@nexrall/code-core 1.4.63 → 1.4.66

package/dist/agent/memory.d.ts

@@ -48,6 +48,17 @@ export declare function memoryStats(scope: MemoryScope, workDir?: string): {
     entries: number;
     archived: number;
 };
+/**
+ * Keep only the lines of a consolidation reply that are real memory entries.
+ *
+ * The prompt says "Output ONLY the bullet lines", but models do not always comply: a reply
+ * that opens with "I'll read the full, untruncated memory text before consolidating…" (seen
+ * in a user's global.md and a project file) used to be saved verbatim as an ACTIVE fact, then
+ * injected into every later session as ground truth. An entry is a line of the exact shape
+ * memory_write produces — `- [YYYY-MM-DD] …` — so anything else (preamble, "Here are the
+ * merged bullets:", a code fence, a trailing remark) is dropped rather than persisted.
+ */
+export declare function extractConsolidatedEntries(reply: string): string[];
 /**
  * Summarize the OLDEST half of a memory file's ACTIVE entries into a few consolidated
  * bullets via an LLM call, keeping the most recent entries verbatim — same "compact,

package/dist/agent/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AAKtE,eAAO,MAAM,wBAAwB,QAAmC,CAAC;AAoFzE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;kCAI8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;6DAEyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA2D5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;iDAG6C;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAKrG;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CASpF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAUpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CAsDlB;AAkBD,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAYR"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AAKtE,eAAO,MAAM,wBAAwB,QAAmC,CAAC;AAoFzE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;kCAI8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;6DAEyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA2D5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;iDAG6C;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAKrG;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CASpF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAUpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKlE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CAyDlB;AAkBD,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAYR"}

package/dist/agent/memory.js

@@ -40,6 +40,7 @@ exports.readMemory = readMemory;
 exports.readAllMemory = readAllMemory;
 exports.clearMemory = clearMemory;
 exports.memoryStats = memoryStats;
+exports.extractConsolidatedEntries = extractConsolidatedEntries;
 exports.compactMemoryIfNeeded = compactMemoryIfNeeded;
 exports.isSafeAgentName = isSafeAgentName;
 exports.agentMemoryPath = agentMemoryPath;
@@ -318,6 +319,22 @@ function memoryStats(scope, workDir) {
         archived: archived.filter((l) => /^-\s\[\d{4}-\d{2}-\d{2}\]/.test(l)).length,
     };
 }
+/**
+ * Keep only the lines of a consolidation reply that are real memory entries.
+ *
+ * The prompt says "Output ONLY the bullet lines", but models do not always comply: a reply
+ * that opens with "I'll read the full, untruncated memory text before consolidating…" (seen
+ * in a user's global.md and a project file) used to be saved verbatim as an ACTIVE fact, then
+ * injected into every later session as ground truth. An entry is a line of the exact shape
+ * memory_write produces — `- [YYYY-MM-DD] …` — so anything else (preamble, "Here are the
+ * merged bullets:", a code fence, a trailing remark) is dropped rather than persisted.
+ */
+function extractConsolidatedEntries(reply) {
+    return reply
+        .split('\n')
+        .map((l) => l.trimEnd())
+        .filter((l) => /^-\s\[\d{4}-\d{2}-\d{2}\]\s*\S/.test(l));
+}
 /**
  * Summarize the OLDEST half of a memory file's ACTIVE entries into a few consolidated
  * bullets via an LLM call, keeping the most recent entries verbatim — same "compact,
@@ -370,9 +387,12 @@ async function compactMemoryIfNeeded(scope, workDir, summarize) {
                 `draws from, and preserve any leading "[src: ...]" provenance tag verbatim when present. ` +
                 `Output ONLY the bullet lines, nothing else.\n\n${older.join('\n')}`;
             try {
-                const summarized = (await summarize(prompt)).trim();
-                if (summarized) {
-                    active = [...summarized.split('\n').filter((l) => l.trim().length > 0), ...recent];
+                const summarized = extractConsolidatedEntries(await summarize(prompt));
+                // Zero valid bullets means the model answered in prose (or refused): treat it
+                // exactly like a failed call and keep the original entries. Writing the reply
+                // anyway would REPLACE the older half with chatter.
+                if (summarized.length > 0) {
+                    active = [...summarized, ...recent];
                     changed = true;
                 }
             }

package/dist/agent/modelCatalogue.d.ts

@@ -64,4 +64,19 @@ export declare function liveCostMultiplierFor(id: string | undefined, fallback:
 export declare function liveSelectableModelIds(): string[] | null;
 /** Test-only: reset the module-level cache between test cases. */
 export declare function _resetModelCatalogueCacheForTests(): void;
+/**
+ * `model: cheapest` — Claude Code's Explore-on-Haiku idea, without leaving the
+ * provider the user chose. Resolves to the lowest-costMultiplier AVAILABLE model
+ * of the parent session's vendor (Opus → Sonnet, GPT-6 Sol → GPT-6 Luna, …), never
+ * a pricier one. Returns the parent model unchanged when the catalogue is not
+ * loaded or does not know it — inheriting is always a safe fallback; guessing a
+ * model on another provider (the bug that made explorer bill Anthropic for
+ * DeepSeek sessions) is not.
+ */
+export declare const CHEAPEST_MODEL_ALIAS = "cheapest";
+export declare function cheapestSameVendorModel(parentModel: string | undefined): string | undefined;
+/** Resolve a sub-agent's `model:` against its parent's: undefined/inherit → parent, cheapest → see above. */
+export declare function resolveSubAgentModel(agentModel: string | undefined, parentModel: string | undefined): string | undefined;
+/** Test hook: install a catalogue without a network fetch. */
+export declare function _setModelCatalogueForTest(models: CodeModelInfo[] | null): void;
 //# sourceMappingURL=modelCatalogue.d.ts.map

package/dist/agent/modelCatalogue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelCatalogue.d.ts","sourceRoot":"","sources":["../../src/agent/modelCatalogue.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAiBlE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuBnE;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAElG;AAOD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErF;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAGzF;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG9G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,GAAG,IAAI,CAExD;AAED,kEAAkE;AAClE,wBAAgB,iCAAiC,IAAI,IAAI,CAGxD"}
+{"version":3,"file":"modelCatalogue.d.ts","sourceRoot":"","sources":["../../src/agent/modelCatalogue.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAiBlE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuBnE;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAElG;AAOD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErF;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAGzF;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAGvF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG9G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,GAAG,IAAI,CAExD;AAED,kEAAkE;AAClE,wBAAgB,iCAAiC,IAAI,IAAI,CAGxD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAO/C,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW3F;AAED,6GAA6G;AAC7G,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIxH;AAED,8DAA8D;AAC9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,IAAI,CAE9E"}

package/dist/agent/modelCatalogue.js

@@ -47,6 +47,7 @@
 // added mid-session is vanishingly rare and would need a restart to use
 // safely anyway, since the picker itself is also static per-render).
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHEAPEST_MODEL_ALIAS = void 0;
 exports.getModelCatalogue = getModelCatalogue;
 exports.getCachedModelCatalogue = getCachedModelCatalogue;
 exports.liveContextWindowFor = liveContextWindowFor;
@@ -59,6 +60,9 @@ exports.liveLabelFor = liveLabelFor;
 exports.liveCostMultiplierFor = liveCostMultiplierFor;
 exports.liveSelectableModelIds = liveSelectableModelIds;
 exports._resetModelCatalogueCacheForTests = _resetModelCatalogueCacheForTests;
+exports.cheapestSameVendorModel = cheapestSameVendorModel;
+exports.resolveSubAgentModel = resolveSubAgentModel;
+exports._setModelCatalogueForTest = _setModelCatalogueForTest;
 const client_1 = require("../api/client");
 /** How long a successful fetch is trusted before a caller should re-fetch. */
 const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes — matches backend's own getPricing() TTL
@@ -180,4 +184,46 @@ function _resetModelCatalogueCacheForTests() {
     _state = null;
     _inFlight = null;
 }
+/**
+ * `model: cheapest` — Claude Code's Explore-on-Haiku idea, without leaving the
+ * provider the user chose. Resolves to the lowest-costMultiplier AVAILABLE model
+ * of the parent session's vendor (Opus → Sonnet, GPT-6 Sol → GPT-6 Luna, …), never
+ * a pricier one. Returns the parent model unchanged when the catalogue is not
+ * loaded or does not know it — inheriting is always a safe fallback; guessing a
+ * model on another provider (the bug that made explorer bill Anthropic for
+ * DeepSeek sessions) is not.
+ */
+exports.CHEAPEST_MODEL_ALIAS = 'cheapest';
+// Legacy tier aliases the backend still resolves (see agentTypes.ts VALID_MODELS).
+const LEGACY_ALIAS_IDS = {
+    turbo: 'claude-sonnet-5-5', fast: 'claude-sonnet-5-5', pro: 'claude-opus-5-5', ultra: 'claude-fable-5-1',
+};
+function cheapestSameVendorModel(parentModel) {
+    if (!_state || !parentModel)
+        return parentModel;
+    const parent = findModel(parentModel) ?? findModel(LEGACY_ALIAS_IDS[parentModel]);
+    if (!parent)
+        return parentModel;
+    const parentCost = parent.costMultiplier ?? Infinity;
+    let best = parent;
+    for (const m of _state.models) {
+        if (m.vendor !== parent.vendor || m.available === false || typeof m.costMultiplier !== 'number')
+            continue;
+        if (m.costMultiplier < (best.costMultiplier ?? Infinity) && m.costMultiplier <= parentCost)
+            best = m;
+    }
+    return best === parent ? parentModel : best.id;
+}
+/** Resolve a sub-agent's `model:` against its parent's: undefined/inherit → parent, cheapest → see above. */
+function resolveSubAgentModel(agentModel, parentModel) {
+    if (!agentModel || agentModel === 'inherit')
+        return parentModel;
+    if (agentModel === exports.CHEAPEST_MODEL_ALIAS)
+        return cheapestSameVendorModel(parentModel);
+    return agentModel;
+}
+/** Test hook: install a catalogue without a network fetch. */
+function _setModelCatalogueForTest(models) {
+    _state = models ? { models, defaultModel: models[0]?.id ?? '', fetchedAt: Date.now() } : null;
+}
 //# sourceMappingURL=modelCatalogue.js.map

package/dist/agent/planMode.d.ts

@@ -10,6 +10,20 @@ export interface PlanModeRefusal {
  * "Provably" is doing real work: unknown verbs are refused, not guessed at.
  */
 export declare function isReadOnlyCommand(command: string): boolean;
+/**
+ * Is a (possibly piped / chained) command read-only on every segment?
+ *
+ * This is what the permission GATE uses to skip a prompt in ask/edit mode. Plan mode
+ * keeps the stricter whole-shape refusal above (`checkPlanMode`): a temporary lock can
+ * afford to say "no pipelines", an approval gate that says it about `git log | head`
+ * just trains people to click through prompts.
+ *
+ * Fail-closed throughout: anything that is not plainly a chain of read-only commands —
+ * a write redirect, `$(…)`, backticks, a lone `&`, an unknown verb, a segment split
+ * wrongly by a quote — returns false, which means "ask the user". The cost of a false
+ * false is one extra keypress; the cost of a false true is `rm` running unasked.
+ */
+export declare function isReadOnlyPipeline(command: string): boolean;
 /**
  * Should this tool call be refused because the session is in plan mode?
  * Returns null when the call is allowed.

package/dist/agent/planMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAwHA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgE1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}
+{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAgJA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAqFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA8D1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}

package/dist/agent/planMode.js

@@ -19,6 +19,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLAN_MODE_INSTRUCTIONS = void 0;
 exports.isReadOnlyCommand = isReadOnlyCommand;
+exports.isReadOnlyPipeline = isReadOnlyPipeline;
 exports.checkPlanMode = checkPlanMode;
 /**
  * Tools that cannot alter anything outside the conversation.
@@ -71,10 +72,31 @@ const READ_ONLY_BASH = new Set([
     'grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack', 'find', 'fd', 'locate',
     'diff', 'comm', 'cmp', 'sort', 'uniq', 'cut', 'tr', 'column', 'jq', 'yq',
     'date', 'whoami', 'hostname', 'uname', 'env', 'printenv', 'id', 'groups',
-    'ps', 'top', 'uptime', 'free', 'node', 'python', 'python3',
-    'tree', 'less', 'more', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
+    'ps', 'uptime', 'free', 'node', 'python', 'python3',
+    // `less`/`more`/`top` are deliberately NOT here: pagers run `!cmd` from inside and
+    // `top` never exits. `env` is listed but only bare — see toolFlagsOk.
+    'tree', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
     'true', 'false', 'test', 'sleep', 'seq', 'expr',
+    // Changes this shell's cwd only. Needed so `cd x && ls` is not refused.
+    'cd',
 ]);
+/**
+ * A verb written with a path is only trusted when it lives in a system bin dir.
+ * Stripping to the basename (the old behaviour) meant `./ls`, `/tmp/evil/cat` and
+ * `build/git` — attacker-written files — were classified by their NAME and waved
+ * through as read-only.
+ */
+const SYSTEM_BIN_DIRS = new Set([
+    '/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin', '/opt/homebrew/bin',
+]);
+/**
+ * Environment assignments that change WHAT a read-only verb runs: the search path,
+ * loader, pager/editor/external-diff hooks, and the interpreters' option vars.
+ * `GIT_EXTERNAL_DIFF=./x git diff` and `PATH=/tmp ls` run the attacker's program
+ * while every word the classifier looks at is innocent.
+ */
+const UNSAFE_ENV = /^(PATH|HOME|SHELL|IFS|ENV|BASH_ENV|PAGER|MANPAGER|EDITOR|VISUAL|BROWSER|LD_\w*|DYLD_\w*|GIT_\w*|NODE_\w*|NPM_\w*|npm_\w*|PYTHON\w*|BASH\w*|RUBY\w*|PERL\w*|LESS\w*|XDG_\w*|\w*OPTS?)=/i;
+const GH_NOUNS = new Set(['pr', 'issue', 'run', 'repo', 'release', 'workflow', 'gist', 'label']);
 /**
  * Subcommands that are read-only for tools whose safety depends on the verb.
  *
@@ -117,6 +139,83 @@ const READ_ONLY_NESTED = {
  * `|` is included: `cat x | tee y` writes, and so does `... | sh`.
  */
 const SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+const isShort = (f) => f.startsWith('-') && !f.startsWith('--');
+const flagName = (f) => f.split('=')[0];
+/**
+ * Flags of an allowlisted VERB that turn it into a writer or an executor. The verb
+ * list says `sort` is read-only; `sort -o f` writes f. Each entry below is a real way
+ * to mutate through a verb the list trusts — the list alone was the hole.
+ */
+function toolFlagsOk(verb, args) {
+    const flags = args.filter((a) => a.startsWith('-'));
+    const pos = args.filter((a) => !a.startsWith('-'));
+    switch (verb) {
+        case 'env': return args.length === 0; // `env CMD` RUNS CMD
+        case 'sort':
+            return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*o/.test(f)) || f.startsWith('--output') || f.startsWith('--compress-program'));
+        case 'uniq': return pos.length <= 1; // second positional is an OUTPUT file
+        case 'find':
+            return !args.some((a) => ['-exec', '-execdir', '-delete', '-ok', '-okdir', '-fprint', '-fprint0', '-fprintf', '-fls'].includes(a));
+        case 'fd':
+            return !flags.some((f) => f.startsWith('--exec') || (isShort(f) && /^-[A-Za-z]*[xX]/.test(f)));
+        case 'rg': return !flags.some((f) => flagName(f) === '--pre' || f.startsWith('--hostname-bin'));
+        case 'ag':
+        case 'ack': return !flags.some((f) => f.startsWith('--pager'));
+        case 'yq': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*i/.test(f)) || f.startsWith('--inplace'));
+        case 'tree': return !flags.some((f) => isShort(f) && /^-[A-Za-z]*o/.test(f));
+        case 'date': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*s/.test(f)) || f.startsWith('--set'));
+        case 'hostname': return pos.length === 0; // `hostname NAME` renames the machine
+        case 'file': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*C/.test(f)) || f.startsWith('--compile'));
+        default: return true;
+    }
+}
+/** Every flag must be a known read-only one; anything unfamiliar fails closed. */
+function flagsWithin(flags, shorts, longs) {
+    return flags.every((f) => {
+        if (isShort(f))
+            return [...f.slice(1)].every((c) => shorts.includes(c) || /\d/.test(c));
+        return longs.includes(flagName(f));
+    });
+}
+const LISTISH = ['-l', '--list', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at'];
+/**
+ * Same idea one level down: `git branch` lists, `git branch newbranch` creates,
+ * `git branch -D main` deletes — one subcommand, three effects.
+ */
+function subcommandFlagsOk(verb, sub, args) {
+    const flags = args.filter((a) => a.startsWith('-'));
+    const pos = args.filter((a) => !a.startsWith('-')); // pos[0] === sub
+    const listish = flags.some((f) => LISTISH.includes(flagName(f)) || (isShort(f) && f.includes('l')));
+    if (verb === 'git') {
+        if (flags.some((f) => f.startsWith('--output') || f === '--ext-diff' || f === '-O' || f.startsWith('--open-files-in-pager')))
+            return false;
+        switch (sub) {
+            case 'branch':
+                return flagsWithin(flags, 'arvlq', ['--all', '--remotes', '--verbose', '--list', '--show-current', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--abbrev', '--no-abbrev', '--ignore-case', '--omit-empty'])
+                    && (pos.length <= 1 || listish);
+            case 'tag':
+                return flagsWithin(flags, 'lnv', ['--list', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--verify', '--ignore-case', '--omit-empty'])
+                    && (pos.length <= 1 || listish || flags.some((f) => f === '-v' || f === '--verify'));
+            case 'remote':
+                return flagsWithin(flags, 'vn', ['--verbose']) && (pos[1] === undefined || pos[1] === 'show' || pos[1] === 'get-url');
+            case 'config':
+                return flagsWithin(flags, 'lz', ['--get', '--get-all', '--get-regexp', '--list', '--show-origin', '--show-scope', '--global', '--local', '--system', '--worktree', '--name-only', '--null', '--includes', '--no-includes', '--type'])
+                    && pos.length <= 2; // `config` itself + at most one key
+            case 'reflog': return pos[1] !== 'expire' && pos[1] !== 'delete';
+            default: return true;
+        }
+    }
+    if (sub === 'config' && (verb === 'npm' || verb === 'pnpm' || verb === 'yarn')) {
+        return pos[1] === undefined || pos[1] === 'get' || pos[1] === 'list' || pos[1] === 'ls';
+    }
+    if (verb === 'go') {
+        return !flags.some((f) => {
+            const n = f.replace(/^--?/, '-');
+            return n === '-w' || n === '-u' || n.startsWith('-vettool') || n.startsWith('-toolexec') || n === '-exec';
+        });
+    }
+    return true;
+}
 function firstWords(command) {
     return command.trim().split(/\s+/).filter(Boolean);
 }
@@ -137,15 +236,21 @@ function isReadOnlyCommand(command) {
         return false;
     // `VAR=x cmd` — skip leading environment assignments to find the real verb.
     let i = 0;
-    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]))
+    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) {
+        if (UNSAFE_ENV.test(words[i]))
+            return false;
         i++;
+    }
     if (i >= words.length)
         return false;
     let verb = words[i];
-    // Strip a path prefix: /usr/bin/git → git
+    // /usr/bin/git → git, but ONLY for a system bin dir (see SYSTEM_BIN_DIRS).
     const slash = verb.lastIndexOf('/');
-    if (slash >= 0)
+    if (slash >= 0) {
+        if (!SYSTEM_BIN_DIRS.has(verb.slice(0, slash)))
+            return false;
         verb = verb.slice(slash + 1);
+    }
     // `sudo anything` is refused outright regardless of the verb behind it: plan
     // mode is a promise about this machine, and privilege escalation is exactly
     // where a mistaken allow is least recoverable.
@@ -159,16 +264,12 @@ function isReadOnlyCommand(command) {
             // Bare `git` / `npm` just prints help — harmless.
             return true;
         }
-        if (subs.has(sub)) {
-            // `git config --global x y` WRITES. Only the read form (no value) passes.
-            if (verb === 'git' && sub === 'config') {
-                const args = words.slice(i + 2).filter((w) => !w.startsWith('-'));
-                return args.length <= 1;
-            }
-            return true;
-        }
+        if (subs.has(sub))
+            return subcommandFlagsOk(verb, sub, words.slice(i + 1));
         const nested = READ_ONLY_NESTED[verb];
-        if (nested && rest[1] && nested.has(rest[1]))
+        // `gh api list -X DELETE` has "list" in second position too — the noun must be a
+        // real resource noun, and `api` (arbitrary HTTP verbs) is not one.
+        if (nested && rest[1] && nested.has(rest[1]) && (verb !== 'gh' || GH_NOUNS.has(sub)))
             return true;
         return false;
     }
@@ -179,15 +280,42 @@ function isReadOnlyCommand(command) {
     if (verb === 'node' || verb === 'python' || verb === 'python3') {
         return words.slice(i + 1).every((w) => w === '--version' || w === '-V' || w === '-v');
     }
-    // `find` can execute and delete.
-    if (verb === 'find' && words.some((w) => w === '-exec' || w === '-execdir' || w === '-delete')) {
+    if (!toolFlagsOk(verb, words.slice(i + 1)))
         return false;
-    }
     // Reading a file with `test`/`stat` is fine, but `tee` is not in the list at
     // all, and `echo`/`printf` are only safe because redirection is already
     // rejected by SHELL_CONTROL above.
     return true;
 }
+/**
+ * Output redirections that cannot write anywhere interesting. Without this `ls 2>&1`
+ * and `cmd 2>/dev/null` — extremely common — would all count as "redirection".
+ */
+const HARMLESS_REDIRECT = /\s*\d?>\s*&\d\b|\s*\d?>>?\s*\/dev\/null(?=\s|$)/g;
+/**
+ * Is a (possibly piped / chained) command read-only on every segment?
+ *
+ * This is what the permission GATE uses to skip a prompt in ask/edit mode. Plan mode
+ * keeps the stricter whole-shape refusal above (`checkPlanMode`): a temporary lock can
+ * afford to say "no pipelines", an approval gate that says it about `git log | head`
+ * just trains people to click through prompts.
+ *
+ * Fail-closed throughout: anything that is not plainly a chain of read-only commands —
+ * a write redirect, `$(…)`, backticks, a lone `&`, an unknown verb, a segment split
+ * wrongly by a quote — returns false, which means "ask the user". The cost of a false
+ * false is one extra keypress; the cost of a false true is `rm` running unasked.
+ */
+function isReadOnlyPipeline(command) {
+    const cmd = command.replace(HARMLESS_REDIRECT, ' ').trim();
+    if (!cmd)
+        return false;
+    if (/[>`]|\$\(|<\(/.test(cmd))
+        return false;
+    const segs = cmd.split(/\|\||&&|[;|\n\r]/).map((x) => x.trim()).filter(Boolean);
+    if (!segs.length)
+        return false;
+    return segs.every((seg) => !seg.includes('&') && isReadOnlyCommand(seg));
+}
 /**
  * Should this tool call be refused because the session is in plan mode?
  * Returns null when the call is allowed.

package/dist/agent/readDedupe.d.ts

@@ -0,0 +1,15 @@
+import type { Message } from '../types';
+export declare class ReadDedupe {
+    private readonly workDir?;
+    private readonly records;
+    constructor(workDir?: string | undefined);
+    private resolve;
+    private key;
+    /** The stub to return instead of re-reading, or null to read normally. */
+    check(input: Record<string, unknown>, messages: Message[]): string | null;
+    /** Remember a successful full read. Call only with a real (non-stub) read_file output. */
+    record(input: Record<string, unknown>, toolUseId: string): void;
+    /** Forget every recorded range of these absolute paths (a write tool touched them). */
+    invalidate(absPaths: string[]): void;
+}
+//# sourceMappingURL=readDedupe.d.ts.map

package/dist/agent/readDedupe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readDedupe.d.ts","sourceRoot":"","sources":["../../src/agent/readDedupe.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAMxC,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAFrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAE5B,OAAO,CAAC,EAAE,MAAM,YAAA;IAE7C,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,GAAG;IAQX,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI;IAezE,0FAA0F;IAC1F,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAS/D,uFAAuF;IACvF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;CAOrC"}

package/dist/agent/readDedupe.js

@@ -0,0 +1,146 @@
+"use strict";
+// read_file de-duplication — Claude Code's "file unchanged since last read" stub.
+//
+// Agents re-read the same file constantly (before an edit, after a test run, while
+// re-checking a plan). Each re-read re-sent up to 25K tokens that were ALREADY in the
+// conversation, and every later request then carried both copies. When the file has not
+// changed and the earlier result is still intact in the history, a one-line stub
+// pointing at it is equivalent for the model and costs ~40 tokens.
+//
+// Safety is the whole design: the stub is only correct if the model can still SEE the
+// earlier content. So a hit requires ALL of:
+//   • same resolved path, offset and limit as a previous successful read in THIS run
+//     (one instance per runAgentLoop — a sub-agent starts with a fresh context and a
+//     fresh instance, so it never gets pointed at its parent's reads);
+//   • the file's mtime and size are unchanged since that read, and no write tool has
+//     touched the path since (explicit invalidation — mtime alone can miss a same-ms edit);
+//   • that read's tool_result is still in the live message array, unpruned — compaction,
+//     pruneOldToolResults or a rewind all remove or stub it, which turns the hit off.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReadDedupe = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const PRUNED_TAIL = 'pruned to conserve context. Re-run the tool if you need the full result.]';
+class ReadDedupe {
+    constructor(workDir) {
+        this.workDir = workDir;
+        this.records = new Map();
+    }
+    resolve(p) {
+        if (typeof p !== 'string' || !p)
+            return null;
+        const expanded = p.startsWith('~/') ? path.join(process.env.HOME ?? '', p.slice(2)) : p;
+        return this.workDir ? path.resolve(this.workDir, expanded) : path.resolve(expanded);
+    }
+    key(input) {
+        const abs = this.resolve(input.path);
+        if (!abs)
+            return null;
+        const offset = typeof input.offset === 'number' ? Math.max(0, Math.floor(input.offset)) : 0;
+        const limit = typeof input.limit === 'number' ? Math.max(1, Math.floor(input.limit)) : 0;
+        return { key: `${abs}\0${offset}\0${limit}`, abs };
+    }
+    /** The stub to return instead of re-reading, or null to read normally. */
+    check(input, messages) {
+        const k = this.key(input);
+        if (!k)
+            return null;
+        const rec = this.records.get(k.key);
+        if (!rec)
+            return null;
+        let st;
+        try {
+            st = fs.statSync(k.abs);
+        }
+        catch {
+            this.records.delete(k.key);
+            return null;
+        }
+        if (st.mtimeMs !== rec.mtimeMs || st.size !== rec.size) {
+            this.records.delete(k.key);
+            return null;
+        }
+        if (!resultStillIntact(messages, rec.toolUseId)) {
+            this.records.delete(k.key);
+            return null;
+        }
+        return (`File unchanged since your last read_file of it (same range). The content in that earlier ` +
+            `tool result is still current — refer to it instead of re-reading.`);
+    }
+    /** Remember a successful full read. Call only with a real (non-stub) read_file output. */
+    record(input, toolUseId) {
+        const k = this.key(input);
+        if (!k)
+            return;
+        try {
+            const st = fs.statSync(k.abs);
+            this.records.set(k.key, { toolUseId, mtimeMs: st.mtimeMs, size: st.size });
+        }
+        catch { /* unreadable now — nothing to remember */ }
+    }
+    /** Forget every recorded range of these absolute paths (a write tool touched them). */
+    invalidate(absPaths) {
+        if (!absPaths.length || !this.records.size)
+            return;
+        const set = new Set(absPaths);
+        for (const key of [...this.records.keys()]) {
+            if (set.has(key.slice(0, key.indexOf('\0'))))
+                this.records.delete(key);
+        }
+    }
+}
+exports.ReadDedupe = ReadDedupe;
+function resultStillIntact(messages, toolUseId) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const m = messages[i];
+        if (m.role !== 'user' || !Array.isArray(m.content))
+            continue;
+        for (const b of m.content) {
+            if (b?.type !== 'tool_result' || b.tool_use_id !== toolUseId)
+                continue;
+            if (b.is_error)
+                return false;
+            const text = typeof b.content === 'string'
+                ? b.content
+                : Array.isArray(b.content)
+                    ? b.content.map((c) => c.text ?? '').join('')
+                    : '';
+            return text.startsWith('[File:') && !text.trimEnd().endsWith(PRUNED_TAIL);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=readDedupe.js.map

package/dist/agent/securityLint.js

@@ -19,7 +19,7 @@
 //
 // Consequently every pattern here is tuned for PRECISION over recall. A check that
 // fires on ordinary code was removed rather than loosened. Deep analysis is the
-// `security-auditor` agent's job; this only catches the flagrant cases at the
+// a dedicated security review's job; this only catches the flagrant cases at the
 // moment they are written.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkSecurity = checkSecurity;
@@ -116,7 +116,7 @@ const RULES = [
         // So the interpolation must name something that plausibly came from the
         // outside: req/request/params/query/body/input/user/args, or a bare
         // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
-        // review is the security-auditor agent's job, not an inline regex's.
+        // review is a dedicated security review's job, not an inline regex's.
         //
         // THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
         // branch originally shared the no-quote gap, which made it miss the QUOTED