@livx.cc/agentx 0.99.13 → 0.99.15

package/dist/index.js

@@ -3280,7 +3280,34 @@ var AgentOptions = class {
    *  `'off'`/undefined = none; `'low'|'medium'|'high'` or a raw token budget. Mapped to the
    *  provider-specific request shape via {@link reasoningToChatFragment}; explicit `providerOptions` wins. */
   reasoning;
+  /** Seed a fresh `run()` with prior conversation turns (real role/content messages) so the model
+   *  sees history as structured turns instead of a flattened text blob. They are inserted AFTER the
+   *  stable system prompt and BEFORE the current user turn — so the cached system(+tools) prefix never
+   *  shifts. Turns are normalized before sending (empties dropped, adjacent same-role coalesced, and the
+   *  first tail turn forced to `user`) so the transcript is always a valid Anthropic alternation ending
+   *  at the current user prompt. Unset/empty ⇒ current behavior, byte-for-byte. */
+  priorMessages;
 };
+function seedTranscriptTail(prior, current) {
+  const seq = (prior ?? []).filter((m) => contentText(m.content).trim().length > 0).map((m) => ({ role: m.role, content: m.content }));
+  seq.push({ role: "user", content: current });
+  const out = [];
+  for (const m of seq) {
+    const last = out[out.length - 1];
+    if (last && last.role === m.role) {
+      if (typeof last.content === "string" && typeof m.content === "string") {
+        last.content = `${last.content}
+
+${m.content}`;
+        continue;
+      }
+      out.push({ role: m.role === "user" ? "assistant" : "user", content: "(continuing)" });
+    }
+    out.push({ role: m.role, content: m.content });
+  }
+  if (out.length && out[0].role !== "user") out.unshift({ role: "user", content: "(Earlier conversation)" });
+  return out;
+}
 var Agent = class _Agent {
   options;
   transcript = [];
@@ -3448,7 +3475,9 @@ var Agent = class _Agent {
     const userContent = await this.applyPromptSubmit(task);
     this.transcript = [
       { role: "system", content: systemPrompt + (startCtx ? "\n\n" + startCtx : "") },
-      { role: "user", content: userContent }
+      // Prior turns (if any) sit between the stable system prefix and the live user turn — the cached
+      // system(+tools) prefix is unaffected; normalization keeps the alternation valid.
+      ...seedTranscriptTail(this.options.priorMessages, userContent)
     ];
     return this.runLoop();
   }
@@ -4445,14 +4474,14 @@ function makeScheduleTools(scheduler, os) {
           backend: { type: "string", enum: ["auto", "session", "os"], description: "Where the job lives (default auto)." }
         }
       },
-      async run({ prompt, trigger, label, backend }) {
+      async run({ prompt, trigger, label, backend: backend2 }) {
         try {
-          if (os && os.route(trigger, backend) === "os") {
+          if (os && os.route(trigger, backend2) === "os") {
             const id2 = `os-${Date.now().toString(36)}`;
             const mechanism = os.schedule({ id: id2, prompt, sessionId: os.sessionId, cwd: os.cwd, trigger, label });
             return `Scheduled ${id2}${label ? ` (${label})` : ""} on the OS scheduler (${mechanism}) \u2014 survives quitting; fires \`agentx --resume ${os.sessionId}\` headless.`;
           }
-          if (backend === "os") return "Error: no OS scheduler available on this platform \u2014 job not created (use the default in-session backend).";
+          if (backend2 === "os") return "Error: no OS scheduler available on this platform \u2014 job not created (use the default in-session backend).";
           const id = scheduler.add({ prompt, trigger, label });
           const job = scheduler.get(id);
           const next = scheduler.nextFire(job);
@@ -4744,9 +4773,37 @@ function digestRun(messages, maxChars) {
 import { MemFilesystem as MemFilesystem2 } from "@livx.cc/wcli/core";
 init_logging();
 
-// src/voice/emotion.ts
-init_logging();
-var log9 = forComponent("Emotion");
+// node_modules/@bod.ee/voice/src/core/logging.ts
+function consoleForComponent(name) {
+  const debugEnv = typeof process !== "undefined" && process.env?.DEBUG || typeof localStorage !== "undefined" && localStorage.getItem("DEBUG") || "";
+  const gated = debugEnv === "*" || debugEnv.split(",").some((p) => p.trim() === name);
+  const gate = (fn) => gated ? fn : () => {
+  };
+  const tag = `[${name}]`;
+  return {
+    debug: gate((...a) => console.debug(tag, ...a)),
+    verbose: gate((...a) => console.debug(tag, ...a)),
+    info: (...a) => console.info(tag, ...a),
+    warn: (...a) => console.warn(tag, ...a),
+    error: (...a) => console.error(tag, ...a)
+  };
+}
+var backend = consoleForComponent;
+function configureLogging(forComponentImpl) {
+  backend = forComponentImpl;
+}
+function forComponent2(name) {
+  return {
+    debug: (...a) => backend(name).debug(...a),
+    verbose: (...a) => backend(name).verbose(...a),
+    info: (...a) => backend(name).info(...a),
+    warn: (...a) => backend(name).warn(...a),
+    error: (...a) => backend(name).error(...a)
+  };
+}
+
+// node_modules/@bod.ee/voice/src/core/emotion.ts
+var log9 = forComponent2("Emotion");
 var EMOTIONS = [
   // primary (best results)
   "neutral",
@@ -4922,9 +4979,8 @@ var EmotionStream = class {
   }
 };
 
-// src/voice/engine.ts
-init_logging();
-var log10 = forComponent("VoiceEngine");
+// node_modules/@bod.ee/voice/src/core/engine.ts
+var log10 = forComponent2("VoiceEngine");
 var realClock = {
   now: () => performance.now(),
   setTimeout: (fn, ms) => setTimeout(fn, ms),
@@ -5108,6 +5164,13 @@ var VoiceEngine = class _VoiceEngine {
   // the exact ack text last spoken (fixed OR adaptive) — the echo-leak guard matches it
   ackTimer = null;
   // one-shot adaptive-ack timer (armed at dispatch, cancelled on first delta)
+  // The adaptive micro-ack ALREADY spoke this turn → the reflex's own leading ack ("Still on it.") is now
+  // redundant (live: host said "On it." then the reflex said "Still on it."). While this is set, speakDelta
+  // probes the reflex's opening sentence and DROPS it if it's purely an acknowledgement; real content passes
+  // through. Reset per turn in beginSpeech()/interrupt().
+  adaptiveAckFired = false;
+  ackProbe = null;
+  // buffered reflex prose while probing the leading ack (null = not probing)
   bargeGraceUntil = 0;
   // no barge-in until this time — the user's OWN trailing audio (after the
   // utterance that JUST dispatched this turn) must not immediately re-interrupt the reply it requested.
@@ -5250,6 +5313,8 @@ var VoiceEngine = class _VoiceEngine {
     this.speaking = true;
     this.ctxOpen = true;
     this.spokeDeltas = false;
+    this.adaptiveAckFired = false;
+    this.ackProbe = null;
     this.reply = "";
     this.revealText = "";
     this.wordStarts = [];
@@ -5278,6 +5343,8 @@ var VoiceEngine = class _VoiceEngine {
         this.lastAck = phrase;
         for (const w of this.words(phrase)) this.echoWords.add(w);
         this.setState("speaking");
+        this.adaptiveAckFired = true;
+        this.ackProbe = "";
         this.options.onAdaptiveAck();
       }, this.options.adaptiveAckMs);
     }
@@ -5289,6 +5356,25 @@ var VoiceEngine = class _VoiceEngine {
   speakDelta(text) {
     if (this.interrupted) return "";
     this.clearAckTimer("first_delta");
+    if (this.adaptiveAckFired && this.ackProbe !== null) {
+      this.ackProbe += text;
+      const probe = this.ackProbe;
+      const bare = probe.replace(/\[emotion[^\]]*\]/gi, "").replace(/^\s+/, "");
+      const m = bare.match(/^([^.!?…\n]*[.!?…\n])([\s\S]*)$/);
+      if (!m && bare.length < 80) return "";
+      this.ackProbe = null;
+      this.adaptiveAckFired = false;
+      const lead = m ? m[1] : bare;
+      const norm2 = lead.replace(/[^a-z ]/gi, " ").replace(/\s+/g, " ").trim().toLowerCase();
+      if (_VoiceEngine.ACK_LEADING.test(norm2)) {
+        const rest = m ? m[2] : "";
+        this.diag("reflex_ack_suppressed", { lead: lead.trim() });
+        if (!rest.trim()) return "";
+        text = rest;
+      } else {
+        text = probe;
+      }
+    }
     if (!this.speaking || !this.ctxOpen) this.beginSpeech();
     let { speech, display, prose } = this.emo ? this.emo.feed(text) : { speech: text, display: text, prose: text };
     if (this.reply && /[.!?…]$/.test(this.reply) && /^[A-Z]/.test(prose)) {
@@ -5347,6 +5433,14 @@ var VoiceEngine = class _VoiceEngine {
   endSpeech() {
     this.interrupted = false;
     this.clearAckTimer("turn_end");
+    const heldProbe = this.ackProbe;
+    this.adaptiveAckFired = false;
+    this.ackProbe = null;
+    if (heldProbe) {
+      const norm2 = heldProbe.replace(/\[emotion[^\]]*\]/gi, "").replace(/[^a-z ]/gi, " ").replace(/\s+/g, " ").trim().toLowerCase();
+      if (_VoiceEngine.ACK_LEADING.test(norm2)) this.diag("reflex_ack_suppressed", { lead: heldProbe.trim() });
+      else this.speakDelta(heldProbe);
+    }
     if (!this.speaking) return;
     this.diag("tts_turn_end", { spoke: this.spokeDeltas, replyChars: this.reply.length });
     this.ctxOpen = false;
@@ -5428,6 +5522,9 @@ var VoiceEngine = class _VoiceEngine {
    *  No 'Okay.': a genuine user "Okay." within the 6s squash window would be swallowed as ack echo. */
   static ACKS_NEUTRAL = ["Mm-hm.", "One sec.", "Right.", "Sec.", "On it.", "Sure, moment.", "Uh, one moment.", "Let me see."];
   static ACKS_QUESTION = ["Hmm.", "Let me think.", "Hm, let me see.", "Good question.", "Mm, one sec.", "Let's see."];
+  /** A reflex opening sentence that is PURELY an acknowledgement (no content) — dropped when the adaptive
+   *  micro-ack already spoke one. Anchored end-to-end so only a whole ack-only clause matches. */
+  static ACK_LEADING = /^(?:(?:okay|ok|alright|sure|yeah|yep|right|got it|on it|still|still on it|still working on it|working on it|checking|one sec|one moment|mm hm|mmhm|hmm|let me (?:see|check|think))[ ,]*)+$/;
   recentAcks = [];
   pickAck() {
     const pool = this.lastDispatchWasQuestion ? _VoiceEngine.ACKS_QUESTION : _VoiceEngine.ACKS_NEUTRAL;
@@ -5452,6 +5549,8 @@ var VoiceEngine = class _VoiceEngine {
   /** barge-in: stop audio NOW, cancel generation, reset for the user's utterance */
   interrupt() {
     this.clearAckTimer("interrupt");
+    this.adaptiveAckFired = false;
+    this.ackProbe = null;
     if (this.uttQueue.length) log10.info(`barge-in dropped ${this.uttQueue.length} queued worker utterance(s)`);
     const droppedQueued = this.uttQueue.length;
     this.uttQueue = [];
@@ -5912,7 +6011,14 @@ var VoiceEngine = class _VoiceEngine {
   }
 };
 
-// src/voice/spokenSplitter.ts
+// node_modules/@bod.ee/voice/src/core/types.ts
+var STT_SAMPLE_RATE = 16e3;
+var TTS_SAMPLE_RATE = 44100;
+async function resolveAuth(auth) {
+  return typeof auth === "function" ? await auth() : auth;
+}
+
+// node_modules/@bod.ee/voice/src/core/spokenSplitter.ts
 var OPEN = "<spoken>";
 var CLOSE = "</spoken>";
 var CLOSERS = `"')]}\xBB\u201D\u2019`;
@@ -5984,1652 +6090,1647 @@ var SpokenSplitter = class {
   }
 };
 
-// src/duplex.ts
-var log11 = forComponent("DuplexAgent");
-function describeCall(call) {
-  const v = call.args && Object.values(call.args).find((x) => typeof x === "string" && x.trim());
-  const hint = v ? ` (${String(v).replace(/\s+/g, " ").trim().slice(0, 48)})` : "";
-  return `${call.name}${hint}`;
-}
-var DuplexAgentOptions = class {
-  /** Any ai.libx.js AIClient — shared by all tiers (routed by model). */
-  ai;
-  /** The WORKER's filesystem (act + think). If omitted the worker keeps Agent's jailed-disk-at-cwd default. */
-  fs;
-  // The reflex IS the voice. 120b (not 20b) for channel discipline + instruction-following: the 20b
-  // mislabels gpt-oss harmony channels under load, leaking raw analysis into the spoken `final` channel
-  // (and misfiring Hold). 120b is the same price tier (~$0.15/$0.60) — the quality/cost trade is free.
-  reflexModel = "groq/openai/gpt-oss-120b";
-  actModel = "anthropic/claude-sonnet-4-6";
-  /** Premium reasoning model. Set to `false` to disable the Think tier entirely. */
-  thinkModel = "anthropic/claude-opus-4-8";
-  /** Per-worker providerOptions, derived from the worker's actual model at spawn time (IoC — keeps duplex
-   *  provider-agnostic). Workers override the reflex/main model, so provider-specific options (e.g. cursor's
-   *  cwd/cursorSession) must be recomputed for the worker's model, never inherited from the main template —
-   *  leaking cursor options to an anthropic worker is a hard 400. Returns undefined → no providerOptions. */
-  providerOptionsFor;
-  /** Escape hatches merged over the derived per-agent options. */
-  reflexOptions;
-  actOptions;
-  thinkOptions;
-  /** Fresh-context check on each successful Act task: a NEW agent (no self-confirmation bias) re-reads
-   *  the file state against the brief and fixes any gap before the result is re-voiced. Bounded to one
-   *  pass; ~2x Act cost so default OFF. The self-verify FOOTER (same context) was measured ineffective —
-   *  this is the structural fix (see mind/10). Think tasks are pure reasoning, never checked. */
-  verifyActTasks = false;
-  /** Receives the voice text_delta stream + task lifecycle events. */
-  host;
-  /** How many recent transcript messages are rendered into a worker's brief. */
-  excerptTurns = 6;
-  /** Voice register: 'neutral' = clean spoken style; 'conversational' = human-like — fillers,
-   *  backchannels, impulsive first reactions before content (mimics real duplex conversation). */
-  voiceStyle = "neutral";
-  /** Teach the model to emit inline `[emotion]` tags for Cartesia emotion control. Only set when the
-   *  TTS actually speaks them — text-duplex (no TTS) would otherwise print literal tags. */
-  emotionTags = false;
-  /** Awaited BEFORE a worker spawns — open a per-task checkpoint frame, audit, etc.
-   *  (post-spawn would race the worker's first edits). */
-  onTaskStart;
-  /** Re-voice throttled worker progress asides ('[task t1 progress] …') so long tasks aren't dead
-   *  air. Off by default — each update costs a voice turn (LLM call + speech). */
-  progressUpdates = false;
-  /** Min ms between progress re-voices per task. */
-  progressIntervalMs = 25e3;
-  /** Relay worker questions (AskUserQuestion + permission asks via parkQuestion) through the VOICE:
-   *  the question re-voices as '[task <id> asks] …', the user answers conversationally, and the
-   *  voice model resolves it with the AnswerTask tool. Off → host.ask passthrough (text menus). */
-  askRelay = false;
-  /** Parked questions auto-resolve empty after this long (callers map '' to deny/best-judgment). */
-  askTimeoutMs = 12e4;
-  /** Max retained task records: oldest SETTLED tasks (and their activity tails) are evicted past this,
-   *  bounding memory over a long-lived session. Running tasks are never evicted. */
-  maxTaskRecords = 50;
-  /** Host overrides for QuickLook lookups (keyed by `what`). The engine's defaults go through the
-   *  (possibly jailed) fs — e.g. `.git/**` is deny-listed, so the CLI supplies 'branch' itself. */
-  quickLook;
-  /** Memory directory/directories on the WORKER fs. If set, the voice agent gets Remember + Recall
-   *  tools directly (no delegation needed) and implicit capture guidance. */
-  memoryDir;
-  /** User-scope memory dir for global facts (type=user/feedback). Forwarded to Remember's routing. */
-  memoryUserDir;
+// node_modules/@bod.ee/voice/src/adapters/soniox.ts
+var log11 = forComponent2("SonioxSTT");
+var now = () => performance.now();
+var SonioxSTTOptions = class {
+  auth = "";
+  source;
+  model = "stt-rt-preview";
+  languageHints = ["en"];
+  /** Client-side endpoint: finalized text + no new tokens for this long = utterance (don't wait for
+   *  Soniox's semantic <end>, which adds 0.5-1.5s — the difference between ping-pong and lag). */
+  silenceEndpointMs = 500;
+  /** No-audio watchdog: if the mic source stops delivering chunks for this long, capture is dead →
+   *  fire onFatal + stop (else Soniox idle-timeouts and reconnect-loops forever). 0 = disable. */
+  noAudioTimeoutMs = 1e4;
 };
-var RESERVED_EVENT_MARKER = /\[task\b[^\]\n]*\b(?:completed|failed|progress|asks)\b/i;
-var RESERVED_EVENT_OPENER = /\[\s*task\b/i;
-var STAGE_DIRECTION_RE = /^\(\s*(?:(?:waiting|checking|searching|thinking|processing|loading|working|fetching|looking)\b[^)]*|[^)]*(?:\.\.\.|…)\s*)\)$/i;
-function nowLine() {
-  return `Current date and time: ${(/* @__PURE__ */ new Date()).toLocaleString("en-US", { weekday: "long", year: "numeric", month: "long", day: "numeric", hour: "numeric", minute: "2-digit", timeZoneName: "short" })}`;
-}
-function isTrivialBarge(text) {
-  const t = text.trim().toLowerCase().replace(/[.,!?…\s]+$/g, "").replace(/^[.,!?…\s]+/, "");
-  if (!t) return false;
-  if (/\b(stop|cancel|no|nope|nah|never\s?mind|nvm|forget it|drop it|don'?t|quiet|shut up|enough|hold on|wait|pause|hang on|actually)\b/.test(t)) return false;
-  const core = t.replace(/^(?:oh|um+|uh+|er+|hmm+|ah+|well|so|okay|ok|yeah|yep)[\s,]+/, "").trim();
-  return /^(?:oh|um+|uh+|er+|hmm+|ah+|sorry|oops|whoops|my bad|pardon|excuse me|apologies|go on|go ahead|continue|keep going|carry on|as you were|please continue|you were saying|sorry go on|sorry continue|go on then|go on please)$/.test(core || t);
-}
-var VOICE_SYSTEM_PROMPT = 'You are a spoken voice assistant \u2014 the user HEARS everything you say. Use short sentences. One idea per sentence. No markdown, no bullet lists, no code blocks, no headings, no emoji. Never emit stage directions or parenthetical asides about your own process \u2014 nothing like "(waiting for the result...)" or "(checking)"; while work runs, either say it as plain speech or end your turn.\nThis holds even when asked to "print", "list", "show", or "make a table" \u2014 there is no screen for the spoken channel. Speak it as flowing prose ("Tuesday is half a meter, Wednesday a bit less\u2026"), or if they truly need it on screen, route it to Act to render. Never emit dashes or pipes into speech.\nKeep turns SHORT \u2014 one to three sentences, then stop. Never lecture, enumerate cases, or add caveats unprompted. Conversation is a fast exchange: give the one thing asked, and let the user pull more if they want it.\nYou have three cognitive tiers \u2014 like a human brain:\n\u2022 YOU (reflex) \u2014 instant, lightweight. Handle greetings, simple questions, status checks, QuickLook.\n\u2022 `Act` \u2014 your hands. A background worker with its own configured tools and access to the user\'s environment (files and shell{{WORKER_WEB}}). Use for reading, editing, searching, running tasks, building \u2014 any real work.\n{{THINK_SLOT}}\nWhen you are unsure whether you can do or access something, do NOT assume and do NOT claim a capability you have not confirmed. To check what you can do, QuickLook `capabilities` (instant \u2014 it lists your worker\'s real tools) and answer from that. Never promise an ability that is not in your capabilities; if it is not there, tell the user plainly you can\'t. To actually DO real work, call `Act`. When the user mentions their project, folder, files, or environment ("this project", "the current folder", "my code"), call `Act` IMMEDIATELY \u2014 do not ask for paths or details the worker can discover itself. Never pretend to have done the work or invent results \u2014 the worker\'s report is your only source.\nYou cannot mute the microphone or stop voice capture yourself \u2014 no tool does it. If the user asks you to stop listening or turn the voice off, never claim you did: tell them to say exactly "voice off" (handled by the app directly), or type /voice.\nYou are NOT a knowledge base. For any question whose answer needs SPECIFIC verifiable facts you do not already have in hand \u2014 how to build/configure/implement something, exact API, library, entitlement, command or option names, current events, or particular numbers, dates, or names \u2014 do NOT answer from your own memory: you will confidently make things up (a fake API, a wrong entitlement, an event that did not happen). Route it to `Act`, which can search and verify, and speak only what its report says. DELEGATION RULE \u2014 decide for yourself, the user never has to push: if you cannot answer confidently from the conversation plus trivial well-known knowledge, do NOT refuse and do NOT guess \u2014 dispatch `Act` immediately with a clear brief and say you are checking. Anything needing CURRENT data (weather, news, prices, dates, sky/astronomy, "right now"), real computation, or verification is an automatic dispatch \u2014 never a refusal. The user should never need to say "search the web" or "think harder" to make you act; needing fresh or verified information IS the trigger. Refuse only what your worker genuinely cannot do (check `capabilities`), and say why. Answer inline ONLY for general conversation, chit-chat, and trivia you are sure of, or facts you can see via QuickLook. When elaborating on a completed task ("tell me more", "the gist"), stay strictly within what that result actually said \u2014 if the user asks for something the result did not cover, that is NEW information: dispatch `Act`, do not improvise.\nALWAYS react before you work: the FIRST thing in your turn is a brief spoken acknowledgement of what you heard and what you are about to do ("got it \u2014 opening that now", "sure, let me pull it up", "okay, checking"). NEVER call a tool (Act, Think, QuickLook) silently \u2014 the user must hear you react before you go quiet to work. After dispatching Act or Think, that same one short sentence IS your turn \u2014 end it and do not wait for the result. Exactly ONE short line: never stack a second acknowledgement, and never narrate your own presence or status while waiting ("I\'m here", "let me see", "still checking" right after you already acked). One clean ack then silence reads as competent; repeated check-ins read as nervous.\nA completed task speaks its OWN result to the user (the worker voices what matters as it finishes) \u2014 you do NOT re-voice clean task results. A FAILED or INCOMPLETE task still arrives as a "[task t1 failed] \u2026" event for you to handle. The completed result stays in YOUR context \u2014 it is yours to draw on. When the user follows up ("tell me more", "what else", "and?"), answer FROM that result first: you already have the detail, so elaborate on what you have. Do NOT spawn a fresh worker to re-search or re-gather what you were just handed. Re-dispatch ONLY when genuinely new information is needed \u2014 e.g. the user wants the full contents of a SPECIFIC source, which is one WebFetch of that URL, not a brand-new search. "[task t1 progress] \u2026" events are interim status, NOT results \u2014 on a genuinely LONG wait you MAY give one brief half-sentence aside, but only occasionally; silence while working is normal and fine (the user knows you are on it). Do NOT narrate every step or re-announce yourself. Never present progress as a finished result.\nCRITICAL: while a task is still running you have NO answer yet \u2014 never state a specific result of any kind (a number, size, count, name, path, or value). The real answer arrives ONLY in the "[task \u2026 completed]" event; inventing one meanwhile (a made-up disk size, commit count, etc.) is a serious error. Until then, only acknowledge and wait.\nNever read raw file paths, diffs, or code aloud verbatim.\nDo NOT end every turn with the same canned offer ("want a rundown?", "want the steps?"). Offer once at most; if the user pushes back, repeats themselves, or sounds unsatisfied ("you know what I mean?", "think deeper", "are you sure?"), do NOT re-offer the same thing \u2014 change approach: dispatch `Act`/`Think` to actually dig in, or ask one concrete clarifying question. Repeating a non-answer is worse than silence.\n"[task t1 asks] \u2026" events are QUESTIONS from a background task \u2014 relay to the user in your own words, short, then end your turn. When the user answers, call `AnswerTask` with that id and their answer. NEVER answer on the user\'s behalf for permissions or risky operations; if their reply is ambiguous, confirm first.\nIf the user\'s message sounds INCOMPLETE \u2014 trailing off mid-sentence, a fragment that needs more context ("and then we", "but the problem is"), hesitation fillers ("uh", "um") \u2014 call `Hold` instead of answering. This keeps listening for the rest of their thought. Only respond with substance when you have a complete question or request.\nDispatch discipline: send ONE self-contained task per request \u2014 a single worker with the full brief beats several workers with fragments (each worker starts fresh and re-discovers context). NEVER dispatch a worker just to read files or gather information \u2014 workers explore and discover context themselves; pass on what you already know and let one worker do the whole job. Split into parallel tasks only when the user asks for genuinely independent things. When a task completes, report its result and stop \u2014 do NOT dispatch follow-up work (verification, polish, extras) the user did not ask for, unless the report itself signals failure or doubt.\nDo not fire a second Act/Think for work already in flight, and NEVER spawn a second task to re-count, cross-check, or verify a result a worker already gave you \u2014 trust its answer; a single question gets ONE task. Call `TaskStatus` at most ONCE per turn; if a task is still running, just say "still on it" and end the turn \u2014 never poll it again and again in a loop. Use `CancelTask` when the user asks to stop something.\nPRIORITY: when the user says goodbye or wants to end/finish/wrap up the session ("ok bye", "that\'s all", "let\'s finish", "let\'s end", "goodnight", "exit", "wrap up"), call `ExitSession` IMMEDIATELY \u2014 do not act, do not check status, just exit.\nFor TRIVIAL instant lookups only \u2014 current time, git branch, listing a folder, peeking at a small file, or checking your own `capabilities`/tools \u2014 use `QuickLook` (instant, no task). Whenever the user asks what you can do or whether you have some ability, QuickLook `capabilities` and answer from that \u2014 never guess. Anything requiring searching, reasoning, running commands, or editing goes through `Act`.\n{{MEMORY_SLOT}}\nUser messages may arrive via speech-to-text and can carry transcription artifacts \u2014 odd words, cut-offs, homophones ("for you" vs "folder"). Read for INTENT, not surface text. If a message seems garbled, surprising, or only half-parses, do NOT guess an action or improvise content from it \u2014 briefly confirm what they meant ("did you mean\u2026?") and wait. A one-line confirm beats a confident wrong answer or an invented response to a request you did not actually understand.';
-var THINK_GUIDANCE = "\u2022 `Think` \u2014 your brain. A premium reasoning model, FAR more expensive than Act. Reserve it for open-ended architecture/design questions, or a problem Act already FAILED at. ALL implementation work \u2014 coding, refactoring, debugging, edge cases, tests \u2014 goes to Act; Act is highly capable. Never send the same work to both.";
-var THINK_DISABLED_GUIDANCE = "(Think tier is not available \u2014 use Act for all escalations.)";
-var VOICE_STYLE_CONVERSATIONAL = `Speak like a person in a live conversation, not an assistant reading a script. React first, then deliver: a quick impulsive beat ("oh nice", "hmm, hold on", "ah, got it") before the substance. Use contractions always. Vary sentence length \u2014 some very short. Light fillers and backchannels are fine ("mm-hm", "right", "let's see") but at most one per reply \u2014 never stack them. When you escalate to Act or Think, say it like a human would ("hang on, let me actually dig into that \u2014 gimme a minute") instead of announcing a task. When a result comes back, react to it like you just found out ("okay so \u2014 turns out\u2026"). Match the user's energy: a quick question gets a quick answer \u2014 a few words is a perfectly good turn. Prefer a short answer plus an offer ("want the details?") over covering everything. Never narrate your own mechanics (no "I will now act", no task ids out loud).`;
-var EMOTION_TAGS_GUIDANCE = `EMOTION: your voice is synthesized with emotion control. Prefix a sentence with an inline [emotion] tag, placed directly before the sentence it colors, to shape how it is spoken. Use it ONLY when the emotion genuinely fits the words (it amplifies real feeling, it cannot fake it) \u2014 do not tag every sentence; reserve it for moments that carry feeling, and vary which one you use. You may also drop [laughter] for a natural laugh. Available emotions: ${EMOTIONS.join(", ")}.`;
-var DuplexAgent = class _DuplexAgent {
+var SonioxSTT = class {
   options;
-  voice;
-  tasks = /* @__PURE__ */ new Map();
-  queue = Promise.resolve();
-  seq = 0;
-  pendingEvents = [];
-  /** Spoken text of parked deliveries that have SETTLED, awaiting a trivial-barge resume decision on the
-   *  next turn (a substantive turn clears it — the result stays in the transcript, recoverable by asking). */
-  parkedRedeliver = [];
-  /** A trivial barge arrived while a parked delivery was STILL RUNNING → resume it the moment it settles. */
-  awaitTrivialRedeliver = false;
-  /** Set by a SUBSTANTIVE turn after a barge: the user moved on, so a parked delivery that settles LATER
-   *  must NOT arm a resume (else a much-later "go on" replays a stale result). Reset by a fresh barge. */
-  suppressParkedResume = false;
-  /** Out-of-band follow-up attribution for the events coalescing into the next flush turn: TRUE iff ≥1 of
-   *  the tasks being integrated was NON-CLEAN (early-stop/failure). Carried out-of-band on the enqueue call
-   *  by the caller that KNOWS the outcome — a plain boolean the MODEL CANNOT PERTURB. It is NOT scanned from
-   *  worker-authored event text (v1: an "Outcome:" substring over-stamped siblings) and NOT keyed on a brief
-   *  string the reflex re-authors (v2: a paraphrased escalation brief missed the Set → followUp:false →
-   *  RE-ENABLED unbounded auto-escalation, the dangerous runaway direction). See [[wrong-discriminator]] /
-   *  [[drive-real-reflex]] / [[fakeaiclient-blind-to-wire-format]]. */
-  pendingNonClean = false;
-  flushQueued = false;
-  /** Per-voice-turn guards (reset by resetTurn at each turn's start). The reflex is a weak model:
-   *  left unguarded it polls TaskStatus after a dispatch and/or dispatches silently (dead air).
-   *  Like CC's Task tool, a dispatch is "said my piece, now wait for the push" — these enforce that. */
-  turnDispatched = false;
-  // an Act/Think fired this turn
-  spokeBeforeDispatch = false;
-  // the reflex ALREADY acked before dispatching — the forced post-dispatch text step must stay silent (live: "Got it…" twice)
-  turnBriefs = /* @__PURE__ */ new Set();
-  // briefs dispatched this turn (detect identical re-dispatch)
-  spokeThisTurn = false;
-  // any non-empty text_delta streamed this turn
-  externalSpeech = false;
-  // host spoke on our behalf (adaptive micro-ack) — not reflex output
-  heldThisTurn = false;
-  // Hold called this turn → turn is INTENTIONALLY silent (suppress reflex text + no dead-air ack)
-  nudging = false;
-  // re-ack pass in flight: block ALL tools, prevent recursion
-  reflexBuf = "";
-  // accumulated reflex text this turn (fabricated-event detection)
-  reflexForwarded = 0;
-  // chars of reflexBuf already forwarded to the host/TTS
-  fabricationCut = false;
-  // reflex emitted a reserved [task …] marker → suppress its tail
-  /** TRUE for the duration of a re-voice turn that is integrating ≥1 NON-CLEAN task (turn-eligibility,
-   *  carried out-of-band — NOT derived from any worker/brief string). ANY Act/Think dispatched in such a
-   *  turn is stamped followUp:true. This GUARANTEES the dangerous direction is impossible: a genuine
-   *  escalation (even one with a paraphrased brief) ALWAYS lands in a non-clean integration turn, so it is
-   *  ALWAYS recognized as a follow-up and CANNOT re-escalate (one hop). The single-dispatch-per-turn guard
-   *  means at most one dispatch happens per flush, so realistically "the one dispatch IS the escalation".
-   *  ACCEPTED SAFE-DIRECTION ERROR: if the reflex instead dispatches FRESH unrelated work during a non-clean
-   *  flush (rare — and only possible when it batches multiple calls in one step, bypassing the guard), that
-   *  fresh task is over-stamped followUp:true and forgoes ONE future auto-escalation. That is SAFE (it only
-   *  ever REMOVES a future escalation, never adds one — no runaway) and is the correct side to err on. */
-  turnFollowUp = false;
-  /** Hard absolute backstop against runaway regardless of attribution: total automatic escalations across
-   *  the whole conversation. Once it hits MAX_AUTO_ESCALATIONS, no integration turn offers escalate/re-delegate. */
-  autoEscalations = 0;
-  static MAX_AUTO_ESCALATIONS = 8;
-  /** Parked worker questions awaiting a (voice-relayed) user answer, keyed by ask id. */
-  pendingAsks = /* @__PURE__ */ new Map();
-  /** SPECULATIVE REFLEX (VoiceEngine.onSpeculate → speculate()): the reflex turn starts on a stable
-   *  PARTIAL transcript, its spoken output buffered — nothing reaches TTS until the endpointed final
-   *  confirms via send() (which flushes the buffer and adopts the call as THE turn). A divergent final
-   *  aborts it: output dropped, history rolled back, the final dispatches normally. */
-  spec;
-  /** Aborted speculative calls (double-billing visibility — each one paid for tokens never spoken). */
-  speculativeAbortedCalls = 0;
-  /** Tools the reflex may execute on UNCONFIRMED (speculated) input — read-only lookups and the
-   *  intentionally-silent Hold. Anything else (Act/Think/AnswerTask/CancelTask/ExitSession/memory
-   *  writes/…) is a side effect on input the user may not have said: the guard ABORTS the speculation
-   *  instead (the endpointed final then dispatches normally and may use the tool for real). */
-  static SPEC_SAFE_TOOLS = /* @__PURE__ */ new Set(["QuickLook", "TaskStatus", "Hold"]);
-  /** Lazily resolved memory tools (async loadMemory runs in initMemory). */
-  memoryReady;
-  constructor(options) {
-    this.options = { ...new DuplexAgentOptions(), ...options };
-    const o = this.options;
-    if (o.memoryDir && o.fs) {
-      this.memoryReady = loadMemory(o.fs, o.memoryDir, { maxWritesPerSession: 10, userDir: o.memoryUserDir });
+  ws;
+  stopped = false;
+  sourceStarted = false;
+  onPartial = () => {
+  };
+  onUtterance = () => {
+  };
+  /** mic energy (RMS) per chunk — drives the energy-based heuristic barge-in tier */
+  onLevel = () => {
+  };
+  /** Unrecoverable: the mic source stopped delivering audio (Soniox starves → idle-timeout reconnect
+   *  loop). The host tears voice down instead of spinning forever. */
+  onFatal = () => {
+  };
+  /** Diagnostic tap (provider errors, ws reconnects, no-audio watchdog). Fire-and-forget: a throwing
+   *  handler disables itself — never affects transcription. Wired by VoiceIO / the lab bridge. */
+  onDiag = () => {
+  };
+  diagOn = true;
+  diag(kind, fields) {
+    if (!this.diagOn) return;
+    try {
+      this.onDiag({ t: now(), kind, ...fields });
+    } catch (e) {
+      this.diagOn = false;
+      log11.debug(`onDiag threw \u2014 STT diagnostics disabled: ${e instanceof Error ? e.message : e}`);
     }
-    const memSlot = o.memoryDir && o.fs ? VOICE_MEMORY_PROMPT : "NEVER claim to have stored, saved, or remembered something durably \u2014 you cannot. Anything the user wants persisted (their name, preferences, notes) must go through Act so a worker writes it to memory.";
-    const thinkSlot = o.thinkModel !== false ? THINK_GUIDANCE : THINK_DISABLED_GUIDANCE;
-    const workerToolNames = (o.actOptions?.tools ?? []).map((t) => t.name);
-    const canSearch = workerToolNames.some((n) => /WebSearch/i.test(n));
-    const canFetch = workerToolNames.some((n) => /WebFetch/i.test(n));
-    const workerWeb = canSearch ? `, and it CAN search the web and read web pages \u2014 so when the user gives you something specific to look up ("search for X", "find me\u2026", "what's the latest on\u2026"), route it to Act. But a bare capability QUESTION like "can you search the web?" just gets a short spoken "yes, I can" \u2014 do NOT dispatch and NEVER invent a query the user did not give you` : canFetch ? ", and it can fetch a specific web page URL (but cannot search the web)" : "";
-    const mcpNames = [
-      ...Object.keys(o.actOptions?.providerOptions?.mcpServers ?? {}),
-      ...new Set(workerToolNames.filter((n) => n.startsWith("mcp__")).map((n) => n.slice(5).split("__")[0]))
-    ];
-    const workerMcp = mcpNames.length ? `, and it can use these MCP servers: ${[...new Set(mcpNames)].join(", ")}` + (mcpNames.some((n) => /browser/i.test(n)) ? ' \u2014 including driving a REAL browser (open tabs, navigate, click, screenshot), so answer "yes" if asked whether you can control/drive a browser and route an actual browse to Act' : "") : "";
-    const prompt = VOICE_SYSTEM_PROMPT.replace("{{MEMORY_SLOT}}", memSlot).replace("{{THINK_SLOT}}", thinkSlot).replace("{{WORKER_WEB}}", workerWeb + workerMcp) + (o.voiceStyle === "conversational" ? "\n" + VOICE_STYLE_CONVERSATIONAL : "") + (o.emotionTags ? "\n" + EMOTION_TAGS_GUIDANCE : "") + `
-${nowLine()}. Anchor every relative or time-sensitive reference \u2014 "today", "now", "current", "recent", "latest", "this year" \u2014 to THIS moment. When the user asks about something recent (news, sports, events), they mean near this date, not a well-known past instance; brief your worker with the current year so it searches for what is happening NOW, not a famous older event.`;
-    const tools = [
-      ...o.reflexOptions?.tools ?? [],
-      this.actTool(),
-      ...o.thinkModel !== false ? [this.thinkTool()] : [],
-      this.taskStatusTool(),
-      this.cancelTaskTool(),
-      this.quickLookTool(),
-      this.answerTaskTool(),
-      this.holdTool()
-    ];
-    const host = o.host;
-    const voiceHost = host && {
-      ask: host.ask ? (q) => host.ask(q) : void 0,
-      confirm: host.confirm ? (p, m) => host.confirm(p, m) : void 0,
-      notify: (ev) => {
-        if (ev?.kind === "text_delta" && typeof ev.message === "string") {
-          if (this.heldThisTurn) return;
-          if (this.fabricationCut) return;
-          if (this.turnDispatched && this.spokeBeforeDispatch) return;
-          const msg = ev.message;
-          this.reflexBuf += msg;
-          this.scrubStageDirections();
-          const m = this.reflexBuf.match(RESERVED_EVENT_MARKER) ?? this.reflexBuf.match(RESERVED_EVENT_OPENER);
-          if (m) {
-            this.fabricationCut = true;
-            log11.warn(`reflex fabricated a [task \u2026] event in its spoken stream \u2014 cutting it (kept ${m.index} chars)`);
-            const safe = this.reflexBuf.slice(this.reflexForwarded, m.index);
-            if (!safe) return;
-            if (safe.trim()) this.spokeThisTurn = true;
-            this.emitHost({ ...ev, message: safe });
-            return;
-          }
-          const held = this.reflexBuf.length - this.reflexForwarded;
-          const partial = held > 0 && /\[\s*t?a?s?k?$/i.test(this.reflexBuf.slice(-Math.min(held, 6)));
-          let upto = partial ? this.reflexBuf.length - this.reflexBuf.slice(-6).match(/\[\s*t?a?s?k?$/i)[0].length : this.reflexBuf.length;
-          const paren = this.reflexBuf.lastIndexOf("(");
-          if (paren >= this.reflexForwarded && !this.reflexBuf.includes(")", paren) && this.reflexBuf.length - paren <= 80)
-            upto = Math.min(upto, paren);
-          const out = this.reflexBuf.slice(this.reflexForwarded, upto);
-          this.reflexForwarded = upto;
-          if (!out) return;
-          if (out.trim()) this.spokeThisTurn = true;
-          this.emitHost({ ...ev, message: out });
-          return;
-        }
-        host.notify?.(ev);
-      }
-    };
-    this.voice = new Agent({
-      ai: o.ai,
-      fs: new MemFilesystem2(),
-      model: o.reflexModel,
-      stream: true,
-      host: voiceHost,
-      // The reflex IS the conversational channel — it confirms ambiguity inline ("did you mean…?"),
-      // never via the blocking AskUserQuestion tool (Agent auto-adds it whenever a host is set). Left in,
-      // it stalls a voice turn until the kill-switch. Worker questions still reach the user via parkQuestion.
-      askUserQuestion: false,
-      systemPrompt: prompt,
-      instructionFiles: false,
-      maxSteps: 8,
-      timeoutMs: 3e4,
-      ...o.reflexOptions,
-      tools,
-      // Composed AFTER the spread so the dispatch guard can't be dropped by reflexOptions.
-      hooks: composeHooks(this.dispatchGuard(), o.reflexOptions?.hooks)
-    });
-  }
-  /** Resolve memory tools + inject index into voice system prompt (once). */
-  async initMemory() {
-    if (!this.memoryReady) return;
-    const mem = await this.memoryReady;
-    this.memoryReady = void 0;
-    this.voice.options.tools.push(...mem.tools);
-    if (mem.index) this.voice.options.systemPrompt += "\n\n" + mem.index;
   }
-  /** Flush any held-back trailing fragment (a possible `[task` opener that never completed) once the
-   *  turn's stream is done — so a legit message ending in "[t" isn't silently dropped. */
-  flushHeldReflexTail() {
-    if (this.fabricationCut) return;
-    this.scrubStageDirections();
-    const tail = this.reflexBuf.slice(this.reflexForwarded);
-    this.reflexForwarded = this.reflexBuf.length;
-    if (!tail) return;
-    if (tail.trim()) this.spokeThisTurn = true;
-    this.emitHost({ kind: "text_delta", message: tail });
+  lastChunkAt = 0;
+  // timestamp of the most recent mic chunk (0 = none yet)
+  startedChunksAt = 0;
+  // when capture started (grace before the first chunk)
+  noAudioTimer = null;
+  finalText = "";
+  partialText = "";
+  lastChangeAt = 0;
+  lastCombined = "";
+  endpointTimer = null;
+  firstTokenAt = 0;
+  // first speech token in current utterance
+  constructor(options) {
+    this.options = { ...new SonioxSTTOptions(), ...options };
   }
-  /** Remove complete stage-direction parentheticals from the UNFORWARDED reflex text (STAGE_DIRECTION_RE).
-   *  Only the unforwarded region is touched — already-spoken audio can't be unsent, and splicing before
-   *  reflexForwarded would corrupt the forward offset. */
-  scrubStageDirections() {
-    if (this.reflexForwarded >= this.reflexBuf.length) return;
-    const region = this.reflexBuf.slice(this.reflexForwarded);
-    const scrubbed = region.replace(/\([^()]*\)/g, (s) => STAGE_DIRECTION_RE.test(s) ? "" : s);
-    if (scrubbed !== region) this.reflexBuf = this.reflexBuf.slice(0, this.reflexForwarded) + scrubbed;
+  get usingAec() {
+    return this.options.source?.aec ?? false;
   }
-  /** Clear the per-turn guards. Called at the head of every voice turn (user send + re-voice flush). */
-  resetTurn() {
-    this.turnDispatched = false;
-    this.spokeBeforeDispatch = false;
-    this.turnBriefs.clear();
-    this.spokeThisTurn = false;
-    this.externalSpeech = false;
-    this.heldThisTurn = false;
-    this.reflexBuf = "";
-    this.reflexForwarded = 0;
-    this.fabricationCut = false;
-    this.turnFollowUp = false;
-    this.voice.options.toolChoice = void 0;
+  async connectWs() {
+    const apiKey = await resolveAuth(this.options.auth);
+    this.ws = new WebSocket("wss://stt-rt.soniox.com/transcribe-websocket");
+    await new Promise((res, rej) => {
+      this.ws.onopen = () => res();
+      this.ws.onerror = (e) => rej(new Error(`soniox ws: ${e.message || "connect failed"}`));
+    });
+    this.ws.send(
+      JSON.stringify({
+        api_key: apiKey,
+        model: this.options.model,
+        audio_format: "pcm_s16le",
+        sample_rate: STT_SAMPLE_RATE,
+        num_channels: 1,
+        language_hints: this.options.languageHints,
+        enable_endpoint_detection: true
+      })
+    );
+    this.ws.onmessage = (ev) => this.handle(JSON.parse(String(ev.data)));
+    this.ws.onclose = (ev) => {
+      if (this.stopped) return;
+      log11.warn(`soniox ws closed (${ev.code} ${ev.reason || ""}) \u2014 reconnecting`);
+      this.diag("stt_ws_closed", { code: ev.code, reason: String(ev.reason || ""), reconnecting: true });
+      this.reset();
+      this.connectWs().catch((e) => {
+        log11.error(`soniox reconnect failed: ${e.message}`);
+        this.diag("stt_reconnect_failed", { message: e.message });
+      });
+    };
   }
-  /** preToolUse guard on the reflex: once it has dispatched this turn, a dispatch is "said my piece,
-   *  now wait for the push" (CC's Task model). Block the temptations — TaskStatus polling and identical
-   *  re-dispatch — so the only remaining move is to voice a short ack and end. A genuinely NEW Act is
-   *  still allowed (parallel independent work). During a re-ack pass, block every tool. */
-  dispatchGuard() {
-    return {
-      preToolUse: (call) => {
-        if (this.spec?.state === "pending" && !_DuplexAgent.SPEC_SAFE_TOOLS.has(call.name)) {
-          log11.verbose(`speculation aborted: reflex called ${call.name} on unconfirmed input`);
-          this.abortSpeculation();
-          return { block: true, reason: "Speculative turn aborted." };
+  async start() {
+    await this.connectWs();
+    if (this.sourceStarted) return;
+    this.sourceStarted = true;
+    this.endpointTimer = setInterval(() => {
+      const combined = (this.finalText + this.partialText).trim();
+      if (!combined || now() - this.lastChangeAt < this.options.silenceEndpointMs) return;
+      if (this.firstTokenAt) log11.debug(`stt: ${Math.round(now() - this.firstTokenAt)}ms first-token\u2192silence-endpoint, "${combined.slice(0, 60)}"`);
+      this.reset();
+      this.onUtterance(combined, now());
+    }, 120);
+    this.endpointTimer.unref?.();
+    this.startedChunksAt = now();
+    const noAudioMs = this.options.noAudioTimeoutMs;
+    if (noAudioMs > 0) {
+      this.noAudioTimer = setInterval(() => {
+        if (this.stopped) return;
+        const ref = this.lastChunkAt || this.startedChunksAt;
+        if (now() - ref > noAudioMs) {
+          log11.error(`stt: no mic audio for >${Math.round(noAudioMs / 1e3)}s \u2014 capture device stopped delivering`);
+          this.diag("stt_watchdog_fatal", { noAudioMs });
+          this.onFatal("microphone stopped delivering audio (try a different input device, e.g. AirPods, or check System Settings \u2192 Sound \u2192 Input)");
+          this.stop();
         }
-        if (this.nudging) return { block: true, reason: "Just say one short spoken acknowledgement \u2014 no tools this turn." };
-        if (!this.turnDispatched) return;
-        if (call.name === "TaskStatus")
-          return { block: true, reason: "You just dispatched a task this turn \u2014 do NOT poll. Give one short spoken acknowledgement and end your turn; the result arrives later as a [task \u2026] event." };
-        if ((call.name === "Act" || call.name === "Think") && this.turnBriefs.has(String(call.args?.brief ?? "")))
-          return { block: true, reason: "You already dispatched this exact task \u2014 acknowledge briefly and end your turn." };
+      }, Math.max(250, Math.min(2e3, noAudioMs / 4)));
+      this.noAudioTimer.unref?.();
+    }
+    await this.options.source.start((chunk) => {
+      this.lastChunkAt = now();
+      let sum = 0;
+      const view = new DataView(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+      for (let i = 0; i + 1 < chunk.byteLength; i += 2) {
+        const v = view.getInt16(i, true);
+        sum += v * v;
       }
-    };
-  }
-  /** The host spoke on this turn's behalf OUTSIDE the reflex stream (e.g. the voice engine's adaptive
-   *  micro-ack). For a DISPATCHED turn that's a sufficient ack (don't stack a second one); for an
-   *  inline turn whose reply came back empty it is NOT — "One sec." followed by permanent silence is
-   *  still dead air, so silentTurn ignores external speech unless work was dispatched. */
-  noteExternalSpeech() {
-    this.externalSpeech = true;
-  }
-  /** True when the just-finished turn voiced NOTHING — dead air to repair. Two ways this happens:
-   *  (a) a dispatch with no spoken ack, and (b) an INLINE turn whose `final` channel came back empty —
-   *  gpt-oss harmony sometimes puts the whole reply in `analysis` (→ thinking_delta, suppressed in
-   *  voice) and emits an empty `final`, so no text_delta ever streams. Both ship silence; both repair.
-   *  Requires a host: without one there's no stream to detect speech on (and no one to speak to). */
-  get silentTurn() {
-    const ackedByHost = this.externalSpeech && this.turnDispatched;
-    return !!this.options.host && !this.spokeThisTurn && !ackedByHost && !this.heldThisTurn;
+      this.onLevel(Math.sqrt(sum / (chunk.byteLength / 2)));
+      if (this.ws.readyState === WebSocket.OPEN) this.ws.send(chunk);
+    });
   }
-  /** A turn that voiced nothing is dead air. Re-prompt the reflex ONCE so the LLM itself voices a short
-   *  line (no template). If it STILL says nothing, fall back to a minimal line so silence never ships.
-   *  Wording adapts to whether work was dispatched (an ack) or the inline reply was simply lost. */
-  async ackIfSilent(fallback) {
-    const dispatched = this.turnDispatched;
-    this.nudging = true;
-    try {
-      await this.voice.send(fallback ? "[reminder] You said nothing to the user this turn. Tell them, in ONE short spoken sentence, what just happened \u2014 no tools." : dispatched ? "[reminder] You dispatched a task but said nothing to the user. Say ONE short spoken acknowledgement now \u2014 no tools." : "[reminder] You said nothing to the user this turn. Give your ONE short spoken reply now \u2014 no tools.");
-    } catch (e) {
-      log11.warn(`ack nudge failed: ${e instanceof Error ? e.message : e}`);
-    } finally {
-      this.nudging = false;
+  handle(m) {
+    if (m.error_message) {
+      this.diag("stt_error", { message: String(m.error_message), code: m.error_code });
+      return log11.error(`soniox: ${m.error_message}`);
     }
-    if (!this.spokeThisTurn) {
-      const pool = fallback ? [fallback] : dispatched ? _DuplexAgent.FALLBACK_ACKS : _DuplexAgent.FALLBACK_RETRY;
-      const fresh = pool.filter((p) => p !== this.lastFallback);
-      const line = (fresh.length ? fresh : pool)[Math.floor(Math.random() * (fresh.length || pool.length))];
-      this.lastFallback = line;
-      this.emitHost({ kind: "text_delta", message: line });
+    let endpoint = false;
+    for (const t of m.tokens ?? []) {
+      if (t.text === "<end>") endpoint = true;
+      else if (t.is_final) this.finalText += t.text;
     }
-  }
-  /** Dead-air fallback pools (see ackIfSilent). Both retry lines keep the 'say that again' phrase —
-   *  hosts/tests key on it. */
-  static FALLBACK_ACKS = ["Okay, on it.", "On it.", "Alright, working on it."];
-  static FALLBACK_RETRY = ["Sorry, could you say that again?", "Hm, I missed that \u2014 could you say that again?"];
-  lastFallback = "";
-  /** One user turn: the voice agent streams the reply (and may Act/Think). Serialized with re-voice turns.
-   *  If a speculative reflex call is pending and this content CONFIRMS it (the final matches the
-   *  speculated partial), the in-flight call is adopted as THE turn: its buffered output flushes to the
-   *  host NOW (this is the latency win) and streaming continues live. Any other content aborts the
-   *  speculation first (rolled back silently) and runs a normal turn behind it. */
-  send(content) {
-    if (typeof content === "string" && isTrivialBarge(content) && this.hasParkedDelivery()) {
-      if (this.spec) this.abortSpeculation();
-      return this.enqueue(async () => {
-        this.resetTurn();
-        if (!this.redeliverParked()) this.awaitTrivialRedeliver = true;
-        return { text: "", steps: 0, finishReason: "stop", messages: [] };
-      });
+    this.partialText = (m.tokens ?? []).filter((t) => !t.is_final && t.text !== "<end>").map((t) => t.text).join("");
+    const combined = this.finalText + this.partialText;
+    if (combined !== this.lastCombined) {
+      this.lastCombined = combined;
+      this.lastChangeAt = now();
+      if (!this.firstTokenAt && combined.trim()) this.firstTokenAt = now();
     }
-    const spec = this.spec;
-    if (spec?.state === "pending") {
-      if (typeof content === "string" && speculationConfirms(spec.text, content)) {
-        spec.state = "confirmed";
-        spec.finalText = content;
-        for (const ev of spec.buf.splice(0)) this.options.host?.notify?.(ev);
-        spec.decide("confirm");
-        this.notify("diag", "speculation_confirmed", { text: spec.text.slice(0, 80) });
-        return spec.done;
-      }
-      this.abortSpeculation();
+    this.onPartial(combined);
+    if (endpoint && this.finalText.trim()) {
+      const utterance = this.finalText.trim();
+      if (this.firstTokenAt) log11.debug(`stt: ${Math.round(now() - this.firstTokenAt)}ms first-token\u2192endpoint, "${utterance.slice(0, 60)}"`);
+      this.reset();
+      this.onUtterance(utterance, now());
     }
-    return this.enqueue(async () => {
-      await this.initMemory();
-      this.resetTurn();
-      this.awaitTrivialRedeliver = false;
-      this.parkedRedeliver = [];
-      this.suppressParkedResume = true;
-      const res = await this.voice.send(content);
-      this.flushHeldReflexTail();
-      if (this.silentTurn) await this.ackIfSilent();
-      return res;
-    });
-  }
-  /** Start a HELD speculative reflex turn on a stable partial (VoiceEngine.onSpeculate). Its spoken
-   *  output buffers in emitHost; send() later confirms (flush + adopt) or aborts it. The turn holds the
-   *  voice mutex until that decision (bounded by a safety timeout), so no other turn can interleave
-   *  into the transcript between the speculative messages and their rollback. No-op if a speculation
-   *  is already in flight. */
-  speculate(text) {
-    if (!text.trim() || this.spec) return;
-    let decide;
-    const decision = new Promise((r) => {
-      decide = r;
-    });
-    const spec = {
-      text,
-      state: "pending",
-      buf: [],
-      ctl: new AbortController(),
-      decide,
-      decision,
-      done: void 0
-    };
-    this.spec = spec;
-    spec.done = this.enqueue(async () => {
-      const empty = { text: "", steps: 0, finishReason: "aborted", messages: this.voice.transcript };
-      if (spec.state === "aborted") {
-        this.speculativeAbortedCalls++;
-        if (this.spec === spec) this.spec = void 0;
-        return empty;
-      }
-      await this.initMemory();
-      this.resetTurn();
-      const base = this.voice.transcript.length;
-      const prevSignal = this.voice.options.signal;
-      this.voice.options.signal = spec.ctl.signal;
-      let res;
-      try {
-        res = await this.voice.send(spec.text);
-      } catch (e) {
-        log11.warn(`speculative turn failed: ${e instanceof Error ? e.message : e}`);
-      } finally {
-        this.voice.options.signal = prevSignal;
-      }
-      const timer = setTimeout(() => {
-        spec.state = spec.state === "pending" ? "aborted" : spec.state;
-        spec.decide("abort");
-      }, 1e4);
-      timer.unref?.();
-      const d = await spec.decision;
-      clearTimeout(timer);
-      if (d === "abort") {
-        if (this.voice.transcript.length > base) this.voice.transcript.length = base;
-        this.speculativeAbortedCalls++;
-        log11.verbose(`speculation aborted (${this.speculativeAbortedCalls} total): "${spec.text.slice(0, 50)}"`);
-        if (this.spec === spec) this.spec = void 0;
-        return res ?? empty;
-      }
-      for (let i = base; i < this.voice.transcript.length; i++) {
-        const m = this.voice.transcript[i];
-        if (m.role === "user" && contentText(m.content) === spec.text) {
-          m.content = spec.finalText;
-          break;
-        }
-      }
-      this.spec = void 0;
-      this.flushHeldReflexTail();
-      if (this.silentTurn) await this.ackIfSilent();
-      return res ?? empty;
-    });
-  }
-  /** Abort a pending speculation (idempotent): kill the in-flight call, drop its buffered output.
-   *  Called on divergence (send), a stale partial (VoiceEngine.onSpeculateAbort), a side-effect tool
-   *  attempt (dispatchGuard), or host paths that will never dispatch a final (commands, voice-off). */
-  abortSpeculation() {
-    const spec = this.spec;
-    if (spec?.state !== "pending") return;
-    spec.state = "aborted";
-    spec.buf.length = 0;
-    spec.ctl.abort();
-    spec.decide("abort");
-    this.notify("diag", "speculation_aborted", { text: spec.text.slice(0, 80) });
-  }
-  /** Cancel a running background task — shared by the CancelTask tool and the CLI /tasks picker. */
-  cancelTask(id) {
-    const rec = this.tasks.get(id);
-    if (!rec) return `No task '${id}'.`;
-    if (rec.status !== "running") return `Task ${rec.id} is already ${rec.status}.`;
-    rec.status = "cancelled";
-    rec.controller.abort();
-    return `Task ${rec.id} (${rec.label}) cancelled.`;
-  }
-  /** Barge-in: the user took the floor while task(s) were running. Suppress those tasks' remaining SPOKEN
-   *  delivery so a superseded topic never talks over the new one (the debt-after-jokes regression). The
-   *  tasks keep running and still fold their result into the transcript — recoverable, just not spoken.
-   *  Returns the parked ids (for logging). Does NOT cancel: that's a deliberate reflex/user action. */
-  parkInFlightDeliveries() {
-    this.suppressParkedResume = false;
-    const parked = [];
-    for (const rec of this.tasks.values())
-      if (rec.status === "running" && !rec.deliveryParked) {
-        rec.deliveryParked = true;
-        parked.push(rec.id);
-      }
-    return parked;
   }
-  /** True while there is a parked delivery to potentially resume: either one already settled (queued) or
-   *  one still running that was parked by a barge. */
-  hasParkedDelivery() {
-    return this.parkedRedeliver.length > 0 || [...this.tasks.values()].some((t) => t.status === "running" && t.deliveryParked);
+  reset() {
+    this.finalText = "";
+    this.partialText = "";
+    this.lastCombined = "";
+    this.firstTokenAt = 0;
   }
-  /** Speak any settled-and-queued parked delivery now (trivial-barge resume). Returns false if nothing was
-   *  queued yet (the caller then arms awaitTrivialRedeliver so the task resumes the instant it settles). */
-  redeliverParked() {
-    if (!this.parkedRedeliver.length) return false;
-    const text = this.parkedRedeliver.splice(0).join(" ").trim();
-    if (text) {
-      this.options.host?.notify?.({ kind: "speak_utterance", message: text });
-      this.notify("diag", "parked_redelivered", { chars: text.length });
-    }
-    return true;
+  stop() {
+    this.stopped = true;
+    if (this.endpointTimer) clearInterval(this.endpointTimer);
+    if (this.noAudioTimer) clearInterval(this.noAudioTimer);
+    this.options.source?.stop();
+    if (this.ws) this.ws.onclose = null;
+    this.ws?.close();
   }
-  /** Resolve when all queued voice turns AND all in-flight worker tasks have settled (tests, graceful shutdown). */
-  async idle() {
-    while (true) {
-      const q = this.queue;
-      await q.catch(() => {
-      });
-      await Promise.all([...this.tasks.values()].map((t) => t.promise));
-      if (this.queue === q && ![...this.tasks.values()].some((t) => t.status === "running")) return;
+};
+
+// node_modules/@bod.ee/voice/src/adapters/cartesia.ts
+var log12 = forComponent2("CartesiaTTS");
+var now2 = () => performance.now();
+var CartesiaTTSOptions = class {
+  auth = "";
+  voiceId = "";
+  model = "sonic-3.5";
+  /** 'apiKey' (server/CLI) → `api_key=` URL param; 'token' (browser, BE-minted) → `access_token=`. */
+  authMode = "apiKey";
+};
+var CartesiaTTS = class _CartesiaTTS {
+  options;
+  ws;
+  ctxSeq = 0;
+  ctxId = "";
+  onAudio = () => {
+  };
+  onDone = () => {
+  };
+  /** Word-level timestamps for karaoke reveal: `start[i]` = seconds from turn-audio start (absolute
+   *  across continuation chunks). Fired only when a consumer opts into reveal (see `wantTimestamps`). */
+  onTimestamps = () => {
+  };
+  /** Request `add_timestamps` from Cartesia. Off by default (saves bandwidth) — the engine sets it
+   *  when revealMode==='word'. */
+  wantTimestamps = false;
+  /** Diagnostic tap (provider errors, circuit-breaker open/close, ws reconnects). Fire-and-forget:
+   *  a throwing handler disables itself — never affects synthesis. Wired by VoiceIO / the lab bridge. */
+  onDiag = () => {
+  };
+  diagOn = true;
+  diag(kind, fields) {
+    if (!this.diagOn) return;
+    try {
+      this.onDiag({ t: now2(), kind, ...fields });
+    } catch (e) {
+      this.diagOn = false;
+      log12.debug(`onDiag threw \u2014 TTS diagnostics disabled: ${e instanceof Error ? e.message : e}`);
     }
   }
-  /** Promise-chain mutex: turns run strictly one at a time; a failed turn doesn't poison the chain. */
-  enqueue(fn) {
-    const run = this.queue.then(fn, fn);
-    this.queue = run.then(() => {
-    }, () => {
-    });
-    return run;
+  firstAudioAt = 0;
+  /** Circuit breaker: consecutive error count + down flag. */
+  consecutiveErrors = 0;
+  consecutiveOk = 0;
+  down = false;
+  downAt = 0;
+  probeTimer = null;
+  static CB_THRESHOLD = 3;
+  // open after 3 consecutive errors
+  static CB_RECOVER_OK = 2;
+  // close only after 2 consecutive good frames (no single-frame flap)
+  static CB_PROBE_MS = 3e4;
+  constructor(options) {
+    this.options = { ...new CartesiaTTSOptions(), ...options };
   }
-  notify(kind, message, data) {
-    this.emitHost({ kind, message, data });
+  closed = false;
+  connecting = null;
+  async connect() {
+    this.closed = false;
+    this.connecting = this.doConnect();
+    await this.connecting;
+    this.connecting = null;
   }
-  /** Host-boundary emit for the reflex's spoken channel: during a PENDING speculation, text_delta and
-   *  hold_filler are BUFFERED (nothing may reach TTS on unconfirmed input); confirm flushes them in
-   *  order, abort drops them silently. Everything else (task_* lifecycle, worker speak_utterance —
-   *  which bypasses this via host.notify directly) passes through untouched. */
-  emitHost(ev) {
-    const spec = this.spec;
-    if (spec && (ev.kind === "text_delta" || ev.kind === "hold_filler")) {
-      if (spec.state === "pending") {
-        spec.buf.push(ev);
-        return;
+  async doConnect() {
+    const key = await resolveAuth(this.options.auth);
+    const param = this.options.authMode === "token" ? "access_token" : "api_key";
+    this.ws = new WebSocket(`wss://api.cartesia.ai/tts/websocket?cartesia_version=2026-03-01&${param}=${key}`);
+    await new Promise((res, rej) => {
+      this.ws.onopen = () => res();
+      this.ws.onerror = (e) => rej(new Error(`cartesia ws: ${e.message || "connect failed"}`));
+    });
+    this.ws.onclose = (ev) => {
+      log12.warn(`cartesia ws closed (${ev.code} ${ev.reason || ""})`);
+      this.diag("tts_ws_closed", { code: ev.code, reason: String(ev.reason || ""), reconnecting: !this.closed });
+      if (!this.closed) {
+        this.connecting = this.doConnect().catch((e) => {
+          log12.error(`cartesia reconnect failed: ${e.message}`);
+          this.diag("tts_reconnect_failed", { message: e.message });
+        });
       }
-      if (spec.state === "aborted") return;
-    }
-    this.options.host?.notify?.(ev);
-  }
-  /** Queue a `[task …]` event for re-voicing. Events arriving while the voice is busy coalesce into ONE turn.
-   *  `nonClean` (out-of-band boolean, set by the caller that KNOWS this event integrates a NON-CLEAN outcome)
-   *  marks the coalesced flush as a non-clean integration turn — turn-eligibility, never inferred from event
-   *  text and never keyed on a (re-authored) brief string. Any dispatch in such a turn is a follow-up. */
-  queueRevoice(event, nonClean = false) {
-    this.pendingEvents.push(event);
-    if (nonClean) this.pendingNonClean = true;
-    if (this.flushQueued) return;
-    this.flushQueued = true;
-    void this.enqueue(async () => {
-      this.flushQueued = false;
-      const events = this.pendingEvents.splice(0);
-      const nonCleanTurn = this.pendingNonClean;
-      this.pendingNonClean = false;
-      if (!events.length) return;
-      const failed = events.find((e) => /^\[task\b[^\]\n]*\bfailed\b/i.test(e));
-      this.resetTurn();
-      this.turnFollowUp = nonCleanTurn;
-      await this.voice.send(events.join("\n"));
-      this.flushHeldReflexTail();
-      if (this.silentTurn) await this.ackIfSilent(failed ? "Sorry, that didn't work \u2014 the task failed." : void 0);
-      this.notify("revoice_done", "");
-    });
-  }
-  /** The worker's brief: the Act/Think args + a STATIC text snapshot of the recent conversation.
-   *  Act briefs get a self-verify footer — the worker's report is trusted without review, so it
-   *  must check its own work before reporting (nearly free under prompt caching; measured honest:
-   *  it does NOT fix one-shot logic bugs — see mind/10). Think tasks are pure reasoning — no footer. */
-  buildBrief(brief, tier = "act", deliver = true) {
-    const recent = this.voice.transcript.filter((m) => (m.role === "user" || m.role === "assistant") && contentText(m.content).trim()).slice(-this.options.excerptTurns).map((m) => `${m.role}: ${contentText(m.content)}`).join("\n");
-    const verify = tier === "act" ? "\n\nBefore reporting done: re-read what you changed and check it against EVERY requirement above \u2014 fix any gap first. Your report is trusted without review." : "";
-    const deliverContract = deliver ? `
-
-## DELIVER (spoken delivery)
-You are reporting back to a user who is LISTENING. Stream your work normally \u2014 your prose is the written work record and detail, and is NOT spoken. Wrap anything the user should HEAR in <spoken>\u2026</spoken> tags. LEAD WITH the actual content they asked for: if they asked for a specific piece of content \u2014 a value, a name, the actual lines, the writing itself \u2014 that content goes INSIDE the <spoken> tags, not a remark about it. Your FIRST <spoken> segment is substantive \u2014 never a greeting or an acknowledgement (the front-end has already acked; do not double-ack). Keep spoken text concise and natural for the ear: short sentences, no markdown. NEVER enumerate in speech \u2014 no numbered or bulleted lists ("One. \u2026 Two. \u2026" is robotic). Deliver multiple items as flowing conversation with brief connective phrasing ("here's one\u2026", "and another\u2026", "oh, and\u2026"), pausing between items with sentence breaks, not numbers.` + (this.options.emotionTags ? " Inside <spoken>, you may prefix a sentence with an inline [emotion] tag (e.g. [excited], [curious]) to color how it is voiced \u2014 only when it genuinely fits, and vary it; [laughter] gives a natural laugh." : "") : "";
-    return `${nowLine()}.
-
-` + (recent ? `${brief}
-
-## Recent conversation (for context)
-${recent}` : brief) + verify + deliverContract;
-  }
-  /** Spawn a detached worker for task `id`; its settlement notifies + enqueues the re-voice turn. */
-  spawnWorker(id, label, briefText, tier, brief, followUp) {
-    const o = this.options;
-    const tierOpts = tier === "think" ? o.thinkOptions : o.actOptions;
-    const tierModel = tier === "think" ? o.thinkModel : o.actModel;
-    const controller = new AbortController();
-    const base = tierOpts?.hooks ?? o.actOptions?.hooks;
-    const report = o.progressUpdates ? this.progressReporter(id) : void 0;
-    const tail = [];
-    const pushTail = (line) => {
-      tail.push(line.slice(0, 200));
-      if (tail.length > 120) tail.splice(0, tail.length - 120);
-    };
-    const hooks = {
-      ...base,
-      preToolUse: async (call, meta) => {
-        const d = await base?.preToolUse?.(call, meta);
-        pushTail(`\u2699 ${describeCall(call)}`);
-        report?.pre(call);
-        return d;
-      },
-      postToolUse: async (call, result, meta) => {
-        await base?.postToolUse?.(call, result, meta);
-        const last = result?.trim().split("\n").filter(Boolean).pop();
-        if (last) pushTail(`  \u21B3 ${last}`);
-        report?.post(call);
-      },
-      onToolOutput: (call, chunk, meta) => {
-        base?.onToolOutput?.(call, chunk, meta);
-        report?.output(chunk);
-      }
-    };
-    const relayAsk = async (q) => {
-      const opts = q.options?.length ? ` Options: ${q.options.map((x) => x.label).join(", ")}.` : "";
-      const a = await this.parkQuestion(id, `${q.question}${opts}`);
-      return a || "(no answer from the user \u2014 use your best judgment and note the assumption)";
-    };
-    const splitter = new SpokenSplitter();
-    const speak = (seg) => {
-      if (!seg) return;
-      const r = this.tasks.get(id);
-      if (r) r.spokenText = (r.spokenText ? r.spokenText + " " : "") + seg;
-      if (!r?.deliveryParked) o.host?.notify?.({ kind: "speak_utterance", message: seg });
-    };
-    const coalescer = new SentenceCoalescer();
-    const feedSpoken = (s) => {
-      const ready = coalescer.feed(s);
-      if (ready) speak(ready);
     };
-    const flushSpoken = () => speak(coalescer.flush());
-    const askBridge = o.askRelay ? { ask: relayAsk } : o.host?.ask ? { ask: (q) => o.host.ask(q) } : {};
-    const workerHost = {
-      ...askBridge,
-      notify: (ev) => {
-        if (ev?.kind === "text_delta" && typeof ev.message === "string") {
-          const { spoken, detail } = splitter.feed(ev.message);
-          feedSpoken(spoken);
-          if (detail.trim()) pushTail(detail.trim());
-          return;
+    this.ws.onmessage = (ev) => {
+      const m = JSON.parse(String(ev.data));
+      if (m.context_id && m.context_id !== this.ctxId) return;
+      if (m.type === "chunk" && m.data) {
+        this.consecutiveErrors = 0;
+        this.markRecovered();
+        if (!this.firstAudioAt) this.firstAudioAt = now2();
+        this.onAudio(base64ToBytes(m.data));
+      } else if (m.type === "done") {
+        this.consecutiveErrors = 0;
+        this.markRecovered();
+        this.onDone();
+      } else if (m.type === "timestamps" && m.word_timestamps) {
+        const wt = m.word_timestamps;
+        if (wt.words?.length && wt.start?.length) this.onTimestamps(wt.words, wt.start);
+      } else if (m.type === "error") {
+        if (/already been cancelled|does not exist/.test(m.message || "")) return;
+        this.consecutiveErrors++;
+        this.diag("tts_error", { message: String(m.message || ""), code: m.status_code, contextId: m.context_id, consecutive: this.consecutiveErrors });
+        if (!this.down && this.consecutiveErrors >= _CartesiaTTS.CB_THRESHOLD) {
+          this.down = true;
+          this.downAt = now2();
+          this.consecutiveOk = 0;
+          log12.warn(`TTS circuit breaker open \u2014 ${this.consecutiveErrors} consecutive errors, switching to text-only`);
+          this.diag("tts_breaker_open", { errors: this.consecutiveErrors });
+          this.onDone();
+          this.startProbe();
+        } else if (!this.down) {
+          (/No valid transcripts/i.test(m.message || "") ? log12.debug : log12.warn)(`cartesia: ${JSON.stringify(m)}`);
         }
       }
     };
-    const agentOpts = {
-      ai: o.ai,
-      fs: o.fs,
-      model: tierModel,
-      ...tier === "think" ? { reasoning: tierOpts?.reasoning ?? "high" } : {},
-      ...tierOpts,
-      // Recompute providerOptions for THIS worker's model (after tierOpts so it wins over any inherited
-      // main-template value) — prevents cursor-only cwd/cursorSession leaking onto an anthropic worker.
-      providerOptions: o.providerOptionsFor?.(tierModel),
-      stream: true,
-      // worker streams text_delta so the splitter can extract <spoken> live (after tierOpts: never overridden off)
-      host: workerHost,
-      // carries BOTH ask AND the <spoken>-splitting notify
-      ...hooks ? { hooks } : {},
-      signal: controller.signal
-      // shared with the checker so a cancel tears down both
-    };
-    const promise = new Agent(agentOpts).run(briefText).then((res) => {
-      const { spoken, detail } = splitter.flush();
-      feedSpoken(spoken);
-      if (detail.trim()) pushTail(detail.trim());
-      flushSpoken();
-      return res;
-    }).then((res) => this.maybeVerify(id, brief, res, tier, agentOpts, askBridge)).then((res) => this.onWorkerSettled(id, res)).catch((err) => this.onWorkerFailed(id, err));
-    this.tasks.set(id, { id, label, status: "running", controller, promise, tail, brief, followUp, splitter });
-    if (this.tasks.size > this.options.maxTaskRecords)
-      for (const [tid, rec] of this.tasks) {
-        if (this.tasks.size <= this.options.maxTaskRecords) break;
-        if (rec.status !== "running") this.tasks.delete(tid);
-      }
   }
-  /** Fresh-context check of a successful Act task: a NEW agent (same model/fs/tools, but NO shared
-   *  conversation context) re-reads the file state against the brief and fixes any gap. The fix lands
-   *  on the shared fs automatically (workers write fs directly, no overlay), so grading sees the
-   *  corrected state. Bounded to ONE pass. Off unless `verifyActTasks`; never runs for think/failed/
-   *  cancelled tasks. Usage is merged so /cost reflects the real (worker + checker) spend. */
-  async maybeVerify(id, brief, res, tier, agentOpts, askBridge) {
-    if (!this.options.verifyActTasks || tier !== "act" || res.finishReason !== "stop") return res;
-    if (this.tasks.get(id)?.status === "cancelled") return res;
-    const { stream: _stream, host: _host, ...restOpts } = agentOpts;
-    const checkerOpts = {
-      ...restOpts,
-      ...askBridge.ask ? { host: { ask: askBridge.ask } } : {}
-    };
-    const checkBrief = `${this.buildBrief(brief, tier, false)}
-
-## VERIFY MODE
-Another agent just implemented the above. Independently check the CURRENT state of the files against EVERY requirement. Fix any gap you find. If everything is already correct, make NO changes \u2014 do not refactor or improve \u2014 and report "verified".`;
-    this.notify("task_verify", `task ${id}: verifying`, { id });
-    const cres = await new Agent(checkerOpts).run(checkBrief);
-    if (cres.finishReason !== "stop") {
-      log11.warn(`task ${id}: verify inconclusive (${cres.finishReason})`);
-      this.notify("task_verify", `task ${id}: verify inconclusive (${cres.finishReason})`, { id, finishReason: cres.finishReason });
-    }
-    const sum = (a = 0, b = 0) => a + b;
-    return {
-      ...res,
-      steps: res.steps + cres.steps,
-      // Merge the checker's messages so downstream tool-call/step accounting includes BOTH agents
-      // (else a verified task's toolCalls would undercount vs its steps/usage).
-      messages: [...res.messages, ...cres.messages],
-      usageEstimated: res.usageEstimated || cres.usageEstimated,
-      usage: res.usage && cres.usage ? {
-        promptTokens: sum(res.usage.promptTokens, cres.usage.promptTokens),
-        completionTokens: sum(res.usage.completionTokens, cres.usage.completionTokens),
-        totalTokens: sum(res.usage.totalTokens, cres.usage.totalTokens),
-        cacheCreationTokens: sum(res.usage.cacheCreationTokens, cres.usage.cacheCreationTokens),
-        cacheReadTokens: sum(res.usage.cacheReadTokens, cres.usage.cacheReadTokens)
-      } : res.usage ?? cres.usage
-    };
+  /** Close the breaker only after CB_RECOVER_OK consecutive good frames, so a single straggler chunk
+   *  after a 503 burst doesn't flap open→recover in <1s. A sub-2s down-window is a transient blip → debug. */
+  markRecovered() {
+    if (!this.down) return;
+    if (++this.consecutiveOk < _CartesiaTTS.CB_RECOVER_OK) return;
+    this.down = false;
+    this.consecutiveOk = 0;
+    this.stopProbe();
+    const downMs = this.downAt ? now2() - this.downAt : 0;
+    this.diag("tts_breaker_close", { downMs: Math.round(downMs) });
+    (downMs < 2e3 ? log12.debug : log12.info)(`TTS recovered${downMs ? ` (down ${downMs}ms)` : ""}`);
   }
-  /** Throttled per-task progress: worker tool calls → at most one progress re-voice per interval.
-   *  Two sources, one throttle: completed steps (post) and a heartbeat for a SINGLE long tool call
-   *  (pre records the in-flight call; a self-cleaning timer narrates "still inside Bash — 70s").
-   *  Completion supersedes: nothing is emitted once the task has settled. */
-  progressReporter(id) {
-    let lastAt = Date.now();
-    let steps = 0;
-    let inflight = null;
-    const due = () => {
-      if (this.pendingAsks.size) return void 0;
-      const rec = this.tasks.get(id);
-      return rec && rec.status === "running" && Date.now() - lastAt >= this.options.progressIntervalMs ? rec : void 0;
-    };
-    const emit = (rec, line, call) => {
-      lastAt = Date.now();
-      this.notify("task_progress", `task ${id} (${rec.label}): ${line}`, { id, steps, call: call.name });
-      this.queueRevoice(`[task ${id} progress] ${line}`);
-    };
-    const timer = setInterval(() => {
-      const rec = this.tasks.get(id);
-      if (!rec || rec.status !== "running") return clearInterval(timer);
-      if (!inflight || !due()) return;
-      const last = inflight.tail.trim().split("\n").filter(Boolean).pop()?.slice(-80);
-      emit(rec, `still inside ${describeCall(inflight.call)} \u2014 ${Math.round((Date.now() - inflight.at) / 1e3)}s on this step${last ? `, last output: ${last}` : ""}`, inflight.call);
-    }, Math.max(this.options.progressIntervalMs, 250));
-    timer.unref?.();
-    return {
-      pre: (call) => {
-        inflight = { call, at: Date.now(), tail: "" };
-      },
-      output: (chunk) => {
-        if (inflight) inflight.tail = (inflight.tail + chunk).slice(-500);
-      },
-      // digest only — NEVER re-voices directly
-      post: (call) => {
-        steps++;
-        inflight = null;
-        const rec = due();
-        if (rec) emit(rec, `still running \u2014 ${steps} steps so far, now: ${describeCall(call)}`, call);
-      }
-    };
+  /** Ensure the WS is open before sending — reconnects if idle-closed. */
+  async ensureConnected() {
+    if (this.connecting) await this.connecting;
+    if (this.ws?.readyState !== WebSocket.OPEN) await this.connect();
   }
-  /** Park a question under `askId` (a task id, or any unique key for permission asks): re-voices
-   *  '[task <id> asks] …' and resolves with the user's answer via AnswerTask — or '' on timeout/
-   *  task settle (callers map '' to deny / best-judgment). Workers never block forever. */
-  parkQuestion(askId, question) {
-    return new Promise((resolve) => {
-      let settled = false;
-      const finish = (answer) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        this.pendingAsks.delete(askId);
-        resolve(answer);
-      };
-      const timer = setTimeout(() => {
-        this.notify("task_ask_timeout", `task ${askId}: question timed out \u2014 proceeding without an answer`);
-        finish("");
-      }, this.options.askTimeoutMs);
-      this.pendingAsks.set(askId, { question, resolve: finish });
-      this.notify("task_ask", `task ${askId} asks: ${question}`, { id: askId, question });
-      this.queueRevoice(`[task ${askId} asks] ${question}
-(Relay this to the user in your own words. When they answer, call AnswerTask with id "${askId}" and their answer.)`);
-    });
-  }
-  /** Resolve any question a settling/cancelled task left parked (its answer can no longer matter). */
-  dropAsk(id) {
-    this.pendingAsks.get(id)?.resolve("");
+  /** Prime the synthesis pipeline on a throwaway context right after connect: the FIRST synthesis on
+   *  a fresh WS pays Cartesia's cold spin-up (~1s+ live) — absorb it at mic-on instead of turn one.
+   *  The returned audio is discarded (engine drops onAudio while not speaking; once a real turn calls
+   *  newContext() any stragglers are stale-context-filtered). Respects the circuit breaker. */
+  warmup() {
+    if (this.down) return;
+    this.newContext();
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("Ok.", false));
   }
-  /** Build the INTEGRATION TURN prompt for a NON-CLEAN settled worker (early stop / failure). A clean
-   *  success never reaches here — it streams its own `<spoken>` delivery during the run. For a partial
-   *  or failed result the outcome re-enters the reflex as a decision (like a tool_result flowing back
-   *  into a normal agent loop): the reflex evaluates the outcome against the original intent and chooses
-   *  what to do next.
-   *
-   *  Decision branches (the reflex acts on them with EXISTING tools — no new surface):
-   *    • accept     → SPEAK the (partial) result plainly — don't dress a failure up as success.
-   *    • escalate   → call `Think` with the SAME brief — only when Act failed/stalled AND a Think tier
-   *                   exists AND this task wasn't already a follow-up (one hop max). Wires the dead
-   *                   "Reserve Think for a problem Act already FAILED at" promise.
-   *    • re-delegate→ call `Act` with a CORRECTED brief — for a recoverable error / partial result.
-   *    • ask        → ask the user ONE concrete question if genuinely blocked.
-   *
-   *  Keeps the `[task <id> completed]` / `[task <id> failed]` opener so existing coalescing + the
-   *  failed-revoice fallback still fire, and the per-event transcript markers stay intact. */
-  integrationPrompt(rec, outcome, body, finishReason) {
-    const opener = outcome === "error" ? `[task ${rec.id} failed]` : `[task ${rec.id} completed]`;
-    const underCap = this.autoEscalations < _DuplexAgent.MAX_AUTO_ESCALATIONS;
-    const canEscalate = (outcome === "error" || outcome === "incomplete") && underCap;
-    const hasThink = this.options.thinkModel !== false;
-    const options = [];
-    if (!rec.followUp && canEscalate && hasThink)
-      options.push("ESCALATE to the Think tier (call Think with the same brief) if this is a hard/architectural problem the Act worker stalled or failed on");
-    if (!rec.followUp && canEscalate)
-      options.push("RE-DELEGATE to Act with a corrected brief if the failure looks recoverable (a wrong path, a fixable mistake)");
-    options.push("ASK the user one short, concrete question if you genuinely cannot proceed without their input");
-    options.push("ACCEPT and tell the user plainly what happened (don't dress a failure up as success)");
-    const decision = options.length > 1 ? ` You must decide what to do next \u2014 choose ONE: ${options.map((o, i) => `(${i + 1}) ${o}`).join("; ")}. Pick exactly one and act on it; do not voice this as a finished success.` : ` Tell the user plainly what happened \u2014 do not present this as a finished success.`;
-    const state = outcome === "error" ? `the worker FAILED with: ${body}` : `the worker STOPPED EARLY (${finishReason}) \u2014 its result is PARTIAL, not a finished success: ${body}`;
-    return `${opener} Original request: "${rec.brief}". Outcome: ${state}.${decision}`;
+  newContext() {
+    this.ctxId = `ctx-${++this.ctxSeq}`;
+    this.firstAudioAt = 0;
+    return this.ctxId;
   }
-  onWorkerSettled(id, res) {
-    this.dropAsk(id);
-    const rec = this.tasks.get(id);
-    if (res.finishReason === "aborted" || rec.status === "cancelled") {
-      rec.status = "cancelled";
-      this.notify("task_cancelled", `task ${id} (${rec.label}) cancelled`);
-      return;
-    }
-    if (res.finishReason === "error") {
-      const msg = res.error instanceof Error ? res.error.message : String(res.error ?? "unknown error");
-      return this.failTask(rec, msg);
-    }
-    rec.status = "done";
-    rec.result = res.text;
-    const incomplete = res.finishReason !== "stop";
-    log11.verbose(`task ${id} done (${res.steps} steps${incomplete ? `, INCOMPLETE: ${res.finishReason}` : ""})`);
-    this.notify("task_done", `task ${id} (${rec.label}) completed`, {
-      id,
-      text: res.text,
-      usage: res.usage,
-      usageEstimated: res.usageEstimated,
-      finishReason: res.finishReason,
-      steps: res.steps,
-      toolCalls: res.messages.filter((m) => m.role === "tool").length
+  frame(transcript, cont) {
+    return JSON.stringify({
+      model_id: this.options.model,
+      transcript,
+      voice: { mode: "id", id: this.options.voiceId },
+      output_format: { container: "raw", encoding: "pcm_s16le", sample_rate: TTS_SAMPLE_RATE },
+      context_id: this.ctxId,
+      continue: cont,
+      ...this.wantTimestamps ? { add_timestamps: true } : {}
     });
-    if (incomplete) {
-      return this.queueRevoice(this.integrationPrompt(rec, "incomplete", res.text, res.finishReason), true);
-    }
-    const tail = rec.splitter?.flush();
-    if (tail?.spoken && !rec.deliveryParked) this.options.host?.notify?.({ kind: "speak_utterance", message: tail.spoken });
-    if (res.text.trim()) this.voice.transcript.push({ role: "assistant", content: res.text });
-    if (rec.deliveryParked && !this.suppressParkedResume) {
-      const gist = (rec.spokenText ?? "").trim() || res.text.trim();
-      if (gist) {
-        if (this.awaitTrivialRedeliver) {
-          this.awaitTrivialRedeliver = false;
-          this.options.host?.notify?.({ kind: "speak_utterance", message: gist });
-          this.notify("diag", "parked_redelivered", { chars: gist.length });
-        } else this.parkedRedeliver.push(gist);
-      }
-    }
-    if (!rec.splitter?.spokeAny && res.text.trim() && !rec.deliveryParked)
-      this.options.host?.notify?.({ kind: "speak_utterance", message: res.text });
-  }
-  onWorkerFailed(id, err) {
-    this.failTask(this.tasks.get(id), err instanceof Error ? err.message : String(err));
   }
-  failTask(rec, msg) {
-    this.dropAsk(rec.id);
-    rec.status = "error";
-    rec.result = msg;
-    log11.warn(`task ${rec.id} failed: ${msg}`);
-    this.notify("task_error", `task ${rec.id} (${rec.label}) failed: ${msg}`);
-    this.queueRevoice(this.integrationPrompt(rec, "error", msg, "error"), true);
+  speak(text, cont) {
+    if (this.down) return;
+    if (cont && !text) return;
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame(text, cont));
+    else void this.ensureConnected().then(() => this.ws?.readyState === WebSocket.OPEN && this.ws.send(this.frame(text, cont)));
   }
-  // --- voice tools (closures over this instance) ---
-  /** Live-switch the think tier: `false` disables (removes the Think tool from the voice agent),
-   *  a model id enables (adds the tool if missing). The system-prompt THINK_SLOT text is frozen at
-   *  construction — the tool's own description carries the routing guidance, so a live enable works;
-   *  dispatch()'s think→act fallback covers any straggler calls after a live disable. */
-  setThinkModel(model) {
-    this.options.thinkModel = model;
-    const tools = this.voice.options.tools;
-    const i = tools.findIndex((t) => t.name === "Think");
-    if (model === false && i >= 0) tools.splice(i, 1);
-    else if (model !== false && i < 0) tools.push(this.thinkTool());
+  end() {
+    if (this.down) {
+      this.onDone();
+      return;
+    }
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("", false));
   }
-  /** User/programmatic spawn: the CLI's /act and /think commands. Returns the task id.
-   *  `followUp` marks an automatic escalation/re-delegation (set by the integration turn) so the new
-   *  task's own integration turn won't escalate again — capping auto-follow-ups to one hop. */
-  async dispatch(brief, tier = "act", label, followUp = false) {
-    if (tier === "think" && this.options.thinkModel === false) tier = "act";
-    if (followUp) this.autoEscalations++;
-    const id = `t${++this.seq}`;
-    const lbl = label ?? tier;
-    await this.options.onTaskStart?.(id, lbl);
-    this.spawnWorker(id, lbl, this.buildBrief(brief, tier), tier, brief, followUp);
-    this.notify("task_started", `task ${id} (${lbl}) started`, { id, brief, tier });
-    return id;
+  cancel() {
+    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify({ context_id: this.ctxId, cancel: true }));
   }
-  actTool() {
-    return {
-      name: "Act",
-      description: 'Escalate real work (reading/editing files, searching, running tasks, building) to a standard background worker. Returns immediately with a task id; the result arrives later as a "[task <id> completed]" event. Provide a clear, self-contained `brief` (the worker does not hear the live conversation).',
-      parameters: {
-        type: "object",
-        required: ["brief"],
-        properties: {
-          brief: { type: "string", description: "full, self-contained instructions for the worker" },
-          label: { type: "string", description: "a short (2-4 word) label for the task" }
-        }
-      },
-      run: async ({ brief, label }) => {
-        this.spokeBeforeDispatch = this.spokeThisTurn;
-        this.turnDispatched = true;
-        this.turnBriefs.add(String(brief ?? ""));
-        this.voice.options.toolChoice = "none";
-        const id = await this.dispatch(String(brief ?? ""), "act", label ? String(label) : void 0, this.turnFollowUp);
-        return this.spokeBeforeDispatch ? `Acting on task ${id}. You already acknowledged \u2014 end your turn now with NO further text; the result will arrive as a [task ${id} completed] event.` : `Acting on task ${id}. Acknowledge briefly; the result will arrive as a [task ${id} completed] event.`;
+  startProbe() {
+    if (this.probeTimer) return;
+    this.probeTimer = setInterval(() => {
+      if (!this.down) {
+        this.stopProbe();
+        return;
       }
-    };
+      this.consecutiveErrors = 0;
+      this.newContext();
+      if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("Ok.", false));
+    }, _CartesiaTTS.CB_PROBE_MS);
+    this.probeTimer.unref?.();
   }
-  thinkTool() {
-    return {
-      name: "Think",
-      description: "Escalate to a premium deep-reasoning agent for complex analysis, architecture decisions, hard debugging, or planning. Same async pattern as Act \u2014 returns a task id. Use when the problem needs careful thought before (or instead of) action. Do not use Think for simple tasks \u2014 Act is cheaper and faster.",
-      parameters: {
-        type: "object",
-        required: ["brief"],
-        properties: {
-          brief: { type: "string", description: "the question or problem to reason about deeply" },
-          label: { type: "string", description: "a short (2-4 word) label for the task" }
-        }
-      },
-      run: async ({ brief, label }) => {
-        this.spokeBeforeDispatch = this.spokeThisTurn;
-        this.turnDispatched = true;
-        this.turnBriefs.add(String(brief ?? ""));
-        this.voice.options.toolChoice = "none";
-        const id = await this.dispatch(String(brief ?? ""), "think", label ? String(label) : void 0, this.turnFollowUp);
-        return this.spokeBeforeDispatch ? `Thinking on task ${id}. You already acknowledged \u2014 end your turn now with NO further text; the result will arrive as a [task ${id} completed] event.` : `Thinking on task ${id}. Acknowledge briefly; the result will arrive as a [task ${id} completed] event.`;
-      }
-    };
+  stopProbe() {
+    if (this.probeTimer) {
+      clearInterval(this.probeTimer);
+      this.probeTimer = null;
+    }
   }
-  taskStatusTool() {
-    return {
-      name: "TaskStatus",
-      description: "Status of background tasks. Pass `id` for one task, or omit it to list all.",
-      parameters: { type: "object", properties: { id: { type: "string" } } },
-      run: async ({ id }) => {
-        const list = id ? [this.tasks.get(String(id))].filter(Boolean) : [...this.tasks.values()];
-        if (!list.length) return id ? `No task '${id}'.` : "No background tasks.";
-        return list.map((t) => `${t.id} (${t.label}): ${t.status}`).join("\n");
-      }
-    };
+  close() {
+    this.closed = true;
+    this.stopProbe();
+    if (this.ws) this.ws.onclose = null;
+    this.ws?.close();
   }
-  /** Sub-100ms read-only lookups the voice may do itself — everything else stays Act-only.
-   *  fs-only (no shell; the engine is VFS-abstracted): time, git branch (.git/HEAD read), ls, file
-   *  head. Output is hard-capped so a lookup can never bloat the skinny voice context. */
-  quickLookTool() {
-    const CAP = 2e3;
-    const kinds = [.../* @__PURE__ */ new Set(["time", "branch", "ls", "file", "capabilities", ...Object.keys(this.options.quickLook ?? {})])];
-    return {
-      name: "QuickLook",
-      description: `Instant read-only lookup \u2014 one of: ${kinds.join(", ")}. For trivial facts only; anything needing search, commands, or reasoning goes through Act.`,
-      parameters: {
-        type: "object",
-        required: ["what"],
-        properties: {
-          what: { type: "string", enum: kinds, description: "what to look up" },
-          path: { type: "string", description: "for ls/file: the path to look at" }
-        }
-      },
-      run: async ({ what, path }) => {
-        const fs = this.options.fs;
-        try {
-          const over = this.options.quickLook?.[String(what)];
-          if (over) return await over(path ? String(path) : void 0);
-          switch (String(what)) {
-            case "capabilities": {
-              const actTools = this.options.actOptions?.tools ?? [];
-              const names = actTools.map((t) => t.name);
-              const mcpServers = Object.keys(this.options.actOptions?.providerOptions?.mcpServers ?? {});
-              const mcpNote = mcpServers.length ? ` Plus MCP servers your worker can use: ${mcpServers.join(", ")} (e.g. browser-bridge \u2192 drive a real browser: open tabs, navigate, click, screenshot).` : "";
-              if (!names.length)
-                return "Your worker uses Act's default local toolset (reading/editing files, running shell commands). No extra tools (e.g. web/internet) are configured; if a request is not a basic file or shell operation, assume you can't do it and say so." + mcpNote;
-              const hasFetch = names.some((n) => /WebFetch/i.test(n));
-              const hasBrowser = names.some((n) => /browser.*(navigate|click|page|type)/i.test(n));
-              const hasSearch = names.some((n) => /(^|_)WebSearch$|search/i.test(n) && !/WebFetch|browser/i.test(n));
-              const notes = [];
-              if (hasFetch) notes.push("WebFetch retrieves ONE specific URL you are given \u2014 it is not a search engine.");
-              if (hasBrowser) notes.push("The browser tools drive a real browser: you CAN open a site and, if needed, navigate to a search engine and search there \u2014 but it is manual and takes a moment, not an instant lookup.");
-              else if (!hasSearch && hasFetch) notes.push('You have no general web-search tool, so for an instant "search the web" you can only fetch a URL they provide.');
-              const webNote = notes.length ? " NOTE: " + notes.join(" ") : "";
-              return `Tools your background worker (Act) can actually use: ${names.join(", ")}. Read each name literally and match the request to a SPECIFIC tool; if none fits, you do NOT have that ability \u2014 say so honestly.` + webNote + mcpNote;
-            }
-            case "time":
-              return (/* @__PURE__ */ new Date()).toString();
-            case "branch": {
-              if (!fs) return "unavailable (no filesystem)";
-              const head = (await fs.readFile(".git/HEAD")).trim();
-              return head.startsWith("ref: refs/heads/") ? `branch: ${head.slice("ref: refs/heads/".length)}` : `detached HEAD at ${head.slice(0, 12)}`;
-            }
-            case "ls": {
-              if (!fs) return "unavailable (no filesystem)";
-              const p = String(path ?? ".");
-              try {
-                const names = await fs.readDir(p);
-                return names.slice(0, 50).join("\n") + (names.length > 50 ? `
-\u2026 (+${names.length - 50} more)` : "");
-              } catch {
-                const names = await fs.readDir(".").catch(() => []);
-                return `'${p}' not found here \u2014 you are likely already inside it. Current directory listing:
-` + names.slice(0, 50).join("\n") + (names.length > 50 ? `
-\u2026 (+${names.length - 50} more)` : "");
-              }
-            }
-            case "file": {
-              if (!fs) return "unavailable (no filesystem)";
-              if (!path) return "file lookup needs a path";
-              try {
-                const text = await fs.readFile(String(path));
-                return text.length > CAP ? text.slice(0, CAP) + `
-\u2026 (truncated \u2014 ${text.length} chars total; Act for the full file)` : text;
-              } catch {
-                const names = await fs.readDir(".").catch(() => []);
-                return `'${path}' not found. Current directory contains:
-` + names.slice(0, 50).join("\n");
-              }
-            }
-            default:
-              return `unknown lookup '${what}'`;
+};
+function base64ToBytes(b64) {
+  if (typeof Buffer !== "undefined") return Buffer.from(b64, "base64");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+// src/voice/engine.ts
+init_logging();
+configureLogging((name) => {
+  const l = forComponent(name);
+  const at = (m) => (...a) => l[m]?.(...a);
+  return { debug: at("debug"), verbose: at("verbose"), info: at("info"), warn: at("warn"), error: at("error") };
+});
+
+// src/duplex.ts
+var log13 = forComponent("DuplexAgent");
+function describeCall(call) {
+  const v = call.args && Object.values(call.args).find((x) => typeof x === "string" && x.trim());
+  const hint = v ? ` (${String(v).replace(/\s+/g, " ").trim().slice(0, 48)})` : "";
+  return `${call.name}${hint}`;
+}
+var DuplexAgentOptions = class {
+  /** Any ai.libx.js AIClient — shared by all tiers (routed by model). */
+  ai;
+  /** The WORKER's filesystem (act + think). If omitted the worker keeps Agent's jailed-disk-at-cwd default. */
+  fs;
+  // The reflex IS the voice. 120b (not 20b) for channel discipline + instruction-following: the 20b
+  // mislabels gpt-oss harmony channels under load, leaking raw analysis into the spoken `final` channel
+  // (and misfiring Hold). 120b is the same price tier (~$0.15/$0.60) — the quality/cost trade is free.
+  reflexModel = "groq/openai/gpt-oss-120b";
+  actModel = "anthropic/claude-sonnet-4-6";
+  /** Premium reasoning model. Set to `false` to disable the Think tier entirely. */
+  thinkModel = "anthropic/claude-opus-4-8";
+  /** Per-worker providerOptions, derived from the worker's actual model at spawn time (IoC — keeps duplex
+   *  provider-agnostic). Workers override the reflex/main model, so provider-specific options (e.g. cursor's
+   *  cwd/cursorSession) must be recomputed for the worker's model, never inherited from the main template —
+   *  leaking cursor options to an anthropic worker is a hard 400. Returns undefined → no providerOptions. */
+  providerOptionsFor;
+  /** Escape hatches merged over the derived per-agent options. */
+  reflexOptions;
+  actOptions;
+  thinkOptions;
+  /** Fresh-context check on each successful Act task: a NEW agent (no self-confirmation bias) re-reads
+   *  the file state against the brief and fixes any gap before the result is re-voiced. Bounded to one
+   *  pass; ~2x Act cost so default OFF. The self-verify FOOTER (same context) was measured ineffective —
+   *  this is the structural fix (see mind/10). Think tasks are pure reasoning, never checked. */
+  verifyActTasks = false;
+  /** Receives the voice text_delta stream + task lifecycle events. */
+  host;
+  /** How many recent transcript messages are rendered into a worker's brief. */
+  excerptTurns = 6;
+  /** Voice register: 'neutral' = clean spoken style; 'conversational' = human-like — fillers,
+   *  backchannels, impulsive first reactions before content (mimics real duplex conversation). */
+  voiceStyle = "neutral";
+  /** Teach the model to emit inline `[emotion]` tags for Cartesia emotion control. Only set when the
+   *  TTS actually speaks them — text-duplex (no TTS) would otherwise print literal tags. */
+  emotionTags = false;
+  /** Awaited BEFORE a worker spawns — open a per-task checkpoint frame, audit, etc.
+   *  (post-spawn would race the worker's first edits). */
+  onTaskStart;
+  /** Re-voice throttled worker progress asides ('[task t1 progress] …') so long tasks aren't dead
+   *  air. Off by default — each update costs a voice turn (LLM call + speech). */
+  progressUpdates = false;
+  /** Min ms between progress re-voices per task. */
+  progressIntervalMs = 25e3;
+  /** Relay worker questions (AskUserQuestion + permission asks via parkQuestion) through the VOICE:
+   *  the question re-voices as '[task <id> asks] …', the user answers conversationally, and the
+   *  voice model resolves it with the AnswerTask tool. Off → host.ask passthrough (text menus). */
+  askRelay = false;
+  /** Parked questions auto-resolve empty after this long (callers map '' to deny/best-judgment). */
+  askTimeoutMs = 12e4;
+  /** Max retained task records: oldest SETTLED tasks (and their activity tails) are evicted past this,
+   *  bounding memory over a long-lived session. Running tasks are never evicted. */
+  maxTaskRecords = 50;
+  /** Host overrides for QuickLook lookups (keyed by `what`). The engine's defaults go through the
+   *  (possibly jailed) fs — e.g. `.git/**` is deny-listed, so the CLI supplies 'branch' itself. */
+  quickLook;
+  /** Memory directory/directories on the WORKER fs. If set, the voice agent gets Remember + Recall
+   *  tools directly (no delegation needed) and implicit capture guidance. */
+  memoryDir;
+  /** User-scope memory dir for global facts (type=user/feedback). Forwarded to Remember's routing. */
+  memoryUserDir;
+};
+var RESERVED_EVENT_MARKER = /\[task\b[^\]\n]*\b(?:completed|failed|progress|asks)\b/i;
+var RESERVED_EVENT_OPENER = /\[\s*task\b/i;
+var STAGE_DIRECTION_RE = /^\(\s*(?:(?:waiting|checking|searching|thinking|processing|loading|working|fetching|looking)\b[^)]*|[^)]*(?:\.\.\.|…)\s*)\)$/i;
+function nowLine() {
+  return `Current date and time: ${(/* @__PURE__ */ new Date()).toLocaleString("en-US", { weekday: "long", year: "numeric", month: "long", day: "numeric", hour: "numeric", minute: "2-digit", timeZoneName: "short" })}`;
+}
+function isTrivialBarge(text) {
+  const t = text.trim().toLowerCase().replace(/[.,!?…\s]+$/g, "").replace(/^[.,!?…\s]+/, "");
+  if (!t) return false;
+  if (/\b(stop|cancel|no|nope|nah|never\s?mind|nvm|forget it|drop it|don'?t|quiet|shut up|enough|hold on|wait|pause|hang on|actually)\b/.test(t)) return false;
+  const core = t.replace(/^(?:oh|um+|uh+|er+|hmm+|ah+|well|so|okay|ok|yeah|yep)[\s,]+/, "").trim();
+  return /^(?:oh|um+|uh+|er+|hmm+|ah+|sorry|oops|whoops|my bad|pardon|excuse me|apologies|go on|go ahead|continue|keep going|carry on|as you were|please continue|you were saying|sorry go on|sorry continue|go on then|go on please)$/.test(core || t);
+}
+var VOICE_SYSTEM_PROMPT = 'You are a spoken voice assistant \u2014 the user HEARS everything you say. Use short sentences. One idea per sentence. No markdown, no bullet lists, no code blocks, no headings, no emoji. Never emit stage directions or parenthetical asides about your own process \u2014 nothing like "(waiting for the result...)" or "(checking)"; while work runs, either say it as plain speech or end your turn.\nThis holds even when asked to "print", "list", "show", or "make a table" \u2014 there is no screen for the spoken channel. Speak it as flowing prose ("Tuesday is half a meter, Wednesday a bit less\u2026"), or if they truly need it on screen, route it to Act to render. Never emit dashes or pipes into speech.\nKeep turns SHORT \u2014 one to three sentences, then stop. Never lecture, enumerate cases, or add caveats unprompted. Conversation is a fast exchange: give the one thing asked, and let the user pull more if they want it.\nYou have three cognitive tiers \u2014 like a human brain:\n\u2022 YOU (reflex) \u2014 instant, lightweight. Handle greetings, simple questions, status checks, QuickLook.\n\u2022 `Act` \u2014 your hands. A background worker with its own configured tools and access to the user\'s environment (files and shell{{WORKER_WEB}}). Use for reading, editing, searching, running tasks, building \u2014 any real work.\n{{THINK_SLOT}}\nWhen you are unsure whether you can do or access something, do NOT assume and do NOT claim a capability you have not confirmed. To check what you can do, QuickLook `capabilities` (instant \u2014 it lists your worker\'s real tools) and answer from that. Never promise an ability that is not in your capabilities; if it is not there, tell the user plainly you can\'t. To actually DO real work, call `Act`. When the user mentions their project, folder, files, or environment ("this project", "the current folder", "my code"), call `Act` IMMEDIATELY \u2014 do not ask for paths or details the worker can discover itself. Never pretend to have done the work or invent results \u2014 the worker\'s report is your only source.\nYou cannot mute the microphone or stop voice capture yourself \u2014 no tool does it. If the user asks you to stop listening or turn the voice off, never claim you did: tell them to say exactly "voice off" (handled by the app directly), or type /voice.\nYou are NOT a knowledge base. For any question whose answer needs SPECIFIC verifiable facts you do not already have in hand \u2014 how to build/configure/implement something, exact API, library, entitlement, command or option names, current events, or particular numbers, dates, or names \u2014 do NOT answer from your own memory: you will confidently make things up (a fake API, a wrong entitlement, an event that did not happen). Route it to `Act`, which can search and verify, and speak only what its report says. DELEGATION RULE \u2014 decide for yourself, the user never has to push: if you cannot answer confidently from the conversation plus trivial well-known knowledge, do NOT refuse and do NOT guess \u2014 dispatch `Act` immediately with a clear brief and say you are checking. Anything needing CURRENT data (weather, news, prices, dates, sky/astronomy, "right now"), real computation, or verification is an automatic dispatch \u2014 never a refusal. The user should never need to say "search the web" or "think harder" to make you act; needing fresh or verified information IS the trigger. Refuse only what your worker genuinely cannot do (check `capabilities`), and say why. Answer inline ONLY for general conversation, chit-chat, and trivia you are sure of, or facts you can see via QuickLook. When elaborating on a completed task ("tell me more", "the gist"), stay strictly within what that result actually said \u2014 if the user asks for something the result did not cover, that is NEW information: dispatch `Act`, do not improvise.\nALWAYS react before you work: the FIRST thing in your turn is a brief spoken acknowledgement of what you heard and what you are about to do ("got it \u2014 opening that now", "sure, let me pull it up", "okay, checking"). NEVER call a tool (Act, Think, QuickLook) silently \u2014 the user must hear you react before you go quiet to work. After dispatching Act or Think, that same one short sentence IS your turn \u2014 end it and do not wait for the result. Exactly ONE short line: never stack a second acknowledgement, and never narrate your own presence or status while waiting ("I\'m here", "let me see", "still checking" right after you already acked). One clean ack then silence reads as competent; repeated check-ins read as nervous.\nA completed task speaks its OWN result to the user (the worker voices what matters as it finishes) \u2014 you do NOT re-voice clean task results. A FAILED or INCOMPLETE task still arrives as a "[task t1 failed] \u2026" event for you to handle. The completed result stays in YOUR context \u2014 it is yours to draw on. When the user follows up ("tell me more", "what else", "and?"), answer FROM that result first: you already have the detail, so elaborate on what you have. Do NOT spawn a fresh worker to re-search or re-gather what you were just handed. Re-dispatch ONLY when genuinely new information is needed \u2014 e.g. the user wants the full contents of a SPECIFIC source, which is one WebFetch of that URL, not a brand-new search. "[task t1 progress] \u2026" events are interim status, NOT results \u2014 on a genuinely LONG wait you MAY give one brief half-sentence aside, but only occasionally; silence while working is normal and fine (the user knows you are on it). Do NOT narrate every step or re-announce yourself. Never present progress as a finished result.\nCRITICAL: while a task is still running you have NO answer yet \u2014 never state a specific result of any kind (a number, size, count, name, path, or value). The real answer arrives ONLY in the "[task \u2026 completed]" event; inventing one meanwhile (a made-up disk size, commit count, etc.) is a serious error. Until then, only acknowledge and wait.\nNever read raw file paths, diffs, or code aloud verbatim.\nDo NOT end every turn with the same canned offer ("want a rundown?", "want the steps?"). Offer once at most; if the user pushes back, repeats themselves, or sounds unsatisfied ("you know what I mean?", "think deeper", "are you sure?"), do NOT re-offer the same thing \u2014 change approach: dispatch `Act`/`Think` to actually dig in, or ask one concrete clarifying question. Repeating a non-answer is worse than silence.\n"[task t1 asks] \u2026" events are QUESTIONS from a background task \u2014 relay to the user in your own words, short, then end your turn. When the user answers, call `AnswerTask` with that id and their answer. NEVER answer on the user\'s behalf for permissions or risky operations; if their reply is ambiguous, confirm first.\nIf the user\'s message sounds INCOMPLETE \u2014 trailing off mid-sentence, a fragment that needs more context ("and then we", "but the problem is"), hesitation fillers ("uh", "um") \u2014 call `Hold` instead of answering. This keeps listening for the rest of their thought. Only respond with substance when you have a complete question or request.\nDispatch discipline: send ONE self-contained task per request \u2014 a single worker with the full brief beats several workers with fragments (each worker starts fresh and re-discovers context). NEVER dispatch a worker just to read files or gather information \u2014 workers explore and discover context themselves; pass on what you already know and let one worker do the whole job. Split into parallel tasks only when the user asks for genuinely independent things. When a task completes, report its result and stop \u2014 do NOT dispatch follow-up work (verification, polish, extras) the user did not ask for, unless the report itself signals failure or doubt.\nDo not fire a second Act/Think for work already in flight, and NEVER spawn a second task to re-count, cross-check, or verify a result a worker already gave you \u2014 trust its answer; a single question gets ONE task. Call `TaskStatus` at most ONCE per turn; if a task is still running, give one brief status aside and end the turn \u2014 never poll it again and again in a loop. "Still on it" is ONLY for a repeat check on a task you already acknowledged earlier \u2014 NEVER as the ack when you first dispatch work ("still" is wrong when nothing was running yet; use a fresh "on it"/"got it, checking" instead). Use `CancelTask` when the user asks to stop something.\nPRIORITY: when the user says goodbye or wants to end/finish/wrap up the session ("ok bye", "that\'s all", "let\'s finish", "let\'s end", "goodnight", "exit", "wrap up"), call `ExitSession` IMMEDIATELY \u2014 do not act, do not check status, just exit.\nFor TRIVIAL instant lookups only \u2014 current time, git branch, listing a folder, peeking at a small file, or checking your own `capabilities`/tools \u2014 use `QuickLook` (instant, no task). Whenever the user asks what you can do or whether you have some ability, QuickLook `capabilities` and answer from that \u2014 never guess. Anything requiring searching, reasoning, running commands, or editing goes through `Act`.\n{{MEMORY_SLOT}}\nUser messages may arrive via speech-to-text and can carry transcription artifacts \u2014 odd words, cut-offs, homophones ("for you" vs "folder"). Read for INTENT, not surface text. If a message seems garbled, surprising, or only half-parses, do NOT guess an action or improvise content from it \u2014 briefly confirm what they meant ("did you mean\u2026?") and wait. A one-line confirm beats a confident wrong answer or an invented response to a request you did not actually understand.';
+var THINK_GUIDANCE = "\u2022 `Think` \u2014 your brain. A premium reasoning model, FAR more expensive than Act. Reserve it for open-ended architecture/design questions, or a problem Act already FAILED at. ALL implementation work \u2014 coding, refactoring, debugging, edge cases, tests \u2014 goes to Act; Act is highly capable. Never send the same work to both.";
+var THINK_DISABLED_GUIDANCE = "(Think tier is not available \u2014 use Act for all escalations.)";
+var VOICE_STYLE_CONVERSATIONAL = `Speak like a person in a live conversation, not an assistant reading a script. React first, then deliver: a quick impulsive beat ("oh nice", "hmm, hold on", "ah, got it") before the substance. Use contractions always. Vary sentence length \u2014 some very short. Light fillers and backchannels are fine ("mm-hm", "right", "let's see") but at most one per reply \u2014 never stack them. When you escalate to Act or Think, say it like a human would ("hang on, let me actually dig into that \u2014 gimme a minute") instead of announcing a task. When a result comes back, react to it like you just found out ("okay so \u2014 turns out\u2026"). Match the user's energy: a quick question gets a quick answer \u2014 a few words is a perfectly good turn. Prefer a short answer plus an offer ("want the details?") over covering everything. Never narrate your own mechanics (no "I will now act", no task ids out loud).`;
+var EMOTION_TAGS_GUIDANCE = `EMOTION: your voice is synthesized with emotion control. Prefix a sentence with an inline [emotion] tag, placed directly before the sentence it colors, to shape how it is spoken. Use it ONLY when the emotion genuinely fits the words (it amplifies real feeling, it cannot fake it) \u2014 do not tag every sentence; reserve it for moments that carry feeling, and vary which one you use. You may also drop [laughter] for a natural laugh. Available emotions: ${EMOTIONS.join(", ")}.`;
+var DuplexAgent = class _DuplexAgent {
+  options;
+  voice;
+  tasks = /* @__PURE__ */ new Map();
+  queue = Promise.resolve();
+  seq = 0;
+  pendingEvents = [];
+  /** Spoken text of parked deliveries that have SETTLED, awaiting a trivial-barge resume decision on the
+   *  next turn (a substantive turn clears it — the result stays in the transcript, recoverable by asking). */
+  parkedRedeliver = [];
+  /** A trivial barge arrived while a parked delivery was STILL RUNNING → resume it the moment it settles. */
+  awaitTrivialRedeliver = false;
+  /** Set by a SUBSTANTIVE turn after a barge: the user moved on, so a parked delivery that settles LATER
+   *  must NOT arm a resume (else a much-later "go on" replays a stale result). Reset by a fresh barge. */
+  suppressParkedResume = false;
+  /** Out-of-band follow-up attribution for the events coalescing into the next flush turn: TRUE iff ≥1 of
+   *  the tasks being integrated was NON-CLEAN (early-stop/failure). Carried out-of-band on the enqueue call
+   *  by the caller that KNOWS the outcome — a plain boolean the MODEL CANNOT PERTURB. It is NOT scanned from
+   *  worker-authored event text (v1: an "Outcome:" substring over-stamped siblings) and NOT keyed on a brief
+   *  string the reflex re-authors (v2: a paraphrased escalation brief missed the Set → followUp:false →
+   *  RE-ENABLED unbounded auto-escalation, the dangerous runaway direction). See [[wrong-discriminator]] /
+   *  [[drive-real-reflex]] / [[fakeaiclient-blind-to-wire-format]]. */
+  pendingNonClean = false;
+  flushQueued = false;
+  /** Per-voice-turn guards (reset by resetTurn at each turn's start). The reflex is a weak model:
+   *  left unguarded it polls TaskStatus after a dispatch and/or dispatches silently (dead air).
+   *  Like CC's Task tool, a dispatch is "said my piece, now wait for the push" — these enforce that. */
+  turnDispatched = false;
+  // an Act/Think fired this turn
+  spokeBeforeDispatch = false;
+  // the reflex ALREADY acked before dispatching — the forced post-dispatch text step must stay silent (live: "Got it…" twice)
+  turnBriefs = /* @__PURE__ */ new Set();
+  // briefs dispatched this turn (detect identical re-dispatch)
+  spokeThisTurn = false;
+  // any non-empty text_delta streamed this turn
+  externalSpeech = false;
+  // host spoke on our behalf (adaptive micro-ack) — not reflex output
+  heldThisTurn = false;
+  // Hold called this turn → turn is INTENTIONALLY silent (suppress reflex text + no dead-air ack)
+  nudging = false;
+  // re-ack pass in flight: block ALL tools, prevent recursion
+  reflexBuf = "";
+  // accumulated reflex text this turn (fabricated-event detection)
+  reflexForwarded = 0;
+  // chars of reflexBuf already forwarded to the host/TTS
+  fabricationCut = false;
+  // reflex emitted a reserved [task …] marker → suppress its tail
+  /** TRUE for the duration of a re-voice turn that is integrating ≥1 NON-CLEAN task (turn-eligibility,
+   *  carried out-of-band — NOT derived from any worker/brief string). ANY Act/Think dispatched in such a
+   *  turn is stamped followUp:true. This GUARANTEES the dangerous direction is impossible: a genuine
+   *  escalation (even one with a paraphrased brief) ALWAYS lands in a non-clean integration turn, so it is
+   *  ALWAYS recognized as a follow-up and CANNOT re-escalate (one hop). The single-dispatch-per-turn guard
+   *  means at most one dispatch happens per flush, so realistically "the one dispatch IS the escalation".
+   *  ACCEPTED SAFE-DIRECTION ERROR: if the reflex instead dispatches FRESH unrelated work during a non-clean
+   *  flush (rare — and only possible when it batches multiple calls in one step, bypassing the guard), that
+   *  fresh task is over-stamped followUp:true and forgoes ONE future auto-escalation. That is SAFE (it only
+   *  ever REMOVES a future escalation, never adds one — no runaway) and is the correct side to err on. */
+  turnFollowUp = false;
+  /** Hard absolute backstop against runaway regardless of attribution: total automatic escalations across
+   *  the whole conversation. Once it hits MAX_AUTO_ESCALATIONS, no integration turn offers escalate/re-delegate. */
+  autoEscalations = 0;
+  static MAX_AUTO_ESCALATIONS = 8;
+  /** Parked worker questions awaiting a (voice-relayed) user answer, keyed by ask id. */
+  pendingAsks = /* @__PURE__ */ new Map();
+  /** SPECULATIVE REFLEX (VoiceEngine.onSpeculate → speculate()): the reflex turn starts on a stable
+   *  PARTIAL transcript, its spoken output buffered — nothing reaches TTS until the endpointed final
+   *  confirms via send() (which flushes the buffer and adopts the call as THE turn). A divergent final
+   *  aborts it: output dropped, history rolled back, the final dispatches normally. */
+  spec;
+  /** Aborted speculative calls (double-billing visibility — each one paid for tokens never spoken). */
+  speculativeAbortedCalls = 0;
+  /** Tools the reflex may execute on UNCONFIRMED (speculated) input — read-only lookups and the
+   *  intentionally-silent Hold. Anything else (Act/Think/AnswerTask/CancelTask/ExitSession/memory
+   *  writes/…) is a side effect on input the user may not have said: the guard ABORTS the speculation
+   *  instead (the endpointed final then dispatches normally and may use the tool for real). */
+  static SPEC_SAFE_TOOLS = /* @__PURE__ */ new Set(["QuickLook", "TaskStatus", "Hold"]);
+  /** Lazily resolved memory tools (async loadMemory runs in initMemory). */
+  memoryReady;
+  constructor(options) {
+    this.options = { ...new DuplexAgentOptions(), ...options };
+    const o = this.options;
+    if (o.memoryDir && o.fs) {
+      this.memoryReady = loadMemory(o.fs, o.memoryDir, { maxWritesPerSession: 10, userDir: o.memoryUserDir });
+    }
+    const memSlot = o.memoryDir && o.fs ? VOICE_MEMORY_PROMPT : "NEVER claim to have stored, saved, or remembered something durably \u2014 you cannot. Anything the user wants persisted (their name, preferences, notes) must go through Act so a worker writes it to memory.";
+    const thinkSlot = o.thinkModel !== false ? THINK_GUIDANCE : THINK_DISABLED_GUIDANCE;
+    const workerToolNames = (o.actOptions?.tools ?? []).map((t) => t.name);
+    const canSearch = workerToolNames.some((n) => /WebSearch/i.test(n));
+    const canFetch = workerToolNames.some((n) => /WebFetch/i.test(n));
+    const workerWeb = canSearch ? `, and it CAN search the web and read web pages \u2014 so when the user gives you something specific to look up ("search for X", "find me\u2026", "what's the latest on\u2026"), route it to Act. But a bare capability QUESTION like "can you search the web?" just gets a short spoken "yes, I can" \u2014 do NOT dispatch and NEVER invent a query the user did not give you` : canFetch ? ", and it can fetch a specific web page URL (but cannot search the web)" : "";
+    const mcpNames = [
+      ...Object.keys(o.actOptions?.providerOptions?.mcpServers ?? {}),
+      ...new Set(workerToolNames.filter((n) => n.startsWith("mcp__")).map((n) => n.slice(5).split("__")[0]))
+    ];
+    const workerMcp = mcpNames.length ? `, and it can use these MCP servers: ${[...new Set(mcpNames)].join(", ")}` + (mcpNames.some((n) => /browser/i.test(n)) ? ' \u2014 including driving a REAL browser (open tabs, navigate, click, screenshot), so answer "yes" if asked whether you can control/drive a browser and route an actual browse to Act' : "") : "";
+    const prompt = VOICE_SYSTEM_PROMPT.replace("{{MEMORY_SLOT}}", memSlot).replace("{{THINK_SLOT}}", thinkSlot).replace("{{WORKER_WEB}}", workerWeb + workerMcp) + (o.voiceStyle === "conversational" ? "\n" + VOICE_STYLE_CONVERSATIONAL : "") + (o.emotionTags ? "\n" + EMOTION_TAGS_GUIDANCE : "") + `
+${nowLine()}. Anchor every relative or time-sensitive reference \u2014 "today", "now", "current", "recent", "latest", "this year" \u2014 to THIS moment. When the user asks about something recent (news, sports, events), they mean near this date, not a well-known past instance; brief your worker with the current year so it searches for what is happening NOW, not a famous older event.`;
+    const tools = [
+      ...o.reflexOptions?.tools ?? [],
+      this.actTool(),
+      ...o.thinkModel !== false ? [this.thinkTool()] : [],
+      this.taskStatusTool(),
+      this.cancelTaskTool(),
+      this.quickLookTool(),
+      this.answerTaskTool(),
+      this.holdTool()
+    ];
+    const host = o.host;
+    const voiceHost = host && {
+      ask: host.ask ? (q) => host.ask(q) : void 0,
+      confirm: host.confirm ? (p, m) => host.confirm(p, m) : void 0,
+      notify: (ev) => {
+        if (ev?.kind === "text_delta" && typeof ev.message === "string") {
+          if (this.heldThisTurn) return;
+          if (this.fabricationCut) return;
+          if (this.turnDispatched && this.spokeBeforeDispatch) return;
+          const msg = ev.message;
+          this.reflexBuf += msg;
+          this.scrubStageDirections();
+          const m = this.reflexBuf.match(RESERVED_EVENT_MARKER) ?? this.reflexBuf.match(RESERVED_EVENT_OPENER);
+          if (m) {
+            this.fabricationCut = true;
+            log13.warn(`reflex fabricated a [task \u2026] event in its spoken stream \u2014 cutting it (kept ${m.index} chars)`);
+            const safe = this.reflexBuf.slice(this.reflexForwarded, m.index);
+            if (!safe) return;
+            if (safe.trim()) this.spokeThisTurn = true;
+            this.emitHost({ ...ev, message: safe });
+            return;
           }
-        } catch (e) {
-          return `lookup failed: ${e?.message ?? e}`;
+          const held = this.reflexBuf.length - this.reflexForwarded;
+          const partial = held > 0 && /\[\s*t?a?s?k?$/i.test(this.reflexBuf.slice(-Math.min(held, 6)));
+          let upto = partial ? this.reflexBuf.length - this.reflexBuf.slice(-6).match(/\[\s*t?a?s?k?$/i)[0].length : this.reflexBuf.length;
+          const paren = this.reflexBuf.lastIndexOf("(");
+          if (paren >= this.reflexForwarded && !this.reflexBuf.includes(")", paren) && this.reflexBuf.length - paren <= 80)
+            upto = Math.min(upto, paren);
+          const out = this.reflexBuf.slice(this.reflexForwarded, upto);
+          this.reflexForwarded = upto;
+          if (!out) return;
+          if (out.trim()) this.spokeThisTurn = true;
+          this.emitHost({ ...ev, message: out });
+          return;
         }
+        host.notify?.(ev);
       }
     };
+    this.voice = new Agent({
+      ai: o.ai,
+      fs: new MemFilesystem2(),
+      model: o.reflexModel,
+      stream: true,
+      host: voiceHost,
+      // The reflex IS the conversational channel — it confirms ambiguity inline ("did you mean…?"),
+      // never via the blocking AskUserQuestion tool (Agent auto-adds it whenever a host is set). Left in,
+      // it stalls a voice turn until the kill-switch. Worker questions still reach the user via parkQuestion.
+      askUserQuestion: false,
+      systemPrompt: prompt,
+      instructionFiles: false,
+      maxSteps: 8,
+      timeoutMs: 3e4,
+      ...o.reflexOptions,
+      tools,
+      // Composed AFTER the spread so the dispatch guard can't be dropped by reflexOptions.
+      hooks: composeHooks(this.dispatchGuard(), o.reflexOptions?.hooks)
+    });
   }
-  answerTaskTool() {
-    return {
-      name: "AnswerTask",
-      description: `Relay the user's answer to a pending question from a background task (the "[task <id> asks]" events). Pass the id from the event and the user's answer.`,
-      parameters: {
-        type: "object",
-        required: ["id", "answer"],
-        properties: { id: { type: "string" }, answer: { type: "string", description: "the user's answer, verbatim or faithfully summarized" } }
-      },
-      run: async ({ id, answer }) => {
-        const ask = this.pendingAsks.get(String(id));
-        if (!ask) return `No pending question for '${id}' \u2014 it may have been answered already or timed out.`;
-        ask.resolve(String(answer ?? ""));
-        return `Answer relayed \u2014 task ${id} resumes.`;
-      }
-    };
+  /** Resolve memory tools + inject index into voice system prompt (once). */
+  async initMemory() {
+    if (!this.memoryReady) return;
+    const mem = await this.memoryReady;
+    this.memoryReady = void 0;
+    this.voice.options.tools.push(...mem.tools);
+    if (mem.index) this.voice.options.systemPrompt += "\n\n" + mem.index;
   }
-  holdTool() {
+  /** Flush any held-back trailing fragment (a possible `[task` opener that never completed) once the
+   *  turn's stream is done — so a legit message ending in "[t" isn't silently dropped. */
+  flushHeldReflexTail() {
+    if (this.fabricationCut) return;
+    this.scrubStageDirections();
+    const tail = this.reflexBuf.slice(this.reflexForwarded);
+    this.reflexForwarded = this.reflexBuf.length;
+    if (!tail) return;
+    if (tail.trim()) this.spokeThisTurn = true;
+    this.emitHost({ kind: "text_delta", message: tail });
+  }
+  /** Remove complete stage-direction parentheticals from the UNFORWARDED reflex text (STAGE_DIRECTION_RE).
+   *  Only the unforwarded region is touched — already-spoken audio can't be unsent, and splicing before
+   *  reflexForwarded would corrupt the forward offset. */
+  scrubStageDirections() {
+    if (this.reflexForwarded >= this.reflexBuf.length) return;
+    const region = this.reflexBuf.slice(this.reflexForwarded);
+    const scrubbed = region.replace(/\([^()]*\)/g, (s) => STAGE_DIRECTION_RE.test(s) ? "" : s);
+    if (scrubbed !== region) this.reflexBuf = this.reflexBuf.slice(0, this.reflexForwarded) + scrubbed;
+  }
+  /** Clear the per-turn guards. Called at the head of every voice turn (user send + re-voice flush). */
+  resetTurn() {
+    this.turnDispatched = false;
+    this.spokeBeforeDispatch = false;
+    this.turnBriefs.clear();
+    this.spokeThisTurn = false;
+    this.externalSpeech = false;
+    this.heldThisTurn = false;
+    this.reflexBuf = "";
+    this.reflexForwarded = 0;
+    this.fabricationCut = false;
+    this.turnFollowUp = false;
+    this.voice.options.toolChoice = void 0;
+  }
+  /** preToolUse guard on the reflex: once it has dispatched this turn, a dispatch is "said my piece,
+   *  now wait for the push" (CC's Task model). Block the temptations — TaskStatus polling and identical
+   *  re-dispatch — so the only remaining move is to voice a short ack and end. A genuinely NEW Act is
+   *  still allowed (parallel independent work). During a re-ack pass, block every tool. */
+  dispatchGuard() {
     return {
-      name: "Hold",
-      description: 'The user seems mid-thought \u2014 hold the turn (stay listening) instead of answering. Optionally pass a short filler ("mhm", "go on") to speak while waiting. Use when the message sounds incomplete, trailing off, or like they paused to think.',
-      parameters: {
-        type: "object",
-        properties: {
-          filler: { type: "string", description: 'optional short filler to speak ("mhm", "go on", "mm-hm")' }
+      preToolUse: (call) => {
+        if (this.spec?.state === "pending" && !_DuplexAgent.SPEC_SAFE_TOOLS.has(call.name)) {
+          log13.verbose(`speculation aborted: reflex called ${call.name} on unconfirmed input`);
+          this.abortSpeculation();
+          return { block: true, reason: "Speculative turn aborted." };
         }
-      },
-      run: async ({ filler }) => {
-        this.heldThisTurn = true;
-        this.notify("hold_filler", filler ? String(filler) : "");
-        return "Holding \u2014 listening for the rest of the user's thought. Do not respond further this turn.";
+        if (this.nudging) return { block: true, reason: "Just say one short spoken acknowledgement \u2014 no tools this turn." };
+        if (!this.turnDispatched) return;
+        if (call.name === "TaskStatus")
+          return { block: true, reason: "You just dispatched a task this turn \u2014 do NOT poll. Give one short spoken acknowledgement and end your turn; the result arrives later as a [task \u2026] event." };
+        if ((call.name === "Act" || call.name === "Think") && this.turnBriefs.has(String(call.args?.brief ?? "")))
+          return { block: true, reason: "You already dispatched this exact task \u2014 acknowledge briefly and end your turn." };
       }
     };
   }
-  cancelTaskTool() {
-    return {
-      name: "CancelTask",
-      description: "Cancel a running background task by id.",
-      parameters: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
-      run: async ({ id }) => this.cancelTask(String(id))
-    };
+  /** The host spoke on this turn's behalf OUTSIDE the reflex stream (e.g. the voice engine's adaptive
+   *  micro-ack). For a DISPATCHED turn that's a sufficient ack (don't stack a second one); for an
+   *  inline turn whose reply came back empty it is NOT — "One sec." followed by permanent silence is
+   *  still dead air, so silentTurn ignores external speech unless work was dispatched. */
+  noteExternalSpeech() {
+    this.externalSpeech = true;
   }
-};
-
-// src/mcp.ts
-function toResult(result) {
-  if (result == null) return { text: "" };
-  if (typeof result === "string") return { text: result };
-  const content = result.content;
-  if (Array.isArray(content)) {
-    const texts = [];
-    const images = [];
-    for (const c of content) {
-      if (c?.type === "image" && typeof c.data === "string" && c.mimeType) {
-        images.push({ mimeType: c.mimeType, data: c.data });
-      } else if (typeof c?.text === "string") {
-        texts.push(c.text);
-      } else {
-        texts.push(JSON.stringify(c));
-      }
-    }
-    const text = texts.join("\n");
-    if (text || images.length) return { text, ...images.length ? { images } : {} };
+  /** True when the just-finished turn voiced NOTHING — dead air to repair. Two ways this happens:
+   *  (a) a dispatch with no spoken ack, and (b) an INLINE turn whose `final` channel came back empty —
+   *  gpt-oss harmony sometimes puts the whole reply in `analysis` (→ thinking_delta, suppressed in
+   *  voice) and emits an empty `final`, so no text_delta ever streams. Both ship silence; both repair.
+   *  Requires a host: without one there's no stream to detect speech on (and no one to speak to). */
+  get silentTurn() {
+    const ackedByHost = this.externalSpeech && this.turnDispatched;
+    return !!this.options.host && !this.spokeThisTurn && !ackedByHost && !this.heldThisTurn;
   }
-  return { text: JSON.stringify(result) };
-}
-function mcpToolToAgentTool(spec, callTool, prefix = "mcp__") {
-  return {
-    name: `${prefix}${spec.name}`,
-    description: spec.description ?? `MCP tool ${spec.name}`,
-    parameters: spec.inputSchema ?? { type: "object", properties: {} },
-    async run(args, _ctx) {
-      const r = toResult(await callTool(spec.name, args ?? {}));
-      return r.images?.length ? r : r.text;
+  /** A turn that voiced nothing is dead air. Re-prompt the reflex ONCE so the LLM itself voices a short
+   *  line (no template). If it STILL says nothing, fall back to a minimal line so silence never ships.
+   *  Wording adapts to whether work was dispatched (an ack) or the inline reply was simply lost. */
+  async ackIfSilent(fallback) {
+    const dispatched = this.turnDispatched;
+    this.nudging = true;
+    try {
+      await this.voice.send(fallback ? "[reminder] You said nothing to the user this turn. Tell them, in ONE short spoken sentence, what just happened \u2014 no tools." : dispatched ? "[reminder] You dispatched a task but said nothing to the user. Say ONE short spoken acknowledgement now \u2014 no tools." : "[reminder] You said nothing to the user this turn. Give your ONE short spoken reply now \u2014 no tools.");
+    } catch (e) {
+      log13.warn(`ack nudge failed: ${e instanceof Error ? e.message : e}`);
+    } finally {
+      this.nudging = false;
     }
-  };
-}
-function mcpToolsToAgentTools(specs, callTool, prefix = "mcp__", filter) {
-  return (filter ? specs.filter(filter) : specs).map((s) => mcpToolToAgentTool(s, callTool, prefix));
-}
-function describeSpec(s) {
-  const schema = s.inputSchema ? `
-   args: ${JSON.stringify(s.inputSchema)}` : "";
-  return `${s.name} \u2014 ${s.description ?? "(no description)"}${schema}`;
-}
-function makeMcpToolSearch(specs, callTool, options = {}) {
-  const maxResults = options.maxResults ?? 10;
-  const byName = new Map(specs.map((s) => [s.name, s]));
-  const catalogLine = `${specs.length} MCP tool(s) available \u2014 search by keyword, then call by exact name.`;
-  const searchTool = {
-    name: "ToolSearch",
-    description: `Search the available MCP tools by keyword (${catalogLine}). Returns matching tool names + their argument schemas; call one with \`McpCall\`.`,
-    parameters: { type: "object", required: ["query"], properties: { query: { type: "string", description: "keywords to match against tool name + description" } } },
-    async run({ query }) {
-      const q = String(query ?? "").trim();
-      if (!q) return catalogLine;
-      const { kept } = topByRelevance(specs, q, (s) => `${s.name} ${s.description ?? ""}`, maxResults);
-      if (!kept.length) return `(no MCP tool matches "${q}" \u2014 try broader keywords)`;
-      return kept.map(describeSpec).join("\n");
+    if (!this.spokeThisTurn) {
+      const pool = fallback ? [fallback] : dispatched ? _DuplexAgent.FALLBACK_ACKS : _DuplexAgent.FALLBACK_RETRY;
+      const fresh = pool.filter((p) => p !== this.lastFallback);
+      const line = (fresh.length ? fresh : pool)[Math.floor(Math.random() * (fresh.length || pool.length))];
+      this.lastFallback = line;
+      this.emitHost({ kind: "text_delta", message: line });
     }
-  };
-  const callMcpTool = {
-    name: "McpCall",
-    description: "Call an MCP tool discovered via `ToolSearch`, by its exact name. Pass its arguments as `args`.",
-    parameters: {
-      type: "object",
-      required: ["name"],
-      properties: {
-        name: { type: "string", description: "exact tool name from ToolSearch" },
-        args: { type: "object", description: "arguments object for the tool (per its schema)" }
-      }
-    },
-    async run({ name, args }) {
-      const n = String(name ?? "");
-      if (!byName.has(n)) return `Error: unknown MCP tool '${n}'. Use ToolSearch to find valid names.`;
-      const r = toResult(await callTool(n, args ?? {}));
-      return r.images?.length ? r : r.text;
+  }
+  /** Dead-air fallback pools (see ackIfSilent). Both retry lines keep the 'say that again' phrase —
+   *  hosts/tests key on it. */
+  static FALLBACK_ACKS = ["Okay, on it.", "On it.", "Alright, working on it."];
+  static FALLBACK_RETRY = ["Sorry, could you say that again?", "Hm, I missed that \u2014 could you say that again?"];
+  lastFallback = "";
+  /** One user turn: the voice agent streams the reply (and may Act/Think). Serialized with re-voice turns.
+   *  If a speculative reflex call is pending and this content CONFIRMS it (the final matches the
+   *  speculated partial), the in-flight call is adopted as THE turn: its buffered output flushes to the
+   *  host NOW (this is the latency win) and streaming continues live. Any other content aborts the
+   *  speculation first (rolled back silently) and runs a normal turn behind it. */
+  send(content) {
+    if (typeof content === "string" && isTrivialBarge(content) && this.hasParkedDelivery()) {
+      if (this.spec) this.abortSpeculation();
+      return this.enqueue(async () => {
+        this.resetTurn();
+        if (!this.redeliverParked()) this.awaitTrivialRedeliver = true;
+        return { text: "", steps: 0, finishReason: "stop", messages: [] };
+      });
     }
-  };
-  return [searchTool, callMcpTool];
-}
-function buildMcpCatalog(servers) {
-  const specs = [];
-  const routes = /* @__PURE__ */ new Map();
-  for (const m of servers) {
-    for (const s of m.specs) {
-      const base = `mcp__${m.name}__${s.name}`.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 128);
-      let display = base;
-      for (let i = 2; routes.has(display); i++) display = `${base.slice(0, 128 - String(i).length - 1)}_${i}`;
-      specs.push({ name: display, description: s.description, inputSchema: s.inputSchema });
-      routes.set(display, { server: m.name, rawName: s.name });
+    const spec = this.spec;
+    if (spec?.state === "pending") {
+      if (typeof content === "string" && speculationConfirms(spec.text, content)) {
+        spec.state = "confirmed";
+        spec.finalText = content;
+        for (const ev of spec.buf.splice(0)) this.options.host?.notify?.(ev);
+        spec.decide("confirm");
+        this.notify("diag", "speculation_confirmed", { text: spec.text.slice(0, 80) });
+        return spec.done;
+      }
+      this.abortSpeculation();
     }
+    return this.enqueue(async () => {
+      await this.initMemory();
+      this.resetTurn();
+      this.awaitTrivialRedeliver = false;
+      this.parkedRedeliver = [];
+      this.suppressParkedResume = true;
+      const res = await this.voice.send(content);
+      this.flushHeldReflexTail();
+      if (this.silentTurn) await this.ackIfSilent();
+      return res;
+    });
   }
-  return { specs, routes };
-}
-function searchOverCatalog(servers, specs, routes, resolve, options) {
-  const tools = specs.length ? makeMcpToolSearch(specs, (name, args) => {
-    const r = routes.get(name);
-    if (!r) throw new Error(`unknown MCP tool '${name}' \u2014 use ToolSearch to find valid names`);
-    return resolve(r.server, r.rawName, args ?? {});
-  }, options) : [];
-  return { tools, serverNames: servers, toolCount: specs.length };
-}
-function makeMcpToolSearchFromMounted(mounted, options) {
-  const { specs, routes } = buildMcpCatalog(mounted);
-  const byName = new Map(mounted.map((m) => [m.name, m]));
-  return searchOverCatalog(mounted.map((m) => m.name), specs, routes, (server, rawName, args) => byName.get(server).client.callTool(rawName, args), options);
-}
-function makeLazyMcpToolSearch(servers, resolve, options) {
-  const { specs, routes } = buildMcpCatalog(servers);
-  return searchOverCatalog(servers.map((s) => s.name), specs, routes, resolve, options);
-}
-
-// src/hooks.ts
-var RecordingHooks = class {
-  /** tool name -> reason; a matching preToolUse call is blocked with that reason. */
-  constructor(blocks = {}) {
-    this.blocks = blocks;
+  /** Start a HELD speculative reflex turn on a stable partial (VoiceEngine.onSpeculate). Its spoken
+   *  output buffers in emitHost; send() later confirms (flush + adopt) or aborts it. The turn holds the
+   *  voice mutex until that decision (bounded by a safety timeout), so no other turn can interleave
+   *  into the transcript between the speculative messages and their rollback. No-op if a speculation
+   *  is already in flight. */
+  speculate(text) {
+    if (!text.trim() || this.spec) return;
+    let decide;
+    const decision = new Promise((r) => {
+      decide = r;
+    });
+    const spec = {
+      text,
+      state: "pending",
+      buf: [],
+      ctl: new AbortController(),
+      decide,
+      decision,
+      done: void 0
+    };
+    this.spec = spec;
+    spec.done = this.enqueue(async () => {
+      const empty = { text: "", steps: 0, finishReason: "aborted", messages: this.voice.transcript };
+      if (spec.state === "aborted") {
+        this.speculativeAbortedCalls++;
+        if (this.spec === spec) this.spec = void 0;
+        return empty;
+      }
+      await this.initMemory();
+      this.resetTurn();
+      const base = this.voice.transcript.length;
+      const prevSignal = this.voice.options.signal;
+      this.voice.options.signal = spec.ctl.signal;
+      let res;
+      try {
+        res = await this.voice.send(spec.text);
+      } catch (e) {
+        log13.warn(`speculative turn failed: ${e instanceof Error ? e.message : e}`);
+      } finally {
+        this.voice.options.signal = prevSignal;
+      }
+      const timer = setTimeout(() => {
+        spec.state = spec.state === "pending" ? "aborted" : spec.state;
+        spec.decide("abort");
+      }, 1e4);
+      timer.unref?.();
+      const d = await spec.decision;
+      clearTimeout(timer);
+      if (d === "abort") {
+        if (this.voice.transcript.length > base) this.voice.transcript.length = base;
+        this.speculativeAbortedCalls++;
+        log13.verbose(`speculation aborted (${this.speculativeAbortedCalls} total): "${spec.text.slice(0, 50)}"`);
+        if (this.spec === spec) this.spec = void 0;
+        return res ?? empty;
+      }
+      for (let i = base; i < this.voice.transcript.length; i++) {
+        const m = this.voice.transcript[i];
+        if (m.role === "user" && contentText(m.content) === spec.text) {
+          m.content = spec.finalText;
+          break;
+        }
+      }
+      this.spec = void 0;
+      this.flushHeldReflexTail();
+      if (this.silentTurn) await this.ackIfSilent();
+      return res ?? empty;
+    });
   }
-  blocks;
-  pre = [];
-  post = [];
-  outputs = [];
-  stops = [];
-  preToolUse(call, meta) {
-    this.pre.push({ call, meta });
-    const reason = this.blocks[call.name];
-    if (reason != null) return { block: true, reason };
+  /** Abort a pending speculation (idempotent): kill the in-flight call, drop its buffered output.
+   *  Called on divergence (send), a stale partial (VoiceEngine.onSpeculateAbort), a side-effect tool
+   *  attempt (dispatchGuard), or host paths that will never dispatch a final (commands, voice-off). */
+  abortSpeculation() {
+    const spec = this.spec;
+    if (spec?.state !== "pending") return;
+    spec.state = "aborted";
+    spec.buf.length = 0;
+    spec.ctl.abort();
+    spec.decide("abort");
+    this.notify("diag", "speculation_aborted", { text: spec.text.slice(0, 80) });
   }
-  postToolUse(call, result, meta) {
-    this.post.push({ call, result, meta });
+  /** Cancel a running background task — shared by the CancelTask tool and the CLI /tasks picker. */
+  cancelTask(id) {
+    const rec = this.tasks.get(id);
+    if (!rec) return `No task '${id}'.`;
+    if (rec.status !== "running") return `Task ${rec.id} is already ${rec.status}.`;
+    rec.status = "cancelled";
+    rec.controller.abort();
+    return `Task ${rec.id} (${rec.label}) cancelled.`;
   }
-  onToolOutput(call, chunk, meta) {
-    this.outputs.push({ call, chunk, meta });
+  /** Barge-in: the user took the floor while task(s) were running. Suppress those tasks' remaining SPOKEN
+   *  delivery so a superseded topic never talks over the new one (the debt-after-jokes regression). The
+   *  tasks keep running and still fold their result into the transcript — recoverable, just not spoken.
+   *  Returns the parked ids (for logging). Does NOT cancel: that's a deliberate reflex/user action. */
+  parkInFlightDeliveries() {
+    this.suppressParkedResume = false;
+    const parked = [];
+    for (const rec of this.tasks.values())
+      if (rec.status === "running" && !rec.deliveryParked) {
+        rec.deliveryParked = true;
+        parked.push(rec.id);
+      }
+    return parked;
   }
-  onStop(finalText) {
-    this.stops.push(finalText);
+  /** True while there is a parked delivery to potentially resume: either one already settled (queued) or
+   *  one still running that was parked by a barge. */
+  hasParkedDelivery() {
+    return this.parkedRedeliver.length > 0 || [...this.tasks.values()].some((t) => t.status === "running" && t.deliveryParked);
   }
-};
-var RecordingLifecycle = class {
-  /** @param startContext injected at session start; @param rewrite maps a submitted prompt to a new one. */
-  constructor(startContext, rewrite) {
-    this.startContext = startContext;
-    this.rewrite = rewrite;
+  /** Speak any settled-and-queued parked delivery now (trivial-barge resume). Returns false if nothing was
+   *  queued yet (the caller then arms awaitTrivialRedeliver so the task resumes the instant it settles). */
+  redeliverParked() {
+    if (!this.parkedRedeliver.length) return false;
+    const text = this.parkedRedeliver.splice(0).join(" ").trim();
+    if (text) {
+      this.options.host?.notify?.({ kind: "speak_utterance", message: text });
+      this.notify("diag", "parked_redelivered", { chars: text.length });
+    }
+    return true;
   }
-  startContext;
-  rewrite;
-  starts = 0;
-  prompts = [];
-  compactions = [];
-  subagentStops = [];
-  onSessionStart() {
-    this.starts++;
-    return this.startContext;
+  /** Resolve when all queued voice turns AND all in-flight worker tasks have settled (tests, graceful shutdown). */
+  async idle() {
+    while (true) {
+      const q = this.queue;
+      await q.catch(() => {
+      });
+      await Promise.all([...this.tasks.values()].map((t) => t.promise));
+      if (this.queue === q && ![...this.tasks.values()].some((t) => t.status === "running")) return;
+    }
   }
-  onUserPromptSubmit(text) {
-    this.prompts.push(text);
-    return this.rewrite?.(text);
+  /** Promise-chain mutex: turns run strictly one at a time; a failed turn doesn't poison the chain. */
+  enqueue(fn) {
+    const run = this.queue.then(fn, fn);
+    this.queue = run.then(() => {
+    }, () => {
+    });
+    return run;
   }
-  onPreCompact(messages) {
-    this.compactions.push(messages.length);
+  notify(kind, message, data) {
+    this.emitHost({ kind, message, data });
   }
-  onSubagentStop(summary, info) {
-    this.subagentStops.push({ summary, label: info?.label });
+  /** Host-boundary emit for the reflex's spoken channel: during a PENDING speculation, text_delta and
+   *  hold_filler are BUFFERED (nothing may reach TTS on unconfirmed input); confirm flushes them in
+   *  order, abort drops them silently. Everything else (task_* lifecycle, worker speak_utterance —
+   *  which bypasses this via host.notify directly) passes through untouched. */
+  emitHost(ev) {
+    const spec = this.spec;
+    if (spec && (ev.kind === "text_delta" || ev.kind === "hold_filler")) {
+      if (spec.state === "pending") {
+        spec.buf.push(ev);
+        return;
+      }
+      if (spec.state === "aborted") return;
+    }
+    this.options.host?.notify?.(ev);
   }
-};
-
-// src/index.ts
-init_logging();
+  /** Queue a `[task …]` event for re-voicing. Events arriving while the voice is busy coalesce into ONE turn.
+   *  `nonClean` (out-of-band boolean, set by the caller that KNOWS this event integrates a NON-CLEAN outcome)
+   *  marks the coalesced flush as a non-clean integration turn — turn-eligibility, never inferred from event
+   *  text and never keyed on a (re-authored) brief string. Any dispatch in such a turn is a follow-up. */
+  queueRevoice(event, nonClean = false) {
+    this.pendingEvents.push(event);
+    if (nonClean) this.pendingNonClean = true;
+    if (this.flushQueued) return;
+    this.flushQueued = true;
+    void this.enqueue(async () => {
+      this.flushQueued = false;
+      const events = this.pendingEvents.splice(0);
+      const nonCleanTurn = this.pendingNonClean;
+      this.pendingNonClean = false;
+      if (!events.length) return;
+      const failed = events.find((e) => /^\[task\b[^\]\n]*\bfailed\b/i.test(e));
+      this.resetTurn();
+      this.turnFollowUp = nonCleanTurn;
+      await this.voice.send(events.join("\n"));
+      this.flushHeldReflexTail();
+      if (this.silentTurn) await this.ackIfSilent(failed ? "Sorry, that didn't work \u2014 the task failed." : void 0);
+      this.notify("revoice_done", "");
+    });
+  }
+  /** The worker's brief: the Act/Think args + a STATIC text snapshot of the recent conversation.
+   *  Act briefs get a self-verify footer — the worker's report is trusted without review, so it
+   *  must check its own work before reporting (nearly free under prompt caching; measured honest:
+   *  it does NOT fix one-shot logic bugs — see mind/10). Think tasks are pure reasoning — no footer. */
+  buildBrief(brief, tier = "act", deliver = true) {
+    const recent = this.voice.transcript.filter((m) => (m.role === "user" || m.role === "assistant") && contentText(m.content).trim()).slice(-this.options.excerptTurns).map((m) => `${m.role}: ${contentText(m.content)}`).join("\n");
+    const verify = tier === "act" ? "\n\nBefore reporting done: re-read what you changed and check it against EVERY requirement above \u2014 fix any gap first. Your report is trusted without review." : "";
+    const deliverContract = deliver ? `
 
-// src/voice/soniox.ts
-init_logging();
+## DELIVER (spoken delivery)
+You are reporting back to a user who is LISTENING. Stream your work normally \u2014 your prose is the written work record and detail, and is NOT spoken. Wrap anything the user should HEAR in <spoken>\u2026</spoken> tags. LEAD WITH the actual content they asked for: if they asked for a specific piece of content \u2014 a value, a name, the actual lines, the writing itself \u2014 that content goes INSIDE the <spoken> tags, not a remark about it. Your FIRST <spoken> segment is substantive \u2014 never a greeting or an acknowledgement (the front-end has already acked; do not double-ack). Keep spoken text concise and natural for the ear: short sentences, no markdown. NEVER enumerate in speech \u2014 no numbered or bulleted lists ("One. \u2026 Two. \u2026" is robotic). Deliver multiple items as flowing conversation with brief connective phrasing ("here's one\u2026", "and another\u2026", "oh, and\u2026"), pausing between items with sentence breaks, not numbers.` + (this.options.emotionTags ? " Inside <spoken>, you may prefix a sentence with an inline [emotion] tag (e.g. [excited], [curious]) to color how it is voiced \u2014 only when it genuinely fits, and vary it; [laughter] gives a natural laugh." : "") : "";
+    return `${nowLine()}.
 
-// src/voice/types.ts
-var STT_SAMPLE_RATE = 16e3;
-var TTS_SAMPLE_RATE = 44100;
-async function resolveAuth(auth) {
-  return typeof auth === "function" ? await auth() : auth;
-}
+` + (recent ? `${brief}
 
-// src/voice/soniox.ts
-var log12 = forComponent("SonioxSTT");
-var now = () => performance.now();
-var SonioxSTTOptions = class {
-  auth = "";
-  source;
-  model = "stt-rt-preview";
-  languageHints = ["en"];
-  /** Client-side endpoint: finalized text + no new tokens for this long = utterance (don't wait for
-   *  Soniox's semantic <end>, which adds 0.5-1.5s — the difference between ping-pong and lag). */
-  silenceEndpointMs = 500;
-  /** No-audio watchdog: if the mic source stops delivering chunks for this long, capture is dead →
-   *  fire onFatal + stop (else Soniox idle-timeouts and reconnect-loops forever). 0 = disable. */
-  noAudioTimeoutMs = 1e4;
-};
-var SonioxSTT = class {
-  options;
-  ws;
-  stopped = false;
-  sourceStarted = false;
-  onPartial = () => {
-  };
-  onUtterance = () => {
-  };
-  /** mic energy (RMS) per chunk — drives the energy-based heuristic barge-in tier */
-  onLevel = () => {
-  };
-  /** Unrecoverable: the mic source stopped delivering audio (Soniox starves → idle-timeout reconnect
-   *  loop). The host tears voice down instead of spinning forever. */
-  onFatal = () => {
-  };
-  /** Diagnostic tap (provider errors, ws reconnects, no-audio watchdog). Fire-and-forget: a throwing
-   *  handler disables itself — never affects transcription. Wired by VoiceIO / the lab bridge. */
-  onDiag = () => {
-  };
-  diagOn = true;
-  diag(kind, fields) {
-    if (!this.diagOn) return;
-    try {
-      this.onDiag({ t: now(), kind, ...fields });
-    } catch (e) {
-      this.diagOn = false;
-      log12.debug(`onDiag threw \u2014 STT diagnostics disabled: ${e instanceof Error ? e.message : e}`);
-    }
-  }
-  lastChunkAt = 0;
-  // timestamp of the most recent mic chunk (0 = none yet)
-  startedChunksAt = 0;
-  // when capture started (grace before the first chunk)
-  noAudioTimer = null;
-  finalText = "";
-  partialText = "";
-  lastChangeAt = 0;
-  lastCombined = "";
-  endpointTimer = null;
-  firstTokenAt = 0;
-  // first speech token in current utterance
-  constructor(options) {
-    this.options = { ...new SonioxSTTOptions(), ...options };
+## Recent conversation (for context)
+${recent}` : brief) + verify + deliverContract;
   }
-  get usingAec() {
-    return this.options.source?.aec ?? false;
+  /** Spawn a detached worker for task `id`; its settlement notifies + enqueues the re-voice turn. */
+  spawnWorker(id, label, briefText, tier, brief, followUp) {
+    const o = this.options;
+    const tierOpts = tier === "think" ? o.thinkOptions : o.actOptions;
+    const tierModel = tier === "think" ? o.thinkModel : o.actModel;
+    const controller = new AbortController();
+    const base = tierOpts?.hooks ?? o.actOptions?.hooks;
+    const report = o.progressUpdates ? this.progressReporter(id) : void 0;
+    const tail = [];
+    const pushTail = (line) => {
+      tail.push(line.slice(0, 200));
+      if (tail.length > 120) tail.splice(0, tail.length - 120);
+    };
+    const hooks = {
+      ...base,
+      preToolUse: async (call, meta) => {
+        const d = await base?.preToolUse?.(call, meta);
+        pushTail(`\u2699 ${describeCall(call)}`);
+        report?.pre(call);
+        return d;
+      },
+      postToolUse: async (call, result, meta) => {
+        await base?.postToolUse?.(call, result, meta);
+        const last = result?.trim().split("\n").filter(Boolean).pop();
+        if (last) pushTail(`  \u21B3 ${last}`);
+        report?.post(call);
+      },
+      onToolOutput: (call, chunk, meta) => {
+        base?.onToolOutput?.(call, chunk, meta);
+        report?.output(chunk);
+      }
+    };
+    const relayAsk = async (q) => {
+      const opts = q.options?.length ? ` Options: ${q.options.map((x) => x.label).join(", ")}.` : "";
+      const a = await this.parkQuestion(id, `${q.question}${opts}`);
+      return a || "(no answer from the user \u2014 use your best judgment and note the assumption)";
+    };
+    const splitter = new SpokenSplitter();
+    const speak = (seg) => {
+      if (!seg) return;
+      const r = this.tasks.get(id);
+      if (r) r.spokenText = (r.spokenText ? r.spokenText + " " : "") + seg;
+      if (!r?.deliveryParked) o.host?.notify?.({ kind: "speak_utterance", message: seg });
+    };
+    const coalescer = new SentenceCoalescer();
+    const feedSpoken = (s) => {
+      const ready = coalescer.feed(s);
+      if (ready) speak(ready);
+    };
+    const flushSpoken = () => speak(coalescer.flush());
+    const askBridge = o.askRelay ? { ask: relayAsk } : o.host?.ask ? { ask: (q) => o.host.ask(q) } : {};
+    const workerHost = {
+      ...askBridge,
+      notify: (ev) => {
+        if (ev?.kind === "text_delta" && typeof ev.message === "string") {
+          const { spoken, detail } = splitter.feed(ev.message);
+          feedSpoken(spoken);
+          if (detail.trim()) pushTail(detail.trim());
+          return;
+        }
+      }
+    };
+    const agentOpts = {
+      ai: o.ai,
+      fs: o.fs,
+      model: tierModel,
+      ...tier === "think" ? { reasoning: tierOpts?.reasoning ?? "high" } : {},
+      ...tierOpts,
+      // Recompute providerOptions for THIS worker's model (after tierOpts so it wins over any inherited
+      // main-template value) — prevents cursor-only cwd/cursorSession leaking onto an anthropic worker.
+      providerOptions: o.providerOptionsFor?.(tierModel),
+      stream: true,
+      // worker streams text_delta so the splitter can extract <spoken> live (after tierOpts: never overridden off)
+      host: workerHost,
+      // carries BOTH ask AND the <spoken>-splitting notify
+      ...hooks ? { hooks } : {},
+      signal: controller.signal
+      // shared with the checker so a cancel tears down both
+    };
+    const promise = new Agent(agentOpts).run(briefText).then((res) => {
+      const { spoken, detail } = splitter.flush();
+      feedSpoken(spoken);
+      if (detail.trim()) pushTail(detail.trim());
+      flushSpoken();
+      return res;
+    }).then((res) => this.maybeVerify(id, brief, res, tier, agentOpts, askBridge)).then((res) => this.onWorkerSettled(id, res)).catch((err) => this.onWorkerFailed(id, err));
+    this.tasks.set(id, { id, label, status: "running", controller, promise, tail, brief, followUp, splitter });
+    if (this.tasks.size > this.options.maxTaskRecords)
+      for (const [tid, rec] of this.tasks) {
+        if (this.tasks.size <= this.options.maxTaskRecords) break;
+        if (rec.status !== "running") this.tasks.delete(tid);
+      }
   }
-  async connectWs() {
-    const apiKey = await resolveAuth(this.options.auth);
-    this.ws = new WebSocket("wss://stt-rt.soniox.com/transcribe-websocket");
-    await new Promise((res, rej) => {
-      this.ws.onopen = () => res();
-      this.ws.onerror = (e) => rej(new Error(`soniox ws: ${e.message || "connect failed"}`));
-    });
-    this.ws.send(
-      JSON.stringify({
-        api_key: apiKey,
-        model: this.options.model,
-        audio_format: "pcm_s16le",
-        sample_rate: STT_SAMPLE_RATE,
-        num_channels: 1,
-        language_hints: this.options.languageHints,
-        enable_endpoint_detection: true
-      })
-    );
-    this.ws.onmessage = (ev) => this.handle(JSON.parse(String(ev.data)));
-    this.ws.onclose = (ev) => {
-      if (this.stopped) return;
-      log12.warn(`soniox ws closed (${ev.code} ${ev.reason || ""}) \u2014 reconnecting`);
-      this.diag("stt_ws_closed", { code: ev.code, reason: String(ev.reason || ""), reconnecting: true });
-      this.reset();
-      this.connectWs().catch((e) => {
-        log12.error(`soniox reconnect failed: ${e.message}`);
-        this.diag("stt_reconnect_failed", { message: e.message });
-      });
+  /** Fresh-context check of a successful Act task: a NEW agent (same model/fs/tools, but NO shared
+   *  conversation context) re-reads the file state against the brief and fixes any gap. The fix lands
+   *  on the shared fs automatically (workers write fs directly, no overlay), so grading sees the
+   *  corrected state. Bounded to ONE pass. Off unless `verifyActTasks`; never runs for think/failed/
+   *  cancelled tasks. Usage is merged so /cost reflects the real (worker + checker) spend. */
+  async maybeVerify(id, brief, res, tier, agentOpts, askBridge) {
+    if (!this.options.verifyActTasks || tier !== "act" || res.finishReason !== "stop") return res;
+    if (this.tasks.get(id)?.status === "cancelled") return res;
+    const { stream: _stream, host: _host, ...restOpts } = agentOpts;
+    const checkerOpts = {
+      ...restOpts,
+      ...askBridge.ask ? { host: { ask: askBridge.ask } } : {}
     };
-  }
-  async start() {
-    await this.connectWs();
-    if (this.sourceStarted) return;
-    this.sourceStarted = true;
-    this.endpointTimer = setInterval(() => {
-      const combined = (this.finalText + this.partialText).trim();
-      if (!combined || now() - this.lastChangeAt < this.options.silenceEndpointMs) return;
-      if (this.firstTokenAt) log12.debug(`stt: ${Math.round(now() - this.firstTokenAt)}ms first-token\u2192silence-endpoint, "${combined.slice(0, 60)}"`);
-      this.reset();
-      this.onUtterance(combined, now());
-    }, 120);
-    this.endpointTimer.unref?.();
-    this.startedChunksAt = now();
-    const noAudioMs = this.options.noAudioTimeoutMs;
-    if (noAudioMs > 0) {
-      this.noAudioTimer = setInterval(() => {
-        if (this.stopped) return;
-        const ref = this.lastChunkAt || this.startedChunksAt;
-        if (now() - ref > noAudioMs) {
-          log12.error(`stt: no mic audio for >${Math.round(noAudioMs / 1e3)}s \u2014 capture device stopped delivering`);
-          this.diag("stt_watchdog_fatal", { noAudioMs });
-          this.onFatal("microphone stopped delivering audio (try a different input device, e.g. AirPods, or check System Settings \u2192 Sound \u2192 Input)");
-          this.stop();
-        }
-      }, Math.max(250, Math.min(2e3, noAudioMs / 4)));
-      this.noAudioTimer.unref?.();
+    const checkBrief = `${this.buildBrief(brief, tier, false)}
+
+## VERIFY MODE
+Another agent just implemented the above. Independently check the CURRENT state of the files against EVERY requirement. Fix any gap you find. If everything is already correct, make NO changes \u2014 do not refactor or improve \u2014 and report "verified".`;
+    this.notify("task_verify", `task ${id}: verifying`, { id });
+    const cres = await new Agent(checkerOpts).run(checkBrief);
+    if (cres.finishReason !== "stop") {
+      log13.warn(`task ${id}: verify inconclusive (${cres.finishReason})`);
+      this.notify("task_verify", `task ${id}: verify inconclusive (${cres.finishReason})`, { id, finishReason: cres.finishReason });
     }
-    await this.options.source.start((chunk) => {
-      this.lastChunkAt = now();
-      let sum = 0;
-      const view = new DataView(chunk.buffer, chunk.byteOffset, chunk.byteLength);
-      for (let i = 0; i + 1 < chunk.byteLength; i += 2) {
-        const v = view.getInt16(i, true);
-        sum += v * v;
+    const sum = (a = 0, b = 0) => a + b;
+    return {
+      ...res,
+      steps: res.steps + cres.steps,
+      // Merge the checker's messages so downstream tool-call/step accounting includes BOTH agents
+      // (else a verified task's toolCalls would undercount vs its steps/usage).
+      messages: [...res.messages, ...cres.messages],
+      usageEstimated: res.usageEstimated || cres.usageEstimated,
+      usage: res.usage && cres.usage ? {
+        promptTokens: sum(res.usage.promptTokens, cres.usage.promptTokens),
+        completionTokens: sum(res.usage.completionTokens, cres.usage.completionTokens),
+        totalTokens: sum(res.usage.totalTokens, cres.usage.totalTokens),
+        cacheCreationTokens: sum(res.usage.cacheCreationTokens, cres.usage.cacheCreationTokens),
+        cacheReadTokens: sum(res.usage.cacheReadTokens, cres.usage.cacheReadTokens)
+      } : res.usage ?? cres.usage
+    };
+  }
+  /** Throttled per-task progress: worker tool calls → at most one progress re-voice per interval.
+   *  Two sources, one throttle: completed steps (post) and a heartbeat for a SINGLE long tool call
+   *  (pre records the in-flight call; a self-cleaning timer narrates "still inside Bash — 70s").
+   *  Completion supersedes: nothing is emitted once the task has settled. */
+  progressReporter(id) {
+    let lastAt = Date.now();
+    let steps = 0;
+    let inflight = null;
+    const due = () => {
+      if (this.pendingAsks.size) return void 0;
+      const rec = this.tasks.get(id);
+      return rec && rec.status === "running" && Date.now() - lastAt >= this.options.progressIntervalMs ? rec : void 0;
+    };
+    const emit = (rec, line, call) => {
+      lastAt = Date.now();
+      this.notify("task_progress", `task ${id} (${rec.label}): ${line}`, { id, steps, call: call.name });
+      this.queueRevoice(`[task ${id} progress] ${line}`);
+    };
+    const timer = setInterval(() => {
+      const rec = this.tasks.get(id);
+      if (!rec || rec.status !== "running") return clearInterval(timer);
+      if (!inflight || !due()) return;
+      const last = inflight.tail.trim().split("\n").filter(Boolean).pop()?.slice(-80);
+      emit(rec, `still inside ${describeCall(inflight.call)} \u2014 ${Math.round((Date.now() - inflight.at) / 1e3)}s on this step${last ? `, last output: ${last}` : ""}`, inflight.call);
+    }, Math.max(this.options.progressIntervalMs, 250));
+    timer.unref?.();
+    return {
+      pre: (call) => {
+        inflight = { call, at: Date.now(), tail: "" };
+      },
+      output: (chunk) => {
+        if (inflight) inflight.tail = (inflight.tail + chunk).slice(-500);
+      },
+      // digest only — NEVER re-voices directly
+      post: (call) => {
+        steps++;
+        inflight = null;
+        const rec = due();
+        if (rec) emit(rec, `still running \u2014 ${steps} steps so far, now: ${describeCall(call)}`, call);
       }
-      this.onLevel(Math.sqrt(sum / (chunk.byteLength / 2)));
-      if (this.ws.readyState === WebSocket.OPEN) this.ws.send(chunk);
+    };
+  }
+  /** Park a question under `askId` (a task id, or any unique key for permission asks): re-voices
+   *  '[task <id> asks] …' and resolves with the user's answer via AnswerTask — or '' on timeout/
+   *  task settle (callers map '' to deny / best-judgment). Workers never block forever. */
+  parkQuestion(askId, question) {
+    return new Promise((resolve) => {
+      let settled = false;
+      const finish = (answer) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        this.pendingAsks.delete(askId);
+        resolve(answer);
+      };
+      const timer = setTimeout(() => {
+        this.notify("task_ask_timeout", `task ${askId}: question timed out \u2014 proceeding without an answer`);
+        finish("");
+      }, this.options.askTimeoutMs);
+      this.pendingAsks.set(askId, { question, resolve: finish });
+      this.notify("task_ask", `task ${askId} asks: ${question}`, { id: askId, question });
+      this.queueRevoice(`[task ${askId} asks] ${question}
+(Relay this to the user in your own words. When they answer, call AnswerTask with id "${askId}" and their answer.)`);
     });
   }
-  handle(m) {
-    if (m.error_message) {
-      this.diag("stt_error", { message: String(m.error_message), code: m.error_code });
-      return log12.error(`soniox: ${m.error_message}`);
-    }
-    let endpoint = false;
-    for (const t of m.tokens ?? []) {
-      if (t.text === "<end>") endpoint = true;
-      else if (t.is_final) this.finalText += t.text;
+  /** Resolve any question a settling/cancelled task left parked (its answer can no longer matter). */
+  dropAsk(id) {
+    this.pendingAsks.get(id)?.resolve("");
+  }
+  /** Build the INTEGRATION TURN prompt for a NON-CLEAN settled worker (early stop / failure). A clean
+   *  success never reaches here — it streams its own `<spoken>` delivery during the run. For a partial
+   *  or failed result the outcome re-enters the reflex as a decision (like a tool_result flowing back
+   *  into a normal agent loop): the reflex evaluates the outcome against the original intent and chooses
+   *  what to do next.
+   *
+   *  Decision branches (the reflex acts on them with EXISTING tools — no new surface):
+   *    • accept     → SPEAK the (partial) result plainly — don't dress a failure up as success.
+   *    • escalate   → call `Think` with the SAME brief — only when Act failed/stalled AND a Think tier
+   *                   exists AND this task wasn't already a follow-up (one hop max). Wires the dead
+   *                   "Reserve Think for a problem Act already FAILED at" promise.
+   *    • re-delegate→ call `Act` with a CORRECTED brief — for a recoverable error / partial result.
+   *    • ask        → ask the user ONE concrete question if genuinely blocked.
+   *
+   *  Keeps the `[task <id> completed]` / `[task <id> failed]` opener so existing coalescing + the
+   *  failed-revoice fallback still fire, and the per-event transcript markers stay intact. */
+  integrationPrompt(rec, outcome, body, finishReason) {
+    const opener = outcome === "error" ? `[task ${rec.id} failed]` : `[task ${rec.id} completed]`;
+    const underCap = this.autoEscalations < _DuplexAgent.MAX_AUTO_ESCALATIONS;
+    const canEscalate = (outcome === "error" || outcome === "incomplete") && underCap;
+    const hasThink = this.options.thinkModel !== false;
+    const options = [];
+    if (!rec.followUp && canEscalate && hasThink)
+      options.push("ESCALATE to the Think tier (call Think with the same brief) if this is a hard/architectural problem the Act worker stalled or failed on");
+    if (!rec.followUp && canEscalate)
+      options.push("RE-DELEGATE to Act with a corrected brief if the failure looks recoverable (a wrong path, a fixable mistake)");
+    options.push("ASK the user one short, concrete question if you genuinely cannot proceed without their input");
+    options.push("ACCEPT and tell the user plainly what happened (don't dress a failure up as success)");
+    const decision = options.length > 1 ? ` You must decide what to do next \u2014 choose ONE: ${options.map((o, i) => `(${i + 1}) ${o}`).join("; ")}. Pick exactly one and act on it; do not voice this as a finished success.` : ` Tell the user plainly what happened \u2014 do not present this as a finished success.`;
+    const state = outcome === "error" ? `the worker FAILED with: ${body}` : `the worker STOPPED EARLY (${finishReason}) \u2014 its result is PARTIAL, not a finished success: ${body}`;
+    return `${opener} Original request: "${rec.brief}". Outcome: ${state}.${decision}`;
+  }
+  onWorkerSettled(id, res) {
+    this.dropAsk(id);
+    const rec = this.tasks.get(id);
+    if (res.finishReason === "aborted" || rec.status === "cancelled") {
+      rec.status = "cancelled";
+      this.notify("task_cancelled", `task ${id} (${rec.label}) cancelled`);
+      return;
     }
-    this.partialText = (m.tokens ?? []).filter((t) => !t.is_final && t.text !== "<end>").map((t) => t.text).join("");
-    const combined = this.finalText + this.partialText;
-    if (combined !== this.lastCombined) {
-      this.lastCombined = combined;
-      this.lastChangeAt = now();
-      if (!this.firstTokenAt && combined.trim()) this.firstTokenAt = now();
+    if (res.finishReason === "error") {
+      const msg = res.error instanceof Error ? res.error.message : String(res.error ?? "unknown error");
+      return this.failTask(rec, msg);
     }
-    this.onPartial(combined);
-    if (endpoint && this.finalText.trim()) {
-      const utterance = this.finalText.trim();
-      if (this.firstTokenAt) log12.debug(`stt: ${Math.round(now() - this.firstTokenAt)}ms first-token\u2192endpoint, "${utterance.slice(0, 60)}"`);
-      this.reset();
-      this.onUtterance(utterance, now());
+    rec.status = "done";
+    rec.result = res.text;
+    const incomplete = res.finishReason !== "stop";
+    log13.verbose(`task ${id} done (${res.steps} steps${incomplete ? `, INCOMPLETE: ${res.finishReason}` : ""})`);
+    this.notify("task_done", `task ${id} (${rec.label}) completed`, {
+      id,
+      text: res.text,
+      usage: res.usage,
+      usageEstimated: res.usageEstimated,
+      finishReason: res.finishReason,
+      steps: res.steps,
+      toolCalls: res.messages.filter((m) => m.role === "tool").length
+    });
+    if (incomplete) {
+      return this.queueRevoice(this.integrationPrompt(rec, "incomplete", res.text, res.finishReason), true);
     }
-  }
-  reset() {
-    this.finalText = "";
-    this.partialText = "";
-    this.lastCombined = "";
-    this.firstTokenAt = 0;
-  }
-  stop() {
-    this.stopped = true;
-    if (this.endpointTimer) clearInterval(this.endpointTimer);
-    if (this.noAudioTimer) clearInterval(this.noAudioTimer);
-    this.options.source?.stop();
-    if (this.ws) this.ws.onclose = null;
-    this.ws?.close();
-  }
-};
-
-// src/voice/cartesia.ts
-init_logging();
-var log13 = forComponent("CartesiaTTS");
-var now2 = () => performance.now();
-var CartesiaTTSOptions = class {
-  auth = "";
-  voiceId = "";
-  model = "sonic-3.5";
-  /** 'apiKey' (server/CLI) → `api_key=` URL param; 'token' (browser, BE-minted) → `access_token=`. */
-  authMode = "apiKey";
-};
-var CartesiaTTS = class _CartesiaTTS {
-  options;
-  ws;
-  ctxSeq = 0;
-  ctxId = "";
-  onAudio = () => {
-  };
-  onDone = () => {
-  };
-  /** Word-level timestamps for karaoke reveal: `start[i]` = seconds from turn-audio start (absolute
-   *  across continuation chunks). Fired only when a consumer opts into reveal (see `wantTimestamps`). */
-  onTimestamps = () => {
-  };
-  /** Request `add_timestamps` from Cartesia. Off by default (saves bandwidth) — the engine sets it
-   *  when revealMode==='word'. */
-  wantTimestamps = false;
-  /** Diagnostic tap (provider errors, circuit-breaker open/close, ws reconnects). Fire-and-forget:
-   *  a throwing handler disables itself — never affects synthesis. Wired by VoiceIO / the lab bridge. */
-  onDiag = () => {
-  };
-  diagOn = true;
-  diag(kind, fields) {
-    if (!this.diagOn) return;
-    try {
-      this.onDiag({ t: now2(), kind, ...fields });
-    } catch (e) {
-      this.diagOn = false;
-      log13.debug(`onDiag threw \u2014 TTS diagnostics disabled: ${e instanceof Error ? e.message : e}`);
+    const tail = rec.splitter?.flush();
+    if (tail?.spoken && !rec.deliveryParked) this.options.host?.notify?.({ kind: "speak_utterance", message: tail.spoken });
+    if (res.text.trim()) this.voice.transcript.push({ role: "assistant", content: res.text });
+    if (rec.deliveryParked && !this.suppressParkedResume) {
+      const gist = (rec.spokenText ?? "").trim() || res.text.trim();
+      if (gist) {
+        if (this.awaitTrivialRedeliver) {
+          this.awaitTrivialRedeliver = false;
+          this.options.host?.notify?.({ kind: "speak_utterance", message: gist });
+          this.notify("diag", "parked_redelivered", { chars: gist.length });
+        } else this.parkedRedeliver.push(gist);
+      }
     }
+    if (!rec.splitter?.spokeAny && res.text.trim() && !rec.deliveryParked)
+      this.options.host?.notify?.({ kind: "speak_utterance", message: res.text });
   }
-  firstAudioAt = 0;
-  /** Circuit breaker: consecutive error count + down flag. */
-  consecutiveErrors = 0;
-  consecutiveOk = 0;
-  down = false;
-  downAt = 0;
-  probeTimer = null;
-  static CB_THRESHOLD = 3;
-  // open after 3 consecutive errors
-  static CB_RECOVER_OK = 2;
-  // close only after 2 consecutive good frames (no single-frame flap)
-  static CB_PROBE_MS = 3e4;
-  constructor(options) {
-    this.options = { ...new CartesiaTTSOptions(), ...options };
+  onWorkerFailed(id, err) {
+    this.failTask(this.tasks.get(id), err instanceof Error ? err.message : String(err));
   }
-  closed = false;
-  connecting = null;
-  async connect() {
-    this.closed = false;
-    this.connecting = this.doConnect();
-    await this.connecting;
-    this.connecting = null;
+  failTask(rec, msg) {
+    this.dropAsk(rec.id);
+    rec.status = "error";
+    rec.result = msg;
+    log13.warn(`task ${rec.id} failed: ${msg}`);
+    this.notify("task_error", `task ${rec.id} (${rec.label}) failed: ${msg}`);
+    this.queueRevoice(this.integrationPrompt(rec, "error", msg, "error"), true);
   }
-  async doConnect() {
-    const key = await resolveAuth(this.options.auth);
-    const param = this.options.authMode === "token" ? "access_token" : "api_key";
-    this.ws = new WebSocket(`wss://api.cartesia.ai/tts/websocket?cartesia_version=2026-03-01&${param}=${key}`);
-    await new Promise((res, rej) => {
-      this.ws.onopen = () => res();
-      this.ws.onerror = (e) => rej(new Error(`cartesia ws: ${e.message || "connect failed"}`));
-    });
-    this.ws.onclose = (ev) => {
-      log13.warn(`cartesia ws closed (${ev.code} ${ev.reason || ""})`);
-      this.diag("tts_ws_closed", { code: ev.code, reason: String(ev.reason || ""), reconnecting: !this.closed });
-      if (!this.closed) {
-        this.connecting = this.doConnect().catch((e) => {
-          log13.error(`cartesia reconnect failed: ${e.message}`);
-          this.diag("tts_reconnect_failed", { message: e.message });
-        });
+  // --- voice tools (closures over this instance) ---
+  /** Live-switch the think tier: `false` disables (removes the Think tool from the voice agent),
+   *  a model id enables (adds the tool if missing). The system-prompt THINK_SLOT text is frozen at
+   *  construction — the tool's own description carries the routing guidance, so a live enable works;
+   *  dispatch()'s think→act fallback covers any straggler calls after a live disable. */
+  setThinkModel(model) {
+    this.options.thinkModel = model;
+    const tools = this.voice.options.tools;
+    const i = tools.findIndex((t) => t.name === "Think");
+    if (model === false && i >= 0) tools.splice(i, 1);
+    else if (model !== false && i < 0) tools.push(this.thinkTool());
+  }
+  /** User/programmatic spawn: the CLI's /act and /think commands. Returns the task id.
+   *  `followUp` marks an automatic escalation/re-delegation (set by the integration turn) so the new
+   *  task's own integration turn won't escalate again — capping auto-follow-ups to one hop. */
+  async dispatch(brief, tier = "act", label, followUp = false) {
+    if (tier === "think" && this.options.thinkModel === false) tier = "act";
+    if (followUp) this.autoEscalations++;
+    const id = `t${++this.seq}`;
+    const lbl = label ?? tier;
+    await this.options.onTaskStart?.(id, lbl);
+    this.spawnWorker(id, lbl, this.buildBrief(brief, tier), tier, brief, followUp);
+    this.notify("task_started", `task ${id} (${lbl}) started`, { id, brief, tier });
+    return id;
+  }
+  actTool() {
+    return {
+      name: "Act",
+      description: 'Escalate real work (reading/editing files, searching, running tasks, building) to a standard background worker. Returns immediately with a task id; the result arrives later as a "[task <id> completed]" event. Provide a clear, self-contained `brief` (the worker does not hear the live conversation).',
+      parameters: {
+        type: "object",
+        required: ["brief"],
+        properties: {
+          brief: { type: "string", description: "full, self-contained instructions for the worker" },
+          label: { type: "string", description: "a short (2-4 word) label for the task" }
+        }
+      },
+      run: async ({ brief, label }) => {
+        this.spokeBeforeDispatch = this.spokeThisTurn;
+        this.turnDispatched = true;
+        this.turnBriefs.add(String(brief ?? ""));
+        this.voice.options.toolChoice = "none";
+        const id = await this.dispatch(String(brief ?? ""), "act", label ? String(label) : void 0, this.turnFollowUp);
+        return this.spokeBeforeDispatch ? `Acting on task ${id}. You already acknowledged \u2014 end your turn now with NO further text; the result will arrive as a [task ${id} completed] event.` : `Acting on task ${id}. Acknowledge briefly; the result will arrive as a [task ${id} completed] event.`;
       }
     };
-    this.ws.onmessage = (ev) => {
-      const m = JSON.parse(String(ev.data));
-      if (m.context_id && m.context_id !== this.ctxId) return;
-      if (m.type === "chunk" && m.data) {
-        this.consecutiveErrors = 0;
-        this.markRecovered();
-        if (!this.firstAudioAt) this.firstAudioAt = now2();
-        this.onAudio(base64ToBytes(m.data));
-      } else if (m.type === "done") {
-        this.consecutiveErrors = 0;
-        this.markRecovered();
-        this.onDone();
-      } else if (m.type === "timestamps" && m.word_timestamps) {
-        const wt = m.word_timestamps;
-        if (wt.words?.length && wt.start?.length) this.onTimestamps(wt.words, wt.start);
-      } else if (m.type === "error") {
-        if (/already been cancelled|does not exist/.test(m.message || "")) return;
-        this.consecutiveErrors++;
-        this.diag("tts_error", { message: String(m.message || ""), code: m.status_code, contextId: m.context_id, consecutive: this.consecutiveErrors });
-        if (!this.down && this.consecutiveErrors >= _CartesiaTTS.CB_THRESHOLD) {
-          this.down = true;
-          this.downAt = now2();
-          this.consecutiveOk = 0;
-          log13.warn(`TTS circuit breaker open \u2014 ${this.consecutiveErrors} consecutive errors, switching to text-only`);
-          this.diag("tts_breaker_open", { errors: this.consecutiveErrors });
-          this.onDone();
-          this.startProbe();
-        } else if (!this.down) {
-          (/No valid transcripts/i.test(m.message || "") ? log13.debug : log13.warn)(`cartesia: ${JSON.stringify(m)}`);
+  }
+  thinkTool() {
+    return {
+      name: "Think",
+      description: "Escalate to a premium deep-reasoning agent for complex analysis, architecture decisions, hard debugging, or planning. Same async pattern as Act \u2014 returns a task id. Use when the problem needs careful thought before (or instead of) action. Do not use Think for simple tasks \u2014 Act is cheaper and faster.",
+      parameters: {
+        type: "object",
+        required: ["brief"],
+        properties: {
+          brief: { type: "string", description: "the question or problem to reason about deeply" },
+          label: { type: "string", description: "a short (2-4 word) label for the task" }
+        }
+      },
+      run: async ({ brief, label }) => {
+        this.spokeBeforeDispatch = this.spokeThisTurn;
+        this.turnDispatched = true;
+        this.turnBriefs.add(String(brief ?? ""));
+        this.voice.options.toolChoice = "none";
+        const id = await this.dispatch(String(brief ?? ""), "think", label ? String(label) : void 0, this.turnFollowUp);
+        return this.spokeBeforeDispatch ? `Thinking on task ${id}. You already acknowledged \u2014 end your turn now with NO further text; the result will arrive as a [task ${id} completed] event.` : `Thinking on task ${id}. Acknowledge briefly; the result will arrive as a [task ${id} completed] event.`;
+      }
+    };
+  }
+  taskStatusTool() {
+    return {
+      name: "TaskStatus",
+      description: "Status of background tasks. Pass `id` for one task, or omit it to list all.",
+      parameters: { type: "object", properties: { id: { type: "string" } } },
+      run: async ({ id }) => {
+        const list = id ? [this.tasks.get(String(id))].filter(Boolean) : [...this.tasks.values()];
+        if (!list.length) return id ? `No task '${id}'.` : "No background tasks.";
+        return list.map((t) => `${t.id} (${t.label}): ${t.status}`).join("\n");
+      }
+    };
+  }
+  /** Sub-100ms read-only lookups the voice may do itself — everything else stays Act-only.
+   *  fs-only (no shell; the engine is VFS-abstracted): time, git branch (.git/HEAD read), ls, file
+   *  head. Output is hard-capped so a lookup can never bloat the skinny voice context. */
+  quickLookTool() {
+    const CAP = 2e3;
+    const kinds = [.../* @__PURE__ */ new Set(["time", "branch", "ls", "file", "capabilities", ...Object.keys(this.options.quickLook ?? {})])];
+    return {
+      name: "QuickLook",
+      description: `Instant read-only lookup \u2014 one of: ${kinds.join(", ")}. For trivial facts only; anything needing search, commands, or reasoning goes through Act.`,
+      parameters: {
+        type: "object",
+        required: ["what"],
+        properties: {
+          what: { type: "string", enum: kinds, description: "what to look up" },
+          path: { type: "string", description: "for ls/file: the path to look at" }
+        }
+      },
+      run: async ({ what, path }) => {
+        const fs = this.options.fs;
+        try {
+          const over = this.options.quickLook?.[String(what)];
+          if (over) return await over(path ? String(path) : void 0);
+          switch (String(what)) {
+            case "capabilities": {
+              const actTools = this.options.actOptions?.tools ?? [];
+              const names = actTools.map((t) => t.name);
+              const mcpServers = Object.keys(this.options.actOptions?.providerOptions?.mcpServers ?? {});
+              const mcpNote = mcpServers.length ? ` Plus MCP servers your worker can use: ${mcpServers.join(", ")} (e.g. browser-bridge \u2192 drive a real browser: open tabs, navigate, click, screenshot).` : "";
+              if (!names.length)
+                return "Your worker uses Act's default local toolset (reading/editing files, running shell commands). No extra tools (e.g. web/internet) are configured; if a request is not a basic file or shell operation, assume you can't do it and say so." + mcpNote;
+              const hasFetch = names.some((n) => /WebFetch/i.test(n));
+              const hasBrowser = names.some((n) => /browser.*(navigate|click|page|type)/i.test(n));
+              const hasSearch = names.some((n) => /(^|_)WebSearch$|search/i.test(n) && !/WebFetch|browser/i.test(n));
+              const notes = [];
+              if (hasFetch) notes.push("WebFetch retrieves ONE specific URL you are given \u2014 it is not a search engine.");
+              if (hasBrowser) notes.push("The browser tools drive a real browser: you CAN open a site and, if needed, navigate to a search engine and search there \u2014 but it is manual and takes a moment, not an instant lookup.");
+              else if (!hasSearch && hasFetch) notes.push('You have no general web-search tool, so for an instant "search the web" you can only fetch a URL they provide.');
+              const webNote = notes.length ? " NOTE: " + notes.join(" ") : "";
+              return `Tools your background worker (Act) can actually use: ${names.join(", ")}. Read each name literally and match the request to a SPECIFIC tool; if none fits, you do NOT have that ability \u2014 say so honestly.` + webNote + mcpNote;
+            }
+            case "time":
+              return (/* @__PURE__ */ new Date()).toString();
+            case "branch": {
+              if (!fs) return "unavailable (no filesystem)";
+              const head = (await fs.readFile(".git/HEAD")).trim();
+              return head.startsWith("ref: refs/heads/") ? `branch: ${head.slice("ref: refs/heads/".length)}` : `detached HEAD at ${head.slice(0, 12)}`;
+            }
+            case "ls": {
+              if (!fs) return "unavailable (no filesystem)";
+              const p = String(path ?? ".");
+              try {
+                const names = await fs.readDir(p);
+                return names.slice(0, 50).join("\n") + (names.length > 50 ? `
+\u2026 (+${names.length - 50} more)` : "");
+              } catch {
+                const names = await fs.readDir(".").catch(() => []);
+                return `'${p}' not found here \u2014 you are likely already inside it. Current directory listing:
+` + names.slice(0, 50).join("\n") + (names.length > 50 ? `
+\u2026 (+${names.length - 50} more)` : "");
+              }
+            }
+            case "file": {
+              if (!fs) return "unavailable (no filesystem)";
+              if (!path) return "file lookup needs a path";
+              try {
+                const text = await fs.readFile(String(path));
+                return text.length > CAP ? text.slice(0, CAP) + `
+\u2026 (truncated \u2014 ${text.length} chars total; Act for the full file)` : text;
+              } catch {
+                const names = await fs.readDir(".").catch(() => []);
+                return `'${path}' not found. Current directory contains:
+` + names.slice(0, 50).join("\n");
+              }
+            }
+            default:
+              return `unknown lookup '${what}'`;
+          }
+        } catch (e) {
+          return `lookup failed: ${e?.message ?? e}`;
+        }
+      }
+    };
+  }
+  answerTaskTool() {
+    return {
+      name: "AnswerTask",
+      description: `Relay the user's answer to a pending question from a background task (the "[task <id> asks]" events). Pass the id from the event and the user's answer.`,
+      parameters: {
+        type: "object",
+        required: ["id", "answer"],
+        properties: { id: { type: "string" }, answer: { type: "string", description: "the user's answer, verbatim or faithfully summarized" } }
+      },
+      run: async ({ id, answer }) => {
+        const ask = this.pendingAsks.get(String(id));
+        if (!ask) return `No pending question for '${id}' \u2014 it may have been answered already or timed out.`;
+        ask.resolve(String(answer ?? ""));
+        return `Answer relayed \u2014 task ${id} resumes.`;
+      }
+    };
+  }
+  holdTool() {
+    return {
+      name: "Hold",
+      description: 'The user seems mid-thought \u2014 hold the turn (stay listening) instead of answering. Optionally pass a short filler ("mhm", "go on") to speak while waiting. Use when the message sounds incomplete, trailing off, or like they paused to think.',
+      parameters: {
+        type: "object",
+        properties: {
+          filler: { type: "string", description: 'optional short filler to speak ("mhm", "go on", "mm-hm")' }
         }
+      },
+      run: async ({ filler }) => {
+        this.heldThisTurn = true;
+        this.notify("hold_filler", filler ? String(filler) : "");
+        return "Holding \u2014 listening for the rest of the user's thought. Do not respond further this turn.";
       }
     };
   }
-  /** Close the breaker only after CB_RECOVER_OK consecutive good frames, so a single straggler chunk
-   *  after a 503 burst doesn't flap open→recover in <1s. A sub-2s down-window is a transient blip → debug. */
-  markRecovered() {
-    if (!this.down) return;
-    if (++this.consecutiveOk < _CartesiaTTS.CB_RECOVER_OK) return;
-    this.down = false;
-    this.consecutiveOk = 0;
-    this.stopProbe();
-    const downMs = this.downAt ? now2() - this.downAt : 0;
-    this.diag("tts_breaker_close", { downMs: Math.round(downMs) });
-    (downMs < 2e3 ? log13.debug : log13.info)(`TTS recovered${downMs ? ` (down ${downMs}ms)` : ""}`);
+  cancelTaskTool() {
+    return {
+      name: "CancelTask",
+      description: "Cancel a running background task by id.",
+      parameters: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
+      run: async ({ id }) => this.cancelTask(String(id))
+    };
   }
-  /** Ensure the WS is open before sending — reconnects if idle-closed. */
-  async ensureConnected() {
-    if (this.connecting) await this.connecting;
-    if (this.ws?.readyState !== WebSocket.OPEN) await this.connect();
+};
+
+// src/mcp.ts
+function toResult(result) {
+  if (result == null) return { text: "" };
+  if (typeof result === "string") return { text: result };
+  const content = result.content;
+  if (Array.isArray(content)) {
+    const texts = [];
+    const images = [];
+    for (const c of content) {
+      if (c?.type === "image" && typeof c.data === "string" && c.mimeType) {
+        images.push({ mimeType: c.mimeType, data: c.data });
+      } else if (typeof c?.text === "string") {
+        texts.push(c.text);
+      } else {
+        texts.push(JSON.stringify(c));
+      }
+    }
+    const text = texts.join("\n");
+    if (text || images.length) return { text, ...images.length ? { images } : {} };
   }
-  /** Prime the synthesis pipeline on a throwaway context right after connect: the FIRST synthesis on
-   *  a fresh WS pays Cartesia's cold spin-up (~1s+ live) — absorb it at mic-on instead of turn one.
-   *  The returned audio is discarded (engine drops onAudio while not speaking; once a real turn calls
-   *  newContext() any stragglers are stale-context-filtered). Respects the circuit breaker. */
-  warmup() {
-    if (this.down) return;
-    this.newContext();
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("Ok.", false));
+  return { text: JSON.stringify(result) };
+}
+function mcpToolToAgentTool(spec, callTool, prefix = "mcp__") {
+  return {
+    name: `${prefix}${spec.name}`,
+    description: spec.description ?? `MCP tool ${spec.name}`,
+    parameters: spec.inputSchema ?? { type: "object", properties: {} },
+    async run(args, _ctx) {
+      const r = toResult(await callTool(spec.name, args ?? {}));
+      return r.images?.length ? r : r.text;
+    }
+  };
+}
+function mcpToolsToAgentTools(specs, callTool, prefix = "mcp__", filter) {
+  return (filter ? specs.filter(filter) : specs).map((s) => mcpToolToAgentTool(s, callTool, prefix));
+}
+function describeSpec(s) {
+  const schema = s.inputSchema ? `
+   args: ${JSON.stringify(s.inputSchema)}` : "";
+  return `${s.name} \u2014 ${s.description ?? "(no description)"}${schema}`;
+}
+function makeMcpToolSearch(specs, callTool, options = {}) {
+  const maxResults = options.maxResults ?? 10;
+  const byName = new Map(specs.map((s) => [s.name, s]));
+  const catalogLine = `${specs.length} MCP tool(s) available \u2014 search by keyword, then call by exact name.`;
+  const searchTool = {
+    name: "ToolSearch",
+    description: `Search the available MCP tools by keyword (${catalogLine}). Returns matching tool names + their argument schemas; call one with \`McpCall\`.`,
+    parameters: { type: "object", required: ["query"], properties: { query: { type: "string", description: "keywords to match against tool name + description" } } },
+    async run({ query }) {
+      const q = String(query ?? "").trim();
+      if (!q) return catalogLine;
+      const { kept } = topByRelevance(specs, q, (s) => `${s.name} ${s.description ?? ""}`, maxResults);
+      if (!kept.length) return `(no MCP tool matches "${q}" \u2014 try broader keywords)`;
+      return kept.map(describeSpec).join("\n");
+    }
+  };
+  const callMcpTool = {
+    name: "McpCall",
+    description: "Call an MCP tool discovered via `ToolSearch`, by its exact name. Pass its arguments as `args`.",
+    parameters: {
+      type: "object",
+      required: ["name"],
+      properties: {
+        name: { type: "string", description: "exact tool name from ToolSearch" },
+        args: { type: "object", description: "arguments object for the tool (per its schema)" }
+      }
+    },
+    async run({ name, args }) {
+      const n = String(name ?? "");
+      if (!byName.has(n)) return `Error: unknown MCP tool '${n}'. Use ToolSearch to find valid names.`;
+      const r = toResult(await callTool(n, args ?? {}));
+      return r.images?.length ? r : r.text;
+    }
+  };
+  return [searchTool, callMcpTool];
+}
+function buildMcpCatalog(servers) {
+  const specs = [];
+  const routes = /* @__PURE__ */ new Map();
+  for (const m of servers) {
+    for (const s of m.specs) {
+      const base = `mcp__${m.name}__${s.name}`.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 128);
+      let display = base;
+      for (let i = 2; routes.has(display); i++) display = `${base.slice(0, 128 - String(i).length - 1)}_${i}`;
+      specs.push({ name: display, description: s.description, inputSchema: s.inputSchema });
+      routes.set(display, { server: m.name, rawName: s.name });
+    }
   }
-  newContext() {
-    this.ctxId = `ctx-${++this.ctxSeq}`;
-    this.firstAudioAt = 0;
-    return this.ctxId;
+  return { specs, routes };
+}
+function searchOverCatalog(servers, specs, routes, resolve, options) {
+  const tools = specs.length ? makeMcpToolSearch(specs, (name, args) => {
+    const r = routes.get(name);
+    if (!r) throw new Error(`unknown MCP tool '${name}' \u2014 use ToolSearch to find valid names`);
+    return resolve(r.server, r.rawName, args ?? {});
+  }, options) : [];
+  return { tools, serverNames: servers, toolCount: specs.length };
+}
+function makeMcpToolSearchFromMounted(mounted, options) {
+  const { specs, routes } = buildMcpCatalog(mounted);
+  const byName = new Map(mounted.map((m) => [m.name, m]));
+  return searchOverCatalog(mounted.map((m) => m.name), specs, routes, (server, rawName, args) => byName.get(server).client.callTool(rawName, args), options);
+}
+function makeLazyMcpToolSearch(servers, resolve, options) {
+  const { specs, routes } = buildMcpCatalog(servers);
+  return searchOverCatalog(servers.map((s) => s.name), specs, routes, resolve, options);
+}
+
+// src/hooks.ts
+var RecordingHooks = class {
+  /** tool name -> reason; a matching preToolUse call is blocked with that reason. */
+  constructor(blocks = {}) {
+    this.blocks = blocks;
   }
-  frame(transcript, cont) {
-    return JSON.stringify({
-      model_id: this.options.model,
-      transcript,
-      voice: { mode: "id", id: this.options.voiceId },
-      output_format: { container: "raw", encoding: "pcm_s16le", sample_rate: TTS_SAMPLE_RATE },
-      context_id: this.ctxId,
-      continue: cont,
-      ...this.wantTimestamps ? { add_timestamps: true } : {}
-    });
+  blocks;
+  pre = [];
+  post = [];
+  outputs = [];
+  stops = [];
+  preToolUse(call, meta) {
+    this.pre.push({ call, meta });
+    const reason = this.blocks[call.name];
+    if (reason != null) return { block: true, reason };
   }
-  speak(text, cont) {
-    if (this.down) return;
-    if (cont && !text) return;
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame(text, cont));
-    else void this.ensureConnected().then(() => this.ws?.readyState === WebSocket.OPEN && this.ws.send(this.frame(text, cont)));
+  postToolUse(call, result, meta) {
+    this.post.push({ call, result, meta });
   }
-  end() {
-    if (this.down) {
-      this.onDone();
-      return;
-    }
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("", false));
+  onToolOutput(call, chunk, meta) {
+    this.outputs.push({ call, chunk, meta });
   }
-  cancel() {
-    if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify({ context_id: this.ctxId, cancel: true }));
+  onStop(finalText) {
+    this.stops.push(finalText);
   }
-  startProbe() {
-    if (this.probeTimer) return;
-    this.probeTimer = setInterval(() => {
-      if (!this.down) {
-        this.stopProbe();
-        return;
-      }
-      this.consecutiveErrors = 0;
-      this.newContext();
-      if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(this.frame("Ok.", false));
-    }, _CartesiaTTS.CB_PROBE_MS);
-    this.probeTimer.unref?.();
+};
+var RecordingLifecycle = class {
+  /** @param startContext injected at session start; @param rewrite maps a submitted prompt to a new one. */
+  constructor(startContext, rewrite) {
+    this.startContext = startContext;
+    this.rewrite = rewrite;
   }
-  stopProbe() {
-    if (this.probeTimer) {
-      clearInterval(this.probeTimer);
-      this.probeTimer = null;
-    }
+  startContext;
+  rewrite;
+  starts = 0;
+  prompts = [];
+  compactions = [];
+  subagentStops = [];
+  onSessionStart() {
+    this.starts++;
+    return this.startContext;
   }
-  close() {
-    this.closed = true;
-    this.stopProbe();
-    if (this.ws) this.ws.onclose = null;
-    this.ws?.close();
+  onUserPromptSubmit(text) {
+    this.prompts.push(text);
+    return this.rewrite?.(text);
+  }
+  onPreCompact(messages) {
+    this.compactions.push(messages.length);
+  }
+  onSubagentStop(summary, info) {
+    this.subagentStops.push({ summary, label: info?.label });
   }
 };
-function base64ToBytes(b64) {
-  if (typeof Buffer !== "undefined") return Buffer.from(b64, "base64");
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
 
 // src/index.ts
+init_logging();
 import { MemFilesystem as MemFilesystem3, IndexedDbFilesystem, CommandExecutor as CommandExecutor2, registerHeadlessCommands as registerHeadlessCommands2 } from "@livx.cc/wcli/core";
 export {
   Agent,