@cydm/pie 1.0.24 → 1.0.25

package/dist/chunks/{chunk-QYYRJ7JW.js → chunk-BEWVRLCP.js}

@@ -2,18 +2,15 @@ import { createRequire as __createRequire } from "node:module"; const require =
 import {
   classifyShellCommand,
   createCodeIntelTool,
-  createLightweightCodeIntelProvider,
   createSharedWebFetchTool,
   createSharedWebResearchTool,
   createSharedWebSearchTool,
-  interpretShellExit
-} from "./chunk-XWNIIJ3X.js";
-import {
+  interpretShellExit,
   requestInteraction
-} from "./chunk-J4P2LP7K.js";
+} from "./chunk-O4DPFYYP.js";
 import {
   Type
-} from "./chunk-HAAYC2N5.js";
+} from "./chunk-64XJIKVK.js";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, renameSync } from "fs";
@@ -130,14 +127,54 @@ function migrateConfigFromAgentDir() {
 
 // src/capabilities/bash/index.ts
 import { spawn } from "child_process";
-import { createWriteStream, existsSync as existsSync2, statSync, writeFileSync } from "fs";
-import { tmpdir, homedir as homedir2 } from "os";
+import { closeSync, createWriteStream, existsSync as existsSync2, openSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
 import { join as join2, resolve as resolve2 } from "path";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 
 // src/capabilities/bash/truncate.ts
-var DEFAULT_MAX_LINES = 2e3;
-var DEFAULT_MAX_BYTES = 50 * 1024;
+var DEFAULT_MAX_LINES = 400;
+var DEFAULT_MAX_BYTES = 16 * 1024;
+function truncateHeadTail(content, options = {}) {
+  const maxLines = options.maxLines ?? DEFAULT_MAX_LINES;
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const totalBytes = Buffer.byteLength(content, "utf-8");
+  const lines = content.split("\n");
+  if (lines.length <= maxLines && totalBytes <= maxBytes) return truncateTail(content, options);
+  const headCount = Math.max(1, Math.floor(maxLines / 2));
+  const tailCount = Math.max(1, maxLines - headCount);
+  let head = lines.slice(0, headCount);
+  let tail = lines.slice(-tailCount);
+  const omittedNotice = () => `... [truncated: ${Math.max(0, lines.length - head.length - tail.length)} middle lines omitted] ...`;
+  let combined = () => [...head, omittedNotice(), ...tail].join("\n");
+  while (Buffer.byteLength(combined(), "utf-8") > maxBytes && (head.length > 1 || tail.length > 1)) {
+    if (head.length >= tail.length && head.length > 1) head.pop();
+    else if (tail.length > 1) tail.shift();
+  }
+  let output = combined();
+  let lastLinePartial = false;
+  if (Buffer.byteLength(output, "utf-8") > maxBytes) {
+    const marker = "\n... [truncated middle] ...\n";
+    const available = Math.max(2, maxBytes - Buffer.byteLength(marker, "utf-8"));
+    const bytes = Buffer.from(content, "utf-8");
+    const prefix = bytes.subarray(0, Math.floor(available / 2)).toString("utf-8").replace(/\uFFFD+$/g, "");
+    const suffix = bytes.subarray(Math.max(0, bytes.length - Math.ceil(available / 2))).toString("utf-8").replace(/^\uFFFD+/g, "");
+    output = `${prefix}${marker}${suffix}`;
+    lastLinePartial = true;
+  }
+  return {
+    content: output,
+    truncated: true,
+    truncatedBy: lines.length > maxLines ? "lines" : "bytes",
+    totalLines: lines.length,
+    totalBytes,
+    outputLines: head.length + tail.length,
+    outputBytes: Buffer.byteLength(output, "utf-8"),
+    lastLinePartial,
+    maxLines,
+    maxBytes
+  };
+}
 function formatSize(bytes) {
   if (bytes < 1024) {
     return `${bytes}B`;
@@ -222,7 +259,7 @@ var bashSchema = Type.Object({
   command: Type.String({ description: "The bash command to execute" }),
   timeout: Type.Optional(
     Type.Number({
-      description: "Timeout in seconds. Default: 120s (2 minutes). For longer tasks, explicitly set a higher value: { timeout: 600 } for npm install, { timeout: 600 } for cargo build, etc."
+      description: "Timeout in seconds. Default: 120s (2 minutes). Longer timeouts are honored for installs, builds, and tests; generic custom scripts and polling commands are capped to protect the turn budget."
     })
   ),
   cwd: Type.Optional(Type.String({ description: "Working directory for the command" })),
@@ -234,6 +271,23 @@ var bashSchema = Type.Object({
   ], { description: "Shell to use. Defaults to bash on macOS/Linux and PowerShell on Windows. Use this only for platform-specific commands." }))
 });
 var DEFAULT_TIMEOUT_SECONDS = 120;
+var MAX_GENERIC_TIMEOUT_SECONDS = 120;
+function resolveTimeoutPolicy(requestedTimeout, commandClass) {
+  const requestedSeconds = requestedTimeout ?? DEFAULT_TIMEOUT_SECONDS;
+  if (requestedSeconds > MAX_GENERIC_TIMEOUT_SECONDS && commandClass !== "package_manager" && commandClass !== "test_or_build") {
+    return {
+      requestedSeconds,
+      effectiveSeconds: MAX_GENERIC_TIMEOUT_SECONDS,
+      capped: true,
+      reason: `long timeouts are capped at ${MAX_GENERIC_TIMEOUT_SECONDS}s for non-build commands`
+    };
+  }
+  return {
+    requestedSeconds,
+    effectiveSeconds: requestedSeconds,
+    capped: false
+  };
+}
 function validateBashCommand(command) {
   const value = typeof command === "string" ? command : "";
   const trimmed = value.trim();
@@ -307,18 +361,95 @@ function getTempFilePath() {
   const id = randomBytes(8).toString("hex");
   return join2(tmpdir(), `pie-bash-${id}.log`);
 }
+var retainedOutputArtifacts = /* @__PURE__ */ new Set();
+function getErrorCode(error) {
+  if (!error || typeof error !== "object" || !("code" in error)) return void 0;
+  const code = error.code;
+  return typeof code === "string" ? code : void 0;
+}
+function createPrivateOutputArtifact() {
+  for (let attempt = 0; attempt < 10; attempt++) {
+    const path3 = getTempFilePath();
+    try {
+      const fd = openSync(path3, "wx", 384);
+      retainedOutputArtifacts.add(path3);
+      try {
+        return { path: path3, stream: createWriteStream(path3, { fd, autoClose: true }) };
+      } catch (error) {
+        closeSync(fd);
+        removeOutputArtifact(path3);
+        throw error;
+      }
+    } catch (error) {
+      if (getErrorCode(error) !== "EEXIST") throw error;
+    }
+  }
+  throw new Error("Unable to allocate a private bash output artifact.");
+}
+function removeOutputArtifact(path3) {
+  if (!path3) return;
+  try {
+    unlinkSync(path3);
+  } catch (error) {
+    if (getErrorCode(error) !== "ENOENT") throw error;
+  }
+  retainedOutputArtifacts.delete(path3);
+}
+function discardOutputArtifact(path3, stream) {
+  if (stream && !stream.closed) {
+    stream.once("close", () => {
+      try {
+        removeOutputArtifact(path3);
+      } catch {
+      }
+    });
+    stream.destroy();
+  }
+  try {
+    removeOutputArtifact(path3);
+  } catch {
+  }
+}
+function cleanupBashOutputArtifacts() {
+  for (const path3 of [...retainedOutputArtifacts]) {
+    try {
+      removeOutputArtifact(path3);
+    } catch {
+    }
+  }
+}
+process.once("exit", cleanupBashOutputArtifacts);
 function finishTempFileStream(stream) {
-  if (!stream) return Promise.resolve();
-  return new Promise((resolve4, reject) => {
-    const onError = (error) => {
+  if (!stream || stream.closed) return Promise.resolve();
+  return new Promise((resolve3, reject) => {
+    let done = false;
+    const cleanup = () => {
+      stream.off("close", onClose);
       stream.off("error", onError);
-      reject(error);
     };
+    const onClose = () => {
+      if (done) return;
+      done = true;
+      cleanup();
+      resolve3();
+    };
+    const onError = (error) => {
+      if (done) return;
+      done = true;
+      cleanup();
+      reject(error instanceof Error ? error : new Error(String(error)));
+    };
+    stream.once("close", onClose);
     stream.once("error", onError);
-    stream.end(() => {
-      stream.off("error", onError);
-      resolve4();
-    });
+    try {
+      if (!stream.writableEnded) {
+        stream.end();
+      } else if (stream.closed) {
+        onClose();
+      }
+    } catch (error) {
+      onError(error);
+    }
   });
 }
 function buildBashRecoveryHint(command, output) {
@@ -351,10 +482,22 @@ function killProcessTree(pid) {
   }
 }
 function createBashTool(defaultCwd, options) {
+  const recentCommands = /* @__PURE__ */ new Map();
+  const rememberCommandResult = (key, fingerprint) => {
+    const previous = recentCommands.get(key);
+    const count = (previous?.count ?? 0) + 1;
+    const sameResult = previous?.fingerprint === fingerprint;
+    recentCommands.set(key, { count, fingerprint });
+    if (recentCommands.size > 100) {
+      const oldest = recentCommands.keys().next().value;
+      if (oldest) recentCommands.delete(oldest);
+    }
+    return { count, sameResult };
+  };
   return {
     name: "bash",
     label: "bash",
-    description: `Execute a shell command in the current working directory. The public tool name remains bash for compatibility; on Windows shell:auto uses PowerShell, otherwise bash. Returns stdout and stderr. Output is truncated to last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). If truncated, full output is saved to a temp file. Default timeout: 120s. Use timeout parameter for longer tasks (e.g., npm install -> 600).`,
+    description: `Execute a shell command in the current working directory. The public tool name remains bash for compatibility; on Windows shell:auto uses PowerShell, otherwise bash. Returns stdout and stderr as a bounded head/tail preview of at most ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB. If truncated, the result includes a private full-output artifact path. Default timeout: 120s. Long timeouts are reserved for installs, builds, and tests; custom scripts, searches, and polling commands are capped at ${MAX_GENERIC_TIMEOUT_SECONDS}s and should be split into bounded steps with progress output.`,
     parameters: bashSchema,
     execute: async (_toolCallId, { command, timeout, cwd, shell }, signal, onUpdate) => {
       validateBashCommand(command);
@@ -363,34 +506,9 @@ function createBashTool(defaultCwd, options) {
       const workingDir = normalizeWorkingDirectory(cwd, defaultCwd);
       validateWorkingDirectory(workingDir);
       const risk = classifyShellCommand(effectiveCommand, resolvedShell, {
-        homeDir: homedir2(),
         cwd: workingDir,
-        env: process.env,
-        pathStyle: process.platform === "win32" ? "windows" : "posix"
+        sandboxRoot: defaultCwd ?? workingDir
       });
-      if (risk.destructive && risk.catastrophic) {
-        const targetExplanation = risk.catastrophicReason === "indeterminate_target" ? "The agent shell tool cannot statically prove every deletion target is scoped" : "The command targets a filesystem root, home directory, or system directory";
-        return {
-          content: [{
-            type: "text",
-            text: `Blocked catastrophic shell command (${risk.commandClass}): ${risk.riskWarnings.join("; ")}. ${targetExplanation} and is never executed, even in YOLO mode, by the agent shell tool. Narrow the target to a statically resolvable subdirectory and retry.`
-          }],
-          details: {
-            exitCode: null,
-            signal: null,
-            timedOut: false,
-            shell: resolvedShell,
-            commandClass: risk.commandClass,
-            riskWarnings: risk.riskWarnings,
-            permissionDecision: {
-              allowed: false,
-              reason: "catastrophic command blocked by shell policy",
-              requiresPermission: true
-            }
-          },
-          isError: true
-        };
-      }
       if (risk.destructive && !options?.isYoloMode?.()) {
         const approved = await (options?.confirm ?? requestHighRiskConfirmation)({
           command: effectiveCommand,
@@ -421,18 +539,31 @@ function createBashTool(defaultCwd, options) {
           };
         }
       }
-      const timeoutMs = (timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1e3;
-      return new Promise((resolve4, reject) => {
+      const timeoutPolicy = resolveTimeoutPolicy(timeout, risk.commandClass);
+      const timeoutMs = timeoutPolicy.effectiveSeconds * 1e3;
+      return new Promise((resolve3, reject) => {
         if (signal?.aborted) {
           reject(new Error("Operation aborted"));
           return;
         }
         let tempFilePath;
         let tempFileStream;
+        let settled = false;
         let totalBytes = 0;
         const chunks = [];
         let chunksBytes = 0;
         const maxChunksBytes = DEFAULT_MAX_BYTES * 2;
+        const headChunks = [];
+        let headBytes = 0;
+        let totalNewlines = 0;
+        const maxHeadBytes = Math.floor(DEFAULT_MAX_BYTES / 2);
+        const captureHead = (data) => {
+          totalNewlines += data.reduce((count, byte) => count + (byte === 10 ? 1 : 0), 0);
+          if (headBytes >= maxHeadBytes) return;
+          const prefix = data.subarray(0, maxHeadBytes - headBytes);
+          headChunks.push(prefix);
+          headBytes += prefix.length;
+        };
         let timedOut = false;
         const spawnCommand = buildSpawnCommand(resolvedShell, effectiveCommand);
         const child = (options?.spawnProcess ?? spawn)(spawnCommand.file, spawnCommand.args, {
@@ -447,19 +578,33 @@ function createBashTool(defaultCwd, options) {
             killProcessTree(child.pid);
           }
         }, timeoutMs);
-        const onAbort = () => {
+        const failExecution = (error) => {
+          if (settled) return;
+          settled = true;
           clearTimeout(timeoutId);
-          if (child.pid) {
-            killProcessTree(child.pid);
-          }
-          reject(new Error("Operation aborted"));
+          signal?.removeEventListener("abort", onAbort);
+          if (child.pid) killProcessTree(child.pid);
+          discardOutputArtifact(tempFilePath, tempFileStream);
+          reject(error);
+        };
+        const onAbort = () => {
+          failExecution(new Error("Operation aborted"));
         };
         signal?.addEventListener("abort", onAbort, { once: true });
         child.stdout?.on("data", (data) => {
+          if (settled) return;
           totalBytes += data.length;
+          captureHead(data);
           if (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {
-            tempFilePath = getTempFilePath();
-            tempFileStream = createWriteStream(tempFilePath);
+            try {
+              const artifact = createPrivateOutputArtifact();
+              tempFilePath = artifact.path;
+              tempFileStream = artifact.stream;
+              tempFileStream.once("error", failExecution);
+            } catch (error) {
+              failExecution(error instanceof Error ? error : new Error(String(error)));
+              return;
+            }
             for (const chunk of chunks) {
               tempFileStream.write(chunk);
             }
@@ -476,7 +621,7 @@ function createBashTool(defaultCwd, options) {
           if (onUpdate) {
             const fullBuffer = Buffer.concat(chunks);
             const fullText = fullBuffer.toString("utf-8");
-            const truncation = truncateTail(fullText);
+            const truncation = truncateHeadTail(fullText);
             onUpdate({
               content: [{ type: "text", text: truncation.content || "" }],
               details: {
@@ -493,6 +638,7 @@ function createBashTool(defaultCwd, options) {
                 shell: resolvedShell,
                 commandClass: risk.commandClass,
                 riskWarnings: risk.riskWarnings,
+                timeoutPolicy,
                 permissionDecision: {
                   allowed: true,
                   requiresPermission: risk.requiresPermission
@@ -502,10 +648,19 @@ function createBashTool(defaultCwd, options) {
           }
         });
         child.stderr?.on("data", (data) => {
+          if (settled) return;
           totalBytes += data.length;
+          captureHead(data);
           if (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {
-            tempFilePath = getTempFilePath();
-            tempFileStream = createWriteStream(tempFilePath);
+            try {
+              const artifact = createPrivateOutputArtifact();
+              tempFilePath = artifact.path;
+              tempFileStream = artifact.stream;
+              tempFileStream.once("error", failExecution);
+            } catch (error) {
+              failExecution(error instanceof Error ? error : new Error(String(error)));
+              return;
+            }
             for (const chunk of chunks) {
               tempFileStream.write(chunk);
             }
@@ -524,13 +679,32 @@ function createBashTool(defaultCwd, options) {
           try {
             clearTimeout(timeoutId);
             signal?.removeEventListener("abort", onAbort);
+            if (settled) return;
             const fullBuffer = Buffer.concat(chunks);
             let fullOutput = fullBuffer.toString("utf-8");
-            const truncation = truncateTail(fullOutput);
+            if (totalBytes > fullBuffer.length) {
+              fullOutput = `${Buffer.concat(headChunks).toString("utf-8")}
+... [stream middle omitted] ...
+${fullOutput}`;
+            }
+            const truncation = truncateHeadTail(fullOutput);
+            if (totalBytes > truncation.totalBytes) {
+              truncation.truncated = true;
+              truncation.totalBytes = totalBytes;
+              truncation.totalLines = totalNewlines + 1;
+              truncation.truncatedBy = totalNewlines + 1 > DEFAULT_MAX_LINES ? "lines" : "bytes";
+            }
             let outputText = truncation.content || "(no output)";
             if (truncation.truncated && !tempFilePath) {
-              tempFilePath = getTempFilePath();
-              writeFileSync(tempFilePath, fullOutput, "utf-8");
+              const path3 = getTempFilePath();
+              const fd = openSync(path3, "wx", 384);
+              tempFilePath = path3;
+              retainedOutputArtifacts.add(path3);
+              try {
+                writeFileSync(fd, fullOutput, "utf-8");
+              } finally {
+                closeSync(fd);
+              }
             }
             await finishTempFileStream(tempFileStream);
             const details = {
@@ -540,6 +714,7 @@ function createBashTool(defaultCwd, options) {
               shell: resolvedShell,
               commandClass: risk.commandClass,
               riskWarnings: risk.riskWarnings,
+              timeoutPolicy,
               permissionDecision: {
                 allowed: true,
                 requiresPermission: risk.requiresPermission
@@ -558,29 +733,26 @@ function createBashTool(defaultCwd, options) {
                 outputLines: truncation.outputLines
               };
               details.fullOutputPath = tempFilePath;
-              const startLine = truncation.totalLines - truncation.outputLines + 1;
-              const endLine = truncation.totalLines;
               if (truncation.lastLinePartial) {
-                const lastLineSize = formatSize(
-                  Buffer.byteLength(fullOutput.split("\n").pop() || "", "utf-8")
-                );
-                outputText += `
-
-[Showing last ${formatSize(truncation.outputBytes)} of line ${endLine} (line is ${lastLineSize}). Full output: ${tempFilePath}]`;
-              } else if (truncation.truncatedBy === "lines") {
                 outputText += `
 
-[Showing lines ${startLine}-${endLine} of ${truncation.totalLines}. Full output: ${tempFilePath}]`;
+[Head/tail preview limited to ${formatSize(truncation.outputBytes)}. Full output: ${tempFilePath}]`;
               } else {
                 outputText += `
 
-[Showing lines ${startLine}-${endLine} of ${truncation.totalLines} (${formatSize(DEFAULT_MAX_BYTES)} limit). Full output: ${tempFilePath}]`;
+[Showing a bounded head/tail preview of ${truncation.totalLines} lines (${formatSize(DEFAULT_MAX_BYTES)} limit). Full output: ${tempFilePath}]`;
               }
             }
             if (timedOut) {
               outputText += `
 
-[Command timed out after ${timeout ?? DEFAULT_TIMEOUT_SECONDS} seconds]`;
+[Command timed out after ${timeoutPolicy.effectiveSeconds} seconds]`;
+              outputText += "\n[Timeout hint: split custom searches or service polls into smaller bounded steps with progress output, inspect partial results/logs, then make a decision. Avoid repeating long waits. Reserve long timeouts for installs, builds, and tests.]";
+            }
+            if (timeoutPolicy.capped) {
+              outputText += `
+
+[Timeout policy: requested ${timeoutPolicy.requestedSeconds} seconds, capped to ${timeoutPolicy.effectiveSeconds} seconds because ${timeoutPolicy.reason}.]`;
             }
             const recoveryHint = buildBashRecoveryHint(command, outputText);
             if (recoveryHint) {
@@ -588,19 +760,25 @@ function createBashTool(defaultCwd, options) {
 
 [Recovery hint: ${recoveryHint}]`;
             }
+            const repeatedCommand = rememberCommandResult(
+              `${resolvedShell}\0${workingDir}\0${effectiveCommand}`,
+              createHash("sha256").update(JSON.stringify({ code, sig, timedOut, outputText })).digest("hex")
+            );
+            details.repeatedCommand = repeatedCommand;
+            if (repeatedCommand.count > 1 && repeatedCommand.sameResult) {
+              outputText += "\n\n[Repeat hint: this exact command already returned the same result in this session. If it proves the task, stop; otherwise change the command or inspect a different file/range.]";
+            }
             const content = [{ type: "text", text: outputText }];
-            resolve4({ content, details, isError: timedOut || semantic.isError });
+            settled = true;
+            resolve3({ content, details, isError: timedOut || semantic.isError });
           } catch (error) {
+            discardOutputArtifact(tempFilePath, tempFileStream);
+            settled = true;
             reject(error);
           }
         });
         child.on("error", (err) => {
-          clearTimeout(timeoutId);
-          signal?.removeEventListener("abort", onAbort);
-          if (tempFileStream) {
-            tempFileStream.end();
-          }
-          reject(new Error(`Failed to start bash command in ${workingDir}: ${err.message}. Check that the command is executable and cwd exists.`));
+          failExecution(new Error(`Failed to start bash command in ${workingDir}: ${err.message}. Check that the command is executable and cwd exists.`));
         });
       });
     }
@@ -610,185 +788,129 @@ function createBashTool(defaultCwd, options) {
 // src/capabilities/code-intel.ts
 import * as fs from "node:fs";
 import * as path from "node:path";
-var projectCache = /* @__PURE__ */ new Map();
-var typescriptModulePromise;
-function loadTypeScript() {
-  typescriptModulePromise ??= import("./typescript-GSKWJIO4.js");
-  return typescriptModulePromise;
-}
-function findTsconfig(startPath, projectRoot) {
-  let dir = fs.existsSync(startPath) && fs.statSync(startPath).isDirectory() ? startPath : path.dirname(startPath);
-  const root = path.resolve(projectRoot);
-  while (dir.startsWith(root)) {
-    const candidate = path.join(dir, "tsconfig.json");
-    if (fs.existsSync(candidate)) return candidate;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+import { Worker } from "node:worker_threads";
+var WORKER_TIMEOUT_MS = 3e4;
+var MAX_ACTIVE_CODE_INTEL_WORKERS = 1;
+var MAX_QUEUED_CODE_INTEL_WORKERS = 16;
+var activeCodeIntelWorkers = 0;
+var codeIntelWorkerWaiters = [];
+function releaseWorkerSlot() {
+  activeCodeIntelWorkers = Math.max(0, activeCodeIntelWorkers - 1);
+  while (activeCodeIntelWorkers < MAX_ACTIVE_CODE_INTEL_WORKERS && codeIntelWorkerWaiters.length > 0) {
+    const waiter = codeIntelWorkerWaiters.shift();
+    waiter.signal?.removeEventListener("abort", waiter.onAbort);
+    if (waiter.timeout) clearTimeout(waiter.timeout);
+    if (waiter.signal?.aborted) continue;
+    activeCodeIntelWorkers++;
+    waiter.resolve();
   }
-  const rootCandidate = path.join(root, "tsconfig.json");
-  return fs.existsSync(rootCandidate) ? rootCandidate : void 0;
 }
-function readConfig(ts, configPath) {
-  const config = ts.readConfigFile(configPath, ts.sys.readFile);
-  if (config.error) {
-    throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, "\n"));
+function acquireWorkerSlot(deadline, signal) {
+  if (signal?.aborted) return Promise.reject(new Error("Operation aborted"));
+  if (Date.now() >= deadline) return Promise.reject(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`));
+  if (activeCodeIntelWorkers < MAX_ACTIVE_CODE_INTEL_WORKERS) {
+    activeCodeIntelWorkers++;
+    return Promise.resolve(releaseWorkerSlot);
   }
-  const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, path.dirname(configPath));
-  return { fileNames: parsed.fileNames, options: parsed.options };
+  if (codeIntelWorkerWaiters.length >= MAX_QUEUED_CODE_INTEL_WORKERS) {
+    return Promise.reject(new Error("TypeScript code intelligence queue is full"));
+  }
+  return new Promise((resolve3, reject) => {
+    const waiter = { resolve: () => resolve3(releaseWorkerSlot), reject, signal };
+    waiter.onAbort = () => {
+      const index = codeIntelWorkerWaiters.indexOf(waiter);
+      if (index >= 0) codeIntelWorkerWaiters.splice(index, 1);
+      if (waiter.timeout) clearTimeout(waiter.timeout);
+      reject(new Error("Operation aborted"));
+    };
+    waiter.timeout = setTimeout(() => {
+      const index = codeIntelWorkerWaiters.indexOf(waiter);
+      if (index >= 0) codeIntelWorkerWaiters.splice(index, 1);
+      signal?.removeEventListener("abort", waiter.onAbort);
+      reject(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`));
+    }, Math.max(1, deadline - Date.now()));
+    waiter.timeout.unref?.();
+    signal?.addEventListener("abort", waiter.onAbort, { once: true });
+    codeIntelWorkerWaiters.push(waiter);
+  });
 }
-function walkJsTs(root, limit = 1e3) {
-  const skip = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "Library", "Temp", "obj"]);
-  const out = [];
-  const visit = (dir) => {
-    if (out.length >= limit) return;
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (skip.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) visit(full);
-      else if (/\.[cm]?[jt]sx?$/.test(entry.name)) out.push(full);
-      if (out.length >= limit) return;
-    }
-  };
-  if (fs.existsSync(root)) visit(root);
-  return out;
+function resolveWorkerPath() {
+  const moduleDirectory = path.dirname(fileURLToPath2(import.meta.url));
+  const candidates = [
+    path.join(moduleDirectory, "code-intel-worker.cjs"),
+    path.join(moduleDirectory, "..", "code-intel-worker.cjs"),
+    path.join(moduleDirectory, "..", "..", "dist", "code-intel-worker.cjs")
+  ];
+  const workerPath = candidates.find((candidate) => fs.existsSync(candidate));
+  if (!workerPath) throw new Error("compiled code-intel worker is unavailable; rebuild the CLI");
+  return workerPath;
 }
-function createProject(ts, projectRoot, focusPath) {
-  const configPath = findTsconfig(focusPath ?? projectRoot, projectRoot);
-  const key = configPath ?? `loose:${projectRoot}`;
-  const cached = projectCache.get(key);
-  if (cached) return cached;
-  const config = configPath ? readConfig(ts, configPath) : {
-    fileNames: walkJsTs(projectRoot),
-    options: {
-      allowJs: true,
-      checkJs: true,
-      moduleResolution: ts.ModuleResolutionKind.NodeJs,
-      target: ts.ScriptTarget.ES2022,
-      module: ts.ModuleKind.ESNext,
-      jsx: ts.JsxEmit.ReactJSX
+function runWorker(request, timeoutMs, signal) {
+  return new Promise((resolve3, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Operation aborted"));
+      return;
     }
-  };
-  const versions = new Map(config.fileNames.map((file) => [path.resolve(file), "0"]));
-  const host = {
-    getScriptFileNames: () => [...versions.keys()],
-    getScriptVersion: (fileName) => versions.get(path.resolve(fileName)) ?? "0",
-    getScriptSnapshot: (fileName) => {
-      if (!fs.existsSync(fileName)) return void 0;
-      return ts.ScriptSnapshot.fromString(fs.readFileSync(fileName, "utf8"));
-    },
-    getCurrentDirectory: () => configPath ? path.dirname(configPath) : projectRoot,
-    getCompilationSettings: () => config.options,
-    getDefaultLibFileName: (options) => ts.getDefaultLibFilePath(options),
-    fileExists: ts.sys.fileExists,
-    readFile: ts.sys.readFile,
-    readDirectory: ts.sys.readDirectory,
-    directoryExists: ts.sys.directoryExists,
-    getDirectories: ts.sys.getDirectories
-  };
-  const project = {
-    configPath,
-    service: ts.createLanguageService(host),
-    fileNames: [...versions.keys()],
-    options: config.options
-  };
-  projectCache.set(key, project);
-  return project;
-}
-function offsetOf(ts, sourceFile, line, character) {
-  if (!line || !character) throw new Error("operation requires path, line, and character");
-  return ts.getPositionOfLineAndCharacter(sourceFile, Math.max(0, line - 1), Math.max(0, character - 1));
-}
-function loc(fileName, start = 0) {
-  const text = fs.existsSync(fileName) ? fs.readFileSync(fileName, "utf8").slice(0, start) : "";
-  const lines = text.split(/\r?\n/);
-  return `${fileName}:${lines.length}:${lines[lines.length - 1].length + 1}`;
-}
-function diagnosticText(ts, d) {
-  const where = d.file && typeof d.start === "number" ? `${loc(d.file.fileName, d.start)} ` : "";
-  return `${where}${ts.flattenDiagnosticMessageText(d.messageText, "\n")}`;
+    const worker = new Worker(pathToFileURL(resolveWorkerPath()), {
+      workerData: request,
+      execArgv: [],
+      resourceLimits: { maxOldGenerationSizeMb: 128, maxYoungGenerationSizeMb: 32, stackSizeMb: 4 }
+    });
+    let finishing = false;
+    let exited = false;
+    const finish = (error, result) => {
+      if (finishing) return;
+      finishing = true;
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+      void (async () => {
+        if (!exited) {
+          try {
+            await worker.terminate();
+          } catch {
+          }
+        }
+        if (error) reject(error);
+        else resolve3(result);
+      })();
+    };
+    const onAbort = () => finish(new Error("Operation aborted"));
+    const timeout = setTimeout(() => finish(new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`)), Math.max(1, timeoutMs));
+    timeout.unref?.();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    worker.once("message", (message) => {
+      if (!message || typeof message !== "object" || typeof message.ok !== "boolean") {
+        finish(new Error("code-intel worker returned an invalid response"));
+        return;
+      }
+      if ("error" in message) finish(new Error(message.error));
+      else finish(void 0, message.result);
+    });
+    worker.once("error", (error) => finish(error));
+    worker.once("exit", (code) => {
+      exited = true;
+      if (!finishing) finish(new Error(`code-intel worker exited before responding (${code})`));
+    });
+  });
 }
-function navItems(items, fileName) {
-  const out = [];
-  const visit = (item, prefix = "") => {
-    const span = item.spans[0];
-    out.push(`${prefix}${item.text} (${item.kind}) ${span ? loc(fileName, span.start) : fileName}`);
-    for (const child of item.childItems ?? []) visit(child, `${prefix}${item.text}.`);
-  };
-  for (const item of items) visit(item);
-  return out;
+async function runWorkerBounded(request, signal) {
+  const deadline = Date.now() + WORKER_TIMEOUT_MS;
+  const release = await acquireWorkerSlot(deadline, signal);
+  try {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error(`TypeScript code intelligence exceeded ${WORKER_TIMEOUT_MS}ms including queue wait`);
+    return await runWorker(request, remaining, signal);
+  } finally {
+    release();
+  }
 }
 function createTypeScriptCodeIntelProvider() {
-  const lightweight = createLightweightCodeIntelProvider();
   return {
     async run(input, context) {
-      try {
-        const ts = await loadTypeScript();
-        const filePath = context.resolvePath(input.path);
-        const project = createProject(ts, context.projectRoot, filePath);
-        const files = filePath ? [filePath] : project.fileNames;
-        if (input.operation === "diagnostics") {
-          const diagnostics = files.flatMap((file) => [
-            ...project.service.getSyntacticDiagnostics(file),
-            ...project.service.getSemanticDiagnostics(file)
-          ]);
-          return {
-            text: diagnostics.length ? diagnostics.map((diagnostic) => diagnosticText(ts, diagnostic)).join("\n") : "No TypeScript diagnostics found.",
-            details: {
-              operation: input.operation,
-              projectRoot: context.projectRoot,
-              path: filePath,
-              provider: "typescript_service",
-              resultCount: diagnostics.length,
-              diagnosticCount: diagnostics.length,
-              tsconfigPath: project.configPath
-            }
-          };
-        }
-        if (input.operation === "symbols") {
-          const query = input.query?.toLowerCase();
-          const symbols = files.flatMap((file) => navItems(project.service.getNavigationBarItems(file), file)).filter((line) => !query || line.toLowerCase().includes(query));
-          return {
-            text: symbols.length ? symbols.join("\n") : "No symbols found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: symbols.length, tsconfigPath: project.configPath }
-          };
-        }
-        if (!filePath) throw new Error(`${input.operation} requires path`);
-        const source = project.service.getProgram()?.getSourceFile(filePath);
-        if (!source) throw new Error(`File is not part of the TypeScript project: ${input.path}`);
-        const offset = offsetOf(ts, source, input.line, input.character);
-        if (input.operation === "definition") {
-          const defs = project.service.getDefinitionAtPosition(filePath, offset) ?? [];
-          return {
-            text: defs.length ? defs.map((def) => `${def.name} ${loc(def.fileName, def.textSpan.start)}`).join("\n") : "No definition found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: defs.length, tsconfigPath: project.configPath }
-          };
-        }
-        if (input.operation === "references") {
-          const refs = project.service.getReferencesAtPosition(filePath, offset) ?? [];
-          return {
-            text: refs.length ? refs.map((ref) => loc(ref.fileName, ref.textSpan.start)).join("\n") : "No references found.",
-            details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: refs.length, tsconfigPath: project.configPath }
-          };
-        }
-        const quickInfo = project.service.getQuickInfoAtPosition(filePath, offset);
-        const text = quickInfo ? ts.displayPartsToString(quickInfo.displayParts ?? []) + (quickInfo.documentation?.length ? `
-${ts.displayPartsToString(quickInfo.documentation)}` : "") : "No hover information found.";
-        return {
-          text,
-          details: { operation: input.operation, projectRoot: context.projectRoot, path: filePath, provider: "typescript_service", resultCount: quickInfo ? 1 : 0, tsconfigPath: project.configPath }
-        };
-      } catch (error) {
-        const fallback = await lightweight.run(input, context);
-        return {
-          ...fallback,
-          details: {
-            ...fallback.details,
-            provider: "lightweight_fallback",
-            fallbackReason: error instanceof Error ? error.message : String(error)
-          }
-        };
-      }
+      const filePath = context.resolvePath(input.path);
+      if (filePath && !context.isPathAllowed(filePath)) throw new Error(`Path escapes the project root: ${input.path}`);
+      return await runWorkerBounded({ input, projectRoot: context.projectRoot, filePath }, context.signal);
     }
   };
 }
@@ -807,7 +929,7 @@ function resolvePlaywrightCli() {
   return require2.resolve("@playwright/cli/playwright-cli.js");
 }
 function runPlaywright(args, timeoutMs = 6e4) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn2(process.execPath, [resolvePlaywrightCli(), ...args], {
       stdio: ["ignore", "pipe", "pipe"],
       shell: false
@@ -832,7 +954,7 @@ function runPlaywright(args, timeoutMs = 6e4) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve4(stdout.trim());
+      if (code === 0) resolve3(stdout.trim());
       else reject(new Error((stderr || stdout || `Playwright CLI exited with ${code}`).trim()));
     });
   });
@@ -941,7 +1063,7 @@ function createCliWebResearchHealthStore(configDir) {
 
 // src/capabilities/index.ts
 function createCliHostCapabilities(cwd, options = {}) {
-  const bashTool = createBashTool(cwd, { isYoloMode: options.isYoloMode });
+  const bashTool = createBashTool(cwd);
   const healthStore = createCliWebResearchHealthStore(options.configDir ?? getConfigDir());
   const webSearchTool = createSharedWebSearchTool({
     getModel: options.getModel ?? (() => void 0),
@@ -1022,5 +1144,6 @@ export {
   getRuntimeLogPath,
   migrateConfigFromAgentDir,
   createCliWebResearchHealthStore,
+  cleanupBashOutputArtifacts,
   createCliHostCapabilities
 };