@moonshot-ai/kimi-code 0.23.4 → 0.23.6

package/dist/main.mjs

@@ -1063,7 +1063,7 @@ var init_provider$1 = __esmMin((() => {}));
 function isUnknownCapability(capability) {
 	if (capability === UNKNOWN_CAPABILITY) return true;
 	if (capability[UNKNOWN_CAPABILITY_MARKER] === true) return true;
-	return !capability.image_in && !capability.video_in && !capability.audio_in && !capability.thinking && !capability.tool_use && capability.select_tools !== true && capability.max_context_tokens === 0;
+	return !capability.image_in && !capability.video_in && !capability.audio_in && !capability.thinking && !capability.tool_use && capability.dynamically_loaded_tools !== true && capability.max_context_tokens === 0;
 }
 var UNKNOWN_CAPABILITY_MARKER, UNKNOWN_CAPABILITY;
 var init_capability = __esmMin((() => {
@@ -1075,7 +1075,7 @@ var init_capability = __esmMin((() => {
 		thinking: false,
 		tool_use: false,
 		max_context_tokens: 0,
-		select_tools: false
+		dynamically_loaded_tools: false
 	}, UNKNOWN_CAPABILITY_MARKER, { value: true }));
 }));
 //#endregion
@@ -1083,13 +1083,42 @@ var init_capability = __esmMin((() => {
 function isRetryableGenerateError(error) {
 	if (error instanceof APIConnectionError$3 || error instanceof APITimeoutError) return true;
 	if (error instanceof APIEmptyResponseError) return true;
-	return error instanceof APIStatusError && [
+	if (error instanceof APIStatusError) return [
+		408,
+		409,
 		429,
 		500,
 		502,
 		503,
-		504
+		504,
+		529
 	].includes(error.statusCode);
+	return error instanceof ChatProviderError && !isImageFormatError(error);
+}
+/**
+* Whether the provider rejected an IMAGE in the request because of its
+* FORMAT or DATA — an unsupported media type or undecodable image bytes.
+* The rejection is deterministic for a given history (the same image is
+* re-sent on every request, so the session would fail every turn), and the
+* only recovery is to resend once with all media stripped (see the
+* media-stripped resend in the agent loop). Body-size (413), context
+* overflow, image count/size limits, image-input-disabled rejections, and
+* non-image (audio/video) media rejections are excluded — the first two
+* have their own recoveries, and the rest are not fixed by stripping media.
+*/
+function isImageFormatError(error) {
+	if (error instanceof APIStatusError) {
+		if (error instanceof APIContextOverflowError) return false;
+		if (error instanceof APIRequestTooLargeError) return false;
+		if (error.statusCode !== 400) return false;
+		const lowerMessage = error.message.toLowerCase();
+		return IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS.some((pattern) => pattern.test(lowerMessage)) || MEDIA_TYPE_FIELD_PATTERN.test(lowerMessage) && lowerMessage.includes("image");
+	}
+	if (error instanceof ChatProviderError) {
+		const lowerMessage = error.message.toLowerCase();
+		return IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS.some((pattern) => pattern.test(lowerMessage));
+	}
+	return false;
 }
 /**
 * Classify a raw (non-SDK) error message into the right transport-layer
@@ -1107,11 +1136,25 @@ function classifyBaseApiError(message) {
 function isContextOverflowErrorCode(code) {
 	return code === "context_length_exceeded";
 }
-function normalizeAPIStatusError(statusCode, message, requestId) {
-	if (statusCode === 429) return new APIProviderRateLimitError(message, requestId);
-	if (isContextOverflowStatusError(statusCode, message)) return new APIContextOverflowError(statusCode, message, requestId);
-	if (isRequestTooLargeStatusError(statusCode, message)) return new APIRequestTooLargeError(statusCode, message, requestId);
-	return new APIStatusError(statusCode, message, requestId);
+function normalizeAPIStatusError(statusCode, message, requestId, retryAfterMs) {
+	if (statusCode === 429) return new APIProviderRateLimitError(message, requestId, retryAfterMs);
+	if (isContextOverflowStatusError(statusCode, message)) return new APIContextOverflowError(statusCode, message, requestId, retryAfterMs);
+	if (isRequestTooLargeStatusError(statusCode, message)) return new APIRequestTooLargeError(statusCode, message, requestId, retryAfterMs);
+	return new APIStatusError(statusCode, message, requestId, retryAfterMs);
+}
+/**
+* Parse a `retry-after` response header into milliseconds. Only integer
+* seconds is honored; an HTTP-date (or any non-integer / missing value)
+* returns null and the caller falls back to its computed backoff. Shared by
+* the provider error converters so every backend honors the same server
+* backoff directive.
+*/
+function parseRetryAfterMs(headers) {
+	const raw = headers !== null && typeof headers === "object" && typeof headers.get === "function" ? headers.get("retry-after") : null;
+	if (raw === null || raw === void 0) return null;
+	const seconds = Number.parseInt(raw, 10);
+	if (!Number.isFinite(seconds) || seconds < 0) return null;
+	return seconds * 1e3;
 }
 function isContextOverflowStatusError(statusCode, message) {
 	if (statusCode !== 400 && statusCode !== 413 && statusCode !== 422) return false;
@@ -1163,7 +1206,7 @@ function getStatusCode(error) {
 function errorMessage$6(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-var ChatProviderError, APIConnectionError$3, APITimeoutError, APIStatusError, APIContextOverflowError, APIRequestTooLargeError, APIProviderRateLimitError, APIEmptyResponseError, NETWORK_RE$1, TIMEOUT_RE$1, CONTEXT_OVERFLOW_MESSAGE_PATTERNS, PROVIDER_RATE_LIMIT_MESSAGE_PATTERNS, REQUEST_TOO_LARGE_MESSAGE_PATTERNS, TOOL_EXCHANGE_ADJACENCY_MESSAGE_PATTERNS, STRUCTURAL_REQUEST_MESSAGE_PATTERNS;
+var ChatProviderError, APIConnectionError$3, APITimeoutError, APIStatusError, APIContextOverflowError, APIRequestTooLargeError, APIProviderRateLimitError, APIEmptyResponseError, IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS, IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS, MEDIA_TYPE_FIELD_PATTERN, NETWORK_RE$1, TIMEOUT_RE$1, CONTEXT_OVERFLOW_MESSAGE_PATTERNS, PROVIDER_RATE_LIMIT_MESSAGE_PATTERNS, REQUEST_TOO_LARGE_MESSAGE_PATTERNS, TOOL_EXCHANGE_ADJACENCY_MESSAGE_PATTERNS, STRUCTURAL_REQUEST_MESSAGE_PATTERNS;
 var init_errors$12 = __esmMin((() => {
 	ChatProviderError = class extends Error {
 		constructor(message) {
@@ -1186,28 +1229,36 @@ var init_errors$12 = __esmMin((() => {
 	APIStatusError = class extends ChatProviderError {
 		statusCode;
 		requestId;
-		constructor(statusCode, message, requestId) {
+		/**
+		* Server-requested backoff from the `retry-after` response header, in
+		* milliseconds. When present, the retry loop honors it instead of its own
+		* computed backoff — a server `Retry-After` directive overrides the local
+		* exponential delay.
+		*/
+		retryAfterMs;
+		constructor(statusCode, message, requestId, retryAfterMs) {
 			super(message);
 			this.name = "APIStatusError";
 			this.statusCode = statusCode;
 			this.requestId = requestId ?? null;
+			this.retryAfterMs = retryAfterMs ?? null;
 		}
 	};
 	APIContextOverflowError = class extends APIStatusError {
-		constructor(statusCode, message, requestId) {
-			super(statusCode, message, requestId);
+		constructor(statusCode, message, requestId, retryAfterMs) {
+			super(statusCode, message, requestId, retryAfterMs);
 			this.name = "APIContextOverflowError";
 		}
 	};
 	APIRequestTooLargeError = class extends APIStatusError {
-		constructor(statusCode, message, requestId) {
-			super(statusCode, message, requestId);
+		constructor(statusCode, message, requestId, retryAfterMs) {
+			super(statusCode, message, requestId, retryAfterMs);
 			this.name = "APIRequestTooLargeError";
 		}
 	};
 	APIProviderRateLimitError = class extends APIStatusError {
-		constructor(message, requestId) {
-			super(429, message, requestId);
+		constructor(message, requestId, retryAfterMs) {
+			super(429, message, requestId, retryAfterMs);
 			this.name = "APIProviderRateLimitError";
 		}
 	};
@@ -1221,6 +1272,16 @@ var init_errors$12 = __esmMin((() => {
 			this.rawFinishReason = options.rawFinishReason ?? null;
 		}
 	};
+	IMAGE_FORMAT_PROVIDER_MESSAGE_PATTERNS = [/unsupported media type for base64 image/, /invalid data url for image/];
+	IMAGE_FORMAT_STATUS_MESSAGE_PATTERNS = [
+		/unsupported image (?:url|format|type)/,
+		/does not represent a valid image/,
+		/could not (?:process|decode) (?:the |input )?image/,
+		/unable to process (?:the |input )?image/,
+		/failed to decode (?:the )?image/,
+		/invalid image(?: data| type| format)?/
+	];
+	MEDIA_TYPE_FIELD_PATTERN = /(?:media|mime)_?type/;
 	NETWORK_RE$1 = /network|connection|connect|disconnect|terminated/i;
 	TIMEOUT_RE$1 = /timed?\s*out|timeout|deadline/i;
 	CONTEXT_OVERFLOW_MESSAGE_PATTERNS = [
@@ -9608,7 +9669,7 @@ function convertAnthropicError(error) {
 	if (error instanceof APIConnectionError$2) return new APIConnectionError$3(error.message);
 	if (error instanceof APIError$2 && typeof error.status === "number") {
 		const reqId = error.requestID ?? null;
-		return normalizeAPIStatusError(error.status, error.message, reqId);
+		return normalizeAPIStatusError(error.status, error.message, reqId, parseRetryAfterMs(error.headers));
 	}
 	if (error instanceof AnthropicError) return new ChatProviderError(`Anthropic error: ${error.message}`);
 	if (error instanceof Error) return classifyBaseApiError(error.message);
@@ -53199,7 +53260,7 @@ function convertOpenAIError(error) {
 	if (error instanceof APIConnectionError) return new APIConnectionError$3(error.message);
 	if (error instanceof APIError && typeof error.status === "number") {
 		const reqId = error.requestID ?? null;
-		return normalizeAPIStatusError(error.status, error.message, reqId);
+		return normalizeAPIStatusError(error.status, error.message, reqId, parseRetryAfterMs(error.headers));
 	}
 	if (error instanceof APIError && error.constructor === APIError && error.error === void 0) return classifyBaseApiError(error.message);
 	if (error instanceof OpenAIError) return new ChatProviderError(`Error: ${error.message}`);
@@ -54315,10 +54376,14 @@ function functionCallId(callId) {
 function formatResponsesErrorEvent(code, message, param) {
 	return `${code ?? "unknown"}: ${message}${param === null ? "" : ` (param: ${param})`}`;
 }
+function readEmbeddedStatusCode(message) {
+	const match = EMBEDDED_STATUS_CODE_RE.exec(message);
+	return match === null ? void 0 : Number(match[1]);
+}
 function errorFromOpenAIResponsesEvent(prefix, code, message, param) {
 	const fullMessage = `${prefix}: ${formatResponsesErrorEvent(code, message, param)}`;
 	if (isContextOverflowErrorCode(code)) return new APIContextOverflowError(400, fullMessage);
-	if (code === "rate_limit_exceeded") return new APIProviderRateLimitError(fullMessage);
+	if (code === "rate_limit_exceeded" || readEmbeddedStatusCode(message) === 429) return new APIProviderRateLimitError(fullMessage);
 	return new ChatProviderError(fullMessage);
 }
 function parseNestedGatewayStreamError(message) {
@@ -54589,7 +54654,7 @@ function convertHistoryMessages(history, modelName, toolMessageConversion) {
 	flushPendingMedia();
 	return input;
 }
-var OPENAI_RESPONSES_TOOL_CALL_ID_POLICY, OMITTED_AUDIO_PLACEHOLDER, OMITTED_VIDEO_PLACEHOLDER, OpenAIResponsesStreamedMessage, OpenAIResponsesChatProvider;
+var OPENAI_RESPONSES_TOOL_CALL_ID_POLICY, EMBEDDED_STATUS_CODE_RE, OMITTED_AUDIO_PLACEHOLDER, OMITTED_VIDEO_PLACEHOLDER, OpenAIResponsesStreamedMessage, OpenAIResponsesChatProvider;
 var init_openai_responses = __esmMin((() => {
 	init_errors$12();
 	init_message$3();
@@ -54602,6 +54667,7 @@ var init_openai_responses = __esmMin((() => {
 		normalize: (id) => sanitizeOpenAIResponsesCallId(id, 64),
 		maxLength: 64
 	};
+	EMBEDDED_STATUS_CODE_RE = /\bstatus_code\s*[:=]\s*(\d{3})\b/;
 	OMITTED_AUDIO_PLACEHOLDER = "(audio omitted: unsupported audio format)";
 	OMITTED_VIDEO_PLACEHOLDER = "(video omitted: not supported by this provider)";
 	OpenAIResponsesStreamedMessage = class {
@@ -55051,7 +55117,7 @@ function catalogModelToCapability(model) {
 			thinking: Boolean(model.reasoning),
 			tool_use: model.tool_call ?? true,
 			max_context_tokens: context,
-			select_tools: model.select_tools === true
+			dynamically_loaded_tools: model.dynamically_loaded_tools === true
 		}
 	};
 }
@@ -61941,7 +62007,7 @@ function isValidPermissionPattern(pattern) {
 		return false;
 	}
 }
-var ProviderTypeSchema, OAuthRefSchema, StringRecordSchema, ProviderConfigSchema, ModelAliasBaseSchema, ModelAliasOverrideSchema, ModelAliasSchema, ThinkingConfigSchema, PermissionModeSchema, PermissionRuleDecisionSchema, PermissionRuleScopeSchema, PermissionRuleSchema, PermissionConfigSchema, LoopControlSchema, BackgroundConfigSchema, ImageConfigSchema, ModelCatalogConfigSchema, ExperimentalConfigSchema, HookDefSchema, MoonshotServiceConfigSchema, ServicesConfigSchema, McpServerCommonFields, McpServerStdioConfigSchema, McpServerHttpConfigSchema, McpServerSseConfigSchema, McpServerConfigDiscriminatedSchema, McpServerConfigSchema, KimiConfigSchema, ProviderConfigPatchSchema, ModelAliasPatchSchema, ThinkingConfigPatchSchema, PermissionConfigPatchSchema, LoopControlPatchSchema, BackgroundConfigPatchSchema, ImageConfigPatchSchema, ModelCatalogConfigPatchSchema, ExperimentalConfigPatchSchema, MoonshotServiceConfigPatchSchema, ServicesConfigPatchSchema, KimiConfigPatchSchema;
+var ProviderTypeSchema, OAuthRefSchema, StringRecordSchema, ProviderConfigSchema, ModelAliasBaseSchema, ModelAliasOverrideSchema, ModelAliasSchema, ThinkingConfigSchema, PermissionModeSchema, PermissionRuleDecisionSchema, PermissionRuleScopeSchema, PermissionRuleSchema, PermissionConfigSchema, LoopControlSchema, BackgroundConfigSchema, SubagentConfigSchema, ImageConfigSchema, ModelCatalogConfigSchema, ExperimentalConfigSchema, HookDefSchema, MoonshotServiceConfigSchema, ServicesConfigSchema, McpServerCommonFields, McpServerStdioConfigSchema, McpServerHttpConfigSchema, McpServerSseConfigSchema, McpServerConfigDiscriminatedSchema, McpServerConfigSchema, KimiConfigSchema, ProviderConfigPatchSchema, ModelAliasPatchSchema, ThinkingConfigPatchSchema, PermissionConfigPatchSchema, LoopControlPatchSchema, BackgroundConfigPatchSchema, SubagentConfigPatchSchema, ImageConfigPatchSchema, ModelCatalogConfigPatchSchema, ExperimentalConfigPatchSchema, MoonshotServiceConfigPatchSchema, ServicesConfigPatchSchema, KimiConfigPatchSchema;
 var init_schema = __esmMin((() => {
 	init_types$18();
 	init_matches_rule();
@@ -62031,8 +62097,15 @@ var init_schema = __esmMin((() => {
 		maxRunningTasks: number$1().int().min(1).optional(),
 		keepAliveOnExit: boolean$1().optional(),
 		killGracePeriodMs: number$1().int().min(0).optional(),
-		printWaitCeilingS: number$1().int().min(1).optional()
+		printWaitCeilingS: number$1().int().min(1).optional(),
+		printBackgroundMode: _enum([
+			"exit",
+			"drain",
+			"steer"
+		]).optional(),
+		printMaxTurns: number$1().int().min(1).optional()
 	});
+	SubagentConfigSchema = object({ timeoutMs: number$1().int().min(1).optional() });
 	ImageConfigSchema = object({
 		/**
 		* Longest-edge ceiling (px) applied when compressing images for the model.
@@ -62138,6 +62211,7 @@ var init_schema = __esmMin((() => {
 		extraSkillDirs: array(string()).optional(),
 		loopControl: LoopControlSchema.optional(),
 		background: BackgroundConfigSchema.optional(),
+		subagent: SubagentConfigSchema.optional(),
 		image: ImageConfigSchema.optional(),
 		modelCatalog: ModelCatalogConfigSchema.optional(),
 		experimental: ExperimentalConfigSchema.optional(),
@@ -62150,6 +62224,7 @@ var init_schema = __esmMin((() => {
 	PermissionConfigPatchSchema = PermissionConfigSchema.partial();
 	LoopControlPatchSchema = LoopControlSchema.partial();
 	BackgroundConfigPatchSchema = BackgroundConfigSchema.partial();
+	SubagentConfigPatchSchema = SubagentConfigSchema.partial();
 	ImageConfigPatchSchema = ImageConfigSchema.partial();
 	ModelCatalogConfigPatchSchema = ModelCatalogConfigSchema.partial();
 	ExperimentalConfigPatchSchema = ExperimentalConfigSchema;
@@ -62175,6 +62250,7 @@ var init_schema = __esmMin((() => {
 		extraSkillDirs: array(string()).optional(),
 		loopControl: LoopControlPatchSchema.optional(),
 		background: BackgroundConfigPatchSchema.optional(),
+		subagent: SubagentConfigPatchSchema.optional(),
 		image: ImageConfigPatchSchema.optional(),
 		modelCatalog: ModelCatalogConfigPatchSchema.optional(),
 		experimental: ExperimentalConfigPatchSchema.optional(),
@@ -63678,6 +63754,7 @@ function transformTomlData(data) {
 		else if (targetKey === "background" && isPlainObject$2(value)) result[targetKey] = transformPlainObject(value);
 		else if (targetKey === "image" && isPlainObject$2(value)) result[targetKey] = transformPlainObject(value);
 		else if (targetKey === "experimental" && isPlainObject$2(value)) result[targetKey] = cloneRecord$2(value);
+		else if (targetKey === "subagent" && isPlainObject$2(value)) result[targetKey] = transformPlainObject(value);
 		else if (!isPlainObject$2(value)) result[targetKey] = value;
 	}
 	return result;
@@ -63788,6 +63865,7 @@ function configToTomlData(config) {
 	setSection(out, "services", config.services, servicesToToml);
 	setSection(out, "loop_control", config.loopControl, loopControlToToml);
 	setSection(out, "background", config.background, backgroundToToml);
+	setSection(out, "subagent", config.subagent, subagentToToml);
 	setSection(out, "image", config.image, imageToToml);
 	setSection(out, "experimental", config.experimental, experimentalToToml);
 	setSection(out, "permission", config.permission, permissionToToml);
@@ -63879,6 +63957,11 @@ function backgroundToToml(background, rawBackground) {
 	for (const [key, value] of Object.entries(background)) setDefined(out, camelToSnake$3(key), value);
 	return out;
 }
+function subagentToToml(subagent, rawSubagent) {
+	const out = cloneRecord$2(rawSubagent);
+	for (const [key, value] of Object.entries(subagent)) setDefined(out, camelToSnake$3(key), value);
+	return out;
+}
 function imageToToml(image, rawImage) {
 	const out = cloneRecord$2(rawImage);
 	for (const [key, value] of Object.entries(image)) setDefined(out, camelToSnake$3(key), value);
@@ -68564,7 +68647,7 @@ var init_registry$1 = __esmMin((() => {
 	FLAG_DEFINITIONS = [{
 		id: "tool-select",
 		title: "Tool select (progressive tool disclosure)",
-		description: "Keep MCP tool schemas out of the immutable top-level tools[]; the model loads them on demand via the select_tools tool. Only takes effect on models whose capability catalog declares select_tools.",
+		description: "Keep MCP tool schemas out of the immutable top-level tools[]; the model loads them on demand via the select_tools tool. Only takes effect on models whose capability catalog declares dynamically loaded tools.",
 		env: "KIMI_CODE_EXPERIMENTAL_TOOL_SELECT",
 		default: false,
 		surface: "core"
@@ -69080,6 +69163,174 @@ var init_file_type$1 = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region ../../packages/agent-core/src/tools/support/image-format-policy.ts
+/**
+* Lowercase, drop MIME parameters, and apply the `image/jpg` alias. Parameter
+* stripping keeps a declared media type like `image/jpeg; charset=utf-8`
+* consistent with a data-URL MIME token (which the parser already clips at
+* the first `;`), so an accepted image with parameters is treated exactly
+* like the bare form instead of being misread as unsupported.
+*/
+function normalizeImageMime(mimeType) {
+	const lower = mimeType.trim().toLowerCase();
+	const semi = lower.indexOf(";");
+	const base = (semi === -1 ? lower : lower.slice(0, semi)).trim();
+	return base === "image/jpg" ? "image/jpeg" : base;
+}
+/**
+* Decode just the prefix of a base64 payload needed for magic-byte
+* sniffing, without allocating the full image. `Buffer.from` never throws
+* on malformed base64 — it decodes what it can.
+*/
+function decodeBase64Prefix(base64) {
+	return Buffer.from(base64.slice(0, BASE64_SNIFF_CHARS), "base64");
+}
+/**
+* The MIME an image should be judged by: the sniffed bytes when the magic
+* header is recognized (bytes are authoritative — a mislabeled image, e.g.
+* AVIF bytes an MCP image search tool labels `image/png`, is gated on what
+* it IS, because the provider decodes bytes not labels), else the declared
+* MIME. A header recognized as a non-image container also wins, so a video
+* file hiding in an image part is refused instead of trusted.
+*/
+function resolveEffectiveImageMime(declaredMime, header) {
+	const sniffed = sniffMediaFromMagic(header);
+	return sniffed !== null ? sniffed.mimeType : declaredMime;
+}
+/**
+* Whether a non-data image URL points at a format providers reject, judged
+* by its path extension. A best-effort heuristic for the case where there
+* are no bytes to sniff (a remote http(s) image): catches the common
+* search-tool direct link ending in `.avif`. Query string and fragment are
+* ignored; the match is case-insensitive. URLs without an extension, or
+* whose extension lies, fall through to the provider — and to the 400
+* recovery — unchanged.
+*
+* Returns the unsupported MIME when the extension is known and not in the
+* accepted set (so the notice names the right format), else null.
+*/
+function unsupportedImageMimeFromUrl(url) {
+	let path = url;
+	const query = path.indexOf("?");
+	if (query !== -1) path = path.slice(0, query);
+	const hash = path.indexOf("#");
+	if (hash !== -1) path = path.slice(0, hash);
+	const dot = path.lastIndexOf(".");
+	if (dot === -1) return null;
+	const ext = path.slice(dot).toLowerCase();
+	const mime = ext === ".svg" ? "image/svg+xml" : IMAGE_MIME_BY_SUFFIX[ext];
+	if (mime === void 0 || isModelAcceptedImageMime(mime)) return null;
+	return mime;
+}
+/**
+* Parse an image `data:` URL into its MIME and base64 payload. The MIME is
+* returned raw — callers decide via {@link isModelAcceptedImageMime} and
+* forward {@link normalizeImageMime}. MIME parameters are tolerated and
+* ignored (`data:image/avif;charset=utf-8;base64,…`), so a parameter-bearing
+* URL cannot slip past the format gate. The scheme and `base64` marker are
+* matched case-insensitively (RFC 2045 encoding names are case-insensitive),
+* so an uppercase `;BASE64,` cannot slip past either — and since callers
+* rebuild to the canonical URL, the marker comes back out lowercase.
+* Returns null for non-data URLs (e.g. a remote http(s) image — see the
+* scope note in the module header).
+*/
+function parseImageDataUrl(url) {
+	const match = /^data:([^;,]+)(?:;[^;,]+)*?;base64,(.*)$/is.exec(url);
+	if (match === null) return null;
+	return {
+		mimeType: match[1],
+		base64: match[2]
+	};
+}
+/**
+* Whether a URL claims to be a `data:` URL (the scheme is case-insensitive).
+* Used to distinguish "failed to parse a data URL" (malformed — guaranteed
+* to fail at the provider) from "not a data URL" (a remote http(s) image
+* the provider fetches).
+*/
+function isDataUrl(url) {
+	return url.toLowerCase().startsWith("data:");
+}
+/**
+* Whether an image with this MIME may be sent to the model. Only the closed
+* accepted set passes; everything else must be refused at the entry point —
+* once an unsupported `image_url` lands in the session history, every later
+* request in the session is rejected by the provider.
+*/
+function isModelAcceptedImageMime(mimeType) {
+	return MODEL_ACCEPTED_IMAGE_MIMES.has(normalizeImageMime(mimeType));
+}
+/**
+* Refusal for an unsupported image that has a readable file path, with a
+* conversion command matching the execution environment (`kaos.osEnv.osKind`
+* — where Bash actually runs, so SSH/container sessions get the right command
+* too). The model can run the command through Bash (under the normal
+* permission flow) and read the converted file.
+*
+* macOS converts with the built-in `sips`; Linux and Windows have no built-in
+* decoder for these formats, so the guidance names ImageMagick (plus the
+* format's dedicated Linux decoder when one exists, e.g. heif-convert).
+*/
+function buildImageConversionGuidance(path, mimeType, osKind) {
+	const converted = path.replace(/\.[^./\\]+$/, "") + ".jpg";
+	return `"${path}" is an ${mimeType} image, which the provider does not accept. Convert it to JPEG first, then read the converted file. ` + imageConversionCommand(path, converted, osKind, UNSUPPORTED_IMAGE_FORMATS[normalizeImageMime(mimeType)]);
+}
+function imageConversionCommand(path, converted, osKind, format) {
+	const magick = `magick "${path}" "${converted}"`;
+	const linuxDecoder = format?.linuxDecoder;
+	switch (osKind) {
+		case "macOS": return `On macOS: sips -s format jpeg "${path}" --out "${converted}"`;
+		case "Linux": return linuxDecoder === void 0 ? `On Linux, with ImageMagick: ${magick}` : `On Linux: ${linuxDecoder.command} "${path}" "${converted}" (package ${linuxDecoder.packageName}), or with ImageMagick: ${magick}`;
+		case "Windows": return `On Windows, with ImageMagick: ${magick} (install it first if missing: winget install ImageMagick.ImageMagick)`;
+		default: return `Options: sips -s format jpeg "${path}" --out "${converted}" (macOS)` + (linuxDecoder === void 0 ? "" : `, ${linuxDecoder.command} "${path}" "${converted}" (Linux, package ${linuxDecoder.packageName})`) + `, or ${magick} (ImageMagick)`;
+	}
+}
+/**
+* Short notice standing in for an unsupported image where there is no file
+* path to point at (MCP tool results, prompt uploads): the image part is
+* dropped and this text replaces it, so the model knows what happened and
+* the session history stays free of formats the provider rejects.
+*/
+function buildUnsupportedImageNotice(mimeType, name) {
+	return `[Image omitted: ${name === void 0 || name.length === 0 ? `unsupported image format ${mimeType}` : `"${name}" uses unsupported image format ${mimeType}`}. Model providers accept only ${ACCEPTED_FORMATS_TEXT} — convert it to PNG or JPEG and try again.]`;
+}
+/**
+* Notice standing in for an image part whose `data:` URL could not be parsed
+* at all (missing `;base64,` separator, empty MIME, …): the provider is
+* guaranteed to reject it, so it is dropped at ingestion instead of being
+* left to poison the session and trigger the media-stripped resend on every
+* later turn. The URL is truncated — a malformed payload can be huge.
+*/
+function buildMalformedImageNotice(url) {
+	return `[Image omitted: "${url.length > 80 ? `${url.slice(0, 80)}…` : url}" is not a valid data URL (its header or payload could not be parsed). Re-encode the image as PNG or JPEG and try again.]`;
+}
+var MODEL_ACCEPTED_IMAGE_MIMES, ACCEPTED_FORMATS_TEXT, UNSUPPORTED_IMAGE_FORMATS, BASE64_SNIFF_CHARS;
+var init_image_format_policy = __esmMin((() => {
+	init_file_type$1();
+	MODEL_ACCEPTED_IMAGE_MIMES = new Set([
+		"image/png",
+		"image/jpeg",
+		"image/gif",
+		"image/webp"
+	]);
+	ACCEPTED_FORMATS_TEXT = "PNG, JPEG, GIF, and WebP";
+	UNSUPPORTED_IMAGE_FORMATS = Object.freeze({
+		"image/avif": {},
+		"image/heic": { linuxDecoder: {
+			command: "heif-convert",
+			packageName: "libheif-examples"
+		} },
+		"image/heif": { linuxDecoder: {
+			command: "heif-convert",
+			packageName: "libheif-examples"
+		} },
+		"image/bmp": {},
+		"image/tiff": {},
+		"image/x-icon": {}
+	});
+	BASE64_SNIFF_CHARS = 48;
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/@jsquash+webp@1.5.0/node_modules/@jsquash/webp/codec/dec/webp_dec.js
 var Module;
 var init_webp_dec = __esmMin((() => {
@@ -111969,7 +112220,7 @@ async function compressImageForModel(bytes, mimeType, options = {}) {
 	const maxEdge = options.maxEdge ?? resolveMaxImageEdgePx();
 	const byteBudget = options.byteBudget ?? 3932160;
 	const maxDecodeBytes = options.maxDecodeBytes ?? MAX_DECODE_BYTES;
-	const normalizedMime = normalizeMime(mimeType);
+	const normalizedMime = normalizeImageMime(mimeType);
 	const dims = sniffImageDimensions(bytes);
 	const passthrough = () => ({
 		data: bytes,
@@ -112031,7 +112282,10 @@ async function compressImageForModel(bytes, mimeType, options = {}) {
 /**
 * Convenience wrapper for call sites that already hold base64 (MCP results,
 * data URLs). Decodes, compresses, and re-encodes to base64. Best effort:
-* returns the original base64 unchanged on any failure.
+* returns the original base64 unchanged on any failure — including formats it
+* cannot re-encode, so callers must refuse MIME types outside the
+* provider-accepted set (`isModelAcceptedImageMime`) before building an
+* image part from the result.
 */
 async function compressBase64ForModel(base64, mimeType, options = {}) {
 	const startedAt = Date.now();
@@ -112052,7 +112306,7 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 		reportCompressEvent(options.telemetry, {
 			outcome: "passthrough_guard",
 			startedAt,
-			inputMime: normalizeMime(mimeType),
+			inputMime: normalizeImageMime(mimeType),
 			exifTransposed: false,
 			result
 		});
@@ -112076,7 +112330,7 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 		reportCompressEvent(options.telemetry, {
 			outcome: "passthrough_error",
 			startedAt,
-			inputMime: normalizeMime(mimeType),
+			inputMime: normalizeImageMime(mimeType),
 			exifTransposed: false,
 			result
 		});
@@ -112107,6 +112361,76 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 	};
 }
 /**
+* Enforce the provider-accepted image format set (see ./image-format-policy)
+* on a content-part list. Inline `data:` image parts whose MIME is outside
+* the accepted set are dropped and replaced with a text notice, so one
+* unsupported image cannot poison the session history. Accepted images are
+* forwarded only as the byte-exact canonical data URL: an alias
+* (`image/jpg`), case/whitespace variants, or MIME parameters
+* (`image/jpeg;charset=utf-8`) all rebuild to the bare canonical form,
+* because strict provider whitelists exact-match the full header. Remote
+* (non-data) image URLs and non-image parts pass through — a URL carries no
+* bytes to inspect.
+*
+* The BYTES are authoritative, not the declared MIME: the header of each
+* inline image is sniffed, and a mismatch (e.g. AVIF bytes an MCP image
+* search tool labels `image/png`) is gated on what the image IS — the
+* provider decodes bytes, not labels. When the sniffer doesn't recognize
+* the bytes (corrupt image, exotic container), the declared MIME stands
+* and the 400-recovery path remains the backstop.
+*
+* This is the format gate shared by every ingestion point; run it BEFORE
+* compression so unsupported bytes are never decoded.
+*/
+function gateImageFormatParts(parts) {
+	const out = [];
+	for (const part of parts) {
+		if (part.type === "image_url") {
+			const parsed = parseImageDataUrl(part.imageUrl.url);
+			if (parsed === null) {
+				if (isDataUrl(part.imageUrl.url)) {
+					out.push({
+						type: "text",
+						text: buildMalformedImageNotice(part.imageUrl.url)
+					});
+					continue;
+				}
+				const extMime = unsupportedImageMimeFromUrl(part.imageUrl.url);
+				if (extMime !== null) {
+					out.push({
+						type: "text",
+						text: buildUnsupportedImageNotice(extMime, part.imageUrl.url)
+					});
+					continue;
+				}
+				out.push(part);
+				continue;
+			}
+			const effectiveMime = resolveEffectiveImageMime(parsed.mimeType, decodeBase64Prefix(parsed.base64));
+			if (!isModelAcceptedImageMime(effectiveMime)) {
+				out.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(effectiveMime)
+				});
+				continue;
+			}
+			const canonicalUrl = `data:${normalizeImageMime(effectiveMime)};base64,${parsed.base64}`;
+			if (part.imageUrl.url !== canonicalUrl) {
+				out.push({
+					type: "image_url",
+					imageUrl: {
+						...part.imageUrl,
+						url: canonicalUrl
+					}
+				});
+				continue;
+			}
+		}
+		out.push(part);
+	}
+	return out;
+}
+/**
 * Compress any inline base64 image parts in a content-part list — used by
 * the MCP tool-result path (prompt ingestion compresses per image with
 * {@link compressBase64ForModel} while constructing the part). Image parts
@@ -112114,6 +112438,13 @@ async function compressBase64ForModel(base64, mimeType, options = {}) {
 * through, as are non-image parts. Best effort: a part that fails to
 * compress is left unchanged.
 *
+* The format gate ({@link gateImageFormatParts}) runs first: parts whose
+* MIME is outside the provider-accepted set are never forwarded — the part
+* is dropped and a text notice stands in, so one unsupported image cannot
+* poison the session history. This is the MCP funnel's enforcement point —
+* MCP servers can return any `image/*` MIME (e.g. AVIF from an image search
+* tool).
+*
 * With `annotate` set, every image that was actually re-encoded gets a
 * caption in {@link CompressedContentParts.captions} so the model knows it
 * is looking at a downsampled copy. `annotate.persistOriginal` additionally
@@ -112125,9 +112456,9 @@ async function compressImageContentParts(parts, options = {}) {
 	const { annotate, ...compressOptions } = options;
 	const out = [];
 	const captions = [];
-	for (const part of parts) {
+	for (const part of gateImageFormatParts(parts)) {
 		if (part.type === "image_url") {
-			const parsed = parseImageDataUrl$1(part.imageUrl.url);
+			const parsed = parseImageDataUrl(part.imageUrl.url);
 			if (parsed !== null) {
 				const result = await compressBase64ForModel(parsed.base64, parsed.mimeType, compressOptions);
 				if (result.changed) {
@@ -112189,7 +112520,7 @@ async function cropImageForModel(bytes, mimeType, region, options = {}) {
 	const maxEdge = options.maxEdge ?? resolveMaxImageEdgePx();
 	const byteBudget = options.byteBudget ?? 3932160;
 	const maxDecodeBytes = options.maxDecodeBytes ?? MAX_DECODE_BYTES;
-	const normalizedMime = normalizeMime(mimeType);
+	const normalizedMime = normalizeImageMime(mimeType);
 	const fail = (errorKind, error) => {
 		reportCropEvent(options.telemetry, {
 			startedAt,
@@ -112339,14 +112670,6 @@ function formatByteSize$2(bytes) {
 	if (bytes < 1024 * 1024) return `${String(Math.round(bytes / 1024))} KB`;
 	return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
-function parseImageDataUrl$1(url) {
-	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
-	if (match === null) return null;
-	return {
-		mimeType: match[1],
-		base64: match[2]
-	};
-}
 /**
 * Decode `bytes` into a jimp image. PNG/JPEG decode through jimp itself
 * (which applies EXIF orientation); WebP decodes through the bundled wasm
@@ -112455,10 +112778,6 @@ function fitWithinEdge(image, edge) {
 	});
 	return true;
 }
-function normalizeMime(mimeType) {
-	const lower = mimeType.trim().toLowerCase();
-	return lower === "image/jpg" ? "image/jpeg" : lower;
-}
 /**
 * Emit the `image_compress` event. Properties are all numeric/enum — never
 * paths or content — and a throwing client is swallowed so telemetry can
@@ -112471,7 +112790,7 @@ function reportCompressEvent(telemetry, input) {
 			source: telemetry.source,
 			outcome: input.outcome,
 			input_mime: input.inputMime,
-			output_mime: normalizeMime(input.result.mimeType),
+			output_mime: normalizeImageMime(input.result.mimeType),
 			original_bytes: input.result.originalByteLength,
 			final_bytes: input.result.finalByteLength,
 			original_width: input.result.originalWidth,
@@ -112508,6 +112827,7 @@ function reportCropEvent(telemetry, input) {
 var MAX_IMAGE_EDGE_ENV, IMAGE_BYTE_BUDGET, READ_IMAGE_BYTE_BUDGET_ENV, JPEG_QUALITY_STEPS, FALLBACK_EDGES_PX, PNG_RESCALE_FLOOR_PX, MAX_DECODE_PIXELS, MAX_DECODE_BYTES, RECODABLE_MIME, CAPTION_OPENING, CAPTION_PATTERN;
 var init_image_compress = __esmMin((() => {
 	init_file_type$1();
+	init_image_format_policy();
 	init_webp_decode();
 	MAX_IMAGE_EDGE_ENV = "KIMI_IMAGE_MAX_EDGE_PX";
 	IMAGE_BYTE_BUDGET = 3.75 * 1024 * 1024;
@@ -120915,10 +121235,10 @@ function isLoadableToolsAnnouncement(message) {
 * Shape a history for a consumer that must not see dynamic-tool protocol
 * context: drop the loadable-tools announcements and strip `message.tools`
 * (dropping the message entirely when nothing else remains). Two callers:
-*   - projection for a model without the `select_tools` capability (mid-session
-*     model switch — the canonical history keeps its shape, only the outgoing
-*     view changes; announcements would be noise and even reference a
-*     select_tools tool the model does not have);
+*   - projection for a model without the dynamically-loaded-tools capability
+*     (mid-session model switch — the canonical history keeps its shape, only
+*     the outgoing view changes; announcements would be noise and even
+*     reference a select_tools tool the model does not have);
 *   - the compaction summarizer input (schemas and announcements are protocol
 *     context, not conversation — summarizing them wastes tokens and risks
 *     leaking schema text into the summary).
@@ -121073,7 +121393,7 @@ async function chatWithRetry(input) {
 			logRequestFailure(input, error, attempt, maxAttempts);
 			throw error;
 		}
-		const delayMs = delays[attempt - 1] ?? 0;
+		const delayMs = readRetryAfterMs(error) ?? delays[attempt - 1] ?? 0;
 		input.params.signal.throwIfAborted();
 		input.dispatchEvent({
 			type: "step.retrying",
@@ -121113,13 +121433,24 @@ function paramsForAttempt(input, attempt, maxAttempts) {
 	};
 }
 function retryBackoffDelays(maxAttempts) {
-	return import_retry$1.timeouts({
-		retries: Math.max(maxAttempts - 1, 0),
-		minTimeout: RETRY_MIN_TIMEOUT_MS,
-		maxTimeout: RETRY_MAX_TIMEOUT_MS,
-		factor: RETRY_FACTOR,
-		randomize: true
-	});
+	const count = Math.max(maxAttempts - 1, 0);
+	const delays = [];
+	for (let i = 0; i < count; i += 1) {
+		const base = Math.min(BASE_DELAY_MS * Math.pow(RETRY_FACTOR, i), MAX_DELAY_MS);
+		delays.push(base + Math.random() * JITTER_FACTOR * base);
+	}
+	return delays;
+}
+/**
+* Server-requested backoff carried on a kosong `APIStatusError` (parsed from
+* the `retry-after` response header). When present and positive it overrides
+* the computed backoff — a server `Retry-After` directive takes precedence
+* over the local exponential delay.
+*/
+function readRetryAfterMs(error) {
+	if (typeof error !== "object" || error === null) return null;
+	const value = error.retryAfterMs;
+	return typeof value === "number" && value > 0 ? value : null;
 }
 async function sleepForRetry(delayMs, signal) {
 	signal.throwIfAborted();
@@ -121137,15 +121468,15 @@ function maybeStatusCode(error) {
 	const statusCode = error.statusCode;
 	return typeof statusCode === "number" ? statusCode : void 0;
 }
-var import_retry$1, RETRY_MIN_TIMEOUT_MS, RETRY_MAX_TIMEOUT_MS, RETRY_FACTOR;
+var BASE_DELAY_MS, MAX_DELAY_MS, RETRY_FACTOR, JITTER_FACTOR;
 var init_retry = __esmMin((() => {
 	init_dist$4();
-	import_retry$1 = /* @__PURE__ */ __toESM(require_retry$4(), 1);
 	init_abort();
 	init_errors$4();
-	RETRY_MIN_TIMEOUT_MS = 300;
-	RETRY_MAX_TIMEOUT_MS = 5e3;
+	BASE_DELAY_MS = 500;
+	MAX_DELAY_MS = 32e3;
 	RETRY_FACTOR = 2;
+	JITTER_FACTOR = .25;
 }));
 //#endregion
 //#region ../../packages/agent-core/src/tools/support/input-schema.ts
@@ -121988,7 +122319,7 @@ var init_full = __esmMin((() => {
 						summary = extractCompactionSummary(response);
 						break;
 					} catch (error) {
-						if (error instanceof APIRequestTooLargeError && !mediaStripAttempted) {
+						if ((error instanceof APIRequestTooLargeError || isImageFormatError(error)) && !mediaStripAttempted) {
 							mediaStripAttempted = true;
 							const stripped = replaceMediaPartsWithMarkers(historyForModel);
 							if (stripped !== historyForModel) {
@@ -123268,6 +123599,21 @@ var init_manager$2 = __esmMin((() => {
 			return this.scheduler.getNextFireForTask(taskId);
 		}
 		/**
+		* Enumerate every scheduled task with its post-jitter next fire time.
+		* Unlike the CronList tool (which renders for the model), this returns
+		* structured data for host applications polling for pending work.
+		*/
+		listTaskSnapshots() {
+			return this.store.list().map((task) => ({
+				id: task.id,
+				cron: task.cron,
+				recurring: task.recurring !== false,
+				createdAt: task.createdAt,
+				lastFiredAt: task.lastFiredAt,
+				nextFireAt: this.scheduler.getNextFireForTask(task.id)
+			}));
+		}
+		/**
 		* Stale judgment.
 		*
 		*   - `KIMI_CRON_NO_STALE=1` short-circuits to false (bench).
@@ -124015,15 +124361,17 @@ function isDegradableMediaPart(part) {
 /**
 * Replace all but the `keepRecent` most recent media parts with deterministic
 * text markers. This is the media-degraded projection used to resend a request
-* the provider rejected as too large (HTTP 413 on accumulated base64 media):
-* a purely read-side transform — the underlying history is left untouched —
-* that trades old pixels for bytes while the surrounding text (including
-* ReadMediaFile's `<image path="...">` wrapper) survives, so the model can
-* re-read any file it still needs. Untouched messages are returned by
-* reference, and when nothing needs degrading the input array itself is
-* returned.
-*/
-function degradeOlderMediaParts(messages, keepRecent) {
+* the provider rejected as too large (HTTP 413 on accumulated base64 media)
+* and — with `keepRecent = 0` and `MEDIA_STRIPPED_PLACEHOLDERS` — the resend
+* after an image-format rejection, where the poisoned image could be anywhere
+* and only a full strip guarantees a clean request. A purely read-side
+* transform — the underlying history is left untouched — that trades pixels
+* for deliverability while the surrounding text (including ReadMediaFile's
+* `<image path="...">` wrapper) survives, so the model can re-read any file
+* it still needs. Untouched messages are returned by reference, and when
+* nothing needs degrading the input array itself is returned.
+*/
+function degradeOlderMediaParts(messages, keepRecent, placeholders = MEDIA_DEGRADED_PLACEHOLDERS) {
 	const mediaCount = messages.reduce((count, message) => count + message.content.filter(isDegradableMediaPart).length, 0);
 	let toDegrade = Math.max(0, mediaCount - keepRecent);
 	if (toDegrade === 0) return messages;
@@ -124034,7 +124382,7 @@ function degradeOlderMediaParts(messages, keepRecent) {
 			toDegrade -= 1;
 			return {
 				type: "text",
-				text: MEDIA_DEGRADED_PLACEHOLDERS[part.type]
+				text: placeholders[part.type]
 			};
 		});
 		return {
@@ -124043,7 +124391,7 @@ function degradeOlderMediaParts(messages, keepRecent) {
 		};
 	});
 }
-var SYNTHETIC_TOOL_RESULT_TEXT, MEDIA_DEGRADED_PLACEHOLDERS;
+var SYNTHETIC_TOOL_RESULT_TEXT, MEDIA_DEGRADED_PLACEHOLDERS, MEDIA_STRIPPED_PLACEHOLDERS;
 var init_projector = __esmMin((() => {
 	init_errors$8();
 	init_tool_result_render();
@@ -124053,6 +124401,11 @@ var init_projector = __esmMin((() => {
 		audio_url: "[audio omitted: dropped to fit the provider request size limit; re-read the file to hear it]",
 		video_url: "[video omitted: dropped to fit the provider request size limit; re-read the file to view it]"
 	};
+	MEDIA_STRIPPED_PLACEHOLDERS = {
+		image_url: "[image omitted: the provider rejected this image; re-read the file for conversion instructions]",
+		audio_url: "[audio omitted: dropped along with a rejected image; re-read the file to hear it]",
+		video_url: "[video omitted: dropped along with a rejected image; re-read the file to view it]"
+	};
 }));
 //#endregion
 //#region ../../packages/agent-core/src/agent/context/types.ts
@@ -124452,6 +124805,9 @@ var init_context$2 = __esmMin((() => {
 		get mediaDegradedMessages() {
 			return degradeOlderMediaParts(this.messages, 2);
 		}
+		get mediaStrippedMessages() {
+			return degradeOlderMediaParts(this.messages, 0, MEDIA_STRIPPED_PLACEHOLDERS);
+		}
 		useProjectedHistoryFrom(source) {
 			this.clear();
 			this.pushHistory(...trimTrailingOpenToolExchange(source.project(source.history)));
@@ -137278,7 +137634,7 @@ var init_tool_call = __esmMin((() => {
 * does not lose model usage that was already spent.
 */
 async function executeLoopStep(deps) {
-	const { turnId, signal, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, dispatchEvent, llm, tools, buildTools, describeMissingTool, hooks, log, currentStep, maxRetryAttempts, recordUsage } = deps;
+	const { turnId, signal, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, buildMessagesMediaStripped, dispatchEvent, llm, tools, buildTools, describeMissingTool, hooks, log, currentStep, maxRetryAttempts, recordUsage } = deps;
 	if (hooks?.beforeStep !== void 0) {
 		const beforeStep = await hooks.beforeStep({
 			turnId,
@@ -137333,6 +137689,7 @@ async function executeLoopStep(deps) {
 	};
 	let response;
 	let mediaDegradedResendUsed = false;
+	let mediaStrippedResendUsed = false;
 	try {
 		response = await chatWithRetry({
 			...retryInput,
@@ -137367,6 +137724,34 @@ async function executeLoopStep(deps) {
 			}
 			mediaDegradedResendUsed = true;
 			log?.info("recovered after media-degraded resend", { turnStep: `${turnId}.${String(currentStep)}` });
+		} else if (buildMessagesMediaStripped !== void 0 && isImageFormatError(error)) {
+			signal.throwIfAborted();
+			log?.warn("provider rejected an image in the request; resending with all media stripped", {
+				turnStep: `${turnId}.${String(currentStep)}`,
+				model: llm.modelName
+			});
+			const strippedMessages = await buildMessagesMediaStripped();
+			signal.throwIfAborted();
+			try {
+				response = await chatWithRetry({
+					...retryInput,
+					params: {
+						...chatParams,
+						messages: strippedMessages,
+						requestLogFields: { projection: "media-stripped" }
+					}
+				});
+			} catch (strippedError) {
+				log?.error("media-stripped resend still rejected by provider", {
+					turnStep: `${turnId}.${String(currentStep)}`,
+					model: llm.modelName,
+					originalError: errorMessage$5(error),
+					strippedError: errorMessage$5(strippedError)
+				});
+				throw strippedError;
+			}
+			mediaStrippedResendUsed = true;
+			log?.info("recovered after media-stripped resend", { turnStep: `${turnId}.${String(currentStep)}` });
 		} else if (buildMessagesStrict !== void 0 && isRecoverableRequestStructureError(error)) {
 			signal.throwIfAborted();
 			log?.warn("provider rejected request structure; resending with strict projection", {
@@ -137436,7 +137821,8 @@ async function executeLoopStep(deps) {
 	return {
 		usage,
 		stopReason: stopTurnAfterStep && effectiveStopReason === "tool_use" ? "end_turn" : effectiveStopReason,
-		mediaDegradedResendUsed
+		mediaDegradedResendUsed,
+		mediaStrippedResendUsed
 	};
 }
 /**
@@ -137535,12 +137921,13 @@ var init_turn_step = __esmMin((() => {
 //#endregion
 //#region ../../packages/agent-core/src/loop/run-turn.ts
 async function runTurn(input) {
-	const { turnId, signal, llm, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, dispatchEvent, tools, buildTools, describeMissingTool, hooks, log, maxSteps, maxRetryAttempts, recordStepUsage: hostRecordStepUsage } = input;
+	const { turnId, signal, llm, buildMessages, buildMessagesStrict, buildMessagesMediaDegraded, buildMessagesMediaStripped, dispatchEvent, tools, buildTools, describeMissingTool, hooks, log, maxSteps, maxRetryAttempts, recordStepUsage: hostRecordStepUsage } = input;
 	let usage = emptyUsage();
 	let steps = 0;
 	let stopReason = "end_turn";
 	let activeStep;
 	let mediaDegradedActive = false;
+	let mediaStrippedActive = false;
 	const recordStepUsage = async (stepUsage) => {
 		usage = addUsage$1(usage, stepUsage);
 		return hostRecordStepUsage?.(stepUsage);
@@ -137554,9 +137941,10 @@ async function runTurn(input) {
 			const stepResult = await executeLoopStep({
 				turnId,
 				signal,
-				buildMessages: mediaDegradedActive && buildMessagesMediaDegraded !== void 0 ? buildMessagesMediaDegraded : buildMessages,
+				buildMessages: mediaStrippedActive && buildMessagesMediaStripped !== void 0 ? buildMessagesMediaStripped : mediaDegradedActive && buildMessagesMediaDegraded !== void 0 ? buildMessagesMediaDegraded : buildMessages,
 				buildMessagesStrict,
 				buildMessagesMediaDegraded,
+				buildMessagesMediaStripped,
 				dispatchEvent,
 				llm,
 				tools,
@@ -137570,6 +137958,7 @@ async function runTurn(input) {
 			});
 			activeStep = void 0;
 			mediaDegradedActive = mediaDegradedActive || stepResult.mediaDegradedResendUsed === true;
+			mediaStrippedActive = mediaStrippedActive || stepResult.mediaStrippedResendUsed === true;
 			if (stepResult.stopReason === "tool_use") continue;
 			const terminalStopReason = stepResult.stopReason;
 			stopReason = terminalStopReason;
@@ -143796,10 +144185,16 @@ function convertMCPContentBlock(block) {
 	}
 	if (block.type === "resource_link" && typeof block.uri === "string") {
 		const mimeType = block.mimeType ?? "application/octet-stream";
-		if (mimeType.startsWith("image/")) return {
-			type: "image_url",
-			imageUrl: { url: block.uri }
-		};
+		if (mimeType.startsWith("image/")) {
+			if (!isModelAcceptedImageMime(mimeType)) return {
+				type: "text",
+				text: buildUnsupportedImageNotice(mimeType, block.uri)
+			};
+			return {
+				type: "image_url",
+				imageUrl: { url: block.uri }
+			};
+		}
 		if (mimeType.startsWith("audio/")) return {
 			type: "audio_url",
 			audioUrl: { url: block.uri }
@@ -143980,6 +144375,7 @@ function collapseSingleText(parts) {
 var MCP_MAX_OUTPUT_CHARS, MCP_OUTPUT_TRUNCATED_TEXT, MCP_MAX_BINARY_PART_BYTES, MCP_MAX_BINARY_PART_CHARS;
 var init_output = __esmMin((() => {
 	init_image_compress();
+	init_image_format_policy();
 	init_image_originals();
 	MCP_MAX_OUTPUT_CHARS = 1e5;
 	MCP_OUTPUT_TRUNCATED_TEXT = `\n\n[Output truncated: exceeded ${String(MCP_MAX_OUTPUT_CHARS)} character limit. Use pagination or more specific queries to get remaining content.]`;
@@ -143987,479 +144383,6 @@ var init_output = __esmMin((() => {
 	MCP_MAX_BINARY_PART_CHARS = Math.ceil(MCP_MAX_BINARY_PART_BYTES * 4 / 3);
 }));
 //#endregion
-//#region ../../packages/agent-core/src/agent/llm-request-logger.ts
-function splitGenerateOptions(options) {
-	if (options === void 0) return {
-		requestLogFields: void 0,
-		generateOptions: void 0
-	};
-	const { requestLogFields, ...generateOptions } = options;
-	return {
-		requestLogFields,
-		generateOptions
-	};
-}
-function toolSignature(tools) {
-	return tools.map(({ name, description, parameters }) => ({
-		name,
-		description,
-		parameters
-	}));
-}
-function fingerprint(content) {
-	return createHash("sha256").update(content).digest("hex");
-}
-var LlmRequestLogger;
-var init_llm_request_logger = __esmMin((() => {
-	LlmRequestLogger = class {
-		log;
-		lastConfigLogSignature;
-		constructor(log) {
-			this.log = log;
-		}
-		logRequest(input) {
-			const { provider, modelAlias, systemPrompt, tools, messages, fields } = input;
-			const requestLogFields = fields ?? {};
-			const wireTools = tools.filter((tool) => tool.deferred !== true);
-			const config = {
-				provider: provider.name,
-				model: provider.modelName,
-				modelAlias,
-				thinkingEffort: provider.thinkingEffort ?? void 0,
-				systemPromptChars: systemPrompt.length,
-				toolCount: wireTools.length
-			};
-			const signature = JSON.stringify({
-				...config,
-				systemPromptHash: fingerprint(systemPrompt),
-				toolsHash: fingerprint(JSON.stringify(toolSignature(wireTools)))
-			});
-			if (signature !== this.lastConfigLogSignature) {
-				this.lastConfigLogSignature = signature;
-				this.log.info("llm config", {
-					...requestLogFields,
-					...config
-				});
-			}
-			const partialMessageCount = messages.filter((message) => message.partial === true).length;
-			const requestFields = { ...requestLogFields };
-			if (partialMessageCount > 0) requestFields.partialMessageCount = partialMessageCount;
-			this.log.info("llm request", requestFields);
-		}
-	};
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/background/task-output.md?raw
-var task_output_default;
-var init_task_output$1 = __esmMin((() => {
-	task_output_default = "Retrieve output from a running or completed background task.\n\nUse this after `Bash(run_in_background=true)` or `Agent(run_in_background=true)` when you need to inspect progress or explicitly wait for completion.\n\nGuidelines:\n- Prefer relying on automatic completion notifications. Use this tool only when you need task output before the automatic notification arrives.\n- Do not use TaskOutput to wait for a result you need before continuing — if your next step depends on the task's result, run that task in the foreground instead. TaskOutput is for a deliberate progress check you will act on without blocking, not a way to sit and wait for a background task you just launched.\n- By default this tool is non-blocking and returns a current status/output snapshot.\n- Use block=true only when you intentionally want to wait for completion or timeout.\n- This tool returns structured task metadata, a fixed-size output preview, and an output_path for the full log.\n- For a terminal task, the metadata also explains why it ended. A shell command that runs to completion reports `status: completed` on a zero exit, or `status: failed` with its non-zero `exit_code` — judge that failure from the `exit_code`, because a plain command failure carries no `stop_reason` and no `terminal_reason`. `terminal_reason` is a categorical label emitted only when the end is not an ordinary exit: `timed_out` when the deadline aborted it, `stopped` when it was explicitly stopped, or `failed` when it errored without producing an exit code; the `stopped` and `failed` cases also carry a human-readable `stop_reason`. A task that finished on its own with a clean exit carries neither `stop_reason` nor `terminal_reason`.\n- The full, never-truncated log is always available at output_path; use the `Read` tool with that path to page through it, whether or not the preview was truncated.\n- This tool works with the generic background task system and should remain the primary read path for future task types, not just bash.\n";
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/background/task-output.ts
-function retrievalStatus(status, block) {
-	if (isBackgroundTaskTerminal(status)) return "success";
-	return block ? "timeout" : "not_ready";
-}
-function terminalReason(info) {
-	if (info.status === "timed_out") return "timed_out";
-	if (info.status === "killed" && info.stopReason !== void 0) return "stopped";
-	if (info.status === "failed" && info.stopReason !== void 0) return "failed";
-}
-function fullOutputHint(output) {
-	if (!output.fullOutputAvailable || output.outputPath === void 0) return void 0;
-	if (output.truncated) return `Only the last ${String(OUTPUT_PREVIEW_BYTES)} bytes are shown above. Use the Read tool with the output_path to page through the full log (parameters: path, line_offset, n_lines; read about ${String(PAGING_HINT_LINES)} lines per page).`;
-	return `The preview above is the complete output. Use the Read tool with the output_path if you need to re-read the full log later (parameters: path, line_offset, n_lines; read about ${String(PAGING_HINT_LINES)} lines per page).`;
-}
-var OUTPUT_PREVIEW_BYTES, PAGING_HINT_LINES, TaskOutputInputSchema, TaskOutputTool;
-var init_task_output = __esmMin((() => {
-	init_zod$1();
-	init_background();
-	init_input_schema();
-	init_rule_match();
-	init_format();
-	init_task_output$1();
-	OUTPUT_PREVIEW_BYTES = 32 * 1024;
-	PAGING_HINT_LINES = 300;
-	TaskOutputInputSchema = object({
-		task_id: string().describe("The background task ID to inspect."),
-		block: boolean$1().default(false).describe("Whether to wait for the task to finish before returning.").optional(),
-		timeout: number$1().int().min(0).max(3600).default(30).describe("Maximum number of seconds to wait when block=true.").optional()
-	});
-	TaskOutputTool = class {
-		manager;
-		name = "TaskOutput";
-		description = task_output_default;
-		parameters = toInputJsonSchema(TaskOutputInputSchema);
-		constructor(manager) {
-			this.manager = manager;
-		}
-		resolveExecution(args) {
-			return {
-				description: `Reading output of task ${args.task_id}`,
-				approvalRule: this.name,
-				matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.task_id),
-				execute: () => this.execute(args)
-			};
-		}
-		async execute(args) {
-			const info = this.manager.getTask(args.task_id);
-			if (!info) return {
-				isError: true,
-				output: `Task not found: ${args.task_id}`
-			};
-			if (args.block && !isBackgroundTaskTerminal(info.status)) await this.manager.wait(args.task_id, (args.timeout ?? 30) * 1e3);
-			const current = this.manager.getTask(args.task_id);
-			if (!current) return {
-				isError: true,
-				output: `Task not found: ${args.task_id}`
-			};
-			const output = await this.manager.getOutputSnapshot(args.task_id, OUTPUT_PREVIEW_BYTES);
-			const lines = [formatPlainObject({
-				retrievalStatus: retrievalStatus(current.status, args.block),
-				...current,
-				outputPath: output.outputPath,
-				terminalReason: terminalReason(current),
-				outputSizeBytes: output.outputSizeBytes,
-				outputPreviewBytes: output.previewBytes,
-				outputTruncated: output.truncated,
-				fullOutputAvailable: output.fullOutputAvailable,
-				fullOutputTool: output.fullOutputAvailable && output.outputPath !== void 0 ? "Read" : void 0,
-				fullOutputHint: fullOutputHint(output)
-			}), ""];
-			if (output.truncated) lines.push(output.fullOutputAvailable && output.outputPath !== void 0 ? `[Truncated. Full output: ${output.outputPath}]` : "[Truncated. No persisted full log is available for this task.]");
-			lines.push("[output]", output.preview || "[no output available]");
-			return {
-				output: lines.join("\n"),
-				isError: false,
-				message: "Task snapshot retrieved."
-			};
-		}
-	};
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/background/task-stop.md?raw
-var task_stop_default;
-var init_task_stop$1 = __esmMin((() => {
-	task_stop_default = "Stop a running background task.\n\nOnly use this when a task must genuinely be cancelled — for a task that is\nfinishing normally, wait for its completion notification or inspect it with\n`TaskOutput` instead of stopping it.\n\nGuidelines:\n- This is a general-purpose stop capability for any background task. It is not\n  a bash-specific kill.\n- Stopping a task is destructive: it may leave partial side effects behind.\n  Use it with care.\n- If the task has already finished, this tool simply returns its current\n  status.\n";
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/background/task-stop.ts
-function terminalStopReason(reason) {
-	const trimmed = reason?.trim();
-	return trimmed === void 0 || trimmed.length === 0 ? "Task already in terminal state" : trimmed;
-}
-var TaskStopInputSchema, TaskStopTool;
-var init_task_stop = __esmMin((() => {
-	init_zod$1();
-	init_background();
-	init_input_schema();
-	init_rule_match();
-	init_task_stop$1();
-	TaskStopInputSchema = object({
-		task_id: string().describe("The background task ID to stop."),
-		reason: string().default("Stopped by TaskStop").describe("Short reason recorded when the task is stopped.").optional()
-	});
-	TaskStopTool = class {
-		manager;
-		name = "TaskStop";
-		description = task_stop_default;
-		parameters = toInputJsonSchema(TaskStopInputSchema);
-		constructor(manager) {
-			this.manager = manager;
-		}
-		resolveExecution(args) {
-			return {
-				description: `Stopping task ${args.task_id}`,
-				approvalRule: this.name,
-				matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.task_id),
-				execute: async () => {
-					const info = this.manager.getTask(args.task_id);
-					if (!info) return {
-						isError: true,
-						output: `Task not found: ${args.task_id}`
-					};
-					const trimmedReason = args.reason?.trim();
-					const reason = trimmedReason === void 0 || trimmedReason.length === 0 ? "Stopped by TaskStop" : trimmedReason;
-					if (isBackgroundTaskTerminal(info.status)) return {
-						output: `task_id: ${info.taskId}\nstatus: ${info.status}\nreason: ${terminalStopReason(info.stopReason)}`,
-						isError: false
-					};
-					await this.manager.suppressTerminalNotification(args.task_id);
-					const result = await this.manager.stop(args.task_id, reason);
-					if (!result) return {
-						isError: true,
-						output: `Failed to stop task: ${args.task_id}`
-					};
-					return {
-						output: `task_id: ${result.taskId}\nstatus: ${result.status}\nreason: ${result.stopReason ?? reason}`,
-						isError: false
-					};
-				}
-			};
-		}
-	};
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/time-format.ts
-/**
-* Render cron-facing timestamps in local wall time with an explicit
-* numeric offset. Cron expressions are evaluated in local time, so the
-* tool output should preserve that mental model while remaining
-* unambiguous and parseable as ISO 8601.
-*/
-function formatLocalIsoWithOffset(ms) {
-	const date = new Date(ms);
-	const offsetMin = -date.getTimezoneOffset();
-	const sign = offsetMin >= 0 ? "+" : "-";
-	const absOffset = Math.abs(offsetMin);
-	const offset = `${sign}${pad(Math.floor(absOffset / 60))}:${pad(absOffset % 60)}`;
-	return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}.${String(date.getMilliseconds()).padStart(3, "0")}${offset}`;
-}
-function pad(n) {
-	return String(n).padStart(2, "0");
-}
-var init_time_format = __esmMin((() => {}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-create.md?raw
-var cron_create_default;
-var init_cron_create$1 = __esmMin((() => {
-	cron_create_default = "Schedule a prompt to be enqueued at a future time. Use for both recurring schedules and one-shot reminders.\n\nUses standard 5-field cron in the user's local timezone: minute hour day-of-month month day-of-week. `0 9 * * *` means 9am local — no timezone conversion needed.\n\n## One-shot tasks (recurring: false)\n\nFor \"remind me at X\" or \"at <time>, do Y\" requests — fire once then auto-delete.\nPin minute/hour/day-of-month/month to specific values:\n  \"remind me at 2:30pm today to check the deploy\" → cron: \"30 14 <today_dom> <today_month> *\", recurring: false\n  \"tomorrow morning, run the smoke test\" → cron: \"57 8 <tomorrow_dom> <tomorrow_month> *\", recurring: false\n\nOne-shots are best for near-term reminders. A task only fires while its session is still alive (see Session lifetime below), so favor near times — within hours or a few days — rather than scheduling weeks or months ahead.\n\n## Recurring jobs (recurring: true, the default)\n\nFor \"every N minutes\" / \"every hour\" / \"weekdays at 9am\" requests:\n  \"*/5 * * * *\" (every 5 min), \"0 * * * *\" (hourly), \"0 9 * * 1-5\" (weekdays at 9am local)\n\n## Avoid the :00 and :30 minute marks when the task allows it\n\nEvery user who asks for \"9am\" gets `0 9`, and every user who asks for \"hourly\" gets `0 *` — which means requests from across the planet land on the API at the same instant. When the user's request is approximate, pick a minute that is NOT 0 or 30:\n  \"every morning around 9\" → \"57 8 * * *\" or \"3 9 * * *\" (not \"0 9 * * *\")\n  \"hourly\" → \"7 * * * *\" (not \"0 * * * *\")\n  \"in an hour or so, remind me to...\" → pick whatever minute you land on, don't round\n\nOnly use minute 0 or 30 when the user names that exact time and clearly means it (\"at 9:00 sharp\", \"at half past\", coordinating with a meeting). When in doubt, nudge a few minutes early or late — the user will not notice, and the fleet will.\n\n## Coalesce semantics\n\nFires are delivered only while the session is idle: a fire that comes due during an active turn is held and delivered at the next idle moment, never injected mid-turn.\n\nIf the scheduler slept past multiple ideal fire times (laptop closed, long-running turn, etc.), only **one** fire is delivered when it wakes up. The origin carries `coalescedCount` showing how many ideal fires were collapsed into this single delivery. You should treat `coalescedCount > 1` as \"I missed some checks; only the latest state matters\" rather than running the prompt that many times.\n\n## Cron-fire envelope\n\nWhen a cron task fires, the prompt you scheduled is re-injected wrapped in an XML envelope that exposes the fire context:\n\n```\n<cron-fire jobId=\"...\" cron=\"...\" recurring=\"true|false\" coalescedCount=\"N\" stale=\"true|false\">\n<prompt>\nyour original prompt text, verbatim\n</prompt>\n</cron-fire>\n```\n\nThe envelope is parseable. Use `coalescedCount > 1` to know multiple ideal fires were collapsed into a single delivery (treat as \"only the latest state matters\"), and `stale=\"true\"` as a cue that the task is past its 7-day threshold.\n\n## 7-day stale behavior\n\nRecurring tasks that have been alive for more than 7 days fire one\nfinal time with `stale: true` on the envelope, and the system then\nauto-deletes the task. The flag is the model's notice that this is\nthe last delivery. If the schedule is still wanted, call `CronCreate`\nagain with the same `cron` and `prompt` — that resets `createdAt` and\nstarts a fresh 7-day window. One-shot tasks are never marked stale.\n\n## Jitter behavior\n\nAnti-herd jitter is applied deterministically per task id:\n  - Recurring: ideal fire time is shifted **forward** by an offset ≤ min(10% of the cron period, 15 minutes). A `*/5 * * * *` task can drift up to 30s; a `0 9 * * *` task can drift up to 15 minutes.\n  - One-shot: only when the ideal fire lands on `:00` or `:30` of the hour, the fire is pulled **earlier** by ≤ 90 seconds. Other minutes pass through unchanged.\n\n## One-shot vs recurring — when to pick which\n\nUse `recurring: false` for \"remind me at X\" style requests, single deadlines, \"in N minutes do Y\", and any task that should not repeat. Use `recurring: true` for periodic polling (CI status, build watchers, scheduled reports), workday rituals, and anything the user explicitly described as recurring.\n\n## Session lifetime\n\nCron tasks live in the current kimi CLI session. When you exit, they\nare persisted under the session homedir; the next `kimi resume` of the\nsame session reloads them and the scheduler resumes from each task's\n`createdAt`. Fire times that fell during the offline window are\ncollapsed into a single delivery via `coalescedCount` (and recurring\ntasks past their 7-day window arrive with `stale: true` as their final\ndelivery).\n\nTasks do **not** carry over into a brand-new session — they are scoped\nto the resumed session id, not to the working directory.\n\n## Limits\n\nA session holds at most 50 live cron tasks; creating one beyond that is rejected. (The `prompt` body is also capped — see its parameter description.) Expressions that never fire within the next 5 years (e.g. `0 0 31 2 *`, an impossible date) are rejected at create time.\n\n## Returned fields\n\n`id` (8-hex), `cron` (the normalized expression), `humanSchedule` (English summary), `recurring`,\n`nextFireAt` (local ISO timestamp with numeric offset, or null). `id` is needed by `CronDelete`.\n\n## Tell the user how to cancel or modify\n\nAfter successfully creating a task, proactively tell the user how they can cancel or modify it later. Users have no direct `/cron` command or self-service UI to manage reminders themselves; they must ask the model to make changes (e.g. \"cancel my 9am reminder\" or \"change my daily check to 10am\"). Include the task `id` in your message so the user can reference it.\n";
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-create.ts
-function formatOutput(o) {
-	return [
-		`id: ${o.id}`,
-		`cron: ${o.cron}`,
-		`humanSchedule: ${o.humanSchedule}`,
-		`recurring: ${String(o.recurring)}`,
-		`nextFireAt: ${o.nextFireAt === null ? "null" : formatLocalIsoWithOffset(o.nextFireAt)}`
-	].join("\n");
-}
-var MAX_PROMPT_BYTES, ONE_SHOT_MAX_FUTURE_MS, CronCreateInputSchema, CronCreateTool;
-var init_cron_create = __esmMin((() => {
-	init_zod$1();
-	init_input_schema();
-	init_rule_match();
-	init_cron_expr();
-	init_jitter();
-	init_time_format();
-	init_cron_create$1();
-	MAX_PROMPT_BYTES = 8 * 1024;
-	ONE_SHOT_MAX_FUTURE_MS = 350 * 24 * 60 * 60 * 1e3;
-	CronCreateInputSchema = object({
-		cron: string().describe("5-field cron expression in local time: \"M H DoM Mon DoW\" (e.g. \"*/5 * * * *\" = every 5 minutes; \"30 14 28 2 *\" = Feb 28 at 2:30pm local — a pinned date like this repeats yearly unless you also pass recurring: false)."),
-		prompt: string().min(1).max(MAX_PROMPT_BYTES).describe("The prompt to enqueue at each fire time. Limited to 8 KiB (UTF-8)."),
-		recurring: boolean$1().optional().default(true).describe("true (default) = fire on every cron match until deleted or auto-expired after 7 days. false = fire once at the next match, then auto-delete. Use false for \"remind me at X\" one-shot requests with pinned minute/hour/dom/month.")
-	});
-	CronCreateTool = class {
-		manager;
-		name = "CronCreate";
-		description = cron_create_default;
-		parameters = toInputJsonSchema(CronCreateInputSchema);
-		constructor(manager) {
-			this.manager = manager;
-		}
-		resolveExecution(args) {
-			if (process.env["KIMI_DISABLE_CRON"] === "1") return {
-				isError: true,
-				output: "Cron scheduling is disabled (KIMI_DISABLE_CRON=1)."
-			};
-			const normalizedCron = args.cron.trim().split(/\s+/).join(" ");
-			let parsed;
-			try {
-				parsed = parseCronExpression(normalizedCron);
-			} catch (err) {
-				return {
-					isError: true,
-					output: `Invalid cron expression: ${err instanceof Error ? err.message : String(err)}`
-				};
-			}
-			const nowAtPrepare = this.manager.clocks.wallNow();
-			if (!hasFireWithinYears(parsed, 5, nowAtPrepare)) return {
-				isError: true,
-				output: `Cron expression ${JSON.stringify(normalizedCron)} has no fire within 5 years; refusing to schedule.`
-			};
-			if (this.manager.store.list().length >= 50) return {
-				isError: true,
-				output: `Cron job cap reached (max ${String(50)} per session).`
-			};
-			const byteLen = Buffer.byteLength(args.prompt, "utf8");
-			if (byteLen > MAX_PROMPT_BYTES) return {
-				isError: true,
-				output: `Prompt exceeds ${String(MAX_PROMPT_BYTES)} bytes (got ${String(byteLen)}).`
-			};
-			const recurring = args.recurring !== false;
-			if (!recurring) {
-				const firstFire = computeNextCronRun(parsed, nowAtPrepare);
-				if (firstFire !== null && firstFire - nowAtPrepare > ONE_SHOT_MAX_FUTURE_MS) return {
-					isError: true,
-					output: `One-shot cron ${JSON.stringify(normalizedCron)} would not fire until ${formatLocalIsoWithOffset(firstFire)} (more than a year out). If you meant "today" or a near date, the pinned day/month has already passed this year — pick a future date or use wildcards.`
-				};
-			}
-			return {
-				description: recurring ? `Scheduling cron ${normalizedCron}` : `Scheduling one-shot ${normalizedCron}`,
-				approvalRule: literalRulePattern(this.name, JSON.stringify({
-					cron: normalizedCron,
-					prompt: args.prompt,
-					recurring
-				})),
-				execute: async () => {
-					const nowMs = this.manager.clocks.wallNow();
-					if (this.manager.store.list().length >= 50) return {
-						isError: true,
-						output: `Cron job cap reached (max ${String(50)} per session).`
-					};
-					const task = this.manager.addTask({
-						cron: normalizedCron,
-						prompt: args.prompt,
-						recurring
-					});
-					const ideal = computeNextCronRun(parsed, nowMs);
-					const nextFireAt = ideal === null ? null : recurring ? jitteredNextCronRunMs(task, parsed, ideal) : oneShotJitteredNextCronRunMs(task, ideal);
-					const humanSchedule = cronToHuman(parsed);
-					this.manager.emitScheduled(task);
-					return {
-						output: formatOutput({
-							id: task.id,
-							cron: normalizedCron,
-							humanSchedule,
-							recurring,
-							nextFireAt
-						}),
-						isError: false,
-						message: `Scheduled cron ${task.id}`
-					};
-				}
-			};
-		}
-	};
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-delete.md?raw
-var cron_delete_default;
-var init_cron_delete$1 = __esmMin((() => {
-	cron_delete_default = "Cancel a scheduled cron job by id.\n\nUse this tool to remove a cron task previously scheduled with\n`CronCreate`. The `id` is the 8-hex value returned by `CronCreate`, or\nshown in the `id:` column of `CronList` — quote it verbatim, no\nprefix.\n\nBehaviour by task kind:\n\n- **Recurring task** (`recurring: true`): stops all future fires\n  immediately. The scheduler picks up the deletion on its next tick.\n- **One-shot task** (`recurring: false`): cancels the pending fire if\n  it has not happened yet. One-shots that have already fired\n  auto-delete themselves, so calling `CronDelete` on a fired one-shot\n  returns \"no cron job with id ...\".\n\nNot-found is reported as an error (not a silent no-op) so you can\ncorrect yourself — typically by calling `CronList` to see which ids\nare actually live, rather than re-trying with the same stale id.\n\nRefresh pattern (use when you want a stale recurring schedule to\ncontinue):\n\nStale recurring tasks are auto-deleted by the system after their final\nfire — there is nothing for `CronDelete` to remove at that point. To\nkeep the schedule running, just call `CronCreate` with the same `cron`\nand `prompt`. Use `CronList`'s `prompt` field to recall the original\ntext after a context compaction.\n\n`CronDelete` remains the right call when you want to cancel a task\nthat is still live (recurring not yet stale, or a one-shot still\npending).\n\nGuidelines:\n\n- Users have no direct `/cron` command or self-service UI to delete\n  tasks themselves; they must ask the model to cancel a reminder.\n  When deleting on behalf of a user, confirm the action and report\n  the result plainly.\n- Cron deletion is irreversible — there is no undo. If you delete the\n  wrong task, you must re-create it with `CronCreate`.\n- If the model is unsure which id is current (e.g. after a context\n  compaction), call `CronList` first rather than guessing.\n";
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-delete.ts
-var ID_PATTERN, CronDeleteInputSchema, CronDeleteTool;
-var init_cron_delete = __esmMin((() => {
-	init_zod$1();
-	init_input_schema();
-	init_cron_delete$1();
-	ID_PATTERN = /^[0-9a-f]{8}$/;
-	CronDeleteInputSchema = object({ id: string().describe("The 8-hex cron job id returned by CronCreate / CronList.") });
-	CronDeleteTool = class {
-		manager;
-		name = "CronDelete";
-		description = cron_delete_default;
-		parameters = toInputJsonSchema(CronDeleteInputSchema);
-		constructor(manager) {
-			this.manager = manager;
-		}
-		resolveExecution(args) {
-			if (!ID_PATTERN.test(args.id)) return {
-				isError: true,
-				output: `Invalid cron job id ${JSON.stringify(args.id)} — must be 8 lowercase hex characters.`
-			};
-			return {
-				description: `Deleting cron ${args.id}`,
-				approvalRule: this.name,
-				execute: async () => {
-					if (this.manager.removeTasks([args.id]).length === 0) return {
-						isError: true,
-						output: `No cron job with id ${args.id}.`
-					};
-					this.manager.emitDeleted(args.id);
-					return {
-						output: `Deleted cron job ${args.id}.`,
-						isError: false
-					};
-				}
-			};
-		}
-	};
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-list.md?raw
-var cron_list_default;
-var init_cron_list$1 = __esmMin((() => {
-	cron_list_default = "List all cron jobs currently scheduled in this session.\n\nUse this tool to see every pending cron task — both recurring jobs and\none-shot reminders — that you (or the user) have scheduled with\n`CronCreate`. The output is the entry point for inspecting scheduled\nwork: it returns a stable id, the original cron expression, a human\nrendering, the next post-jitter fire time, the recurring flag, the\ntask's age in days, and a stale indicator.\n\nEach record carries:\n\n- `id` — the 8-hex task id. Pass this to `CronDelete` to remove the\n  task, or quote it in user-facing messages when asking for\n  confirmation.\n- `cron` — the verbatim 5-field cron expression as scheduled.\n- `humanSchedule` — plain-English rendering (e.g. `every 5 minutes`).\n- `prompt` — the scheduled prompt text, JSON-encoded so embedded\n  newlines stay on one line. Truncated to 200 UTF-8 bytes with\n  `…(truncated)` if longer. Use this to recall what a task is for\n  after a context compaction, and as the source for the\n  `CronCreate` refresh ritual.\n- `nextFireAt` — local ISO timestamp with an explicit numeric offset\n  for the next fire **after jitter has been applied**. The actual fire\n  may land slightly before or after a round `:00` / `:30` minute mark\n  due to herd-avoidance jitter; this is the value the scheduler will\n  compare against, so it reflects what will really happen. `null` if\n  the expression has no fire in the next 5 years (should not happen\n  for tasks created through `CronCreate`, which validates).\n- `recurring` — `true` for cadenced jobs, `false` for one-shots.\n- `ageDays` — `(now - createdAt) / day`, two decimal places. Useful\n  when deciding whether a long-running cron is still relevant.\n- `stale` — `true` when a recurring task is older than 7 days. The\n  system **auto-deletes the task after this fire** to bound session\n  lifetime; the `stale: true` flag is the model's notice that this is\n  the final delivery. To resume the same schedule, call `CronCreate`\n  again with the original `cron` and `prompt` (the `prompt` row above\n  carries it for exactly this purpose). One-shots are never marked\n  stale — they fire at most once by construction.\n\nGuidelines:\n\n- This tool is read-only and never mutates state, so it is always\n  safe to call (including in plan mode).\n- Users cannot directly manage cron tasks themselves; if they want to\n  cancel or modify a schedule, route the request through the model\n  (i.e. call `CronDelete` or `CronCreate` on their behalf).\n- The empty case returns `cron_jobs: 0\\nNo cron jobs scheduled.`. Cron\n  tasks survive a `kimi resume` of the same session but do not bleed\n  into new sessions.\n- After a context compaction, or whenever you are unsure which cron\n  jobs are live, call this tool to re-enumerate them rather than\n  guessing ids from earlier in the conversation.\n- Records are separated by a line containing just `---`, in the\n  insertion order they were scheduled.\n";
-}));
-//#endregion
-//#region ../../packages/agent-core/src/tools/cron/cron-list.ts
-function previewPrompt(prompt) {
-	const buf = Buffer.from(prompt, "utf8");
-	if (buf.byteLength <= PROMPT_PREVIEW_BYTES) return prompt;
-	let end = PROMPT_PREVIEW_BYTES;
-	while (end > 0 && (buf[end] & 192) === 128) end--;
-	return `${buf.subarray(0, end).toString("utf8")}…(truncated)`;
-}
-var CronListInputSchema, MS_PER_DAY, PROMPT_PREVIEW_BYTES, CronListTool;
-var init_cron_list = __esmMin((() => {
-	init_zod$1();
-	init_input_schema();
-	init_cron_expr();
-	init_time_format();
-	init_cron_list$1();
-	CronListInputSchema = object({}).strict();
-	MS_PER_DAY = 1440 * 60 * 1e3;
-	PROMPT_PREVIEW_BYTES = 200;
-	CronListTool = class {
-		manager;
-		name = "CronList";
-		description = cron_list_default;
-		parameters = toInputJsonSchema(CronListInputSchema);
-		constructor(manager) {
-			this.manager = manager;
-		}
-		resolveExecution(_args) {
-			return {
-				description: "Listing scheduled cron jobs",
-				approvalRule: this.name,
-				execute: async () => {
-					const tasks = this.manager.store.list();
-					const nowMs = this.manager.clocks.wallNow();
-					const records = tasks.map((t) => this.renderRecord(t, nowMs));
-					const header = `cron_jobs: ${String(tasks.length)}`;
-					if (records.length === 0) return {
-						output: `${header}\nNo cron jobs scheduled.`,
-						isError: false
-					};
-					return {
-						output: `${header}\n${records.join("\n---\n")}`,
-						isError: false
-					};
-				}
-			};
-		}
-		renderRecord(task, nowMs) {
-			const recurring = task.recurring !== false;
-			const ageMs = nowMs - task.createdAt;
-			const ageDays = Number.isFinite(ageMs) ? ageMs / MS_PER_DAY : 0;
-			const stale = this.manager.isStale(task);
-			let humanSchedule = task.cron;
-			let nextFireAtIso = "null";
-			try {
-				humanSchedule = cronToHuman(parseCronExpression(task.cron));
-				const nextFireMs = this.manager.getNextFireForTask(task.id);
-				if (nextFireMs !== null) nextFireAtIso = formatLocalIsoWithOffset(nextFireMs);
-			} catch {}
-			return [
-				`id: ${task.id}`,
-				`cron: ${task.cron}`,
-				`humanSchedule: ${humanSchedule}`,
-				`prompt: ${JSON.stringify(previewPrompt(task.prompt))}`,
-				`nextFireAt: ${nextFireAtIso}`,
-				`recurring: ${String(recurring)}`,
-				`ageDays: ${ageDays.toFixed(2)}`,
-				`stale: ${String(stale)}`
-			].join("\n");
-		}
-	};
-}));
-//#endregion
 //#region ../../packages/agent-core/src/agent/permission/policies/deny-all.ts
 var DenyAllPermissionPolicy;
 var init_deny_all = __esmMin((() => {
@@ -145119,6 +145042,38 @@ var init_summary_continuation = __esmMin((() => {
 }));
 //#endregion
 //#region ../../packages/agent-core/src/session/subagent-host.ts
+/**
+* Resolve the effective subagent per-task timeout. Precedence:
+* `KIMI_SUBAGENT_TIMEOUT_MS` (positive integer ms) → `configMs` →
+* `DEFAULT_SUBAGENT_TIMEOUT_MS` (30 min). Set a large value to effectively
+* disable the cap. The value feeds the background-task manager's per-task
+* timeout, so it governs foreground and background subagents (and AgentSwarm).
+*/
+function resolveSubagentTimeoutMs(configMs) {
+	const raw = process.env[SUBAGENT_TIMEOUT_ENV];
+	if (raw !== void 0 && raw.trim().length > 0) {
+		const parsed = Number(raw);
+		if (Number.isInteger(parsed) && parsed >= 1) return parsed;
+	}
+	if (configMs !== void 0 && Number.isInteger(configMs) && configMs >= 1) return configMs;
+	return DEFAULT_SUBAGENT_TIMEOUT_MS;
+}
+/** Human-readable duration for the subagent timeout message. */
+function formatSubagentTimeoutDescription(ms) {
+	if (ms % (3600 * 1e3) === 0) {
+		const h = ms / (3600 * 1e3);
+		return `${h} hour${h === 1 ? "" : "s"}`;
+	}
+	if (ms % (60 * 1e3) === 0) {
+		const m = ms / (60 * 1e3);
+		return `${m} minute${m === 1 ? "" : "s"}`;
+	}
+	if (ms % 1e3 === 0) {
+		const s = ms / 1e3;
+		return `${s} second${s === 1 ? "" : "s"}`;
+	}
+	return `${ms} ms`;
+}
 async function runChildTurnToCompletion(child, signal) {
 	const completion = await child.turn.waitForCurrentTurn(signal);
 	const turnEnded = completion.event;
@@ -145146,7 +145101,7 @@ function shouldSuppressQueuedAttemptFailureEvent(options, error) {
 	if (isProviderRateLimitError(error)) return true;
 	return isAbortError$3(error) || options.signal.aborted;
 }
-var DEFAULT_SUBAGENT_TIMEOUT_MS, DEFAULT_SUBAGENT_TIMEOUT_DESCRIPTION, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, SUBAGENT_MAX_TOKENS_ERROR, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
+var DEFAULT_SUBAGENT_TIMEOUT_MS, SUBAGENT_TIMEOUT_ENV, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, SUBAGENT_MAX_TOKENS_ERROR, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
 var init_subagent_host = __esmMin((() => {
 	init_src$4();
 	init_errors$8();
@@ -145158,8 +145113,8 @@ var init_subagent_host = __esmMin((() => {
 	init_git_context();
 	init_subagent_batch();
 	init_summary_continuation();
-	DEFAULT_SUBAGENT_TIMEOUT_MS = 1800 * 1e3;
-	DEFAULT_SUBAGENT_TIMEOUT_DESCRIPTION = "30 minutes";
+	DEFAULT_SUBAGENT_TIMEOUT_MS = 7200 * 1e3;
+	SUBAGENT_TIMEOUT_ENV = "KIMI_SUBAGENT_TIMEOUT_MS";
 	SUMMARY_MIN_LENGTH = 200;
 	SUMMARY_CONTINUATION_ATTEMPTS = 1;
 	HOOK_TEXT_PREVIEW_LENGTH = 500;
@@ -145463,6 +145418,479 @@ IMPORTANT:
 	};
 }));
 //#endregion
+//#region ../../packages/agent-core/src/agent/llm-request-logger.ts
+function splitGenerateOptions(options) {
+	if (options === void 0) return {
+		requestLogFields: void 0,
+		generateOptions: void 0
+	};
+	const { requestLogFields, ...generateOptions } = options;
+	return {
+		requestLogFields,
+		generateOptions
+	};
+}
+function toolSignature(tools) {
+	return tools.map(({ name, description, parameters }) => ({
+		name,
+		description,
+		parameters
+	}));
+}
+function fingerprint(content) {
+	return createHash("sha256").update(content).digest("hex");
+}
+var LlmRequestLogger;
+var init_llm_request_logger = __esmMin((() => {
+	LlmRequestLogger = class {
+		log;
+		lastConfigLogSignature;
+		constructor(log) {
+			this.log = log;
+		}
+		logRequest(input) {
+			const { provider, modelAlias, systemPrompt, tools, messages, fields } = input;
+			const requestLogFields = fields ?? {};
+			const wireTools = tools.filter((tool) => tool.deferred !== true);
+			const config = {
+				provider: provider.name,
+				model: provider.modelName,
+				modelAlias,
+				thinkingEffort: provider.thinkingEffort ?? void 0,
+				systemPromptChars: systemPrompt.length,
+				toolCount: wireTools.length
+			};
+			const signature = JSON.stringify({
+				...config,
+				systemPromptHash: fingerprint(systemPrompt),
+				toolsHash: fingerprint(JSON.stringify(toolSignature(wireTools)))
+			});
+			if (signature !== this.lastConfigLogSignature) {
+				this.lastConfigLogSignature = signature;
+				this.log.info("llm config", {
+					...requestLogFields,
+					...config
+				});
+			}
+			const partialMessageCount = messages.filter((message) => message.partial === true).length;
+			const requestFields = { ...requestLogFields };
+			if (partialMessageCount > 0) requestFields.partialMessageCount = partialMessageCount;
+			this.log.info("llm request", requestFields);
+		}
+	};
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/background/task-output.md?raw
+var task_output_default;
+var init_task_output$1 = __esmMin((() => {
+	task_output_default = "Retrieve output from a running or completed background task.\n\nUse this after `Bash(run_in_background=true)` or `Agent(run_in_background=true)` when you need to inspect progress or explicitly wait for completion.\n\nGuidelines:\n- Prefer relying on automatic completion notifications. Use this tool only when you need task output before the automatic notification arrives.\n- Do not use TaskOutput to wait for a result you need before continuing — if your next step depends on the task's result, run that task in the foreground instead. TaskOutput is for a deliberate progress check you will act on without blocking, not a way to sit and wait for a background task you just launched.\n- By default this tool is non-blocking and returns a current status/output snapshot.\n- Use block=true only when you intentionally want to wait for completion or timeout.\n- This tool returns structured task metadata, a fixed-size output preview, and an output_path for the full log.\n- For a terminal task, the metadata also explains why it ended. A shell command that runs to completion reports `status: completed` on a zero exit, or `status: failed` with its non-zero `exit_code` — judge that failure from the `exit_code`, because a plain command failure carries no `stop_reason` and no `terminal_reason`. `terminal_reason` is a categorical label emitted only when the end is not an ordinary exit: `timed_out` when the deadline aborted it, `stopped` when it was explicitly stopped, or `failed` when it errored without producing an exit code; the `stopped` and `failed` cases also carry a human-readable `stop_reason`. A task that finished on its own with a clean exit carries neither `stop_reason` nor `terminal_reason`.\n- The full, never-truncated log is always available at output_path; use the `Read` tool with that path to page through it, whether or not the preview was truncated.\n- This tool works with the generic background task system and should remain the primary read path for future task types, not just bash.\n";
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/background/task-output.ts
+function retrievalStatus(status, block) {
+	if (isBackgroundTaskTerminal(status)) return "success";
+	return block ? "timeout" : "not_ready";
+}
+function terminalReason(info) {
+	if (info.status === "timed_out") return "timed_out";
+	if (info.status === "killed" && info.stopReason !== void 0) return "stopped";
+	if (info.status === "failed" && info.stopReason !== void 0) return "failed";
+}
+function fullOutputHint(output) {
+	if (!output.fullOutputAvailable || output.outputPath === void 0) return void 0;
+	if (output.truncated) return `Only the last ${String(OUTPUT_PREVIEW_BYTES)} bytes are shown above. Use the Read tool with the output_path to page through the full log (parameters: path, line_offset, n_lines; read about ${String(PAGING_HINT_LINES)} lines per page).`;
+	return `The preview above is the complete output. Use the Read tool with the output_path if you need to re-read the full log later (parameters: path, line_offset, n_lines; read about ${String(PAGING_HINT_LINES)} lines per page).`;
+}
+var OUTPUT_PREVIEW_BYTES, PAGING_HINT_LINES, TaskOutputInputSchema, TaskOutputTool;
+var init_task_output = __esmMin((() => {
+	init_zod$1();
+	init_background();
+	init_input_schema();
+	init_rule_match();
+	init_format();
+	init_task_output$1();
+	OUTPUT_PREVIEW_BYTES = 32 * 1024;
+	PAGING_HINT_LINES = 300;
+	TaskOutputInputSchema = object({
+		task_id: string().describe("The background task ID to inspect."),
+		block: boolean$1().default(false).describe("Whether to wait for the task to finish before returning.").optional(),
+		timeout: number$1().int().min(0).max(3600).default(30).describe("Maximum number of seconds to wait when block=true.").optional()
+	});
+	TaskOutputTool = class {
+		manager;
+		name = "TaskOutput";
+		description = task_output_default;
+		parameters = toInputJsonSchema(TaskOutputInputSchema);
+		constructor(manager) {
+			this.manager = manager;
+		}
+		resolveExecution(args) {
+			return {
+				description: `Reading output of task ${args.task_id}`,
+				approvalRule: this.name,
+				matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.task_id),
+				execute: () => this.execute(args)
+			};
+		}
+		async execute(args) {
+			const info = this.manager.getTask(args.task_id);
+			if (!info) return {
+				isError: true,
+				output: `Task not found: ${args.task_id}`
+			};
+			if (args.block && !isBackgroundTaskTerminal(info.status)) await this.manager.wait(args.task_id, (args.timeout ?? 30) * 1e3);
+			const current = this.manager.getTask(args.task_id);
+			if (!current) return {
+				isError: true,
+				output: `Task not found: ${args.task_id}`
+			};
+			const output = await this.manager.getOutputSnapshot(args.task_id, OUTPUT_PREVIEW_BYTES);
+			const lines = [formatPlainObject({
+				retrievalStatus: retrievalStatus(current.status, args.block),
+				...current,
+				outputPath: output.outputPath,
+				terminalReason: terminalReason(current),
+				outputSizeBytes: output.outputSizeBytes,
+				outputPreviewBytes: output.previewBytes,
+				outputTruncated: output.truncated,
+				fullOutputAvailable: output.fullOutputAvailable,
+				fullOutputTool: output.fullOutputAvailable && output.outputPath !== void 0 ? "Read" : void 0,
+				fullOutputHint: fullOutputHint(output)
+			}), ""];
+			if (output.truncated) lines.push(output.fullOutputAvailable && output.outputPath !== void 0 ? `[Truncated. Full output: ${output.outputPath}]` : "[Truncated. No persisted full log is available for this task.]");
+			lines.push("[output]", output.preview || "[no output available]");
+			return {
+				output: lines.join("\n"),
+				isError: false,
+				message: "Task snapshot retrieved."
+			};
+		}
+	};
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/background/task-stop.md?raw
+var task_stop_default;
+var init_task_stop$1 = __esmMin((() => {
+	task_stop_default = "Stop a running background task.\n\nOnly use this when a task must genuinely be cancelled — for a task that is\nfinishing normally, wait for its completion notification or inspect it with\n`TaskOutput` instead of stopping it.\n\nGuidelines:\n- This is a general-purpose stop capability for any background task. It is not\n  a bash-specific kill.\n- Stopping a task is destructive: it may leave partial side effects behind.\n  Use it with care.\n- If the task has already finished, this tool simply returns its current\n  status.\n";
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/background/task-stop.ts
+function terminalStopReason(reason) {
+	const trimmed = reason?.trim();
+	return trimmed === void 0 || trimmed.length === 0 ? "Task already in terminal state" : trimmed;
+}
+var TaskStopInputSchema, TaskStopTool;
+var init_task_stop = __esmMin((() => {
+	init_zod$1();
+	init_background();
+	init_input_schema();
+	init_rule_match();
+	init_task_stop$1();
+	TaskStopInputSchema = object({
+		task_id: string().describe("The background task ID to stop."),
+		reason: string().default("Stopped by TaskStop").describe("Short reason recorded when the task is stopped.").optional()
+	});
+	TaskStopTool = class {
+		manager;
+		name = "TaskStop";
+		description = task_stop_default;
+		parameters = toInputJsonSchema(TaskStopInputSchema);
+		constructor(manager) {
+			this.manager = manager;
+		}
+		resolveExecution(args) {
+			return {
+				description: `Stopping task ${args.task_id}`,
+				approvalRule: this.name,
+				matchesRule: (ruleArgs) => matchesGlobRuleSubject(ruleArgs, args.task_id),
+				execute: async () => {
+					const info = this.manager.getTask(args.task_id);
+					if (!info) return {
+						isError: true,
+						output: `Task not found: ${args.task_id}`
+					};
+					const trimmedReason = args.reason?.trim();
+					const reason = trimmedReason === void 0 || trimmedReason.length === 0 ? "Stopped by TaskStop" : trimmedReason;
+					if (isBackgroundTaskTerminal(info.status)) return {
+						output: `task_id: ${info.taskId}\nstatus: ${info.status}\nreason: ${terminalStopReason(info.stopReason)}`,
+						isError: false
+					};
+					await this.manager.suppressTerminalNotification(args.task_id);
+					const result = await this.manager.stop(args.task_id, reason);
+					if (!result) return {
+						isError: true,
+						output: `Failed to stop task: ${args.task_id}`
+					};
+					return {
+						output: `task_id: ${result.taskId}\nstatus: ${result.status}\nreason: ${result.stopReason ?? reason}`,
+						isError: false
+					};
+				}
+			};
+		}
+	};
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/time-format.ts
+/**
+* Render cron-facing timestamps in local wall time with an explicit
+* numeric offset. Cron expressions are evaluated in local time, so the
+* tool output should preserve that mental model while remaining
+* unambiguous and parseable as ISO 8601.
+*/
+function formatLocalIsoWithOffset(ms) {
+	const date = new Date(ms);
+	const offsetMin = -date.getTimezoneOffset();
+	const sign = offsetMin >= 0 ? "+" : "-";
+	const absOffset = Math.abs(offsetMin);
+	const offset = `${sign}${pad(Math.floor(absOffset / 60))}:${pad(absOffset % 60)}`;
+	return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}.${String(date.getMilliseconds()).padStart(3, "0")}${offset}`;
+}
+function pad(n) {
+	return String(n).padStart(2, "0");
+}
+var init_time_format = __esmMin((() => {}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-create.md?raw
+var cron_create_default;
+var init_cron_create$1 = __esmMin((() => {
+	cron_create_default = "Schedule a prompt to be enqueued at a future time. Use for both recurring schedules and one-shot reminders.\n\nUses standard 5-field cron in the user's local timezone: minute hour day-of-month month day-of-week. `0 9 * * *` means 9am local — no timezone conversion needed.\n\n## One-shot tasks (recurring: false)\n\nFor \"remind me at X\" or \"at <time>, do Y\" requests — fire once then auto-delete.\nPin minute/hour/day-of-month/month to specific values:\n  \"remind me at 2:30pm today to check the deploy\" → cron: \"30 14 <today_dom> <today_month> *\", recurring: false\n  \"tomorrow morning, run the smoke test\" → cron: \"57 8 <tomorrow_dom> <tomorrow_month> *\", recurring: false\n\nOne-shots are best for near-term reminders. A task only fires while its session is still alive (see Session lifetime below), so favor near times — within hours or a few days — rather than scheduling weeks or months ahead.\n\n## Recurring jobs (recurring: true, the default)\n\nFor \"every N minutes\" / \"every hour\" / \"weekdays at 9am\" requests:\n  \"*/5 * * * *\" (every 5 min), \"0 * * * *\" (hourly), \"0 9 * * 1-5\" (weekdays at 9am local)\n\n## Avoid the :00 and :30 minute marks when the task allows it\n\nEvery user who asks for \"9am\" gets `0 9`, and every user who asks for \"hourly\" gets `0 *` — which means requests from across the planet land on the API at the same instant. When the user's request is approximate, pick a minute that is NOT 0 or 30:\n  \"every morning around 9\" → \"57 8 * * *\" or \"3 9 * * *\" (not \"0 9 * * *\")\n  \"hourly\" → \"7 * * * *\" (not \"0 * * * *\")\n  \"in an hour or so, remind me to...\" → pick whatever minute you land on, don't round\n\nOnly use minute 0 or 30 when the user names that exact time and clearly means it (\"at 9:00 sharp\", \"at half past\", coordinating with a meeting). When in doubt, nudge a few minutes early or late — the user will not notice, and the fleet will.\n\n## Coalesce semantics\n\nFires are delivered only while the session is idle: a fire that comes due during an active turn is held and delivered at the next idle moment, never injected mid-turn.\n\nIf the scheduler slept past multiple ideal fire times (laptop closed, long-running turn, etc.), only **one** fire is delivered when it wakes up. The origin carries `coalescedCount` showing how many ideal fires were collapsed into this single delivery. You should treat `coalescedCount > 1` as \"I missed some checks; only the latest state matters\" rather than running the prompt that many times.\n\n## Cron-fire envelope\n\nWhen a cron task fires, the prompt you scheduled is re-injected wrapped in an XML envelope that exposes the fire context:\n\n```\n<cron-fire jobId=\"...\" cron=\"...\" recurring=\"true|false\" coalescedCount=\"N\" stale=\"true|false\">\n<prompt>\nyour original prompt text, verbatim\n</prompt>\n</cron-fire>\n```\n\nThe envelope is parseable. Use `coalescedCount > 1` to know multiple ideal fires were collapsed into a single delivery (treat as \"only the latest state matters\"), and `stale=\"true\"` as a cue that the task is past its 7-day threshold.\n\n## 7-day stale behavior\n\nRecurring tasks that have been alive for more than 7 days fire one\nfinal time with `stale: true` on the envelope, and the system then\nauto-deletes the task. The flag is the model's notice that this is\nthe last delivery. If the schedule is still wanted, call `CronCreate`\nagain with the same `cron` and `prompt` — that resets `createdAt` and\nstarts a fresh 7-day window. One-shot tasks are never marked stale.\n\n## Jitter behavior\n\nAnti-herd jitter is applied deterministically per task id:\n  - Recurring: ideal fire time is shifted **forward** by an offset ≤ min(10% of the cron period, 15 minutes). A `*/5 * * * *` task can drift up to 30s; a `0 9 * * *` task can drift up to 15 minutes.\n  - One-shot: only when the ideal fire lands on `:00` or `:30` of the hour, the fire is pulled **earlier** by ≤ 90 seconds. Other minutes pass through unchanged.\n\n## One-shot vs recurring — when to pick which\n\nUse `recurring: false` for \"remind me at X\" style requests, single deadlines, \"in N minutes do Y\", and any task that should not repeat. Use `recurring: true` for periodic polling (CI status, build watchers, scheduled reports), workday rituals, and anything the user explicitly described as recurring.\n\n## Session lifetime\n\nCron tasks live in the current kimi CLI session. When you exit, they\nare persisted under the session homedir; the next `kimi resume` of the\nsame session reloads them and the scheduler resumes from each task's\n`createdAt`. Fire times that fell during the offline window are\ncollapsed into a single delivery via `coalescedCount` (and recurring\ntasks past their 7-day window arrive with `stale: true` as their final\ndelivery).\n\nTasks do **not** carry over into a brand-new session — they are scoped\nto the resumed session id, not to the working directory.\n\n## Limits\n\nA session holds at most 50 live cron tasks; creating one beyond that is rejected. (The `prompt` body is also capped — see its parameter description.) Expressions that never fire within the next 5 years (e.g. `0 0 31 2 *`, an impossible date) are rejected at create time.\n\n## Returned fields\n\n`id` (8-hex), `cron` (the normalized expression), `humanSchedule` (English summary), `recurring`,\n`nextFireAt` (local ISO timestamp with numeric offset, or null). `id` is needed by `CronDelete`.\n\n## Tell the user how to cancel or modify\n\nAfter successfully creating a task, proactively tell the user how they can cancel or modify it later. Users have no direct `/cron` command or self-service UI to manage reminders themselves; they must ask the model to make changes (e.g. \"cancel my 9am reminder\" or \"change my daily check to 10am\"). Include the task `id` in your message so the user can reference it.\n";
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-create.ts
+function formatOutput(o) {
+	return [
+		`id: ${o.id}`,
+		`cron: ${o.cron}`,
+		`humanSchedule: ${o.humanSchedule}`,
+		`recurring: ${String(o.recurring)}`,
+		`nextFireAt: ${o.nextFireAt === null ? "null" : formatLocalIsoWithOffset(o.nextFireAt)}`
+	].join("\n");
+}
+var MAX_PROMPT_BYTES, ONE_SHOT_MAX_FUTURE_MS, CronCreateInputSchema, CronCreateTool;
+var init_cron_create = __esmMin((() => {
+	init_zod$1();
+	init_input_schema();
+	init_rule_match();
+	init_cron_expr();
+	init_jitter();
+	init_time_format();
+	init_cron_create$1();
+	MAX_PROMPT_BYTES = 8 * 1024;
+	ONE_SHOT_MAX_FUTURE_MS = 350 * 24 * 60 * 60 * 1e3;
+	CronCreateInputSchema = object({
+		cron: string().describe("5-field cron expression in local time: \"M H DoM Mon DoW\" (e.g. \"*/5 * * * *\" = every 5 minutes; \"30 14 28 2 *\" = Feb 28 at 2:30pm local — a pinned date like this repeats yearly unless you also pass recurring: false)."),
+		prompt: string().min(1).max(MAX_PROMPT_BYTES).describe("The prompt to enqueue at each fire time. Limited to 8 KiB (UTF-8)."),
+		recurring: boolean$1().optional().default(true).describe("true (default) = fire on every cron match until deleted or auto-expired after 7 days. false = fire once at the next match, then auto-delete. Use false for \"remind me at X\" one-shot requests with pinned minute/hour/dom/month.")
+	});
+	CronCreateTool = class {
+		manager;
+		name = "CronCreate";
+		description = cron_create_default;
+		parameters = toInputJsonSchema(CronCreateInputSchema);
+		constructor(manager) {
+			this.manager = manager;
+		}
+		resolveExecution(args) {
+			if (process.env["KIMI_DISABLE_CRON"] === "1") return {
+				isError: true,
+				output: "Cron scheduling is disabled (KIMI_DISABLE_CRON=1)."
+			};
+			const normalizedCron = args.cron.trim().split(/\s+/).join(" ");
+			let parsed;
+			try {
+				parsed = parseCronExpression(normalizedCron);
+			} catch (err) {
+				return {
+					isError: true,
+					output: `Invalid cron expression: ${err instanceof Error ? err.message : String(err)}`
+				};
+			}
+			const nowAtPrepare = this.manager.clocks.wallNow();
+			if (!hasFireWithinYears(parsed, 5, nowAtPrepare)) return {
+				isError: true,
+				output: `Cron expression ${JSON.stringify(normalizedCron)} has no fire within 5 years; refusing to schedule.`
+			};
+			if (this.manager.store.list().length >= 50) return {
+				isError: true,
+				output: `Cron job cap reached (max ${String(50)} per session).`
+			};
+			const byteLen = Buffer.byteLength(args.prompt, "utf8");
+			if (byteLen > MAX_PROMPT_BYTES) return {
+				isError: true,
+				output: `Prompt exceeds ${String(MAX_PROMPT_BYTES)} bytes (got ${String(byteLen)}).`
+			};
+			const recurring = args.recurring !== false;
+			if (!recurring) {
+				const firstFire = computeNextCronRun(parsed, nowAtPrepare);
+				if (firstFire !== null && firstFire - nowAtPrepare > ONE_SHOT_MAX_FUTURE_MS) return {
+					isError: true,
+					output: `One-shot cron ${JSON.stringify(normalizedCron)} would not fire until ${formatLocalIsoWithOffset(firstFire)} (more than a year out). If you meant "today" or a near date, the pinned day/month has already passed this year — pick a future date or use wildcards.`
+				};
+			}
+			return {
+				description: recurring ? `Scheduling cron ${normalizedCron}` : `Scheduling one-shot ${normalizedCron}`,
+				approvalRule: literalRulePattern(this.name, JSON.stringify({
+					cron: normalizedCron,
+					prompt: args.prompt,
+					recurring
+				})),
+				execute: async () => {
+					const nowMs = this.manager.clocks.wallNow();
+					if (this.manager.store.list().length >= 50) return {
+						isError: true,
+						output: `Cron job cap reached (max ${String(50)} per session).`
+					};
+					const task = this.manager.addTask({
+						cron: normalizedCron,
+						prompt: args.prompt,
+						recurring
+					});
+					const ideal = computeNextCronRun(parsed, nowMs);
+					const nextFireAt = ideal === null ? null : recurring ? jitteredNextCronRunMs(task, parsed, ideal) : oneShotJitteredNextCronRunMs(task, ideal);
+					const humanSchedule = cronToHuman(parsed);
+					this.manager.emitScheduled(task);
+					return {
+						output: formatOutput({
+							id: task.id,
+							cron: normalizedCron,
+							humanSchedule,
+							recurring,
+							nextFireAt
+						}),
+						isError: false,
+						message: `Scheduled cron ${task.id}`
+					};
+				}
+			};
+		}
+	};
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-delete.md?raw
+var cron_delete_default;
+var init_cron_delete$1 = __esmMin((() => {
+	cron_delete_default = "Cancel a scheduled cron job by id.\n\nUse this tool to remove a cron task previously scheduled with\n`CronCreate`. The `id` is the 8-hex value returned by `CronCreate`, or\nshown in the `id:` column of `CronList` — quote it verbatim, no\nprefix.\n\nBehaviour by task kind:\n\n- **Recurring task** (`recurring: true`): stops all future fires\n  immediately. The scheduler picks up the deletion on its next tick.\n- **One-shot task** (`recurring: false`): cancels the pending fire if\n  it has not happened yet. One-shots that have already fired\n  auto-delete themselves, so calling `CronDelete` on a fired one-shot\n  returns \"no cron job with id ...\".\n\nNot-found is reported as an error (not a silent no-op) so you can\ncorrect yourself — typically by calling `CronList` to see which ids\nare actually live, rather than re-trying with the same stale id.\n\nRefresh pattern (use when you want a stale recurring schedule to\ncontinue):\n\nStale recurring tasks are auto-deleted by the system after their final\nfire — there is nothing for `CronDelete` to remove at that point. To\nkeep the schedule running, just call `CronCreate` with the same `cron`\nand `prompt`. Use `CronList`'s `prompt` field to recall the original\ntext after a context compaction.\n\n`CronDelete` remains the right call when you want to cancel a task\nthat is still live (recurring not yet stale, or a one-shot still\npending).\n\nGuidelines:\n\n- Users have no direct `/cron` command or self-service UI to delete\n  tasks themselves; they must ask the model to cancel a reminder.\n  When deleting on behalf of a user, confirm the action and report\n  the result plainly.\n- Cron deletion is irreversible — there is no undo. If you delete the\n  wrong task, you must re-create it with `CronCreate`.\n- If the model is unsure which id is current (e.g. after a context\n  compaction), call `CronList` first rather than guessing.\n";
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-delete.ts
+var ID_PATTERN, CronDeleteInputSchema, CronDeleteTool;
+var init_cron_delete = __esmMin((() => {
+	init_zod$1();
+	init_input_schema();
+	init_cron_delete$1();
+	ID_PATTERN = /^[0-9a-f]{8}$/;
+	CronDeleteInputSchema = object({ id: string().describe("The 8-hex cron job id returned by CronCreate / CronList.") });
+	CronDeleteTool = class {
+		manager;
+		name = "CronDelete";
+		description = cron_delete_default;
+		parameters = toInputJsonSchema(CronDeleteInputSchema);
+		constructor(manager) {
+			this.manager = manager;
+		}
+		resolveExecution(args) {
+			if (!ID_PATTERN.test(args.id)) return {
+				isError: true,
+				output: `Invalid cron job id ${JSON.stringify(args.id)} — must be 8 lowercase hex characters.`
+			};
+			return {
+				description: `Deleting cron ${args.id}`,
+				approvalRule: this.name,
+				execute: async () => {
+					if (this.manager.removeTasks([args.id]).length === 0) return {
+						isError: true,
+						output: `No cron job with id ${args.id}.`
+					};
+					this.manager.emitDeleted(args.id);
+					return {
+						output: `Deleted cron job ${args.id}.`,
+						isError: false
+					};
+				}
+			};
+		}
+	};
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-list.md?raw
+var cron_list_default;
+var init_cron_list$1 = __esmMin((() => {
+	cron_list_default = "List all cron jobs currently scheduled in this session.\n\nUse this tool to see every pending cron task — both recurring jobs and\none-shot reminders — that you (or the user) have scheduled with\n`CronCreate`. The output is the entry point for inspecting scheduled\nwork: it returns a stable id, the original cron expression, a human\nrendering, the next post-jitter fire time, the recurring flag, the\ntask's age in days, and a stale indicator.\n\nEach record carries:\n\n- `id` — the 8-hex task id. Pass this to `CronDelete` to remove the\n  task, or quote it in user-facing messages when asking for\n  confirmation.\n- `cron` — the verbatim 5-field cron expression as scheduled.\n- `humanSchedule` — plain-English rendering (e.g. `every 5 minutes`).\n- `prompt` — the scheduled prompt text, JSON-encoded so embedded\n  newlines stay on one line. Truncated to 200 UTF-8 bytes with\n  `…(truncated)` if longer. Use this to recall what a task is for\n  after a context compaction, and as the source for the\n  `CronCreate` refresh ritual.\n- `nextFireAt` — local ISO timestamp with an explicit numeric offset\n  for the next fire **after jitter has been applied**. The actual fire\n  may land slightly before or after a round `:00` / `:30` minute mark\n  due to herd-avoidance jitter; this is the value the scheduler will\n  compare against, so it reflects what will really happen. `null` if\n  the expression has no fire in the next 5 years (should not happen\n  for tasks created through `CronCreate`, which validates).\n- `recurring` — `true` for cadenced jobs, `false` for one-shots.\n- `ageDays` — `(now - createdAt) / day`, two decimal places. Useful\n  when deciding whether a long-running cron is still relevant.\n- `stale` — `true` when a recurring task is older than 7 days. The\n  system **auto-deletes the task after this fire** to bound session\n  lifetime; the `stale: true` flag is the model's notice that this is\n  the final delivery. To resume the same schedule, call `CronCreate`\n  again with the original `cron` and `prompt` (the `prompt` row above\n  carries it for exactly this purpose). One-shots are never marked\n  stale — they fire at most once by construction.\n\nGuidelines:\n\n- This tool is read-only and never mutates state, so it is always\n  safe to call (including in plan mode).\n- Users cannot directly manage cron tasks themselves; if they want to\n  cancel or modify a schedule, route the request through the model\n  (i.e. call `CronDelete` or `CronCreate` on their behalf).\n- The empty case returns `cron_jobs: 0\\nNo cron jobs scheduled.`. Cron\n  tasks survive a `kimi resume` of the same session but do not bleed\n  into new sessions.\n- After a context compaction, or whenever you are unsure which cron\n  jobs are live, call this tool to re-enumerate them rather than\n  guessing ids from earlier in the conversation.\n- Records are separated by a line containing just `---`, in the\n  insertion order they were scheduled.\n";
+}));
+//#endregion
+//#region ../../packages/agent-core/src/tools/cron/cron-list.ts
+function previewPrompt(prompt) {
+	const buf = Buffer.from(prompt, "utf8");
+	if (buf.byteLength <= PROMPT_PREVIEW_BYTES) return prompt;
+	let end = PROMPT_PREVIEW_BYTES;
+	while (end > 0 && (buf[end] & 192) === 128) end--;
+	return `${buf.subarray(0, end).toString("utf8")}…(truncated)`;
+}
+var CronListInputSchema, MS_PER_DAY, PROMPT_PREVIEW_BYTES, CronListTool;
+var init_cron_list = __esmMin((() => {
+	init_zod$1();
+	init_input_schema();
+	init_cron_expr();
+	init_time_format();
+	init_cron_list$1();
+	CronListInputSchema = object({}).strict();
+	MS_PER_DAY = 1440 * 60 * 1e3;
+	PROMPT_PREVIEW_BYTES = 200;
+	CronListTool = class {
+		manager;
+		name = "CronList";
+		description = cron_list_default;
+		parameters = toInputJsonSchema(CronListInputSchema);
+		constructor(manager) {
+			this.manager = manager;
+		}
+		resolveExecution(_args) {
+			return {
+				description: "Listing scheduled cron jobs",
+				approvalRule: this.name,
+				execute: async () => {
+					const tasks = this.manager.store.list();
+					const nowMs = this.manager.clocks.wallNow();
+					const records = tasks.map((t) => this.renderRecord(t, nowMs));
+					const header = `cron_jobs: ${String(tasks.length)}`;
+					if (records.length === 0) return {
+						output: `${header}\nNo cron jobs scheduled.`,
+						isError: false
+					};
+					return {
+						output: `${header}\n${records.join("\n---\n")}`,
+						isError: false
+					};
+				}
+			};
+		}
+		renderRecord(task, nowMs) {
+			const recurring = task.recurring !== false;
+			const ageMs = nowMs - task.createdAt;
+			const ageDays = Number.isFinite(ageMs) ? ageMs / MS_PER_DAY : 0;
+			const stale = this.manager.isStale(task);
+			let humanSchedule = task.cron;
+			let nextFireAtIso = "null";
+			try {
+				humanSchedule = cronToHuman(parseCronExpression(task.cron));
+				const nextFireMs = this.manager.getNextFireForTask(task.id);
+				if (nextFireMs !== null) nextFireAtIso = formatLocalIsoWithOffset(nextFireMs);
+			} catch {}
+			return [
+				`id: ${task.id}`,
+				`cron: ${task.cron}`,
+				`humanSchedule: ${humanSchedule}`,
+				`prompt: ${JSON.stringify(previewPrompt(task.prompt))}`,
+				`nextFireAt: ${nextFireAtIso}`,
+				`recurring: ${String(recurring)}`,
+				`ageDays: ${ageDays.toFixed(2)}`,
+				`stale: ${String(stale)}`
+			].join("\n");
+		}
+	};
+}));
+//#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/agent-background-disabled.md?raw
 var agent_background_disabled_default;
 var init_agent_background_disabled = __esmMin((() => {
@@ -145580,6 +146008,7 @@ var init_agent$1 = __esmMin((() => {
 			this.backgroundManager = backgroundManager;
 			const log = options?.log;
 			this.allowBackground = options?.allowBackground ?? true;
+			this.subagentTimeoutMs = options?.subagentTimeoutMs;
 			const typeLines = buildSubagentDescriptions(subagents);
 			const baseDescription = `${agent_default}\n\n${this.allowBackground ? agent_background_enabled_default : agent_background_disabled_default}`;
 			this.description = typeLines ? `${baseDescription}\n\nAvailable agent types (pass via subagent_type):\n${typeLines}` : baseDescription;
@@ -145587,6 +146016,7 @@ var init_agent$1 = __esmMin((() => {
 		}
 		log;
 		allowBackground;
+		subagentTimeoutMs;
 		async resolveExecution(args) {
 			let profileName = args.subagent_type?.length ? args.subagent_type : "coder";
 			const resumeAgentId = args.resume?.trim();
@@ -145654,7 +146084,7 @@ var init_agent$1 = __esmMin((() => {
 				try {
 					taskId = this.backgroundManager.registerTask(new AgentBackgroundTask(handle, args.description, this.subagentHost, controller), {
 						detached: runInBackground,
-						timeoutMs: DEFAULT_SUBAGENT_TIMEOUT_MS,
+						timeoutMs: this.subagentTimeoutMs ?? 72e5,
 						signal: runInBackground ? void 0 : signal
 					});
 					signal.removeEventListener("abort", abortBeforeRegister);
@@ -145688,7 +146118,7 @@ var init_agent$1 = __esmMin((() => {
 			if (info?.status === "completed") return { output: formatForegroundAgentSuccess(handle, await this.backgroundManager.readOutput(taskId)) };
 			const timedOut = info?.status === "timed_out";
 			return {
-				output: formatForegroundAgentFailure(handle, timedOut ? `Agent timed out after ${DEFAULT_SUBAGENT_TIMEOUT_DESCRIPTION}.` : info?.stopReason === "Interrupted by user" ? USER_INTERRUPTED_SUBAGENT_MESSAGE : info?.stopReason !== void 0 ? info.stopReason : "The subagent was stopped before it finished.", timedOut),
+				output: formatForegroundAgentFailure(handle, timedOut ? `Agent timed out after ${formatSubagentTimeoutDescription(this.subagentTimeoutMs ?? 72e5)}.` : info?.stopReason === "Interrupted by user" ? USER_INTERRUPTED_SUBAGENT_MESSAGE : info?.stopReason !== void 0 ? info.stopReason : "The subagent was stopped before it finished.", timedOut),
 				isError: true
 			};
 		}
@@ -145802,12 +146232,14 @@ var init_agent_swarm = __esmMin((() => {
 	AgentSwarmTool = class {
 		subagentHost;
 		swarmMode;
+		subagentTimeoutMs;
 		name = "AgentSwarm";
 		description = agent_swarm_default;
 		parameters = toInputJsonSchema(AgentSwarmToolInputSchema);
-		constructor(subagentHost, swarmMode) {
+		constructor(subagentHost, swarmMode, subagentTimeoutMs) {
 			this.subagentHost = subagentHost;
 			this.swarmMode = swarmMode;
+			this.subagentTimeoutMs = subagentTimeoutMs;
 		}
 		resolveExecution(args) {
 			const agentCount = (args.items?.length ?? 0) + Object.keys(args.resume_agent_ids ?? {}).length;
@@ -145848,7 +146280,7 @@ var init_agent_swarm = __esmMin((() => {
 					runInBackground: false,
 					swarmItem: spec.item,
 					signal,
-					timeout: DEFAULT_SUBAGENT_TIMEOUT_MS
+					timeout: this.subagentTimeoutMs ?? 72e5
 				};
 				if (spec.kind === "resume") return {
 					...common,
@@ -145871,7 +146303,7 @@ var init_agent_swarm = __esmMin((() => {
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/ask-user.md?raw
 var ask_user_default;
 var init_ask_user$1 = __esmMin((() => {
-	ask_user_default = "Use this tool when you need to ask the user questions with structured options during execution. This allows you to:\n1. Collect user preferences or requirements before proceeding\n2. Resolve ambiguous or underspecified instructions\n3. Let the user decide between implementation approaches as you work\n4. Present concrete options when multiple valid directions exist\n\n**When NOT to use:**\n- When you can infer the answer from context — be decisive and proceed\n- Trivial decisions that don't materially affect the outcome\n\nOverusing this tool interrupts the user's flow. Only use it when the user's input genuinely changes your next action.\n\n**Usage notes:**\n- Users always have an \"Other\" option for custom input — don't create one yourself\n- Use multi_select to allow multiple answers to be selected for a question\n- Keep option labels concise (1-5 words), use descriptions for trade-offs and details\n- Each question should have 2-4 meaningful, distinct options\n- Question texts must be unique across the call, and option labels must be unique within each question\n- You can ask 1-4 questions at a time; group related questions to minimize interruptions\n- If you recommend a specific option, list it first and append \"(Recommended)\" to its label\n- The result is JSON with an `answers` object keyed by question text; each value is the chosen option's label (comma-separated labels for multi_select, or the user's own words if they picked \"Other\"); if `answers` is empty and a `note` says the user dismissed it, they declined to answer — proceed with your best judgment and do not re-ask the same question\n";
+	ask_user_default = "Use this tool when you need to ask the user questions with structured options during execution. This allows you to:\n1. Collect user preferences or requirements before proceeding\n2. Resolve ambiguous or underspecified instructions\n3. Let the user decide between implementation approaches as you work\n4. Present concrete options when multiple valid directions exist\n\n**When NOT to use:**\n- When you can infer the answer from context — be decisive and proceed\n- Trivial decisions that don't materially affect the outcome\n\nOverusing this tool interrupts the user's flow. Only use it when the user's input genuinely changes your next action.\n\n**Usage notes:**\n- Users always have an \"Other\" option for custom input — don't create one yourself\n- Use multi_select to allow multiple answers to be selected for a question\n- Keep option labels concise (1-5 words), use descriptions for trade-offs and details\n- Each question should have 2-4 meaningful, distinct options\n- Question texts must be unique across the call, and option labels must be unique within each question\n- You can ask 1-4 questions at a time; group related questions to minimize interruptions\n- If you recommend a specific option, list it first and append \"(Recommended)\" to its label\n- The result is JSON with an `answers` object keyed by question text; each value is the chosen option's label (comma-separated labels for multi_select, or the user's own words if they picked \"Other\"); if `answers` is empty and a `note` says the user dismissed it, they chose not to answer — do not treat this as selecting the recommended option; decide based on context and do not re-ask the same question\n";
 }));
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/collaboration/ask-user.ts
@@ -152113,25 +152545,6 @@ function buildMediaNote(input) {
 	parts.push("If you generate or edit images or videos via commands or scripts, read the result back immediately before continuing.");
 	return `<system>${parts.join(" ")}</system>`;
 }
-/**
-* Refusal message for HEIC/HEIF with a conversion command matching the
-* execution environment (`kaos.osEnv.osKind` — where Bash actually runs, so
-* SSH/container sessions get the right command too). macOS converts with the
-* built-in `sips`; Linux and Windows have no built-in HEIC decoder, so the
-* guidance names the common tools and how to get them.
-*/
-function buildHeicConversionGuidance(path, mimeType, osKind) {
-	const converted = path.replace(/\.[^./\\]+$/, "") + ".jpg";
-	return `"${path}" is a ${mimeType} image, which the provider does not accept. Convert it to JPEG first, then read the converted file. ` + heicConversionCommand(path, converted, osKind);
-}
-function heicConversionCommand(path, converted, osKind) {
-	switch (osKind) {
-		case "macOS": return `On macOS: sips -s format jpeg "${path}" --out "${converted}"`;
-		case "Linux": return `On Linux: heif-convert "${path}" "${converted}" (package libheif-examples), or with ImageMagick: magick "${path}" "${converted}"`;
-		case "Windows": return `On Windows, with ImageMagick: magick "${path}" "${converted}" (install it first if missing: winget install ImageMagick.ImageMagick)`;
-		default: return `Options: sips -s format jpeg "${path}" --out "${converted}" (macOS), heif-convert "${path}" "${converted}" (Linux, package libheif-examples), or magick "${path}" "${converted}" (ImageMagick)`;
-	}
-}
 var MAX_MEDIA_MEGABYTES, MAX_MEDIA_BYTES, ReadMediaFileInputSchema, ReadMediaFileTool;
 var init_read_media = __esmMin((() => {
 	init_zod$1();
@@ -152140,6 +152553,7 @@ var init_read_media = __esmMin((() => {
 	init_path_access();
 	init_file_type$1();
 	init_image_compress();
+	init_image_format_policy();
 	init_image_limits();
 	init_input_schema();
 	init_rule_match();
@@ -152225,9 +152639,9 @@ var init_read_media = __esmMin((() => {
 					isError: true,
 					output: "The current model does not support image input. Tell the user to use a model with image input capability."
 				};
-				if (fileType.mimeType === "image/heic" || fileType.mimeType === "image/heif") return {
+				if (fileType.kind === "image" && !isModelAcceptedImageMime(fileType.mimeType)) return {
 					isError: true,
-					output: buildHeicConversionGuidance(args.path, fileType.mimeType, this.kaos.osEnv.osKind)
+					output: buildImageConversionGuidance(args.path, fileType.mimeType, this.kaos.osEnv.osKind)
 				};
 				if (fileType.kind === "video" && !this.capabilities.video_in) return {
 					isError: true,
@@ -153599,6 +154013,7 @@ var init_tool$1 = __esmMin((() => {
 	init_output();
 	init_tool_naming();
 	init_profile();
+	init_subagent_host();
 	init_skill$4();
 	init_llm_request_logger();
 	init_builtin();
@@ -154155,9 +154570,10 @@ var init_tool$1 = __esmMin((() => {
 				this.agent.skills?.registry.listInvocableSkills().length && new SkillTool(this.agent),
 				this.agent.subagentHost && new AgentTool(this.agent.subagentHost, background, DEFAULT_AGENT_PROFILES["agent"]?.subagents, {
 					allowBackground,
-					log: this.agent.log
+					log: this.agent.log,
+					subagentTimeoutMs: resolveSubagentTimeoutMs(this.agent.kimiConfig?.subagent?.timeoutMs)
 				}),
-				this.agent.subagentHost && new AgentSwarmTool(this.agent.subagentHost, this.agent.swarmMode),
+				this.agent.subagentHost && new AgentSwarmTool(this.agent.subagentHost, this.agent.swarmMode, resolveSubagentTimeoutMs(this.agent.kimiConfig?.subagent?.timeoutMs)),
 				toolServices?.webSearcher && new WebSearchTool(toolServices.webSearcher),
 				toolServices?.urlFetcher && new FetchURLTool(toolServices.urlFetcher)
 			].filter((tool) => !!tool).map((tool) => [tool.name, tool]));
@@ -154723,6 +155139,7 @@ var init_turn = __esmMin((() => {
 	init_errors$8();
 	init_errors$4();
 	init_loop();
+	init_image_compress();
 	init_abort();
 	init_context$2();
 	init_hooks();
@@ -154792,27 +155209,29 @@ var init_turn = __esmMin((() => {
 			return this.agent.homedir ? basename$2(this.agent.homedir) : this.agent.type;
 		}
 		prompt(input, origin = USER_PROMPT_ORIGIN) {
+			const gated = gateImageFormatParts(input);
 			this.agent.records.logRecord({
 				type: "turn.prompt",
-				input,
+				input: gated,
 				origin
 			});
-			return this.launch(input, origin);
+			return this.launch(gated, origin);
 		}
 		steer(input, origin = USER_PROMPT_ORIGIN) {
+			const gated = gateImageFormatParts(input);
 			this.agent.records.logRecord({
 				type: "turn.steer",
-				input,
+				input: gated,
 				origin
 			});
 			if (this.activeTurn || this.agent.fullCompaction.isCompacting) {
 				this.steerBuffer.push({
-					input,
+					input: gated,
 					origin
 				});
 				return null;
 			}
-			return this.launch(input, origin);
+			return this.launch(gated, origin);
 		}
 		retry(trigger) {
 			return this.prompt([], {
@@ -155245,6 +155664,7 @@ var init_turn = __esmMin((() => {
 						buildMessages: () => this.agent.context.messages,
 						buildMessagesStrict: () => this.agent.context.strictMessages,
 						buildMessagesMediaDegraded: () => this.agent.context.mediaDegradedMessages,
+						buildMessagesMediaStripped: () => this.agent.context.mediaStrippedMessages,
 						dispatchEvent: this.buildDispatchEvent(turnId),
 						buildTools: () => this.agent.tools.loopTools,
 						describeMissingTool: (name) => this.agent.tools.missingToolMessage(name),
@@ -156018,17 +156438,18 @@ var init_agent = __esmMin((() => {
 		}
 		/**
 		* Single decision point for select_tools progressive disclosure. All three
-		* gates must be open: the model declares the `select_tools` capability, the
-		* model declares `tool_use` (a model without tool use registering
-		* select_tools is a contradiction), and the `tool-select` experimental flag
-		* is on. Every consumer — top-level tools[] convergence, select_tools
-		* registration, manifest announcements, projection shaping — reads this
-		* instead of re-deriving the conditions, so degradation is lossless: any
-		* closed gate reproduces the inline behavior byte-for-byte.
+		* gates must be open: the model has the `dynamically_loaded_tools`
+		* capability (message-level tool declarations), the model declares
+		* `tool_use` (a model without tool use loading tools dynamically is a
+		* contradiction), and the `tool-select` experimental flag is on. Every
+		* consumer — top-level tools[] convergence, select_tools registration,
+		* manifest announcements, projection shaping — reads this instead of
+		* re-deriving the conditions, so degradation is lossless: any closed gate
+		* reproduces the inline behavior byte-for-byte.
 		*/
 		get toolSelectEnabled() {
 			const capability = this.config.modelCapabilities;
-			return capability.select_tools === true && capability.tool_use && this.experimentalFlags.enabled("tool-select");
+			return capability.dynamically_loaded_tools === true && capability.tool_use && this.experimentalFlags.enabled("tool-select");
 		}
 		get generate() {
 			return async (provider, systemPrompt, tools, history, callbacks, options) => {
@@ -156260,6 +156681,7 @@ var init_agent = __esmMin((() => {
 				pauseGoal: () => this.goal.pauseGoal(),
 				resumeGoal: () => this.goal.resumeGoal(),
 				cancelGoal: () => this.goal.cancelGoal(),
+				getCronTasks: () => ({ tasks: this.cron?.listTaskSnapshots() ?? [] }),
 				getBackgroundOutput: (payload) => this.background.readOutput(payload.taskId, payload.tail),
 				getContext: () => this.context.data(),
 				getConfig: () => this.config.data(),
@@ -187111,6 +187533,8 @@ var init_session$1 = __esmMin((() => {
 		};
 		writeMetadataPromise = Promise.resolve();
 		agentsMdWarning;
+		printSteerDeadline;
+		printSteerTurns = 0;
 		constructor(options) {
 			this.options = options;
 			this.logHandle = options.id === void 0 ? void 0 : getRootLogger().attachSession({
@@ -187297,23 +187721,18 @@ var init_session$1 = __esmMin((() => {
 		* Wait for all still-running background tasks (across every agent) to reach a
 		* terminal state before a `kimi -p` (print) run exits.
 		*
-		* Gated by `background.keep_alive_on_exit`: when it is not `true`, this returns
-		* immediately so print mode keeps its default single-turn semantics. The wait is
-		* bounded by `background.print_wait_ceiling_s` (default 3600s) so a wedged task
-		* cannot keep the process alive forever.
+		* Only runs when the resolved print background mode is `'drain'` (see
+		* `resolvePrintBackgroundMode`): `print_background_mode = "drain"`, or the
+		* legacy `keep_alive_on_exit = true` fallback. In every other mode it returns
+		* immediately. The wait is bounded by `background.print_wait_ceiling_s`
+		* (default 3600s) so a wedged task cannot keep the process alive forever.
 		*
 		* Terminal notifications are suppressed for each task while we wait, so a task
 		* completing cannot `turn.steer` the (already finished) main agent into launching
-		* a new turn.
+		* a new turn. (This is exactly what `'steer'` mode avoids by never calling here.)
 		*/
 		async waitForBackgroundTasksOnPrint() {
-			if (!resolveConfigValue({
-				env: process.env,
-				envKey: BACKGROUND_KEEP_ALIVE_ON_EXIT_ENV,
-				configValue: this.options.background?.keepAliveOnExit,
-				defaultValue: false,
-				parseEnv: parseBooleanEnv
-			})) return;
+			if (this.resolvePrintBackgroundMode() !== "drain") return;
 			const timeoutMs = (this.options.background?.printWaitCeilingS ?? 3600) * 1e3;
 			const deadline = Date.now() + timeoutMs;
 			const seen = /* @__PURE__ */ new Set();
@@ -187349,6 +187768,67 @@ var init_session$1 = __esmMin((() => {
 				});
 			}
 		}
+		/**
+		* Resolve the effective print-mode (`kimi -p`) background-task policy.
+		*
+		* `background.print_background_mode` is authoritative when set. Otherwise we
+		* fall back to the legacy `background.keep_alive_on_exit` mapping so existing
+		* configs keep their behavior: `keep_alive_on_exit = true` ⇒ `'drain'`
+		* (suppress + drain background tasks before exit), otherwise `'exit'`.
+		*/
+		resolvePrintBackgroundMode() {
+			const configured = this.options.background?.printBackgroundMode;
+			if (configured !== void 0) return configured;
+			return resolveConfigValue({
+				env: process.env,
+				envKey: BACKGROUND_KEEP_ALIVE_ON_EXIT_ENV,
+				configValue: this.options.background?.keepAliveOnExit,
+				defaultValue: false,
+				parseEnv: parseBooleanEnv
+			}) ? "drain" : "exit";
+		}
+		countActiveBackgroundTasks() {
+			let count = 0;
+			for (const agent of this.readyAgents()) count += agent.background.list(true).length;
+			return count;
+		}
+		/**
+		* Decide what the `kimi -p` driver should do after the main agent's turn ends
+		* with `reason === 'completed'`. Returns `'finish'` when the run may exit, or
+		* `'continue'` when the driver must stay alive so a background-task completion
+		* can `turn.steer` the main agent into a new turn.
+		*
+		*  - 'exit'  : finish immediately (default).
+		*  - 'drain' : suppress + drain background tasks, then finish (legacy
+		*              `keep_alive_on_exit = true` behavior).
+		*  - 'steer' : while background tasks are still pending, return 'continue' so
+		*              completions steer new main turns; finish once quiescent, or when
+		*              the wall-clock ceiling (`print_wait_ceiling_s`) or the turn cap
+		*              (`print_max_turns`) is reached.
+		*/
+		async handlePrintMainTurnCompleted() {
+			const mode = this.resolvePrintBackgroundMode();
+			if (mode === "exit") return "finish";
+			if (mode === "drain") {
+				await this.waitForBackgroundTasksOnPrint();
+				return "finish";
+			}
+			const ceilingS = this.options.background?.printWaitCeilingS ?? 3600;
+			const maxTurns = this.options.background?.printMaxTurns ?? 50;
+			const now = Date.now();
+			this.printSteerDeadline ??= now + ceilingS * 1e3;
+			this.printSteerTurns += 1;
+			if (now >= this.printSteerDeadline) {
+				this.log.warn("print steer ceiling reached, finishing", { ceilingS });
+				return "finish";
+			}
+			if (this.printSteerTurns > maxTurns) {
+				this.log.warn("print steer max turns reached, finishing", { maxTurns });
+				return "finish";
+			}
+			if (this.countActiveBackgroundTasks() > 0) return "continue";
+			return "finish";
+		}
 		async createAgent(config, options = {}) {
 			await this.skillsReady;
 			const type = config.type ?? "main";
@@ -205850,7 +206330,9 @@ var init_model_alias_merge = __esmMin((() => {
 		"model",
 		"maxContextSize",
 		"capabilities",
-		"displayName"
+		"displayName",
+		"supportEfforts",
+		"defaultEffort"
 	]);
 }));
 //#endregion
@@ -206578,6 +207060,10 @@ function toModelEntry(value) {
 	}
 	if (typeof value["tool_call"] === "boolean") entry.tool_call = value["tool_call"];
 	if (typeof value["reasoning"] === "boolean") entry.reasoning = value["reasoning"];
+	const supportEfforts = toStringArrayOrUndefined(value["support_efforts"]);
+	if (supportEfforts !== void 0) entry.support_efforts = supportEfforts;
+	const defaultEffort = value["default_effort"];
+	if (typeof defaultEffort === "string" && defaultEffort.length > 0) entry.default_effort = defaultEffort;
 	const modalities = value["modalities"];
 	if (isRecord$10(modalities)) {
 		const input = toStringArrayOrUndefined(modalities["input"]);
@@ -206651,7 +207137,7 @@ async function fetchCustomRegistry(source, fetchImpl = fetch, signal) {
 function capabilitiesFromCustomEntry(model) {
 	const caps = /* @__PURE__ */ new Set();
 	if (model.tool_call === true) caps.add("tool_use");
-	if (model.reasoning === true) caps.add("thinking");
+	if (model.reasoning === true || (model.support_efforts?.length ?? 0) > 0) caps.add("thinking");
 	if (model.modalities?.input?.includes("image") === true) caps.add("image_in");
 	if (model.modalities?.input?.includes("video") === true) caps.add("video_in");
 	if (model.modalities?.output?.includes("image") === true) caps.add("image_out");
@@ -206659,7 +207145,7 @@ function capabilitiesFromCustomEntry(model) {
 	return [...caps];
 }
 function hasRichCapabilityHints(model) {
-	return typeof model.tool_call === "boolean" || typeof model.reasoning === "boolean" || model.modalities !== void 0;
+	return typeof model.tool_call === "boolean" || typeof model.reasoning === "boolean" || model.modalities !== void 0 || model.support_efforts !== void 0;
 }
 function resolveMaxContextSize(model) {
 	const context = model.limit?.context;
@@ -206701,7 +207187,9 @@ function applyCustomRegistryProvider(config, entry, source) {
 			model: model.id,
 			maxContextSize,
 			capabilities,
-			displayName
+			displayName,
+			...model.support_efforts !== void 0 ? { supportEfforts: model.support_efforts } : {},
+			...model.default_effort !== void 0 ? { defaultEffort: model.default_effort } : {}
 		}, CUSTOM_REGISTRY_MODEL_FIELDS);
 	}
 	config.models = existingModels;
@@ -207450,7 +207938,7 @@ function resolveModelCapabilities(alias, provider) {
 		thinking: declared.has("thinking") || declared.has("always_thinking") || detected.thinking,
 		tool_use: declared.has("tool_use") || detected.tool_use,
 		max_context_tokens: alias.maxContextSize,
-		select_tools: declared.has("select_tools") || detected.select_tools === true
+		dynamically_loaded_tools: declared.has("dynamically_loaded_tools") || detected.dynamically_loaded_tools === true
 	};
 }
 function toKosongProviderConfig(provider, model, modelProtocol, kimiRequestHeaders, maxOutputSize, reasoningKey, promptCacheKey, adaptiveThinking, betaApi, supportEfforts) {
@@ -207793,6 +208281,9 @@ var init_rpc$1 = __esmMin((() => {
 		waitForBackgroundTasksOnPrint(_payload) {
 			return this.session.waitForBackgroundTasksOnPrint();
 		}
+		handlePrintMainTurnCompleted(_payload) {
+			return this.session.handlePrintMainTurnCompleted();
+		}
 		addAdditionalDir(payload) {
 			return this.session.addAdditionalDir(payload.path, payload.persist);
 		}
@@ -207895,6 +208386,9 @@ var init_rpc$1 = __esmMin((() => {
 		async cancelGoal({ agentId, ...payload }) {
 			return (await this.getAgent(agentId)).cancelGoal(payload);
 		}
+		async getCronTasks({ agentId, ...payload }) {
+			return (await this.getAgent(agentId)).getCronTasks(payload);
+		}
 		async getBackgroundOutput({ agentId, ...payload }) {
 			return (await this.getAgent(agentId)).getBackgroundOutput(payload);
 		}
@@ -209687,6 +210181,9 @@ var init_core_impl = __esmMin((() => {
 		waitForBackgroundTasksOnPrint({ sessionId, ...payload }) {
 			return this.sessionApi(sessionId).waitForBackgroundTasksOnPrint(payload);
 		}
+		handlePrintMainTurnCompleted({ sessionId, ...payload }) {
+			return this.sessionApi(sessionId).handlePrintMainTurnCompleted(payload);
+		}
 		addAdditionalDir({ sessionId, ...payload }) {
 			return this.requireSession(sessionId).addAdditionalDir(payload.path, payload.persist);
 		}
@@ -209708,6 +210205,9 @@ var init_core_impl = __esmMin((() => {
 		cancelGoal({ sessionId, ...payload }) {
 			return Promise.resolve(this.sessionApi(sessionId).cancelGoal(payload));
 		}
+		getCronTasks({ sessionId, ...payload }) {
+			return Promise.resolve(this.sessionApi(sessionId).getCronTasks(payload));
+		}
 		async installPlugin(payload) {
 			await this.pluginsReady;
 			this.assertPluginsLoaded();
@@ -216461,25 +216961,29 @@ function mapContentPart(part) {
 * Build the protocol-shaped `Message.content[]` for one ContextMessage.
 *
 * Order:
-*   1. For `tool` role: emit a SINGLE `tool_result` part. The output is the
-*      flattened text of the kosong message's content parts (most tool
-*      messages emit a single text). `is_error` is taken from `ContextMessage.isError`.
+*   1. For `tool` role: emit a SINGLE `tool_result` part. Plain-text results
+*      keep the historical flattened-text output (most tool messages emit a
+*      single text); a result that carries media parts (image/video/audio —
+*      e.g. ReadMediaFile) passes the raw kosong content-part array through
+*      instead, the same shape the live `tool.result` event stream carries,
+*      so REST consumers can still render the media. `is_error` is taken
+*      from `ContextMessage.isError`.
 *   2. For other roles: emit each content part mapped per `mapContentPart`,
 *      THEN append one `tool_use` part per `ToolCall` (assistant only).
 */
 function buildProtocolContent(msg) {
 	if (msg.role === "tool") {
 		if (msg.toolCallId === void 0) return msg.content.map((p) => mapContentPart(p));
-		const flattenedOutput = msg.content.map((p) => p.type === "text" ? p.text : "").join("");
+		const output = msg.content.some((p) => p.type === "image_url" || p.type === "video_url" || p.type === "audio_url") ? msg.content : msg.content.map((p) => p.type === "text" ? p.text : "").join("");
 		return [msg.isError === true ? {
 			type: "tool_result",
 			tool_call_id: msg.toolCallId,
-			output: flattenedOutput,
+			output,
 			is_error: true
 		} : {
 			type: "tool_result",
 			tool_call_id: msg.toolCallId,
-			output: flattenedOutput
+			output
 		}];
 	}
 	const base = msg.content.map((p) => mapContentPart(p));
@@ -218888,6 +219392,7 @@ var init_src = __esmMin((() => {
 	init_context$2();
 	init_tool_result_render();
 	init_image_compress();
+	init_image_format_policy();
 	init_image_limits();
 	init_image_originals();
 	init_provider_manager();
@@ -219170,14 +219675,27 @@ var Session = class {
 	/**
 	* Block until every still-running background task (across all agents in this
 	* session) reaches a terminal state. Used by `kimi -p` after the main agent's
-	* turn finishes when `background.keep_alive_on_exit` is `true`, so background
-	* subagents get a chance to complete before the process exits. No-op when
-	* `keep_alive_on_exit` is not enabled. Bounded by `background.print_wait_ceiling_s`.
+	* turn finishes when the resolved print background mode is `'drain'`
+	* (`print_background_mode = "drain"`, or the legacy `keep_alive_on_exit = true`
+	* fallback), so background subagents get a chance to complete before the process
+	* exits. No-op in other modes. Bounded by `background.print_wait_ceiling_s`.
 	*/
 	async waitForBackgroundTasksOnPrint() {
 		this.ensureOpen();
 		await this.rpc.waitForBackgroundTasksOnPrint({ sessionId: this.id });
 	}
+	/**
+	* Used by `kimi -p` after the main agent's turn ends with `reason ===
+	* 'completed'`. Returns `'finish'` when the run may exit, or `'continue'` when
+	* the caller must keep the session alive so a background-task completion can
+	* steer the main agent into a new turn. Policy is selected by
+	* `background.print_background_mode` (`'exit' | 'drain' | 'steer'`); when unset
+	* it falls back to the legacy `keep_alive_on_exit` mapping (`true ⇒ 'drain'`).
+	*/
+	async handlePrintMainTurnCompleted() {
+		this.ensureOpen();
+		return this.rpc.handlePrintMainTurnCompleted({ sessionId: this.id });
+	}
 	async createGoal(input) {
 		this.ensureOpen();
 		return this.rpc.createGoal({
@@ -219201,6 +219719,15 @@ var Session = class {
 		this.ensureOpen();
 		return this.rpc.cancelGoal({ sessionId: this.id });
 	}
+	/**
+	* Enumerate the cron tasks scheduled in this session. Hosts running a
+	* bounded session lifetime (e.g. `kimi -p`) poll this to decide whether
+	* pending scheduled work still needs the process alive.
+	*/
+	async getCronTasks() {
+		this.ensureOpen();
+		return this.rpc.getCronTasks({ sessionId: this.id });
+	}
 	async listMcpServers() {
 		this.ensureOpen();
 		return this.rpc.listMcpServers({ sessionId: this.id });
@@ -220063,6 +220590,9 @@ var SDKRpcClientBase = class {
 	async waitForBackgroundTasksOnPrint(input) {
 		return (await this.getRpc()).waitForBackgroundTasksOnPrint({ sessionId: input.sessionId });
 	}
+	async handlePrintMainTurnCompleted(input) {
+		return (await this.getRpc()).handlePrintMainTurnCompleted({ sessionId: input.sessionId });
+	}
 	async createGoal(input) {
 		return (await this.getRpc()).createGoal({
 			sessionId: input.sessionId,
@@ -220095,6 +220625,12 @@ var SDKRpcClientBase = class {
 			agentId: this.interactiveAgentId
 		});
 	}
+	async getCronTasks(input) {
+		return (await this.getRpc()).getCronTasks({
+			sessionId: input.sessionId,
+			agentId: this.interactiveAgentId
+		});
+	}
 	async listMcpServers(input) {
 		return (await this.getRpc()).listMcpServers({ sessionId: input.sessionId });
 	}
@@ -220423,7 +220959,7 @@ function capabilityToStrings(capability) {
 	if (capability.audio_in) caps.push("audio_in");
 	if (capability.thinking) caps.push("thinking");
 	if (capability.tool_use) caps.push("tool_use");
-	if (capability.select_tools === true) caps.push("select_tools");
+	if (capability.dynamically_loaded_tools === true) caps.push("dynamically_loaded_tools");
 	return caps.length > 0 ? caps : void 0;
 }
 /** Builds a kimi-code model alias from a normalized catalog model. */
@@ -240329,6 +240865,9 @@ function isHideOutputMarker(value) {
 * Convert an array of ACP {@link ContentBlock}s into the SDK's
 * {@link PromptPart} array.
 *
+* Image parts are built from the client-declared MIME verbatim; run the
+* result through {@link compressPromptImageParts} before submitting so
+* unsupported formats are dropped and MIME aliases canonicalized.
 */
 function acpBlocksToPromptParts(blocks) {
 	const out = [];
@@ -240394,6 +240933,13 @@ function acpBlocksToPromptParts(blocks) {
 * server's upload-time step. Best effort: a part that cannot be compressed is
 * passed through unchanged.
 *
+* The format gate (`gateImageFormatParts`) runs first: parts whose MIME is
+* outside the provider-accepted set are never forwarded — the part is
+* dropped and a text notice stands in, so one unsupported image cannot
+* poison the session history; accepted MIME aliases (`image/jpg`,
+* case/whitespace variants) are rewritten to the canonical form strict
+* provider whitelists require.
+*
 * Compression is never silent: a re-encoded image gains a caption text part
 * immediately before it stating what the original was, and the original bytes
 * are persisted (into `originalsDir` — typically the session's
@@ -240402,7 +240948,7 @@ function acpBlocksToPromptParts(blocks) {
 */
 async function compressPromptImageParts(parts, options = {}) {
 	const out = [];
-	for (const part of parts) {
+	for (const part of gateImageFormatParts(parts)) {
 		if (part.type === "image_url") {
 			const parsed = parseImageDataUrl(part.imageUrl.url);
 			if (parsed !== null) {
@@ -240448,14 +240994,6 @@ async function compressPromptImageParts(parts, options = {}) {
 	}
 	return out;
 }
-function parseImageDataUrl(url) {
-	const match = /^data:([^;,]+);base64,(.*)$/s.exec(url);
-	if (match === null) return null;
-	return {
-		mimeType: match[1],
-		base64: match[2]
-	};
-}
 /**
 * Minimum-viable XML-attribute escaping for prompt-embedded resource
 * wrappers. The output is consumed by an LLM, not parsed by a canonical
@@ -278086,7 +278624,17 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 	const content = [];
 	for (const part of body.content) {
 		if (part.type === "image" && part.source.kind === "base64") {
-			const compressed = await compressBase64ForModel(part.source.data, part.source.media_type, {
+			const effectiveMime = resolveEffectiveImageMime(part.source.media_type, decodeBase64Prefix(part.source.data));
+			if (!isModelAcceptedImageMime(effectiveMime)) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(effectiveMime)
+				});
+				changed = true;
+				continue;
+			}
+			const canonicalMime = normalizeImageMime(effectiveMime);
+			const compressed = await compressBase64ForModel(part.source.data, canonicalMime, {
 				maxEdge: options.maxImageEdgePx,
 				telemetry: telemetryFor("prompt_inline")
 			});
@@ -278120,9 +278668,31 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 					}
 				});
 				changed = true;
+			} else if (canonicalMime !== part.source.media_type) {
+				content.push({
+					...part,
+					source: {
+						...part.source,
+						media_type: canonicalMime
+					}
+				});
+				changed = true;
 			} else content.push(part);
 			continue;
 		}
+		if (part.type === "image" && part.source.kind === "url") {
+			const extMime = unsupportedImageMimeFromUrl(part.source.url);
+			if (extMime !== null) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(extMime, part.source.url)
+				});
+				changed = true;
+				continue;
+			}
+			content.push(part);
+			continue;
+		}
 		if (part.type !== "image" && part.type !== "video" || part.source.kind !== "file") {
 			content.push(part);
 			continue;
@@ -278142,6 +278712,16 @@ async function resolvePromptMediaFiles(body, store, cacheDir, options = {}) {
 		let mediaType = file.meta.media_type;
 		let bytes = data;
 		if (part.type === "image") {
+			mediaType = resolveEffectiveImageMime(mediaType, data);
+			if (!isModelAcceptedImageMime(mediaType)) {
+				content.push({
+					type: "text",
+					text: buildUnsupportedImageNotice(mediaType, file.meta.name)
+				});
+				changed = true;
+				continue;
+			}
+			mediaType = normalizeImageMime(mediaType);
 			const compressed = await compressImageForModel(data, mediaType, {
 				maxEdge: options.maxImageEdgePx,
 				telemetry: telemetryFor("prompt_file")
@@ -303284,7 +303864,7 @@ const REMOVE_CONFIRM_REMOVE = "remove";
 const INSTALL_TRUST_EXIT = "exit";
 const INSTALL_TRUST_TRUST = "trust";
 const ELLIPSIS$6 = "…";
-const WEB_BRIDGE_URL = "https://www.kimi.com/features/webbridge";
+const WEB_BRIDGE_URL = "https://www.kimi.com/features/webbridge#local-agent";
 const WEB_BRIDGE_ENTRY = {
 	id: "kimi-webbridge",
 	displayName: "Kimi WebBridge",
@@ -370450,7 +371030,7 @@ async function runHeadlessGoal(session, goal, model, outputFormat, stdout, stder
 		if (event.type === "goal.updated" && event.agentId === "main" && event.change?.kind === "completion" && event.snapshot !== null) completedSnapshot = event.snapshot;
 	});
 	try {
-		await runPromptTurn(session, goal.objective, outputFormat, stdout, stderr, true);
+		await runPromptTurn(session, goal.objective, outputFormat, stdout, stderr);
 	} finally {
 		unsubscribeGoalEvents();
 		const snapshot = completedSnapshot ?? (await session.getGoal()).goal;
@@ -370577,17 +371157,26 @@ function signalExitCode(signal) {
 	if (signal === "SIGHUP") return 129;
 	return 143;
 }
-function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoalTerminal = false) {
+function runPromptTurn(session, prompt, outputFormat, stdout, stderr) {
 	let activeTurnId;
 	let activeAgentId;
-	let latestStartedTurnId;
 	const outputWriter = outputFormat === "stream-json" ? new PromptJsonWriter(stdout) : new PromptTranscriptWriter(stdout, stderr);
 	let settled = false;
 	let unsubscribe;
+	let keepAliveTimer;
+	const holdEventLoop = () => {
+		keepAliveTimer ??= setInterval(() => {}, 6e4);
+	};
+	const releaseEventLoop = () => {
+		if (keepAliveTimer === void 0) return;
+		clearInterval(keepAliveTimer);
+		keepAliveTimer = void 0;
+	};
 	return new Promise((resolve, reject) => {
 		const finish = (error) => {
 			if (settled) return;
 			settled = true;
+			releaseEventLoop();
 			unsubscribe?.();
 			outputWriter.finish();
 			if (error !== void 0) {
@@ -370596,21 +371185,39 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 			}
 			resolve();
 		};
+		const evaluateRunCompletion = async () => {
+			try {
+				const { goal } = await session.getGoal();
+				if (settled || activeTurnId !== void 0) return;
+				if (goal?.status === "active") {
+					holdEventLoop();
+					return;
+				}
+				const { tasks } = await session.getCronTasks();
+				if (settled || activeTurnId !== void 0) return;
+				if (tasks.some((task) => task.nextFireAt !== null)) {
+					holdEventLoop();
+					return;
+				}
+				await finishCompletedTurn();
+			} catch (error) {
+				finish(error instanceof Error ? error : new Error(String(error)));
+			}
+		};
 		unsubscribe = session.onEvent((event) => {
 			if (event.type === "error") {
 				if (event.agentId !== PROMPT_MAIN_AGENT_ID) return;
 				finish(/* @__PURE__ */ new Error(`${event.code}: ${event.message}`));
 				return;
 			}
-			if (event.type === "turn.started" && activeTurnId === void 0) {
+			if (event.type === "turn.started") {
 				if (event.agentId !== PROMPT_MAIN_AGENT_ID) return;
 				activeTurnId = event.turnId;
 				activeAgentId = event.agentId;
-				latestStartedTurnId = event.turnId;
 				return;
 			}
-			if (waitForGoalTerminal && event.type === "goal.updated" && event.agentId === PROMPT_MAIN_AGENT_ID && activeTurnId === void 0 && event.snapshot !== null && event.snapshot.status !== "active") {
-				finishCompletedTurn();
+			if (event.type === "goal.updated" && event.agentId === PROMPT_MAIN_AGENT_ID && activeTurnId === void 0 && event.snapshot !== null && event.snapshot.status !== "active") {
+				evaluateRunCompletion();
 				return;
 			}
 			if (activeTurnId === void 0 || activeAgentId === void 0 || !hasTurnId(event) || event.turnId !== activeTurnId || event.agentId !== activeAgentId) return;
@@ -370621,6 +371228,7 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 					return;
 				case "turn.step.retrying":
 					outputWriter.discardAssistant();
+					outputWriter.writeRetrying(event);
 					return;
 				case "assistant.delta":
 					outputWriter.writeAssistantDelta(event.delta);
@@ -370646,23 +371254,9 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 				case "turn.ended":
 					if (event.reason === "completed") {
 						outputWriter.flushAssistant();
-						if (waitForGoalTerminal) {
-							const completedTurnId = event.turnId;
-							activeTurnId = void 0;
-							activeAgentId = void 0;
-							(async () => {
-								try {
-									const { goal } = await session.getGoal();
-									if (activeTurnId !== void 0 || latestStartedTurnId !== completedTurnId) return;
-									if (goal?.status === "active") return;
-									await finishCompletedTurn();
-								} catch (error) {
-									finish(error instanceof Error ? error : new Error(String(error)));
-								}
-							})();
-							return;
-						}
-						finishCompletedTurn();
+						activeTurnId = void 0;
+						activeAgentId = void 0;
+						evaluateRunCompletion();
 						return;
 					}
 					finish(new Error(formatTurnEndedFailure(event)));
@@ -370685,7 +371279,6 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 				case "subagent.started":
 				case "subagent.suspended":
 				case "tool.list.updated":
-				case "turn.started":
 				case "turn.step.completed":
 				case "warning": return;
 			}
@@ -370696,9 +371289,12 @@ function runPromptTurn(session, prompt, outputFormat, stdout, stderr, waitForGoa
 		async function finishCompletedTurn() {
 			outputWriter.flushAssistant();
 			try {
-				await session.waitForBackgroundTasksOnPrint();
+				if (await session.handlePrintMainTurnCompleted() === "continue") {
+					holdEventLoop();
+					return;
+				}
 			} catch (error) {
-				log.warn("waitForBackgroundTasksOnPrint failed", { error });
+				log.warn("handlePrintMainTurnCompleted failed", { error });
 			}
 			finish();
 		}
@@ -370727,6 +371323,7 @@ var PromptTranscriptWriter = class {
 	writeToolCall() {}
 	writeToolCallDelta() {}
 	writeToolResult() {}
+	writeRetrying() {}
 	flushAssistant() {
 		this.assistantWriter.finish();
 	}
@@ -370813,6 +371410,20 @@ var PromptJsonWriter = class {
 		this.assistantText = "";
 		this.toolCalls.length = 0;
 	}
+	writeRetrying(event) {
+		const message = {
+			role: "meta",
+			type: "turn.step.retrying",
+			failed_attempt: event.failedAttempt,
+			next_attempt: event.nextAttempt,
+			max_attempts: event.maxAttempts,
+			delay_ms: event.delayMs,
+			error_name: event.errorName,
+			error_message: event.errorMessage,
+			status_code: event.statusCode
+		};
+		this.writeJsonLine(message);
+	}
 	finish() {
 		this.flushAssistant();
 	}