@cryer/star-cli 0.3.8 → 0.3.10

package/dist/chunk-MNVCCOI2.js

@@ -0,0 +1,3510 @@
+#!/usr/bin/env node
+import {
+  INTERRUPTED_TOOL_RESULT_TEXT,
+  UNFINISHED_TOOL_RESULT_TEXT,
+  coreMessageText,
+  diffTreeNames,
+  isSyntheticUserMessage,
+  reconcileStarMessages,
+  resolveCompactThreshold,
+  restoreTree,
+  retractLastTurn,
+  toCoreMessages,
+  toStarMessage,
+  trackTree
+} from "./chunk-IJGUW4PM.js";
+import {
+  createModel,
+  streamActivity
+} from "./chunk-MVAMPVTA.js";
+import {
+  resolveModelConfig
+} from "./chunk-4IRY44TG.js";
+import {
+  ToolRegistry,
+  createDefaultRegistry,
+  debugStreamLog
+} from "./chunk-URC7JXKX.js";
+import {
+  TodoStore,
+  beginTurn,
+  currentTurnSeq,
+  defaultAgentTasks,
+  dropTurnSnapshots,
+  isOversizedImageError,
+  isSensitivePath,
+  isVisionUnsupportedError,
+  pendingTodoTitles,
+  responseBodyOf,
+  setSnapshotHooks,
+  setTodoPersistGuard,
+  starHome,
+  stripAllImages,
+  stripOversizedImages,
+  undoTurnSnapshots,
+  userMemoryPath
+} from "./chunk-A5PXPWHB.js";
+
+// src/agent/loop.ts
+import { tool as aiTool, generateText as generateText3 } from "ai";
+
+// src/context/compaction.ts
+import { generateText } from "ai";
+
+// src/context/tokens.ts
+import { zodSchema } from "ai";
+import { encode } from "gpt-tokenizer/encoding/cl100k_base";
+var CHARS_PER_TOKEN = 4;
+var MESSAGE_OVERHEAD = 4;
+var IMAGE_PART_TOKENS = 1024;
+var ENCODE_OPTIONS = { disallowedSpecial: /* @__PURE__ */ new Set() };
+function countTextTokens(text) {
+  if (text.length === 0) return 0;
+  try {
+    return encode(text, ENCODE_OPTIONS).length;
+  } catch {
+    return Math.ceil(textWeight(text) / CHARS_PER_TOKEN);
+  }
+}
+function isCjkCode(code) {
+  return code >= 12288 && code <= 12543 || code >= 13312 && code <= 19903 || code >= 19968 && code <= 40959 || code >= 63744 && code <= 64255 || code >= 65280 && code <= 65519;
+}
+function textWeight(text) {
+  let cjk = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (isCjkCode(text.charCodeAt(i))) cjk++;
+  }
+  return text.length + cjk * (CHARS_PER_TOKEN - 1);
+}
+function contentTokenLength(message) {
+  if (message.role === "tool") {
+    let tokens2 = 0;
+    for (const part of message.content) {
+      tokens2 += countTextTokens(JSON.stringify(part.result ?? null));
+    }
+    return tokens2;
+  }
+  if (typeof message.content === "string") {
+    return countTextTokens(message.content);
+  }
+  let tokens = 0;
+  for (const part of message.content) {
+    if (part.type === "text" || part.type === "reasoning") {
+      tokens += countTextTokens(part.text);
+    } else if (part.type === "tool-call") {
+      tokens += countTextTokens(part.toolName) + countTextTokens(JSON.stringify(part.args ?? null));
+    }
+  }
+  return tokens;
+}
+function imagePartCount(message) {
+  if (typeof message.content === "string" || message.role === "tool") return 0;
+  return message.content.filter((part) => part.type === "image" || part.type === "file").length;
+}
+var tokenCache = /* @__PURE__ */ new WeakMap();
+function estimateMessageTokens(message) {
+  const cached = tokenCache.get(message);
+  if (cached !== void 0) return cached;
+  const tokens = contentTokenLength(message) + MESSAGE_OVERHEAD + imagePartCount(message) * IMAGE_PART_TOKENS;
+  tokenCache.set(message, tokens);
+  return tokens;
+}
+function estimateTokens(messages) {
+  return messages.reduce((total, message) => total + estimateMessageTokens(message), 0);
+}
+function parametersWireJson(parameters) {
+  if (parameters == null) return "";
+  const wrapper = parameters;
+  if (wrapper.jsonSchema !== void 0) {
+    try {
+      return JSON.stringify(wrapper.jsonSchema) ?? "";
+    } catch {
+      return "";
+    }
+  }
+  try {
+    return JSON.stringify(zodSchema(parameters).jsonSchema) ?? "";
+  } catch {
+    try {
+      return JSON.stringify(parameters) ?? "";
+    } catch {
+      return "";
+    }
+  }
+}
+function estimateToolSchemaTokens(tools) {
+  let tokens = 0;
+  for (const [name, tool] of Object.entries(tools)) {
+    tokens += countTextTokens(name);
+    const description = tool.description;
+    if (typeof description === "string") tokens += countTextTokens(description);
+    tokens += countTextTokens(parametersWireJson(tool.parameters));
+  }
+  return tokens;
+}
+
+// src/context/compaction.ts
+var MIN_KEPT_MESSAGES = 4;
+function placeholderMessage(droppedCount) {
+  return {
+    message: {
+      role: "user",
+      content: `[context compacted: ${droppedCount} earlier messages dropped]`
+    }
+  };
+}
+var SUMMARY_SYSTEM_PROMPT = [
+  "You are summarizing an AI coding agent's conversation for context compaction.",
+  "Write a concise summary that preserves:",
+  "- the user's goals and requests",
+  "- decisions made and their rationale",
+  "- files and code touched (paths, key changes)",
+  "- tool results that matter (errors, key outputs)",
+  "- outstanding TODOs and next steps",
+  "Output only the summary, no preamble."
+].join("\n");
+var MAX_SUMMARY_INPUT_CHARS = 8e4;
+var SUMMARY_HEAD_CHARS = 24e3;
+function serializeMessage(message) {
+  if (typeof message.content === "string") {
+    return `${message.role}: ${message.content}`;
+  }
+  const parts = message.content.map((part) => {
+    if (part.type === "text") return part.text;
+    if (part.type === "tool-call")
+      return `[tool-call ${part.toolName}] ${JSON.stringify(part.args)}`;
+    if (part.type === "tool-result")
+      return `[tool-result ${part.toolName}] ${JSON.stringify(part.result)}`;
+    return `[${part.type}]`;
+  });
+  return `${message.role}: ${parts.join("\n")}`;
+}
+function headSlice(parts, budget) {
+  const kept = [];
+  let used = 0;
+  for (const part of parts) {
+    if (used >= budget) break;
+    const sep = kept.length > 0 ? 1 : 0;
+    if (used + sep + part.length <= budget) {
+      kept.push(part);
+      used += sep + part.length;
+    } else {
+      kept.push(part.slice(0, budget - used - sep));
+      used = budget;
+    }
+  }
+  return kept.join("\n");
+}
+function tailSlice(parts, budget) {
+  const kept = [];
+  let used = 0;
+  for (let i = parts.length - 1; i >= 0; i--) {
+    if (used >= budget) break;
+    const part = parts[i] ?? "";
+    const sep = kept.length > 0 ? 1 : 0;
+    if (used + sep + part.length <= budget) {
+      kept.unshift(part);
+      used += sep + part.length;
+    } else {
+      kept.unshift(part.slice(part.length - (budget - used - sep)));
+      used = budget;
+    }
+  }
+  return kept.join("\n");
+}
+function serializeSummaryInput(messages) {
+  const parts = messages.map(serializeMessage);
+  let total = Math.max(0, parts.length - 1);
+  for (const part of parts) total += part.length;
+  if (total <= MAX_SUMMARY_INPUT_CHARS) return parts.join("\n");
+  const head = headSlice(parts, SUMMARY_HEAD_CHARS);
+  const tail = tailSlice(parts, MAX_SUMMARY_INPUT_CHARS - SUMMARY_HEAD_CHARS);
+  return `${head}
+[... ${total - MAX_SUMMARY_INPUT_CHARS} characters omitted ...]
+${tail}`;
+}
+async function summarizeMessages(messages, model, signal, temperature) {
+  const transcript = serializeSummaryInput(messages);
+  const { text } = await generateText({
+    model,
+    system: SUMMARY_SYSTEM_PROMPT,
+    prompt: `Summarize this conversation so far:
+
+${transcript}`,
+    temperature,
+    // A hung relay must not stall the whole turn on the summary: cap it at
+    // 60s and let the caller's abort (Esc) cut it short as well; the caller
+    // falls back to the truncation placeholder on any failure.
+    abortSignal: signal ? AbortSignal.any([signal, AbortSignal.timeout(6e4)]) : AbortSignal.timeout(6e4)
+  });
+  return text.trim();
+}
+function compactMessages(messages, maxTokens, opts = {}) {
+  const limit = opts.force ? 0 : maxTokens;
+  const overhead = opts.overheadTokens ?? 0;
+  const tokens = messages.map((star) => estimateMessageTokens(star.message));
+  let total = overhead;
+  for (const messageTokens of tokens) total += messageTokens;
+  if (total <= limit) {
+    return { messages: [...messages], compacted: false, droppedCount: 0 };
+  }
+  const hasSystem = messages[0]?.message.role === "system";
+  const head = hasSystem ? [messages[0]] : [];
+  const restStart = hasSystem ? 1 : 0;
+  const restCount = messages.length - restStart;
+  const headTokens = hasSystem ? tokens[0] ?? 0 : 0;
+  let restTokens = 0;
+  for (let i = restStart; i < tokens.length; i++) restTokens += tokens[i] ?? 0;
+  const turns = [];
+  for (let i = restStart; i < messages.length; i++) {
+    const current = turns[turns.length - 1];
+    const star = messages[i];
+    if (star && star.message.role === "user" && !isSyntheticUserMessage(star) || !current) {
+      turns.push({ length: 1, tokens: tokens[i] ?? 0 });
+    } else {
+      current.length += 1;
+      current.tokens += tokens[i] ?? 0;
+    }
+  }
+  let droppedCount = 0;
+  let droppedTokens = 0;
+  for (const turn of turns) {
+    if (restCount - droppedCount - turn.length < MIN_KEPT_MESSAGES) {
+      break;
+    }
+    droppedCount += turn.length;
+    droppedTokens += turn.tokens;
+    const candidateTokens = overhead + headTokens + estimateMessageTokens(placeholderMessage(droppedCount).message) + (restTokens - droppedTokens);
+    if (candidateTokens <= limit) {
+      break;
+    }
+  }
+  if (droppedCount === 0) {
+    return { messages: [...messages], compacted: false, droppedCount: 0 };
+  }
+  return {
+    messages: [
+      ...head,
+      placeholderMessage(droppedCount),
+      ...messages.slice(restStart + droppedCount)
+    ],
+    compacted: true,
+    droppedCount
+  };
+}
+
+// src/context/elision.ts
+var ACTIVATION_FRACTION = 0.5;
+var KEEP_RECENT_MESSAGES = 24;
+var MIN_ELISION_TOKENS = 250;
+var ELIDED_TOOL_RESULT_TEXT = "[stale tool output elided to free context \u2014 it was shown in full earlier; re-run the tool if you need it again]";
+var ELIDED_IMAGE_TEXT = "[image elided to free context \u2014 re-attach it if it is still needed]";
+function elideStaleContent(messages, thresholdTokens, overheadTokens = 0) {
+  let total = overheadTokens;
+  for (const star of messages) total += estimateMessageTokens(star.message);
+  if (total < thresholdTokens * ACTIVATION_FRACTION) return null;
+  const cutoff = messages.length - KEEP_RECENT_MESSAGES;
+  if (cutoff <= 0) return null;
+  let elidedCount = 0;
+  const out = messages.slice();
+  for (let i = 0; i < cutoff; i++) {
+    const star = out[i];
+    if (!star || star.meta?.elided) continue;
+    const message = star.message;
+    if (message.role === "tool") {
+      if (estimateMessageTokens(message) < MIN_ELISION_TOKENS) continue;
+      out[i] = {
+        message: {
+          ...message,
+          content: message.content.map((part) => ({
+            ...part,
+            result: ELIDED_TOOL_RESULT_TEXT
+          }))
+        },
+        meta: { ...star.meta, elided: true }
+      };
+      elidedCount++;
+    } else if (message.role === "user" && Array.isArray(message.content)) {
+      if (!message.content.some((part) => part.type === "image" || part.type === "file")) continue;
+      out[i] = {
+        message: {
+          ...message,
+          content: message.content.map(
+            (part) => part.type === "image" || part.type === "file" ? { type: "text", text: ELIDED_IMAGE_TEXT } : part
+          )
+        },
+        meta: { ...star.meta, elided: true }
+      };
+      elidedCount++;
+    }
+  }
+  if (elidedCount === 0) return null;
+  return { messages: out, elidedCount };
+}
+
+// src/core/events.ts
+function usageTotalTokens(usage) {
+  const summed = usage.promptTokens + usage.completionTokens;
+  return summed > 0 ? summed : usage.totalTokens;
+}
+function toStreamErrorInfo(error) {
+  const err = error instanceof Error ? error : new Error(String(error));
+  const info = { name: err.name, message: err.message };
+  const statusCode = err.statusCode;
+  if (typeof statusCode === "number") info.statusCode = statusCode;
+  if (err.isRetryable === true) info.isRetryable = true;
+  const code = err.code;
+  if (typeof code === "string") info.code = code;
+  const cause = err.cause;
+  const causeCode = cause && typeof cause === "object" ? cause.code : void 0;
+  if (typeof causeCode === "string") info.causeCode = causeCode;
+  const headers = err.responseHeaders;
+  if (headers && typeof headers === "object") {
+    const strings = {};
+    for (const [key, value] of Object.entries(headers)) {
+      if (typeof value === "string") strings[key] = value;
+    }
+    if (Object.keys(strings).length > 0) info.responseHeaders = strings;
+  }
+  const body = err.responseBody;
+  if (typeof body === "string" && body.length > 0) info.responseBody = body;
+  return info;
+}
+
+// src/core/git.ts
+import { execFileSync } from "child_process";
+var GIT_TIMEOUT_MS = 2e3;
+var GIT_MAX_BUFFER = 8 * 1024 * 1024;
+var COMMIT_DIFF_MAX_LINES = 2e3;
+var WORKING_DIFF_MAX_LINES = 2e3;
+function runGit(args, cwd) {
+  try {
+    const out = execFileSync("git", args, {
+      cwd,
+      timeout: GIT_TIMEOUT_MS,
+      encoding: "utf8",
+      maxBuffer: GIT_MAX_BUFFER,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return out.replace(/\n$/, "");
+  } catch {
+    return null;
+  }
+}
+function isGitRepo(cwd) {
+  return runGit(["rev-parse", "--is-inside-work-tree"], cwd) === "true";
+}
+function getGitSummary(cwd) {
+  const branch = runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
+  if (branch === null) return null;
+  const status = runGit(["status", "--porcelain"], cwd) ?? "";
+  const dirtyCount = status === "" ? 0 : status.split("\n").length;
+  const log = runGit(["log", "--oneline", "-3"], cwd) ?? "";
+  return { branch, dirtyCount, recentCommits: log === "" ? [] : log.split("\n") };
+}
+var GIT_SUMMARY_CACHE_TTL_MS = 15e3;
+var gitSummaryCache = /* @__PURE__ */ new Map();
+function getGitSummaryCached(cwd) {
+  const now = Date.now();
+  const hit = gitSummaryCache.get(cwd);
+  if (hit && now - hit.at < GIT_SUMMARY_CACHE_TTL_MS) return hit.summary;
+  const summary = getGitSummary(cwd);
+  gitSummaryCache.set(cwd, { at: now, summary });
+  return summary;
+}
+function formatGitSummary(summary) {
+  const lines = [
+    "Git context for the working directory (refreshed each turn):",
+    `Branch: ${summary.branch}`,
+    summary.dirtyCount === 0 ? "Working tree: clean" : `Working tree: ${summary.dirtyCount} file(s) with uncommitted changes`
+  ];
+  if (summary.recentCommits.length > 0) {
+    lines.push("Recent commits:", ...summary.recentCommits);
+  }
+  return lines.join("\n");
+}
+function truncateLines(text, maxLines) {
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) return { text, truncated: false };
+  return { text: lines.slice(0, maxLines).join("\n"), truncated: true };
+}
+function collectDiffs(cwd) {
+  return {
+    staged: runGit(["diff", "--cached"], cwd) ?? "",
+    unstaged: runGit(["diff"], cwd) ?? ""
+  };
+}
+function collectCommitContext(cwd) {
+  if (!isGitRepo(cwd)) return null;
+  const status = runGit(["status", "--short"], cwd) ?? "";
+  const { staged, unstaged } = collectDiffs(cwd);
+  if (status === "" && staged === "" && unstaged === "") return null;
+  const rawDiff = [staged, unstaged].filter((part) => part !== "").join("\n");
+  const { text: diff, truncated } = truncateLines(rawDiff, COMMIT_DIFF_MAX_LINES);
+  const recentLog = runGit(["log", "--oneline", "-5"], cwd) ?? "";
+  return { status, diff, diffTruncated: truncated, recentLog };
+}
+function buildCommitPrompt(context, instructions = "") {
+  const parts = [
+    "Analyze the uncommitted git changes below and create a commit for them.",
+    "",
+    "Requirements:",
+    "- Draft a commit message in Conventional Commits style (e.g. `feat(scope): summary`), consistent with the repository's recent commit history.",
+    "- Stage the relevant files and create the commit with the bash tool (`git add` + `git commit`), through the normal permission flow.",
+    "- Do not push and do not amend existing commits.",
+    "- After committing, briefly report the commit hash and message."
+  ];
+  if (instructions) {
+    parts.push("", `Additional instructions from the user: ${instructions}`);
+  }
+  parts.push("", "## git status --short", "```", context.status || "(clean)", "```");
+  if (context.recentLog) {
+    parts.push("", "## recent commits (git log --oneline -5)", "```", context.recentLog, "```");
+  }
+  if (context.diff) {
+    parts.push("", "## git diff (staged + unstaged)", "```diff", context.diff, "```");
+    if (context.diffTruncated) {
+      parts.push(`(diff truncated to ${COMMIT_DIFF_MAX_LINES} lines)`);
+    }
+  }
+  return parts.join("\n");
+}
+function collectWorkingDiff(cwd) {
+  if (!isGitRepo(cwd)) return null;
+  const status = runGit(["status", "--short"], cwd) ?? "";
+  const { staged, unstaged } = collectDiffs(cwd);
+  const sections = [];
+  if (staged) sections.push(`# Staged changes
+${staged}`);
+  if (unstaged) sections.push(`# Unstaged changes
+${unstaged}`);
+  const { text, truncated } = truncateLines(sections.join("\n"), WORKING_DIFF_MAX_LINES);
+  return { status, diff: text, truncated };
+}
+
+// src/hooks/runner.ts
+import { spawn } from "child_process";
+import { StringDecoder } from "string_decoder";
+var STDERR_LIMIT = 2e3;
+var STDERR_CAPTURE_LIMIT = 64 * 1024;
+var STDIN_PAYLOAD_THRESHOLD = 16 * 1024;
+function truncate(text) {
+  const trimmed = text.trim();
+  return trimmed.length > STDERR_LIMIT ? `${trimmed.slice(0, STDERR_LIMIT)}\u2026` : trimmed;
+}
+function killTree(pid) {
+  if (pid === void 0) return;
+  if (process.platform === "win32") {
+    spawn("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true }).on(
+      "error",
+      () => {
+      }
+    );
+  } else {
+    try {
+      process.kill(-pid, "SIGKILL");
+    } catch {
+      try {
+        process.kill(pid, "SIGKILL");
+      } catch {
+      }
+    }
+  }
+}
+function runCommand(hook, event, ctx, timeoutSec) {
+  const env = {
+    ...process.env,
+    STAR_HOOK_EVENT: event,
+    STAR_CWD: ctx.cwd,
+    STAR_SESSION_ID: ctx.sessionId ?? ""
+  };
+  if (ctx.toolName !== void 0) env.STAR_TOOL_NAME = ctx.toolName;
+  const inputJson = ctx.toolInput !== void 0 ? JSON.stringify(ctx.toolInput) : void 0;
+  const inputViaStdin = inputJson !== void 0 && Buffer.byteLength(inputJson, "utf8") > STDIN_PAYLOAD_THRESHOLD;
+  if (inputJson !== void 0 && !inputViaStdin) env.STAR_TOOL_INPUT = inputJson;
+  if (inputViaStdin) env.STAR_TOOL_INPUT_STDIN = "1";
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(hook.command, [], {
+        shell: true,
+        cwd: ctx.cwd,
+        env,
+        windowsHide: true,
+        detached: process.platform !== "win32"
+      });
+    } catch (error) {
+      resolve({
+        code: 1,
+        stderr: "",
+        timedOut: false,
+        spawnError: error instanceof Error ? error.message : String(error)
+      });
+      return;
+    }
+    if (inputViaStdin && inputJson !== void 0 && child.stdin) {
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(inputJson);
+    }
+    let stderr = "";
+    const stderrDecoder = new StringDecoder("utf8");
+    let timedOut = false;
+    let settled = false;
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(fallback);
+      resolve({ ...outcome, stderr: outcome.stderr + stderrDecoder.end() });
+    };
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killTree(child.pid);
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      fallback = setTimeout(() => {
+        finish({ code: 1, stderr, timedOut: true });
+      }, 2e3);
+      fallback.unref?.();
+    }, timeoutSec * 1e3);
+    let fallback;
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < STDERR_CAPTURE_LIMIT) stderr += stderrDecoder.write(chunk);
+    });
+    child.stdout?.resume();
+    child.on("error", (error) => {
+      finish({ code: 1, stderr, timedOut, spawnError: error.message });
+    });
+    child.on("close", (code) => {
+      finish({ code: code ?? 1, stderr, timedOut });
+    });
+  });
+}
+function hookMatches(hook, event, toolName) {
+  if (hook.event !== event) return false;
+  if (event === "Stop" || !hook.matcher) return true;
+  if (toolName === void 0) return false;
+  try {
+    return new RegExp(hook.matcher).test(toolName);
+  } catch {
+    return false;
+  }
+}
+async function runHooks(event, hooks, ctx, opts) {
+  const result = { blocked: false, warnings: [] };
+  for (const hook of hooks) {
+    if (!hookMatches(hook, event, ctx.toolName)) continue;
+    const timeoutSec = opts?.timeoutSec ?? hook.timeoutSec;
+    let outcome;
+    try {
+      outcome = await runCommand(hook, event, ctx, timeoutSec);
+    } catch (error) {
+      result.warnings.push(
+        `Hook "${hook.command}" (${event}) failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+      continue;
+    }
+    if (outcome.code === 0) continue;
+    const stderr = truncate(outcome.stderr);
+    if (event === "PreToolUse" && outcome.code === 2 && !outcome.timedOut) {
+      result.blocked = true;
+      result.reason = stderr || `hook "${hook.command}" exited with code 2`;
+      return result;
+    }
+    const detail = outcome.timedOut ? `timed out after ${timeoutSec}s` : outcome.spawnError ? `failed to start: ${outcome.spawnError}` : `exited with code ${outcome.code}`;
+    result.warnings.push(
+      `Hook "${hook.command}" (${event}) ${detail}${stderr ? `: ${stderr}` : ""}`
+    );
+  }
+  return result;
+}
+
+// src/llm/retry.ts
+var NON_RETRYABLE_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "AI_NoSuchToolError",
+  "AI_InvalidToolArgumentsError",
+  "AI_InvalidPromptError",
+  "AI_NoSuchModelError",
+  "AI_LoadAPIKeyError",
+  "AI_TypeValidationError",
+  "AI_JSONParseError"
+]);
+var RETRYABLE_MESSAGE_PATTERNS = [
+  /\b(408|425|429|500|502|503|504|520|521|522|523|524|529)\b/,
+  /rate.?limit|too many requests|rate increased/i,
+  /overloaded|service.?unavailable|internal (server )?error|server error|provider returned error|bad gateway|gateway timeout/i,
+  /terminated|fetch failed|failed to fetch|network.?error|upstream connect|connection (?:error|refused|lost|reset)|socket (?:hang up|connection)|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout|epipe|ehostunreach|enetunreach/i,
+  /\b(?:request|response|connection|network|stream|read|headers?|body) (?:timeout|timed out|time out)\b/i,
+  /resource.?exhausted|try (?:your request )?again|at capacity/i
+];
+var NON_RETRYABLE_4XX = /* @__PURE__ */ new Set([400, 401, 403, 404, 413, 422]);
+var NETWORK_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+  "ECONNABORTED"
+]);
+function isNetworkFailure(error) {
+  for (const code of [error.code, error.causeCode]) {
+    if (code && (NETWORK_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"))) return true;
+  }
+  return error.name === "TypeError" && /fetch failed|failed to fetch|network/i.test(error.message);
+}
+function matchesRetryablePattern(text) {
+  return typeof text === "string" && RETRYABLE_MESSAGE_PATTERNS.some((p) => p.test(text));
+}
+function isRetryableStreamError(error) {
+  if (NON_RETRYABLE_ERROR_NAMES.has(error.name)) return false;
+  if (error.isRetryable === true) return true;
+  const status = error.statusCode;
+  if (status !== void 0) {
+    if (status === 408 || status === 429 || status >= 500 && status !== 501) return true;
+    if (NON_RETRYABLE_4XX.has(status)) return false;
+    return matchesRetryablePattern(error.message) || matchesRetryablePattern(responseBodyOf(error));
+  }
+  return isNetworkFailure(error);
+}
+var RETRY_JITTER_FACTOR = 0.25;
+var MAX_RETRY_DELAY_MS = 6e4;
+function retryAfterDelayMs(error) {
+  const headers = error.responseHeaders;
+  if (!headers) return void 0;
+  const normalized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    normalized[key.toLowerCase()] = value;
+  }
+  const afterMs = Number.parseFloat(normalized["retry-after-ms"] ?? "");
+  if (!Number.isNaN(afterMs)) return Math.max(0, afterMs);
+  const after = normalized["retry-after"];
+  if (after) {
+    const seconds = Number.parseFloat(after);
+    if (!Number.isNaN(seconds)) return Math.max(0, Math.ceil(seconds * 1e3));
+    const dateMs = Date.parse(after) - Date.now();
+    if (!Number.isNaN(dateMs) && dateMs > 0) return Math.ceil(dateMs);
+  }
+  return void 0;
+}
+function computeRetryDelayMs(attempt, baseMs, error, random = Math.random()) {
+  const hinted = error ? retryAfterDelayMs(error) : void 0;
+  if (hinted !== void 0) return Math.min(hinted, MAX_RETRY_DELAY_MS);
+  const base = baseMs * 2 ** attempt;
+  return Math.min(Math.ceil(base + base * RETRY_JITTER_FACTOR * random), MAX_RETRY_DELAY_MS);
+}
+function summarizeStreamError(error) {
+  const parts = [error.message || error.name];
+  const status = error.statusCode;
+  if (status !== void 0 && !error.message.includes(String(status))) {
+    parts.push(`(HTTP ${status})`);
+  }
+  const body = responseBodyOf(error);
+  if (body && !error.message.includes(body.slice(0, 40))) {
+    const excerpt = body.replace(/\s+/g, " ").trim().slice(0, 200);
+    if (excerpt) parts.push(`\u2014 ${excerpt}`);
+  }
+  return parts.join(" ");
+}
+
+// src/llm/stream.ts
+import { streamText } from "ai";
+var DEFAULT_IDLE_TIMEOUT_MS = 6e4;
+var DEFAULT_FIRST_PART_TIMEOUT_MS = 12e4;
+var CONTENT_PART_TYPES = /* @__PURE__ */ new Set(["text-delta", "tool-call", "tool-call-delta"]);
+var MAX_KEEPALIVE_SILENCE_MS = 10 * 6e4;
+var CACHE_READ_KEYS = ["cacheReadInputTokens", "cache_read_input_tokens"];
+var CACHED_PROMPT_KEYS = ["cachedPromptTokens", "cached_prompt_tokens", "cachedTokens"];
+function withAnthropicCacheBreakpoints(model, messages) {
+  if (!model.provider.startsWith("anthropic")) return messages;
+  const mark = (message) => ({
+    ...message,
+    experimental_providerMetadata: {
+      ...message.experimental_providerMetadata,
+      anthropic: {
+        ...message.experimental_providerMetadata?.anthropic,
+        cacheControl: { type: "ephemeral" }
+      }
+    }
+  });
+  const result = messages.slice();
+  if (result[0]?.role === "system") result[0] = mark(result[0]);
+  const last = result.length - 1;
+  if (last > 0 && result[last]) result[last] = mark(result[last]);
+  return result;
+}
+function extractCacheUsage(providerMetadata) {
+  if (!providerMetadata || typeof providerMetadata !== "object") return {};
+  for (const value of Object.values(providerMetadata)) {
+    if (!value || typeof value !== "object") continue;
+    const record = value;
+    for (const key of CACHE_READ_KEYS) {
+      const n = record[key];
+      if (typeof n === "number" && Number.isFinite(n)) return { cacheReadInputTokens: n };
+    }
+    for (const key of CACHED_PROMPT_KEYS) {
+      const n = record[key];
+      if (typeof n === "number" && Number.isFinite(n)) return { cachedPromptTokens: n };
+    }
+  }
+  return {};
+}
+async function* streamChat(opts) {
+  const controller = new AbortController();
+  const onAbort = () => controller.abort();
+  opts.abortSignal?.addEventListener("abort", onAbort);
+  if (opts.abortSignal?.aborted) controller.abort();
+  const { openai: openaiMetadata, ...otherMetadata } = opts.providerMetadata ?? {};
+  const result = streamText({
+    model: opts.model,
+    messages: withAnthropicCacheBreakpoints(opts.model, opts.messages),
+    tools: opts.tools,
+    abortSignal: controller.signal,
+    maxTokens: opts.maxTokens,
+    temperature: opts.temperature,
+    // Disable the SDK's own retries (ai@4 defaults to 2 internal attempts with
+    // fixed backoff that ignores Retry-After and the abort signal, and
+    // exhaustion throws an AI_RetryError stripped of status/headers/body) —
+    // the retry policy in agent/loop.ts + llm/retry.ts owns the full budget
+    // and needs the raw error to classify.
+    maxRetries: 0,
+    // Pass tool-call argument deltas through (instead of buffering until the
+    // complete call) so large write_file payloads report receive progress.
+    toolCallStreaming: true,
+    experimental_providerMetadata: {
+      // Only the openai provider (our responses-protocol path) reads these;
+      // other providers ignore unknown metadata. The SDK's responses provider
+      // sends every tool with strict:true by default (strictSchemas), and
+      // strict mode requires every schema property to be required — our
+      // classic function-calling schemas use optional properties, which
+      // relays then reject. store:false matches how codex and opencode talk
+      // to relays (no server-side response storage).
+      ...otherMetadata,
+      openai: { strictSchemas: false, store: false, ...openaiMetadata }
+    }
+  });
+  const idleTimeoutMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+  const firstPartTimeoutMs = opts.firstPartTimeoutMs ?? DEFAULT_FIRST_PART_TIMEOUT_MS;
+  const iterator = result.fullStream[Symbol.asyncIterator]();
+  let seenContent = false;
+  let deltas = 0;
+  let hasContent = false;
+  const argsProgress = /* @__PURE__ */ new Map();
+  let lastPartAt = Date.now();
+  debugStreamLog("request", {
+    messages: opts.messages.length,
+    idleTimeoutMs,
+    firstPartTimeoutMs
+  });
+  try {
+    let pending;
+    for (; ; ) {
+      pending ??= iterator.next();
+      let timer;
+      const windowMs = seenContent ? idleTimeoutMs : firstPartTimeoutMs;
+      const idle = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), windowMs);
+      });
+      let next;
+      try {
+        next = await Promise.race([pending, idle]);
+      } catch (error) {
+        debugStreamLog("stream-throw", {
+          seenContent,
+          deltas,
+          error: error instanceof Error ? summarizeStreamError(error) : String(error)
+        });
+        throw error;
+      } finally {
+        if (timer) clearTimeout(timer);
+      }
+      if (next !== null) pending = void 0;
+      if (next === null) {
+        const activity = streamActivity(controller.signal);
+        const silentForMs = Date.now() - lastPartAt;
+        const lastChunkAgoMs = activity ? Date.now() - activity.lastChunkAt : void 0;
+        if (lastChunkAgoMs !== void 0 && lastChunkAgoMs < windowMs && silentForMs < MAX_KEEPALIVE_SILENCE_MS) {
+          debugStreamLog("keepalive", { seenContent, deltas, lastChunkAgoMs, silentForMs });
+          continue;
+        }
+        debugStreamLog("idle-timeout", {
+          seenContent,
+          deltas,
+          waitedMs: windowMs,
+          lastChunkAgoMs
+        });
+        yield {
+          type: "finish",
+          finishReason: "idle-timeout",
+          usage: void 0,
+          // Content already streamed means the reply may be cut off
+          // mid-thought; the loop surfaces a notice for that.
+          ...hasContent ? { truncated: true } : {}
+        };
+        return;
+      }
+      if (next.done) {
+        debugStreamLog("end", { seenContent, deltas });
+        return;
+      }
+      const part = next.value;
+      lastPartAt = Date.now();
+      if (CONTENT_PART_TYPES.has(part.type)) seenContent = true;
+      switch (part.type) {
+        case "text-delta":
+          deltas++;
+          hasContent = true;
+          yield { type: "text-delta", text: part.textDelta };
+          break;
+        case "reasoning":
+          deltas++;
+          yield { type: "reasoning", text: part.textDelta };
+          break;
+        case "tool-call":
+          hasContent = true;
+          yield {
+            type: "tool-call",
+            id: part.toolCallId,
+            name: part.toolName,
+            args: part.args
+          };
+          break;
+        case "tool-call-streaming-start": {
+          argsProgress.set(part.toolCallId, {
+            name: part.toolName,
+            chars: 0,
+            nextMark: 4096
+          });
+          break;
+        }
+        case "tool-call-delta": {
+          const progress = argsProgress.get(part.toolCallId) ?? {
+            name: part.toolName,
+            chars: 0,
+            nextMark: 4096
+          };
+          progress.chars += part.argsTextDelta.length;
+          argsProgress.set(part.toolCallId, progress);
+          if (progress.chars >= progress.nextMark) {
+            progress.nextMark *= 2;
+            yield { type: "tool-call-progress", name: progress.name, bytes: progress.chars };
+          }
+          break;
+        }
+        case "finish": {
+          const finite = (n) => Number.isFinite(n) ? n : 0;
+          const cache4 = extractCacheUsage(
+            part.providerMetadata ?? part.experimental_providerMetadata
+          );
+          debugStreamLog("finish", {
+            finishReason: part.finishReason,
+            usage: part.usage,
+            deltas
+          });
+          yield {
+            type: "finish",
+            finishReason: part.finishReason,
+            usage: part.usage ? {
+              promptTokens: finite(part.usage.promptTokens),
+              completionTokens: finite(part.usage.completionTokens),
+              totalTokens: finite(part.usage.totalTokens),
+              ...cache4
+            } : void 0
+          };
+          return;
+        }
+        case "error": {
+          if (opts.abortSignal?.aborted) return;
+          const error = toStreamErrorInfo(part.error);
+          debugStreamLog("error-part", { seenContent, deltas, error: summarizeStreamError(error) });
+          yield { type: "error", error };
+          return;
+        }
+      }
+    }
+  } finally {
+    opts.abortSignal?.removeEventListener("abort", onAbort);
+    await iterator.return?.();
+    controller.abort();
+  }
+}
+
+// src/permissions/gate.ts
+import fs from "fs";
+import path from "path";
+
+// src/permissions/shell.ts
+var REDIRECT_OPS = /* @__PURE__ */ new Set([">", ">>", "<", ">&", "<&"]);
+var FILE_REDIRECT_OPS = /* @__PURE__ */ new Set([">", ">>", "<"]);
+var SEGMENT_SEPARATORS = /* @__PURE__ */ new Set([
+  "&&",
+  "||",
+  "&",
+  "|",
+  ";",
+  "\n",
+  "(",
+  ")"
+]);
+function lexShell(command) {
+  const tokens = [];
+  let word = "";
+  let doubleQuoted = false;
+  let i = 0;
+  const flush = () => {
+    if (word.length > 0) {
+      tokens.push({ kind: "word", text: word });
+      word = "";
+    }
+  };
+  const findCloseParen = (from) => {
+    let depth = 0;
+    let j = from;
+    while (j < command.length) {
+      const c = command[j];
+      if (c === "\\") {
+        j += 2;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        const close = command.indexOf(c, j + 1);
+        j = close === -1 ? command.length : close + 1;
+        continue;
+      }
+      if (c === "(") depth += 1;
+      if (c === ")") {
+        depth -= 1;
+        if (depth === 0) return j + 1;
+      }
+      j += 1;
+    }
+    return -1;
+  };
+  const pushSubstitution = (openParen, process2) => {
+    const close = findCloseParen(openParen);
+    const innerEnd = close === -1 ? command.length : close - 1;
+    flush();
+    tokens.push({ kind: "subst", inner: command.slice(openParen + 1, innerEnd), process: process2 });
+    return close === -1 ? command.length : close;
+  };
+  const lexDollarOrBacktick = (pos) => {
+    const c = command[pos];
+    if (c === "`") {
+      const close = command.indexOf("`", pos + 1);
+      const end = close === -1 ? command.length : close;
+      flush();
+      tokens.push({ kind: "subst", inner: command.slice(pos + 1, end), process: false });
+      return close === -1 ? command.length : close + 1;
+    }
+    const next = command[pos + 1];
+    if (next === "(") {
+      return pushSubstitution(pos + 1, false);
+    }
+    if (next === "{") {
+      const close = command.indexOf("}", pos + 2);
+      if (close !== -1) {
+        word += `$${command.slice(pos + 2, close)}`;
+        return close + 1;
+      }
+      word += "$";
+      return pos + 1;
+    }
+    if (next !== void 0 && /[A-Za-z_]/.test(next)) {
+      let end = pos + 1;
+      while (end < command.length && /[A-Za-z0-9_]/.test(command[end] ?? "")) {
+        end += 1;
+      }
+      word += command.slice(pos, end);
+      return end;
+    }
+    word += "$";
+    return pos + 1;
+  };
+  while (i < command.length) {
+    const c = command[i];
+    if (doubleQuoted) {
+      if (c === '"') {
+        doubleQuoted = false;
+        i += 1;
+      } else if (c === "\\") {
+        if (i + 1 < command.length) {
+          word += command[i + 1];
+          i += 2;
+        } else {
+          word += "\\";
+          i += 1;
+        }
+      } else if (c === "$" || c === "`") {
+        i = lexDollarOrBacktick(i);
+      } else {
+        word += c;
+        i += 1;
+      }
+      continue;
+    }
+    if (c === "\\") {
+      if (i + 1 < command.length) {
+        word += command[i + 1];
+        i += 2;
+      } else {
+        word += "\\";
+        i += 1;
+      }
+      continue;
+    }
+    if (c === "'") {
+      const close = command.indexOf("'", i + 1);
+      const end = close === -1 ? command.length : close;
+      word += command.slice(i + 1, end);
+      i = close === -1 ? command.length : close + 1;
+      continue;
+    }
+    if (c === '"') {
+      doubleQuoted = true;
+      i += 1;
+      continue;
+    }
+    if (c === "$" || c === "`") {
+      i = lexDollarOrBacktick(i);
+      continue;
+    }
+    if (c === " " || c === "	" || c === "\r") {
+      flush();
+      i += 1;
+      continue;
+    }
+    if (c === "\n") {
+      flush();
+      tokens.push({ kind: "op", op: "\n" });
+      i += 1;
+      continue;
+    }
+    if (c === "&" || c === "|") {
+      flush();
+      if (command[i + 1] === c) {
+        tokens.push({ kind: "op", op: c === "&" ? "&&" : "||" });
+        i += 2;
+      } else {
+        tokens.push({ kind: "op", op: c });
+        i += 1;
+      }
+      continue;
+    }
+    if (c === ";" || c === "(" || c === ")") {
+      flush();
+      tokens.push({ kind: "op", op: c });
+      i += 1;
+      continue;
+    }
+    if (c === ">" || c === "<") {
+      flush();
+      const next = command[i + 1];
+      if (next === "(") {
+        i = pushSubstitution(i + 1, true);
+        continue;
+      }
+      if (c === ">" && next === ">") {
+        tokens.push({ kind: "op", op: ">>" });
+        i += 2;
+      } else if (next === "&") {
+        tokens.push({ kind: "op", op: c === ">" ? ">&" : "<&" });
+        i += 2;
+      } else {
+        tokens.push({ kind: "op", op: c });
+        i += 1;
+      }
+      continue;
+    }
+    word += c;
+    i += 1;
+  }
+  flush();
+  return tokens;
+}
+function splitShellSegments(tokens) {
+  const segments = [];
+  let current = [];
+  for (const token of tokens) {
+    if (token.kind === "op" && SEGMENT_SEPARATORS.has(token.op)) {
+      if (current.length > 0) {
+        segments.push(current);
+        current = [];
+      }
+      continue;
+    }
+    current.push(token);
+  }
+  if (current.length > 0) {
+    segments.push(current);
+  }
+  return segments;
+}
+function segmentWords(segment) {
+  const words = [];
+  const redirectTargets = [];
+  for (let k = 0; k < segment.length; k += 1) {
+    const token = segment[k];
+    if (token.kind === "op" && REDIRECT_OPS.has(token.op)) {
+      const target = segment[k + 1];
+      if (target?.kind === "word") {
+        redirectTargets.push(target.text);
+        k += 1;
+      }
+      continue;
+    }
+    if (token.kind === "word") {
+      words.push(token.text);
+    }
+  }
+  return { words, redirectTargets };
+}
+function renderSegment(segment) {
+  return segment.map((token) => {
+    if (token.kind === "word") return token.text;
+    if (token.kind === "op") return token.op;
+    return token.process ? ">(\u2026)" : "$(\u2026)";
+  }).join(" ");
+}
+
+// src/permissions/lex-cache.ts
+function lexCached(cache4, command) {
+  if (cache4 === void 0) return lexShell(command);
+  const hit = cache4.get(command);
+  if (hit !== void 0) return hit;
+  const tokens = lexShell(command);
+  cache4.set(command, tokens);
+  return tokens;
+}
+
+// src/permissions/rules.ts
+function parseAllowRule(rule) {
+  const match = /^([\w-]+)(?:\((.*)\))?$/.exec(rule.trim());
+  if (!match) return null;
+  return { toolName: match[1], pattern: match[2] };
+}
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function requestTarget(req) {
+  if (typeof req.args !== "object" || req.args === null) return void 0;
+  const args = req.args;
+  const key = req.toolName === "bash" ? "command" : "path";
+  const value = args[key];
+  return typeof value === "string" ? value : void 0;
+}
+function compileRule(raw) {
+  const parsed = parseAllowRule(raw);
+  if (parsed === null) return null;
+  if (parsed.pattern === void 0) return { toolName: parsed.toolName };
+  return { toolName: parsed.toolName, pattern: globToRegExp(parsed.pattern) };
+}
+var compiledRuleCache = /* @__PURE__ */ new WeakMap();
+function compiledRules(rules) {
+  const hit = compiledRuleCache.get(rules);
+  if (hit !== void 0) return hit;
+  const compiled = rules.map(compileRule);
+  compiledRuleCache.set(rules, compiled);
+  return compiled;
+}
+function matchCompiledRule(rule, req) {
+  if (rule.toolName !== req.toolName) return false;
+  if (rule.pattern === void 0) return true;
+  const target = requestTarget(req);
+  return target !== void 0 && rule.pattern.test(target);
+}
+
+// src/permissions/allow.ts
+function splitCommandChain(command, lex) {
+  if (command.includes("$(") || command.includes("`")) return null;
+  const tokens = lexCached(lex, command);
+  if (tokens.some((token) => token.kind === "subst")) return null;
+  const segments = splitShellSegments(tokens);
+  for (const segment of segments) {
+    if (segment.some((token) => token.kind === "op" && FILE_REDIRECT_OPS.has(token.op))) {
+      return null;
+    }
+  }
+  return segments.map(renderSegment).filter((segment) => segment.length > 0);
+}
+function withCommand(req, command) {
+  return {
+    ...req,
+    args: { ...req.args ?? {}, command }
+  };
+}
+function isAllowedByRules(rules, req, lex) {
+  if (req.toolName !== "bash") return matchesAnyRule(rules, req);
+  const command = requestTarget(req);
+  if (command === void 0) return matchesAnyRule(rules, req);
+  const segments = splitCommandChain(command, lex);
+  if (segments === null) return false;
+  if (segments.length === 0) return matchesAnyRule(rules, req);
+  return segments.every((segment) => matchesAnyRule(rules, withCommand(req, segment)));
+}
+function isDeniedByRules(rules, req, lex) {
+  if (req.toolName !== "bash") return matchesAnyRule(rules, req);
+  const command = requestTarget(req);
+  if (command === void 0) return matchesAnyRule(rules, req);
+  const segments = splitCommandChain(command, lex);
+  if (segments === null || segments.length === 0) return matchesAnyRule(rules, req);
+  return segments.some((segment) => matchesAnyRule(rules, withCommand(req, segment)));
+}
+function isAskedByRules(rules, req, lex) {
+  if (req.toolName !== "bash") return matchesAnyRule(rules, req);
+  const command = requestTarget(req);
+  if (command === void 0) return matchesAnyRule(rules, req);
+  const segments = splitCommandChain(command, lex);
+  if (segments === null || segments.length === 0) return matchesAnyRule(rules, req);
+  return segments.some((segment) => matchesAnyRule(rules, withCommand(req, segment)));
+}
+function matchesAnyRule(rules, req) {
+  return compiledRules(rules).some((rule) => rule !== null && matchCompiledRule(rule, req));
+}
+function buildAllowRule(req) {
+  const target = requestTarget(req);
+  return target !== void 0 ? `${req.toolName}(${target})` : req.toolName;
+}
+
+// src/permissions/gate.ts
+var FILE_TOOLS = /* @__PURE__ */ new Set([
+  "write_file",
+  "edit_file",
+  "read_file",
+  "read_image",
+  "grep",
+  "glob",
+  "code_outline"
+]);
+var FORK_BOMB = /:\(\)\s*\{\s*:\|:&\s*\}\s*;:/;
+var MAX_ANALYSIS_DEPTH = 8;
+var SH_FAMILY = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ash"]);
+var EGRESS_COMMANDS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "nc",
+  "ncat",
+  "ssh",
+  "scp",
+  "sftp",
+  "ftp",
+  "telnet"
+]);
+var BLOCK_DEVICE = /^\/dev\/(?:sd[a-z]+\d*|xvd[a-z]+\d*|vd[a-z]+\d*|hd[a-z]+\d*|nvme\d+n\d+(?:p\d+)?|mmcblk\d+(?:p\d+)?)$/i;
+function baseName(word) {
+  const base = word.replace(/\\/g, "/").split("/").pop() ?? word;
+  return base.toLowerCase().replace(/\.exe$/, "");
+}
+function isDangerousDeleteTarget(target) {
+  if (/^\/+$/.test(target)) return true;
+  const norm = target.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (norm === "/*" || norm === "*") return true;
+  if (norm === "~" || norm.startsWith("~/") || /^~[^/]/.test(norm)) return true;
+  if (norm === "." || norm === "./*") return true;
+  if (/^[a-zA-Z]:$/.test(norm)) return true;
+  const homeVars = ["$HOME", "$USERPROFILE", "$HOMEPATH"];
+  if (homeVars.includes(norm)) return true;
+  if (homeVars.some((v) => norm.startsWith(`${v}/`))) return true;
+  if (/^%(USERPROFILE|HOMEDRIVE|HOMEPATH)%$/i.test(norm)) return true;
+  if (/^%(USERPROFILE|HOMEPATH)%\//i.test(norm)) return true;
+  return false;
+}
+function rmIsDangerous(args) {
+  let recursive = false;
+  let optionsDone = false;
+  const targets = [];
+  for (const arg of args) {
+    if (!optionsDone && arg === "--") {
+      optionsDone = true;
+      continue;
+    }
+    if (!optionsDone && arg.startsWith("-")) {
+      if (arg === "--recursive") {
+        recursive = true;
+      } else if (!arg.startsWith("--") && /[rR]/.test(arg)) {
+        recursive = true;
+      }
+      continue;
+    }
+    targets.push(arg);
+  }
+  return recursive && targets.some(isDangerousDeleteTarget);
+}
+function findIsDangerous(args, depth, lex) {
+  const paths = [];
+  for (const arg of args) {
+    if (arg.startsWith("-") || arg === "(" || arg === ")" || arg === "!" || arg === ",") {
+      break;
+    }
+    paths.push(arg);
+  }
+  const rootishPaths = paths.length === 0 || paths.some(isDangerousDeleteTarget);
+  if (args.includes("-delete") && rootishPaths) return true;
+  for (let k = 0; k < args.length; k += 1) {
+    const arg = args[k];
+    if (arg !== "-exec" && arg !== "-execdir") continue;
+    const cmd = [];
+    for (let j = k + 1; j < args.length; j += 1) {
+      const token = args[j];
+      if (token === ";" || token === "+") break;
+      cmd.push(token);
+    }
+    if (cmd.length === 0) continue;
+    const argv = rootishPaths ? cmd.map((token) => token.replaceAll("{}", "~")) : cmd;
+    const name = baseName(argv[0]);
+    if (name === "rm" && rmIsDangerous(argv.slice(1))) return true;
+    if (SH_FAMILY.has(name)) {
+      const idx = argv.indexOf("-c");
+      const script = idx >= 0 ? argv[idx + 1] : void 0;
+      if (script !== void 0 && commandLineIsDangerous(script, depth + 1, lex)) return true;
+    }
+    if (commandLineIsDangerous(argv.join(" "), depth + 1, lex)) return true;
+  }
+  return false;
+}
+var XARGS_VALUE_OPTS = /* @__PURE__ */ new Set([
+  "-I",
+  "-n",
+  "-P",
+  "-s",
+  "-L",
+  "-d",
+  "-E",
+  "-a",
+  "--replace",
+  "--max-args",
+  "--max-procs",
+  "--max-lines",
+  "--delimiter",
+  "--eof",
+  "--arg-file",
+  "--interactive",
+  "--exit"
+]);
+function xargsIsDangerous(args, depth, lex) {
+  let replstr;
+  for (let k = 0; k < args.length; k += 1) {
+    const arg = args[k];
+    if (arg === "-I" || arg === "--replace") {
+      replstr = args[k + 1];
+      k += 1;
+      continue;
+    }
+    if (arg.startsWith("--replace=")) {
+      replstr = arg.slice("--replace=".length);
+      continue;
+    }
+    if (arg.startsWith("-I") && arg.length > 2) {
+      replstr = arg.slice(2);
+      continue;
+    }
+    if (XARGS_VALUE_OPTS.has(arg)) {
+      k += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      continue;
+    }
+    const name = baseName(arg);
+    if (name === "rm") return true;
+    if (!SH_FAMILY.has(name)) return false;
+    const scriptArgs = args.slice(k + 1);
+    const idx = scriptArgs.indexOf("-c");
+    const script = idx >= 0 ? scriptArgs[idx + 1] : void 0;
+    if (script === void 0) return false;
+    const substituted = replstr !== void 0 ? script.split(replstr).join("~") : script;
+    return commandLineIsDangerous(substituted, depth + 1, lex);
+  }
+  return false;
+}
+function chmodIsDangerous(args) {
+  let recursive = false;
+  let optionsDone = false;
+  const operands = [];
+  for (const arg of args) {
+    if (!optionsDone && arg === "--") {
+      optionsDone = true;
+      continue;
+    }
+    if (!optionsDone && arg.startsWith("-")) {
+      if (arg === "--recursive" || !arg.startsWith("--") && arg.includes("R")) {
+        recursive = true;
+      }
+      continue;
+    }
+    operands.push(arg);
+  }
+  return recursive && operands.slice(1).some(isDangerousDeleteTarget);
+}
+var WRAPPER_COMMANDS = {
+  sudo: {
+    valueOpts: /* @__PURE__ */ new Set([
+      "-u",
+      "-g",
+      "-h",
+      "-p",
+      "-t",
+      "-C",
+      "-T",
+      "-D",
+      "-R",
+      "-U",
+      "--user",
+      "--group",
+      "--host",
+      "--prompt",
+      "--type"
+    ]),
+    positionals: 0
+  },
+  doas: { valueOpts: /* @__PURE__ */ new Set(["-u"]), positionals: 0 },
+  env: { valueOpts: /* @__PURE__ */ new Set(["-u", "-C", "--unset", "--chdir"]), positionals: 0 },
+  nice: { valueOpts: /* @__PURE__ */ new Set(["-n", "--adjustment"]), positionals: 0 },
+  ionice: {
+    valueOpts: /* @__PURE__ */ new Set(["-c", "-n", "-p", "--class", "--classdata", "--pid"]),
+    positionals: 0
+  },
+  nohup: { valueOpts: /* @__PURE__ */ new Set(), positionals: 0 },
+  timeout: {
+    valueOpts: /* @__PURE__ */ new Set(["-k", "-s", "--kill-after", "--signal"]),
+    positionals: 1
+  },
+  stdbuf: {
+    valueOpts: /* @__PURE__ */ new Set(["-i", "-o", "-e", "--input", "--output", "--error"]),
+    positionals: 0
+  },
+  setsid: { valueOpts: /* @__PURE__ */ new Set(), positionals: 0 },
+  chrt: { valueOpts: /* @__PURE__ */ new Set(["-p", "--pid"]), positionals: 1 },
+  taskset: {
+    valueOpts: /* @__PURE__ */ new Set(["-c", "-p", "--cpu-list", "--pid"]),
+    positionals: 1,
+    positionalSubstitutes: /* @__PURE__ */ new Set(["-c", "--cpu-list"])
+  }
+};
+function commandInvocation(words) {
+  let sudo = false;
+  let k = 0;
+  for (; ; ) {
+    const word = words[k];
+    if (word === void 0) return null;
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
+      k += 1;
+      continue;
+    }
+    const name = baseName(word);
+    const spec = WRAPPER_COMMANDS[name];
+    if (spec === void 0) {
+      return { name, rest: words.slice(k + 1), sudo };
+    }
+    sudo = sudo || name === "sudo" || name === "doas";
+    k += 1;
+    let positionals = spec.positionals;
+    for (; ; ) {
+      const arg = words[k];
+      if (arg === void 0) return null;
+      if (arg.startsWith("-") && arg !== "-") {
+        if (spec.valueOpts.has(arg)) {
+          if (spec.positionalSubstitutes?.has(arg)) positionals = 0;
+          k += 2;
+        } else {
+          k += 1;
+        }
+        continue;
+      }
+      if (positionals > 0) {
+        positionals -= 1;
+        k += 1;
+        continue;
+      }
+      break;
+    }
+  }
+}
+function commandLineIsDangerous(command, depth, lex) {
+  if (depth > MAX_ANALYSIS_DEPTH) return true;
+  const tokens = lexCached(lex, command);
+  for (const token of tokens) {
+    if (token.kind === "subst" && commandLineIsDangerous(token.inner, depth + 1, lex)) {
+      return true;
+    }
+  }
+  return splitShellSegments(tokens).some((segment) => segmentIsDangerous(segment, depth, lex));
+}
+function decodePowerShellEncoded(encoded) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 !== 0) return null;
+  try {
+    return Buffer.from(encoded, "base64").toString("utf16le");
+  } catch {
+    return null;
+  }
+}
+function segmentIsDangerous(segment, depth, lex) {
+  const { words, redirectTargets } = segmentWords(segment);
+  if (redirectTargets.some((target) => BLOCK_DEVICE.test(target))) {
+    return true;
+  }
+  const invocation = commandInvocation(words);
+  if (!invocation) return false;
+  const { name, rest, sudo } = invocation;
+  if (sudo && name === "rm") return true;
+  switch (name) {
+    case "shutdown":
+    case "reboot":
+    case "poweroff":
+    case "halt":
+    case "diskpart":
+    case "wipefs":
+    case "shred":
+    case "format-volume":
+    case "clear-disk":
+    case "stop-computer":
+    case "bcdedit":
+    case "takeown":
+    case "sdelete":
+      return true;
+    case "rm":
+      return rmIsDangerous(rest);
+    case "rmdir":
+    case "rd":
+    case "del":
+    case "erase":
+      return rest.some((arg) => /^\/s$/i.test(arg));
+    case "remove-item": {
+      let recursive = false;
+      const targets = [];
+      for (const arg of rest) {
+        if (arg.startsWith("-") && /^-r/i.test(arg)) {
+          recursive = true;
+        } else if (!arg.startsWith("-")) {
+          targets.push(arg);
+        }
+      }
+      return recursive && targets.some(isDangerousDeleteTarget);
+    }
+    case "format":
+      return rest.some((arg) => /^[a-z]:$/i.test(arg));
+    case "dd":
+      return rest.some(
+        (arg) => arg.startsWith("if=") || arg.startsWith("of=") && BLOCK_DEVICE.test(arg.slice(3))
+      );
+    case "find":
+      return findIsDangerous(rest, depth, lex);
+    case "xargs":
+      return xargsIsDangerous(rest, depth, lex);
+    case "chmod":
+      return chmodIsDangerous(rest);
+    case "systemctl":
+      return rest.some((arg) => ["poweroff", "halt", "reboot"].includes(arg.toLowerCase()));
+    case "init":
+      return rest.some((arg) => arg === "0" || arg === "6");
+    case "vssadmin":
+      return rest.some((arg) => /^delete$/i.test(arg)) && rest.some((arg) => /^shadows$/i.test(arg));
+    case "wbadmin":
+      return rest.some((arg) => /^delete$/i.test(arg));
+    case "cipher":
+      return rest.some((arg) => /^\/w/i.test(arg));
+    case "icacls":
+      return rest.some((arg) => /^\/reset$/i.test(arg));
+    case "reg":
+      return rest.some((arg) => /^delete$/i.test(arg)) && rest.some((arg) => /^hklm/i.test(arg));
+    case "sh":
+    case "bash":
+    case "zsh":
+    case "dash":
+    case "ash": {
+      const idx = rest.indexOf("-c");
+      const script = idx >= 0 ? rest[idx + 1] : void 0;
+      return script !== void 0 && commandLineIsDangerous(script, depth + 1, lex);
+    }
+    case "eval":
+      return rest.length > 0 && commandLineIsDangerous(rest.join(" "), depth + 1, lex);
+    case "cmd": {
+      const idx = rest.findIndex((arg) => /^\/[ck]$/i.test(arg));
+      if (idx < 0) return false;
+      const script = rest.slice(idx + 1).join(" ");
+      if (script.length === 0) return false;
+      return commandLineIsDangerous(script.replace(/\^(.)/gs, "$1"), depth + 1, lex);
+    }
+    case "powershell":
+    case "pwsh": {
+      for (let k = 0; k < rest.length; k += 1) {
+        const arg = rest[k];
+        if (/^-(c|command)$/i.test(arg)) {
+          const script = rest.slice(k + 1).join(" ");
+          return script.length > 0 && commandLineIsDangerous(script, depth + 1, lex);
+        }
+        if (/^-(enc|encodedcommand)$/i.test(arg)) {
+          const encoded = rest[k + 1];
+          if (encoded === void 0) return true;
+          const script = decodePowerShellEncoded(encoded);
+          if (script === null) return true;
+          return commandLineIsDangerous(script, depth + 1, lex);
+        }
+      }
+      return false;
+    }
+    default:
+      return name.startsWith("mkfs") && (name.length === 4 || /[.-]/.test(name.charAt(4)));
+  }
+}
+function isDangerousCommand(command, lex) {
+  if (FORK_BOMB.test(command)) return true;
+  return commandLineIsDangerous(command, 0, lex);
+}
+var SENSITIVE_DIR_PREFIXES = [
+  "~/.star-cli",
+  "~/.ssh",
+  "$home/.star-cli",
+  "$home/.ssh",
+  "$userprofile/.ssh",
+  "%userprofile%/.ssh"
+];
+function tokenTouchesSensitivePath(word) {
+  const norm = word.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  for (const prefix of SENSITIVE_DIR_PREFIXES) {
+    if (norm === prefix || norm.startsWith(`${prefix}/`)) return true;
+  }
+  return isSensitivePath(word);
+}
+function bashHygiene(command, lex) {
+  let sensitive = false;
+  let egress = false;
+  const visit = (tokens, depth) => {
+    if (depth > MAX_ANALYSIS_DEPTH) return;
+    for (const token of tokens) {
+      if (token.kind === "subst") visit(lexCached(lex, token.inner), depth + 1);
+    }
+    for (const segment of splitShellSegments(tokens)) {
+      const { words, redirectTargets } = segmentWords(segment);
+      for (const word of [...words, ...redirectTargets]) {
+        if (tokenTouchesSensitivePath(word)) sensitive = true;
+      }
+      const invocation = commandInvocation(words);
+      if (!invocation) continue;
+      if (EGRESS_COMMANDS.has(invocation.name)) egress = true;
+      let script;
+      if (SH_FAMILY.has(invocation.name)) {
+        const idx = invocation.rest.indexOf("-c");
+        script = idx >= 0 ? invocation.rest[idx + 1] : void 0;
+      } else if (invocation.name === "cmd") {
+        const idx = invocation.rest.findIndex((arg) => /^\/[ck]$/i.test(arg));
+        script = idx >= 0 ? invocation.rest.slice(idx + 1).join(" ") : void 0;
+      } else if (invocation.name === "eval" && invocation.rest.length > 0) {
+        script = invocation.rest.join(" ");
+      }
+      if (script !== void 0) visit(lexCached(lex, script), depth + 1);
+    }
+  };
+  visit(lexCached(lex, command), 0);
+  return { sensitive, egress };
+}
+function getStringArg(args, key) {
+  if (typeof args === "object" && args !== null) {
+    const value = args[key];
+    if (typeof value === "string") {
+      return value;
+    }
+  }
+  return void 0;
+}
+function normalizeAbsolute(p, cwd) {
+  const abs = path.isAbsolute(p) ? path.normalize(p) : path.resolve(cwd, p);
+  return abs.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isOutsideCwd(p, cwd) {
+  const abs = normalizeAbsolute(p, cwd);
+  const base = normalizeAbsolute(cwd, cwd);
+  return abs !== base && !abs.startsWith(`${base}/`);
+}
+var REALPATH_TTL_MS = 5e3;
+var REALPATH_CACHE_MAX = 1e3;
+var RealpathCache = class {
+  map = /* @__PURE__ */ new Map();
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (entry.expires <= Date.now()) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    if (this.map.size >= REALPATH_CACHE_MAX) {
+      const oldest = this.map.keys().next().value;
+      if (oldest !== void 0) this.map.delete(oldest);
+    }
+    this.map.set(key, { value, expires: Date.now() + REALPATH_TTL_MS });
+  }
+};
+var realpathCache = new RealpathCache();
+var resolvedPathCache = new RealpathCache();
+function realpathCached(p) {
+  const hit = realpathCache.get(p);
+  if (hit !== void 0) return hit;
+  let value;
+  try {
+    value = fs.realpathSync(p);
+  } catch {
+    value = null;
+  }
+  realpathCache.set(p, value);
+  return value;
+}
+function resolveRealPath(p, cwd) {
+  const start = path.isAbsolute(p) ? path.normalize(p) : path.resolve(cwd, p);
+  const hit = resolvedPathCache.get(start);
+  if (hit !== void 0) return hit;
+  const value = resolveRealPathUncached(start);
+  resolvedPathCache.set(start, value);
+  return value;
+}
+function resolveRealPathUncached(start) {
+  if (process.platform === "win32" && start.startsWith("\\\\")) {
+    return realpathCached(start) ?? start;
+  }
+  let current = start;
+  const missing = [];
+  for (; ; ) {
+    const resolved = realpathCached(current);
+    if (resolved !== null) {
+      return path.join(resolved, ...missing.reverse());
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    missing.push(path.basename(current));
+    current = parent;
+  }
+}
+function isOutsideResolved(p, cwd) {
+  const resolved = resolveRealPath(p, cwd);
+  if (resolved === null) return isOutsideCwd(p, cwd);
+  const realCwd = realpathCached(cwd);
+  if (realCwd === null) return isOutsideCwd(p, cwd);
+  return isOutsideCwd(resolved, realCwd);
+}
+function checkPermission(mode, req, ctx, allowRules = [], denyRules = [], askRules = []) {
+  if (mode === "yolo") {
+    return "allow";
+  }
+  const command = getStringArg(req.args, "command");
+  const filePath = getStringArg(req.args, "path");
+  const lex = req.toolName === "bash" && command !== void 0 ? /* @__PURE__ */ new Map() : void 0;
+  let bashTouchesSensitive = false;
+  if (req.toolName === "bash" && command !== void 0) {
+    if (isDangerousCommand(command, lex)) {
+      return "deny";
+    }
+    const hygiene = bashHygiene(command, lex);
+    if (hygiene.sensitive && hygiene.egress) {
+      return "deny";
+    }
+    bashTouchesSensitive = hygiene.sensitive;
+  }
+  if (FILE_TOOLS.has(req.toolName) && filePath !== void 0) {
+    const isWriteTool = req.toolName === "write_file" || req.toolName === "edit_file";
+    if (isWriteTool && isSensitivePath(filePath)) {
+      return "deny";
+    }
+    if (isOutsideResolved(filePath, ctx.cwd)) {
+      if (mode === "ask" && req.level === "read") {
+        return "ask";
+      }
+      return "deny";
+    }
+  }
+  if (isDeniedByRules(denyRules, req, lex)) {
+    return "deny";
+  }
+  if (mode === "auto") {
+    if (bashTouchesSensitive) {
+      return "ask";
+    }
+    if (isAskedByRules(askRules, req, lex)) {
+      return "ask";
+    }
+    return "allow";
+  }
+  if (mode === "readonly") {
+    return req.level === "read" ? "allow" : "deny";
+  }
+  if (mode === "plan") {
+    return req.level === "read" ? "allow" : "deny";
+  }
+  if (isAskedByRules(askRules, req, lex)) {
+    return "ask";
+  }
+  if (isAllowedByRules(allowRules, req, lex)) {
+    return "allow";
+  }
+  return req.level === "read" ? "allow" : "ask";
+}
+
+// src/session/title.ts
+import { generateText as generateText2 } from "ai";
+var TITLE_MAX_CHARS = 50;
+var TITLE_INPUT_MAX_CHARS = 1e3;
+var TITLE_MAX_TOKENS = 20;
+var TITLE_TIMEOUT_MS = 15e3;
+var TITLE_SYSTEM_PROMPT = [
+  "You write short titles for conversations.",
+  "Summarize the user's first message into a single concise title:",
+  "- at most 50 characters",
+  "- no surrounding quotes, no trailing punctuation",
+  "- same language as the user's message",
+  "Output only the title, nothing else."
+].join("\n");
+function sanitizeTitle(raw) {
+  let title = raw.trim().split("\n")[0]?.trim() ?? "";
+  let previous;
+  do {
+    previous = title;
+    title = title.replace(/^["'“”‘’「」『』\s]+|["'“”‘’「」『』\s]+$/g, "").replace(/[。．.!！?？…:：;；,，、\s]+$/u, "");
+  } while (title !== previous);
+  return title.slice(0, TITLE_MAX_CHARS).trim();
+}
+async function generateSessionTitle(userText, model) {
+  const { text } = await generateText2({
+    model,
+    system: TITLE_SYSTEM_PROMPT,
+    prompt: userText.slice(0, TITLE_INPUT_MAX_CHARS),
+    maxTokens: TITLE_MAX_TOKENS,
+    abortSignal: AbortSignal.timeout(TITLE_TIMEOUT_MS)
+  });
+  return sanitizeTitle(text);
+}
+function scheduleSessionTitle(store, userText, model) {
+  void (async () => {
+    const meta = await store.meta();
+    if (meta.title) return;
+    const title = await generateSessionTitle(userText, model);
+    if (!title) return;
+    const current = await store.meta();
+    if (current.title) return;
+    await store.setTitle(title);
+  })().catch(() => {
+  });
+}
+
+// src/agent/project-memory.ts
+import { readFileSync, statSync } from "fs";
+import path2 from "path";
+var PROJECT_MEMORY_FILE = "AGENTS.md";
+var PROJECT_MEMORY_MAX_CHARS = 32 * 1024;
+var cache = /* @__PURE__ */ new Map();
+function readProjectMemory(cwd) {
+  const file = path2.join(cwd, PROJECT_MEMORY_FILE);
+  let mtimeMs;
+  try {
+    mtimeMs = statSync(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  const hit = cache.get(file);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.block;
+  let block = null;
+  try {
+    let body = readFileSync(file, "utf8").trim();
+    if (body) {
+      if (body.length > PROJECT_MEMORY_MAX_CHARS) {
+        body = `${body.slice(0, PROJECT_MEMORY_MAX_CHARS)}
+
+[AGENTS.md truncated to ${PROJECT_MEMORY_MAX_CHARS} characters]`;
+      }
+      block = `# Project instructions (AGENTS.md)
+${body}`;
+    }
+  } catch {
+    block = null;
+  }
+  cache.set(file, { mtimeMs, block });
+  return block;
+}
+
+// src/agent/skills.ts
+import { readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "fs";
+import path3 from "path";
+import { z } from "zod";
+var SKILL_FILE = "SKILL.md";
+var SKILL_MAX_CHARS = 32 * 1024;
+var NAME_PATTERN = /^[a-z0-9-]+$/;
+function parseFrontmatter(raw) {
+  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) return null;
+  const meta = {};
+  for (const line of (match[1] ?? "").split(/\r?\n/)) {
+    const kv = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (kv?.[1]) meta[kv[1]] = (kv[2] ?? "").trim();
+  }
+  return { meta, body: raw.slice(match[0].length).trim() };
+}
+var cache2 = /* @__PURE__ */ new Map();
+function parseSkillFile(filePath, dirName, scope) {
+  let mtimeMs;
+  try {
+    mtimeMs = statSync2(filePath).mtimeMs;
+  } catch {
+    return null;
+  }
+  const hit = cache2.get(filePath);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.skill;
+  let skill = null;
+  try {
+    const parsed = parseFrontmatter(readFileSync2(filePath, "utf8"));
+    const name = parsed?.meta.name || dirName;
+    const description = parsed?.meta.description;
+    if (parsed && NAME_PATTERN.test(name) && description) {
+      skill = { name, description, filePath, dir: path3.dirname(filePath), scope };
+    }
+  } catch {
+    skill = null;
+  }
+  cache2.set(filePath, { mtimeMs, skill });
+  return skill;
+}
+function scanDir(base, scope, into) {
+  let entries;
+  try {
+    entries = readdirSync(base);
+  } catch {
+    return;
+  }
+  for (const entry of entries.sort()) {
+    if (!NAME_PATTERN.test(entry)) continue;
+    const parsed = parseSkillFile(path3.join(base, entry, SKILL_FILE), entry, scope);
+    if (parsed) into.set(parsed.name, parsed);
+  }
+}
+function discoverSkills(cwd, home = starHome()) {
+  const byName = /* @__PURE__ */ new Map();
+  scanDir(path3.join(home, "skills"), "user", byName);
+  scanDir(path3.join(cwd, ".star", "skills"), "project", byName);
+  return [...byName.values()];
+}
+function formatSkillsBlock(skills) {
+  const lines = skills.map((s) => `- ${s.name}: ${s.description}`);
+  return [
+    "# Available skills",
+    "When the user's request matches one of these skills, call the skill tool with its name to load the full instructions before proceeding:",
+    ...lines
+  ].join("\n");
+}
+function loadSkillBody(skill) {
+  let parsed = null;
+  try {
+    parsed = parseFrontmatter(readFileSync2(skill.filePath, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!parsed?.body) return null;
+  if (parsed.body.length > SKILL_MAX_CHARS) {
+    return `${parsed.body.slice(0, SKILL_MAX_CHARS)}
+
+[skill truncated to ${SKILL_MAX_CHARS} characters]`;
+  }
+  return parsed.body;
+}
+function createSkillTool(deps) {
+  return {
+    name: "skill",
+    description: "Load the full instructions of a skill by name. Available skills are listed in the system prompt when present; call this before starting work that matches one of them.",
+    permission: "read",
+    parameters: z.object({
+      name: z.string().describe("Name of the skill to load, as listed in the system prompt.")
+    }),
+    async execute(args) {
+      const skills = discoverSkills(deps.cwd, deps.home);
+      const skill = skills.find((s) => s.name === args.name);
+      if (!skill) {
+        const available = skills.map((s) => s.name).join(", ") || "none";
+        return {
+          content: `Unknown skill: "${args.name}". Available skills: ${available}`,
+          isError: true
+        };
+      }
+      const body = loadSkillBody(skill);
+      if (!body) {
+        return { content: `Skill "${skill.name}" is empty or unreadable.`, isError: true };
+      }
+      return {
+        content: [
+          `# Skill: ${skill.name}`,
+          "",
+          body,
+          "",
+          `Base directory for relative file references in this skill: ${skill.dir}`
+        ].join("\n")
+      };
+    }
+  };
+}
+
+// src/agent/subagent.ts
+import { randomUUID } from "crypto";
+import { z as z2 } from "zod";
+var MAX_SUBAGENT_DEPTH = 1;
+var MAX_REPORT_CHARS = 2e4;
+var SUBAGENT_PROMPT = "You are a subagent spawned to handle a focused subtask on behalf of the main agent. Work autonomously with the tools available to you. Your final text is returned to the main agent as the tool result \u2014 make it a self-contained report: state what you found or did, cite exact file paths with line numbers for anything the main agent may need to open, and note explicitly anything left undone or unverified. Report outcomes, not process.";
+var READ_ONLY_PROMPT = "This subtask is read-only: your tools cannot modify files, run shell commands, or kill tasks. Investigate and report; do not attempt changes.";
+function convertUsagePricing(usage, from, to, config, names) {
+  if (from === to) return usage;
+  const fromCfg = findModelPricing(config, names?.fromName, from.modelId);
+  const toCfg = findModelPricing(config, names?.toName, to.modelId);
+  if (fromCfg?.promptPrice === void 0 || fromCfg.completionPrice === void 0 || toCfg?.promptPrice === void 0 || toCfg.completionPrice === void 0 || toCfg.promptPrice <= 0 || toCfg.completionPrice <= 0) {
+    return usage;
+  }
+  const cached = Math.min(Math.max(usage.cachedPromptTokens ?? 0, 0), usage.promptTokens);
+  const promptUsd = (usage.promptTokens - cached) * fromCfg.promptPrice;
+  const cachedUsd = cached * (fromCfg.cacheReadPrice ?? fromCfg.promptPrice);
+  const cacheReadUsd = (usage.cacheReadInputTokens ?? 0) * (fromCfg.cacheReadPrice ?? 0);
+  const completionUsd = usage.completionTokens * fromCfg.completionPrice;
+  const scaledCached = cachedUsd / (toCfg.cacheReadPrice ?? toCfg.promptPrice);
+  const promptTokens = Math.round(promptUsd / toCfg.promptPrice + scaledCached);
+  const cachedPromptTokens = Math.round(scaledCached);
+  const toCacheReadPrice = toCfg.cacheReadPrice !== void 0 && toCfg.cacheReadPrice > 0 ? toCfg.cacheReadPrice : void 0;
+  const completionTokens = Math.round(
+    completionUsd / toCfg.completionPrice + (toCacheReadPrice === void 0 ? cacheReadUsd / toCfg.completionPrice : 0)
+  );
+  const cacheReadInputTokens = toCacheReadPrice === void 0 ? 0 : Math.round(cacheReadUsd / toCacheReadPrice);
+  const result = {
+    promptTokens,
+    completionTokens,
+    totalTokens: promptTokens + completionTokens
+  };
+  if (cachedPromptTokens > 0) result.cachedPromptTokens = cachedPromptTokens;
+  if (cacheReadInputTokens > 0) result.cacheReadInputTokens = cacheReadInputTokens;
+  return result;
+}
+function findModelPricing(config, name, modelId) {
+  if (name !== void 0) {
+    const byName = config.models.find((m) => m.name === name);
+    if (byName) return byName;
+  }
+  return config.models.find((m) => m.model === modelId);
+}
+async function runSubagent(deps, args, cwd, signal, agentIdRef) {
+  const { AgentLoop: AgentLoop2 } = await import("./loop-TW2FHL7J.js");
+  const child = new AgentLoop2({
+    model: deps.model,
+    registry: createDefaultRegistry(),
+    config: deps.config,
+    cwd,
+    system: deps.system ? `${deps.system}
+
+${SUBAGENT_PROMPT}${args.read_only ? `
+
+${READ_ONLY_PROMPT}` : ""}` : `${SUBAGENT_PROMPT}${args.read_only ? `
+
+${READ_ONLY_PROMPT}` : ""}`,
+    providerMetadata: deps.providerMetadata,
+    temperature: deps.temperature,
+    streamIdleTimeoutSec: deps.streamIdleTimeoutSec,
+    streamFirstChunkTimeoutSec: deps.streamFirstChunkTimeoutSec,
+    vision: deps.vision,
+    subagentDepth: deps.depth + 1,
+    readOnly: args.read_only,
+    modelName: deps.modelName,
+    // Read after the dynamic-import await: defaultAgentTasks.start() has
+    // returned by then, so a background spawn's ref.id is already assigned.
+    // Foreground spawns get a throwaway id.
+    agentId: agentIdRef?.id ?? `subagent-${randomUUID().slice(0, 8)}`
+  });
+  const confirmHandler = deps.getConfirmHandler?.();
+  if (confirmHandler) child.confirmHandler = confirmHandler;
+  let toolCalls = 0;
+  let error = null;
+  const usage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
+  try {
+    for await (const event of child.stream(args.prompt, signal)) {
+      if (event.type === "tool-result") {
+        toolCalls++;
+      } else if (event.type === "error") {
+        error = event.error.message;
+        break;
+      } else if (event.type === "finish" && event.usage) {
+        usage.promptTokens += event.usage.promptTokens;
+        usage.completionTokens += event.usage.completionTokens;
+        usage.totalTokens += usageTotalTokens(event.usage);
+        usage.cachedPromptTokens = (usage.cachedPromptTokens ?? 0) + (event.usage.cachedPromptTokens ?? 0);
+        usage.cacheReadInputTokens = (usage.cacheReadInputTokens ?? 0) + (event.usage.cacheReadInputTokens ?? 0);
+      }
+    }
+  } catch (e) {
+    error = e instanceof Error ? e.message : String(e);
+  } finally {
+    if (usage.totalTokens > 0) deps.onUsage?.(usage, deps.model, deps.modelName);
+  }
+  if (signal.aborted) {
+    throw new Error("Tool execution aborted.");
+  }
+  let report = "";
+  const messages = child.getMessages();
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message?.role !== "assistant" || !Array.isArray(message.content)) continue;
+    const text = message.content.filter((part) => part.type === "text").map((part) => part.text).join("");
+    if (text) {
+      report = text;
+      break;
+    }
+  }
+  if (report.length > MAX_REPORT_CHARS) {
+    report = `${report.slice(0, MAX_REPORT_CHARS)}
+... (truncated)`;
+  }
+  const tags = [
+    args.description ? `"${args.description}"` : null,
+    args.read_only ? "read-only" : null
+  ].filter(Boolean).join(" ");
+  const stats = `[subagent${tags ? ` ${tags}` : ""}: ${toolCalls} tool call(s)]`;
+  if (error) {
+    throw new Error([`Subagent failed: ${error}`, stats, report].filter(Boolean).join("\n"));
+  }
+  return `${stats}
+${report || "(subagent produced no text output)"}`;
+}
+function createSubagentTool(deps) {
+  return {
+    name: "subagent",
+    description: "Spawn a subagent with its own agent loop to handle a focused subtask (research, exploration, or an isolated change). The subagent has the same tools but cannot spawn further subagents, and it starts with zero context beyond what you write \u2014 brief it like a colleague who just walked in: state the goal, hand over what you already know (paths, identifiers, prior findings), and say exactly what the report should contain. Returns the subagent's final report. Prefer this for self-contained work that would otherwise clutter the main conversation. Set read_only for research, exploration, or review subtasks that must not modify anything. Set run_in_background to start it without blocking: independent subtasks then run concurrently and their reports are delivered to you automatically when they finish (also inspectable via task_list/task_output/task_kill).",
+    permission: "exec",
+    parameters: z2.object({
+      prompt: z2.string().describe(
+        "Complete, self-contained instructions for the subagent: the goal, everything you already know that it needs, and the expected report."
+      ),
+      description: z2.string().optional().describe("Short label for the subtask, shown in the result header."),
+      read_only: z2.boolean().optional().describe(
+        "Restrict the subagent to read-level tools \u2014 no file writes, no shell commands, no task kills (default false). Use for research, exploration, and review subtasks."
+      ),
+      run_in_background: z2.boolean().optional().describe(
+        "Run concurrently in the background and return a task id immediately (default false). Use for independent subtasks that can run in parallel."
+      )
+    }),
+    async execute(args, ctx) {
+      if (args.run_in_background) {
+        const ref = {};
+        const task = defaultAgentTasks.start(
+          (signal2) => runSubagent(deps, args, ctx.cwd, signal2, ref),
+          {
+            prompt: args.prompt,
+            description: args.description
+          }
+        );
+        ref.id = task.id;
+        const label = args.description ? ` "${args.description}"` : "";
+        return {
+          content: `Background subagent ${task.id}${label} started. Its report will be delivered as a message when it finishes; use task_list/task_output to check progress.`
+        };
+      }
+      const signal = ctx.abortSignal ?? new AbortController().signal;
+      try {
+        return { content: await runSubagent(deps, args, ctx.cwd, signal) };
+      } catch (e) {
+        return { content: e instanceof Error ? e.message : String(e), isError: true };
+      }
+    }
+  };
+}
+
+// src/agent/user-memory.ts
+import { appendFileSync, mkdirSync, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import path4 from "path";
+import { z as z3 } from "zod";
+var USER_MEMORY_MAX_CHARS = 32 * 1024;
+var REMEMBER_TEXT_MAX_CHARS = 500;
+var cache3 = /* @__PURE__ */ new Map();
+function readUserMemory(home = starHome()) {
+  const file = path4.join(home, "MEMORY.md");
+  let mtimeMs;
+  try {
+    mtimeMs = statSync3(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  const hit = cache3.get(file);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.block;
+  let block = null;
+  try {
+    let body = readFileSync3(file, "utf8").trim();
+    if (body) {
+      if (body.length > USER_MEMORY_MAX_CHARS) {
+        body = `${body.slice(0, USER_MEMORY_MAX_CHARS)}
+
+[MEMORY.md truncated to ${USER_MEMORY_MAX_CHARS} characters]`;
+      }
+      block = [
+        "# User memory (MEMORY.md)",
+        "The following notes were saved by the user across sessions. Respect them unless they conflict with the current request.",
+        body
+      ].join("\n");
+    }
+  } catch {
+    block = null;
+  }
+  cache3.set(file, { mtimeMs, block });
+  return block;
+}
+function appendUserMemory(text, home = starHome()) {
+  mkdirSync(home, { recursive: true });
+  appendFileSync(path4.join(home, "MEMORY.md"), `- ${text}
+`, "utf8");
+}
+function createRememberTool(deps = {}) {
+  return {
+    name: "remember",
+    description: `Save a note to the user's long-term memory (${userMemoryPath()}), injected into every future session. ONLY use when the user explicitly asks to remember or save something. Never use autonomously.`,
+    permission: "write",
+    parameters: z3.object({
+      text: z3.string().max(REMEMBER_TEXT_MAX_CHARS).describe("The note to save, as a single concise sentence.")
+    }),
+    async execute(args) {
+      appendUserMemory(args.text, deps.home);
+      return { content: `Saved to user memory: ${args.text}` };
+    }
+  };
+}
+
+// src/agent/loop.ts
+var PLAN_MODE_PROMPT = "\n\nYou are currently in PLAN MODE. Research the task using only the read-only tools available to you, then present a concrete, step-by-step implementation plan as your final answer. You must not modify files, run shell commands, or otherwise change the system \u2014 write/exec tools are unavailable in this mode. Do not ask the user to run commands for you; note manual steps in the plan instead. The user will review your plan and approve it before any execution begins.";
+var PENDING_WORK_PATTERN = /(?:我将|我会|我现在|接下来|下一步|下面(?:我|将)|稍后|随后|准备开始|现在开始|马上|即将|这就|待会|开始(?:执行|进行|处理|转换|动手|生成|写入|运行|创建)|(?:完成后|然后|接着)会|让我(?:们)?(?:来)?(?!知道)|I will|I'll|I am going to|I'm going to|I shall|\blet me(?!\s+know\b)|next,? I|I will now)/i;
+var AUTO_CONTINUE_NUDGE = "[auto-continue] You ended your turn with words instead of actions. Do not describe or restate the plan \u2014 continue the task NOW by calling tools. Reply with text only if the task is already fully complete.";
+var EMPTY_REPLY_NUDGE = "[auto-continue] Your previous reply was empty \u2014 no text and no tool calls. If the task is fully complete, reply with one short confirmation; otherwise continue NOW by calling tools.";
+var TRUNCATED_CONTINUE_NUDGE = "[auto-continue] Your previous reply was cut off mid-stream by a timeout \u2014 it is incomplete. Resume EXACTLY where you stopped: do not repeat or restate what you already wrote; continue with the next tool call or the remainder of the text.";
+function isFilteredEmptyFinish(finishReason) {
+  return finishReason === "content-filter";
+}
+function isSteerableEmptyFinish(finishReason) {
+  return finishReason === "stop" || finishReason === "content-filter";
+}
+function finalNudgeWarning(autoContinues, maxAutoContinues) {
+  return autoContinues >= maxAutoContinues ? " This is the final automatic continuation \u2014 if your next reply again has no tool calls, nudging stops and the turn is handed back to the user. Finish the work now or summarize what remains." : "";
+}
+var COMPLETION_CHECK_TIMEOUT_MS = 3e4;
+function attachTurnContext(messages, context) {
+  if (!context) return messages;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message?.role !== "user") continue;
+    const reminder = {
+      type: "text",
+      text: `<system-reminder>
+${context}
+</system-reminder>`
+    };
+    const content = typeof message.content === "string" ? message.content ? [reminder, { type: "text", text: message.content }] : [reminder] : [reminder, ...message.content];
+    const copy = messages.slice();
+    copy[i] = { ...message, content };
+    return copy;
+  }
+  return messages;
+}
+async function checkTaskComplete(model, request, finalReply, signal, temperature) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), COMPLETION_CHECK_TIMEOUT_MS);
+  const onAbort = () => controller.abort();
+  signal.addEventListener("abort", onAbort, { once: true });
+  try {
+    const { text } = await generateText3({
+      model,
+      maxTokens: 8,
+      temperature,
+      abortSignal: controller.signal,
+      prompt: [
+        "An AI coding agent was given this task by the user:",
+        `<task>
+${request.slice(0, 2e3)}
+</task>`,
+        "The agent has stopped calling tools and ended with this reply:",
+        `<reply>
+${finalReply.slice(0, 2e3)}
+</reply>`,
+        "Has the agent fully completed the task \u2014 every requested action actually performed, and the result verified by running a check (tests, build, or inspecting the produced output) rather than assumed? For a task that changed code, completion also requires tests covering the change when the project has a test setup, and a test run that actually passed \u2014 a reply that claims success without an observed green check is not complete. Or is it only describing, planning, or reporting progress with work still left? Answer with exactly one word: DONE or NOT_DONE."
+      ].join("\n")
+    });
+    const verdict = text.trim().toUpperCase();
+    if (verdict.startsWith("NOT_DONE")) return false;
+    if (verdict.startsWith("DONE")) return true;
+    return null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+var STREAM_RETRY_BASE_DELAY_MS = 1e3;
+var ABORT_STOP_HOOK_TIMEOUT_SEC = 3;
+var REDO_LABEL_MAX = 40;
+function stableStringify(value) {
+  if (value === void 0) return "undefined";
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const record = value;
+  const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+  return `{${entries.join(",")}}`;
+}
+function sleep(ms, signal) {
+  if (signal.aborted) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve(false);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(true);
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var AgentLoop = class {
+  // History with side-band meta: synthetic user messages (nudges, background
+  // reports, tool images) carry a MessageMeta so turn-boundary scans skip
+  // them; the model only ever sees the mapped CoreMessage view.
+  messages = [];
+  opts;
+  // Seq + user-message index of each turn started via stream(); lets /undo
+  // match a retracted turn to the file snapshots it produced. `tree` is the
+  // whole-tree git snapshot captured at the turn's start (root loop only,
+  // config.gitSnapshots) — when present, /undo restores it instead of
+  // replaying per-file snapshots, which also covers bash-made changes.
+  // Cleared when history is replaced wholesale (resume/compact), because
+  // indices no longer line up — in that case /undo only retracts messages,
+  // never wrong files.
+  turnMarkers = [];
+  // Pre-undo tree snapshots, latest last: a git-path /undo pushes the
+  // pre-undo working tree here so /redo can restore it exactly. Only the git
+  // path feeds this — per-file snapshot undos stay non-redoable.
+  redoStack = [];
+  // Start of the most recently retracted turn's user message; undoLastTurn
+  // consumes it as the redo label right after retractLastTurn sets it.
+  lastUndoneLabel = "";
+  // Doom-loop guard: signature of the most recent tool call and how many
+  // times in a row it has repeated. Any different call resets the count, and
+  // each new user turn restarts the streak.
+  lastToolSignature = null;
+  repeatedToolCalls = 0;
+  // Token usage subagents consumed, waiting to fold into this loop's next
+  // finish event with usage: sync children report when their tool call
+  // settles, background ones whenever they finish (drained or not).
+  // Consumers meter only root-loop finish events, so folding here bills
+  // subagent spend with zero consumer changes — /cost, /usage and
+  // sessionBudgetUsd all cover it. A background child still running when the
+  // session's last finish has passed never reports (best effort, noted in
+  // agent-tasks cleanup paths).
+  subagentUsage = null;
+  // Turn context of the in-flight stream() turn, stamped onto every tool
+  // execution so file snapshots attribute root changes to a turn and mark
+  // subagent changes as excluded from turn-level retraction.
+  activeTurnSeq = 0;
+  activeTurnUserIndex = -1;
+  titleScheduled = false;
+  titleInput;
+  // Rendered git context for the in-flight turn (null when unavailable);
+  // snapshotted at turn start so every step of the turn sends the same block.
+  turnGitContext = null;
+  // Request-view cache: the CoreMessage[] sent to the model, with the turn's
+  // volatile context already attached. Rebuilt only when the history actually
+  // changed — the cache key is the history array's identity plus its length
+  // (wholesale rewrites like compaction/image-stripping replace the array,
+  // appends grow it; history messages are never mutated in place) and the
+  // turn context string. Saves a full toCoreMessages + attachTurnContext copy
+  // per stream attempt, which retried steps used to pay every time.
+  requestMessagesCache = null;
+  // Memoized per (registry, plan flag): tools register on the registry only
+  // at loop construction, and the plan filter re-reads the live permission
+  // mode on every call — so a built map stays valid until either input
+  // changes, and a runtime mode switch rebuilds exactly once. schemaTokens
+  // (the tool map's share of the request window) is computed alongside since
+  // it depends on the same inputs.
+  aiToolsCache = null;
+  // Lazily resolved auxiliary model (config.smallModel) for cheap side calls
+  // — compaction summaries, session titles, completion checks. Undefined =
+  // use the main model; a resolution failure is surfaced once as a notice.
+  auxModelResolved = false;
+  auxModelValue;
+  auxTemperatureValue;
+  auxModelError = null;
+  confirmHandler;
+  // Hook failures never block the turn (except an explicit PreToolUse block);
+  // their stderr surfaces through this callback (REPL system message / stderr
+  // in print mode).
+  onHookWarning;
+  constructor(opts) {
+    this.opts = opts;
+    const depth = opts.subagentDepth ?? 0;
+    if (depth > 0) {
+      opts.registry = new ToolRegistry(new TodoStore());
+    } else {
+      setTodoPersistGuard(() => {
+        const mode = this.opts.config.permissionMode;
+        return mode !== "readonly" && mode !== "plan";
+      });
+    }
+    if (opts.system) {
+      this.messages.push({ message: { role: "system", content: opts.system } });
+    }
+    if (opts.sessionStore) {
+      this.bindSnapshotHooks(opts.sessionStore);
+    }
+    opts.registry?.register(createSkillTool({ cwd: opts.cwd }));
+    opts.registry?.register(createRememberTool());
+    if (opts.registry && depth < MAX_SUBAGENT_DEPTH) {
+      opts.registry.register(
+        createSubagentTool({
+          model: opts.model,
+          config: opts.config,
+          cwd: opts.cwd,
+          system: opts.system,
+          providerMetadata: opts.providerMetadata,
+          temperature: opts.temperature,
+          streamIdleTimeoutSec: opts.streamIdleTimeoutSec,
+          streamFirstChunkTimeoutSec: opts.streamFirstChunkTimeoutSec,
+          vision: opts.vision,
+          depth,
+          modelName: opts.modelName,
+          getConfirmHandler: () => this.confirmHandler,
+          onUsage: (usage, childModel, childModelName) => this.addSubagentUsage(usage, childModel, childModelName)
+        })
+      );
+    }
+    if (opts.readOnly && depth > 0) {
+      opts.registry?.retain((tool) => tool.permission === "read");
+    }
+  }
+  // CoreMessage view of the history (meta stripped): what the model, the
+  // display and the token estimator consume. Element identity is preserved,
+  // so the estimator's per-object cache (context/tokens.ts) still hits.
+  getMessages() {
+    return toCoreMessages(this.messages);
+  }
+  // Full-fidelity view including the side-band meta; for flows that must not
+  // lose synthetic-message markers (model switch, manual /compact).
+  getStarMessages() {
+    return this.messages;
+  }
+  // Wire-schema token overhead of the active tool set (memoized by
+  // buildAiTools). The auto-compact budget includes it; surfaced here so the
+  // status bar ctx% can show the same total the compaction decision uses.
+  getToolSchemaTokens() {
+    return this.buildAiTools().schemaTokens;
+  }
+  // Auxiliary model for cheap side calls: config.smallModel, resolved once.
+  // An unresolvable name/key degrades to the main model instead of breaking
+  // turns; the failure rides out once as a notice at the next turn start.
+  resolveAuxModel() {
+    if (this.auxModelResolved) return;
+    this.auxModelResolved = true;
+    const name = this.opts.config.smallModel;
+    if (!name) return;
+    try {
+      this.auxModelValue = createModel(this.opts.config, name);
+      this.auxTemperatureValue = resolveModelConfig(this.opts.config, name).temperature ?? this.opts.temperature;
+    } catch (error) {
+      this.auxModelError = `smallModel "${name}" could not be resolved (${error instanceof Error ? error.message : String(error)}); using the main model for auxiliary calls.`;
+    }
+  }
+  getAuxModel() {
+    this.resolveAuxModel();
+    return this.auxModelValue ?? this.opts.model;
+  }
+  getAuxTemperature() {
+    this.resolveAuxModel();
+    return this.auxModelValue ? this.auxTemperatureValue : this.opts.temperature;
+  }
+  // Rebinds the per-call provider metadata (e.g. after the reasoning effort
+  // for the current model changed via /model) without recreating the loop.
+  setProviderMetadata(metadata) {
+    this.opts.providerMetadata = metadata;
+  }
+  // Swaps the persistence target (/new starts a fresh session mid-REPL).
+  // Title generation is re-armed so the new session gets one after its first
+  // turn, and snapshot checkpoints now flow to the new store. The redo stack
+  // dies with the old session context: its trees describe working-tree states
+  // that no longer line up with the new session's conversation. Subagent
+  // usage still waiting to fold belongs to the old conversation too — it
+  // must not bill the new session's first finish.
+  setSessionStore(store) {
+    this.opts.sessionStore = store;
+    this.titleScheduled = false;
+    this.titleInput = void 0;
+    this.redoStack = [];
+    this.subagentUsage = null;
+    if (store) this.bindSnapshotHooks(store);
+  }
+  bindSnapshotHooks(store) {
+    setSnapshotHooks({
+      onPush: (snapshot) => store.appendCheckpoint(
+        {
+          id: snapshot.id,
+          timestamp: snapshot.timestamp,
+          path: snapshot.path,
+          existed: snapshot.existed,
+          toolName: snapshot.toolName,
+          turn: snapshot.turn,
+          messageIndex: snapshot.messageIndex,
+          owner: snapshot.owner,
+          contentTooLarge: snapshot.contentTooLarge
+        },
+        snapshot.content
+      ),
+      onRemove: (ids) => store.removeCheckpoints(ids)
+    });
+  }
+  async loadMessages(messages) {
+    this.messages = reconcileStarMessages(messages.map(toStarMessage));
+    this.turnMarkers = [];
+    this.redoStack = [];
+    this.subagentUsage = null;
+    this.opts.registry?.resetVolatileState();
+  }
+  // Read-only counterpart of retractLastTurn: how many messages /undo would
+  // drop, which snapshot turn's file changes it would revert (undefined =
+  // no verified turn, so no file snapshots may be reverted), and the turn's
+  // whole-tree snapshot when one was captured. Mutates nothing, so the REPL
+  // can show the preview before the user confirms.
+  previewLastTurnRetraction() {
+    const result = retractLastTurn([...this.messages]);
+    if (result.removed === 0) return { removed: 0 };
+    const userIndex = result.messages.length;
+    const last = this.turnMarkers[this.turnMarkers.length - 1];
+    const verified = last && last.userIndex === userIndex;
+    return {
+      removed: result.removed,
+      turn: verified ? last.seq : void 0,
+      tree: verified ? last.tree : void 0
+    };
+  }
+  // Drops the final user message and everything after it, and persists the
+  // trimmed history so a later /resume does not bring the turn back.
+  // `turn` is the retracted turn's snapshot seq when it could be verified
+  // against the marker recorded at turn start — undefined means the caller
+  // must not revert any file snapshots. `tree` is the turn's whole-tree
+  // snapshot when git snapshots tracked it.
+  async retractLastTurn() {
+    const result = retractLastTurn([...this.messages]);
+    if (result.removed === 0) return { removed: 0 };
+    const userIndex = result.messages.length;
+    this.lastUndoneLabel = coreMessageText(this.messages[userIndex]?.message).slice(
+      0,
+      REDO_LABEL_MAX
+    );
+    this.messages = result.messages;
+    await this.opts.sessionStore?.replaceMessages([...this.messages]);
+    this.opts.registry?.resetVolatileState();
+    const last = this.turnMarkers[this.turnMarkers.length - 1];
+    let turn;
+    let tree;
+    if (last && last.userIndex === userIndex) {
+      turn = last.seq;
+      tree = last.tree;
+      this.turnMarkers.pop();
+    }
+    return { removed: result.removed, turn, tree };
+  }
+  // The confirmed /undo: retract the last turn, then revert its file changes.
+  // With a whole-tree snapshot the working tree is restored from git — which
+  // also reverts changes no tool snapshot saw (bash edits, deleted files) —
+  // and the turn's per-file snapshots are dropped instead of replayed (they
+  // would double-restore). The pre-undo tree feeds the redo stack, so /redo
+  // returns to the exact state before the undo. Any git failure falls back
+  // to the per-file snapshot revert, which never pushes the redo stack.
+  async undoLastTurn() {
+    const { removed, turn, tree } = await this.retractLastTurn();
+    if (removed === 0) return { removed, reverted: [] };
+    if (turn !== void 0 && tree !== void 0) {
+      const preUndoTree = await trackTree(this.opts.cwd);
+      if (preUndoTree !== null && await restoreTree(this.opts.cwd, tree)) {
+        this.redoStack.push({ tree: preUndoTree, label: this.lastUndoneLabel });
+        const dropped = await dropTurnSnapshots(turn, true);
+        return {
+          removed,
+          reverted: [
+            `Restored the working tree from the git snapshot taken at the turn's start (${tree.slice(0, 8)}; covers changes from any tool, bash included; ${dropped} per-file snapshot(s) discarded).`
+          ],
+          tree
+        };
+      }
+    }
+    const reverted = turn !== void 0 ? await undoTurnSnapshots(turn) : [];
+    return { removed, reverted };
+  }
+  // The redo entry /redo would restore, without popping it (for the confirm
+  // prompt); null when there is nothing to redo.
+  peekRedo() {
+    return this.redoStack[this.redoStack.length - 1] ?? null;
+  }
+  // Restores the working tree to its state just before the last git-path
+  // /undo. Conversation messages are not re-added — redo is file-level only.
+  // The entry stays on the stack when the restore fails, so it can be retried.
+  async redoLastUndo() {
+    const entry = this.redoStack[this.redoStack.length - 1];
+    if (!entry) return null;
+    const names = await diffTreeNames(this.opts.cwd, entry.tree);
+    if (!await restoreTree(this.opts.cwd, entry.tree)) {
+      return { ok: false, tree: entry.tree, label: entry.label, files: null };
+    }
+    this.redoStack.pop();
+    return { ok: true, tree: entry.tree, label: entry.label, files: names?.length ?? null };
+  }
+  // Cut point for a rewind: messages[index] should be the user message that
+  // started the rewound turn, but compaction may have shifted indices, so
+  // walk back to the nearest real user message — a synthetic one (nudge,
+  // background report, tool image) belongs to the turn before it and is
+  // never a boundary. Never touches a leading system message.
+  retractionCut(index) {
+    const clamped = Math.max(0, Math.min(index, this.messages.length - 1));
+    for (let i = clamped; i >= 0; i--) {
+      const star = this.messages[i];
+      if (star && star.message.role === "user" && !isSyntheticUserMessage(star)) return i;
+    }
+    return this.messages[0]?.message.role === "system" ? 1 : 0;
+  }
+  countRetraction(index) {
+    return this.messages.length - this.retractionCut(index);
+  }
+  // Truncates the history back to the given message index (the user message
+  // at that index and everything after it is dropped) and persists the
+  // trimmed history, so /rewind stays consistent across resume. The redo
+  // stack dies with the rewound context: its entries describe pre-/undo
+  // working-tree states that no longer line up with this conversation, so
+  // restoring one would clobber the rewound tree.
+  async retractFromIndex(index) {
+    const cut = this.retractionCut(index);
+    const removed = this.messages.length - cut;
+    if (removed === 0) return 0;
+    this.messages = this.messages.slice(0, cut);
+    await this.opts.sessionStore?.replaceMessages([...this.messages]);
+    this.opts.registry?.resetVolatileState();
+    this.turnMarkers = this.turnMarkers.filter((m) => m.userIndex < cut);
+    this.redoStack = [];
+    return removed;
+  }
+  async appendContextMessage(text, role = "user") {
+    const message = { role, content: text };
+    this.messages.push({ message });
+    await this.persist(message);
+  }
+  async persist(message, meta) {
+    await this.opts.sessionStore?.append(message, meta);
+  }
+  // Replaces oversized image parts in the in-memory history with text
+  // placeholders and rewrites the persisted session, so the failed request
+  // can be resent and a later resume never carries the offending images.
+  async stripOversizedImages() {
+    const { messages, removed } = stripOversizedImages(toCoreMessages(this.messages));
+    if (removed === 0) return 0;
+    this.messages = this.messages.map((star, i) => ({
+      message: messages[i] ?? star.message,
+      meta: star.meta
+    }));
+    await this.opts.sessionStore?.replaceMessages(this.messages);
+    return removed;
+  }
+  // Same rewrite as above, but for text-only endpoints that reject any image
+  // at all: every image part in the history is replaced with a placeholder,
+  // which also heals sessions already poisoned by an attached image.
+  async stripAllImages() {
+    const { messages, removed } = stripAllImages(toCoreMessages(this.messages));
+    if (removed === 0) return 0;
+    this.messages = this.messages.map((star, i) => ({
+      message: messages[i] ?? star.message,
+      meta: star.meta
+    }));
+    await this.opts.sessionStore?.replaceMessages(this.messages);
+    return removed;
+  }
+  // Background title generation runs once per loop, fed by the first real
+  // user message of the session. It must NOT latch on the first assistant
+  // step's text: that text is empty for a tool-call-only first step (the
+  // common agentic case), which used to burn the one-shot flag on an empty
+  // input and left every such session untitled. The store-level title check
+  // makes resumed sessions that already have a title a no-op.
+  maybeScheduleTitle() {
+    if (this.titleScheduled) return;
+    const store = this.opts.sessionStore;
+    if (!store) return;
+    const input = this.titleInput;
+    if (!input) return;
+    this.titleScheduled = true;
+    scheduleSessionTitle(store, input, this.getAuxModel());
+  }
+  // A user interrupt (Esc) ends the turn mid-stream, before the normal
+  // assistant-message persistence runs. Whatever text and tool calls already
+  // arrived are still persisted — the text marked with "[interrupted]" so the
+  // cut-off stays visible after a resume and the model can tell its reply was
+  // cut short — and streamed tool calls are closed with synthetic results so
+  // the stored history stays valid for the API.
+  async *persistInterrupted(text, toolCalls) {
+    if (text.length === 0 && toolCalls.length === 0) return;
+    const assistantMessage = {
+      role: "assistant",
+      content: [
+        ...text ? [{ type: "text", text: `${text} [interrupted]` }] : [],
+        ...toolCalls.map((call) => ({
+          type: "tool-call",
+          toolCallId: call.id,
+          toolName: call.name,
+          args: call.args
+        }))
+      ]
+    };
+    this.messages.push({ message: assistantMessage });
+    await this.persist(assistantMessage);
+    for (const call of toolCalls) {
+      const content = INTERRUPTED_TOOL_RESULT_TEXT;
+      const synthetic = {
+        role: "tool",
+        content: [
+          {
+            type: "tool-result",
+            toolCallId: call.id,
+            toolName: call.name,
+            result: content
+          }
+        ]
+      };
+      this.messages.push({ message: synthetic });
+      await this.persist(synthetic).catch(() => {
+      });
+      yield { type: "tool-result", id: call.id, name: call.name, content, isError: true };
+    }
+  }
+  async *stream(input, signal, opts) {
+    this.syncSystemMessage();
+    const git = getGitSummaryCached(this.opts.cwd);
+    this.turnGitContext = git ? formatGitSummary(git) : null;
+    this.requestMessagesCache = null;
+    this.resolveAuxModel();
+    if (this.auxModelError) {
+      yield { type: "notice", message: this.auxModelError };
+      this.auxModelError = null;
+    }
+    const inputText = typeof input === "string" ? input : input.text;
+    const images = typeof input === "string" ? [] : input.images;
+    if (this.titleInput === void 0 && inputText.trim().length > 0) {
+      this.titleInput = inputText;
+    }
+    const userMessage = images.length > 0 ? {
+      role: "user",
+      content: [
+        ...images.map((img) => ({
+          type: "image",
+          image: img.data,
+          mimeType: img.mimeType
+        })),
+        { type: "text", text: inputText }
+      ]
+    } : { role: "user", content: inputText };
+    const isRoot = (this.opts.subagentDepth ?? 0) === 0;
+    const trackTreePromise = isRoot && this.opts.config.gitSnapshots ? trackTree(this.opts.cwd) : null;
+    this.messages.push({ message: userMessage });
+    const seq = isRoot ? beginTurn(this.messages.length - 1) : currentTurnSeq();
+    const turnMarker = {
+      seq,
+      userIndex: this.messages.length - 1
+    };
+    this.turnMarkers.push(turnMarker);
+    this.activeTurnSeq = seq;
+    this.activeTurnUserIndex = this.messages.length - 1;
+    let turnTreeReady = null;
+    if (trackTreePromise !== null) {
+      turnTreeReady = trackTreePromise.catch(() => null).then((tree) => {
+        if (tree !== null && this.turnMarkers.includes(turnMarker)) {
+          turnMarker.tree = tree;
+        }
+      });
+    }
+    await this.persist(
+      opts?.persistAs !== void 0 ? { role: "user", content: opts.persistAs } : userMessage
+    );
+    this.maybeScheduleTitle();
+    const { config, registry, cwd } = this.opts;
+    const { tools: aiTools, schemaTokens: toolSchemaTokens } = this.buildAiTools();
+    this.lastToolSignature = null;
+    this.repeatedToolCalls = 0;
+    let autoContinues = 0;
+    let lastWasNudge = false;
+    let usedToolsThisTurn = false;
+    let streamCutContinues = 0;
+    let openTodos = [];
+    const maxSteps = config.maxSteps;
+    let step = 0;
+    let toolExecutedSinceCheckpoint = false;
+    for (; ; ) {
+      if (maxSteps > 0 && step >= maxSteps) {
+        if (!toolExecutedSinceCheckpoint) {
+          yield {
+            type: "error",
+            error: {
+              name: "Error",
+              message: `Max steps (${maxSteps}) reached with no tool execution since the last checkpoint, stopping.`
+            }
+          };
+          await this.runStopHooks("max-steps");
+          return;
+        }
+        toolExecutedSinceCheckpoint = false;
+        step = 0;
+        yield {
+          type: "notice",
+          message: `maxSteps (${maxSteps}) reached and the turn is still making progress; continuing. Press Esc to interrupt.`
+        };
+      }
+      if ((this.opts.subagentDepth ?? 0) === 0) {
+        for (const finished of defaultAgentTasks.drainNotifications()) {
+          const label = finished.description ? ` "${finished.description}"` : "";
+          const note = {
+            role: "user",
+            content: `[background subagent ${finished.id}${label} ${finished.status}]
+${finished.result}`
+          };
+          const meta = { synthetic: "bg-report" };
+          this.messages.push({ message: note, meta });
+          await this.persist(note, meta);
+        }
+      }
+      const maxTokens = this.opts.contextMaxTokens ?? config.contextMaxTokens;
+      const threshold = resolveCompactThreshold(config, maxTokens);
+      const elided = elideStaleContent(this.messages, threshold, toolSchemaTokens);
+      if (elided) {
+        this.messages = elided.messages;
+        await this.opts.sessionStore?.replaceMessages([...this.messages]);
+        this.opts.registry?.resetVolatileState();
+      }
+      const compacted = compactMessages(this.messages, threshold, {
+        overheadTokens: toolSchemaTokens
+      });
+      if (compacted.compacted) {
+        this.messages = await this.applyCompactionSummary(compacted, signal);
+        await this.opts.sessionStore?.replaceMessages([...this.messages]);
+        this.turnMarkers = [];
+        this.opts.registry?.resetVolatileState();
+      }
+      const maxRetries = Math.max(0, config.streamMaxRetries);
+      const baseDelay = this.opts.retryDelayMs ?? STREAM_RETRY_BASE_DELAY_MS;
+      let text = "";
+      const toolCalls = [];
+      let failure = null;
+      let lastFinishReason;
+      let lastUsage;
+      let sawReasoning = false;
+      let wasTruncated = false;
+      let oversizedImagesStripped = false;
+      let visionUnsupportedStripped = false;
+      const hasOutput = () => text.trim().length > 0 || toolCalls.length > 0;
+      for (let attempt = 0; ; attempt++) {
+        text = "";
+        toolCalls.length = 0;
+        failure = null;
+        lastFinishReason = void 0;
+        lastUsage = void 0;
+        sawReasoning = false;
+        wasTruncated = false;
+        const timeoutScale = Math.min(attempt + 1, 3);
+        try {
+          for await (const event of this.streamOnce(aiTools, signal, timeoutScale)) {
+            if (event.type === "text-delta") {
+              text += event.text;
+              yield event;
+            } else if (event.type === "reasoning") {
+              sawReasoning = true;
+              yield event;
+            } else if (event.type === "tool-call") {
+              toolCalls.push({ id: event.id, name: event.name, args: event.args });
+              yield event;
+            } else if (event.type === "finish") {
+              lastFinishReason = event.finishReason;
+              if (event.truncated) wasTruncated = true;
+              lastUsage = event.usage;
+              yield this.foldSubagentUsage(event);
+            } else if (event.type === "error") {
+              failure = event.error;
+            } else {
+              yield event;
+            }
+          }
+        } catch (error) {
+          if (!signal.aborted) {
+            failure = toStreamErrorInfo(error);
+          }
+        }
+        if (signal.aborted) {
+          yield* this.persistInterrupted(text, toolCalls);
+          await this.runStopHooks("aborted");
+          return;
+        }
+        if (!failure && hasOutput()) break;
+        if (failure && !oversizedImagesStripped && isOversizedImageError(failure)) {
+          oversizedImagesStripped = true;
+          const removed = await this.stripOversizedImages();
+          if (removed > 0) {
+            yield {
+              type: "notice",
+              message: `Removed ${removed} oversized image(s) the model rejected; retrying the request.`
+            };
+            continue;
+          }
+        }
+        if (failure && !visionUnsupportedStripped && isVisionUnsupportedError(failure)) {
+          visionUnsupportedStripped = true;
+          const removed = await this.stripAllImages();
+          if (removed > 0) {
+            yield {
+              type: "notice",
+              message: `Removed ${removed} image(s) the model cannot read; retrying the request.`
+            };
+            continue;
+          }
+        }
+        if (failure && !isRetryableStreamError(failure)) break;
+        if (attempt >= maxRetries) break;
+        if (!failure && !hasOutput() && attempt >= 1 && (isFilteredEmptyFinish(lastFinishReason) || sawReasoning || lastUsage !== void 0 && lastUsage.completionTokens > 0))
+          break;
+        const delayMs = computeRetryDelayMs(attempt, failure ? baseDelay : baseDelay * 2, failure);
+        yield {
+          type: "retry",
+          attempt: attempt + 2,
+          maxAttempts: maxRetries + 1,
+          delayMs,
+          reason: failure ? summarizeStreamError(failure) : `empty response (finish: ${lastFinishReason ?? "none"})`
+        };
+        if (!await sleep(delayMs, signal)) {
+          yield* this.persistInterrupted(text, toolCalls);
+          await this.runStopHooks("aborted");
+          return;
+        }
+      }
+      if (failure) {
+        yield { type: "error", error: failure };
+        await this.runStopHooks("error");
+        return;
+      }
+      if (!hasOutput()) {
+        if (isSteerableEmptyFinish(lastFinishReason) && config.permissionMode !== "plan" && autoContinues < config.maxAutoContinues) {
+          autoContinues++;
+          lastWasNudge = true;
+          yield {
+            type: "notice",
+            message: `the model returned an empty reply; asking the model to continue (${autoContinues}/${config.maxAutoContinues}).`
+          };
+          const nudge = {
+            role: "user",
+            content: EMPTY_REPLY_NUDGE + finalNudgeWarning(autoContinues, config.maxAutoContinues)
+          };
+          const meta = { synthetic: "nudge" };
+          this.messages.push({ message: nudge, meta });
+          await this.persist(nudge, meta);
+          continue;
+        }
+        yield {
+          type: "error",
+          error: {
+            name: "Error",
+            message: "The model returned an empty response after retries; ending the turn."
+          }
+        };
+        await this.runStopHooks("empty");
+        return;
+      }
+      const assistantMessage = {
+        role: "assistant",
+        content: [
+          ...text ? [{ type: "text", text }] : [],
+          ...toolCalls.map((call) => ({
+            type: "tool-call",
+            toolCallId: call.id,
+            toolName: call.name,
+            args: call.args
+          }))
+        ]
+      };
+      this.messages.push({ message: assistantMessage });
+      await this.persist(assistantMessage);
+      if (toolCalls.length === 0) {
+        if (wasTruncated) {
+          if (config.permissionMode !== "plan" && streamCutContinues < config.streamMaxRetries) {
+            streamCutContinues++;
+            yield {
+              type: "notice",
+              message: `reply cut short by a stream timeout; asking the model to resume where it stopped (${streamCutContinues}/${config.streamMaxRetries}).`
+            };
+            const nudge = { role: "user", content: TRUNCATED_CONTINUE_NUDGE };
+            const meta = { synthetic: "nudge" };
+            this.messages.push({ message: nudge, meta });
+            await this.persist(nudge, meta);
+            continue;
+          }
+          if (config.permissionMode !== "plan") {
+            yield {
+              type: "notice",
+              message: 'reply was cut short by a stream timeout and resume attempts are exhausted, handing the turn back \u2014 reply "continue" to keep going.'
+            };
+          }
+          await this.runStopHooks("completed");
+          return;
+        }
+        let reason = null;
+        let nudgeText = AUTO_CONTINUE_NUDGE;
+        if (openTodos.length > 0) {
+          reason = `${openTodos.length} todo item(s) still open`;
+          nudgeText = `[auto-continue] You ended your turn with unfinished todo item(s): ${openTodos.map((t) => `"${t}"`).join(
+            ", "
+          )}. Complete them now with tool calls, or update the list with todo_write if they are no longer needed.`;
+        } else if (usedToolsThisTurn && !signal.aborted) {
+          const complete = await checkTaskComplete(
+            this.getAuxModel(),
+            inputText,
+            text,
+            signal,
+            this.getAuxTemperature()
+          );
+          if (complete === false) {
+            reason = "completion check reports the task unfinished";
+          } else if (complete === null) {
+            if (lastWasNudge) {
+              reason = "reply still had no tool calls";
+            } else if (PENDING_WORK_PATTERN.test(text)) {
+              reason = "reply announced unfinished work";
+            }
+          }
+        } else if (lastWasNudge) {
+          reason = "reply still had no tool calls";
+        } else if (PENDING_WORK_PATTERN.test(text)) {
+          reason = "reply announced unfinished work";
+        }
+        if (reason !== null && config.permissionMode !== "plan" && autoContinues < config.maxAutoContinues) {
+          autoContinues++;
+          lastWasNudge = true;
+          yield {
+            type: "notice",
+            message: `${reason}; asking the model to continue (${autoContinues}/${config.maxAutoContinues}).`
+          };
+          const nudge = {
+            role: "user",
+            content: nudgeText + finalNudgeWarning(autoContinues, config.maxAutoContinues)
+          };
+          const meta = { synthetic: "nudge" };
+          this.messages.push({ message: nudge, meta });
+          await this.persist(nudge, meta);
+          continue;
+        }
+        if (reason !== null && config.permissionMode !== "plan") {
+          yield {
+            type: "notice",
+            message: `${reason}; auto-continue limit reached, handing the turn back \u2014 reply "continue" to keep going.`
+          };
+        }
+        await this.runStopHooks("completed");
+        return;
+      }
+      lastWasNudge = false;
+      usedToolsThisTurn = true;
+      autoContinues = 0;
+      if (turnTreeReady !== null) {
+        await turnTreeReady;
+        turnTreeReady = null;
+      }
+      const answered = /* @__PURE__ */ new Set();
+      const pendingImages = [];
+      try {
+        for (const call of toolCalls) {
+          if (signal.aborted) break;
+          const refusal = this.doomLoopRefusal(call);
+          if (refusal !== null) {
+            yield { type: "notice", message: refusal };
+          } else {
+            toolExecutedSinceCheckpoint = true;
+          }
+          const result = refusal !== null ? { content: refusal, isError: true } : await this.executeTool(call, signal);
+          const toolMessage = {
+            role: "tool",
+            content: [
+              {
+                type: "tool-result",
+                toolCallId: call.id,
+                toolName: call.name,
+                result: result.content
+              }
+            ]
+          };
+          this.messages.push({ message: toolMessage });
+          await this.persist(toolMessage);
+          answered.add(call.id);
+          if (result.images && result.images.length > 0) {
+            const imageMessage = {
+              role: "user",
+              content: [
+                ...result.images.map((img) => ({
+                  type: "image",
+                  image: img.data,
+                  mimeType: img.mimeType
+                })),
+                ...result.images.map((img) => ({
+                  type: "text",
+                  text: `[image from ${call.name}: ${img.path}]`
+                }))
+              ]
+            };
+            pendingImages.push({ message: imageMessage, meta: { synthetic: "tool-image" } });
+          }
+          if (call.name === "todo_write" && !result.isError) {
+            openTodos = pendingTodoTitles(call.args);
+          }
+          yield {
+            type: "tool-result",
+            id: call.id,
+            name: call.name,
+            content: result.content,
+            isError: result.isError
+          };
+        }
+      } finally {
+        for (const call of toolCalls) {
+          if (answered.has(call.id)) continue;
+          const content = signal.aborted ? INTERRUPTED_TOOL_RESULT_TEXT : UNFINISHED_TOOL_RESULT_TEXT;
+          const synthetic = {
+            role: "tool",
+            content: [
+              {
+                type: "tool-result",
+                toolCallId: call.id,
+                toolName: call.name,
+                result: content
+              }
+            ]
+          };
+          this.messages.push({ message: synthetic });
+          await this.persist(synthetic).catch(() => {
+          });
+          yield { type: "tool-result", id: call.id, name: call.name, content, isError: true };
+        }
+        for (const { message, meta } of pendingImages) {
+          this.messages.push({ message, meta });
+          await this.persist(message, meta).catch(() => {
+          });
+        }
+      }
+      if (signal.aborted) {
+        await this.runStopHooks("aborted");
+        return;
+      }
+      step++;
+    }
+  }
+  // The permission mode can change at runtime, so the system message is
+  // recomputed at the start of every turn instead of being frozen by the
+  // constructor. Also restores a system message after loadMessages() (resume,
+  // /model switch) replaced the history with one that has none. Everything in
+  // here is stable across turns (base prompt, plan-mode flag, memories, skills
+  // — the latter two cached by mtime), which keeps the prompt-cache prefix
+  // intact; volatile git state rides per-turn on the latest user message
+  // instead (attachTurnContext).
+  syncSystemMessage() {
+    const base = this.opts.system;
+    const plan = this.opts.config.permissionMode === "plan";
+    const parts = [];
+    if (base) parts.push(base);
+    if (plan) parts.push(PLAN_MODE_PROMPT.trim());
+    const memory = readProjectMemory(this.opts.cwd);
+    if (memory) parts.push(memory);
+    const userMemory = readUserMemory();
+    if (userMemory) parts.push(userMemory);
+    const skills = discoverSkills(this.opts.cwd);
+    if (skills.length > 0) parts.push(formatSkillsBlock(skills));
+    if (parts.length === 0) return;
+    const content = parts.join("\n\n");
+    const head = this.messages[0];
+    if (head?.message.role === "system" && typeof head.message.content === "string") {
+      if (head.message.content !== content) {
+        this.messages[0] = { message: { role: "system", content } };
+      }
+    } else if (head?.message.role !== "system") {
+      this.messages.unshift({ message: { role: "system", content } });
+    }
+  }
+  async applyCompactionSummary(compacted, signal) {
+    const { config } = this.opts;
+    if (config.contextCompaction !== "summary") {
+      return compacted.messages;
+    }
+    const headCount = compacted.messages[0]?.message.role === "system" ? 1 : 0;
+    const dropped = toCoreMessages(
+      this.messages.slice(headCount, headCount + compacted.droppedCount)
+    );
+    try {
+      const summary = await summarizeMessages(
+        dropped,
+        this.getAuxModel(),
+        signal,
+        this.getAuxTemperature()
+      );
+      if (summary.trim().length === 0) return compacted.messages;
+      const messages = compacted.messages.slice();
+      messages[headCount] = {
+        message: {
+          role: "user",
+          content: `[earlier conversation summarized]
+${summary}`
+        }
+      };
+      return messages;
+    } catch {
+      return compacted.messages;
+    }
+  }
+  async *streamOnce(aiTools, signal, timeoutScale = 1) {
+    for await (const event of streamChat({
+      model: this.opts.model,
+      messages: this.buildRequestMessages(),
+      tools: aiTools,
+      abortSignal: signal,
+      providerMetadata: this.opts.providerMetadata,
+      idleTimeoutMs: (this.opts.streamIdleTimeoutSec ?? this.opts.config.streamIdleTimeoutSec) * 1e3 * timeoutScale,
+      firstPartTimeoutMs: (this.opts.streamFirstChunkTimeoutSec ?? this.opts.config.streamFirstChunkTimeoutSec) * 1e3 * timeoutScale,
+      temperature: this.opts.temperature
+    })) {
+      if (event.type === "finish" && event.truncated) {
+        yield {
+          type: "notice",
+          message: "Response was cut short by the stream idle timeout \u2014 the reply may be incomplete."
+        };
+      }
+      yield event;
+    }
+  }
+  // The CoreMessage[] view sent to the model, with the turn's volatile git
+  // context attached to the latest user message (request-only — the result is
+  // never persisted, see attachTurnContext). Memoized within a turn: stream
+  // retries and multi-step turns rebuild only when the history changed
+  // (new array identity after a wholesale rewrite, or a new length after
+  // appends) or the turn context changed.
+  buildRequestMessages() {
+    const cached = this.requestMessagesCache;
+    if (cached && cached.source === this.messages && cached.length === this.messages.length && cached.context === this.turnGitContext) {
+      return cached.result;
+    }
+    const result = attachTurnContext(toCoreMessages(this.messages), this.turnGitContext);
+    this.requestMessagesCache = {
+      source: this.messages,
+      length: this.messages.length,
+      context: this.turnGitContext,
+      result
+    };
+    return result;
+  }
+  buildAiTools() {
+    const plan = this.opts.config.permissionMode === "plan";
+    const registry = this.opts.registry;
+    const cached = this.aiToolsCache;
+    if (cached && cached.registry === registry && cached.plan === plan) {
+      return { tools: cached.tools, schemaTokens: cached.schemaTokens };
+    }
+    const tools = {};
+    for (const t of registry.list()) {
+      if (plan && t.permission !== "read") continue;
+      tools[t.name] = aiTool({
+        description: t.description,
+        parameters: t.parameters
+      });
+    }
+    const schemaTokens = estimateToolSchemaTokens(tools);
+    this.aiToolsCache = { registry, plan, tools, schemaTokens };
+    return { tools, schemaTokens };
+  }
+  // Fires the Stop hooks for a turn's end, on every termination path (normal
+  // completion, Esc abort, exhausted stream retries, terminal empty replies,
+  // the maxSteps no-progress stop). The reason rides in STAR_TOOL_INPUT as
+  // {"reason": ...}: Stop hooks ignore tool matchers and the variable was
+  // never set for Stop before, so existing hooks are unaffected. An abort is
+  // the user waiting at the prompt, so its hooks get a short leash instead
+  // of the hooks' own (default 30s) timeouts.
+  async runStopHooks(reason) {
+    await this.runEventHooks(
+      "Stop",
+      void 0,
+      { reason },
+      reason === "aborted" ? ABORT_STOP_HOOK_TIMEOUT_SEC : void 0
+    );
+  }
+  async runEventHooks(event, toolName, toolInput, timeoutSec) {
+    const empty = { blocked: false, warnings: [] };
+    if (this.opts.config.hooks.length === 0) return empty;
+    try {
+      const result = await runHooks(
+        event,
+        this.opts.config.hooks,
+        {
+          cwd: this.opts.cwd,
+          sessionId: this.opts.sessionStore?.id,
+          toolName,
+          toolInput
+        },
+        timeoutSec !== void 0 ? { timeoutSec } : void 0
+      );
+      for (const warning of result.warnings) this.onHookWarning?.(warning);
+      return result;
+    } catch {
+      return empty;
+    }
+  }
+  // Accumulates a settled subagent's usage. When the child provably ran on a
+  // different, fully priced model, the counts are first converted into
+  // this-model-priced equivalents (convertUsagePricing): session cost is
+  // token totals × the active model's price, so the conversion keeps the $
+  // estimate accurate where raw sums would misprice. Price lookup goes by
+  // the [[models]] entry names both loops were resolved from, not model id.
+  addSubagentUsage(usage, childModel, childModelName) {
+    const converted = convertUsagePricing(usage, childModel, this.opts.model, this.opts.config, {
+      fromName: childModelName,
+      toName: this.opts.modelName
+    });
+    const pending = this.subagentUsage ?? {
+      promptTokens: 0,
+      completionTokens: 0,
+      totalTokens: 0
+    };
+    pending.promptTokens += converted.promptTokens;
+    pending.completionTokens += converted.completionTokens;
+    pending.totalTokens += usageTotalTokens(converted);
+    if (converted.cachedPromptTokens) {
+      pending.cachedPromptTokens = (pending.cachedPromptTokens ?? 0) + converted.cachedPromptTokens;
+    }
+    if (converted.cacheReadInputTokens) {
+      pending.cacheReadInputTokens = (pending.cacheReadInputTokens ?? 0) + converted.cacheReadInputTokens;
+    }
+    this.subagentUsage = pending;
+  }
+  // Folds pending subagent usage into an outgoing finish event (and clears
+  // it). A finish without usage reports nothing to consumers, so the pending
+  // amount is kept for the next finish that carries usage instead. Totals
+  // sum the billed classes (usageTotalTokens), not whatever extra classes a
+  // provider folded into its reported totalTokens.
+  foldSubagentUsage(event) {
+    const pending = this.subagentUsage;
+    if (!pending || !event.usage) return event;
+    this.subagentUsage = null;
+    const usage = {
+      promptTokens: event.usage.promptTokens + pending.promptTokens,
+      completionTokens: event.usage.completionTokens + pending.completionTokens,
+      totalTokens: usageTotalTokens(event.usage) + usageTotalTokens(pending)
+    };
+    const cachedPromptTokens = (event.usage.cachedPromptTokens ?? 0) + (pending.cachedPromptTokens ?? 0);
+    const cacheReadInputTokens = (event.usage.cacheReadInputTokens ?? 0) + (pending.cacheReadInputTokens ?? 0);
+    if (cachedPromptTokens > 0) usage.cachedPromptTokens = cachedPromptTokens;
+    if (cacheReadInputTokens > 0) usage.cacheReadInputTokens = cacheReadInputTokens;
+    return { ...event, usage };
+  }
+  // opencode's doom_loop guard: returns a refusal once the identical tool
+  // call (name + stable-serialized args) has repeated config.doomLoopThreshold
+  // times in a row; 0 disables. Any different signature resets the streak.
+  // Subagents are separate loop instances, so each counts its own streak.
+  doomLoopRefusal(call) {
+    const threshold = this.opts.config.doomLoopThreshold;
+    if (threshold <= 0) return null;
+    const signature = `${call.name} ${stableStringify(call.args)}`;
+    if (signature === this.lastToolSignature) {
+      this.repeatedToolCalls += 1;
+    } else {
+      this.lastToolSignature = signature;
+      this.repeatedToolCalls = 1;
+    }
+    if (this.repeatedToolCalls < threshold) return null;
+    return `Refused: tool "${call.name}" was called ${this.repeatedToolCalls} times in a row with identical arguments. Stop retrying it \u2014 change your approach or report that you are blocked.`;
+  }
+  async executeTool(call, signal) {
+    const { registry, config, cwd } = this.opts;
+    const tool = registry.get(call.name);
+    if (!tool) {
+      return { content: `Unknown tool: ${call.name}`, isError: true };
+    }
+    const decision = checkPermission(
+      config.permissionMode,
+      { toolName: call.name, args: call.args, level: tool.permission },
+      { cwd },
+      config.permissions.allow,
+      config.permissions.deny,
+      config.permissions.ask
+    );
+    if (decision === "deny") {
+      return { content: `Permission denied for tool "${call.name}".`, isError: true };
+    }
+    if (decision === "ask") {
+      let approved = false;
+      try {
+        approved = this.confirmHandler ? await this.confirmHandler({
+          toolName: call.name,
+          args: call.args,
+          level: tool.permission
+        }) : false;
+      } catch {
+        approved = false;
+      }
+      if (!approved) {
+        return { content: `User rejected tool "${call.name}".`, isError: true };
+      }
+    }
+    const parsed = tool.parameters.safeParse(call.args);
+    if (!parsed.success) {
+      return { content: `Invalid arguments: ${parsed.error.message}`, isError: true };
+    }
+    const pre = await this.runEventHooks("PreToolUse", call.name, call.args);
+    if (pre.blocked) {
+      return {
+        content: `Tool "${call.name}" blocked by a PreToolUse hook: ${pre.reason}`,
+        isError: true
+      };
+    }
+    let result;
+    try {
+      result = await tool.execute(parsed.data, {
+        cwd,
+        abortSignal: signal,
+        agentId: this.opts.agentId ?? "root",
+        visionEnabled: this.opts.vision !== false,
+        snapshotContext: {
+          owner: (this.opts.subagentDepth ?? 0) > 0 ? "subagent" : "root",
+          turn: this.activeTurnSeq,
+          messageIndex: this.activeTurnUserIndex
+        }
+      });
+    } catch (error) {
+      if (signal.aborted) {
+        return { content: "Tool execution aborted.", isError: true };
+      }
+      return {
+        content: `Tool error: ${error instanceof Error ? error.message : String(error)}`,
+        isError: true
+      };
+    }
+    if (!result.isError) {
+      await this.runEventHooks("PostToolUse", call.name, call.args);
+    }
+    return result;
+  }
+};
+
+export {
+  estimateTokens,
+  summarizeMessages,
+  compactMessages,
+  WORKING_DIFF_MAX_LINES,
+  isGitRepo,
+  getGitSummaryCached,
+  collectCommitContext,
+  buildCommitPrompt,
+  collectWorkingDiff,
+  isAllowedByRules,
+  buildAllowRule,
+  isDangerousCommand,
+  discoverSkills,
+  appendUserMemory,
+  PLAN_MODE_PROMPT,
+  attachTurnContext,
+  AgentLoop
+};
+//# sourceMappingURL=chunk-MNVCCOI2.js.map