@symerian/symi 3.4.25 → 3.4.27

package/dist/{onboarding.gateway-config-arRNxrI9.js → onboarding.gateway-config-CDRLfIZM.js}

@@ -3,24 +3,24 @@ import "./paths-By0XjHBk.js";
 import "./utils-CTPsqyE_.js";
 import "./subsystem-CHbO_DkH.js";
 import "./exec-DuYbft0z.js";
-import "./agent-scope-DOrZjOnW.js";
-import "./model-selection-7wdmO-Iw.js";
-import "./config-D7SS4vdk.js";
+import "./agent-scope-Bnsyyeci.js";
+import "./model-selection-CCTzD29o.js";
+import "./config-D-PYSlE8.js";
 import "./boolean-CbZoNRMn.js";
 import "./env-BRnPI9sO.js";
 import "./shell-env-Dc3iU7HK.js";
 import "./manifest-registry-D1MLZEjS.js";
 import { a as findTailscaleBinary } from "./tailscale-DpKBMIvx.js";
-import "./sessions-optZRB57.js";
+import "./sessions-aSo5jsmg.js";
 import "./dock-hF45sewN.js";
 import "./message-channel-DgjXWzf-.js";
 import "./plugins-CF5skkHh.js";
 import "./paths-BtvQ7JvU.js";
-import "./client-BzUAFrla.js";
-import "./call-BouPakqe.js";
-import "./pairing-token-Dcy37-4s.js";
+import "./client-T5P9umyG.js";
+import "./call-CW8U1BPq.js";
+import "./pairing-token-B703A1U3.js";
 import "./prompt-style-BEDZROvQ.js";
-import { h as randomToken, u as normalizeGatewayTokenInput, y as validateGatewayPasswordInput } from "./onboard-helpers---sZ9pdZ.js";
+import { h as randomToken, u as normalizeGatewayTokenInput, y as validateGatewayPasswordInput } from "./onboard-helpers-OB_xKQze.js";
 import { i as TAILSCALE_MISSING_BIN_NOTE_LINES, n as TAILSCALE_DOCS_LINES, r as TAILSCALE_EXPOSURE_OPTIONS, t as validateIPv4AddressInput } from "./ipv4-Coaw2jro.js";
 
 //#region src/wizard/onboarding.gateway-config.ts

package/dist/{openai-model-default-XudD4Xik.js → openai-model-default-Dl21Ivjc.js}

@@ -1,7 +1,7 @@
 import { c as escapeRegExp, p as resolveConfigDir } from "./utils-CTPsqyE_.js";
-import { p as resolveAllowlistModelKey, w as DEFAULT_PROVIDER } from "./model-selection-7wdmO-Iw.js";
+import { p as resolveAllowlistModelKey, w as DEFAULT_PROVIDER } from "./model-selection-CCTzD29o.js";
 import { n as fetchWithTimeout } from "./fetch-timeout-BhdrdVp5.js";
-import { St as ZAI_GLOBAL_BASE_URL, bt as ZAI_CODING_CN_BASE_URL, xt as ZAI_CODING_GLOBAL_BASE_URL, yt as ZAI_CN_BASE_URL } from "./auth-token-DgRRSbEX.js";
+import { St as ZAI_GLOBAL_BASE_URL, bt as ZAI_CODING_CN_BASE_URL, xt as ZAI_CODING_GLOBAL_BASE_URL, yt as ZAI_CN_BASE_URL } from "./auth-token-CAV1oLQG.js";
 import path from "node:path";
 import fs from "node:fs";
 

package/dist/{pairing-cli-NDavTm1_.js → pairing-cli-C2_Zobhz.js}

@@ -4,16 +4,16 @@ import "./utils-CTPsqyE_.js";
 import { f as defaultRuntime } from "./subsystem-CHbO_DkH.js";
 import { t as formatCliCommand } from "./command-format-BzjsXBTi.js";
 import "./exec-DuYbft0z.js";
-import "./agent-scope-DOrZjOnW.js";
-import "./model-selection-7wdmO-Iw.js";
-import "./file-lock-BVUYnlQv.js";
-import { i as loadConfig } from "./config-D7SS4vdk.js";
+import "./agent-scope-Bnsyyeci.js";
+import "./model-selection-CCTzD29o.js";
+import "./file-lock-2AecMjCa.js";
+import { i as loadConfig } from "./config-D-PYSlE8.js";
 import "./boolean-CbZoNRMn.js";
 import "./env-BRnPI9sO.js";
 import "./shell-env-Dc3iU7HK.js";
 import "./manifest-registry-D1MLZEjS.js";
 import { r as normalizeChannelId } from "./plugins-CF5skkHh.js";
-import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests, s as getPairingAdapter } from "./pairing-store-BNhJOnWn.js";
+import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests, s as getPairingAdapter } from "./pairing-store-Be-ZQK87.js";
 import { t as formatDocsLink } from "./links-TQwptN6q.js";
 import { t as renderTable } from "./table-D902H0x3.js";
 

package/dist/{pairing-store-BNhJOnWn.js → pairing-store-Be-ZQK87.js}

@@ -1,6 +1,6 @@
 import { _ as resolveStateDir, b as resolveRequiredHomeDir, h as resolveOAuthDir } from "./paths-By0XjHBk.js";
 import { g as safeParseJson } from "./utils-CTPsqyE_.js";
-import { t as withFileLock$1 } from "./file-lock-BVUYnlQv.js";
+import { t as withFileLock$1 } from "./file-lock-2AecMjCa.js";
 import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-CF5skkHh.js";
 import crypto from "node:crypto";
 import path from "node:path";

package/dist/{pairing-token-Dcy37-4s.js → pairing-token-B703A1U3.js}

@@ -2,12 +2,12 @@ import { _ as resolveStateDir } from "./paths-By0XjHBk.js";
 import { t as safeEqualSecret } from "./secret-equal-CbntzRkh.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/infra/json-files.ts
 async function readJsonFile(filePath) {
 	try {
-		const raw = await fs.readFile(filePath, "utf8");
+		const raw = await fsPromises.readFile(filePath, "utf8");
 		return JSON.parse(raw);
 	} catch {
 		return null;
@@ -16,15 +16,15 @@ async function readJsonFile(filePath) {
 async function writeJsonAtomic(filePath, value, options) {
 	const mode = options?.mode ?? 384;
 	const dir = path.dirname(filePath);
-	await fs.mkdir(dir, { recursive: true });
+	await fsPromises.mkdir(dir, { recursive: true });
 	const tmp = `${filePath}.${randomUUID()}.tmp`;
-	await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
+	await fsPromises.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
 	try {
-		await fs.chmod(tmp, mode);
+		await fsPromises.chmod(tmp, mode);
 	} catch {}
-	await fs.rename(tmp, filePath);
+	await fsPromises.rename(tmp, filePath);
 	try {
-		await fs.chmod(filePath, mode);
+		await fsPromises.chmod(filePath, mode);
 	} catch {}
 }
 function createAsyncLock() {

package/dist/{paths-DObzwe08.js → paths-BWqg8NZT.js}

@@ -1,5 +1,5 @@
 import { B as resolvePreferredSymiTmpDir } from "./registry-Sbac4a4z.js";
-import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-BdejYjW8.js";
+import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-B0Is-oLk.js";
 import path from "node:path";
 
 //#region src/browser/paths.ts

package/dist/{pi-auth-json-Db8XJVGL.js → pi-auth-json-D-vdh-nY.js}

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { b as ensureAuthProfileStore } from "./auth-profiles-Ce7R_25e.js";
-import { u as normalizeProviderId } from "./model-selection-7wdmO-Iw.js";
+import { b as ensureAuthProfileStore } from "./auth-profiles-D5nYBj_Z.js";
+import { u as normalizeProviderId } from "./model-selection-CCTzD29o.js";
 import { t as normalizeOptionalSecretInput } from "./normalize-secret-input-DjGU5EXe.js";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/agents/pi-auth-json.ts
 var pi_auth_json_exports = /* @__PURE__ */ __exportAll({ ensurePiAuthJsonFromAuthProfiles: () => ensurePiAuthJsonFromAuthProfiles });
 async function readAuthJson(filePath) {
 	try {
-		const raw = await fs.readFile(filePath, "utf8");
+		const raw = await fsPromises.readFile(filePath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (!parsed || typeof parsed !== "object") return {};
 		return parsed;
@@ -120,11 +120,11 @@ async function ensurePiAuthJsonFromAuthProfiles(agentDir, options) {
 		wrote: false,
 		authPath
 	};
-	await fs.mkdir(agentDir, {
+	await fsPromises.mkdir(agentDir, {
 		recursive: true,
 		mode: 448
 	});
-	await fs.writeFile(authPath, `${JSON.stringify(existing, null, 2)}\n`, { mode: 384 });
+	await fsPromises.writeFile(authPath, `${JSON.stringify(existing, null, 2)}\n`, { mode: 384 });
 	return {
 		wrote: true,
 		authPath

package/dist/{pi-embedded-0I7WdtRz.js → pi-embedded-C7mJzGIf.js}

@@ -9,7 +9,7 @@ import { i as resolveAckReaction, o as resolveEffectiveMessagesConfig, r as reso
 import { t as normalizeChatType } from "./chat-type-Acj2OK2p.js";
 import { i as resolveSlackAccount, n as listChannelPlugins, o as resolveSlackAppToken, r as normalizeChannelId$1, s as resolveSlackBotToken, t as getChannelPlugin } from "./plugins-CZ_mYwXq.js";
 import { S as resolveSlackChannelId, _ as resolveSlackWebClientOptions, a as sendMessageSlack, b as buildSlackBlocksFallbackText, c as getDefaultLocalRoots, d as fetchRemoteMedia, f as readResponseWithLimit, g as createSlackWebClient, h as fetchWithTimeout, i as resolveSlackThreadTs, l as loadWebMedia, m as bindAbortRelay, n as deliverReplies, o as renderMarkdownWithMarkers, p as fetchWithSsrFGuard, s as markdownToIRWithMeta, t as createSlackReplyDeliveryPlan, u as MediaFetchError, v as parseSlackBlocksInput, x as parseSlackTarget, y as validateSlackBlocksArray } from "./replies-BYF1gbJf.js";
-import { $ as loadSessionStore, $t as resolveToolProfilePolicy, A as formatRawAssistantErrorForUi, At as resolveMainSessionKey, B as isRateLimitAssistantError, Bt as saveMediaBuffer, C as downgradeOpenAIReasoningBlocks, Ct as resolveChannelResetConfig, D as classifyFailoverReason, Dt as DEFAULT_RESET_TRIGGERS, E as BILLING_ERROR_USER_MESSAGE, Et as resolveThreadFlag, F as isCompactionFailureError, Ft as createBrowserRouteContext, G as parseImageSizeError, Gt as resolveBrowserControlAuth, H as isTimeoutErrorMessage, Ht as resolveExistingPathsWithinRoot, I as isContextOverflowError, It as registerBrowserRoutes, J as resolveSandboxContext, Jt as collectExplicitAllowlist, K as sanitizeUserFacingText, Kt as applyOwnerOnlyToolPolicy, L as isFailoverAssistantError, Lt as resolveBrowserConfig, M as isAuthAssistantError, Mt as resolveGroupSessionKey, N as isBillingAssistantError, Nt as acquireSessionWriteLock, O as formatAssistantErrorText, Ot as resolveFreshSessionTotalTokens, P as isCloudCodeAssistFormatError, Pt as resolveSessionLockMaxHoldFromTimeout, Q as resolveAndPersistSessionFile, Qt as normalizeToolName$1, R as isFailoverErrorMessage, Rt as resolveProfile, S as extractToolResultId, St as evaluateSessionFreshness, T as isGoogleModelApi, Tt as resolveSessionResetType, U as isTransientHttpError, Ut as getBridgeAuthForPort, V as isRawApiErrorPayload, Vt as DEFAULT_UPLOAD_DIR, W as parseImageDimensionError, Wt as ensureBrowserControlAuth, X as extractDeliveryInfo, Xt as expandToolGroups, Y as resolveSandboxRuntimeStatus, Yt as expandPolicyWithPluginGroups, Z as appendAssistantMessageToSessionTranscript, Zt as mergeAlsoAllowPolicy, _ as sanitizeSessionMessagesImages, _t as INPUT_PROVENANCE_KIND_VALUES, a as normalizeChannelTargetInput, an as resolveBootstrapMaxChars, at as updateSessionStoreEntry, b as resolveImageSanitizationLimits, bt as normalizeInputProvenance, c as parseReplyDirectives, cn as getGlobalHookRunner, ct as deliveryContextFromSession, d as parseInlineDirectives$1, dt as normalizeDeliveryContext, en as stripPluginOnlyAllowlist, et as readSessionUpdatedAt, f as validateAnthropicTurns, ft as normalizeSessionDeliveryFields, g as normalizeTextForComparison, gt as extractToolCallNames, h as isMessagingToolDuplicateNormalized, ht as countToolResults, i as buildTargetResolverSignature, in as ensureSessionHeader, it as updateSessionStore, j as getApiErrorPayloadFingerprint, jt as deriveSessionMetaPatch, k as formatBillingErrorMessage, kt as canonicalizeMainSessionAlias, l as MEDIA_TOKEN_RE, ln as initializeGlobalHookRunner, lt as deliveryContextKey, m as pickFallbackThinkingLevel, mt as capArrayByJsonBytes, nn as matchesAnyGlobPattern, o as normalizeTargetForProvider, on as resolveBootstrapTotalMaxChars, ot as isCacheEnabled, p as validateGeminiTurns, pt as archiveSessionTranscripts, q as ensureSandboxWorkspaceForSession, qt as buildPluginToolGroups, r as normalizeReplyPayloadsForDelivery, rn as buildBootstrapContextFiles, rt as updateLastRoute, s as throwIfAborted, sn as sanitizeGoogleTurnOrdering, st as resolveCacheTtlMs$1, t as deliverOutboundPayloads, tn as compileGlobPatterns, tt as recordSessionMetaFromInbound, u as splitMediaFromOutput, ut as mergeDeliveryContext, v as sanitizeImageBlocks, vt as applyInputProvenanceToUserMessage, w as isAntigravityClaude, wt as resolveSessionResetPolicy, x as extractToolCallsFromAssistant, xt as resolveSessionKey, y as sanitizeToolResultImages, yt as hasInterSessionUserProvenance, z as isLikelyContextOverflowError, zt as getMediaDir } from "./deliver-oWGJwzFf.js";
+import { $ as loadSessionStore, $t as resolveToolProfilePolicy, A as formatRawAssistantErrorForUi, At as resolveMainSessionKey, B as isRateLimitAssistantError, Bt as saveMediaBuffer, C as downgradeOpenAIReasoningBlocks, Ct as resolveChannelResetConfig, D as classifyFailoverReason, Dt as DEFAULT_RESET_TRIGGERS, E as BILLING_ERROR_USER_MESSAGE, Et as resolveThreadFlag, F as isCompactionFailureError, Ft as createBrowserRouteContext, G as parseImageSizeError, Gt as resolveBrowserControlAuth, H as isTimeoutErrorMessage, Ht as resolveExistingPathsWithinRoot, I as isContextOverflowError, It as registerBrowserRoutes, J as resolveSandboxContext, Jt as collectExplicitAllowlist, K as sanitizeUserFacingText, Kt as applyOwnerOnlyToolPolicy, L as isFailoverAssistantError, Lt as resolveBrowserConfig, M as isAuthAssistantError, Mt as resolveGroupSessionKey, N as isBillingAssistantError, Nt as acquireSessionWriteLock, O as formatAssistantErrorText, Ot as resolveFreshSessionTotalTokens, P as isCloudCodeAssistFormatError, Pt as resolveSessionLockMaxHoldFromTimeout, Q as resolveAndPersistSessionFile, Qt as normalizeToolName$1, R as isFailoverErrorMessage, Rt as resolveProfile, S as extractToolResultId, St as evaluateSessionFreshness, T as isGoogleModelApi, Tt as resolveSessionResetType, U as isTransientHttpError, Ut as getBridgeAuthForPort, V as isRawApiErrorPayload, Vt as DEFAULT_UPLOAD_DIR, W as parseImageDimensionError, Wt as ensureBrowserControlAuth, X as extractDeliveryInfo, Xt as expandToolGroups, Y as resolveSandboxRuntimeStatus, Yt as expandPolicyWithPluginGroups, Z as appendAssistantMessageToSessionTranscript, Zt as mergeAlsoAllowPolicy, _ as sanitizeSessionMessagesImages, _t as INPUT_PROVENANCE_KIND_VALUES, a as normalizeChannelTargetInput, an as resolveBootstrapMaxChars, at as updateSessionStoreEntry, b as resolveImageSanitizationLimits, bt as normalizeInputProvenance, c as parseReplyDirectives, cn as getGlobalHookRunner, ct as deliveryContextFromSession, d as parseInlineDirectives$1, dt as normalizeDeliveryContext, en as stripPluginOnlyAllowlist, et as readSessionUpdatedAt, f as validateAnthropicTurns, ft as normalizeSessionDeliveryFields, g as normalizeTextForComparison, gt as extractToolCallNames, h as isMessagingToolDuplicateNormalized, ht as countToolResults, i as buildTargetResolverSignature, in as ensureSessionHeader, it as updateSessionStore, j as getApiErrorPayloadFingerprint, jt as deriveSessionMetaPatch, k as formatBillingErrorMessage, kt as canonicalizeMainSessionAlias, l as MEDIA_TOKEN_RE, ln as initializeGlobalHookRunner, lt as deliveryContextKey, m as pickFallbackThinkingLevel, mt as capArrayByJsonBytes, nn as matchesAnyGlobPattern, o as normalizeTargetForProvider, on as resolveBootstrapTotalMaxChars, ot as isCacheEnabled, p as validateGeminiTurns, pt as archiveSessionTranscripts, q as ensureSandboxWorkspaceForSession, qt as buildPluginToolGroups, r as normalizeReplyPayloadsForDelivery, rn as buildBootstrapContextFiles, rt as updateLastRoute, s as throwIfAborted, sn as sanitizeGoogleTurnOrdering, st as resolveCacheTtlMs$1, t as deliverOutboundPayloads, tn as compileGlobPatterns, tt as recordSessionMetaFromInbound, u as splitMediaFromOutput, ut as mergeDeliveryContext, v as sanitizeImageBlocks, vt as applyInputProvenanceToUserMessage, w as isAntigravityClaude, wt as resolveSessionResetPolicy, x as extractToolCallsFromAssistant, xt as resolveSessionKey, y as sanitizeToolResultImages, yt as hasInterSessionUserProvenance, z as isLikelyContextOverflowError, zt as getMediaDir } from "./deliver-Cjyb6h4g.js";
 import { a as logMessageProcessed, i as logLaneEnqueue, o as logMessageQueued, r as logLaneDequeue, s as logSessionStateChange, t as diag } from "./diagnostic-BdRnGknC.js";
 import { n as getDiagnosticSessionState } from "./diagnostic-session-state-DpxCUzoM.js";
 import { S as GATEWAY_CLIENT_NAMES, _ as listDeliverableMessageChannels, a as chunkText, b as GATEWAY_CLIENT_IDS, c as resolveChunkMode, d as isSafeFenceBreak, f as parseFenceSpans, g as isMarkdownCapableMessageChannel, h as isInternalMessageChannel, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit, m as isDeliverableMessageChannel, o as chunkTextWithMode, p as INTERNAL_MESSAGE_CHANNEL, r as chunkMarkdownText, t as chunkByNewline, u as findFenceSpanAt, v as normalizeMessageChannel, x as GATEWAY_CLIENT_MODES, y as resolveGatewayMessageChannel } from "./chunk-CAZujdOi.js";
@@ -18,7 +18,7 @@ import { C as unsetConfigValueAtPath, S as setConfigValueAtPath, T as VERSION, _
 import { t as parseBooleanValue } from "./boolean-BW6OTjPi.js";
 import { i as resolveShellEnvFallbackTimeoutMs, n as getShellPathFromLoginShell, s as isTruthyEnvValue } from "./shell-env-DgjeObDZ.js";
 import { c as normalizePluginsConfig, f as isPathInsideWithRealpath, i as safeStatSync, l as resolveEnableState, n as discoverSymiPlugins, p as isDangerousHostEnvVarName, r as isPathInside, s as applyTestPluginDefaults, t as loadPluginManifestRegistry, u as resolveMemorySlotDecision } from "./manifest-registry-CAWGTwb5.js";
-import { C as rawDataToString, O as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as isSecureWebSocketUrl, x as ensureChromeExtensionRelayServer } from "./chrome-B7-rO4i9.js";
+import { C as rawDataToString, O as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as isSecureWebSocketUrl, x as ensureChromeExtensionRelayServer } from "./chrome-BKUACyeO.js";
 import { n as resolveCliName, t as formatCliCommand } from "./command-format-DPd9RN2g.js";
 import { c as assertSandboxPath, d as resolveSandboxedMediaSource, f as applySkillEnvOverrides, h as parseFrontmatterBlock, i as resolveSkillsPromptForRun, l as resolveSandboxInputPath, n as buildWorkspaceSkillSnapshot, p as applySkillEnvOverridesFromSnapshot, r as loadWorkspaceSkillEntries, s as assertMediaNotDataUrl } from "./skills-DO7WNsVJ.js";
 import { n as redactToolDetail } from "./redact-DSOAcWMe.js";
@@ -29,7 +29,7 @@ import { n as resolveConversationLabel } from "./conversation-label-DTTqF8gH.js"
 import { i as resolveSessionTranscriptPath, n as resolveSessionFilePath, o as resolveSessionTranscriptsDirForAgent, r as resolveSessionFilePathOptions, s as resolveStorePath, t as resolveDefaultSessionStorePath } from "./paths-BsT3BvfH.js";
 import { t as emitSessionTranscriptUpdate } from "./transcript-events-ChU6IQwp.js";
 import { n as saveJsonFile, t as loadJsonFile } from "./json-file-B7D44OOV.js";
-import { a as parseGeminiAuth, c as resolveMemorySearchConfig, d as requireApiKey, f as resolveApiKeyForProvider, h as resolveModelAuthMode, i as resolveOllamaBaseUrl, l as getApiKeyForModel, m as resolveEnvApiKey, n as retryAsync, o as collectProviderApiKeysForExecution, p as resolveAwsSdkEnvVarName, r as probeOllamaEmbeddingModels, s as executeWithApiKeyRotation, u as getCustomProviderApiKey } from "./manager-DhHNnMyK.js";
+import { a as parseGeminiAuth, c as resolveMemorySearchConfig, d as requireApiKey, f as resolveApiKeyForProvider, h as resolveModelAuthMode, i as resolveOllamaBaseUrl, l as getApiKeyForModel, m as resolveEnvApiKey, n as retryAsync, o as collectProviderApiKeysForExecution, p as resolveAwsSdkEnvVarName, r as probeOllamaEmbeddingModels, s as executeWithApiKeyRotation, u as getCustomProviderApiKey } from "./manager-Bryhc0Ip.js";
 import { r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-dYUr1mDQ.js";
 import { c as normalizeExtraMemoryPaths, f as runTasksWithConcurrency, s as listMemoryFiles } from "./internal-Ce-sg7EN.js";
 import { n as resolveMarkdownTableMode } from "./markdown-tables-jQzXAsf3.js";
@@ -53,7 +53,7 @@ import { fileURLToPath } from "node:url";
 import { CURRENT_SESSION_VERSION, DefaultResourceLoader, SessionManager, SettingsManager, codingTools, createAgentSession, createEditTool, createReadTool, createWriteTool, estimateTokens, generateSummary, readTool } from "@mariozechner/pi-coding-agent";
 import crypto, { X509Certificate, createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import AjvPkg from "ajv";
-import { WebSocket as WebSocket$1 } from "ws";
+import { WebSocket } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { complete, createAssistantMessageEventStream, streamSimple } from "@mariozechner/pi-ai";
 import { BedrockClient, ListFoundationModelsCommand } from "@aws-sdk/client-bedrock";
@@ -3390,7 +3390,7 @@ async function getMemorySearchManager(params) {
 				const wrapper = new FallbackMemoryManager({
 					primary,
 					fallbackFactory: async () => {
-						const { MemoryIndexManager } = await import("./manager-DhHNnMyK.js").then((n) => n.t);
+						const { MemoryIndexManager } = await import("./manager-Bryhc0Ip.js").then((n) => n.t);
 						return await MemoryIndexManager.get(params);
 					}
 				}, () => QMD_MANAGER_CACHE.delete(cacheKey));
@@ -3403,7 +3403,7 @@ async function getMemorySearchManager(params) {
 		}
 	}
 	try {
-		const { MemoryIndexManager } = await import("./manager-DhHNnMyK.js").then((n) => n.t);
+		const { MemoryIndexManager } = await import("./manager-Bryhc0Ip.js").then((n) => n.t);
 		return { manager: await MemoryIndexManager.get(params) };
 	} catch (err) {
 		return {
@@ -5918,7 +5918,7 @@ var GatewayClient = class {
 				if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
 			});
 		}
-		this.ws = new WebSocket$1(url, wsOptions);
+		this.ws = new WebSocket(url, wsOptions);
 		this.ws.on("open", () => {
 			if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
 				const tlsError = this.validateTlsFingerprint();
@@ -6137,7 +6137,7 @@ var GatewayClient = class {
 		return null;
 	}
 	async request(method, params, opts) {
-		if (!this.ws || this.ws.readyState !== WebSocket$1.OPEN) throw new Error("gateway not connected");
+		if (!this.ws || this.ws.readyState !== WebSocket.OPEN) throw new Error("gateway not connected");
 		const id = randomUUID();
 		const frame = {
 			type: "req",
@@ -7084,7 +7084,7 @@ async function routeReply(params) {
 	const resolvedReplyToId = replyToId ?? (channelId === "slack" && threadId != null && threadId !== "" ? String(threadId) : void 0);
 	const resolvedThreadId = channelId === "slack" ? null : threadId ?? null;
 	try {
-		const { deliverOutboundPayloads } = await import("./deliver-oWGJwzFf.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-Cjyb6h4g.js").then((n) => n.n);
 		return {
 			ok: true,
 			messageId: (await deliverOutboundPayloads({
@@ -40590,11 +40590,19 @@ function createWebSearchTool(options) {
 	const provider = resolveSearchProvider(search);
 	const perplexityConfig = resolvePerplexityConfig(search);
 	const grokConfig = resolveGrokConfig(search);
+	const description = provider === "perplexity" ? "Search the web using Perplexity Sonar (direct or via OpenRouter). Returns AI-synthesized answers with citations from real-time web search." : provider === "grok" ? "Search the web using xAI Grok. Returns AI-synthesized answers with citations from real-time web search." : "Search the web using Brave Search API. Supports region-specific and localized search via country and language parameters. Returns titles, URLs, and snippets for fast research.";
+	const resolveActiveApiKey = () => {
+		if (provider === "perplexity") return resolvePerplexityApiKey(perplexityConfig)?.apiKey;
+		if (provider === "grok") return resolveGrokApiKey(grokConfig);
+		return resolveSearchApiKey(search);
+	};
 	return {
 		label: "Web Search",
 		name: "web_search",
-		description: provider === "perplexity" ? "Search the web using Perplexity Sonar (direct or via OpenRouter). Returns AI-synthesized answers with citations from real-time web search." : provider === "grok" ? "Search the web using xAI Grok. Returns AI-synthesized answers with citations from real-time web search." : "Search the web using Brave Search API. Supports region-specific and localized search via country and language parameters. Returns titles, URLs, and snippets for fast research.",
+		description,
 		parameters: WebSearchSchema,
+		checkFn: () => Boolean(resolveActiveApiKey()),
+		requiredEnv: provider === "perplexity" ? ["PERPLEXITY_API_KEY", "OPENROUTER_API_KEY"] : provider === "grok" ? ["XAI_API_KEY"] : ["BRAVE_API_KEY"],
 		execute: async (_toolCallId, args) => {
 			const perplexityAuth = provider === "perplexity" ? resolvePerplexityApiKey(perplexityConfig) : void 0;
 			const apiKey = provider === "perplexity" ? perplexityAuth?.apiKey : provider === "grok" ? resolveGrokApiKey(grokConfig) : resolveSearchApiKey(search);
@@ -41140,7 +41148,7 @@ async function deliverSessionMaintenanceWarning(params) {
 		return;
 	}
 	try {
-		const { deliverOutboundPayloads } = await import("./deliver-oWGJwzFf.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-Cjyb6h4g.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg: params.cfg,
 			channel,
@@ -60903,6 +60911,44 @@ function applyToolPolicyPipeline(params) {
 	return filtered;
 }
 
+//#endregion
+//#region src/agents/tools/availability-filter.ts
+const FORCE_ALL_TOOLS_ENV = "SYMI_FORCE_ALL_TOOLS";
+/**
+* Filter the tool palette by each tool's `checkFn`. Tools without a
+* checkFn pass through unchanged. Throwing checkFns are treated as
+* available (defensive). The `SYMI_FORCE_ALL_TOOLS=1` env bypasses the
+* filter entirely.
+*
+* Pure function — does not mutate the input array.
+*/
+function filterToolsByAvailability(tools) {
+	if (isTruthyEnvValue(process.env[FORCE_ALL_TOOLS_ENV])) return [...tools];
+	const out = [];
+	for (const tool of tools) {
+		if (!tool.checkFn) {
+			out.push(tool);
+			continue;
+		}
+		let available;
+		try {
+			available = tool.checkFn();
+		} catch (err) {
+			logVerbose(`tool availability: checkFn for "${getToolName(tool)}" threw — including tool anyway. ${String(err)}`);
+			out.push(tool);
+			continue;
+		}
+		if (available) out.push(tool);
+		else logVerbose(`tool availability: filtered out "${getToolName(tool)}" — checkFn returned false. Set ${FORCE_ALL_TOOLS_ENV}=1 to bypass this filter.`);
+	}
+	return out;
+}
+function getToolName(tool) {
+	const definition = tool.definition;
+	if (definition && typeof definition.name === "string") return definition.name;
+	return "(unknown tool)";
+}
+
 //#endregion
 //#region src/agents/pi-tools.ts
 function isOpenAIProvider(provider) {
@@ -61122,7 +61168,7 @@ function createSymiCodingTools(options) {
 		root: sandboxRoot,
 		bridge: sandboxFsBridge
 	}), readEditTracker) : null;
-	const withHooks = applyToolPolicyPipeline({
+	const withHooks = filterToolsByAvailability(applyToolPolicyPipeline({
 		tools: applyOwnerOnlyToolPolicy([
 			...base,
 			...sandboxRoot ? allowWorkspaceWrites && sandboxedEditTool && sandboxedWriteTool ? [workspaceOnly ? wrapToolWorkspaceRootGuard(sandboxedEditTool, sandboxRoot) : sandboxedEditTool, workspaceOnly ? wrapToolWorkspaceRootGuard(sandboxedWriteTool, sandboxRoot) : sandboxedWriteTool] : [] : [],
@@ -61194,7 +61240,7 @@ function createSymiCodingTools(options) {
 				label: "subagent tools.allow"
 			}
 		]
-	}).map((tool) => normalizeToolParameters(tool, { modelProvider: options?.modelProvider })).map((tool) => wrapToolWithBeforeToolCallHook(tool, {
+	})).map((tool) => normalizeToolParameters(tool, { modelProvider: options?.modelProvider })).map((tool) => wrapToolWithBeforeToolCallHook(tool, {
 		agentId,
 		sessionKey: options?.sessionKey,
 		loopDetection: resolveToolLoopDetectionConfig({

package/dist/{pi-embedded-helpers-B5cWV7_y.js → pi-embedded-helpers-y3vJmW6T.js}

@@ -1,11 +1,11 @@
 import { x as truncateUtf16Safe } from "./utils-CTPsqyE_.js";
 import { t as createSubsystemLogger } from "./subsystem-CHbO_DkH.js";
-import { s as formatSandboxToolPolicyBlockedMessage } from "./sandbox-Dx8IMw-E.js";
-import { i as getImageMetadata, n as buildImageResizeSideGrid, s as resizeToJpeg, t as IMAGE_REDUCE_QUALITY_STEPS } from "./image-ops-L70xVnpG.js";
+import { s as formatSandboxToolPolicyBlockedMessage } from "./sandbox-DQCaejcD.js";
+import { i as getImageMetadata, n as buildImageResizeSideGrid, s as resizeToJpeg, t as IMAGE_REDUCE_QUALITY_STEPS } from "./image-ops-BzCBIakN.js";
 import { s as normalizeThinkLevel } from "./thinking-COroyVA5.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/agents/pi-embedded-helpers/bootstrap.ts
 function isBase64Signature(value) {
@@ -102,10 +102,10 @@ function clampToBudget(content, budget) {
 async function ensureSessionHeader(params) {
 	const file = params.sessionFile;
 	try {
-		await fs.stat(file);
+		await fsPromises.stat(file);
 		return;
 	} catch {}
-	await fs.mkdir(path.dirname(file), { recursive: true });
+	await fsPromises.mkdir(path.dirname(file), { recursive: true });
 	const entry = {
 		type: "session",
 		version: 2,
@@ -113,7 +113,7 @@ async function ensureSessionHeader(params) {
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
 		cwd: params.cwd
 	};
-	await fs.writeFile(file, `${JSON.stringify(entry)}\n`, "utf-8");
+	await fsPromises.writeFile(file, `${JSON.stringify(entry)}\n`, "utf-8");
 }
 function buildBootstrapContextFiles(files, opts) {
 	const maxChars = opts?.maxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS;

package/dist/{pi-tools.policy-BdGVEMZn.js → pi-tools.policy-ji-L-Mpv.js}

@@ -1,7 +1,7 @@
 import { S as resolveThreadParentSessionKey, c as resolveAgentIdFromSessionKey } from "./session-key-DUSb7CCb.js";
-import { r as resolveAgentConfig } from "./agent-scope-DOrZjOnW.js";
-import { A as DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH } from "./config-D7SS4vdk.js";
-import { T as matchesAnyGlobPattern, w as compileGlobPatterns, x as normalizeToolName, y as expandToolGroups } from "./sandbox-Dx8IMw-E.js";
+import { r as resolveAgentConfig } from "./agent-scope-Bnsyyeci.js";
+import { A as DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH } from "./config-D-PYSlE8.js";
+import { T as matchesAnyGlobPattern, w as compileGlobPatterns, x as normalizeToolName, y as expandToolGroups } from "./sandbox-DQCaejcD.js";
 import { a as resolveChannelGroupToolsPolicy, t as getChannelDock } from "./dock-hF45sewN.js";
 import { l as normalizeMessageChannel } from "./message-channel-DgjXWzf-.js";
 

package/dist/{plugin-auto-enable-B_lNp6yM.js → plugin-auto-enable-Ctbn2w4Q.js}

@@ -1,6 +1,6 @@
 import { o as getChatChannelMeta, s as listChatChannels, u as normalizeChatChannelId } from "./registry-Sbac4a4z.js";
 import { u as isRecord } from "./utils-CTPsqyE_.js";
-import { u as normalizeProviderId } from "./model-selection-7wdmO-Iw.js";
+import { u as normalizeProviderId } from "./model-selection-CCTzD29o.js";
 import { n as getChannelPluginCatalogEntry, r as listChannelPluginCatalogEntries } from "./catalog-DsC3JTw1.js";
 import { t as ensurePluginAllowlisted } from "./plugins-allowlist-CWCQC08H.js";
 

package/dist/{plugin-registry-DovNSdK0.js → plugin-registry-D2ZbwBU_.js}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { s as loadSymiPlugins } from "./unified-runner-DZAjU6aB.js";
+import { s as loadSymiPlugins } from "./unified-runner-BIUJm_Iv.js";
 import { d as getActivePluginRegistry } from "./registry-Sbac4a4z.js";
 import { t as createSubsystemLogger } from "./subsystem-CHbO_DkH.js";
-import { c as resolveAgentWorkspaceDir, l as resolveDefaultAgentId } from "./agent-scope-DOrZjOnW.js";
-import { i as loadConfig } from "./config-D7SS4vdk.js";
+import { c as resolveAgentWorkspaceDir, l as resolveDefaultAgentId } from "./agent-scope-Bnsyyeci.js";
+import { i as loadConfig } from "./config-D-PYSlE8.js";
 
 //#region src/cli/plugin-registry.ts
 var plugin_registry_exports = /* @__PURE__ */ __exportAll({ ensurePluginRegistryLoaded: () => ensurePluginRegistryLoaded });

package/dist/{plugin-registry-CAdIrLmG.js → plugin-registry-pKaJ4ltN.js}

@@ -2,7 +2,7 @@ import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { M as getActivePluginRegistry, o as createSubsystemLogger } from "./entry.js";
 import { c as resolveAgentWorkspaceDir, l as resolveDefaultAgentId } from "./agent-scope-C-Jte08L.js";
 import { i as loadConfig } from "./config-_DaupjQd.js";
-import { m as loadSymiPlugins } from "./subagent-registry-Dkif1XYO.js";
+import { m as loadSymiPlugins } from "./subagent-registry-DWemyjbN.js";
 
 //#region src/cli/plugin-registry.ts
 var plugin_registry_exports = /* @__PURE__ */ __exportAll({ ensurePluginRegistryLoaded: () => ensurePluginRegistryLoaded });

package/dist/plugin-sdk/agents/pi-tools.types.d.ts

@@ -1,2 +1 @@
-import type { AgentTool } from "@mariozechner/pi-agent-core";
-export type AnyAgentTool = AgentTool<any, unknown>;
+export type { AnyAgentTool } from "./tools/common.js";

package/dist/plugin-sdk/agents/tools/availability-filter.d.ts

@@ -0,0 +1,10 @@
+import type { AnyAgentTool } from "./common.js";
+/**
+ * Filter the tool palette by each tool's `checkFn`. Tools without a
+ * checkFn pass through unchanged. Throwing checkFns are treated as
+ * available (defensive). The `SYMI_FORCE_ALL_TOOLS=1` env bypasses the
+ * filter entirely.
+ *
+ * Pure function — does not mutate the input array.
+ */
+export declare function filterToolsByAvailability(tools: readonly AnyAgentTool[]): AnyAgentTool[];

package/dist/plugin-sdk/agents/tools/common.d.ts

@@ -2,6 +2,36 @@ import type { AgentTool, AgentToolResult } from "@mariozechner/pi-agent-core";
 import type { ImageSanitizationLimits } from "../image-sanitization.js";
 export type AnyAgentTool = AgentTool<any, unknown> & {
     ownerOnly?: boolean;
+    /**
+     * Optional runtime availability check. If defined and returns `false`,
+     * the tool is filtered out of the agent's palette before the LLM ever
+     * sees it — preventing wasted turns on tools that can't actually run
+     * (e.g., a search tool with no API key configured).
+     *
+     * **Defensive design rules**:
+     * - Default behavior (when not defined) is "always available" — tools
+     *   without checkFn are NEVER filtered. Existing tools keep working
+     *   exactly as before.
+     * - When implementing checkFn, only return `false` if the tool is
+     *   CERTAIN to fail. When uncertain, return `true` and let the agent
+     *   try — better to surface the real error than to wrongly hide a
+     *   working tool.
+     * - For multi-credential tools (e.g., web_search has 4 providers),
+     *   return `true` if ANY credential path is available.
+     * - The user can bypass all checkFn filtering by setting the env var
+     *   `SYMI_FORCE_ALL_TOOLS=1` — useful when our check is wrong and
+     *   the user knows their setup works.
+     */
+    checkFn?: () => boolean;
+    /**
+     * Optional declarative list of env var names this tool may use. Pure
+     * metadata — the gateway uses it to answer "Why isn't tool X
+     * available?" by listing which env vars would enable it. Not consumed
+     * for actual gating (that's checkFn's job). When the tool accepts
+     * credentials from multiple sources (env, config, profile store),
+     * list every env var name it ever consults.
+     */
+    requiredEnv?: readonly string[];
 };
 export type StringParamOptions = {
     required?: boolean;