@cydm/pie 1.0.23 → 1.0.25

package/dist/chunks/{chunk-4WU5VAX4.js → chunk-BEWVRLCP.js}

@@ -2,16 +2,15 @@ import { createRequire as __createRequire } from "node:module"; const require =
 import {
   classifyShellCommand,
   createCodeIntelTool,
-  createLightweightCodeIntelProvider,
   createSharedWebFetchTool,
   createSharedWebResearchTool,
   createSharedWebSearchTool,
   interpretShellExit,
   requestInteraction
-} from "./chunk-AFTBFF6J.js";
+} from "./chunk-O4DPFYYP.js";
 import {
   Type
-} from "./chunk-7ABSJC2D.js";
+} from "./chunk-64XJIKVK.js";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, renameSync } from "fs";
@@ -75,6 +74,9 @@ function getCustomThemesDir() {
 function getSettingsPath() {
   return join(getConfigDir(), "settings.json");
 }
+function getProjectSettingsPath(cwd) {
+  return join(cwd, CONFIG_DIR_NAME, "settings.json");
+}
 function getSessionsDir() {
   return join(getConfigDir(), "sessions");
 }
@@ -125,14 +127,54 @@ function migrateConfigFromAgentDir() {
 
 // src/capabilities/bash/index.ts
 import { spawn } from "child_process";
-import { createWriteStream, existsSync as existsSync2, statSync, writeFileSync } from "fs";
+import { closeSync, createWriteStream, existsSync as existsSync2, openSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
-import { randomBytes } from "crypto";
+import { join as join2, resolve as resolve2 } from "path";
+import { createHash, randomBytes } from "crypto";
 
 // src/capabilities/bash/truncate.ts
-var DEFAULT_MAX_LINES = 2e3;
-var DEFAULT_MAX_BYTES = 50 * 1024;
+var DEFAULT_MAX_LINES = 400;
+var DEFAULT_MAX_BYTES = 16 * 1024;
+function truncateHeadTail(content, options = {}) {
+  const maxLines = options.maxLines ?? DEFAULT_MAX_LINES;
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const totalBytes = Buffer.byteLength(content, "utf-8");
+  const lines = content.split("\n");
+  if (lines.length <= maxLines && totalBytes <= maxBytes) return truncateTail(content, options);
+  const headCount = Math.max(1, Math.floor(maxLines / 2));
+  const tailCount = Math.max(1, maxLines - headCount);
+  let head = lines.slice(0, headCount);
+  let tail = lines.slice(-tailCount);
+  const omittedNotice = () => `... [truncated: ${Math.max(0, lines.length - head.length - tail.length)} middle lines omitted] ...`;
+  let combined = () => [...head, omittedNotice(), ...tail].join("\n");
+  while (Buffer.byteLength(combined(), "utf-8") > maxBytes && (head.length > 1 || tail.length > 1)) {
+    if (head.length >= tail.length && head.length > 1) head.pop();
+    else if (tail.length > 1) tail.shift();
+  }
+  let output = combined();
+  let lastLinePartial = false;
+  if (Buffer.byteLength(output, "utf-8") > maxBytes) {
+    const marker = "\n... [truncated middle] ...\n";
+    const available = Math.max(2, maxBytes - Buffer.byteLength(marker, "utf-8"));
+    const bytes = Buffer.from(content, "utf-8");
+    const prefix = bytes.subarray(0, Math.floor(available / 2)).toString("utf-8").replace(/\uFFFD+$/g, "");
+    const suffix = bytes.subarray(Math.max(0, bytes.length - Math.ceil(available / 2))).toString("utf-8").replace(/^\uFFFD+/g, "");
+    output = `${prefix}${marker}${suffix}`;
+    lastLinePartial = true;
+  }
+  return {
+    content: output,
+    truncated: true,
+    truncatedBy: lines.length > maxLines ? "lines" : "bytes",
+    totalLines: lines.length,
+    totalBytes,
+    outputLines: head.length + tail.length,
+    outputBytes: Buffer.byteLength(output, "utf-8"),
+    lastLinePartial,
+    maxLines,
+    maxBytes
+  };
+}
 function formatSize(bytes) {
   if (bytes < 1024) {
     return `${bytes}B`;
@@ -217,7 +259,7 @@ var bashSchema = Type.Object({
   command: Type.String({ description: "The bash command to execute" }),
   timeout: Type.Optional(
     Type.Number({
-      description: "Timeout in seconds. Default: 120s (2 minutes). For longer tasks, explicitly set a higher value: { timeout: 600 } for npm install, { timeout: 600 } for cargo build, etc."
+      description: "Timeout in seconds. Default: 120s (2 minutes). Longer timeouts are honored for installs, builds, and tests; generic custom scripts and polling commands are capped to protect the turn budget."
     })
   ),
   cwd: Type.Optional(Type.String({ description: "Working directory for the command" })),
@@ -229,6 +271,23 @@ var bashSchema = Type.Object({
   ], { description: "Shell to use. Defaults to bash on macOS/Linux and PowerShell on Windows. Use this only for platform-specific commands." }))
 });
 var DEFAULT_TIMEOUT_SECONDS = 120;
+var MAX_GENERIC_TIMEOUT_SECONDS = 120;
+function resolveTimeoutPolicy(requestedTimeout, commandClass) {
+  const requestedSeconds = requestedTimeout ?? DEFAULT_TIMEOUT_SECONDS;
+  if (requestedSeconds > MAX_GENERIC_TIMEOUT_SECONDS && commandClass !== "package_manager" && commandClass !== "test_or_build") {
+    return {
+      requestedSeconds,
+      effectiveSeconds: MAX_GENERIC_TIMEOUT_SECONDS,
+      capped: true,
+      reason: `long timeouts are capped at ${MAX_GENERIC_TIMEOUT_SECONDS}s for non-build commands`
+    };
+  }
+  return {
+    requestedSeconds,
+    effectiveSeconds: requestedSeconds,
+    capped: false
+  };
+}
 function validateBashCommand(command) {
   const value = typeof command === "string" ? command : "";
   const trimmed = value.trim();
@@ -263,7 +322,7 @@ function buildSpawnCommand(shell, command) {
   if (shell === "cmd") {
     return { file: "cmd.exe", args: ["/d", "/s", "/c", command], shell: false };
   }
-  return { file: command, args: [], shell: true };
+  return { file: process.platform === "win32" ? "bash.exe" : "bash", args: ["-c", command], shell: false };
 }
 async function requestHighRiskConfirmation(request) {
   const response = await requestInteraction({
@@ -296,24 +355,101 @@ function validateWorkingDirectory(cwd) {
 }
 function normalizeWorkingDirectory(cwd, defaultCwd) {
   const requestedCwd = typeof cwd === "string" && cwd.trim().length > 0 ? cwd.trim() : void 0;
-  return requestedCwd ?? defaultCwd ?? process.cwd();
+  return resolve2(requestedCwd ?? defaultCwd ?? process.cwd());
 }
 function getTempFilePath() {
   const id = randomBytes(8).toString("hex");
   return join2(tmpdir(), `pie-bash-${id}.log`);
 }
+var retainedOutputArtifacts = /* @__PURE__ */ new Set();
+function getErrorCode(error) {
+  if (!error || typeof error !== "object" || !("code" in error)) return void 0;
+  const code = error.code;
+  return typeof code === "string" ? code : void 0;
+}
+function createPrivateOutputArtifact() {
+  for (let attempt = 0; attempt < 10; attempt++) {
+    const path3 = getTempFilePath();
+    try {
+      const fd = openSync(path3, "wx", 384);
+      retainedOutputArtifacts.add(path3);
+      try {
+        return { path: path3, stream: createWriteStream(path3, { fd, autoClose: true }) };
+      } catch (error) {
+        closeSync(fd);
+        removeOutputArtifact(path3);
+        throw error;
+      }
+    } catch (error) {
+      if (getErrorCode(error) !== "EEXIST") throw error;
+    }
+  }
+  throw new Error("Unable to allocate a private bash output artifact.");
+}
+function removeOutputArtifact(path3) {
+  if (!path3) return;
+  try {
+    unlinkSync(path3);
+  } catch (error) {
+    if (getErrorCode(error) !== "ENOENT") throw error;
+  }
+  retainedOutputArtifacts.delete(path3);
+}
+function discardOutputArtifact(path3, stream) {
+  if (stream && !stream.closed) {
+    stream.once("close", () => {
+      try {
+        removeOutputArtifact(path3);
+      } catch {
+      }
+    });
+    stream.destroy();
+  }
+  try {
+    removeOutputArtifact(path3);
+  } catch {
+  }
+}
+function cleanupBashOutputArtifacts() {
+  for (const path3 of [...retainedOutputArtifacts]) {
+    try {
+      removeOutputArtifact(path3);
+    } catch {
+    }
+  }
+}
+process.once("exit", cleanupBashOutputArtifacts);
 function finishTempFileStream(stream) {
-  if (!stream) return Promise.resolve();
+  if (!stream || stream.closed) return Promise.resolve();
   return new Promise((resolve3, reject) => {
-    const onError = (error) => {
+    let done = false;
+    const cleanup = () => {
+      stream.off("close", onClose);
       stream.off("error", onError);
-      reject(error);
     };
-    stream.once("error", onError);
-    stream.end(() => {
-      stream.off("error", onError);
+    const onClose = () => {
+      if (done) return;
+      done = true;
+      cleanup();
       resolve3();
-    });
+    };
+    const onError = (error) => {
+      if (done) return;
+      done = true;
+      cleanup();
+      reject(error instanceof Error ? error : new Error(String(error)));
+    };
+    stream.once("close", onClose);
+    stream.once("error", onError);
+    try {
+      if (!stream.writableEnded) {
+        stream.end();
+      } else if (stream.closed) {
+        onClose();
+      }
+    } catch (error) {
+      onError(error);
+    }
   });
 }
 function buildBashRecoveryHint(command, output) {
@@ -346,10 +482,22 @@ function killProcessTree(pid) {
   }
 }
 function createBashTool(defaultCwd, options) {
+  const recentCommands = /* @__PURE__ */ new Map();
+  const rememberCommandResult = (key, fingerprint) => {
+    const previous = recentCommands.get(key);
+    const count = (previous?.count ?? 0) + 1;
+    const sameResult = previous?.fingerprint === fingerprint;
+    recentCommands.set(key, { count, fingerprint });
+    if (recentCommands.size > 100) {
+      const oldest = recentCommands.keys().next().value;
+      if (oldest) recentCommands.delete(oldest);
+    }
+    return { count, sameResult };
+  };
   return {
     name: "bash",
     label: "bash",
-    description: `Execute a shell command in the current working directory. The public tool name remains bash for compatibility; on Windows shell:auto uses PowerShell, otherwise bash. Returns stdout and stderr. Output is truncated to last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). If truncated, full output is saved to a temp file. Default timeout: 120s. Use timeout parameter for longer tasks (e.g., npm install -> 600).`,
+    description: `Execute a shell command in the current working directory. The public tool name remains bash for compatibility; on Windows shell:auto uses PowerShell, otherwise bash. Returns stdout and stderr as a bounded head/tail preview of at most ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB. If truncated, the result includes a private full-output artifact path. Default timeout: 120s. Long timeouts are reserved for installs, builds, and tests; custom scripts, searches, and polling commands are capped at ${MAX_GENERIC_TIMEOUT_SECONDS}s and should be split into bounded steps with progress output.`,
     parameters: bashSchema,
     execute: async (_toolCallId, { command, timeout, cwd, shell }, signal, onUpdate) => {
       validateBashCommand(command);
@@ -357,7 +505,10 @@ function createBashTool(defaultCwd, options) {
       const effectiveCommand = buildEffectiveCommand(command, options);
       const workingDir = normalizeWorkingDirectory(cwd, defaultCwd);
       validateWorkingDirectory(workingDir);
-      const risk = classifyShellCommand(effectiveCommand, resolvedShell);
+      const risk = classifyShellCommand(effectiveCommand, resolvedShell, {
+        cwd: workingDir,
+        sandboxRoot: defaultCwd ?? workingDir
+      });
       if (risk.destructive && !options?.isYoloMode?.()) {
         const approved = await (options?.confirm ?? requestHighRiskConfirmation)({
           command: effectiveCommand,
@@ -388,7 +539,8 @@ function createBashTool(defaultCwd, options) {
           };
         }
       }
-      const timeoutMs = (timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1e3;
+      const timeoutPolicy = resolveTimeoutPolicy(timeout, risk.commandClass);
+      const timeoutMs = timeoutPolicy.effectiveSeconds * 1e3;
       return new Promise((resolve3, reject) => {
         if (signal?.aborted) {
           reject(new Error("Operation aborted"));
@@ -396,13 +548,25 @@ function createBashTool(defaultCwd, options) {
         }
         let tempFilePath;
         let tempFileStream;
+        let settled = false;
         let totalBytes = 0;
         const chunks = [];
         let chunksBytes = 0;
         const maxChunksBytes = DEFAULT_MAX_BYTES * 2;
+        const headChunks = [];
+        let headBytes = 0;
+        let totalNewlines = 0;
+        const maxHeadBytes = Math.floor(DEFAULT_MAX_BYTES / 2);
+        const captureHead = (data) => {
+          totalNewlines += data.reduce((count, byte) => count + (byte === 10 ? 1 : 0), 0);
+          if (headBytes >= maxHeadBytes) return;
+          const prefix = data.subarray(0, maxHeadBytes - headBytes);
+          headChunks.push(prefix);
+          headBytes += prefix.length;
+        };
         let timedOut = false;
         const spawnCommand = buildSpawnCommand(resolvedShell, effectiveCommand);
-        const child = spawn(spawnCommand.file, spawnCommand.args, {
+        const child = (options?.spawnProcess ?? spawn)(spawnCommand.file, spawnCommand.args, {
           shell: spawnCommand.shell,
           cwd: workingDir,
           env: process.env,
@@ -414,19 +578,33 @@ function createBashTool(defaultCwd, options) {
             killProcessTree(child.pid);
           }
         }, timeoutMs);
-        const onAbort = () => {
+        const failExecution = (error) => {
+          if (settled) return;
+          settled = true;
           clearTimeout(timeoutId);
-          if (child.pid) {
-            killProcessTree(child.pid);
-          }
-          reject(new Error("Operation aborted"));
+          signal?.removeEventListener("abort", onAbort);
+          if (child.pid) killProcessTree(child.pid);
+          discardOutputArtifact(tempFilePath, tempFileStream);
+          reject(error);
+        };
+        const onAbort = () => {
+          failExecution(new Error("Operation aborted"));
         };
         signal?.addEventListener("abort", onAbort, { once: true });
         child.stdout?.on("data", (data) => {
+          if (settled) return;
           totalBytes += data.length;
+          captureHead(data);
           if (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {
-            tempFilePath = getTempFilePath();
-            tempFileStream = createWriteStream(tempFilePath);
+            try {
+              const artifact = createPrivateOutputArtifact();
+              tempFilePath = artifact.path;
+              tempFileStream = artifact.stream;
+              tempFileStream.once("error", failExecution);
+            } catch (error) {
+              failExecution(error instanceof Error ? error : new Error(String(error)));
+              return;
+            }
             for (const chunk of chunks) {
               tempFileStream.write(chunk);
             }
@@ -443,7 +621,7 @@ function createBashTool(defaultCwd, options) {
           if (onUpdate) {
             const fullBuffer = Buffer.concat(chunks);
             const fullText = fullBuffer.toString("utf-8");
-            const truncation = truncateTail(fullText);
+            const truncation = truncateHeadTail(fullText);
             onUpdate({
               content: [{ type: "text", text: truncation.content || "" }],
               details: {
@@ -460,6 +638,7 @@ function createBashTool(defaultCwd, options) {
                 shell: resolvedShell,
                 commandClass: risk.commandClass,
                 riskWarnings: risk.riskWarnings,
+                timeoutPolicy,
                 permissionDecision: {
                   allowed: true,
                   requiresPermission: risk.requiresPermission
@@ -469,10 +648,19 @@ function createBashTool(defaultCwd, options) {
           }
         });
         child.stderr?.on("data", (data) => {
+          if (settled) return;
           totalBytes += data.length;
+          captureHead(data);
           if (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {
-            tempFilePath = getTempFilePath();
-            tempFileStream = createWriteStream(tempFilePath);
+            try {
+              const artifact = createPrivateOutputArtifact();
+              tempFilePath = artifact.path;
+              tempFileStream = artifact.stream;
+              tempFileStream.once("error", failExecution);
+            } catch (error) {
+              failExecution(error instanceof Error ? error : new Error(String(error)));
+              return;
+            }
             for (const chunk of chunks) {
               tempFileStream.write(chunk);
             }
@@ -491,13 +679,32 @@ function createBashTool(defaultCwd, options) {
           try {
             clearTimeout(timeoutId);
             signal?.removeEventListener("abort", onAbort);
+            if (settled) return;
             const fullBuffer = Buffer.concat(chunks);
             let fullOutput = fullBuffer.toString("utf-8");
-            const truncation = truncateTail(fullOutput);
+            if (totalBytes > fullBuffer.length) {
+              fullOutput = `${Buffer.concat(headChunks).toString("utf-8")}
+... [stream middle omitted] ...
+${fullOutput}`;
+            }
+            const truncation = truncateHeadTail(fullOutput);
+            if (totalBytes > truncation.totalBytes) {
+              truncation.truncated = true;
+              truncation.totalBytes = totalBytes;
+              truncation.totalLines = totalNewlines + 1;
+              truncation.truncatedBy = totalNewlines + 1 > DEFAULT_MAX_LINES ? "lines" : "bytes";
+            }
             let outputText = truncation.content || "(no output)";
             if (truncation.truncated && !tempFilePath) {
-              tempFilePath = getTempFilePath();
-              writeFileSync(tempFilePath, fullOutput, "utf-8");
+              const path3 = getTempFilePath();
+              const fd = openSync(path3, "wx", 384);
+              tempFilePath = path3;
+              retainedOutputArtifacts.add(path3);
+              try {
+                writeFileSync(fd, fullOutput, "utf-8");
+              } finally {
+                closeSync(fd);
+              }
             }
             await finishTempFileStream(tempFileStream);
             const details = {
@@ -507,6 +714,7 @@ function createBashTool(defaultCwd, options) {
               shell: resolvedShell,
               commandClass: risk.commandClass,
               riskWarnings: risk.riskWarnings,
+              timeoutPolicy,
               permissionDecision: {
                 allowed: true,
                 requiresPermission: risk.requiresPermission
@@ -525,29 +733,26 @@ function createBashTool(defaultCwd, options) {
                 outputLines: truncation.outputLines
               };
               details.fullOutputPath = tempFilePath;
-              const startLine = truncation.totalLines - truncation.outputLines + 1;
-              const endLine = truncation.totalLines;
               if (truncation.lastLinePartial) {
-                const lastLineSize = formatSize(
-                  Buffer.byteLength(fullOutput.split("\n").pop() || "", "utf-8")
-                );
                 outputText += `
 
-[Showing last ${formatSize(truncation.outputBytes)} of line ${endLine} (line is ${lastLineSize}). Full output: ${tempFilePath}]`;
-              } else if (truncation.truncatedBy === "lines") {
-                outputText += `
-
-[Showing lines ${startLine}-${endLine} of ${truncation.totalLines}. Full output: ${tempFilePath}]`;
+[Head/tail preview limited to ${formatSize(truncation.outputBytes)}. Full output: ${tempFilePath}]`;
               } else {
                 outputText += `
 
-[Showing lines ${startLine}-${endLine} of ${truncation.totalLines} (${formatSize(DEFAULT_MAX_BYTES)} limit). Full output: ${tempFilePath}]`;
+[Showing a bounded head/tail preview of ${truncation.totalLines} lines (${formatSize(DEFAULT_MAX_BYTES)} limit). Full output: ${tempFilePath}]`;
               }
             }
             if (timedOut) {
               outputText += `
 
-[Command timed out after ${timeout ?? DEFAULT_TIMEOUT_SECONDS} seconds]`;
+[Command timed out after ${timeoutPolicy.effectiveSeconds} seconds]`;
+              outputText += "\n[Timeout hint: split custom searches or service polls into smaller bounded steps with progress output, inspect partial results/logs, then make a decision. Avoid repeating long waits. Reserve long timeouts for installs, builds, and tests.]";
+            }
+            if (timeoutPolicy.capped) {
+              outputText += `
+
+[Timeout policy: requested ${timeoutPolicy.requestedSeconds} seconds, capped to ${timeoutPolicy.effectiveSeconds} seconds because ${timeoutPolicy.reason}.]`;
             }
             const recoveryHint = buildBashRecoveryHint(command, outputText);
             if (recoveryHint) {
@@ -555,19 +760,25 @@ function createBashTool(defaultCwd, options) {
 
 [Recovery hint: ${recoveryHint}]`;
             }
+            const repeatedCommand = rememberCommandResult(
+              `${resolvedShell}\0${workingDir}\0${effectiveCommand}`,
+              createHash("sha256").update(JSON.stringify({ code, sig, timedOut, outputText })).digest("hex")
+            );
+            details.repeatedCommand = repeatedCommand;
+            if (repeatedCommand.count > 1 && repeatedCommand.sameResult) {
+              outputText += "\n\n[Repeat hint: this exact command already returned the same result in this session. If it proves the task, stop; otherwise change the command or inspect a different file/range.]";
+            }
             const content = [{ type: "text", text: outputText }];
+            settled = true;
             resolve3({ content, details, isError: timedOut || semantic.isError });
           } catch (error) {
+            discardOutputArtifact(tempFilePath, tempFileStream);
+            settled = true;
             reject(error);
           }
         });
         child.on("error", (err) => {
-          clearTimeout(timeoutId);
-          signal?.removeEventListener("abort", onAbort);
-          if (tempFileStream) {
-            tempFileStream.end();
-          }
-          reject(new Error(`Failed to start bash command in ${workingDir}: ${err.message}. Check that the command is executable and cwd exists.`));
+          failExecution(new Error(`Failed to start bash command in ${workingDir}: ${err.message}. Check that the command is executable and cwd exists.`));
         });
       });
     }
@@ -577,185 +788,129 @@ function createBashTool(defaultCwd, options) {
 // src/capabilities/code-intel.ts
 import * as fs from "node:fs";
 import * as path from "node:path";
-var projectCache = /* @__PURE__ */ new Map();
-var typescriptModulePromise;
-function loadTypeScript() {
-  typescriptModulePromise ??= import("./typescript-GSKWJIO4.js");
-  return typescriptModulePromise;
-}
-function findTsconfig(startPath, projectRoot) {
-  let dir = fs.existsSync(startPath) && fs.statSync(startPath).isDirectory() ? startPath : path.dirname(startPath);
-  const root = path.resolve(projectRoot);
-  while (dir.startsWith(root)) {
-    const candidate = path.join(dir, "tsconfig.json");
-    if (fs.existsSync(candidate)) return candidate;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  const rootCandidate = path.join(root, "tsconfig.json");
-  return fs.existsSync(rootCandidate) ? rootCandidate : void 0;
-}
-function readConfig(ts, configPath) {
-  const config = ts.readConfigFile(configPath, ts.sys.readFile);
-  if (config.error) {
-    throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, "\n"));
-  }
-  const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, path.dirname(configPath));
-  return { fileNames: parsed.fileNames, options: parsed.options };
-}
-function walkJsTs(root, limit = 1e3) {
-  const skip = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "Library", "Temp", "obj"]);
-  const out = [];
-  const visit = (dir) => {
-    if (out.length >= limit) return;
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (skip.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) visit(full);
-      else if (/\.[cm]?[jt]sx?$/.test(entry.name)) out.push(full);
-      if (out.length >= limit) return;
-    }
-  };
-  if (fs.existsSync(root)) visit(root);
-  return out;
-}
-function createProject(ts, projectRoot, focusPath) {
-  const configPath = findTsconfig(focusPath ?? projectRoot, projectRoot);
-  const key = configPath ?? `loose:${projectRoot}`;
-  const cached = projectCache.get(key);
-  if (cached) return cached;
-  const config = configPath ? readConfig(ts, configPath) : {
-    fileNames: walkJsTs(projectRoot),
-    options: {
-      allowJs: true,
-      checkJs: true,
-      moduleResolution: ts.ModuleResolutionKind.NodeJs,
-      target: ts.ScriptTarget.ES2022,
-      module: ts.ModuleKind.ESNext,
-      jsx: ts.JsxEmit.ReactJSX
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+import { Worker } from "node:worker_threads";
+var WORKER_TIMEOUT_MS = 3e4;
+var MAX_ACTIVE_CODE_INTEL_WORKERS = 1;
+var MAX_QUEUED_CODE_INTEL_WORKERS = 16;
+var activeCodeIntelWorkers = 0;
+var codeIntelWorkerWaiters = [];
+function releaseWorkerSlot() {
+  activeCodeIntelWorkers = Math.max(0, activeCodeIntelWorkers - 1);
+  while (activeCodeIntelWorkers < MAX_ACTIVE_CODE_INTEL_WORKERS && codeIntelWorkerWaiters.length > 0) {
+    const waiter = codeIntelWorkerWaiters.shift();
+    waiter.signal?.removeEventListener("abort", waiter.onAbort);
+    if (waiter.timeout) clearTimeout(waiter.timeout);
+    if (waiter.signal?.aborted) continue;
+    activeCodeIntelWorkers++;
+    waiter.resolve();
+  }
+}
+function acquireWorkerSlot(deadline, signal) {
+  if (signal?.aborted) return Promise.reject(new Error("Operation aborted"));
+  if (Date.now() >= deadline) return Promise.reject(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`));
+  if (activeCodeIntelWorkers < MAX_ACTIVE_CODE_INTEL_WORKERS) {
+    activeCodeIntelWorkers++;
+    return Promise.resolve(releaseWorkerSlot);
+  }
+  if (codeIntelWorkerWaiters.length >= MAX_QUEUED_CODE_INTEL_WORKERS) {
+    return Promise.reject(new Error("TypeScript code intelligence queue is full"));
+  }
+  return new Promise((resolve3, reject) => {
+    const waiter = { resolve: () => resolve3(releaseWorkerSlot), reject, signal };
+    waiter.onAbort = () => {
+      const index = codeIntelWorkerWaiters.indexOf(waiter);
+      if (index >= 0) codeIntelWorkerWaiters.splice(index, 1);
+      if (waiter.timeout) clearTimeout(waiter.timeout);
+      reject(new Error("Operation aborted"));
+    };
+    waiter.timeout = setTimeout(() => {
+      const index = codeIntelWorkerWaiters.indexOf(waiter);
+      if (index >= 0) codeIntelWorkerWaiters.splice(index, 1);
+      signal?.removeEventListener("abort", waiter.onAbort);
+      reject(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`));
+    }, Math.max(1, deadline - Date.now()));
+    waiter.timeout.unref?.();
+    signal?.addEventListener("abort", waiter.onAbort, { once: true });
+    codeIntelWorkerWaiters.push(waiter);
+  });
+}
+function resolveWorkerPath() {
+  const moduleDirectory = path.dirname(fileURLToPath2(import.meta.url));
+  const candidates = [
+    path.join(moduleDirectory, "code-intel-worker.cjs"),
+    path.join(moduleDirectory, "..", "code-intel-worker.cjs"),
+    path.join(moduleDirectory, "..", "..", "dist", "code-intel-worker.cjs")
+  ];
+  const workerPath = candidates.find((candidate) => fs.existsSync(candidate));
+  if (!workerPath) throw new Error("compiled code-intel worker is unavailable; rebuild the CLI");
+  return workerPath;
+}
+function runWorker(request, timeoutMs, signal) {
+  return new Promise((resolve3, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Operation aborted"));
+      return;
     }
-  };
-  const versions = new Map(config.fileNames.map((file) => [path.resolve(file), "0"]));
-  const host = {
-    getScriptFileNames: () => [...versions.keys()],
-    getScriptVersion: (fileName) => versions.get(path.resolve(fileName)) ?? "0",
-    getScriptSnapshot: (fileName) => {
-      if (!fs.existsSync(fileName)) return void 0;
-      return ts.ScriptSnapshot.fromString(fs.readFileSync(fileName, "utf8"));
-    },
-    getCurrentDirectory: () => configPath ? path.dirname(configPath) : projectRoot,
-    getCompilationSettings: () => config.options,
-    getDefaultLibFileName: (options) => ts.getDefaultLibFilePath(options),
-    fileExists: ts.sys.fileExists,
-    readFile: ts.sys.readFile,
-    readDirectory: ts.sys.readDirectory,
-    directoryExists: ts.sys.directoryExists,
-    getDirectories: ts.sys.getDirectories
-  };
-  const project = {
-    configPath,
-    service: ts.createLanguageService(host),
-    fileNames: [...versions.keys()],
-    options: config.options
-  };
-  projectCache.set(key, project);
-  return project;
-}
-function offsetOf(ts, sourceFile, line, character) {
-  if (!line || !character) throw new Error("operation requires path, line, and character");
-  return ts.getPositionOfLineAndCharacter(sourceFile, Math.max(0, line - 1), Math.max(0, character - 1));
-}
-function loc(fileName, start = 0) {
-  const text = fs.existsSync(fileName) ? fs.readFileSync(fileName, "utf8").slice(0, start) : "";
-  const lines = text.split(/\r?\n/);
-  return `${fileName}:${lines.length}:${lines[lines.length - 1].length + 1}`;
-}
-function diagnosticText(ts, d) {
-  const where = d.file && typeof d.start === "number" ? `${loc(d.file.fileName, d.start)} ` : "";
-  return `${where}${ts.flattenDiagnosticMessageText(d.messageText, "\n")}`;
-}
-function navItems(items, fileName) {
-  const out = [];
-  const visit = (item, prefix = "") => {
-    const span = item.spans[0];
-    out.push(`${prefix}${item.text} (${item.kind}) ${span ? loc(fileName, span.start) : fileName}`);
-    for (const child of item.childItems ?? []) visit(child, `${prefix}${item.text}.`);
-  };
-  for (const item of items) visit(item);
-  return out;
+    const worker = new Worker(pathToFileURL(resolveWorkerPath()), {
+      workerData: request,
+      execArgv: [],
+      resourceLimits: { maxOldGenerationSizeMb: 128, maxYoungGenerationSizeMb: 32, stackSizeMb: 4 }
+    });
+    let finishing = false;
+    let exited = false;
+    const finish = (error, result) => {
+      if (finishing) return;
+      finishing = true;
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+      void (async () => {
+        if (!exited) {
+          try {
+            await worker.terminate();
+          } catch {
+          }
+        }
+        if (error) reject(error);
+        else resolve3(result);
+      })();
+    };
+    const onAbort = () => finish(new Error("Operation aborted"));
+    const timeout = setTimeout(() => finish(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`)), Math.max(1, timeoutMs));
+    timeout.unref?.();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    worker.once("message", (message) => {
+      if (!message || typeof message !== "object" || typeof message.ok !== "boolean") {
+        finish(new Error("code-intel worker returned an invalid response"));
+        return;
+      }
+      if ("error" in message) finish(new Error(message.error));
+      else finish(void 0, message.result);
+    });
+    worker.once("error", (error) => finish(error));
+    worker.once("exit", (code) => {
+      exited = true;
+      if (!finishing) finish(new Error(`code-intel worker exited before responding (${code})`));
+    });
+  });
+}
+async function runWorkerBounded(request, signal) {
+  const deadline = Date.now() + WORKER_TIMEOUT_MS;
+  const release = await acquireWorkerSlot(deadline, signal);
+  try {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`);
+    return await runWorker(request, remaining, signal);
+  } finally {
+    release();
+  }
 }
 function createTypeScriptCodeIntelProvider() {
-  const lightweight = createLightweightCodeIntelProvider();
   return {
     async run(input, context) {
-      try {
-        const ts = await loadTypeScript();
-        const filePath = context.resolvePath(input.path);
-        const project = createProject(ts, context.projectRoot, filePath);
-        const files = filePath ? [filePath] : project.fileNames;
-        if (input.operation === "diagnostics") {
-          const diagnostics = files.flatMap((file) => [
-            ...project.service.getSyntacticDiagnostics(file),
-            ...project.service.getSemanticDiagnostics(file)
-          ]);
-          return {
-            text: diagnostics.length ? diagnostics.map((diagnostic) => diagnosticText(ts, diagnostic)).join("\n") : "No TypeScript diagnostics found.",
-            details: {
-              operation: input.operation,
-              projectRoot: context.projectRoot,
-              path: filePath,
-              provider: "typescript_service",
-              resultCount: diagnostics.length,
-              diagnosticCount: diagnostics.length,
-              tsconfigPath: project.configPath
-            }
-          };
-        }
-        if (input.operation === "symbols") {
-          const query = input.query?.toLowerCase();
-          const symbols = files.flatMap((file) => navItems(project.service.getNavigationBarItems(file), file)).filter((line) => !query || line.toLowerCase().includes(query));
-          return {
-            text: symbols.length ? symbols.join("\n") : "No symbols found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: symbols.length, tsconfigPath: project.configPath }
-          };
-        }
-        if (!filePath) throw new Error(`${input.operation} requires path`);
-        const source = project.service.getProgram()?.getSourceFile(filePath);
-        if (!source) throw new Error(`File is not part of the TypeScript project: ${input.path}`);
-        const offset = offsetOf(ts, source, input.line, input.character);
-        if (input.operation === "definition") {
-          const defs = project.service.getDefinitionAtPosition(filePath, offset) ?? [];
-          return {
-            text: defs.length ? defs.map((def) => `${def.name} ${loc(def.fileName, def.textSpan.start)}`).join("\n") : "No definition found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: defs.length, tsconfigPath: project.configPath }
-          };
-        }
-        if (input.operation === "references") {
-          const refs = project.service.getReferencesAtPosition(filePath, offset) ?? [];
-          return {
-            text: refs.length ? refs.map((ref) => loc(ref.fileName, ref.textSpan.start)).join("\n") : "No references found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: refs.length, tsconfigPath: project.configPath }
-          };
-        }
-        const quickInfo = project.service.getQuickInfoAtPosition(filePath, offset);
-        const text = quickInfo ? ts.displayPartsToString(quickInfo.displayParts ?? []) + (quickInfo.documentation?.length ? `
-${ts.displayPartsToString(quickInfo.documentation)}` : "") : "No hover information found.";
-        return {
-          text,
-          details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: quickInfo ? 1 : 0, tsconfigPath: project.configPath }
-        };
-      } catch (error) {
-        const fallback = await lightweight.run(input, context);
-        return {
-          ...fallback,
-          details: {
-            ...fallback.details,
-            provider: "lightweight_fallback",
-            fallbackReason: error instanceof Error ? error.message : String(error)
-          }
-        };
-      }
+      const filePath = context.resolvePath(input.path);
+      if (filePath && !context.isPathAllowed(filePath)) throw new Error(`Path escapes the project root: ${input.path}`);
+      return await runWorkerBounded({ input, projectRoot: context.projectRoot, filePath }, context.signal);
     }
   };
 }
@@ -833,12 +988,12 @@ function createCliRenderedPageReader() {
     try {
       await runPlaywright([`-s=${session}`, "open", "about:blank"]);
       await runPlaywright([`-s=${session}`, "goto", url]);
-      const [snapshot, pageInfoRaw, screenshotOutput, consoleOutput, networkOutput] = await Promise.all([
+      const [snapshot, pageInfoRaw, screenshotOutput, consoleOutput, requestsOutput] = await Promise.all([
         runPlaywright([`-s=${session}`, "snapshot"]),
         runPlaywright([`-s=${session}`, "--raw", "eval", "() => JSON.stringify({ title: document.title, href: location.href, text: document.body ? document.body.innerText : '' })"]),
         runPlaywright([`-s=${session}`, "--raw", "screenshot"]).catch((error) => `screenshot_failed: ${error instanceof Error ? error.message : String(error)}`),
         runPlaywright([`-s=${session}`, "--raw", "console"]).catch((error) => `console_failed: ${error instanceof Error ? error.message : String(error)}`),
-        runPlaywright([`-s=${session}`, "--raw", "network"]).catch((error) => `network_failed: ${error instanceof Error ? error.message : String(error)}`)
+        runPlaywright([`-s=${session}`, "--raw", "requests"]).catch((error) => `requests_failed: ${error instanceof Error ? error.message : String(error)}`)
       ]);
       const pageInfo = parsePageInfo(pageInfoRaw);
       const text = pageInfo.text?.trim() || snapshot.trim();
@@ -853,7 +1008,7 @@ function createCliRenderedPageReader() {
         citationAnchors: [{ url: pageInfo.finalUrl || url, title: pageInfo.title, startOffset: 0, endOffset: Math.min(120, text.length) }],
         screenshotPath: parseScreenshotPath(screenshotOutput),
         consoleMessages: linesOf(consoleOutput),
-        networkRequests: linesOf(networkOutput)
+        networkRequests: linesOf(requestsOutput)
       };
     } finally {
       runPlaywright([`-s=${session}`, "close"], 1e4).catch(() => void 0);
@@ -983,10 +1138,12 @@ export {
   getAgentDir,
   getCustomThemesDir,
   getSettingsPath,
+  getProjectSettingsPath,
   getSessionsDir,
   getLogsDir,
   getRuntimeLogPath,
   migrateConfigFromAgentDir,
   createCliWebResearchHealthStore,
+  cleanupBashOutputArtifacts,
   createCliHostCapabilities
 };