@noxsoft/anima 5.1.1 → 6.0.0

package/dist/{subagent-registry-BVrDlKmm.js → subagent-registry-CPtElVX0.js}

@@ -1,56 +1,58 @@
 import { n as __exportAll } from "./chunk-BXK9XSlF.js";
 import { $ as resolveStateDir, Dt as resolveRequiredHomeDir, N as theme, O as shouldLogVerbose, P as getChildLogger, T as logVerbose, Y as resolveGatewayPort, ct as normalizeAnyChannelId, g as defaultRuntime, lt as normalizeChannelId, n as isTruthyEnvValue, nt as CHAT_CHANNEL_ORDER, o as createSubsystemLogger, pt as setActivePluginRegistry, ut as normalizeChatChannelId, z as normalizeLogLevel } from "./entry.js";
-import { S as resolveAuthProfileDisplayLabel, a as resolveApiKeyForProfile, l as ensureAuthProfileStore, m as resolveAuthStorePathForDisplay, n as resolveAuthProfileOrder, r as isProfileInCooldown, s as listProfilesForProvider, u as loadAuthProfileStore, v as loadJsonFile, x as normalizeSecretInput, y as saveJsonFile } from "./auth-profiles-BF5x9Ej0.js";
+import { S as saveJsonFile, T as resolveAuthProfileDisplayLabel, a as markAuthProfileUsed, i as markAuthProfileFailure, l as listProfilesForProvider, n as resolveAuthProfileOrder, p as ensureAuthProfileStore, r as isProfileInCooldown, s as resolveApiKeyForProfile, u as markAuthProfileGood, v as resolveAuthStorePathForDisplay, w as normalizeSecretInput, x as loadJsonFile } from "./auth-profiles-Brxz2ojJ.js";
 import { r as resolveCliName, t as formatCliCommand } from "./command-format-kLw3YIIu.js";
 import { S as resolveThreadParentSessionKey, _ as isAcpSessionKey, a as buildAgentPeerSessionKey, b as isSubagentSessionKey, c as normalizeAccountId$1, d as resolveAgentIdFromSessionKey, f as resolveThreadSessionKeys, g as getSubagentDepth, i as buildAgentMainSessionKey, l as normalizeAgentId, n as DEFAULT_AGENT_ID, p as sanitizeAgentId, r as DEFAULT_MAIN_KEY, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isCronRunSessionKey, x as parseAgentSessionKey } from "./session-key-DP2WHl90.js";
 import { C as sleep, E as truncateUtf16Safe, S as shortenHomePath, c as escapeRegExp, d as isRecord, r as clampInt, t as CONFIG_DIR, u as isPlainObject, w as sliceUtf16Safe, y as resolveUserPath } from "./utils-D1VGbO3C.js";
 import { a as logDebug, c as logWarn, i as spawnWithFallback, n as runExec, r as formatSpawnError, s as logInfo, t as runCommandWithTimeout } from "./exec-BtBJICHE.js";
 import { c as resolveDefaultAgentId, f as DEFAULT_AGENT_WORKSPACE_DIR, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, n as resolveAgentConfig, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, u as resolveSessionAgentIds, x as ensureAgentWorkspace } from "./agent-scope-Dm8IL1Ks.js";
-import { _ as DEFAULT_MODEL, a as isCliProvider, c as normalizeProviderId, d as resolveConfiguredModelRef, f as resolveDefaultModelForAgent, g as DEFAULT_CONTEXT_TOKENS, h as resolveThinkingDefault, m as resolveModelRefFromString, n as buildConfiguredAllowlistKeys, o as modelKey, r as buildModelAliasIndex, s as normalizeModelRef, t as buildAllowedModelSet, v as DEFAULT_PROVIDER } from "./model-selection-DFbDH9o2.js";
+import { _ as DEFAULT_MODEL, a as isCliProvider, c as normalizeProviderId, d as resolveConfiguredModelRef, f as resolveDefaultModelForAgent, g as DEFAULT_CONTEXT_TOKENS, h as resolveThinkingDefault, m as resolveModelRefFromString, n as buildConfiguredAllowlistKeys, o as modelKey, r as buildModelAliasIndex, s as normalizeModelRef, t as buildAllowedModelSet, v as DEFAULT_PROVIDER } from "./model-selection-DcO3qJOu.js";
 import { t as resolveAnimaAgentDir } from "./agent-paths-niQrLbGc.js";
 import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-BZryRo8-.js";
 import { c as assertMediaNotDataUrl, i as loadWorkspaceSkillEntries, l as assertSandboxPath, n as buildWorkspaceSkillCommandSpecs, o as resolvePluginSkillDirs, r as buildWorkspaceSkillSnapshot, u as resolveSandboxedMediaSource } from "./skills-DtoVe1dS.js";
 import { a as applyTestPluginDefaults, c as resolveEnableState, l as resolveMemorySlotDecision, n as discoverAnimaPlugins, s as normalizePluginsConfig, t as loadPluginManifestRegistry } from "./manifest-registry-W_OfCIRP.js";
-import { C as unsetConfigValueAtPath, M as VERSION, S as setConfigValueAtPath, _ as resetConfigOverrides, b as getConfigValueAtPath, c as resolveConfigSnapshotHash, g as getConfigOverrides, h as validateJsonSchemaValue, i as loadConfig, l as writeConfigFile, m as parseDurationMs, o as readConfigFileSnapshot, u as validateConfigObjectWithPlugins, v as setConfigOverride, x as parseConfigPath, y as unsetConfigOverride } from "./config-Ofh9gKvs.js";
+import { C as unsetConfigValueAtPath, M as VERSION, S as setConfigValueAtPath, _ as resetConfigOverrides, b as getConfigValueAtPath, c as resolveConfigSnapshotHash, g as getConfigOverrides, h as validateJsonSchemaValue, i as loadConfig, l as writeConfigFile, m as parseDurationMs, o as readConfigFileSnapshot, u as validateConfigObjectWithPlugins, v as setConfigOverride, x as parseConfigPath, y as unsetConfigOverride } from "./config-BrVuTQ8R.js";
 import { i as resolveShellEnvFallbackTimeoutMs, n as getShellPathFromLoginShell } from "./shell-env-2QqHvBMl.js";
-import { At as SESSION_LABEL_MAX_LENGTH, Mt as hasInterSessionUserProvenance } from "./client-DzIcZx4J.js";
-import { a as randomIdempotencyKey, n as callGateway } from "./call-DHZ76BNg.js";
-import { a as isInternalMessageChannel, c as listDeliverableMessageChannels, d as resolveMessageChannel, h as GATEWAY_CLIENT_NAMES, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, o as isMarkdownCapableMessageChannel, p as GATEWAY_CLIENT_IDS, t as INTERNAL_MESSAGE_CHANNEL, u as resolveGatewayMessageChannel } from "./message-channel-DdOBO6Qm.js";
-import { A as buildGroupDisplayName, D as listChannelDocks, E as getChannelDock, F as normalizeDeliveryContext, I as normalizeSessionDeliveryFields, M as deliveryContextFromSession, N as deliveryContextKey, O as resolveConversationLabel, P as mergeDeliveryContext, S as resolveMainSessionKey, _ as DEFAULT_RESET_TRIGGERS, a as readSessionUpdatedAt, b as resolveAgentMainSessionKey, c as updateLastRoute, d as resolveSessionKey$1, f as evaluateSessionFreshness, g as resolveThreadFlag, h as resolveSessionResetType, i as loadSessionStore, j as resolveGroupSessionKey, k as normalizeChatType, l as updateSessionStore, m as resolveSessionResetPolicy, n as appendAssistantMessageToSessionTranscript, o as recordSessionMetaFromInbound, p as resolveChannelResetConfig, t as extractDeliveryInfo, u as updateSessionStoreEntry, v as resolveFreshSessionTotalTokens, w as deriveSessionMetaPatch, y as canonicalizeMainSessionAlias } from "./sessions-1XK2mH6L.js";
+import { At as SESSION_LABEL_MAX_LENGTH, Mt as hasInterSessionUserProvenance } from "./client-CfLiulzK.js";
+import { a as randomIdempotencyKey, n as callGateway } from "./call-B4lhqS6H.js";
+import { a as isInternalMessageChannel, c as listDeliverableMessageChannels, d as resolveMessageChannel, h as GATEWAY_CLIENT_NAMES, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, o as isMarkdownCapableMessageChannel, p as GATEWAY_CLIENT_IDS, t as INTERNAL_MESSAGE_CHANNEL, u as resolveGatewayMessageChannel } from "./message-channel-DIHHKJhk.js";
+import { A as buildGroupDisplayName, D as listChannelDocks, E as getChannelDock, F as normalizeDeliveryContext, I as normalizeSessionDeliveryFields, M as deliveryContextFromSession, N as deliveryContextKey, O as resolveConversationLabel, P as mergeDeliveryContext, S as resolveMainSessionKey, _ as DEFAULT_RESET_TRIGGERS, a as readSessionUpdatedAt, b as resolveAgentMainSessionKey, c as updateLastRoute, d as resolveSessionKey$1, f as evaluateSessionFreshness, g as resolveThreadFlag, h as resolveSessionResetType, i as loadSessionStore, j as resolveGroupSessionKey, k as normalizeChatType, l as updateSessionStore, m as resolveSessionResetPolicy, n as appendAssistantMessageToSessionTranscript, o as recordSessionMetaFromInbound, p as resolveChannelResetConfig, t as extractDeliveryInfo, u as updateSessionStoreEntry, v as resolveFreshSessionTotalTokens, w as deriveSessionMetaPatch, y as canonicalizeMainSessionAlias } from "./sessions-C_3wTmSA.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText, t as HEARTBEAT_TOKEN } from "./tokens-CmlI2hSz.js";
-import { $ as makeBootstrapWarn, A as getTtsMaxLength, B as resolveTtsPrefsPath, C as resolveUserTimeFormat, D as sanitizeBinaryOutput, E as killProcessTree, F as maybeApplyTtsToPayload, G as setTtsMaxLength, H as setLastTtsAttempt, I as normalizeTtsAutoMode, J as textToSpeechTelephony, K as setTtsProvider, L as resolveTtsApiKey, M as isSummarizationEnabled, N as isTtsEnabled, O as buildTtsSystemPromptHint, P as isTtsProviderConfigured, Q as isVoiceCompatibleAudio, R as resolveTtsAutoMode, S as formatUserTime, T as getShellConfig, U as setSummarizationEnabled, W as setTtsEnabled, _ as resolveSessionIdToSend, b as buildAgentSystemPrompt, c as buildCliArgs, ct as resolveHeartbeatPrompt, d as cleanupSuspendedCliProcesses, et as resolveBootstrapContextForRun, f as enqueueCliRun, g as resolvePromptInput, h as parseCliJsonl, i as resolveRunWorkspaceDir, it as triggerInternalHook, j as getTtsProvider, k as getLastTtsAttempt, l as buildSystemPrompt, lt as stripHeartbeatToken, m as parseCliJson, nt as createInternalHookEvent, o as resolveAnimaDocsPath, p as normalizeCliModel, q as textToSpeech, r as redactRunIdentifier, rt as registerInternalHook, s as appendImagePathsToPrompt, t as runAnthropicDirectAgent, u as cleanupResumeProcesses, v as resolveSystemPromptUsage, w as resolveUserTimezone, x as buildSystemPromptParams, y as writeCliImages, z as resolveTtsConfig } from "./anthropic-direct-runner-CzQb7QkD.js";
+import { $ as isVoiceCompatibleAudio, A as getLastTtsAttempt, B as resolveTtsConfig, C as formatUserTime, D as killProcessTree, E as getShellConfig, F as isTtsProviderConfigured, G as setTtsEnabled, I as maybeApplyTtsToPayload, J as textToSpeech, K as setTtsMaxLength, L as normalizeTtsAutoMode, M as getTtsProvider, N as isSummarizationEnabled, O as sanitizeBinaryOutput, P as isTtsEnabled, R as resolveTtsApiKey, S as buildSystemPromptParams, T as resolveUserTimezone, U as setLastTtsAttempt, V as resolveTtsPrefsPath, W as setSummarizationEnabled, Y as textToSpeechTelephony, _ as resolvePromptInput, at as triggerInternalHook, b as writeCliImages, c as appendImagePathsToPrompt, d as cleanupResumeProcesses, et as makeBootstrapWarn, f as cleanupSuspendedCliProcesses, g as parseCliJsonl, h as parseCliJson, i as resolveRunWorkspaceDir, it as registerInternalHook, j as getTtsMaxLength, k as buildTtsSystemPromptHint, l as buildCliArgs, lt as resolveHeartbeatPrompt, m as normalizeCliModel, o as appendRunnerCapabilityPrompt, p as enqueueCliRun, q as setTtsProvider, r as redactRunIdentifier, rt as createInternalHookEvent, s as resolveAnimaDocsPath, t as runAnthropicDirectAgent, tt as resolveBootstrapContextForRun, u as buildSystemPrompt, ut as stripHeartbeatToken, v as resolveSessionIdToSend, w as resolveUserTimeFormat, x as buildAgentSystemPrompt, y as resolveSystemPromptUsage, z as resolveTtsAutoMode } from "./anthropic-direct-runner-C2Kwju-r.js";
 import { S as resolveBootstrapMaxChars, _ as isFailoverErrorMessage, a as normalizeElevatedLevel, b as sanitizeUserFacingText, c as normalizeUsageDisplay, d as supportsXHighThinking, g as isContextOverflowError, h as isCompactionFailureError, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, p as classifyFailoverReason, s as normalizeThinkLevel, t as formatThinkingLevels, u as resolveResponseUsageMode, v as isLikelyContextOverflowError, y as isTransientHttpError } from "./pi-embedded-helpers-D2SLlgS4.js";
-import { _ as resolveToolProfilePolicy, a as ensureSandboxWorkspaceForSession, c as resolveSandboxConfigForAgent, d as applyOwnerOnlyToolPolicy, f as buildPluginToolGroups, g as normalizeToolName, m as expandPolicyWithPluginGroups, o as resolveSandboxRuntimeStatus, p as collectExplicitAllowlist, s as getBridgeAuthForPort, v as stripPluginOnlyAllowlist } from "./sandbox-DDOFuJU9.js";
+import { _ as resolveToolProfilePolicy, a as ensureSandboxWorkspaceForSession, c as resolveSandboxConfigForAgent, d as applyOwnerOnlyToolPolicy, f as buildPluginToolGroups, g as normalizeToolName, m as expandPolicyWithPluginGroups, o as resolveSandboxRuntimeStatus, p as collectExplicitAllowlist, s as getBridgeAuthForPort, v as stripPluginOnlyAllowlist } from "./sandbox-D-N7M7lp.js";
 import { x as DEFAULT_AI_SNAPSHOT_MAX_CHARS } from "./chrome-CmxIwwsr.js";
 import { c as safeEqualSecret } from "./auth-Cp__MMeO.js";
-import { a as resolveBrowserConfig, h as resolveBrowserControlAuth } from "./server-context-Dkz4Ce8z.js";
-import { a as resolvePathsWithinRoot, i as DEFAULT_UPLOAD_DIR, n as getMediaDir, r as saveMediaBuffer } from "./routes-ZlpnlJFF.js";
+import { a as resolveBrowserConfig, h as resolveBrowserControlAuth } from "./server-context-Clykq0XU.js";
+import { a as resolvePathsWithinRoot, i as DEFAULT_UPLOAD_DIR, n as getMediaDir, r as saveMediaBuffer } from "./routes-CWCAc8uJ.js";
 import { n as formatErrorMessage, r as formatUncaughtError, t as extractErrorCode } from "./errors-COFgygw8.js";
 import { a as resizeToJpeg, c as getFileExtension, d as kindFromMime, h as SsrFBlockedError, l as imageMimeFromFormat, m as mediaKindFromMime, n as getImageMetadata, o as detectMime, s as extensionForMime, u as isAudioFileName, v as isBlockedHostname, y as isPrivateIpAddress } from "./image-ops-BdrMmiG4.js";
 import { n as listChannelPlugins, r as normalizeChannelId$1, t as getChannelPlugin } from "./plugins-BOMS6J5A.js";
 import { a as resolveSessionTranscriptPathInDir, c as resolveStorePath$1, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions } from "./paths-DMk3Q7yD.js";
 import { t as sanitizeToolResultImages } from "./tool-images-D1HuaGdS.js";
-import { i as resolveApiKeyForProvider, n as getCustomProviderApiKey, o as resolveEnvApiKey, r as requireApiKey, s as resolveModelAuthMode, t as getApiKeyForModel } from "./model-auth-CxAB4iZ0.js";
-import { _ as throwIfAborted, b as initializeGlobalHookRunner, c as applyReplyThreading, d as shouldSuppressMessagingToolReplies, f as createReplyToModeFilterForChannel, g as normalizeTargetForProvider, h as normalizeChannelTargetInput, l as filterMessagingToolDuplicates, m as buildTargetResolverSignature, o as normalizeReplyPayloadsForDelivery, p as resolveReplyToMode, s as applyReplyTagsToPayload, t as deliverOutboundPayloads, u as isRenderablePayload, v as parseReplyDirectives, y as getGlobalHookRunner } from "./deliver-DVt8TbK9.js";
-import { i as resolveMemoryBackendConfig, n as registerMemoryCli, r as getMemorySearchManager } from "./memory-cli-COl5xoIl.js";
-import { n as resolveMemorySearchConfig } from "./manager-Cvmm95Pf.js";
+import { i as resolveApiKeyForProvider, n as getCustomProviderApiKey, o as resolveEnvApiKey, r as requireApiKey, s as resolveModelAuthMode, t as getApiKeyForModel } from "./model-auth-KpsOXKDc.js";
+import { _ as throwIfAborted, b as initializeGlobalHookRunner, c as applyReplyThreading, d as shouldSuppressMessagingToolReplies, f as createReplyToModeFilterForChannel, g as normalizeTargetForProvider, h as normalizeChannelTargetInput, l as filterMessagingToolDuplicates, m as buildTargetResolverSignature, o as normalizeReplyPayloadsForDelivery, p as resolveReplyToMode, s as applyReplyTagsToPayload, t as deliverOutboundPayloads, u as isRenderablePayload, v as parseReplyDirectives, y as getGlobalHookRunner } from "./deliver-C1L5nO0K.js";
+import { i as resolveMemoryBackendConfig, n as registerMemoryCli, r as getMemorySearchManager } from "./memory-cli-B0kKl-9T.js";
+import { n as resolveMemorySearchConfig } from "./manager-C6L_DH0O.js";
+import { c as pruneExpiredPending, d as writeJsonAtomic, l as readJsonFile, s as createAsyncLock, u as resolvePairingPaths } from "./loader-C87TLS4J.js";
 import { a as jsonResult, c as readStringArrayParam, i as imageResultFromFile, l as readStringParam, o as readNumberParam, r as imageResult } from "./common-CqIa2poH.js";
-import { a as chunkText, c as resolveTextChunkLimit, i as chunkMarkdownTextWithMode, o as chunkTextWithMode, r as chunkMarkdownText, s as resolveChunkMode, t as chunkByNewline } from "./chunk-D3vyM2EQ.js";
-import { a as shouldHandleTextCommands, i as normalizeCommandBody, n as listChatCommands, r as listChatCommandsForConfig, t as parseTimeoutMs } from "./parse-timeout-DlU4ymhF.js";
+import { a as chunkText, c as resolveTextChunkLimit, i as chunkMarkdownTextWithMode, o as chunkTextWithMode, r as chunkMarkdownText, s as resolveChunkMode, t as chunkByNewline } from "./chunk-Cy0Bj0F3.js";
+import { a as shouldHandleTextCommands, i as normalizeCommandBody, n as listChatCommands, r as listChatCommandsForConfig, t as parseTimeoutMs } from "./parse-timeout-D4UO8pY_.js";
 import { n as formatTimeAgo } from "./format-relative-CBDSicUs.js";
 import { a as resolveMarkdownTableMode, c as loadWebMedia, d as readResponseWithLimit, f as fetchWithSsrFGuard, i as convertMarkdownTables, l as MediaFetchError, m as fetchWithTimeout, o as normalizePollInput, p as bindAbortRelay, s as getDefaultLocalRoots, t as getActiveWebListener, u as fetchRemoteMedia } from "./active-listener-gGCoq55D.js";
-import { n as ensureAnimaModelsJson, t as lookupContextTokens } from "./context-CpsnZLOp.js";
-import { a as resolveSubagentToolPolicy, c as addChannelAllowFromStoreEntry, d as upsertChannelPairingRequest, f as listPairingChannels, i as resolveGroupToolPolicy, l as readChannelAllowFromStore, n as isToolAllowedByPolicies, o as resolveChannelGroupPolicy, r as resolveEffectiveToolPolicy, s as resolveChannelGroupRequireMention, t as filterToolsByPolicy, u as removeChannelAllowFromStoreEntry } from "./pi-tools.policy-CDgjN_3f.js";
+import { n as ensureAnimaModelsJson, t as lookupContextTokens } from "./context-B5X720Bs.js";
+import { a as resolveSubagentToolPolicy, c as addChannelAllowFromStoreEntry, d as upsertChannelPairingRequest, f as listPairingChannels, i as resolveGroupToolPolicy, l as readChannelAllowFromStore, n as isToolAllowedByPolicies, o as resolveChannelGroupPolicy, r as resolveEffectiveToolPolicy, s as resolveChannelGroupRequireMention, t as filterToolsByPolicy, u as removeChannelAllowFromStoreEntry } from "./pi-tools.policy-D2FusuQa.js";
 import { a as minSecurity, c as recordAllowlistUse, d as resolveExecApprovalsFromFile, g as resolveSafeBins, h as evaluateShellAllowlist, i as maxAsk, l as requiresExecApproval, n as addAllowlistEntry, u as resolveExecApprovals, v as buildSafeBinsShellCommand, y as buildSafeShellCommand } from "./exec-approvals-CpOeHRBL.js";
 import { t as resolveNodeIdFromCandidates } from "./node-match-Cbt-ZqUE.js";
 import { t as formatDurationCompact$1 } from "./format-duration-BoQ6ac8g.js";
 import { c as derivePromptTokens, d as normalizeUsage, l as deriveSessionTotalTokens, n as loadCostUsageSummary, o as extractToolCallNames, r as loadSessionCostSummary, s as hasToolCall, u as hasNonzeroUsage } from "./session-cost-usage-DnxtnK1E.js";
 import { i as resolveModelCostConfig, n as formatTokenCount$2, r as formatUsd, t as estimateUsageCost } from "./usage-format-BGCAJt5K.js";
 import { d as resolveGatewaySystemdServiceName, l as resolveGatewayLaunchAgentLabel } from "./constants-Dt8s_a7s.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-D1oxSXVg.js";
-import { t as createBrowserRouteDispatcher } from "./dispatcher-DpSnqIL0.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-3CI4vt1h.js";
+import { t as createBrowserRouteDispatcher } from "./dispatcher-BQQugU-7.js";
 import { t as parseAbsoluteTimeMs } from "./parse-DLMgOMDI.js";
-import { a as logoutWeb, c as readWebSelfId, f as webAuthExists, i as logWebSelfId, n as getWebAuthAgeMs } from "./auth-store-Vfd6oc1G.js";
+import { t as TOKEN_PATH } from "./noxsoft-auth-CgCk5707.js";
+import { a as logoutWeb, c as readWebSelfId, f as webAuthExists, i as logWebSelfId, n as getWebAuthAgeMs } from "./auth-store-BEfSfCbW.js";
 import { createRequire } from "node:module";
 import { spawn, spawnSync } from "node:child_process";
 import process$1 from "node:process";
@@ -583,8 +585,7 @@ const DEFAULT_CODEX_BACKEND = {
 		"--json",
 		"--color",
 		"never",
-		"--sandbox",
-		"danger-full-access",
+		"--dangerously-bypass-approvals-and-sandbox",
 		"--skip-git-repo-check"
 	],
 	resumeArgs: [
@@ -662,6 +663,7 @@ const LEGACY_CODEX_RESUME_ARGS = [
 	"read-only",
 	"--skip-git-repo-check"
 ];
+const CODEX_BYPASS_FLAG = "--dangerously-bypass-approvals-and-sandbox";
 function normalizeBackendKey(key) {
 	return normalizeProviderId(key);
 }
@@ -698,29 +700,43 @@ function argsEqual(left, right) {
 	if (!left || !right || left.length !== right.length) return false;
 	return left.every((entry, index) => entry === right[index]);
 }
-function resolveCliSandboxArg(args) {
+function resolveCodexExecModeArg(args) {
 	if (!args) return;
+	if (args.includes(CODEX_BYPASS_FLAG)) return CODEX_BYPASS_FLAG;
 	const index = args.indexOf("--sandbox");
 	const value = index >= 0 ? args[index + 1] : void 0;
-	return typeof value === "string" && value.trim() ? value : void 0;
-}
-function setCliArgValue(args, flag, value) {
-	const nextArgs = [...args ?? []];
-	const index = nextArgs.indexOf(flag);
-	if (index >= 0 && nextArgs[index + 1]) {
-		nextArgs[index + 1] = value;
-		return nextArgs;
+	return value === "workspace-write" || value === "read-only" ? value : void 0;
+}
+function setCodexExecModeArgs(args, mode) {
+	const nextArgs = [];
+	const source = args ?? [];
+	for (let i = 0; i < source.length; i += 1) {
+		const entry = source[i];
+		if (entry === CODEX_BYPASS_FLAG) continue;
+		if (entry === "--sandbox") {
+			i += 1;
+			continue;
+		}
+		nextArgs.push(entry);
 	}
-	nextArgs.push(flag, value);
+	if (mode === CODEX_BYPASS_FLAG) nextArgs.push(CODEX_BYPASS_FLAG);
+	else nextArgs.push("--sandbox", mode);
 	return nextArgs;
 }
-function resolveManagedCodexSandbox(cfg) {
+function normalizeExecSecurity$2(execSecurity) {
+	const normalized = execSecurity?.trim().toLowerCase();
+	if (!normalized) return;
+	if (normalized === "deny") return "deny";
+	return "full";
+}
+function resolveManagedCodexExecMode(cfg, options) {
+	if (normalizeExecSecurity$2(options?.execSecurity) === "deny") return "read-only";
 	const workspaceAccess = cfg?.agents?.defaults?.sandbox?.workspaceAccess;
 	if (workspaceAccess === "ro") return "read-only";
 	if (workspaceAccess === "rw") return "workspace-write";
-	return "danger-full-access";
+	return CODEX_BYPASS_FLAG;
 }
-function resolveCliBackendConfig(provider, cfg) {
+function resolveCliBackendConfig(provider, cfg, options) {
 	const normalized = normalizeBackendKey(provider);
 	const configured = cfg?.agents?.defaults?.cliBackends ?? {};
 	if (CLAUDE_BACKEND_ALIAS_SET.has(normalized)) {
@@ -746,9 +762,9 @@ function resolveCliBackendConfig(provider, cfg) {
 			...merged,
 			resumeArgs: DEFAULT_CODEX_BACKEND.resumeArgs
 		};
-		if (!resolveCliSandboxArg(override?.args) || (override?.args ? argsEqual(override.args, LEGACY_CODEX_ARGS) : false)) merged = {
+		if (!resolveCodexExecModeArg(override?.args) || (override?.args ? argsEqual(override.args, LEGACY_CODEX_ARGS) : false)) merged = {
 			...merged,
-			args: setCliArgValue(merged.args, "--sandbox", resolveManagedCodexSandbox(cfg))
+			args: setCodexExecModeArgs(merged.args, resolveManagedCodexExecMode(cfg, options))
 		};
 		const command = merged.command?.trim();
 		if (!command) return null;
@@ -927,14 +943,14 @@ async function runCliAgent(params) {
 	const redactedWorkspace = redactRunIdentifier(resolvedWorkspace);
 	if (workspaceResolution.usedFallback) log$6.warn(`[workspace-fallback] caller=runCliAgent reason=${workspaceResolution.fallbackReason} run=${params.runId} session=${redactedSessionId} sessionKey=${redactedSessionKey} agent=${workspaceResolution.agentId} workspace=${redactedWorkspace}`);
 	const workspaceDir = resolvedWorkspace;
-	const backendResolved = resolveCliBackendConfig(params.provider, params.config);
+	const backendResolved = resolveCliBackendConfig(params.provider, params.config, { execSecurity: params.sessionExecSecurity });
 	if (!backendResolved) throw new Error(`Unknown CLI backend: ${params.provider}`);
 	const backend = backendResolved.config;
-	const effectiveCliSandbox = resolveCliSandboxArg(backend.args);
+	const effectiveCodexExecMode = resolveCodexExecModeArg(backend.args);
 	const modelId = (params.model ?? "default").trim() || "default";
 	const normalizedModel = normalizeCliModel(modelId, backend);
 	const modelDisplay = `${params.provider}/${modelId}`;
-	const extraSystemPrompt = [params.extraSystemPrompt?.trim(), "Tools are disabled in this session. Do not call tools."].filter(Boolean).join("\n");
+	const extraSystemPrompt = appendRunnerCapabilityPrompt(params.extraSystemPrompt, "cli-native");
 	const sessionLabel = params.sessionKey ?? params.sessionId;
 	const { contextFiles } = await resolveBootstrapContextForRun({
 		workspaceDir,
@@ -981,15 +997,24 @@ async function runCliAgent(params) {
 		const lines = (await readFile(params.sessionFile, "utf-8")).trim().split("\n");
 		const lastLine = lines[lines.length - 1];
 		if (lastLine) {
-			const effectiveSandbox = JSON.parse(lastLine).metadata?.effectiveSandbox;
-			const currentSandbox = effectiveCliSandbox;
-			if (effectiveSandbox && effectiveSandbox !== currentSandbox) {
-				log$6.info(`Codex sandbox changed (${effectiveSandbox} -> ${currentSandbox}); forcing session restart.`);
+			const parsed = JSON.parse(lastLine);
+			const previousMode = parsed.metadata?.effectiveCodexExecMode ?? parsed.metadata?.effectiveSandbox;
+			const currentMode = effectiveCodexExecMode;
+			if (!previousMode) {
+				log$6.info("Codex execution mode is unknown for the saved session; forcing session restart.");
+				useResume = false;
+				isNew = true;
+			} else if (previousMode !== currentMode) {
+				log$6.info(`Codex execution mode changed (${previousMode} -> ${currentMode}); forcing session restart.`);
 				useResume = false;
 				isNew = true;
 			}
 		}
-	} catch {}
+	} catch {
+		log$6.info("Codex session transcript is unavailable; forcing session restart.");
+		useResume = false;
+		isNew = true;
+	}
 	const sessionIdSent = cliSessionIdToSend ? useResume || Boolean(backend.sessionArg) || Boolean(backend.sessionArgs?.length) ? cliSessionIdToSend : void 0 : void 0;
 	const systemPromptArg = resolveSystemPromptUsage({
 		backend,
@@ -1105,8 +1130,9 @@ async function runCliAgent(params) {
 				if (stderr) log$6.debug(`cli stderr:\n${stderr}`);
 			}
 			if (result.code !== 0) {
-				const err = stderr || stdout || "CLI failed.";
-				const reason = classifyFailoverReason(err) ?? "unknown";
+				const timedOut = result.killed && result.signal === "SIGKILL";
+				const err = timedOut ? `Request timed out after ${params.timeoutMs}ms` : stderr || stdout || "CLI failed.";
+				const reason = timedOut ? "timeout" : classifyFailoverReason(err) ?? "unknown";
 				const status = resolveFailoverStatus(reason);
 				throw new FailoverError(err, {
 					reason,
@@ -1133,7 +1159,7 @@ async function runCliAgent(params) {
 					provider: params.provider,
 					model: modelId,
 					usage: output.usage,
-					...effectiveCliSandbox ? { metadata: { effectiveSandbox: effectiveCliSandbox } } : {}
+					...effectiveCodexExecMode ? { metadata: { effectiveCodexExecMode } } : {}
 				}
 			}
 		};
@@ -4568,7 +4594,7 @@ async function loadModelCatalog(params) {
 		});
 		try {
 			await ensureAnimaModelsJson(params?.config ?? loadConfig());
-			await (await import("./pi-auth-json-DjxzPUt3.js")).ensurePiAuthJsonFromAuthProfiles(resolveAnimaAgentDir());
+			await (await import("./pi-auth-json-DkYqdjrV.js")).ensurePiAuthJsonFromAuthProfiles(resolveAnimaAgentDir());
 			const piSdk = await importPiSdk();
 			const agentDir = resolveAnimaAgentDir();
 			const { join } = await import("node:path");
@@ -6363,8 +6389,8 @@ const resolveProfileOverride = (params) => {
 //#region src/auto-reply/reply/directive-handling.model-picker.ts
 const PROVIDER_RANK = new Map([
 	"anthropic",
-	"openai",
 	"openai-codex",
+	"openai",
 	"minimax",
 	"synthetic",
 	"google",
@@ -6680,7 +6706,7 @@ async function createModelSelectionState(params) {
 		}
 	}
 	if (sessionEntry && sessionStore && sessionKey && sessionEntry.authProfileOverride) {
-		const { ensureAuthProfileStore } = await import("./auth-profiles-BF5x9Ej0.js").then((n) => n.t);
+		const { ensureAuthProfileStore } = await import("./auth-profiles-Brxz2ojJ.js").then((n) => n.t);
 		const profile = ensureAuthProfileStore(void 0, { allowKeychainPrompt: false }).profiles[sessionEntry.authProfileOverride];
 		const providerKey = normalizeProviderId(provider);
 		if (!profile || normalizeProviderId(profile.provider) !== providerKey) await clearSessionAuthProfileOverride({
@@ -7748,58 +7774,6 @@ function ensureSkillsWatcher(params) {
 	watchers.set(workspaceDir, state);
 }
 
-//#endregion
-//#region src/infra/pairing-files.ts
-function resolvePairingPaths(baseDir, subdir) {
-	const root = baseDir ?? resolveStateDir();
-	const dir = path.join(root, subdir);
-	return {
-		dir,
-		pendingPath: path.join(dir, "pending.json"),
-		pairedPath: path.join(dir, "paired.json")
-	};
-}
-async function readJsonFile(filePath) {
-	try {
-		const raw = await fs$1.readFile(filePath, "utf8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-async function writeJsonAtomic(filePath, value) {
-	const dir = path.dirname(filePath);
-	await fs$1.mkdir(dir, { recursive: true });
-	const tmp = `${filePath}.${randomUUID()}.tmp`;
-	await fs$1.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
-	try {
-		await fs$1.chmod(tmp, 384);
-	} catch {}
-	await fs$1.rename(tmp, filePath);
-	try {
-		await fs$1.chmod(filePath, 384);
-	} catch {}
-}
-function pruneExpiredPending(pendingById, nowMs, ttlMs) {
-	for (const [id, req] of Object.entries(pendingById)) if (nowMs - req.ts > ttlMs) delete pendingById[id];
-}
-function createAsyncLock() {
-	let lock = Promise.resolve();
-	return async function withLock(fn) {
-		const prev = lock;
-		let release;
-		lock = new Promise((resolve) => {
-			release = resolve;
-		});
-		await prev;
-		try {
-			return await fn();
-		} finally {
-			release?.();
-		}
-	};
-}
-
 //#endregion
 //#region src/infra/pairing-token.ts
 const PAIRING_TOKEN_BYTES = 32;
@@ -16054,7 +16028,7 @@ async function routeReply(params) {
 	const resolvedReplyToId = replyToId ?? (channelId === "slack" && threadId != null && threadId !== "" ? String(threadId) : void 0);
 	const resolvedThreadId = channelId === "slack" ? null : threadId ?? null;
 	try {
-		const { deliverOutboundPayloads } = await import("./deliver-DVt8TbK9.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-C1L5nO0K.js").then((n) => n.n);
 		return {
 			ok: true,
 			messageId: (await deliverOutboundPayloads({
@@ -19469,6 +19443,275 @@ function createGatewayTool(opts) {
 	};
 }
 
+//#endregion
+//#region src/agents/model-auto.ts
+const DEFAULT_USAGE_THRESHOLD_PERCENT = 5;
+const USAGE_CACHE_TTL_MS = 6e4;
+const USAGE_TIMEOUT_MS = 1500;
+const usageSummaryCache = /* @__PURE__ */ new Map();
+function resolveRawAutoConfig(cfg) {
+	const modelConfig = cfg?.agents?.defaults?.model;
+	if (typeof modelConfig !== "object" || !modelConfig) return;
+	return modelConfig.auto;
+}
+function dedupeProviders(values) {
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const input of values) {
+		if (!input) continue;
+		const normalized = normalizeProviderId(input);
+		if (!normalized || seen.has(normalized)) continue;
+		seen.add(normalized);
+		result.push(normalized);
+	}
+	return result;
+}
+function resolveModelAutoConfig(cfg) {
+	const raw = resolveRawAutoConfig(cfg);
+	if (!raw?.enabled) return null;
+	const byProvider = {};
+	for (const [providerRaw, entry] of Object.entries(raw.byProvider ?? {})) {
+		const provider = normalizeProviderId(providerRaw);
+		if (!provider) continue;
+		const models = Array.isArray(entry?.models) ? entry.models.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
+		if (models.length > 0) byProvider[provider] = { models };
+	}
+	const usageThresholdPercent = typeof raw.usageThresholdPercent === "number" && Number.isFinite(raw.usageThresholdPercent) ? Math.max(0, Math.min(100, raw.usageThresholdPercent)) : DEFAULT_USAGE_THRESHOLD_PERCENT;
+	return {
+		enabled: true,
+		providerOrder: dedupeProviders(raw.providerOrder ?? []),
+		byProvider,
+		byWorkingMode: {
+			read: Array.isArray(raw.byWorkingMode?.read) ? raw.byWorkingMode.read.map((value) => String(value ?? "").trim()).filter(Boolean) : [],
+			write: Array.isArray(raw.byWorkingMode?.write) ? raw.byWorkingMode.write.map((value) => String(value ?? "").trim()).filter(Boolean) : []
+		},
+		usageCheck: raw.usageCheck === "prefer-available" ? "prefer-available" : "off",
+		usageThresholdPercent
+	};
+}
+function buildCandidatesFromRawModels(params) {
+	const defaultProvider = params.defaultProvider ?? DEFAULT_PROVIDER;
+	const index = buildModelAliasIndex({
+		cfg: params.cfg ?? {},
+		defaultProvider
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const raw of params.rawModels) {
+		const resolved = resolveModelRefFromString({
+			raw,
+			defaultProvider,
+			aliasIndex: index
+		});
+		if (!resolved) continue;
+		const key = modelKey(resolved.ref.provider, resolved.ref.model);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(resolved.ref);
+	}
+	return out;
+}
+function resolveWorkingModeModelSelection(params) {
+	if (!params.workingMode) return null;
+	const autoConfig = resolveModelAutoConfig(params.cfg);
+	if (!autoConfig) return null;
+	const modeModels = autoConfig.byWorkingMode[params.workingMode];
+	if (!modeModels || modeModels.length === 0) return null;
+	return buildCandidatesFromRawModels({
+		rawModels: modeModels,
+		cfg: params.cfg,
+		defaultProvider: params.defaultProvider
+	})[0] ?? null;
+}
+async function loadUsageSummary(agentDir, providers) {
+	const key = `${agentDir ?? "main"}::${providers.slice().toSorted().join(",")}`;
+	const now = Date.now();
+	const cached = usageSummaryCache.get(key);
+	if (cached && cached.expiresAt > now) return cached.summary;
+	const summary = await loadProviderUsageSummary({
+		agentDir,
+		providers,
+		timeoutMs: USAGE_TIMEOUT_MS
+	});
+	usageSummaryCache.set(key, {
+		expiresAt: now + USAGE_CACHE_TTL_MS,
+		summary
+	});
+	return summary;
+}
+function remainingPercent(snapshot) {
+	if (snapshot.error || snapshot.windows.length === 0) return;
+	const values = snapshot.windows.map((window) => 100 - window.usedPercent).filter((value) => Number.isFinite(value));
+	if (values.length === 0) return;
+	return Math.max(0, Math.min(...values));
+}
+async function resolveAvailability(params) {
+	const availability = /* @__PURE__ */ new Map();
+	const usageProviders = Array.from(new Set(params.providerOrder.map((provider) => resolveUsageProviderId(provider)).filter((provider) => Boolean(provider))));
+	let summary;
+	if (usageProviders.length > 0) try {
+		summary = await loadUsageSummary(params.agentDir, usageProviders);
+	} catch {
+		summary = void 0;
+	}
+	const snapshots = /* @__PURE__ */ new Map();
+	for (const entry of summary?.providers ?? []) snapshots.set(entry.provider, entry);
+	for (const provider of params.providerOrder) {
+		const usageProvider = resolveUsageProviderId(provider);
+		if (!usageProvider) {
+			availability.set(provider, {
+				provider,
+				state: "unknown"
+			});
+			continue;
+		}
+		const snapshot = snapshots.get(usageProvider);
+		const percent = snapshot ? remainingPercent(snapshot) : void 0;
+		availability.set(provider, {
+			provider,
+			usageProvider,
+			remainingPercent: percent,
+			state: percent === void 0 ? "unknown" : percent <= params.autoConfig.usageThresholdPercent ? "exhausted" : "available"
+		});
+	}
+	return availability;
+}
+function reorderByAvailability(params) {
+	const lockedPrimary = params.preservePrimary ? params.candidates[0] : void 0;
+	const rest = params.preservePrimary ? params.candidates.slice(1) : params.candidates;
+	const grouped = /* @__PURE__ */ new Map();
+	for (const candidate of rest) {
+		const normalized = normalizeProviderId(candidate.provider);
+		const group = grouped.get(normalized) ?? [];
+		group.push({
+			provider: normalized,
+			model: candidate.model
+		});
+		grouped.set(normalized, group);
+	}
+	const order = [];
+	for (const [provider, availability] of params.availability) if (availability.state === "available") order.push(provider);
+	for (const [provider, availability] of params.availability) if (availability.state === "unknown") order.push(provider);
+	for (const [provider, availability] of params.availability) if (availability.state === "exhausted") order.push(provider);
+	for (const provider of grouped.keys()) if (!order.includes(provider)) order.push(provider);
+	const ordered = [];
+	for (const provider of order) {
+		const group = grouped.get(provider) ?? [];
+		ordered.push(...group);
+	}
+	return lockedPrimary ? [lockedPrimary, ...ordered] : ordered;
+}
+async function applyAutoModelRouting(params) {
+	const autoConfig = resolveModelAutoConfig(params.cfg);
+	if (!autoConfig) return {
+		candidates: [...params.candidates],
+		autoConfigured: false,
+		preserveProviderOrder: false,
+		availabilityByProvider: /* @__PURE__ */ new Map()
+	};
+	const providerOrder = dedupeProviders([...autoConfig.providerOrder, ...params.candidates.map((candidate) => candidate.provider)]);
+	let candidates = [...params.candidates];
+	const modePreferred = params.workingMode ? buildCandidatesFromRawModels({
+		rawModels: autoConfig.byWorkingMode[params.workingMode] ?? [],
+		cfg: params.cfg,
+		defaultProvider: params.candidates[0]?.provider ?? DEFAULT_PROVIDER
+	}) : [];
+	if (modePreferred.length > 0) {
+		const lockedPrimary = params.preservePrimary && candidates.length > 0 ? [candidates[0]] : [];
+		const remainingCandidates = params.preservePrimary ? candidates.slice(1) : candidates;
+		const seen = /* @__PURE__ */ new Set();
+		candidates = [
+			...lockedPrimary,
+			...modePreferred,
+			...remainingCandidates
+		].filter((candidate) => {
+			const key = modelKey(candidate.provider, candidate.model);
+			if (seen.has(key)) return false;
+			seen.add(key);
+			return true;
+		});
+	}
+	const availability = await resolveAvailability({
+		providerOrder,
+		agentDir: params.agentDir,
+		autoConfig
+	});
+	if (autoConfig.usageCheck === "prefer-available") candidates = reorderByAvailability({
+		candidates,
+		availability,
+		preservePrimary: params.preservePrimary
+	});
+	return {
+		candidates,
+		autoConfigured: true,
+		preserveProviderOrder: true,
+		config: autoConfig,
+		availabilityByProvider: availability
+	};
+}
+
+//#endregion
+//#region src/agents/model-preference.ts
+const HIGH_THINK_LEVELS = new Set(["high", "xhigh"]);
+const SESSION_COST_THRESHOLD_USD = .5;
+const SESSION_TOKEN_THRESHOLD = 3e5;
+const SESSION_TURN_THRESHOLD = 12;
+const SESSION_COMPACTION_THRESHOLD = 2;
+function toPositiveFiniteNumber(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return;
+	return value;
+}
+function shouldPreferCheap(entry) {
+	if (!entry) return false;
+	const sessionCostUsd = toPositiveFiniteNumber(entry.sessionEstimatedCostUsdTotal) ?? 0;
+	const sessionInputTokens = toPositiveFiniteNumber(entry.sessionInputTokensTotal) ?? 0;
+	const sessionOutputTokens = toPositiveFiniteNumber(entry.sessionOutputTokensTotal) ?? 0;
+	const sessionTurnCount = toPositiveFiniteNumber(entry.sessionTurnCount) ?? 0;
+	const compactionCount = toPositiveFiniteNumber(entry.compactionCount) ?? 0;
+	return sessionCostUsd >= SESSION_COST_THRESHOLD_USD || sessionInputTokens + sessionOutputTokens >= SESSION_TOKEN_THRESHOLD || sessionTurnCount >= SESSION_TURN_THRESHOLD || compactionCount >= SESSION_COMPACTION_THRESHOLD;
+}
+function resolveCandidateCostScore(candidate, cfg) {
+	const cost = resolveModelCostConfig({
+		provider: candidate.provider,
+		model: candidate.model,
+		config: cfg
+	});
+	if (!cost) return;
+	const values = [
+		cost.input,
+		cost.output,
+		cost.cacheRead,
+		cost.cacheWrite
+	].filter((value) => typeof value === "number" && Number.isFinite(value));
+	if (values.length === 0) return;
+	return values.reduce((sum, value) => sum + value, 0);
+}
+function resolveUsageAwareModelPreference(params) {
+	if (params.sessionEntry?.providerOverride || params.sessionEntry?.modelOverride) return "preserve";
+	if (params.thinkLevel && HIGH_THINK_LEVELS.has(params.thinkLevel)) return "prefer-strong";
+	if (shouldPreferCheap(params.sessionEntry)) return "prefer-cheap";
+	return "preserve";
+}
+function orderCandidatesByPreference(params) {
+	const preferenceMode = params.preferenceMode ?? "preserve";
+	if (preferenceMode === "preserve" || params.candidates.length <= 1) return [...params.candidates];
+	const scoredCandidates = params.candidates.map((candidate) => ({
+		candidate,
+		score: resolveCandidateCostScore(candidate, params.cfg)
+	}));
+	const sortable = scoredCandidates.filter((entry) => entry.score !== void 0);
+	if (sortable.length < 2) return [...params.candidates];
+	sortable.sort((left, right) => preferenceMode === "prefer-cheap" ? left.score - right.score : right.score - left.score);
+	const reordered = sortable.map((entry) => entry.candidate);
+	let reorderedIndex = 0;
+	return scoredCandidates.map((entry) => {
+		if (entry.score === void 0) return entry.candidate;
+		const next = reordered[reorderedIndex];
+		reorderedIndex += 1;
+		return next;
+	});
+}
+
 //#endregion
 //#region src/agents/model-fallback.ts
 /**
@@ -19570,12 +19813,32 @@ function resolveFallbackCandidates(params) {
 	}, false);
 	return candidates;
 }
+function resolveWorkingModeFromSessionEntry(entry) {
+	const execSecurity = entry?.execSecurity?.trim().toLowerCase();
+	if (!execSecurity) return;
+	return execSecurity === "deny" ? "read" : "write";
+}
 async function runWithModelFallback(params) {
-	const candidates = resolveFallbackCandidates({
+	const preservePrimary = Boolean(params.sessionEntry?.providerOverride || params.sessionEntry?.modelOverride);
+	const resolvedWorkingMode = params.workingMode ?? resolveWorkingModeFromSessionEntry(params.sessionEntry);
+	const candidates = orderCandidatesByPreference({
+		candidates: (await applyAutoModelRouting({
+			candidates: resolveFallbackCandidates({
+				cfg: params.cfg,
+				provider: params.provider,
+				model: params.model,
+				fallbacksOverride: params.fallbacksOverride
+			}),
+			cfg: params.cfg,
+			agentDir: params.agentDir,
+			preservePrimary,
+			workingMode: resolvedWorkingMode
+		})).candidates,
 		cfg: params.cfg,
-		provider: params.provider,
-		model: params.model,
-		fallbacksOverride: params.fallbacksOverride
+		preferenceMode: resolveUsageAwareModelPreference({
+			thinkLevel: params.thinkLevel,
+			sessionEntry: params.sessionEntry
+		})
 	});
 	const authStore = params.cfg ? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }) : null;
 	const attempts = [];
@@ -20689,6 +20952,24 @@ function pickAmbiguousMatch(entries, mode) {
 	const bestRank = Math.max(...ranked.map((item) => item.rank));
 	return ranked.find((item) => item.rank === bestRank)?.entry ?? entries[0] ?? null;
 }
+function resolveConfiguredNoxsoftTarget(params) {
+	const trimmed = params.input.trim();
+	if (!trimmed) return null;
+	const configured = params.cfg.channels?.noxsoft?.channels;
+	if (!configured) return null;
+	const lower = trimmed.toLowerCase();
+	for (const [name, entry] of Object.entries(configured)) {
+		const channelId = entry?.id?.trim();
+		if (!channelId) continue;
+		if (lower === name.trim().toLowerCase() || trimmed === channelId) return {
+			to: channelId,
+			kind: "channel",
+			display: name,
+			source: "normalized"
+		};
+	}
+	return null;
+}
 async function resolveMessagingTarget(params) {
 	const raw = normalizeChannelTargetInput(params.input);
 	if (!raw) return {
@@ -20700,6 +20981,16 @@ async function resolveMessagingTarget(params) {
 	const hint = plugin?.messaging?.targetResolver?.hint;
 	const kind = detectTargetKind(params.channel, raw, params.preferredKind);
 	const normalized = normalizeTargetForProvider(params.channel, raw) ?? raw;
+	if (params.channel === "noxsoft") {
+		const configuredTarget = resolveConfiguredNoxsoftTarget({
+			cfg: params.cfg,
+			input: raw
+		});
+		if (configuredTarget) return {
+			ok: true,
+			target: configuredTarget
+		};
+	}
 	const looksLikeTargetId = () => {
 		const trimmed = raw.trim();
 		if (!trimmed) return false;
@@ -21115,13 +21406,62 @@ function resolveGatewayOptions(opts) {
 		mode: opts?.mode ?? GATEWAY_CLIENT_MODES.CLI
 	};
 }
+function resolveNoxsoftApiBase(cfg) {
+	return cfg.channels?.noxsoft?.apiUrl?.trim() || "https://auth.noxsoft.net";
+}
+function resolveNoxsoftToken(cfg) {
+	const inlineToken = cfg.channels?.noxsoft?.token?.trim();
+	if (inlineToken) return inlineToken;
+	const tokenFile = cfg.channels?.noxsoft?.tokenFile?.trim() || TOKEN_PATH;
+	try {
+		const token = fs.readFileSync(tokenFile, "utf-8").trim();
+		if (token) return token;
+	} catch {}
+	throw new Error(`NoxSoft token not configured. Expected token in ${tokenFile}`);
+}
+async function sendNoxsoftMessageDirect(params) {
+	if (params.dryRun) return {
+		channel: "noxsoft",
+		to: params.to,
+		via: "direct",
+		mediaUrl: params.mediaUrl,
+		mediaUrls: params.mediaUrls,
+		dryRun: true
+	};
+	const token = resolveNoxsoftToken(params.cfg);
+	const apiBase = resolveNoxsoftApiBase(params.cfg).replace(/\/+$/, "");
+	const response = await fetch(`${apiBase}/api/agents/chat/channels/${params.to}/messages`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			content: params.content,
+			mediaUrl: params.mediaUrl ?? void 0,
+			mediaUrls: params.mediaUrls?.length ? params.mediaUrls : void 0
+		}),
+		signal: params.abortSignal
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`NoxSoft send failed (${response.status}): ${text}`);
+	}
+	const payload = await response.json().catch(() => ({}));
+	const messageId = payload.messageId ?? payload.id ?? `noxsoft:${Date.now()}`;
+	return {
+		channel: "noxsoft",
+		to: params.to,
+		via: "direct",
+		mediaUrl: params.mediaUrl,
+		mediaUrls: params.mediaUrls,
+		result: { messageId }
+	};
+}
 async function sendMessage(params) {
 	const cfg = params.cfg ?? loadConfig();
-	const channel = params.channel?.trim() ? normalizeChannelId$1(params.channel) : (await resolveMessageChannelSelection({ cfg })).channel;
+	const channel = params.channel?.trim() ? normalizeMessageChannel(params.channel) : (await resolveMessageChannelSelection({ cfg })).channel;
 	if (!channel) throw new Error(`Unknown channel: ${params.channel}`);
-	const plugin = getChannelPlugin(channel);
-	if (!plugin) throw new Error(`Unknown channel: ${channel}`);
-	const deliveryMode = plugin.outbound?.deliveryMode ?? "direct";
 	const normalizedPayloads = normalizeReplyPayloadsForDelivery([{
 		text: params.content,
 		mediaUrl: params.mediaUrl,
@@ -21130,6 +21470,18 @@ async function sendMessage(params) {
 	const mirrorText = normalizedPayloads.map((payload) => payload.text).filter(Boolean).join("\n");
 	const mirrorMediaUrls = normalizedPayloads.flatMap((payload) => payload.mediaUrls ?? (payload.mediaUrl ? [payload.mediaUrl] : []));
 	const primaryMediaUrl = mirrorMediaUrls[0] ?? params.mediaUrl ?? null;
+	if (channel === "noxsoft") return sendNoxsoftMessageDirect({
+		cfg,
+		to: params.to,
+		content: params.content,
+		mediaUrl: primaryMediaUrl,
+		mediaUrls: mirrorMediaUrls.length ? mirrorMediaUrls : void 0,
+		dryRun: params.dryRun,
+		abortSignal: params.abortSignal
+	});
+	const plugin = getChannelPlugin(channel);
+	if (!plugin) throw new Error(`Unknown channel: ${channel}`);
+	const deliveryMode = plugin.outbound?.deliveryMode ?? "direct";
 	if (params.dryRun) return {
 		channel,
 		to: params.to,
@@ -21208,7 +21560,7 @@ async function sendMessage(params) {
 }
 async function sendPoll(params) {
 	const cfg = params.cfg ?? loadConfig();
-	const channel = params.channel?.trim() ? normalizeChannelId$1(params.channel) : (await resolveMessageChannelSelection({ cfg })).channel;
+	const channel = params.channel?.trim() ? normalizeMessageChannel(params.channel) : (await resolveMessageChannelSelection({ cfg })).channel;
 	if (!channel) throw new Error(`Unknown channel: ${params.channel}`);
 	const pollInput = {
 		question: params.question,
@@ -28944,6 +29296,8 @@ async function runAgentTurnWithFallback(params) {
 			provider: params.followupRun.run.provider,
 			model: params.followupRun.run.model,
 			agentDir: params.followupRun.run.agentDir,
+			sessionEntry: params.getActiveSessionEntry(),
+			thinkLevel: params.followupRun.run.thinkLevel,
 			fallbacksOverride: resolveAgentModelFallbacksOverride(params.followupRun.run.config, resolveAgentIdFromSessionKey(params.followupRun.run.sessionKey)),
 			run: (provider, model) => {
 				params.opts?.onModelSelected?.({
@@ -28951,97 +29305,8 @@ async function runAgentTurnWithFallback(params) {
 					model,
 					thinkLevel: params.followupRun.run.thinkLevel
 				});
-				if (isCliProvider(provider, params.followupRun.run.config)) {
-					const startedAt = Date.now();
-					emitAgentEvent$1({
-						runId,
-						stream: "lifecycle",
-						data: {
-							phase: "start",
-							startedAt
-						}
-					});
-					const cliSessionId = getCliSessionId(params.getActiveSessionEntry(), provider);
-					return (async () => {
-						let lifecycleTerminalEmitted = false;
-						let sawCliStream = false;
-						let lastCliStreamText = "";
-						try {
-							const result = await runCliAgent({
-								sessionId: params.followupRun.run.sessionId,
-								sessionKey: params.sessionKey,
-								agentId: params.followupRun.run.agentId,
-								sessionFile: params.followupRun.run.sessionFile,
-								workspaceDir: params.followupRun.run.workspaceDir,
-								config: params.followupRun.run.config,
-								prompt: params.commandBody,
-								provider,
-								model,
-								thinkLevel: params.followupRun.run.thinkLevel,
-								timeoutMs: params.followupRun.run.timeoutMs,
-								runId,
-								extraSystemPrompt: params.followupRun.run.extraSystemPrompt,
-								ownerNumbers: params.followupRun.run.ownerNumbers,
-								cliSessionId,
-								images: params.opts?.images,
-								onTextStream: (text) => {
-									const nextText = text.trim();
-									if (!nextText) return;
-									sawCliStream = true;
-									lastCliStreamText = nextText;
-									emitAgentEvent$1({
-										runId,
-										stream: "assistant",
-										data: { text: nextText }
-									});
-								}
-							});
-							const cliText = result.payloads?.[0]?.text?.trim();
-							if (cliText && (!sawCliStream || cliText !== lastCliStreamText)) emitAgentEvent$1({
-								runId,
-								stream: "assistant",
-								data: { text: cliText }
-							});
-							emitAgentEvent$1({
-								runId,
-								stream: "lifecycle",
-								data: {
-									phase: "end",
-									startedAt,
-									endedAt: Date.now()
-								}
-							});
-							lifecycleTerminalEmitted = true;
-							return result;
-						} catch (err) {
-							emitAgentEvent$1({
-								runId,
-								stream: "lifecycle",
-								data: {
-									phase: "error",
-									startedAt,
-									endedAt: Date.now(),
-									error: String(err)
-								}
-							});
-							lifecycleTerminalEmitted = true;
-							throw err;
-						} finally {
-							if (!lifecycleTerminalEmitted) emitAgentEvent$1({
-								runId,
-								stream: "lifecycle",
-								data: {
-									phase: "error",
-									startedAt,
-									endedAt: Date.now(),
-									error: "CLI run completed without lifecycle terminal event"
-								}
-							});
-						}
-					})();
-				}
 				const authProfileId = provider === params.followupRun.run.provider ? params.followupRun.run.authProfileId : void 0;
-				return runEmbeddedPiAgent({
+				return runNoxSoftEmbeddedAgent({
 					sessionId: params.followupRun.run.sessionId,
 					sessionKey: params.sessionKey,
 					agentId: params.followupRun.run.agentId,
@@ -29078,6 +29343,8 @@ async function runAgentTurnWithFallback(params) {
 					verboseLevel: params.followupRun.run.verboseLevel,
 					reasoningLevel: params.followupRun.run.reasoningLevel,
 					execOverrides: params.followupRun.run.execOverrides,
+					execSecurity: params.getActiveSessionEntry()?.execSecurity,
+					cliSessionId: getCliSessionId(params.getActiveSessionEntry(), provider),
 					toolResultFormat: (() => {
 						const channel = resolveMessageChannel(params.sessionCtx.Surface, params.sessionCtx.Provider);
 						if (!channel) return "markdown";
@@ -29109,6 +29376,11 @@ async function runAgentTurnWithFallback(params) {
 						});
 					} : void 0,
 					onAgentEvent: async (evt) => {
+						emitAgentEvent$1({
+							runId,
+							stream: evt.stream,
+							data: evt.data
+						});
 						if (evt.stream === "tool") {
 							const phase = typeof evt.data.phase === "string" ? evt.data.phase : "";
 							if (phase === "start" || phase === "update") await params.typingSignals.signalToolStart();
@@ -29378,10 +29650,12 @@ async function runMemoryFlushIfNeeded(params) {
 			provider: params.followupRun.run.provider,
 			model: params.followupRun.run.model,
 			agentDir: params.followupRun.run.agentDir,
+			sessionEntry: params.sessionEntry ?? (params.sessionKey ? params.sessionStore?.[params.sessionKey] : void 0) ?? void 0,
+			thinkLevel: params.followupRun.run.thinkLevel,
 			fallbacksOverride: resolveAgentModelFallbacksOverride(params.followupRun.run.config, resolveAgentIdFromSessionKey(params.followupRun.run.sessionKey)),
 			run: (provider, model) => {
 				const authProfileId = provider === params.followupRun.run.provider ? params.followupRun.run.authProfileId : void 0;
-				return runEmbeddedPiAgent({
+				return runNoxSoftEmbeddedAgent({
 					sessionId: params.followupRun.run.sessionId,
 					sessionKey: params.sessionKey,
 					agentId: params.followupRun.run.agentId,
@@ -29415,6 +29689,7 @@ async function runMemoryFlushIfNeeded(params) {
 					verboseLevel: params.followupRun.run.verboseLevel,
 					reasoningLevel: params.followupRun.run.reasoningLevel,
 					execOverrides: params.followupRun.run.execOverrides,
+					execSecurity: (params.sessionEntry ?? (params.sessionKey ? params.sessionStore?.[params.sessionKey] : void 0))?.execSecurity,
 					bashElevated: params.followupRun.run.bashElevated,
 					timeoutMs: params.followupRun.run.timeoutMs,
 					runId: flushRunId,
@@ -29750,10 +30025,12 @@ function createFollowupRunner(params) {
 					provider: queued.run.provider,
 					model: queued.run.model,
 					agentDir: queued.run.agentDir,
+					sessionEntry: (sessionKey ? sessionStore?.[sessionKey] : void 0) ?? sessionEntry ?? void 0,
+					thinkLevel: queued.run.thinkLevel,
 					fallbacksOverride: resolveAgentModelFallbacksOverride(queued.run.config, resolveAgentIdFromSessionKey(queued.run.sessionKey)),
 					run: (provider, model) => {
 						const authProfileId = provider === queued.run.provider ? queued.run.authProfileId : void 0;
-						return runEmbeddedPiAgent({
+						return runNoxSoftEmbeddedAgent({
 							sessionId: queued.run.sessionId,
 							sessionKey: queued.run.sessionKey,
 							agentId: queued.run.agentId,
@@ -29784,6 +30061,7 @@ function createFollowupRunner(params) {
 							verboseLevel: queued.run.verboseLevel,
 							reasoningLevel: queued.run.reasoningLevel,
 							execOverrides: queued.run.execOverrides,
+							execSecurity: ((sessionKey ? sessionStore?.[sessionKey] : void 0) ?? sessionEntry)?.execSecurity,
 							bashElevated: queued.run.bashElevated,
 							timeoutMs: queued.run.timeoutMs,
 							runId,
@@ -30764,7 +31042,7 @@ async function deliverSessionMaintenanceWarning(params) {
 		return;
 	}
 	try {
-		const { deliverOutboundPayloads } = await import("./deliver-DVt8TbK9.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-C1L5nO0K.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg: params.cfg,
 			channel,
@@ -32201,7 +32479,7 @@ function createWhatsAppLoginTool() {
 			force: Type.Optional(Type.Boolean())
 		}),
 		execute: async (_toolCallId, args) => {
-			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-657mh7cI.js");
+			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-DILcBA_q.js");
 			if ((args?.action ?? "start") === "wait") {
 				const result = await waitForWebLogin({ timeoutMs: typeof args.timeoutMs === "number" ? args.timeoutMs : void 0 });
 				return {
@@ -32376,23 +32654,23 @@ let webLoginQrPromise = null;
 let webChannelPromise = null;
 let whatsappActionsPromise = null;
 function loadWebOutbound() {
-	webOutboundPromise ??= import("./outbound-Rs0fFC2g.js").then((n) => n.t);
+	webOutboundPromise ??= import("./outbound-C577aWZp.js").then((n) => n.t);
 	return webOutboundPromise;
 }
 function loadWebLogin() {
-	webLoginPromise ??= import("./login-C54B66KM.js").then((n) => n.n);
+	webLoginPromise ??= import("./login-CrMpAZ0n.js").then((n) => n.n);
 	return webLoginPromise;
 }
 function loadWebLoginQr() {
-	webLoginQrPromise ??= import("./login-qr-657mh7cI.js");
+	webLoginQrPromise ??= import("./login-qr-DILcBA_q.js");
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-D8EsFSet.js");
+	webChannelPromise ??= import("./web-DvTXV-fo.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {
-	whatsappActionsPromise ??= import("./whatsapp-actions-tWRWRZ4X.js");
+	whatsappActionsPromise ??= import("./whatsapp-actions-C0tlEdLy.js");
 	return whatsappActionsPromise;
 }
 function createPluginRuntime() {
@@ -34466,15 +34744,6 @@ function createAnimaCodingTools(options) {
 
 //#endregion
 //#region src/agents/gemini-direct-runner.ts
-/**
-* Gemini Direct API Runner
-*
-* Makes calls directly to generativelanguage.googleapis.com without needing
-* a CLI wrapper. Works with Google API keys (GEMINI_API_KEY).
-*
-* This runner is automatically used when a google API key is available
-* and the provider is set to "google" or "gemini".
-*/
 const log = createSubsystemLogger("agent/gemini-direct");
 const DEFAULT_GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta";
 const MODEL_MAP = {
@@ -34566,7 +34835,7 @@ async function runGeminiDirectAgent(params) {
 		cwd: process.cwd(),
 		moduleUrl: import.meta.url
 	});
-	const extraSystemPrompt = [params.extraSystemPrompt?.trim()].filter(Boolean).join("\n");
+	const extraSystemPrompt = appendRunnerCapabilityPrompt(params.extraSystemPrompt, "local-tools");
 	const systemPrompt = buildSystemPrompt({
 		workspaceDir,
 		config: params.config,
@@ -34645,7 +34914,6 @@ async function runGeminiDirectAgent(params) {
 				};
 			}
 			if (!response.body) throw new Error("No response body received from Gemini API");
-			await params.onAssistantMessageStart?.();
 			const bodyStream = Readable.fromWeb(response.body);
 			let buffer = "";
 			let chunkAssistantText = "";
@@ -34671,12 +34939,11 @@ async function runGeminiDirectAgent(params) {
 							nonTextParts.push(p);
 							if (p.functionCall) functionCalls.push(p.functionCall);
 						}
-						if (parsed.candidates?.[0]?.finishReason) parsed.candidates[0].finishReason;
 						if (parsed.usageMetadata) {
 							totalInputTokens = Math.max(totalInputTokens, parsed.usageMetadata.promptTokenCount ?? 0);
 							totalOutputTokens += parsed.usageMetadata.candidatesTokenCount ?? 0;
 						}
-					} catch (e) {}
+					} catch {}
 				}
 			}
 			if (functionCalls.length > 0) {
@@ -34736,7 +35003,7 @@ async function runGeminiDirectAgent(params) {
 			const errorMsg = isAbort ? `Request timed out after ${params.timeoutMs}ms` : String(err);
 			log.error(`gemini api error: ${errorMsg}`, { error: String(err) });
 			return {
-				status: "failed",
+				status: isAbort ? "timeout" : "failed",
 				meta: {
 					durationMs: Date.now() - started,
 					error: {
@@ -34773,7 +35040,7 @@ async function runGeminiDirectAgent(params) {
 }
 
 //#endregion
-//#region src/agents/pi-embedded.ts
+//#region src/agents/noxsoft-runner.ts
 function normalizeEmbeddedProvider(provider) {
 	return normalizeProviderId(provider ?? "") || "anthropic";
 }
@@ -34794,178 +35061,375 @@ async function emitAgentEvent(params, stream, data) {
 		data
 	});
 }
-async function runEmbeddedPiAgent(...args) {
-	const params = args[0];
-	if (!params || typeof params !== "object") throw new Error("runEmbeddedPiAgent expected params object");
+function resolveDirectAuthProvider(provider) {
+	if (provider === "anthropic" || provider === "claude") return "anthropic";
+	if (provider === "google" || provider === "gemini") return "google";
+	return null;
+}
+function resolveProfileFailureReason(result) {
+	const kind = result.meta.error?.kind?.trim().toLowerCase();
+	if (kind === "auth") return "auth";
+	if (kind === "rate_limit") return "rate_limit";
+	const classified = classifyFailoverReason(result.meta.error?.message ?? "");
+	if (classified === "billing") return "billing";
+	if (classified === "auth") return "auth";
+	if (classified === "rate_limit") return "rate_limit";
+}
+function resolveResultErrorKind(result) {
+	const kind = result.meta.error?.kind?.trim().toLowerCase();
+	if (kind) return kind;
+	return result.status === "timeout" ? "timeout" : "unknown";
+}
+function normalizeResultStatus(result) {
+	const kind = resolveResultErrorKind(result);
+	if (result.status === "timeout" || kind === "timeout") return "timeout";
+	return result.status;
+}
+function normalizeResultPayloads(result) {
+	const payloads = result.payloads?.filter((payload) => payload && typeof payload === "object");
+	if (payloads && payloads.length > 0) return payloads;
+	const output = result.output?.trim();
+	return output ? [{ text: output }] : void 0;
+}
+function normalizeResultOutput(result, payloads) {
+	const directOutput = result.output?.trim();
+	if (directOutput) return directOutput;
+	return payloads?.find((payload) => payload.text?.trim())?.text?.trim() || void 0;
+}
+function normalizeRunnerResult(params) {
+	const payloads = normalizeResultPayloads(params.result);
+	const output = normalizeResultOutput(params.result, payloads);
+	const usage = normalizeUsage(params.result.meta.agentMeta?.usage);
+	const lastCallUsage = normalizeUsage(params.result.meta.agentMeta?.lastCallUsage);
+	const promptTokens = params.result.meta.agentMeta?.promptTokens ?? derivePromptTokens(usage ?? lastCallUsage);
+	const status = normalizeResultStatus(params.result);
+	const errorMessage = params.result.meta.error?.message?.trim();
+	const errorKind = resolveResultErrorKind(params.result);
+	return {
+		...params.result,
+		status,
+		output,
+		payloads,
+		meta: {
+			...params.result.meta,
+			error: status === "completed" && !errorMessage ? void 0 : {
+				message: errorMessage || (status === "timeout" ? "Request timed out." : "Runner execution failed."),
+				kind: errorKind
+			},
+			agentMeta: {
+				...params.result.meta.agentMeta,
+				sessionId: params.result.meta.agentMeta?.sessionId?.trim() || params.sessionId,
+				provider: params.provider,
+				model: params.model ?? params.result.meta.agentMeta?.model,
+				usage,
+				promptTokens,
+				lastCallUsage
+			}
+		}
+	};
+}
+function coerceResultFailure(params) {
+	if (params.result.status === "completed") return null;
+	const message = params.result.meta.error?.message?.trim() || (params.result.status === "timeout" ? "Request timed out." : "Runner execution failed.");
+	const reason = classifyFailoverReason(message) ?? resolveResultErrorKind(params.result);
+	return new FailoverError(message, {
+		reason: reason === "timeout" ? "timeout" : reason,
+		provider: params.provider,
+		model: params.model,
+		status: resolveFailoverStatus(reason)
+	});
+}
+async function resolveDirectProviderAuth(params) {
+	return resolveApiKeyForProvider({
+		provider: params.provider,
+		cfg: params.config,
+		preferredProfile: params.preferredProfile,
+		agentDir: params.agentDir,
+		store: params.store
+	});
+}
+async function runDirectWithProfileFallback(params) {
+	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+	const attemptedAuthSources = /* @__PURE__ */ new Set();
+	let preferredProfile = params.authProfileId;
+	let lastResult = null;
+	for (;;) {
+		const auth = await resolveDirectProviderAuth({
+			provider: params.directProvider,
+			config: params.config,
+			agentDir: params.agentDir,
+			preferredProfile,
+			store
+		});
+		const authSourceKey = auth.profileId ?? `${auth.mode}:${auth.source}`;
+		if (attemptedAuthSources.has(authSourceKey)) return lastResult ?? {
+			status: "failed",
+			meta: {
+				durationMs: 0,
+				error: {
+					message: `Auth fallback loop detected for ${params.directProvider}.`,
+					kind: "unknown"
+				}
+			}
+		};
+		attemptedAuthSources.add(authSourceKey);
+		const result = params.directProvider === "anthropic" ? await runAnthropicDirectAgent({
+			token: auth.apiKey ?? "",
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			agentId: params.agentId,
+			sessionFile: params.sessionFile,
+			workspaceDir: params.workspaceDir,
+			config: params.config,
+			prompt: params.prompt,
+			model: params.model,
+			thinkLevel: params.thinkLevel,
+			timeoutMs: params.timeoutMs,
+			runId: params.runId,
+			extraSystemPrompt: params.extraSystemPrompt,
+			ownerNumbers: params.ownerNumbers,
+			onPartialReply: params.emitPartial,
+			onAssistantMessageStart: params.onAssistantMessageStart
+		}) : await runGeminiDirectAgent({
+			apiKey: auth.apiKey ?? "",
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			agentId: params.agentId,
+			sessionFile: params.sessionFile,
+			workspaceDir: params.workspaceDir,
+			config: params.config,
+			prompt: params.prompt,
+			model: params.model,
+			thinkLevel: params.thinkLevel,
+			timeoutMs: params.timeoutMs,
+			runId: params.runId,
+			extraSystemPrompt: params.extraSystemPrompt,
+			ownerNumbers: params.ownerNumbers,
+			onPartialReply: params.emitPartial,
+			onAssistantMessageStart: params.onAssistantMessageStart
+		});
+		if (result.status === "completed") {
+			if (auth.profileId) {
+				await markAuthProfileUsed({
+					store,
+					profileId: auth.profileId,
+					agentDir: params.agentDir
+				});
+				await markAuthProfileGood({
+					store,
+					provider: params.directProvider,
+					profileId: auth.profileId,
+					agentDir: params.agentDir
+				});
+			}
+			return result;
+		}
+		lastResult = result;
+		const failureReason = resolveProfileFailureReason(result);
+		if (!auth.profileId || !failureReason) return result;
+		await markAuthProfileFailure({
+			store,
+			profileId: auth.profileId,
+			reason: failureReason,
+			cfg: params.config,
+			agentDir: params.agentDir
+		});
+		preferredProfile = void 0;
+	}
+}
+async function resolveDirectStrategy(provider, config, agentDir) {
+	const directProvider = resolveDirectAuthProvider(provider);
+	if (!directProvider) return null;
+	try {
+		const auth = await resolveDirectProviderAuth({
+			provider: directProvider,
+			config,
+			agentDir,
+			store: ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false })
+		});
+		if (auth.apiKey) {
+			if (directProvider === "anthropic" && auth.apiKey.startsWith("sk-ant-oat01-")) return null;
+			return {
+				kind: directProvider === "google" ? "gemini-direct" : "anthropic-direct",
+				provider
+			};
+		}
+	} catch {}
+	return null;
+}
+async function resolveNoxSoftRunnerStrategy(params) {
 	const provider = normalizeEmbeddedProvider(params.provider);
+	const direct = await resolveDirectStrategy(provider, params.config, params.agentDir);
+	if (direct) return direct;
+	const cliProvider = resolveCompatCliProvider(provider, params.config);
+	if (!resolveCliBackendConfig(cliProvider, params.config)) throw new Error(`No CLI backend available for provider "${provider}" (resolved "${cliProvider}").\nEither:\n  • Run: anima setup-token  (set an Anthropic API key — no CLI needed)\n  • Install the matching CLI and log in`);
+	return {
+		kind: "cli",
+		provider,
+		cliProvider
+	};
+}
+async function runNoxSoftEmbeddedAgent(params) {
+	const provider = normalizeEmbeddedProvider(params.provider);
+	const normalizedRequestedRef = params.model?.trim() ? normalizeModelRef(provider, params.model) : null;
 	const startedAt = Date.now();
 	const runId = params.runId?.trim() || crypto.randomUUID();
 	const timeoutMs = typeof params.timeoutMs === "number" && params.timeoutMs > 0 ? params.timeoutMs : 12e4;
 	let assistantStarted = false;
 	const streamTasks = [];
-	if (provider === "anthropic" || provider === "claude") {
-		const store = loadAuthProfileStore();
-		const profile = store.profiles["anthropic:default"] ?? store.profiles[store.lastGood?.["anthropic"] ?? ""] ?? null;
-		const directToken = profile?.type === "token" ? profile.token : profile?.type === "oauth" ? profile.access : null;
-		if (directToken) {
-			await emitAgentEvent(params, "lifecycle", {
-				phase: "start",
-				startedAt
-			});
-			try {
-				const result = await runAnthropicDirectAgent({
-					token: directToken,
-					sessionId: params.sessionId,
-					sessionKey: params.sessionKey,
-					agentId: params.agentId,
-					sessionFile: params.sessionFile,
-					workspaceDir: params.workspaceDir,
-					config: params.config,
-					prompt: params.prompt,
-					model: params.model,
-					thinkLevel: params.thinkLevel,
+	const emitPartial = async (payload) => {
+		if (!assistantStarted) {
+			assistantStarted = true;
+			await params.onAssistantMessageStart?.();
+		}
+		await params.onPartialReply?.(payload);
+		await emitAgentEvent(params, "assistant", { text: payload.text });
+	};
+	const strategy = await resolveNoxSoftRunnerStrategy({
+		provider: params.provider,
+		config: params.config,
+		agentDir: params.agentDir
+	});
+	if (strategy.kind === "anthropic-direct") {
+		await emitAgentEvent(params, "lifecycle", {
+			phase: "start",
+			startedAt
+		});
+		try {
+			const result = normalizeRunnerResult({
+				result: await runDirectWithProfileFallback({
+					...params,
+					directProvider: "anthropic",
 					timeoutMs,
 					runId,
-					extraSystemPrompt: params.extraSystemPrompt,
-					ownerNumbers: params.ownerNumbers,
-					onPartialReply: async (payload) => {
-						if (!assistantStarted) {
-							assistantStarted = true;
-							await params.onAssistantMessageStart?.();
-						}
-						await params.onPartialReply?.(payload);
-						await emitAgentEvent(params, "assistant", { text: payload.text });
-					},
-					onAssistantMessageStart: params.onAssistantMessageStart
-				});
-				await emitAgentEvent(params, "lifecycle", {
-					phase: "end",
-					durationMs: Date.now() - startedAt,
-					status: result.status
-				});
-				return result;
-			} catch (err) {
+					emitPartial
+				}),
+				provider: normalizedRequestedRef?.provider ?? provider,
+				model: normalizedRequestedRef?.model,
+				sessionId: params.sessionId
+			});
+			const failure = coerceResultFailure({
+				result,
+				provider: result.meta.agentMeta?.provider ?? provider,
+				model: result.meta.agentMeta?.model
+			});
+			if (failure) {
 				await emitAgentEvent(params, "lifecycle", {
 					phase: "error",
-					error: String(err instanceof Error ? err.message : err)
+					startedAt,
+					endedAt: Date.now(),
+					error: failure.message,
+					status: result.status
 				});
-				throw err;
+				throw failure;
 			}
-		}
-	}
-	if (provider === "google" || provider === "gemini") {
-		const geminiApiKey = (await resolveApiKeyForProvider({
-			provider: "google",
-			cfg: params.config
-		}))?.apiKey;
-		if (geminiApiKey) {
 			await emitAgentEvent(params, "lifecycle", {
-				phase: "start",
-				startedAt
+				phase: "end",
+				durationMs: Date.now() - startedAt,
+				status: result.status
 			});
-			try {
-				const result = await runGeminiDirectAgent({
-					apiKey: geminiApiKey,
-					sessionId: params.sessionId,
-					sessionKey: params.sessionKey,
-					agentId: params.agentId,
-					sessionFile: params.sessionFile,
-					workspaceDir: params.workspaceDir,
-					config: params.config,
-					prompt: params.prompt,
-					model: params.model,
-					thinkLevel: params.thinkLevel,
+			return result;
+		} catch (err) {
+			await emitAgentEvent(params, "lifecycle", {
+				phase: "error",
+				error: String(err instanceof Error ? err.message : err)
+			});
+			throw err;
+		}
+	}
+	if (strategy.kind === "gemini-direct") {
+		await emitAgentEvent(params, "lifecycle", {
+			phase: "start",
+			startedAt
+		});
+		try {
+			const result = normalizeRunnerResult({
+				result: await runDirectWithProfileFallback({
+					...params,
+					directProvider: "google",
 					timeoutMs,
 					runId,
-					extraSystemPrompt: params.extraSystemPrompt,
-					ownerNumbers: params.ownerNumbers,
-					onPartialReply: async (payload) => {
-						if (!assistantStarted) {
-							assistantStarted = true;
-							await params.onAssistantMessageStart?.();
-						}
-						await params.onPartialReply?.(payload);
-						await emitAgentEvent(params, "assistant", { text: payload.text });
-					},
-					onAssistantMessageStart: params.onAssistantMessageStart
-				});
-				await emitAgentEvent(params, "lifecycle", {
-					phase: "end",
-					durationMs: Date.now() - startedAt,
-					status: result.status
-				});
-				return result;
-			} catch (err) {
+					emitPartial
+				}),
+				provider: normalizedRequestedRef?.provider ?? provider,
+				model: normalizedRequestedRef?.model,
+				sessionId: params.sessionId
+			});
+			const failure = coerceResultFailure({
+				result,
+				provider: result.meta.agentMeta?.provider ?? provider,
+				model: result.meta.agentMeta?.model
+			});
+			if (failure) {
 				await emitAgentEvent(params, "lifecycle", {
 					phase: "error",
-					error: String(err instanceof Error ? err.message : err)
+					startedAt,
+					endedAt: Date.now(),
+					error: failure.message,
+					status: result.status
 				});
-				throw err;
+				throw failure;
 			}
+			await emitAgentEvent(params, "lifecycle", {
+				phase: "end",
+				durationMs: Date.now() - startedAt,
+				status: result.status
+			});
+			return result;
+		} catch (err) {
+			await emitAgentEvent(params, "lifecycle", {
+				phase: "error",
+				error: String(err instanceof Error ? err.message : err)
+			});
+			throw err;
 		}
 	}
-	const cliProvider = resolveCompatCliProvider(provider, params.config);
-	if (!resolveCliBackendConfig(cliProvider, params.config)) throw new Error(`No CLI backend available for provider "${provider}" (resolved "${cliProvider}").\nEither:\n  • Run: anima setup-token  (set an Anthropic API key — no CLI needed)\n  • Install the matching CLI and log in`);
 	await emitAgentEvent(params, "lifecycle", {
 		phase: "start",
 		startedAt
 	});
 	try {
-		const result = await runCliAgent({
-			sessionId: params.sessionId,
-			sessionKey: params.sessionKey,
-			agentId: params.agentId,
-			sessionFile: params.sessionFile,
-			workspaceDir: params.workspaceDir,
-			config: params.config,
-			prompt: params.prompt,
-			provider: cliProvider,
-			model: params.model,
-			thinkLevel: params.thinkLevel,
-			timeoutMs,
-			runId,
-			extraSystemPrompt: params.extraSystemPrompt,
-			ownerNumbers: params.ownerNumbers,
-			images: params.images,
-			onTextStream: (text) => {
-				const nextText = text.trim();
-				if (!nextText) return;
-				const task = (async () => {
-					if (!assistantStarted) {
-						assistantStarted = true;
-						await params.onAssistantMessageStart?.();
-					}
-					await params.onPartialReply?.({ text: nextText });
-					await emitAgentEvent(params, "assistant", { text: nextText });
-				})();
-				streamTasks.push(task);
-			}
+		const result = normalizeRunnerResult({
+			result: await runCliAgent({
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				agentId: params.agentId,
+				sessionFile: params.sessionFile,
+				workspaceDir: params.workspaceDir,
+				config: params.config,
+				prompt: params.prompt,
+				provider: strategy.cliProvider,
+				model: params.model,
+				thinkLevel: params.thinkLevel,
+				timeoutMs,
+				runId,
+				extraSystemPrompt: params.extraSystemPrompt,
+				ownerNumbers: params.ownerNumbers,
+				cliSessionId: params.cliSessionId,
+				sessionExecSecurity: params.execSecurity,
+				images: params.images,
+				streamParams: params.streamParams,
+				onTextStream: (text) => {
+					const nextText = text.trim();
+					if (!nextText) return;
+					streamTasks.push(emitPartial({ text: nextText }));
+				}
+			}),
+			provider: normalizedRequestedRef?.provider ?? provider,
+			model: normalizedRequestedRef?.model,
+			sessionId: params.sessionId
 		});
 		if (streamTasks.length > 0) await Promise.allSettled(streamTasks);
 		const finalText = result.payloads?.[0]?.text?.trim();
-		if (finalText && !assistantStarted) {
-			assistantStarted = true;
-			await params.onAssistantMessageStart?.();
-			await params.onPartialReply?.({ text: finalText });
-			await emitAgentEvent(params, "assistant", { text: finalText });
-		}
+		if (finalText && !assistantStarted) await emitPartial({ text: finalText });
 		await emitAgentEvent(params, "lifecycle", {
 			phase: "end",
 			startedAt,
 			endedAt: Date.now(),
-			aborted: false
+			aborted: false,
+			status: result.status
 		});
-		return {
-			...result,
-			meta: {
-				...result.meta,
-				agentMeta: {
-					...result.meta.agentMeta,
-					provider,
-					model: params.model?.trim() || result.meta.agentMeta?.model
-				}
-			}
-		};
+		return result;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		await emitAgentEvent(params, "lifecycle", {
@@ -34977,6 +35441,9 @@ async function runEmbeddedPiAgent(...args) {
 		throw error;
 	}
 }
+
+//#endregion
+//#region src/agents/pi-embedded.ts
 async function compactEmbeddedPiSession(..._args) {
 	return {
 		ok: true,
@@ -36124,4 +36591,4 @@ function initSubagentRegistry() {
 }
 
 //#endregion
-export { resolveOutboundSessionRoute as $, normalizeMimeList as $n, buildChannelSummary as $t, getTotalQueueSize as A, clearSessionAuthProfileOverride as An, applyBrowserProxyPaths as At, loadCombinedSessionStoreForGateway as B, registerUnhandledRejectionHandler as Bn, markGatewaySigusr1RestartHandled as Bt, createDedupeCache as C, createAsyncLock as Cn, runCliAgent as Cr, normalizePayloadToSystemText as Ct, setCliSessionId as D, writeJsonAtomic as Dn, getAgentRunContext as Dr, detectSuspiciousPatterns as Dt, getCliSessionId as E, resolvePairingPaths as En, emitAgentEvent$1 as Er, buildSafeExternalPrompt as Et, readLatestAssistantReply as F, isSystemEventContextChanged as Fn, CommandLane as Ft, archiveFileOnDisk as G, DEFAULT_INPUT_IMAGE_MIMES as Gn, parseActivationCommand as Gt, pruneLegacyStoreKeys as H, DEFAULT_INPUT_FILE_MAX_CHARS as Hn, setGatewaySigusr1RestartPolicy as Ht, resolveAnnounceTargetFromKey as I, peekSystemEventEntries as In, consumeGatewaySigusr1RestartAuthorization as It, readSessionMessages as J, DEFAULT_INPUT_PDF_MAX_PIXELS as Jn, maskApiKey as Jt, archiveSessionTranscripts as K, DEFAULT_INPUT_MAX_REDIRECTS as Kn, loadProviderUsageSummary as Kt, canonicalizeSpawnedByForAgent as L, peekSystemEvents as Ln, deferGatewayRestartUntilIdle as Lt, setCommandLaneConcurrency as M, applyVerboseOverride as Mn, extractShortModelName as Mt, waitForActiveTasks as N, parseVerboseOverride as Nn, AGENT_LANE_NESTED as Nt, getActiveTaskCount as O, getSkillsSnapshotVersion as On, onAgentEvent as Or, getHookType as Ot, createAnimaTools as P, enqueueSystemEvent as Pn, AGENT_LANE_SUBAGENT as Pt, ensureOutboundSessionEntry as Q, extractImageContentFromSource as Qn, resolveUsageProviderId as Qt, listAgentsForGateway as R, loadModelCatalog as Rn, emitGatewayRestart as Rt, getTotalPendingReplies as S, verifyPairingToken as Sn, resolveMessagePrefix as Sr, normalizeOptionalText as St, BARE_SESSION_RESET_PROMPT as T, readJsonFile as Tn, clearAgentRunContext as Tr, migrateLegacyCronPayload as Tt, resolveGatewaySessionStoreTarget as U, DEFAULT_INPUT_FILE_MIMES as Un, setPreRestartDeferralCheck as Ut, loadSessionEntry as V, DEFAULT_INPUT_FILE_MAX_BYTES as Vn, scheduleGatewaySigusr1Restart as Vt, resolveSessionModelRef as W, DEFAULT_INPUT_IMAGE_MAX_BYTES as Wn, normalizeGroupActivation as Wt, resolveSessionTranscriptCandidates as X, DEFAULT_INPUT_TIMEOUT_MS as Xn, formatUsageReportLines as Xt, readSessionPreviewItemsFromTranscript as Y, DEFAULT_INPUT_PDF_MIN_TEXT_CHARS as Yn, saveProviderStore as Yt, stripEnvelopeFromMessages as Z, extractFileContentFromSource as Zn, formatUsageWindowSummary as Zt, recordChannelActivity as _, renamePairedNode as _n, normalizeMentionText as _r, writeRestartSentinel as _t, runSubagentAnnounceFlow as a, normalizeSendPolicy as an, isDiagnosticsEnabled as ar, resolveHeartbeatSenderContext as at, dispatchInboundMessage as b, verifyNodeToken as bn, resolveIdentityName as br, inferLegacyName as bt, runEmbeddedPiAgent as c, primeRemoteSkillsCache as cn, formatInboundEnvelope as cr, resetDirectoryCache as ct, buildDefaultToolPolicyPipelineSteps as d, refreshRemoteNodeBins as dn, hasControlCommand as dr, consumeRestartSentinel as dt, buildChannelAccountSnapshot as en, estimateBase64DecodedBytes as er, buildAgentSessionKey as et, sniffMimeFromBase64 as f, removeRemoteNodeInfo as fn, shouldComputeCommandAuthorized as fr, formatDoctorNonInteractiveHint as ft, getChannelActivity as g, rejectNodePairing as gn, buildMentionRegexes as gr, trimLogTail as gt, buildPairingReply as h, listNodePairing as hn, CURRENT_MESSAGE_MARKER as hr, summarizeRestartSentinel as ht, subagent_registry_exports as i, setHeartbeatWakeHandler as in, stopDiagnosticHeartbeat as ir, resolveHeartbeatDeliveryTarget as it, resetAllLanes as j, applyModelOverrideToSessionEntry as jn, persistBrowserProxyFiles as jt, getQueueSize as k, registerSkillsChangeListener as kn, registerAgentRunContext as kr, isExternalHookSession as kt, waitForEmbeddedPiRunEnd as l, recordRemoteNodeInfo as ln, resolveEnvelopeFormatOptions as lr, resolveMessageChannelSelection as lt, loadAnimaPlugins as m, approveNodePairing as mn, stopSubagentsForRequester as mr, readRestartSentinel as mt, initSubagentRegistry as n, resolveCommitHash as nn, resolveAgentTimeoutMs as nr, buildChannelAccountBindings as nt, clearSessionQueues as o, resolveSendPolicy as on, createInboundDebouncer as or, resolveOutboundTarget as ot, getPluginToolMeta as p, setSkillsRemoteRegistry as pn, isAbortTrigger as pr, formatRestartSentinelMessage as pt, capArrayByJsonBytes as q, DEFAULT_INPUT_PDF_MAX_PAGES as qn, loadProviderStore as qt, listDescendantRunsForRequester as r, requestHeartbeatNow as rn, startDiagnosticHeartbeat as rr, resolvePreferredAccountId as rt, abortEmbeddedPiRun as s, getRemoteSkillEligibility as sn, resolveInboundDebounceMs as sr, resolveSessionDeliveryTarget as st, countActiveDescendantRuns as t, formatChannelAllowFrom as tn, finalizeInboundContext as tr, resolveAgentRoute as tt, applyToolPolicyPipeline as u, refreshRemoteBinsForConnectedNodes as un, formatZonedTimestamp as ur, runWithModelFallback as ut, shouldAckReactionForWhatsApp as v, requestNodePairing as vn, resolveAgentIdentity as vr, normalizeCronJobCreate as vt, getReplyFromConfig as w, pruneExpiredPending as wn, describeFailoverError as wr, normalizeRequiredName as wt, createReplyDispatcher as x, generatePairingToken as xn, resolveIdentityNamePrefix as xr, normalizeOptionalAgentId as xt, dispatchReplyWithBufferedBlockDispatcher as y, updatePairedNodeMetadata as yn, resolveEffectiveMessagesConfig as yr, normalizeCronJobPatch as yt, listSessionsFromStore as z, installUnhandledRejectionHandler as zn, isGatewaySigusr1RestartExternallyAllowed as zt };
+export { ensureOutboundSessionEntry as $, extractImageContentFromSource as $n, loadProviderStore as $t, getTotalQueueSize as A, registerSkillsChangeListener as An, CHANNEL_TARGETS_DESCRIPTION as At, loadCombinedSessionStoreForGateway as B, installUnhandledRejectionHandler as Bn, AGENT_LANE_SUBAGENT as Bt, createDedupeCache as C, renamePairedNode as Cn, resolveMessagePrefix as Cr, normalizeCronJobPatch as Ct, setCliSessionId as D, generatePairingToken as Dn, getAgentRunContext as Dr, normalizePayloadToSystemText as Dt, getCliSessionId as E, verifyNodeToken as En, emitAgentEvent$1 as Er, normalizeOptionalText as Et, readLatestAssistantReply as F, enqueueSystemEvent as Fn, isExternalHookSession as Ft, archiveFileOnDisk as G, DEFAULT_INPUT_IMAGE_MAX_BYTES as Gn, isGatewaySigusr1RestartExternallyAllowed as Gt, pruneLegacyStoreKeys as H, DEFAULT_INPUT_FILE_MAX_BYTES as Hn, consumeGatewaySigusr1RestartAuthorization as Ht, resolveAnnounceTargetFromKey as I, isSystemEventContextChanged as In, applyBrowserProxyPaths as It, readSessionMessages as J, DEFAULT_INPUT_PDF_MAX_PAGES as Jn, setGatewaySigusr1RestartPolicy as Jt, archiveSessionTranscripts as K, DEFAULT_INPUT_IMAGE_MIMES as Kn, markGatewaySigusr1RestartHandled as Kt, canonicalizeSpawnedByForAgent as L, peekSystemEventEntries as Ln, persistBrowserProxyFiles as Lt, setCommandLaneConcurrency as M, applyModelOverrideToSessionEntry as Mn, buildSafeExternalPrompt as Mt, waitForActiveTasks as N, applyVerboseOverride as Nn, detectSuspiciousPatterns as Nt, getActiveTaskCount as O, verifyPairingToken as On, onAgentEvent as Or, normalizeRequiredName as Ot, createAnimaTools as P, parseVerboseOverride as Pn, getHookType as Pt, runMessageAction as Q, extractFileContentFromSource as Qn, loadProviderUsageSummary as Qt, listAgentsForGateway as R, peekSystemEvents as Rn, extractShortModelName as Rt, getTotalPendingReplies as S, rejectNodePairing as Sn, resolveIdentityNamePrefix as Sr, normalizeCronJobCreate as St, BARE_SESSION_RESET_PROMPT as T, updatePairedNodeMetadata as Tn, clearAgentRunContext as Tr, normalizeOptionalAgentId as Tt, resolveGatewaySessionStoreTarget as U, DEFAULT_INPUT_FILE_MAX_CHARS as Un, deferGatewayRestartUntilIdle as Ut, loadSessionEntry as V, registerUnhandledRejectionHandler as Vn, CommandLane as Vt, resolveSessionModelRef as W, DEFAULT_INPUT_FILE_MIMES as Wn, emitGatewayRestart as Wt, resolveSessionTranscriptCandidates as X, DEFAULT_INPUT_PDF_MIN_TEXT_CHARS as Xn, normalizeGroupActivation as Xt, readSessionPreviewItemsFromTranscript as Y, DEFAULT_INPUT_PDF_MAX_PIXELS as Yn, setPreRestartDeferralCheck as Yt, stripEnvelopeFromMessages as Z, DEFAULT_INPUT_TIMEOUT_MS as Zn, parseActivationCommand as Zt, recordChannelActivity as _, refreshRemoteNodeBins as _n, buildMentionRegexes as _r, formatRestartSentinelMessage as _t, runSubagentAnnounceFlow as a, buildChannelSummary as an, stopDiagnosticHeartbeat as ar, resolveHeartbeatDeliveryTarget as at, dispatchInboundMessage as b, approveNodePairing as bn, resolveEffectiveMessagesConfig as br, trimLogTail as bt, waitForEmbeddedPiRunEnd as c, resolveCommitHash as cn, resolveInboundDebounceMs as cr, resolveSessionDeliveryTarget as ct, buildDefaultToolPolicyPipelineSteps as d, normalizeSendPolicy as dn, formatZonedTimestamp as dr, resolveMessageChannelSelection as dt, maskApiKey as en, normalizeMimeList as er, resolveOutboundSessionRoute as et, sniffMimeFromBase64 as f, resolveSendPolicy as fn, hasControlCommand as fr, CHANNEL_MESSAGE_ACTION_NAMES as ft, getChannelActivity as g, refreshRemoteBinsForConnectedNodes as gn, CURRENT_MESSAGE_MARKER as gr, formatDoctorNonInteractiveHint as gt, buildPairingReply as h, recordRemoteNodeInfo as hn, stopSubagentsForRequester as hr, consumeRestartSentinel as ht, subagent_registry_exports as i, resolveUsageProviderId as in, startDiagnosticHeartbeat as ir, resolvePreferredAccountId as it, resetAllLanes as j, clearSessionAuthProfileOverride as jn, CHANNEL_TARGET_DESCRIPTION as jt, getQueueSize as k, getSkillsSnapshotVersion as kn, registerAgentRunContext as kr, migrateLegacyCronPayload as kt, runNoxSoftEmbeddedAgent as l, requestHeartbeatNow as ln, formatInboundEnvelope as lr, formatTargetDisplay as lt, loadAnimaPlugins as m, primeRemoteSkillsCache as mn, isAbortTrigger as mr, resolveWorkingModeModelSelection as mt, initSubagentRegistry as n, formatUsageReportLines as nn, finalizeInboundContext as nr, resolveAgentRoute as nt, clearSessionQueues as o, buildChannelAccountSnapshot as on, isDiagnosticsEnabled as or, resolveHeartbeatSenderContext as ot, getPluginToolMeta as p, getRemoteSkillEligibility as pn, shouldComputeCommandAuthorized as pr, runWithModelFallback as pt, capArrayByJsonBytes as q, DEFAULT_INPUT_MAX_REDIRECTS as qn, scheduleGatewaySigusr1Restart as qt, listDescendantRunsForRequester as r, formatUsageWindowSummary as rn, resolveAgentTimeoutMs as rr, buildChannelAccountBindings as rt, abortEmbeddedPiRun as s, formatChannelAllowFrom as sn, createInboundDebouncer as sr, resolveOutboundTarget as st, countActiveDescendantRuns as t, saveProviderStore as tn, estimateBase64DecodedBytes as tr, buildAgentSessionKey as tt, applyToolPolicyPipeline as u, setHeartbeatWakeHandler as un, resolveEnvelopeFormatOptions as ur, resetDirectoryCache as ut, shouldAckReactionForWhatsApp as v, removeRemoteNodeInfo as vn, normalizeMentionText as vr, readRestartSentinel as vt, getReplyFromConfig as w, requestNodePairing as wn, describeFailoverError as wr, inferLegacyName as wt, createReplyDispatcher as x, listNodePairing as xn, resolveIdentityName as xr, writeRestartSentinel as xt, dispatchReplyWithBufferedBlockDispatcher as y, setSkillsRemoteRegistry as yn, resolveAgentIdentity as yr, summarizeRestartSentinel as yt, listSessionsFromStore as z, loadModelCatalog as zn, AGENT_LANE_NESTED as zt };