@runtypelabs/cli 2.2.0 → 2.2.1

package/dist/index.js

@@ -5,10 +5,16 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod) => function __require() {
+var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __export = (target, all) => {
@@ -147,6 +153,33 @@ var init_credential_store = __esm({
   }
 });
 
+// ../shared/dist/integration-providers.js
+var require_integration_providers = __commonJS({
+  "../shared/dist/integration-providers.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.NON_AI_PROVIDER_IDS = void 0;
+    exports.isNonAIProvider = isNonAIProvider2;
+    exports.NON_AI_PROVIDER_IDS = /* @__PURE__ */ new Set([
+      // Analytics & Tracking
+      "posthog",
+      // Development Tools
+      "daytona",
+      // Web Scraping & Data Extraction
+      "firecrawl",
+      // Search Providers
+      "exa",
+      // Email Services
+      "resend",
+      // Audio / Speech
+      "elevenlabs"
+    ]);
+    function isNonAIProvider2(id) {
+      return exports.NON_AI_PROVIDER_IDS.has(id.trim().toLowerCase());
+    }
+  }
+});
+
 // ../shared/dist/builtin-tools-registry.js
 var require_builtin_tools_registry = __commonJS({
   "../shared/dist/builtin-tools-registry.js"(exports) {
@@ -4565,8 +4598,8 @@ var CallbackServer = class {
   expectedState;
   constructor() {
     this.app = express();
-    this.codePromise = new Promise((resolve7, reject) => {
-      this.codeResolve = resolve7;
+    this.codePromise = new Promise((resolve8, reject) => {
+      this.codeResolve = resolve8;
       this.codeReject = reject;
     });
     this.app.get("/callback", (req, res) => {
@@ -5761,14 +5794,14 @@ async function promptConfirm(message, options) {
     output: process.stdout,
     terminal: true
   });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(chalk2.cyan(`${message} (${hint}): `), (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
       if (trimmed === "") {
-        resolve7(defaultYes);
+        resolve8(defaultYes);
       } else {
-        resolve7(trimmed === "y" || trimmed === "yes");
+        resolve8(trimmed === "y" || trimmed === "yes");
       }
     });
   });
@@ -5843,13 +5876,24 @@ function getCliVersion() {
   if (cachedCliVersion) {
     return cachedCliVersion;
   }
-  try {
-    const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    cachedCliVersion = pkg.version || "0.0.0";
-  } catch {
-    cachedCliVersion = "0.0.0";
+  const base = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(base, "..", "..", "package.json"),
+    // src/lib/ → package root
+    join(base, "..", "package.json")
+    // dist/   → package root
+  ];
+  for (const pkgPath of candidates) {
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+      if (pkg.name === CLI_PACKAGE_NAME && pkg.version) {
+        cachedCliVersion = pkg.version;
+        return cachedCliVersion;
+      }
+    } catch {
+    }
   }
+  cachedCliVersion = "0.0.0";
   return cachedCliVersion;
 }
 
@@ -5869,9 +5913,9 @@ var ApiClient = class {
     this.baseUrl = baseUrl || getApiUrl();
   }
   /** Prefix path with API version (e.g. /v1) so all requests hit versioned routes. */
-  path(path13) {
+  path(path14) {
     const version = getApiVersion();
-    const p = path13.startsWith("/") ? path13 : `/${path13}`;
+    const p = path14.startsWith("/") ? path14 : `/${path14}`;
     return p.startsWith(`/${version}/`) ? p : `/${version}${p}`;
   }
   headers(extra) {
@@ -5904,8 +5948,8 @@ var ApiClient = class {
     }
     return response.json();
   }
-  async get(path13, params) {
-    const url = new URL(this.path(path13), this.baseUrl);
+  async get(path14, params) {
+    const url = new URL(this.path(path14), this.baseUrl);
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         if (value !== void 0 && value !== "") {
@@ -5918,32 +5962,32 @@ var ApiClient = class {
     });
     return this.handleResponse(response);
   }
-  async post(path13, body) {
-    const response = await fetch(new URL(this.path(path13), this.baseUrl).toString(), {
+  async post(path14, body) {
+    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
       method: "POST",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async put(path13, body) {
-    const response = await fetch(new URL(this.path(path13), this.baseUrl).toString(), {
+  async put(path14, body) {
+    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
       method: "PUT",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async patch(path13, body) {
-    const response = await fetch(new URL(this.path(path13), this.baseUrl).toString(), {
+  async patch(path14, body) {
+    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
       method: "PATCH",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async delete(path13) {
-    const response = await fetch(new URL(this.path(path13), this.baseUrl).toString(), {
+  async delete(path14) {
+    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
       method: "DELETE",
       headers: this.headers()
     });
@@ -5957,8 +6001,8 @@ var ApiClient = class {
       throw new ApiError(response.status, message);
     }
   }
-  async stream(path13, body) {
-    const response = await fetch(new URL(this.path(path13), this.baseUrl).toString(), {
+  async stream(path14, body) {
+    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
       method: "POST",
       headers: this.headers({ Accept: "text/event-stream" }),
       body: body !== void 0 ? JSON.stringify(body) : void 0
@@ -8346,6 +8390,7 @@ import React9 from "react";
 import { useState as useState22, useEffect as useEffect19, useRef as useRef9, useCallback as useCallback8, useMemo as useMemo11 } from "react";
 import { execSync } from "child_process";
 import * as fs4 from "fs";
+import * as path4 from "path";
 import open4 from "open";
 import { Box as Box28, Text as Text28, useApp as useApp4, useInput as useInput11, useStdout as useStdout5 } from "ink";
 import { StatusBar, theme as theme31 } from "@runtypelabs/ink-components";
@@ -8570,7 +8615,8 @@ function formatContextCompactionCompleteLine(event) {
   return thresholdLabel ? `[context] History compacted ${modeLabel}${modelLabel}${strategyLabel} at ${thresholdLabel}${breakdownLabel}.` : `[context] History compacted ${modeLabel}${modelLabel}${strategyLabel}${breakdownLabel}.`;
 }
 function formatContextNoticeLine(event) {
-  return `[context] ${event.message}`;
+  const prefix = event.kind === "server_network_retry" ? "[retry]" : "[context]";
+  return `${prefix} ${event.message}`;
 }
 var toolCounter = 0;
 function useMarathonStream() {
@@ -8578,6 +8624,7 @@ function useMarathonStream() {
   const rawEventsRef = useRef3([]);
   const stateRef = useRef3(state);
   stateRef.current = state;
+  const costOffsetRef = useRef3(0);
   const eventWriterRef = useRef3(null);
   const toolPayloadsRef = useRef3(/* @__PURE__ */ new Map());
   const hydrateToolEntry = useCallback2((tool) => {
@@ -8958,7 +9005,7 @@ function useMarathonStream() {
               executionTime: Date.now() - (t.localExecutionStartedAt ?? t.startedAt)
             } : t
           ),
-          totalCost: event.totalCost != null ? event.totalCost : prev.totalCost,
+          totalCost: event.totalCost != null ? costOffsetRef.current + event.totalCost : prev.totalCost,
           totalInputTokens: event.totalTokens?.input ?? prev.totalInputTokens,
           totalOutputTokens: event.totalTokens?.output ?? prev.totalOutputTokens
         }));
@@ -9040,18 +9087,21 @@ function useMarathonStream() {
   }, []);
   const resetForNewSession = useCallback2(() => {
     toolPayloadsRef.current.clear();
-    setState((prev) => ({
-      ...prev,
-      phase: "idle",
-      content: "",
-      reasoning: "",
-      lastTranscriptKind: null,
-      thinkingStartedAt: null,
-      tools: [],
-      currentIteration: 0,
-      error: null,
-      contextCompaction: null
-    }));
+    setState((prev) => {
+      costOffsetRef.current = prev.totalCost;
+      return {
+        ...prev,
+        phase: "idle",
+        content: "",
+        reasoning: "",
+        lastTranscriptKind: null,
+        thinkingStartedAt: null,
+        tools: [],
+        currentIteration: 0,
+        error: null,
+        contextCompaction: null
+      };
+    });
   }, []);
   const showError = useCallback2((error) => {
     pushRawEvent(rawEventsRef, "agent_error", { message: error.message }, eventWriterRef);
@@ -10357,6 +10407,10 @@ function FileContentView({
             separator,
             "from tool call"
           ] }),
+          /* @__PURE__ */ jsxs14(Text16, { color: theme17.textSubtle, children: [
+            separator,
+            "o: open"
+          ] }),
           /* @__PURE__ */ jsxs14(Text16, { color: theme17.textSubtle, children: [
             separator,
             "c: copy"
@@ -10459,6 +10513,14 @@ function FilesPanel({
             separator,
             files.length,
             " files"
+          ] }),
+          /* @__PURE__ */ jsxs14(Text16, { color: theme17.border, children: [
+            separator,
+            "Enter: view",
+            separator,
+            "o: open",
+            separator,
+            "c: copy path"
           ] })
         ] }),
         /* @__PURE__ */ jsxs14(Box15, { flexDirection: "row", children: [
@@ -11959,7 +12021,7 @@ function CheckpointRecap({
     `Tools: ${toolCallsMade}`,
     `Tokens: ${formatTokenCount2(tokensInput)} in${separator}${formatTokenCount2(tokensOutput)} out`,
     ...reasoningTokens && reasoningTokens > 0 ? [`Reasoning: ${formatTokenCount2(reasoningTokens)}`] : [],
-    `Cost: $${cost.toFixed(4)}`
+    `Total cost: $${cost.toFixed(4)}`
   ].join(separator);
   return /* @__PURE__ */ jsxs19(
     Box20,
@@ -13090,8 +13152,8 @@ function MarathonApp({
           setIsTerminalCheckpoint(true);
           isTerminalCheckpointRef.current = true;
         }
-        return new Promise((resolve7) => {
-          checkpointResolveRef.current = resolve7;
+        return new Promise((resolve8) => {
+          checkpointResolveRef.current = resolve8;
         });
       },
       updateMilestone: (milestone) => {
@@ -13417,7 +13479,7 @@ function MarathonApp({
       setUpgradeModalDismissed(true);
       return;
     }
-    if (_input === "o" && agentPageUrl && !(state.phase === "checkpoint" && checkpointRecap)) {
+    if (_input === "o" && agentPageUrl && !showFilesPanel && !(state.phase === "checkpoint" && checkpointRecap)) {
       void open4(agentPageUrl);
       return;
     }
@@ -13573,6 +13635,19 @@ function MarathonApp({
       setReasoningCollapsed((prev) => !prev);
       return;
     }
+    if (_input === "o" && showFilesPanel) {
+      const file = detailFile ?? trackedFiles[fileCursor];
+      if (file) {
+        const filePath = path4.resolve(file.path);
+        if (fs4.existsSync(filePath)) {
+          void open4(filePath);
+          showFlash(`Opening ${file.path}`);
+        } else {
+          showFlash("File not found on disk");
+        }
+      }
+      return;
+    }
     if (_input === "c" && showFilesPanel) {
       if (detailFile && detailFileContent) {
         const ok = copyToClipboard(detailFileContent);
@@ -14325,7 +14400,8 @@ function buildPromptShellModel(prompt, columnWidth) {
 }
 function MarathonStartupShell({
   startupRef,
-  marathonAppProps
+  marathonAppProps,
+  version
 }) {
   const { exit } = useApp5();
   const { stdout } = useStdout6();
@@ -14351,16 +14427,16 @@ function MarathonStartupShell({
   latestAppPropsRef.current = marathonAppProps;
   useEffect20(() => {
     if (scene !== "app" || !appReadyResolverRef.current) return;
-    const resolve7 = appReadyResolverRef.current;
+    const resolve8 = appReadyResolverRef.current;
     appReadyResolverRef.current = null;
-    resolve7();
+    resolve8();
   }, [scene]);
   const beginTransition = (target) => {
     if (transitionPromiseRef.current) return transitionPromiseRef.current;
     if (target === "app" && !latestAppPropsRef.current) {
       throw new Error("Cannot complete startup before marathon app props are ready.");
     }
-    const promise = new Promise((resolve7) => {
+    const promise = new Promise((resolve8) => {
       globalThis.setTimeout(() => {
         setPrompt(null);
         setModelChoices(null);
@@ -14381,12 +14457,12 @@ function MarathonStartupShell({
         if (target === "app") {
           appReadyResolverRef.current = () => {
             transitionPromiseRef.current = null;
-            resolve7();
+            resolve8();
           };
         } else {
           dismissResolverRef.current = () => {
             transitionPromiseRef.current = null;
-            resolve7();
+            resolve8();
           };
         }
       }, Math.max(0, MIN_HOLD_MS - (Date.now() - mountedAtRef.current)));
@@ -14403,8 +14479,8 @@ function MarathonStartupShell({
         setModelChoices(null);
         setPrompt(nextPrompt);
         setSelectedPromptIndex(0);
-        return new Promise((resolve7) => {
-          promptResolverRef.current = resolve7;
+        return new Promise((resolve8) => {
+          promptResolverRef.current = resolve8;
         });
       },
       requestModelChoice: async (nextCurrentModel, models) => {
@@ -14412,8 +14488,8 @@ function MarathonStartupShell({
         setPlaybookConfirm(null);
         setCurrentModel(nextCurrentModel);
         setModelChoices(models);
-        return new Promise((resolve7) => {
-          modelResolverRef.current = resolve7;
+        return new Promise((resolve8) => {
+          modelResolverRef.current = resolve8;
         });
       },
       requestPlaybookModelConfirm: async (playbookName, milestoneModels) => {
@@ -14428,8 +14504,8 @@ function MarathonStartupShell({
           // Default selection is the "Confirm" action (first item after milestones)
           selectedIndex: names.length
         });
-        return new Promise((resolve7) => {
-          playbookConfirmResolverRef.current = resolve7;
+        return new Promise((resolve8) => {
+          playbookConfirmResolverRef.current = resolve8;
         });
       },
       completeStartup: () => beginTransition("app"),
@@ -14579,6 +14655,22 @@ function MarathonStartupShell({
         children: /* @__PURE__ */ jsx34(StartupGridIconCompactLightInverted, { autoplay: false })
       }
     ),
+    version && /* @__PURE__ */ jsx34(
+      Box29,
+      {
+        position: "absolute",
+        width: terminalWidth,
+        height: terminalRows,
+        alignItems: "flex-end",
+        justifyContent: "flex-end",
+        paddingX: 2,
+        paddingY: 1,
+        children: /* @__PURE__ */ jsxs27(Text29, { color: theme32.border, children: [
+          "v",
+          version
+        ] })
+      }
+    ),
     /* @__PURE__ */ jsx34(
       Box29,
       {
@@ -14680,23 +14772,25 @@ function MarathonStartupShell({
 }
 
 // src/commands/agents-task.ts
+var import_integration_providers = __toESM(require_integration_providers(), 1);
 import * as fs13 from "fs";
 import {
   RuntypeClient as RuntypeClient2,
   defaultWorkflow,
   deployWorkflow,
-  gameWorkflow
+  gameWorkflow,
+  getDefaultPlanPath
 } from "@runtypelabs/sdk";
 
 // src/lib/terminal-title.ts
-import path4 from "path";
+import path5 from "path";
 function setTerminalTitle(title) {
   if (process.stdout.isTTY) {
     process.stdout.write(`\x1B]0;${title}\x07`);
   }
 }
 function getFolderName() {
-  return path4.basename(process.cwd());
+  return path5.basename(process.cwd());
 }
 function setCliTitle() {
   setTerminalTitle(`Runtype (${getFolderName()})`);
@@ -14707,21 +14801,21 @@ function setMarathonTitle() {
 
 // src/marathon/checkpoint.ts
 import * as fs6 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 
 // src/config/paths.ts
 import * as os3 from "os";
-import * as path5 from "path";
+import * as path6 from "path";
 import * as crypto3 from "crypto";
 import * as fs5 from "fs";
 function getRuntypeHomeDir() {
-  return process.env.RUNTYPE_STATE_DIR || path5.join(os3.homedir(), ".runtype");
+  return process.env.RUNTYPE_STATE_DIR || path6.join(os3.homedir(), ".runtype");
 }
 function getProjectStateDir(projectDir) {
   const dir = projectDir || process.cwd();
   const hash = crypto3.createHash("sha256").update(dir).digest("hex").slice(0, 12);
-  const stateDir = path5.join(getRuntypeHomeDir(), "projects", hash);
-  const breadcrumb = path5.join(stateDir, "project-path.txt");
+  const stateDir = path6.join(getRuntypeHomeDir(), "projects", hash);
+  const breadcrumb = path6.join(stateDir, "project-path.txt");
   if (!fs5.existsSync(breadcrumb)) {
     fs5.mkdirSync(stateDir, { recursive: true });
     fs5.writeFileSync(breadcrumb, dir);
@@ -14729,7 +14823,7 @@ function getProjectStateDir(projectDir) {
   return stateDir;
 }
 function getMarathonStateDir(projectDir) {
-  return path5.join(getProjectStateDir(projectDir), "marathons");
+  return path6.join(getProjectStateDir(projectDir), "marathons");
 }
 
 // src/marathon/checkpoint.ts
@@ -14740,12 +14834,12 @@ function stateSafeName(name) {
   return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function marathonArtifactsDir(taskName, stateDir) {
-  return path6.join(stateDir || defaultStateDir(), stateSafeName(taskName));
+  return path7.join(stateDir || defaultStateDir(), stateSafeName(taskName));
 }
 function resolveMarathonCheckpointPath(taskName, targetPath, stateDir) {
-  const normalizedTargetPath = path6.normalize(targetPath);
-  const relativeTargetPath = path6.isAbsolute(normalizedTargetPath) ? path6.relative(process.cwd(), normalizedTargetPath) : normalizedTargetPath;
-  return path6.join(
+  const normalizedTargetPath = path7.normalize(targetPath);
+  const relativeTargetPath = path7.isAbsolute(normalizedTargetPath) ? path7.relative(process.cwd(), normalizedTargetPath) : normalizedTargetPath;
+  return path7.join(
     marathonArtifactsDir(taskName, stateDir),
     "checkpoints",
     "original",
@@ -14753,23 +14847,23 @@ function resolveMarathonCheckpointPath(taskName, targetPath, stateDir) {
   );
 }
 function ensureMarathonFileCheckpoint(taskName, targetPath, stateDir) {
-  const normalizedTargetPath = path6.resolve(targetPath);
-  const relativeTargetPath = path6.relative(process.cwd(), normalizedTargetPath);
+  const normalizedTargetPath = path7.resolve(targetPath);
+  const relativeTargetPath = path7.relative(process.cwd(), normalizedTargetPath);
   if (!relativeTargetPath || relativeTargetPath.startsWith("..")) return void 0;
   if (!fs6.existsSync(normalizedTargetPath)) return void 0;
   if (!fs6.statSync(normalizedTargetPath).isFile()) return void 0;
   const normalizedRelativeTargetPath = relativeTargetPath.replace(/\\/g, "/");
   if (normalizedRelativeTargetPath.startsWith(".runtype/")) return void 0;
-  if (normalizedTargetPath.startsWith(getRuntypeHomeDir() + path6.sep)) return void 0;
+  if (normalizedTargetPath.startsWith(getRuntypeHomeDir() + path7.sep)) return void 0;
   const checkpointPath = resolveMarathonCheckpointPath(taskName, normalizedTargetPath, stateDir);
   if (fs6.existsSync(checkpointPath)) return checkpointPath;
-  fs6.mkdirSync(path6.dirname(checkpointPath), { recursive: true });
+  fs6.mkdirSync(path7.dirname(checkpointPath), { recursive: true });
   fs6.copyFileSync(normalizedTargetPath, checkpointPath);
   return checkpointPath;
 }
 function restoreMarathonFileCheckpoint(taskName, targetPath, stateDir) {
-  const normalizedTargetPath = path6.resolve(targetPath);
-  const relativeTargetPath = path6.relative(process.cwd(), normalizedTargetPath);
+  const normalizedTargetPath = path7.resolve(targetPath);
+  const relativeTargetPath = path7.relative(process.cwd(), normalizedTargetPath);
   if (!relativeTargetPath || relativeTargetPath.startsWith("..")) {
     return {
       restored: false,
@@ -14784,7 +14878,7 @@ function restoreMarathonFileCheckpoint(taskName, targetPath, stateDir) {
       error: `No checkpoint found for ${normalizedTargetPath}`
     };
   }
-  fs6.mkdirSync(path6.dirname(normalizedTargetPath), { recursive: true });
+  fs6.mkdirSync(path7.dirname(normalizedTargetPath), { recursive: true });
   fs6.copyFileSync(checkpointPath, normalizedTargetPath);
   return { restored: true, checkpointPath };
 }
@@ -14910,7 +15004,7 @@ async function retryOnNetworkError(fn, opts = {}) {
       }
       const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
       opts.onRetry?.(attempt + 1, delay, error);
-      await new Promise((resolve7) => setTimeout(resolve7, delay));
+      await new Promise((resolve8) => setTimeout(resolve8, delay));
     }
   }
   throw lastError;
@@ -14984,6 +15078,72 @@ function formatMarathonApiError(error) {
 }
 
 // src/marathon/verification.ts
+var SAFE_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "TERM",
+  "COLORTERM",
+  "FORCE_COLOR",
+  "CI",
+  "NODE_PATH",
+  "NODE_ENV",
+  "NPM_CONFIG_CACHE",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "HOSTNAME",
+  "PNPM_HOME",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME"
+];
+function getSanitizedEnv() {
+  const clean = {};
+  for (const key of SAFE_ENV_KEYS) {
+    if (process.env[key]) clean[key] = process.env[key];
+  }
+  return clean;
+}
+function redactSecrets(output, secrets) {
+  const sorted = secrets.filter((s) => s.length >= 8).sort((a, b) => b.length - a.length);
+  let redacted = output;
+  for (const secret of sorted) {
+    redacted = redacted.replaceAll(secret, "[REDACTED]");
+  }
+  return redacted;
+}
+function collectSecretValues() {
+  const secretPatterns = [
+    /key/i,
+    /secret/i,
+    /token/i,
+    /password/i,
+    /credential/i,
+    /auth/i,
+    /api_key/i,
+    /apikey/i,
+    /private/i,
+    /signing/i,
+    /encryption/i,
+    /database_url/i,
+    /connection_string/i,
+    /dsn/i
+  ];
+  const secrets = [];
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!value || value.length < 8) continue;
+    if (SAFE_ENV_KEYS.includes(key)) continue;
+    if (secretPatterns.some((pattern) => pattern.test(key))) {
+      secrets.push(value);
+    }
+  }
+  return secrets;
+}
 var BLOCKED_VERIFICATION_PATTERNS = [
   /&&/,
   /\|\|/,
@@ -15022,10 +15182,54 @@ function isSafeVerificationCommand(command) {
   if (BLOCKED_VERIFICATION_PATTERNS.some((pattern) => pattern.test(trimmed))) return false;
   return ALLOWED_VERIFICATION_COMMANDS.some((pattern) => pattern.test(trimmed));
 }
+var SCRIPT_COMMAND_PATTERNS = [
+  {
+    pattern: /^(?:pnpm|npm|yarn|bun)\s+(?:test|lint|build|check|typecheck|run\s+\w+)\b/i,
+    files: ["package.json"]
+  },
+  {
+    pattern: /^make\s+/i,
+    files: ["Makefile", "makefile", "GNUmakefile"]
+  },
+  {
+    pattern: /^just\s+/i,
+    files: ["justfile", "Justfile"]
+  }
+];
+function getScriptConfigFiles(command) {
+  const trimmed = command.trim();
+  for (const { pattern, files } of SCRIPT_COMMAND_PATTERNS) {
+    if (pattern.test(trimmed)) return files;
+  }
+  return [];
+}
+function isScriptConfigModified(cwd, files) {
+  try {
+    const { spawnSync: spawnSync2 } = __require("child_process");
+    const spawnOpts = { cwd, encoding: "utf-8", timeout: 5e3 };
+    const failed = (r) => r.error != null || r.status === null || r.status !== 0;
+    const diff = spawnSync2("git", ["diff", "--name-only", "HEAD", "--", ...files], spawnOpts);
+    if (failed(diff)) return true;
+    if (diff.stdout?.trim()) return true;
+    const staged = spawnSync2("git", ["diff", "--name-only", "--cached", "--", ...files], spawnOpts);
+    if (failed(staged)) return true;
+    if (staged.stdout?.trim()) return true;
+    const lsFiles = spawnSync2(
+      "git",
+      ["ls-files", "--others", "--exclude-standard", "--", ...files],
+      spawnOpts
+    );
+    if (lsFiles.error != null || lsFiles.status === null) return true;
+    if (lsFiles.stdout?.trim()) return true;
+    return false;
+  } catch {
+    return true;
+  }
+}
 
 // src/marathon/state.ts
 import * as fs7 from "fs";
-import * as path7 from "path";
+import * as path8 from "path";
 import chalk15 from "chalk";
 
 // src/lib/select-prompt.ts
@@ -15060,14 +15264,14 @@ async function promptNumericSelect(choices, promptLabel) {
     output: process.stdout,
     terminal: true
   });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const ask = () => {
       rl.question(chalk14.cyan(`
 ${promptLabel} (1-${choices.length}): `), (answer) => {
         const value = parseInt(answer.trim(), 10);
         if (value >= 1 && value <= choices.length) {
           rl.close();
-          resolve7(choices[value - 1].value);
+          resolve8(choices[value - 1].value);
           return;
         }
         console.log(chalk14.red(`Please enter a number between 1 and ${choices.length}.`));
@@ -15095,7 +15299,7 @@ ${message}`));
   const previousRawMode = input.isRaw === true;
   let selectedIndex = 0;
   let renderedLineCount = 0;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const renderMenu = () => {
       if (renderedLineCount > 0) {
         clearRenderedLines(output, renderedLineCount);
@@ -15117,7 +15321,7 @@ ${message}`));
     };
     const finish = (value) => {
       cleanup();
-      resolve7(value);
+      resolve8(value);
     };
     const onKeypress = (_, key) => {
       if (key.ctrl && key.name === "c") {
@@ -15163,7 +15367,7 @@ function stateSafeName2(name) {
 }
 function stateFilePath(name, stateDir) {
   const dir = stateDir || defaultStateDir2();
-  return path7.join(dir, `${stateSafeName2(name)}.json`);
+  return path8.join(dir, `${stateSafeName2(name)}.json`);
 }
 function normalizeMarathonStatePath(candidatePath) {
   if (!candidatePath) return void 0;
@@ -15172,15 +15376,15 @@ function normalizeMarathonStatePath(candidatePath) {
 }
 function marathonStatePathExists(candidatePath) {
   if (!candidatePath) return false;
-  return fs7.existsSync(path7.resolve(candidatePath));
+  return fs7.existsSync(path8.resolve(candidatePath));
 }
 function isMarathonArtifactStatePath(candidatePath) {
   if (!candidatePath) return false;
   const normalized = normalizeMarathonStatePath(candidatePath)?.toLowerCase();
   if (normalized === ".runtype" || normalized?.startsWith(".runtype/") === true) return true;
-  const resolved = path7.resolve(candidatePath);
+  const resolved = path8.resolve(candidatePath);
   const homeStateDir = getRuntypeHomeDir();
-  return resolved.startsWith(homeStateDir + path7.sep) || resolved === homeStateDir;
+  return resolved.startsWith(homeStateDir + path8.sep) || resolved === homeStateDir;
 }
 function scoreMarathonCandidatePath(candidatePath) {
   const normalized = candidatePath.toLowerCase();
@@ -15353,7 +15557,7 @@ function loadState(filePath) {
   }
 }
 function saveState(filePath, state, options) {
-  const dir = path7.dirname(filePath);
+  const dir = path8.dirname(filePath);
   fs7.mkdirSync(dir, { recursive: true });
   const stateToWrite = options?.stripSnapshotEvents && state.sessionSnapshots?.length ? {
     ...state,
@@ -15393,9 +15597,9 @@ function findStateFile(name, stateDir) {
   }
   const homePath = stateFilePath(name, getMarathonStateDir());
   if (fs7.existsSync(homePath)) return homePath;
-  const oldMarathonPath = stateFilePath(name, path7.join(process.cwd(), ".runtype", "marathons"));
+  const oldMarathonPath = stateFilePath(name, path8.join(process.cwd(), ".runtype", "marathons"));
   if (fs7.existsSync(oldMarathonPath)) return oldMarathonPath;
-  const oldTaskPath = stateFilePath(name, path7.join(process.cwd(), ".runtype", "tasks"));
+  const oldTaskPath = stateFilePath(name, path8.join(process.cwd(), ".runtype", "tasks"));
   if (fs7.existsSync(oldTaskPath)) return oldTaskPath;
   return homePath;
 }
@@ -15404,15 +15608,15 @@ function findLatestStateFile(stateDir) {
     // New home-dir location
     getMarathonStateDir(),
     // Old project-dir locations (backward compat)
-    path7.join(process.cwd(), ".runtype", "marathons"),
-    path7.join(process.cwd(), ".runtype", "tasks")
+    path8.join(process.cwd(), ".runtype", "marathons"),
+    path8.join(process.cwd(), ".runtype", "tasks")
   ];
   let latest = null;
   for (const dir of dirs) {
     if (!fs7.existsSync(dir)) continue;
     const files = fs7.readdirSync(dir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
-      const fullPath = path7.join(dir, file);
+      const fullPath = path8.join(dir, file);
       const stat = fs7.statSync(fullPath);
       if (!latest || stat.mtimeMs > latest.mtime) {
         latest = { name: file.replace(".json", ""), filePath: fullPath, mtime: stat.mtimeMs };
@@ -15534,12 +15738,12 @@ function buildResumeCommand(agent, options, parsedSandbox) {
 
 // src/marathon/local-tools.ts
 import * as fs9 from "fs";
-import * as path9 from "path";
+import * as path10 from "path";
 import { spawnSync } from "child_process";
 
 // src/marathon/repo-discovery.ts
 import * as fs8 from "fs";
-import * as path8 from "path";
+import * as path9 from "path";
 var IGNORED_REPO_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -15637,8 +15841,8 @@ var SEARCH_STOP_WORDS = /* @__PURE__ */ new Set([
   "do"
 ]);
 function normalizeToolPath(toolPath) {
-  const resolved = path8.resolve(toolPath || ".");
-  return path8.relative(process.cwd(), resolved) || ".";
+  const resolved = path9.resolve(toolPath || ".");
+  return path9.relative(process.cwd(), resolved) || ".";
 }
 function tokenizeSearchQuery(query) {
   return query.toLowerCase().split(/[^a-z0-9./_-]+/g).map((token) => token.trim()).filter((token) => token.length >= 2 && !SEARCH_STOP_WORDS.has(token));
@@ -15647,7 +15851,7 @@ function scoreSearchPath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   const segments = normalized.split("/");
   const fileName = segments[segments.length - 1] || normalized;
-  const extension = path8.extname(fileName).toLowerCase();
+  const extension = path9.extname(fileName).toLowerCase();
   let score = 0;
   if (LOW_SIGNAL_FILE_NAMES.has(fileName)) score -= 50;
   if (segments.some((segment) => LOW_SIGNAL_PATH_SEGMENTS.has(segment))) score -= 15;
@@ -15663,7 +15867,7 @@ function shouldIgnoreRepoEntry(entryPath) {
   const normalized = normalizeToolPath(entryPath).replace(/\\/g, "/");
   if (normalized === ".") return false;
   if (isSensitivePath(normalized)) return true;
-  return normalized.split(path8.sep).some((segment) => IGNORED_REPO_DIRS.has(segment));
+  return normalized.split(path9.sep).some((segment) => IGNORED_REPO_DIRS.has(segment));
 }
 function safeReadTextFile(filePath) {
   try {
@@ -15691,7 +15895,7 @@ function walkRepo(startPath, visitor) {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path8.join(currentDir, entry.name);
+      const entryPath = path9.join(currentDir, entry.name);
       if (shouldIgnoreRepoEntry(entryPath)) continue;
       const shouldStop = visitor(entryPath, entry);
       if (shouldStop === true) return;
@@ -15736,7 +15940,7 @@ function buildTree(dirPath, maxDepth, depth = 0) {
   }
   const lines = [];
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-    const entryPath = path8.join(dirPath, entry.name);
+    const entryPath = path9.join(dirPath, entry.name);
     if (shouldIgnoreRepoEntry(entryPath)) continue;
     lines.push(`${"  ".repeat(depth)}- ${entry.name}${entry.isDirectory() ? "/" : ""}`);
     if (entry.isDirectory() && depth < maxDepth) {
@@ -15752,14 +15956,14 @@ function stateSafeName3(name) {
   return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function getOffloadedOutputDir(taskName, stateDir) {
-  return path9.join(stateDir || getMarathonStateDir(), stateSafeName3(taskName), "outputs");
+  return path10.join(stateDir || getMarathonStateDir(), stateSafeName3(taskName), "outputs");
 }
 function isPathWithinRoot(targetPath, rootPath) {
-  const relativePath = path9.relative(rootPath, targetPath);
-  return relativePath === "" || !relativePath.startsWith("..") && !path9.isAbsolute(relativePath);
+  const relativePath = path10.relative(rootPath, targetPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path10.isAbsolute(relativePath);
 }
 function resolveCanonicalToolPath(toolPath, allowMissing) {
-  const absolutePath = path9.resolve(toolPath);
+  const absolutePath = path10.resolve(toolPath);
   if (fs9.existsSync(absolutePath)) {
     return {
       canonicalPath: fs9.realpathSync.native(absolutePath),
@@ -15770,22 +15974,22 @@ function resolveCanonicalToolPath(toolPath, allowMissing) {
   const missingSegments = [];
   let currentPath = absolutePath;
   while (!fs9.existsSync(currentPath)) {
-    const parentPath = path9.dirname(currentPath);
+    const parentPath = path10.dirname(currentPath);
     if (parentPath === currentPath) return null;
-    missingSegments.unshift(path9.basename(currentPath));
+    missingSegments.unshift(path10.basename(currentPath));
     currentPath = parentPath;
   }
   return {
-    canonicalPath: path9.join(fs9.realpathSync.native(currentPath), ...missingSegments),
+    canonicalPath: path10.join(fs9.realpathSync.native(currentPath), ...missingSegments),
     exists: false
   };
 }
 function canonicalizeAllowedRoot(rootPath) {
-  return resolveCanonicalToolPath(rootPath, true)?.canonicalPath || path9.resolve(rootPath);
+  return resolveCanonicalToolPath(rootPath, true)?.canonicalPath || path10.resolve(rootPath);
 }
 function findBlockedWorkspaceSegment(targetPath, workspaceRoot) {
   if (!isPathWithinRoot(targetPath, workspaceRoot)) return void 0;
-  const relativePath = path9.relative(workspaceRoot, targetPath).replace(/\\/g, "/");
+  const relativePath = path10.relative(workspaceRoot, targetPath).replace(/\\/g, "/");
   if (!relativePath) return void 0;
   return relativePath.split("/").find((segment) => DIRECT_TOOL_BLOCKED_SEGMENTS.has(segment));
 }
@@ -15814,19 +16018,24 @@ function resolveToolPath(toolPath, options = {}) {
     };
   }
   if (matchedRoot === workspaceRoot) {
-    const blockedSegment = findBlockedWorkspaceSegment(resolved.canonicalPath, workspaceRoot);
-    if (blockedSegment) {
-      return {
-        ok: false,
-        error: `Access denied: ${requestedPath} is inside restricted workspace state (${blockedSegment})`
-      };
-    }
-    const relativeFromWorkspace = path9.relative(workspaceRoot, resolved.canonicalPath).replace(/\\/g, "/");
-    if (isSensitivePath(relativeFromWorkspace)) {
-      return {
-        ok: false,
-        error: `Access denied: ${requestedPath} is a sensitive path and cannot be read or written`
-      };
+    const isUnderExtraRoot = extraRoots.some(
+      (extraRoot) => isPathWithinRoot(resolved.canonicalPath, extraRoot)
+    );
+    if (!isUnderExtraRoot) {
+      const blockedSegment = findBlockedWorkspaceSegment(resolved.canonicalPath, workspaceRoot);
+      if (blockedSegment) {
+        return {
+          ok: false,
+          error: `Access denied: ${requestedPath} is inside restricted workspace state (${blockedSegment})`
+        };
+      }
+      const relativeFromWorkspace = path10.relative(workspaceRoot, resolved.canonicalPath).replace(/\\/g, "/");
+      if (isSensitivePath(relativeFromWorkspace)) {
+        return {
+          ok: false,
+          error: `Access denied: ${requestedPath} is a sensitive path and cannot be read or written`
+        };
+      }
     }
   }
   if (resolved.exists) {
@@ -15849,15 +16058,17 @@ function resolveToolPath(toolPath, options = {}) {
   return { ok: true, resolvedPath: resolved.canonicalPath };
 }
 function getTaskStateRoot(taskName, stateDir) {
-  return path9.join(stateDir || getMarathonStateDir(), stateSafeName3(taskName));
+  return path10.join(stateDir || getMarathonStateDir(), stateSafeName3(taskName));
 }
 function createDefaultLocalTools(context) {
   const taskStateRoot = context?.taskName ? getTaskStateRoot(context.taskName, context.stateDir) : void 0;
-  const planDir = context?.taskName ? path9.resolve(`.runtype/marathons/${stateSafeName3(context.taskName)}`) : void 0;
+  const planDir = context?.taskName ? path10.resolve(`.runtype/marathons/${stateSafeName3(context.taskName)}`) : void 0;
+  const planPathDir = context?.planPath ? path10.resolve(path10.dirname(context.planPath)) : void 0;
   const allowedReadRoots = context?.taskName ? [
     getOffloadedOutputDir(context.taskName, context.stateDir),
     ...taskStateRoot ? [taskStateRoot] : [],
-    ...planDir ? [planDir] : []
+    ...planDir ? [planDir] : [],
+    ...planPathDir ? [planPathDir] : []
   ] : [];
   return {
     read_file: {
@@ -15895,7 +16106,7 @@ function createDefaultLocalTools(context) {
         if (fs9.existsSync(resolvedPath.resolvedPath) && fs9.statSync(resolvedPath.resolvedPath).isDirectory()) {
           return `Error: Path is a directory: ${String(args.path || "")}`;
         }
-        const dir = path9.dirname(resolvedPath.resolvedPath);
+        const dir = path10.dirname(resolvedPath.resolvedPath);
         fs9.mkdirSync(dir, { recursive: true });
         fs9.writeFileSync(resolvedPath.resolvedPath, content);
         return "ok";
@@ -15912,7 +16123,7 @@ function createDefaultLocalTools(context) {
           requireDirectory: true
         });
         if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
-        return fs9.readdirSync(resolvedPath.resolvedPath, { withFileTypes: true }).filter((entry) => !shouldIgnoreRepoEntry(path9.join(resolvedPath.resolvedPath, entry.name))).map((entry) => entry.name).join("\n");
+        return fs9.readdirSync(resolvedPath.resolvedPath, { withFileTypes: true }).filter((entry) => !shouldIgnoreRepoEntry(path10.join(resolvedPath.resolvedPath, entry.name))).map((entry) => entry.name).join("\n");
       }
     },
     search_repo: {
@@ -16059,9 +16270,12 @@ function createDefaultLocalTools(context) {
     }
   };
 }
-function createCheckpointedWriteFileTool(taskName, stateDir) {
+function createCheckpointedWriteFileTool(taskName, stateDir, planPath) {
   const taskStateRoot = getTaskStateRoot(taskName, stateDir);
-  const planDir = path9.resolve(`.runtype/marathons/${stateSafeName3(taskName)}`);
+  const planDir = path10.resolve(`.runtype/marathons/${stateSafeName3(taskName)}`);
+  const marathonPlanRoot = path10.resolve(".runtype/marathons");
+  const planPathDir = planPath ? path10.resolve(path10.dirname(planPath)) : void 0;
+  const writeAllowedRoots = [taskStateRoot, planDir, marathonPlanRoot, ...planPathDir ? [planPathDir] : []];
   return {
     description: "Write content to a file, creating directories as needed and checkpointing original repo files",
     parametersSchema: {
@@ -16075,14 +16289,102 @@ function createCheckpointedWriteFileTool(taskName, stateDir) {
     execute: async (args) => {
       const resolvedPath = resolveToolPath(String(args.path || ""), {
         allowMissing: true,
-        allowedRoots: [taskStateRoot, planDir]
+        allowedRoots: writeAllowedRoots
       });
       if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
       const content = String(args.content || "");
       ensureMarathonFileCheckpoint(taskName, resolvedPath.resolvedPath, stateDir);
-      const dir = path9.dirname(resolvedPath.resolvedPath);
+      const dir = path10.dirname(resolvedPath.resolvedPath);
       fs9.mkdirSync(dir, { recursive: true });
       fs9.writeFileSync(resolvedPath.resolvedPath, content);
+      const ext = path10.extname(resolvedPath.resolvedPath).toLowerCase();
+      if (ext === ".js" || ext === ".jsx") {
+        const syntaxError = quickJsSyntaxCheck(content);
+        if (syntaxError) {
+          return `ok
+
+\u26A0\uFE0F Syntax error detected in written file: ${syntaxError}. The file was written but contains errors. Read it back and fix the issues.`;
+        }
+      }
+      return "ok";
+    }
+  };
+}
+function quickJsSyntaxCheck(content) {
+  try {
+    new Function(content);
+    return void 0;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      return err.message;
+    }
+    return void 0;
+  }
+}
+function createEditFileTool(taskName, stateDir, planPath) {
+  const taskStateRoot = getTaskStateRoot(taskName, stateDir);
+  const planDir = path10.resolve(`.runtype/marathons/${stateSafeName3(taskName)}`);
+  const marathonPlanRoot = path10.resolve(".runtype/marathons");
+  const planPathDir = planPath ? path10.resolve(path10.dirname(planPath)) : void 0;
+  const writeAllowedRoots = [taskStateRoot, planDir, marathonPlanRoot, ...planPathDir ? [planPathDir] : []];
+  return {
+    description: "Make a targeted edit to a file by replacing a specific string. Much more efficient than rewriting the entire file with write_file. The old_string must appear exactly once in the file (or use replace_all for global replacement). Always read the file first to get the exact text to replace.",
+    parametersSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "File path to edit" },
+        // @snake-case-ok: Parameter names use snake_case to match agent tool conventions
+        old_string: { type: "string", description: "Exact string to find and replace (must be unique in the file)" },
+        // @snake-case-ok: Parameter names use snake_case to match agent tool conventions
+        new_string: { type: "string", description: "Replacement string" },
+        // @snake-case-ok: Parameter names use snake_case to match agent tool conventions
+        replace_all: {
+          type: "boolean",
+          description: "If true, replace all occurrences instead of requiring uniqueness. Default: false"
+        }
+      },
+      required: ["path", "old_string", "new_string"]
+    },
+    execute: async (args) => {
+      const resolvedPath = resolveToolPath(String(args.path || ""), {
+        requireFile: true,
+        allowedRoots: writeAllowedRoots
+      });
+      if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
+      const oldString = String(args.old_string ?? "");
+      const newString = String(args.new_string ?? "");
+      const replaceAll = Boolean(args.replace_all);
+      if (!oldString) return "Error: old_string cannot be empty";
+      if (oldString === newString) return "Error: old_string and new_string are identical";
+      let content;
+      try {
+        content = fs9.readFileSync(resolvedPath.resolvedPath, "utf-8");
+      } catch {
+        return `Error: Could not read file: ${String(args.path || "")}`;
+      }
+      if (!content.includes(oldString)) {
+        return `Error: old_string not found in ${String(args.path || "")}. Read the file first to get the exact text.`;
+      }
+      if (!replaceAll) {
+        const firstIndex = content.indexOf(oldString);
+        const secondIndex = content.indexOf(oldString, firstIndex + 1);
+        if (secondIndex !== -1) {
+          const count = content.split(oldString).length - 1;
+          return `Error: old_string appears ${count} times in the file. Provide more surrounding context to make it unique, or set replace_all to true.`;
+        }
+      }
+      ensureMarathonFileCheckpoint(taskName, resolvedPath.resolvedPath, stateDir);
+      const updated = replaceAll ? content.split(oldString).join(newString) : content.replace(oldString, newString);
+      fs9.writeFileSync(resolvedPath.resolvedPath, updated);
+      const ext = path10.extname(resolvedPath.resolvedPath).toLowerCase();
+      if (ext === ".js" || ext === ".jsx") {
+        const syntaxError = quickJsSyntaxCheck(updated);
+        if (syntaxError) {
+          return `ok
+
+\u26A0\uFE0F Syntax error detected after edit: ${syntaxError}. The edit was applied but the file now contains errors.`;
+        }
+      }
       return "ok";
     }
   };
@@ -16129,7 +16431,7 @@ function createReadOffloadedOutputTool(taskName, stateDir) {
       if (!/^[a-zA-Z0-9_-]+$/.test(outputId)) {
         return `Error: invalid offloaded output id: ${outputId}`;
       }
-      const outputPath = path9.join(getOffloadedOutputDir(taskName, stateDir), `${outputId}.txt`);
+      const outputPath = path10.join(getOffloadedOutputDir(taskName, stateDir), `${outputId}.txt`);
       if (!fs9.existsSync(outputPath) || !fs9.statSync(outputPath).isFile()) {
         return `Error: offloaded output not found: ${outputId}`;
       }
@@ -16171,6 +16473,15 @@ function createRunCheckTool() {
           error: "Blocked unsafe verification command. Use a single non-destructive lint/test/typecheck/build command."
         });
       }
+      const configFiles = getScriptConfigFiles(command);
+      if (configFiles.length > 0 && isScriptConfigModified(process.cwd(), configFiles)) {
+        return JSON.stringify({
+          success: false,
+          blocked: true,
+          command,
+          error: `Blocked: ${configFiles.join("/")} has been modified since last commit. Cannot run script commands when config files have uncommitted changes.`
+        });
+      }
       const timeoutMs = Math.max(
         1e3,
         Math.min(
@@ -16184,9 +16495,11 @@ function createRunCheckTool() {
           encoding: "utf-8",
           shell: true,
           timeout: timeoutMs,
-          maxBuffer: 1024 * 1024 * 4
+          maxBuffer: 1024 * 1024 * 4,
+          env: getSanitizedEnv()
         });
-        const output = `${result.stdout || ""}${result.stderr || ""}`.trim().slice(0, 12e3);
+        const rawOutput = `${result.stdout || ""}${result.stderr || ""}`.trim().slice(0, 12e3);
+        const output = redactSecrets(rawOutput, collectSecretValues());
         return JSON.stringify({
           success: result.status === 0 && !result.error,
           command,
@@ -16261,7 +16574,8 @@ function buildLocalTools(client, sandboxProvider, options, context) {
   if (!options.noLocalTools) {
     Object.assign(enabledTools, createDefaultLocalTools(context));
     if (context) {
-      enabledTools.write_file = createCheckpointedWriteFileTool(context.taskName, context.stateDir);
+      enabledTools.write_file = createCheckpointedWriteFileTool(context.taskName, context.stateDir, context.planPath);
+      enabledTools.edit_file = createEditFileTool(context.taskName, context.stateDir, context.planPath);
       enabledTools.restore_file_checkpoint = createRestoreFileCheckpointTool(
         context.taskName,
         context.stateDir
@@ -16422,7 +16736,7 @@ function createLoopDetector(options = {}) {
 
 // src/marathon/context-offload.ts
 import * as fs10 from "fs";
-import * as path10 from "path";
+import * as path11 from "path";
 var DEFAULT_OUTPUT_THRESHOLD = 2e3;
 var DEFAULT_PREVIEW_LENGTH = 200;
 function buildOffloadedOutputId(toolName) {
@@ -16454,13 +16768,13 @@ function offloadToolOutput(taskName, toolName, output, options = {}, stateDir) {
     return { offloaded: false, content: output };
   }
   const outputId = buildOffloadedOutputId(toolName);
-  const dir = path10.join(
+  const dir = path11.join(
     stateDir || defaultStateDir3(),
     stateSafeName4(taskName),
     "outputs"
   );
   const fileName = `${outputId}.txt`;
-  const filePath = path10.join(dir, fileName);
+  const filePath = path11.join(dir, fileName);
   fs10.mkdirSync(dir, { recursive: true });
   fs10.writeFileSync(filePath, output, "utf-8");
   const preview = output.slice(0, previewLength).replace(/\n/g, " ");
@@ -16635,17 +16949,17 @@ function resolveAutoCompactTokenThreshold(modelContextLength, rawThreshold, stra
 
 // src/marathon/recipes.ts
 import * as fs11 from "fs";
-import * as path11 from "path";
+import * as path12 from "path";
 var RULES_DIR = ".marathon/rules";
 function loadRules(cwd) {
   const baseCwd = cwd || process.cwd();
-  const rulesDir = path11.resolve(baseCwd, RULES_DIR);
+  const rulesDir = path12.resolve(baseCwd, RULES_DIR);
   if (!fs11.existsSync(rulesDir)) return [];
   const rules = [];
   try {
     const entries = fs11.readdirSync(rulesDir).filter((f) => f.endsWith(".md"));
     for (const entry of entries) {
-      const filePath = path11.join(rulesDir, entry);
+      const filePath = path12.join(rulesDir, entry);
       try {
         const raw = fs11.readFileSync(filePath, "utf-8");
         const parsed = parseRuleFile(raw);
@@ -16722,7 +17036,7 @@ function resolveErrorHandlingForPhase(phase, cliFallbackModel, milestoneFallback
 
 // src/marathon/playbook-loader.ts
 import * as fs12 from "fs";
-import * as path12 from "path";
+import * as path13 from "path";
 import * as os4 from "os";
 import micromatch from "micromatch";
 import { parse as parseYaml } from "yaml";
@@ -16737,20 +17051,20 @@ function getCandidatePaths(nameOrPath, cwd) {
   const home = os4.homedir();
   return [
     // Exact path
-    path12.resolve(cwd, nameOrPath),
+    path13.resolve(cwd, nameOrPath),
     // Repo-level
-    path12.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.yaml`),
-    path12.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.yml`),
-    path12.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.json`),
+    path13.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.yaml`),
+    path13.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.yml`),
+    path13.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.json`),
     // User-level
-    path12.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.yaml`),
-    path12.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.yml`),
-    path12.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.json`)
+    path13.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.yaml`),
+    path13.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.yml`),
+    path13.resolve(home, PLAYBOOKS_DIR, `${nameOrPath}.json`)
   ];
 }
 function parsePlaybookFile(filePath) {
   const raw = fs12.readFileSync(filePath, "utf-8");
-  const ext = path12.extname(filePath).toLowerCase();
+  const ext = path13.extname(filePath).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(raw);
   }
@@ -17016,6 +17330,8 @@ function buildMarathonStartupModelOptions(configuredModels, availableModels) {
   for (const model of configuredModels) {
     const modelId = model.modelId?.trim();
     if (!modelId) continue;
+    const provider = model.provider?.trim().toLowerCase() ?? "";
+    if ((0, import_integration_providers.isNonAIProvider)(provider) || (0, import_integration_providers.isNonAIProvider)(modelId)) continue;
     pushOption({
       label: model.displayName?.trim() || modelId,
       value: modelId,
@@ -17027,6 +17343,8 @@ function buildMarathonStartupModelOptions(configuredModels, availableModels) {
       for (const provider of model.providers) {
         const modelId2 = provider.modelId?.trim() || model.baseModel?.trim();
         if (!modelId2) continue;
+        const providerName = provider.provider?.trim().toLowerCase() ?? "";
+        if ((0, import_integration_providers.isNonAIProvider)(providerName) || (0, import_integration_providers.isNonAIProvider)(modelId2)) continue;
         pushOption({
           label: provider.displayName?.trim() || model.displayName?.trim() || model.baseModel?.trim() || modelId2,
           value: modelId2,
@@ -17037,6 +17355,7 @@ function buildMarathonStartupModelOptions(configuredModels, availableModels) {
     }
     const modelId = model.baseModel?.trim();
     if (!modelId) continue;
+    if ((0, import_integration_providers.isNonAIProvider)(modelId)) continue;
     pushOption({
       label: model.displayName?.trim() || modelId,
       value: modelId,
@@ -17202,14 +17521,15 @@ async function taskAction(agent, options) {
     const renderedShell = render9(
       React9.createElement(MarathonStartupShell, {
         startupRef: startupShellRef,
-        marathonAppProps: null
+        marathonAppProps: null,
+        version: getCliVersion()
       }),
       { exitOnCtrlC: false }
     );
     waitForUiExit = renderedShell.waitUntilExit;
     rerenderUi = renderedShell.rerender;
     unmountUi = renderedShell.unmount;
-    await new Promise((resolve7) => setTimeout(resolve7, 0));
+    await new Promise((resolve8) => setTimeout(resolve8, 0));
     if (!startupShellRef.current) {
       exitAltScreen();
       unmountUi?.();
@@ -17589,9 +17909,11 @@ ${rulesContext}`;
       });
     }
   }
+  const resolvedPlanPath = resumeLoadedState?.planPath ?? resumeState?.planPath ?? getDefaultPlanPath(taskName);
   let localTools = buildLocalTools(client, parsedSandbox, options, {
     taskName,
-    stateDir: options.stateDir
+    stateDir: options.stateDir,
+    planPath: resolvedPlanPath
   });
   const resolveContextLimitForModel = (modelId) => resolveModelContextLength(modelId, configuredModels, availableModels);
   const resolveCompactStrategyForModel = (modelId) => {
@@ -17651,7 +17973,8 @@ ${rulesContext}`;
   const checkpointHasConfigChanges = (result) => Boolean(result.model) || result.tools === true || result.sandbox !== void 0;
   const rebuildCheckpointTools = () => buildLocalTools(client, parsedSandbox, options, {
     taskName,
-    stateDir: options.stateDir
+    stateDir: options.stateDir,
+    planPath: resolvedPlanPath
   });
   const applyCheckpointConfig = (result) => {
     if (result.model) {
@@ -17738,7 +18061,8 @@ Saving state... done. Session saved to ${filePath}`);
       rerenderUi?.(
         React9.createElement(MarathonStartupShell, {
           startupRef: startupShellRef,
-          marathonAppProps
+          marathonAppProps,
+          version: getCliVersion()
         })
       );
       await startupShellRef.current?.completeStartup();
@@ -17751,7 +18075,7 @@ Saving state... done. Session saved to ${filePath}`);
       waitForUiExit = renderedApp.waitUntilExit;
       unmountUi = renderedApp.unmount;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, 0));
+    await new Promise((resolve8) => setTimeout(resolve8, 0));
     const streamActions = streamRef.current;
     if (!streamActions) {
       exitAltScreen();
@@ -17876,7 +18200,7 @@ Saving state... done. Session saved to ${filePath}`);
           };
           if (event.phase === "start") {
             currentActions.startContextCompaction(absoluteEvent);
-            await new Promise((resolve7) => setTimeout(resolve7, 0));
+            await new Promise((resolve8) => setTimeout(resolve8, 0));
             return;
           }
           currentActions.finishContextCompaction(absoluteEvent);
@@ -18118,7 +18442,7 @@ Saving state... done. Session saved to ${filePath}`);
             toolCallsMade: accumulatedToolCalls,
             tokensInput: accumulatedTokens.input,
             tokensOutput: accumulatedTokens.output,
-            cost: accumulatedCost,
+            cost: priorCost + accumulatedCost,
             outputPreview: terminalPreview.slice(0, 100)
           };
           const checkpointResult = await currentActions.requestCheckpoint(recap, true);
@@ -19848,13 +20172,13 @@ apiKeysCommand.command("delete <id>").description("Delete an API key").option("-
     await waitUntilExit2();
     return;
   }
-  const confirmed = await new Promise((resolve7) => {
+  const confirmed = await new Promise((resolve8) => {
     const { unmount } = render14(
       React14.createElement(ConfirmPrompt, {
         message: `Delete API key ${id}?`,
         defaultValue: false,
         onConfirm: (result) => {
-          resolve7(result);
+          resolve8(result);
           unmount();
         }
       })
@@ -19959,8 +20283,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
   const client = new ApiClient(apiKey);
   if (!isTTY(options) || options.json) {
     try {
-      const path13 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-      const data = await client.get(path13);
+      const path14 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+      const data = await client.get(path14);
       printJson(data);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
@@ -19977,8 +20301,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
     useEffect25(() => {
       const run = async () => {
         try {
-          const path13 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-          const data = await client.get(path13);
+          const path14 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+          const data = await client.get(path14);
           printJson(data);
           setSuccess(true);
           setLoading(false);