(file.abs).catch(() => null);
+      if (!st) {
+        continue;
+      }
+      if (st.size > MAX_FILE_BYTES) {
+        skippedLarge += 1;
+        continue;
+      }
       let buf;
       try {
-        buf = await readFile4(file.abs);
+        buf = await readFile3(file.abs);
       } catch {
         continue;
       }
@@ -1755,7 +1937,8 @@ var grepTool = {
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i] ?? "";
         if (re.test(line)) {
-          out.push(`${file.rel}:${i + 1}:${line}`);
+          const shown = line.length > MAX_LINE_CHARS ? `${line.slice(0, MAX_LINE_CHARS)}\u2026` : line;
+          out.push(`${file.rel}:${i + 1}:${shown}`);
           if (out.length >= MAX_MATCHES) {
             truncated = true;
             break outer;
@@ -1763,26 +1946,55 @@ var grepTool = {
         }
       }
     }
+    const skippedNote = skippedLarge > 0 ? `(skipped ${skippedLarge} file(s) larger than 5MB)` : null;
     if (out.length === 0) {
-      return { content: `No matches for pattern: ${args.pattern}` };
+      return {
+        content: `No matches for pattern: ${args.pattern}${skippedNote ? ` ${skippedNote}` : ""}`
+      };
     }
     if (truncated) {
       out.push(`... (truncated: more than ${MAX_MATCHES} matches)`);
     }
+    if (skippedNote) {
+      out.push(`... ${skippedNote}`);
+    }
     return { content: out.join("\n") };
   }
 };
 
 // src/tools/fs/read.ts
-import { readFile as readFile5, stat as stat3 } from "fs/promises";
-import path11 from "path";
-import { z as z7 } from "zod";
+import { open, stat as stat5 } from "fs/promises";
+import path9 from "path";
+import { z as z6 } from "zod";
 var DEFAULT_LIMIT = 2e3;
 var MAX_CHARS = 100 * 1024;
-var schema5 = z7.object({
-  path: z7.string().describe("File path, absolute or relative to the working directory"),
-  offset: z7.number().int().positive().optional().describe("1-based line number to start reading from"),
-  limit: z7.number().int().positive().optional().describe("Maximum number of lines to read (default 2000)")
+var MAX_READ_BYTES = 1024 * 1024;
+var BINARY_PROBE_BYTES = 8192;
+function decodeUtf16be(buf) {
+  const len = buf.length - buf.length % 2;
+  const swapped = Buffer.allocUnsafe(len);
+  for (let k = 0; k < len; k += 2) {
+    swapped[k] = buf[k + 1] ?? 0;
+    swapped[k + 1] = buf[k] ?? 0;
+  }
+  return swapped.toString("utf16le");
+}
+function decodeTextBuffer(buf) {
+  if (buf.length >= 2 && buf[0] === 255 && buf[1] === 254) {
+    return { text: buf.subarray(2).toString("utf16le") };
+  }
+  if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) {
+    return { text: decodeUtf16be(buf.subarray(2)) };
+  }
+  if (buf.subarray(0, BINARY_PROBE_BYTES).includes(0)) {
+    return { binary: true };
+  }
+  return { text: buf.toString("utf8") };
+}
+var schema5 = z6.object({
+  path: z6.string().describe("File path, absolute or relative to the working directory"),
+  offset: z6.number().int().positive().optional().describe("1-based line number to start reading from"),
+  limit: z6.number().int().positive().optional().describe("Maximum number of lines to read (default 2000)")
 });
 var readFileTool = {
   name: "read_file",
@@ -1790,30 +2002,48 @@ var readFileTool = {
   permission: "read",
   parameters: schema5,
   async execute(args, ctx) {
-    const filePath = path11.resolve(ctx.cwd, args.path);
-    if (isSensitivePath2(filePath)) {
+    const filePath = path9.resolve(ctx.cwd, args.path);
+    if (isSensitivePath(filePath)) {
       return { content: `Refused to read sensitive file: ${args.path}`, isError: true };
     }
-    const st = await stat3(filePath).catch(() => null);
+    const st = await stat5(filePath).catch(() => null);
     if (!st) {
       return { content: `File not found: ${args.path}`, isError: true };
     }
     if (st.isDirectory()) {
       return { content: `Path is a directory, not a file: ${args.path}`, isError: true };
     }
-    const raw = await readFile5(filePath, "utf8");
-    const lines = raw.split("\n");
+    const bytesToRead = Math.min(st.size, MAX_READ_BYTES);
+    const fileCapped = st.size > MAX_READ_BYTES;
+    const handle = await open(filePath, "r").catch(() => null);
+    if (!handle) {
+      return { content: `Failed to read ${args.path}`, isError: true };
+    }
+    let buf;
+    try {
+      const { bytesRead, buffer } = await handle.read(Buffer.alloc(bytesToRead), 0, bytesToRead, 0);
+      buf = buffer.subarray(0, bytesRead);
+    } finally {
+      await handle.close().catch(() => {
+      });
+    }
+    const decoded = decodeTextBuffer(buf);
+    if ("binary" in decoded) {
+      return { content: `Cannot read binary file: ${args.path}`, isError: true };
+    }
+    const lines = decoded.text.split("\n");
+    const totalDesc = fileCapped ? `at least ${lines.length}` : `${lines.length}`;
     const start = args.offset ?? 1;
     const limit = args.limit ?? DEFAULT_LIMIT;
+    if (start > lines.length) {
+      return { content: `(offset ${start} beyond end of file; file has ${totalDesc} lines)` };
+    }
     const end = Math.min(lines.length, start - 1 + limit);
     const out = [];
     let size = 0;
     let truncatedBySize = false;
     for (let i = start - 1; i < end; i++) {
-      const line = lines[i];
-      if (line === void 0) {
-        break;
-      }
+      const line = (lines[i] ?? "").replace(/\r$/, "");
       const numbered = `${i + 1}	${line}`;
       if (size + numbered.length > MAX_CHARS) {
         truncatedBySize = true;
@@ -1825,22 +2055,22 @@ var readFileTool = {
     const lastShown = start - 1 + out.length;
     if (truncatedBySize) {
       out.push(
-        `... (truncated: output exceeds 100KB, showing lines ${start}-${lastShown} of ${lines.length})`
+        `... (truncated: output exceeds 100KB, showing lines ${start}-${lastShown} of ${totalDesc})`
       );
-    } else if (end < lines.length) {
-      out.push(`... (truncated: showing lines ${start}-${end} of ${lines.length})`);
+    } else if (end < lines.length || fileCapped) {
+      out.push(`... (truncated: showing lines ${start}-${end} of ${totalDesc})`);
     }
     return { content: out.join("\n") };
   }
 };
 
 // src/tools/fs/write.ts
-import { mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
-import path12 from "path";
-import { z as z8 } from "zod";
-var schema6 = z8.object({
-  path: z8.string().describe("File path, absolute or relative to the working directory"),
-  content: z8.string().describe("Full content to write to the file")
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import path10 from "path";
+import { z as z7 } from "zod";
+var schema6 = z7.object({
+  path: z7.string().describe("File path, absolute or relative to the working directory"),
+  content: z7.string().describe("Full content to write to the file")
 });
 var writeFileTool = {
   name: "write_file",
@@ -1848,11 +2078,11 @@ var writeFileTool = {
   permission: "write",
   parameters: schema6,
   async execute(args, ctx) {
-    const filePath = path12.resolve(ctx.cwd, args.path);
-    const snapshot = await captureSnapshot(filePath, "write_file");
+    const filePath = path10.resolve(ctx.cwd, args.path);
+    const snapshot = await captureSnapshot(filePath, "write_file", ctx.snapshotContext);
     try {
-      await mkdir3(path12.dirname(filePath), { recursive: true });
-      await writeFile4(filePath, args.content, "utf8");
+      await mkdir3(path10.dirname(filePath), { recursive: true });
+      await writeFile3(filePath, args.content, "utf8");
     } catch (err) {
       return { content: `Failed to write ${args.path}: ${err.message}`, isError: true };
     }
@@ -1862,7 +2092,132 @@ var writeFileTool = {
 };
 
 // src/tools/tasks.ts
-import { z as z9 } from "zod";
+import { z as z8 } from "zod";
+
+// src/agent/agent-tasks.ts
+import { EventEmitter as EventEmitter2 } from "events";
+var MAX_FINISHED_RECORDS2 = 50;
+var AgentTaskManager = class extends EventEmitter2 {
+  records = /* @__PURE__ */ new Map();
+  counter = 0;
+  start(run, meta) {
+    const id = `agent-${++this.counter}`;
+    const rec = {
+      id,
+      prompt: meta.prompt,
+      description: meta.description,
+      status: "running",
+      startedAt: Date.now(),
+      result: "",
+      controller: new AbortController(),
+      notified: false
+    };
+    this.records.set(id, rec);
+    void run(rec.controller.signal).then((result) => this.finish(rec, "completed", result)).catch(
+      (error) => this.finish(rec, "failed", error instanceof Error ? error.message : String(error))
+    );
+    this.emitUpdate(rec);
+    return this.snapshot(rec);
+  }
+  get(id) {
+    const rec = this.records.get(id);
+    return rec ? this.snapshot(rec) : void 0;
+  }
+  list() {
+    return [...this.records.values()].map((rec) => this.snapshot(rec));
+  }
+  runningCount() {
+    let count = 0;
+    for (const rec of this.records.values()) {
+      if (rec.status === "running") count += 1;
+    }
+    return count;
+  }
+  kill(id) {
+    const rec = this.records.get(id);
+    if (!rec || rec.status !== "running") return void 0;
+    rec.controller.abort();
+    this.finish(rec, "stopped", rec.result || "Stopped by user.");
+    return this.snapshot(rec);
+  }
+  cleanup() {
+    const killed = [];
+    for (const rec of this.records.values()) {
+      if (rec.status === "running") {
+        rec.controller.abort();
+        this.finish(rec, "stopped", rec.result || "Stopped on shutdown.");
+        killed.push(this.snapshot(rec));
+      }
+    }
+    return killed;
+  }
+  // Finished tasks whose result has not yet been handed to the parent loop.
+  drainNotifications() {
+    const drained = [];
+    for (const rec of this.records.values()) {
+      if (rec.status !== "running" && !rec.notified) {
+        rec.notified = true;
+        drained.push(this.snapshot(rec));
+      }
+    }
+    this.pruneFinished();
+    return drained;
+  }
+  // Map iteration is insertion-ordered, so the first finished records met are
+  // the oldest. Never drop an un-notified record: the parent has not seen its
+  // result yet. Running records are untouched.
+  pruneFinished() {
+    let finished = 0;
+    for (const rec of this.records.values()) {
+      if (rec.status !== "running") finished += 1;
+    }
+    let excess = finished - MAX_FINISHED_RECORDS2;
+    if (excess <= 0) return;
+    for (const rec of this.records.values()) {
+      if (excess <= 0) return;
+      if (rec.status !== "running" && rec.notified) {
+        this.records.delete(rec.id);
+        excess -= 1;
+      }
+    }
+  }
+  finish(rec, status, result) {
+    if (rec.status !== "running") return;
+    rec.status = status;
+    rec.result = result;
+    rec.endedAt = Date.now();
+    this.emitUpdate(rec);
+  }
+  emitUpdate(rec) {
+    this.emit("update", this.snapshot(rec));
+  }
+  snapshot(rec) {
+    return {
+      id: rec.id,
+      prompt: rec.prompt,
+      description: rec.description,
+      status: rec.status,
+      startedAt: rec.startedAt,
+      endedAt: rec.endedAt,
+      result: rec.result
+    };
+  }
+};
+var defaultAgentTasks = new AgentTaskManager();
+function formatAgentTaskUpdate(task) {
+  const label = task.description ? `: ${task.description}` : "";
+  if (task.status === "running") {
+    return `Background subagent ${task.id} started${label}`;
+  }
+  let text = `Background subagent ${task.id} ${task.status}${label}`;
+  if (task.status === "failed") {
+    const reason = (task.result.split("\n")[0] ?? "").replace(/^Subagent failed:\s*/, "");
+    if (reason) {
+      text += ` \u2014 ${reason.length > 140 ? `${reason.slice(0, 140)}\u2026` : reason}`;
+    }
+  }
+  return text;
+}
 
 // src/tasks/format.ts
 function formatDuration(startedAt, endedAt) {
@@ -1908,9 +2263,14 @@ function formatTaskFinished(task) {
 }
 
 // src/tools/tasks.ts
-var idSchema = z9.object({
-  id: z9.string().describe("Task id, e.g. task-1 or agent-1")
+var idSchema = z8.object({
+  id: z8.string().describe("Task id, e.g. task-1 or agent-1")
 });
+function truncateOutput(s) {
+  if (s.length <= MAX_OUTPUT) return s;
+  return `[... earlier output truncated; showing the last ${MAX_OUTPUT} characters ...]
+${s.slice(-MAX_OUTPUT)}`;
+}
 function formatAgentTaskLine(task) {
   const duration = formatDuration(task.startedAt, task.endedAt);
   const label = task.description ?? task.prompt.slice(0, 60);
@@ -1921,7 +2281,7 @@ var taskListTool = {
   name: "task_list",
   description: "List background tasks (shell commands and subagents) with status and runtime.",
   permission: "read",
-  parameters: z9.object({}),
+  parameters: z8.object({}),
   execute() {
     const shell = formatTaskList(defaultTaskManager.list());
     const agents = defaultAgentTasks.list();
@@ -1939,13 +2299,13 @@ var taskOutputTool = {
   execute(args) {
     const shell = defaultTaskManager.get(args.id);
     if (shell) {
-      const body = shell.output.replace(/\s+$/, "") || "(no output yet)";
+      const body = truncateOutput(shell.output.replace(/\s+$/, "") || "(no output yet)");
       return Promise.resolve({ content: `${formatTaskLine(shell)}
 ${body}` });
     }
     const agent = defaultAgentTasks.get(args.id);
     if (agent) {
-      const body = agent.status === "running" ? "(still running)" : agent.result.replace(/\s+$/, "") || "(no report)";
+      const body = agent.status === "running" ? "(still running)" : truncateOutput(agent.result.replace(/\s+$/, "") || "(no report)");
       return Promise.resolve({ content: `${formatAgentTaskLine(agent)}
 ${body}` });
     }
@@ -1979,6 +2339,133 @@ var taskKillTool = {
   }
 };
 
+// src/tools/todo.ts
+import { mkdir as mkdir4, readFile as readFile4, rename, writeFile as writeFile4 } from "fs/promises";
+import path11 from "path";
+import { z as z9 } from "zod";
+var todoItemSchema = z9.object({
+  id: z9.number().int(),
+  title: z9.string(),
+  status: z9.enum(["pending", "in_progress", "done"])
+});
+var writeSchema = z9.object({
+  todos: z9.array(todoItemSchema).describe("The full todo list, replacing the current one")
+});
+var readSchema = z9.object({});
+function fileFor(cwd) {
+  return path11.join(cwd, ".star", "todos.json");
+}
+var persistGuard = () => true;
+function setTodoPersistGuard(guard) {
+  persistGuard = guard;
+}
+var TodoStore = class {
+  items = /* @__PURE__ */ new Map();
+  list() {
+    return [...this.items.values()];
+  }
+  replace(items) {
+    this.items.clear();
+    for (const item of items) {
+      this.items.set(item.id, item);
+    }
+  }
+  async load(cwd) {
+    let raw;
+    try {
+      raw = await readFile4(fileFor(cwd), "utf8");
+    } catch {
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        this.replace(parsed.filter((it) => todoItemSchema.safeParse(it).success));
+      }
+    } catch {
+    }
+  }
+  // Atomic write (tmp + rename): a crash or failed save can never leave a
+  // truncated todos.json behind.
+  async save(cwd) {
+    if (!persistGuard()) {
+      return;
+    }
+    await mkdir4(path11.join(cwd, ".star"), { recursive: true });
+    const file = fileFor(cwd);
+    const tmp = `${file}.tmp`;
+    await writeFile4(tmp, `${JSON.stringify(this.list(), null, 2)}
+`);
+    await rename(tmp, file);
+  }
+};
+var SYMBOLS = {
+  pending: "[ ]",
+  in_progress: "[~]",
+  done: "[x]"
+};
+function formatTodos(items) {
+  if (items.length === 0) {
+    return "No todos.";
+  }
+  const lines = items.map((it) => `${SYMBOLS[it.status]} ${it.id}. ${it.title}`);
+  const width = Math.max(...lines.map((l) => l.length));
+  return lines.map((line, i) => {
+    const status = items[i]?.status;
+    return status === "pending" ? line : `${line.padEnd(width + 4)}(${status})`;
+  }).join("\n");
+}
+var defaultStore = new TodoStore();
+function parseTodoArgs(args) {
+  const parsed = writeSchema.safeParse(args);
+  return parsed.success ? parsed.data.todos : null;
+}
+function pendingTodoTitles(args) {
+  return (parseTodoArgs(args) ?? []).filter((t) => t.status !== "done").map((t) => t.title);
+}
+async function loadTodos(cwd) {
+  await defaultStore.load(cwd);
+  return defaultStore.list();
+}
+function resetTodos() {
+  defaultStore.replace([]);
+}
+function createTodoTools(store = defaultStore) {
+  const todoWrite = {
+    name: "todo_write",
+    description: "Replace the current todo list with the given items. Each item has an id, title, and status (pending, in_progress, done).",
+    permission: "read",
+    parameters: writeSchema,
+    async execute(args, ctx) {
+      const parsed = writeSchema.safeParse(args);
+      if (!parsed.success) {
+        return { content: `Invalid todos: ${parsed.error.message}`, isError: true };
+      }
+      const previous = store.list();
+      store.replace(parsed.data.todos);
+      try {
+        await store.save(ctx.cwd);
+      } catch (err) {
+        store.replace(previous);
+        return { content: `Failed to save todos: ${err.message}`, isError: true };
+      }
+      const items = store.list();
+      const done = items.filter((it) => it.status === "done").length;
+      return { content: `Todo list updated (${done}/${items.length} done).` };
+    }
+  };
+  const todoRead = {
+    name: "todo_read",
+    description: "Read the current todo list.",
+    permission: "read",
+    parameters: readSchema,
+    async execute() {
+      return { content: formatTodos(store.list()) };
+    }
+  };
+  return [todoWrite, todoRead];
+}
+
 // src/tools/web/fetch.ts
 import { z as z10 } from "zod";
 var DEFAULT_MAX_CHARS = 2e4;
@@ -1988,8 +2475,14 @@ var schema7 = z10.object({
   url: z10.string().describe("The http(s) URL to fetch"),
   maxChars: z10.number().int().positive().optional().describe("Maximum characters of text to return (default 20000)")
 });
+function safeCodePoint(n, raw) {
+  if (!Number.isInteger(n) || n < 0 || n > 1114111) {
+    return raw;
+  }
+  return String.fromCodePoint(n);
+}
 function decodeEntities(s) {
-  return s.replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n))).replace(/&#x([0-9a-fA-F]+);/gi, (_, n) => String.fromCodePoint(Number.parseInt(n, 16))).replace(/&(quot|lt|gt|nbsp);/g, (m) => {
+  return s.replace(/&#(\d+);/g, (m, n) => safeCodePoint(Number(n), m)).replace(/&#x([0-9a-fA-F]+);/gi, (m, n) => safeCodePoint(Number.parseInt(n, 16), m)).replace(/&(quot|lt|gt|nbsp);/g, (m) => {
     switch (m) {
       case "&quot;":
         return '"';
@@ -2049,7 +2542,7 @@ function truncate2(s, maxChars) {
 }
 var webFetchTool = {
   name: "web_fetch",
-  description: "Fetch a URL over http(s) and return its contents as readable text. HTML pages are converted to plain text (tags, scripts and styles removed). Output is truncated to maxChars (default 20000).",
+  description: "Fetch a URL over http(s) and return its contents as readable text. HTML pages are converted to plain text (tags, scripts and styles removed). Output is truncated to maxChars (default 20000). Can reach internal/intranet addresses, so do not use it for untrusted URLs.",
   permission: "read",
   parameters: schema7,
   async execute(args, ctx) {
@@ -2231,7 +2724,9 @@ var webSearchTool = {
 // src/tools/registry.ts
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
-  constructor() {
+  // todoStore defaults to the module-level shared store; subagent loops pass
+  // their own instance so a child's todo_write cannot clobber the parent list.
+  constructor(todoStore) {
     for (const tool of [
       readFileTool,
       writeFileTool,
@@ -2244,7 +2739,7 @@ var ToolRegistry = class {
       taskListTool,
       taskOutputTool,
       taskKillTool,
-      ...createTodoTools()
+      ...createTodoTools(todoStore)
     ]) {
       this.register(tool);
     }
@@ -2263,13 +2758,165 @@ var ToolRegistry = class {
   }
 };
 
-// src/tools/index.ts
-function createDefaultRegistry() {
-  const registry = new ToolRegistry();
-  for (const tool of createTodoTools()) {
-    registry.register(tool);
+// src/agent/project-memory.ts
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import path12 from "path";
+var PROJECT_MEMORY_FILE = "AGENTS.md";
+var PROJECT_MEMORY_MAX_CHARS = 32 * 1024;
+var cache = /* @__PURE__ */ new Map();
+function readProjectMemory(cwd) {
+  const file = path12.join(cwd, PROJECT_MEMORY_FILE);
+  let mtimeMs;
+  try {
+    mtimeMs = statSync2(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  const hit = cache.get(file);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.block;
+  let block = null;
+  try {
+    let body = readFileSync2(file, "utf8").trim();
+    if (body) {
+      if (body.length > PROJECT_MEMORY_MAX_CHARS) {
+        body = `${body.slice(0, PROJECT_MEMORY_MAX_CHARS)}
+
+[AGENTS.md truncated to ${PROJECT_MEMORY_MAX_CHARS} characters]`;
+      }
+      block = `# Project instructions (AGENTS.md)
+${body}`;
+    }
+  } catch {
+    block = null;
+  }
+  cache.set(file, { mtimeMs, block });
+  return block;
+}
+
+// src/agent/skills.ts
+import { readFileSync as readFileSync3, readdirSync, statSync as statSync3 } from "fs";
+import path13 from "path";
+import { z as z12 } from "zod";
+var SKILL_FILE = "SKILL.md";
+var SKILL_MAX_CHARS = 32 * 1024;
+var NAME_PATTERN = /^[a-z0-9-]+$/;
+function parseFrontmatter(raw) {
+  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) return null;
+  const meta = {};
+  for (const line of (match[1] ?? "").split(/\r?\n/)) {
+    const kv = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (kv?.[1]) meta[kv[1]] = (kv[2] ?? "").trim();
+  }
+  return { meta, body: raw.slice(match[0].length).trim() };
+}
+var cache2 = /* @__PURE__ */ new Map();
+function parseSkillFile(filePath, dirName, scope) {
+  let mtimeMs;
+  try {
+    mtimeMs = statSync3(filePath).mtimeMs;
+  } catch {
+    return null;
+  }
+  const hit = cache2.get(filePath);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.skill;
+  let skill = null;
+  try {
+    const parsed = parseFrontmatter(readFileSync3(filePath, "utf8"));
+    const name = parsed?.meta.name || dirName;
+    const description = parsed?.meta.description;
+    if (parsed && NAME_PATTERN.test(name) && description) {
+      skill = { name, description, filePath, dir: path13.dirname(filePath), scope };
+    }
+  } catch {
+    skill = null;
   }
-  return registry;
+  cache2.set(filePath, { mtimeMs, skill });
+  return skill;
+}
+function scanDir(base, scope, into) {
+  let entries;
+  try {
+    entries = readdirSync(base);
+  } catch {
+    return;
+  }
+  for (const entry of entries.sort()) {
+    if (!NAME_PATTERN.test(entry)) continue;
+    const parsed = parseSkillFile(path13.join(base, entry, SKILL_FILE), entry, scope);
+    if (parsed) into.set(parsed.name, parsed);
+  }
+}
+function discoverSkills(cwd, home = starHome()) {
+  const byName = /* @__PURE__ */ new Map();
+  scanDir(path13.join(home, "skills"), "user", byName);
+  scanDir(path13.join(cwd, ".star", "skills"), "project", byName);
+  return [...byName.values()];
+}
+function formatSkillsBlock(skills) {
+  const lines = skills.map((s) => `- ${s.name}: ${s.description}`);
+  return [
+    "# Available skills",
+    "When the user's request matches one of these skills, call the skill tool with its name to load the full instructions before proceeding:",
+    ...lines
+  ].join("\n");
+}
+function loadSkillBody(skill) {
+  let parsed = null;
+  try {
+    parsed = parseFrontmatter(readFileSync3(skill.filePath, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!parsed?.body) return null;
+  if (parsed.body.length > SKILL_MAX_CHARS) {
+    return `${parsed.body.slice(0, SKILL_MAX_CHARS)}
+
+[skill truncated to ${SKILL_MAX_CHARS} characters]`;
+  }
+  return parsed.body;
+}
+function createSkillTool(deps) {
+  return {
+    name: "skill",
+    description: "Load the full instructions of a skill by name. Available skills are listed in the system prompt when present; call this before starting work that matches one of them.",
+    permission: "read",
+    parameters: z12.object({
+      name: z12.string().describe("Name of the skill to load, as listed in the system prompt.")
+    }),
+    async execute(args) {
+      const skills = discoverSkills(deps.cwd, deps.home);
+      const skill = skills.find((s) => s.name === args.name);
+      if (!skill) {
+        const available = skills.map((s) => s.name).join(", ") || "none";
+        return {
+          content: `Unknown skill: "${args.name}". Available skills: ${available}`,
+          isError: true
+        };
+      }
+      const body = loadSkillBody(skill);
+      if (!body) {
+        return { content: `Skill "${skill.name}" is empty or unreadable.`, isError: true };
+      }
+      return {
+        content: [
+          `# Skill: ${skill.name}`,
+          "",
+          body,
+          "",
+          `Base directory for relative file references in this skill: ${skill.dir}`
+        ].join("\n")
+      };
+    }
+  };
+}
+
+// src/agent/subagent.ts
+import { z as z13 } from "zod";
+
+// src/tools/index.ts
+function createDefaultRegistry(todoStore) {
+  return new ToolRegistry(todoStore);
 }
 
 // src/agent/subagent.ts
@@ -2277,7 +2924,7 @@ var MAX_SUBAGENT_DEPTH = 1;
 var MAX_REPORT_CHARS = 2e4;
 var SUBAGENT_PROMPT = "You are a subagent spawned to handle a focused subtask on behalf of the main agent. Work autonomously with the tools available to you, then finish with a concise report of what you found or did. Your final text is returned to the main agent as the tool result \u2014 make it self-contained.";
 async function runSubagent(deps, args, cwd, signal) {
-  const { AgentLoop: AgentLoop2 } = await import("./loop-XKC5HQBT.js");
+  const { AgentLoop: AgentLoop2 } = await import("./loop-SDZVEQND.js");
   const child = new AgentLoop2({
     model: deps.model,
     registry: createDefaultRegistry(),
@@ -2304,6 +2951,9 @@ ${SUBAGENT_PROMPT}` : SUBAGENT_PROMPT,
   } catch (e) {
     error = e instanceof Error ? e.message : String(e);
   }
+  if (signal.aborted) {
+    throw new Error("Tool execution aborted.");
+  }
   let report = "";
   const messages = child.getMessages();
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -2332,10 +2982,10 @@ function createSubagentTool(deps) {
     name: "subagent",
     description: "Spawn a subagent with its own agent loop to handle a focused subtask (research, exploration, or an isolated change). The subagent has the same tools but cannot spawn further subagents. Returns the subagent's final report. Prefer this for self-contained work that would otherwise clutter the main conversation. Set run_in_background to start it without blocking: independent subtasks then run concurrently and their reports are delivered to you automatically when they finish (also inspectable via task_list/task_output/task_kill).",
     permission: "exec",
-    parameters: z12.object({
-      prompt: z12.string().describe("Complete, self-contained instructions for the subagent."),
-      description: z12.string().optional().describe("Short label for the subtask, shown in the result header."),
-      run_in_background: z12.boolean().optional().describe(
+    parameters: z13.object({
+      prompt: z13.string().describe("Complete, self-contained instructions for the subagent."),
+      description: z13.string().optional().describe("Short label for the subtask, shown in the result header."),
+      run_in_background: z13.boolean().optional().describe(
         "Run concurrently in the background and return a task id immediately (default false). Use for independent subtasks that can run in parallel."
       )
     }),
@@ -2362,13 +3012,13 @@ function createSubagentTool(deps) {
 
 // src/agent/user-memory.ts
 import { appendFileSync, mkdirSync, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import path13 from "path";
-import { z as z13 } from "zod";
+import path14 from "path";
+import { z as z14 } from "zod";
 var USER_MEMORY_MAX_CHARS = 32 * 1024;
 var REMEMBER_TEXT_MAX_CHARS = 500;
 var cache3 = /* @__PURE__ */ new Map();
 function readUserMemory(home = starHome()) {
-  const file = path13.join(home, "MEMORY.md");
+  const file = path14.join(home, "MEMORY.md");
   let mtimeMs;
   try {
     mtimeMs = statSync4(file).mtimeMs;
@@ -2400,7 +3050,7 @@ function readUserMemory(home = starHome()) {
 }
 function appendUserMemory(text, home = starHome()) {
   mkdirSync(home, { recursive: true });
-  appendFileSync(path13.join(home, "MEMORY.md"), `- ${text}
+  appendFileSync(path14.join(home, "MEMORY.md"), `- ${text}
 `, "utf8");
 }
 function createRememberTool(deps = {}) {
@@ -2408,8 +3058,8 @@ function createRememberTool(deps = {}) {
     name: "remember",
     description: `Save a note to the user's long-term memory (${userMemoryPath()}), injected into every future session. ONLY use when the user explicitly asks to remember or save something. Never use autonomously.`,
     permission: "write",
-    parameters: z13.object({
-      text: z13.string().max(REMEMBER_TEXT_MAX_CHARS).describe("The note to save, as a single concise sentence.")
+    parameters: z14.object({
+      text: z14.string().max(REMEMBER_TEXT_MAX_CHARS).describe("The note to save, as a single concise sentence.")
     }),
     async execute(args) {
       appendUserMemory(args.text, deps.home);
@@ -2467,6 +3117,24 @@ ${finalReply.slice(0, 2e3)}
   }
 }
 var STREAM_RETRY_BASE_DELAY_MS = 1e3;
+var REDO_LABEL_MAX = 40;
+function messageText(message) {
+  if (!message) return "";
+  const content = message.content;
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.filter((part) => part.type === "text").map((part) => "text" in part ? part.text : "").join(" ");
+  }
+  return "";
+}
+function stableStringify(value) {
+  if (value === void 0) return "undefined";
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const record = value;
+  const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+  return `{${entries.join(",")}}`;
+}
 function sleep(ms, signal) {
   if (signal.aborted) return Promise.resolve(false);
   return new Promise((resolve) => {
@@ -2485,11 +3153,32 @@ var AgentLoop = class {
   messages = [];
   opts;
   // Seq + user-message index of each turn started via stream(); lets /undo
-  // match a retracted turn to the file snapshots it produced. Cleared when
-  // history is replaced wholesale (resume/compact), because indices no longer
-  // line up — in that case /undo only retracts messages, never wrong files.
+  // match a retracted turn to the file snapshots it produced. `tree` is the
+  // whole-tree git snapshot captured at the turn's start (root loop only,
+  // config.gitSnapshots) — when present, /undo restores it instead of
+  // replaying per-file snapshots, which also covers bash-made changes.
+  // Cleared when history is replaced wholesale (resume/compact), because
+  // indices no longer line up — in that case /undo only retracts messages,
+  // never wrong files.
   turnMarkers = [];
+  // Pre-undo tree snapshots, latest last: a git-path /undo pushes the
+  // pre-undo working tree here so /redo can restore it exactly. Only the git
+  // path feeds this — per-file snapshot undos stay non-redoable.
+  redoStack = [];
+  // Start of the most recently retracted turn's user message; undoLastTurn
+  // consumes it as the redo label right after retractLastTurn sets it.
+  lastUndoneLabel = "";
+  // Doom-loop guard: signature of the most recent tool call and how many
+  // times in a row it has repeated. Any different call resets the count.
+  lastToolSignature = null;
+  repeatedToolCalls = 0;
+  // Turn context of the in-flight stream() turn, stamped onto every tool
+  // execution so file snapshots attribute root changes to a turn and mark
+  // subagent changes as excluded from turn-level retraction.
+  activeTurnSeq = 0;
+  activeTurnUserIndex = -1;
   titleScheduled = false;
+  titleInput;
   confirmHandler;
   // Hook failures never block the turn (except an explicit PreToolUse block);
   // their stderr surfaces through this callback (REPL system message / stderr
@@ -2497,6 +3186,15 @@ var AgentLoop = class {
   onHookWarning;
   constructor(opts) {
     this.opts = opts;
+    const depth = opts.subagentDepth ?? 0;
+    if (depth > 0) {
+      opts.registry = new ToolRegistry(new TodoStore());
+    } else {
+      setTodoPersistGuard(() => {
+        const mode = this.opts.config.permissionMode;
+        return mode !== "readonly" && mode !== "plan";
+      });
+    }
     if (opts.system) {
       this.messages.push({ role: "system", content: opts.system });
     }
@@ -2505,7 +3203,6 @@ var AgentLoop = class {
     }
     opts.registry?.register(createSkillTool({ cwd: opts.cwd }));
     opts.registry?.register(createRememberTool());
-    const depth = opts.subagentDepth ?? 0;
     if (opts.registry && depth < MAX_SUBAGENT_DEPTH) {
       opts.registry.register(
         createSubagentTool({
@@ -2524,10 +3221,14 @@ var AgentLoop = class {
   }
   // Swaps the persistence target (/new starts a fresh session mid-REPL).
   // Title generation is re-armed so the new session gets one after its first
-  // turn, and snapshot checkpoints now flow to the new store.
+  // turn, and snapshot checkpoints now flow to the new store. The redo stack
+  // dies with the old session context: its trees describe working-tree states
+  // that no longer line up with the new session's conversation.
   setSessionStore(store) {
     this.opts.sessionStore = store;
     this.titleScheduled = false;
+    this.titleInput = void 0;
+    this.redoStack = [];
     if (store) this.bindSnapshotHooks(store);
   }
   bindSnapshotHooks(store) {
@@ -2540,7 +3241,9 @@ var AgentLoop = class {
           existed: snapshot.existed,
           toolName: snapshot.toolName,
           turn: snapshot.turn,
-          messageIndex: snapshot.messageIndex
+          messageIndex: snapshot.messageIndex,
+          owner: snapshot.owner,
+          contentTooLarge: snapshot.contentTooLarge
         },
         snapshot.content
       ),
@@ -2550,37 +3253,92 @@ var AgentLoop = class {
   async loadMessages(messages) {
     this.messages = reconcileToolCalls(messages);
     this.turnMarkers = [];
+    this.redoStack = [];
   }
   // Read-only counterpart of retractLastTurn: how many messages /undo would
-  // drop and which snapshot turn's file changes it would revert (undefined =
-  // no verified turn, so no file snapshots may be reverted). Mutates nothing,
-  // so the REPL can show the preview before the user confirms.
+  // drop, which snapshot turn's file changes it would revert (undefined =
+  // no verified turn, so no file snapshots may be reverted), and the turn's
+  // whole-tree snapshot when one was captured. Mutates nothing, so the REPL
+  // can show the preview before the user confirms.
   previewLastTurnRetraction() {
     const result = retractLastTurn([...this.messages]);
     if (result.removed === 0) return { removed: 0 };
     const userIndex = result.messages.length;
     const last = this.turnMarkers[this.turnMarkers.length - 1];
-    const turn = last && last.userIndex === userIndex ? last.seq : void 0;
-    return { removed: result.removed, turn };
+    const verified = last && last.userIndex === userIndex;
+    return {
+      removed: result.removed,
+      turn: verified ? last.seq : void 0,
+      tree: verified ? last.tree : void 0
+    };
   }
   // Drops the final user message and everything after it, and persists the
   // trimmed history so a later /resume does not bring the turn back.
   // `turn` is the retracted turn's snapshot seq when it could be verified
   // against the marker recorded at turn start — undefined means the caller
-  // must not revert any file snapshots.
+  // must not revert any file snapshots. `tree` is the turn's whole-tree
+  // snapshot when git snapshots tracked it.
   async retractLastTurn() {
     const result = retractLastTurn([...this.messages]);
     if (result.removed === 0) return { removed: 0 };
     const userIndex = result.messages.length;
+    this.lastUndoneLabel = messageText(this.messages[userIndex]).slice(0, REDO_LABEL_MAX);
     this.messages = result.messages;
     await this.opts.sessionStore?.replaceMessages([...this.messages]);
     const last = this.turnMarkers[this.turnMarkers.length - 1];
     let turn;
+    let tree;
     if (last && last.userIndex === userIndex) {
       turn = last.seq;
+      tree = last.tree;
       this.turnMarkers.pop();
     }
-    return { removed: result.removed, turn };
+    return { removed: result.removed, turn, tree };
+  }
+  // The confirmed /undo: retract the last turn, then revert its file changes.
+  // With a whole-tree snapshot the working tree is restored from git — which
+  // also reverts changes no tool snapshot saw (bash edits, deleted files) —
+  // and the turn's per-file snapshots are dropped instead of replayed (they
+  // would double-restore). The pre-undo tree feeds the redo stack, so /redo
+  // returns to the exact state before the undo. Any git failure falls back
+  // to the per-file snapshot revert, which never pushes the redo stack.
+  async undoLastTurn() {
+    const { removed, turn, tree } = await this.retractLastTurn();
+    if (removed === 0) return { removed, reverted: [] };
+    if (turn !== void 0 && tree !== void 0) {
+      const preUndoTree = await trackTree(this.opts.cwd);
+      if (preUndoTree !== null && await restoreTree(this.opts.cwd, tree)) {
+        this.redoStack.push({ tree: preUndoTree, label: this.lastUndoneLabel });
+        const dropped = await dropTurnSnapshots(turn, true);
+        return {
+          removed,
+          reverted: [
+            `Restored the working tree from the git snapshot taken at the turn's start (${tree.slice(0, 8)}; covers changes from any tool, bash included; ${dropped} per-file snapshot(s) discarded).`
+          ],
+          tree
+        };
+      }
+    }
+    const reverted = turn !== void 0 ? await undoTurnSnapshots(turn) : [];
+    return { removed, reverted };
+  }
+  // The redo entry /redo would restore, without popping it (for the confirm
+  // prompt); null when there is nothing to redo.
+  peekRedo() {
+    return this.redoStack[this.redoStack.length - 1] ?? null;
+  }
+  // Restores the working tree to its state just before the last git-path
+  // /undo. Conversation messages are not re-added — redo is file-level only.
+  // The entry stays on the stack when the restore fails, so it can be retried.
+  async redoLastUndo() {
+    const entry = this.redoStack[this.redoStack.length - 1];
+    if (!entry) return null;
+    const names = await diffTreeNames(this.opts.cwd, entry.tree);
+    if (!await restoreTree(this.opts.cwd, entry.tree)) {
+      return { ok: false, tree: entry.tree, label: entry.label, files: null };
+    }
+    this.redoStack.pop();
+    return { ok: true, tree: entry.tree, label: entry.label, files: names?.length ?? null };
   }
   // Cut point for a rewind: messages[index] should be the user message that
   // started the rewound turn, but compaction may have shifted indices, so
@@ -2626,13 +3384,18 @@ var AgentLoop = class {
     await this.opts.sessionStore?.replaceMessages([...this.messages]);
     return removed;
   }
-  // After the first assistant reply, kick off background title generation
-  // for the session. Runs once per loop; the store-level title check makes
-  // resumed sessions that already have a title a no-op.
-  maybeScheduleTitle(input) {
+  // Background title generation runs once per loop, fed by the first real
+  // user message of the session. It must NOT latch on the first assistant
+  // step's text: that text is empty for a tool-call-only first step (the
+  // common agentic case), which used to burn the one-shot flag on an empty
+  // input and left every such session untitled. The store-level title check
+  // makes resumed sessions that already have a title a no-op.
+  maybeScheduleTitle() {
     if (this.titleScheduled) return;
     const store = this.opts.sessionStore;
     if (!store) return;
+    const input = this.titleInput;
+    if (!input) return;
     this.titleScheduled = true;
     scheduleSessionTitle(store, input, this.opts.model);
   }
@@ -2681,6 +3444,9 @@ var AgentLoop = class {
     this.syncSystemMessage();
     const inputText = typeof input === "string" ? input : input.text;
     const images = typeof input === "string" ? [] : input.images;
+    if (this.titleInput === void 0 && inputText.trim().length > 0) {
+      this.titleInput = inputText;
+    }
     const userMessage = images.length > 0 ? {
       role: "user",
       content: [
@@ -2692,12 +3458,17 @@ var AgentLoop = class {
         { type: "text", text: inputText }
       ]
     } : { role: "user", content: inputText };
+    const isRoot = (this.opts.subagentDepth ?? 0) === 0;
+    const tree = isRoot && this.opts.config.gitSnapshots ? await trackTree(this.opts.cwd) ?? void 0 : void 0;
     this.messages.push(userMessage);
-    const seq = (this.opts.subagentDepth ?? 0) === 0 ? beginTurn(this.messages.length - 1) : currentTurnSeq();
-    this.turnMarkers.push({ seq, userIndex: this.messages.length - 1 });
+    const seq = isRoot ? beginTurn(this.messages.length - 1) : currentTurnSeq();
+    this.turnMarkers.push({ seq, userIndex: this.messages.length - 1, tree });
+    this.activeTurnSeq = seq;
+    this.activeTurnUserIndex = this.messages.length - 1;
     await this.persist(
       opts?.persistAs !== void 0 ? { role: "user", content: opts.persistAs } : userMessage
     );
+    this.maybeScheduleTitle();
     const { config, registry, cwd } = this.opts;
     const aiTools = this.buildAiTools();
     let autoContinues = 0;
@@ -2718,9 +3489,13 @@ ${finished.result}`
         }
       }
       const maxTokens = this.opts.contextMaxTokens ?? config.contextMaxTokens;
-      const compacted = compactMessages([...this.messages], maxTokens);
+      const compacted = compactMessages(
+        [...this.messages],
+        resolveCompactThreshold(config, maxTokens)
+      );
       if (compacted.compacted) {
-        this.messages = await this.applyCompactionSummary(compacted);
+        this.messages = await this.applyCompactionSummary(compacted, signal);
+        this.turnMarkers = [];
       }
       const maxRetries = Math.max(0, config.streamMaxRetries);
       const baseDelay = this.opts.retryDelayMs ?? STREAM_RETRY_BASE_DELAY_MS;
@@ -2785,7 +3560,7 @@ ${finished.result}`
         if (attempt >= maxRetries) break;
         if (!failure && text.length === 0 && toolCalls.length === 0 && attempt >= 1 && (isFilteredEmptyFinish(lastFinishReason) || sawReasoning || lastUsage !== void 0 && lastUsage.completionTokens > 0))
           break;
-        const delayMs = computeRetryDelayMs(attempt, baseDelay, failure);
+        const delayMs = computeRetryDelayMs(attempt, failure ? baseDelay : baseDelay * 2, failure);
         yield {
           type: "retry",
           attempt: attempt + 2,
@@ -2793,7 +3568,10 @@ ${finished.result}`
           delayMs,
           reason: failure ? summarizeStreamError(failure) : `empty response (finish: ${lastFinishReason ?? "none"})`
         };
-        if (!await sleep(delayMs, signal)) return;
+        if (!await sleep(delayMs, signal)) {
+          yield* this.persistInterrupted(text, toolCalls);
+          return;
+        }
       }
       if (failure) {
         yield { type: "error", error: failure };
@@ -2835,7 +3613,6 @@ ${finished.result}`
       };
       this.messages.push(assistantMessage);
       await this.persist(assistantMessage);
-      this.maybeScheduleTitle(text);
       if (toolCalls.length === 0) {
         let reason = null;
         let nudgeText = AUTO_CONTINUE_NUDGE;
@@ -2883,7 +3660,11 @@ ${finished.result}`
       try {
         for (const call of toolCalls) {
           if (signal.aborted) break;
-          const result = await this.executeTool(call, signal);
+          const refusal = this.doomLoopRefusal(call);
+          if (refusal !== null) {
+            yield { type: "notice", message: refusal };
+          }
+          const result = refusal !== null ? { content: refusal, isError: true } : await this.executeTool(call, signal);
           const toolMessage = {
             role: "tool",
             content: [
@@ -2960,7 +3741,7 @@ ${finished.result}`
     if (userMemory) parts.push(userMemory);
     const skills = discoverSkills(this.opts.cwd);
     if (skills.length > 0) parts.push(formatSkillsBlock(skills));
-    const git = getGitSummary(this.opts.cwd);
+    const git = getGitSummaryCached(this.opts.cwd);
     if (git) parts.push(formatGitSummary(git));
     if (parts.length === 0) return;
     const content = parts.join("\n\n");
@@ -2971,7 +3752,7 @@ ${finished.result}`
       this.messages.unshift({ role: "system", content });
     }
   }
-  async applyCompactionSummary(compacted) {
+  async applyCompactionSummary(compacted, signal) {
     const { config, model } = this.opts;
     if (config.contextCompaction !== "summary" || !model) {
       return compacted.messages;
@@ -2979,7 +3760,7 @@ ${finished.result}`
     const headCount = compacted.messages[0]?.role === "system" ? 1 : 0;
     const dropped = this.messages.slice(headCount, headCount + compacted.droppedCount);
     try {
-      const summary = await summarizeMessages(dropped, model);
+      const summary = await summarizeMessages(dropped, model, signal);
       const messages = compacted.messages.slice();
       messages[headCount] = {
         role: "user",
@@ -2992,15 +3773,23 @@ ${summary}`
     }
   }
   async *streamOnce(aiTools, signal, timeoutScale = 1) {
-    const { streamChat } = await import("./stream-OY2MKWYE.js");
-    yield* streamChat({
+    const { streamChat } = await import("./stream-H4BYBVAZ.js");
+    for await (const event of streamChat({
       model: this.opts.model,
       messages: this.messages,
       tools: aiTools,
       abortSignal: signal,
       idleTimeoutMs: this.opts.config.streamIdleTimeoutSec * 1e3 * timeoutScale,
       firstPartTimeoutMs: this.opts.config.streamFirstChunkTimeoutSec * 1e3 * timeoutScale
-    });
+    })) {
+      if (event.type === "finish" && event.truncated) {
+        yield {
+          type: "notice",
+          message: "Response was cut short by the stream idle timeout \u2014 the reply may be incomplete."
+        };
+      }
+      yield event;
+    }
   }
   buildAiTools() {
     const plan = this.opts.config.permissionMode === "plan";
@@ -3030,6 +3819,23 @@ ${summary}`
       return empty;
     }
   }
+  // opencode's doom_loop guard: returns a refusal once the identical tool
+  // call (name + stable-serialized args) has repeated config.doomLoopThreshold
+  // times in a row; 0 disables. Any different signature resets the streak.
+  // Subagents are separate loop instances, so each counts its own streak.
+  doomLoopRefusal(call) {
+    const threshold = this.opts.config.doomLoopThreshold;
+    if (threshold <= 0) return null;
+    const signature = `${call.name} ${stableStringify(call.args)}`;
+    if (signature === this.lastToolSignature) {
+      this.repeatedToolCalls += 1;
+    } else {
+      this.lastToolSignature = signature;
+      this.repeatedToolCalls = 1;
+    }
+    if (this.repeatedToolCalls < threshold) return null;
+    return `Refused: tool "${call.name}" was called ${this.repeatedToolCalls} times in a row with identical arguments. Stop retrying it \u2014 change your approach or report that you are blocked.`;
+  }
   async executeTool(call, signal) {
     const { registry, config, cwd } = this.opts;
     const tool = registry.get(call.name);
@@ -3074,7 +3880,15 @@ ${summary}`
     }
     let result;
     try {
-      result = await tool.execute(parsed.data, { cwd, abortSignal: signal });
+      result = await tool.execute(parsed.data, {
+        cwd,
+        abortSignal: signal,
+        snapshotContext: {
+          owner: (this.opts.subagentDepth ?? 0) > 0 ? "subagent" : "root",
+          turn: this.activeTurnSeq,
+          messageIndex: this.activeTurnUserIndex
+        }
+      });
     } catch (error) {
       if (signal.aborted) {
         return { content: "Tool execution aborted.", isError: true };
@@ -3093,6 +3907,9 @@ ${summary}`
 
 export {
   defaultAgentTasks,
+  formatAgentTaskUpdate,
+  ConfigSchema,
+  contextWindowTokens,
   estimateTokens,
   summarizeMessages,
   compactMessages,
@@ -3105,34 +3922,34 @@ export {
   MAX_IMAGE_DIMENSION,
   probeImageDimensions,
   reconcileToolCalls,
+  isSensitivePath,
   isAllowedByRules,
   buildAllowRule,
   isDangerousCommand,
+  diffTreeNames,
   listSnapshots,
   clearSnapshots,
   hydrateSnapshots,
   listTurnSnapshots,
   resolveSnapshotContent,
-  undoTurnSnapshots,
   rewindToSnapshot,
-  TodoStore,
-  formatTodos,
-  parseTodoArgs,
-  loadTodos,
-  resetTodos,
-  discoverSkills,
   defaultTaskManager,
   resolveShell,
   bashTool,
   SKIP_DIRS,
   createIgnorePredicate,
-  isSensitivePath2 as isSensitivePath,
   formatTaskList,
   formatTaskStarted,
   formatTaskFinished,
+  TodoStore,
+  formatTodos,
+  parseTodoArgs,
+  loadTodos,
+  resetTodos,
+  discoverSkills,
   createDefaultRegistry,
   appendUserMemory,
   PLAN_MODE_PROMPT,
   AgentLoop
 };
-//# sourceMappingURL=chunk-BV4PLM6X.js.map
+//# sourceMappingURL=chunk-K3R42LOX.js.map