@cryer/star-cli 0.3.6 → 0.3.7

package/dist/{chunk-I6FDXAWX.js → chunk-OOOW7FC4.js}

@@ -1,13 +1,4 @@
 #!/usr/bin/env node
-import {
-  computeRetryDelayMs,
-  gitTreesDir,
-  isRetryableStreamError,
-  responseBodyOf,
-  starHome,
-  summarizeStreamError,
-  userMemoryPath
-} from "./chunk-B6P4VUBE.js";
 
 // src/agent/loop.ts
 import { tool as aiTool, generateText as generateText3 } from "ai";
@@ -42,6 +33,17 @@ var ModelConfigSchema = z.object({
   // request carries no effort field and the server-side default applies.
   // Anthropic maps effort to a thinking budget instead — ignored there.
   reasoningEffort: z.string().min(1).optional(),
+  // Sampling temperature forwarded on every request. Unset = the AI SDK's
+  // own default applies (ai@4 sends 0 — it does NOT omit the field). Some
+  // endpoints reject anything but one explicit value (e.g. kimi-for-coding:
+  // "invalid temperature: only 1 is allowed") — set it here. No upper
+  // bound: ranges vary by provider and the server validates.
+  temperature: z.number().min(0).optional(),
+  // Per-model overrides of the top-level stream watchdog timeouts (unset =
+  // the global values apply). Raise streamIdleTimeoutSec for relays that
+  // buffer long generations and stall mid-stream between flushes.
+  streamIdleTimeoutSec: z.number().positive().optional(),
+  streamFirstChunkTimeoutSec: z.number().positive().optional(),
   // Cost estimation needs BOTH prices (USD per 1M tokens); with only one set
   // the model is treated as unpriced.
   promptPrice: z.number().nonnegative().optional(),
@@ -91,10 +93,12 @@ var ConfigSchema = z.object({
   compactThresholdTokens: z.number().int().positive().optional(),
   // Seconds without any stream part before a stalled response is ended
   // gracefully (some relays never send the terminal chunks). Applies once
-  // streaming has started; the first part gets a longer, fixed allowance.
+  // content has started streaming; the wait for the first content part gets
+  // a longer allowance (control/metadata parts don't count as content).
   streamIdleTimeoutSec: z.number().positive().default(20),
-  // Seconds to wait for the very first stream part before giving up; slow
-  // thinking-model relays can buffer for minutes before sending anything.
+  // Seconds to wait for the very first content part before giving up; slow
+  // thinking-model endpoints can stay silent for minutes after accepting
+  // the request.
   streamFirstChunkTimeoutSec: z.number().positive().default(300),
   // Extra attempts per model request when a stream fails transiently
   // (network error, 429/5xx, idle watchdog cutoff) or comes back empty, so a
@@ -150,11 +154,13 @@ import { generateText } from "ai";
 var CHARS_PER_TOKEN = 4;
 var MESSAGE_OVERHEAD = 4;
 var IMAGE_PART_TOKENS = 1024;
-var CJK_RE = /[\u3000-\u30FF\u3400-\u4DBF\u4E00-\u9FFF\uF900-\uFAFF\uFF00-\uFFEF]/;
+function isCjkCode(code) {
+  return code >= 12288 && code <= 12543 || code >= 13312 && code <= 19903 || code >= 19968 && code <= 40959 || code >= 63744 && code <= 64255 || code >= 65280 && code <= 65519;
+}
 function textWeight(text) {
   let cjk = 0;
-  for (const ch of text) {
-    if (CJK_RE.test(ch)) cjk++;
+  for (let i = 0; i < text.length; i++) {
+    if (isCjkCode(text.charCodeAt(i))) cjk++;
   }
   return text.length + cjk * (CHARS_PER_TOKEN - 1);
 }
@@ -183,8 +189,13 @@ function imagePartCount(message) {
   if (typeof message.content === "string" || message.role === "tool") return 0;
   return message.content.filter((part) => part.type === "image" || part.type === "file").length;
 }
+var tokenCache = /* @__PURE__ */ new WeakMap();
 function estimateMessageTokens(message) {
-  return Math.ceil(contentCharLength(message) / CHARS_PER_TOKEN) + MESSAGE_OVERHEAD + imagePartCount(message) * IMAGE_PART_TOKENS;
+  const cached = tokenCache.get(message);
+  if (cached !== void 0) return cached;
+  const tokens = Math.ceil(contentCharLength(message) / CHARS_PER_TOKEN) + MESSAGE_OVERHEAD + imagePartCount(message) * IMAGE_PART_TOKENS;
+  tokenCache.set(message, tokens);
+  return tokens;
 }
 function estimateTokens(messages) {
   return messages.reduce((total, message) => total + estimateMessageTokens(message), 0);
@@ -222,7 +233,7 @@ function serializeMessage(message) {
   });
   return `${message.role}: ${parts.join("\n")}`;
 }
-async function summarizeMessages(messages, model, signal) {
+async function summarizeMessages(messages, model, signal, temperature) {
   const transcript = messages.map(serializeMessage).join("\n");
   const { text } = await generateText({
     model,
@@ -230,6 +241,7 @@ async function summarizeMessages(messages, model, signal) {
     prompt: `Summarize this conversation so far:
 
 ${transcript}`,
+    temperature,
     // A hung relay must not stall the whole turn on the summary: cap it at
     // 60s and let the caller's abort (Esc) cut it short as well; the caller
     // falls back to the truncation placeholder on any failure.
@@ -246,26 +258,29 @@ function compactMessages(messages, maxTokens, opts = {}) {
   const hasSystem = first?.role === "system";
   const head = hasSystem && first ? [first] : [];
   const rest = hasSystem ? messages.slice(1) : messages.slice();
+  const messageTokens = rest.map((message) => estimateMessageTokens(message));
   const turns = [];
-  for (const message of rest) {
+  for (let i = 0; i < rest.length; i++) {
     const current = turns[turns.length - 1];
-    if (message.role === "user" || !current) {
-      turns.push([message]);
+    if (rest[i]?.role === "user" || !current) {
+      turns.push({ length: 1, tokens: messageTokens[i] ?? 0 });
     } else {
-      current.push(message);
+      current.length += 1;
+      current.tokens += messageTokens[i] ?? 0;
     }
   }
+  const headTokens = estimateTokens(head);
+  const restTokens = estimateTokens(rest);
   let droppedCount = 0;
-  let turnIndex = 0;
-  while (turnIndex < turns.length) {
-    const turn = turns[turnIndex];
+  let droppedTokens = 0;
+  for (const turn of turns) {
     if (rest.length - droppedCount - turn.length < MIN_KEPT_MESSAGES) {
       break;
     }
     droppedCount += turn.length;
-    turnIndex += 1;
-    const candidate = [...head, placeholderMessage(droppedCount), ...rest.slice(droppedCount)];
-    if (estimateTokens(candidate) <= limit) {
+    droppedTokens += turn.tokens;
+    const candidateTokens = headTokens + estimateMessageTokens(placeholderMessage(droppedCount)) + (restTokens - droppedTokens);
+    if (candidateTokens <= limit) {
       break;
     }
   }
@@ -390,6 +405,12 @@ ${unstaged}`);
   return { status, diff: text, truncated };
 }
 
+// src/core/http-error.ts
+function responseBodyOf(error) {
+  const body = error.responseBody;
+  return typeof body === "string" && body.length > 0 ? body : void 0;
+}
+
 // src/core/image.ts
 var MAX_IMAGE_DIMENSION = 2e3;
 var OVERSIZED_IMAGE_FALLBACK_BYTES = 5 * 1024 * 1024;
@@ -689,9 +710,365 @@ async function runHooks(event, hooks2, ctx) {
   return result;
 }
 
+// src/llm/retry.ts
+var NON_RETRYABLE_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "AI_NoSuchToolError",
+  "AI_InvalidToolArgumentsError",
+  "AI_InvalidPromptError",
+  "AI_NoSuchModelError",
+  "AI_LoadAPIKeyError",
+  "AI_TypeValidationError",
+  "AI_JSONParseError"
+]);
+var RETRYABLE_MESSAGE_PATTERNS = [
+  /\b(408|425|429|500|502|503|504|520|521|522|523|524|529)\b/,
+  /rate.?limit|too many requests|rate increased/i,
+  /overloaded|service.?unavailable|internal (server )?error|server error|provider returned error|bad gateway|gateway timeout/i,
+  /terminated|fetch failed|failed to fetch|network.?error|upstream connect|connection (?:error|refused|lost|reset)|socket (?:hang up|connection)|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout|epipe|ehostunreach|enetunreach/i,
+  /\b(?:request|response|connection|network|stream|read|headers?|body) (?:timeout|timed out|time out)\b/i,
+  /resource.?exhausted|try (?:your request )?again|at capacity/i
+];
+function statusCodeOf(error) {
+  const status = error.statusCode;
+  return typeof status === "number" ? status : void 0;
+}
+function matchesRetryablePattern(text) {
+  return typeof text === "string" && RETRYABLE_MESSAGE_PATTERNS.some((p) => p.test(text));
+}
+function isRetryableStreamError(error) {
+  if (NON_RETRYABLE_ERROR_NAMES.has(error.name)) return false;
+  if (error.isRetryable === true) return true;
+  const status = statusCodeOf(error);
+  if (status !== void 0) {
+    if (status === 408 || status === 429 || status >= 500 && status !== 501) return true;
+    return matchesRetryablePattern(error.message) || matchesRetryablePattern(responseBodyOf(error));
+  }
+  return true;
+}
+var RETRY_JITTER_FACTOR = 0.25;
+var MAX_RETRY_DELAY_MS = 6e4;
+function retryAfterDelayMs(error) {
+  const headers = error.responseHeaders;
+  if (!headers || typeof headers !== "object") return void 0;
+  const normalized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (typeof value === "string") normalized[key.toLowerCase()] = value;
+  }
+  const afterMs = Number.parseFloat(normalized["retry-after-ms"] ?? "");
+  if (!Number.isNaN(afterMs)) return Math.max(0, afterMs);
+  const after = normalized["retry-after"];
+  if (after) {
+    const seconds = Number.parseFloat(after);
+    if (!Number.isNaN(seconds)) return Math.max(0, Math.ceil(seconds * 1e3));
+    const dateMs = Date.parse(after) - Date.now();
+    if (!Number.isNaN(dateMs) && dateMs > 0) return Math.ceil(dateMs);
+  }
+  return void 0;
+}
+function computeRetryDelayMs(attempt, baseMs, error, random = Math.random()) {
+  const hinted = error ? retryAfterDelayMs(error) : void 0;
+  if (hinted !== void 0) return Math.min(hinted, MAX_RETRY_DELAY_MS);
+  const base = baseMs * 2 ** attempt;
+  return Math.min(Math.ceil(base + base * RETRY_JITTER_FACTOR * random), MAX_RETRY_DELAY_MS);
+}
+function summarizeStreamError(error) {
+  const parts = [error.message || error.name];
+  const status = statusCodeOf(error);
+  if (status !== void 0 && !error.message.includes(String(status))) {
+    parts.push(`(HTTP ${status})`);
+  }
+  const body = responseBodyOf(error);
+  if (body && !error.message.includes(body.slice(0, 40))) {
+    const excerpt = body.replace(/\s+/g, " ").trim().slice(0, 200);
+    if (excerpt) parts.push(`\u2014 ${excerpt}`);
+  }
+  return parts.join(" ");
+}
+
+// src/llm/stream.ts
+import { streamText } from "ai";
+
+// src/llm/activity.ts
+var trackers = /* @__PURE__ */ new WeakMap();
+function streamActivity(signal) {
+  return trackers.get(signal);
+}
+function wrapFetchWithActivity(baseFetch = fetch) {
+  return async (input, init) => {
+    const response = await baseFetch(input, init);
+    const signal = init?.signal ?? (input instanceof Request ? input.signal : null);
+    if (!signal || !response.body) return response;
+    const tracker = { lastChunkAt: Date.now() };
+    trackers.set(signal, tracker);
+    const reader = response.body.getReader();
+    const body = new ReadableStream({
+      async pull(controller) {
+        try {
+          const { done, value } = await reader.read();
+          if (done) {
+            controller.close();
+            return;
+          }
+          tracker.lastChunkAt = Date.now();
+          controller.enqueue(value);
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel(reason) {
+        return reader.cancel(reason);
+      }
+    });
+    return new Response(body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  };
+}
+
+// src/llm/debug.ts
+import { appendFileSync } from "fs";
+import path2 from "path";
+
+// src/config/paths.ts
+import os from "os";
+import path from "path";
+function starHome() {
+  return process.env.STAR_HOME ?? path.join(os.homedir(), ".star-cli");
+}
+function globalConfigPath() {
+  return path.join(starHome(), "config.toml");
+}
+function sessionsDir() {
+  return path.join(starHome(), "sessions");
+}
+function userMemoryPath() {
+  return path.join(starHome(), "MEMORY.md");
+}
+function gitTreesDir() {
+  return path.join(starHome(), "git-trees");
+}
+function envFilePath() {
+  return path.join(starHome(), ".env");
+}
+function projectConfigPath(cwd) {
+  return path.join(cwd, ".star", "config.toml");
+}
+
+// src/llm/debug.ts
+function debugStreamLog(event, data) {
+  if (!process.env.STAR_DEBUG) return;
+  try {
+    const line = `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), event, ...data })}
+`;
+    appendFileSync(path2.join(starHome(), "debug.log"), line);
+  } catch {
+  }
+}
+
+// src/llm/stream.ts
+var DEFAULT_IDLE_TIMEOUT_MS = 2e4;
+var DEFAULT_FIRST_PART_TIMEOUT_MS = 12e4;
+var GENERATION_PART_TYPES = /* @__PURE__ */ new Set(["text-delta", "reasoning", "tool-call", "tool-call-delta"]);
+var MAX_KEEPALIVE_SILENCE_MS = 10 * 6e4;
+var CACHE_READ_KEYS = ["cacheReadInputTokens", "cache_read_input_tokens"];
+var CACHED_PROMPT_KEYS = ["cachedPromptTokens", "cached_prompt_tokens", "cachedTokens"];
+function extractCacheUsage(providerMetadata) {
+  if (!providerMetadata || typeof providerMetadata !== "object") return {};
+  for (const value of Object.values(providerMetadata)) {
+    if (!value || typeof value !== "object") continue;
+    const record = value;
+    for (const key of CACHE_READ_KEYS) {
+      const n = record[key];
+      if (typeof n === "number" && Number.isFinite(n)) return { cacheReadInputTokens: n };
+    }
+    for (const key of CACHED_PROMPT_KEYS) {
+      const n = record[key];
+      if (typeof n === "number" && Number.isFinite(n)) return { cachedPromptTokens: n };
+    }
+  }
+  return {};
+}
+async function* streamChat(opts) {
+  const controller = new AbortController();
+  const onAbort = () => controller.abort();
+  opts.abortSignal?.addEventListener("abort", onAbort);
+  if (opts.abortSignal?.aborted) controller.abort();
+  const { openai: openaiMetadata, ...otherMetadata } = opts.providerMetadata ?? {};
+  const result = streamText({
+    model: opts.model,
+    messages: opts.messages,
+    tools: opts.tools,
+    abortSignal: controller.signal,
+    maxTokens: opts.maxTokens,
+    temperature: opts.temperature,
+    // Disable the SDK's own retries (ai@4 defaults to 2 internal attempts with
+    // fixed backoff that ignores Retry-After and the abort signal, and
+    // exhaustion throws an AI_RetryError stripped of status/headers/body) —
+    // the retry policy in agent/loop.ts + llm/retry.ts owns the full budget
+    // and needs the raw error to classify.
+    maxRetries: 0,
+    // Pass tool-call argument deltas through (instead of buffering until the
+    // complete call) so large write_file payloads report receive progress.
+    toolCallStreaming: true,
+    experimental_providerMetadata: {
+      // Only the openai provider (our responses-protocol path) reads these;
+      // other providers ignore unknown metadata. The SDK's responses provider
+      // sends every tool with strict:true by default (strictSchemas), and
+      // strict mode requires every schema property to be required — our
+      // classic function-calling schemas use optional properties, which
+      // relays then reject. store:false matches how codex and opencode talk
+      // to relays (no server-side response storage).
+      ...otherMetadata,
+      openai: { strictSchemas: false, store: false, ...openaiMetadata }
+    }
+  });
+  const idleTimeoutMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+  const firstPartTimeoutMs = opts.firstPartTimeoutMs ?? DEFAULT_FIRST_PART_TIMEOUT_MS;
+  const iterator = result.fullStream[Symbol.asyncIterator]();
+  let seenContent = false;
+  let deltas = 0;
+  let hasContent = false;
+  const argsProgress = /* @__PURE__ */ new Map();
+  let lastPartAt = Date.now();
+  debugStreamLog("request", {
+    messages: opts.messages.length,
+    idleTimeoutMs,
+    firstPartTimeoutMs
+  });
+  try {
+    for (; ; ) {
+      let timer;
+      const windowMs = seenContent ? idleTimeoutMs : firstPartTimeoutMs;
+      const idle = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), windowMs);
+      });
+      let next;
+      try {
+        next = await Promise.race([iterator.next(), idle]);
+      } catch (error) {
+        debugStreamLog("stream-throw", {
+          seenContent,
+          deltas,
+          error: error instanceof Error ? summarizeStreamError(error) : String(error)
+        });
+        throw error;
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+      if (next === null) {
+        const activity = streamActivity(controller.signal);
+        const silentForMs = Date.now() - lastPartAt;
+        const lastChunkAgoMs = activity ? Date.now() - activity.lastChunkAt : void 0;
+        if (lastChunkAgoMs !== void 0 && lastChunkAgoMs < windowMs && silentForMs < MAX_KEEPALIVE_SILENCE_MS) {
+          debugStreamLog("keepalive", { seenContent, deltas, lastChunkAgoMs, silentForMs });
+          continue;
+        }
+        debugStreamLog("idle-timeout", {
+          seenContent,
+          deltas,
+          waitedMs: windowMs,
+          lastChunkAgoMs
+        });
+        yield {
+          type: "finish",
+          finishReason: "idle-timeout",
+          usage: void 0,
+          // Content already streamed means the reply may be cut off
+          // mid-thought; the loop surfaces a notice for that.
+          ...hasContent ? { truncated: true } : {}
+        };
+        return;
+      }
+      if (next.done) {
+        debugStreamLog("end", { seenContent, deltas });
+        return;
+      }
+      const part = next.value;
+      lastPartAt = Date.now();
+      if (GENERATION_PART_TYPES.has(part.type)) seenContent = true;
+      switch (part.type) {
+        case "text-delta":
+          deltas++;
+          hasContent = true;
+          yield { type: "text-delta", text: part.textDelta };
+          break;
+        case "reasoning":
+          deltas++;
+          yield { type: "reasoning", text: part.textDelta };
+          break;
+        case "tool-call":
+          hasContent = true;
+          yield {
+            type: "tool-call",
+            id: part.toolCallId,
+            name: part.toolName,
+            args: part.args
+          };
+          break;
+        case "tool-call-streaming-start": {
+          argsProgress.set(part.toolCallId, {
+            name: part.toolName,
+            chars: 0,
+            nextMark: 4096
+          });
+          break;
+        }
+        case "tool-call-delta": {
+          const progress = argsProgress.get(part.toolCallId) ?? {
+            name: part.toolName,
+            chars: 0,
+            nextMark: 4096
+          };
+          progress.chars += part.argsTextDelta.length;
+          argsProgress.set(part.toolCallId, progress);
+          if (progress.chars >= progress.nextMark) {
+            progress.nextMark *= 2;
+            yield { type: "tool-call-progress", name: progress.name, bytes: progress.chars };
+          }
+          break;
+        }
+        case "finish": {
+          const finite = (n) => Number.isFinite(n) ? n : 0;
+          const cache4 = extractCacheUsage(
+            part.providerMetadata ?? part.experimental_providerMetadata
+          );
+          debugStreamLog("finish", {
+            finishReason: part.finishReason,
+            usage: part.usage,
+            deltas
+          });
+          yield {
+            type: "finish",
+            finishReason: part.finishReason,
+            usage: part.usage ? {
+              promptTokens: finite(part.usage.promptTokens),
+              completionTokens: finite(part.usage.completionTokens),
+              totalTokens: finite(part.usage.totalTokens),
+              ...cache4
+            } : void 0
+          };
+          return;
+        }
+        case "error": {
+          if (opts.abortSignal?.aborted) return;
+          const error = part.error instanceof Error ? part.error : new Error(String(part.error));
+          debugStreamLog("error-part", { seenContent, deltas, error: summarizeStreamError(error) });
+          yield { type: "error", error };
+          break;
+        }
+      }
+    }
+  } finally {
+    opts.abortSignal?.removeEventListener("abort", onAbort);
+    controller.abort();
+  }
+}
+
 // src/permissions/gate.ts
 import fs from "fs";
-import path from "path";
+import path3 from "path";
 
 // src/core/sensitive.ts
 var SENSITIVE_BASENAMES = /* @__PURE__ */ new Set([
@@ -734,6 +1111,239 @@ function isSensitivePath(p) {
   return false;
 }
 
+// src/permissions/shell.ts
+var REDIRECT_OPS = /* @__PURE__ */ new Set([">", ">>", "<", ">&", "<&"]);
+var FILE_REDIRECT_OPS = /* @__PURE__ */ new Set([">", ">>", "<"]);
+var SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([
+  "&&",
+  "||",
+  "&",
+  "|",
+  ";",
+  "\n",
+  "(",
+  ")"
+]);
+function lexShell(command) {
+  const tokens = [];
+  let word = "";
+  let doubleQuoted = false;
+  let i = 0;
+  const flush = () => {
+    if (word.length > 0) {
+      tokens.push({ kind: "word", text: word });
+      word = "";
+    }
+  };
+  const findCloseParen = (from) => {
+    let depth = 0;
+    let j = from;
+    while (j < command.length) {
+      const c = command[j];
+      if (c === "\\") {
+        j += 2;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        const close = command.indexOf(c, j + 1);
+        j = close === -1 ? command.length : close + 1;
+        continue;
+      }
+      if (c === "(") depth += 1;
+      if (c === ")") {
+        depth -= 1;
+        if (depth === 0) return j + 1;
+      }
+      j += 1;
+    }
+    return -1;
+  };
+  const pushSubstitution = (openParen, process2) => {
+    const close = findCloseParen(openParen);
+    const innerEnd = close === -1 ? command.length : close - 1;
+    flush();
+    tokens.push({ kind: "subst", inner: command.slice(openParen + 1, innerEnd), process: process2 });
+    return close === -1 ? command.length : close;
+  };
+  const lexDollarOrBacktick = (pos) => {
+    const c = command[pos];
+    if (c === "`") {
+      const close = command.indexOf("`", pos + 1);
+      const end = close === -1 ? command.length : close;
+      flush();
+      tokens.push({ kind: "subst", inner: command.slice(pos + 1, end), process: false });
+      return close === -1 ? command.length : close + 1;
+    }
+    const next = command[pos + 1];
+    if (next === "(") {
+      return pushSubstitution(pos + 1, false);
+    }
+    if (next === "{") {
+      const close = command.indexOf("}", pos + 2);
+      if (close !== -1) {
+        word += `$${command.slice(pos + 2, close)}`;
+        return close + 1;
+      }
+      word += "$";
+      return pos + 1;
+    }
+    if (next !== void 0 && /[A-Za-z_]/.test(next)) {
+      let end = pos + 1;
+      while (end < command.length && /[A-Za-z0-9_]/.test(command[end] ?? "")) {
+        end += 1;
+      }
+      word += command.slice(pos, end);
+      return end;
+    }
+    word += "$";
+    return pos + 1;
+  };
+  while (i < command.length) {
+    const c = command[i];
+    if (doubleQuoted) {
+      if (c === '"') {
+        doubleQuoted = false;
+        i += 1;
+      } else if (c === "\\") {
+        if (i + 1 < command.length) {
+          word += command[i + 1];
+          i += 2;
+        } else {
+          word += "\\";
+          i += 1;
+        }
+      } else if (c === "$" || c === "`") {
+        i = lexDollarOrBacktick(i);
+      } else {
+        word += c;
+        i += 1;
+      }
+      continue;
+    }
+    if (c === "\\") {
+      if (i + 1 < command.length) {
+        word += command[i + 1];
+        i += 2;
+      } else {
+        word += "\\";
+        i += 1;
+      }
+      continue;
+    }
+    if (c === "'") {
+      const close = command.indexOf("'", i + 1);
+      const end = close === -1 ? command.length : close;
+      word += command.slice(i + 1, end);
+      i = close === -1 ? command.length : close + 1;
+      continue;
+    }
+    if (c === '"') {
+      doubleQuoted = true;
+      i += 1;
+      continue;
+    }
+    if (c === "$" || c === "`") {
+      i = lexDollarOrBacktick(i);
+      continue;
+    }
+    if (c === " " || c === "	" || c === "\r") {
+      flush();
+      i += 1;
+      continue;
+    }
+    if (c === "\n") {
+      flush();
+      tokens.push({ kind: "op", op: "\n" });
+      i += 1;
+      continue;
+    }
+    if (c === "&" || c === "|") {
+      flush();
+      if (command[i + 1] === c) {
+        tokens.push({ kind: "op", op: c === "&" ? "&&" : "||" });
+        i += 2;
+      } else {
+        tokens.push({ kind: "op", op: c });
+        i += 1;
+      }
+      continue;
+    }
+    if (c === ";" || c === "(" || c === ")") {
+      flush();
+      tokens.push({ kind: "op", op: c });
+      i += 1;
+      continue;
+    }
+    if (c === ">" || c === "<") {
+      flush();
+      const next = command[i + 1];
+      if (next === "(") {
+        i = pushSubstitution(i + 1, true);
+        continue;
+      }
+      if (c === ">" && next === ">") {
+        tokens.push({ kind: "op", op: ">>" });
+        i += 2;
+      } else if (next === "&") {
+        tokens.push({ kind: "op", op: c === ">" ? ">&" : "<&" });
+        i += 2;
+      } else {
+        tokens.push({ kind: "op", op: c });
+        i += 1;
+      }
+      continue;
+    }
+    word += c;
+    i += 1;
+  }
+  flush();
+  return tokens;
+}
+function splitShellSegments(tokens) {
+  const segments = [];
+  let current = [];
+  for (const token of tokens) {
+    if (token.kind === "op" && SEGMENT_SEPARATORS.has(token.op)) {
+      if (current.length > 0) {
+        segments.push(current);
+        current = [];
+      }
+      continue;
+    }
+    current.push(token);
+  }
+  if (current.length > 0) {
+    segments.push(current);
+  }
+  return segments;
+}
+function segmentWords(segment) {
+  const words = [];
+  const redirectTargets = [];
+  for (let k = 0; k < segment.length; k += 1) {
+    const token = segment[k];
+    if (token.kind === "op" && REDIRECT_OPS.has(token.op)) {
+      const target = segment[k + 1];
+      if (target?.kind === "word") {
+        redirectTargets.push(target.text);
+        k += 1;
+      }
+      continue;
+    }
+    if (token.kind === "word") {
+      words.push(token.text);
+    }
+  }
+  return { words, redirectTargets };
+}
+function renderSegment(segment) {
+  return segment.map((token) => {
+    if (token.kind === "word") return token.text;
+    if (token.kind === "op") return token.op;
+    return token.process ? ">(\u2026)" : "$(\u2026)";
+  }).join(" ");
+}
+
 // src/permissions/allow.ts
 function parseAllowRule(rule) {
   const match = /^([\w-]+)(?:\((.*)\))?$/.exec(rule.trim());
@@ -759,7 +1369,15 @@ function matchAllowRule(rule, req) {
 }
 function splitCommandChain(command) {
   if (command.includes("$(") || command.includes("`")) return null;
-  return command.split(/&&|\|\||[;|\n]/).map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+  const tokens = lexShell(command);
+  if (tokens.some((token) => token.kind === "subst")) return null;
+  const segments = splitShellSegments(tokens);
+  for (const segment of segments) {
+    if (segment.some((token) => token.kind === "op" && FILE_REDIRECT_OPS.has(token.op))) {
+      return null;
+    }
+  }
+  return segments.map(renderSegment).filter((segment) => segment.length > 0);
 }
 function withCommand(req, command) {
   return {
@@ -796,27 +1414,206 @@ function buildAllowRule(req) {
 }
 
 // src/permissions/gate.ts
-var FILE_TOOLS = /* @__PURE__ */ new Set(["write_file", "edit_file", "read_file", "grep", "glob"]);
-var DANGEROUS_COMMAND_PATTERNS = [
-  /rm\s+-rf\s+\/(?:\s|$|;|&)/i,
-  /rm\s+-rf\s+~(?:\s|\/|$|;|&)/i,
-  /rm\s+-rf\s+\.\/?(?:\s|$|;|&)/i,
-  /rm\s+-rf\s+\*(?:\s|$|;|&)/i,
-  /\bsudo\s+rm\b/i,
-  /\bdel\s+\/s\b/i,
-  /\brd\s+\/s\b/i,
-  /\bformat\s+[a-z]:/i,
-  /\bdiskpart\b/i,
-  /:\(\)\s*\{\s*:\|:&\s*\}\s*;:/,
-  /\bmkfs\b/i,
-  /dd\s+[^|;]*\bif=/i,
-  />\s*\/dev\/sd[a-z]/i,
-  /\bshutdown\b/i,
-  /\breboot\b/i,
-  /\bpoweroff\b/i
-];
+var FILE_TOOLS = /* @__PURE__ */ new Set(["write_file", "edit_file", "read_file", "read_image", "grep", "glob"]);
+var FORK_BOMB = /:\(\)\s*\{\s*:\|:&\s*\}\s*;:/;
+var MAX_ANALYSIS_DEPTH = 8;
+function baseName(word) {
+  const base = word.replace(/\\/g, "/").split("/").pop() ?? word;
+  return base.toLowerCase().replace(/\.exe$/, "");
+}
+function isDangerousDeleteTarget(target) {
+  if (/^\/+$/.test(target)) return true;
+  const norm = target.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (norm === "/*" || norm === "*") return true;
+  if (norm === "~" || norm.startsWith("~/")) return true;
+  if (norm === "." || norm === "./*") return true;
+  if (/^[a-zA-Z]:$/.test(norm)) return true;
+  if (["$HOME", "$USERPROFILE", "$HOMEPATH"].includes(norm)) return true;
+  if (/^%(USERPROFILE|HOMEDRIVE|HOMEPATH)%$/i.test(norm)) return true;
+  return false;
+}
+function rmIsDangerous(args) {
+  let recursive = false;
+  let optionsDone = false;
+  const targets = [];
+  for (const arg of args) {
+    if (!optionsDone && arg === "--") {
+      optionsDone = true;
+      continue;
+    }
+    if (!optionsDone && arg.startsWith("-")) {
+      if (arg === "--recursive") {
+        recursive = true;
+      } else if (!arg.startsWith("--") && /[rR]/.test(arg)) {
+        recursive = true;
+      }
+      continue;
+    }
+    targets.push(arg);
+  }
+  return recursive && targets.some(isDangerousDeleteTarget);
+}
+function findIsDangerous(args) {
+  if (!args.includes("-delete")) return false;
+  const paths = [];
+  for (const arg of args) {
+    if (arg.startsWith("-") || arg === "(" || arg === ")" || arg === "!" || arg === ",") {
+      break;
+    }
+    paths.push(arg);
+  }
+  return paths.length === 0 || paths.some(isDangerousDeleteTarget);
+}
+var XARGS_VALUE_OPTS = /* @__PURE__ */ new Set([
+  "-I",
+  "-n",
+  "-P",
+  "-s",
+  "-L",
+  "-d",
+  "-E",
+  "-a",
+  "--replace",
+  "--max-args",
+  "--max-procs",
+  "--max-lines",
+  "--delimiter",
+  "--eof",
+  "--arg-file",
+  "--interactive",
+  "--exit"
+]);
+function xargsIsDangerous(args) {
+  for (let k = 0; k < args.length; k += 1) {
+    const arg = args[k];
+    if (XARGS_VALUE_OPTS.has(arg)) {
+      k += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      continue;
+    }
+    return baseName(arg) === "rm";
+  }
+  return false;
+}
+function chmodIsDangerous(args) {
+  let recursive = false;
+  let optionsDone = false;
+  const operands = [];
+  for (const arg of args) {
+    if (!optionsDone && arg === "--") {
+      optionsDone = true;
+      continue;
+    }
+    if (!optionsDone && arg.startsWith("-")) {
+      if (arg === "--recursive" || !arg.startsWith("--") && arg.includes("R")) {
+        recursive = true;
+      }
+      continue;
+    }
+    operands.push(arg);
+  }
+  return recursive && operands.slice(1).some(isDangerousDeleteTarget);
+}
+function commandInvocation(words) {
+  let sudo = false;
+  let wrapped = false;
+  let k = 0;
+  for (; ; ) {
+    const word = words[k];
+    if (word === void 0) return null;
+    const lower = word.toLowerCase();
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
+      k += 1;
+      continue;
+    }
+    if (lower === "sudo" || lower === "doas" || lower === "env") {
+      sudo = sudo || lower !== "env";
+      wrapped = true;
+      k += 1;
+      continue;
+    }
+    if (wrapped && word.startsWith("-")) {
+      k += 1;
+      continue;
+    }
+    return { name: baseName(word), rest: words.slice(k + 1), sudo };
+  }
+}
+function commandLineIsDangerous(command, depth) {
+  if (depth > MAX_ANALYSIS_DEPTH) return true;
+  const tokens = lexShell(command);
+  for (const token of tokens) {
+    if (token.kind === "subst" && commandLineIsDangerous(token.inner, depth + 1)) {
+      return true;
+    }
+  }
+  return splitShellSegments(tokens).some((segment) => segmentIsDangerous(segment, depth));
+}
+function segmentIsDangerous(segment, depth) {
+  const { words, redirectTargets } = segmentWords(segment);
+  if (redirectTargets.some((target) => /^\/dev\/sd[a-z]/i.test(target))) {
+    return true;
+  }
+  const invocation = commandInvocation(words);
+  if (!invocation) return false;
+  const { name, rest, sudo } = invocation;
+  if (sudo && name === "rm") return true;
+  switch (name) {
+    case "shutdown":
+    case "reboot":
+    case "poweroff":
+    case "halt":
+    case "diskpart":
+    case "wipefs":
+    case "shred":
+      return true;
+    case "rm":
+      return rmIsDangerous(rest);
+    case "rmdir":
+    case "rd":
+    case "del":
+    case "erase":
+      return rest.some((arg) => /^\/s$/i.test(arg));
+    case "format":
+      return rest.some((arg) => /^[a-z]:$/i.test(arg));
+    case "dd":
+      return rest.some((arg) => arg.startsWith("if="));
+    case "find":
+      return findIsDangerous(rest);
+    case "xargs":
+      return xargsIsDangerous(rest);
+    case "chmod":
+      return chmodIsDangerous(rest);
+    case "systemctl":
+      return rest.some((arg) => ["poweroff", "halt", "reboot"].includes(arg.toLowerCase()));
+    case "init":
+      return rest.some((arg) => arg === "0" || arg === "6");
+    case "sh":
+    case "bash":
+    case "zsh":
+    case "dash":
+    case "ash": {
+      const idx = rest.indexOf("-c");
+      const script = idx >= 0 ? rest[idx + 1] : void 0;
+      return script !== void 0 && commandLineIsDangerous(script, depth + 1);
+    }
+    case "eval":
+      return rest.length > 0 && commandLineIsDangerous(rest.join(" "), depth + 1);
+    case "cmd": {
+      const idx = rest.findIndex((arg) => /^\/c$/i.test(arg));
+      if (idx < 0) return false;
+      const script = rest.slice(idx + 1).join(" ");
+      return script.length > 0 && commandLineIsDangerous(script, depth + 1);
+    }
+    default:
+      return name.startsWith("mkfs") && (name.length === 4 || /[.-]/.test(name.charAt(4)));
+  }
+}
 function isDangerousCommand(command) {
-  return DANGEROUS_COMMAND_PATTERNS.some((pattern) => pattern.test(command));
+  if (FORK_BOMB.test(command)) return true;
+  return commandLineIsDangerous(command, 0);
 }
 function getStringArg(args, key) {
   if (typeof args === "object" && args !== null) {
@@ -828,7 +1625,7 @@ function getStringArg(args, key) {
   return void 0;
 }
 function normalizeAbsolute(p, cwd) {
-  const abs = path.isAbsolute(p) ? path.normalize(p) : path.resolve(cwd, p);
+  const abs = path3.isAbsolute(p) ? path3.normalize(p) : path3.resolve(cwd, p);
   return abs.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
 function isOutsideCwd(p, cwd) {
@@ -837,20 +1634,20 @@ function isOutsideCwd(p, cwd) {
   return abs !== base && !abs.startsWith(`${base}/`);
 }
 function resolveRealPath(p, cwd) {
-  let current = path.isAbsolute(p) ? path.normalize(p) : path.resolve(cwd, p);
+  let current = path3.isAbsolute(p) ? path3.normalize(p) : path3.resolve(cwd, p);
   const missing = [];
   for (; ; ) {
     try {
-      return path.join(fs.realpathSync(current), ...missing.reverse());
+      return path3.join(fs.realpathSync(current), ...missing.reverse());
     } catch {
-      const parent = path.dirname(current);
+      const parent = path3.dirname(current);
       if (parent === current) return null;
-      missing.push(path.basename(current));
+      missing.push(path3.basename(current));
       current = parent;
     }
   }
 }
-function isOutsideForWrite(p, cwd) {
+function isOutsideResolved(p, cwd) {
   const resolved = resolveRealPath(p, cwd);
   if (resolved === null) return isOutsideCwd(p, cwd);
   let realCwd;
@@ -875,8 +1672,7 @@ function checkPermission(mode, req, ctx, allowRules = [], denyRules = []) {
     if (isWriteTool && isSensitivePath(filePath)) {
       return "deny";
     }
-    const outside = isWriteTool ? isOutsideForWrite(filePath, ctx.cwd) : isOutsideCwd(filePath, ctx.cwd);
-    if (outside) {
+    if (isOutsideResolved(filePath, ctx.cwd)) {
       if (mode === "ask" && req.level === "read") {
         return "ask";
       }
@@ -950,17 +1746,40 @@ function scheduleSessionTitle(store, userText, model) {
 // src/snapshot/git-tree.ts
 import { execFile } from "child_process";
 import { existsSync } from "fs";
-import { mkdir } from "fs/promises";
-import os from "os";
-import path2 from "path";
+import { mkdir, readdir, rm, writeFile } from "fs/promises";
+import os2 from "os";
+import path4 from "path";
 var GIT_TIMEOUT_MS2 = 1e4;
+var GC_TIMEOUT_MS = 6e4;
 var GIT_MAX_BUFFER2 = 8 * 1024 * 1024;
-function runGit2(args) {
+var GC_INTERVAL = 50;
+var TRACK_FAILURE_TTL_MS = 5 * 60 * 1e3;
+var SENSITIVE_EXCLUDE_PATTERNS = [
+  ".env",
+  ".env.*",
+  "!.env.example",
+  "!.env.sample",
+  "!.env.template",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  ".npmrc",
+  ".netrc",
+  ".pgpass",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "**/.aws/credentials",
+  "**/.kube/config"
+];
+function runGit2(args, timeoutMs = GIT_TIMEOUT_MS2) {
   return new Promise((resolve) => {
     execFile(
       "git",
       args,
-      { timeout: GIT_TIMEOUT_MS2, maxBuffer: GIT_MAX_BUFFER2, encoding: "utf8" },
+      { timeout: timeoutMs, maxBuffer: GIT_MAX_BUFFER2, encoding: "utf8" },
       (error, stdout) => {
         resolve(error ? null : stdout.trim());
       }
@@ -968,6 +1787,9 @@ function runGit2(args) {
   });
 }
 var gitAvailable = null;
+var trackFailureUntil = /* @__PURE__ */ new Map();
+var trackCounts = /* @__PURE__ */ new Map();
+var scrubbedRepos = /* @__PURE__ */ new Set();
 async function isGitAvailable() {
   if (gitAvailable === null) {
     gitAvailable = await runGit2(["--version"]) !== null;
@@ -975,41 +1797,119 @@ async function isGitAvailable() {
   return gitAvailable;
 }
 function treeRepoDir(cwd) {
-  const key = Buffer.from(path2.resolve(cwd), "utf8").toString("base64url");
-  return path2.join(gitTreesDir(), key);
+  const key = Buffer.from(path4.resolve(cwd), "utf8").toString("base64url");
+  return path4.join(gitTreesDir(), key);
+}
+async function removeTreeRepo(cwd) {
+  const dir = treeRepoDir(cwd);
+  trackFailureUntil.delete(path4.resolve(cwd));
+  trackCounts.delete(dir);
+  scrubbedRepos.delete(dir);
+  await rm(dir, { recursive: true, force: true }).catch(() => {
+  });
+}
+async function pruneTreeReposExcept(remainingCwds) {
+  let entries;
+  try {
+    entries = await readdir(gitTreesDir());
+  } catch {
+    return;
+  }
+  const keep = /* @__PURE__ */ new Set();
+  for (const cwd of remainingCwds) keep.add(path4.basename(treeRepoDir(cwd)));
+  await Promise.all(
+    entries.filter((entry) => !keep.has(entry)).map(
+      (entry) => rm(path4.join(gitTreesDir(), entry), { recursive: true, force: true }).catch(() => {
+      })
+    )
+  );
 }
 function isGuardedDir(cwd) {
-  const resolved = path2.resolve(cwd);
-  const home = path2.resolve(os.homedir());
+  const resolved = path4.resolve(cwd);
+  const home = path4.resolve(os2.homedir());
   const same = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
-  return same(resolved, home) || same(resolved, path2.parse(resolved).root);
+  return same(resolved, home) || same(resolved, path4.parse(resolved).root);
 }
 async function ensureTreeRepo(cwd) {
   const dir = treeRepoDir(cwd);
-  if (existsSync(path2.join(dir, "HEAD"))) return dir;
-  await mkdir(path2.dirname(dir), { recursive: true });
-  const out = await runGit2(["init", "--bare", dir]);
-  return out === null ? null : dir;
+  try {
+    await mkdir(dir, { recursive: true, mode: 448 });
+    if (!existsSync(path4.join(dir, "HEAD"))) {
+      const out = await runGit2(["init", "--bare", dir]);
+      if (out === null) return null;
+    }
+    await mkdir(path4.join(dir, "info"), { recursive: true });
+    await writeFile(
+      path4.join(dir, "info", "exclude"),
+      `${SENSITIVE_EXCLUDE_PATTERNS.join("\n")}
+`,
+      "utf8"
+    );
+  } catch {
+    return null;
+  }
+  return dir;
 }
 function repoArgs(dir, cwd) {
   return [`--git-dir=${dir}`, `--work-tree=${cwd}`];
 }
+async function untrackExcluded(dir, cwd) {
+  const base = repoArgs(dir, cwd);
+  const listed = await runGit2([...base, "ls-files", "-z", "-c", "-i", "--exclude-standard"]);
+  if (listed === null) return false;
+  const files = listed.split("\0").filter(Boolean);
+  if (files.length === 0) return true;
+  const removed = await runGit2([
+    ...base,
+    "rm",
+    "--cached",
+    "--ignore-unmatch",
+    "-q",
+    "--",
+    ...files.map((file) => `:(literal)${file}`)
+  ]);
+  return removed !== null;
+}
 async function trackTree(cwd) {
   if (isGuardedDir(cwd)) return null;
+  const key = path4.resolve(cwd);
+  const failedUntil = trackFailureUntil.get(key);
+  if (failedUntil !== void 0 && Date.now() < failedUntil) return null;
+  const tree = await trackTreeUncached(cwd);
+  if (tree === null) {
+    trackFailureUntil.set(key, Date.now() + TRACK_FAILURE_TTL_MS);
+    return null;
+  }
+  trackFailureUntil.delete(key);
+  return tree;
+}
+async function trackTreeUncached(cwd) {
   if (!await isGitAvailable()) return null;
   const dir = await ensureTreeRepo(cwd);
   if (!dir) return null;
   const base = repoArgs(dir, cwd);
+  if (!scrubbedRepos.has(dir)) {
+    if (!await untrackExcluded(dir, cwd)) return null;
+    scrubbedRepos.add(dir);
+  }
   if (await runGit2([...base, "add", "-A"]) === null) return null;
-  return runGit2([...base, "write-tree"]);
+  const tree = await runGit2([...base, "write-tree"]);
+  if (tree === null) return null;
+  const count = (trackCounts.get(dir) ?? 0) + 1;
+  trackCounts.set(dir, count);
+  if (count % GC_INTERVAL === 0) {
+    await runGit2([`--git-dir=${dir}`, "gc", "--auto"], GC_TIMEOUT_MS);
+  }
+  return tree;
 }
 async function restoreTree(cwd, hash) {
   if (isGuardedDir(cwd)) return false;
   if (!await isGitAvailable()) return false;
-  const dir = treeRepoDir(cwd);
-  if (!existsSync(path2.join(dir, "HEAD"))) return false;
+  const dir = await ensureTreeRepo(cwd);
+  if (!dir) return false;
   const base = repoArgs(dir, cwd);
   if (await runGit2([...base, "read-tree", hash]) === null) return false;
+  if (!await untrackExcluded(dir, cwd)) return false;
   if (await runGit2([...base, "checkout-index", "-f", "-a"]) === null) return false;
   if (await runGit2([...base, "clean", "-fd"]) === null) return false;
   return true;
@@ -1017,21 +1917,23 @@ async function restoreTree(cwd, hash) {
 async function diffTreeNames(cwd, hash) {
   if (!await isGitAvailable()) return null;
   const dir = treeRepoDir(cwd);
-  if (!existsSync(path2.join(dir, "HEAD"))) return null;
+  if (!existsSync(path4.join(dir, "HEAD"))) return null;
   const base = repoArgs(dir, cwd);
   const changed = await runGit2([...base, "diff", "--name-only", hash]);
   const untracked = await runGit2([...base, "ls-files", "--others", "--exclude-standard"]);
   if (changed === null || untracked === null) return null;
   const names = /* @__PURE__ */ new Set();
   for (const line of [...changed.split("\n"), ...untracked.split("\n")]) {
-    if (line !== "") names.add(line);
+    if (line !== "" && !isSensitivePath(line)) names.add(line);
   }
   return [...names];
 }
 
 // src/tools/fs/snapshots.ts
-import { mkdir as mkdir2, readFile, rm, stat, writeFile } from "fs/promises";
-import path3 from "path";
+import { randomUUID } from "crypto";
+import { mkdir as mkdir2, readFile, rm as rm2, stat, writeFile as writeFile2 } from "fs/promises";
+import os3 from "os";
+import path5 from "path";
 var MAX_SNAPSHOTS = 50;
 var MAX_SNAPSHOT_CONTENT_BYTES = 5 * 1024 * 1024;
 var stack = [];
@@ -1039,6 +1941,30 @@ var activeTurn = 0;
 var activeTurnMessageIndex = -1;
 var checkpointSeq = 0;
 var hooks = null;
+var spillDir = path5.join(
+  os3.tmpdir(),
+  `star-cli-snapshots-${process.pid}-${randomUUID().slice(0, 8)}`
+);
+function isSpillPath(p) {
+  return p.startsWith(spillDir + path5.sep);
+}
+async function spillContent(snapshot) {
+  if (snapshot.content === null || snapshot.contentFile) return;
+  try {
+    const file = path5.join(spillDir, `${snapshot.id}.snap`);
+    await mkdir2(spillDir, { recursive: true, mode: 448 });
+    await writeFile2(file, snapshot.content, { encoding: "utf8", mode: 384 });
+    snapshot.contentFile = file;
+    snapshot.content = null;
+  } catch {
+  }
+}
+async function discardSpill(snapshot) {
+  if (snapshot.contentFile && isSpillPath(snapshot.contentFile)) {
+    await rm2(snapshot.contentFile, { force: true }).catch(() => {
+    });
+  }
+}
 function setSnapshotHooks(next) {
   hooks = next;
 }
@@ -1097,8 +2023,10 @@ async function pushSnapshot(snapshot) {
       console.error("[star] failed to persist snapshot checkpoint:", err);
     }
   }
+  await spillContent(snapshot);
   if (stack.length > MAX_SNAPSHOTS) {
     const evicted = stack.splice(0, stack.length - MAX_SNAPSHOTS);
+    for (const old of evicted) await discardSpill(old);
     await removeFromStore(evicted.map((s) => s.id));
   }
 }
@@ -1109,9 +2037,11 @@ function listSnapshots() {
   return [...stack];
 }
 function clearSnapshots() {
+  for (const snapshot of stack) void discardSpill(snapshot);
   stack.length = 0;
 }
 function hydrateSnapshots(snapshots) {
+  for (const snapshot of stack) void discardSpill(snapshot);
   stack.length = 0;
   stack.push(...snapshots.slice(-MAX_SNAPSHOTS));
   for (const snapshot of stack) {
@@ -1136,11 +2066,11 @@ async function revert(snapshot) {
     if (content === null) {
       return `Skipped ${snapshot.path}: the snapshot content is no longer available.`;
     }
-    await mkdir2(path3.dirname(snapshot.path), { recursive: true });
-    await writeFile(snapshot.path, content, "utf8");
+    await mkdir2(path5.dirname(snapshot.path), { recursive: true });
+    await writeFile2(snapshot.path, content, "utf8");
     return `Restored ${snapshot.path} to its state before ${snapshot.toolName}.`;
   }
-  await rm(snapshot.path, { force: true });
+  await rm2(snapshot.path, { force: true });
   return `Deleted ${snapshot.path} (it did not exist before ${snapshot.toolName}).`;
 }
 function listTurnSnapshots(turn, includeSubagent = false) {
@@ -1167,6 +2097,7 @@ async function undoTurnSnapshots(turn, includeSubagent = false) {
       const idx = stack.indexOf(snapshot);
       if (idx >= 0) stack.splice(idx, 1);
       revertedIds.push(snapshot.id);
+      await discardSpill(snapshot);
     } catch (err) {
       messages.push(
         `Failed to revert ${snapshot.path}: ${err.message} (checkpoint kept)`
@@ -1178,13 +2109,16 @@ async function undoTurnSnapshots(turn, includeSubagent = false) {
 }
 async function dropTurnSnapshots(turn, includeSubagent = false) {
   const dropped = [];
+  const droppedSnapshots = [];
   for (let i = stack.length - 1; i >= 0; i--) {
     const snapshot = stack[i];
     if (snapshot && snapshot.turn === turn && (includeSubagent || ownerOf(snapshot) === "root")) {
       dropped.push(snapshot.id);
+      droppedSnapshots.push(snapshot);
       stack.splice(i, 1);
     }
   }
+  for (const snapshot of droppedSnapshots) await discardSpill(snapshot);
   await removeFromStore(dropped);
   return dropped.length;
 }
@@ -1206,6 +2140,7 @@ async function rewindToSnapshot(id, includeSubagent = false) {
       const idx = stack.indexOf(snapshot);
       if (idx >= 0) stack.splice(idx, 1);
       revertedIds.push(snapshot.id);
+      await discardSpill(snapshot);
       if (snapshot.messageIndex >= 0) {
         messageIndex = messageIndex === null ? snapshot.messageIndex : Math.min(messageIndex, snapshot.messageIndex);
       }
@@ -1222,7 +2157,7 @@ async function rewindToSnapshot(id, includeSubagent = false) {
 // src/tools/bash.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync2 } from "fs";
-import path4 from "path";
+import path6 from "path";
 import { z as z2 } from "zod";
 
 // src/tasks/manager.ts
@@ -1241,6 +2176,9 @@ var TaskManager = class extends EventEmitter {
     const child = spawn2(spec.shell, spec.wrap(opts.command), {
       cwd: opts.cwd,
       windowsHide: true,
+      // No stdin: background commands that read it would hang until the
+      // (much longer) task timeout; give them EOF immediately.
+      stdio: ["ignore", "pipe", "pipe"],
       // POSIX: the child leads its own process group so killTree can SIGKILL
       // the whole tree with a negative pid (Windows uses taskkill /t).
       detached: process.platform !== "win32"
@@ -1356,11 +2294,11 @@ var HALF_OUTPUT = MAX_OUTPUT / 2;
 var DEFAULT_TIMEOUT = 120;
 var MAX_TIMEOUT = 600;
 function findOnPath(exe, exclude) {
-  for (const dir of (process.env.PATH ?? "").split(path4.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path6.delimiter)) {
     if (!dir || exclude?.(dir)) {
       continue;
     }
-    const full = path4.join(dir, exe);
+    const full = path6.join(dir, exe);
     if (existsSync2(full)) {
       return full;
     }
@@ -1378,16 +2316,22 @@ function resolveShellUncached() {
   }
   const gitExe = findOnPath("git.exe");
   if (gitExe) {
-    const sibling = path4.join(path4.dirname(path4.dirname(gitExe)), "bin", "bash.exe");
+    const sibling = path6.join(path6.dirname(path6.dirname(gitExe)), "bin", "bash.exe");
     if (existsSync2(sibling)) {
       return { shell: sibling, wrap: (c) => ["-c", c], label: "bash" };
     }
   }
-  for (const candidate of [
-    "C:\\Program Files\\Git\\bin\\bash.exe",
-    "C:\\Program Files (x86)\\Git\\bin\\bash.exe",
-    "D:\\Git\\bin\\bash.exe"
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of [
+    process.env.ProgramFiles,
+    process.env["ProgramFiles(x86)"],
+    process.env.ProgramW6432
   ]) {
+    if (!root) continue;
+    const candidate = path6.join(root, "Git", "bin", "bash.exe");
+    const key = candidate.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
     if (existsSync2(candidate)) {
       return { shell: candidate, wrap: (c) => ["-c", c], label: "bash" };
     }
@@ -1489,7 +2433,10 @@ description: ${args.description ?? "(none)"}`
       const child = spawn3(spec.shell, spec.wrap(args.command), {
         cwd: ctx.cwd,
         windowsHide: true,
-        detached: process.platform !== "win32"
+        detached: process.platform !== "win32",
+        // No stdin: a command that reads it (cat, read, input()) must get
+        // EOF immediately instead of hanging until the timeout.
+        stdio: ["ignore", "pipe", "pipe"]
       });
       const output = new BoundedOutput();
       let settled = false;
@@ -1538,9 +2485,10 @@ Command timed out after ${timeoutSeconds}s`,
 };
 
 // src/tools/fs/edit.ts
-import { readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
-import path5 from "path";
+import { readFile as readFile2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import path7 from "path";
 import { z as z3 } from "zod";
+var BINARY_PROBE_BYTES = 8192;
 var schema2 = z3.object({
   path: z3.string().describe("File path, absolute or relative to the working directory"),
   old_string: z3.string().min(1).describe("Exact text to replace"),
@@ -1549,16 +2497,27 @@ var schema2 = z3.object({
 });
 var editFileTool = {
   name: "edit_file",
-  description: "Replace an exact string in a file. Fails if old_string is not found or matches multiple locations unless replace_all is set.",
+  description: "Replace an exact string in a file. Fails if old_string is not found or matches multiple locations unless replace_all is set. Refuses binary files and files over 5MB.",
   permission: "write",
   parameters: schema2,
   async execute(args, ctx) {
-    const filePath = path5.resolve(ctx.cwd, args.path);
+    const filePath = path7.resolve(ctx.cwd, args.path);
     let content;
     let readMtimeMs;
     try {
-      content = await readFile2(filePath, "utf8");
-      readMtimeMs = (await stat2(filePath)).mtimeMs;
+      const st = await stat2(filePath);
+      if (st.size > MAX_SNAPSHOT_CONTENT_BYTES) {
+        return {
+          content: `Refused to edit ${args.path}: file is ${st.size} bytes, over the 5MB limit (edits past it could not be restored by /undo)`,
+          isError: true
+        };
+      }
+      readMtimeMs = st.mtimeMs;
+      const buf = await readFile2(filePath);
+      if (buf.subarray(0, BINARY_PROBE_BYTES).includes(0)) {
+        return { content: `Refused to edit binary file: ${args.path}`, isError: true };
+      }
+      content = buf.toString("utf8");
     } catch (err) {
       return { content: `Failed to read ${args.path}: ${err.message}`, isError: true };
     }
@@ -1586,7 +2545,7 @@ var editFileTool = {
           isError: true
         };
       }
-      await writeFile2(filePath, updated, "utf8");
+      await writeFile3(filePath, updated, "utf8");
     } catch (err) {
       return { content: `Failed to write ${args.path}: ${err.message}`, isError: true };
     }
@@ -1608,23 +2567,23 @@ var editFileTool = {
 };
 
 // src/tools/fs/glob.ts
-import path7 from "path";
+import path9 from "path";
 import { z as z4 } from "zod";
 
 // src/tools/fs/util.ts
 import { readFileSync, statSync } from "fs";
-import { readdir, stat as stat3 } from "fs/promises";
-import path6 from "path";
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import path8 from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist"]);
 async function walkFiles(root, skipDirs = SKIP_DIRS, options = {}) {
   const out = [];
   async function walk(dir, relBase) {
-    const entries = await readdir(dir, { withFileTypes: true }).catch(() => null);
+    const entries = await readdir2(dir, { withFileTypes: true }).catch(() => null);
     if (!entries) {
       return;
     }
     for (const entry of entries) {
-      const abs = path6.join(dir, entry.name);
+      const abs = path8.join(dir, entry.name);
       const rel = relBase ? `${relBase}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (skipDirs.has(entry.name) || options.ignore?.(abs, true)) {
@@ -1783,7 +2742,7 @@ function parseIgnorePatterns(body) {
   return out;
 }
 function loadIgnorePatterns(dir) {
-  const file = path6.join(dir, IGNORE_FILE);
+  const file = path8.join(dir, IGNORE_FILE);
   let mtimeMs;
   try {
     mtimeMs = statSync(file).mtimeMs;
@@ -1808,9 +2767,9 @@ function createIgnorePredicate(cwd) {
   if (patterns.length === 0) {
     return void 0;
   }
-  const root = path6.resolve(cwd);
+  const root = path8.resolve(cwd);
   return (absPath, isDir) => {
-    const rel = path6.relative(root, absPath).split(path6.sep).join("/");
+    const rel = path8.relative(root, absPath).split(path8.sep).join("/");
     if (!rel || rel.startsWith("..")) {
       return false;
     }
@@ -1846,15 +2805,24 @@ var schema3 = z4.object({
   ),
   path: z4.string().optional().describe("Directory to search, defaults to the working directory")
 });
+function hasParentSegment(pattern) {
+  return pattern.replace(/\\/g, "/").split("/").some((segment) => segment === "..");
+}
 var globTool = {
   name: "glob",
   description: "Find files by glob pattern. Skips node_modules, .git and dist. Returns paths sorted by modification time, newest first, up to 100 results.",
   permission: "read",
   parameters: schema3,
   async execute(args, ctx) {
-    const root = path7.resolve(ctx.cwd, args.path ?? ".");
+    if (hasParentSegment(args.pattern)) {
+      return {
+        content: `Refused glob pattern with '..' segment: ${args.pattern}`,
+        isError: true
+      };
+    }
+    const root = path9.resolve(ctx.cwd, args.path ?? ".");
     const prefixSegments = literalDirPrefix(args.pattern);
-    const walkRoot = prefixSegments.length > 0 ? path7.join(root, ...prefixSegments) : root;
+    const walkRoot = prefixSegments.length > 0 ? path9.join(root, ...prefixSegments) : root;
     const prefix = prefixSegments.length > 0 ? `${prefixSegments.join("/")}/` : "";
     const files = await walkFiles(walkRoot, void 0, { ignore: createIgnorePredicate(ctx.cwd) });
     const matched = files.filter((f) => matchesGlob(args.pattern, `${prefix}${f.rel}`)).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, MAX_RESULTS);
@@ -1866,8 +2834,8 @@ var globTool = {
 };
 
 // src/tools/fs/grep.ts
-import { readFile as readFile3, stat as stat4 } from "fs/promises";
-import path8 from "path";
+import { readFile as readFile3, realpath, stat as stat4 } from "fs/promises";
+import path10 from "path";
 import { z as z5 } from "zod";
 var MAX_MATCHES = 250;
 var MAX_LINE_CHARS = 500;
@@ -1900,18 +2868,19 @@ var grepTool = {
     } catch (err) {
       return { content: `Invalid regular expression: ${err.message}`, isError: true };
     }
-    const root = path8.resolve(ctx.cwd, args.path ?? ".");
+    const root = path10.resolve(ctx.cwd, args.path ?? ".");
     let files;
     try {
       const st = await stat4(root);
       if (st.isFile()) {
-        if (isSensitivePath(root)) {
+        const resolved = await realpath(root).catch(() => null);
+        if (isSensitivePath(root) || resolved !== null && isSensitivePath(resolved)) {
           return {
             content: `Refused to grep sensitive file: ${args.path ?? "."}`,
             isError: true
           };
         }
-        files = [{ abs: root, rel: path8.basename(root), mtimeMs: st.mtimeMs }];
+        files = [{ abs: root, rel: path10.basename(root), mtimeMs: st.mtimeMs }];
       } else {
         const walked = await walkFiles(root, void 0, {
           ignore: createIgnorePredicate(ctx.cwd),
@@ -1977,13 +2946,13 @@ var grepTool = {
 };
 
 // src/tools/fs/read.ts
-import { open, stat as stat5 } from "fs/promises";
-import path9 from "path";
+import { open, realpath as realpath2, stat as stat5 } from "fs/promises";
+import path11 from "path";
 import { z as z6 } from "zod";
 var DEFAULT_LIMIT = 2e3;
 var MAX_CHARS = 100 * 1024;
 var MAX_READ_BYTES = 1024 * 1024;
-var BINARY_PROBE_BYTES = 8192;
+var BINARY_PROBE_BYTES2 = 8192;
 function decodeUtf16be(buf) {
   const len = buf.length - buf.length % 2;
   const swapped = Buffer.allocUnsafe(len);
@@ -2000,7 +2969,7 @@ function decodeTextBuffer(buf) {
   if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) {
     return { text: decodeUtf16be(buf.subarray(2)) };
   }
-  if (buf.subarray(0, BINARY_PROBE_BYTES).includes(0)) {
+  if (buf.subarray(0, BINARY_PROBE_BYTES2).includes(0)) {
     return { binary: true };
   }
   return { text: buf.toString("utf8") };
@@ -2016,8 +2985,9 @@ var readFileTool = {
   permission: "read",
   parameters: schema5,
   async execute(args, ctx) {
-    const filePath = path9.resolve(ctx.cwd, args.path);
-    if (isSensitivePath(filePath)) {
+    const filePath = path11.resolve(ctx.cwd, args.path);
+    const resolvedPath = await realpath2(filePath).catch(() => null);
+    if (isSensitivePath(filePath) || resolvedPath !== null && isSensitivePath(resolvedPath)) {
       return { content: `Refused to read sensitive file: ${args.path}`, isError: true };
     }
     const st = await stat5(filePath).catch(() => null);
@@ -2078,25 +3048,224 @@ var readFileTool = {
   }
 };
 
-// src/tools/fs/write.ts
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import path10 from "path";
+// src/tools/fs/read-image.ts
+import { readFile as readFile5, realpath as realpath3, stat as stat6 } from "fs/promises";
+import path13 from "path";
 import { z as z7 } from "zod";
+
+// src/core/image-resize.ts
+import { execFile as execFile2 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { readFile as readFile4, unlink, writeFile as writeFile4 } from "fs/promises";
+import os4 from "os";
+import path12 from "path";
+import { promisify } from "util";
+var RESIZE_TIMEOUT_MS = 1e4;
+var execFileAsync = promisify(execFile2);
+function windowsResizeScript(inputFile, outputFile, maxDimension) {
+  const input = inputFile.replace(/'/g, "''");
+  const output = outputFile.replace(/'/g, "''");
+  return [
+    "Add-Type -AssemblyName System.Drawing",
+    `$img = [System.Drawing.Image]::FromFile('${input}')`,
+    `$scale = [Math]::Min(1.0, ${maxDimension} / [Math]::Max($img.Width, $img.Height))`,
+    "$w = [int][Math]::Max(1, [Math]::Round($img.Width * $scale))",
+    "$h = [int][Math]::Max(1, [Math]::Round($img.Height * $scale))",
+    "$bmp = New-Object System.Drawing.Bitmap($w, $h)",
+    "$g = [System.Drawing.Graphics]::FromImage($bmp)",
+    "$g.InterpolationMode = [System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic",
+    "$g.DrawImage($img, 0, 0, $w, $h)",
+    `$bmp.Save('${output}', [System.Drawing.Imaging.ImageFormat]::Png)`,
+    "$g.Dispose(); $bmp.Dispose(); $img.Dispose()"
+  ].join("; ");
+}
+function resizeImagePlan(platform, inputFile, outputFile, maxDimension, tools = {}) {
+  if (platform === "win32") {
+    return {
+      command: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        windowsResizeScript(inputFile, outputFile, maxDimension)
+      ]
+    };
+  }
+  if (platform === "darwin") {
+    return {
+      command: "sips",
+      args: ["-Z", String(maxDimension), inputFile, "--out", outputFile]
+    };
+  }
+  if (platform === "linux") {
+    if (tools.hasConvert) {
+      return {
+        command: "convert",
+        // -auto-orient keeps EXIF-rotated photos upright after the resize
+        // strips their orientation metadata.
+        args: [
+          inputFile,
+          "-auto-orient",
+          "-resize",
+          `${maxDimension}x${maxDimension}>`,
+          outputFile
+        ]
+      };
+    }
+    if (tools.hasFfmpeg) {
+      return {
+        command: "ffmpeg",
+        args: [
+          "-y",
+          "-i",
+          inputFile,
+          "-vf",
+          `scale='if(gt(iw,ih),min(iw,${maxDimension}),-1)':'if(gt(iw,ih),-1,min(ih,${maxDimension}))'`,
+          outputFile
+        ]
+      };
+    }
+    return null;
+  }
+  return null;
+}
+async function commandExists(command) {
+  const checker = process.platform === "win32" ? "where" : "which";
+  try {
+    await execFileAsync(checker, [command], { timeout: RESIZE_TIMEOUT_MS });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downsampleImageIfNeeded(image) {
+  const buf = Buffer.from(image.data, "base64");
+  const dims = probeImageDimensions(buf);
+  if (!dims || Math.max(dims.width, dims.height) <= MAX_IMAGE_DIMENSION) {
+    return { image, oversized: false, resized: false };
+  }
+  const inputFile = path12.join(os4.tmpdir(), `star-image-${randomUUID2()}.src`);
+  const outputFile = path12.join(os4.tmpdir(), `star-image-${randomUUID2()}.png`);
+  try {
+    const [hasConvert, hasFfmpeg] = process.platform === "linux" ? await Promise.all([commandExists("convert"), commandExists("ffmpeg")]) : [false, false];
+    const plan = resizeImagePlan(process.platform, inputFile, outputFile, MAX_IMAGE_DIMENSION, {
+      hasConvert,
+      hasFfmpeg
+    });
+    if (!plan) return { image, oversized: true, resized: false };
+    await writeFile4(inputFile, buf);
+    await execFileAsync(plan.command, plan.args, { timeout: RESIZE_TIMEOUT_MS });
+    const out = await readFile4(outputFile).catch(() => null);
+    if (!out || out.length === 0) return { image, oversized: true, resized: false };
+    return {
+      image: { path: image.path, mimeType: "image/png", data: out.toString("base64") },
+      oversized: true,
+      resized: true
+    };
+  } catch {
+    return { image, oversized: true, resized: false };
+  } finally {
+    await unlink(inputFile).catch(() => {
+    });
+    await unlink(outputFile).catch(() => {
+    });
+  }
+}
+
+// src/tools/fs/read-image.ts
+var MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+var IMAGE_MIME_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp"
+};
 var schema6 = z7.object({
-  path: z7.string().describe("File path, absolute or relative to the working directory"),
-  content: z7.string().describe("Full content to write to the file")
+  path: z7.string().describe(
+    "Image file path (png/jpg/jpeg/gif/webp), absolute or relative to the working directory"
+  )
+});
+var readImageTool = {
+  name: "read_image",
+  description: "Read an image file (png, jpg, gif, webp) and show it to the model. Use this whenever the user references a screenshot, diagram, or picture file you need to see. Images larger than 2000px are downsampled automatically.",
+  permission: "read",
+  parameters: schema6,
+  async execute(args, ctx) {
+    const filePath = path13.resolve(ctx.cwd, args.path);
+    const resolvedPath = await realpath3(filePath).catch(() => null);
+    if (isSensitivePath(filePath) || resolvedPath !== null && isSensitivePath(resolvedPath)) {
+      return { content: `Refused to read sensitive file: ${args.path}`, isError: true };
+    }
+    const mimeType = IMAGE_MIME_TYPES[path13.extname(filePath).toLowerCase()];
+    if (!mimeType) {
+      return {
+        content: `Not a supported image (png/jpg/jpeg/gif/webp): ${args.path}`,
+        isError: true
+      };
+    }
+    const st = await stat6(filePath).catch(() => null);
+    if (!st || !st.isFile()) {
+      return { content: `File not found: ${args.path}`, isError: true };
+    }
+    if (st.size > MAX_IMAGE_BYTES) {
+      return {
+        content: `Image too large (${Math.round(st.size / 1024)}KB > ${MAX_IMAGE_BYTES / 1024}KB): ${args.path}`,
+        isError: true
+      };
+    }
+    const buf = await readFile5(filePath).catch(() => null);
+    if (!buf || buf.length === 0) {
+      return { content: `Failed to read ${args.path}`, isError: true };
+    }
+    if (!probeImageDimensions(buf)) {
+      return {
+        content: `File is not a valid image (unrecognized header): ${args.path}`,
+        isError: true
+      };
+    }
+    const downsampled = await downsampleImageIfNeeded({
+      path: args.path,
+      mimeType,
+      data: buf.toString("base64")
+    });
+    if (downsampled.oversized && !downsampled.resized) {
+      return {
+        content: `Image exceeds 2000px and could not be downsampled on this platform: ${args.path}`,
+        isError: true
+      };
+    }
+    const image = downsampled.image;
+    const dims = probeImageDimensions(Buffer.from(image.data, "base64"));
+    const sizeKB = Math.round(image.data.length / 1024);
+    const desc = dims ? `${dims.width}x${dims.height}` : "unknown dimensions";
+    const resizedNote = downsampled.resized ? " (downsampled to fit 2000px)" : "";
+    return {
+      content: `Image loaded: ${args.path} (${desc}, ~${sizeKB}KB)${resizedNote}. The image is attached below \u2014 look at it now.`,
+      images: [image]
+    };
+  }
+};
+
+// src/tools/fs/write.ts
+import { mkdir as mkdir3, writeFile as writeFile5 } from "fs/promises";
+import path14 from "path";
+import { z as z8 } from "zod";
+var schema7 = z8.object({
+  path: z8.string().describe("File path, absolute or relative to the working directory"),
+  content: z8.string().describe("Full content to write to the file")
 });
 var writeFileTool = {
   name: "write_file",
   description: "Write content to a file, creating parent directories as needed. Overwrites existing files.",
   permission: "write",
-  parameters: schema6,
+  parameters: schema7,
   async execute(args, ctx) {
-    const filePath = path10.resolve(ctx.cwd, args.path);
+    const filePath = path14.resolve(ctx.cwd, args.path);
     const snapshot = await captureSnapshot(filePath, "write_file", ctx.snapshotContext);
     try {
-      await mkdir3(path10.dirname(filePath), { recursive: true });
-      await writeFile3(filePath, args.content, "utf8");
+      await mkdir3(path14.dirname(filePath), { recursive: true });
+      await writeFile5(filePath, args.content, "utf8");
     } catch (err) {
       return { content: `Failed to write ${args.path}: ${err.message}`, isError: true };
     }
@@ -2106,7 +3275,7 @@ var writeFileTool = {
 };
 
 // src/tools/tasks.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/agent/agent-tasks.ts
 import { EventEmitter as EventEmitter2 } from "events";
@@ -2277,8 +3446,8 @@ function formatTaskFinished(task) {
 }
 
 // src/tools/tasks.ts
-var idSchema = z8.object({
-  id: z8.string().describe("Task id, e.g. task-1 or agent-1")
+var idSchema = z9.object({
+  id: z9.string().describe("Task id, e.g. task-1 or agent-1")
 });
 function truncateOutput(s) {
   if (s.length <= MAX_OUTPUT) return s;
@@ -2295,7 +3464,7 @@ var taskListTool = {
   name: "task_list",
   description: "List background tasks (shell commands and subagents) with status and runtime.",
   permission: "read",
-  parameters: z8.object({}),
+  parameters: z9.object({}),
   execute() {
     const shell = formatTaskList(defaultTaskManager.list());
     const agents = defaultAgentTasks.list();
@@ -2354,20 +3523,20 @@ var taskKillTool = {
 };
 
 // src/tools/todo.ts
-import { mkdir as mkdir4, readFile as readFile4, rename, writeFile as writeFile4 } from "fs/promises";
-import path11 from "path";
-import { z as z9 } from "zod";
-var todoItemSchema = z9.object({
-  id: z9.number().int(),
-  title: z9.string(),
-  status: z9.enum(["pending", "in_progress", "done"])
+import { mkdir as mkdir4, readFile as readFile6, rename, writeFile as writeFile6 } from "fs/promises";
+import path15 from "path";
+import { z as z10 } from "zod";
+var todoItemSchema = z10.object({
+  id: z10.number().int(),
+  title: z10.string(),
+  status: z10.enum(["pending", "in_progress", "done"])
 });
-var writeSchema = z9.object({
-  todos: z9.array(todoItemSchema).describe("The full todo list, replacing the current one")
+var writeSchema = z10.object({
+  todos: z10.array(todoItemSchema).describe("The full todo list, replacing the current one")
 });
-var readSchema = z9.object({});
+var readSchema = z10.object({});
 function fileFor(cwd) {
-  return path11.join(cwd, ".star", "todos.json");
+  return path15.join(cwd, ".star", "todos.json");
 }
 var persistGuard = () => true;
 function setTodoPersistGuard(guard) {
@@ -2387,7 +3556,7 @@ var TodoStore = class {
   async load(cwd) {
     let raw;
     try {
-      raw = await readFile4(fileFor(cwd), "utf8");
+      raw = await readFile6(fileFor(cwd), "utf8");
     } catch {
       return;
     }
@@ -2405,10 +3574,10 @@ var TodoStore = class {
     if (!persistGuard()) {
       return;
     }
-    await mkdir4(path11.join(cwd, ".star"), { recursive: true });
+    await mkdir4(path15.join(cwd, ".star"), { recursive: true });
     const file = fileFor(cwd);
     const tmp = `${file}.tmp`;
-    await writeFile4(tmp, `${JSON.stringify(this.list(), null, 2)}
+    await writeFile6(tmp, `${JSON.stringify(this.list(), null, 2)}
 `);
     await rename(tmp, file);
   }
@@ -2481,13 +3650,13 @@ function createTodoTools(store = defaultStore) {
 }
 
 // src/tools/web/fetch.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var DEFAULT_MAX_CHARS = 2e4;
 var MAX_BYTES = 2 * 1024 * 1024;
 var TIMEOUT_MS = 3e4;
-var schema7 = z10.object({
-  url: z10.string().describe("The http(s) URL to fetch"),
-  maxChars: z10.number().int().positive().optional().describe("Maximum characters of text to return (default 20000)")
+var schema8 = z11.object({
+  url: z11.string().describe("The http(s) URL to fetch"),
+  maxChars: z11.number().int().positive().optional().describe("Maximum characters of text to return (default 20000)")
 });
 function safeCodePoint(n, raw) {
   if (!Number.isInteger(n) || n < 0 || n > 1114111) {
@@ -2558,7 +3727,7 @@ var webFetchTool = {
   name: "web_fetch",
   description: "Fetch a URL over http(s) and return its contents as readable text. HTML pages are converted to plain text (tags, scripts and styles removed). Output is truncated to maxChars (default 20000). Can reach internal/intranet addresses, so do not use it for untrusted URLs.",
   permission: "read",
-  parameters: schema7,
+  parameters: schema8,
   async execute(args, ctx) {
     let url;
     try {
@@ -2621,15 +3790,15 @@ var webFetchTool = {
 };
 
 // src/tools/web/search.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var TIMEOUT_MS2 = 15e3;
 var DEFAULT_MAX_RESULTS = 5;
 var MAX_RESULTS_LIMIT = 10;
 var SEARCH_URL = "https://html.duckduckgo.com/html/?q=";
 var USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
-var schema8 = z11.object({
-  query: z11.string().min(1).describe("The search query"),
-  maxResults: z11.number().int().min(1).max(MAX_RESULTS_LIMIT).optional().describe(
+var schema9 = z12.object({
+  query: z12.string().min(1).describe("The search query"),
+  maxResults: z12.number().int().min(1).max(MAX_RESULTS_LIMIT).optional().describe(
     `Maximum number of results to return (default ${DEFAULT_MAX_RESULTS}, max ${MAX_RESULTS_LIMIT})`
   )
 });
@@ -2680,7 +3849,7 @@ var webSearchTool = {
   name: "web_search",
   description: "Search the web using DuckDuckGo and return a numbered list of results with title, URL and snippet. No API key required. Use web_fetch to read a result's full page.",
   permission: "read",
-  parameters: schema8,
+  parameters: schema9,
   async execute(args, ctx) {
     const maxResults = Math.min(args.maxResults ?? DEFAULT_MAX_RESULTS, MAX_RESULTS_LIMIT);
     const url = `${SEARCH_URL}${encodeURIComponent(args.query)}`;
@@ -2743,6 +3912,7 @@ var ToolRegistry = class {
   constructor(todoStore) {
     for (const tool of [
       readFileTool,
+      readImageTool,
       writeFileTool,
       editFileTool,
       globTool,
@@ -2774,12 +3944,12 @@ var ToolRegistry = class {
 
 // src/agent/project-memory.ts
 import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import path12 from "path";
+import path16 from "path";
 var PROJECT_MEMORY_FILE = "AGENTS.md";
 var PROJECT_MEMORY_MAX_CHARS = 32 * 1024;
 var cache = /* @__PURE__ */ new Map();
 function readProjectMemory(cwd) {
-  const file = path12.join(cwd, PROJECT_MEMORY_FILE);
+  const file = path16.join(cwd, PROJECT_MEMORY_FILE);
   let mtimeMs;
   try {
     mtimeMs = statSync2(file).mtimeMs;
@@ -2809,8 +3979,8 @@ ${body}`;
 
 // src/agent/skills.ts
 import { readFileSync as readFileSync3, readdirSync, statSync as statSync3 } from "fs";
-import path13 from "path";
-import { z as z12 } from "zod";
+import path17 from "path";
+import { z as z13 } from "zod";
 var SKILL_FILE = "SKILL.md";
 var SKILL_MAX_CHARS = 32 * 1024;
 var NAME_PATTERN = /^[a-z0-9-]+$/;
@@ -2840,7 +4010,7 @@ function parseSkillFile(filePath, dirName, scope) {
     const name = parsed?.meta.name || dirName;
     const description = parsed?.meta.description;
     if (parsed && NAME_PATTERN.test(name) && description) {
-      skill = { name, description, filePath, dir: path13.dirname(filePath), scope };
+      skill = { name, description, filePath, dir: path17.dirname(filePath), scope };
     }
   } catch {
     skill = null;
@@ -2857,14 +4027,14 @@ function scanDir(base, scope, into) {
   }
   for (const entry of entries.sort()) {
     if (!NAME_PATTERN.test(entry)) continue;
-    const parsed = parseSkillFile(path13.join(base, entry, SKILL_FILE), entry, scope);
+    const parsed = parseSkillFile(path17.join(base, entry, SKILL_FILE), entry, scope);
     if (parsed) into.set(parsed.name, parsed);
   }
 }
 function discoverSkills(cwd, home = starHome()) {
   const byName = /* @__PURE__ */ new Map();
-  scanDir(path13.join(home, "skills"), "user", byName);
-  scanDir(path13.join(cwd, ".star", "skills"), "project", byName);
+  scanDir(path17.join(home, "skills"), "user", byName);
+  scanDir(path17.join(cwd, ".star", "skills"), "project", byName);
   return [...byName.values()];
 }
 function formatSkillsBlock(skills) {
@@ -2895,8 +4065,8 @@ function createSkillTool(deps) {
     name: "skill",
     description: "Load the full instructions of a skill by name. Available skills are listed in the system prompt when present; call this before starting work that matches one of them.",
     permission: "read",
-    parameters: z12.object({
-      name: z12.string().describe("Name of the skill to load, as listed in the system prompt.")
+    parameters: z13.object({
+      name: z13.string().describe("Name of the skill to load, as listed in the system prompt.")
     }),
     async execute(args) {
       const skills = discoverSkills(deps.cwd, deps.home);
@@ -2926,7 +4096,7 @@ function createSkillTool(deps) {
 }
 
 // src/agent/subagent.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/tools/index.ts
 function createDefaultRegistry(todoStore) {
@@ -2937,8 +4107,37 @@ function createDefaultRegistry(todoStore) {
 var MAX_SUBAGENT_DEPTH = 1;
 var MAX_REPORT_CHARS = 2e4;
 var SUBAGENT_PROMPT = "You are a subagent spawned to handle a focused subtask on behalf of the main agent. Work autonomously with the tools available to you, then finish with a concise report of what you found or did. Your final text is returned to the main agent as the tool result \u2014 make it self-contained.";
+function convertUsagePricing(usage, from, to, config) {
+  if (from === to) return usage;
+  const fromCfg = config.models.find((m) => m.model === from.modelId);
+  const toCfg = config.models.find((m) => m.model === to.modelId);
+  if (fromCfg?.promptPrice === void 0 || fromCfg.completionPrice === void 0 || toCfg?.promptPrice === void 0 || toCfg.completionPrice === void 0 || toCfg.promptPrice <= 0 || toCfg.completionPrice <= 0) {
+    return usage;
+  }
+  const cached = Math.min(Math.max(usage.cachedPromptTokens ?? 0, 0), usage.promptTokens);
+  const promptUsd = (usage.promptTokens - cached) * fromCfg.promptPrice;
+  const cachedUsd = cached * (fromCfg.cacheReadPrice ?? fromCfg.promptPrice);
+  const cacheReadUsd = (usage.cacheReadInputTokens ?? 0) * (fromCfg.cacheReadPrice ?? 0);
+  const completionUsd = usage.completionTokens * fromCfg.completionPrice;
+  const scaledCached = cachedUsd / (toCfg.cacheReadPrice ?? toCfg.promptPrice);
+  const promptTokens = Math.round(promptUsd / toCfg.promptPrice + scaledCached);
+  const cachedPromptTokens = Math.round(scaledCached);
+  const toCacheReadPrice = toCfg.cacheReadPrice !== void 0 && toCfg.cacheReadPrice > 0 ? toCfg.cacheReadPrice : void 0;
+  const completionTokens = Math.round(
+    completionUsd / toCfg.completionPrice + (toCacheReadPrice === void 0 ? cacheReadUsd / toCfg.completionPrice : 0)
+  );
+  const cacheReadInputTokens = toCacheReadPrice === void 0 ? 0 : Math.round(cacheReadUsd / toCacheReadPrice);
+  const result = {
+    promptTokens,
+    completionTokens,
+    totalTokens: promptTokens + completionTokens
+  };
+  if (cachedPromptTokens > 0) result.cachedPromptTokens = cachedPromptTokens;
+  if (cacheReadInputTokens > 0) result.cacheReadInputTokens = cacheReadInputTokens;
+  return result;
+}
 async function runSubagent(deps, args, cwd, signal) {
-  const { AgentLoop: AgentLoop2 } = await import("./loop-XY3TE5NN.js");
+  const { AgentLoop: AgentLoop2 } = await import("./loop-DVVPIOS7.js");
   const child = new AgentLoop2({
     model: deps.model,
     registry: createDefaultRegistry(),
@@ -2948,12 +4147,16 @@ async function runSubagent(deps, args, cwd, signal) {
 
 ${SUBAGENT_PROMPT}` : SUBAGENT_PROMPT,
     providerMetadata: deps.providerMetadata,
+    temperature: deps.temperature,
+    streamIdleTimeoutSec: deps.streamIdleTimeoutSec,
+    streamFirstChunkTimeoutSec: deps.streamFirstChunkTimeoutSec,
     subagentDepth: deps.depth + 1
   });
   const confirmHandler = deps.getConfirmHandler?.();
   if (confirmHandler) child.confirmHandler = confirmHandler;
   let toolCalls = 0;
   let error = null;
+  const usage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
   try {
     for await (const event of child.stream(args.prompt, signal)) {
       if (event.type === "tool-result") {
@@ -2961,10 +4164,18 @@ ${SUBAGENT_PROMPT}` : SUBAGENT_PROMPT,
       } else if (event.type === "error") {
         error = event.error.message;
         break;
+      } else if (event.type === "finish" && event.usage) {
+        usage.promptTokens += event.usage.promptTokens;
+        usage.completionTokens += event.usage.completionTokens;
+        usage.totalTokens += event.usage.totalTokens;
+        usage.cachedPromptTokens = (usage.cachedPromptTokens ?? 0) + (event.usage.cachedPromptTokens ?? 0);
+        usage.cacheReadInputTokens = (usage.cacheReadInputTokens ?? 0) + (event.usage.cacheReadInputTokens ?? 0);
       }
     }
   } catch (e) {
     error = e instanceof Error ? e.message : String(e);
+  } finally {
+    if (usage.totalTokens > 0) deps.onUsage?.(usage, deps.model);
   }
   if (signal.aborted) {
     throw new Error("Tool execution aborted.");
@@ -2997,10 +4208,10 @@ function createSubagentTool(deps) {
     name: "subagent",
     description: "Spawn a subagent with its own agent loop to handle a focused subtask (research, exploration, or an isolated change). The subagent has the same tools but cannot spawn further subagents. Returns the subagent's final report. Prefer this for self-contained work that would otherwise clutter the main conversation. Set run_in_background to start it without blocking: independent subtasks then run concurrently and their reports are delivered to you automatically when they finish (also inspectable via task_list/task_output/task_kill).",
     permission: "exec",
-    parameters: z13.object({
-      prompt: z13.string().describe("Complete, self-contained instructions for the subagent."),
-      description: z13.string().optional().describe("Short label for the subtask, shown in the result header."),
-      run_in_background: z13.boolean().optional().describe(
+    parameters: z14.object({
+      prompt: z14.string().describe("Complete, self-contained instructions for the subagent."),
+      description: z14.string().optional().describe("Short label for the subtask, shown in the result header."),
+      run_in_background: z14.boolean().optional().describe(
         "Run concurrently in the background and return a task id immediately (default false). Use for independent subtasks that can run in parallel."
       )
     }),
@@ -3026,14 +4237,14 @@ function createSubagentTool(deps) {
 }
 
 // src/agent/user-memory.ts
-import { appendFileSync, mkdirSync, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import path14 from "path";
-import { z as z14 } from "zod";
+import { appendFileSync as appendFileSync2, mkdirSync, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import path18 from "path";
+import { z as z15 } from "zod";
 var USER_MEMORY_MAX_CHARS = 32 * 1024;
 var REMEMBER_TEXT_MAX_CHARS = 500;
 var cache3 = /* @__PURE__ */ new Map();
 function readUserMemory(home = starHome()) {
-  const file = path14.join(home, "MEMORY.md");
+  const file = path18.join(home, "MEMORY.md");
   let mtimeMs;
   try {
     mtimeMs = statSync4(file).mtimeMs;
@@ -3065,7 +4276,7 @@ function readUserMemory(home = starHome()) {
 }
 function appendUserMemory(text, home = starHome()) {
   mkdirSync(home, { recursive: true });
-  appendFileSync(path14.join(home, "MEMORY.md"), `- ${text}
+  appendFileSync2(path18.join(home, "MEMORY.md"), `- ${text}
 `, "utf8");
 }
 function createRememberTool(deps = {}) {
@@ -3073,8 +4284,8 @@ function createRememberTool(deps = {}) {
     name: "remember",
     description: `Save a note to the user's long-term memory (${userMemoryPath()}), injected into every future session. ONLY use when the user explicitly asks to remember or save something. Never use autonomously.`,
     permission: "write",
-    parameters: z14.object({
-      text: z14.string().max(REMEMBER_TEXT_MAX_CHARS).describe("The note to save, as a single concise sentence.")
+    parameters: z15.object({
+      text: z15.string().max(REMEMBER_TEXT_MAX_CHARS).describe("The note to save, as a single concise sentence.")
     }),
     async execute(args) {
       appendUserMemory(args.text, deps.home);
@@ -3085,9 +4296,10 @@ function createRememberTool(deps = {}) {
 
 // src/agent/loop.ts
 var PLAN_MODE_PROMPT = "\n\nYou are currently in PLAN MODE. Research the task using only the read-only tools available to you, then present a concrete, step-by-step implementation plan as your final answer. You must not modify files, run shell commands, or otherwise change the system \u2014 write/exec tools are unavailable in this mode. Do not ask the user to run commands for you; note manual steps in the plan instead. The user will review your plan and approve it before any execution begins.";
-var PENDING_WORK_PATTERN = /(?:我将|我会|我现在|接下来|下一步|下面(?:我|将)|稍后|随后|准备开始|现在开始|马上|即将|这就|待会|开始(?:执行|进行|处理|转换|动手|生成|写入|运行|创建)|(?:完成后|然后|接着)会|让我(?:们)?(?:来)?|I will|I'll|I am going to|I'm going to|I shall|let me|next,? I|I will now)/i;
+var PENDING_WORK_PATTERN = /(?:我将|我会|我现在|接下来|下一步|下面(?:我|将)|稍后|随后|准备开始|现在开始|马上|即将|这就|待会|开始(?:执行|进行|处理|转换|动手|生成|写入|运行|创建)|(?:完成后|然后|接着)会|让我(?:们)?(?:来)?(?!知道)|I will|I'll|I am going to|I'm going to|I shall|\blet me(?!\s+know\b)|next,? I|I will now)/i;
 var AUTO_CONTINUE_NUDGE = "[auto-continue] You ended your turn with words instead of actions. Do not describe or restate the plan \u2014 continue the task NOW by calling tools. Reply with text only if the task is already fully complete.";
 var EMPTY_REPLY_NUDGE = "[auto-continue] Your previous reply was empty \u2014 no text and no tool calls. If the task is fully complete, reply with one short confirmation; otherwise continue NOW by calling tools.";
+var TRUNCATED_CONTINUE_NUDGE = "[auto-continue] Your previous reply was cut off mid-stream by a timeout \u2014 it is incomplete. Resume EXACTLY where you stopped: do not repeat or restate what you already wrote; continue with the next tool call or the remainder of the text.";
 function isFilteredEmptyFinish(finishReason) {
   return finishReason === "content-filter";
 }
@@ -3098,7 +4310,7 @@ function finalNudgeWarning(autoContinues, maxAutoContinues) {
   return autoContinues >= maxAutoContinues ? " This is the final automatic continuation \u2014 if your next reply again has no tool calls, nudging stops and the turn is handed back to the user. Finish the work now or summarize what remains." : "";
 }
 var COMPLETION_CHECK_TIMEOUT_MS = 3e4;
-async function checkTaskComplete(model, request, finalReply, signal) {
+async function checkTaskComplete(model, request, finalReply, signal, temperature) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), COMPLETION_CHECK_TIMEOUT_MS);
   const onAbort = () => controller.abort();
@@ -3107,6 +4319,7 @@ async function checkTaskComplete(model, request, finalReply, signal) {
     const { text } = await generateText3({
       model,
       maxTokens: 8,
+      temperature,
       abortSignal: controller.signal,
       prompt: [
         "An AI coding agent was given this task by the user:",
@@ -3184,9 +4397,19 @@ var AgentLoop = class {
   // consumes it as the redo label right after retractLastTurn sets it.
   lastUndoneLabel = "";
   // Doom-loop guard: signature of the most recent tool call and how many
-  // times in a row it has repeated. Any different call resets the count.
+  // times in a row it has repeated. Any different call resets the count, and
+  // each new user turn restarts the streak.
   lastToolSignature = null;
   repeatedToolCalls = 0;
+  // Token usage subagents consumed, waiting to fold into this loop's next
+  // finish event with usage: sync children report when their tool call
+  // settles, background ones whenever they finish (drained or not).
+  // Consumers meter only root-loop finish events, so folding here bills
+  // subagent spend with zero consumer changes — /cost, /usage and
+  // sessionBudgetUsd all cover it. A background child still running when the
+  // session's last finish has passed never reports (best effort, noted in
+  // agent-tasks cleanup paths).
+  subagentUsage = null;
   // Turn context of the in-flight stream() turn, stamped onto every tool
   // execution so file snapshots attribute root changes to a turn and mark
   // subagent changes as excluded from turn-level retraction.
@@ -3226,8 +4449,12 @@ var AgentLoop = class {
           cwd: opts.cwd,
           system: opts.system,
           providerMetadata: opts.providerMetadata,
+          temperature: opts.temperature,
+          streamIdleTimeoutSec: opts.streamIdleTimeoutSec,
+          streamFirstChunkTimeoutSec: opts.streamFirstChunkTimeoutSec,
           depth,
-          getConfirmHandler: () => this.confirmHandler
+          getConfirmHandler: () => this.confirmHandler,
+          onUsage: (usage, childModel) => this.addSubagentUsage(usage, childModel)
         })
       );
     }
@@ -3377,7 +4604,10 @@ var AgentLoop = class {
   }
   // Truncates the history back to the given message index (the user message
   // at that index and everything after it is dropped) and persists the
-  // trimmed history, so /rewind stays consistent across resume.
+  // trimmed history, so /rewind stays consistent across resume. The redo
+  // stack dies with the rewound context: its entries describe pre-/undo
+  // working-tree states that no longer line up with this conversation, so
+  // restoring one would clobber the rewound tree.
   async retractFromIndex(index) {
     const cut = this.retractionCut(index);
     const removed = this.messages.length - cut;
@@ -3385,6 +4615,7 @@ var AgentLoop = class {
     this.messages = this.messages.slice(0, cut);
     await this.opts.sessionStore?.replaceMessages([...this.messages]);
     this.turnMarkers = this.turnMarkers.filter((m) => m.userIndex < cut);
+    this.redoStack = [];
     return removed;
   }
   async appendContextMessage(text, role = "user") {
@@ -3492,9 +4723,12 @@ var AgentLoop = class {
     this.maybeScheduleTitle();
     const { config, registry, cwd } = this.opts;
     const aiTools = this.buildAiTools();
+    this.lastToolSignature = null;
+    this.repeatedToolCalls = 0;
     let autoContinues = 0;
     let lastWasNudge = false;
     let usedToolsThisTurn = false;
+    let streamCutContinues = 0;
     let openTodos = [];
     const maxSteps = config.maxSteps;
     let step = 0;
@@ -3508,6 +4742,7 @@ var AgentLoop = class {
               `Max steps (${maxSteps}) reached with no tool execution since the last checkpoint, stopping.`
             )
           };
+          await this.runStopHooks("max-steps");
           return;
         }
         toolExecutedSinceCheckpoint = false;
@@ -3536,6 +4771,7 @@ ${finished.result}`
       );
       if (compacted.compacted) {
         this.messages = await this.applyCompactionSummary(compacted, signal);
+        await this.opts.sessionStore?.replaceMessages([...this.messages]);
         this.turnMarkers = [];
       }
       const maxRetries = Math.max(0, config.streamMaxRetries);
@@ -3546,7 +4782,9 @@ ${finished.result}`
       let lastFinishReason;
       let lastUsage;
       let sawReasoning = false;
+      let wasTruncated = false;
       let oversizedImagesStripped = false;
+      const hasOutput = () => text.trim().length > 0 || toolCalls.length > 0;
       for (let attempt = 0; ; attempt++) {
         text = "";
         toolCalls.length = 0;
@@ -3554,6 +4792,7 @@ ${finished.result}`
         lastFinishReason = void 0;
         lastUsage = void 0;
         sawReasoning = false;
+        wasTruncated = false;
         const timeoutScale = Math.min(attempt + 1, 3);
         try {
           for await (const event of this.streamOnce(aiTools, signal, timeoutScale)) {
@@ -3568,8 +4807,9 @@ ${finished.result}`
               yield event;
             } else if (event.type === "finish") {
               lastFinishReason = event.finishReason;
+              if (event.truncated) wasTruncated = true;
               lastUsage = event.usage;
-              yield event;
+              yield this.foldSubagentUsage(event);
             } else if (event.type === "error") {
               failure = event.error;
             } else {
@@ -3583,9 +4823,10 @@ ${finished.result}`
         }
         if (signal.aborted) {
           yield* this.persistInterrupted(text, toolCalls);
+          await this.runStopHooks("aborted");
           return;
         }
-        if (!failure && (text.length > 0 || toolCalls.length > 0)) break;
+        if (!failure && hasOutput()) break;
         if (failure && !oversizedImagesStripped && isOversizedImageError(failure)) {
           oversizedImagesStripped = true;
           const removed = await this.stripOversizedImages();
@@ -3599,7 +4840,7 @@ ${finished.result}`
         }
         if (failure && !isRetryableStreamError(failure)) break;
         if (attempt >= maxRetries) break;
-        if (!failure && text.length === 0 && toolCalls.length === 0 && attempt >= 1 && (isFilteredEmptyFinish(lastFinishReason) || sawReasoning || lastUsage !== void 0 && lastUsage.completionTokens > 0))
+        if (!failure && !hasOutput() && attempt >= 1 && (isFilteredEmptyFinish(lastFinishReason) || sawReasoning || lastUsage !== void 0 && lastUsage.completionTokens > 0))
           break;
         const delayMs = computeRetryDelayMs(attempt, failure ? baseDelay : baseDelay * 2, failure);
         yield {
@@ -3611,14 +4852,16 @@ ${finished.result}`
         };
         if (!await sleep(delayMs, signal)) {
           yield* this.persistInterrupted(text, toolCalls);
+          await this.runStopHooks("aborted");
           return;
         }
       }
       if (failure) {
         yield { type: "error", error: failure };
+        await this.runStopHooks("error");
         return;
       }
-      if (text.length === 0 && toolCalls.length === 0) {
+      if (!hasOutput()) {
         if (isSteerableEmptyFinish(lastFinishReason) && config.permissionMode !== "plan" && autoContinues < config.maxAutoContinues) {
           autoContinues++;
           lastWasNudge = true;
@@ -3638,6 +4881,7 @@ ${finished.result}`
           type: "error",
           error: new Error("The model returned an empty response after retries; ending the turn.")
         };
+        await this.runStopHooks("empty");
         return;
       }
       const assistantMessage = {
@@ -3655,6 +4899,27 @@ ${finished.result}`
       this.messages.push(assistantMessage);
       await this.persist(assistantMessage);
       if (toolCalls.length === 0) {
+        if (wasTruncated) {
+          if (config.permissionMode !== "plan" && streamCutContinues < config.streamMaxRetries) {
+            streamCutContinues++;
+            yield {
+              type: "notice",
+              message: `reply cut short by a stream timeout; asking the model to resume where it stopped (${streamCutContinues}/${config.streamMaxRetries}).`
+            };
+            const nudge = { role: "user", content: TRUNCATED_CONTINUE_NUDGE };
+            this.messages.push(nudge);
+            await this.persist(nudge);
+            continue;
+          }
+          if (config.permissionMode !== "plan") {
+            yield {
+              type: "notice",
+              message: 'reply was cut short by a stream timeout and resume attempts are exhausted, handing the turn back \u2014 reply "continue" to keep going.'
+            };
+          }
+          await this.runStopHooks("completed");
+          return;
+        }
         let reason = null;
         let nudgeText = AUTO_CONTINUE_NUDGE;
         if (openTodos.length > 0) {
@@ -3662,13 +4927,27 @@ ${finished.result}`
           nudgeText = `[auto-continue] You ended your turn with unfinished todo item(s): ${openTodos.map((t) => `"${t}"`).join(
             ", "
           )}. Complete them now with tool calls, or update the list with todo_write if they are no longer needed.`;
+        } else if (usedToolsThisTurn && !signal.aborted) {
+          const complete = await checkTaskComplete(
+            this.opts.model,
+            inputText,
+            text,
+            signal,
+            this.opts.temperature
+          );
+          if (complete === false) {
+            reason = "completion check reports the task unfinished";
+          } else if (complete === null) {
+            if (lastWasNudge) {
+              reason = "reply still had no tool calls";
+            } else if (PENDING_WORK_PATTERN.test(text)) {
+              reason = "reply announced unfinished work";
+            }
+          }
         } else if (lastWasNudge) {
           reason = "reply still had no tool calls";
         } else if (PENDING_WORK_PATTERN.test(text)) {
           reason = "reply announced unfinished work";
-        } else if (usedToolsThisTurn && !signal.aborted) {
-          const complete = await checkTaskComplete(this.opts.model, inputText, text, signal);
-          if (complete === false) reason = "completion check reports the task unfinished";
         }
         if (reason !== null && config.permissionMode !== "plan" && autoContinues < config.maxAutoContinues) {
           autoContinues++;
@@ -3691,7 +4970,7 @@ ${finished.result}`
             message: `${reason}; auto-continue limit reached, handing the turn back \u2014 reply "continue" to keep going.`
           };
         }
-        await this.runEventHooks("Stop");
+        await this.runStopHooks("completed");
         return;
       }
       lastWasNudge = false;
@@ -3722,6 +5001,24 @@ ${finished.result}`
           this.messages.push(toolMessage);
           await this.persist(toolMessage);
           answered.add(call.id);
+          if (result.images && result.images.length > 0) {
+            const imageMessage = {
+              role: "user",
+              content: [
+                ...result.images.map((img) => ({
+                  type: "image",
+                  image: img.data,
+                  mimeType: img.mimeType
+                })),
+                ...result.images.map((img) => ({
+                  type: "text",
+                  text: `[image from ${call.name}: ${img.path}]`
+                }))
+              ]
+            };
+            this.messages.push(imageMessage);
+            await this.persist(imageMessage);
+          }
           if (call.name === "todo_write" && !result.isError) {
             openTodos = pendingTodoTitles(call.args);
           }
@@ -3754,7 +5051,10 @@ ${finished.result}`
           yield { type: "tool-result", id: call.id, name: call.name, content, isError: true };
         }
       }
-      if (signal.aborted) return;
+      if (signal.aborted) {
+        await this.runStopHooks("aborted");
+        return;
+      }
       step++;
     }
   }
@@ -3787,7 +5087,7 @@ ${finished.result}`
     const content = parts.join("\n\n");
     const head = this.messages[0];
     if (head?.role === "system" && typeof head.content === "string") {
-      if (head.content !== content) head.content = content;
+      if (head.content !== content) this.messages[0] = { role: "system", content };
     } else if (head?.role !== "system") {
       this.messages.unshift({ role: "system", content });
     }
@@ -3800,7 +5100,7 @@ ${finished.result}`
     const headCount = compacted.messages[0]?.role === "system" ? 1 : 0;
     const dropped = this.messages.slice(headCount, headCount + compacted.droppedCount);
     try {
-      const summary = await summarizeMessages(dropped, model, signal);
+      const summary = await summarizeMessages(dropped, model, signal, this.opts.temperature);
       const messages = compacted.messages.slice();
       messages[headCount] = {
         role: "user",
@@ -3813,15 +5113,15 @@ ${summary}`
     }
   }
   async *streamOnce(aiTools, signal, timeoutScale = 1) {
-    const { streamChat } = await import("./stream-EFQPULQQ.js");
     for await (const event of streamChat({
       model: this.opts.model,
       messages: this.messages,
       tools: aiTools,
       abortSignal: signal,
       providerMetadata: this.opts.providerMetadata,
-      idleTimeoutMs: this.opts.config.streamIdleTimeoutSec * 1e3 * timeoutScale,
-      firstPartTimeoutMs: this.opts.config.streamFirstChunkTimeoutSec * 1e3 * timeoutScale
+      idleTimeoutMs: (this.opts.streamIdleTimeoutSec ?? this.opts.config.streamIdleTimeoutSec) * 1e3 * timeoutScale,
+      firstPartTimeoutMs: (this.opts.streamFirstChunkTimeoutSec ?? this.opts.config.streamFirstChunkTimeoutSec) * 1e3 * timeoutScale,
+      temperature: this.opts.temperature
     })) {
       if (event.type === "finish" && event.truncated) {
         yield {
@@ -3844,6 +5144,14 @@ ${summary}`
     }
     return tools;
   }
+  // Fires the Stop hooks for a turn's end, on every termination path (normal
+  // completion, Esc abort, exhausted stream retries, terminal empty replies,
+  // the maxSteps no-progress stop). The reason rides in STAR_TOOL_INPUT as
+  // {"reason": ...}: Stop hooks ignore tool matchers and the variable was
+  // never set for Stop before, so existing hooks are unaffected.
+  async runStopHooks(reason) {
+    await this.runEventHooks("Stop", void 0, { reason });
+  }
   async runEventHooks(event, toolName, toolInput) {
     const empty = { blocked: false, warnings: [] };
     if (this.opts.config.hooks.length === 0) return empty;
@@ -3860,6 +5168,47 @@ ${summary}`
       return empty;
     }
   }
+  // Accumulates a settled subagent's usage. When the child provably ran on a
+  // different, fully priced model, the counts are first converted into
+  // this-model-priced equivalents (convertUsagePricing): session cost is
+  // token totals × the active model's price, so the conversion keeps the $
+  // estimate accurate where raw sums would misprice.
+  addSubagentUsage(usage, childModel) {
+    const converted = convertUsagePricing(usage, childModel, this.opts.model, this.opts.config);
+    const pending = this.subagentUsage ?? {
+      promptTokens: 0,
+      completionTokens: 0,
+      totalTokens: 0
+    };
+    pending.promptTokens += converted.promptTokens;
+    pending.completionTokens += converted.completionTokens;
+    pending.totalTokens += converted.totalTokens;
+    if (converted.cachedPromptTokens) {
+      pending.cachedPromptTokens = (pending.cachedPromptTokens ?? 0) + converted.cachedPromptTokens;
+    }
+    if (converted.cacheReadInputTokens) {
+      pending.cacheReadInputTokens = (pending.cacheReadInputTokens ?? 0) + converted.cacheReadInputTokens;
+    }
+    this.subagentUsage = pending;
+  }
+  // Folds pending subagent usage into an outgoing finish event (and clears
+  // it). A finish without usage reports nothing to consumers, so the pending
+  // amount is kept for the next finish that carries usage instead.
+  foldSubagentUsage(event) {
+    const pending = this.subagentUsage;
+    if (!pending || !event.usage) return event;
+    this.subagentUsage = null;
+    const usage = {
+      promptTokens: event.usage.promptTokens + pending.promptTokens,
+      completionTokens: event.usage.completionTokens + pending.completionTokens,
+      totalTokens: event.usage.totalTokens + pending.totalTokens
+    };
+    const cachedPromptTokens = (event.usage.cachedPromptTokens ?? 0) + (pending.cachedPromptTokens ?? 0);
+    const cacheReadInputTokens = (event.usage.cacheReadInputTokens ?? 0) + (pending.cacheReadInputTokens ?? 0);
+    if (cachedPromptTokens > 0) usage.cachedPromptTokens = cachedPromptTokens;
+    if (cacheReadInputTokens > 0) usage.cacheReadInputTokens = cacheReadInputTokens;
+    return { ...event, usage };
+  }
   // opencode's doom_loop guard: returns a refusal once the identical tool
   // call (name + stable-serialized args) has repeated config.doomLoopThreshold
   // times in a row; 0 disables. Any different signature resets the streak.
@@ -3956,17 +5305,25 @@ export {
   compactMessages,
   WORKING_DIFF_MAX_LINES,
   isGitRepo,
-  getGitSummary,
+  getGitSummaryCached,
   collectCommitContext,
   buildCommitPrompt,
   collectWorkingDiff,
   MAX_IMAGE_DIMENSION,
-  probeImageDimensions,
   reconcileToolCalls,
+  wrapFetchWithActivity,
+  starHome,
+  globalConfigPath,
+  sessionsDir,
+  userMemoryPath,
+  envFilePath,
+  projectConfigPath,
   isSensitivePath,
   isAllowedByRules,
   buildAllowRule,
   isDangerousCommand,
+  removeTreeRepo,
+  pruneTreeReposExcept,
   diffTreeNames,
   listSnapshots,
   clearSnapshots,
@@ -3979,6 +5336,7 @@ export {
   bashTool,
   SKIP_DIRS,
   createIgnorePredicate,
+  downsampleImageIfNeeded,
   formatTaskList,
   formatTaskStarted,
   formatTaskFinished,
@@ -3993,4 +5351,4 @@ export {
   PLAN_MODE_PROMPT,
   AgentLoop
 };
-//# sourceMappingURL=chunk-I6FDXAWX.js.map
+//# sourceMappingURL=chunk-OOOW7FC4.js.map