@wrongstack/core 0.250.0 → 0.256.0

package/dist/defaults/index.d.ts

@@ -1,39 +1,39 @@
 export { D as DefaultLogger, a as DefaultLoggerOptions, L as LogFormat } from '../logger-DmmQhf4P.js';
-export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../plan-templates-BUVRY0pU.js';
-export { D as DefaultSessionReader } from '../session-reader-CCOssnBS.js';
-export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-BhtkkFFy.js';
+export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../plan-templates-DPiQMkBz.js';
+export { D as DefaultSessionReader } from '../session-reader-CqRvaL5v.js';
+export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-BAFWdgQ3.js';
 export { a as DirectorStateCheckpoint, D as DirectorStateSnapshot, b as DirectorSubagentState, c as DirectorTaskState, l as loadDirectorState } from '../director-state-BfeCUbmk.js';
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CeVNiy_f.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-AOk0LVsV.js';
-export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, E as EternalAutonomyEngine, c as EternalAutonomyOptions, d as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, e as ParallelEternalEngine, f as ParallelEternalOptions, g as ParallelIterationStage, T as ToolExecutor } from '../parallel-eternal-engine-UZg1xOzE.js';
-export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultSkillLoader, d as DoneCheckResult, e as DoneConditionChecker, I as IntelligentCompactor, f as IntelligentCompactorOptions, S as SelectiveCompactor, g as SelectiveCompactorOptions, h as SkillLoaderOptions, i as StrategyCompactorOptions, j as buildGoalPreamble, k as createStrategyCompactor, m as makeAutonomyPromptContributor } from '../goal-preamble-BjJpnLW4.js';
-import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-D0HgUqwV.js';
-import { b as Response } from '../context-CLz3z_E8.js';
-export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetHealthTool, a8 as makeFleetSessionTool, a9 as makeFleetStatusTool, aa as makeFleetUsageTool, ab as makeRollUpTool, ac as makeSpawnTool, ad as makeTerminateTool, af as rosterSummaryFromConfigs } from '../null-fleet-bus-Do1OLYpj.js';
-export { b as AgentBudgetTier, c as AgentCapability, A as AgentDefinition, d as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-CnbEqpv0.js';
-export { h as AgentFactory, i as AgentFactoryResult, j as AgentRunnerOptions, k as BudgetExceededError, l as BudgetKind, m as BudgetLimits, r as BudgetUsage, F as FleetBus, s as FleetEvent, t as FleetHandler, u as FleetUsage, v as FleetUsageAggregator, w as SubagentBudget, x as SubagentUsageSnapshot, y as makeAgentSubagentRunner } from '../agent-subagent-runner-Dz-9kiE6.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-4gc0vfW2.js';
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-DpanBg8D.js';
-export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, l as loadProjectModes, b as loadUserModes } from '../llm-selector-D22R4AFz.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BkYkJWQs.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-B8rSu908.js';
+export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, E as EternalAutonomyEngine, c as EternalAutonomyOptions, d as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, e as ParallelEternalEngine, f as ParallelEternalOptions, g as ParallelIterationStage, T as ToolExecutor } from '../parallel-eternal-engine-C0juOszP.js';
+export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultSkillLoader, d as DoneCheckResult, e as DoneConditionChecker, I as IntelligentCompactor, f as IntelligentCompactorOptions, S as SelectiveCompactor, g as SelectiveCompactorOptions, h as SkillLoaderOptions, i as StrategyCompactorOptions, j as buildGoalPreamble, k as createStrategyCompactor, m as makeAutonomyPromptContributor } from '../goal-preamble-UiEkbNmW.js';
+import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-hM7EXlLI.js';
+import { b as Response } from '../context-CGdgA0q6.js';
+export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetHealthTool, a8 as makeFleetSessionTool, a9 as makeFleetStatusTool, aa as makeFleetUsageTool, ab as makeRollUpTool, ac as makeSpawnTool, ad as makeTerminateTool, af as rosterSummaryFromConfigs } from '../null-fleet-bus-B5mfTJXT.js';
+export { b as AgentBudgetTier, c as AgentCapability, A as AgentDefinition, d as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-DqTUEAeC.js';
+export { h as AgentFactory, i as AgentFactoryResult, j as AgentRunnerOptions, k as BudgetExceededError, l as BudgetKind, m as BudgetLimits, r as BudgetUsage, F as FleetBus, s as FleetEvent, t as FleetHandler, u as FleetUsage, v as FleetUsageAggregator, w as SubagentBudget, x as SubagentUsageSnapshot, y as makeAgentSubagentRunner } from '../agent-subagent-runner-US741uBH.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-BrxWHEOm.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-ByZCdFuQ.js';
+export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, l as loadProjectModes, b as loadUserModes } from '../llm-selector-CJ4SyAFE.js';
 export { AISpecBuilder, AISpecBuilderOptions, AISpecPhase, AISpecSession, AutoExecutor, AutoExecutorOptions, BottleneckTask, CollectedAnswer, CriticalPathAnalysis, DefaultTaskStore, ExecutionSummary, GeneratedTask, RunResult, SPEC_TEMPLATES, SddParallelRun, SddParallelRunOptions, SddProgress, SddTaskDecomposer, SddTaskDecomposerOptions, SpecDiff, SpecDrivenDev, SpecDrivenDevOptions, SpecIndexEntry, SpecParser, SpecStore, SpecStoreOptions, SpecVersion, SpecVersioning, TaskBatch, TaskExecutionContext, TaskExecutionResult, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskGraphIndexEntry, TaskGraphStore, TaskGraphStoreOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, WaveResult, analyzeCriticalPath, createAutoExecutor, getTemplate, listTemplates, renderProgress, renderSpecAnalysis, renderTaskGraph, renderTaskList, templateToMarkdown } from '../sdd/index.js';
 export { DefaultHealthRegistry, InMemoryMetricsSink, MetricsServerHandle, MetricsServerOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, buildOtlpMetricsRequest, buildOtlpTracesRequest, renderPrometheus, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from '../observability/index.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, q as slackServer, z as zaiVisionServer } from '../mcp-servers-DfXxCASH.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, q as slackServer, z as zaiVisionServer } from '../mcp-servers-D8YnLaEp.js';
 export { D as DEFAULT_AUTONOMY_CONFIG, a as DEFAULT_CONTEXT_CONFIG, d as DEFAULT_TOOLS_CONFIG } from '../default-config-CXsDvOmP.js';
 import '../logger-B63L5bTg.js';
-import '../brain-sCZ3lCjq.js';
-import '../permission-DbWPbuoA.js';
+import '../brain-TjEEwSpw.js';
+import '../permission-CwBBpCoF.js';
 import '../wstack-paths-CJjEwPXn.js';
-import '../config-eSsrto5d.js';
+import '../config-DuAu23zm.js';
 import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';
-import '../retry-policy-BVnkbMET.js';
-import '../compactor-BRfg3QPd.js';
-import '../index-IehiNryU.js';
-import '../pipeline-D1n-gQI-.js';
+import '../retry-policy-Tg7LXkoK.js';
+import '../compactor-C5sT4U7I.js';
+import '../index-CitPrI3a.js';
+import '../pipeline-JG8XoudC.js';
 import '../observability-D-HZN_mF.js';
 import '../goal-store-CV9Yz2X_.js';
-import '../skill-Bj6Ezqb8.js';
-import '../selector-Cb4_9-hf.js';
+import '../skill-DGIXCtdv.js';
+import '../selector-DWsqVjGf.js';
 import 'node:events';
 import '../mode-CZlO9iU1.js';
 import '../spec-TBi3Jr6T.js';

package/dist/defaults/index.js

@@ -4366,9 +4366,28 @@ var PATTERNS = [
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;
+function hasCredentialAnchors(text) {
+  return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
+  text.includes("sk-") || // Anthropic + OpenAI keys
+  text.includes("sk_") || // Stripe live/test keys
+  text.includes("ghp_") || // GitHub PAT v1
+  text.includes("github_pat_") || // GitHub PAT v2
+  text.includes("eyJ") || // JWT
+  text.includes("AKIA") || // AWS access key
+  text.includes("AIza") || // GCP service key
+  text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
+  text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
+  text.includes("/bot") || // Telegram bot token (URL path pattern)
+  text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
+  text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
+  text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
+  text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
+  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://");
+}
 var DefaultSecretScrubber = class {
   scrub(text) {
     if (!text) return text;
+    if (!hasCredentialAnchors(text)) return text;
     if (text.length <= SCRUB_CHUNK_BYTES) {
       return this.scrubOne(text);
     }
@@ -4386,6 +4405,7 @@ var DefaultSecretScrubber = class {
     return out.join("");
   }
   scrubOne(text) {
+    if (!hasCredentialAnchors(text)) return text;
     let out = text;
     for (const p of PATTERNS) {
       out = out.replace(p.regex, (_match, group1, group2) => {
@@ -4421,10 +4441,14 @@ var ToolCapabilities = {
   SHELL_ARBITRARY: "shell.arbitrary",
   /** Can execute a restricted set of commands (the `exec` tool). */
   SHELL_RESTRICTED: "shell.restricted",
+  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
+  FS_READ: "fs.read",
   /** Can write / modify / delete files inside the project. */
   FS_WRITE: "fs.write",
   /** Can write files outside the current project root (very high risk). */
   FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
+  /** Can perform outbound network requests. */
+  NET_OUTBOUND: "net.outbound",
   /** Proxies tools from external MCP servers (unknown capability). */
   MCP_PROXY: "mcp.proxy",
   /** Can spawn or manage subagents / multi-agent tasks. */
@@ -4657,6 +4681,21 @@ var DefaultPermissionPolicy = class {
   promptDelegate;
   /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
   wildcardEntries = [];
+  /**
+   * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
+   * with the same tool+input skip namespace matching, subject computation,
+   * pattern matching (matchAny), and YOLO destructive gating.
+   *
+   * Cleared on any state change (reload, trust, deny, yolo toggle) because
+   * the result depends on the full policy state. The write-tool smart-bypass
+   * (step 7 in `evaluate()`) is not cached since `ctx.hasRead()` changes
+   * dynamically within a session.
+   *
+   * LRU eviction is not needed — the cache is cleared on state changes
+   * that are rare (trust file ops, user confirm) and the number of unique
+   * tool+subject pairs per iteration is small (<50).
+   */
+  _evalCache = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
@@ -4675,6 +4714,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle YOLO (auto-approve) mode at runtime. */
   setYolo(enabled) {
+    if (this.yolo !== enabled) this._evalCache.clear();
     this.yolo = enabled;
   }
   /** Check whether YOLO mode is currently active. */
@@ -4683,6 +4723,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle the destructive YOLO override at runtime. */
   setYoloDestructive(enabled) {
+    if (this.yoloDestructive !== enabled) this._evalCache.clear();
     this.yoloDestructive = enabled;
   }
   /** Check whether the destructive YOLO override is active. */
@@ -4691,6 +4732,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
   setConfirmDestructive(enabled) {
+    if (this.confirmDestructive !== enabled) this._evalCache.clear();
     this.confirmDestructive = enabled;
   }
   /** Check whether destructive confirmation gate is active. */
@@ -4711,6 +4753,7 @@ var DefaultPermissionPolicy = class {
     }
     this.sessionDenied.clear();
     this.sessionAllowed.clear();
+    this._evalCache.clear();
     this.loaded = true;
   }
   async evaluate(tool, input, ctx) {
@@ -4718,44 +4761,60 @@ var DefaultPermissionPolicy = class {
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = this.subjectFor(tool.name, input, tool.subjectKey);
-    const subjectKey = `${tool.name}::${subject ?? tool.name}`;
-    if (this.sessionDenied.has(subjectKey)) {
-      return { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+    const cacheKey = `${tool.name}::${subject ?? tool.name}`;
+    if (tool.name !== "write") {
+      const cached = this._evalCache.get(cacheKey);
+      if (cached !== void 0) return cached;
+    }
+    if (this.sessionDenied.has(cacheKey)) {
+      const decision = { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
-    if (this.sessionAllowed.has(subjectKey)) {
-      return {
+    if (this.sessionAllowed.has(cacheKey)) {
+      const decision = {
         permission: "auto",
         source: "trust",
         reason: "session soft allow (user pressed yes)"
       };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.deny && subject && matchAny(entry.deny, subject)) {
-      return { permission: "deny", source: "deny", reason: "matched deny pattern" };
+      const decision = { permission: "deny", source: "deny", reason: "matched deny pattern" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (tool.permission === "deny") {
-      return { permission: "deny", source: "default", reason: "tool default deny" };
+      const decision = { permission: "deny", source: "default", reason: "tool default deny" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.allow && subject && matchAny(entry.allow, subject)) {
-      return { permission: "auto", source: "trust", reason: "matched allow pattern" };
+      const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.auto) {
-      return { permission: "auto", source: "trust" };
+      const decision = { permission: "auto", source: "trust" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (this.yolo) {
       if (this.confirmDestructive) {
         const destructive = this.isDestructiveYoloCall(tool, input, ctx);
         if (destructive) {
           if (this.promptDelegate) {
-            const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision === "always") {
+            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
+            if (decision2 === "always") {
               await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
               return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
             }
-            if (decision === "deny") {
+            if (decision2 === "deny") {
               await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
               return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
             }
-            return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
+            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
           }
           return {
             permission: "confirm",
@@ -4765,7 +4824,9 @@ var DefaultPermissionPolicy = class {
           };
         }
       }
-      return { permission: "auto", source: "yolo" };
+      const decision = { permission: "auto", source: "yolo" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (tool.name === "write" && subject) {
       if (ctx.hasRead(subject)) {
@@ -4777,7 +4838,9 @@ var DefaultPermissionPolicy = class {
       }
     }
     if (tool.permission === "auto" && !tool.mutating) {
-      return { permission: "auto", source: "default" };
+      const decision = { permission: "auto", source: "default" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (this.promptDelegate) {
       const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
@@ -4810,6 +4873,7 @@ var DefaultPermissionPolicy = class {
     const entry = this.policy[rule.tool] ?? {};
     entry.allow = Array.from(/* @__PURE__ */ new Set([...entry.allow ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
+    this._evalCache.clear();
     try {
       await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
     } catch (err) {
@@ -4827,6 +4891,7 @@ var DefaultPermissionPolicy = class {
     const entry = this.policy[rule.tool] ?? {};
     entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
+    this._evalCache.clear();
     try {
       await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
     } catch (err) {
@@ -4841,10 +4906,12 @@ var DefaultPermissionPolicy = class {
   /** Block this tool+pattern for the rest of this session (no trust file). */
   denyOnce(rule) {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
+    this._evalCache.clear();
   }
   /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
+    this._evalCache.clear();
   }
   subjectFor(toolName, input, subjectKey) {
     if (!input || typeof input !== "object") return void 0;
@@ -4880,15 +4947,23 @@ var DefaultPermissionPolicy = class {
   }
 };
 var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
+  allowedCapabilities;
+  constructor(allowedCapabilities) {
+    this.allowedCapabilities = allowedCapabilities ?? [
+      ToolCapabilities.FS_READ,
+      ToolCapabilities.NET_OUTBOUND
+    ];
+  }
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
   async evaluate(tool) {
-    const hasDangerousCap = hasDangerousCapabilityForSubagents(tool);
+    const caps = tool.capabilities ?? [];
+    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const blocked = tool.permission === "deny" || hasDangerousCap || isMcp;
+    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap;
     if (blocked) {
-      const reason = hasDangerousCap ? `tool declares dangerous capability (${tool.capabilities?.join(", ")}) \u2014 not auto-approved for subagents` : isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : "tool default deny";
+      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",
@@ -5101,6 +5176,35 @@ var DefaultErrorHandler = class {
     return null;
   }
 };
+function stripFrontmatter(raw) {
+  if (!raw.startsWith("---")) return raw;
+  const end = raw.indexOf("\n---", 4);
+  if (end === -1) return raw;
+  let body = raw.slice(end + 4);
+  if (body.startsWith("\n")) body = body.slice(1);
+  return body;
+}
+function compactSkillBody(body) {
+  const sections = [];
+  const overviewMatch = body.match(/##\s*Overview\s*\n([\s\S]*?)(?=\n##|\n$|$)/i);
+  const overview = overviewMatch?.[1];
+  if (overview?.trim()) {
+    sections.push(overview.trim().slice(0, 200));
+  }
+  const rulesMatch = body.match(/##\s*Rules\s*\n([\s\S]*?)(?=\n##|\n$|$)/i);
+  const rules = rulesMatch?.[1];
+  if (rules?.trim()) {
+    const trimmed = rules.trim().slice(0, 350);
+    const ruleLines = trimmed.split("\n").filter((l) => /^\s*[-*]\s/.test(l) || /^\s*\d+[.)]\s/.test(l)).slice(0, 6).join("\n");
+    if (ruleLines) sections.push(ruleLines);
+  }
+  if (sections.length === 0) {
+    const first = body.trim().slice(0, 200);
+    if (first) sections.push(first);
+  }
+  const result = sections.join("\n\n");
+  return result.length > 450 ? result.slice(0, 447) + "\u2026" : result;
+}
 var DefaultSkillLoader = class {
   dirs;
   cache;
@@ -5182,6 +5286,24 @@ var DefaultSkillLoader = class {
     if (!m) throw new Error(`Skill "${name}" not found`);
     return fsp.readFile(m.path, "utf8");
   }
+  async readSaveBody(name) {
+    const m = await this.find(name);
+    if (!m) throw new Error(`Skill "${name}" not found`);
+    const savePath = path11.join(path11.dirname(m.path), "SKILL.save.md");
+    try {
+      return await fsp.readFile(savePath, "utf8");
+    } catch {
+      const full = await fsp.readFile(m.path, "utf8");
+      const body = stripFrontmatter(full);
+      const compact = compactSkillBody(body);
+      if (compact) {
+        return `## Overview
+
+${compact}`;
+      }
+      return body.trim().slice(0, 300);
+    }
+  }
 };
 function parseFrontmatter(raw) {
   if (!raw.startsWith("---")) return {};
@@ -5237,6 +5359,9 @@ function parseDescription(raw) {
 function completePartialObject(s) {
   if (!s.trim().startsWith("{")) return s;
   if (tryParse(s).ok) return s;
+  return repairTruncated(s);
+}
+function repairTruncated(s) {
   const stack = [];
   let inString = false;
   let escaped = false;
@@ -5833,6 +5958,14 @@ function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = C
     total
   };
 }
+function getCalibrationState(calibrationKey = CALIBRATION_GLOBAL_KEY) {
+  const cal = calState(calibrationKey);
+  return {
+    ratio: cal.ratio,
+    count: cal.count,
+    calibrated: cal.count >= MIN_SAMPLES_FOR_CALIBRATION
+  };
+}
 function estimateRequestTokensCalibrated(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
   const result = estimateRequestTokens(messages, systemPrompt, tools, calibrationKey);
   const cal = calState(calibrationKey);
@@ -6841,6 +6974,13 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         tokens = this._estimator(ctx);
       } else if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && this._cachedTokens >= 0) {
         tokens = this._cachedTokens;
+      } else if (this.tryStashedTokens(ctx, msgCount, toolCount) !== null) {
+        const stashed = this.tryStashedTokens(ctx, msgCount, toolCount);
+        const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
+        tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
+        this._cachedTokens = tokens;
+        this._cachedMsgCount = msgCount;
+        this._cachedToolCount = toolCount;
       } else {
         tokens = estimateRequestTokensCalibrated(
           ctx.messages,
@@ -6873,6 +7013,25 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       return next(ctx);
     };
   }
+  /**
+   * H1: try to read a pre-computed token total from `ctx.lastRequestTokens`
+   * (set by the agent loop's pre-flight or its restash in emitContextPct).
+   * Returns the uncalibrated total when the stash is valid for the current
+   * context shape (positive number, and the message count it was computed
+   * at matches the current one — otherwise tool results have been appended
+   * since and the value is stale). Returns null when missing or stale so
+   * the caller falls back to a fresh walk.
+   */
+  tryStashedTokens(ctx, msgCount, toolCount) {
+    const stashed = ctx.lastRequestTokens;
+    if (typeof stashed !== "number" || stashed <= 0) return null;
+    const stashedAt = ctx.meta?.["lastRequestTokensAt"];
+    if (typeof stashedAt !== "object" || stashedAt === null) return null;
+    const meta = stashedAt;
+    if (meta.msgCount !== msgCount) return null;
+    if (typeof meta.toolCount === "number" && meta.toolCount !== toolCount) return null;
+    return stashed;
+  }
   /**
    * Returns true when the previous compaction at the same or higher pressure
    * level reduced nothing and context has not grown materially since. Prevents
@@ -7128,7 +7287,7 @@ var ToolExecutor = class _ToolExecutor {
       const tool = this.registry.get(use.name);
       if (!tool) {
         const result = this.unknownToolResult(use, () => this.registry.list().map((t) => t.name));
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       const validation = validateAgainstSchema(use.input, tool.inputSchema);
@@ -7145,20 +7304,20 @@ ${errorDetails}
 Please call the tool again with arguments that match its inputSchema. You can use the "tool-help" tool with name="${tool.name}" to see the exact expected schema.`,
           is_error: true
         };
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       const toolDangerousCaps = getDangerousCapabilities(tool);
       if (hasMalformedArguments(use.input)) {
         const result = this.malformedInputResult(use, extractMalformedRaw(use.input));
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       if (this.opts.hookRunner?.has("PreToolUse")) {
         const pre = await this.opts.hookRunner.preToolUse(tool.name, use.input, ctx);
         if (pre.block) {
           const result = this.blockedByHookResult(use, pre.reason);
-          budget = this.decrementBudget(result, budget);
+          budget = this.budgetForString(result.content, budget);
           return { result, tool, durationMs: Date.now() - start };
         }
         if (pre.input) {
@@ -7174,7 +7333,7 @@ Validation errors:
 ${errorDetails}`,
               is_error: true
             };
-            budget = this.decrementBudget(result, budget);
+            budget = this.budgetForString(result.content, budget);
             return { result, tool, durationMs: Date.now() - start };
           }
           use = { ...use, input: pre.input };
@@ -7189,7 +7348,7 @@ ${errorDetails}`,
       }
       if (effectivePermission === "deny") {
         const result = this.deniedResult(use, decision.reason);
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         return { result, tool, durationMs: Date.now() - start };
       }
       if (effectivePermission === "confirm") {
@@ -7202,7 +7361,7 @@ ${errorDetails}`,
               content: `Tool "${tool.name}" denied by user.`,
               is_error: true
             };
-            budget = this.decrementBudget(result, budget);
+            budget = this.budgetForString(result.content, budget);
             return { result, tool, durationMs: Date.now() - start };
           }
         } else {
@@ -7226,7 +7385,8 @@ ${errorDetails}`,
         "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
-        let result = await this.executeTool(tool, use, ctx, budget);
+        let { block: result, bytes } = await this.executeTool(tool, use, ctx, budget);
+        budget -= bytes;
         if (this.opts.hookRunner?.has("PostToolUse")) {
           const post = await this.opts.hookRunner.postToolUse(
             tool.name,
@@ -7235,12 +7395,13 @@ ${errorDetails}`,
             ctx
           );
           if (post.additionalContext) {
-            result = { ...result, content: `${result.content}
+            const appended = `
 
-${post.additionalContext}` };
+${post.additionalContext}`;
+            result = { ...result, content: `${result.content}${appended}` };
+            budget = Math.max(0, budget - Buffer.byteLength(appended, "utf8"));
           }
         }
-        budget = this.decrementBudget(result, budget);
         span?.setAttribute("tool.is_error", !!result.is_error);
         span?.setAttribute(
           "tool.output_bytes",
@@ -7257,7 +7418,7 @@ ${post.additionalContext}` };
           content: `Tool "${tool.name}" threw: ${scrubbed}`,
           is_error: true
         };
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         if (err instanceof Error) span?.recordError(err);
         span?.setAttribute("tool.is_error", true);
         return { result, tool, durationMs: Date.now() - start };
@@ -7277,7 +7438,7 @@ ${post.additionalContext}` };
           content: `Tool "${use.name}" execution failed: ${scrubbed}`,
           is_error: true
         };
-        budget = this.decrementBudget(result, budget);
+        budget = this.budgetForString(result.content, budget);
         return { result, tool: this.registry.get(use.name), durationMs: 0 };
       }
     };
@@ -7326,14 +7487,20 @@ ${post.additionalContext}` };
     const output = await this.runWithTimeout(tool, use.input, ctx.signal, ctx, use.id);
     const text = this.serializer.serialize(output);
     const scrubbed = this.opts.secretScrubber.scrub(text);
-    const { text: capped } = this.serializer.enforceCap(scrubbed, budget);
+    const { text: capped, newBudget } = this.serializer.enforceCap(scrubbed, budget);
     this.opts.renderer?.writeToolResult(tool.name, capped, false);
     return {
-      type: "tool_result",
-      tool_use_id: use.id,
-      name: tool.name,
-      content: capped,
-      is_error: false
+      block: {
+        type: "tool_result",
+        tool_use_id: use.id,
+        name: tool.name,
+        content: capped,
+        is_error: false
+      },
+      // `budget - newBudget` is the exact byte count enforceCap spent
+      // (capped at `budget` so a truncated output shows as `budget`
+      // consumed, matching the pre-fix `decrementBudget` semantics).
+      bytes: budget - newBudget
     };
   }
   async runWithTimeout(tool, input, parentSignal, ctx, toolUseId) {
@@ -7473,9 +7640,19 @@ ${excerpt}`;
       is_error: true
     };
   }
-  decrementBudget(result, budget) {
-    const contentBytes = typeof result.content === "string" ? Buffer.byteLength(result.content, "utf8") : Buffer.byteLength(JSON.stringify(result.content), "utf8");
-    return Math.max(0, budget - contentBytes);
+  /**
+   * Subtract a string-content result's UTF-8 byte length from the
+   * iteration output budget. Used for synthesized results (unknown tool,
+   * validation error, blocked, threw) where the content is a small
+   * string built in the executor. The success path no longer goes
+   * through here — `executeTool` carries the exact byte count it spent
+   * in its return value, derived from `enforceCap`'s `newBudget`.
+   *
+   * Floors the result at 0 to match the pre-fix `decrementBudget`
+   * semantics (over-budget spends don't underflow the running total).
+   */
+  budgetForString(content, budget) {
+    return Math.max(0, budget - Buffer.byteLength(content, "utf8"));
   }
   /**
    * Compute the suggestedPattern string for a tool+input pair.
@@ -15426,6 +15603,17 @@ var Director = class _Director {
    * default cap.
    */
   taskCompletedListener = null;
+  /**
+   * Unsub handles for the two `FleetBus.filter()` calls installed in the
+   * constructor for timeout-heartbeat tracking. Without capturing these
+   * and calling them in `shutdown()`, repeated Director construction
+   * (tests, hot reloads, `--director` restarts) accumulates 2 dangling
+   * listeners per Director on the FleetBus, slowly drifting the
+   * EventEmitter past its default cap. Mirrors the rationale on
+   * `taskCompletedListener` above.
+   */
+  toolExecFilter = null;
+  budgetFilter = null;
   /** Optional LLM classifier for smart dispatch. Passed from options. */
   dispatchClassifier;
   /** Leader agent's current context pressure (full request tokens). */
@@ -15563,10 +15751,10 @@ var Director = class _Director {
     const extendCounts = /* @__PURE__ */ new Map();
     const progressBySubagent = /* @__PURE__ */ new Map();
     const lastTimeoutProgress = /* @__PURE__ */ new Map();
-    this.fleet.filter("tool.executed", (e) => {
+    this.toolExecFilter = this.fleet.filter("tool.executed", (e) => {
       progressBySubagent.set(e.subagentId, (progressBySubagent.get(e.subagentId) ?? 0) + 1);
     });
-    this.fleet.filter("budget.threshold_reached", (e) => {
+    this.budgetFilter = this.fleet.filter("budget.threshold_reached", (e) => {
       const payload = e.payload;
       if (e.subagentId.startsWith("bug-hunter-") || e.subagentId.startsWith("refactor-planner-") || e.subagentId.startsWith("critic-")) {
         return;
@@ -16097,6 +16285,14 @@ var Director = class _Director {
       this.coordinator.off("task.completed", this.taskCompletedListener);
       this.taskCompletedListener = null;
     }
+    if (this.toolExecFilter) {
+      this.toolExecFilter();
+      this.toolExecFilter = null;
+    }
+    if (this.budgetFilter) {
+      this.budgetFilter();
+      this.budgetFilter = null;
+    }
     await this.coordinator.stopAll();
     for (const b of this.subagentBridges.values()) {
       await b.stop().catch((err) => this.logShutdownError("subagent_bridge_stop", err));