@moonshot-ai/kimi-code 0.20.2 → 0.20.3

package/dist/main.mjs

@@ -54411,7 +54411,7 @@ function toKimiErrorPayload(error) {
 		const code = error.statusCode === 429 ? ErrorCodes.PROVIDER_RATE_LIMIT : error.statusCode === 401 ? ErrorCodes.PROVIDER_AUTH_ERROR : ErrorCodes.PROVIDER_API_ERROR;
 		return {
 			code,
-			message: error.message,
+			message: sanitizeStatusErrorMessage(error.message),
 			name: error.name,
 			details: {
 				statusCode: error.statusCode,
@@ -54455,6 +54455,19 @@ function toKimiErrorPayload(error) {
 	};
 }
 /**
+* Provider status errors occasionally carry an HTML body instead of a
+* structured message (for example, nginx returning
+* "413 <html><head><title>413 Request Entity Too Large</title>...</html>").
+* Extract the `<title>` when present so the wire message is human readable,
+* and strip carriage returns so the text renders cleanly in terminals — a
+* trailing `\r` combined with line-end padding would otherwise overwrite
+* the whole line. The original HTML remains available in logs and `details`.
+*/
+function sanitizeStatusErrorMessage(message) {
+	const extracted = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(message)?.[1]?.trim();
+	return (extracted !== void 0 && extracted.length > 0 ? extracted : message).replaceAll("\r", "");
+}
+/**
 * Rehydrate a KimiErrorPayload into a KimiError. Used by SDK boundary code
 * receiving errors over RPC to re-surface them with a real class so
 * in-process consumers can still use `instanceof`.
@@ -60771,6 +60784,12 @@ const BackgroundConfigSchema = object({
 	killGracePeriodMs: number$1().int().min(0).optional(),
 	printWaitCeilingS: number$1().int().min(1).optional()
 });
+const ModelCatalogConfigSchema = object({
+	/** Interval (ms) between automatic provider-model refreshes. `0` disables. */
+	refreshIntervalMs: number$1().int().min(0).optional(),
+	/** Refresh once shortly after the daemon starts. */
+	refreshOnStart: boolean$1().optional()
+});
 const ExperimentalConfigSchema = record(string(), boolean$1());
 const HookDefSchema = object({
 	event: _enum(HOOK_EVENT_TYPES),
@@ -60851,6 +60870,7 @@ const KimiConfigSchema = object({
 	extraSkillDirs: array(string()).optional(),
 	loopControl: LoopControlSchema.optional(),
 	background: BackgroundConfigSchema.optional(),
+	modelCatalog: ModelCatalogConfigSchema.optional(),
 	experimental: ExperimentalConfigSchema.optional(),
 	telemetry: boolean$1().optional(),
 	raw: record(string(), unknown()).optional()
@@ -60861,6 +60881,7 @@ const ThinkingConfigPatchSchema = ThinkingConfigSchema.partial();
 const PermissionConfigPatchSchema = PermissionConfigSchema.partial();
 const LoopControlPatchSchema = LoopControlSchema.partial();
 const BackgroundConfigPatchSchema = BackgroundConfigSchema.partial();
+const ModelCatalogConfigPatchSchema = ModelCatalogConfigSchema.partial();
 const ExperimentalConfigPatchSchema = ExperimentalConfigSchema;
 const MoonshotServiceConfigPatchSchema = MoonshotServiceConfigSchema.partial();
 const ServicesConfigPatchSchema = object({
@@ -60885,6 +60906,7 @@ const KimiConfigPatchSchema = object({
 	extraSkillDirs: array(string()).optional(),
 	loopControl: LoopControlPatchSchema.optional(),
 	background: BackgroundConfigPatchSchema.optional(),
+	modelCatalog: ModelCatalogConfigPatchSchema.optional(),
 	experimental: ExperimentalConfigPatchSchema.optional(),
 	telemetry: boolean$1().optional()
 }).strict();
@@ -72070,28 +72092,31 @@ var FullCompaction = class {
 				tokensAfter
 			};
 			this.agent.telemetry.track("compaction_finished", {
-				tokensBefore: result.tokensBefore,
-				tokensAfter: result.tokensAfter,
+				source: data.source,
+				tokens_before: result.tokensBefore,
+				tokens_after: result.tokensAfter,
 				duration_ms: Date.now() - startedAt,
-				compactedCount: result.compactedCount,
-				retryCount,
+				compacted_count: result.compactedCount,
+				retry_count: retryCount,
 				round,
-				thinkingLevel: this.agent.config.thinkingLevel,
-				...usage,
-				...data
+				thinking_level: this.agent.config.thinkingLevel,
+				...usage === null ? {} : {
+					input_tokens: inputTotal(usage),
+					output_tokens: usage.output
+				}
 			});
 			this.agent.context.applyCompaction(result);
 			return result;
 		} catch (error) {
 			if (isAbortError$3(error)) return;
 			this.agent.telemetry.track("compaction_failed", {
-				...data,
-				tokensBefore,
+				source: data.source,
+				tokens_before: tokensBefore,
 				duration_ms: Date.now() - startedAt,
 				round,
-				retryCount,
-				thinkingLevel: this.agent.config.thinkingLevel,
-				errorType: error instanceof Error ? error.name : "Unknown"
+				retry_count: retryCount,
+				thinking_level: this.agent.config.thinkingLevel,
+				error_type: error instanceof Error ? error.name : "Unknown"
 			});
 			if (isKimiError(error) && error.code === ErrorCodes.AUTH_LOGIN_REQUIRED) throw error;
 			throw new KimiError(ErrorCodes.COMPACTION_FAILED, String(error), { cause: error });
@@ -72179,15 +72204,21 @@ var MicroCompaction = class {
 			const tokensBefore = rawContextTokens - previousEffect.truncatedToolResultTokensBefore + previousEffect.truncatedToolResultTokensAfter;
 			const tokensAfter = rawContextTokens - effect.truncatedToolResultTokensBefore + effect.truncatedToolResultTokensAfter;
 			this.agent.telemetry.track("micro_compaction_finished", {
-				...config,
-				...effect,
-				tokensBefore,
-				tokensAfter,
+				keep_recent_messages: config.keepRecentMessages,
+				min_content_tokens: config.minContentTokens,
+				cache_missed_threshold_ms: config.cacheMissedThresholdMs,
+				truncated_marker: config.truncatedMarker,
+				min_context_usage_ratio: config.minContextUsageRatio,
+				truncated_tool_result_count: effect.truncatedToolResultCount,
+				truncated_tool_result_tokens_before: effect.truncatedToolResultTokensBefore,
+				truncated_tool_result_tokens_after: effect.truncatedToolResultTokensAfter,
+				tokens_before: tokensBefore,
+				tokens_after: tokensAfter,
 				previous_cutoff: previousCutoff,
 				cutoff: nextCutoff,
 				message_count: history.length,
 				cache_age_ms: cacheAgeMs,
-				thinkingLevel: this.agent.config.thinkingLevel
+				thinking_level: this.agent.config.thinkingLevel
 			});
 		}
 	}
@@ -89424,6 +89455,29 @@ function validateToolArgs(validator, args) {
 	return errors.map((error) => formatValidationError(error)).join("; ");
 }
 //#endregion
+//#region ../../packages/agent-core/src/loop/tool-args-parse.ts
+function parseToolCallArguments$1(raw) {
+	if (raw === null || raw.length === 0) return {
+		success: true,
+		data: {},
+		parseFailed: false
+	};
+	try {
+		return {
+			success: true,
+			data: JSON.parse(raw),
+			parseFailed: false
+		};
+	} catch (error) {
+		return {
+			success: true,
+			data: {},
+			parseFailed: true,
+			error: errorMessage$5(error)
+		};
+	}
+}
+//#endregion
 //#region ../../packages/agent-core/src/loop/tool-scheduler.ts
 /**
 * Stateful execution scheduler for tool calls in one model step.
@@ -89504,7 +89558,7 @@ async function runToolCallBatch(step, response) {
 		...step,
 		toolCalls: response.toolCalls
 	};
-	const calls = response.toolCalls.map((toolCall) => preflightToolCall(step.tools, toolCall));
+	const calls = response.toolCalls.map((toolCall) => preflightToolCall(step, toolCall));
 	const scheduler = new ToolScheduler();
 	const pendingResults = [];
 	let stopTurn = false;
@@ -89541,25 +89595,23 @@ async function runToolCallBatch(step, response) {
 * Provider-order validation pass. It does not run hooks, spawn tools, or write
 * events. Validator compilation may populate the local cache.
 */
-function preflightToolCall(tools, toolCall) {
+function preflightToolCall(step, toolCall) {
 	const toolName = toolCall.name;
 	const parsedArgs = parseToolCallArguments$1(toolCall.arguments);
-	const args = parsedArgs.success ? parsedArgs.data : {};
-	const tool = tools?.find((candidate) => candidate.name === toolName);
+	const tool = step.tools?.find((candidate) => candidate.name === toolName);
 	if (tool === void 0) return {
 		kind: "rejected",
 		toolCall,
 		toolName,
-		args,
+		args: parsedArgs.data,
 		output: `Tool "${toolName}" not found`
 	};
-	if (!parsedArgs.success) return {
-		kind: "rejected",
-		toolCall,
+	if (parsedArgs.parseFailed) step.log?.debug("tool args JSON parse failed", {
 		toolName,
-		args,
-		output: `Invalid args for tool "${toolName}": malformed JSON in arguments: ${parsedArgs.error}`
-	};
+		toolCallId: toolCall.id,
+		rawLength: toolCall.arguments?.length ?? 0,
+		error: parsedArgs.error
+	});
 	const validationError = validateExecutableToolArgs(tool, parsedArgs.data);
 	if (validationError !== null) return {
 		kind: "rejected",
@@ -89576,23 +89628,6 @@ function preflightToolCall(tools, toolCall) {
 		args: parsedArgs.data
 	};
 }
-function parseToolCallArguments$1(raw) {
-	if (raw === null || raw.length === 0) return {
-		success: true,
-		data: {}
-	};
-	try {
-		return {
-			success: true,
-			data: JSON.parse(raw)
-		};
-	} catch (error) {
-		return {
-			success: false,
-			error: errorMessage$5(error)
-		};
-	}
-}
 function validateExecutableToolArgs(tool, args) {
 	let validator = validators.get(tool);
 	if (validator === void 0) try {
@@ -90972,6 +91007,39 @@ const patchConfigRequestSchema = object({
 	telemetry: boolean$1().optional()
 });
 //#endregion
+//#region ../../packages/protocol/src/modelCatalog.ts
+const modelCatalogItemSchema = object({
+	provider: string().min(1),
+	model: string().min(1),
+	display_name: string().min(1).optional(),
+	max_context_size: number$1().int().min(1),
+	capabilities: array(string()).optional()
+});
+const providerCatalogStatusSchema = _enum([
+	"connected",
+	"error",
+	"unconfigured"
+]);
+const providerCatalogItemSchema = object({
+	id: string().min(1),
+	type: string().min(1),
+	base_url: string().min(1).optional(),
+	default_model: string().min(1).optional(),
+	has_api_key: boolean$1(),
+	status: providerCatalogStatusSchema,
+	models: array(string().min(1)).optional()
+});
+const providerRefreshChangeSchema = object({
+	provider_id: string().min(1),
+	provider_name: string().min(1),
+	added: number$1().int().min(0),
+	removed: number$1().int().min(0)
+});
+const providerRefreshFailureSchema = object({
+	provider: string().min(1),
+	reason: string().min(1)
+});
+//#endregion
 //#region ../../packages/protocol/src/events.ts
 const MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE = "mcp.oauth.authorization_url";
 const tokenUsageSchema = object({
@@ -91298,6 +91366,12 @@ object({
 	changedFields: array(string()),
 	config: configResponseSchema
 });
+const modelCatalogChangedEventSchema = object({
+	type: literal("event.model_catalog.changed"),
+	changed: array(providerRefreshChangeSchema),
+	unchanged: array(string().min(1)),
+	failed: array(providerRefreshFailureSchema)
+});
 const goalUpdatedEventSchema = object({
 	type: literal("goal.updated"),
 	snapshot: goalSnapshotSchema.nullable(),
@@ -91530,6 +91604,7 @@ const eventSchema = discriminatedUnion("type", [
 	workspaceUpdatedEventSchema,
 	workspaceDeletedEventSchema,
 	sessionStatusChangedEventSchema,
+	modelCatalogChangedEventSchema,
 	goalUpdatedEventSchema,
 	skillActivatedEventSchema,
 	turnStartedEventSchema,
@@ -92329,39 +92404,6 @@ const fileMetaSchema = object({
 	expires_at: isoDateTimeSchema.optional()
 });
 //#endregion
-//#region ../../packages/protocol/src/modelCatalog.ts
-const modelCatalogItemSchema = object({
-	provider: string().min(1),
-	model: string().min(1),
-	display_name: string().min(1).optional(),
-	max_context_size: number$1().int().min(1),
-	capabilities: array(string()).optional()
-});
-const providerCatalogStatusSchema = _enum([
-	"connected",
-	"error",
-	"unconfigured"
-]);
-const providerCatalogItemSchema = object({
-	id: string().min(1),
-	type: string().min(1),
-	base_url: string().min(1).optional(),
-	default_model: string().min(1).optional(),
-	has_api_key: boolean$1(),
-	status: providerCatalogStatusSchema,
-	models: array(string().min(1)).optional()
-});
-const providerRefreshChangeSchema = object({
-	provider_id: string().min(1),
-	provider_name: string().min(1),
-	added: number$1().int().min(0),
-	removed: number$1().int().min(0)
-});
-const providerRefreshFailureSchema = object({
-	provider: string().min(1),
-	reason: string().min(1)
-});
-//#endregion
 //#region ../../packages/protocol/src/rest/fs.ts
 /**
 *   POST /v1/sessions/{sid}/fs:list
@@ -93024,7 +93066,12 @@ const setDefaultModelResponseSchema = object({
 	default_model: string().min(1),
 	model: modelCatalogItemSchema
 });
-const refreshOAuthProviderModelsResponseSchema = object({
+object({
+	changed: array(providerRefreshChangeSchema),
+	unchanged: array(string().min(1)),
+	failed: array(providerRefreshFailureSchema)
+});
+const refreshProviderModelsResponseSchema = object({
 	changed: array(providerRefreshChangeSchema),
 	unchanged: array(string().min(1)),
 	failed: array(providerRefreshFailureSchema)
@@ -97246,7 +97293,7 @@ var agent_default$1 = "name: agent\ndescription: Default Kimi Code agent\n\nsyst
 var coder_default = "extends: agent\nname: coder\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\nwhenToUse: |\n  Use this agent for non-trivial software engineering work that may require reading files, editing code, running commands, and returning a compact but technically complete summary to the parent agent.\ntools:\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - Write\n  - Edit\n  - WebSearch\n  - FetchURL\n  - mcp__*\n";
 //#endregion
 //#region ../../packages/agent-core/src/profile/default/explore.yaml?raw
-var explore_default = "extends: agent\nname: explore\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\n\n    You are a codebase exploration specialist. Your role is EXCLUSIVELY to search, read, and analyze existing code and resources. You do NOT have access to file editing tools.\n\n    Your strengths:\n    - Rapidly finding files using glob patterns\n    - Searching code and text with powerful regex patterns\n    - Reading and analyzing file contents\n    - Running read-only shell commands (git log, git diff, ls, find, etc.)\n\n    Guidelines:\n    - Use Glob for broad file pattern matching. Prefer a pattern with a literal anchor (extension or subdirectory): results are capped at a fixed number of matches, so a broad pattern like `**/*` can truncate before reaching what you need.\n    - Use Grep for searching file contents with regex\n    - Use Read when you know the specific file path\n    - Use Bash ONLY for read-only operations (ls, git status, git log, git diff, find)\n    - NEVER use Bash for any file creation or modification commands\n    - Adapt your search depth based on the thoroughness level specified by the caller\n    - Wherever possible, spawn multiple parallel tool calls for grepping and reading files to maximize speed\n\n    If the prompt includes a <git-context> block, use it to orient yourself about the repository state before starting your investigation.\n\n    You are meant to be a fast agent. Complete the search request efficiently and report your findings clearly in a structured format.\nwhenToUse: |\n  Fast agent specialized for exploring codebases. Use this when you need to quickly find files by patterns (e.g. \"src/**/*.yaml\"), search code for keywords (e.g. \"database connection\"), or answer questions about the codebase (e.g. \"how does the auth module work?\"). When calling this agent, specify the desired thoroughness level: \"quick\" for basic searches, \"medium\" for moderate exploration, or \"thorough\" for comprehensive analysis across multiple locations and naming conventions. Use this agent for any read-only exploration that will clearly require more than 3 search queries. Prefer launching multiple explore agents concurrently when investigating independent questions.\ntools:\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - WebSearch\n  - FetchURL\n";
+var explore_default = "extends: agent\nname: explore\npromptVars:\n  roleAdditional: |\n    You are now running as a subagent. All the `user` messages are sent by the main agent. The main agent cannot see your context, it can only see your last message when you finish the task. You must treat the parent agent as your caller. Do not directly ask the end user questions. If something is unclear, explain the ambiguity in your final summary to the parent agent.\n\n    You are a codebase exploration specialist. Your role is EXCLUSIVELY to search, read, and analyze existing code and resources. You do NOT have access to file editing tools.\n\n    Your strengths:\n    - Rapidly finding files using glob patterns\n    - Searching code and text with powerful regex patterns\n    - Reading and analyzing file contents\n    - Running read-only shell commands (git log, git diff, ls, find, etc.)\n\n    Guidelines:\n    - Use Glob for broad file pattern matching. Prefer patterns with a literal anchor (extension or subdirectory); pure wildcards like `*` or `**/*` are allowed but usually truncate at the match cap.\n    - Use Grep for searching file contents with regex\n    - Use Read when you know the specific file path\n    - Use Bash ONLY for read-only operations (ls, git status, git log, git diff, find)\n    - NEVER use Bash for any file creation or modification commands\n    - Adapt your search depth based on the thoroughness level specified by the caller\n    - Wherever possible, spawn multiple parallel tool calls for grepping and reading files to maximize speed\n\n    If the prompt includes a <git-context> block, use it to orient yourself about the repository state before starting your investigation.\n\n    You are meant to be a fast agent. Complete the search request efficiently and report your findings clearly in a structured format.\nwhenToUse: |\n  Fast agent specialized for exploring codebases. Use this when you need to quickly find files by patterns (e.g. \"src/**/*.yaml\"), search code for keywords (e.g. \"database connection\"), or answer questions about the codebase (e.g. \"how does the auth module work?\"). When calling this agent, specify the desired thoroughness level: \"quick\" for basic searches, \"medium\" for moderate exploration, or \"thorough\" for comprehensive analysis across multiple locations and naming conventions. Use this agent for any read-only exploration that will clearly require more than 3 search queries. Prefer launching multiple explore agents concurrently when investigating independent questions.\ntools:\n  - Bash\n  - Read\n  - ReadMediaFile\n  - Glob\n  - Grep\n  - WebSearch\n  - FetchURL\n";
 //#endregion
 //#region ../../packages/agent-core/src/profile/default/init.md?raw
 var init_default = "You are a software engineering expert with many years of programming experience. Please explore the current project directory to understand the project's architecture and main details.\n\nTask requirements:\n1. Analyze the project structure and identify key configuration files (such as pyproject.toml, package.json, Cargo.toml, etc.).\n2. Understand the project's technology stack, build process and runtime architecture.\n3. Identify how the code is organized and main module divisions.\n4. Discover project-specific development conventions, testing strategies, and deployment processes.\n\nAfter the exploration, you should do a thorough summary of your findings and overwrite it into `AGENTS.md` file in the project root. You need to refer to what is already in the file when you do so.\n\nFor your information, `AGENTS.md` is a file intended to be read by AI coding agents. Expect the reader of this file know nothing about the project.\n\nYou should compose this file according to the actual project content. Do not make any assumptions or generalizations. Ensure the information is accurate and useful. You must use the natural language that is mainly used in the project's comments and documentation.\n\nPopular sections that people usually write in `AGENTS.md` are:\n\n- Project overview\n- Build and test commands\n- Code style guidelines\n- Testing instructions\n- Security considerations\n";
@@ -99664,278 +99711,6 @@ var EditTool = class {
 	}
 };
 //#endregion
-//#region ../../packages/agent-core/src/tools/builtin/file/glob.md?raw
-var glob_default = "Find files (and optionally directories) by glob pattern, sorted by modification time (most recent first).\n\nGood patterns:\n- `*.ts` — files in the current directory matching an extension\n- `src/**/*.ts` — recursive walk with a subdirectory anchor and extension\n- `**/*.py` — recursive walk from the search root for an extension\n- `*.{ts,tsx}` — brace expansion is supported; expanded into `*.ts` and `*.tsx` before walking\n- `{src,test}/**/*.ts` — cartesian brace expansion is supported too\n\nPrefer a pattern with a literal anchor (a file extension or subdirectory) up front; a bare `**/*` walks until it truncates at the match cap. Results are capped at the first 100 matching paths (walk order, not global modification-time order). If a search would return more, a truncation marker is appended with the count of matches seen so far. Refine the pattern (extension, subdirectory) when 100 is not enough, or call again with a narrower anchor.\n\nLarge-directory caveat — avoid recursing into dependency / build output even with an anchor:\n- `node_modules/**/*.js`, `.venv/**/*.py`, `__pycache__/**`, `target/**` all match technically but\n  typically produce thousands of results that truncate at the match cap and waste the caller context.\n  Prefer specific subpaths like `node_modules/react/src/**/*.js`.\n";
-//#endregion
-//#region ../../packages/agent-core/src/tools/builtin/file/glob.ts
-const GlobInputSchema = object({
-	pattern: string().describe("Glob pattern to match files/directories."),
-	path: string().optional().describe("Absolute path to the directory to search in. Defaults to the current working directory."),
-	include_dirs: boolean$1().default(true).optional().describe("Whether to include directories in results. Defaults to true. Set false to return only files.")
-});
-/**
-* Hard upper bound on the number of sub-patterns a single brace expansion
-* is allowed to produce. Generous enough for the common LLM patterns
-* (`*.{ts,tsx,js,jsx,mjs,cjs}` etc.) while still keeping pathological
-* cartesian inputs like `{a,b}{c,d}{e,f}{g,h}{i,j}{k,l}` (= 64) from
-* fanning out unboundedly. Beyond this we fall through with the original
-* pattern unexpanded — kaos would then treat the braces as literals and
-* match zero, which is the right "obvious failure" signal for a pattern
-* the model probably did not mean.
-*/
-const MAX_BRACE_EXPANSIONS = 64;
-/**
-* Path-shape hint appended to the tool description only on a Windows
-* (`win32` path class) backend. The `path` argument accepts both native
-* Windows paths and POSIX-style paths, but matched paths come back in
-* Windows backslash form — a command run through Bash must convert them
-* to forward slashes first. Injected conditionally so non-Windows
-* sessions are not shown a hint that does not apply to them.
-*/
-const WINDOWS_PATH_HINT = "\n\nWindows note: the `path` argument accepts both Windows paths (e.g. `C:\\Users\\foo`) and POSIX-style paths (e.g. `/c/Users/foo`). Matched paths are returned in Windows backslash form; convert them to forward slashes before using them in a Bash command.";
-const S_IFMT$2 = 61440;
-const S_IFDIR$1 = 16384;
-/**
-* Tool-level description shown to the LLM at tool declaration time.
-* Tells the model — before any round-trip — which patterns are accepted,
-* how brace expansion is handled, and which directories are too large to
-* recurse into. On a Windows backend the description also carries
-* `WINDOWS_PATH_HINT` (path-shape guidance).
-*/
-var GlobTool = class {
-	kaos;
-	workspace;
-	name = "Glob";
-	description;
-	parameters = toInputJsonSchema(GlobInputSchema);
-	constructor(kaos, workspace) {
-		this.kaos = kaos;
-		this.workspace = workspace;
-		this.description = this.kaos.pathClass() === "win32" ? glob_default + WINDOWS_PATH_HINT : glob_default;
-	}
-	resolveExecution(args) {
-		let path;
-		if (args.path !== void 0) path = resolvePathAccessPath(args.path, {
-			kaos: this.kaos,
-			workspace: this.workspace,
-			operation: "search",
-			policy: {
-				guardMode: "absolute-outside-allowed",
-				checkSensitive: false
-			}
-		});
-		const searchRoots = [path ?? this.workspace.workspaceDir];
-		const detailParts = [];
-		detailParts.push(`pattern: ${args.pattern}`);
-		if (args.path !== void 0) detailParts.push(`path: ${args.path}`);
-		if (args.include_dirs === false) detailParts.push("include_dirs: false");
-		return {
-			accesses: ToolAccesses.searchTree(searchRoots[0]),
-			description: `Searching ${args.pattern}`,
-			display: {
-				kind: "file_io",
-				operation: "glob",
-				path: searchRoots[0],
-				detail: detailParts.join(", ")
-			},
-			approvalRule: literalRulePattern(this.name, args.pattern),
-			matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.pattern),
-			execute: () => this.execution(args, searchRoots)
-		};
-	}
-	async execution(args, searchRoots) {
-		const subPatterns = expandBraces(args.pattern).map((p) => hasGlobEscape(p) ? p : normalize$1(p));
-		const includeDirs = args.include_dirs ?? true;
-		for (const root of searchRoots) try {
-			const iter = this.kaos.iterdir(root);
-			await iter.next();
-			if (typeof iter.return === "function") await iter.return(void 0);
-		} catch (error) {
-			if (error !== null && typeof error === "object" && "code" in error) {
-				const code = error.code;
-				if (code === "ENOENT") return {
-					isError: true,
-					output: `${root} does not exist`
-				};
-				if (code === "ENOTDIR") return {
-					isError: true,
-					output: `${root} is not a directory`
-				};
-			}
-		}
-		try {
-			const seen = /* @__PURE__ */ new Set();
-			const entries = [];
-			const YIELD_SAFETY_CAP = 200 * subPatterns.length;
-			let yielded = 0;
-			let truncated = false;
-			outer: for (const root of searchRoots) for (const subPattern of subPatterns) for await (const filePath of this.kaos.glob(root, subPattern)) {
-				yielded++;
-				if (yielded >= YIELD_SAFETY_CAP) {
-					truncated = true;
-					break outer;
-				}
-				if (seen.has(filePath)) continue;
-				if (entries.length >= 100) {
-					truncated = true;
-					break outer;
-				}
-				seen.add(filePath);
-				let mtime = 0;
-				let isDir = false;
-				try {
-					const st = await this.kaos.stat(filePath);
-					mtime = st.stMtime ?? 0;
-					isDir = (st.stMode & S_IFMT$2) === S_IFDIR$1;
-				} catch {}
-				if (!includeDirs && isDir) continue;
-				entries.push({
-					path: filePath,
-					mtime
-				});
-			}
-			entries.sort((a, b) => b.mtime - a.mtime);
-			const paths = entries.map((e) => e.path);
-			const pathClass = this.kaos.pathClass();
-			const relBase = searchRoots[0] ?? this.workspace.workspaceDir;
-			const shouldRelativize = isWithinDirectory(relBase, this.workspace.workspaceDir, pathClass);
-			const displayLines = paths.map((p) => shouldRelativize ? relativizeIfUnder$1(p, relBase, pathClass) : p);
-			if (entries.length === 0 && !truncated) return { output: "No matches found" };
-			const lines = [];
-			if (truncated) {
-				lines.push(`[Truncated at ${String(100)} matches — ${String(seen.size)} matched so far, use a more specific pattern]`);
-				lines.push(`Only the first ${String(100)} matches are returned.`);
-			}
-			lines.push(...displayLines);
-			if (!truncated && entries.length === 100) lines.push(`Found ${String(entries.length)} matches`);
-			return { output: lines.join("\n") };
-		} catch (error) {
-			if (error !== null && typeof error === "object" && "code" in error) {
-				const code = error.code;
-				const path = searchRoots[0] ?? this.workspace.workspaceDir;
-				if (code === "ENOENT") return {
-					isError: true,
-					output: `${path} does not exist`
-				};
-				if (code === "ENOTDIR") return {
-					isError: true,
-					output: `${path} is not a directory`
-				};
-			}
-			return {
-				isError: true,
-				output: error instanceof Error ? error.message : String(error)
-			};
-		}
-	}
-};
-/**
-* If `candidate` is under `base`, return the portion after `base/`.
-* Otherwise return `candidate` unchanged (absolute). Both arguments
-* should be canonical absolute paths.
-*/
-function relativizeIfUnder$1(candidate, base, pathClass) {
-	const normCandidate = normalize$1(candidate);
-	const normBase = normalize$1(base);
-	const comparableCandidate = pathClass === "win32" ? normCandidate.toLowerCase() : normCandidate;
-	const comparableBase = pathClass === "win32" ? normBase.toLowerCase() : normBase;
-	if (comparableCandidate === comparableBase) return ".";
-	const prefix = comparableBase.endsWith("/") ? comparableBase : comparableBase + "/";
-	if (comparableCandidate.startsWith(prefix)) return normCandidate.slice(prefix.length);
-	return normCandidate;
-}
-/**
-* Expand brace alternations (`{a,b,c}`, `{src,test}/**`) into a flat list
-* of sub-patterns. Recursive — handles cartesian products (`{a,b}/{c,d}.ts`
-* → 4 patterns) and one or more levels of nesting (`{a,{b,c}}.ts`).
-*
-* Falls through with the original pattern as a single-element list when:
-*   - the pattern contains no `{...}` group at all;
-*   - the pattern contains `{...}` groups but none have a top-level comma
-*     (e.g. `{abc}` — bash treats those as literal);
-*   - braces are unbalanced (a stray `{` with no matching `}`, etc.);
-*   - expansion would produce more than `MAX_BRACE_EXPANSIONS` patterns —
-*     pathological cartesian inputs (`{a,b}{c,d}{e,f}{g,h}{i,j}{k,l,m}`
-*     ≥ 192) bail out rather than fan out unboundedly.
-*
-* Backslash-escaped braces (`\{`, `\}`) are treated as literals and skip
-* the structural recognition so a user can opt out of expansion.
-*/
-function expandBraces(pattern) {
-	const out = [];
-	if (!expandInto(pattern, out, MAX_BRACE_EXPANSIONS)) return [pattern];
-	return out;
-}
-function hasGlobEscape(pattern) {
-	return /\\[{}[\]*?,]/.test(pattern);
-}
-function expandInto(pattern, out, cap) {
-	let depth = 0;
-	let start = -1;
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === "\\" && i + 1 < pattern.length) {
-			i++;
-			continue;
-		}
-		if (ch === "{") {
-			if (depth === 0) start = i;
-			depth++;
-			continue;
-		}
-		if (ch === "}") {
-			if (depth === 0) return pushLiteral(pattern, out, cap);
-			depth--;
-			if (depth === 0 && start !== -1) {
-				const parts = splitTopLevelCommas(pattern.slice(start + 1, i));
-				if (parts.length < 2) {
-					start = -1;
-					continue;
-				}
-				const prefix = pattern.slice(0, start);
-				const suffix = pattern.slice(i + 1);
-				for (const part of parts) {
-					if (out.length >= cap) return false;
-					if (!expandInto(prefix + part + suffix, out, cap)) return false;
-				}
-				return true;
-			}
-		}
-	}
-	if (depth !== 0) return pushLiteral(pattern, out, cap);
-	return pushLiteral(pattern, out, cap);
-}
-function pushLiteral(pattern, out, cap) {
-	if (out.length >= cap) return false;
-	out.push(pattern);
-	return true;
-}
-/**
-* Split on commas that sit at brace depth zero. Used by `expandBraces`
-* to slice a `{a,{b,c},d}` group into `["a", "{b,c}", "d"]` rather than
-* `["a", "{b", "c}", "d"]`.
-*/
-function splitTopLevelCommas(s) {
-	const parts = [];
-	let depth = 0;
-	let last = 0;
-	for (let i = 0; i < s.length; i++) {
-		const ch = s[i];
-		if (ch === "\\" && i + 1 < s.length) {
-			i++;
-			continue;
-		}
-		if (ch === "{") depth++;
-		else if (ch === "}") depth--;
-		else if (ch === "," && depth === 0) {
-			parts.push(s.slice(last, i));
-			last = i + 1;
-		}
-	}
-	parts.push(s.slice(last));
-	return parts;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/tar@7.5.13/node_modules/tar/dist/esm/index.min.js
 var kr = Object.defineProperty;
 var vr = (s, t) => {
@@ -104310,6 +104085,386 @@ function rgUnavailableMessage(cause) {
 Error: ${cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "unknown error"}\n\nFix options:\n  macOS:   brew install ripgrep\n  Ubuntu:  sudo apt-get install ripgrep\n  Other:   https://github.com/BurntSushi/ripgrep#installation\n\nAlternatively, drop a static rg binary at ${join$4(getShareDir(), "bin", rgBinaryName())}`;
 }
 //#endregion
+//#region ../../packages/agent-core/src/tools/support/stream.ts
+function isPrematureCloseError(error) {
+	return error instanceof Error && error.code === "ERR_STREAM_PREMATURE_CLOSE";
+}
+//#endregion
+//#region ../../packages/agent-core/src/tools/support/run-rg.ts
+const DEFAULT_TIMEOUT_MS$1 = 2e4;
+const MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+const VCS_DIRECTORIES_TO_EXCLUDE = [
+	".git",
+	".svn",
+	".hg",
+	".bzr",
+	".jj",
+	".sl"
+];
+const SENSITIVE_GLOBS_TO_EXCLUDE = [
+	"**/.env",
+	...[
+		"id_rsa",
+		"id_ed25519",
+		"id_ecdsa"
+	].flatMap((name) => [
+		`**/${name}`,
+		`**/${name}[-_]*`,
+		...SENSITIVE_DOT_VARIANT_SUFFIXES.map((suffix) => `**/${name}${suffix}`)
+	]),
+	"**/.aws/credentials",
+	"**/.aws/credentials/**",
+	"**/.gcp/credentials",
+	"**/.gcp/credentials/**"
+];
+async function disposeProcess$1(proc) {
+	try {
+		await proc.dispose();
+	} catch {}
+}
+async function runRipgrepOnce(kaos, rgArgs, signal, options = {}) {
+	const abortedMessage = options.abortedMessage ?? "Aborted";
+	if (signal.aborted) return {
+		kind: "tool-error",
+		result: {
+			isError: true,
+			output: abortedMessage
+		}
+	};
+	let proc;
+	try {
+		proc = await kaos.exec(...rgArgs);
+	} catch (error) {
+		return {
+			kind: "tool-error",
+			result: {
+				isError: true,
+				output: error instanceof Error && "code" in error && error.code === "ENOENT" ? rgUnavailableMessage(error) : error instanceof Error ? error.message : String(error)
+			}
+		};
+	}
+	try {
+		proc.stdin.end();
+	} catch {}
+	let timedOut = false;
+	let aborted = false;
+	let killed = false;
+	const killProc = async () => {
+		if (killed) return;
+		killed = true;
+		try {
+			await proc.kill("SIGTERM");
+		} catch {}
+		const exited = proc.wait().then(() => true).catch(() => true);
+		if (!await Promise.race([exited, new Promise((resolve) => {
+			setTimeout(() => {
+				resolve(false);
+			}, 5e3);
+		})]) && proc.exitCode === null) try {
+			await proc.kill("SIGKILL");
+		} catch {}
+		await disposeProcess$1(proc);
+	};
+	const onAbort = () => {
+		aborted = true;
+		killProc();
+	};
+	signal.addEventListener("abort", onAbort);
+	if (signal.aborted) onAbort();
+	const timeoutHandle = setTimeout(() => {
+		timedOut = true;
+		killProc();
+	}, DEFAULT_TIMEOUT_MS$1);
+	let exitCode = 0;
+	let stdoutText = "";
+	let stderrText = "";
+	let bufferTruncated = false;
+	let stderrTruncated = false;
+	try {
+		const isTerminating = () => timedOut || aborted || killed;
+		const [stdoutResult, stderrResult, code] = await Promise.all([
+			readStreamWithCap(proc.stdout, MAX_OUTPUT_BYTES, isTerminating),
+			readStreamWithCap(proc.stderr, MAX_OUTPUT_BYTES, isTerminating),
+			proc.wait()
+		]);
+		stdoutText = stdoutResult.text;
+		stderrText = stderrResult.text;
+		bufferTruncated = stdoutResult.truncated;
+		stderrTruncated = stderrResult.truncated;
+		exitCode = code;
+	} catch (error) {
+		if (isPrematureCloseError(error) && (timedOut || aborted || killed)) {} else return {
+			kind: "tool-error",
+			result: {
+				isError: true,
+				output: error instanceof Error ? error.message : String(error)
+			}
+		};
+	} finally {
+		clearTimeout(timeoutHandle);
+		signal.removeEventListener("abort", onAbort);
+		await disposeProcess$1(proc);
+	}
+	if (aborted) return {
+		kind: "tool-error",
+		result: {
+			isError: true,
+			output: abortedMessage
+		}
+	};
+	return {
+		kind: "result",
+		exitCode,
+		stdoutText,
+		stderrText,
+		bufferTruncated,
+		stderrTruncated,
+		timedOut
+	};
+}
+function shouldRetryRipgrepEagain(result) {
+	return result.exitCode !== 0 && result.exitCode !== 1 && !result.timedOut && isEagainRipgrepError(result.stderrText);
+}
+function isEagainRipgrepError(stderr) {
+	return stderr.includes("os error 11") || stderr.includes("Resource temporarily unavailable");
+}
+async function readStreamWithCap(stream, maxBytes, suppressPrematureClose) {
+	const chunks = [];
+	let total = 0;
+	let truncated = false;
+	try {
+		for await (const chunk of stream) {
+			const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+			if (truncated) continue;
+			if (total + buf.length > maxBytes) {
+				const remaining = maxBytes - total;
+				if (remaining > 0) chunks.push(buf.subarray(0, remaining));
+				total = maxBytes;
+				truncated = true;
+				continue;
+			}
+			chunks.push(buf);
+			total += buf.length;
+		}
+	} catch (error) {
+		if (!isPrematureCloseError(error) || suppressPrematureClose?.() !== true) throw error;
+	}
+	return {
+		text: Buffer.concat(chunks).toString("utf8"),
+		truncated
+	};
+}
+//#endregion
+//#region ../../packages/agent-core/src/tools/builtin/file/glob.md?raw
+var glob_default = "Find files by glob pattern, sorted by modification time (most recent first).\n\nPowered by ripgrep. Respects `.gitignore`, `.ignore`, and `.rgignore` by default — set `include_ignored` to also match ignored files (e.g. build outputs, `node_modules`). Sensitive files (such as `.env`) are always filtered out.\n\nGood patterns:\n- `*.ts` — all files matching an extension, at any depth below the search root (a bare pattern without `/` matches recursively)\n- `src/*.ts` — files directly inside `src/` (one level, not recursive)\n- `src/**/*.ts` — recursive walk with a subdirectory anchor and extension\n- `**/*.py` — recursive walk from the search root for an extension\n- `*.{ts,tsx}` — brace expansion is supported\n- `{src,test}/**/*.ts` — cartesian brace expansion is supported too\n\nResults are capped at the first 100 matching paths. If a search would return more, a truncation marker is appended. Refine the pattern (extension, subdirectory) when 100 is not enough, or call again with a narrower anchor.\n\nLarge-directory caveat — avoid recursing into dependency / build output even with an anchor, especially when `include_ignored` is set:\n- `node_modules/**/*.js`, `.venv/**/*.py`, `__pycache__/**`, `target/**` can produce thousands of results that truncate at the match cap and waste context. Prefer specific subpaths like `node_modules/react/src/**/*.js`.\n";
+//#endregion
+//#region ../../packages/agent-core/src/tools/builtin/file/glob.ts
+const GlobInputSchema = object({
+	pattern: string().describe("Glob pattern to match files."),
+	path: string().optional().describe("Absolute path to the directory to search in. Defaults to the current working directory."),
+	include_ignored: boolean$1().optional().describe("Also match files excluded by ignore files such as `.gitignore`, `.ignore`, and `.rgignore` (for example `node_modules` or build outputs). Sensitive files (such as `.env`) remain filtered out for safety. Defaults to false."),
+	include_dirs: boolean$1().optional().describe("Deprecated and ignored. Results are always files-only — directories are never listed. Accepted only so older calls that still pass this flag are not rejected by parameter validation.")
+});
+/**
+* Path-shape hint appended to the tool description only on a Windows
+* (`win32` path class) backend. The `path` argument accepts both native
+* Windows paths and POSIX-style paths, but matched paths come back in
+* Windows backslash form — a command run through Bash must convert them
+* to forward slashes first. Injected conditionally so non-Windows
+* sessions are not shown a hint that does not apply to them.
+*/
+const WINDOWS_PATH_HINT = "\n\nWindows note: the `path` argument accepts both Windows paths (e.g. `C:\\Users\\foo`) and POSIX-style paths (e.g. `/c/Users/foo`). Matched paths are returned in Windows backslash form; convert them to forward slashes before using them in a Bash command.";
+const S_IFMT$2 = 61440;
+const S_IFDIR$1 = 16384;
+/**
+* Tool-level description shown to the LLM at tool declaration time.
+* Tells the model — before any round-trip — which patterns are accepted,
+* how brace expansion is handled, and which directories are too large to
+* recurse into. On a Windows backend the description also carries
+* `WINDOWS_PATH_HINT` (path-shape guidance).
+*/
+var GlobTool = class {
+	kaos;
+	workspace;
+	name = "Glob";
+	description;
+	parameters = toInputJsonSchema(GlobInputSchema);
+	telemetry;
+	constructor(kaos, workspace, telemetry = noopTelemetryClient) {
+		this.kaos = kaos;
+		this.workspace = workspace;
+		this.telemetry = telemetry;
+		this.description = this.kaos.pathClass() === "win32" ? glob_default + WINDOWS_PATH_HINT : glob_default;
+	}
+	resolveExecution(args) {
+		let path;
+		if (args.path !== void 0) path = resolvePathAccessPath(args.path, {
+			kaos: this.kaos,
+			workspace: this.workspace,
+			operation: "search",
+			policy: {
+				guardMode: "absolute-outside-allowed",
+				checkSensitive: false
+			}
+		});
+		const searchRoots = [path ?? this.workspace.workspaceDir];
+		const detailParts = [`pattern: ${args.pattern}`];
+		if (args.path !== void 0) detailParts.push(`path: ${args.path}`);
+		if (args.include_ignored === true) detailParts.push("include_ignored: true");
+		return {
+			accesses: ToolAccesses.searchTree(searchRoots[0]),
+			description: `Searching ${args.pattern}`,
+			display: {
+				kind: "file_io",
+				operation: "glob",
+				path: searchRoots[0],
+				detail: detailParts.join(", ")
+			},
+			approvalRule: literalRulePattern(this.name, args.pattern),
+			matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.pattern),
+			execute: ({ signal }) => this.execution(args, signal, searchRoots)
+		};
+	}
+	async execution(args, signal, searchRoots) {
+		const searchRoot = searchRoots[0] ?? this.workspace.workspaceDir;
+		try {
+			if (((await this.kaos.stat(searchRoot)).stMode & S_IFMT$2) !== S_IFDIR$1) return {
+				isError: true,
+				output: `${searchRoot} is not a directory`
+			};
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return {
+				isError: true,
+				output: `${searchRoot} does not exist`
+			};
+			return {
+				isError: true,
+				output: error instanceof Error ? error.message : String(error)
+			};
+		}
+		let rgPath;
+		try {
+			const resolution = await ensureRgPath({ signal });
+			rgPath = resolution.path;
+			if (resolution.source !== "system-path") this.telemetry.track("glob_tool_rg_fallback", {
+				source: resolution.source,
+				outcome: "resolved"
+			});
+		} catch (error) {
+			if (isAbortError$3(error)) return {
+				isError: true,
+				output: "Glob aborted"
+			};
+			this.telemetry.track("glob_tool_rg_fallback", { outcome: "failed" });
+			return {
+				isError: true,
+				output: rgUnavailableMessage(error)
+			};
+		}
+		const execKaos = this.kaos.withCwd(searchRoot);
+		let runResult = await runRipgrepOnce(execKaos, buildRgArgs$1(rgPath, args), signal, { abortedMessage: "Glob aborted" });
+		if (runResult.kind === "tool-error") return runResult.result;
+		if (shouldRetryRipgrepEagain(runResult)) {
+			runResult = await runRipgrepOnce(execKaos, buildRgArgs$1(rgPath, args, true), signal, { abortedMessage: "Glob aborted" });
+			if (runResult.kind === "tool-error") return runResult.result;
+		}
+		const { exitCode, stdoutText, stderrText, bufferTruncated, timedOut } = runResult;
+		let traversalWarning;
+		if (exitCode !== 0 && exitCode !== 1 && !timedOut) {
+			if (splitCompletePaths(stdoutText, true).length === 0) return {
+				isError: true,
+				output: formatGlobError(searchRoot, stderrText)
+			};
+			traversalWarning = formatGlobWarning(stderrText);
+		}
+		if (signal.aborted) return {
+			isError: true,
+			output: "Glob aborted"
+		};
+		const rawPaths = splitCompletePaths(stdoutText, bufferTruncated || timedOut).map((p) => resolve$2(searchRoot, p));
+		const kept = [];
+		let filteredSensitive = 0;
+		for (const p of rawPaths) if (isSensitiveFile(p)) filteredSensitive++;
+		else kept.push(p);
+		const truncated = kept.length > 100;
+		const limited = truncated ? kept.slice(0, 100) : kept;
+		if (limited.length === 0 && !timedOut) {
+			if (filteredSensitive > 0) return { output: `No non-sensitive matches found (${String(filteredSensitive)} sensitive file(s) filtered).` };
+			return { output: "No matches found" };
+		}
+		const pathClass = this.kaos.pathClass();
+		const shouldRelativize = isWithinDirectory(searchRoot, this.workspace.workspaceDir, pathClass);
+		const displayLines = limited.map((p) => shouldRelativize ? relativizeIfUnder$1(p, searchRoot, pathClass) : p);
+		const lines = [];
+		if (timedOut) lines.push(`Glob timed out after ${String(DEFAULT_TIMEOUT_MS$1 / 1e3)}s; partial results returned.`);
+		if (bufferTruncated) lines.push(`[stdout truncated at ${String(MAX_OUTPUT_BYTES)} bytes; results may be incomplete — use a more specific pattern]`);
+		if (traversalWarning !== void 0) lines.push(traversalWarning);
+		if (truncated) {
+			lines.push(`[Truncated at ${String(100)} matches — use a more specific pattern]`);
+			lines.push(`Only the first ${String(100)} matches are returned.`);
+		}
+		lines.push(...displayLines);
+		if (filteredSensitive > 0) lines.push(`Filtered ${String(filteredSensitive)} sensitive file(s).`);
+		if (!truncated && limited.length === 100) lines.push(`Found ${String(limited.length)} matches`);
+		return { output: lines.join("\n") };
+	}
+};
+function buildRgArgs$1(rgPath, args, singleThreaded = false) {
+	const cmd = [rgPath];
+	if (singleThreaded) cmd.push("-j", "1");
+	cmd.push("--files", "--hidden", "--sortr=modified");
+	for (const dir of VCS_DIRECTORIES_TO_EXCLUDE) cmd.push("--glob", `!${dir}`);
+	cmd.push("--glob", args.pattern);
+	for (const glob of SENSITIVE_GLOBS_TO_EXCLUDE) cmd.push("--glob", `!${glob}`);
+	if (args.include_ignored) cmd.push("--no-ignore");
+	cmd.push(".");
+	return cmd;
+}
+function formatGlobError(searchRoot, stderr) {
+	const trimmed = stderr.trim();
+	if (/no such file or directory/i.test(trimmed)) return `${searchRoot} does not exist`;
+	return trimmed.length > 0 ? `Glob failed: ${trimmed}` : "Glob failed";
+}
+function formatGlobWarning(stderr) {
+	const trimmed = stderr.trim();
+	return trimmed.length > 0 ? `Glob completed with warnings; some directories could not be read: ${trimmed}` : "Glob completed with warnings; some directories could not be read.";
+}
+function errorCode(error) {
+	if (error !== null && typeof error === "object" && "code" in error) {
+		const code = error.code;
+		return typeof code === "string" ? code : void 0;
+	}
+}
+/**
+* Split `rg --files` stdout into complete paths. When the run was capped or
+* timed out (`truncatedOutput`), a path cut mid-write lacks its terminating
+* newline; drop that trailing fragment so it is never surfaced as a match.
+* Complete output always ends in `\n`, so the split is lossless in that case.
+*/
+function splitCompletePaths(stdoutText, truncatedOutput) {
+	let text = stdoutText;
+	if (truncatedOutput && !text.endsWith("\n")) {
+		const lastNewline = text.lastIndexOf("\n");
+		text = lastNewline >= 0 ? text.slice(0, lastNewline + 1) : "";
+	}
+	return text.split("\n").filter((p) => p.length > 0);
+}
+/**
+* If `candidate` is under `base`, return the portion after `base/`.
+* Otherwise return `candidate` unchanged (absolute). Both arguments
+* should be canonical absolute paths.
+*/
+function relativizeIfUnder$1(candidate, base, pathClass) {
+	const normCandidate = normalize$1(candidate);
+	const normBase = normalize$1(base);
+	const comparableCandidate = pathClass === "win32" ? normCandidate.toLowerCase() : normCandidate;
+	const comparableBase = pathClass === "win32" ? normBase.toLowerCase() : normBase;
+	if (comparableCandidate === comparableBase) return ".";
+	const prefix = comparableBase.endsWith("/") ? comparableBase : comparableBase + "/";
+	if (comparableCandidate.startsWith(prefix)) return normCandidate.slice(prefix.length);
+	return normCandidate;
+}
+//#endregion
 //#region ../../packages/agent-core/src/tools/support/result-builder.ts
 const DEFAULT_MAX_CHARS = 5e4;
 const DEFAULT_MAX_LINE_LENGTH = 2e3;
@@ -104394,11 +104549,6 @@ var ToolResultBuilder = class {
 	}
 };
 //#endregion
-//#region ../../packages/agent-core/src/tools/support/stream.ts
-function isPrematureCloseError(error) {
-	return error instanceof Error && error.code === "ERR_STREAM_PREMATURE_CLOSE";
-}
-//#endregion
 //#region ../../packages/agent-core/src/tools/builtin/file/grep.md?raw
 var grep_default = "Search file contents using regular expressions (powered by ripgrep).\n\nUse Grep when the task is to find unknown content or unknown file locations. Do not use shell `grep` or `rg` directly; this tool applies workspace path policy, output limits, and sensitive-file filtering.\nALWAYS use Grep tool instead of running `grep` or `rg` from a shell — direct shell calls bypass workspace policy, output limits, and sensitive-file filtering.\nIf you already know a concrete file path and need to inspect its contents, use Read directly instead.\n\nWrite patterns in ripgrep regex syntax, which differs from POSIX `grep` syntax. For example, braces are special, so escape them as `\\{` to match a literal `{`.\n\nHidden files (dotfiles such as `.gitlab-ci.yml` or `.eslintrc.json`) are searched by default. To also search files excluded by `.gitignore` (such as `node_modules` or build outputs), set `include_ignored` to `true`. Sensitive files (such as `.env`) are always skipped for safety, even when `include_ignored` is `true`.\n";
 //#endregion
@@ -104436,41 +104586,9 @@ object({
 	numMatches: number$1().int().nonnegative().optional(),
 	appliedLimit: number$1().int().nonnegative().optional()
 });
-const DEFAULT_TIMEOUT_MS$1 = 2e4;
-const SIGTERM_GRACE_MS = 5e3;
-const MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
-async function disposeProcess$1(proc) {
-	try {
-		await proc.dispose();
-	} catch {}
-}
 const RG_MAX_COLUMNS = 500;
 const DEFAULT_HEAD_LIMIT = 250;
 const MTIME_STAT_CONCURRENCY = 32;
-const VCS_DIRECTORIES_TO_EXCLUDE = [
-	".git",
-	".svn",
-	".hg",
-	".bzr",
-	".jj",
-	".sl"
-];
-const SENSITIVE_GLOBS_TO_EXCLUDE = [
-	"**/.env",
-	...[
-		"id_rsa",
-		"id_ed25519",
-		"id_ecdsa"
-	].flatMap((name) => [
-		`**/${name}`,
-		`**/${name}[-_]*`,
-		...SENSITIVE_DOT_VARIANT_SUFFIXES.map((suffix) => `**/${name}${suffix}`)
-	]),
-	"**/.aws/credentials",
-	"**/.aws/credentials/**",
-	"**/.gcp/credentials",
-	"**/.gcp/credentials/**"
-];
 const CONTENT_LINE_RE = /^(.*?)([:-])(\d+)\2/;
 var GrepTool = class {
 	kaos;
@@ -104478,9 +104596,11 @@ var GrepTool = class {
 	name = "Grep";
 	description = grep_default;
 	parameters = toInputJsonSchema(GrepInputSchema);
-	constructor(kaos, workspace) {
+	telemetry;
+	constructor(kaos, workspace, telemetry = noopTelemetryClient) {
 		this.kaos = kaos;
 		this.workspace = workspace;
+		this.telemetry = telemetry;
 	}
 	resolveExecution(args) {
 		let path;
@@ -104516,21 +104636,27 @@ var GrepTool = class {
 		const pathClass = this.kaos.pathClass();
 		let rgPath;
 		try {
-			rgPath = (await ensureRgPath({ signal })).path;
+			const resolution = await ensureRgPath({ signal });
+			rgPath = resolution.path;
+			if (resolution.source !== "system-path") this.telemetry.track("grep_tool_rg_fallback", {
+				source: resolution.source,
+				outcome: "resolved"
+			});
 		} catch (error) {
 			if (isAbortError$3(error)) return {
 				isError: true,
 				output: "Grep aborted"
 			};
+			this.telemetry.track("grep_tool_rg_fallback", { outcome: "failed" });
 			return {
 				isError: true,
 				output: rgUnavailableMessage(error)
 			};
 		}
-		let runResult = await runRipgrepOnce(this.kaos, buildRgArgs(rgPath, args, searchPaths), signal);
+		let runResult = await runRipgrepOnce(this.kaos, buildRgArgs(rgPath, args, searchPaths), signal, { abortedMessage: "Grep aborted" });
 		if (runResult.kind === "tool-error") return runResult.result;
 		if (shouldRetryRipgrepEagain(runResult)) {
-			runResult = await runRipgrepOnce(this.kaos, buildRgArgs(rgPath, args, searchPaths, true), signal);
+			runResult = await runRipgrepOnce(this.kaos, buildRgArgs(rgPath, args, searchPaths, true), signal, { abortedMessage: "Grep aborted" });
 			if (runResult.kind === "tool-error") return runResult.result;
 		}
 		const { exitCode, stderrText, bufferTruncated, stderrTruncated, timedOut } = runResult;
@@ -104605,111 +104731,6 @@ var GrepAbortedError = class extends Error {
 		this.name = "GrepAbortedError";
 	}
 };
-async function runRipgrepOnce(kaos, rgArgs, signal) {
-	if (signal.aborted) return {
-		kind: "tool-error",
-		result: {
-			isError: true,
-			output: "Grep aborted"
-		}
-	};
-	let proc;
-	try {
-		proc = await kaos.exec(...rgArgs);
-	} catch (error) {
-		return {
-			kind: "tool-error",
-			result: {
-				isError: true,
-				output: error instanceof Error && "code" in error && error.code === "ENOENT" ? rgUnavailableMessage(error) : error instanceof Error ? error.message : String(error)
-			}
-		};
-	}
-	try {
-		proc.stdin.end();
-	} catch {}
-	let timedOut = false;
-	let aborted = false;
-	let killed = false;
-	const killProc = async () => {
-		if (killed) return;
-		killed = true;
-		try {
-			await proc.kill("SIGTERM");
-		} catch {}
-		const exited = proc.wait().then(() => true).catch(() => true);
-		if (!await Promise.race([exited, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve(false);
-			}, SIGTERM_GRACE_MS);
-		})]) && proc.exitCode === null) try {
-			await proc.kill("SIGKILL");
-		} catch {}
-		await disposeProcess$1(proc);
-	};
-	const onAbort = () => {
-		aborted = true;
-		killProc();
-	};
-	signal.addEventListener("abort", onAbort);
-	if (signal.aborted) onAbort();
-	const timeoutHandle = setTimeout(() => {
-		timedOut = true;
-		killProc();
-	}, DEFAULT_TIMEOUT_MS$1);
-	let exitCode = 0;
-	let stdoutText = "";
-	let stderrText = "";
-	let bufferTruncated = false;
-	let stderrTruncated = false;
-	try {
-		const isTerminating = () => timedOut || aborted || killed;
-		const [stdoutResult, stderrResult, code] = await Promise.all([
-			readStreamWithCap(proc.stdout, MAX_OUTPUT_BYTES, isTerminating),
-			readStreamWithCap(proc.stderr, MAX_OUTPUT_BYTES, isTerminating),
-			proc.wait()
-		]);
-		stdoutText = stdoutResult.text;
-		stderrText = stderrResult.text;
-		bufferTruncated = stdoutResult.truncated;
-		stderrTruncated = stderrResult.truncated;
-		exitCode = code;
-	} catch (error) {
-		if (isPrematureCloseError(error) && (timedOut || aborted || killed)) {} else return {
-			kind: "tool-error",
-			result: {
-				isError: true,
-				output: error instanceof Error ? error.message : String(error)
-			}
-		};
-	} finally {
-		clearTimeout(timeoutHandle);
-		signal.removeEventListener("abort", onAbort);
-		await disposeProcess$1(proc);
-	}
-	if (aborted) return {
-		kind: "tool-error",
-		result: {
-			isError: true,
-			output: "Grep aborted"
-		}
-	};
-	return {
-		kind: "result",
-		exitCode,
-		stdoutText,
-		stderrText,
-		bufferTruncated,
-		stderrTruncated,
-		timedOut
-	};
-}
-function shouldRetryRipgrepEagain(result) {
-	return result.exitCode !== 0 && result.exitCode !== 1 && !result.timedOut && isEagainRipgrepError(result.stderrText);
-}
-function isEagainRipgrepError(stderr) {
-	return stderr.includes("os error 11") || stderr.includes("Resource temporarily unavailable");
-}
 async function sortFilesWithMatchesByMtime(lines, kaos, signal) {
 	const entries = await mapWithConcurrency(lines, MTIME_STAT_CONCURRENCY, signal, async (line, index) => {
 		const path = line.kind === "record" ? line.filePath : line.kind === "legacy" ? line.text : void 0;
@@ -104986,32 +105007,6 @@ function countPayloadFromLegacyLine(line) {
 	const idx = line.lastIndexOf(":");
 	return idx > 0 ? line.slice(idx + 1) : void 0;
 }
-async function readStreamWithCap(stream, maxBytes, suppressPrematureClose) {
-	const chunks = [];
-	let total = 0;
-	let truncated = false;
-	try {
-		for await (const chunk of stream) {
-			const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
-			if (truncated) continue;
-			if (total + buf.length > maxBytes) {
-				const remaining = maxBytes - total;
-				if (remaining > 0) chunks.push(buf.subarray(0, remaining));
-				total = maxBytes;
-				truncated = true;
-				continue;
-			}
-			chunks.push(buf);
-			total += buf.length;
-		}
-	} catch (error) {
-		if (!isPrematureCloseError(error) || suppressPrematureClose?.() !== true) throw error;
-	}
-	return {
-		text: Buffer.concat(chunks).toString("utf8"),
-		truncated
-	};
-}
 const IMAGE_MIME_BY_SUFFIX = Object.freeze({
 	".png": "image/png",
 	".jpg": "image/jpeg",
@@ -108540,8 +108535,8 @@ var ToolManager = class {
 			new ReadTool(kaos, workspace),
 			new WriteTool(kaos, workspace),
 			new EditTool(kaos, workspace),
-			new GrepTool(kaos, workspace),
-			new GlobTool(kaos, workspace),
+			new GrepTool(kaos, workspace, this.agent.telemetry),
+			new GlobTool(kaos, workspace, this.agent.telemetry),
 			new BashTool(kaos, cwd, background, { allowBackground }),
 			(modelCapabilities.image_in || modelCapabilities.video_in) && new ReadMediaFileTool(kaos, workspace, modelCapabilities, videoUploader),
 			new EnterPlanModeTool(this.agent),
@@ -108603,7 +108598,7 @@ var ToolManager = class {
 					...base,
 					outcome: "error",
 					duration_ms: Date.now() - startedAt,
-					error: error instanceof Error ? error.message : String(error)
+					error_type: error instanceof Error ? error.name : "Unknown"
 				});
 				throw error;
 			}
@@ -158254,6 +158249,382 @@ function normalizeOAuthHost(oauthHost) {
 	return oauthHost.trim().replace(/\/+$/, "");
 }
 //#endregion
+//#region ../../packages/oauth/src/refreshProviderModels.ts
+function readProvider(config, providerId) {
+	const provider = config.providers[providerId];
+	if (provider === void 0) return void 0;
+	return provider;
+}
+function readModel(config, alias) {
+	const model = config.models?.[alias];
+	if (model === void 0) return void 0;
+	return model;
+}
+function readCustomRegistrySource$1(provider) {
+	const source = provider.source;
+	if (typeof source !== "object" || source === null) return void 0;
+	const candidate = source;
+	if (candidate["kind"] !== "apiJson") return void 0;
+	const url = candidate["url"];
+	const apiKey = candidate["apiKey"];
+	if (typeof url !== "string" || url.length === 0) return void 0;
+	if (typeof apiKey !== "string") return void 0;
+	return {
+		kind: "apiJson",
+		url,
+		apiKey
+	};
+}
+function customRegistrySourceKey(source) {
+	return JSON.stringify([source.url]);
+}
+function customRegistrySourceCredentialKey(source) {
+	return JSON.stringify([source.url, source.apiKey]);
+}
+async function fetchCustomRegistryFromSources(sources) {
+	let lastError;
+	for (const source of sources) try {
+		return {
+			entries: await fetchCustomRegistry(source),
+			source
+		};
+	} catch (error) {
+		lastError = error;
+	}
+	if (lastError instanceof Error) throw lastError;
+	if (typeof lastError === "string") throw new Error(lastError);
+	throw new Error("No custom registry sources configured.");
+}
+function collectModelIdsForAliases(config, aliasKeys) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const aliasKey of aliasKeys) {
+		const alias = readModel(config, aliasKey);
+		if (alias !== void 0 && alias.model.length > 0) ids.add(alias.model);
+	}
+	return ids;
+}
+function providerAliasKeys(config, providerId) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [alias, raw] of Object.entries(config.models ?? {})) if (raw.provider === providerId) keys.add(alias);
+	return keys;
+}
+function generatedProviderAliasKeys(config, providerId, aliasPrefix) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [alias, raw] of Object.entries(config.models ?? {})) if (raw.provider === providerId && alias.startsWith(aliasPrefix)) keys.add(alias);
+	return keys;
+}
+function computeChanges(oldIds, newIds) {
+	let added = 0;
+	for (const id of newIds) if (!oldIds.has(id)) added++;
+	let removed = 0;
+	for (const id of oldIds) if (!newIds.has(id)) removed++;
+	return {
+		added,
+		removed
+	};
+}
+function providerModelSnapshot(config, providerId, aliasKeys) {
+	const snapshots = [];
+	for (const alias of aliasKeys) {
+		const model = readModel(config, alias);
+		if (model === void 0 || model.provider !== providerId) continue;
+		snapshots.push({
+			alias,
+			model: {
+				...model,
+				capabilities: model.capabilities === void 0 ? void 0 : model.capabilities.toSorted()
+			}
+		});
+	}
+	snapshots.sort((a, b) => a.alias.localeCompare(b.alias));
+	return JSON.stringify(snapshots);
+}
+function providerModelsEqual(config, nextConfig, providerId, aliasKeys) {
+	return providerModelSnapshot(config, providerId, aliasKeys) === providerModelSnapshot(nextConfig, providerId, aliasKeys);
+}
+function providerConfigSnapshot(config, providerId) {
+	return JSON.stringify(config.providers[providerId] ?? null);
+}
+function providerConfigEqual(config, nextConfig, providerId) {
+	return providerConfigSnapshot(config, providerId) === providerConfigSnapshot(nextConfig, providerId);
+}
+function providerRefreshAliasKeys(config, nextConfig, providerId, aliasPrefix) {
+	const keys = generatedProviderAliasKeys(config, providerId, aliasPrefix);
+	for (const key of providerAliasKeys(nextConfig, providerId)) keys.add(key);
+	return keys;
+}
+function preserveUserProviderAliases(config, providerId, refreshedAliasKeys) {
+	const preserved = {};
+	for (const [alias, raw] of Object.entries(config.models ?? {})) {
+		const model = raw;
+		if (model.provider !== providerId || refreshedAliasKeys.has(alias)) continue;
+		preserved[alias] = structuredClone(model);
+	}
+	return preserved;
+}
+function restoreProviderAliases(config, aliases) {
+	if (Object.keys(aliases).length === 0) return;
+	config.models = {
+		...config.models,
+		...aliases
+	};
+}
+function restoreDefaultSelection(config, defaultModel, defaultThinking) {
+	if (defaultModel === void 0 || readModel(config, defaultModel) === void 0) return;
+	config.defaultModel = defaultModel;
+	config.defaultThinking = (readModel(config, defaultModel)?.capabilities ?? []).includes("always_thinking") ? true : defaultThinking;
+}
+function clampDanglingDefault(config) {
+	if (config.defaultModel !== void 0 && readModel(config, config.defaultModel) === void 0) {
+		config.defaultModel = void 0;
+		config.defaultThinking = void 0;
+	}
+}
+function clearDefaultThinkingWhenDefaultRemoved(config, previousDefaultModel) {
+	if (previousDefaultModel !== void 0 && config.defaultModel === void 0) config.defaultThinking = void 0;
+}
+function pickDefaultModel(config, providerId, models) {
+	const firstModel = models[0];
+	if (firstModel === void 0) return "";
+	const existingDefault = config.defaultModel;
+	if (existingDefault !== void 0) {
+		const alias = readModel(config, existingDefault);
+		if (alias !== void 0 && alias.provider === providerId) {
+			const stillAvailable = models.find((m) => m.id === alias.model);
+			if (stillAvailable !== void 0) return stillAvailable.id;
+		}
+	}
+	return firstModel.id;
+}
+/**
+* Refresh remote model metadata for the configured providers and persist any
+* changes through the host. Handles three provider kinds, in order:
+*
+*  1. Managed Kimi Code (OAuth) — `GET /models` against the runtime endpoint.
+*  2. Open platforms (moonshot-cn, moonshot-ai, …) — platform catalog fetch.
+*  3. Custom registries (models.dev-style, keyed by `provider.source`).
+*
+* Each branch diffs old vs new and only writes when something actually changed
+* (`removeProvider` then `setConfig`). Failures are collected per-provider and
+* never abort the whole refresh. Pass `providerId` to scope the refresh to a
+* single provider; pass `scope: 'oauth'` to refresh only the managed provider.
+*/
+async function refreshProviderModels(host, options = {}) {
+	const changed = [];
+	const unchanged = [];
+	const failed = [];
+	const scope = options.scope ?? "all";
+	const targetId = options.providerId;
+	let config = await host.getConfig();
+	const managedProvider = readProvider(config, KIMI_CODE_PROVIDER_NAME$1);
+	if ((targetId === void 0 || targetId === "managed:kimi-code") && managedProvider !== void 0 && managedProvider.type === "kimi" && managedProvider.oauth !== void 0) try {
+		const auth = resolveKimiCodeRuntimeAuth({
+			configuredBaseUrl: managedProvider.baseUrl,
+			configuredOAuthRef: managedProvider.oauth
+		});
+		const models = await fetchManagedKimiCodeModels({
+			accessToken: await host.resolveOAuthToken(KIMI_CODE_PROVIDER_NAME$1, auth.oauthRef),
+			baseUrl: auth.baseUrl
+		});
+		if (models.length > 0) {
+			const next = structuredClone(config);
+			applyManagedKimiCodeConfig(next, {
+				models,
+				baseUrl: auth.baseUrl,
+				oauthKey: auth.oauthRef.key,
+				oauthHost: auth.oauthRef.oauthHost,
+				preserveDefaultModel: true
+			});
+			const refreshedAliasKeys = providerRefreshAliasKeys(config, next, KIMI_CODE_PROVIDER_NAME$1, `${KIMI_CODE_PLATFORM_ID}/`);
+			restoreProviderAliases(next, preserveUserProviderAliases(config, KIMI_CODE_PROVIDER_NAME$1, refreshedAliasKeys));
+			restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
+			clampDanglingDefault(next);
+			clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
+			if (providerModelsEqual(config, next, "managed:kimi-code", refreshedAliasKeys)) unchanged.push(KIMI_CODE_PROVIDER_NAME$1);
+			else {
+				const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
+				await host.removeProvider(KIMI_CODE_PROVIDER_NAME$1);
+				config = await host.setConfig({
+					providers: next.providers,
+					models: next.models,
+					defaultModel: next.defaultModel,
+					defaultThinking: next.defaultThinking
+				});
+				changed.push({
+					providerId: KIMI_CODE_PROVIDER_NAME$1,
+					providerName: "Kimi Code",
+					added,
+					removed
+				});
+			}
+		}
+	} catch (error) {
+		failed.push({
+			provider: KIMI_CODE_PROVIDER_NAME$1,
+			reason: error instanceof Error ? error.message : String(error)
+		});
+	}
+	if (scope === "oauth" || targetId === "managed:kimi-code") return {
+		changed,
+		unchanged,
+		failed
+	};
+	const openPlatformIds = Object.keys(config.providers).filter((id) => isOpenPlatformId(id));
+	for (const providerId of openPlatformIds) {
+		if (targetId !== void 0 && targetId !== providerId) continue;
+		const platform = getOpenPlatformById(providerId);
+		if (platform === void 0) continue;
+		const providerConfig = readProvider(config, providerId);
+		if (providerConfig === void 0) continue;
+		const apiKey = providerConfig.apiKey;
+		if (typeof apiKey !== "string" || apiKey.length === 0) continue;
+		try {
+			let models = await fetchOpenPlatformModels(platform, apiKey);
+			models = filterModelsByPrefix(models, platform);
+			if (models.length === 0) continue;
+			const selectedModelId = pickDefaultModel(config, providerId, models);
+			const selectedModel = models.find((m) => m.id === selectedModelId);
+			if (selectedModel === void 0) continue;
+			const next = structuredClone(config);
+			applyOpenPlatformConfig(next, {
+				platform,
+				models,
+				selectedModel,
+				thinking: false,
+				apiKey
+			});
+			const refreshedAliasKeys = providerRefreshAliasKeys(config, next, providerId, `${providerId}/`);
+			restoreProviderAliases(next, preserveUserProviderAliases(config, providerId, refreshedAliasKeys));
+			restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
+			clampDanglingDefault(next);
+			clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
+			if (providerModelsEqual(config, next, providerId, refreshedAliasKeys)) unchanged.push(providerId);
+			else {
+				const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
+				await host.removeProvider(providerId);
+				config = await host.setConfig({
+					providers: next.providers,
+					models: next.models,
+					defaultModel: next.defaultModel,
+					defaultThinking: next.defaultThinking
+				});
+				changed.push({
+					providerId,
+					providerName: platform.name,
+					added,
+					removed
+				});
+			}
+		} catch (error) {
+			failed.push({
+				provider: providerId,
+				reason: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	const customSources = /* @__PURE__ */ new Map();
+	for (const providerId of Object.keys(config.providers)) {
+		if (providerId === "managed:kimi-code") continue;
+		if (isOpenPlatformId(providerId)) continue;
+		const provider = readProvider(config, providerId);
+		if (provider === void 0) continue;
+		const source = readCustomRegistrySource$1(provider);
+		if (source === void 0) continue;
+		const key = customRegistrySourceKey(source);
+		const sourceKey = customRegistrySourceCredentialKey(source);
+		const entry = customSources.get(key);
+		if (entry !== void 0) {
+			if (!entry.sourceKeys.has(sourceKey)) {
+				entry.sources.push(source);
+				entry.sourceKeys.add(sourceKey);
+			}
+			entry.providerIds.push(providerId);
+		} else customSources.set(key, {
+			sources: [source],
+			sourceKeys: new Set([sourceKey]),
+			providerIds: [providerId]
+		});
+	}
+	for (const { sources, providerIds } of customSources.values()) {
+		if (targetId !== void 0 && !providerIds.includes(targetId)) continue;
+		try {
+			const { entries, source } = await fetchCustomRegistryFromSources(sources);
+			const next = structuredClone(config);
+			const changedProviders = [];
+			const providersToRemoveBeforeSet = /* @__PURE__ */ new Set();
+			let hasUnreportedConfigChange = false;
+			const remoteEntries = Object.values(entries);
+			const remoteEntriesByProviderId = new Map(remoteEntries.map((entry) => [entry.id, entry]));
+			const providerIdsToSync = new Set(providerIds);
+			if (targetId === void 0) for (const entry of remoteEntries) providerIdsToSync.add(entry.id);
+			for (const providerId of providerIdsToSync) {
+				if (targetId !== void 0 && providerId !== targetId) continue;
+				const entry = remoteEntriesByProviderId.get(providerId);
+				if (entry === void 0) {
+					const oldIds = collectModelIdsForAliases(config, providerAliasKeys(config, providerId));
+					removeCustomRegistryProvider(next, providerId);
+					changedProviders.push({
+						providerId,
+						providerName: providerId,
+						added: 0,
+						removed: oldIds.size
+					});
+					providersToRemoveBeforeSet.add(providerId);
+					continue;
+				}
+				const existed = config.providers[providerId] !== void 0;
+				applyCustomRegistryProvider(next, entry, source);
+				const refreshedAliasKeys = providerRefreshAliasKeys(config, next, providerId, `${providerId}/`);
+				if (existed) restoreProviderAliases(next, preserveUserProviderAliases(config, providerId, refreshedAliasKeys));
+				if (existed && providerModelsEqual(config, next, providerId, refreshedAliasKeys) && providerConfigEqual(config, next, providerId)) unchanged.push(providerId);
+				else if (existed && providerModelsEqual(config, next, providerId, refreshedAliasKeys)) {
+					unchanged.push(providerId);
+					providersToRemoveBeforeSet.add(providerId);
+					hasUnreportedConfigChange = true;
+				} else {
+					const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
+					changedProviders.push({
+						providerId,
+						providerName: entry.name || providerId,
+						added,
+						removed
+					});
+					if (existed) providersToRemoveBeforeSet.add(providerId);
+				}
+			}
+			if (changedProviders.length > 0 || hasUnreportedConfigChange) {
+				restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
+				clampDanglingDefault(next);
+				clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
+				for (const providerId of providersToRemoveBeforeSet) await host.removeProvider(providerId);
+				config = await host.setConfig({
+					providers: next.providers,
+					models: next.models,
+					defaultModel: next.defaultModel,
+					defaultThinking: next.defaultThinking
+				});
+				for (const change of changedProviders) changed.push({
+					providerId: change.providerId,
+					providerName: change.providerName,
+					added: change.added,
+					removed: change.removed
+				});
+			}
+		} catch (error) {
+			const reportedIds = targetId !== void 0 ? [targetId] : providerIds;
+			for (const providerId of reportedIds) failed.push({
+				provider: providerId,
+				reason: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	return {
+		changed,
+		unchanged,
+		failed
+	};
+}
+//#endregion
 //#region ../../packages/agent-core/src/session/provider-manager.ts
 var ProviderManager = class {
 	options;
@@ -160889,16 +161260,12 @@ function telemetryErrorReason(error) {
 }
 function clientTelemetryProperties(client) {
 	if (client === void 0) return {};
-	const properties = {};
-	addNonEmpty(properties, "client_id", client.id);
-	addNonEmpty(properties, "client_name", client.name);
-	addNonEmpty(properties, "client_version", client.version);
-	addNonEmpty(properties, "ui_mode", client.uiMode);
-	return properties;
-}
-function addNonEmpty(target, key, value) {
-	const trimmed = value?.trim();
-	if (trimmed !== void 0 && trimmed.length > 0) target[key] = trimmed;
+	return {
+		client_id: client.id ?? null,
+		client_name: client.name ?? null,
+		client_version: client.version ?? null,
+		ui_mode: client.uiMode ?? null
+	};
 }
 async function resumeSessionResult(summary, session, warning) {
 	const api = new SessionAPIImpl(session);
@@ -163600,10 +163967,12 @@ let FsSearchService = class FsSearchService extends Disposable {
 	gitignoreCache = /* @__PURE__ */ new Map();
 	rgPath = void 0;
 	rgMissingWarned = false;
-	constructor(sessions, logger) {
+	telemetry;
+	constructor(telemetry, sessions, logger) {
 		super();
 		this.sessions = sessions;
 		this.logger = logger;
+		this.telemetry = telemetry;
 	}
 	dispose() {
 		this.gitignoreCache.clear();
@@ -163650,6 +164019,7 @@ let FsSearchService = class FsSearchService extends Disposable {
 		try {
 			const rg = await this.probeRg();
 			if (rg !== null) return await this.grepWithRg(rg, realCwd, req, abortController.signal, startedAt);
+			this.telemetry.track("fs_grep_node_fallback", { reason: "rg_missing" });
 			return await this.grepWithNode(realCwd, req, abortController.signal, startedAt);
 		} finally {
 			clearTimeout(timeoutHandle);
@@ -163920,7 +164290,7 @@ let FsSearchService = class FsSearchService extends Disposable {
 		return ig;
 	}
 };
-FsSearchService = __decorate([__decorateParam(0, ISessionService), __decorateParam(1, ILogService)], FsSearchService);
+FsSearchService = __decorate([__decorateParam(1, ISessionService), __decorateParam(2, ILogService)], FsSearchService);
 function computeFuzzyScore(name, queryLower) {
 	if (queryLower.length === 0) return 0;
 	const nameLower = name.toLowerCase();
@@ -164034,7 +164404,7 @@ async function whichBinary(name) {
 	}
 	return null;
 }
-registerSingleton(IFsSearchService, FsSearchService, 1);
+registerSingleton(IFsSearchService, new SyncDescriptor(FsSearchService, [noopTelemetryClient], true));
 //#endregion
 //#region ../../packages/agent-core/src/services/fs/fsGit.ts
 var FsGitUnavailableError = class extends Error {
@@ -167252,15 +167622,20 @@ function globalDefaultForProvider(config, providerId) {
 var _ModelCatalogService;
 let ModelCatalogService = _ModelCatalogService = class ModelCatalogService extends Disposable {
 	core;
+	eventService;
 	_serviceBrand;
 	_authFacade;
-	constructor(env, core) {
+	/** Serializes refresh runs so a scheduled refresh and a manual one (or two
+	*  manual ones with different options) never race on writing config.toml. */
+	_refreshChain = Promise.resolve();
+	constructor(env, core, eventService) {
 		super();
 		this.core = core;
+		this.eventService = eventService;
 		this._authFacade = createManagedAuthFacade(env);
 	}
-	static _createForTest(env, core, authFacade) {
-		const service = new _ModelCatalogService(env, core);
+	static _createForTest(env, core, authFacade, eventService = noopEventService) {
+		const service = new _ModelCatalogService(env, core, eventService);
 		service._authFacade = authFacade;
 		return service;
 	}
@@ -167289,74 +167664,44 @@ let ModelCatalogService = _ModelCatalogService = class ModelCatalogService exten
 		};
 	}
 	async refreshOAuthProviderModels() {
-		let config = await this._readConfig();
-		const changed = [];
-		const unchanged = [];
-		const failed = [];
-		const provider = config.providers?.[KIMI_CODE_PROVIDER_NAME$1];
-		if (provider?.type !== "kimi" || provider.oauth === void 0) return {
-			changed,
-			unchanged,
-			failed
-		};
-		try {
-			const auth = resolveKimiCodeRuntimeAuth({
-				configuredBaseUrl: provider.baseUrl,
-				configuredOAuthRef: provider.oauth
-			});
-			const tokenProvider = this._authFacade.resolveOAuthTokenProvider(KIMI_CODE_PROVIDER_NAME$1, auth.oauthRef);
-			if (tokenProvider === void 0) throw new Error("OAuth token provider is not configured.");
-			const models = await fetchManagedKimiCodeModels({
-				accessToken: await tokenProvider.getAccessToken(),
-				baseUrl: auth.baseUrl,
-				headers: this.core.kimiRequestHeaders
-			});
-			if (models.length === 0) return {
-				changed,
-				unchanged,
-				failed
-			};
-			const next = structuredClone(config);
-			applyManagedKimiCodeConfig(next, {
-				models,
-				baseUrl: auth.baseUrl,
-				oauthKey: auth.oauthRef.key,
-				oauthHost: auth.oauthRef.oauthHost,
-				preserveDefaultModel: true
-			});
-			const refreshedAliasKeys = providerRefreshAliasKeys$1(config, next, KIMI_CODE_PROVIDER_NAME$1, `${KIMI_CODE_PLATFORM_ID}/`);
-			restoreProviderAliases$1(next, preserveUserProviderAliases$1(config, KIMI_CODE_PROVIDER_NAME$1, refreshedAliasKeys));
-			restoreDefaultSelection$1(next, config.defaultModel, config.defaultThinking);
-			clampDanglingDefault$1(next);
-			if (providerModelsEqual$1(config, next, "managed:kimi-code", refreshedAliasKeys)) unchanged.push(KIMI_CODE_PROVIDER_NAME$1);
-			else {
-				const { added, removed } = computeChanges$1(collectModelIdsForAliases$1(config, refreshedAliasKeys), collectModelIdsForAliases$1(next, refreshedAliasKeys));
-				await this.core.rpc.removeKimiProvider({ providerId: KIMI_CODE_PROVIDER_NAME$1 });
-				await this.core.rpc.setKimiConfig({
-					providers: next.providers,
-					models: next.models,
-					defaultModel: next.defaultModel,
-					defaultThinking: next.defaultThinking
-				});
-				changed.push({
-					provider_id: KIMI_CODE_PROVIDER_NAME$1,
-					provider_name: "Kimi Code",
-					added,
-					removed
-				});
-			}
-		} catch (err) {
-			failed.push({
-				provider: KIMI_CODE_PROVIDER_NAME$1,
-				reason: err instanceof Error ? err.message : String(err)
-			});
+		return this.refreshProviderModels({ scope: "oauth" });
+	}
+	refreshProviderModels(options = {}) {
+		const run = this._refreshChain.then(() => this._doRefreshProviderModels(options));
+		this._refreshChain = run.then(() => void 0, () => void 0);
+		return run;
+	}
+	async _doRefreshProviderModels(options) {
+		if (options.providerId !== void 0) {
+			if ((await this._readConfig()).providers?.[options.providerId] === void 0) throw new ProviderNotFoundError(options.providerId);
 		}
+		const response = mapRefreshResult(await refreshProviderModels(this._buildRefreshHost(), {
+			scope: options.scope,
+			providerId: options.providerId
+		}));
+		if (response.changed.length > 0) this.eventService.publish({
+			type: "event.model_catalog.changed",
+			agentId: "main",
+			sessionId: "__global__",
+			changed: response.changed,
+			unchanged: response.unchanged,
+			failed: response.failed
+		});
+		return response;
+	}
+	_buildRefreshHost() {
 		return {
-			changed,
-			unchanged,
-			failed
+			getConfig: () => this._readConfig(),
+			removeProvider: (providerId) => this.core.rpc.removeKimiProvider({ providerId }),
+			setConfig: (patch) => this.core.rpc.setKimiConfig(patch),
+			resolveOAuthToken: (providerName, oauthRef) => this._resolveOAuthToken(providerName, oauthRef)
 		};
 	}
+	async _resolveOAuthToken(providerName, oauthRef) {
+		const tokenProvider = this._authFacade.resolveOAuthTokenProvider(providerName, oauthRef);
+		if (tokenProvider === void 0) throw new Error("OAuth token provider is not configured.");
+		return tokenProvider.getAccessToken();
+	}
 	async _readConfig() {
 		return this.core.rpc.getKimiConfig({ reload: true });
 	}
@@ -167375,7 +167720,26 @@ let ModelCatalogService = _ModelCatalogService = class ModelCatalogService exten
 		}
 	}
 };
-ModelCatalogService = _ModelCatalogService = __decorate([__decorateParam(0, IEnvironmentService), __decorateParam(1, ICoreProcessService)], ModelCatalogService);
+ModelCatalogService = _ModelCatalogService = __decorate([
+	__decorateParam(0, IEnvironmentService),
+	__decorateParam(1, ICoreProcessService),
+	__decorateParam(2, IEventService)
+], ModelCatalogService);
+function mapRefreshResult(result) {
+	return {
+		changed: result.changed.map((change) => ({
+			provider_id: change.providerId,
+			provider_name: change.providerName,
+			added: change.added,
+			removed: change.removed
+		})),
+		unchanged: [...result.unchanged],
+		failed: result.failed.map((failure) => ({
+			provider: failure.provider,
+			reason: failure.reason
+		}))
+	};
+}
 function hasConfiguredApiKey(provider) {
 	if (nonEmpty$1(provider.apiKey) !== void 0) return true;
 	switch (provider.type) {
@@ -167388,89 +167752,16 @@ function hasConfiguredApiKey(provider) {
 	}
 	return false;
 }
-function collectModelIdsForAliases$1(config, aliasKeys) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const aliasKey of aliasKeys) {
-		const alias = config.models?.[aliasKey];
-		if (alias !== void 0 && alias.model.length > 0) ids.add(alias.model);
-	}
-	return ids;
-}
-function providerAliasKeys$1(config, providerId) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const [alias, model] of Object.entries(config.models ?? {})) if (model.provider === providerId) keys.add(alias);
-	return keys;
-}
-function generatedProviderAliasKeys$1(config, providerId, aliasPrefix) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const [alias, model] of Object.entries(config.models ?? {})) if (model.provider === providerId && alias.startsWith(aliasPrefix)) keys.add(alias);
-	return keys;
-}
-function computeChanges$1(oldIds, newIds) {
-	let added = 0;
-	for (const id of newIds) if (!oldIds.has(id)) added++;
-	let removed = 0;
-	for (const id of oldIds) if (!newIds.has(id)) removed++;
-	return {
-		added,
-		removed
-	};
-}
-function providerModelsEqual$1(config, nextConfig, providerId, aliasKeys) {
-	return providerModelSnapshot$1(config, providerId, aliasKeys) === providerModelSnapshot$1(nextConfig, providerId, aliasKeys);
-}
-function providerModelSnapshot$1(config, providerId, aliasKeys) {
-	const snapshots = [];
-	for (const alias of aliasKeys) {
-		const model = config.models?.[alias];
-		if (model === void 0 || model.provider !== providerId) continue;
-		snapshots.push({
-			alias,
-			model: {
-				...model,
-				capabilities: model.capabilities === void 0 ? void 0 : model.capabilities.toSorted()
-			}
-		});
-	}
-	snapshots.sort((a, b) => a.alias.localeCompare(b.alias));
-	return JSON.stringify(snapshots);
-}
-function providerRefreshAliasKeys$1(config, nextConfig, providerId, aliasPrefix) {
-	const keys = generatedProviderAliasKeys$1(config, providerId, aliasPrefix);
-	for (const key of providerAliasKeys$1(nextConfig, providerId)) keys.add(key);
-	return keys;
-}
-function preserveUserProviderAliases$1(config, providerId, refreshedAliasKeys) {
-	const preserved = {};
-	for (const [alias, model] of Object.entries(config.models ?? {})) {
-		if (model.provider !== providerId || refreshedAliasKeys.has(alias)) continue;
-		preserved[alias] = structuredClone(model);
-	}
-	return preserved;
-}
-function restoreProviderAliases$1(config, aliases) {
-	if (Object.keys(aliases).length === 0) return;
-	config.models = {
-		...config.models,
-		...aliases
-	};
-}
-function restoreDefaultSelection$1(config, defaultModel, defaultThinking) {
-	if (defaultModel === void 0 || config.models?.[defaultModel] === void 0) return;
-	config.defaultModel = defaultModel;
-	config.defaultThinking = (config.models[defaultModel]?.capabilities ?? []).includes("always_thinking") ? true : defaultThinking;
-}
-function clampDanglingDefault$1(config) {
-	if (config.defaultModel !== void 0 && config.models?.[config.defaultModel] === void 0) {
-		config.defaultModel = void 0;
-		config.defaultThinking = void 0;
-	}
-}
 function nonEmpty$1(value) {
 	if (value === void 0) return void 0;
 	const trimmed = value.trim();
 	return trimmed.length === 0 ? void 0 : trimmed;
 }
+const noopEventService = {
+	_serviceBrand: void 0,
+	onDidPublish: () => ({ dispose: () => void 0 }),
+	publish: () => void 0
+};
 registerSingleton(IModelCatalogService, ModelCatalogService, 1);
 //#endregion
 //#region ../../packages/agent-core/src/services/config/config.ts
@@ -170793,6 +171084,7 @@ var KimiHarness = class {
 		withTelemetryContext$1(this.telemetry, { sessionId: eventSessionId }).track("session_started", {
 			...this.sessionStartedProperties,
 			...sessionScoped,
+			client_id: null,
 			client_name: this.identity?.userAgentProduct ?? null,
 			client_version: this.identity?.version ?? null,
 			ui_mode: this.uiMode,
@@ -193111,7 +193403,7 @@ var AcpSession = class {
 				}
 			}));
 			if (answer === null) this.emitTelemetry("question_dismissed");
-			else this.emitTelemetry("question_answered");
+			else this.emitTelemetry("question_answered", { answered: Object.keys(answer).length });
 			return answer;
 		} catch (err) {
 			log.warn("acp: requestPermission (question) failed; dismissing", {
@@ -194959,7 +195251,7 @@ async function handleProviderAdd$1(deps, url, opts) {
 	const addedProviderIds = [];
 	let modelCount = 0;
 	for (const entry of entryList) {
-		applyCustomRegistryProvider(asManaged$1(config), entry, source);
+		applyCustomRegistryProvider(asManaged(config), entry, source);
 		addedProviderIds.push(entry.id);
 		modelCount += Object.keys(entry.models).length;
 	}
@@ -195201,7 +195493,7 @@ function resolveApiKey(flag, env) {
 	const fromEnv = env["KIMI_REGISTRY_API_KEY"];
 	if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
 }
-function asManaged$1(config) {
+function asManaged(config) {
 	return config;
 }
 function providerSourceLabel(provider) {
@@ -224670,7 +224962,7 @@ function extractSessionId(event) {
 	if (typeof snake === "string" && snake.length > 0) return snake;
 }
 function isGlobalSessionEvent(type) {
-	return type === "event.session.created" || type === "event.session.status_changed" || type === "session.meta.updated" || type === "event.config.changed" || type === "event.workspace.created" || type === "event.workspace.updated" || type === "event.workspace.deleted";
+	return type === "event.session.created" || type === "event.session.status_changed" || type === "session.meta.updated" || type === "event.config.changed" || type === "event.model_catalog.changed" || type === "event.workspace.created" || type === "event.workspace.updated" || type === "event.workspace.deleted";
 }
 /** Session ids are ULID-ish, but never trust an id used as a path segment. */
 function sanitizeFileName(sid) {
@@ -228304,6 +228596,8 @@ function parseActionSuffix(opts) {
 //#region ../../packages/server/src/routes/modelCatalog.ts
 const providerIdParamSchema = object({ provider_id: string().min(1) });
 const modelActionTailParamSchema = object({ tail: string().min(1) });
+const providerActionTailParamSchema = object({ tail: string().min(1) });
+const providerCollectionActionParamSchema = object({ action: string().min(1) });
 function registerModelCatalogRoutes(app, ix) {
 	const listModelsRoute = defineRoute({
 		method: "GET",
@@ -228359,18 +228653,63 @@ function registerModelCatalogRoutes(app, ix) {
 		reply.send(okEnvelope({ items }, req.id));
 	});
 	app.get(listProvidersRoute.path, listProvidersRoute.options, listProvidersRoute.handler);
-	const refreshOAuthProvidersRoute = defineRoute({
+	const refreshProvidersRoute = defineRoute({
 		method: "POST",
-		path: "/providers:refresh_oauth",
-		success: { data: refreshOAuthProviderModelsResponseSchema },
-		description: "Refresh OAuth-backed provider model metadata",
+		path: "/providers:action",
+		params: providerCollectionActionParamSchema,
+		success: { data: refreshProviderModelsResponseSchema },
+		errors: { [ErrorCode$1.VALIDATION_FAILED]: {} },
+		description: "Refresh provider model metadata. Use `:refresh` for all providers or `:refresh_oauth` for OAuth-backed providers only.",
 		tags: ["providers"],
-		operationId: "refreshOAuthProviderModels"
+		operationId: "refreshProviders"
 	}, async (req, reply) => {
-		const result = await ix.invokeFunction((a) => a.get(IModelCatalogService).refreshOAuthProviderModels());
-		reply.send(okEnvelope(result, req.id));
+		const raw = req.params.action;
+		const action = raw.startsWith(":") ? raw.slice(1) : raw;
+		if (action === "refresh_oauth") {
+			const result = await ix.invokeFunction((a) => a.get(IModelCatalogService).refreshOAuthProviderModels());
+			reply.send(okEnvelope(result, req.id));
+			return;
+		}
+		if (action === "refresh") {
+			const result = await ix.invokeFunction((a) => a.get(IModelCatalogService).refreshProviderModels({ scope: "all" }));
+			reply.send(okEnvelope(result, req.id));
+			return;
+		}
+		reply.send(errEnvelope(ErrorCode$1.VALIDATION_FAILED, `unsupported action: ${raw}`, req.id));
 	});
-	app.post(refreshOAuthProvidersRoute.path, refreshOAuthProvidersRoute.options, refreshOAuthProvidersRoute.handler);
+	app.post(refreshProvidersRoute.path, refreshProvidersRoute.options, refreshProvidersRoute.handler);
+	const refreshProviderRoute = defineRoute({
+		method: "POST",
+		path: "/providers/{tail}",
+		params: providerActionTailParamSchema,
+		success: { data: refreshProviderModelsResponseSchema },
+		errors: {
+			[ErrorCode$1.VALIDATION_FAILED]: {},
+			[ErrorCode$1.PROVIDER_NOT_FOUND]: {}
+		},
+		description: "Refresh model metadata for a single provider",
+		tags: ["providers"],
+		operationId: "refreshProvider"
+	}, async (req, reply) => {
+		try {
+			const { tail } = req.params;
+			const parsed = parseActionSuffix({
+				tail,
+				allowedActions: ["refresh"],
+				resourceLabel: "provider"
+			});
+			if (parsed.kind !== "action") {
+				const message = parsed.kind === "invalid" ? parsed.reason : `unsupported action: ${tail}`;
+				reply.send(errEnvelope(ErrorCode$1.VALIDATION_FAILED, message, req.id));
+				return;
+			}
+			const result = await ix.invokeFunction((a) => a.get(IModelCatalogService).refreshProviderModels({ providerId: parsed.id }));
+			reply.send(okEnvelope(result, req.id));
+		} catch (err) {
+			sendMappedError$8(reply, req.id, err);
+		}
+	});
+	app.post(refreshProviderRoute.path, refreshProviderRoute.options, refreshProviderRoute.handler);
 	const getProviderRoute = defineRoute({
 		method: "GET",
 		path: "/providers/{provider_id}",
@@ -230639,13 +230978,100 @@ function registerHealthRoute(apiV1) {
 	});
 }
 //#endregion
+//#region ../../packages/server/src/services/modelCatalog/modelCatalogRefreshScheduler.ts
+/**
+* Periodic background refresh of provider model metadata for a long-lived
+* daemon. The original CLI refreshed `/models` at startup; once the server
+* became a daemon that started once and ran for days, the on-disk catalog went
+* stale. This scheduler restores "stays fresh" behavior: it refreshes once on
+* start and then on a configurable interval, delegating the actual work to
+* `IModelCatalogService.refreshProviderModels` (which serializes concurrent
+* runs, persists changes, and publishes `event.model_catalog.changed`).
+*
+* This is a server-local service (only the daemon is long-lived); the CLI uses
+* the same underlying refresh orchestrator but triggers it on demand.
+*/
+const DEFAULT_REFRESH_INTERVAL_MS = 360 * 60 * 1e3;
+const INTERVAL_ENV = "KIMI_CODE_MODEL_CATALOG_REFRESH_INTERVAL_MS";
+const REFRESH_ON_START_ENV = "KIMI_CODE_MODEL_CATALOG_REFRESH_ON_START";
+const IModelCatalogRefreshScheduler = createDecorator("modelCatalogRefreshScheduler");
+let ModelCatalogRefreshScheduler = class ModelCatalogRefreshScheduler extends Disposable {
+	modelCatalog;
+	core;
+	logger;
+	_serviceBrand;
+	_timer;
+	_started = false;
+	constructor(modelCatalog, core, logger) {
+		super();
+		this.modelCatalog = modelCatalog;
+		this.core = core;
+		this.logger = logger;
+	}
+	async start() {
+		if (this._started) return;
+		this._started = true;
+		const config = await this.core.rpc.getKimiConfig({ reload: true });
+		const intervalMs = resolveIntervalMs(config.modelCatalog?.refreshIntervalMs);
+		if (resolveRefreshOnStart(config.modelCatalog?.refreshOnStart)) this._refresh("startup");
+		if (intervalMs > 0) {
+			this._timer = setInterval(() => void this._refresh("interval"), intervalMs);
+			this._timer.unref?.();
+			this.logger.info({ intervalMs }, "provider-model catalog auto-refresh enabled");
+		}
+	}
+	async _refresh(trigger) {
+		try {
+			const result = await this.modelCatalog.refreshProviderModels({ scope: "all" });
+			if (result.failed.length > 0) this.logger.warn({
+				trigger,
+				failed: result.failed
+			}, "provider-model catalog refresh completed with failures");
+		} catch (error) {
+			this.logger.warn({
+				trigger,
+				err: error instanceof Error ? error.message : String(error)
+			}, "provider-model catalog refresh failed");
+		}
+	}
+	dispose() {
+		if (this._timer !== void 0) {
+			clearInterval(this._timer);
+			this._timer = void 0;
+		}
+		super.dispose();
+	}
+};
+ModelCatalogRefreshScheduler = __decorate([
+	__decorateParam(0, IModelCatalogService),
+	__decorateParam(1, ICoreProcessService),
+	__decorateParam(2, ILogService)
+], ModelCatalogRefreshScheduler);
+function resolveIntervalMs(configValue) {
+	const raw = process.env[INTERVAL_ENV];
+	if (raw !== void 0 && raw.trim().length > 0) {
+		const parsed = Number(raw);
+		if (Number.isFinite(parsed) && parsed >= 0) return parsed;
+	}
+	return configValue ?? DEFAULT_REFRESH_INTERVAL_MS;
+}
+function resolveRefreshOnStart(configValue) {
+	const raw = process.env[REFRESH_ON_START_ENV];
+	if (raw !== void 0 && raw.trim().length > 0) {
+		const normalized = raw.trim().toLowerCase();
+		return normalized === "1" || normalized === "true" || normalized === "yes";
+	}
+	return configValue ?? true;
+}
+//#endregion
 //#region ../../packages/server/src/services/serviceCollection.ts
 function createServerServiceCollection(input) {
 	const { server, app, pinoLogger, envService } = input;
 	const snapshotConfig = loadSnapshotConfig();
-	const services = new ServiceCollection(...getSingletonServiceDescriptors(), [IConnectionRegistry, new SyncDescriptor(ConnectionRegistry, [], false)], [ISessionClientsService, new SyncDescriptor(SessionClientsService, [], false)], [IWSBroadcastService, new SyncDescriptor(WSBroadcastService, [], false)], [IApprovalService, new SyncDescriptor(ApprovalService, [], false)], [IQuestionService, new SyncDescriptor(QuestionService, [], false)]);
+	const services = new ServiceCollection(...getSingletonServiceDescriptors(), [IConnectionRegistry, new SyncDescriptor(ConnectionRegistry, [], false)], [ISessionClientsService, new SyncDescriptor(SessionClientsService, [], false)], [IWSBroadcastService, new SyncDescriptor(WSBroadcastService, [], false)], [IModelCatalogRefreshScheduler, new SyncDescriptor(ModelCatalogRefreshScheduler, [], false)], [IApprovalService, new SyncDescriptor(ApprovalService, [], false)], [IQuestionService, new SyncDescriptor(QuestionService, [], false)]);
 	if (snapshotConfig.mode !== "legacy") services.set(ISnapshotService, new SyncDescriptor(SnapshotService, [], false));
 	services.set(ILogService, new PinoLogger(pinoLogger));
+	services.set(IFsSearchService, new SyncDescriptor(FsSearchService, [server.coreProcessOptions?.telemetry ?? noopTelemetryClient], true));
 	services.set(IRestGateway, new FastifyRestGateway(app));
 	services.set(IEnvironmentService, envService);
 	services.set(IWSGateway, new SyncDescriptor(WSGateway, [server.wsGatewayOptions ?? {}], false));
@@ -241163,6 +241589,7 @@ async function startServer(opts) {
 			a.get(IAuthSummaryService);
 			a.get(IOAuthService);
 			a.get(IModelCatalogService);
+			a.get(IModelCatalogRefreshScheduler).start().catch((err) => log.error({ err }, "failed to start provider-model refresh scheduler"));
 			const promptService = a.get(IPromptService);
 			const terminalService = a.get(ITerminalService);
 			wsGw.setAbortHandler({
@@ -242570,10 +242997,7 @@ async function runServerInProcess(options, mode, onReady) {
 			} : void 0
 		}
 	});
-	track("server_started", {
-		ui_mode: "web",
-		daemon: mode.daemon
-	});
+	track("server_started", { daemon: mode.daemon });
 	process.once("SIGINT", () => {
 		shutdown("SIGINT");
 	});
@@ -248274,6 +248698,7 @@ async function handleKimiCodeOAuthLogin(host) {
 		}
 		host.track("login", {
 			provider: DEFAULT_OAUTH_PROVIDER_NAME,
+			method: "oauth",
 			already_logged_in: alreadyLoggedIn
 		});
 		if (alreadyLoggedIn) host.showStatus("Already logged in. Model configuration refreshed.");
@@ -253414,7 +253839,7 @@ var CustomRegistryImportDialogComponent = class extends Container {
 const ADD_ROW_LABEL = "[ Add New Platform ]";
 const PAGE_SIZE = 8;
 const HEADER_HINT = "↑↓ navigate · D delete · Esc cancel";
-function readCustomRegistrySource$1(provider) {
+function readCustomRegistrySource(provider) {
 	if (typeof provider !== "object" || provider === null) return void 0;
 	const source = provider.source;
 	if (typeof source !== "object" || source === null) return void 0;
@@ -253469,7 +253894,7 @@ function buildRows(opts) {
 			continue;
 		}
 		const baseUrl = typeof cfg === "object" && cfg !== null && "baseUrl" in cfg && typeof cfg.baseUrl === "string" ? cfg.baseUrl : void 0;
-		const customSource = readCustomRegistrySource$1(cfg);
+		const customSource = readCustomRegistrySource(cfg);
 		if (customSource !== void 0) {
 			const key = `${customSource.url}${customSource.apiKey}`;
 			const existingIdx = customRegistryIndex.get(key);
@@ -317103,7 +317528,7 @@ function extractKeyArgument(toolName, args, workspaceDir) {
 		let summary = pattern;
 		const path = args["path"];
 		if (typeof path === "string" && path.length > 0) summary += ` · ${makeWorkspaceRelativePath(path, workspaceDir)}`;
-		if (args["include_dirs"] === false) summary += " · no dirs";
+		if (args["include_ignored"] === true) summary += " · include ignored";
 		return truncateArgValue("pattern", summary);
 	}
 	const candidates = keyMap[toolName] ?? Object.keys(args);
@@ -323020,7 +323445,7 @@ var StatusMessageComponent = class extends Container {
 		super.invalidate();
 	}
 	renderText() {
-		return (this.color === void 0 ? currentTheme.fg("textDim", this.content) : currentTheme.fg(this.color, this.content)).split("\n").map((line) => `  ${line}`).join("\n");
+		return (this.color === void 0 ? currentTheme.fg("textDim", this.content) : currentTheme.fg(this.color, this.content)).replaceAll("\r", "").split("\n").map((line) => `  ${line}`).join("\n");
 	}
 };
 var NoticeMessageComponent = class extends Container {
@@ -323128,349 +323553,18 @@ var QueuePaneComponent = class extends Container {
 };
 //#endregion
 //#region src/tui/utils/refresh-providers.ts
-function readCustomRegistrySource(provider) {
-	const source = provider.source;
-	if (typeof source !== "object" || source === null) return void 0;
-	const candidate = source;
-	if (candidate["kind"] !== "apiJson") return void 0;
-	const url = candidate["url"];
-	const apiKey = candidate["apiKey"];
-	if (typeof url !== "string" || url.length === 0) return void 0;
-	if (typeof apiKey !== "string") return void 0;
-	return {
-		kind: "apiJson",
-		url,
-		apiKey
-	};
-}
-function customRegistrySourceKey(source) {
-	return JSON.stringify([source.url]);
-}
-function customRegistrySourceCredentialKey(source) {
-	return JSON.stringify([source.url, source.apiKey]);
-}
-async function fetchCustomRegistryFromSources(sources) {
-	let lastError;
-	for (const source of sources) try {
-		return {
-			entries: await fetchCustomRegistry(source),
-			source
-		};
-	} catch (error) {
-		lastError = error;
-	}
-	if (lastError instanceof Error) throw lastError;
-	if (typeof lastError === "string") throw new Error(lastError);
-	throw new Error("No custom registry sources configured.");
-}
-function asManaged(config) {
-	return config;
-}
-function collectModelIdsForAliases(config, aliasKeys) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const aliasKey of aliasKeys) {
-		const alias = config.models?.[aliasKey];
-		if (alias !== void 0 && alias.model.length > 0) ids.add(alias.model);
-	}
-	return ids;
-}
-function providerAliasKeys(config, providerId) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const [alias, model] of Object.entries(config.models ?? {})) if (model.provider === providerId) keys.add(alias);
-	return keys;
-}
-function generatedProviderAliasKeys(config, providerId, aliasPrefix) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const [alias, model] of Object.entries(config.models ?? {})) if (model.provider === providerId && alias.startsWith(aliasPrefix)) keys.add(alias);
-	return keys;
-}
-function computeChanges(oldIds, newIds) {
-	let added = 0;
-	for (const id of newIds) if (!oldIds.has(id)) added++;
-	let removed = 0;
-	for (const id of oldIds) if (!newIds.has(id)) removed++;
-	return {
-		added,
-		removed
-	};
-}
-function providerModelSnapshot(config, providerId, aliasKeys) {
-	const snapshots = [];
-	for (const alias of aliasKeys) {
-		const model = config.models?.[alias];
-		if (model === void 0 || model.provider !== providerId) continue;
-		snapshots.push({
-			alias,
-			model: {
-				...model,
-				capabilities: model.capabilities === void 0 ? void 0 : model.capabilities.toSorted()
-			}
-		});
-	}
-	snapshots.sort((a, b) => a.alias.localeCompare(b.alias));
-	return JSON.stringify(snapshots);
-}
-function providerModelsEqual(config, nextConfig, providerId, aliasKeys) {
-	return providerModelSnapshot(config, providerId, aliasKeys) === providerModelSnapshot(nextConfig, providerId, aliasKeys);
-}
-function providerConfigSnapshot(config, providerId) {
-	return JSON.stringify(config.providers[providerId] ?? null);
-}
-function providerConfigEqual(config, nextConfig, providerId) {
-	return providerConfigSnapshot(config, providerId) === providerConfigSnapshot(nextConfig, providerId);
-}
-function providerRefreshAliasKeys(config, nextConfig, providerId, aliasPrefix) {
-	const keys = generatedProviderAliasKeys(config, providerId, aliasPrefix);
-	for (const key of providerAliasKeys(nextConfig, providerId)) keys.add(key);
-	return keys;
-}
-function preserveUserProviderAliases(config, providerId, refreshedAliasKeys) {
-	const preserved = {};
-	for (const [alias, model] of Object.entries(config.models ?? {})) {
-		if (model.provider !== providerId || refreshedAliasKeys.has(alias)) continue;
-		preserved[alias] = structuredClone(model);
-	}
-	return preserved;
-}
-function restoreProviderAliases(config, aliases) {
-	if (Object.keys(aliases).length === 0) return;
-	config.models = {
-		...config.models,
-		...aliases
-	};
-}
-function restoreDefaultSelection(config, defaultModel, defaultThinking) {
-	if (defaultModel === void 0 || config.models?.[defaultModel] === void 0) return;
-	config.defaultModel = defaultModel;
-	config.defaultThinking = (config.models[defaultModel]?.capabilities ?? []).includes("always_thinking") ? true : defaultThinking;
-}
-function clampDanglingDefault(config) {
-	if (config.defaultModel !== void 0 && config.models?.[config.defaultModel] === void 0) {
-		config.defaultModel = void 0;
-		config.defaultThinking = void 0;
-	}
-}
-function clearDefaultThinkingWhenDefaultRemoved(config, previousDefaultModel) {
-	if (previousDefaultModel !== void 0 && config.defaultModel === void 0) config.defaultThinking = void 0;
-}
-function pickDefaultModel(config, providerId, models) {
-	const firstModel = models[0];
-	if (firstModel === void 0) return "";
-	const existingDefault = config.defaultModel;
-	if (existingDefault !== void 0) {
-		const alias = config.models?.[existingDefault];
-		if (alias !== void 0 && alias.provider === providerId) {
-			const stillAvailable = models.find((m) => m.id === alias.model);
-			if (stillAvailable !== void 0) return stillAvailable.id;
-		}
-	}
-	return firstModel.id;
-}
+/**
+* Refresh remote model metadata for the configured providers. Thin adapter over
+* the shared `refreshProviderModels` orchestrator in `@moonshot-ai/kimi-code-oauth`
+* (which is also what the daemon's scheduled/manual refresh uses).
+*/
 async function refreshAllProviderModels(host, options = {}) {
-	const changed = [];
-	const unchanged = [];
-	const failed = [];
-	const scope = options.scope ?? "all";
-	let config = await host.getConfig();
-	const managedProvider = config.providers[KIMI_CODE_PROVIDER_NAME$1];
-	if (managedProvider !== void 0 && managedProvider.type === "kimi" && managedProvider.oauth !== void 0) try {
-		const auth = resolveKimiCodeRuntimeAuth({
-			configuredBaseUrl: managedProvider.baseUrl,
-			configuredOAuthRef: managedProvider.oauth
-		});
-		const models = await fetchManagedKimiCodeModels({
-			accessToken: await host.resolveOAuthToken(KIMI_CODE_PROVIDER_NAME$1, auth.oauthRef),
-			baseUrl: auth.baseUrl
-		});
-		if (models.length > 0) {
-			const next = structuredClone(config);
-			applyManagedKimiCodeConfig(asManaged(next), {
-				models,
-				baseUrl: auth.baseUrl,
-				oauthKey: auth.oauthRef.key,
-				oauthHost: auth.oauthRef.oauthHost,
-				preserveDefaultModel: true
-			});
-			const refreshedAliasKeys = providerRefreshAliasKeys(config, next, KIMI_CODE_PROVIDER_NAME$1, `${KIMI_CODE_PLATFORM_ID}/`);
-			restoreProviderAliases(next, preserveUserProviderAliases(config, KIMI_CODE_PROVIDER_NAME$1, refreshedAliasKeys));
-			restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
-			clampDanglingDefault(next);
-			clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
-			if (providerModelsEqual(config, next, "managed:kimi-code", refreshedAliasKeys)) unchanged.push(KIMI_CODE_PROVIDER_NAME$1);
-			else {
-				const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
-				await host.removeProvider(KIMI_CODE_PROVIDER_NAME$1);
-				config = await host.setConfig({
-					providers: next.providers,
-					models: next.models,
-					defaultModel: next.defaultModel,
-					defaultThinking: next.defaultThinking
-				});
-				changed.push({
-					providerId: KIMI_CODE_PROVIDER_NAME$1,
-					providerName: "Kimi Code",
-					added,
-					removed
-				});
-			}
-		}
-	} catch (error) {
-		failed.push({
-			provider: KIMI_CODE_PROVIDER_NAME$1,
-			reason: error instanceof Error ? error.message : String(error)
-		});
-	}
-	if (scope === "oauth") return {
-		changed,
-		unchanged,
-		failed
-	};
-	const openPlatformIds = Object.keys(config.providers).filter((id) => isOpenPlatformId(id));
-	for (const providerId of openPlatformIds) {
-		const platform = getOpenPlatformById(providerId);
-		if (platform === void 0) continue;
-		const providerConfig = config.providers[providerId];
-		if (providerConfig === void 0) continue;
-		const apiKey = providerConfig.apiKey;
-		if (typeof apiKey !== "string" || apiKey.length === 0) continue;
-		try {
-			let models = await fetchOpenPlatformModels(platform, apiKey);
-			models = filterModelsByPrefix(models, platform);
-			if (models.length === 0) continue;
-			const selectedModelId = pickDefaultModel(config, providerId, models);
-			const selectedModel = models.find((m) => m.id === selectedModelId);
-			if (selectedModel === void 0) continue;
-			const next = structuredClone(config);
-			applyOpenPlatformConfig(asManaged(next), {
-				platform,
-				models,
-				selectedModel,
-				thinking: false,
-				apiKey
-			});
-			const refreshedAliasKeys = providerRefreshAliasKeys(config, next, providerId, `${providerId}/`);
-			restoreProviderAliases(next, preserveUserProviderAliases(config, providerId, refreshedAliasKeys));
-			restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
-			clampDanglingDefault(next);
-			clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
-			if (providerModelsEqual(config, next, providerId, refreshedAliasKeys)) unchanged.push(providerId);
-			else {
-				const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
-				await host.removeProvider(providerId);
-				config = await host.setConfig({
-					providers: next.providers,
-					models: next.models,
-					defaultModel: next.defaultModel,
-					defaultThinking: next.defaultThinking
-				});
-				changed.push({
-					providerId,
-					providerName: platform.name,
-					added,
-					removed
-				});
-			}
-		} catch (error) {
-			failed.push({
-				provider: providerId,
-				reason: error instanceof Error ? error.message : String(error)
-			});
-		}
-	}
-	const customSources = /* @__PURE__ */ new Map();
-	for (const [providerId, providerConfig] of Object.entries(config.providers)) {
-		if (providerId === "managed:kimi-code") continue;
-		if (isOpenPlatformId(providerId)) continue;
-		const source = readCustomRegistrySource(providerConfig);
-		if (source === void 0) continue;
-		const key = customRegistrySourceKey(source);
-		const sourceKey = customRegistrySourceCredentialKey(source);
-		const entry = customSources.get(key);
-		if (entry !== void 0) {
-			if (!entry.sourceKeys.has(sourceKey)) {
-				entry.sources.push(source);
-				entry.sourceKeys.add(sourceKey);
-			}
-			entry.providerIds.push(providerId);
-		} else customSources.set(key, {
-			sources: [source],
-			sourceKeys: new Set([sourceKey]),
-			providerIds: [providerId]
-		});
-	}
-	for (const { sources, providerIds } of customSources.values()) try {
-		const { entries, source } = await fetchCustomRegistryFromSources(sources);
-		const next = structuredClone(config);
-		const changedProviders = [];
-		const providersToRemoveBeforeSet = /* @__PURE__ */ new Set();
-		let hasUnreportedConfigChange = false;
-		const remoteEntries = Object.values(entries);
-		const remoteEntriesByProviderId = new Map(remoteEntries.map((entry) => [entry.id, entry]));
-		const providerIdsToSync = new Set(providerIds);
-		for (const entry of remoteEntries) providerIdsToSync.add(entry.id);
-		for (const providerId of providerIdsToSync) {
-			const entry = remoteEntriesByProviderId.get(providerId);
-			if (entry === void 0) {
-				const oldIds = collectModelIdsForAliases(config, providerAliasKeys(config, providerId));
-				removeCustomRegistryProvider(asManaged(next), providerId);
-				changedProviders.push({
-					providerId,
-					providerName: providerId,
-					added: 0,
-					removed: oldIds.size
-				});
-				providersToRemoveBeforeSet.add(providerId);
-				continue;
-			}
-			const existed = config.providers[providerId] !== void 0;
-			applyCustomRegistryProvider(asManaged(next), entry, source);
-			const refreshedAliasKeys = providerRefreshAliasKeys(config, next, providerId, `${providerId}/`);
-			if (existed) restoreProviderAliases(next, preserveUserProviderAliases(config, providerId, refreshedAliasKeys));
-			if (existed && providerModelsEqual(config, next, providerId, refreshedAliasKeys) && providerConfigEqual(config, next, providerId)) unchanged.push(providerId);
-			else if (existed && providerModelsEqual(config, next, providerId, refreshedAliasKeys)) {
-				unchanged.push(providerId);
-				providersToRemoveBeforeSet.add(providerId);
-				hasUnreportedConfigChange = true;
-			} else {
-				const { added, removed } = computeChanges(collectModelIdsForAliases(config, refreshedAliasKeys), collectModelIdsForAliases(next, refreshedAliasKeys));
-				changedProviders.push({
-					providerId,
-					providerName: entry.name || providerId,
-					added,
-					removed
-				});
-				if (existed) providersToRemoveBeforeSet.add(providerId);
-			}
-		}
-		if (changedProviders.length > 0 || hasUnreportedConfigChange) {
-			restoreDefaultSelection(next, config.defaultModel, config.defaultThinking);
-			clampDanglingDefault(next);
-			clearDefaultThinkingWhenDefaultRemoved(next, config.defaultModel);
-			for (const providerId of providersToRemoveBeforeSet) await host.removeProvider(providerId);
-			config = await host.setConfig({
-				providers: next.providers,
-				models: next.models,
-				defaultModel: next.defaultModel,
-				defaultThinking: next.defaultThinking
-			});
-			for (const change of changedProviders) changed.push({
-				providerId: change.providerId,
-				providerName: change.providerName,
-				added: change.added,
-				removed: change.removed
-			});
-		}
-	} catch (error) {
-		for (const providerId of providerIds) failed.push({
-			provider: providerId,
-			reason: error instanceof Error ? error.message : String(error)
-		});
-	}
-	return {
-		changed,
-		unchanged,
-		failed
-	};
+	return refreshProviderModels({
+		getConfig: () => host.getConfig(),
+		removeProvider: (providerId) => host.removeProvider(providerId),
+		setConfig: (patch) => host.setConfig(patch),
+		resolveOAuthToken: (providerName, oauthRef) => host.resolveOAuthToken(providerName, oauthRef)
+	}, options);
 }
 //#endregion
 //#region src/tui/controllers/auth-flow.ts
@@ -333329,8 +333423,6 @@ async function shouldAutoInstallUpdates() {
 }
 function trackUpdatePrompted(track, currentVersion, target, source, decision, rolloutTelemetry) {
 	trackUpdateEvent(track, "update_prompted", {
-		current: currentVersion,
-		latest: target.version,
 		current_version: currentVersion,
 		target_version: target.version,
 		source,