@iowarp/clio-coder 0.4.8 → 0.4.9

package/dist/{chunk-RXI7K4J5.js → chunk-ZF6CV4WZ.js}

@@ -1,33 +1,58 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  clioDocsToolSurface,
+  clioLibraryToolSurface
+} from "./chunk-ACCECAH4.js";
 import {
   contextToolSurface
-} from "./chunk-LZCCBLRC.js";
+} from "./chunk-HBJQQTKM.js";
 import {
   resolveFdBinary,
   resolveRgBinary
 } from "./chunk-JABWPKFY.js";
 import {
-  webFetchToolSurface
-} from "./chunk-ICYIUNO4.js";
+  runScriptToolSurface
+} from "./chunk-HCVKSGNZ.js";
+import {
+  webFetchToolSurface,
+  webReadToolSurface
+} from "./chunk-PNJE7JPS.js";
 import {
   verifyToolSurface
-} from "./chunk-2U2U5POA.js";
+} from "./chunk-L4RUTLRL.js";
+import {
+  dataToolSurface,
+  prepareDataAdmissionArguments
+} from "./chunk-PPIFDSBK.js";
 import {
   codeNavToolSurface
-} from "./chunk-WTZVSMQZ.js";
+} from "./chunk-TCUOGIL2.js";
+import {
+  McpError,
+  createMcpStdioClient,
+  resolveMcpServers
+} from "./chunk-PP23PZEV.js";
+import {
+  incompleteInstallationAdvice
+} from "./chunk-3A3CUMKA.js";
 import {
   RESPONSE_SCHEMA_RUNTIME_ID,
   bashTool,
   builtin,
   createAskUserTool,
+  nestedBlockedResult,
+  nestedExecutedResult,
   readMaxBytes,
   readTool,
   renderAgentLedger
-} from "./chunk-MWMW53WW.js";
+} from "./chunk-4ATBOFRP.js";
 import {
   createTaskBoardStore,
   taskBoardCounts
-} from "./chunk-WJWNZXRM.js";
+} from "./chunk-KOAHT3N2.js";
+import {
+  hashToolCall
+} from "./chunk-AY4XE6GN.js";
 import {
   isLoadableExtension
 } from "./chunk-OH3YYA3B.js";
@@ -37,18 +62,34 @@ import {
   parseExtensionManifest,
   resolveExtensionEntrypoint
 } from "./chunk-6TKOFFGE.js";
+import {
+  gatewayCapabilityKind,
+  toolSpecPlacement,
+  withGatewayForCapabilities
+} from "./chunk-2JBZYUPY.js";
 import {
   describeCallAction
-} from "./chunk-2GPGAE5W.js";
+} from "./chunk-XNIZBOFV.js";
 import {
   applyToolProfile
-} from "./chunk-GEVQNST4.js";
+} from "./chunk-XZWSP67B.js";
+import {
+  BusChannels
+} from "./chunk-W5RM7YAH.js";
 import {
   networkToolsDisabled
 } from "./chunk-SL2RDHKO.js";
 import {
-  gitTool
-} from "./chunk-MEHBW2SP.js";
+  DATA_OBSERVATION_SELF_CAP_BYTES,
+  GATEWAY_FIND_SELF_CAP_BYTES
+} from "./chunk-JURMQWVJ.js";
+import {
+  compileGlobRegex,
+  fallbackIgnoredDirs,
+  fdIgnoreArgs,
+  normalizeGlobInput,
+  rgIgnoreArgs
+} from "./chunk-IZZI3SKQ.js";
 import {
   OBSERVATION_POLICY_SLACK_BYTES,
   OBSERVE_SELF_CAPS,
@@ -59,61 +100,51 @@ import {
   observationBudgetExhausted,
   releaseObservation,
   reserveObservation,
-  toolResultContextText,
+  toolResultContextText
+} from "./chunk-ZKQ63XZ5.js";
+import {
+  createSafetyPolicyEngine,
+  formatModelRejection
+} from "./chunk-IC7JXLOM.js";
+import {
   truncateHead
-} from "./chunk-526ABLHD.js";
+} from "./chunk-GHXGMFQ5.js";
 import {
   GREP_MAX_LINE_LENGTH,
   truncateLine
 } from "./chunk-KECNXMDE.js";
 import {
-  compileGlobRegex,
-  fallbackIgnoredDirs,
-  fdIgnoreArgs,
-  normalizeGlobInput,
   resolveReadPath,
   resolveToCwd,
-  rgIgnoreArgs,
   toPosixPath
-} from "./chunk-V552WL53.js";
-import {
-  parseAgentLedgerBody
-} from "./chunk-VQD7NH7Z.js";
-import {
-  hashToolCall
-} from "./chunk-MUXNDNMZ.js";
-import {
-  formatModelRejection
-} from "./chunk-RAUOKUZV.js";
-import {
-  StringEnum,
-  engineStreamSimple
-} from "./chunk-QLAGXTTV.js";
-import {
-  byteLength,
-  truncateUtf8
-} from "./chunk-MYI32N4R.js";
-import {
-  BusChannels
-} from "./chunk-W5RM7YAH.js";
+} from "./chunk-KP5BPXR3.js";
 import {
   extensionContentDigestWithCapture
 } from "./chunk-XW2UZICE.js";
 import {
   classify
-} from "./chunk-YXFKLMX2.js";
+} from "./chunk-H2WSCZZT.js";
 import {
   protectArtifact,
   protectedArtifactMutationBlockReason
-} from "./chunk-E2NSPYLC.js";
+} from "./chunk-SQBT46OF.js";
+import {
+  gitTool
+} from "./chunk-YQYINEJI.js";
+import {
+  byteLength,
+  truncateUtf8
+} from "./chunk-MYI32N4R.js";
 import {
   CLIO_ARTIFACT_DIR,
   artifactDefaultPath
 } from "./chunk-NTTS3O53.js";
 import {
   ToolNames,
-  isBuiltinToolName
-} from "./chunk-WLHX3MM5.js";
+  isBuiltinToolName,
+  isMcpToolName,
+  mcpToolName
+} from "./chunk-V4XJWDHR.js";
 import {
   GUARDRAIL_DEFAULTS,
   resolveGuardrail,
@@ -126,16 +157,21 @@ import {
   require_dist
 } from "./chunk-B5GGDIHT.js";
 import {
-  incompleteInstallationAdvice
-} from "./chunk-3A3CUMKA.js";
+  StringEnum,
+  engineStreamSimple,
+  validateEngineToolArguments
+} from "./chunk-UIU7MGZ3.js";
+import {
+  parseAgentLedgerBody
+} from "./chunk-VQD7NH7Z.js";
 import {
   buildSafeToolEnv,
   runCommandVector
-} from "./chunk-GJ24ODAX.js";
+} from "./chunk-XTQ7MEJG.js";
 import {
   decisionRef,
   skillActivationFromToolDetails
-} from "./chunk-6R5MBXBJ.js";
+} from "./chunk-NBPA5QM6.js";
 import {
   assertSafeId
 } from "./chunk-UHW5V7HC.js";
@@ -652,6 +688,7 @@ function createLoopGuardRegistration(options) {
       return true;
     },
     evaluate(input) {
+      if (input.metadata?.nested === true) return [];
       if (input.hook === "after_tool") {
         recordSuccessfulResult(input);
         recordResultForStagnation(input);
@@ -1040,7 +1077,7 @@ function resolveAgentTools(input) {
   const specs = [];
   for (const name of effectiveToolNames(input)) {
     const spec = input.registry.get(name);
-    if (spec) specs.push(spec);
+    if (spec && toolSpecPlacement(spec) === "direct") specs.push(spec);
   }
   specs.sort((a, b) => a.name.localeCompare(b.name));
   return specs.map((spec) => toAgentTool(spec, input.registry, input.telemetry, input.invokeOptions));
@@ -1050,7 +1087,9 @@ function effectiveToolNames(input) {
     ...input.agentId !== void 0 ? { agentId: input.agentId } : {},
     ...input.task !== void 0 ? { task: input.task } : {}
   };
-  const toolIds = applyToolProfile(input.registry.listRegistered(), input.toolProfile, profileContext);
+  const gatewayNames = input.registry.listGateway().map((spec) => spec.name);
+  const registered = [...input.registry.listRegistered(), ...gatewayNames];
+  const toolIds = applyToolProfile(registered, input.toolProfile, profileContext);
   const allowed = input.allowedTools ? new Set(input.allowedTools) : null;
   const includeInteractiveTools = input.includeInteractiveTools !== false;
   const names = [];
@@ -1059,7 +1098,8 @@ function effectiveToolNames(input) {
     if (allowed && !allowed.has(name)) continue;
     names.push(name);
   }
-  return names;
+  if (input.registry.get(ToolNames.Gateway) === void 0) return names;
+  return withGatewayForCapabilities(names);
 }
 function resolveSessionTools(runtime, toolRegistry, invokeOptions, telemetry) {
   if (!toolRegistry || runtime.runtimeResolution.capabilityDecisions.tools !== true) return [];
@@ -1258,6 +1298,558 @@ function patchWorkerRequestPayload(payload, model, options) {
   return changed ? patched : void 0;
 }
 
+// src/tools/gateway/mcp-capabilities.ts
+init_esm_shims();
+var MCP_RESULT_CONTEXT_BYTES = 16 * 1024;
+function mcpTrustRemedy(id) {
+  return { remedy: `clio-coder mcp trust ${id}`, interactiveRemedy: `/mcp trust ${id}` };
+}
+function quoted(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function errorMessage2(error) {
+  if (error instanceof McpError) return `${error.message} (${error.code})`;
+  return error instanceof Error ? error.message : String(error);
+}
+function imageBlocks(result) {
+  const images = [];
+  for (const block of result.content) {
+    if (block.type !== "image") continue;
+    const { data, mimeType } = block;
+    if (typeof data === "string" && typeof mimeType === "string" && mimeType.startsWith("image/")) {
+      images.push({ type: "image", data, mimeType });
+    }
+  }
+  return images;
+}
+function createMcpCapabilitySource(options) {
+  const registry = options.registry;
+  const clientFactory = options.clientFactory ?? createMcpStdioClient;
+  let states = null;
+  let diagnostics = [];
+  let exitHookInstalled = false;
+  let closed = false;
+  let closePromise = null;
+  const teardowns = [];
+  const killLaunchedOnExit = () => {
+    for (const state of states?.values() ?? []) state.client?.killOwnedOnExit();
+  };
+  const installExitHook = () => {
+    if (exitHookInstalled) return;
+    exitHookInstalled = true;
+    process.once("exit", killLaunchedOnExit);
+  };
+  const closeClient = (state) => {
+    if (state.closing !== null) return state.closing;
+    const client = state.client;
+    if (client === null) return void 0;
+    state.closing = client.close().then((outcome) => {
+      teardowns.push({ id: state.declaration.id, outcome });
+      state.client = null;
+      if (!outcome.complete) {
+        process.stderr.write(
+          `[gateway] mcp server ${state.declaration.id}: process group ${outcome.pgid} survived SIGKILL for ${outcome.boundMs}ms; recorded, not signalled again
+`
+        );
+      }
+      return outcome;
+    });
+    return state.closing;
+  };
+  const resolveStates = () => {
+    if (states !== null) return states;
+    const resolved = resolveMcpServers({
+      cwd: options.cwd,
+      ...options.configDir ? { configDir: options.configDir } : {}
+    });
+    diagnostics = [
+      ...resolved.diagnostics.map((entry) => `${entry.scope} ${entry.path}: ${entry.message}`),
+      ...resolved.trustDiagnostics
+    ];
+    states = new Map(
+      resolved.servers.map((declaration) => [
+        declaration.id,
+        {
+          declaration,
+          client: null,
+          connecting: null,
+          closing: null,
+          tools: [],
+          truncated: false,
+          registered: [],
+          unregistrable: [],
+          failure: null
+        }
+      ])
+    );
+    return states;
+  };
+  const makeSpec = (state, tool, name) => {
+    const { declaration } = state;
+    const trustClass = declaration.trust.actionClass;
+    const timeoutMs = declaration.timeoutMs ?? options.requestTimeoutMs;
+    const spec = {
+      name,
+      description: `${tool.description.trim().length > 0 ? tool.description.trim() : `MCP tool ${tool.name}`}
+Local MCP server ${declaration.id} (${declaration.scope} scope), trusted with action class ${trustClass}; launching it does not sandbox it.`,
+      parameters: tool.inputSchema,
+      baseActionClass: trustClass,
+      executionMode: "sequential",
+      placement: "gateway",
+      sourceInfo: { path: declaration.path, scope: "domain" },
+      metadata: {
+        objective: tool.description.trim().length > 0 ? tool.description.trim() : `MCP tool ${tool.name}`,
+        uiLabel: `${declaration.id}/${tool.name}`,
+        retrySafety: "unknown",
+        // The session cap alone (64 KiB) let one search result spend a sixth
+        // of a 131k window. Bound MCP output like the built-in observation
+        // tools; the full text is offloaded and stays readable by path.
+        resultSizePolicy: {
+          kind: "bounded",
+          maxBytes: MCP_RESULT_CONTEXT_BYTES,
+          followUpHint: "Call again with a narrower query or the server's own limit/page arguments, or read the offloaded file in windows."
+        },
+        costLatency: "local_slow"
+      },
+      async run(args, invokeOptions) {
+        const client = state.client;
+        if (client === null || client.state().status !== "ready") {
+          return {
+            kind: "error",
+            message: `${name}: mcp server ${declaration.id} is not connected${state.failure ? ` (${state.failure})` : ""}; a server that exited stays closed for this session`
+          };
+        }
+        try {
+          const result = await client.callTool(tool.name, args, {
+            ...invokeOptions?.signal ? { signal: invokeOptions.signal } : {},
+            ...timeoutMs !== void 0 ? { timeoutMs } : {}
+          });
+          const details = {
+            server: declaration.id,
+            tool: tool.name,
+            contentTypes: result.content.map((block) => block.type),
+            textTruncated: result.textTruncated,
+            ...result.structuredContent !== void 0 ? { structuredContent: result.structuredContent } : {},
+            ...result.structuredContentJson !== void 0 ? { structuredContentJson: result.structuredContentJson } : {}
+          };
+          if (result.isError) return { kind: "error", message: `${name}: ${result.text || "tool error"}`, details };
+          const images = imageBlocks(result);
+          return { kind: "ok", output: result.text, details, ...images.length > 0 ? { images } : {} };
+        } catch (error) {
+          if (error instanceof McpError && (error.code === "closed" || error.code === "spawn")) {
+            state.failure = errorMessage2(error);
+          }
+          return { kind: "error", message: `${name}: ${errorMessage2(error)}` };
+        }
+      }
+    };
+    if (trustClass === "execute") {
+      spec.safetyCall = () => ({
+        tool: "bash",
+        args: { command: [declaration.command, ...declaration.args].map(quoted).join(" ") }
+      });
+    }
+    return spec;
+  };
+  const connect = async (state) => {
+    if (state.connecting !== null) return state.connecting;
+    if (closed || state.client !== null || state.failure !== null) return;
+    if (state.declaration.trust.status !== "trusted") return;
+    state.connecting = (async () => {
+      const { declaration } = state;
+      let client = null;
+      try {
+        client = clientFactory(
+          {
+            id: declaration.id,
+            command: declaration.command,
+            args: declaration.args,
+            cwd: declaration.cwd,
+            env: declaration.env
+          },
+          {
+            workspaceRoot: declaration.cwdRoot,
+            ...declaration.timeoutMs !== null ? { requestTimeoutMs: declaration.timeoutMs } : options.requestTimeoutMs !== void 0 ? { requestTimeoutMs: options.requestTimeoutMs } : {}
+          }
+        );
+        state.client = client;
+        installExitHook();
+        await client.initialize();
+        const listing = await client.listTools();
+        state.tools = listing.tools;
+        state.truncated = listing.truncated;
+        for (const tool of listing.tools) {
+          const name = mcpToolName(declaration.id, tool.name);
+          if (name === null || ownerOf(name) !== state || registry.get(name) !== void 0) {
+            state.unregistrable.push(tool.name);
+            continue;
+          }
+          registry.register(makeSpec(state, tool, name));
+          state.registered.push(name);
+        }
+      } catch (error) {
+        state.failure = errorMessage2(error);
+        await closeClient(state);
+      } finally {
+        state.connecting = null;
+      }
+    })();
+    return state.connecting;
+  };
+  const discover = async (state, signal) => {
+    const aborted = () => new McpError("aborted", "MCP discovery aborted");
+    if (signal?.aborted) throw aborted();
+    let cleanup;
+    const onAbort = () => {
+      state.failure = errorMessage2(aborted());
+      cleanup = closeClient(state);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      await connect(state);
+      await cleanup;
+      if (signal?.aborted) throw aborted();
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+    }
+  };
+  const listingFor = (state) => {
+    const { declaration } = state;
+    const base = { id: declaration.id, scope: declaration.scope, actionClass: declaration.trust.actionClass };
+    if (declaration.trust.status !== "trusted") {
+      return {
+        ...base,
+        status: declaration.trust.status,
+        reason: declaration.trust.reason,
+        ...mcpTrustRemedy(declaration.id)
+      };
+    }
+    if (state.failure !== null) {
+      return { ...base, status: "failed", reason: state.failure };
+    }
+    if (state.client !== null) {
+      return {
+        ...base,
+        status: "connected",
+        tools: [...state.registered],
+        ...state.truncated ? { truncated: true } : {},
+        ...state.unregistrable.length > 0 ? { unregistrable: [...state.unregistrable] } : {}
+      };
+    }
+    return { ...base, status: "trusted" };
+  };
+  const ownerOf = (name) => {
+    let owner = null;
+    for (const state of resolveStates().values()) {
+      if (name.startsWith(`mcp_${state.declaration.id}__`) && (owner === null || state.declaration.id.length > owner.declaration.id.length)) {
+        owner = state;
+      }
+    }
+    return owner;
+  };
+  return {
+    async list(invokeOptions) {
+      if (invokeOptions?.signal?.aborted) throw new McpError("aborted", "MCP discovery aborted");
+      const all = [...resolveStates().values()];
+      const results = await Promise.allSettled(all.map((state) => discover(state, invokeOptions?.signal)));
+      for (const result of results) {
+        if (result.status === "rejected") throw result.reason;
+      }
+      return { servers: all.map(listingFor), diagnostics: [...diagnostics] };
+    },
+    async ensure(name, invokeOptions) {
+      if (invokeOptions?.signal?.aborted) throw new McpError("aborted", "MCP discovery aborted");
+      const owner = ownerOf(name);
+      if (owner === null) return { spec: null, reason: `no declared MCP server owns ${name}` };
+      const trust = owner.declaration.trust;
+      if (trust.status !== "trusted") {
+        const remedy = mcpTrustRemedy(owner.declaration.id);
+        return {
+          spec: null,
+          reason: `mcp server ${owner.declaration.id} is ${trust.status} (${trust.reason}); it is never launched until trusted: run ${remedy.remedy} (${remedy.interactiveRemedy} in an interactive session)`
+        };
+      }
+      await discover(owner, invokeOptions?.signal);
+      const spec = registry.get(name);
+      if (spec !== void 0 && owner.registered.includes(spec.name)) return { spec };
+      return {
+        spec: null,
+        reason: owner.failure !== null ? `mcp server ${owner.declaration.id} failed: ${owner.failure}` : `mcp server ${owner.declaration.id} offers no tool named ${name.slice(`mcp_${owner.declaration.id}__`.length)}`
+      };
+    },
+    authorityNote(name) {
+      const owner = ownerOf(name);
+      if (owner === null) return null;
+      const { declaration } = owner;
+      return `Local stdio MCP server ${declaration.id} (${declaration.scope} scope, declared in ${declaration.path}), trusted with action class ${declaration.trust.actionClass}: ${declaration.trust.actionClass === "unknown" ? "every call asks for approval and read-only denies it" : declaration.trust.actionClass === "execute" ? "calls are admitted like an unrecognized shell command" : "calls run as reads at every autonomy level"}. Launching the server does not sandbox it.`;
+    },
+    connectedIds() {
+      return [...states?.values() ?? []].filter((state) => state.client !== null).map((state) => state.declaration.id);
+    },
+    teardownReports() {
+      return [...teardowns];
+    },
+    close() {
+      if (closePromise !== null) return closePromise;
+      closed = true;
+      closePromise = (async () => {
+        const all = [...states?.values() ?? []];
+        await Promise.all(all.map(closeClient));
+        await Promise.all(all.map((state) => state.connecting));
+        const report = { incomplete: [] };
+        for (const { id, outcome } of teardowns) {
+          if (!outcome.complete) report.incomplete.push({ id, pgid: outcome.pgid, boundMs: outcome.boundMs });
+        }
+        if (exitHookInstalled) {
+          process.removeListener("exit", killLaunchedOnExit);
+          exitHookInstalled = false;
+        }
+        return report;
+      })();
+      return closePromise;
+    }
+  };
+}
+
+// src/tools/gateway/index.ts
+init_esm_shims();
+var GATEWAY_OPS = ["find", "describe", "call"];
+var GATEWAY_FIND_MAX_ENTRIES = 300;
+var DESCRIPTION = `Reach secondary capabilities on demand. op="find" lists them as JSON {name, kind: builtin|extension|mcp, description, actionClass} (query filters by name or description); op="describe" returns one capability's full description, JSON parameter schema, and authority notes; op="call" runs one with args under the same admission as a direct tool: its own action class, approval, and evidence apply and the result is the capability's result. Capabilities: artifact (terminal plan/review/report documents), web_read (GET-only web reading), web_fetch (full HTTP requests), git (read-only status/diff/log), evidence, credential_present, clio_docs, clio_library, data (CSV/TSV, JSON, JSONL inspection), installed extension commands, and trusted local MCP servers.`;
+var gatewayToolSurface = {
+  name: ToolNames.Gateway,
+  description: DESCRIPTION,
+  parameters: typebox_exports.Object({
+    op: StringEnum(GATEWAY_OPS, { description: "find, describe, or call." }),
+    capability: typebox_exports.Optional(typebox_exports.String({ description: "describe and call: the capability name from find." })),
+    query: typebox_exports.Optional(typebox_exports.String({ description: "find: case-insensitive filter over names and descriptions." })),
+    args: typebox_exports.Optional(
+      typebox_exports.Record(typebox_exports.String(), typebox_exports.Unknown(), {
+        description: "call: the capability's arguments, matching its describe schema."
+      })
+    )
+  }),
+  baseActionClass: "read",
+  executionMode: "sequential"
+};
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function prepareGatewayArguments(args) {
+  const out = { ...args };
+  if (typeof out.capability !== "string") {
+    const alias = out.name ?? out.tool;
+    if (typeof alias === "string") out.capability = alias;
+  }
+  if (typeof out.args === "string") {
+    try {
+      const parsed = JSON.parse(out.args);
+      if (isRecord3(parsed)) out.args = parsed;
+    } catch {
+    }
+  }
+  if (typeof out.op !== "string") {
+    if (typeof out.capability === "string" && out.args !== void 0) out.op = "call";
+    else if (typeof out.capability === "string") out.op = "describe";
+    else out.op = "find";
+  }
+  return out;
+}
+function firstSentence(text) {
+  const line = text.split("\n")[0]?.trim() ?? "";
+  const match = /^(.*?[.!?])(?:\s|$)/u.exec(line);
+  return (match?.[1] ?? line).slice(0, 240);
+}
+function autonomyNote(actionClass) {
+  switch (actionClass) {
+    case "read":
+      return "Read class: runs at every autonomy level.";
+    case "write":
+      return "Write class: parks for operator approval at suggest, runs at auto-edit and full-auto, and is denied at read-only.";
+    case "execute":
+      return "Execute class: an unrecognized command asks at auto-edit, runs at full-auto, and is denied at read-only.";
+    case "dispatch":
+      return "Dispatch class: plan-scale calls ask below full-auto; denied at read-only.";
+    case "unknown":
+      return "No action class was declared: every call asks for approval and read-only denies it.";
+    default:
+      return `Action class ${actionClass}.`;
+  }
+}
+function createGatewayTool(deps) {
+  const { registry } = deps;
+  const allowedSet = (options) => options?.allowedTools ? new Set(options.allowedTools) : null;
+  const resolveCapability = async (name, options) => {
+    let spec = registry.get(name);
+    if (spec === void 0 && isMcpToolName(name) && deps.mcp) {
+      const ensured = await deps.mcp.ensure(name, options?.signal ? { signal: options.signal } : {});
+      if (ensured.spec === null)
+        return { spec: null, message: `gateway: ${ensured.reason ?? `unknown capability ${name}`}` };
+      spec = ensured.spec;
+    }
+    if (spec === void 0) {
+      return {
+        spec: null,
+        message: `gateway: unknown capability "${name}"; run gateway(op="find") to list the capabilities this session offers`
+      };
+    }
+    if (toolSpecPlacement(spec) === "direct") {
+      return {
+        spec: null,
+        message: `gateway: "${name}" is a direct tool with an attached schema; call it directly, not through the gateway`
+      };
+    }
+    return { spec };
+  };
+  const outsideSurface = (name, allowed) => ({
+    kind: "error",
+    message: `gateway: capability "${name}" is not on this run's admitted tool surface (${[...allowed].sort().join(", ")}); the recipe did not declare it, so the gateway refuses to call it`
+  });
+  const runFind = async (args, options) => {
+    const query = typeof args.query === "string" ? args.query.trim().toLowerCase() : "";
+    const allowed = allowedSet(options);
+    const reservation = reserveObservation(GATEWAY_FIND_SELF_CAP_BYTES, options);
+    if (reservation.exhausted) {
+      return observationBudgetExhausted({
+        tool: ToolNames.Gateway,
+        unit: "entries",
+        reservation,
+        subject: query.length > 0 ? `find query=${query}` : "find",
+        hint: "Continue in a follow-up turn."
+      });
+    }
+    commitObservationReservation(reservation);
+    try {
+      let servers = [];
+      let diagnostics = [];
+      if (deps.mcp && allowed === null) {
+        const listing = await deps.mcp.list(options?.signal ? { signal: options.signal } : {});
+        servers = listing.servers;
+        diagnostics = listing.diagnostics;
+      }
+      const entries = registry.listGateway().filter((spec) => allowed === null || allowed.has(spec.name)).map((spec) => ({
+        name: spec.name,
+        kind: gatewayCapabilityKind(spec.name),
+        description: firstSentence(spec.description),
+        actionClass: spec.baseActionClass
+      })).filter(
+        (entry) => query.length === 0 || entry.name.toLowerCase().includes(query) || entry.description.toLowerCase().includes(query)
+      ).sort((left, right) => left.name.localeCompare(right.name));
+      const total = entries.length;
+      const shown = entries.slice(0, GATEWAY_FIND_MAX_ENTRIES);
+      const truncated = shown.length < total;
+      const payload = {
+        capabilities: shown,
+        count: shown.length,
+        total,
+        ...servers.length > 0 ? { servers } : {},
+        ...diagnostics.length > 0 ? { diagnostics } : {},
+        ...truncated ? { note: "listing truncated; narrow it with query" } : {}
+      };
+      return finalizeObservation({
+        tool: ToolNames.Gateway,
+        unit: "entries",
+        format: "json",
+        output: JSON.stringify(payload),
+        shownCount: shown.length,
+        totalCount: total,
+        truncated,
+        ...truncated ? { next: "query=<narrower terms>" } : {},
+        details: { op: "find", count: shown.length, total, servers: servers.length },
+        reservation,
+        ...options ? { options } : {}
+      });
+    } catch (error) {
+      releaseObservation(reservation);
+      return { kind: "error", message: `gateway: find failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  };
+  const runDescribe = async (args, options) => {
+    const name = typeof args.capability === "string" ? args.capability.trim() : "";
+    if (name.length === 0) return { kind: "error", message: 'gateway: op="describe" requires capability' };
+    const allowed = allowedSet(options);
+    if (allowed !== null && !allowed.has(name)) return outsideSurface(name, allowed);
+    const resolved = await resolveCapability(name, options);
+    if (resolved.spec === null) return { kind: "error", message: resolved.message };
+    const spec = resolved.spec;
+    const kind = gatewayCapabilityKind(spec.name);
+    const authority = [
+      `Runs through the same admission as a direct call, under its own name and action class (${spec.baseActionClass}); the approval overlay, audit row, and ledger record name ${spec.name}, not the gateway.`,
+      autonomyNote(spec.baseActionClass)
+    ];
+    if (spec.name === ToolNames.WebFetch) {
+      authority.push(
+        "A non-GET method or a body is an outward action and asks at suggest and auto-edit; use web_read when a plain GET is enough."
+      );
+    }
+    if (spec.name === ToolNames.Artifact) {
+      authority.push("Terminal: writing the artifact completes the turn, so close the task board before calling it.");
+    }
+    if (kind === "extension") {
+      authority.push(
+        `Harness extension${spec.sourceInfo?.extension ? ` ${spec.sourceInfo.extension.contentDigest.slice(0, 12)}` : ""}: an installed command run with JSON input on the workspace; its argv is classified like a bash command, and running it does not sandbox it.`
+      );
+    }
+    const mcpNote = kind === "mcp" ? deps.mcp?.authorityNote(spec.name) : null;
+    if (mcpNote) authority.push(mcpNote);
+    const payload = {
+      name: spec.name,
+      kind,
+      description: spec.description,
+      parameters: wireParameterSchema(spec.parameters),
+      actionClass: spec.baseActionClass,
+      executionMode: spec.executionMode ?? "sequential",
+      authority
+    };
+    return { kind: "ok", output: JSON.stringify(payload), details: { op: "describe", described: spec.name } };
+  };
+  const runCall = async (args, options) => {
+    const name = typeof args.capability === "string" ? args.capability.trim() : "";
+    if (name.length === 0) return { kind: "error", message: 'gateway: op="call" requires capability' };
+    const allowed = allowedSet(options);
+    if (allowed !== null && !allowed.has(name)) return outsideSurface(name, allowed);
+    const resolved = await resolveCapability(name, options);
+    if (resolved.spec === null) return { kind: "error", message: resolved.message };
+    const spec = resolved.spec;
+    if (args.args !== void 0 && !isRecord3(args.args)) {
+      return { kind: "error", message: `gateway: args for ${spec.name} must be a JSON object` };
+    }
+    const rawArgs = isRecord3(args.args) ? args.args : {};
+    let validated;
+    try {
+      validated = validateEngineToolArguments(
+        { name: spec.name, description: spec.description, parameters: spec.parameters },
+        { type: "toolCall", id: options?.toolCallId ?? "", name: spec.name, arguments: rawArgs }
+      );
+    } catch (error) {
+      return {
+        kind: "error",
+        message: `gateway: ${spec.name} arguments rejected: ${error instanceof Error ? error.message : String(error)}. Use gateway(op="describe", capability="${spec.name}") for the schema.`
+      };
+    }
+    const { approval: _approval, ...outer } = options ?? {};
+    const verdict = await registry.invoke({ tool: spec.name, args: validated }, { ...outer, nested: true });
+    if (verdict.kind === "not_visible") return { kind: "error", message: `gateway: ${verdict.reason}` };
+    if (verdict.kind === "blocked") return nestedBlockedResult(verdict);
+    return nestedExecutedResult(
+      { ...verdict.result, details: { ...verdict.result.details, capability: spec.name } },
+      verdict.decision
+    );
+  };
+  return {
+    ...gatewayToolSurface,
+    prepareArguments: prepareGatewayArguments,
+    async run(rawArgs, options) {
+      const args = prepareGatewayArguments(rawArgs);
+      const op = typeof args.op === "string" ? args.op : "";
+      if (op === "find") return runFind(args, options);
+      if (op === "describe") return runDescribe(args, options);
+      if (op === "call") return runCall(args, options);
+      return { kind: "error", message: `gateway: op must be find, describe, or call; got '${op}'` };
+    }
+  };
+}
+
 // src/tools/lazy-tool.ts
 init_esm_shims();
 function surfaceSnapshot(spec) {
@@ -1311,20 +1903,29 @@ init_esm_shims();
 
 // src/tools/artifact.ts
 init_esm_shims();
-import { mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
 // src/tools/file-mutation-queue.ts
 init_esm_shims();
-import { realpathSync } from "node:fs";
-import { resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { lstat, mkdir, open, readlink, realpath, rename, stat, unlink } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 var fileMutationQueues = /* @__PURE__ */ new Map();
-function mutationQueueKey(filePath) {
+function mutationQueueKey(filePath, depth = 0) {
   const resolved = resolve(filePath);
+  if (depth > 40) throw new Error("Too many symbolic links");
   try {
     return realpathSync.native(resolved);
   } catch {
-    return resolved;
+    try {
+      if (lstatSync(resolved).isSymbolicLink()) {
+        return mutationQueueKey(resolve(dirname(resolved), readlinkSync(resolved)), depth + 1);
+      }
+    } catch {
+    }
+    const parent = dirname(resolved);
+    return parent === resolved ? resolved : join(mutationQueueKey(parent, depth), basename(resolved));
   }
 }
 async function withFileMutationQueue(filePath, fn) {
@@ -1346,6 +1947,73 @@ async function withFileMutationQueue(filePath, fn) {
     }
   }
 }
+async function resolvePublishTarget(filePath, depth = 0) {
+  if (depth > 40) throw new Error("Too many symbolic links");
+  const absolute = resolve(filePath);
+  try {
+    const info = await lstat(absolute);
+    if (info.isSymbolicLink()) {
+      return resolvePublishTarget(resolve(dirname(absolute), await readlink(absolute)), depth + 1);
+    }
+    if (!info.isFile()) throw new Error(`Refusing non-file target (including directories): ${filePath}`);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  await mkdir(dirname(absolute), { recursive: true });
+  return join(await realpath(dirname(absolute)), basename(absolute));
+}
+async function publishFileAtomically(filePath, content, options = {}) {
+  let tempPath;
+  try {
+    const target = await resolvePublishTarget(filePath);
+    const previous = await stat(target).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (previous && !previous.isFile()) throw new Error(`Refusing directory or non-file target: ${filePath}`);
+    tempPath = join(dirname(target), `.clio-coder-publish-${randomUUID()}.tmp`);
+    const handle = await open(tempPath, "wx", previous ? previous.mode & 4095 : 438);
+    let after;
+    try {
+      await handle.writeFile(content);
+      if (previous) await handle.chmod(previous.mode & 4095);
+      await handle.sync();
+      const info = await handle.stat();
+      after = { bytes: info.size, mtimeMs: info.mtimeMs };
+    } finally {
+      await handle.close();
+    }
+    await (options.rename ?? rename)(tempPath, target);
+    tempPath = void 0;
+    const result = {
+      before: previous ? { bytes: previous.size, mtimeMs: previous.mtimeMs } : null,
+      after
+    };
+    try {
+      const directory = await open(dirname(target), "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    } catch (error) {
+      result.durabilityWarning = `Published, but directory fsync was unavailable or failed: ${String(error)}`;
+    }
+    return result;
+  } catch (error) {
+    let cleanup = "";
+    if (tempPath) {
+      try {
+        await unlink(tempPath);
+      } catch (cleanupError) {
+        if (cleanupError.code !== "ENOENT") {
+          cleanup = ` Temporary file cleanup failed at ${tempPath}: ${String(cleanupError)}`;
+        }
+      }
+    }
+    throw new Error(`Nothing was published: ${String(error)}.${cleanup}`, { cause: error });
+  }
+}
 
 // src/tools/artifact.ts
 var ARTIFACT_KINDS = ["plan", "review", "report"];
@@ -1368,11 +2036,9 @@ async function writeTerminalArtifact(kind, args, cwd) {
   const body = title.length > 0 && !content.trimStart().startsWith("#") ? `# ${title}
 
 ${content}` : content;
+  let published;
   try {
-    await withFileMutationQueue(target, async () => {
-      mkdirSync(path.dirname(target), { recursive: true });
-      writeFileSync(target, body, "utf8");
-    });
+    published = await withFileMutationQueue(target, () => publishFileAtomically(target, body));
   } catch (err) {
     return { kind: "error", message: `artifact: ${err instanceof Error ? err.message : String(err)}` };
   }
@@ -1380,10 +2046,16 @@ ${content}` : content;
   const bytes = Buffer.byteLength(body, "utf8");
   return {
     kind: "ok",
-    output: `wrote ${kind} artifact (${bytes}B) to ${rel}`,
+    output: `wrote ${kind} artifact (${bytes}B) to ${rel}${published.durabilityWarning ? `
+${published.durabilityWarning}` : ""}`,
     // shownBytes is the artifact's real size; the ledger otherwise measures
     // this confirmation sentence (a 4753B plan rendered as "60B", #76).
-    details: { kind, paths: [target], observation: { shownBytes: bytes } },
+    details: {
+      kind,
+      paths: [target],
+      observation: { shownBytes: bytes },
+      file: { before: published.before, after: published.after }
+    },
     // Writing the artifact is the whole turn; terminate skips the follow-up
     // LLM call that would only restate what was just written.
     terminate: true
@@ -1641,7 +2313,8 @@ function createDecideTool(deps = {}) {
 
 // src/tools/edit.ts
 init_esm_shims();
-import { readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFile, stat as stat2 } from "node:fs/promises";
+import { setImmediate as yieldImmediate } from "node:timers/promises";
 
 // src/tools/edit-diff.ts
 init_esm_shims();
@@ -2183,12 +2856,6 @@ function capDiffLine(text) {
   if (text.length <= MAX_DIFF_LINE_CHARS) return text;
   return `${text.slice(0, MAX_DIFF_LINE_CHARS)}\u2026 (+${text.length - MAX_DIFF_LINE_CHARS} chars)`;
 }
-function detectLineEnding(content) {
-  const crlfIdx = content.indexOf("\r\n");
-  const lfIdx = content.indexOf("\n");
-  if (lfIdx === -1 || crlfIdx === -1) return "\n";
-  return crlfIdx < lfIdx ? "\r\n" : "\n";
-}
 function normalizeToLF(text) {
   return text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
 }
@@ -2580,6 +3247,78 @@ function generateDiffString(oldContent, newContent, contextLines = 4) {
 }
 
 // src/tools/edit.ts
+var DIFF_LIMIT = 1024 * 1024;
+var VALIDATION_CHUNK = 64 * 1024;
+async function invalidUtf8Offset(bytes) {
+  const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  let failingStart = 0;
+  for (let start2 = 0; start2 < bytes.length; start2 += VALIDATION_CHUNK) {
+    try {
+      decoder.decode(bytes.subarray(start2, start2 + VALIDATION_CHUNK), { stream: true });
+    } catch {
+      failingStart = start2;
+      break;
+    }
+    failingStart = Math.min(start2 + VALIDATION_CHUNK, bytes.length);
+    await yieldImmediate();
+  }
+  let start = Math.max(0, failingStart - 4);
+  while (start > 0 && ((bytes[start] ?? 0) & 192) === 128) start -= 1;
+  const narrow = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  let sequenceStart = start;
+  const end = Math.min(bytes.length, failingStart + VALIDATION_CHUNK);
+  for (let i = start; i < end; i += 1) {
+    try {
+      if (narrow.decode(bytes.subarray(i, i + 1), { stream: true }).length > 0) sequenceStart = i + 1;
+    } catch {
+      return sequenceStart;
+    }
+    if ((i - start + 1) % 1024 === 0) await yieldImmediate();
+  }
+  return sequenceStart;
+}
+async function classifyEndings(bytes) {
+  let crlf = false;
+  let lf = false;
+  let nextYield = VALIDATION_CHUNK;
+  for (let i = 0; i < bytes.length; i += 1) {
+    if (bytes[i] === 0) throw new Error(`NUL byte at byte offset ${i}; refusing binary input`);
+    if (bytes[i] === 13) {
+      if (bytes[i + 1] !== 10) throw new Error("Mixed or bare-CR line endings are unsupported; nothing was normalized");
+      crlf = true;
+      i += 1;
+    } else if (bytes[i] === 10) lf = true;
+    if (crlf && lf) throw new Error("Mixed or bare-CR line endings are unsupported; nothing was normalized");
+    if (i >= nextYield) {
+      nextYield = i + VALIDATION_CHUNK;
+      await yieldImmediate();
+    }
+  }
+  return crlf ? "\r\n" : "\n";
+}
+function applyLargeExactEdits(content, edits, ending) {
+  const matches = edits.map((edit, editIndex) => {
+    const oldText = restoreLineEndings(normalizeToLF(edit.oldText), ending);
+    if (!oldText) throw new Error(`edits[${editIndex}].oldText must not be empty`);
+    const index = content.indexOf(oldText);
+    if (index < 0)
+      throw new Error("Files above 1 MiB require exact matches; fuzzy matching is skipped to bound allocation");
+    if (content.indexOf(oldText, index + oldText.length) >= 0)
+      throw new Error("The text must be unique; provide more context");
+    return { index, length: oldText.length, replacement: restoreLineEndings(normalizeToLF(edit.newText), ending) };
+  }).sort((a, b) => a.index - b.index);
+  const pieces = [];
+  let cursor = 0;
+  for (const entry of matches) {
+    if (entry.index < cursor) throw new Error("Edits overlap; target disjoint regions");
+    pieces.push(content.slice(cursor, entry.index), entry.replacement);
+    cursor = entry.index + entry.length;
+  }
+  pieces.push(content.slice(cursor));
+  const result = pieces.join("");
+  if (result === content) throw new Error("No changes made; replacements produced identical content");
+  return result;
+}
 var editEntrySchema = typebox_exports.Object({
   oldText: typebox_exports.String({ description: "Exact unique text to replace; must not overlap other edits." }),
   newText: typebox_exports.String({ description: "Replacement text." })
@@ -2618,7 +3357,7 @@ function prepareEditArguments(args) {
 }
 var editTool = {
   name: ToolNames.Edit,
-  description: "Edit one file with exact text replacements. Each oldText must match a unique region of the original file.",
+  description: "Edit one file with exact text replacements. Each oldText must match a unique region of the original file. Matching tries exact text first, then quote/dash/NFKC and trailing-space normalization, then indentation relaxation. Files above 1 MiB require exact matches and skip diffs to bound allocation. Refuses NUL bytes, invalid UTF-8, and mixed or bare-CR line endings. LF replacement text adopts the file\u2019s LF or CRLF endings; the UTF-8 BOM is preserved. Publishes atomically through symlinks with mode bits preserved. External writers are not locked; the last rename wins. Returned file identities describe publication, not a precondition on an earlier model read.",
   parameters: typebox_exports.Object({
     path: typebox_exports.String({ description: "File path (relative or absolute)." }),
     edits: typebox_exports.Array(editEntrySchema, { description: "One or more targeted replacements." })
@@ -2637,21 +3376,39 @@ var editTool = {
     const filePath = resolveToCwd(pathArg);
     try {
       return await withFileMutationQueue(filePath, async () => {
-        const rawContent = readFileSync(filePath, "utf8");
+        const info = await stat2(filePath);
+        if (!info.isFile()) throw new Error("Refusing directory or non-file target");
+        const bytes = await readFile(filePath);
+        const originalEnding = await classifyEndings(bytes);
+        let rawContent;
+        try {
+          rawContent = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+        } catch {
+          throw new Error(`Invalid UTF-8 at byte offset ${await invalidUtf8Offset(bytes)}`);
+        }
         const { bom, text: content } = stripBom(rawContent);
-        const originalEnding = detectLineEnding(content);
-        const normalizedContent = normalizeToLF(content);
-        const applied = {
-          ...applyEditsToNormalizedContent(normalizedContent, edits, pathArg),
-          replacements: edits.length
-        };
-        const finalContent = bom + restoreLineEndings(applied.newContent, originalEnding);
-        writeFileSync2(filePath, finalContent, "utf8");
-        const diff = generateDiffString(applied.baseContent, applied.newContent);
+        let finalContent;
+        let diff;
+        if (bytes.length > DIFF_LIMIT) {
+          finalContent = bom + applyLargeExactEdits(content, edits, originalEnding);
+        } else {
+          const applied = applyEditsToNormalizedContent(normalizeToLF(content), edits, pathArg);
+          finalContent = bom + restoreLineEndings(applied.newContent, originalEnding);
+          if (Buffer.byteLength(finalContent, "utf8") <= DIFF_LIMIT) {
+            diff = generateDiffString(applied.baseContent, applied.newContent);
+          }
+        }
+        const file = await publishFileAtomically(filePath, finalContent);
         return {
           kind: "ok",
-          output: `edited ${pathArg}: ${applied.replacements} replacement(s). Validate now: rerun the failing test or verify; navigation tools do not validate edits.`,
-          details: { diff: diff.diff, firstChangedLine: diff.firstChangedLine, paths: [filePath] }
+          output: `edited ${pathArg}: ${edits.length} replacement(s). Validate now: rerun the failing test or verify; navigation tools do not validate edits.${!diff ? "\nnote: diff skipped because the previous or new file exceeds 1 MiB" : ""}${file.durabilityWarning ? `
+${file.durabilityWarning}` : ""}`,
+          details: {
+            file: { before: file.before, after: file.after },
+            diff: diff?.diff,
+            firstChangedLine: diff?.firstChangedLine,
+            paths: [filePath]
+          }
         };
       });
     } catch (err) {
@@ -2660,10 +3417,10 @@ var editTool = {
       if (code === "ENOENT") {
         return {
           kind: "error",
-          message: `edit: ${msg}. File not found at ${pathArg}. The path may be wrong. Try: code_nav, find, glob, or ls to locate it.`
+          message: `edit: Nothing was published. ${msg}. File not found at ${pathArg}. The path may be wrong. Try: code_nav, find, glob, or ls to locate it.`
         };
       }
-      return { kind: "error", message: `edit: ${msg}` };
+      return { kind: "error", message: `edit: Nothing was published. ${msg}` };
     }
   }
 };
@@ -2705,7 +3462,7 @@ var evidenceTool = {
     try {
       const dataDir = clioDataDir();
       if (mode === "list") {
-        const { evidenceInventorySnapshot } = await import("./inventory-QPQUTUUZ.js");
+        const { evidenceInventorySnapshot } = await import("./inventory-I6VJDDYF.js");
         return boundedResult(await evidenceInventorySnapshot(Date.now, dataDir));
       }
       const id = mode === "inspect" ? args.id : args.runId;
@@ -2713,8 +3470,8 @@ var evidenceTool = {
         return { kind: "error", message: `evidence: ${mode} requires ${mode === "inspect" ? "id" : "runId"}` };
       }
       assertSafeId(id, mode === "inspect" ? "evidence" : "run");
-      const { buildEvidence, EvidenceNotFoundError, inspectEvidence, loadEvidenceGateDecisions } = await import("./evidence-POWAEBEW.js");
-      const { evidenceDetailSnapshot } = await import("./detail-VSBWYSGZ.js");
+      const { buildEvidence, EvidenceNotFoundError, inspectEvidence, loadEvidenceGateDecisions } = await import("./evidence-P4NZOAK7.js");
+      const { evidenceDetailSnapshot } = await import("./detail-4GLROGY5.js");
       let evidenceId = mode === "run" ? `run-${id}` : id;
       let inspected;
       try {
@@ -2754,15 +3511,58 @@ var evidenceTool = {
 init_esm_shims();
 import { existsSync, statSync } from "node:fs";
 import { readdir } from "node:fs/promises";
-import { join, relative } from "node:path";
+import { join as join2, relative, resolve as resolve2 } from "node:path";
 
 // src/tools/spawn-hygiene.ts
 init_esm_shims();
+import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
 import { createInterface as createInterface2 } from "node:readline";
+import { StringDecoder } from "node:string_decoder";
 var SEARCH_SPAWN_TIMEOUT_MS = 3e4;
 var KILL_GRACE_MS = 3e3;
-var STDERR_CAP_BYTES = 16 * 1024;
+var SEARCH_STDERR_CAP_BYTES = 16 * 1024;
+var timeoutContext = new AsyncLocalStorage();
+function decodeBoundedUtf8(buffer) {
+  const decoded = new StringDecoder("utf8").write(buffer);
+  return truncateUtf8(decoded, SEARCH_STDERR_CAP_BYTES, "");
+}
+var BoundedDiagnosticDecoder = class {
+  constructor(onLine) {
+    this.onLine = onLine;
+  }
+  onLine;
+  buffer = Buffer.alloc(SEARCH_STDERR_CAP_BYTES);
+  used = 0;
+  truncated = false;
+  oversizedLines = 0;
+  get bufferedBytes() {
+    return this.used;
+  }
+  write(chunk) {
+    let start = 0;
+    while (start < chunk.length) {
+      const newline = chunk.indexOf(10, start);
+      const end = newline < 0 ? chunk.length : newline;
+      const take = Math.min(end - start, this.buffer.length - this.used);
+      chunk.copy(this.buffer, this.used, start, start + take);
+      this.used += take;
+      if (take < end - start) this.truncated = true;
+      if (newline < 0) break;
+      this.flush();
+      start = newline + 1;
+    }
+  }
+  end() {
+    if (this.used || this.truncated) this.flush();
+  }
+  flush() {
+    if (this.truncated) this.oversizedLines++;
+    this.onLine(decodeBoundedUtf8(this.buffer.subarray(0, this.used)).replace(/\r$/, ""), this.truncated);
+    this.used = 0;
+    this.truncated = false;
+  }
+};
 var MAX_SEARCH_PATTERN_BYTES = 64 * 1024;
 function validateSearchPatternSize(pattern) {
   const bytes = Buffer.byteLength(pattern, "utf8");
@@ -2772,15 +3572,76 @@ function validateSearchPatternSize(pattern) {
     message: `pattern too large (${bytes} bytes; max ${MAX_SEARCH_PATTERN_BYTES}). Narrow the pattern before searching.`
   };
 }
+function newSearchCompleteness() {
+  return { complete: true, skipped: { count: 0, samples: [] } };
+}
+function skipSearchPath(search, path5, allows = () => true) {
+  search.complete = false;
+  search.reason ??= "errors";
+  search.skipped.count += 1;
+  if (allows(path5) && search.skipped.samples.length < 5) search.skipped.samples.push(path5);
+}
+function searchDiagnosticPath(line) {
+  const cleaned = line.replace(/^(?:rg: |\[fd error\]:? )/, "").replace(/^IO error for operation on /, "");
+  if (/^(?:regex parse error|error parsing (?:glob|regex)|invalid (?:glob|regex)|error:|Usage:)/i.test(cleaned))
+    return null;
+  const match = /^((?:[A-Za-z]:[\\/])?[^\r\n]+?):(?:\s|$)/.exec(cleaned);
+  return match?.[1] ?? null;
+}
+function createSearchDiagnostics(search, allows) {
+  let continuation = false;
+  let realError = false;
+  return {
+    get realError() {
+      return realError;
+    },
+    onLine(line, truncated = false) {
+      if (truncated) {
+        search.skipped.unknown = true;
+        search.complete = false;
+        search.reason ??= "errors";
+      }
+      if (!line.trim()) return;
+      if (continuation && /^\s/.test(line)) return;
+      const path5 = searchDiagnosticPath(line);
+      if (path5) {
+        skipSearchPath(search, path5, allows);
+        continuation = true;
+        return;
+      }
+      if (continuation && /\(os error \d+\)/.test(line)) return;
+      continuation = false;
+      if (/^(?:rg: |\[fd error\]:? )?(?:regex parse error|error parsing (?:glob|regex)|invalid (?:glob|regex)|error:|Usage:)/i.test(
+        line
+      ))
+        realError = true;
+      else search.skipped.unknown = true;
+      search.complete = false;
+      search.reason ??= "errors";
+    }
+  };
+}
+function finishSearch(search, result) {
+  const reason = result.aborted ? "cancelled" : result.timedOut ? "timeout" : result.stoppedEarly ? "limit" : result.exitCode !== 0 && result.exitCode !== 1 ? "errors" : search.reason;
+  if (reason) {
+    search.complete = false;
+    search.reason = reason;
+  }
+}
+function searchNotice(search, shown, unit) {
+  return search.complete ? "" : `
+[Search incomplete: ${search.reason}; ${shown} ${unit} shown; ${search.skipped.count}${search.skipped.unknown ? "+ (diagnostic coverage unknown)" : ""} paths skipped.]`;
+}
 function spawnLineStream(file, args, options) {
-  return new Promise((resolve2) => {
-    const timeoutMs = options.timeoutMs ?? SEARCH_SPAWN_TIMEOUT_MS;
+  return new Promise((resolve3) => {
+    const timeoutMs = options.timeoutMs ?? timeoutContext.getStore() ?? SEARCH_SPAWN_TIMEOUT_MS;
     let timedOut = false;
     let aborted = false;
     let stoppedEarly = false;
     let killSent = false;
     let settled = false;
-    let stderr = "";
+    const retainedStderr = Buffer.alloc(SEARCH_STDERR_CAP_BYTES);
+    let stderrBytes = 0;
     let killGraceTimer = null;
     const spawned = (() => {
       try {
@@ -2798,9 +3659,10 @@ function spawnLineStream(file, args, options) {
       }
     })();
     if (!spawned.ok) {
-      resolve2({
+      resolve3({
         exitCode: null,
         stderr: "",
+        oversizedDiagnostics: 0,
         timedOut: false,
         aborted: false,
         stoppedEarly: false,
@@ -2810,6 +3672,7 @@ function spawnLineStream(file, args, options) {
     }
     const child = spawned.child;
     const rl = createInterface2({ input: child.stdout });
+    const stderrLines = new BoundedDiagnosticDecoder((line, truncated) => options.onStderrLine?.(line, truncated));
     const sendSignal = (signalName) => {
       const pid = child.pid;
       if (pid && process.platform !== "win32") {
@@ -2851,9 +3714,11 @@ function spawnLineStream(file, args, options) {
       if (killGraceTimer) clearTimeout(killGraceTimer);
       options.signal?.removeEventListener("abort", onAbort);
       rl.close();
-      resolve2({
+      stderrLines.end();
+      resolve3({
         exitCode: child.exitCode,
-        stderr,
+        stderr: decodeBoundedUtf8(retainedStderr.subarray(0, stderrBytes)),
+        oversizedDiagnostics: stderrLines.oversizedLines,
         timedOut,
         aborted,
         stoppedEarly,
@@ -2865,7 +3730,10 @@ function spawnLineStream(file, args, options) {
       options.onLine(line, stop);
     });
     child.stderr?.on("data", (chunk) => {
-      if (stderr.length < STDERR_CAP_BYTES) stderr += chunk.toString("utf8");
+      const take = Math.min(chunk.length, retainedStderr.length - stderrBytes);
+      chunk.copy(retainedStderr, stderrBytes, 0, take);
+      stderrBytes += take;
+      stderrLines.write(chunk);
     });
     child.on("error", (error) => finish(error.message));
     child.on("close", () => finish(null));
@@ -2875,9 +3743,9 @@ function spawnLineStream(file, args, options) {
 // src/tools/find.ts
 var DEFAULT_LIMIT = 500;
 var MTIME_CANDIDATE_FLOOR = 2e3;
-function buildFdArgs(pattern, searchPath, maxResults, includeIgnored) {
+function buildFdArgs(pattern, searchPath, collectLimit, includeIgnored) {
   const args = ["--glob", "--color=never", ...fdIgnoreArgs(searchPath, includeIgnored)];
-  args.push("--max-results", String(maxResults));
+  args.push("--show-errors", "--max-results", String(collectLimit));
   let effectivePattern = pattern;
   if (pattern.includes("/")) {
     args.push("--full-path");
@@ -2888,35 +3756,38 @@ function buildFdArgs(pattern, searchPath, maxResults, includeIgnored) {
   args.push("--", effectivePattern, searchPath);
   return args;
 }
-async function fdFind(fdPath, pattern, searchPath, collectLimit, includeIgnored, signal) {
+async function fdFind(fdPath, pattern, searchPath, collectLimit, includeIgnored, search, allows, signal) {
   const lines = [];
+  const diagnostics = createSearchDiagnostics(search, (path5) => allows(resolve2(process.cwd(), path5)));
   const result = await spawnLineStream(fdPath, buildFdArgs(pattern, searchPath, collectLimit, includeIgnored), {
     ...signal ? { signal } : {},
+    onStderrLine: diagnostics.onLine,
     onLine(line, stop) {
       lines.push(line);
       if (lines.length >= collectLimit) stop();
     }
   });
-  if (result.aborted) return { ok: false, message: "find: operation aborted" };
-  if (result.timedOut) {
+  finishSearch(search, result);
+  if (!result.aborted && !result.timedOut && !result.stoppedEarly && result.exitCode !== 0) {
+    search.complete = false;
+    search.reason = "errors";
+  }
+  if (result.spawnError !== null) return { ok: false, message: `find: failed to run fd: ${result.spawnError}` };
+  if (!result.aborted && !result.timedOut && !result.stoppedEarly && result.exitCode !== 0 && lines.length === 0 && (diagnostics.realError || search.skipped.count === 0 && !search.skipped.unknown)) {
     return {
       ok: false,
-      message: `find: fd timed out after ${SEARCH_SPAWN_TIMEOUT_MS / 1e3}s. Narrow the pattern or path, or lower limit.`
+      message: `find: fd rejected the search or failed (exit code ${result.exitCode}). Check the glob and search path.`
     };
   }
-  if (result.spawnError !== null) return { ok: false, message: `find: failed to run fd: ${result.spawnError}` };
-  if (!result.stoppedEarly && result.exitCode !== 0 && lines.length === 0) {
-    return { ok: false, message: `find: ${result.stderr.trim() || `fd exited with code ${result.exitCode}`}` };
-  }
-  const paths = lines.map((rawLine) => rawLine.replace(/\r$/, "").trim()).filter((line) => line.length > 0).map((line) => {
+  const paths = lines.map((rawLine) => rawLine.replace(/\r$/, "")).filter((line) => line.length > 0).map((line) => {
     const hadTrailingSlash = line.endsWith("/") || line.endsWith("\\");
-    let relPath = line.startsWith(searchPath) ? line.slice(searchPath.length + 1) : relative(searchPath, line);
+    let relPath = relative(searchPath, line);
     if (hadTrailingSlash && !relPath.endsWith("/")) relPath += "/";
     return toPosixPath(relPath);
   });
   return { ok: true, paths };
 }
-async function fallbackFind(pattern, searchPath, collectLimit, includeIgnored, signal) {
+async function fallbackFind(pattern, searchPath, collectLimit, includeIgnored, search, allows, signal) {
   const matcher = compileGlobRegex(pattern.includes("/") ? pattern : `**/${pattern}`);
   const ignored = fallbackIgnoredDirs(includeIgnored);
   const out = [];
@@ -2926,11 +3797,13 @@ async function fallbackFind(pattern, searchPath, collectLimit, includeIgnored, s
     try {
       entries = (await readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     } catch {
+      skipSearchPath(search, dir, allows);
       return;
     }
     for (const entry of entries) {
       if (out.length >= collectLimit || signal?.aborted) return;
-      const absPath = join(dir, entry.name);
+      const absPath = join2(dir, entry.name);
+      if (!allows(absPath)) continue;
       if (entry.isDirectory() && !entry.isSymbolicLink()) {
         if (ignored.has(entry.name)) continue;
         const relDir = `${toPosixPath(relative(searchPath, absPath))}/`;
@@ -2938,7 +3811,13 @@ async function fallbackFind(pattern, searchPath, collectLimit, includeIgnored, s
         await walk(absPath);
         continue;
       }
-      if (!entry.isFile()) continue;
+      if (entry.isSymbolicLink()) {
+        try {
+          if (statSync(absPath).isDirectory()) skipSearchPath(search, absPath, allows);
+        } catch {
+          skipSearchPath(search, absPath, allows);
+        }
+      } else if (!entry.isFile()) continue;
       const relPath = toPosixPath(relative(searchPath, absPath));
       if (matcher.test(normalizeGlobInput(relPath))) out.push(relPath);
     }
@@ -2946,13 +3825,14 @@ async function fallbackFind(pattern, searchPath, collectLimit, includeIgnored, s
   await walk(searchPath);
   return out;
 }
-function orderByMtime(paths, searchPath, limit, candidateCap) {
+function orderByMtime(paths, searchPath, limit, candidateCap, search) {
   const candidateCapHit = paths.length >= candidateCap;
   const stamped = paths.map((relPath) => {
     let mtimeMs = 0;
     try {
-      mtimeMs = statSync(join(searchPath, relPath)).mtimeMs;
+      mtimeMs = statSync(join2(searchPath, relPath)).mtimeMs;
     } catch {
+      skipSearchPath(search, join2(searchPath, relPath));
     }
     return { relPath, mtimeMs };
   });
@@ -2960,16 +3840,22 @@ function orderByMtime(paths, searchPath, limit, candidateCap) {
   return { paths: stamped.slice(0, limit).map((entry) => entry.relPath), candidateCapHit, candidateCap };
 }
 function renderFindResult(input) {
-  const { ordered, collected, collectLimit, limit, order, reservation, options } = input;
+  const { ordered, collected, collectLimit, limit, order, reservation, options, search } = input;
+  if ((collected > limit || collected >= collectLimit || ordered.candidateCapHit) && search.complete) {
+    search.complete = false;
+    search.reason = "limit";
+  }
+  const coverageNotice = input.fallback ? "\n[Fallback search uses GENERATED_DIRS only; .gitignore is not applied.]" : "\n[Native fd search: skipped symlinked directories are not counted.]";
   if (ordered.paths.length === 0) {
     return finalizeObservation({
       tool: ToolNames.Find,
       withheldPaths: input.withheldPaths,
       unit: "paths",
-      output: "No visible files found matching pattern",
+      output: (search.complete ? "No visible files found matching pattern" : "Search incomplete") + searchNotice(search, 0, "paths") + coverageNotice,
+      details: { search, symlinkDirectories: { counted: input.fallback } },
       shownCount: 0,
-      totalCount: collected >= collectLimit ? null : 0,
-      truncated: collected >= collectLimit,
+      totalCount: search.complete ? 0 : null,
+      truncated: !search.complete,
       ...collected >= collectLimit ? { next: `limit=${limit * 2}` } : {},
       reservation,
       ...options ? { options } : {}
@@ -2981,10 +3867,14 @@ function renderFindResult(input) {
     maxLines: Number.MAX_SAFE_INTEGER
   });
   const limitHit = collected > limit || collected >= collectLimit;
-  const totalKnown = !limitHit && !ordered.candidateCapHit;
-  const truncated = limitHit || ordered.candidateCapHit || truncation.truncated;
+  if (truncation.truncated && search.complete) {
+    search.complete = false;
+    search.reason = "limit";
+  }
+  const totalKnown = search.complete;
+  const truncated = !search.complete || limitHit || ordered.candidateCapHit || truncation.truncated;
   const next = limitHit ? `limit=${limit * 2}` : ordered.candidateCapHit ? "order=path" : void 0;
-  const details = {};
+  const details = { search, symlinkDirectories: { counted: input.fallback } };
   if (order === "mtime" && ordered.candidateCap !== null) {
     details.candidates = {
       cap: ordered.candidateCap,
@@ -2997,7 +3887,7 @@ function renderFindResult(input) {
     tool: ToolNames.Find,
     withheldPaths: input.withheldPaths,
     unit: "paths",
-    output: truncation.content,
+    output: truncation.content + searchNotice(search, truncation.outputLines, "paths") + coverageNotice,
     // Offload only when the byte cap cut collected paths; a bare result
     // limit continues via `next`, and the offload would duplicate the body.
     ...truncation.truncated ? { fullOutput } : {},
@@ -3012,7 +3902,7 @@ function renderFindResult(input) {
 }
 var findTool = {
   name: ToolNames.Find,
-  description: "Find files and directories by glob pattern (supports *, **, ?, [abc]); returns paths relative to the search directory. Respects .gitignore and skips generated dirs (node_modules, dist, build, ...) unless include_ignored=true. order=path (default) returns fd's native order; order=mtime returns newest first from a bounded candidate set. Truncated results say how to continue and where the full list was saved.",
+  description: "Find files and directories by glob pattern (supports *, **, ?, [abc]); returns paths relative to the search directory. Respects .gitignore and skips generated dirs (node_modules, dist, build, ...) unless include_ignored=true. Symlinked directories are never followed. Only the fallback counts skipped symlinked directories; native fd leaves that count unmeasured, as indicated by details.symlinkDirectories.counted=false. Without fd the fallback uses GENERATED_DIRS only, with no .gitignore support. order=path (default) returns fd's native order; order=mtime returns newest first from a bounded candidate set. Truncated results say how to continue and where the full list was saved.",
   parameters: typebox_exports.Object({
     pattern: typebox_exports.String({ description: "Glob pattern, e.g. 'src/**/*.ts'." }),
     path: typebox_exports.Optional(typebox_exports.String({ description: "Directory to search in." })),
@@ -3052,24 +3942,48 @@ var findTool = {
     commitObservationReservation(reservation);
     try {
       let collectedPaths;
+      const search = newSearchCompleteness();
+      const pathFilter = createObservationPathFilter(process.cwd(), options?.allowsObservationPath);
       const fdPath = resolveFdBinary();
       if (fdPath) {
-        const result = await fdFind(fdPath, pattern, searchPath, collectLimit, includeIgnored, options?.signal);
+        const result = await fdFind(
+          fdPath,
+          pattern,
+          searchPath,
+          collectLimit,
+          includeIgnored,
+          search,
+          pathFilter.allows,
+          options?.signal
+        );
         if (!result.ok) return { kind: "error", message: result.message };
         collectedPaths = result.paths;
       } else {
         try {
-          collectedPaths = await fallbackFind(pattern, searchPath, collectLimit, includeIgnored, options?.signal);
+          collectedPaths = await fallbackFind(
+            pattern,
+            searchPath,
+            collectLimit,
+            includeIgnored,
+            search,
+            pathFilter.allows,
+            options?.signal
+          );
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           return { kind: "error", message: `find: ${message}` };
         }
       }
+      if (options?.signal?.aborted) {
+        search.complete = false;
+        search.reason = "cancelled";
+      }
       const collectedCount = collectedPaths.length;
-      const pathFilter = createObservationPathFilter(process.cwd(), options?.allowsObservationPath);
-      collectedPaths = collectedPaths.filter((entry) => pathFilter.allows(join(searchPath, entry)));
-      const ordered = order === "mtime" ? orderByMtime(collectedPaths, searchPath, limit, collectLimit) : { paths: collectedPaths.slice(0, limit), candidateCapHit: false, candidateCap: null };
+      collectedPaths = collectedPaths.filter((entry) => pathFilter.allows(join2(searchPath, entry)));
+      const ordered = order === "mtime" ? orderByMtime(collectedPaths, searchPath, limit, collectLimit, search) : { paths: collectedPaths.slice(0, limit), candidateCapHit: false, candidateCap: null };
       return renderFindResult({
+        search,
+        fallback: !fdPath,
         withheldPaths: pathFilter.withheldPaths,
         ordered,
         collected: collectedCount,
@@ -3087,8 +4001,10 @@ var findTool = {
 
 // src/tools/grep.ts
 init_esm_shims();
-import { readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
-import path2, { join as join2, relative as relative2 } from "node:path";
+import { statSync as statSync2 } from "node:fs";
+import { readdir as readdir2, readFile as readFile2, stat as stat3 } from "node:fs/promises";
+import path2, { join as join3, relative as relative2 } from "node:path";
+import { setImmediate as yieldToLoop } from "node:timers/promises";
 var DEFAULT_LIMIT2 = 100;
 var FALLBACK_MAX_FILE_BYTES = 2e7;
 var MODE_UNITS = {
@@ -3118,16 +4034,18 @@ function statIsDirectory(searchPath) {
 }
 var NO_MATCH_OUTPUT = "No matches found";
 function renderGrepResult(input) {
-  const { mode, lines, matchCount, limitHit, limit, linesTruncated, reservation, options } = input;
+  const { mode, lines, matchCount, limitHit, limit, linesTruncated, reservation, options, search } = input;
+  const fallbackNotice = input.fallback ? "\n[Fallback search uses GENERATED_DIRS only; .gitignore is not applied.]" : "";
   if (lines.length === 0) {
     return finalizeObservation({
       tool: ToolNames.Grep,
       withheldPaths: input.withheldPaths,
       unit: MODE_UNITS[mode],
-      output: NO_MATCH_OUTPUT,
+      output: (search.complete ? NO_MATCH_OUTPUT : "Search incomplete") + searchNotice(search, 0, "matches") + fallbackNotice,
+      details: { search },
       shownCount: 0,
-      totalCount: 0,
-      truncated: false,
+      totalCount: search.complete ? 0 : null,
+      truncated: !search.complete,
       reservation,
       ...options ? { options } : {}
     });
@@ -3143,7 +4061,11 @@ function renderGrepResult(input) {
   } else {
     shownCount = truncation.outputLines;
   }
-  const truncated = limitHit || truncation.truncated;
+  if (truncation.truncated && search.complete) {
+    search.complete = false;
+    search.reason = "limit";
+  }
+  const truncated = !search.complete || limitHit || truncation.truncated;
   const next = limitHit ? `limit=${limit * 2}` : truncation.truncated && mode === "content" ? "mode=files" : void 0;
   let output = truncation.content;
   if (linesTruncated) {
@@ -3155,12 +4077,13 @@ function renderGrepResult(input) {
     tool: ToolNames.Grep,
     withheldPaths: input.withheldPaths,
     unit: MODE_UNITS[mode],
-    output,
+    output: output + searchNotice(search, shownCount, "matches") + fallbackNotice,
+    details: { search },
     // Offload only when the byte cap cut collected content; a bare match
     // limit continues via `next`, and the offload would duplicate the body.
     ...truncation.truncated ? { fullOutput } : {},
     shownCount,
-    totalCount: limitHit ? null : matchCount,
+    totalCount: search.complete ? matchCount : null,
     truncated,
     ...next !== void 0 ? { next } : {},
     reservation,
@@ -3244,22 +4167,23 @@ async function runRipgrep(input) {
       stop();
     }
   };
+  const search = newSearchCompleteness();
+  const diagnostics = createSearchDiagnostics(search, (filePath) => input.pathFilter.allows(path2.resolve(filePath)));
   const result = await spawnLineStream(input.rgPath, buildRgArgs(input), {
     ...input.options?.signal ? { signal: input.options.signal } : {},
-    onLine: input.mode === "content" ? onContentLine : onListLine
+    onLine: input.mode === "content" ? onContentLine : onListLine,
+    onStderrLine: diagnostics.onLine
   });
-  if (result.aborted) return { kind: "error", message: "grep: operation aborted" };
-  if (result.timedOut) {
+  finishSearch(search, result);
+  if (result.spawnError !== null) return { kind: "error", message: `grep: failed to run rg: ${result.spawnError}` };
+  if (!result.aborted && !result.timedOut && !result.stoppedEarly && result.exitCode !== 0 && result.exitCode !== 1 && matchCount === 0 && (diagnostics.realError || search.skipped.count === 0 && !search.skipped.unknown)) {
     return {
       kind: "error",
-      message: `grep: rg timed out after ${SEARCH_SPAWN_TIMEOUT_MS / 1e3}s. Narrow the pattern, path, or glob, lower context, or use mode=files.`
+      message: `grep: rg rejected the search or failed (exit code ${result.exitCode}). Check the pattern and search path.`
     };
   }
-  if (result.spawnError !== null) return { kind: "error", message: `grep: failed to run rg: ${result.spawnError}` };
-  if (!result.stoppedEarly && result.exitCode !== 0 && result.exitCode !== 1) {
-    return { kind: "error", message: `grep: ${result.stderr.trim() || `ripgrep exited with code ${result.exitCode}`}` };
-  }
   return renderGrepResult({
+    search,
     withheldPaths: input.pathFilter.withheldPaths,
     mode: input.mode,
     lines: rendered,
@@ -3287,7 +4211,8 @@ function looksBinary(buffer) {
   }
   return false;
 }
-function fallbackGrep(input) {
+async function fallbackGrep(input) {
+  const search = newSearchCompleteness();
   const built = buildMatchRegex(input.pattern, input.literal, input.ignoreCase);
   if (!built.ok) return { kind: "error", message: built.message };
   const regex = built.regex;
@@ -3312,21 +4237,32 @@ function fallbackGrep(input) {
     if (truncatedLine.wasTruncated) linesTruncated = true;
     rendered.push({ text: truncatedLine.text, isMatch });
   };
-  const searchFile = (filePath) => {
-    if (limitHit || !input.pathFilter.allows(filePath)) return;
+  const searchFile = async (filePath) => {
+    if (limitHit || signal?.aborted || !input.pathFilter.allows(filePath)) return;
     let buffer;
     try {
-      const stat = statSync2(filePath);
-      if (!stat.isFile() || stat.size > FALLBACK_MAX_FILE_BYTES) return;
-      buffer = readFileSync2(filePath);
+      const fileStat = await stat3(filePath);
+      if (!fileStat.isFile() || fileStat.size > FALLBACK_MAX_FILE_BYTES) {
+        skipSearchPath(search, filePath, input.pathFilter.allows);
+        return;
+      }
+      buffer = await readFile2(filePath);
     } catch {
+      skipSearchPath(search, filePath, input.pathFilter.allows);
+      return;
+    }
+    if (looksBinary(buffer)) {
+      skipSearchPath(search, filePath, input.pathFilter.allows);
       return;
     }
-    if (looksBinary(buffer)) return;
     const lines = buffer.toString("utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
     const rel = formatPath(filePath, input.searchPath, input.isDirectory);
     let fileMatches = 0;
     for (let i = 0; i < lines.length; i += 1) {
+      if (i % 1024 === 0) {
+        await yieldToLoop();
+        if (signal?.aborted) return;
+      }
       const lineText = lines[i] ?? "";
       regex.lastIndex = 0;
       if (!regex.test(lineText)) continue;
@@ -3358,34 +4294,45 @@ function fallbackGrep(input) {
       if (matchCount >= input.limit) limitHit = true;
     }
   };
-  const walk = (dir) => {
+  const walk = async (dir) => {
+    await yieldToLoop();
     if (limitHit || signal?.aborted) return;
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      entries = (await readdir2(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     } catch {
+      skipSearchPath(search, dir, input.pathFilter.allows);
       return;
     }
     for (const entry of entries) {
       if (limitHit || signal?.aborted) return;
-      const absPath = join2(dir, entry.name);
+      const absPath = join3(dir, entry.name);
+      if (!input.pathFilter.allows(absPath)) continue;
       if (entry.isDirectory()) {
         if (ignored.has(entry.name)) continue;
-        walk(absPath);
+        await walk(absPath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        skipSearchPath(search, absPath, input.pathFilter.allows);
         continue;
       }
-      if (!entry.isFile()) continue;
       if (globMatcher) {
         const relPath = normalizeGlobInput(relative2(input.searchPath, absPath));
         if (!globMatcher.test(relPath)) continue;
       }
-      searchFile(absPath);
+      await searchFile(absPath);
     }
   };
-  if (input.isDirectory) walk(input.searchPath);
-  else searchFile(input.searchPath);
-  if (signal?.aborted) return { kind: "error", message: "grep: operation aborted" };
+  if (input.isDirectory) await walk(input.searchPath);
+  else await searchFile(input.searchPath);
+  if (signal?.aborted || limitHit) {
+    search.complete = false;
+    search.reason = signal?.aborted ? "cancelled" : "limit";
+  }
   return renderGrepResult({
+    fallback: true,
+    search,
     withheldPaths: input.pathFilter.withheldPaths,
     mode: input.mode,
     lines: rendered,
@@ -3399,7 +4346,7 @@ function fallbackGrep(input) {
 }
 var grepTool = {
   name: ToolNames.Grep,
-  description: `Search file contents with ripgrep. mode=content (default) returns matching lines with paths and line numbers, mode=files returns only matching file paths, mode=count returns per-file match counts. Respects .gitignore and skips generated dirs unless include_ignored=true. Capped at ${DEFAULT_LIMIT2} matches by default; truncated results say how to continue and where the full output was saved.`,
+  description: `Search file contents with ripgrep. mode=content (default) returns matching lines with paths and line numbers, mode=files returns only matching file paths, mode=count returns per-file match counts. Respects .gitignore and skips generated dirs unless include_ignored=true. Without rg, the async fallback uses GENERATED_DIRS only and does not apply .gitignore; unreadable, binary, oversized files and symlinks are reported as skipped. Capped at ${DEFAULT_LIMIT2} matches by default; truncated results say how to continue and where the full output was saved.`,
   parameters: typebox_exports.Object({
     pattern: typebox_exports.String({ description: "Search pattern (regex by default)." }),
     path: typebox_exports.Optional(typebox_exports.String({ description: "Directory or file to search." })),
@@ -3425,8 +4372,8 @@ var grepTool = {
     const context = parseContext(args.context);
     if (context === null) return { kind: "error", message: "grep: context must be a non-negative number" };
     const searchPath = resolveReadPath(typeof args.path === "string" && args.path.length > 0 ? args.path : ".");
-    const stat = statIsDirectory(searchPath);
-    if (!stat.ok) return { kind: "error", message: `grep: ${stat.message}` };
+    const stat6 = statIsDirectory(searchPath);
+    if (!stat6.ok) return { kind: "error", message: `grep: ${stat6.message}` };
     const limit = typeof args.limit === "number" && args.limit > 0 ? Math.floor(args.limit) : DEFAULT_LIMIT2;
     const glob = typeof args.glob === "string" && args.glob.length > 0 ? args.glob : void 0;
     const ignoreCase = args.ignore_case === true;
@@ -3448,7 +4395,7 @@ var grepTool = {
       mode,
       pattern,
       searchPath,
-      isDirectory: stat.isDirectory,
+      isDirectory: stat6.isDirectory,
       ...glob !== void 0 ? { glob } : {},
       ignoreCase,
       literal,
@@ -3462,7 +4409,7 @@ var grepTool = {
     try {
       const rgPath = resolveRgBinary();
       if (rgPath) return await runRipgrep({ rgPath, ...shared });
-      return fallbackGrep(shared);
+      return await fallbackGrep(shared);
     } finally {
       releaseObservation(reservation);
     }
@@ -3675,15 +4622,62 @@ var limitationTool = {
 
 // src/tools/ls.ts
 init_esm_shims();
-import { readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { lstat as lstat2, opendir, readlink as readlink2, stat as stat4 } from "node:fs/promises";
 import path3 from "node:path";
+import { setImmediate as yieldToLoop2 } from "node:timers/promises";
 var DEFAULT_LIMIT3 = 500;
 function parseLimit(value) {
-  return typeof value === "number" && value > 0 ? Math.floor(value) : DEFAULT_LIMIT3;
-}
+  return typeof value === "number" && Number.isFinite(value) && value >= 1 ? Math.floor(value) : DEFAULT_LIMIT3;
+}
+var compareEntries = (a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.order - b.order;
+var BoundedListingSelection = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  limit;
+  entries = [];
+  nextOrder = 0;
+  get retained() {
+    return this.entries.length;
+  }
+  entryAt(index) {
+    const entry = this.entries[index];
+    if (!entry) throw new Error("Invalid listing heap index");
+    return entry;
+  }
+  add(name) {
+    const entry = { name, order: this.nextOrder++ };
+    if (this.entries.length < this.limit) {
+      this.entries.push(entry);
+      let i2 = this.entries.length - 1;
+      while (i2 > 0) {
+        const parent = Math.floor((i2 - 1) / 2);
+        if (compareEntries(this.entryAt(parent), entry) >= 0) break;
+        this.entries[i2] = this.entryAt(parent);
+        i2 = parent;
+      }
+      this.entries[i2] = entry;
+      return;
+    }
+    if (compareEntries(entry, this.entryAt(0)) >= 0) return;
+    this.entries[0] = entry;
+    let i = 0;
+    while (2 * i + 1 < this.entries.length) {
+      let child = 2 * i + 1;
+      if (child + 1 < this.entries.length && compareEntries(this.entryAt(child + 1), this.entryAt(child)) > 0) child++;
+      if (compareEntries(entry, this.entryAt(child)) >= 0) break;
+      this.entries[i] = this.entryAt(child);
+      i = child;
+    }
+    this.entries[i] = entry;
+  }
+  sorted() {
+    return [...this.entries].sort(compareEntries).map((entry) => entry.name);
+  }
+};
 var lsTool = {
   name: ToolNames.Ls,
-  description: 'List directory entries sorted alphabetically, "/" suffix for directories, dotfiles included.',
+  description: 'List directory entries sorted alphabetically, "/" suffix for directories, dotfiles included. Symlinks render as name@ -> target, broken links as name@ (broken), and inaccessible entries are marked and counted.',
   parameters: typebox_exports.Object({
     path: typebox_exports.Optional(typebox_exports.String({ description: "Directory to list." })),
     limit: typebox_exports.Optional(typebox_exports.Number({ description: `Max entries (default ${DEFAULT_LIMIT3}).` }))
@@ -3695,7 +4689,7 @@ var lsTool = {
     const root = resolveReadPath(rootArg);
     const limit = parseLimit(args.limit);
     try {
-      const rootStat = statSync3(root);
+      const rootStat = await stat4(root);
       if (!rootStat.isDirectory()) {
         return { kind: "error", message: `ls: not a directory: ${root}` };
       }
@@ -3713,28 +4707,57 @@ var lsTool = {
         hint: "Use find with a narrower pattern or continue in a follow-up turn."
       });
     }
+    commitObservationReservation(reservation);
     try {
-      const pathFilter = createObservationPathFilter(process.cwd(), options?.allowsObservationPath);
-      const entries = readdirSync2(root).filter((entry) => pathFilter.allows(path3.join(root, entry))).sort((a, b) => a.toLowerCase().localeCompare(b.toLowerCase()));
+      const policy = options?.allowsObservationPath ? void 0 : createSafetyPolicyEngine({ cwd: process.cwd() });
+      const allows = options?.allowsObservationPath ?? ((entryPath) => policy?.evaluate({ tool: "read", args: { path: entryPath } }).reasonCode !== "path-policy:zeroAccessPaths");
+      let withheldPaths = 0;
+      let visibleCount = 0;
+      let scanned = 0;
+      const selection = new BoundedListingSelection(limit);
+      for await (const entry of await opendir(root)) {
+        if (++scanned % 128 === 0) await yieldToLoop2();
+        if (options?.signal?.aborted) return { kind: "error", message: "ls: operation aborted during enumeration" };
+        if (!allows(path3.join(root, entry.name))) {
+          withheldPaths++;
+          continue;
+        }
+        visibleCount++;
+        selection.add(entry.name);
+      }
+      const entries = selection.sorted();
       const outputEntries = [];
-      let entryLimitReached = false;
+      const entryLimitReached = visibleCount > limit;
+      const search = newSearchCompleteness();
       for (const entry of entries) {
-        if (outputEntries.length >= limit) {
-          entryLimitReached = true;
-          break;
-        }
+        const entryPath = path3.join(root, entry);
         try {
-          const entryStat = statSync3(path3.join(root, entry));
-          outputEntries.push(entryStat.isDirectory() ? `${entry}/` : entry);
+          const entryStat = await lstat2(entryPath);
+          if (entryStat.isSymbolicLink()) {
+            const target = await readlink2(entryPath);
+            try {
+              await stat4(entryPath);
+              outputEntries.push(`${entry}@ -> ${target}`);
+            } catch (error) {
+              const code = error.code;
+              outputEntries.push(`${entry}@ (${code === "ENOENT" || code === "ENOTDIR" ? "broken" : "unreadable"})`);
+              skipSearchPath(search, entryPath);
+            }
+          } else {
+            outputEntries.push(entryStat.isDirectory() ? `${entry}/` : entry);
+          }
         } catch {
+          outputEntries.push(`${entry} (unreadable)`);
+          skipSearchPath(search, entryPath);
         }
       }
       if (outputEntries.length === 0) {
         return finalizeObservation({
           tool: ToolNames.Ls,
-          withheldPaths: pathFilter.withheldPaths,
+          withheldPaths,
           unit: "entries",
           output: "(empty directory)",
+          details: { skipped: search.skipped, selection: { scanned, retained: selection.retained } },
           shownCount: 0,
           totalCount: 0,
           truncated: false,
@@ -3750,14 +4773,15 @@ var lsTool = {
       const truncated = entryLimitReached || truncation.truncated;
       return finalizeObservation({
         tool: ToolNames.Ls,
-        withheldPaths: pathFilter.withheldPaths,
+        withheldPaths,
         unit: "entries",
         output: truncation.content,
+        details: { skipped: search.skipped, selection: { scanned, retained: selection.retained } },
         // Offload only when the byte cap cut collected entries; a bare
         // entry limit continues via `next`.
         ...truncation.truncated ? { fullOutput } : {},
         shownCount: truncation.outputLines,
-        totalCount: entries.length,
+        totalCount: visibleCount,
         truncated,
         ...entryLimitReached ? { next: `limit=${limit * 2}` } : {},
         reservation,
@@ -3766,6 +4790,8 @@ var lsTool = {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { kind: "error", message: `ls: ${msg}` };
+    } finally {
+      releaseObservation(reservation);
     }
   }
 };
@@ -3781,6 +4807,12 @@ var TOOL_PLANES = {
   [ToolNames.CodeNav]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
   [ToolNames.Context]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
   [ToolNames.CredentialPresent]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
+  // clio_docs and clio_library are the bundled-documentation and recipe-catalog
+  // reads that used to be context scopes; same envelope, same read class.
+  [ToolNames.ClioDocs]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
+  [ToolNames.ClioLibrary]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
+  // data streams structured files and never writes; parallel like read.
+  [ToolNames.Data]: { plane: "observe", actionClass: "read", executionMode: "parallel" },
   [ToolNames.Write]: { plane: "mutate", actionClass: "write", executionMode: "sequential" },
   [ToolNames.Edit]: { plane: "mutate", actionClass: "write", executionMode: "sequential" },
   [ToolNames.Bash]: { plane: "execute", actionClass: "execute", executionMode: "sequential" },
@@ -3788,6 +4820,9 @@ var TOOL_PLANES = {
   // its containment posture, read class for its safety disposition.
   [ToolNames.Git]: { plane: "execute", actionClass: "read", executionMode: "parallel" },
   [ToolNames.Verify]: { plane: "execute", actionClass: "execute", executionMode: "sequential" },
+  // run_script runs one interpreter over one workspace script and projects
+  // itself to a bash command for the policy engine; execute class, sequential.
+  [ToolNames.RunScript]: { plane: "execute", actionClass: "execute", executionMode: "sequential" },
   [ToolNames.Dispatch]: { plane: "orchestrate", actionClass: "dispatch", executionMode: "sequential" },
   // monitor never mutates a run, so it stays read class and parallel.
   [ToolNames.Monitor]: { plane: "orchestrate", actionClass: "read", executionMode: "parallel" },
@@ -3814,9 +4849,17 @@ var TOOL_PLANES = {
   // nothing else. Read class so it never trips a safety gate; sequential so
   // two decisions in one batch never race the supersede lookup.
   [ToolNames.Decide]: { plane: "orchestrate", actionClass: "read", executionMode: "sequential" },
+  // web_read is the GET-only half of the split: no method, headers, or body,
+  // so it is never an outward action.
+  [ToolNames.WebRead]: { plane: "retrieve", actionClass: "read", executionMode: "parallel" },
   [ToolNames.WebFetch]: { plane: "retrieve", actionClass: "read", executionMode: "parallel" },
   [ToolNames.AskUser]: { plane: "interact", actionClass: "read", executionMode: "sequential" },
-  [ToolNames.Artifact]: { plane: "artifact", actionClass: "write", executionMode: "sequential" }
+  [ToolNames.Artifact]: { plane: "artifact", actionClass: "write", executionMode: "sequential" },
+  // gateway lists, describes, and calls secondary capabilities. Its own class
+  // is read; a call carries the capability's class through the same admission.
+  // Sequential because a call may park for approval or run a sequential
+  // capability, and two such calls in one batch must not interleave.
+  [ToolNames.Gateway]: { plane: "gateway", actionClass: "read", executionMode: "sequential" }
 };
 var OBSERVE_ENVELOPE_SELF_CAPS = [
   [ToolNames.Read, () => readMaxBytes()],
@@ -3824,22 +4867,18 @@ var OBSERVE_ENVELOPE_SELF_CAPS = [
   [ToolNames.Find, () => OBSERVE_SELF_CAPS.find],
   [ToolNames.Ls, () => OBSERVE_SELF_CAPS.ls],
   [ToolNames.CodeNav, () => OBSERVE_SELF_CAPS.codeNav],
-  [
-    ToolNames.Context,
-    () => Math.max(
-      OBSERVE_SELF_CAPS.contextDocs,
-      OBSERVE_SELF_CAPS.contextSkills,
-      OBSERVE_SELF_CAPS.contextWorkspace,
-      OBSERVE_SELF_CAPS.contextLibrary
-    )
-  ]
+  [ToolNames.Context, () => Math.max(OBSERVE_SELF_CAPS.contextSkills, OBSERVE_SELF_CAPS.contextWorkspace)],
+  [ToolNames.ClioDocs, () => OBSERVE_SELF_CAPS.contextDocs],
+  [ToolNames.ClioLibrary, () => OBSERVE_SELF_CAPS.contextLibrary],
+  [ToolNames.Data, () => DATA_OBSERVATION_SELF_CAP_BYTES],
+  [ToolNames.Gateway, () => GATEWAY_FIND_SELF_CAP_BYTES]
 ];
 var SESSION_BOUND_TOOLS = /* @__PURE__ */ new Set([]);
 var DISPATCH_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.Dispatch, ToolNames.Monitor, ToolNames.Steer]);
 var INTERACTIVE_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.AskUser]);
 var PANES_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.Panes]);
 var LEDGER_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.Ledger]);
-var NETWORK_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.WebFetch]);
+var NETWORK_BOUND_TOOLS = /* @__PURE__ */ new Set([ToolNames.WebRead, ToolNames.WebFetch]);
 function validateBuiltinToolPolicy(specs, options = {}) {
   const errors = [];
   const registered = /* @__PURE__ */ new Map();
@@ -4138,11 +5177,10 @@ function createTasksTool(deps) {
 
 // src/tools/write.ts
 init_esm_shims();
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname } from "node:path";
+import { open as open2, stat as stat5 } from "node:fs/promises";
 var writeTool = {
   name: ToolNames.Write,
-  description: "Write a UTF-8 text file, creating parent directories and overwriting existing files. Use edit for surgical changes.",
+  description: "Write a UTF-8 text file, creating parent directories and overwriting existing files. Publishes atomically through symlinks, preserving mode bits. In-process writes are serialized; external writers are not locked and the last rename wins. Use edit for surgical changes.",
   parameters: typebox_exports.Object({
     path: typebox_exports.String({ description: "File path (relative or absolute)." }),
     content: typebox_exports.String({ description: "Full UTF-8 file contents." })
@@ -4156,30 +5194,56 @@ var writeTool = {
     if (content === null) return { kind: "error", message: "write: missing content argument" };
     const filePath = resolveToCwd(pathArg);
     try {
-      let previousEndedWithNewline = false;
-      let previousContent = "";
-      await withFileMutationQueue(filePath, async () => {
-        try {
-          previousContent = readFileSync3(filePath, "utf8");
-          previousEndedWithNewline = previousContent.endsWith("\n");
-        } catch {
-          previousContent = "";
-          previousEndedWithNewline = false;
+      const bytes = Buffer.byteLength(content, "utf8");
+      const { file, diff, previousEndedWithNewline, skipDiff } = await withFileMutationQueue(filePath, async () => {
+        const previous = await stat5(filePath).catch((error) => {
+          if (error.code === "ENOENT") return null;
+          throw error;
+        });
+        if (previous && !previous.isFile()) throw new Error("Refusing directory or non-file target");
+        let skipDiff2 = Math.max(previous?.size ?? 0, bytes) > 1024 * 1024;
+        let previousContent = "";
+        if (previous && !skipDiff2) {
+          const handle = await open2(filePath, "r");
+          try {
+            const buffer = Buffer.allocUnsafe(1024 * 1024 + 1);
+            let total = 0;
+            while (total < buffer.length) {
+              const { bytesRead } = await handle.read(buffer, total, buffer.length - total, total);
+              if (bytesRead === 0) break;
+              total += bytesRead;
+            }
+            skipDiff2 = total > 1024 * 1024;
+            if (!skipDiff2) previousContent = buffer.toString("utf8", 0, total);
+          } finally {
+            await handle.close();
+          }
         }
-        mkdirSync2(dirname(filePath), { recursive: true });
-        writeFileSync3(filePath, content, "utf8");
+        const diff2 = skipDiff2 ? void 0 : generateDiffString(previousContent, content).diff;
+        const file2 = await publishFileAtomically(filePath, content);
+        return { file: file2, diff: diff2, previousEndedWithNewline: previousContent.endsWith("\n"), skipDiff: skipDiff2 };
       });
-      const bytes = Buffer.byteLength(content, "utf8");
-      const diff = generateDiffString(previousContent, content).diff;
       let output = `wrote ${bytes}B to ${pathArg}`;
+      if (skipDiff) output += "\nnote: diff skipped because the previous or new file exceeds 1 MiB";
+      if (file.durabilityWarning) output += `
+${file.durabilityWarning}`;
       if (previousEndedWithNewline && !content.endsWith("\n")) {
         output += `
 note: ${pathArg} no longer ends with a newline; the previous content did`;
       }
-      return { kind: "ok", output, details: { diff, paths: [filePath], observation: { shownBytes: bytes } } };
+      return {
+        kind: "ok",
+        output,
+        details: {
+          file: { before: file.before, after: file.after },
+          diff,
+          paths: [filePath],
+          observation: { shownBytes: bytes }
+        }
+      };
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      return { kind: "error", message: `write: ${msg}` };
+      return { kind: "error", message: `write: Nothing was published. ${msg}` };
     }
   }
 };
@@ -4212,7 +5276,13 @@ function registerCoreTools(registry, deps = {}) {
   if (includeNetworkTools) {
     registry.register({
       ...builtin(
-        lazyTool(webFetchToolSurface, async () => (await import("./web-fetch-U22Q7HV4.js")).webFetchTool),
+        lazyTool(webReadToolSurface, async () => (await import("./web-fetch-6BRRVQON.js")).webReadTool),
+        { path: "src/tools/web-fetch.ts", scope: "core" }
+      )
+    });
+    registry.register({
+      ...builtin(
+        lazyTool(webFetchToolSurface, async () => (await import("./web-fetch-6BRRVQON.js")).webFetchTool),
         { path: "src/tools/web-fetch.ts", scope: "core" }
       )
     });
@@ -4222,13 +5292,35 @@ function registerCoreTools(registry, deps = {}) {
   });
   registry.register({
     ...builtin(
-      lazyTool(verifyToolSurface, async () => (await import("./verify-OZU4LLNP.js")).verifyTool),
+      lazyTool(verifyToolSurface, async () => (await import("./verify-SUKUK6XM.js")).verifyTool),
       { path: "src/tools/verify/index.ts", scope: "core" }
     )
   });
+  const getWorkspaceRoot = () => deps.session?.current()?.cwd ?? process.cwd();
+  registry.register({
+    ...builtin(
+      lazyTool({ ...runScriptToolSurface, name: ToolNames.RunScript }, async () => ({
+        ...(await import("./run-script-H2KUDIII.js")).createRunScriptTool({ getWorkspaceRoot }),
+        name: ToolNames.RunScript
+      })),
+      { path: "src/tools/run-script.ts", scope: "core" }
+    )
+  });
+  registry.register({
+    ...builtin(
+      lazyTool(
+        {
+          ...dataToolSurface,
+          prepareAdmissionArguments: (args) => prepareDataAdmissionArguments(args, getWorkspaceRoot())
+        },
+        async () => (await import("./data-tool-KMBWKKWR.js")).createDataTool({ getCwd: getWorkspaceRoot })
+      ),
+      { path: "src/tools/gateway/data-tool.ts", scope: "core" }
+    )
+  });
   registry.register({
     ...builtin(
-      lazyTool(codeNavToolSurface, async () => (await import("./code-nav-KBQ3RIFK.js")).codeNavTool),
+      lazyTool(codeNavToolSurface, async () => (await import("./code-nav-7OVCTP2Z.js")).codeNavTool),
       { path: "src/tools/codewiki/code-nav.ts", scope: "core" }
     )
   });
@@ -4263,7 +5355,7 @@ function registerCoreTools(registry, deps = {}) {
   registry.register({
     ...builtin(
       lazyTool(contextToolSurface, async () => {
-        const { createContextTool } = await import("./context-EZZPT2ZV.js");
+        const { createContextTool } = await import("./context-72VQV7JX.js");
         if (!session) return createContextTool(skillToolDeps);
         const { probeWorkspace } = await import("./workspace-DZ7JADBG.js");
         return createContextTool({
@@ -4297,6 +5389,31 @@ function registerCoreTools(registry, deps = {}) {
   registry.register({
     ...builtin(createArtifactTool({ getCwd: skillToolDeps.getCwd }), { path: "src/tools/artifact.ts", scope: "core" })
   });
+  registry.register({
+    ...builtin(
+      lazyTool(clioDocsToolSurface, async () => (await import("./clio-context-tools-FT672MNZ.js")).createClioDocsTool()),
+      { path: "src/tools/gateway/clio-context-tools.ts", scope: "core" }
+    )
+  });
+  registry.register({
+    ...builtin(
+      lazyTool(
+        clioLibraryToolSurface,
+        async () => (await import("./clio-context-tools-FT672MNZ.js")).createClioLibraryTool({
+          getCwd: skillToolDeps.getCwd,
+          ...deps.skillMarketplace !== void 0 ? { skillMarketplace: deps.skillMarketplace } : {},
+          ...deps.getSkillLoaderOptions ? { getSkillLoaderOptions: deps.getSkillLoaderOptions } : {}
+        })
+      ),
+      { path: "src/tools/gateway/clio-context-tools.ts", scope: "core" }
+    )
+  });
+  registry.register({
+    ...builtin(createGatewayTool({ registry, ...deps.mcpCapabilities ? { mcp: deps.mcpCapabilities } : {} }), {
+      path: "src/tools/gateway/index.ts",
+      scope: "core"
+    })
+  });
   const includeLedgerTools = deps.includeLedgerTools === true || deps.agentLedger !== void 0;
   if (includeLedgerTools) {
     registry.register({
@@ -4335,7 +5452,7 @@ init_esm_shims();
 import path4 from "node:path";
 var import_yaml = __toESM(require_dist(), 1);
 var MAX_INPUT_BYTES = 64 * 1024;
-function quoted(value) {
+function quoted2(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 function jsonInput(args) {
@@ -4374,6 +5491,9 @@ Harness extension ${extension.id}@${extension.version}; runs an installed comman
     parameters: tool.inputSchema,
     baseActionClass: "execute",
     executionMode: "sequential",
+    // Reached through gateway find/describe/call; the spec, its execute
+    // class, and its bash projection are unchanged by the placement.
+    placement: "gateway",
     sourceInfo: { path: extension.manifestPath, scope: "domain", extension: extension.provenance },
     metadata: {
       objective: tool.description,
@@ -4388,7 +5508,7 @@ Harness extension ${extension.id}@${extension.version}; runs an installed comman
         input = jsonInput(args);
       } catch {
       }
-      return { tool: "bash", args: { command: [vector.file, ...vector.args, input].map(quoted).join(" "), cwd } };
+      return { tool: "bash", args: { command: [vector.file, ...vector.args, input].map(quoted2).join(" "), cwd } };
     },
     async run(args, options) {
       try {
@@ -4485,9 +5605,10 @@ export {
   stripBom,
   applyEditsToNormalizedContent,
   generateDiffString,
+  createMcpCapabilitySource,
   lazyTool,
   registerCoreTools,
   assertRegisteredBuiltinTools,
   registerHarnessExtensionTools
 };
-//# sourceMappingURL=chunk-RXI7K4J5.js.map
+//# sourceMappingURL=chunk-ZF6CV4WZ.js.map