@cydm/pie 2.5.1 → 2.6.0

package/dist/chunks/{chunk-REP6QANY.js → chunk-AZ336HKF.js}

@@ -1,7 +1,8 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
-  Agent
-} from "./chunk-ZKHMNEXL.js";
+  Agent,
+  getToolCallerIdentity
+} from "./chunk-Y4CYXJR7.js";
 import {
   FileSystemGateway,
   completeSimple,
@@ -10,7 +11,7 @@ import {
   getPlatformConfig,
   hashText,
   streamSimple
-} from "./chunk-YRXXRLMQ.js";
+} from "./chunk-O2DKMLNX.js";
 import {
   Type
 } from "./chunk-XXGYUYXI.js";
@@ -19,22 +20,31 @@ import {
   __toESM
 } from "./chunk-LZQXQOPJ.js";
 
-// ../../packages/shared-headless-capabilities/node_modules/shell-quote/quote.js
+// ../../node_modules/shell-quote/quote.js
 var require_quote = __commonJS({
-  "../../packages/shared-headless-capabilities/node_modules/shell-quote/quote.js"(exports, module) {
+  "../../node_modules/shell-quote/quote.js"(exports, module) {
     "use strict";
     var OPS = (
       /** @type {const} */
       [
         "||",
         "&&",
+        ";;&",
         ";;",
+        ";&",
         "|&",
         "<(",
+        ">(",
         "<<<",
+        "<<-",
+        "<<",
         ">>",
         ">&",
+        ">|",
+        "&>>",
+        "&>",
         "<&",
+        "<>",
         "&",
         ";",
         "(",
@@ -45,9 +55,13 @@ var require_quote = __commonJS({
       ]
     );
     var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
-    var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+    var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|~]/g;
     module.exports = function quote(xs) {
+      var sawComment = false;
       return xs.map(function(s) {
+        if (sawComment && typeof s === "string" && LINE_TERMINATORS.test(s)) {
+          throw new TypeError("a token after a `comment` must not contain line terminators");
+        }
         if (s === "") {
           return (
             /** @type {const} */
@@ -62,6 +76,12 @@ var require_quote = __commonJS({
             if (LINE_TERMINATORS.test(s.pattern)) {
               throw new TypeError("glob `pattern` must not contain line terminators");
             }
+            if (s.pattern === "") {
+              return (
+                /** @type {const} */
+                "''"
+              );
+            }
             return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
           }
           if ("op" in s && typeof s.op === "string") {
@@ -74,15 +94,19 @@ var require_quote = __commonJS({
             if (LINE_TERMINATORS.test(s.comment)) {
               throw new TypeError("`comment` must not contain line terminators");
             }
+            sawComment = true;
             return "#" + s.comment;
           }
           throw new TypeError("unrecognized object token shape");
         }
+        if (/'/.test(s) && /!/.test(s)) {
+          return "'" + s.replace(/'/g, `'"'"'`) + "'";
+        }
         if (/["\s\\]/.test(s) && !/'/.test(s)) {
-          return "'" + s.replace(/(['])/g, "\\$1") + "'";
+          return "'" + s + "'";
         }
         if (/["'\s]/.test(s)) {
-          return '"' + s.replace(/(["\\$`!])/g, "\\$1") + '"';
+          return '"' + s.replace(/(["\\$`])/g, "\\$1") + '"';
         }
         return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
       }).join(" ");
@@ -90,23 +114,31 @@ var require_quote = __commonJS({
   }
 });
 
-// ../../packages/shared-headless-capabilities/node_modules/shell-quote/parse.js
+// ../../node_modules/shell-quote/parse.js
 var require_parse = __commonJS({
-  "../../packages/shared-headless-capabilities/node_modules/shell-quote/parse.js"(exports, module) {
+  "../../node_modules/shell-quote/parse.js"(exports, module) {
     "use strict";
     var CONTROL = (
       /** @type {const} */
       "(?:" + /** @type {const} */
       [
         "\\|\\|",
-        "\\&\\&",
-        ";;",
-        "\\|\\&",
+        "\\&(?:\\&|>>?)",
+        // `&&`, `&>`, and `&>>`
+        ";;\\&?",
+        // `;;` and `;;&`
+        "[;|]\\&",
+        // `;&` and `|&`
         "\\<\\(",
         "\\<\\<\\<",
+        "\\<\\<-",
+        "\\<\\<(?!\\()",
+        // `<<(` stays `<` and `<(`, as zsh reads it; other shells reject it
         ">>",
-        ">\\&",
-        "<\\&",
+        ">[&|(]",
+        // `>&`, `>|`, and `>(`
+        "<[&>]",
+        // `<&` and `<>`
         "[&;()|<>]"
       ].join(
         /** @type {const} */
@@ -123,10 +155,11 @@ var require_parse = __commonJS({
       /** @type {const} */
       "'([^']*?)'"
     );
-    var DOUBLE_QUOTE = (
-      /** @type {const} */
-      '"((\\\\"|[^"])*?)"'
-    );
+    var ANSI_C_BODY = "(?:\\\\[\\s\\S]|[^\\\\'])*?";
+    var ANSI_C_QUOTE = "\\$'" + ANSI_C_BODY + "'";
+    var ansiCAt = new RegExp("\\$'" + ANSI_C_BODY + "(?:(')|\\\\?$)", "g");
+    var ANSI_C_LETTERS = "abeEfnrtv";
+    var ANSI_C_CHARS = "\x07\b\x1B\x1B\f\n\r	\v";
     var hash = /^#$/;
     var SQ = (
       /** @type {const} */
@@ -175,17 +208,46 @@ var require_parse = __commonJS({
       }
       return pre + r;
     }
+    var ansiCEscape = /\\([0-7]{1,3}|x[\dA-Fa-f]{1,2}|u[\dA-Fa-f]{1,4}|U[\dA-Fa-f]{1,8}|c(?:\\\\|[\s\S])|[abeEfnrtv\\'"?])/g;
+    function expandAnsiCEscape(m, escape2) {
+      var kind = escape2.charAt(0);
+      if (kind === "c") {
+        var ctrl = escape2.charAt(1);
+        return ctrl === "?" ? "\x7F" : String.fromCharCode(ctrl.charCodeAt(0) & 31);
+      }
+      if (kind === "x" || kind === "u" || kind === "U") {
+        var cp = parseInt(escape2.slice(1), 16);
+        if (cp > 1114111) {
+          return m;
+        }
+        return String.fromCharCode.apply(null, cp > 65535 ? [55232 + (cp >> 10), 56320 + (cp & 1023)] : [cp]);
+      }
+      if (kind >= "0" && kind <= "7") {
+        return String.fromCharCode(parseInt(escape2, 8) & 255);
+      }
+      var letter = ANSI_C_LETTERS.indexOf(escape2);
+      return letter < 0 ? escape2 : ANSI_C_CHARS.charAt(letter);
+    }
+    function expandAnsiC(body) {
+      return body.replace(ansiCEscape, expandAnsiCEscape).split("\0")[0];
+    }
+    function closesAnsiC(s, i2) {
+      ansiCAt.lastIndex = i2;
+      return !!/** @type {RegExpExecArray} */
+      ansiCAt.exec(s)[1];
+    }
     function parseInternal(string, env, opts) {
       if (!opts) {
         opts = {};
       }
       var BS = opts.escape || "\\";
       var ifs = opts.splitUnquoted === true ? " 	\n" : typeof opts.splitUnquoted === "string" ? opts.splitUnquoted : "";
-      var BAREWORD = "(\\" + BS + `['"` + META + `]|[^\\s'"` + META + "])+";
+      var BAREWORD = "(\\" + BS + `['"$\\` + BS + META + "]|\\$\\$|\\$(?!" + ANSI_C_QUOTE.slice(2) + `)|[^\\s'"$` + META + "])+";
+      var DOUBLE_QUOTE = '"(?:\\' + BS + '[\\s\\S]|[^"\\' + BS + '])*"';
       var chunker = new RegExp([
         "(" + CONTROL + ")",
         // control chars
-        "(" + BAREWORD + "|" + DOUBLE_QUOTE + "|" + SINGLE_QUOTE + ")+"
+        "(" + ANSI_C_QUOTE + "|" + BAREWORD + "|" + DOUBLE_QUOTE + "|" + SINGLE_QUOTE + ")+"
       ].join("|"), "g");
       var matches = matchAll(string, chunker);
       if (matches.length === 0) {
@@ -240,9 +302,8 @@ var require_parse = __commonJS({
             varend -= 1;
             varname = s.slice(i2, varend);
             i2 = varend;
-          } else if (/[*@#?$!_-]/.test(char)) {
+          } else if (/[*@#?$!-]/.test(char)) {
             varname = char;
-            i2 += 1;
           } else {
             var slicedFromI = s.slice(i2);
             varend = slicedFromI.match(/[^\w\d_]/);
@@ -332,6 +393,11 @@ var require_parse = __commonJS({
             );
           } else if (c === BS) {
             esc = true;
+          } else if (c === DS && s.charAt(i2 + 1) === SQ && closesAnsiC(s, i2)) {
+            flushRun();
+            sawQuote = true;
+            out += expandAnsiC(s.slice(i2 + 2, ansiCAt.lastIndex - 1));
+            i2 = ansiCAt.lastIndex - 1;
           } else if (c === DS) {
             var value = parseEnvVar();
             if (!ifs) {
@@ -415,9 +481,9 @@ var require_parse = __commonJS({
   }
 });
 
-// ../../packages/shared-headless-capabilities/node_modules/shell-quote/index.js
+// ../../node_modules/shell-quote/index.js
 var require_shell_quote = __commonJS({
-  "../../packages/shared-headless-capabilities/node_modules/shell-quote/index.js"(exports) {
+  "../../node_modules/shell-quote/index.js"(exports) {
     "use strict";
     exports.quote = require_quote();
     exports.parse = require_parse();
@@ -1392,10 +1458,14 @@ Subagent guarded mode uses the same bash risk policy as the parent agent. Destru
     }
   };
 }
-function filterToolsForSubagent(runtimeTools, parentTools, plan) {
+function filterToolsForSubagent(runtimeTools, parentTools, plan, mode) {
   const parentNames = new Set(parentTools.map((tool) => tool.name));
   const filtered = [];
   for (const tool of runtimeTools) {
+    if (tool.name === "spawn_subagents_parallel") {
+      plan.toolsExcluded.push({ name: tool.name, reason: "recursive delegation is not allowed" });
+      continue;
+    }
     if (!parentNames.has(tool.name)) {
       plan.toolsExcluded.push({ name: tool.name, reason: "not available in parent tool set" });
       continue;
@@ -1404,6 +1474,10 @@ function filterToolsForSubagent(runtimeTools, parentTools, plan) {
       filtered.push(wrapBashGuard(tool, plan));
       continue;
     }
+    if (mode === "edit" && (tool.name === "write_file" || tool.name === "edit_file")) {
+      filtered.push(tool);
+      continue;
+    }
     const policy = getSubagentToolPolicyDecision(tool);
     if (!policy.allowed) {
       plan.toolsExcluded.push({ name: tool.name, reason: policy.reason || "not allowed for subagent" });
@@ -1413,7 +1487,7 @@ function filterToolsForSubagent(runtimeTools, parentTools, plan) {
   }
   return filtered;
 }
-function buildSubagentPlan(deps, task, name, priority, timeoutSeconds, modelOverride, thinkingLevel = DEFAULT_SUBAGENT_THINKING_LEVEL) {
+function buildSubagentPlan(deps, task, name, priority, timeoutSeconds, modelOverride, thinkingLevel = DEFAULT_SUBAGENT_THINKING_LEVEL, mode = "read") {
   const complexity = inferComplexity(task, priority);
   const modelClass = selectModelClass(complexity, priority);
   const overrideResolution = modelOverride ? deps.resolveModelRef?.(modelOverride) ?? { model: void 0, fallbackReason: `model override "${modelOverride}" is not supported by this host` } : void 0;
@@ -1428,6 +1502,7 @@ function buildSubagentPlan(deps, task, name, priority, timeoutSeconds, modelOver
     task,
     name,
     priority,
+    mode,
     complexity,
     modelClass,
     modelOverride,
@@ -1439,8 +1514,11 @@ function buildSubagentPlan(deps, task, name, priority, timeoutSeconds, modelOver
     timeoutSeconds,
     outputContract: "Return a concise answer with evidence, uncertainty, and any parent follow-up needed."
   };
-  const runtimeTools = deps.createRuntimeTools();
-  const filteredTools = filterToolsForSubagent(runtimeTools, deps.getParentTools(), partialPlan);
+  const runtimeTools = deps.createRuntimeTools(mode);
+  const filteredTools = filterToolsForSubagent(runtimeTools, deps.getParentTools(), partialPlan, mode);
+  if (mode === "edit" && !filteredTools.some((tool) => tool.name === "write_file" || tool.name === "edit_file")) {
+    throw new Error("Edit delegation requires executable editing tools from the parent's current tool set; it is unavailable in read-only/plan mode.");
+  }
   const plan = {
     ...partialPlan,
     toolsAllowed: filteredTools.map((tool) => tool.name)
@@ -1502,7 +1580,7 @@ function inferUncertainty(text, signals) {
   return "medium";
 }
 function isParentHandoffRequired(task) {
-  return task.needsParentWrite || task.status === "timeout" || task.status === "failed" || task.confidenceSignals.some((signal) => signal.type === "tool_error" || signal.type === "no_tool_use");
+  return task.mode === "edit" || task.needsParentWrite || task.status === "timeout" || task.status === "failed" || task.confidenceSignals.some((signal) => signal.type === "tool_error" || signal.type === "no_tool_use");
 }
 async function runSubagentWithProgress(deps, task, reportProgress, signal) {
   const startTime = Date.now();
@@ -1511,9 +1589,9 @@ async function runSubagentWithProgress(deps, task, reportProgress, signal) {
   deps.debugLog?.("run", "runSubagentWithProgress START", { taskName: task.name, yoloMode: deps.yoloMode });
   try {
     reportProgress({ message: `[${task.name}] Starting...`, increment: 5 });
-    const { plan, tools, apiKey, model } = buildSubagentPlan(deps, task.task, task.name, task.priority, task.timeoutSeconds, task.modelOverride, task.thinkingLevel);
+    const { plan, tools, apiKey, model } = buildSubagentPlan(deps, task.task, task.name, task.priority, task.timeoutSeconds, task.modelOverride, task.thinkingLevel, task.mode);
     task.plan = plan;
-    task.needsParentWrite = needsParentWrite(task.task);
+    task.needsParentWrite = task.mode === "read" && needsParentWrite(task.task);
     for (const excluded of plan.toolsExcluded) {
       if (excluded.reason === "unclassified_tool") {
         task.confidenceSignals.push({ type: "unclassified_tool", message: `${excluded.name} inherited without risk metadata` });
@@ -1538,7 +1616,7 @@ async function runSubagentWithProgress(deps, task, reportProgress, signal) {
 Task boundary:
 - Work only on the assigned task.
 - Use available tools to gather evidence before making claims.
-- Do not edit files; if writing is needed, say what the parent agent should change.
+${task.mode === "edit" ? "- You may edit files and run tests using the inherited parent tools and permissions. This is a shared workspace, not an isolated sandbox. Preserve existing user changes. Do not commit or automatically roll back changes. Report changed files, tests actually run, and remaining work for parent review." : "- Do not edit files; if writing is needed, say what the parent agent should change."}
 - Return a concise answer with evidence and uncertainty.
 
 Output:
@@ -1600,8 +1678,8 @@ ${formatSkillsForPrompt(deps.skills ?? [])}`;
       }
     });
     let prompt = task.task;
-    if (task.needsParentWrite) {
-      prompt += "\n\nThis task appears to require edits. Do not write files; provide a read-only plan and set clear parent follow-up.";
+    if (task.mode === "read") {
+      prompt += "\n\nThis delegation is read mode. Do not write files. If changes are needed, describe them for the parent.";
     }
     prompt += "\n\nReturn evidence for your conclusion and state uncertainty as low, medium, or high.";
     reportProgress({ message: `[${task.name}] Running plan ${plan.complexity}/${plan.modelClass}...`, increment: 20 });
@@ -1669,7 +1747,7 @@ function buildParallelResult(tasks, totalDuration) {
     const statusLabel = task.status === "completed" ? "completed" : task.status;
     resultText += `**${task.name}** (${statusLabel}`;
     if (task.plan) {
-      resultText += `, ${task.plan.complexity}/${task.plan.modelClass}`;
+      resultText += `, mode=${task.mode}, ${task.plan.complexity}/${task.plan.modelClass}`;
       if (task.plan.thinkingLevel !== DEFAULT_SUBAGENT_THINKING_LEVEL) {
         resultText += `, thinking=${task.plan.thinkingLevel}`;
       }
@@ -1693,7 +1771,9 @@ function buildParallelResult(tasks, totalDuration) {
       resultText += `Evidence: ${task.evidence.slice(0, 5).map((entry) => `${entry.type}:${entry.value}`).join("; ")}
 `;
     }
-    if (task.needsParentWrite) {
+    if (task.mode === "edit") {
+      resultText += "Parent follow-up: review changes and validate reported tests. Partial edits are preserved on failure; no automatic rollback or task retry.\n";
+    } else if (task.needsParentWrite) {
       resultText += "Parent follow-up: writing appears to be needed; parent agent must make any edits.\n";
     } else if (task.parentHandoffRequired) {
       resultText += "Parent follow-up: subagent result needs parent review or continuation.\n";
@@ -1715,7 +1795,7 @@ function normalizeTaskDefs(args) {
     return { error: "Invalid spawn_subagents_parallel arguments: tasks must be a non-empty array." };
   }
   const normalized = [];
-  const allowedFields = [...TASK_FIELD_ALIASES, "name", "priority", "timeout", "model", "thinkingLevel"];
+  const allowedFields = [...TASK_FIELD_ALIASES, "name", "priority", "timeout", "model", "thinkingLevel", "mode"];
   for (const [index, def] of taskDefs.entries()) {
     if (!def || typeof def !== "object") {
       return { error: `Invalid task #${index + 1}: expected an object with the objective in "task" (aliases "description"/"prompt"/"objective" accepted).` };
@@ -1737,6 +1817,9 @@ function normalizeTaskDefs(args) {
     if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
       return { error: `Invalid task #${index + 1}: timeout must be a positive number of seconds.` };
     }
+    if (def.mode !== void 0 && def.mode !== "read" && def.mode !== "edit") {
+      return { error: `Invalid task #${index + 1}: "mode" must be "read" or "edit".` };
+    }
     const priority = def.priority === "thorough" ? "thorough" : "fast";
     const modelOverride = typeof def.model === "string" ? def.model.trim() : void 0;
     if (def.model !== void 0 && !modelOverride) {
@@ -1749,11 +1832,15 @@ function normalizeTaskDefs(args) {
       name: typeof def.name === "string" && def.name.trim() ? def.name.trim() : void 0,
       task,
       priority,
+      mode: def.mode ?? "read",
       timeoutSeconds,
       modelOverride,
       thinkingLevel: def.thinkingLevel
     });
   }
+  if (normalized.length !== 1 && normalized.some((task) => task.mode === "edit")) {
+    return { error: "An edit delegation must contain exactly one task. Wait for it to finish before editing or launching another edit task in the shared workspace." };
+  }
   return normalized;
 }
 var DEFAULT_MAX_CONCURRENT_SUBAGENTS = 4;
@@ -1792,10 +1879,10 @@ function createSubagentCapability(deps) {
     label: "Spawn Subagents",
     description: `Spawn child agents to run bounded sub-tasks in parallel.
 
-Use this for independent investigation, search, review, or triage work. Provide each task as a plain objective. Pie chooses the model class automatically. Use timeout only for unusually long tasks.
+Default mode="read" is for investigation, search, review, or triage and cannot edit source files. Explicit mode="edit" permits file editing and tests with inherited parent permissions. An edit call must contain exactly one task; wait for it to finish before editing or launching another edit task. The workspace is shared, not isolated. Edit tasks are not automatically retried; the parent must review changes and test results. Provide each task as a plain objective. Pie chooses the model class automatically. Use timeout only for unusually long tasks.
 
 Arguments shape (each tasks[] item puts the objective in "task" \u2014 "description"/"prompt"/"objective" are accepted as aliases):
-{ "tasks": [{ "task": "<objective text>", "name": "<optional short label>", "priority": "fast" | "thorough", "model": "<optional explicit model override>", "thinkingLevel": "<optional off|minimal|low|medium|high|xhigh, default medium>", "timeout": 600 }] }
+{ "tasks": [{ "task": "<objective text>", "mode": "read" | "edit", "name": "<optional short label>", "priority": "fast" | "thorough", "model": "<optional explicit model override>", "thinkingLevel": "<optional off|minimal|low|medium|high|xhigh, default medium>", "timeout": 600 }] }
 
 "model" overrides the automatic model-class selection for that task when the user explicitly asks for a specific model (e.g. "anthropic/claude-..."). Prefer "provider/model-id"; a bare model id works only when it is unambiguous across providers. When the override cannot be resolved, the task falls back to automatic selection and reports why.
 
@@ -1809,6 +1896,7 @@ Arguments shape (each tasks[] item puts the objective in "task" \u2014 "descript
             prompt: Type.Optional(Type.String({ description: "Alias for task." })),
             objective: Type.Optional(Type.String({ description: "Alias for task." })),
             name: Type.Optional(Type.String({ description: "Short name for this subagent, shown in progress updates." })),
+            mode: Type.Optional(Type.Union([Type.Literal("read"), Type.Literal("edit")], { description: "Default read. Edit permits inherited file editing and tests in the shared workspace; exactly one task per edit call, parent review required." })),
             priority: Type.Optional(Type.Union([Type.Literal("fast"), Type.Literal("thorough")], { description: "fast uses lower-cost defaults; thorough raises model class when needed." })),
             model: Type.Optional(Type.String({ description: 'Explicit model override for this task, e.g. "provider/model-id". Only set when the user explicitly requests a specific model; otherwise Pie picks the model class automatically.' })),
             thinkingLevel: Type.Optional(Type.Union([Type.Literal("off"), Type.Literal("minimal"), Type.Literal("low"), Type.Literal("medium"), Type.Literal("high"), Type.Literal("xhigh")], { description: `Reasoning level for this task. Default: "medium". Only override when the user asks (e.g. "xhigh" for deep review tasks, "off" for cheap lookups). Ignored by non-reasoning models.` })),
@@ -1846,6 +1934,7 @@ Arguments shape (each tasks[] item puts the objective in "task" \u2014 "descript
         status: "pending",
         task: def.task,
         priority: def.priority,
+        mode: def.mode,
         timeoutSeconds: def.timeoutSeconds,
         modelOverride: def.modelOverride,
         thinkingLevel: def.thinkingLevel,
@@ -1864,7 +1953,7 @@ Arguments shape (each tasks[] item puts the objective in "task" \u2014 "descript
       const runTask = async (task) => {
         for (let attempt = 0; ; attempt++) {
           await runSubagentWithProgress(deps, task, toolContext.reportProgress, signal);
-          const canRetry = task.status === "failed" && isTransientNetworkError(task.error ?? "") && attempt < MAX_TRANSIENT_RETRIES && !signal?.aborted;
+          const canRetry = task.mode === "read" && task.status === "failed" && isTransientNetworkError(task.error ?? "") && attempt < MAX_TRANSIENT_RETRIES && !signal?.aborted;
           if (!canRetry) return;
           const failureReason = task.error ?? "unknown";
           task.evidence.length = 0;
@@ -1896,6 +1985,7 @@ Arguments shape (each tasks[] item puts the objective in "task" \u2014 "descript
             id: task.id,
             name: task.name,
             status: task.status,
+            mode: task.mode,
             task: task.task,
             timeoutSeconds: task.timeoutSeconds,
             plan: task.plan,
@@ -5244,6 +5334,16 @@ var AgentSessionQueue = class {
     }
     this.emitQueueChanged();
   }
+  /** Promote only an input still owned by this queue, never re-send agent-owned inputs. */
+  promoteLatestFollowUp() {
+    const input = this.queuedInputs.slice().reverse().find((queued) => queued.visibility === "user" && queued.mode === "followUp");
+    if (!input || input.deliveredToAgent) return void 0;
+    input.mode = "steer";
+    input.deliverWhileStreaming = true;
+    if (this.getIsStreaming()) this.deliverToAgent(input);
+    this.emitQueueChanged();
+    return cloneQueuedInput(input);
+  }
   deliverToAgent(queuedInput) {
     if (queuedInput.deliveredToAgent) {
       return;
@@ -6404,6 +6504,12 @@ var AgentSessionController = class {
   drainQueuedInputsForEditor() {
     return this.queue.drainForEditor();
   }
+  /** Upgrade the latest visible follow-up that has not been delivered to the agent. */
+  promoteLatestFollowUpToSteer() {
+    const promoted = this.disposed ? void 0 : this.queue.promoteLatestFollowUp();
+    if (promoted && !this.isStreaming) this.requestQueueDispatch();
+    return promoted;
+  }
   replaceQueuedInputText(search, replacement) {
     this.queue.replaceText(search, replacement);
   }
@@ -8775,7 +8881,7 @@ function createReadTool(cwd, options) {
   return {
     name: "read",
     label: "read",
-    description: `Read a file's contents. Use this before editing, and use offset/limit for large files. It can also directly understand image, video, audio, and document files when a file-understanding model is configured; pass question for a focused media/document question instead of preprocessing the file with shell tools. Example: read_file path='Scripts/PlayerController.cs' or read_file path='Data/config.json'. ${pathResolutionDescription} For text files, output is truncated to ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). When you need the full file, continue with a larger offset until complete.`,
+    description: `Read a file's contents. Use this before editing, and use offset/limit for large files. Images are attached for the current model when it supports vision; otherwise a configured file-understanding service analyzes them. Video, audio, and documents require a configured understanding service. Pass question to specify what to focus on; it does not force a separate model request. Example: read_file path='Scripts/PlayerController.cs' or read_file path='Data/config.json'. ${pathResolutionDescription} For text files, output is truncated to ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). When you need the full file, continue with a larger offset until complete.`,
     parameters: readSchema,
     execute: async (_toolCallId, params, signal) => {
       const { path: path4, root, offset, limit, question } = params;
@@ -8848,7 +8954,7 @@ function createReadTool(cwd, options) {
                 });
                 return;
               }
-              if (magicInfo?.kind === "image" && question && options?.understandFile && (!INLINE_IMAGE_MIME_TYPES.has(magicInfo.mimeType) || stat.size > MAX_INLINE_IMAGE_BYTES)) {
+              if (magicInfo?.kind === "image" && options?.understandFile && (!INLINE_IMAGE_MIME_TYPES.has(magicInfo.mimeType) || stat.size > MAX_INLINE_IMAGE_BYTES)) {
                 resolve3(await options.understandFile({
                   absolutePath,
                   displayPath: path4,
@@ -8864,7 +8970,7 @@ function createReadTool(cwd, options) {
               }
               const imageInfo = options?.allowBinary === false || magicInfo?.kind !== "image" || !INLINE_IMAGE_MIME_TYPES.has(magicInfo.mimeType) ? void 0 : await readImageInfo(absolutePath, fs2);
               if (imageInfo) {
-                if (question && options?.understandFile) {
+                if (options?.understandFile) {
                   resolve3(await options.understandFile({
                     absolutePath,
                     displayPath: path4,
@@ -8879,7 +8985,8 @@ function createReadTool(cwd, options) {
                 const dimensionText = imageInfo.width && imageInfo.height ? `, ${imageInfo.width}x${imageInfo.height}` : "";
                 resolve3({
                   content: [
-                    { type: "text", text: `Read image file [${imageInfo.mimeType}${dimensionText}]. Original image attached as an image block; for very large images, prefer a smaller crop or resized copy before rereading.` },
+                    { type: "text", text: `Read image file [${imageInfo.mimeType}${dimensionText}]. Original image attached as an image block; for very large images, prefer a smaller crop or resized copy before rereading.${question?.trim() ? `
+Focus: ${question.trim()}` : ""}` },
                     { type: "image", data: imageInfo.base64, mimeType: imageInfo.mimeType }
                   ],
                   details: {
@@ -8998,14 +9105,15 @@ function createReadTool(cwd, options) {
               const readReachedEndOfFile = startLine + range2.selectedLines >= range2.totalLines;
               const isCompleteTextKnown = readStartsAtBeginning && readReachedEndOfFile && !truncation.truncated && !truncation.firstLineExceedsLimit;
               let callerObservation = fileObservationState;
-              if (signal) {
+              const callerKey = getToolCallerIdentity(signal) ?? signal;
+              if (callerKey) {
                 const generation = fileObservationState.getGeneration();
-                const existing = callerObservations.get(signal);
+                const existing = callerObservations.get(callerKey);
                 if (existing?.generation === generation) {
                   callerObservation = existing.state;
                 } else {
                   callerObservation = createFileObservationState();
-                  callerObservations.set(signal, { generation, state: callerObservation });
+                  callerObservations.set(callerKey, { generation, state: callerObservation });
                 }
               }
               if (fileObservationState.isUnchangedReadRange(absolutePath, rangeKey, snapshot, range2.selectedContentHash) && callerObservation.isUnchangedReadRange(absolutePath, rangeKey, snapshot, range2.selectedContentHash)) {
@@ -13451,6 +13559,44 @@ function createReadFileUnderstandingHandler(deps) {
 async function understandFileWithModel(deps, request) {
   const purpose = `read_file.${request.kind}`;
   const agentModel = deps.getAgentModel();
+  if (request.kind === "image" && request.imageInfo && agentModel?.input.includes("image")) {
+    if (request.signal?.aborted) throw new Error("Operation aborted");
+    return {
+      content: [
+        { type: "text", text: `Read image file ${request.displayPath} [${request.mimeType}]. Original image attached for the current model.${request.question?.trim() ? `
+Focus: ${request.question.trim()}` : ""}` },
+        { type: "image", data: request.imageInfo.base64, mimeType: request.imageInfo.mimeType }
+      ],
+      details: {
+        image: { mimeType: request.imageInfo.mimeType, width: request.imageInfo.width, height: request.imageInfo.height },
+        understanding: { purpose, kind: request.kind, mimeType: request.mimeType, agentModel: getModelLabel(agentModel), routeSource: "current_model", inputMode: "nativeAttachment" }
+      },
+      isError: false
+    };
+  }
+  if ((request.kind === "video" || request.kind === "audio") && agentModel?.api === "openai-completions" && agentModel.input.includes(request.kind)) {
+    const capability = agentModel.fileCapabilities?.[request.kind];
+    const audioSupported = request.kind !== "audio" || ["audio/wav", "audio/mpeg", "audio/mp3"].includes(request.mimeType);
+    if (capability && typeof capability === "object" && capability.supported !== false && capability.nativeInline === true && audioSupported && (!capability.formats || capability.formats.includes(request.mimeType)) && capability.maxDurationSeconds === void 0) {
+      const fs2 = getFileSystem();
+      const size = (await fs2.stat(request.absolutePath)).size;
+      const cap = Math.min(capability.maxFileSizeMb ?? 15, 15) * 1024 * 1024;
+      if (size > 0 && size <= cap) {
+        if (request.signal?.aborted) throw new Error("Operation aborted");
+        const data = await fs2.readFile(request.absolutePath, "base64");
+        if (request.signal?.aborted) throw new Error("Operation aborted");
+        if (data) return {
+          content: [
+            { type: "text", text: `Read ${request.kind} file ${request.displayPath} [${request.mimeType}]. Original media attached for the current model.${request.question?.trim() ? `
+Focus: ${request.question.trim()}` : ""}` },
+            { type: request.kind, data, mimeType: request.mimeType }
+          ],
+          details: { understanding: { purpose, kind: request.kind, mimeType: request.mimeType, agentModel: getModelLabel(agentModel), routeSource: "current_model", inputMode: "nativeAttachment", attachmentBytes: size } },
+          isError: false
+        };
+      }
+    }
+  }
   const singleDecision = deps.resolveToolModel(purpose);
   const candidateDecisions = deps.resolveToolModelCandidates?.(purpose) ?? [singleDecision];
   const sessionId = deps.getSessionId() || `read-file-${Date.now()}`;
@@ -14570,19 +14716,121 @@ var webFetchSchema = Type.Object({
 var DEFAULT_TIMEOUT_MS = 45e3;
 var DEFAULT_MAX_BYTES2 = 2e6;
 var DEFAULT_MAX_CHARS = 1e5;
+var DEFAULT_MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 function modelLabel2(model) {
   return model ? `${model.provider}/${model.id}` : void 0;
 }
+function parseIpv4Part(part) {
+  if (part === "") return void 0;
+  const lowered = part.toLowerCase();
+  if (lowered.startsWith("0x")) {
+    const digits = lowered.slice(2);
+    return /^[0-9a-f]+$/.test(digits) ? parseInt(digits, 16) : void 0;
+  }
+  if (lowered.length > 1 && lowered.startsWith("0")) {
+    return /^[0-7]+$/.test(lowered) ? parseInt(lowered, 8) : void 0;
+  }
+  if (!/^\d+$/.test(lowered)) return void 0;
+  return parseInt(lowered, 10);
+}
+function parseIpv4Literal(host) {
+  const parts = host.split(".");
+  if (parts.length === 0 || parts.length > 4) return void 0;
+  const numbers = [];
+  for (const part of parts) {
+    const value = parseIpv4Part(part);
+    if (value === void 0) return void 0;
+    numbers.push(value);
+  }
+  const count = numbers.length;
+  const last = numbers[count - 1];
+  if (last > 256 ** (5 - count) - 1) return void 0;
+  for (let i = 0; i < count - 1; i += 1) {
+    if (numbers[i] > 255) return void 0;
+  }
+  let address = 0;
+  for (let i = 0; i < count - 1; i += 1) address = address * 256 + numbers[i];
+  address = address * 256 ** (5 - count) + last;
+  return [address >>> 24 & 255, address >>> 16 & 255, address >>> 8 & 255, address & 255];
+}
+function isPrivateIpv4(octets) {
+  const [a = 0, b = 0] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && octets[2] === 0) return true;
+  if (a === 192 && b === 0 && octets[2] === 2) return true;
+  if (a === 192 && b === 88 && octets[2] === 99) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51 && octets[2] === 100) return true;
+  if (a === 203 && b === 0 && octets[2] === 113) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function parseIpv6Literal(hostname) {
+  let host = hostname.toLowerCase();
+  if (host.startsWith("[")) host = host.slice(1, host.endsWith("]") ? -1 : void 0);
+  const zoneIndex = host.indexOf("%");
+  if (zoneIndex >= 0) host = host.slice(0, zoneIndex);
+  if (!host.includes(":")) return void 0;
+  const halves = host.split("::");
+  if (halves.length > 2) return void 0;
+  const parseTokens = (tokens) => {
+    const groups = [];
+    for (let i = 0; i < tokens.length; i += 1) {
+      const token = tokens[i];
+      if (token === "") return void 0;
+      if (i === tokens.length - 1 && token.includes(".")) {
+        const v4 = parseIpv4Literal(token);
+        if (!v4) return void 0;
+        groups.push(v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/.test(token)) return void 0;
+      groups.push(parseInt(token, 16));
+    }
+    return groups;
+  };
+  const head = halves[0] === "" ? [] : parseTokens(halves[0].split(":"));
+  if (head === void 0) return void 0;
+  const tail = halves.length === 2 ? halves[1] === "" ? [] : parseTokens(halves[1].split(":")) : [];
+  if (tail === void 0) return void 0;
+  if (halves.length === 1) return head.length === 8 ? head : void 0;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 1) return void 0;
+  return [...head, ...new Array(missing).fill(0), ...tail];
+}
+function isPrivateIpv6(groups) {
+  const first = groups[0];
+  if (groups.every((group) => group === 0)) return true;
+  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) return true;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  const embeddedV4 = [groups[6] >> 8, groups[6] & 255, groups[7] >> 8, groups[7] & 255];
+  if (groups.slice(0, 5).every((group) => group === 0) && groups[5] === 65535) {
+    return isPrivateIpv4(embeddedV4);
+  }
+  if (groups.slice(0, 6).every((group) => group === 0)) {
+    return isPrivateIpv4(embeddedV4);
+  }
+  if (first === 100 && groups[1] === 65435 && groups.slice(2, 6).every((group) => group === 0)) {
+    return isPrivateIpv4(embeddedV4);
+  }
+  return false;
+}
 function isPrivateHostname(hostname) {
-  const host = hostname.toLowerCase();
+  const host = hostname.toLowerCase().trim().replace(/\.+$/, "");
   if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (host === "0.0.0.0") return true;
-  if (host.startsWith("127.")) return true;
-  if (host.startsWith("10.")) return true;
-  if (host.startsWith("192.168.")) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (host === "::1" || host === "[::1]") return true;
-  if (host === "169.254.169.254") return true;
+  if (host === "local" || host.endsWith(".local")) return true;
+  const v4 = parseIpv4Literal(host);
+  if (v4) return isPrivateIpv4(v4);
+  const v6 = parseIpv6Literal(host);
+  if (v6) return isPrivateIpv6(v6);
   return false;
 }
 function charsetFromContentType(contentType) {
@@ -14721,6 +14969,24 @@ async function cancelResponseBody(response) {
   } catch {
   }
 }
+var DISCARD_BODY_GRACE_MS = 250;
+async function discardResponseBody(response) {
+  await new Promise((resolve3) => {
+    let settled = false;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve3();
+    };
+    const timer = setTimeout(settle, DISCARD_BODY_GRACE_MS);
+    try {
+      void cancelResponseBody(response).then(settle, settle);
+    } catch {
+      settle();
+    }
+  });
+}
 var BODY_TRUNCATED_ERROR_CODE = "body_truncated";
 function isBodyTruncationError(error) {
   return error instanceof Error && error.code === BODY_TRUNCATED_ERROR_CODE;
@@ -14857,7 +15123,8 @@ function createSharedWebFetchTool(deps = {}) {
           isError: true
         };
       }
-      if (!deps.allowPrivateHosts?.() && isPrivateHostname(parsed.hostname)) {
+      const allowPrivate = deps.allowPrivateHosts?.() ?? false;
+      if (!allowPrivate && isPrivateHostname(parsed.hostname)) {
         return {
           content: [{ type: "text", text: `Blocked private or local URL: ${url}` }],
           details: { url, sourceUrl: url, durationMs: Date.now() - start, failureCategory: "blocked_private_host" },
@@ -14866,22 +15133,91 @@ function createSharedWebFetchTool(deps = {}) {
       }
       const timeout = createTimeoutSignal(signal, deps.timeoutMs ?? DEFAULT_TIMEOUT_MS);
       try {
-        const response = await (deps.fetch ?? fetch)(url, {
+        const requestHeaders = {
+          "user-agent": "Pie web_fetch/1.0",
+          accept: "text/html,application/xhtml+xml,text/plain,application/pdf,*/*;q=0.8"
+        };
+        const doFetch = (target) => (deps.fetch ?? fetch)(target, {
           method: "GET",
-          redirect: "follow",
+          // Redirects are followed manually in the loop below so that every
+          // hop is validated (scheme + host) BEFORE its request is issued.
+          // A transport that ignores this and follows internally is caught
+          // post-hoc via the response.url guard below.
+          redirect: "manual",
           signal: timeout.signal,
-          headers: {
-            "user-agent": "Pie web_fetch/1.0",
-            accept: "text/html,application/xhtml+xml,text/plain,application/pdf,*/*;q=0.8"
-          }
+          headers: requestHeaders
         });
+        const redirectChain = [url];
+        const maxRedirects = deps.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+        let currentUrl = url;
+        let response = await doFetch(currentUrl);
+        let redirectsFollowed = 0;
+        while (REDIRECT_STATUSES.has(response.status)) {
+          const location = response.headers.get("location")?.trim();
+          if (!location) break;
+          let next;
+          try {
+            next = new URL(location, currentUrl);
+          } catch {
+            await discardResponseBody(response);
+            return {
+              content: [{ type: "text", text: `web_fetch redirect target is not a valid URL: ${location}` }],
+              details: { url, sourceUrl: url, finalUrl: currentUrl, redirectChain, durationMs: Date.now() - start, failureCategory: "invalid_url" },
+              isError: true
+            };
+          }
+          if (next.protocol !== "http:" && next.protocol !== "https:") {
+            await discardResponseBody(response);
+            return {
+              content: [{ type: "text", text: `web_fetch only follows http(s) redirects: ${next.toString()} (from ${currentUrl})` }],
+              details: { url, sourceUrl: url, finalUrl: next.toString(), redirectChain: [...redirectChain, next.toString()], durationMs: Date.now() - start, failureCategory: "invalid_url" },
+              isError: true
+            };
+          }
+          if (!allowPrivate && isPrivateHostname(next.hostname)) {
+            await discardResponseBody(response);
+            return {
+              content: [{ type: "text", text: `Blocked redirect to private or local URL: ${next.toString()} (while fetching ${url})` }],
+              details: { url, sourceUrl: url, finalUrl: next.toString(), redirectChain: [...redirectChain, next.toString()], durationMs: Date.now() - start, failureCategory: "blocked_private_host" },
+              isError: true
+            };
+          }
+          redirectsFollowed += 1;
+          if (redirectsFollowed > maxRedirects) {
+            await discardResponseBody(response);
+            return {
+              content: [{ type: "text", text: `web_fetch stopped after ${maxRedirects} redirects while fetching ${url} (last hop: ${currentUrl} -> ${location})` }],
+              details: { url, sourceUrl: url, finalUrl: currentUrl, redirectChain, durationMs: Date.now() - start, failureCategory: "too_many_redirects" },
+              isError: true
+            };
+          }
+          await discardResponseBody(response);
+          currentUrl = next.toString();
+          redirectChain.push(currentUrl);
+          response = await doFetch(currentUrl);
+        }
+        const finalUrl = response.url || currentUrl;
+        let transportFinalHostname;
+        try {
+          transportFinalHostname = new URL(finalUrl).hostname;
+        } catch {
+          transportFinalHostname = void 0;
+        }
+        if (!allowPrivate && transportFinalHostname && isPrivateHostname(transportFinalHostname)) {
+          await discardResponseBody(response);
+          return {
+            content: [{ type: "text", text: `Blocked: the fetch transport followed a redirect to private or local URL ${finalUrl} (while fetching ${url})` }],
+            details: { url, sourceUrl: url, finalUrl, redirectChain, durationMs: Date.now() - start, failureCategory: "blocked_private_host" },
+            isError: true
+          };
+        }
         const contentType = response.headers.get("content-type") || "";
         const maxBytes = deps.maxBytes ?? DEFAULT_MAX_BYTES2;
         const bodyResult = await readResponseBody(response, maxBytes);
         if (bodyResult.exceededLimit) {
           return {
             content: [{ type: "text", text: `Fetched content is too large (${bodyResult.observedBytes} bytes; max ${maxBytes}).` }],
-            details: { url, sourceUrl: url, finalUrl: response.url || url, status: response.status, contentType, bytes: bodyResult.observedBytes, truncated: true, truncationReason: "max_bytes", durationMs: Date.now() - start, failureCategory: "too_large" },
+            details: { url, sourceUrl: url, finalUrl, status: response.status, contentType, bytes: bodyResult.observedBytes, truncated: true, truncationReason: "max_bytes", durationMs: Date.now() - start, failureCategory: "too_large" },
             isError: true
           };
         }
@@ -14889,7 +15225,7 @@ function createSharedWebFetchTool(deps = {}) {
         if (!response.ok) {
           return {
             content: [{ type: "text", text: `web_fetch failed with HTTP ${response.status} for ${url}` }],
-            details: { url, sourceUrl: url, finalUrl: response.url || url, status: response.status, contentType, bytes: bodyResult.observedBytes, durationMs: Date.now() - start, failureCategory: "http_error" },
+            details: { url, sourceUrl: url, finalUrl, status: response.status, contentType, bytes: bodyResult.observedBytes, redirectChain, durationMs: Date.now() - start, failureCategory: "http_error" },
             isError: true
           };
         }
@@ -14907,7 +15243,7 @@ function createSharedWebFetchTool(deps = {}) {
             details: {
               url,
               sourceUrl: url,
-              finalUrl: response.url || url,
+              finalUrl,
               status: response.status,
               contentType,
               charset: decoded.charset,
@@ -14926,15 +15262,14 @@ function createSharedWebFetchTool(deps = {}) {
         if (!text) {
           return {
             content: [{ type: "text", text: `web_fetch could not extract readable text from ${url}` }],
-            details: { url, sourceUrl: url, finalUrl: response.url || url, status: response.status, contentType, charset: decoded.charset, decodeWarning: decoded.decodeWarning, bytes: bodyResult.observedBytes, extractionMethod, durationMs: Date.now() - start, failureCategory: "unsupported_content" },
+            details: { url, sourceUrl: url, finalUrl, status: response.status, contentType, charset: decoded.charset, decodeWarning: decoded.decodeWarning, bytes: bodyResult.observedBytes, redirectChain, extractionMethod, durationMs: Date.now() - start, failureCategory: "unsupported_content" },
             isError: true
           };
         }
         const maxChars = deps.maxChars ?? DEFAULT_MAX_CHARS;
         const truncated = text.length > maxChars;
         if (truncated) text = text.slice(0, maxChars) + "\n\n[web_fetch content truncated]";
-        const extraction = prompt?.trim() ? await applyPromptWithModel(deps, prompt.trim(), response.url || url, text, timeout.signal) : { text, model: modelLabel2(deps.getModel?.()) };
-        const finalUrl = response.url || url;
+        const extraction = prompt?.trim() ? await applyPromptWithModel(deps, prompt.trim(), finalUrl, text, timeout.signal) : { text, model: modelLabel2(deps.getModel?.()) };
         return {
           content: [{ type: "text", text: extraction.text }],
           details: {
@@ -14948,7 +15283,7 @@ function createSharedWebFetchTool(deps = {}) {
             bytes: bodyResult.observedBytes,
             title,
             truncated,
-            redirectChain: finalUrl !== url ? [url, finalUrl] : [url],
+            redirectChain,
             extractionMethod: prompt?.trim() ? "model_extraction" : extractionMethod,
             readabilityScore: htmlExtraction?.readabilityScore,
             citationAnchors: buildCitationAnchors(finalUrl, title, text),